December 2003 - cypherpunks-legacy

key signing
by Tom Allard 17 Dec '03

17 Dec '03

Hmmm... I requested my key from the MIT key-server and it came back with two unknown signatures. So I requested those two keys, only to find that they were Bill Clinton and Al Gore. I've never met either of them (although I have seen Al Gore jogging through Rock Creek Park). Those keys had signatures also, so I got the signator's key as well, only to find that it was "Hillary's" key. Type bits/keyID Date User ID pub 384/23BDC6F9 1980/01/01 William J. Clinton <president(a)whitehouse.gov> sig CC3D9213 (Unknown signator, can't be checked) sig DE09D78D (Unknown signator, can't be checked) Type bits/keyID Date User ID pub 384/DE09D78D 1980/01/01 Albert Gore <vice-president(a)whitehouse.gov> sig CC3D9213 (Unknown signator, can't be checked) sig DE09D78D Albert Gore <vice-president(a)whitehouse.gov> sig 23BDC6F9 (Unknown signator, can't be checked) Type bits/keyID Date User ID pub 1024/CC3D9213 1993/12/25 Hillary Rodham Clinton <bimbo(a)whitehouse.gov> sig CC3D9213 Hillary Rodham Clinton <bimbo(a)whitehouse.gov> rgds-- TA (tallard(a)frb.gov) +-+ I don't speak for the Federal Reserve Board, it doesn't speak for me. |X| pgp fingerprint: 10 49 F5 24 F1 D9 A7 D6 DE 14 25 C8 C0 E2 57 9D +-+

1 0

e$: Multi-Industry Coalition Framework - NII (fwd)
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Thought you folks would want to see this... >PRESS RELEASE > >FOR IMMEDIATE REALEASE CONTACT: Charles N. Brownstein >September 12, 1994 703-620-8990 > >MULTI-INDUSTRY COALITION SETS TECHNICAL FRAMEWORK >FOR THE NATIONAL INFORMATION INFRASTRUCTURE > > > >Washington, D.C. -- Today, more than forty leading communications, >computing, and services companies proposed a consensus vision of the >architecture required for tomorrow's information superhighway. In addition, >the Cross-Industry Working Team (XIWT) members detailed an example of a key >component of the National Information Infrastructure (NII) - digital cash. > >The two white papers, 1) An Architectural Framework for the NII and 2) >Digital Cash, Tokens and Payments in the NII, will be presented to the >President's NII Advisory Committee tomorrow at its meeting in New York. > >"These papers provide a technical vision and goals for the NII that cut >across a range of industries," said Robert Kahn, President of CNRI and >chair of the XIWT Executive Committee. "They provide a common foundation >for thinking about the objectives and technical requirements of the NII." > >In its Architecture paper, XIWT calls for an NII that promotes >interoperability and provides universal access, privacy, protection, >intellectual property, security, job creation and commerce in a competitive >business environment. Based on these objectives, XIWT defines the NII in >terms of a Functional Services Framework -- a model used to characterize >the NII by function and certain key characteristics. > >According to this model, the NII has three basic components: applications, >enabling services, and physical infrastructure. Together, these components >include all the NII's information and transporting machinery, the networked >software tools that facilitate manipulation and movement of digital >information, and the information processing activities of NII users. > >To meet the goals outlined for the NII, XIWT recommends that each of these >components be addressed in terms of functionality (what it does), trust >(the conditions under which it operates), and control (how it is managed). > >XIWT also provides a Reference Architecture Model for the NII -- a >description of the system in terms of the interconnection of the functional >elements of the system and the interfaces between them. XIWT identifies >four functional elements: 1) appliances: 2) networks; 3) resources; and 4) >control points. In addition, it identifies seven categories of interfaces >and protocols needed to integrate these elements and make them >interoperable. > >The Digital Cash report defines ways in which the NII will facilitate >existing and new forms of commerce. "It describes the functional >requirements and technical options for conducting everyday financial >transactions in networked electronic settings with the ease and certainty >of today's cash economy -- and with more security and control," said Dan >Schutzer of Citibank who chairs the XIWT Applications Services Working >Team. > >"The flexibility and choice implicit in the architecture we have described >will be a boon to the users of the NII and provide a challenging but >fertile business environment for savvy companies in many different >industries," said Niel Ransom of BellSouth, who chairs the XIWT >Architecture Working Team. "The members of XIWT are committed to making it >happen." > >The XIWT papers quickly received praise from the White House. "By bringing >together the views and technical recommendations of such a diverse group of >U.S. companies, the XIWT has made significant progress in moving the work >on the NII another important step forward." said Vice President Al Gore. >"We commend the work they have done so far and urge them to continue >working to define the technical aspects of the NII." > >The Cross-Industry Working Team (XIWT) was formed in 1993 to develop a >technical vision for the NII, XIWT members include over forty companies >from a range of U.S. industries. Membership list attached. > >### >PLEASE NOTE: Copies of XIWT's white papers are available in hard copy or >on-line. Please call Charles N. Brownstein at 703-620-8990, or access via >Internet from the XIWT Home Page at ><http://www.cnri.reston.va.us:3000/XIWT/public.html> > >Charles N. Brownstein >Executive Director >Cross-Industry Working Team >Corporation for National Research Initiatives >1895 Preston White Drive >Suite 100 >Reston, VA 22091 > >Tel: (703) 620-8990 >Fax: (703) 620-0913 > >Internet: cbrownst(a)cnri.reston.va.us > > > > > > ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

2 1

Re: thoughts on RC4
by m5＠vail.tivoli.com 17 Dec '03

17 Dec '03

Carl Ellison writes: > >Can anyone see any reason why one could not change RC4 to > >being a word oriented stream cipher, call it "ERC4"? > > (1) You could conceivably go to an array of 65K short values and retain the > permutation but I wouldn't try to go to an array of longs. I don't have > 32GB of RAM on my workstation. Perhaps some improvement on RISC architectures could be achieved by using four arrays, 32 bits wide by 256 entries long. The arrays would mirror the single array in the original code, except that the "interesting" byte would be at a different position in each. Then, the main encryption loop could be unwound so that you'd do four operations to each word, one from each array to hit the four bytes. (You'd do the increment/swap between each one.) This *might* be worthwhile. (On an Alpha, you'd have 8 arrays...) | GOOD TIME FOR MOVIE - GOING ||| Mike McNally <m5(a)tivoli.com> | | TAKE TWA TO CAIRO. ||| Tivoli Systems, Austin, TX: | | (actual fortune cookie) ||| "Like A Little Bit of Semi-Heaven" |

1 0

Re: (fwd) A new PGP
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

> > This posting is a call for participation in a complete rehash of PGP to > > parallel the existing PGP effort in the US. All contributions are welcome, > > although any cryptographic material from the US won't be usable by anyone else, > > so it'd be best if all crypto work was done outside the US. I am working on a crypto package. It will be able to read and write Selane, PEM and PGP messages and to handle (and convert where possible) all keys. I am writing in C++. And I am sitting in Germany. ;-) Who is interested in discussing the design of such a program? BTW: Who defines new tags in the PGP format? Phil Zimmermann? Hadmut Danisch E.I.S.S. (European Institute for System Security, University of Karlsruhe)

1 0

Re: [CyberCash Media hype]
by jamiel＠sybase.com 17 Dec '03

17 Dec '03

Uh, I was paraphrasing the conclusions of the article in order to convey that the authors clearly have no clue about security software. I (incorrectly) thought there was sufficient sarcasm in my post to convey that. Question - where did the below-highlighted opinion come from? Also, I do disagree with your statement "security through obscurity is no security at all." A rather high degree of security can be had through obscurity, but it is often entirely unpredictable whether or not a particlar 'obscurity method' will be secure or not (any 15 year old hiding cigarettes under the bed can attest to that). I see this as an extension of the pricipals underlying modern crypto - it could be that a factoring attack on RSA is possible but really obscure. It is simply an example of more predictable security through obscurity. Perhaps I'm pushing definitions a little too far here. At 2:45 PM 9/15/94, Chael Hall wrote: >> >>These are my favorite paragraphs. >> >>1) Proprietary == secure >> >>2) Understanding how it works == insecure > > I disagree. Proprietary is MORE secure, but security through ^^^^^^^^^^^^^^^^^^^^^^^^^^ >obscurity is no security at all. The only thing that does is separate >the proverbial men from the boys. It keeps the idiots who think they >can crack a system from touching it, but the people who know what they >are doing will learn it rather quickly. > > Understanding how it works is also not necessarily insecure either. >What about PGP? Would you rather use some proprietary methond that may >or may not have a backdoor or may not be as secure as it is touted to >be? I prefer to use something that has been proven and tested. > >Chael -j -- "It's a question of semantics, and I've always been rather anti- semantic." -Gene Simmons ___________________________________________________________________ Jamie Lawrence <foodie(a)netcom.com> <jamiel(a)sybase.com>

5 5

Re: PRIVACY REGULATIONS (A Matter of Form)
by Blanc Weber 17 Dec '03

17 Dec '03

From: Duncan Frissell >> Can't you free yourself from jail with a writ of habeas corpus ad >> subjiciendum from John Doe? > >But you have to know how to write one. > >brad > But if you proceed "in forma pauperis" you don't need to know how to write one. ............................................................................. Must a person carry around a legal dictionary in order to have all the right terms to use just in case they are put in jail and to need to select the proper procedure? (What shall it be: habeas corpus? subjuciendum? forma pauperis? I'm so confused.) "Don't leave home without it." Blanc

1 0

Wiretap Emergency
by Nathan Zook 17 Dec '03

17 Dec '03

I just spoke with Joe Barton (R) from Texas about the FBI wiretap bill. He is on a subcommittee that is hearing the bill. He has heard _no_ citizen opposition to it. I was not prepared, but he did invite me to send him my concerns :-D Congressman Joe Barton 1514 Longworth Building Washington, D.C. 20515 p:202-225-2002 f:202-225-3052 Folks, if we can generate a few hundred calls and well-thought-out faxes tommorrow, we might have some effect. I don't know a lot about him, but he seemed to be of the opinion that he didn't really know that much about the bill. It's up to us to educate him. Nathan

1 0

Re: PRIVACY REGULATIONS (A Matter of Form)
by merriman＠metronet.com 17 Dec '03

17 Dec '03

>From: Duncan Frissell > > >> Can't you free yourself from jail with a writ of habeas corpus ad > >> subjiciendum from John Doe? > > > >But you have to know how to write one. > > > >brad > > > >But if you proceed "in forma pauperis" you don't need to know how to write one. >............................................................................. > >Must a person carry around a legal dictionary in order to have all the >right terms to use just in case they are put in jail and to need to >select the proper procedure? > >(What shall it be: habeas corpus? "produce (release?) the body" subjuciendum? "Show why" (????) forma pauperis? "that's not my regular job" (????) Now you know _part_ of the reason lawyers get away with charging a bazillion dollars an hour. That's okay, though, 'cause most lawyers probably think a hash is either fried potatoes or involves corned (or roast) beef :-) It's a matter of the lingua franca of the profession. :-> Dave Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)metronet.com for PGP/RIPEM public keys and fingerprints. Unencrypted Email may be ignored without notice to sender. PGP preferred. Remember: It is not enough to _obey_ Big Brother; you must also learn to *love* Big Brother.

1 0

Re: Wiretap Emergency
by Rick H. Wesson 17 Dec '03

17 Dec '03

I believe you can write your congress person via E-Mail to FirstName.LastName(a)house.gov I was told it was up and running but I may be incorrect... -Rick

1 0

pgp 2.6.1 circumventing legal kludge
by 0x7CF5048D＠nowhere 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have examined the source to the latest modification to pgp2.6 pgp2.6.1. It appears that the +legal_kludge command parameter remains as also does the bug that prevents this code from working! (Value is used instead of Flag.) One would have thought that the bug would have been fixed or the legal kludge code would have been removed in pgp2.61. The existence of this bug was widely publicized. Perhaps the authors wish there to continue to be a way to circumvent the kludge, but can not be seen taking explicit action to fix the bug. The bottom line is that to encrypt a message to be sent to someone with an earlier version of pgp such as pgp 2.3a, one should disable the legal kludge by using the following command line: pgp +cert_depth=0 +legal_kludge=off +cert_depth=4 -eat file them My program in noklg.zip is a way to use the above feature to cause pgp to be compatible with earlier versions of pgp without the extra typing. (It supports MSDOS and OS/2). You can set up the program so that pgp shells and other programs work as originally designed, but encrypting files compatible with earlier versions of pgp. I wish that someone would store this program in at a public ftp site. -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLninbg2Gnhl89QSNAQEB7QP+L2iA+ha2KCfH31O2OoG6syIWWNc7f76e rx5lQ3HpufkVIqhvw+Ff1FWR5aWIPZ2ZKfYAAHjpDiTRMJIMOs2dalx30Hjn/Jyw X6cEIGzywRpRx8oX+kX5BhxM93IblP1mHAe1e17jiwgBXfbX1yj4/loxL8aHv/cB LYB0F2go2C0= =qN3q -----END PGP SIGNATURE-----

1 0