December 2003 - cypherpunks-legacy

PGP is Product of the Week
by Claborne, Chris at SanDiegoCA 17 Dec '03

17 Dec '03

PGP is Product of the Week in last weeks PCMag. I will bang my drum one more time... How to beat the three letter agencies: 1. Power of the press is just one of the weapons at our disposal. Public education and continued press on privacy alternatives is important. One of the things that would help a concerted offensive against the three letter agencies that want to remove our privacy would be to send more articles to the industry rags. Hopefully better than the one published in Byte. The more exposure the better. You there! Start writing! 2. Improve the ease-of-use factor for PGP... That is, write more front ends (windowing since most of the general public uses it). Example: ViaCryptPGP for Compuserve's WINCIM and navigator. I believe in the critical mass theory... "A product becomes a defacto standard not that it is always the best product but because of sheer number of users". In this case I am pushing PGP but I think it would go for crypto products in general. 3. Drive for an independent "renegade" standard like PGP. The term renegade here meaning "having rejected tradition". Flood the net with it and the genie is truly out of the bottle. Now that PGP is "legal" in the US, and people outside the U.S. have the product spec no-one gets left out in the cold. 4. Mentioned earlier... "Attack the NSA budget". This can be a win and a loose since a smaller budget could lower our countries defenses. It is possible that an attack on the budget would get them to lay off without any real action needing to be taken. ... __o .. -\<, chris.claborne(a)sandiegoca.ncr.com ...(*)/(*). CI$: 76340.2422 PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server.

3 2

RE: Unofficial release
by nobody＠ds1.wu-wien.ac.at 17 Dec '03

17 Dec '03

++++++++++++++++++++++++++++++++++++ > Rumor has it that certain government applications do Diffie Hellman > with 2K-bit moduli. Given the apparent connections between factoring > and discrete logarithm (the complexity formulas seem to look very much > alike), it appears that at least one user feels that keys longer than > 1K bits provide a desirable safety margin. I'm still not sure that I understand the original argument against using keys that are "too long" by someone's standards. Nor am I sure the analogy holds up. It would be the security equivalent of saying that it's "paranoid" to put strong locks on your front door because your windows are made of glass, and are thus easier to break than the door. The fact is, most burglars would rather not break a window, if possible, because it's a glaring sign of forced entry visible even while they're in the process of burgling, it's noisy, and they could get cut, leaving blood samples behind and causing themselves pain. Sure, hypothetically, it might be "easier", in a given case, to monitor RF (Tempest) leakage vs. breaking a 1K+ key. OTOH, it would also require putting monitoring equipment at every Internet user's site vs. collecting and cracking keys at a centralized location. Of course, if someone wants to leave his front door unlocked for fear of being labelled "paranoid", that's his prerogative, I suppose. Just don't ridicule others who are more security conscious! +++++++++++++++++++++

2 1

RE: WARNING!
by nobody＠ds1.wu-wien.ac.at 17 Dec '03

17 Dec '03

+++++++++++++++++++++++++++++++++ dcosenza(a)netcom.com wrote: > I spoke with Phil Zimmermann today at some length, and he has informed me > that users who decide to use the jumo keys generated by the hack of 2.6ui > will be running a risk of incompatibility on down the line with future > releases he has planned. You have been warned! > > Ever forward, Doesn't part of "ever forward" sometimes involve something "non-standard" and "running the risk of incompatibility"? Unless there's something flawed with the implementation of longer keys, why shouldn't the first to implement them become the de-facto standard? If a leter release turns out to be incompatible with an older one, but it's cryptographically superior, then it's time to switch, even if it means generating and distributing new keys. Anyone concerned enough about security to want the "latest and greatest" crypto package, with longer/stronger keys or whatever, should already be practicing good key management and generating new keys periodically, anyway. My only concern would be whether the implementation of longer keys might possibly "push the envelope" of the math routines used, and thus introduce subtle, hidden weaknesses. Two examples might be an RNG that became non-random with larger numbers, or a primality tester that failed to detect larger non-primes. If you have evidence for any of those scenarios, I'd love to hear it. Personally, I'm staying with PGP 2.3a until the dust settles a bit. I've FTPed the RSAREF 2.6 release, and it remains in its zipped archive for now. Just as an aside, can some of the PGP-aware-anon-remailer operators comment on what they plan to do with respect to the various PGP versions? ++++++++++++++++++++++

4 3

Re: PGP is Product of the
by Duncan Frissell 17 Dec '03

17 Dec '03

To: cypherpunks(a)toad.com J >A person in the group to which I refer is ``in the US'' by the J >commonly understood geographical definition of that phrase, but has as J >a matter of conscience renounced any citizenship he may have had. He J >refuses on principle to affirm that he is a national person, and J >therefore cannot use PGP 2.6 because such affirmation is supposed to be J >required in order to obtain PGP 2.6, and may therefore be implicit in J >each use of PGP 2.6. On the other hand, if he uses PGP 2.6ui, he risks J >being accused of violating RSADSI's patent rights, because they will J >take him to be "in the US", even though he has disaffiliated himself. J >What version of PGP can such a person use? Even though your friend is no longer a U.S. Citizen he is a "legal resident of the U.S." in that he could not be deported. Residence is defined at law as equal to "domicile" and is under the legal control of the individual rather than the State. "Domicile" is defined as "Actual physical presence plus intent to make the place one's home." Once domicile is gained, it persists even if you are away until one acquires a new domicile by one's own action. So he could use the MIT version of PGP. When their lawyers came up with their spastic language about users having to be U.S. Citizens or Green Card holders they weren't trying to be exhaustive. They were clearly trying to mirror the ITAR crypto regs. Since your friend, while not a citizen, is not an alien he can possess crypto technology under ITAR and thus under the MIT license. DCF "If Nicole had had a Colt Mk IV Govt. Model, she'd be alive today." --- WinQwk 2.0b#1165

1 0

Re: RE: WARNING!
by usura＠vox.hacktic.nl 17 Dec '03

17 Dec '03

nobody(a)ds1.wu-wien.ac.at writes: >Just as an aside, can some of the PGP-aware-anon-remailer operators comment >on what they plan to do with respect to the various PGP versions? The remailers at vox.hacktic.nl are running PGP 2.6 ui. Regz, -- Exit! Stage Left. Alex de Joode <usura(a)vox.hacktic.nl>

1 0

Re: Cellular Telephone Experimenter's Kit (2600 article)
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

>>This CTEK sounds like a fun toy and I guess I'm glad that it can't be >>used for cellular phone fraud. That would be an illegitimate use. But, >>monitoring cell phone traffic is a crime now, right? Is there a legitimate >>use for the device? Can anyone think of one? > >Several companies make cellular test sets (or optional modules for >more general purpose RF test sets) that perform functions very much >like those of the CTEK package. Since we manufacture cell phones, we >have a perfectly legitimate reason to have a few of those test sets >around here. And I know of no special licensing requirements to buy >them (other than having $20,000 or so in cash). Sure, I know that Qualcomm could easily justify having the toys around the place. But what would I say to the cops/FCC when they came knocking? I was just waiting to get the capital together to set up a phone manufacturing program? Is there any legitimate use for someone not in the business? The best I can come up with is: a wife who wants to track her husbands progress home so she knows when to throw the steaks on the grill. ("He always arrives 12 minutes after the he moves into our cell.") > >Phil

1 0

Re: PGP is the product of the week!
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

>> 4. Mentioned earlier... "Attack the NSA budget". This can be a win and a >> loose since a smaller budget could lower our countries defenses. It is >> possible that an attack on the budget would get them to lay off without any >> real action needing to be taken. > This isn't truly an issue. The NSA had it's hey-day during the Cold >War. Now that that's over, and the same level of effort can be attuned to >fewer enemies, one would think that they don't NEED a bigger budget. "Fewer" enemies? Yugoslavia is now split into at least 5 pieces. Before we only needed to monitor the line from Moscow to Tito. All the orders came down this line and Yugoslavia did what they were told, more or less. No one in the US had to seriously wonder about the differences between Bosnia, Serbia, Croatia etc... We didn't need to monitor the different governments in the different regions. The ex-SU is now split into too many pieces for me to count. Some of them have nuclear weapons that they don't want to turn over. Others have military ships. Before, it was enought to have a good presence in Moscow. Now you need to be in Kiev, Lvov, Talinn, etc... North Korea, the Mid East and Cuba are the only places that still need the same amount of attention that they needed during the Cold War. This is because they're already maxed out. > > --Jeff >-- >====== ====== +----------------jgostin(a)eternal.pha.pa.us----------------+ > == == | The new, improved, environmentally safe, bigger, better,| > == == -= | faster, hypo-allergenic, AND politically correct .sig. | >==== ====== | Now with a new fresh lemon scent! | >PGP Key Available +---------------------------------------------------------+

1 0

(None)
by Jeff Gostin 17 Dec '03

17 Dec '03

pcw(a)access.digex.net (Peter Wayner) writes: > "Fewer" enemies? I am of the opinion that most of the Post SU countries will amount to no serious threat. Remember, most of our problem was with Moscow. Most of the SU didn't especially care about us -- they were more concerned with eating dinner that night. As a result, yes, there are a few emerging hot spots, but they aren't _our_ enemies. The Bosnia deal is a local political problem. It is _not_ a threat to US security, much as Clinton would like us to think it is... ;-) > Croatia etc... We didn't need to monitor the different governments in the > different regions. True, but, most of that died. Yugoslavia, for example, is hardly a threat to us. Our problems in the past were mostly with Moscow. Most of the rest of the SU was not an issue. So yes, we have more governments to watch, but fewer enemies. > The ex-SU is now split into too many pieces for me to count. Some of them > have nuclear weapons that they don't want to turn over. Others have military > ships. Yes, they have Nukes. If I did, in their shoes, you're damn right I wouldn't want to give them up! Yes, they bear watching. Hell, even Israel, our military ally, bears watching. That doesn't mean they require the same level of surveillance. > North Korea, the Mid East and Cuba are the only places that still need the > same amount of attention that they needed during the Cold War. This is > because they're already maxed out. NK is a hot spot at the moment. Even if the C/W was still in effect and the SU still in force, NK would probably still be a problem now. The Middle Eastern area still requires a mind-boggling amount of watching. That situation is just too volatile not to watch it. However, I find it hard to buy into the fact that we're going to give 100% to Middle East, and the same 100% to Russia, who not only still can't feed it's people, but has SERIOUS financial problems. --Jeff -- ====== ====== +----------------jgostin(a)eternal.pha.pa.us----------------+ == == | The new, improved, environmentally safe, bigger, better,| == == -= | faster, hypo-allergenic, AND politically correct .sig. | ==== ====== | Now with a new fresh lemon scent! | PGP Key Available +---------------------------------------------------------+ -- ====== ====== +----------------jgostin(a)eternal.pha.pa.us----------------+ == == | The new, improved, environmentally safe, bigger, better,| == == -= | faster, hypo-allergenic, AND politically correct .sig. | ==== ====== | Now with a new fresh lemon scent! | PGP Key Available +---------------------------------------------------------+

1 0

remail@c2.org supports X-Anon-To and Request-Remailing-To
by sameer 17 Dec '03

17 Dec '03

I forgot when I moved the code over from remailer@soda over here to accept X-Anon-To: and Request-Remailing-To: I prefer Anon-Send-To: because it differentiates between Send and Post, such as with Anon-Post-To: Well here's a list of the commands remail(a)c2.org supports: Subject "remailer-info" pipe A instructions.pl X-Ping "--PING--" pipe A pinger.pl # anon block response header Response-Key "" pipe A reply.pl # remailing headers - non-anon Send-To "" pipe A send.pl # remailing headers - anon Anon-To "" pipe A anon-send.pl Request-Remailing-To "" pipe A anon-send.pl X-Anon-To "" pipe A anon-send.pl Anon-Send-To "" pipe A anon-send.pl # posting headers - not anon Post-To "" pipe A post.pl # posting headers - anon Anon-Post-To "" pipe A anon-post.pl Resp-To "" pipe A resp-send.pl Resp-Send-To "" pipe A resp-send.pl Resp-Post-To "" pipe A resp-post.pl Encrypted PGP pipe A pgpmail.pl # * "" pipe ? recurse.pl -- sameer Voice: 510-841-2014 Network Administrator Pager: 510-321-1014 Community ConneXion: The NEXUS-Berkeley Dialin: 510-841-0909 http://www.c2.org (or login as "guest") sameer(a)c2.org

1 0

Differences in key generation
by Matt Thomlinson 17 Dec '03

17 Dec '03

I've recently been asked if there are any differences in key generation techniques between US and non-US encryption programs. For that matter, are there any *basic* differences between foreign and domestic encryption algorithms? (IDEA, LUC, etc..?) I know the question is worded poorly; I'm wondering if there *is* a difference (I haven't ever assumed there was). This is very important and I need a response by midafternoon. :l matt (formerly phantom(a)u.washington.edu)

1 0