December 2003 - cypherpunks-legacy

Re: MIT has released PGP 2.6
by Richard Johnson 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- What will we have to do to get MIT-PGP 2.6 via anonymous ftp from net-dist.mit.edu? Like with MIT-PGP 2.5, telnet to net-dist.mit.edu, and answer questions. This time there are 4. The first three questions help MIT protect itself from possible legal problems related to their distributing PGP - they cover their rear ends with regard to ITAR regs (questions 1 and 2) and patent infringement (question 3). First, we must assure net-dist that we're not trying to export MIT-PGP 2.6. Second, we must promise not to export MIT-PGP 2.6. Third, we must agree to the terms and conditions in the RSAREF license. Finally, we must agree that we won't use MIT-PGP 2.6 for commercial purposes. A "yes" answer to that last question is the only thing specifically required by the RSAREF license. Note well that we aren't required to obey strictures in some kind of "README" file. Remember this for when someone tries to muddy the waters with baseless obfuscatory claims about what we agreed to in some auxiliary file, and how that auxiliary file somehow overrules the license terms. :-) I find the RSAREF license quite reasonable, as I did their previous version. I have not yet seen the MIT license. I don't know about the source, because I haven't grabbed it yet. Richard - --------- Here are the details: boojum(101) % telnet net-dist.mit.edu ULTRIX V4.2A (Rev. 47) (bitsy) login: getpgp Warning: no Kerberos tickets obtained. Athena Server (DSMAXINE) Version 7.4G Mon Jul 27 10:22:03 1992 Unable to open /usr/tmp/attachtab: No such file or directory This distribution of PGP 2.6 incorporates the RSAREF(tm) Cryptographic Toolkit under license from RSA Data Security, Inc. A copy of that license is in the file /pub/PGP/rsalicen.txt available via anonymous FTP from net-dist.mit.edu (note: login as anonymous *not* getpgp). In accordance with the terms of that license, PGP 2.6 may be used for non-commercial purposes only. PGP 2.6 and RSAREF may be subject to the export control laws of the United States of America as implemented by the United States Department of State Office of Defense Trade Controls. Users who wish to obtain a copy of PGP 2.6 are require to answer the following questions: Are you a citizen or national of the United States or a person who has been lawfully admitted for permanent residence in the United States under the Immigration and Naturalization Act? <type "yes" or "no"> XXXXX Do you agree not to export PGP 2.6, or RSAREF to the extent incorporated therein, in violation of the export control laws of the United States of America as implemented by the United States Department of State Office of Defense Trade Controls? <type "yes" or "no"> XXXXX Do you agree to the terms and conditions of the RSAREF license (in /pub/PGP/rsalicen.txt)? <type "yes" or "no"> XXXXX Will you use PGP 2.6 solely for non-commercial purposes? <type "yes" or "no"> XXXXX To get PGP 2.6 use anonymous FTP to net-dist.mit.edu and look in the directory: /pub/PGP/dist/U.S.-only-XXXXX Note: Use anonymous FTP, do not attempt to login to on the "getpgp" account. Holding for 60 seconds ^C to quit sooner. telnet> quit -----BEGIN PGP SIGNATURE----- Version: 2.5 iQCVAgUBLeGyAPobez3wRbTBAQHvqwQApqr3yozjVheZxLE7VI8hrPp7eTylUWT1 qh6wtlqVjrsJWnYh+LwOzCEL+o6ZZzuXaKwnoaVZO2C6sf9666ZETSMnCRiCvIBv 0mhgbyc96DCLJVkv1O7gAOmzq3B+bNauXQndjdTr58lRZgoTd7A8FfK0m3xP7y8P 1WYXytLPomI= =ls3s -----END PGP SIGNATURE-----

2 1

Fix for pgp23a to make it 2.6 compatible
by catalyst-remailer＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I found a bug in pgp 2.3a : it's incompatible with pgp 2.6 messages made after September first. Here's the fix, in both uuencode and pgp armored format. Uudecode or pgp-extract this, and you will get a file called fixpgp.com. Go into the directory where your pgp 2.3a DOS executable is (pgp.exe) and run fixpgp. It should print "Done". That's it! 2.3a is now fully compatible with 2.6. If it prints "File error" pgp.exe is either not present or not writable. Fixpgp must be run with pgp.exe in the current directory. Do not run on anything but a virgin copy of the pgp23a for dos distribution. If you compiled it yourself, modify the source as described below. Pr0duct Cypher section 1 of uuencode 4.13 of file FIXPGP.COM begin 644 FIXPGP.COM MN`(]NCL!S2%R*(O8N`!"N0``NH?"S2%R&;1`N0$`NE,!S2%R#;0^S2&T";I.W G`<TAS2"T";I#`<TAS2!P9W`N97AE`$9I;&4@97)R;W(D1&]N920&7 `` end sum -r/size 47444/146 section (from "begin" to "end") sum -r/size 46454/84 entire input file - -----BEGIN PGP MESSAGE----- Version: 2.3a rGRiCmZpeHBncC5jb20AAAAAuAI9ujsBzSFyKIvYuABCuQAAuofCzSFyGbRAuQEA ulMBzSFyDbQ+zSG0CbpOAc0hzSC0CbpDAc0hzSBwZ3AuZXhlAEZpbGUgZXJyb3Ik RG9uZSQG =4Xbh - -----END PGP MESSAGE----- Now, wait a minute! This sounds like an evil NSA plot to compromise PGP! What, exactly, will this program do to my PGP? The short answer: it changes the byte at file offset C287 hex from a 08 hex to a 06 hex. The long answer: take a look at crypto.c and we find: /* Return nonzero if val doesn't match checkval, after printing a * warning. */ int version_error(int val, int checkval) { if (val != checkval) { fprintf (pgpout, PSTR( "\n\007Unsupported packet format - you need a newer version\ of PGP for this file.\n")); return(1); } return(0); } We need to disable this comparison. So looking at the object code: (CS at startup was 136D) 1B8B:069F 55 PUSH BP 1B8B:06A0 8BEC MOV BP,SP 1B8B:06A2 8B4606 MOV AX,[BP+06] 1B8B:06A5 3B4608 CMP AX,[BP+08] 1B8B:06A8 7424 JZ 06CE 1B8B:06AA 1E PUSH DS 1B8B:06AB B8C00F MOV AX,0FC0 1B8B:06AE 50 PUSH AX 1B8B:06AF 9A6A04412E CALL 2E41:046A There's our comparison. [bp+06] and [bp+08] are val and checkval. So if we change the [bp+08] in the cmp to [bp+06], the program compares [bp+06] to itself. This will always be true, so PGP will not notice the fact that the packet number has changed to 03 from 02. Problem solved. This is the source for fixpgp.com. I used the a86 assembler. BTW note that PGPTools does not check version numbers, so it is always compatible with 2.6. ; fixpgp.com : writes 06 hex to byte c287 of pgp2.3a ; this fixes 2.6 incompatibility org 100h mov ax,03d02 ; r/w mov dx,fname ; filename int 21h ; open file jc error ; check for error mov bx,ax ; move file handle mov ax,04200 ; file seek mov cx,0 ; msw of offset mov dx,0c287h ; magic address int 21h ; move file pointer jc error ; check for error mov ah,040h ; write file mov cx,1 ; one byte mov dx,offset magic ; byte to write int 21h ; write the byte jc error ; check for error mov ah,03eh ; close file int 21h ; do it mov ah,09h ; print msg mov dx,okmsg ; it worked int 21h ; print int 20h ; and quit error: mov ah,09h ; print msg mov dx,ermsg ; adr of msg int 21h ; print the error int 20h ; abort fname: db 'pgp.exe',0 ermsg: db 'File error$' okmsg: db 'Done$' magic: db 06h -----BEGIN PGP SIGNATURE----- Version: 2.3a lives! iQCVAgUBLeGxH8GoFIWXVYodAQGH9wQAhLGL4V/86DMTjw4qlfJd0gbQCAf+sFSC Hpf9jD1YAdUfUMRGYvp+8wNVBv9z90EHppRkU7MOT8zFJ3F0uJHvbzQgiiWp/5tO nyimv9D4lotqg/K7wmQwCEmys0sj0/zLOyyzAX/62YX8rmLKfTCo88V94QdEaNHS boBMlUSX0ys= =pVKf -----END PGP SIGNATURE-----

1 0

(Fwd) The Guardian OnLine
by whitaker＠dpair.csd.sgi.com 17 Dec '03

17 Dec '03

Forwarded from Ian Geldard, with his permission. Note that the address is "online(a)guardian.co.uk"; misspelling of guardian, below. The Guardian (still known to most Brits as "the Manchester Guardian") is a national daily broadsheet newspaper. -Russell --- Forwarded mail from igeldard(a)capital.demon.co.uk To: russw(a)netcom.com Russell, Thought you might like to know, if you don't already know, that the Guardian has started to produce a new weekly supplement called The Guardian OnLine, which is "exclusively devoted to the startling developments in computing, science and technology." The first edition (Thursday May 19) had a lot about the Internet and the recent crackdown on the Fidonet system by Italian police. Might be worth sending them items about cypherpunks etc. email: online(a)guradian.co.uk snail: OnLine, The Guardian, 119 Farringdon Road, London EC1R 3ER TTFN - Ian -- +-----------------------------------------------------+ | Ian Geldard | FidoNet 2:254/151 CIS 70734,426 | | London U.K. | Internet igeldard(a)capital.demon.co.uk | +-----------------------------------------------------+ --- End of forwarded mail from igeldard(a)capital.demon.co.uk -- Russell Earl Whitaker whitaker(a)csd.sgi.com Silicon Graphics Inc. Technical Assistance Center / Centre D'Assistance Technique / Tekunikaru Ashisutansu Sentaa Mountain View CA (415) 390-2250 ================================================================ #include <std_disclaimer.h>

1 0

Testing compatibility 2.6 v. 2.3a
by ER CRAMER 17 Dec '03

17 Dec '03

Please could someone change the date of his computer after 1 september 1994 and send a PGP-ed message to me so I can test the compatibily of 2.6 (I also implemented the patch send to this server in 2.3a so I can check that too...). My public key: -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3c mQCNAiv3vSkAAAEEAMGWtCrT8eIhK0qR0yqYepYCcRdjw+EhiIzP4XkHlwkR9iVt 4xnTGHKuuCnGJG0ftez4hEZsTpdrz8mQ0SnYy0KLQ6DUvKH9IMgl6S9yJiYAgtC2 4TN15+t/9ZJjlVMgwtRY5tPLgrZ7h6Jw/rZIj+Wwj78yjcdguYDAdPKe9hHLAAUR tCZFZWxjbyBDcmFtZXIgPGNyYW1lMDAxQGhpby50ZW0ubmhsLm5sPokAlQIFEC20 ++aAwHTynvYRywEBJ/UD+QEah9xIn/Vt3GbJYA3b6i/vXnEhG/z6qrqaJ8fubFin Ia2JMT4AceNEtz+6j7lIz/iJbj9CPIOASnSIQ/hmrERlWcsgWR7U29QnQjunZ6BE S64pONVmEA207lDwgAzUJ4+h+urYTIfz4qW/jHcs6nTfwe5qhfbDM1b6yTe301A/ iQCVAgUQK/qELegWAlGwR3dDAQEd/AQA1iny6lLuQFxVg6yvJ6xjnjSmOpHkz2Un ZTfbnXHtDBLA0CDFT8A4nfW/hLT1j7dx6yD5+lUPkMX1GTttlOMp819VyK8Wm8lv HnkFbehTTmmlY2BxBqWC7EUml39BqQEWbxqlt6M/btScsMVlQJyiluEW1cacYt68 DPpqScQWzz0= =cAIH -----END PGP PUBLIC KEY BLOCK----- ... If you outlaw Privacy, only the Outlaws will have Privacy! Eelco Cramer <crame001(a)hio.tem.nhl.nl> ------ --------------------------------------------------

1 0

Anonymous libel and Unicorn's lawsuit
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

The two basic reasons for anonymity, as I see it, are: 1. freedom of expression 2. freedom from analysis, i.e. context-based 'profiling' by companies or governments, based on your non-anonymous posts. In an ideal world one would have the freedom to express without any risk of damage, whether it be economic, material or social. Ideally, I should be able to publicly discuss my views, on anarchy or religion or sadism or whatever, without risking social censure. In an ideally tolerant society, the need for anonymity would then be reduced to (2), freedom from analysis. Unfortunately our society is far from ideal. Though Unicorn could freely post on the relatively more tolerant Net, he still faces intolerance in the 'real' world. For all we may talk about reputation systems, multiple identities and so on, the seven-digit possible loss Unicorn talks about is _real_, in a way cyberspace just isn't, yet. Suppose tmp _had_ posted through chains of remailers? The damage would have been just as real; the remedy would have been far less. Would, and should, remailer operators facing such a situation 'open up'? Uni says Julf would disable tmp though Netcom didn't, Julf understands netiquette. Maybe, but it's not that easy to disable an account through a chain of cypherpunk-style remailers. I remember when we discussed the Usenet libel case in Australia, someone (Tim?) said that anonymous posts, and libellious posts in general, should not be taken that seriously. Uni's business associates are not likely to be so familiar with net culture, and would not understand the anonymous part of it, just the slight (from their perspective) on Uni's character. Of course, Uni should have posted everything through a chain of remailers himself, if he was concerned about his views leaking out of the Net. Does that mean he'd never be able to attend cypherpunk meetings, or have truename contact with anyone, lest he be identified with his anonymously held opinions? If tmp, or anyone else for that matter, were to suspect that Uni was behind specific anon posts, he'd just make that accusation anonymously, in 100 news groups. Libel doesn't have to be proven to be damaging. What I find amusing is that Detweiler was the one who started going nuts while making paranoid warnings about the dangers of anonymity, such as in libel. He seems bent on proving his predictions correct, as many of the recent examples of identity abuse (tm) were instigated by him. (Of course, by this I'm not saying that Detweiler's views are reflected in tmp's posts... ;-) -------------------------------------------------------------------------- Rishab Aiyer Ghosh rishab(a)dxm.ernet.in Voicemail +91 11 3760335; Vox/Fax/Data 6853410 H-34C Saket New Delhi 110017 INDIA The National Short-Sleeved Shirt Association says: Support your right to bare arms! --------------------------------------------------------------------------

1 0

Pocket Data Encryptor
by Jim choate 17 Dec '03

17 Dec '03

LAN Computing May 94 V5#5 pp.41 Cylink has released a pocket sized DES encryptor that is designed to fit between a modem and a serial port. Cylink 310 N. Mary Av. Sunnyvale, CA 94086 408-735-6643 Check them out...

2 1

PGP 2.6
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

Here is an exchange I had with the folks at MIT who did PGP2.6. I've suggested that they delay their anti-patent-infringement gadgetry until PGP2.6 is more widely available for _all_ platforms. >> I use a Macintosh. Is there a Mac PGP 2.6? > >Me too. Hopefully we will have a MacPGP 2.6 shortly (I am not sure whether >we will do the port at MIT, or whether the traditional MacPGP development >team will do it, probably the later). > > -Jeff Perhaps you should delay the expiration of old, pre-RSAREF PGP keys until after a Mac version is available. That would avoid cutting off a large part of the populace.

1 0

Response to Uni's "Lawsuit" Message
by jazz＠hal.com 17 Dec '03

17 Dec '03

Quoting from Curtis Frye's response: What exactly is Netcom's liability in this case? If a service provider is treated as a phone company, abuse of the service could be grounds for discontinuing the service. As Netcom did not discontinue tmp's service (see below), perhaps there is room for suit there. By your phrase "treated as a phone company", are you implying Common Carrier status? If so, I wonder under what grounds a common carrier is allowed to terminate service? Certainly, non-payment of bills is one. If person A alleges person B has made threatening phone calls, can the phone company terminate person B's service unilaterally based solely on the allegations? Must it wait until civil suits or criminal charges are brought? My understanding of common carriage was that the carrier was obligated to provide service to everyone within its service area, whether or not it liked their politics, or bedmates, or the content of their communications. What protection should Netcom, and other access providers, have against the abuses of their subscribers? Damn if I know, but it's an important question to stay awake at night worrying about... What was in the contract signed by the subscribers? You can bet that if I ever start an on-line service, there will be an "indemnify and hold harmless" clause, and provisions for demanding proof of umbrella liability coverage; lack of coverage upon demand would be grounds for termination. In other words, if tmp@netcom were a subscriber to my service, and someone alleged wrongdoing to this degree, my action would be to demand of tmp proof of umbrella liability coverage of $1,000,000; without such proof, account revoked. The only way to put teeth in an indemnify-and-hold-harmless clause for an individual, I guess. Very much in line with your earlier thoughts on the potential (non-) application of traditional libel/slander law to the Net -- would the Courts allow cyberspace to be that much more rough-and-tumble, with higher standards of abuse required for successful suits? They'll have to, with the current state of the art with respect to authentication and non-repudiation. A plaintiff will have to work pretty hard to prove a particular human generated a piece of email, given the ease of spoofing, remailers, anonymity and pseudonymity. I also thank Uni for posting. Jason Zions

1 0

Canadian site
by dave.hodgins＠canrem.com 17 Dec '03

17 Dec '03

For any other Canrem.com members reading this, I've uploaded a file called PGP26INF.ZIP, that contains a copy of all files that can be downloaded from net-dist.mit.edu, without recognition as a Canadian, or U.S. Site. Regards, Dave Hodgins. ********** Original From: DAVE HODGINS * CARBON * To: MIT POSTMASTER * COPY * Date/Number: 05/24/94 - Not Yet Posted ********** On: CRS - 0104 - Internet_Mail ----------------------------------------------------------------------- As per my message, to you, on 05/15, PLEASE add canrem.com to your list of Canadian sites, that should be allowed access, to the PGP 2.6 files! I just tried to download the files, and was again, denied access to the directory. Please send me an email message confirming completion of the above, so I don't have to waste telenet time (which I pay for), looking up a directory name, that I cannot access! Regards, Dave Hodgins, (416) 538-6516 2350 Dundas Street West, Apt. 2505, Toronto, Ontario, Canada M6P 4B1 -----BEGIN PGP SIGNED MESSAGE----- 230-If you are FTP'ing in to get PGP, and your DNS name of your host isn't 230-one that is "obviously" from the U.S., you may get a permission denied 230-message when you try to cd into /pub/PGP. If this happens to you, and 230-your host is located in the United States or Canada, send mail to 230-postmaster(a)bitsy.mit.edu to be added to a special exception list. The site I'm using is being denied access. Please add canrem.com (CRS Online, formerly Canada Remote Systems) to your special exception list. The IP address is 198.133.43.nn, where nn is any number from 1 to around 200. Could you email me when this has been completed? Thanks, Dave Hodgins, Toronto, Ontario, Canada. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLdZptKsStlBrWUZ9AQEtXgQAlRYyMbQ+e1zc8Igr4xL6o7BzmR7wr2Mj HJL4qAYjwIErG/QuAay8c+rDsiHulaM5aoXRifWa7NI46qfD33mQ5be89gjCzB/D CpUoH81Vfb+bqi9PiJDqZsBhoPgRJ8cot47P3EYxM/9ZgrtUKlWJZlLLV2XPlqQ4 9qihKaa3adI= =9hvn -----END PGP SIGNATURE----- cc: ALL in 8 on CRS cc: CYPHERPUNKS(a)TOAD.COM in 0104 on CRS --- * RM 1.3 00820 * Internet:Dave.Hodgins@Canrem.com Rime->118 Fido(1:229/15)

1 0

Looking for a paper...
by Jim McCoy 17 Dec '03

17 Dec '03

I am trying to hunt up a copy of: The Dining Cryptographers in the Disco: Unconditional Sender and Recipient Untracability with Computationally Secure Serviceability by Michael Waidner and Birgit Pfitzmann So far the only ref I have found is the abstract in Eurocrypt '89, but I can't seem to locate a copy of the entire paper. If anyone knows of where I might find a copy I would appreciate it... jim

1 0