December 2003 - cypherpunks-legacy

PGP 2.5 info...
by lile＠netcom.com 17 Dec '03

17 Dec '03

I got this from the WWW. -lile Date: Fri, 13 May 1994 15:09:37 +0800 X-Url: http://web.mit.edu/network/pgp.html MIT PGP Release Beta Test Release of PGP version 2.5 May 9, 1994 The Massachusetts Institute of Technology announces the distribution of PGP version 2.5, incorporating the RSAREF 2.0 cryptographic toolkit under license from RSA Data Security, Inc., dated March 16, 1994. In accordance with the terms and limitations of the RSAREF 2.0 license of March 16, 1994, this version of PGP may be used for non-commercial purposes only. PGP 2.5 strictly conforms to the conditions of the RSAREF 2.0 license of March 16, 1994. As permitted under its RSAREF license, MIT's distribution of PGP 2.5 includes an accompanying distribution of the March 16, 1994 release of RSAREF 2.0. Users of PGP 2.5 are directed to consult the RSAREF 2.0 license included with the distribution to understand their obligations under that license. This distribution of PGP 2.5, available in source code form, is available only to users within the United States of America. Use of PGP 2.5 (and the included RSAREF 2.0) may be subject to export control. Questions concerning possible export restrictions on PGP 2.5 (and RSAREF 2.0) should be directed to the U.S. State Department's Office of Defense Trade Controls. Users in the United States of America can obtain information via FTP from net-dist.mit.edu in the directory /pub/PGP. *** Beta Release Note -- May 7, 1994 *** Today's release of PGP 2.5 is a beta test release, designed to permit users to familiarize themselves with the program and to give us feedback before we make the final release. This version of PGP2.5 has been tested on the following platforms: MSDOS, Sun381i, Solaris 2.X, Ultrix 4.X, Linux, RS6000, HP/UX Over the next few days, we will be testing PGP2.5 on a variety of other systems and collecting bug reports from this release. Please send bug reports to pgp-bugs(a)mit.edu. If you obtain a copy of this beta release code, please keep checking http://web.mit.edu for the announcement of the final release, so that you can update your copy of PGP2.5. We expect the final release to occur within a week. *** To Get PGP2.5: The directory where PGP2.5 is located is hidden. To get it you need to telnet to "net-dist.mit.edu" and login as getpgp. You will be asked to confirm that you will abide by the terms and conditions of the 3/16/94 RSAREF 2.0 license. The license is in the file "license.txt" in /pub/PGP on net-dist.mit.edu you can see it now by clicking here.

1 0

Re: Message Havens (fwd)
by Karl Lui Barrus 17 Dec '03

17 Dec '03

[Douglas asked me to forward this to the list] > I disagree. The only resource that will be hit is the message haven > (unlike say every computer in the world that carries the certain > usenet group you have chosen to use as a communications vehicle). > Geez, think of like a place that offers anonymous ftp. It's resources > are hit, but I don't buy the "massive load on net.resources". You think so? Hm. I'm just pulling numbers out of the air here, but... Let's say the cypherpunk dream is realized, and everyone on the net uses anonymous mail through a message haven. I believe there are 20 000 000 InterNet users right now. Lets say each person sends one piece of mail every day, and also checks the message haven each day. Each day there are twenty million new messages on the message haven. These are downloaded by twenty million people each day. That's 400 trillion messages that the message haven must send each day. Let's say the average size of a message is 1Kb. This gives a total of 3 Petabits a day. At 86400 seconds in a day, this requires a bandwidth of 30 Terabits/second. This is, of course, far beyond practicality. I'm allso being a little silly here, assuming there is only one message haven for the world. With distributed havens the load on each haven decreases. However, the load on each recieving terminal is the same. Each terminal must process 20 Gigabytes of mail to look for messages to the user. Maybe that'll be practical in a few years, but then again in a few years there will be more internet users. > This scheme is precisely what I described earlier! The two users > agree on what to name/tag the file, and that's how they get messages > to each other. The problem is Bob can't just retreive that one file > (if he is concerned about traffic analysis), so he can get them all so > a watcher learns nothing. You have suggested downloading a smaller > portion of the available message base instead of the whole thing. I'm sorry, I must not have read your post carefully enough. I understood there to be no tag outside the encryption wrapper. I thought you were implying attempting decryption of every post on the haven until one worked. My appologies.

1 0

Re: Message Havens
by Karl Lui Barrus 17 Dec '03

17 Dec '03

> Let's say the cypherpunk dream is realized, and everyone on the net > uses anonymous mail through a message haven. I believe there are Well, if the cypherpunks "dream" is realized then there won't be a need for message havens since anonymous mail will be accepted net-wide. People wouldn't go after anonymous remailer operators because somebody harrassed another person. But back to the problem at hand... Your analysis is interesting, but so far fetched I'm not going to worry about it. I mean, yes, if the 5 billion people of earth decide to do this, or decide to call each other, or decide to send each other snail mail, everything will collapse. Considering this as a worst case, in my opinion, is a waste for right now, and will deter useful work before it even starts. Planning for this is about as useful as worrying about all 20 million net users will access the same Mosaic page, the same gopher site, the same ftp site, etc. I just don't expect traffic to be that heavy. And I base it on personal experience from running anonymous remailers. Plus, it is ONLY necessary to retreive all messages if you don't want it know who you are communicating with. If you don't care if it is known you communicate with some psuedonym, then you don't have to get all the messages. The primary goal is to not mail messages out since that is where most the complaints against anonymous remailers lie. -- Karl L. Barrus: klbarrus(a)owlnet.rice.edu keyID: 5AD633 hash: D1 59 9D 48 72 E9 19 D5 3D F3 93 7E 81 B5 CC 32 "One man's mnemonic is another man's cryptography" - my compilers prof discussing file naming in public directories

1 0

MacPGP interface project
by Black Unicorn 17 Dec '03

17 Dec '03

1) Get source code for MacPGP2.3aV1.1 and alter it to accept the Clipboard as an input/output option, which it already can do, if operated manually. Till then we will spool the Clipboard to disk and have MacPGP2.3aV1.1 act only on files. MacPGP2.3aV1.1 was recently released in Germany, and will act as our temporary model crypto engine. <- This has proved a serious set back. I would design around MacPGP2.3 v.1.0.5 (or whatever) The V1.1 source code doesn't look like it will be around real soon. Cut your losses, and work on v1.0.5 -uni- (Dark)

1 0

Re: MacPGP interface project
by Richard Johnson 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- From the keyboard of: Black Unicorn <unicorn(a)access.digex.net> > I would design around MacPGP2.3 v.1.0.5 (or whatever) > The V1.1 source code doesn't look like it will be around real soon. Can someone fill the rest of us in on the true story behind this? Why is the (copylefted) source code to 2.3a V1.1 not available? I figure there must be a reason, but I'm all out of guesses. Richard -----BEGIN PGP SIGNATURE----- Version: 2.4 iQCVAgUBLdQuHPobez3wRbTBAQHqOwQAm56N4SKwIA4Rnjr207g/w5wcA99/u7AB yAEzBicn1lHd7uFFL8WvAEMBF0tNwBBPZENtlQ/3ql3rwCien0gLbFwJD0/j/qUC sntCha/7qvbDj5WXnOLICDzZBtS+gw6zno1oE2ne0wbEfW6u95ttzNEmh/Xxeche soYjfahyZ+I= =ybK+ -----END PGP SIGNATURE-----

1 0

Message Haven explanation
by Karl Lui Barrus 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hm... after reading various replies about the message haven I described, I've concluded my original explanation was terrible and confusing ;) Background: I've noticed that about the only opposition voiced to anonymous mail is the fact somebody can harrass another user (however, they can also be used to forward Clarinet posts, for example). Also, systems such as Julf's, convenient as it is, require tables which map psuedonym to true identity. The message haven is my idea of how to get around these two problems. (I'm not saying Julf is untrustworthy or something, this is just an idea to try out!) The way I see it working is you would create a message containing what you want to say, what to name the next reply, and anything else... perhaps a new public key to encrypt the reply with. You encrypt this message with the public key for whoever you want to communicate with, and send it to the haven with instuctions to file it under a name you specify. Your partner would browse the message haven, and retreive the message. He would frame a response, include what to name the next reply, maybe include another key, etc., encrypt his message with your public key, and send it back to be filed under the name you specified. The very first message to a person would have to be titled something obvious to them (i.e. "To Pr0duct Cypher", "To Deadbeat", "To Wonderer", "To L. Detweiler" or whoever), unless you can pre-arrange this. So far, the haven just accepts messages and files them. Maybe it could take a digital cash payment to file in an area where the message will be available for longer. The haven doesn't even have a public key (unless it runs a bank and has a public key for the bank portion). Now, if the message haven keeps logs of what messages you read, it will be able to figure out who you are communicating with. One possibility is to take all the message, so even if the haven fully logs, it will derive no information. This is only if you actually care that the haven can figure out who you are communicating with. If not, just grab the messages for you. Some people are suggesting retrieving a subset of the messages. Yes, this will work, but only if you take the same subset all the time. For example, you take your messages and message addressed to users A, B, C, and yourself. (There would be a complication if all the other users changed public keys simultaneously). If you don't take the same subset all the time (say you retrieve A, B, C, and yourself once, and then X, Y, Z, and yourself another time. It should be pretty clear who you are!), you expose your identity. Also, you would need to take all the messages of the other users (say A, B, C, and you have 5 messages each. You take all of yours, and just 1 from each of the others. Again, it should be pretty obvious who you are). Maybe the easiest thing to do is simply use a brand new public key every time, then you can take random messages. Indeed, you could even fool the haven into thinking you are communicating with someone else by always retrieving their messages, if you use a new public key each time. Some schemes have been suggested in which you tell the haven what messages you want. It would send them along with some random ones. I don't like this idea since it requires the haven to be able to connect your pseudonym with your true identity, and it's more complicated, as far as the haven goes, and as far as you (if you want to use a new key). And if you are already telling the haven your identity, you may as well just browse it and retrieve the messages intended for you. So, hopefully that is a bit clearer. Comments are welcome! Karl Barrus klbarrus(a)owlnet.rice.edu -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLdQmYIOA7OpLWtYzAQHIdwP9FHCtdL0XHhGCrLgVoFNNNdiSH8IGvlyO wZq8vvbYtW34uRrEs0nYDchVpEtDpMgrSQdfSFaKrNjg5mdfbqWh9qEeMv1NM91p jtqhYfUHqP1RE/CegET3tunI1h6fqfz91cMIpPc4hGM69OSJZecw8rumwKyxNwC8 cCBBDrb1iMk= =H9K8 -----END PGP SIGNATURE-----

2 1

PGP 2.5 & Remailers
by David Merriman 17 Dec '03

17 Dec '03

I was just wondering if there was going to be any hacking done to the anon remailers to allow PGP 2.5 usage, as well as PGP 2.3. If so, how would the headers change (if any), other than the obvious version numbers? Can we expect to see anouncements by various remailers advising as to whether they'll be supporting v2.5? Dave Merriman -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCNAi12VeYAAAEEAOqndSk+w1iAtW1nJDtdajTZEZEOuMjeKoFbXWuMK8H93Ckx Ba6c0Z8+STXtscP2WWKwRUVcrM0iZa2X4/7Z/Brl31aaA4DT6AVoxet3CLY0JUfi FciusBFCfPB6wfDdwABLZAzTd49YDyWI/Fq0MlNJ3JAeTFwhPeJ9eOnzcfP1AAUR tCVEYXZlIE1lcnJpbWFuIDxtZXJyaW1hbkBtZXRyb25ldC5jb20+iQCVAgUQLZxj 0Jmg14VGv4TFAQFNsQP+JdRjafESlDYmLvgmQqxZUE90lct/EIy5C8sIDT7vFt1f FI5PLtFg1xlxl8thrBjfff9GYKOt2WSw6Uw144OCNnIw5l93QR3ueSXWmHqowJ6c Hp8batrO/X3InNj6IDx6bolZzv6+lBz2XimE2SvYXCdU+7OA4CYxMQ6nfPwErdWJ AJUCBRAtdkQq4n146fNx8/UBAaN9BACQu9ILO57cRojTLc22LdDkFeOcmzQ/mvBm oJJaTRRXXm6t7G3a48uNVDuI36d2dcARTE1hYnu+6JFCqUsfLElQu/3NjFeVdHsu ygziv9pYb9vifzcyBuW6IUxiEkHnixIuTxNtOajscw6eJ29hv/o211gjRd3gAb2d RrmWxWkJtg== =8RGj -----END PGP PUBLIC KEY BLOCK-----

2 1

rec.guns Cross-Post
by anonymous＠extropia.wimsey.com 17 Dec '03

17 Dec '03

[Cross-posted from rec.guns regarding the banning of remailered posts] + Date: 11 May 94 14:32:13 + From: john.nieder(a)tigerteam.org (John Nieder) + To: gun-control(a)cs.umd.edu [rec.guns] + Subj: [ANON]: Yes or Goodbye! ========================================================= "The Federalist Papers were anonymous posts." -- Anon. ========================================================= I'm so angry I can barely enter this... This question of anon posts is currently the subject of conflict in numerous RTKBA net-venues, and I am sorry to see it come up here. As someone who has carefully followed the encryption/net-privacy/anonymity movement for the past three years, I feel that I am qualified to comment on the issue. To get to the point, _there are no logical arguments against anon posts_. ALL the arguments against them I have heard boil down to one of two roots: <1> Technical ignorance. <2> An adolescent prejudice that anon posting isn't macho. That's _it_. I can't dignify them further. To elaborate: <technical ignorance - short course> "Real" Names and accounts aren't. Fictitious and virtually untraceable "real" accounts and net identities are trivially generated, particularly with the increasing number of other commercial nets and computer Bulletin Board Systems linked to Internet. Anyone can produce a "good" account in about as much time as it took me to write this. If anyone is bent on making trouble on this or any other group, there is no practical barrier to their efforts, least of all by the banning of remailed posts. Generating new "real" accounts is often easier than using remailers. At least a message from a remailer _says_ it's an anonymous post, and the reader may killfile that From: field if he has an anti-anon bias. "Accountability" is generally illusory anyway, as anyone knows who has tried to silence the many legendary Net Nuisances who have abused Internet to an extent beyond that which we are likely to encounter in rec.guns. If troublemakers want to post mischief, even under their own names, there is very little that can be done about it. If you doubt this, consider the infamous Prodigy "Vito" case. They'll be back. In short, if you think a "real accounts only" policy is any protection against _anything_, you're just dreaming, plain and simple. Further, _remailers provide needed non-anonymizing functions for some users_. Though the parochial Internet mindset assumes that all users are on complex institutional Unix systems, this is simply no longer true; many users are on private home computers, linked through a wide variety of host systems, each with its own limitations. For example: In posting this message, I am limited by the (non-configurable) host software to headers containing only To:, From: and Subject: fields. It is impossible for me to Cc: a netmail reply to a post's author, or include Reference:, Comment:, Reply-To: or any other header field. This is frustrating, but by using some remailers for my reply, I may include these and other standard header fields for enhanced function. I do not use the remailer to anonymize, but merely to post more efficiently - I will include a Reply-To: field with my name in it as well as my sig. Currently, such posts are rejected from rec.guns. There are many other secondary functions for remailers. Use your own imagination. <"Duhhhh...but I betcha _John Wayne_ wouldn't use a remailer!"> A competent explanation of "anonymized digital reputation" as concept is beyond the purview of rec.guns, but I will refer those interested in it to the cypherpunks(a)toad.com mailing list. Put on your thinking cap, though, as the list principals are smart boys who'll leave you in the dust if you can't keep up. Anyone who wishes a better understanding of the purpose of the anonymity movement should monitor the list for a while. But so what? _Ultimately, all posts stand or fall on their internal merits, no matter what name - if any - is on them_. Ego and identity is utterly irrelevant, or should be. In these anon-post arguments over the past few years, I have noticed those who most oppose anon posts are consistently the same persons who habitually engage in flamewars, ego battles and rants. This cannot be a coincidence. As I have already demonstrated above, remailed posts pose no "threat" to anything beyond what is already present from falsely generated "real" accounts, but the urge to personalize and invest ego (however illusorily) in posts dies hard. The anonymous post has a long and noble history; it says, "Here is a thought - consider it on it's merits, irrespective of how 'important' or obscure its author is." Further, there are legitimate reasons for wishing anonymity in any case. There are many persons whose situations are such that participation in politically-sensitive newsgroups and lists is unwise. On ca-firearms, there was an anonymous poster who was a policeman in a highly politicized, anti-gun PD. His participation on an activist RTKBA list would jeopardize his job (remember Leroy Pyle). Would anyone braying on here about the un-machoness of anon posting wish to support his family when he gets fired because of "manly" non-anon policy preferences? I thought not...funny how that works. "Caution is not cowardice and carelessness is not courage." There is no upside to being personally conspicuous in dangerous political waters. If you want to stick your neck out for no good reason, go right ahead, but don't impose that pointless risk on everyone else just because you don't know any better. < MAKE ENEMIES FAST! > Though the political and civil rights issues at stake in the privacy movement have probably never seriously crossed the minds of 95% of the participants here, they exist nonetheless, and are remarkably related to the RTKBA battle. _There are no more important natural allies to the RTKBA movement on Internet than the computer privacy advocates_. There is substantial overlap in these groups, and the ill-informed banning of remailer use in RTKBA net forums is stupidly antagonistic and insulting to the best friends we have...and right now, we need all the friends we can get, especially ones who are experienced and organized activists in their own right. Such anon codewriters and advocates as Tim May and most other principal encryption/anti-Clipper/remailer activists are vehemently pro-RTKBA, and make their support known at every opportunity. I find it embarrassing that "well-meaning" but ignorant RTKBA list and newsgroup maintainers such as "Magnum" and Jeff Chan have directly insulted them so grievously, without a second's thought or serious consideration. < "It's _my_ list! If you don't like it LEAVE!" > I intend to. I believe in the RTBKA because I dislike folks who compulsively want to dominate others by force of authority and who wish to ban everything they can't understand, or fear because they can't control. The anti-gunners and the anti-privacy people are the _same_. Usually, they are actually the same people (check voting records in Congress), but in any case exhibit identical mindsets. When another user left ca-firearms(a)shell.portal.com in protest of the anti-anon policy, imposed there not because of any problems caused by anon posts but rather "on principle," he received netmail from two anti-anon users which he forwarded to me when I left the list. Neither one had the least idea of the actual issues and technical considerations enumerated in this message, which was not a surprise. What I found truly sickening was that one idiot went on for his entire post about how a list had to be a "benevolent dictatorship," (oxymoron unnoted) and that anon posts somehow threatened the "order" of the list, and that anon posters were ungrateful and soforth. It was nothing more than a catalogue of irrational bullyings by a control-addict. I do not want to align myself with people like that. Sorry. If anon posts are forbidden on rec.guns - or ca-firearms, or anywhere else - I'm leaving and encourage others to do likewise. |%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%| | <john.nieder(a)tigerteam.org> * CP2A * PGP Key # E27937 on all servers | |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| |"If you love wealth better than liberty, the tranquility of servitude | | better than the animating contest of freedom, go home from us in | | peace. We ask not your counsels or arms. Crouch down and lick the | | hands which feed you. May your chains set lightly upon you, and may | |posterity forget that ye were our countrymen." -- Samuel Adams, 1776| |=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-| |BOYCOTT: Pepsico <KFC - Taco Bell - Frito-Lay - Pepsi-Cola> & Gillette| |%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%|

1 0

IGNORE-NEON
by ADAM GERSTEIN, _THE_ MACGURU 17 Dec '03

17 Dec '03

Neon- Here's my pgp key, and I will send the files to the appropriate people. Adam P.S.- What's the best way to contact you? the Alt.? newsgroup you mentioned? -=-=-=-=-=-=- -----BEGIN PGP SIGNATURE----- Version: 2.3 iQBVAgUBLc0c/AT73QJlKKVlAQGV5QIAmusRN0C58o/ScjA1/V7Mq77XurUi3Ktk XZfUXkk6yLJtxtKj5kIddxMiJISfRLbNFvKkAv7LFbYDAdI0RYpnxg== =vEVx -----END PGP SIGNATURE----- -=-=-=-=-=- God's last message to his creation: "We apologize for the inconvenience" -D. Adams

1 0

Penet spoofing
by SINCLAIR DOUGLAS N 17 Dec '03

17 Dec '03

Forwarded message: > From anon.penet.fi!daemon Fri May 13 18:40:07 1994 > Date: Fri, 13 May 1994 18:33:08 -0400 > From: daemon(a)anon.penet.fi (System Daemon) > Message-Id: <9405132233.AA21224(a)anon.penet.fi> > To: sinclai(a)ecf.toronto.edu > Subject: Anonymous code name allocated. > > You have sent a message using the anonymous contact service. > You have been allocated the code name anXXXXX. > You can be reached anonymously using the address > anXXXX(a)anon.penet.fi. > > If you want to use a nickname, please send a message to > nick(a)anon.penet.fi, with a Subject: field containing your nickname. > > For instructions, send a message to help(a)anon.penet.fi. > > I didn't send mail to penet. I'm assuming someone on the list must have forged the post. I'm not amused. Anyone else get this, or did someone think I'm special?

8 9