December 2003 - cypherpunks-legacy

Mac Encryption Components?
by acspring＠knoware.nl 17 Dec '03

17 Dec '03

Does anybody know if there is an encryption component registered with Apple? I was planning to write one, but I wanted to know if there was already a standard/spec I could code to. I e-mailed REGISTRY at AppleLink a coupla weeks ago, but they seem to be focussed just on registering new components; not fielding queries about what's already registered. -- Man! Woman! Child! All! are up against the WALL of SCIENCE! <acspring(a)knoware.nl> PGP Key print:4C 17 EC 47 A1 6D AF 67 F3 B4 26 24 FE B2 0F 5E

2 1

Re: The Market for Crypto--A Curmudgeon's View
by JEFF LICQUIA (CEI) 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > From: eric(a)remailer.net (Eric Hughes) > Let me review the exact proposal. First, a recognizer is set up at > toad.com to distinguish between digitally signed and unsigned > messages. Second, some action on the message would be taken, which > would gradually increase in effect over time. The first action would > be to add a header to the end of the mail identifying it as unsigned. > A later action would be to delay the mail at the server for some > amount of time. A final action would be to delete or bounce messages > that weren't signed. Perhaps something a little more useful would be a little more palatable. I have a feeling that something like the above would sound gratuitous to many on the list. A better way would possibly be to have some value-added service offered by the list server which involves encryption or digital signatures. Here are a few ideas: 1. What if all messages on the list were themselves signed by "Cypherpunks List <cypherpunks(a)toad.com>"? (yeah, I'm reaching here; let my brain warm up...) 2. Encrypted submission to the list. This could be useful if used in tandem with remailers, perhaps... 3. Offer anonymization locally. Messages posted this way could appear as "cypherpunks-reader@somewhere" or something like that. When combined with remailers and encryption (like #2 above), this could mix things up with respect to anonymous mail. As another (possible) option, the remailers could be set to recognize cypherpunks(a)toad.com and send in such a way as to use this local anonymizing. 4. Auto-verify signed messages. Put a header at the top of signed messages such as: [Signature verified. ID: Joe Blow <jblow(a)uunet.net>] [Bad signature! ID: Joe Blow <jblow(a)uunet.net>] for tested signatures. This would either require a key registry (where you register your public key with the list server) or an interface to the key servers. This would of course imply quite a few changes to the list server code, as well as possibly non-trivial resources to do the processing, but hey, social imperatives don't have to answer to reality, now, do they? (At least they never seem to when the government is concerned. :-) Two variants: Strip the signatures after verifying them, and/or marking unsigned posts in a similar way. 5. Allow the option to encrypt list messages before sending. If we used #4 above, this could encrypt with the public keys; otherwise, it could use conventional encryption. This could be a great boon to readers whose sysadmins might take a dim view of them reading such an antisocial list. :-) Corollary: allow the option of sending the list, encrypted, through the remailers as well without requiring a pseudonymous remailer. I'm sure I could think of more lamebrained ideas given enough time and motivation. :-) > I do, however, agree with the other two premises of Tim's > hypothetical. I do think that crypto isn't being used by enough > people. I realize that the exact meaning of 'enough' is subjective, > so let me rephrase. I do think that crypto is being used by fewer > people than I want. I also believe that setting an example is a good > thing, because it signals an achievable task to those who are > considering doing it. I would agree, though I would suggest that holding out carrots (neat features you can take advantage of if you encrypt) would work better than punishments (your posts won't get through as fast if you don't sign your posts). Does that make me a Puller? > When I first proposed server actions last year, it was with the full > realization that I wouldn't be signing my own posts and would thereby > be subject to the delay (the first-proposed action). This post isn't > signed either. This post is. :-) I'm a believer that it serves as effective spoof insurance. But, then again, I've got a direct Ethernet link to the net on my Windows box at work and Linux at home, so it's easy for me. Also, I wasn't even a lurker at that time, so my suggestions may be old hat. If so, please bonk lightly! -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLtuijTER5KvPRd0NAQFfXAQAgDrbMlEJBXU2V9NIquHNQGonE/dwwH0I aEnykWh+8Bu3hCdqYgbv6zhe7gc+0itb/QuwHMpUn8MNHE6VhykFPl+i7c3HOibf 0yAqPVy10UNMuJY6LxqSxfrTKwV/sFcnRWDaJcboL3MvTFrwRqC3ItdaOeokKvx2 1Cgv1ioQqfc= =gzbV -----END PGP SIGNATURE-----

1 0

Re: The Market for Crypto--A Curmudgeon's View
by Sandy Sandfort 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Did anyone but me notice that Eric Hughes and Tim May have reached a consensus in the on-going debate about signed posts? Tim says, "your house, your rules" and acknowledges that Eric is the de facto boss of the list. Tim expresses no real objection to Eric's first step except in a "slippery slope" sort of way. Personally, I'm against mandatory digitally signatures as a rerequisite for posting to Cypherpunks. On the other hand, I like the idea of having the list software automatic verify digital signatures. This is a valuable service I'm usually too lazy to perform for myself. Here's my suggestion. Eric should unilaterally impose his first step, i.e., all unsigned messages and messages with spoofed signatures will henceforth be flagged as such. Let's see what effect, if any, that has on the way people post their messages. After the protocol has been in effect for some time, we can re-open the topic for further discussion. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLtulbk5ULTXct1IzAQERKQP/QKtfYC1MNpvxTNPeLTlxJeAcFiTrufKi M3I0vpH3gXRDZeeL+ff/8YyRbkDgYZEOu6Si/fZuiWWZCYNmAQb22QaQ9riW6amq ghIybvhd66i7rOntNIkcXOAGtk6rBJ8AVc3lFqmGEYBRW2p/+mATsAFaJ7Agj5K9 L9nc34T6Mb0= =sDH7 -----END PGP SIGNATURE-----

5 4

Re: whats all this nonsense
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

>I just signed onto this list. What the hell is all this nonsense that I hear >about mandating PGP signed messages? > >I thought the whole grassroots crypto thing was about protecting privacy >rights and individual liberty and all that. So what if someone wants to >post a message to cypherpunks AND DOES NOT WANT ANYONE TO BE ABLE TO >PROVE THEY WROTE THE MESSAGE. Whether because they fear legal prosecution, >or some other social consequence down the line, or whatever Of course we all agree with you there, but as someone else mentioned, users would be perfectly free to sign with a _pseudonymous_ key. My key wouldn't have to be in the name of "Jonathan Rochkind," it could be "Dirk the Destroyer", or whatever else I wanted it to be. I'm not sure if Eric is suggesting that everyone submit their public key to the list or not. If he is, then things would be made a bit dificult, as you would have to make your one-time-only anonymous key, send it to toad.com, wait for it to be recognized, and _then_ send your message to the list. Assuming that not only do I not want your messages traceable to Jonathan Rochkind, but I also don't want them traceable to _each other_, then I'd have to make a new key before sending each message, and go through that whole rigamarole each time. I'm not how often people actually _would_ desire to do such a thing (generally, it's important to most people to build up a good reputation, pseudonymous or otherwise), but.... I agree you have a good point that it's important the list be set up so it's possible to contribute to it anonymously/pseudonomously. And that _some_ implementations of what Eric is suggesting might make that either impossible or just a pain in the ass (and we probably dont' want to do either). There are probably other implementations that wouldn't have this problem. Although I would still oppose them, pretty much on the grounds Tim May has been ranting about. (and I do mean ranting in the best way. :) ). People should pretty much be able to do what they want, and I don't see any compelling reason to force people to sign their messages whether they like it or not.

2 1

Jeff @ViaCrypt
by Joe Turner 17 Dec '03

17 Dec '03

Please excuse the bandwith. Earlier today I had a conversation with Jeff who claimed to be from ViaCrypt. I was in a hurry to attend a lunch/meeting and forgot to get his internet address. Could someone point me in the right direction? -- Joe N. Turner Telecheck International turner(a)telecheck.com 5251 Westheimer, PO BOX 4659, Houston, TX 77210-4659 compu$erv: 73301,1654 (800) 888-4922 * (713) 439-6597

1 0

PGP hook for Eudora?
by dmandl＠bear.com 17 Dec '03

17 Dec '03

> Jonathan Rochkind wrote: > > > Because premail makes it incredibly easy to use PGP on a unix box. And, for > > that matter, the Eudora/PGP applescritps make it incredibly easy to use PGP > > on a mac. And there are some people working on an applescript that will I keep hearing about PGP hooks for (Mac) Eudora, but a casual search of at least five advertised ftp sites has turned up nothing. Can someone post an address where this stuff can definitely be found? Thanks. --Dave.

2 1

CFV on Signing Posts To List?
by werewolf＠io.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- It seems like we have a pretty good thread on the for/against arguments re: digitally signing articles posted to the list. Perhaps we should allow it to run its course over the next 48 hrs, and then Eric could circulate a form like the following Friday morning (ie Dec 2): - --------------------------------------------------------------------------- Question: Do you agree that all articles posted to the list should be digitally signed and that the keeper of the list should take steps to implement such? Yes ___ No ___ - ---------------------------------------------------------------------------- I realize we are not exactly in a democracy here (ie Eric maintains the list) but then again the participation of the subscribers would be a lot more enthusiastic if the perception of "majority rules" was met. As someone mentioned earlier, this discussion seems to pop up every so often and ramble on for a certain amount of time with nothing being resolved. Maybe a "Call for the Vote" would change that. We all would seem to hold the net and its functions to a high degree of importance. Settling of this issue (as opposed to the thread meandering for the next month or so) would indicate that something concrete in favour of crypto could be implemented (or discarded....after suitable discussion) by its main proponents. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLtu4hK+YbMzawbu5AQE4GAP+LM4gNXDS5O4uzOWTYC4U60veXnjWVjC6 gXxvE/fEJu99SzThgthrf51Jb5K4hKrtJfZ44hwmdyQHsOx+p9xStjkSZFQFWc7b /J9vEtzwG/IyO/DxD2hHmCzUod64WIx0cXtwUDjUCxgDnAdFaIEjhLfYk5Pr3KaW e6mkrDiQtSQ= =S4BI -----END PGP SIGNATURE-----

2 1

(re-tx) RE: Transparent Email (WAS disable telnet to port 25)
by p.v.mcmahon.rea0803＠oasis.icl.co.uk 17 Dec '03

17 Dec '03

I sent this yesterday, but it apparently didn't through. -- > > I don't have an answer to your question, but you did bring up something > > I've been meaning to ask about for some time and I never really got > > around to it; Are there any short-term plans to press for an RFC > > utilizing digital signatures? With the exponential increase of mail Existing standards track RFCs support PEM-based security of RFC-822 email (RFC 1421, RFC 1422, RFC 1423, and RFC 1424). Recent work on security of MIME has allowed for an alternative content protection and certification mechanism (i.e. PGP). See Internet Drafts draft-ietf-pem-sigenc-02.txt and draft-ietf-pem-mime-07.txt which respectively define the framework and the PEM-specific parts. > The best answer that I can come up with for this problem is to allow for > several webs of trust to function simultaneously. Perhaps we would have The intent of the MIME extensions is to enable either PGP or PEM to be used, although the standard for the former is I believe still pending. I am not aware of efforts to integrate the two certification mechanisms. > A web could be defined by a single top-level public key and a set of This is the function for the IPRA (as discussed in RFC 1422). > rules. Perhaps a text based program -- a sort of "meta-pgp" -- could > check chains of signatures to validate a key. This is what a PEM-conformant user agent does. > Suppose, for example, that I'm administering a web of trust. I set up > the web so that I can deputize notaries who can in turn sign user keys. The PEM WG used to call these organisational notaries, but they have been dropped from the standards. They are also referred to in related work as Local Registration Agents or Authorities - and are necessary for large organisations' use of certification services. > Lets further assume that all signatures are good for a year. A keyserver > would return a text file containing: (a) the user's key, concated with a > notary's key, concated with a header specifiying the date it was singed > by me. This sounds similar to the certification message in RFC 1424. There isn't a requirement for certificate retrieval as certificates are sent with the message or handled using (as yet unspecified) directory facilities - probably an extended DNS in the Internet environment. - pvm

1 0

signing messages
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Seems like one way to encourage the use of digital signatures is to start forging messages from people who don't ordinarily sign their messages. Necessity is the mother of invention, and all of that. I finally started signing my messages on a regular basis as a result of Detweiler forging a message which purported to be from me. On the other hand, I think Tim has been the most frequent target of Detweiler's forgeries, and I don't detect much of a creep towards signing messages on his part. Eric, would you mind clarifying the purpose of the "sign-or-delay" rule? Last time this came up I assumed that it was to encourage folks who had 95% of the tools/initiative to start using crypto techniques on a day-to-day basis to get off their asses and do so; but other people seem to have different ideas about the purpose(s) of such a practice. I think it might be interesting to try the "sign-or-delay" rule on a part-time basis - perhaps weekends only, or never on weekends, or only during December, or whatever. To me, it seems useful as sort of a "Great American Smoke-Out Day" for crypto; to get folks to go just one day where they use crypto in a practical, applied way, to prove that they can do it. What they do after that is their own business. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLtvFC33YhjZY3fMNAQGc+QP/R2kBRlCNVLDVJNOLOGOWv6URYmnj+qTt poo1LKtz31Mzj+rBAiXPZSYY5xPtTXKD/7X8dU3JYyJbH12kwvH/RS1GS4mEV++V QDJD6L84EekrdFy0piP7jsGDMq2SQsHnI6G3GG0koGoMN/3u/UbDiCG3+yJ1b5u1 iMCS8dZQTfA= =eCnh -----END PGP SIGNATURE-----

4 3

RE: CFV on Signing Posts To List?
by Blanc Weber 17 Dec '03

17 Dec '03

I disagree that a cypherpunk should be expected agree to commit everyone towards arriving at a consensus over whether anyone who posts to the list should sign their messages, or that the list owner should be expected to submit to their conclusions simply because that is what they agreed among themselves he ought do. It's a matter of (anarchist) principle. Blanc

1 0