December 2003 - cypherpunks-legacy

Academic crypto export over e-mail?
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

mpj(a)csn.org: > be other restrictions that I am not aware of to your using it. The C++ code > fragment above is just intended to illustrate the algorithm being discussed, > and is not a complete application. I understand this document to be > Constitutionally protected publication, and not a munition, but don't blame > me if it explodes or has toxic side effects. Eeek! My skin just peeled off! Seriously, I thought the whole ITAR hassle was that 'code fragments' intended to 'illustrate algorithms' are only exportable on paper? After all Mike Ingle can't sent me his Perl RSA libraries to 'illustrate cryptographic prototyping techinques' even though the libraries don't run on their own. "We know everything about you that we need to know" - Coleta Brueck, IRS ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "In between the breaths is rishab(a)dxm.ernet.in the space where we live" rishab(a)arbornet.org - Lawrence Durrell Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

bashing mcom
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

Can we maybe discuss other things then how Mcom fucked up? They've said specifically that they plan to support IPSP as soon as it is viable to do so. They've said they plan to support whatever MIME encryption thingamajigs exist, as soon as they are standardized. [And don't get mad at them for waiting for it to become standardized when their own protocol isn't. I have talked with someone developing commercial software who spent some serious time writing stuff to handle MIME encryption, only to have the specs change on him significantly.] Now, maybe they are lying about this. But you aren't going to get anything else out of them on this list. They've come as close as they are going to to admitting they made a mistake with SSL. I believe a good paraphrase of what wa said (I didnt' keep a copy of the message) was that "however it looks now, SSL made sense at the time, and it's a done thing now." Maybe they are only saying this much to appease the list, but again, that's all you are going to get out of them. It seems like it would be an impossibility economically and public-relations-ly for them to just abandom SSL, and they probably dont' want to either. But they've said that they plan on supporting IPSP, MIME encryption stuff, and anything else out there that will do the job. I'm not sure what else you want to drag out of them. Can we maybe stop this flame fest and let the list return to it's normal traffic levels?

1 0

Re: Authentication vs encryption: CPs on the web
by Amanda Walker 17 Dec '03

17 Dec '03

> I notice that the people who come to this topic from an > institutional point of view tend to be more interested in > the authentication aspects. > This seems to fit better into the control-oriented mindset. > With authentication you can track what people are doing > better; non-repudiable signatures could actually work in some ways > against the signer. I think that may be one reason Phil Zimmermann > is famous for not signing his messages. :-) But encryption can > actually work against institutional interests (compared to individual > ones) by making it harder to keep track of people's activities. Very much agreed. This is why, in my description of the rough criteria I sent out, I included mention of self-signed certificates (which only show that you do in fact have the private key corresponding to a given public key), bare keys, and so on. There clearly needs to be facilities for encrypted anonymous use. To expand on my example of wanting sales literature to be signed so I know it's genuine, I correspondingly *don't* want to include a certificate with identifying information in my own query--I get enough junk mail already, and I don't want vendors to be able to capture market research at the browsing level (I haven't looked at WIRED's server for precisely this reason). Amanda Walker InterCon Systems Corporation

1 0

RE: Winsock & PGP Integration
by Johnathan Corgan 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > Except one. What all of these agents have in common is that they > interface with the Windows Sockets API to establish TCP streams > that are used in the POP and SMTP protocols. Since these are well > known and standardized protocols, this gives us our toehold. > >How might an interposed winsock DLL recognize what high level protocol >it was going to spoof? Getting the port number will be a very good >approximation, but I'm not convinced of its reliability. Well, it could be done "by definition." Let's say I tell my Eudora that the SMTP and POP address to use is 192.0.0.1. I can now configure my spoofing agent that when there is an attempt to establish a TCP stream on port 110 of 192.0.0.1, I can be assured that it is the mailer trying to retrieve mail. Likewise for mail delivery (and news, spoofing NNTP, though this is probably an order of magnitude more complicated than just mail.) >As to the general issue of MSWindows v. Unix, the Unix predominance >for remailer software involves the fact that Unix is on the bulk of >the machines connected to the Internet. It's more reliable for >offering network services than MSWindows and it's got a cleaner >architecture for reconfiguration. None of these explanations, >however, means that there won't be more MSWindows that Unix boxes for >a long time. Of course. Unix was around long before DOS/Windows gained market dominance of the personal computing market. And for automated encryption on that platform, premail seems to do a great job (though there are some features I'd like to see added, Raph). The unfortunate thing I think is that Unix/X-Windows has never gained a foothold in the "consumer" market. - From a marketing perspective, if we are trying to "sell" strong crypto use to the "masses", then it is only prudent to assess where these types of products would be deployed. And the two platforms that will entirely make up the personal computing market will be DOS/Windows95 and to a lesser extent, OS/2 Warp. This was a subject brought up at the last Cypherpunks meeting (by Tim, I think.) For fifteen years we have had some pretty sophisticated theoretical models of strong cryptographic techniques. Some of these, such as PK encryption, have reached the "masses" in the form of PGP. Others, such as digital cash, have been mired in implementation issues. It is frustrating to read about and listen to lectures on advanced cryptographic subjects (such as all the great presentations at the last meeting), knowing that it may be years before this "theory" makes it into "practice." I will be happy when cryptography is as ubiquitous on a PC as screen savers. ======================================================================= Johnathan Corgan "Violence is the last refuge of the incompetent" jcorgan(a)netcom.com -Isaac Asimov PGP Public Key: http://www-swiss.ai.mit.edu/~bal/pks-toplev.html Or send email to: pgp-public-keys(a)pgp.ai.mit.edu Subj: GET jcorgan ======================================================================= -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLu3ksU1Diok8GKihAQFyXwQApqXdcRfM7cV2EeRbrB6xMDXwJwWSFl5i 3gwTwDkZ8omK/9N+R9gLx4V6CcpPo7kku+GfUy7dkj4wDYtLTZ7m2sZ+mvg0FJNS 3LUSOKC911LpGj9m7uUcFKF+OsthO7WDz5Xtk5AMUTK26Uo0W4lOxBgOTrdiCdDx q3rYla9+ueU= =TL0Z -----END PGP SIGNATURE-----

1 0

Re: Clarification of my remarks about Netscape
by Amanda Walker 17 Dec '03

17 Dec '03

> I didn't bother imbedding the RSA Unaffiliated User CA because I > didn't think server operators would use it to get certificates. Well, it's what Apple is using for PowerTalk signers (which are a key pair and X.509 certificates, by default from the Unaffiliated User PCA). It makes sense for personal (as opposed to organizational) servers, such as someone running MacHTTP for their home page... On the other hand, if RSA has set up a server PCA, that should be suffcient for now. I wonder what the certification policy is, though--how do you prove that you control a given server? For an Unaffiliated User CA certificate, you just have to show a notarized application and two forms of ID, one with a photo (driver's license, passport, etc.). I can't off hand think of an equivalently strong way to ID control of a server... Amanda Walker InterCon Systems Corporation

2 1

Legal implications of a PGP DLL
by bshantz＠spry.com 17 Dec '03

17 Dec '03

I know this has been hashed over recently, but I never found out (or don't remember) what was decided in regards to the legal implications of a PGP functional DLL for Windows. If a company (i.e. SPRY, wink, wink, nudge, nudge.) were to write a PGP DLL and make it publicly available, would that be legal? Viacrypt just straight out charges too damn much to make it worth licensing. So, if a company wants to make it's mail client PGP friendly, but not actually supply the encryption algoritm, etc. Would a DLL be legal if it were in the public domain? >>>>>>>>>>>>>>>>>>>>>INTERNETWORKING THE DESKTOP<<<<<<<<<<<<<<<<<<<<<<< Brad Shantz bshantz(a)spry.com Senior Software Engineer SPRY Inc. Direct #: (206)-442-8251 316 Occidental Ave. S. Main #: (206)-447-0300 Suite 316 Fax #: (206)-447-9008 Seattle, WA 98104 WWW URL: http://WWW.SPRY.COM ---------------------------------------------------------------------- PGP Public Key at: http://www-swiss.ai.mit.edu/~bal/pks-toplev.html Or email: pgp-public-keys(a)pgp.ai.mit.edu Subj: GET bshantz >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

3 3

Re: Winsock & PGP Integration
by Johnathan Corgan 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > Seems to me that the UNIX model of building one mail transport >instead of 20 is a good one. If you seperate out the UA from the >transport, you make it easy to fix or update the transport. I agree. > So I would suggest, rather than hacking at Winsock and >hoping to catch the right protocols, build a set of libraries that can >be called by programs. smtp.dll, for example, would be a mailer that >any mail program could call. nntp.dll would handle news, underneath >all the various interfaces. If you want to pretend to be premail, you >do it in smtp.dll. This is of course much closer to the ideal way of doing things. However, the original motivation for this project was that in order for all existing Winsock based mail agents (except for Zmail, it looks like now) to add crypto/anonymity to their functionality, some work has to be done to change them. The system I came up with to spoof Winsock would be (hopefully!) transparent, in that it would work with _existing_ mailers _today_. To go the route you outlined, while in the long run a much more sensible way of doing things, would require the same sort of effort on the part of the current mail agents, i.e., they would need to change. Your suggestion is one I would like to follow up on; in the mean time, I am going to make an attempt at the spoofing idea. > The advantage to other programmers is that they no longer have >to do the low level stuff that they had to before. It allows >programmers build whats interesting, namely, the interface & gizmos. Hehe. It's the user interface I hate doing the most! > Make the package do the user interface side of things, and >make a seperate package to do the network protocols. Makes building, >testing, and changing things a lot easier. And while you're at it, >store all of your files as text. :) Nah. Variable bit sized binary records work well enough :) ======================================================================= Johnathan Corgan "Violence is the last refuge of the incompetent" jcorgan(a)netcom.com -Isaac Asimov PGP Public Key: http://www-swiss.ai.mit.edu/~bal/pks-toplev.html Or send email to: pgp-public-keys(a)pgp.ai.mit.edu Subj: GET jcorgan ======================================================================= -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLu4cV01Diok8GKihAQEQqwP/T1XQPJYPHyVZWB3sAO1Fl8TdgikW+I/6 1/XnNitgm7WwwUdadGFx0gVEzbmwN0yRbwntKV/M8wuYG+0oQ2NPBBSoBDMbUYqR OmIjUDg7P+v7X4Ga4B6MLeca6bemxYGT+Jv3F4xTQrohyUyNc+zMBR6CPWrv5d7g NQzIeTsIn/M= =Tagz -----END PGP SIGNATURE-----

1 0

Re: archiving cpunks
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- > I'm working on a system that indexes,marks up, and serves up html versions > of E-Mail lists. It's still very alpha stuff. cypherpunks is in the > tryal part of system I call the Biblotech. All URL's that come through > the system are also indexed... [...] > Would anyone be against me doing such a thing? alowing anyone to > view the c-punks list via html etc... The list is public and has been archived before (and maybe still is, I'm not clear on the point). Hence I don't see any grounds for objecting to your project. - - -L. Futplex McCarthy - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLu4dtmf7YYibNzjpAQFkNwP/XCHjzLX8Y5VCPTsDRMnP+sc41Koe7acQ RDfT6Ojgb/Fb6rtYiBjn9aSIu57kza5rSYjVmaKljM06p2QptZ2M1Jz9jxU7rfNk BHVJSAc2Y+kbu0KqVzAVgx4o5GC41BnCoJiB9/l8iWvIgkO5pvSHTO3LlrgD15+6 kjlS5fq664Y= =nr2r - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLu4gTCoZzwIn1bdtAQHk1wF/XY0PbJjkuOia/lUi+11GsSFVODQLM6b1 lPEF38ufdFM157KPVWX4HI0ry7Wxr+Sm =W21x -----END PGP SIGNATURE-----

1 0

CHOMSKY MADNESS!!!
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- James Donald writes: > One may be a reasonable inference, as I inferred > that Chomsky sought to justify mass murder and > brutal terror. The other is a lie. Hey Eric, how about a filter that delays all messages to the list which mention Chomsky by a month or so ? - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLu4kpCoZzwIn1bdtAQHgDgGApDSD7Z+FZW+ykNEO8WujOFnDUhbyxSnv tyb0ZVY8mnVjmookxn19UVE8iRbLZQKU =Rwt7 -----END PGP SIGNATURE-----

1 0

Re: Fundamental Question?
by Andrew Lowenstern 17 Dec '03

17 Dec '03

> Although I understand the need for remailers for anonymity, is it > not true that the whole idea of encryption (good encryption, that > is) is that no matter who gets the encrypted text, it really doesn't > matter? Does this not mean that something like USENET is *perfect* > for this? Usenet may be provide good untracability for the recipient, but the if the sender desires untracability she needs to use a remailer or some other service to get the message into Usenet. Also, the recipient needs to know if and where to look for the message. If the recipient isn't anticipating the receipt of a message untracably, or doesn't care if 'they' know she is receiving the message, then Usenet isn't necessary. andrew

1 0