December 2003 - cypherpunks-legacy

Re: Comdex Disks?
by merriman＠metronet.com 17 Dec '03

17 Dec '03

> >David K. Merriman says: >> Back some time ago, there was some discussion of giving away disks at Comdex >> in NY; > >Comdex isn't held in New York. Fine. Whatever the hell the damn expo-thingy that was held in New York sometime in the April/May timeframe. Dave Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)fohnix.metronet.com for PGP public key and fingerprint. PGP encrypted Email welcome, encouraged, and preferred. "Those who make peaceful revolution impossible will make violent revolution inevitable." John F. Kennedy

1 0

RE: 2048-bit key...I'm leery
by Johnathan Corgan 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >2) Can the key generation possibly be done on my machine that >quickly? I was expecting it to take at least several hours based on >what I've been reading in the cryptology groups. My first try took about twenty minutes on a 486/50. Second try was about 15 minutes on a 486/66. ======================================================================= Johnathan Corgan "Violence is the last refuge of the incompetent" jcorgan(a)scruznet.com -Isaac Asimov PGP Public Key: http://www-swiss.ai.mit.edu/~bal/pks-toplev.html Or send email to: pgp-public-keys(a)pgp.ai.mit.edu Subj: GET jcorgan ======================================================================= -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBLv3mk+lPfVlQ1n99AQGz9Qf/Rdn+OQjX9Z6gXiMCZ+N6iHJhvDBVMyRm 7o8xHM/BO1x5ELfRS/aBWHwjRei61woEhGY5fo2QZQkAZw7LgKQ9fQlhuQyiEkg/ bNrwwS1KXPhfSOKn4xexSkRL2T7BEoipPOs+8lVwKBfZsKfVqK534wjYtXiEqEt0 QPqGkUPbdRxC54Vt2CxaKqMu6MInh6M8I6yoWhXDBRBwTq4LXN5Rg14ecIWr2++Q y6ECqnqqHCyR9ugfweF61tmJL8JkEXdCcr3hFn9S4/Z88ep7i6+4fJQVJ64GTs5J wiSWFUiMRemtbMx6t/RKE8oXZYYm+0VRqQqVKeKoKEGQOh4Hiikccg== =CD8i -----END PGP SIGNATURE----- ======================================================================= Johnathan Corgan "Violence is the last refuge of the incompetent" jcorgan(a)scruznet.com -Isaac Asimov PGP Public Key: http://www-swiss.ai.mit.edu/~bal/pks-toplev.html Or send email to: pgp-public-keys(a)pgp.ai.mit.edu Subj: GET jcorgan =======================================================================

1 0

Phil Zimmermann
by Philip L. Dubois 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Phil Zimmermann and his defense team are heartened by the substantial outpouring of support that has been demonstrated through numerous postings in this and other news groups. As we approach a crucial meeting with the prosecutor, it is particularly encouraging to see that many others are willing to devote themselves, both financially and through volunteered time, to Phil's defense. A number of postings have suggested a variety of support activities ranging from petitions to the President to gatherings in San Jose. Phil's lawyers are concerned that some of these activities would not assist in our efforts to protect his legal interests and could in fact hurt. The upcoming meeting with the prosecutor is not a court hearing, but is a private meeting of counsel. Neither Phil nor any judicial official will be present. It will not be a trial or hearing, but a discussion with the Assistant United States Attorney who is handling Phil's case. As such, it is not an appropriate setting for any public demonstrations of support for Phil or for unrestricted dissemination of cryptography. What Phil needs at that meeting is a quiet environment in which serious legal issues can be discussed candidly in an effort to avoid the necessity for any trial. Given the purposes and importance of the meeting, we -- and most especially Phil ZImmermann -- ask that any of his supporters not come to San Jose for any form of public demonstration. We encourage you instead to continue to support Phil's defense by financial contributions. Communications of support to government officials in Washington, DC are also appropriate and helpful. To the extent that effective representation of Phil's interest permits us to communicate with his supporters, we will periodically post announcements to this and other appropriate news groups. Philip L. Dubois Lawyer -----BEGIN PGP SIGNATURE----- Version: 2.7 iQCVAwUBLwJTObZ7C+AHeDONAQH1jAP/T6ZMSIAbgjfLliPbDALVMaOkuHBHGdeq ny0KPsZhIz6/K6ate8yr1uF84RtdolHMx73DBpSf6L9H7d3zcPVfy3ArAv44J/kZ jX0y36eCcn9pxhtU+41k9vkSLnGaNdiM5JKpehbRLgP0Gm+dAq0tbGNIXwL0XOEq CKmZXTWj/vs= =4hhB -----END PGP SIGNATURE-----

1 0

good blaze quote
by ddt＠lsd.com 17 Dec '03

17 Dec '03

At 9:41 pm 11/9/94, Matt Blaze wrote: >Cypherpunks write code, and design protocols, and analyze ciphers, and >assess risks, and write articles, and attend conferences, and lobby >Congress, and in general look at the world with a critical eye. I was just going through some old mail and found this nice quote from one of our own. BTW, thanks for those pointers to Rivest's RC5 materials...I'm just getting around to them but they're very educational. dave __________________________________________________________ I have a flawless philosophic/scientific model of reality. Unfortunately, it's actual size.

2 1

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.30.tar.gz For the PGP public keys of the remailers, as well as some help on how to use them, finger remailer.help.all(a)chaos.bsu.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"vox"} = "<remail(a)vox.xs4all.nl> cpunk pgp. post"; $remailer{"avox"} = "<anon(a)vox.hacktic.nl> cpunk pgp post"; $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"rebma"} = "<remailer(a)rebma.mn.org> cpunk pgp hash"; $remailer{"jpunix"} = "<remailer(a)jpunix.com> cpunk pgp hash latent cut post ek"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash"; $remailer{"soda"} = "<remailer(a)csua.berkeley.edu> eric post"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub"; $remailer{"usura"} = "<usura(a)replay.com> cpunk pgp. hash latent cut post"; $remailer{"desert"} = "<remail(a)desert.xs4all.nl> cpunk pgp. post"; $remailer{"nately"} = "<remailer(a)nately.ucsd.edu> cpunk pgp hash latent cut"; $remailer{"xs4all"} = "<remailer(a)xs4all.nl> cpunk pgp hash latent cut post ek"; $remailer{"flame"} = "<tomaz(a)flame.sinet.org> cpunk pgp hash latent cut post ek"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk"; $remailer{"mix"} = "<mixmaster(a)nately.ucsd.edu> cpunk hash latent cut ek"; $remailer{"q"} = "<q(a)c2.org> cpunk hash latent cut ek"; catalyst(a)netcom.com is _not_ a remailer. Last ping: Mon 26 Dec 94 6:00:25 PST remailer email address history latency uptime ----------------------------------------------------------------------- alumni hal(a)alumni.caltech.edu +*********** 3:37 99.99% usura usura(a)replay.com +*********** 4:41 99.99% nately remailer(a)nately.ucsd.edu ++++++++++++ 45:12 99.99% portal hfinney(a)shell.portal.com *******#*#*# 1:52 99.99% penet anon(a)anon.penet.fi +*********** 22:14 99.99% mix mixmaster(a)nately.ucsd.edu ++++++-+++++ 55:05 99.99% ideath remailer(a)ideath.goldenbear.com +******++* + 1:33:50 99.99% vox remail(a)vox.xs4all.nl --...-..-..- 15:24:27 99.99% rahul homer(a)rahul.net ****-----*** 38:39 99.90% soda remailer(a)csua.berkeley.edu ........-. 9:26:00 99.88% desert remail(a)desert.xs4all.nl --.-...---- 14:54:03 99.99% q q(a)c2.org +--++- -- 7:56:13 99.51% c2 remail(a)c2.org ++-++ -- 6:16:43 98.96% xs4all remailer(a)xs4all.nl +**** * **** 4:56 98.85% flame tomaz(a)flame.sinet.org **+* +*** * 6:03 97.30% rebma remailer(a)rebma.mn.org ..-.------*+ 10:22:19 97.32% jpunix remailer(a)jpunix.com **+* +*** * 5:38 97.26% bsu-cs nowhere(a)bsu-cs.bsu.edu *******+* - 8:30:01 93.77% extropia remail(a)extropia.wimsey.com _ .+.-+* 32:24:15 81.95% For more info: http://www.cs.berkeley.edu/~raph/remailer-list.html History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). Options and features cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. oldpgp Remailer does not like messages encoded with MIT PGP 2.6. Other versions of PGP, including 2.3a and 2.6ui, work fine. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. special Accepts only pgp encrypted messages. ek Encrypt responses in relpy blocks using Encrypt-Key: header. Comments and suggestions welcome! Raph Levien

2 1

Re: Moving from 1024-bit -> 2048-bit key.
by grmorgan＠freenet.vcu.edu 17 Dec '03

17 Dec '03

> >Once I've generated a 2048-bit key, how can I update my key on the >keyservers? > First you need to generate a key revocation for your old key and post that to the servers. Then just email your new key to the server. I think the command to revoke a key is PGP -kr <key ID> but check the manual/help files to be sure... I haven't had to revoke a key yet so that's why I'm a little fuzzy. Later... Greg Morgan -- ----------------------------------------------------------------------------- Greg Morgan <grmorgan(a)freenet.vcu.edu> | "I dunno Brain, me and Pipi

2 1

Re: Moving from 1024-bit -> 2048-bit key.
by an169306＠anon.penet.fi 17 Dec '03

17 Dec '03

I am wondering if going to 2048 bits is worth it or not. After a certain point, it doesn't matter whether it takes 200 quadrillion years or 200 decillion years to factor a key, it will be a long time before its factored ;-). Perhaps keep your 1024 bit key, unless you want to expire it and generate a new one. (I did that, expired two keys, replaced them with a 2048 bit key, but realize that a 2048 bit key takes somewhat more time and processing power to do the usual PGP hijinks with. I probably would be better off just using a 1500 bit key, but too late now...) Just remember (so your web of trust stays intact) to sign your new key and use your new key to sign your old one before revoking the old key. This confirms that it IS a new key, rather than someone trying to spoof you. Also, keep a backup of your public and secret keyrings before revoking the old key. This is just common sense. Make sure your backup is secure, though. (I PKZIP my PGP stuff, encrypt it several times with convential key encryption, wnstorm it, THEN lastly use Norton Diskreet with a password that is different from all the rest. If Diskreet is not secure, PGP and wnstorm are, so I don't really care if Diskreet has holes in it or not. Its just there to 'spice things up' for anyone trying to crack the backup, which is stored in a place any party I authorize or I can easily get at it. If anyone sees something weak about this, E-mail me... ;-) The main thing is not to go keysize crazy which I did, as you do pay a performance penalty for those huge keys, and make sure that your other avenues of attack are defended against. (As soon as I can, I am buying a portable 486 or Pentium, since my main weakness is a 'black bag' attack using a good keystroke monitor or a hardware bug, then a simple copy of the secring file when I mount my SecureDrive partion and the Stacker partition inside of that to access my PGP stuff.) ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

voice encryption for portable PCs
by an109574＠anon.penet.fi 17 Dec '03

17 Dec '03

One of the problems with Philip Zimmermann's very worthy voice encryption project is the lack of support for PC laptops, notebooks and palmtops that lack soundcards. If anyone involved in this project is listening, please consider creating a version that will work well with the PCMCIA "Wavejammer" card or some other peripheral soundcard substitute. Cogon Electronics Inc., as has been discussed in this group, markets a voice encryption program called Aquafone that employs Diffie-Hellman+triple DES. The current version uses a push-to-talk feature like a CB radio, but the company plans a fully duplexed version in March. Like the Zimmermann project, the Aquafone uses a standard soundcard. The company reports mixed results using Wavejammer cards. The audio quality afforded by the Wavejammer is noticeably inferior to that of a soundcard. Seems the audio digitization algorithms would have to be tweaked to optimize the fidelity using the Wavejammer. BTW, please don't misconstrue this as an advertisement for Wavejammer or Aquafone. I fully expect Phil's voice encryption software to become the de facto telephonic standard just as PGP became the Internet standard. Cogon's Aquafone, while commendable, has the disadvantage of employing DES. I presume Phil will select a more resilient conventional algorithm. Cogon also lacks Phil's cachet as certified by his fans at Justice and Customs. And, of course, the Zimmermann software will be freeware. Likewise, I mention Wavejammer because that is the only PCMCIA substitute for a soundcard with which I am familiar. If someone can suggest other solutions to the sound card deficiency in PC laptops and notebooks -- short of buying a Mac or restricting one's selection to the few PC portables that have internal soundcards -- please do. I don't regularly monitor this group, so I would greatly appreciate any replies by e-mail. This is an important problem to solve. After cryptanalysis, traffic analysis is the biggest threat to secure telephony. A readily portable PC armed with Phil's voice encryption program represents a real dilemma for traffic analysts since one or both targeted parties are no longer tied to specific telephones. I am neither a telecommunications expert nor a programmer. I am a civil liberties activist. Periodically, from the safety of the United States, I must communicate with people whose courage and idealism puts them in jeopardy of hostile parties. PGP is quite popular in such circles. As you might expect, Phil's voice encryption software is awaited with equal enthusiasm. ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Re: Moving from 1024-bit -> 2048-bit key.
by bryce＠cybernet.co.nz 17 Dec '03

17 Dec '03

>Just remember (so your web of trust stays intact) to sign your new key >and use your new key to sign your old one before revoking the old key. >This confirms that it IS a new key, rather than someone trying to >spoof you. You would want to sign your new key with your old key wouldn't you? Anyone can add a signature to your old key, but only you can add your (old key's) signature to a new key. I agree that signing your old key with your new key is probably a good idea, as it shows that the owners of the key (the same person) trust that the keys belong to who they say they are. ------------------------------------------------------------------------------- Bryce Boland <bryce(a)cybernet.co.nz> Finger for PGP Public Key http://cybernet.co.nz/home/bryce/www/home.html

1 0

PGP at MacWorld Expo?
by crawford＠scruznet.com 17 Dec '03

17 Dec '03

The MacWorld Expo is coming up soon in San Francisco, I believe from the 4th through the 7th of January. There must be _someone_ on this list who works for a company or user group that will be exhibiting (I know for sure the Berkeley Macintosh User's Group always exhibits, as does the Boston Computer Society). Do the world a favor. Distribute PGP from your booth. This being the MacWorld Expo, you'll need mostly Mac disks, but you would want to have some Unix and DOS disks on hand as well. Have flyers about the Digital Telephony Bill, to clue in the legislatively impaired. Imagine what a crowd you'll draw to your booth with a sign reading "Unbreakable encryption software - just $3 a disk". You might even make headlines in the trade rags or the SF newspapers. Certainly BMUG and BCS already have the "infrastructure" to sell freeware disks. But any of your companies out there would do well to sell freeware disks too. I understand, from my own experience of working at MacWorld (no, I won't be exhibiting...), that one of the biggest objections to this will be simply dealing with getting the disks duped and labeled, getting them to the show floor, and dealing with the large number of people who will be purchasing the disks and needing you to make change. This could be no small amount of impact on your booth operations. Another option is to offer PGP free with any purchase of your regular product, or to just distribute flyers about the DT bill with instructions for obtaining PGP from the Internet and online services. Regards, Michael D. Crawford crawford(a)scruznet.com <- Please note change of address. crawford(a)maxwell.ucsc.edu <- Finger me here for PGP Public Key.

1 0