December 2003 - cypherpunks-legacy

uSuRa anonymous remailer [update]
by Alex de Joode 17 Dec '03

17 Dec '03

I have registerd the domain-name replay.COM at InterNic. XS4all has installed some sort of MX-handling for my account, usura(a)xs4all.nl, so my new address wil be usura(a)replay.com. The remailer that is operated from that account is now also reachable at the replay.com address. The usura(a)xs4all.nl remains valid. Raph Levien has updated the address in his automated pinger; here is the updated PGPkey for the usura(a)replay.COM remailer: -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 Comment: Replay and Company Limited. mQCNAi4wTh8AAAEEAMb9gl6NlZHy4FdjADel4d+C+Th7+inTOV4mEsKk+N/QfJAj BN6YPnJ9bm+Ch19FrR1KeTwrpluP6J+GdJrMkVSosvIqBPpSRgOs7nvMhnn3Tnrn uUFZVDYslQ1wRZvFbTpCEW8TzgVhGy6HMznxEC4ttnOq8pFRFUpL3asf+toVAAUR tCt1U3VSYSBhbm9ueW1vdXMgcmVtYWlsZXIgPHVzdXJhQHJlcGxheS5DT00+iQCV AgUQLu0YykpL3asf+toVAQGqhAQAuAnqzqRc5MzYGHmzBVjvUxnEuHiwju4EZmIO OZ5wbxd62gNDV7Nj+M3yj5pnSuwLBL/AOjxLEGRQ49HwvCOLy0wtJWulsg71Pi+y sPkUrP9uq7Aa381Rkwcrcje73WGvFcv89LGtcZlvuiqeNatubbvEgeC9VWb5ovEq jZFLvEI= =snZE -----END PGP PUBLIC KEY BLOCK----- EnJoY. -- Exit! Stage Left. <URL:mailto:usura@replay.com> Alex de Joode <URL:http://www.xs4all.nl/~usura>

1 0

Re: THROUGH THE LOOKING GLASS
by snyderra＠dunx1.ocs.drexel.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 9:13 PM 12/12/94, Sandy Sandfort wrote: >My proposal is not anti-cop; it's anti- *bad* cop. Good cops >*benefit* from protective surveillance; and *all* cops benefit >from having their exact location known when the feces impacts the >turbine. sed -e "s/cop/citizen/g" sed -e "s/cop/employee/g" sed... Bob [For the sed-impared: s - search and replace string 1 with string 2. g - do it multiple times per line.] -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLu0bQeS0CjsjWS0VAQEmzAP+OV59f7hR8CKi6UC13k2x/Fj1QylXPSaj /nR614LzoCeHf7+OAVLN6COx5vGC6yL3EoDL1Ocjm52bWh1nxoIfsGImRBuqRo9R Mcwa6Av+/kn9271O6I6VKLnFU6SYA35vuOAACOAVB647aQ6dAOfheU2fLAd0xEEZ l9mpaNalm7E= =HXZ/ -----END PGP SIGNATURE----- -- Bob Snyder N2KGO MIME, PGP, RIPEM mail accepted snyderra(a)post.drexel.edu PGP & RIPEM keys on key servers When cryptography is outlawed, bayl bhgynjf jvyy unir cevinpl.

1 0

Re: Broadcasts - addressing
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> I have been contemplating how to mark broadcast messages as being > 'for' someone. To foil traffic analysis, you don't want to include > their nym or key-id, for the sake of the your poor CPU, you want to > avoid the need to attempt decryption on everything that passes through. The main problem is how to avoid decrypting _most_ of the traffic, without giving away significant information about the recipient. One approach is to do something some political users have been asking for - implement support for very short keyids (e.g. 4 bits instead of 24-32), so that the keyid isn't a good identifier for the user. Another approach is to include a tag in the Subject: with either a hash of the key (substantially reducing the number of bits), or simply the last hex or two of the keyid - that lets you ignore 15/16th or 255/256th of the traffic, without giving away much.

2 1

Photuris
by amanda＠intercon.com 17 Dec '03

17 Dec '03

> Ah, the hazards of not going to IETF... Good thing the proceedings get publicized in electronic format, eh? :) --Amanda

1 0

RE: Crypto Declaration of Independence
by nobody＠jpunix.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- James A. Donald <jamesd(a)netcom.com> wrote: >Anonymous writes >> I have a proposal for you all. >> >> I have started work on a Crypto Declaration of Independence, based on the >> famous American work which represents Independence. > >This is unwise and unnecessary. > >It is unwise because we do not wish to alert the government >to the fact that the net is largely ungoverned and ungovernable. I do not think it is unwise because we do want to state a position for ourselves. We need to let everyone, including the government, know that we will not stand for crypto-policy which is not in our best interest. No matter what comes, we will continue to use PGP, SHTTP, link-encryption and every method which we have determined to be in our best interest, not what we must have faith in what we are told is in our best interest. >It is unnecessary because crypto is already covered by various >existing declarations on rights. > > > >THE BILL OF RIGHTS This is bullshit, and you know it as well as I do. A steady stream of misinformation has mislead government officials into 'ignoring' these rights when dealing with electronic documents, and encryption specifically. When the administration has something which might be unfavorable in the public eye (ie, Clipper), they quickly try to pass it through, ignoring public cries in the process. How many letters did it take before there were any open hearings about the EES, and then the words of respected professionals were seemingly ignored as the policy was pushed ahead. This was not thought to be an extremist attempt at breaking off from our current government. It's also not supposed to be a confrontational attack. It was intended to be a strong statement, letting all know what we believe in and why we do. We need to declare our independence from being governed by policy which encroaches on our rights, rights which this country was founded in, and rights which are being ignored. Asynchronous -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLuwXDFG1rORFKstdAQEc2wP/Ytq8crc/8YiHlYeO9eoF/Mrx4Q39be9t Y1vD/Hn2qcvXUlWqtqfSPZXzpBV10rNH2qZ0L1A7j/ErUxqXm4Xqz36fWDgxht2m t/KWBXydSBzGDt3HEgmXQ29XE0Ka8w9iaXXq0bKfx87l5XPuknOnAyu8ZBEPj4wM dN5Gc4uMdtM= =vrB+ -----END PGP SIGNATURE-----

1 0

Re: Real-time surveillance of the police
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

Tim wrote: >(The longer-than-I'd-planned section above is meant to show that even >a cop-disliking skeptic like me can be convinced that some good is >done is by them, and that not all cops are bad. Perhaps my on-day >exposure co-opted me the way certain folks in D.C. got co-opted?) Yup! -- Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred.

1 0

Winsock & PGP Integration
by Johnathan Corgan 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- It has been a long discussed and desired feature for MS-Windows users to be able to integrate PGP functionality into the various Windows Sockets based mail and news readers. After a discussion with Raph and Pierre at the cypherpunks meeting this weekend, I took a look at the paradigm that premail uses and gave some thought to how this same concept could be applied in the Windows environment. On a Un*x machine, premail works by impersonating the mail transfer agent and intercepting the flow of mail in each direction, adding encryption, signing, and anonymous remail services in a rather elegant fashion. As the mail system under Un*x (indeed, the entire OS) is designed to be a "piped and glued together" batch of smaller utilities, premail's method works well and is very 'unix-like'. How to achieve the same under Windows with winsock based SLIP or PPP access? The various mail agents such as Eudora and Chameleon are integrated packages that do everything from using SMTP and POP for mail transfer to providing the user agent that reads and writes mail. There really is no simple way to wedge into the package and replace or supplement functionality. Except one. What all of these agents have in common is that they interface with the Windows Sockets API to establish TCP streams that are used in the POP and SMTP protocols. Since these are well known and standardized protocols, this gives us our toehold. Picture this. Using a replacement WINSOCK.DLL, we can intercept those specific API calls that an application would use to open the appropriate sockets and establish a TCP stream to a particular remote socket. For all other API calls, we hand these off to the "real" WINSOCK.DLL (that we have renamed and loaded after our DLL has loaded). Our replacement DLL now has the ability to make the mail application think it is talking to a remote SMTP or POP process, when in fact, it is talking to our agent on the local machine. Our local agent spoofs the SMTP protocol, accepts the mail, does all the neat crypto stuff, and stores the mail in an outbound queue. At whatever preprogrammed intervals, _our_ agent makes the _real_ SMTP call to the remote and delivers the mail. The reverse process would work as well. Our local agent periodically makes a POP call to the remote end, retrieves mail, and stores it in an inbound queue. Again, we do all the neat crypto stuff, and finally the next time Eudora or whatever mail agent is in use makes its POP run, we spoof POP and deliver the mail to the mail program. A little thought on this and I realized that this could be a generalized process. Want to implement an anonymous remailer under Windows? Use this mechanism and replace "neat crypto stuff" with "even neater anonymous remailing stuff." Majordomo for Windows? No problem, same method. By intercepting the flow of mail in each direction, there is no limit to the stuff you could come up with. Why bother fiddling with Windows anyway, when one has all the beauty and power of Un*x at one's disposal (such as Linux)? Well, think about where the personal computing sector is going to grow in about six months or so with the advent of Windows95. Okay, it's a great OS for what it is designed for, but it doesn't have pipes or perl or twenty or thirty command line parameters for every executable. So what. I garauntee that there will be more laptops and desktop PC's with Windows95 than with any flavor of Un*x. If we are to promote and encourage, as well as make the tools for, the use of strong crypto by the average Joe, then Windows is where it is at. I've just enough Windows programming experience to know that the scheme I worked out above is feasible and would work well. On the other hand, I have no experience with Windows Sockets at the api level, nor with any implementation of SMTP or POP (though I know the protocols themselves well.) Yep. It would be cool to write a message in Chameleon (such as this one), press the send button, and have a dialog box pop up asking me if I wanted to sign, encrypt, or remail this message. Or to have it done automatically for me. And this would work with existing mailers today. Sheesh, somebody burst my bubble. Comments, criticisms, suggestions, and especially financial donations, are quite welcome :) ======================================================================= Johnathan Corgan "Violence is the last refuge of the incompetent" jcorgan(a)netcom.com -Isaac Asimov PGP Public Key: http://www-swiss.ai.mit.edu/~bal/pks-toplev.html Or send email to: pgp-public-keys(a)pgp.ai.mit.edu Subj: GET jcorgan ======================================================================= -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLu0w2k1Diok8GKihAQGdnQP8DiqQt3820dhKHY3dbXAZnl/11eEce4z+ /oFZMKVBHlCJAxCSucnK31dcyRbvXiOkAt9x9EMinXC26VWh3sETd+YbaJNznkx6 VmM1UNID2bQ+Xpcc4ANJQx6CgPrRxspr3reVeuFv7QLtKGMy5Mucl5mXGp829f6i Gj7NMlhcu+s= =rgyq -----END PGP SIGNATURE-----

3 2

re: IPSP and Netscape
by John Giannandrea 17 Dec '03

17 Dec '03

Eric Hughes writes: > It may be that IPSP is not the quickest or best way to link security, but > that is not the point I am making here. The original denial of IPSP's > potential utility was made in complete ignorance Widespread acceptance of IPSP may well make SSL irrelevant. I do not believe that anyone at Netscape is claiming otherwise. Nonetheless, widespread implementation of IPSP simply does not exist at this time. We need a solution for our customers _today_. SSL is one working solution to the problem of link security. By publishing our specification of SSL we are inviting others to share in our work, or criticize us for being foolish. I do not believe that we are either arrogant nor ignorant in creating SSL. The market will, of course, help decide. -jg

2 1

What, exactly is elliptic encryption?
by dfloyd＠io.com 17 Dec '03

17 Dec '03

What, exactly is elliptic curve encryption? (Only thing I knew that the NeXT nearly had it in its OS, but the heavy hammer of ITAR squashed that...)

5 6

Re: Broadcasts - addressing
by lcottrell＠popmail.ucsd.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >> I have been contemplating how to mark broadcast messages as being >> 'for' someone. To foil traffic analysis, you don't want to include >> their nym or key-id, for the sake of the your poor CPU, you want to >> avoid the need to attempt decryption on everything that passes through. > >The main problem is how to avoid decrypting _most_ of the traffic, >without giving away significant information about the recipient. >One approach is to do something some political users have been asking for - >implement support for very short keyids (e.g. 4 bits instead of 24-32), >so that the keyid isn't a good identifier for the user. >Another approach is to include a tag in the Subject: with either a hash >of the key (substantially reducing the number of bits), >or simply the last hex or two of the keyid - that lets you ignore >15/16th or 255/256th of the traffic, without giving away much. I am not completely clear on what sort of communication you are trying to protect, and what your threat model is. Are you worried about an attacker noticing that an anonymous ID is getting a lot of messages? If you are using PGP and a message pool, any attacker can decrypt all the messages, and see which correspond to which key, and therefor to which anonymous ID. The only way around this is to use private key crypto. If you are doing that, then you can also use a shared secret to generate a stream of one use message IDs. -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLu09tlVkk3dax7hlAQHLkAP+L8j+9eLcwC7oPpq+OPxDb+C6QJ/H0OX5 3O7uQnU8OZY9YgHsMETh6AY7aTMZYrm9+p3wJu9znFYOwXRIzF+spfyxDDzLVuE1 kQBwGKQt/5YQd6i/jc1Jias6rb/GOBvckYcHKERjSBL638Gi65cC4OFEff5k6ujQ YkkQXkh3JWg= =o5nF -----END PGP SIGNATURE----- -------------------------------------------------- Lance Cottrell who does not speak for CASS/UCSD loki(a)nately.ucsd.edu PGP 2.6 key available by finger or server. Encrypted mail welcome. Home page http://nately.ucsd.edu/~loki/ Home of "chain" the remailer chaining script. For anon remailer info, mail remailer(a)nately.ucsd.edu Subject: remailer-help "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche

2 1