December 2003 - cypherpunks-legacy

Re: Factorisation and Discrete Logs (was Re: EE Times on PRZ)
by Hal 17 Dec '03

17 Dec '03

From: dwa(a)mirage.svl.trw.com (Dana Albrecht) > Choose, at random, "a" such that gcd(a,N) = 1. > > Compute x such that: > > a^x = 1 (mod N) [ Discrete log time! ] DH uses prime moduli, I believe. Solving the DL problem sufficiently to break DH may not let you solve it for composite moduli, not without knowing the factors. Hal

1 0

Re: TEMPEST
by pstemari＠erinet.com 17 Dec '03

17 Dec '03

At 12:32 PM 1/18/95, Timothy C. May wrote: > ... And if nothing is seen with our $10K of equipment, what does this >prove against an attacker who can easily afford to spend 20 or 30 >times that amount to equip a van? > >Cypherpunks have been exploiting technology that is comparatively >_much cheaper_ and which changes the equation. > > ... In general, for reasons many of us have written about here before, and in >particular, because I think spending $10,000 to prove what we already >know--that RF emissions can be detected and demodulated--is a poor use >of money. That $10K would go a long way to getting PGP Phone finished. ... I'm not sure how encryption chages the equation if that van on the street can read the data off your screen and/or printer. Just as cryptanalysis is a necessary component of good cryptography, some sort of VanEck analysis would seem to be required in order to evaluate the utility of methods to block it. What exactly would one need to do to block Van Eck monitoring? I've seen computer rooms that were completely lined with copper sheathing. Is it really necessary to go to that extent? Will aluminum foil and power line conditioning handle it? You can't really tell how effective counter-measures are unless you have some way to see what reduction in emitted signal they provide. --Paul J. Ste. Marie pstemari(a)well.sf.ca.us, pstemari(a)erinet.com

1 0

The Remailer Crisis
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

I don't think I've used "crisis" in a thread I started, so this tells you what I think. The remailers are stagnating, only very slowly adding important features, and the number is not growing...in fact, it's been shrinking. This, as the remailers are under attack. Editorialists are railing against the dangers of anonymity and remailers, and the "Church of Scientology" is threatening lawsuits against remailer operators unless they block certain newsgroups. (Lots of issues, clever workarounds proposed, etc.) Now whether or not the Church of Scientology, or RSADSI (for the RC4 code remailing), or anyone else could legally _win_ such a case is not the issue. Not many remailer operators would be able to mount a defense...they are not, frankly, folks heros as Zimmermann is--and even PRZ is struggling to raise money. Maybe the EFF (ugh) would leap into the fray, but I doubt it. Nope, I fear that the pressures that have driven several remailers to halt operation are just the tip of the iceberg. (Some remailers have quit because of words from their sysadmins, semi-threatening conversations with Brad Templeton--Hi, Brad!--, and so on. Real letters from real lawyers would have a profoundly more chilling effect.) We've debated this stuff many times, but the numbers of remailers are shrinking. Raph Levien summarized the situation nicely in a post to alt.anon-server: "We're down to fifteen remailers now, many of which are unreliable. I would say the remailer net is not in good shape right now. Fortunately, I know of a number of plans to bring new remailers up, as well as restoring old ones." (I hope Raph can share with us soon what some of the plans are, unless he fears revealing this will aid our opponents.) I could see the whole remailer system imploding. A few threatening letters, especially if sent by real lawyers, could demolish the few U.S. sites. And with the Netherlands toying with proposals to ban or limit private encryption, having Holland as the main remaining host for remailers would be rather precarious. We need lots more remailers, in many more countries. What can be done? * We need to get the number of "solid" remailers up from the current dozen or so up into the _hundreds_. * I favor separating the "account that remails" from the "owner of the site," as I have argued in vain in the past. (Example: a willing site gives out or sells many accounts...each is legally separate, and each must be legally challenged. My longer posts dealt with this.) (The owner of the site/machine can take a "hands off" attitude toward what his customers are doing in their accounts. This doesn't stop pressures from being applied, but it slows them down, and (probably) better insulates the owner from legal charges.) * Traffic needs to be increased. Remailers should probably go to constant padding traffic, to do this. Exhorting end-users to use remailers more won't be enough. * More offshore sites are needed. So far, only Canada and the Netherlands are offshore hosts (and Canada is effectively part of the U.S.). Some sites in Russia would be dramatic. Ditto for Asia, South America, etc. * The whole issue of "remailer businesses," with all the usual issues of digital postage, stamps, coupons, etc, has to be resolved. That is, we need to get some movement here. Most remailers are run as projects by students on machines they don't control, or that they can be pressured on, or with a committment to stay in business that will evaporate too easily. A business, with business responsibilities, is usually a more stable solution. I think we need to set some rough targets and brainstorm on how to get to them. For example, the Linux mavens could tell us if Linux-based remailer boxes could be hung on dedicated connections to The Little Garden network, as a specific example. A "black box remailer" such as several folks have suggested (Chaum (in 1981), me, Eric Hughes, others) might be buildable for under a grand. We could ask here for contributions, and might even raise this amount of money. Then each of us who contributed could have "accounts," maybe several of them. Imagine 100 or more "remailers" all on this one machine--I'm deliberately ignoring the security issue for now. Little Garden has stated categorically that they will not tell users what they can or can't do with their machines (though I can think of some cases where they might have to, as with spamming, etc.). Anyway, you can see where I'm headed. My big fear is that the one really major achievement of the Cypherpunks group, the remailers, are not increasing in number and could be knocked out all too easily with some legal attacks. It's time to get cracking on this crisis. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. Cypherpunks list: majordomo(a)toad.com with body message of only: subscribe cypherpunks. FAQ available at ftp.netcom.com in pub/tc/tcmay

1 0

Internet, spamming, etc.
by rparratt＠london.micrognosis.com 17 Dec '03

17 Dec '03

> From owner-cypherpunks(a)toad.com Wed Jan 18 17:00:14 1995 > Date: Wed, 18 Jan 1995 07:54:00 -0800 > I also think this is the one great flaw in the design of the Internet; > namely, that the sender has all the control over what packets flow > over the net. A receiver can ask for a slowdown or cessation, but > there's no obligation to do so. This will be, if anything, the > limiting factor in scalability of the internet. In theory, yes. However, almost all Internet protocols are TCP/IP based. The receiver of a TCP connection can choose not to accept the connection, or to drop it at any time. The window protocol keeps the sender from transmitting faster than any part of the connection can manage. (How do you think ftp transfers between sites with disparate connection speeds would work otherwise?) One could theoretically have a package that sprayed UDP packets at a particular IP address, or even have a modified TCP that ignored disconnects. I think most service providers would regard using such code as being on a par with running a program that tried to telnet sequentially to all known IP addresses, trying common passwords on each. -- Richard Parratt

2 1

Re: Internet, spamming, etc.
by rparratt＠london.micrognosis.com 17 Dec '03

17 Dec '03

> > One could theoretically have a package that sprayed UDP packets > > at a particular IP address, or even have a modified TCP > > that ignored disconnects. I think most service providers > > would regard using such code as being on a par with running > > a program that tried to telnet sequentially to all known IP > > addresses, trying common passwords on each. > > Code exists to do all of the things that you've mentioned. > > That was the original point of the discussion. No doubt it does. But my assertion is that most service providers would cut you off if you tried running such code, especially the latter case. -- Richard Parratt

1 0

Where to Get PGP FAQ
by Michael Paul Johnson 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- ===============================BEGIN SIGNED TEXT============================= WHERE TO GET THE PRETTY GOOD PRIVACY PROGRAM (PGP) (Last modified: 17 January 1995 by Mike Johnson) WHAT IS THE LATEST VERSION? |-----------------+---------------------+---------------------------------| | Platform(s) | Latest Version | Distribution File Names | |-----------------+---------------------+---------------------------------| | DOS, Unix, | Viacrypt PGP 2.7 | disk sets | | Mac, Windows, | | | | or WinCIM/CSNav | | | |-----------------+---------------------+---------------------------------| | DOS, Unix, | MIT PGP 2.6.2 | pgp262.zip (DOS + docs) | | others | | pgp262s.zip (source) | | | | pg262s.zip source on CompuServe | | | | pgp262.tar.gz (source) | | | | pgp262.gz (same as above on DOS)| | | | pgp262.tar.Z (source) | | | | pgp262dc.zip (documentation) | | | | pg262d.zip (docs on CompuServe) | |-----------------+---------------------+---------------------------------| | Macintosh | MIT PGP 2.6 | MacPGP2.6.sea.hqx (binary+docs) | | | | macpgp26.hqx (same as above) | | | | MacPGP2.6.src.sea.hqx (source) | | | | macpgp26.src (same as above) | | | | MacPGP2.6-68000.sea.hqx (binary)| | | | mcpgp268.hqx (same as above) | |-----------------+---------------------+---------------------------------| | Mac Applescript | MacPGP 2.6ui v 1.2 | MacPGP-2.6ui-v1.2.sit.hqx | | | + some beta versions| MacPGP2.6ui_V1.2_sources.cpt.hqx| | | based on MIT PGP | MacPGP2.6uiV1.2en.cpt.hqx | | | 2.6.2 | MacPGP2.6uiV1.2src.cpt.hqx | | | | MacPGP2.6uiV1.2.68000.hqx | | | | MacPGP2.6.2.beta*.sea.hqx | | | | MacPGP2.6.2.beta*.src.sea.hqx | |-----------------+---------------------+---------------------------------| | Amiga | PGP 2.6.2 Amiga 1.4 | pgp262-a14-000.lha | | | | pgp262-a14-020.lha | | | | pgp262-a14-src.lha | |-----------------+---------------------+---------------------------------| | Atari | Atari PGP 2.6.1 | pgp261st.zip | | | | pgp261b.lzh | |-----------------+---------------------+---------------------------------| | Non-USA version | PGP 2.6.i from | pgp26i.zip | | to avoid RSAREF | Stale Schumacher | pgp26is.zip | | license. | | pgp26is.tar.gz | |_________________|_____________________|_________________________________| PGP BOOKS Protect Your Privacy: PGP: Pretty Good Privacy A Guide for PGP Users by William Stallings by Simson Garfinkel Prentice Hall PTR O'Reilly & Associates, Inc. ISBN 0-13-185596-4 ISBN 1-56592-098-8 US $19.95 US $24.95 If you order Stallings' book from National Computer Security Association (74774.1326(a)compuserve.com) they will donate $1 of the price to Phil Zimmermann's legal defense fund. WHERE CAN I GET THE PGP VERSION DIRECTLY FROM PHILIP ZIMMERMANN? Get the MIT version. See http://web.mit.edu/network/pgp-form.html WHAT IS PGP 2.6.i? Stale Schumacher <staalesc(a)ifi.uio.no> released an international version of PGP built the "right way." By "right way," I mean that it uses the latest MIT code, but uses a different rsaglue.c to use the mpilib instead of RSAREF for RSA calculations, thus including all the latest bug fixes and features in the main freeware PGP code line, but frees non-USA persons from the limitations of the RSAREF license. This release has been as strongly endorsed by Philip Zimmermann as he can do without incriminating himself. Naturally, by not using the RSAREF code for RSA calculations, this version is not legal for use in the USA (other than limited research, etc.), but is fine anywhere else (like Canada) were RSA patents don't hold. Note that the latest version of Stale Schumacher's PGP is 2.6.i, 2.6i (without the second .) was a beta test version that has been superceded. WHAT IS PGP 2.6ui? The "unofficial international" versions are really just PGP 2.3a, modified just enough to make it compatible with MIT PGP 2.6, but do not include all of the fixes in MIT PGP 2.6 and MIT PGP 2.6.1. They have a "ui" somewhere in their file names. WHERE CAN I GET VIACRYPT PGP? Contact Viacrypt in Phoenix, Arizona, USA. The commecial version of PGP is fully licensed to use the patented RSA and IDEA encryption algorithms in commercial and government environments in the USA and Canada. It is fully compatible with, functionally the same as, and just as strong as the freeware version of PGP. Due to limitations on ViaCrypt's RSA distribution license, ViaCrypt only distributes executable code and documentation for it, but they are working on making PGP available for a variety of platforms. Call or write to them for the latest information. The latest version number for Viacrypt PGP is 2.7. Here is a brief summary of Viacrypt's currently-available products: 1. ViaCrypt PGP for MS-DOS. Prices start at $99.98 2. ViaCrypt PGP for UNIX. Includes executables for the following platforms: SunOS 4.1.x (SPARC) IBM RS/6000 AIX HP 9000 Series 700/800 UX SCO 386/486 UNIX SGI IRIX AViiON DG-UX(88/OPEN) Prices start at $149.98 Executables for the following additional platforms are available upon request for an additional $30.00 charge. BSD 386 Ultrix MIPS DECstation 4.x 3. ViaCrypt PGP for WinCIM/CSNav. A special package for users of CompuServe. Prices start at $119.98 Please contact ViaCrypt for quantity discount pricing. Orders may be placed by calling 800-536-2664 during the hours of 8:30am to 5:00pm MST, Monday - Friday. They accept VISA, MasterCard, AMEX and Discover credit cards. If you have further questions, please feel free to contact: Paul E. Uhlhorn Director of Marketing, ViaCrypt Products Mail: 9033 N. 24th Avenue Suite 7 Phoenix AZ 85021-2847 Phone: (602) 944-0773 Fax: (602) 943-2601 Internet: viacrypt(a)acm.org Compuserve: 70304.41 WHERE CAN I GET THE FREEWARE PGP? These listings are subject to change without notice. If you find that PGP has been removed from any of these sites, please let me know so that I can update this list. Likewise, if you find PGP on a good site elsewhere (especially on any BBS that allows first time callers to access PGP for free), please let me know so that I can update this list. Because this list changes frequently, I have not attempted to keep it complete, but there should be enough pointers to let you easily find PGP. There are several ways to get the freeware PGP: ftp, WWW, BBS, CompuServe, email ftp server, and sneakernet (ask a friend for a copy). Just don't ask Philip Zimmermann directly for a copy. FTP SITES IN NORTH AMERICA There are some wierd hoops to jump through, thanks to the U. S. Department of State, at many of these sites. This is apparently because the U. S. Department of State wants to make it easier for people outside of North America to develop, distribute, use, or sell strong cryptographic software than people inside of the USA and Canada -- at least that is the effect of their rules. Telnet to net-dist.mit.edu, log in as getpgp, answer the questions, then ftp to net-dist.mit.edu and change to the hidden directory named in the telnet session to get your own copy. MIT-PGP is for U. S. and Canadian use only, but MIT is only distributing it within the USA (due to some archaic export control laws). You can also get PGP from: ftp.csn.net/mpj See ftp://ftp.csn.net/mpj/README.MPJ ftp.netcom.com/pub/mp/mpj See ftp://ftp.netcom.com/pub/mp/mpj/README.MPJ ftp.netcom.com/pub/gr/grady/PGP (U. S. and Canada only). ftp.eff.org Follow the instructions found in README.Dist that you get from one of: ftp://ftp.eff.org/pub/Net_info/Tools/Crypto/README.Dist gopher.eff.org, 1/Net_info/Tools/Crypto gopher://gopher.eff.org/11/Net_info/Tools/Crypto http://www.eff.org/pub/Net_info/Tools/Crypto/ ftp.csua.berkeley.edu (for U. S. or Canadian users) /pub/cypherpunks/pgp/ ftp.gibbon.com /pub/pgp/README.PGP (OS/2 users see also /pub/gcp/gcppgp10.zip) ftp.wimsey.bc.ca /pub/crypto/software/dist/README WORLD WIDE WEB ACCESS http://web.mit.edu/network/pgp-form.html http://www.ifi.uio.no/~staalesc/PGPVersions.html http://www.mantis.co.uk/pgp/pgp.html http://rschp2.anu.edu.au:8080/crypt.html http://www.eff.org/pub/Net_info/Tools/Crypto/ http://community.net/community/all/home/solano/sbaldwin http://www.cco.caltech.edu/~rknop/amiga_pgp26.html COMPUSERVE GO NCSAFORUM. Follow the instructions there to gain access to Library 12: Export Controlled. PGP may be other places, too. Compuserve file names are even more limited than DOS (6.3 instead of the already lame 8.3), so the file names to look for are PGP262.ZIP, PG262S.ZIP (source code), PGP262.GZ (Unix source code) and PG262D.ZIP (documentation only). BULLETIN BOARD SYSTEMS Colorado Catacombs BBS Mike Johnson, sysop Mac and DOS versions of PGP, PGP shells, and some other crypto stuff. Also the home of some good Bible search files and some shareware written by Mike Johnson, including ATBASH, DLOCK, CRYPTA, CRYPTE, CRYPTMPJ, MCP, MDIR, DELETE, PROVERB, SPLIT, ONEPAD, QUICRYPT, etc. v.FAST/v.32bis/v.42bis, speeds up to 28,800 bps 8 data bits, 1 stop, no parity, as fast as your modem will go. Use ANSI terminal emulation, or if you can't, try VT-100. Free access to PGP. If busy or no answer, try again later. For free access: log in with your own name, answer the questions, then select [Q]uestionaire 3 from the [M]ain menu. (303) 772-1062 Longmont, Colorado number - 2 lines. (303) 938-9654 Boulder, Colorado number forwarded to Longmont number intended for use by people in the Denver, Colorado area. The Freedom Files BBS, DeLand Florida, USA 904-738-2691 Exec-Net, New York, NY, USA (Host BBS for the ILink net) 914-667-4567 The Ferret BBS (North Little Rock, Arkansas) (501) 791-0124 also (501) 791-0125 Special PGP users account: login name: PGP USER password: PGP CVRC BBS 317-791-9617 CyberGold BBS 601-582-5748 Self-Governor Information Resource, 915-587-7888, El Paso, Texas, USA In the UK, try 01273-688888 MAUS BBS (+49 781 38807) Offenburg, Germany - angeschlossen an das MausNet OTHER FTP SITES ftp.informatik.uni-hamburg.de /pub/virus/crypt/pgp This site has most, if not all, of the current PGP files. ftp.leo.org /pub/com/os/os2/crypt ftp.ox.ac.uk (163.1.2.4) /pub/crypto/pgp This is a well organized site with most of the current PGP files as well as shells and mailer scripts. ftp.netcom.com /pub/dc/dcosenza -- Some crypto stuff, sometimes includes PGP. unix.hensa.ac.uk /pub/uunet/pub/security/virus/crypt/pgp ftp.ee.und.ac.za /pub/crypto/pgp ftp.csua.berkeley.edu /pub/cypherpunks/pgp (DOS, MAC) ftp.demon.co.uk /pub/amiga/pgp /pub/archimedes /pub/pgp /pub/mac/MacPGP ftp.informatik.tu-muenchen.de ftp.funet.fi ftp.dsi.unimi.it /pub/security/crypt/PGP atari.archive.umich.edu /pub/atari/Utilities/pgp261st.zip (Atari) ftp.tu-clausthal.de (139.174.2.10) (Atari ST/E,TT,Falcon) /pub/atari/misc/pgp/pgp261b.lzh wuarchive.wustl.edu /pub/aminet/util/crypt src.doc.ic.ac.uk (Amiga) /aminet /amiga-boing ftp.informatik.tu-muenchen.de /pub/comp/os/os2/crypt/pgp23os2A.zip (OS/2) iswuarchive.wustl.edu pub/aminet/util/crypt (Amiga) nic.funet.fi (128.214.6.100) /pub/crypt ftp.uni-kl.de (131.246.9.95) /pub/aminet/util/crypt qiclab.scn.rain.com (147.28.0.97) pc.usl.edu (130.70.40.3) leif.thep.lu.se (130.235.92.55) goya.dit.upm.es (138.4.2.2) tupac-amaru.informatik.rwth-aachen.de (137.226.112.31) ftp.etsu.edu (192.43.199.20) pencil.cs.missouri.edu (128.206.100.207) ftp.csua.berkeley.edu kauri.vuw.ac.nz nctuccca.edu.tw /PC/wuarchive/pgp/ ftp.fu-berlin.de:/mac/sys/init/MacPGP2.6uiV1.2en.cpt.hqx.gz Also, try an archie search for PGP. FTPMAIL For those individuals who do not have access to FTP, but do have access to e-mail, you can get FTP files mailed to you. For information on this service, send a message saying "help" to ftpmail(a)decwrl.dec.com. Another e-mail service is from nic.funet.fi. Send mail to mailserv(a)nic.funet.fi with the word HELP. For the ftp sites on netcom, send mail to ftp-request(a)netcom.com containing the word HELP in the body of the message. To get pgp 2.6.i by email: Send a message to hypnotech-request(a)ifi.uio.no with your request in the Subject: field. Subject What you will get GET pgp26i.zip MS-DOS executable (uuencoded) GET pgp26is.zip MS-DOS source code (uuencoded) GET pgp26is.tar.gz UNIX source code (uuencoded) For FAQ information, send e-mail to mail-server(a)rtfm.mit.edu with send usenet/news.answers/ftp-list/faq in the body of the message. MACPGP OPTIONS There are multiple parallel efforts to write an up-to-date MacPGP. See the following for the latest MacPGP beta stuff. Zbigniew Fiedorowicz <fiedorow(a)math.ohio-state.edu> has updated his MacPGP to support Apple events, and his distribution comes with complete source code. Grady's netcom directory contains a different version, about which he says "This latest bug release beta 1.23 fixes several relatively minor bugs. Source to this version is NOT available, so its use should be restricted to experimentation only." ftp://ftp.csn.net/mpj/README.MPJ ftp://ataxia.res.wpi.edu/pub/mac-pgp/README ftp://highway.alinc.com/users/jordyn/mac-pgp/README ftp://ftp.netcom.com/pub/gr/grady/PGP/MacPGP262b1.23.seq.hqx.asc PGP FOR WINDOWS, WINDOWS NT, AND WINDOWS 95 There isn't one, yet, that I know of (at least not a true native Windows application). There are several good shells that call the DOS PGP for the actual work, though. I use Viacrypt's, but there are others available as shareware or freeware at most of the sites listed above for PGP itself. IS MY COPY OF PGP GOOD? If you find a version of the PGP package that does not include the PGP User's Guide, something is wrong. The manual should always be included in the package. PGP should be signed by one of the developers (Philip Zimmermann, Jeff Schiller, Viacrypt, Stale Schumacher, etc.). OTHER PGP DOCUMENTATION For more information on the "time bomb" in PGP, see ftp://ftp.csn.net/mpj/pgpbomb.asc More PGP details are at http://www.pegasus.esprit.ec.org/people/arne/pgp.html Windows shells documentation http://www.LCS.com/winpgp.html Watch for the full PGP FAQ on alt.security.pgp. LANGUAGE MODULES These are suitable for most PGP versions. I am not aware of any export/import restrictions on these files. German * _UK:_ ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp23_german.txt * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp_german.txt * _US:_ ftp://ftp.csn.net/mpj/public/pgp/PGP_german_docs.lha Italian * _IT:_ ftp://ftp.dsi.unimi.it/pub/security/crypt/PGP/pgp-lang.italian.tar.gz * _FI:_ ftp://ftp.funet.fi/pub/crypt/ghost.dsi.unimi.it/PGP/pgp-lang.italian.tar.gz * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp-lang.italian.tar.gz Japanese * _UK:_ ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp23_japanese.tar.gz * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp-msgs-japanese.tar.gz Lithuanian * _UK:_ ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp23_lithuanian.zip * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp23ltk.zip Russian * _UK:_ ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp26_russian.zip * _RU:_ ftp://ftp.kiae.su/unix/crypto/pgp/pgp26ru.zip * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp26ru.zip Spanish * _IT:_ ftp://ftp.dsi.unimi.it/pub/security/crypt/PGP/pgp-lang.spanish.tar.gz * _FI:_ ftp://ftp.funet.fi/pub/crypt/ghost.dsi.unimi.it/pgp-lang.spanish.tar.gz * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp-lang.spanish.tar.gz Swedish * _UK:_ ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp23_swedish.txt * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp_swedish.txt MAILINGLISTE FUER PGP UND VERWANDTES (PGP MAILING LIST IN GERMAN) Die Listenadresse: pgp-friends(a)fiction.pb.owl.de Die *Request*adresse (fuer subscribe/unsubscribe und andere Administra- tiva): pgp-friends-request(a)fiction.pb.owl.de WHAT IS ALL THIS NONSENSE ABOUT EXPORT CONTROLS? For a detailed rant, get ftp://ftp.csn.net/mpj/cryptusa.zip WHAT INTELLECTUAL PROPERTY RESTRICTIONS EXIST IN THE USA? MIT PGP is only for personal, noncommercial use because of restrictions on the licensing of both the RSA algorithm (attached to RSAREF) and the IDEA algorithm. PKP/RSADSI insist that we use RSAREF instead of the mpi library for reasons that make sense to them. For commercial use, use Viacrypt PGP, which is fully licensed to use both the RSA and IDEA algorithms in commercial and corporate environments (as well as personal use, of course). Another restriction is due to an exclusive marketing agreement between Philip Zimmermann and Viacrypt that applies to the USA and Canada only. Viacrypt has exclusive rights to market PGP commercialy in this area of the world. This means that if you want to market PGP commercially in competition with Viacrypt in the USA or Canada, you would have to create a new implementation of the functions of PGP containing none of Philip Zimmermann's copyrighted code. You are free to modify existing PGP code for your own use, as long as you don't sell it. Phil would also appreciate your checking with him before you distribute any modified versions of PGP as freeware. "PGP", "Pretty Good Privacy" and "Phil's Pretty Good Software" are trademarks owned by Philip Zimmermann. This means that if you modify an older version of PGP that was issued under the copyleft license and distribute it without Phil's permission, you have to call it something else. This avoids confusing all of us and protects Phil's good name. WHAT INTELLECTUAL PROPERTY RESTRICTIONS EXIST IN CANADA? MIT PGP is only for noncommercial use because of restrictions on the licensing of the IDEA algorithm. Because the RSA algorithm isn't patented in Canada, you are free to use the mpi library instead of RSAREF, if you want to, thus freeing yourself of the RSAREF license associated with the RSAREF copyright, which is valid in Canada. For commercial use, use Viacrypt PGP, which is fully licensed to use the IDEA algorithm in commercial and corporate environments. The exclusive marketing agreement with Viacrypt also applies in Canada. See the section on USA intellectual property restrictions for more details. WHAT INTELLECTUAL PROPERTY RESTRICTIONS EXIST OUTSIDE NORTH AMERICA? MIT PGP is only for noncommercial in areas where there is a patent on software implementations of the IDEA algorithm. Because the RSA algorithm isn't patented outside of the USA, you are free to use the mpi library instead of RSAREF, if you want to, thus freeing yourself of the RSAREF license restrictions. The RSAREF copyright holds outside of the USA, even though the RSA patent does not. The IDEA conventional block cipher is covered by US Patent 5,214,703 and European patent EP 0 482 154 B1. IDEA is a trademark of Ascom-Tech AG. Commercial users of IDEA (including commercial use of PGP) may obtain licensing details from Ph. Baumann, IDEA Lizenz Ascom Tech AG Postfach 151 CH-4502 Solothurn Switzerland Tel ++41 65 242828, Fax ++41 65 242847. WHAT IS COMMERCIAL USE? Use some common sense. If you are running a business and using PGP to protect credit card numbers sent to you electronically, then you are using PGP commercially. Your customers, however, need not buy the commercial version of PGP just to buy something from you, if that is the only commercial use they make of PGP (since they are spending, not making, money with PGP). If you are just encrypting love letters or other personal mail (for which you don't get paid) on your own personal computer, that is not commercial. If you are encrypting official business mail on your for-profit corporation's computer with PGP, that is commercial use. Note that there are some gray areas not covered above, and the patent owners of RSA and IDEA may differ from my interpretation in the areas not covered above, so if you are in doubt, you should consider the licensing of Viacrypt PGP (or outside of North America, direct licensing of IDEA) to be cheap legal insurance. Indeed, the license fee is probably a lot cheaper than a legal opinion from a lawyer qualified to make such a judgement. Note that I am not a lawyer and the above is not legal advise. Use it at your own risk. ARE MY KEYS COMPATIBLE WITH THE OTHER PGP VERSIONS? If your RSA key modulus length is less than or equal to 1024 bits (I don't recommend less, unless you have a really slow computer and little patience), and if your key was generated in the PKCS format, then it will work with any of the current PGP versions (MIT PGP 2.6, PGP 2.6ui, or Viacrypt PGP 2.7). If this is not the case, you really should generate a new key that qualifies. MIT PGP 2.6.2 should be able to use 2048 bit keys. Generation of 2048 bit keys was supposed to automatically be enabled in PGP 2.6.2 in December, 1994, but a bug caused the actual key limit to be 2047 bits. MORE WORLD WIDE WEB URLs http://draco.centerline.com:8080/~franl/pgp/pgp-mac-faq-hinely.html http://draco.centerline.com:8080/~franl/pgp/pgp.html http://draco.centerline.com:8080/~franl/crypto/cryptography.html http://www.pegasus.esprit.ec.org/people/arne/pgp.html http://rschp2.anu.edu.au:8080/crypt.html http://ibd.ar.com/PublicKeys.html http://www.ifi.uio.no/~staalesc/PGPversions.html WINDOWS SHELLS Several shells for running PGP with Microsoft Windows are available at the same places PGP can be found. MACPGP KIT ftp://duke.bwh.harvard.edu:/pub/adam/mcip/MacPGP_icons.sit.hqx ftp://duke.bwh.harvard.edu:/pub/adam/mcip/MacPGPkit.hqx ftp://duke.bwh.harvard.edu:/pub/adam/mcip/MacPGPkitSources.sit.hqx BUGS See the documentation that comes with PGP in the latest versions for bugs in the older versions. The latest versions of PGP may not fully wipe all traces of plain text from a file when given the -w option. For more information, see http://www.mit.edu:8001/people/warlord/pgp-faq.html BETSI - BELLCORE'S TRUSTED SOFTWARE INTEGRITY SYSTEM For information on this service, send mail to certify(a)bellcore.com with the subject help, or check http://info.bellcore.com/BETSI/betsi.html INTEGRATING PGP AND PINE Send blank e-mail to slutsky(a)lipschitz.sfasu.edu with Subject: mkpgp to get a c-shell script to interface PGP and Pine. Send a second message with Subject: addtomkpgplist if you want updates sent you automatically. HOW DO I PUBLISH MY PGP PUBLIC KEY? There are lots of ways. One way is to use a key server. Send mail to one of these addresses with the single word "help" in the subject line to find out how to use a key server. pgp-public-keys(a)pgp.iastate.edu pgp-public-keys(a)pgp.mit.edu pgp-public-keys(a)pgp.ai.mit.edu public-key-server(a)pgp.ai.mit.edu pgp-public-keys(a)cs.tamu.edu pgp-public-keys(a)chao.sw.oz.au pgp-public-keys(a)jpunix.com pgp-public-keys(a)dsi.unimi.it pgp-public-keys(a)kiae.su pgp-public-keys(a)fbihh.informatik.uni-hamburg.de There is also an experimental public key server at http://ibd.ar.com/PublicKeys.html There is an excellent commercial key certification and publication service, too. For $20/year or so, you can have your key officially certified and published in a "clean" key database that is much less susceptible to denial-of-service attacks than the other key servers. People need not pay any fees to retrieve keys so published. Send mail to info-pgp(a)Four11.com for information, or look at http://www.Four11.com/ You can also mail your key to pgp-public-keys(a)c2.org, and it will be posted to the subscribers of that mailing list, sent to the keyservers, and posted to alt.security.keydist. To subscribe to the mailing list, send a message to majordomo(a)c2.org with "subscribe pgp-public-keys" in the body of the message. Another way is to upload it to the PGP public keys area of the Colorado Catacombs BBS (303-772-1062). Another way is to just send it to your correspondents. You could add it to your .plan file so that finger returns your key. You could add it to some of your postings. No matter which way you do it, you should have your key signed by someone who verifies that your key belongs to you, so that you don't have someone else generating a key that has your name on it, but that isn't yours. Here is my public key: - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.7 mQCNAi4PT2QAAAEEAPPCZnrshEJ9PSnV+mXEwjM4kzJF0kyg2MnLMzo83vWI40ei jogncqdkXT0c2TQWg+Bsu9ckFoXdId0utumYv0aqd8yI/oU/DwJ1zJrqRL2PFbxe ZLofHoKFjvq1TiNiJq9ps3jW6iYS4IU1SzyKhjmyE+K0+WyrPPX0zg8FAL9FAAUR tCdNaWNoYWVsIFBhdWwgSm9obnNvbiA8bXBqQGNzbi5vcmc+IG1wajiJAJUDBRAv Cw5o1TIhz19jpbkBARptA/9RHd27Io/48e3KRj/i/rptFTxdUR2DZTn+OrW23aNC 1fjH3YJl1C43lzipUL2Si6Paj1LKKBSVMVYAly8XMP5S+wEokzYffqsZfv6VrC7f YozSNLsHbjDdY6JjRY6LHTU0hAe3grzWpBJPwc9oXsUJynrGk7jTCs+6nkrHddTa zokAlQIFEC4bdyFleYS4x6lm3QEBm0AD/RHDmaKe2VQOAfJw1t6jIiIwegu7yNZo JJqIZK350NTUD9tQKj6Ciu/lNjE4KVF/dceMPrNKihbJTPd6Gi2vM9gu6eFU4TZg HE9T468oU5zfuZxmudcYGUXk1uWdJjGnTXzq0ZpObtYxbHs0OUdPga+HMclBI6ij jzKQOQqb+aQsiQCVAgUQLg9Zuz9nBjyFM+vFAQErIwP8DuS/3ULVlkhG2RsL2T2W xY6A6c7zAbxsYxqNpyjjrlnmWVYP5jxAIx1JZyjC04EZ9bRa/VtnW55t4KmDUvrq knsL4E4TGuSA+pFUKy0suJV6soZ5I5mjfJe3FgphfuYdA+sen3x5/t9QbgiIpL5L 7OeYbGknCtWwdlGWEneFdSyJAJUCBRAuD1l59fTODwUAv0UBAUFMBACHi7hW6fta E+4vp+xeJealpoZ94u13duJGP9o4wAbV4e6FV1Z6PHvWiubIpN00HZhXnpumwTcl D8qEG5gOjQ1KRGep4zZL4R/tpkSDpDji5cbnamoJlSV20J5h86zdosJH1IyVzpjf OalLAHXAo/Tn6033Ou41hUooEtYQgUBjtbQrTWljaGFlbCBQYXVsIEpvaG5zb24g PG0ucC5qb2huc29uQGllZWUub3JnPokAlQMFEC8LDn/VMiHPX2OluQEBiGkD/0Qu BxvMErp6BCaQVmh1Zxp0dghYZmAPK/15xDGLoTLcv7+hltDqntlZcH3Pb8UGTYmW /v/+e0wPErTl3Fp+KV/tzcGqo/n2GwKAcrk6cYpMVysLr6c47Sf1c0/EE4Xhczx3 sfPxLBoJ6z8n/sq5WNfjgfOM9ol/hXUZpaJ+Ykf9tCBNaWNoYWVsIEpvaG5zb24g PG1wakBuZXRjb20uY29tPokAlQMFEC8LDpTVMiHPX2OluQEBNWYD/iwuOas0LcM/ 7UFhWc6qZBTaQ2i0/fLdSq1NbnqZ/qAga4Gp+wNmBI3xvNBnF1Vm76Ss9G2PWgIE qzcJWLYULGVoT/rFwOLST4TXYK8m/juVKfinmntkwWeDRkXqlGWnvbndjNTYGwEn D+gTouzLAeYrd955OqxaIaVaNRWGlZBbtChNaWtlIEpvaG5zb24gPDcxMzMxLjIz MzJAY29tcHVzZXJ2ZS5jb20+iQCVAwUQLwsOqdUyIc9fY6W5AQGWsgP/dq1QNJ/1 ZsD3CJlcIGF/bbQwd6tozd2eXS4GQMwvuanHIuraGRVvAd1QodmWMQnVVOPOat5r Wq9vOBGan2GFp/OTNCBJTS664Ezdi8cpIdcLYasHJEBZ1mWCrTXLdvRlvNtL80x3 SmZH28m9Z3QMghzUg3q6KuZUy58UCgnMAx20K01pY2hhZWwgUC4gSm9obnNvbiA8 bXBqb2huc29Abnl4LmNzLmR1LmVkdT6JAJUDBRAvCw6+1TIhz19jpbkBAa77A/4q SsVT/+VsAHwmAn/JuXnNDOIqkqRlMMFWoB1QySEI8QHljrFJU5UphqWbVGhVNazv FSMAtTkgbM6R6n1BTx9EObR4y3ZmfRHTZbSsDOYmtF2pWxCG/qfg9cOKJBD4oxB2 ORo74hXecb0dGrDwBgl0OEJ7BF4FMr1wzWhgodsP97QtRG8gbm90IHVzZSBmb3Ig ZW5jcnlwdGlvbiBhZnRlciAyNyBKdW5lIDE5OTYuiQCVAwUQLwsO09UyIc9fY6W5 AQFyvgQAhPbYYVsYiyv67rKOEhROw/QKluloHZIvx53eWxVQ7KNpp/jg+KBVjL7N yoteDcofbVseBugAiAFPJgNQVCGfG5w6rtvMm4tN8oTz/4Q+vf6DyCkQnj+Qu6KO Fo80TgazVGeteODtCDiZg4wMUv0TNTd80NV6hm0Ygd/pmw+7A7w= =htAN - -----END PGP PUBLIC KEY BLOCK----- TIME STAMP SERVICES Mail sent to Time S. Tamp <timestamp(a)lorax.mv.com> will be returned, signed with its own private key. REPRODUCING THIS FAQ Permission is granted to distribute unmodified copies of this FAQ. To get the latest version of this FAQ, get ftp://ftp.netcom.com/pub/mp/mpj/getpgp.asc or send mail to ftp-request(a)netcom.com with the line SEND mp/mpj/getpgp.asc in the body of the message, or send blank mail to mpjohnso(a)nyx.cs.du.edu. This FAQ is also archived at rtfm.mit.edu with a very long file name. There are many other frequently asked questions. Most of them are covered in the documentation that comes with PGP or in one of the books about PGP. Send corrections to mpj(a)netcom.com. I regret that I lost some of the corrections people sent me on the last round of this FAQ, so if I missed yours, please send it again. Thanks. ___________________________________________________________ |\ /| | | | | \/ |o| | Michael Paul Johnson Colorado Catacombs BBS 303-772-1062 | | | | / _ | mpj(a)csn.org aka mpj(a)netcom.com m.p.johnson(a)ieee.org | | |||/ /_\ | ftp://ftp.csn.net/mpj/README.MPJ CIS: 71331,2332 | | |||\ ( | ftp://ftp.netcom.com/pub/mp/mpj/README -. --- ----- .... | | ||| \ \_/ |___________________________________________________________| -----BEGIN PGP SIGNATURE----- Version: 2.7 iQCVAgUBLxvrHPX0zg8FAL9FAQHz9AQAjdyLzJ2L+PSkqL0nZ4ULiq4ReHdYfLrX DlBvkM9JG0jCgpDmcWkWg4IEUwJ8VoKnjFYaUgbw3CkCoIZYRekXrUkRgoZSq5TV BdADxEXJabF7It3e6jH2ICVNSYdsfe/4xh+8F7v7CKzSZubtwaLOIbZ+CSBVi3D0 3iyn6+zrZVo= =5zak -----END PGP SIGNATURE-----

1 0

Surety Technologies announces: Digital Notary System is on-line
by stuart＠surety.com 17 Dec '03

17 Dec '03

Many readers of this list have heard about the work that Scott Stornetta and I have done, beginning as Bellcore researchers a few years ago, on the problem of cryptographically secure digital time-stamping. In 1993 Bellcore spun off a company in order to commercialize this work. The company is called Surety Technologies, and we call our product and service the Digital Notary(tm) System. I am happy to report that we have just launched the product. To read about it, as well as to get the software, please visit our World-Wide Web home page: http://www.surety.com You can get the software and installation instructions directly by anonymous ftp to ftp.surety.com in the directory /dns/windows. Scott and I would both like to thank those readers of the list who have offered us their support, encouragement, and advice over the years. Stuart Haber | Surety Technologies provides Chief Scientist | the Digital Notary(tm) System. Surety Technologies, Inc. | General info: info(a)surety.com stuart(a)surety.com | (201) 701-0600, fax -0601

1 0

internet mag
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

This month's issue of Internet World Magazine deals primarily with internet security. I'm am not going to review everything in the mag but I'll list the table of content: Better Safe: Danger lurks on the Info Highway. You must take precaution to reduce your riks. By Dave Taylor and Rosalind Resnick Getting Cryptic: Phil Zimmermann's PGP gives you powerful encryption to keep your messages safe from prying eyes. Read all about it. By William Stalling. (Introductory article about PGP. Nothing we, here, don't already know) Securing the Enterprise: Connectiong your corporation to the Internet can be a security nightmare. Firewalls are the main line of defense. By Alton Hoover (An overview of Firewalls, application-layer gateways and token-based authentication schemes) Beyond the Firewall: The latest firewall technology not only detects intruders, but strikes back. By Winn Schwartau (Very interesting article. Here are some quotes to wet your appetite: Wouldn't it be nice if a computer system attacked from the Internet responded to the attack by striking back at the intruder? This is exactly what Sidewinder's implementation of type enforcement does.....It will detect the intrusion immediately....As soon as a violation occurs, a silent alarm is activated....sidewinder can be configured to react in any number of ways, once an attack has been detected...it can shut the intruder cold...(or)...it can invoke a mechanism that would record all the information from whence came the attack....By luring the attacker into a false sense of security, the hacker would continue trying to break in, unaware that every step was being recorded... Cashing In: As Internet commerce expands, a host of companies are vying to establish their system as the basis for cyberbanking and credit-card transactions. By Lisa Morgan Business Browser: New versions of Mosaic with built-in encryption promise to keep your transactions safe. By Richard W. Wiggins Unlawful Entry Crackers can feasts on your data if you fail to plug your leaky Unix system By Aaron Weiss (Five Ways to crack a Unix System) It's Alive: Although the furor has subsided, reports of Clipper's death are greatly exaggerated. The government's controversial eavesdropping effort lives on. By Steven Vaughan-Nichols Building Trust The chief executives of Trusted Information Systems -Steve Crocker and Steve Walker- talk about encryption, CyberCash, Clipper, and more. By Jeff Ubois. All in all a rather interesting mag. Check it out. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ wizard(a)alpha.c2.org Give me the liberty to know, to utter, and to argue freely according to conscience, above all liberties. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Anonyous Cash through Options Trading
by pcw＠access.digex.com 17 Dec '03

17 Dec '03

Several months ago, there was a discussion at length about how one could use the futures and options markets to transfer funds anonymously. This week's edition of Forbes magazine (Jan 30, 95) has the headline, "OIL! GUNS! GREED! Was Chase Manhattan ripped off by arms traffickers?" In the story, Forbes guesses that some suspiciously large losses in the options market could have been a smoke screen for money laundering: Oil traders do big business in unlisted options, providing a further smoke screen. Perkins points to deals in which Harris would buy a put option on a cargo of crude from a friendly counterpart like Bayoil and resell a similar contract in the oil market. If oil prices climbed, the put would expire worthless and Bayoil would pocket the price of the option, while Arochem would break even. If oil prices dropped, and the ultimate buyer exercised the put, Arochem could absorb the loss while conveniently neglecting to exercise its put against Bayoil, Perkins theorizes. (pg 87)

1 0

Re: JP vs Homer
by jalicqui＠prairienet.org 17 Dec '03

17 Dec '03

> We are capable of controlling mail bombs, for instance, in the >following way: > > Take an incoming message, capture From: line. Strip header. MD5 body. >Add to sorted table [From: MD5(message) date]. Check for repetition of >first two fields. If reps = 1, forward message. If reps = 2, send message >to From: "Possible error. Two copies of message <message> received." If >reps = 0 mod 5, send letter to postmaster@From:. "Possible mailbomb or >spam. <reps> copies of <message> received from <From:> at your site in the >past week." Clear table of entries more than a week old every midnight. > > > If all remailers did this, then no matter where the net was entered, >the messages would be rejected. And spammers/bombers would be spamming/ >bombing their own postmaster. Probably a bad idea. If not all did it, >then add special handling to hit remailer-operator@. This would encourage >the operator to auto-magically handle the spam-bomb himself. This works only if one assumes that the exact same message is posted using the exact same path. Granted, it would probably be effective for novice spammers. Consider a premail/chain type script and a cleartext spam message. The script is executed once every five minutes, say. When it runs, it creates a new random path through the remailers, adding encryption wrappers for each hop. Your spam detector would miss this one completely unless your remailer was used as the terminal remailer for a significant number of spams. More significantly, the MD5 hashes of each message would be different even if the same path were used more than once because the PGP session key would be different (again, unless your remailer would be the terminal remailer in the particular path that repeated).

1 0