December 2003 - cypherpunks-legacy

Where to Get PGP FAQ
by Michael Paul Johnson 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- ===============================BEGIN SIGNED TEXT============================= WHERE TO GET THE PRETTY GOOD PRIVACY PROGRAM (PGP) (Last modified: 17 January 1995 by Mike Johnson) WHAT IS THE LATEST VERSION? |-----------------+---------------------+---------------------------------| | Platform(s) | Latest Version | Distribution File Names | |-----------------+---------------------+---------------------------------| | DOS, Unix, | Viacrypt PGP 2.7 | disk sets | | Mac, Windows, | | | | or WinCIM/CSNav | | | |-----------------+---------------------+---------------------------------| | DOS, Unix, | MIT PGP 2.6.2 | pgp262.zip (DOS + docs) | | others | | pgp262s.zip (source) | | | | pg262s.zip source on CompuServe | | | | pgp262.tar.gz (source) | | | | pgp262.gz (same as above on DOS)| | | | pgp262.tar.Z (source) | | | | pgp262dc.zip (documentation) | | | | pg262d.zip (docs on CompuServe) | |-----------------+---------------------+---------------------------------| | Macintosh | MIT PGP 2.6 | MacPGP2.6.sea.hqx (binary+docs) | | | | macpgp26.hqx (same as above) | | | | MacPGP2.6.src.sea.hqx (source) | | | | macpgp26.src (same as above) | | | | MacPGP2.6-68000.sea.hqx (binary)| | | | mcpgp268.hqx (same as above) | |-----------------+---------------------+---------------------------------| | Mac Applescript | MacPGP 2.6ui v 1.2 | MacPGP-2.6ui-v1.2.sit.hqx | | | + some beta versions| MacPGP2.6ui_V1.2_sources.cpt.hqx| | | based on MIT PGP | MacPGP2.6uiV1.2en.cpt.hqx | | | 2.6.2 | MacPGP2.6uiV1.2src.cpt.hqx | | | | MacPGP2.6uiV1.2.68000.hqx | | | | MacPGP2.6.2.beta*.sea.hqx | | | | MacPGP2.6.2.beta*.src.sea.hqx | |-----------------+---------------------+---------------------------------| | Amiga | PGP 2.6.2 Amiga 1.4 | pgp262-a14-000.lha | | | | pgp262-a14-020.lha | | | | pgp262-a14-src.lha | |-----------------+---------------------+---------------------------------| | Atari | Atari PGP 2.6.1 | pgp261st.zip | | | | pgp261b.lzh | |-----------------+---------------------+---------------------------------| | Non-USA version | PGP 2.6.i from | pgp26i.zip | | to avoid RSAREF | Stale Schumacher | pgp26is.zip | | license. | | pgp26is.tar.gz | |_________________|_____________________|_________________________________| PGP BOOKS Protect Your Privacy: PGP: Pretty Good Privacy A Guide for PGP Users by William Stallings by Simson Garfinkel Prentice Hall PTR O'Reilly & Associates, Inc. ISBN 0-13-185596-4 ISBN 1-56592-098-8 US $19.95 US $24.95 If you order Stallings' book from National Computer Security Association (74774.1326(a)compuserve.com) they will donate $1 of the price to Phil Zimmermann's legal defense fund. WHERE CAN I GET THE PGP VERSION DIRECTLY FROM PHILIP ZIMMERMANN? Get the MIT version. See http://web.mit.edu/network/pgp-form.html WHAT IS PGP 2.6.i? Stale Schumacher <staalesc(a)ifi.uio.no> released an international version of PGP built the "right way." By "right way," I mean that it uses the latest MIT code, but uses a different rsaglue.c to use the mpilib instead of RSAREF for RSA calculations, thus including all the latest bug fixes and features in the main freeware PGP code line, but frees non-USA persons from the limitations of the RSAREF license. This release has been as strongly endorsed by Philip Zimmermann as he can do without incriminating himself. Naturally, by not using the RSAREF code for RSA calculations, this version is not legal for use in the USA (other than limited research, etc.), but is fine anywhere else (like Canada) were RSA patents don't hold. Note that the latest version of Stale Schumacher's PGP is 2.6.i, 2.6i (without the second .) was a beta test version that has been superceded. WHAT IS PGP 2.6ui? The "unofficial international" versions are really just PGP 2.3a, modified just enough to make it compatible with MIT PGP 2.6, but do not include all of the fixes in MIT PGP 2.6 and MIT PGP 2.6.1. They have a "ui" somewhere in their file names. WHERE CAN I GET VIACRYPT PGP? Contact Viacrypt in Phoenix, Arizona, USA. The commecial version of PGP is fully licensed to use the patented RSA and IDEA encryption algorithms in commercial and government environments in the USA and Canada. It is fully compatible with, functionally the same as, and just as strong as the freeware version of PGP. Due to limitations on ViaCrypt's RSA distribution license, ViaCrypt only distributes executable code and documentation for it, but they are working on making PGP available for a variety of platforms. Call or write to them for the latest information. The latest version number for Viacrypt PGP is 2.7. Here is a brief summary of Viacrypt's currently-available products: 1. ViaCrypt PGP for MS-DOS. Prices start at $99.98 2. ViaCrypt PGP for UNIX. Includes executables for the following platforms: SunOS 4.1.x (SPARC) IBM RS/6000 AIX HP 9000 Series 700/800 UX SCO 386/486 UNIX SGI IRIX AViiON DG-UX(88/OPEN) Prices start at $149.98 Executables for the following additional platforms are available upon request for an additional $30.00 charge. BSD 386 Ultrix MIPS DECstation 4.x 3. ViaCrypt PGP for WinCIM/CSNav. A special package for users of CompuServe. Prices start at $119.98 Please contact ViaCrypt for quantity discount pricing. Orders may be placed by calling 800-536-2664 during the hours of 8:30am to 5:00pm MST, Monday - Friday. They accept VISA, MasterCard, AMEX and Discover credit cards. If you have further questions, please feel free to contact: Paul E. Uhlhorn Director of Marketing, ViaCrypt Products Mail: 9033 N. 24th Avenue Suite 7 Phoenix AZ 85021-2847 Phone: (602) 944-0773 Fax: (602) 943-2601 Internet: viacrypt(a)acm.org Compuserve: 70304.41 WHERE CAN I GET THE FREEWARE PGP? These listings are subject to change without notice. If you find that PGP has been removed from any of these sites, please let me know so that I can update this list. Likewise, if you find PGP on a good site elsewhere (especially on any BBS that allows first time callers to access PGP for free), please let me know so that I can update this list. Because this list changes frequently, I have not attempted to keep it complete, but there should be enough pointers to let you easily find PGP. There are several ways to get the freeware PGP: ftp, WWW, BBS, CompuServe, email ftp server, and sneakernet (ask a friend for a copy). Just don't ask Philip Zimmermann directly for a copy. FTP SITES IN NORTH AMERICA There are some wierd hoops to jump through, thanks to the U. S. Department of State, at many of these sites. This is apparently because the U. S. Department of State wants to make it easier for people outside of North America to develop, distribute, use, or sell strong cryptographic software than people inside of the USA and Canada -- at least that is the effect of their rules. Telnet to net-dist.mit.edu, log in as getpgp, answer the questions, then ftp to net-dist.mit.edu and change to the hidden directory named in the telnet session to get your own copy. MIT-PGP is for U. S. and Canadian use only, but MIT is only distributing it within the USA (due to some archaic export control laws). You can also get PGP from: ftp.csn.net/mpj See ftp://ftp.csn.net/mpj/README.MPJ ftp.netcom.com/pub/mp/mpj See ftp://ftp.netcom.com/pub/mp/mpj/README.MPJ ftp.netcom.com/pub/gr/grady/PGP (U. S. and Canada only). ftp.eff.org Follow the instructions found in README.Dist that you get from one of: ftp://ftp.eff.org/pub/Net_info/Tools/Crypto/README.Dist gopher.eff.org, 1/Net_info/Tools/Crypto gopher://gopher.eff.org/11/Net_info/Tools/Crypto http://www.eff.org/pub/Net_info/Tools/Crypto/ ftp.csua.berkeley.edu (for U. S. or Canadian users) /pub/cypherpunks/pgp/ ftp.gibbon.com /pub/pgp/README.PGP (OS/2 users see also /pub/gcp/gcppgp10.zip) ftp.wimsey.bc.ca /pub/crypto/software/dist/README WORLD WIDE WEB ACCESS http://web.mit.edu/network/pgp-form.html http://www.ifi.uio.no/~staalesc/PGPVersions.html http://www.mantis.co.uk/pgp/pgp.html http://rschp2.anu.edu.au:8080/crypt.html http://www.eff.org/pub/Net_info/Tools/Crypto/ http://community.net/community/all/home/solano/sbaldwin http://www.cco.caltech.edu/~rknop/amiga_pgp26.html COMPUSERVE GO NCSAFORUM. Follow the instructions there to gain access to Library 12: Export Controlled. PGP may be other places, too. Compuserve file names are even more limited than DOS (6.3 instead of the already lame 8.3), so the file names to look for are PGP262.ZIP, PG262S.ZIP (source code), PGP262.GZ (Unix source code) and PG262D.ZIP (documentation only). BULLETIN BOARD SYSTEMS Colorado Catacombs BBS Mike Johnson, sysop Mac and DOS versions of PGP, PGP shells, and some other crypto stuff. Also the home of some good Bible search files and some shareware written by Mike Johnson, including ATBASH, DLOCK, CRYPTA, CRYPTE, CRYPTMPJ, MCP, MDIR, DELETE, PROVERB, SPLIT, ONEPAD, QUICRYPT, etc. v.FAST/v.32bis/v.42bis, speeds up to 28,800 bps 8 data bits, 1 stop, no parity, as fast as your modem will go. Use ANSI terminal emulation, or if you can't, try VT-100. Free access to PGP. If busy or no answer, try again later. For free access: log in with your own name, answer the questions, then select [Q]uestionaire 3 from the [M]ain menu. (303) 772-1062 Longmont, Colorado number - 2 lines. (303) 938-9654 Boulder, Colorado number forwarded to Longmont number intended for use by people in the Denver, Colorado area. The Freedom Files BBS, DeLand Florida, USA 904-738-2691 Exec-Net, New York, NY, USA (Host BBS for the ILink net) 914-667-4567 The Ferret BBS (North Little Rock, Arkansas) (501) 791-0124 also (501) 791-0125 Special PGP users account: login name: PGP USER password: PGP CVRC BBS 317-791-9617 CyberGold BBS 601-582-5748 Self-Governor Information Resource, 915-587-7888, El Paso, Texas, USA In the UK, try 01273-688888 MAUS BBS (+49 781 38807) Offenburg, Germany - angeschlossen an das MausNet OTHER FTP SITES ftp.informatik.uni-hamburg.de /pub/virus/crypt/pgp This site has most, if not all, of the current PGP files. ftp.leo.org /pub/com/os/os2/crypt ftp.ox.ac.uk (163.1.2.4) /pub/crypto/pgp This is a well organized site with most of the current PGP files as well as shells and mailer scripts. ftp.netcom.com /pub/dc/dcosenza -- Some crypto stuff, sometimes includes PGP. unix.hensa.ac.uk /pub/uunet/pub/security/virus/crypt/pgp ftp.ee.und.ac.za /pub/crypto/pgp ftp.csua.berkeley.edu /pub/cypherpunks/pgp (DOS, MAC) ftp.demon.co.uk /pub/amiga/pgp /pub/archimedes /pub/pgp /pub/mac/MacPGP ftp.informatik.tu-muenchen.de ftp.funet.fi ftp.dsi.unimi.it /pub/security/crypt/PGP atari.archive.umich.edu /pub/atari/Utilities/pgp261st.zip (Atari) ftp.tu-clausthal.de (139.174.2.10) (Atari ST/E,TT,Falcon) /pub/atari/misc/pgp/pgp261b.lzh wuarchive.wustl.edu /pub/aminet/util/crypt src.doc.ic.ac.uk (Amiga) /aminet /amiga-boing ftp.informatik.tu-muenchen.de /pub/comp/os/os2/crypt/pgp23os2A.zip (OS/2) iswuarchive.wustl.edu pub/aminet/util/crypt (Amiga) nic.funet.fi (128.214.6.100) /pub/crypt ftp.uni-kl.de (131.246.9.95) /pub/aminet/util/crypt qiclab.scn.rain.com (147.28.0.97) pc.usl.edu (130.70.40.3) leif.thep.lu.se (130.235.92.55) goya.dit.upm.es (138.4.2.2) tupac-amaru.informatik.rwth-aachen.de (137.226.112.31) ftp.etsu.edu (192.43.199.20) pencil.cs.missouri.edu (128.206.100.207) ftp.csua.berkeley.edu kauri.vuw.ac.nz nctuccca.edu.tw /PC/wuarchive/pgp/ ftp.fu-berlin.de:/mac/sys/init/MacPGP2.6uiV1.2en.cpt.hqx.gz Also, try an archie search for PGP. FTPMAIL For those individuals who do not have access to FTP, but do have access to e-mail, you can get FTP files mailed to you. For information on this service, send a message saying "help" to ftpmail(a)decwrl.dec.com. Another e-mail service is from nic.funet.fi. Send mail to mailserv(a)nic.funet.fi with the word HELP. For the ftp sites on netcom, send mail to ftp-request(a)netcom.com containing the word HELP in the body of the message. To get pgp 2.6.i by email: Send a message to hypnotech-request(a)ifi.uio.no with your request in the Subject: field. Subject What you will get GET pgp26i.zip MS-DOS executable (uuencoded) GET pgp26is.zip MS-DOS source code (uuencoded) GET pgp26is.tar.gz UNIX source code (uuencoded) For FAQ information, send e-mail to mail-server(a)rtfm.mit.edu with send usenet/news.answers/ftp-list/faq in the body of the message. MACPGP OPTIONS There are multiple parallel efforts to write an up-to-date MacPGP. See the following for the latest MacPGP beta stuff. Zbigniew Fiedorowicz <fiedorow(a)math.ohio-state.edu> has updated his MacPGP to support Apple events, and his distribution comes with complete source code. Grady's netcom directory contains a different version, about which he says "This latest bug release beta 1.23 fixes several relatively minor bugs. Source to this version is NOT available, so its use should be restricted to experimentation only." ftp://ftp.csn.net/mpj/README.MPJ ftp://ataxia.res.wpi.edu/pub/mac-pgp/README ftp://highway.alinc.com/users/jordyn/mac-pgp/README ftp://ftp.netcom.com/pub/gr/grady/PGP/MacPGP262b1.23.seq.hqx.asc PGP FOR WINDOWS, WINDOWS NT, AND WINDOWS 95 There isn't one, yet, that I know of (at least not a true native Windows application). There are several good shells that call the DOS PGP for the actual work, though. I use Viacrypt's, but there are others available as shareware or freeware at most of the sites listed above for PGP itself. IS MY COPY OF PGP GOOD? If you find a version of the PGP package that does not include the PGP User's Guide, something is wrong. The manual should always be included in the package. PGP should be signed by one of the developers (Philip Zimmermann, Jeff Schiller, Viacrypt, Stale Schumacher, etc.). OTHER PGP DOCUMENTATION For more information on the "time bomb" in PGP, see ftp://ftp.csn.net/mpj/pgpbomb.asc More PGP details are at http://www.pegasus.esprit.ec.org/people/arne/pgp.html Windows shells documentation http://www.LCS.com/winpgp.html Watch for the full PGP FAQ on alt.security.pgp. LANGUAGE MODULES These are suitable for most PGP versions. I am not aware of any export/import restrictions on these files. German * _UK:_ ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp23_german.txt * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp_german.txt * _US:_ ftp://ftp.csn.net/mpj/public/pgp/PGP_german_docs.lha Italian * _IT:_ ftp://ftp.dsi.unimi.it/pub/security/crypt/PGP/pgp-lang.italian.tar.gz * _FI:_ ftp://ftp.funet.fi/pub/crypt/ghost.dsi.unimi.it/PGP/pgp-lang.italian.tar.gz * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp-lang.italian.tar.gz Japanese * _UK:_ ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp23_japanese.tar.gz * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp-msgs-japanese.tar.gz Lithuanian * _UK:_ ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp23_lithuanian.zip * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp23ltk.zip Russian * _UK:_ ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp26_russian.zip * _RU:_ ftp://ftp.kiae.su/unix/crypto/pgp/pgp26ru.zip * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp26ru.zip Spanish * _IT:_ ftp://ftp.dsi.unimi.it/pub/security/crypt/PGP/pgp-lang.spanish.tar.gz * _FI:_ ftp://ftp.funet.fi/pub/crypt/ghost.dsi.unimi.it/pgp-lang.spanish.tar.gz * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp-lang.spanish.tar.gz Swedish * _UK:_ ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp23_swedish.txt * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp_swedish.txt MAILINGLISTE FUER PGP UND VERWANDTES (PGP MAILING LIST IN GERMAN) Die Listenadresse: pgp-friends(a)fiction.pb.owl.de Die *Request*adresse (fuer subscribe/unsubscribe und andere Administra- tiva): pgp-friends-request(a)fiction.pb.owl.de WHAT IS ALL THIS NONSENSE ABOUT EXPORT CONTROLS? For a detailed rant, get ftp://ftp.csn.net/mpj/cryptusa.zip WHAT INTELLECTUAL PROPERTY RESTRICTIONS EXIST IN THE USA? MIT PGP is only for personal, noncommercial use because of restrictions on the licensing of both the RSA algorithm (attached to RSAREF) and the IDEA algorithm. PKP/RSADSI insist that we use RSAREF instead of the mpi library for reasons that make sense to them. For commercial use, use Viacrypt PGP, which is fully licensed to use both the RSA and IDEA algorithms in commercial and corporate environments (as well as personal use, of course). Another restriction is due to an exclusive marketing agreement between Philip Zimmermann and Viacrypt that applies to the USA and Canada only. Viacrypt has exclusive rights to market PGP commercialy in this area of the world. This means that if you want to market PGP commercially in competition with Viacrypt in the USA or Canada, you would have to create a new implementation of the functions of PGP containing none of Philip Zimmermann's copyrighted code. You are free to modify existing PGP code for your own use, as long as you don't sell it. Phil would also appreciate your checking with him before you distribute any modified versions of PGP as freeware. "PGP", "Pretty Good Privacy" and "Phil's Pretty Good Software" are trademarks owned by Philip Zimmermann. This means that if you modify an older version of PGP that was issued under the copyleft license and distribute it without Phil's permission, you have to call it something else. This avoids confusing all of us and protects Phil's good name. WHAT INTELLECTUAL PROPERTY RESTRICTIONS EXIST IN CANADA? MIT PGP is only for noncommercial use because of restrictions on the licensing of the IDEA algorithm. Because the RSA algorithm isn't patented in Canada, you are free to use the mpi library instead of RSAREF, if you want to, thus freeing yourself of the RSAREF license associated with the RSAREF copyright, which is valid in Canada. For commercial use, use Viacrypt PGP, which is fully licensed to use the IDEA algorithm in commercial and corporate environments. The exclusive marketing agreement with Viacrypt also applies in Canada. See the section on USA intellectual property restrictions for more details. WHAT INTELLECTUAL PROPERTY RESTRICTIONS EXIST OUTSIDE NORTH AMERICA? MIT PGP is only for noncommercial in areas where there is a patent on software implementations of the IDEA algorithm. Because the RSA algorithm isn't patented outside of the USA, you are free to use the mpi library instead of RSAREF, if you want to, thus freeing yourself of the RSAREF license restrictions. The RSAREF copyright holds outside of the USA, even though the RSA patent does not. The IDEA conventional block cipher is covered by US Patent 5,214,703 and European patent EP 0 482 154 B1. IDEA is a trademark of Ascom-Tech AG. Commercial users of IDEA (including commercial use of PGP) may obtain licensing details from Ph. Baumann, IDEA Lizenz Ascom Tech AG Postfach 151 CH-4502 Solothurn Switzerland Tel ++41 65 242828, Fax ++41 65 242847. WHAT IS COMMERCIAL USE? Use some common sense. If you are running a business and using PGP to protect credit card numbers sent to you electronically, then you are using PGP commercially. Your customers, however, need not buy the commercial version of PGP just to buy something from you, if that is the only commercial use they make of PGP (since they are spending, not making, money with PGP). If you are just encrypting love letters or other personal mail (for which you don't get paid) on your own personal computer, that is not commercial. If you are encrypting official business mail on your for-profit corporation's computer with PGP, that is commercial use. Note that there are some gray areas not covered above, and the patent owners of RSA and IDEA may differ from my interpretation in the areas not covered above, so if you are in doubt, you should consider the licensing of Viacrypt PGP (or outside of North America, direct licensing of IDEA) to be cheap legal insurance. Indeed, the license fee is probably a lot cheaper than a legal opinion from a lawyer qualified to make such a judgement. Note that I am not a lawyer and the above is not legal advise. Use it at your own risk. ARE MY KEYS COMPATIBLE WITH THE OTHER PGP VERSIONS? If your RSA key modulus length is less than or equal to 1024 bits (I don't recommend less, unless you have a really slow computer and little patience), and if your key was generated in the PKCS format, then it will work with any of the current PGP versions (MIT PGP 2.6, PGP 2.6ui, or Viacrypt PGP 2.7). If this is not the case, you really should generate a new key that qualifies. MIT PGP 2.6.2 should be able to use 2048 bit keys. Generation of 2048 bit keys was supposed to automatically be enabled in PGP 2.6.2 in December, 1994, but a bug caused the actual key limit to be 2047 bits. MORE WORLD WIDE WEB URLs http://draco.centerline.com:8080/~franl/pgp/pgp-mac-faq-hinely.html http://draco.centerline.com:8080/~franl/pgp/pgp.html http://draco.centerline.com:8080/~franl/crypto/cryptography.html http://www.pegasus.esprit.ec.org/people/arne/pgp.html http://rschp2.anu.edu.au:8080/crypt.html http://ibd.ar.com/PublicKeys.html http://www.ifi.uio.no/~staalesc/PGPversions.html WINDOWS SHELLS Several shells for running PGP with Microsoft Windows are available at the same places PGP can be found. MACPGP KIT ftp://duke.bwh.harvard.edu:/pub/adam/mcip/MacPGP_icons.sit.hqx ftp://duke.bwh.harvard.edu:/pub/adam/mcip/MacPGPkit.hqx ftp://duke.bwh.harvard.edu:/pub/adam/mcip/MacPGPkitSources.sit.hqx BUGS See the documentation that comes with PGP in the latest versions for bugs in the older versions. The latest versions of PGP may not fully wipe all traces of plain text from a file when given the -w option. For more information, see http://www.mit.edu:8001/people/warlord/pgp-faq.html BETSI - BELLCORE'S TRUSTED SOFTWARE INTEGRITY SYSTEM For information on this service, send mail to certify(a)bellcore.com with the subject help, or check http://info.bellcore.com/BETSI/betsi.html INTEGRATING PGP AND PINE Send blank e-mail to slutsky(a)lipschitz.sfasu.edu with Subject: mkpgp to get a c-shell script to interface PGP and Pine. Send a second message with Subject: addtomkpgplist if you want updates sent you automatically. HOW DO I PUBLISH MY PGP PUBLIC KEY? There are lots of ways. One way is to use a key server. Send mail to one of these addresses with the single word "help" in the subject line to find out how to use a key server. pgp-public-keys(a)pgp.iastate.edu pgp-public-keys(a)pgp.mit.edu pgp-public-keys(a)pgp.ai.mit.edu public-key-server(a)pgp.ai.mit.edu pgp-public-keys(a)cs.tamu.edu pgp-public-keys(a)chao.sw.oz.au pgp-public-keys(a)jpunix.com pgp-public-keys(a)dsi.unimi.it pgp-public-keys(a)kiae.su pgp-public-keys(a)fbihh.informatik.uni-hamburg.de There is also an experimental public key server at http://ibd.ar.com/PublicKeys.html There is an excellent commercial key certification and publication service, too. For $20/year or so, you can have your key officially certified and published in a "clean" key database that is much less susceptible to denial-of-service attacks than the other key servers. People need not pay any fees to retrieve keys so published. Send mail to info-pgp(a)Four11.com for information, or look at http://www.Four11.com/ You can also mail your key to pgp-public-keys(a)c2.org, and it will be posted to the subscribers of that mailing list, sent to the keyservers, and posted to alt.security.keydist. To subscribe to the mailing list, send a message to majordomo(a)c2.org with "subscribe pgp-public-keys" in the body of the message. Another way is to upload it to the PGP public keys area of the Colorado Catacombs BBS (303-772-1062). Another way is to just send it to your correspondents. You could add it to your .plan file so that finger returns your key. You could add it to some of your postings. No matter which way you do it, you should have your key signed by someone who verifies that your key belongs to you, so that you don't have someone else generating a key that has your name on it, but that isn't yours. Here is my public key: - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.7 mQCNAi4PT2QAAAEEAPPCZnrshEJ9PSnV+mXEwjM4kzJF0kyg2MnLMzo83vWI40ei jogncqdkXT0c2TQWg+Bsu9ckFoXdId0utumYv0aqd8yI/oU/DwJ1zJrqRL2PFbxe ZLofHoKFjvq1TiNiJq9ps3jW6iYS4IU1SzyKhjmyE+K0+WyrPPX0zg8FAL9FAAUR tCdNaWNoYWVsIFBhdWwgSm9obnNvbiA8bXBqQGNzbi5vcmc+IG1wajiJAJUDBRAv Cw5o1TIhz19jpbkBARptA/9RHd27Io/48e3KRj/i/rptFTxdUR2DZTn+OrW23aNC 1fjH3YJl1C43lzipUL2Si6Paj1LKKBSVMVYAly8XMP5S+wEokzYffqsZfv6VrC7f YozSNLsHbjDdY6JjRY6LHTU0hAe3grzWpBJPwc9oXsUJynrGk7jTCs+6nkrHddTa zokAlQIFEC4bdyFleYS4x6lm3QEBm0AD/RHDmaKe2VQOAfJw1t6jIiIwegu7yNZo JJqIZK350NTUD9tQKj6Ciu/lNjE4KVF/dceMPrNKihbJTPd6Gi2vM9gu6eFU4TZg HE9T468oU5zfuZxmudcYGUXk1uWdJjGnTXzq0ZpObtYxbHs0OUdPga+HMclBI6ij jzKQOQqb+aQsiQCVAgUQLg9Zuz9nBjyFM+vFAQErIwP8DuS/3ULVlkhG2RsL2T2W xY6A6c7zAbxsYxqNpyjjrlnmWVYP5jxAIx1JZyjC04EZ9bRa/VtnW55t4KmDUvrq knsL4E4TGuSA+pFUKy0suJV6soZ5I5mjfJe3FgphfuYdA+sen3x5/t9QbgiIpL5L 7OeYbGknCtWwdlGWEneFdSyJAJUCBRAuD1l59fTODwUAv0UBAUFMBACHi7hW6fta E+4vp+xeJealpoZ94u13duJGP9o4wAbV4e6FV1Z6PHvWiubIpN00HZhXnpumwTcl D8qEG5gOjQ1KRGep4zZL4R/tpkSDpDji5cbnamoJlSV20J5h86zdosJH1IyVzpjf OalLAHXAo/Tn6033Ou41hUooEtYQgUBjtbQrTWljaGFlbCBQYXVsIEpvaG5zb24g PG0ucC5qb2huc29uQGllZWUub3JnPokAlQMFEC8LDn/VMiHPX2OluQEBiGkD/0Qu BxvMErp6BCaQVmh1Zxp0dghYZmAPK/15xDGLoTLcv7+hltDqntlZcH3Pb8UGTYmW /v/+e0wPErTl3Fp+KV/tzcGqo/n2GwKAcrk6cYpMVysLr6c47Sf1c0/EE4Xhczx3 sfPxLBoJ6z8n/sq5WNfjgfOM9ol/hXUZpaJ+Ykf9tCBNaWNoYWVsIEpvaG5zb24g PG1wakBuZXRjb20uY29tPokAlQMFEC8LDpTVMiHPX2OluQEBNWYD/iwuOas0LcM/ 7UFhWc6qZBTaQ2i0/fLdSq1NbnqZ/qAga4Gp+wNmBI3xvNBnF1Vm76Ss9G2PWgIE qzcJWLYULGVoT/rFwOLST4TXYK8m/juVKfinmntkwWeDRkXqlGWnvbndjNTYGwEn D+gTouzLAeYrd955OqxaIaVaNRWGlZBbtChNaWtlIEpvaG5zb24gPDcxMzMxLjIz MzJAY29tcHVzZXJ2ZS5jb20+iQCVAwUQLwsOqdUyIc9fY6W5AQGWsgP/dq1QNJ/1 ZsD3CJlcIGF/bbQwd6tozd2eXS4GQMwvuanHIuraGRVvAd1QodmWMQnVVOPOat5r Wq9vOBGan2GFp/OTNCBJTS664Ezdi8cpIdcLYasHJEBZ1mWCrTXLdvRlvNtL80x3 SmZH28m9Z3QMghzUg3q6KuZUy58UCgnMAx20K01pY2hhZWwgUC4gSm9obnNvbiA8 bXBqb2huc29Abnl4LmNzLmR1LmVkdT6JAJUDBRAvCw6+1TIhz19jpbkBAa77A/4q SsVT/+VsAHwmAn/JuXnNDOIqkqRlMMFWoB1QySEI8QHljrFJU5UphqWbVGhVNazv FSMAtTkgbM6R6n1BTx9EObR4y3ZmfRHTZbSsDOYmtF2pWxCG/qfg9cOKJBD4oxB2 ORo74hXecb0dGrDwBgl0OEJ7BF4FMr1wzWhgodsP97QtRG8gbm90IHVzZSBmb3Ig ZW5jcnlwdGlvbiBhZnRlciAyNyBKdW5lIDE5OTYuiQCVAwUQLwsO09UyIc9fY6W5 AQFyvgQAhPbYYVsYiyv67rKOEhROw/QKluloHZIvx53eWxVQ7KNpp/jg+KBVjL7N yoteDcofbVseBugAiAFPJgNQVCGfG5w6rtvMm4tN8oTz/4Q+vf6DyCkQnj+Qu6KO Fo80TgazVGeteODtCDiZg4wMUv0TNTd80NV6hm0Ygd/pmw+7A7w= =htAN - -----END PGP PUBLIC KEY BLOCK----- TIME STAMP SERVICES Mail sent to Time S. Tamp <timestamp(a)lorax.mv.com> will be returned, signed with its own private key. REPRODUCING THIS FAQ Permission is granted to distribute unmodified copies of this FAQ. To get the latest version of this FAQ, get ftp://ftp.netcom.com/pub/mp/mpj/getpgp.asc or send mail to ftp-request(a)netcom.com with the line SEND mp/mpj/getpgp.asc in the body of the message, or send blank mail to mpjohnso(a)nyx.cs.du.edu. This FAQ is also archived at rtfm.mit.edu with a very long file name. There are many other frequently asked questions. Most of them are covered in the documentation that comes with PGP or in one of the books about PGP. Send corrections to mpj(a)netcom.com. I regret that I lost some of the corrections people sent me on the last round of this FAQ, so if I missed yours, please send it again. Thanks. ___________________________________________________________ |\ /| | | | | \/ |o| | Michael Paul Johnson Colorado Catacombs BBS 303-772-1062 | | | | / _ | mpj(a)csn.org aka mpj(a)netcom.com m.p.johnson(a)ieee.org | | |||/ /_\ | ftp://ftp.csn.net/mpj/README.MPJ CIS: 71331,2332 | | |||\ ( | ftp://ftp.netcom.com/pub/mp/mpj/README -. --- ----- .... | | ||| \ \_/ |___________________________________________________________| -----BEGIN PGP SIGNATURE----- Version: 2.7 iQCVAgUBLxvrHPX0zg8FAL9FAQHz9AQAjdyLzJ2L+PSkqL0nZ4ULiq4ReHdYfLrX DlBvkM9JG0jCgpDmcWkWg4IEUwJ8VoKnjFYaUgbw3CkCoIZYRekXrUkRgoZSq5TV BdADxEXJabF7It3e6jH2ICVNSYdsfe/4xh+8F7v7CKzSZubtwaLOIbZ+CSBVi3D0 3iyn6+zrZVo= =5zak -----END PGP SIGNATURE-----

1 0

Surety Technologies announces: Digital Notary System is on-line
by stuart＠surety.com 17 Dec '03

17 Dec '03

Many readers of this list have heard about the work that Scott Stornetta and I have done, beginning as Bellcore researchers a few years ago, on the problem of cryptographically secure digital time-stamping. In 1993 Bellcore spun off a company in order to commercialize this work. The company is called Surety Technologies, and we call our product and service the Digital Notary(tm) System. I am happy to report that we have just launched the product. To read about it, as well as to get the software, please visit our World-Wide Web home page: http://www.surety.com You can get the software and installation instructions directly by anonymous ftp to ftp.surety.com in the directory /dns/windows. Scott and I would both like to thank those readers of the list who have offered us their support, encouragement, and advice over the years. Stuart Haber | Surety Technologies provides Chief Scientist | the Digital Notary(tm) System. Surety Technologies, Inc. | General info: info(a)surety.com stuart(a)surety.com | (201) 701-0600, fax -0601

1 0

internet mag
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

This month's issue of Internet World Magazine deals primarily with internet security. I'm am not going to review everything in the mag but I'll list the table of content: Better Safe: Danger lurks on the Info Highway. You must take precaution to reduce your riks. By Dave Taylor and Rosalind Resnick Getting Cryptic: Phil Zimmermann's PGP gives you powerful encryption to keep your messages safe from prying eyes. Read all about it. By William Stalling. (Introductory article about PGP. Nothing we, here, don't already know) Securing the Enterprise: Connectiong your corporation to the Internet can be a security nightmare. Firewalls are the main line of defense. By Alton Hoover (An overview of Firewalls, application-layer gateways and token-based authentication schemes) Beyond the Firewall: The latest firewall technology not only detects intruders, but strikes back. By Winn Schwartau (Very interesting article. Here are some quotes to wet your appetite: Wouldn't it be nice if a computer system attacked from the Internet responded to the attack by striking back at the intruder? This is exactly what Sidewinder's implementation of type enforcement does.....It will detect the intrusion immediately....As soon as a violation occurs, a silent alarm is activated....sidewinder can be configured to react in any number of ways, once an attack has been detected...it can shut the intruder cold...(or)...it can invoke a mechanism that would record all the information from whence came the attack....By luring the attacker into a false sense of security, the hacker would continue trying to break in, unaware that every step was being recorded... Cashing In: As Internet commerce expands, a host of companies are vying to establish their system as the basis for cyberbanking and credit-card transactions. By Lisa Morgan Business Browser: New versions of Mosaic with built-in encryption promise to keep your transactions safe. By Richard W. Wiggins Unlawful Entry Crackers can feasts on your data if you fail to plug your leaky Unix system By Aaron Weiss (Five Ways to crack a Unix System) It's Alive: Although the furor has subsided, reports of Clipper's death are greatly exaggerated. The government's controversial eavesdropping effort lives on. By Steven Vaughan-Nichols Building Trust The chief executives of Trusted Information Systems -Steve Crocker and Steve Walker- talk about encryption, CyberCash, Clipper, and more. By Jeff Ubois. All in all a rather interesting mag. Check it out. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ wizard(a)alpha.c2.org Give me the liberty to know, to utter, and to argue freely according to conscience, above all liberties. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Anonyous Cash through Options Trading
by pcw＠access.digex.com 17 Dec '03

17 Dec '03

Several months ago, there was a discussion at length about how one could use the futures and options markets to transfer funds anonymously. This week's edition of Forbes magazine (Jan 30, 95) has the headline, "OIL! GUNS! GREED! Was Chase Manhattan ripped off by arms traffickers?" In the story, Forbes guesses that some suspiciously large losses in the options market could have been a smoke screen for money laundering: Oil traders do big business in unlisted options, providing a further smoke screen. Perkins points to deals in which Harris would buy a put option on a cargo of crude from a friendly counterpart like Bayoil and resell a similar contract in the oil market. If oil prices climbed, the put would expire worthless and Bayoil would pocket the price of the option, while Arochem would break even. If oil prices dropped, and the ultimate buyer exercised the put, Arochem could absorb the loss while conveniently neglecting to exercise its put against Bayoil, Perkins theorizes. (pg 87)

1 0

Re: JP vs Homer
by jalicqui＠prairienet.org 17 Dec '03

17 Dec '03

> We are capable of controlling mail bombs, for instance, in the >following way: > > Take an incoming message, capture From: line. Strip header. MD5 body. >Add to sorted table [From: MD5(message) date]. Check for repetition of >first two fields. If reps = 1, forward message. If reps = 2, send message >to From: "Possible error. Two copies of message <message> received." If >reps = 0 mod 5, send letter to postmaster@From:. "Possible mailbomb or >spam. <reps> copies of <message> received from <From:> at your site in the >past week." Clear table of entries more than a week old every midnight. > > > If all remailers did this, then no matter where the net was entered, >the messages would be rejected. And spammers/bombers would be spamming/ >bombing their own postmaster. Probably a bad idea. If not all did it, >then add special handling to hit remailer-operator@. This would encourage >the operator to auto-magically handle the spam-bomb himself. This works only if one assumes that the exact same message is posted using the exact same path. Granted, it would probably be effective for novice spammers. Consider a premail/chain type script and a cleartext spam message. The script is executed once every five minutes, say. When it runs, it creates a new random path through the remailers, adding encryption wrappers for each hop. Your spam detector would miss this one completely unless your remailer was used as the terminal remailer for a significant number of spams. More significantly, the MD5 hashes of each message would be different even if the same path were used more than once because the PGP session key would be different (again, unless your remailer would be the terminal remailer in the particular path that repeated).

1 0

WSJ on CIA Dump
by John Young 17 Dec '03

17 Dec '03

The Wall Street Journal January 18, 1995, p. A14. Get Smart -- Eliminate the CIA By Angelo Codevilla Over the past several years, U.S. intelligence agencies in general and the CIA in particular have proved themselves incompetent in peacetime and of little use in conflict. Stripped of their mystique and lacking the capacity to reform themselves, these organizations are virtually in receivership. The maladies ailing the intelligence community are numerous. Independent quality control was never more than a pretense, and competition among intelligence agencies was nonexistent. Producers of intelligence -- rather than the soldiers and diplomats who have to use it -- have also become its judges. All this has spawned a complex of habits, procedures, mentalities and people too entrenched to be repaired and too noxious for any part to form the nucleus of a new, healthy system. Hence, we should take Sen. Daniel Patrick Moynihan's advice, and rethink our intelligence from the ground up. A good place to start is with the fact that about half of the $28 billion U.S. intelligence budget pays for units directly controlled by military commanders, which routinely provide precise information for the armed forces' operations close to the front lines. The Treasury and State Departments also have their own intelligence units, which fit their needs quite well. So why do we need a national system headed by the CIA? The original justification for the creation of the CIA in 1947 was that intelligence would be best if its gathering and evaluation were divorced as much as possible from the operating departments of government -- State, Defense, etc. -- and placed under the president. This judgment has turned out to be wrong. Because presidents have relied on the CIA to run the system, the result has been a system dominated by the priorities of the producers -- not the users -- of intelligence. A basic failing is that the CIA has primary responsibility for intelligence and none at all for real world events. The CIA prefers to place its career employees in U.S. embassies, where they pretend to be employees of other parts of the government. Such "case officers" must acknowledge that they are gathering information for the U.S. Another disadvantage is that they don't speak foreign languages well. And unlike successful reporters, they virtually never know the substantive fields about which they are seeking information. Thus it is unsurprising that they are usually outdone in economic reporting by economic reporters, in military reporting by military reporters, and so forth. The Aldrich Ames case shows how much more highly the CIA values the smooth functioning of its system than what the system produces. Mr. Ames handed the KGB the capacity to shape the intelligence flowing to top U.S. officials during the endgame of the Cold War. Thus disinformation made presidents and secretaries of state more vulnerable to Gorbomania than the average citizen informed by newspaper accounts. How could the CIA fail to notice the fishiness of reports generated by a network controlled by the other side? The same way that, in the 1970s and 1980s, the agency had failed to notice that it was passing along reports from a network of agents in Cuba totally controlled by Castro's DGI, and from a network in East Germany all but a few of whose agents were working for the Stasi. In other words, while the Ames case was unusually destructive, it was a typical example of bureaucratic sclerosis. In the Gulf War, intelligence worsened the farther one got away from the front lines. The national system headed by the CIA misperceived the nature of Saddam Hussein's regime, failed to grasp the obvious signs of attack, and has yet to learn Saddam's military and political reasoning. Our imaging satellites failed to find mobile Scud launchers, and our communications intelligence antennas failed to shed light on the diplomatic intercourse between Saddam and the Soviets. National analysts misjudged Iraq's nuclear program, and were fooled by elementary camouflage. Gen. H. Norman Schwarzkopf's public belittling of CIA-run intelligence was matched by unprintable epithets from field commanders. What happened in the Gulf would have happened in any conflict because the intelligence community's cameras and antennas were conceived, and its people trained, on the CIA's assumption that cooperative competition with the Soviet Union would last forever and that the basic designs of weapons would not change. Thus cameras, for example, were optimized to take pictures of fixed installations rather than to keep track of attacking military forces or mobile missile launchers. Long before the Soviet collapse, however, it had become clear that the CIA made bad bets. The age of mobile missiles arrived long ago, and modern weapons are defined by the software they contain rather than by observable features. So what's the point of, for example, analyzing a radar signal that a computer can change in an instant? Divorce from operational responsibility also tends to make the reports that flow to top officials less valuable than the information used to compile them. (In any given subject, the CIA delivers a consensus of the system's several agencies. It takes far more time for a paper to go through the interagency process than for someone to write the paper. Considering the elementary errors and ignorance that often come out, it is clear that the conferees do not spend much time fact-checking. Intelligence analysts become spin doctors, concerned not with facts but with pushing policy makers in the direction of their parent agencies' prejudices. Hence the ultimate irony: A system whose ostensible reason for being was to eliminate from intelligence the parochial interests of tank drivers, diplomats, bomber pilots, etc. ended up aggregating the prejudices of the analysts -- prejudices unrelieved by the sobering prospect of having to carry out the policies they are pushing for. The CIA has maintained a monopoly on judging the quality of the system's operations and products. It does not heed presidents, much less their appointees. A decade ago, the agency ignored President Reagan's executive order to reorganize counterintelligence. Two decades ago, President Ford, shocked by how far intelligence estimates were diverging from reality, asked a group of distinguished outsiders (the B team) to see whether the intelligence community's data on Soviet nuclear forces could support conclusions different from those of the insider analysts. The B Team, despite resistance from the agency, came up with results far superior to the insider A Team's. A better intelligence system should be built on a model radically different from the 1947 original. Each of the major departments of the U.S. government (State, Defense, etc.) should be responsible for gathering and evaluating the information it needs to operate in the new world disorder. Intelligence, in short, should be franchised out to its consumers. There is reason to believe that the departments would do better without the ClA's tutelage than with it. In the past, the armed forces have asked to deploy officers who speak foreign languages, who could blend in with the local population, and who would be experts in the military fields on which they were reporting. U.S. military leaders have also clamored for satellites whose products they could use. Each time, the CIA made sure such requests were denied. If those requests had been granted, the country would be better informed. In all this there is a need for some central coordination. The several agencies have to mesh their quest for agents abroad, lest they stumble over each other. The information that any part of the government collects must be available to properly cleared people in all other parts, so that any and all analysis can be based on all the facts. Fortunately, maintaining a central registry nowadays requires computers, rather than the bureaucratic monster that arose a half century ago. Finally the president of the United States' own intelligence needs should be provided by his own staff. Among its duties should be to make sure that all the agencies get each others' estimates. The availability to the president and other top decision makers of contrasting estimates from through out the government would stimulate better performance all around. So, while there is a role for a central intelligence agency in a system based on consumer sovereignty, there is none for the CIA. Mr. Codevilla, a fellow at the Hoover Institution, is the author of "Informing Statecraft" (Free Press, 1992). End

1 0

BYTE on PGP WoT
by John Young 17 Dec '03

17 Dec '03

William Stallings writes in the BYTE February issue on "The PGP Web of Trust."

1 0

Re: The Remailer Crisis
by jalicqui＠prairienet.org 17 Dec '03

17 Dec '03

>For example, the Linux mavens could tell us if Linux-based remailer >boxes could be hung on dedicated connections to The Little Garden >network, as a specific example. A "black box remailer" such as several >folks have suggested (Chaum (in 1981), me, Eric Hughes, others) might be >buildable for under a grand. We could ask here for contributions, and >might even raise this amount of money. Then each of us who contributed >could have "accounts," maybe several of them. Imagine 100 or more >"remailers" all on this one machine--I'm deliberately ignoring the >security issue for now. Little Garden has stated categorically that >they will not tell users what they can or can't do with their machines >(though I can think of some cases where they might have to, as with >spamming, etc.). Anyway, you can see where I'm headed. The "Linux mavens" followed by the "black box" stuff sparked an idea... First, before delving into dreamland: I'm sure Linux could be hung off just about any store-and-forward (a la UUCP) or TCP/IP-based network there is with a minimum of trouble. Linux junkies are familiar with the concept of "distributions". For the uninitiated, Linux itself is just a kernel; Linus Torvalds doesn't hold anyone's hand when it comes to actually turning that kernel into a working system. As a result, people have done this job themselves: they build their own working systems painstakingly from scratch and then archive it off to disk or CD-ROM, which they sell or give away. Most of the time, when you get Linux, you're actually getting one of these "distributions" of Linux, complete with all the frills that don't come with the kernel (like the shell, basic utils, and so on). Now how 'bout this: Consider a new distribution of Linux, the "Cypherpunk" distribution (if ya don't like the name, make up yer own!). This would be a bare minimum of a distribution, with nothing fancy: bash, misc. utils like ls, etc. This can fit (tightly) in 20 MB. The supplied kernel would have every networking option under the sun turned on, but would be otherwise bare of frills as well. Now let's add minimal network utils (telnet and telnetd for connecting and sendmail for obvious reasons), perl, PGP, and a remailer package. To make it as easy as possible, I'd use the UMSDOS filesystem, so that Linux could be installed on a DOS machine without any reformatting, repartitioning, or similar headaches. We could make this available via FTP or press some CD-ROMs if we were ambitious. Better yet, the cool Linux thing to do now is to install via NFS; this makes installing Linux as easy as sticking in a boot disk and pointing the install program at the NFS server (well, not quite, but pretty close). After adding in the cute little install program (like the Slackware distribution already has) and some boot options, you'd have an "instant remailer" software package, able to transform any 386SX/4MB RAM DOS machine or better into a Linux-based remailer site, complete with aliases, logging policies, etc. already configured for you. I bet even Tim May could install this if it were done right. :-) So, am I dreaming, or does this sound viable to y'all?

4 4

Re: Cone of silence update
by Rich Salz 17 Dec '03

17 Dec '03

---------- Begin Forwarded Message ---------- Date: Wed, 18 Jan 95 21:03:02 -0500 From: burton(a)het.brown.edu (Joshua W. Burton) To: silent-tristero(a)world.std.com Subject: Cone of silence update I haven't been able to turn up the original New York Times article I saw, but our own Providence (RI) Journal today reprinted an article from the Washington Post, no date given, that tells substantially the same story, though without any mention of the cost of Intelink. Since a few people have asked me for details, I thought I'd better post this verbatim. Be sure to save a copy, in case this article disappears the way the first one I saw did.... GOVERNMENT'S SECRETS FLOW THROUGH AN INTERNET CLONE WASHINGTON - When the US intelligence community recently decided to modernize the way it communicates, it did what countless other government agencies, businesses and individuals have done over the last few years: it turned to the Internet. But the regular Internet wouldn't do. For spies and other government officials concerned about secrecy, that very public, very uncontrollable global mesh of computer networks was too risky a place to do business. So the intelligence community created its own Internet. Dubbed Intelink and based on the same technology used to run and navigate the original Internet, this new network for sharing supersecret information---including satellite imagery and video footage---officially began operating just a few weeks ago. When the bugs are worked out and a final system is in place, it will allow analysts, policy-makers, military officials and soldiers in the field to tap quickly and directly into classified information at the Central Intelligence Agency, the National Security Agency, the Pentagon and diverse other parts of the national security bureaucracy. Those familiar with Intelink say it could promote cooperation in a business characterized by internecine rivalry, and that at the very least it will centralize and speed up information retrieval. ``This is a major breakthrough,'' said Barry Horton, principal deputy assistant secretary of defense for command, control, communications and intelligence. ``Intelink for the first time, in a user-friendly environment, allows every element of the intelligence community and every element of the Department of Defense to reach into every other element,'' he said. As one might imagine, it's not for everybody. Horton said the system is now available only to people with ``Top Secret'' or higher security clearances. Moreover, those who run the system eventually will have to confront a major issue of how to make Intelink flexible enough to accommodate users with a variety of clearances. There are many levels of classification higher than Top Secret, and for Intelink to be useful to those working on the most secret programs, the officials responsible would have to be comfortable placing such information on the system. And, while Pentagon and CIA officials spoke of how Intelink promises to improve communication and cooperation among the agencies and reduce duplication of effort, others said there is good reason to be skeptical. The intelligence community has made innumerable attempts to eliminate redundancy and streamline information channels, but there has been little progress. ``It's gone like gangbusters since its inception, but any Internet-like thing grows overnight. The question is, is it going to mature well? And how will it operate in a time of crisis?'' said Ross Stapleton-Gray, who recently left the CIA to start a business providing Internet services to embassies in Washington. In a way it is fitting that what some call an Internet ``clone'' should come out of the national security bureaucracy. Internet itself was started under Department of Defense sponsorship in the 1960s, as an attack-proof communications link among military, corporate and university research centers. ``Remember, Internet is a DoD creation,'' said Neil Munro, a reporter for Washington_Technology, a local business newspaper, who recently broke the story about Intelink's start-up. ``This is the prodigal son....They created it and now it comes back in much stronger fashion.'' All those familiar with the system said it is totally walled off from the Internet, and designed never to be penetrated. But several experts familiar with Intelink noted that no system is ever totally secure. ``This would obviously be a Mount Everest for hackers,'' said John E. Pike of the Federation of American Scientists. But Pike, who said he thinks Intelink has the potential to ``revolutionize'' the intelligence community, added that it would be so difficult to crack he doubts many will try. The network now operates among several dozen intelligence agencies and centers. But it is the talk of the intelligence community, and its reach is expected to grow rapidly. Those who now have regular access to it number in the hundreds, estimated Martin C. Faga, general manager of the Center for Integrated Intelligence Systems at the Mitre Corp., the company that helped the intelligence agencies set up the system. ----------- End Forwarded Message -----------

1 0

"Time" Magazine and "Future Shock" Author
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

[I'm into my daily "blackout" of toad mail to Netcom, so am posting blind, as usual. If this article has already been posted, my condolences.] The January 23rd issue of "Time," this week's issue, features a cover story on talk shows, Limbaugh, Gingrich, and "HyperDemocracy." I haven't seen the physical issue yet, but have skimmed the Web version at: http://www.timeinc.com/time/magazine/magazine.html Point your browser at it and have fun. Lots of folks are flaming the article, in the usual newsgroups (e.g., alt.data-highway). Me, I'm as scared as "Time" is about "direct, electronic democracy," though perhaps for different reasons. On a related note, the article and sidebars touch heavily on the "cybergurus" who are advising Newt Gingrich on his journey into cyberscpace, notably Alvin Toffler ("Future Shock," "The Third Wave," "Powershift," etc.) and George Gilder ("Beyond Wealth and Poverty," "Macrocosm," lots of essays on the Net). As it happens, I spent some time talking to Alvin and Heidi Toffler at an interview last Friday in L.A.--they were being interviewed before and after me. Not enough time to really get into issues, and of course they did most of the talking (Heidi is especially opinionated, and had just been in a highly publicized battle with newage guru Arianne Huffington, spacey wife of losing candiate in California, Michael H.). Anyway, we talked about John Brunner (as you all know, Brunner's seminal "The Shockwave Rider," was inspired by "Future Shock") and his ideas. (And we all agreed that "Stand on Zanzibar" was his crowning achievement...even Shalmaneser admitted "Christ, what an imagination he's got.") Tidbits: * on digital cash: Heidi: "Oh, we're for it! Did you hear what I just told the interviewer?" (I didn't, as I was in the adjacent room. Later comments lead me to believe that neither of the Tofflers has a clear idea of what's going to happen with digital cash and crypto anarchy.) * on the NSA and the t-shirt I showed them ("Cypherpunks: putting the NSA out of business"): "Oh, no, we need a strong NSA now more than ever!" (What else would I expect? They view the NSA as the main bastion against terrorists plotting to blow up the World Trade Center. Alvin was generally more reserved and thoughtful. When I pointed out that the very hotel room we were in could be used to plot crimes, even nuclear terrorism, and that the solution to stop this would have to be an Orwellian regime of continuous monitoring, Alvin nodded thoughtfully, but Heidi just sniffed. I mention this to give a flavor, just a whiff, of what senior advisors to the most influential man in America are thinking.) * I gave Alvin a copy of my "Crypto Anarchy and Virtual Communities" paper. * My interview was pretty disappointing, by the way. Lots of sitting around, delays in getting my laptop hooked up to Netcom (outside calls had to be unblocked). The interviewer wanted memorable, quotable stuff from me, but I felt constricted sitting around and being expected to spout on cue. Maybe they'll get a few minutes of usable stuff.... (Print media is so much better. An interviewer can let the tape recorder run for hours, can edit the containing material of a quote, and can thus produce clear, coherent quotes. A video interview is more constrained in lots of ways, and offending gestures or rambling interjections cannot be easily edited out. As one example, at one point I naturally (to me at least) said something about "As we just saw...." Well, this made this quote unusable. And so it goes.) I was generally unhappy with the whole thing. Four hours to get there, two hours spend waiting around, an hour to resolve problems, an hour under the camera lights (being told not to move, to "use the mouse," to "tell us why cryptography is important," etc.), and five hours to get home. All for a few minutes at most on a t.v. show. Oh, the show is the BBC's "Horizons" science series, which may also get sold to U.S. outlets, etc. I think the title will be "The Information Bomb," and features segments on information warfare, a la Winn Schwartau's views, the Tofflers, some military planners, and--maybe--me. I don't have high hopes for my segment. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. Cypherpunks list: majordomo(a)toad.com with body message of only: subscribe cypherpunks. FAQ available at ftp.netcom.com in pub/tc/tcmay

1 0