December 2003 - cypherpunks-legacy

Re: Abuse and Remailer Ethics
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

>This thread illustrates (at least if setup's like this are >worthy of a place in Raph's list) that penet.fi is the safest >way to go for the moment. I would just hate it to have my >head on the plate of a remailer operator who takes an interest >in subtile ethical discussion of whether to sell me out or not. If you chain it through 3 or 4 remailers with PGP, then pretty much all 3 or 4 of them have got to decide to sell you out. I trust Julf a lot, but I'm not sure I trust him four times as much as much as every other remailer operator. Or something like that. You can also probably use penet as a link on your larger chain, although I've never tried this to see how it works. And I would note that the "subtle ethical discussion" seemed to consist of the operator trying to figure out what he should do in the future about this sort of thing, and he never even seemed to consider turning over the name of the anon user. Although he did acknowledge that in the future he might, or might work with other operators to try and discover a True Name. *shrug*

3 2

Re: Internet, spamming, etc.
by rparratt＠london.micrognosis.com 17 Dec '03

17 Dec '03

> > One could theoretically have a package that sprayed UDP packets > > at a particular IP address, or even have a modified TCP > > that ignored disconnects. I think most service providers > > would regard using such code as being on a par with running > > a program that tried to telnet sequentially to all known IP > > addresses, trying common passwords on each. > > Code exists to do all of the things that you've mentioned. > > That was the original point of the discussion. No doubt it does. But my assertion is that most service providers would cut you off if you tried running such code, especially the latter case. -- Richard Parratt

1 0

Where to Get PGP FAQ
by Michael Paul Johnson 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- ===============================BEGIN SIGNED TEXT============================= WHERE TO GET THE PRETTY GOOD PRIVACY PROGRAM (PGP) (Last modified: 17 January 1995 by Mike Johnson) WHAT IS THE LATEST VERSION? |-----------------+---------------------+---------------------------------| | Platform(s) | Latest Version | Distribution File Names | |-----------------+---------------------+---------------------------------| | DOS, Unix, | Viacrypt PGP 2.7 | disk sets | | Mac, Windows, | | | | or WinCIM/CSNav | | | |-----------------+---------------------+---------------------------------| | DOS, Unix, | MIT PGP 2.6.2 | pgp262.zip (DOS + docs) | | others | | pgp262s.zip (source) | | | | pg262s.zip source on CompuServe | | | | pgp262.tar.gz (source) | | | | pgp262.gz (same as above on DOS)| | | | pgp262.tar.Z (source) | | | | pgp262dc.zip (documentation) | | | | pg262d.zip (docs on CompuServe) | |-----------------+---------------------+---------------------------------| | Macintosh | MIT PGP 2.6 | MacPGP2.6.sea.hqx (binary+docs) | | | | macpgp26.hqx (same as above) | | | | MacPGP2.6.src.sea.hqx (source) | | | | macpgp26.src (same as above) | | | | MacPGP2.6-68000.sea.hqx (binary)| | | | mcpgp268.hqx (same as above) | |-----------------+---------------------+---------------------------------| | Mac Applescript | MacPGP 2.6ui v 1.2 | MacPGP-2.6ui-v1.2.sit.hqx | | | + some beta versions| MacPGP2.6ui_V1.2_sources.cpt.hqx| | | based on MIT PGP | MacPGP2.6uiV1.2en.cpt.hqx | | | 2.6.2 | MacPGP2.6uiV1.2src.cpt.hqx | | | | MacPGP2.6uiV1.2.68000.hqx | | | | MacPGP2.6.2.beta*.sea.hqx | | | | MacPGP2.6.2.beta*.src.sea.hqx | |-----------------+---------------------+---------------------------------| | Amiga | PGP 2.6.2 Amiga 1.4 | pgp262-a14-000.lha | | | | pgp262-a14-020.lha | | | | pgp262-a14-src.lha | |-----------------+---------------------+---------------------------------| | Atari | Atari PGP 2.6.1 | pgp261st.zip | | | | pgp261b.lzh | |-----------------+---------------------+---------------------------------| | Non-USA version | PGP 2.6.i from | pgp26i.zip | | to avoid RSAREF | Stale Schumacher | pgp26is.zip | | license. | | pgp26is.tar.gz | |_________________|_____________________|_________________________________| PGP BOOKS Protect Your Privacy: PGP: Pretty Good Privacy A Guide for PGP Users by William Stallings by Simson Garfinkel Prentice Hall PTR O'Reilly & Associates, Inc. ISBN 0-13-185596-4 ISBN 1-56592-098-8 US $19.95 US $24.95 If you order Stallings' book from National Computer Security Association (74774.1326(a)compuserve.com) they will donate $1 of the price to Phil Zimmermann's legal defense fund. WHERE CAN I GET THE PGP VERSION DIRECTLY FROM PHILIP ZIMMERMANN? Get the MIT version. See http://web.mit.edu/network/pgp-form.html WHAT IS PGP 2.6.i? Stale Schumacher <staalesc(a)ifi.uio.no> released an international version of PGP built the "right way." By "right way," I mean that it uses the latest MIT code, but uses a different rsaglue.c to use the mpilib instead of RSAREF for RSA calculations, thus including all the latest bug fixes and features in the main freeware PGP code line, but frees non-USA persons from the limitations of the RSAREF license. This release has been as strongly endorsed by Philip Zimmermann as he can do without incriminating himself. Naturally, by not using the RSAREF code for RSA calculations, this version is not legal for use in the USA (other than limited research, etc.), but is fine anywhere else (like Canada) were RSA patents don't hold. Note that the latest version of Stale Schumacher's PGP is 2.6.i, 2.6i (without the second .) was a beta test version that has been superceded. WHAT IS PGP 2.6ui? The "unofficial international" versions are really just PGP 2.3a, modified just enough to make it compatible with MIT PGP 2.6, but do not include all of the fixes in MIT PGP 2.6 and MIT PGP 2.6.1. They have a "ui" somewhere in their file names. WHERE CAN I GET VIACRYPT PGP? Contact Viacrypt in Phoenix, Arizona, USA. The commecial version of PGP is fully licensed to use the patented RSA and IDEA encryption algorithms in commercial and government environments in the USA and Canada. It is fully compatible with, functionally the same as, and just as strong as the freeware version of PGP. Due to limitations on ViaCrypt's RSA distribution license, ViaCrypt only distributes executable code and documentation for it, but they are working on making PGP available for a variety of platforms. Call or write to them for the latest information. The latest version number for Viacrypt PGP is 2.7. Here is a brief summary of Viacrypt's currently-available products: 1. ViaCrypt PGP for MS-DOS. Prices start at $99.98 2. ViaCrypt PGP for UNIX. Includes executables for the following platforms: SunOS 4.1.x (SPARC) IBM RS/6000 AIX HP 9000 Series 700/800 UX SCO 386/486 UNIX SGI IRIX AViiON DG-UX(88/OPEN) Prices start at $149.98 Executables for the following additional platforms are available upon request for an additional $30.00 charge. BSD 386 Ultrix MIPS DECstation 4.x 3. ViaCrypt PGP for WinCIM/CSNav. A special package for users of CompuServe. Prices start at $119.98 Please contact ViaCrypt for quantity discount pricing. Orders may be placed by calling 800-536-2664 during the hours of 8:30am to 5:00pm MST, Monday - Friday. They accept VISA, MasterCard, AMEX and Discover credit cards. If you have further questions, please feel free to contact: Paul E. Uhlhorn Director of Marketing, ViaCrypt Products Mail: 9033 N. 24th Avenue Suite 7 Phoenix AZ 85021-2847 Phone: (602) 944-0773 Fax: (602) 943-2601 Internet: viacrypt(a)acm.org Compuserve: 70304.41 WHERE CAN I GET THE FREEWARE PGP? These listings are subject to change without notice. If you find that PGP has been removed from any of these sites, please let me know so that I can update this list. Likewise, if you find PGP on a good site elsewhere (especially on any BBS that allows first time callers to access PGP for free), please let me know so that I can update this list. Because this list changes frequently, I have not attempted to keep it complete, but there should be enough pointers to let you easily find PGP. There are several ways to get the freeware PGP: ftp, WWW, BBS, CompuServe, email ftp server, and sneakernet (ask a friend for a copy). Just don't ask Philip Zimmermann directly for a copy. FTP SITES IN NORTH AMERICA There are some wierd hoops to jump through, thanks to the U. S. Department of State, at many of these sites. This is apparently because the U. S. Department of State wants to make it easier for people outside of North America to develop, distribute, use, or sell strong cryptographic software than people inside of the USA and Canada -- at least that is the effect of their rules. Telnet to net-dist.mit.edu, log in as getpgp, answer the questions, then ftp to net-dist.mit.edu and change to the hidden directory named in the telnet session to get your own copy. MIT-PGP is for U. S. and Canadian use only, but MIT is only distributing it within the USA (due to some archaic export control laws). You can also get PGP from: ftp.csn.net/mpj See ftp://ftp.csn.net/mpj/README.MPJ ftp.netcom.com/pub/mp/mpj See ftp://ftp.netcom.com/pub/mp/mpj/README.MPJ ftp.netcom.com/pub/gr/grady/PGP (U. S. and Canada only). ftp.eff.org Follow the instructions found in README.Dist that you get from one of: ftp://ftp.eff.org/pub/Net_info/Tools/Crypto/README.Dist gopher.eff.org, 1/Net_info/Tools/Crypto gopher://gopher.eff.org/11/Net_info/Tools/Crypto http://www.eff.org/pub/Net_info/Tools/Crypto/ ftp.csua.berkeley.edu (for U. S. or Canadian users) /pub/cypherpunks/pgp/ ftp.gibbon.com /pub/pgp/README.PGP (OS/2 users see also /pub/gcp/gcppgp10.zip) ftp.wimsey.bc.ca /pub/crypto/software/dist/README WORLD WIDE WEB ACCESS http://web.mit.edu/network/pgp-form.html http://www.ifi.uio.no/~staalesc/PGPVersions.html http://www.mantis.co.uk/pgp/pgp.html http://rschp2.anu.edu.au:8080/crypt.html http://www.eff.org/pub/Net_info/Tools/Crypto/ http://community.net/community/all/home/solano/sbaldwin http://www.cco.caltech.edu/~rknop/amiga_pgp26.html COMPUSERVE GO NCSAFORUM. Follow the instructions there to gain access to Library 12: Export Controlled. PGP may be other places, too. Compuserve file names are even more limited than DOS (6.3 instead of the already lame 8.3), so the file names to look for are PGP262.ZIP, PG262S.ZIP (source code), PGP262.GZ (Unix source code) and PG262D.ZIP (documentation only). BULLETIN BOARD SYSTEMS Colorado Catacombs BBS Mike Johnson, sysop Mac and DOS versions of PGP, PGP shells, and some other crypto stuff. Also the home of some good Bible search files and some shareware written by Mike Johnson, including ATBASH, DLOCK, CRYPTA, CRYPTE, CRYPTMPJ, MCP, MDIR, DELETE, PROVERB, SPLIT, ONEPAD, QUICRYPT, etc. v.FAST/v.32bis/v.42bis, speeds up to 28,800 bps 8 data bits, 1 stop, no parity, as fast as your modem will go. Use ANSI terminal emulation, or if you can't, try VT-100. Free access to PGP. If busy or no answer, try again later. For free access: log in with your own name, answer the questions, then select [Q]uestionaire 3 from the [M]ain menu. (303) 772-1062 Longmont, Colorado number - 2 lines. (303) 938-9654 Boulder, Colorado number forwarded to Longmont number intended for use by people in the Denver, Colorado area. The Freedom Files BBS, DeLand Florida, USA 904-738-2691 Exec-Net, New York, NY, USA (Host BBS for the ILink net) 914-667-4567 The Ferret BBS (North Little Rock, Arkansas) (501) 791-0124 also (501) 791-0125 Special PGP users account: login name: PGP USER password: PGP CVRC BBS 317-791-9617 CyberGold BBS 601-582-5748 Self-Governor Information Resource, 915-587-7888, El Paso, Texas, USA In the UK, try 01273-688888 MAUS BBS (+49 781 38807) Offenburg, Germany - angeschlossen an das MausNet OTHER FTP SITES ftp.informatik.uni-hamburg.de /pub/virus/crypt/pgp This site has most, if not all, of the current PGP files. ftp.leo.org /pub/com/os/os2/crypt ftp.ox.ac.uk (163.1.2.4) /pub/crypto/pgp This is a well organized site with most of the current PGP files as well as shells and mailer scripts. ftp.netcom.com /pub/dc/dcosenza -- Some crypto stuff, sometimes includes PGP. unix.hensa.ac.uk /pub/uunet/pub/security/virus/crypt/pgp ftp.ee.und.ac.za /pub/crypto/pgp ftp.csua.berkeley.edu /pub/cypherpunks/pgp (DOS, MAC) ftp.demon.co.uk /pub/amiga/pgp /pub/archimedes /pub/pgp /pub/mac/MacPGP ftp.informatik.tu-muenchen.de ftp.funet.fi ftp.dsi.unimi.it /pub/security/crypt/PGP atari.archive.umich.edu /pub/atari/Utilities/pgp261st.zip (Atari) ftp.tu-clausthal.de (139.174.2.10) (Atari ST/E,TT,Falcon) /pub/atari/misc/pgp/pgp261b.lzh wuarchive.wustl.edu /pub/aminet/util/crypt src.doc.ic.ac.uk (Amiga) /aminet /amiga-boing ftp.informatik.tu-muenchen.de /pub/comp/os/os2/crypt/pgp23os2A.zip (OS/2) iswuarchive.wustl.edu pub/aminet/util/crypt (Amiga) nic.funet.fi (128.214.6.100) /pub/crypt ftp.uni-kl.de (131.246.9.95) /pub/aminet/util/crypt qiclab.scn.rain.com (147.28.0.97) pc.usl.edu (130.70.40.3) leif.thep.lu.se (130.235.92.55) goya.dit.upm.es (138.4.2.2) tupac-amaru.informatik.rwth-aachen.de (137.226.112.31) ftp.etsu.edu (192.43.199.20) pencil.cs.missouri.edu (128.206.100.207) ftp.csua.berkeley.edu kauri.vuw.ac.nz nctuccca.edu.tw /PC/wuarchive/pgp/ ftp.fu-berlin.de:/mac/sys/init/MacPGP2.6uiV1.2en.cpt.hqx.gz Also, try an archie search for PGP. FTPMAIL For those individuals who do not have access to FTP, but do have access to e-mail, you can get FTP files mailed to you. For information on this service, send a message saying "help" to ftpmail(a)decwrl.dec.com. Another e-mail service is from nic.funet.fi. Send mail to mailserv(a)nic.funet.fi with the word HELP. For the ftp sites on netcom, send mail to ftp-request(a)netcom.com containing the word HELP in the body of the message. To get pgp 2.6.i by email: Send a message to hypnotech-request(a)ifi.uio.no with your request in the Subject: field. Subject What you will get GET pgp26i.zip MS-DOS executable (uuencoded) GET pgp26is.zip MS-DOS source code (uuencoded) GET pgp26is.tar.gz UNIX source code (uuencoded) For FAQ information, send e-mail to mail-server(a)rtfm.mit.edu with send usenet/news.answers/ftp-list/faq in the body of the message. MACPGP OPTIONS There are multiple parallel efforts to write an up-to-date MacPGP. See the following for the latest MacPGP beta stuff. Zbigniew Fiedorowicz <fiedorow(a)math.ohio-state.edu> has updated his MacPGP to support Apple events, and his distribution comes with complete source code. Grady's netcom directory contains a different version, about which he says "This latest bug release beta 1.23 fixes several relatively minor bugs. Source to this version is NOT available, so its use should be restricted to experimentation only." ftp://ftp.csn.net/mpj/README.MPJ ftp://ataxia.res.wpi.edu/pub/mac-pgp/README ftp://highway.alinc.com/users/jordyn/mac-pgp/README ftp://ftp.netcom.com/pub/gr/grady/PGP/MacPGP262b1.23.seq.hqx.asc PGP FOR WINDOWS, WINDOWS NT, AND WINDOWS 95 There isn't one, yet, that I know of (at least not a true native Windows application). There are several good shells that call the DOS PGP for the actual work, though. I use Viacrypt's, but there are others available as shareware or freeware at most of the sites listed above for PGP itself. IS MY COPY OF PGP GOOD? If you find a version of the PGP package that does not include the PGP User's Guide, something is wrong. The manual should always be included in the package. PGP should be signed by one of the developers (Philip Zimmermann, Jeff Schiller, Viacrypt, Stale Schumacher, etc.). OTHER PGP DOCUMENTATION For more information on the "time bomb" in PGP, see ftp://ftp.csn.net/mpj/pgpbomb.asc More PGP details are at http://www.pegasus.esprit.ec.org/people/arne/pgp.html Windows shells documentation http://www.LCS.com/winpgp.html Watch for the full PGP FAQ on alt.security.pgp. LANGUAGE MODULES These are suitable for most PGP versions. I am not aware of any export/import restrictions on these files. German * _UK:_ ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp23_german.txt * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp_german.txt * _US:_ ftp://ftp.csn.net/mpj/public/pgp/PGP_german_docs.lha Italian * _IT:_ ftp://ftp.dsi.unimi.it/pub/security/crypt/PGP/pgp-lang.italian.tar.gz * _FI:_ ftp://ftp.funet.fi/pub/crypt/ghost.dsi.unimi.it/PGP/pgp-lang.italian.tar.gz * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp-lang.italian.tar.gz Japanese * _UK:_ ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp23_japanese.tar.gz * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp-msgs-japanese.tar.gz Lithuanian * _UK:_ ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp23_lithuanian.zip * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp23ltk.zip Russian * _UK:_ ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp26_russian.zip * _RU:_ ftp://ftp.kiae.su/unix/crypto/pgp/pgp26ru.zip * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp26ru.zip Spanish * _IT:_ ftp://ftp.dsi.unimi.it/pub/security/crypt/PGP/pgp-lang.spanish.tar.gz * _FI:_ ftp://ftp.funet.fi/pub/crypt/ghost.dsi.unimi.it/pgp-lang.spanish.tar.gz * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp-lang.spanish.tar.gz Swedish * _UK:_ ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp23_swedish.txt * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp_swedish.txt MAILINGLISTE FUER PGP UND VERWANDTES (PGP MAILING LIST IN GERMAN) Die Listenadresse: pgp-friends(a)fiction.pb.owl.de Die *Request*adresse (fuer subscribe/unsubscribe und andere Administra- tiva): pgp-friends-request(a)fiction.pb.owl.de WHAT IS ALL THIS NONSENSE ABOUT EXPORT CONTROLS? For a detailed rant, get ftp://ftp.csn.net/mpj/cryptusa.zip WHAT INTELLECTUAL PROPERTY RESTRICTIONS EXIST IN THE USA? MIT PGP is only for personal, noncommercial use because of restrictions on the licensing of both the RSA algorithm (attached to RSAREF) and the IDEA algorithm. PKP/RSADSI insist that we use RSAREF instead of the mpi library for reasons that make sense to them. For commercial use, use Viacrypt PGP, which is fully licensed to use both the RSA and IDEA algorithms in commercial and corporate environments (as well as personal use, of course). Another restriction is due to an exclusive marketing agreement between Philip Zimmermann and Viacrypt that applies to the USA and Canada only. Viacrypt has exclusive rights to market PGP commercialy in this area of the world. This means that if you want to market PGP commercially in competition with Viacrypt in the USA or Canada, you would have to create a new implementation of the functions of PGP containing none of Philip Zimmermann's copyrighted code. You are free to modify existing PGP code for your own use, as long as you don't sell it. Phil would also appreciate your checking with him before you distribute any modified versions of PGP as freeware. "PGP", "Pretty Good Privacy" and "Phil's Pretty Good Software" are trademarks owned by Philip Zimmermann. This means that if you modify an older version of PGP that was issued under the copyleft license and distribute it without Phil's permission, you have to call it something else. This avoids confusing all of us and protects Phil's good name. WHAT INTELLECTUAL PROPERTY RESTRICTIONS EXIST IN CANADA? MIT PGP is only for noncommercial use because of restrictions on the licensing of the IDEA algorithm. Because the RSA algorithm isn't patented in Canada, you are free to use the mpi library instead of RSAREF, if you want to, thus freeing yourself of the RSAREF license associated with the RSAREF copyright, which is valid in Canada. For commercial use, use Viacrypt PGP, which is fully licensed to use the IDEA algorithm in commercial and corporate environments. The exclusive marketing agreement with Viacrypt also applies in Canada. See the section on USA intellectual property restrictions for more details. WHAT INTELLECTUAL PROPERTY RESTRICTIONS EXIST OUTSIDE NORTH AMERICA? MIT PGP is only for noncommercial in areas where there is a patent on software implementations of the IDEA algorithm. Because the RSA algorithm isn't patented outside of the USA, you are free to use the mpi library instead of RSAREF, if you want to, thus freeing yourself of the RSAREF license restrictions. The RSAREF copyright holds outside of the USA, even though the RSA patent does not. The IDEA conventional block cipher is covered by US Patent 5,214,703 and European patent EP 0 482 154 B1. IDEA is a trademark of Ascom-Tech AG. Commercial users of IDEA (including commercial use of PGP) may obtain licensing details from Ph. Baumann, IDEA Lizenz Ascom Tech AG Postfach 151 CH-4502 Solothurn Switzerland Tel ++41 65 242828, Fax ++41 65 242847. WHAT IS COMMERCIAL USE? Use some common sense. If you are running a business and using PGP to protect credit card numbers sent to you electronically, then you are using PGP commercially. Your customers, however, need not buy the commercial version of PGP just to buy something from you, if that is the only commercial use they make of PGP (since they are spending, not making, money with PGP). If you are just encrypting love letters or other personal mail (for which you don't get paid) on your own personal computer, that is not commercial. If you are encrypting official business mail on your for-profit corporation's computer with PGP, that is commercial use. Note that there are some gray areas not covered above, and the patent owners of RSA and IDEA may differ from my interpretation in the areas not covered above, so if you are in doubt, you should consider the licensing of Viacrypt PGP (or outside of North America, direct licensing of IDEA) to be cheap legal insurance. Indeed, the license fee is probably a lot cheaper than a legal opinion from a lawyer qualified to make such a judgement. Note that I am not a lawyer and the above is not legal advise. Use it at your own risk. ARE MY KEYS COMPATIBLE WITH THE OTHER PGP VERSIONS? If your RSA key modulus length is less than or equal to 1024 bits (I don't recommend less, unless you have a really slow computer and little patience), and if your key was generated in the PKCS format, then it will work with any of the current PGP versions (MIT PGP 2.6, PGP 2.6ui, or Viacrypt PGP 2.7). If this is not the case, you really should generate a new key that qualifies. MIT PGP 2.6.2 should be able to use 2048 bit keys. Generation of 2048 bit keys was supposed to automatically be enabled in PGP 2.6.2 in December, 1994, but a bug caused the actual key limit to be 2047 bits. MORE WORLD WIDE WEB URLs http://draco.centerline.com:8080/~franl/pgp/pgp-mac-faq-hinely.html http://draco.centerline.com:8080/~franl/pgp/pgp.html http://draco.centerline.com:8080/~franl/crypto/cryptography.html http://www.pegasus.esprit.ec.org/people/arne/pgp.html http://rschp2.anu.edu.au:8080/crypt.html http://ibd.ar.com/PublicKeys.html http://www.ifi.uio.no/~staalesc/PGPversions.html WINDOWS SHELLS Several shells for running PGP with Microsoft Windows are available at the same places PGP can be found. MACPGP KIT ftp://duke.bwh.harvard.edu:/pub/adam/mcip/MacPGP_icons.sit.hqx ftp://duke.bwh.harvard.edu:/pub/adam/mcip/MacPGPkit.hqx ftp://duke.bwh.harvard.edu:/pub/adam/mcip/MacPGPkitSources.sit.hqx BUGS See the documentation that comes with PGP in the latest versions for bugs in the older versions. The latest versions of PGP may not fully wipe all traces of plain text from a file when given the -w option. For more information, see http://www.mit.edu:8001/people/warlord/pgp-faq.html BETSI - BELLCORE'S TRUSTED SOFTWARE INTEGRITY SYSTEM For information on this service, send mail to certify(a)bellcore.com with the subject help, or check http://info.bellcore.com/BETSI/betsi.html INTEGRATING PGP AND PINE Send blank e-mail to slutsky(a)lipschitz.sfasu.edu with Subject: mkpgp to get a c-shell script to interface PGP and Pine. Send a second message with Subject: addtomkpgplist if you want updates sent you automatically. HOW DO I PUBLISH MY PGP PUBLIC KEY? There are lots of ways. One way is to use a key server. Send mail to one of these addresses with the single word "help" in the subject line to find out how to use a key server. pgp-public-keys(a)pgp.iastate.edu pgp-public-keys(a)pgp.mit.edu pgp-public-keys(a)pgp.ai.mit.edu public-key-server(a)pgp.ai.mit.edu pgp-public-keys(a)cs.tamu.edu pgp-public-keys(a)chao.sw.oz.au pgp-public-keys(a)jpunix.com pgp-public-keys(a)dsi.unimi.it pgp-public-keys(a)kiae.su pgp-public-keys(a)fbihh.informatik.uni-hamburg.de There is also an experimental public key server at http://ibd.ar.com/PublicKeys.html There is an excellent commercial key certification and publication service, too. For $20/year or so, you can have your key officially certified and published in a "clean" key database that is much less susceptible to denial-of-service attacks than the other key servers. People need not pay any fees to retrieve keys so published. Send mail to info-pgp(a)Four11.com for information, or look at http://www.Four11.com/ You can also mail your key to pgp-public-keys(a)c2.org, and it will be posted to the subscribers of that mailing list, sent to the keyservers, and posted to alt.security.keydist. To subscribe to the mailing list, send a message to majordomo(a)c2.org with "subscribe pgp-public-keys" in the body of the message. Another way is to upload it to the PGP public keys area of the Colorado Catacombs BBS (303-772-1062). Another way is to just send it to your correspondents. You could add it to your .plan file so that finger returns your key. You could add it to some of your postings. No matter which way you do it, you should have your key signed by someone who verifies that your key belongs to you, so that you don't have someone else generating a key that has your name on it, but that isn't yours. Here is my public key: - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.7 mQCNAi4PT2QAAAEEAPPCZnrshEJ9PSnV+mXEwjM4kzJF0kyg2MnLMzo83vWI40ei jogncqdkXT0c2TQWg+Bsu9ckFoXdId0utumYv0aqd8yI/oU/DwJ1zJrqRL2PFbxe ZLofHoKFjvq1TiNiJq9ps3jW6iYS4IU1SzyKhjmyE+K0+WyrPPX0zg8FAL9FAAUR tCdNaWNoYWVsIFBhdWwgSm9obnNvbiA8bXBqQGNzbi5vcmc+IG1wajiJAJUDBRAv Cw5o1TIhz19jpbkBARptA/9RHd27Io/48e3KRj/i/rptFTxdUR2DZTn+OrW23aNC 1fjH3YJl1C43lzipUL2Si6Paj1LKKBSVMVYAly8XMP5S+wEokzYffqsZfv6VrC7f YozSNLsHbjDdY6JjRY6LHTU0hAe3grzWpBJPwc9oXsUJynrGk7jTCs+6nkrHddTa zokAlQIFEC4bdyFleYS4x6lm3QEBm0AD/RHDmaKe2VQOAfJw1t6jIiIwegu7yNZo JJqIZK350NTUD9tQKj6Ciu/lNjE4KVF/dceMPrNKihbJTPd6Gi2vM9gu6eFU4TZg HE9T468oU5zfuZxmudcYGUXk1uWdJjGnTXzq0ZpObtYxbHs0OUdPga+HMclBI6ij jzKQOQqb+aQsiQCVAgUQLg9Zuz9nBjyFM+vFAQErIwP8DuS/3ULVlkhG2RsL2T2W xY6A6c7zAbxsYxqNpyjjrlnmWVYP5jxAIx1JZyjC04EZ9bRa/VtnW55t4KmDUvrq knsL4E4TGuSA+pFUKy0suJV6soZ5I5mjfJe3FgphfuYdA+sen3x5/t9QbgiIpL5L 7OeYbGknCtWwdlGWEneFdSyJAJUCBRAuD1l59fTODwUAv0UBAUFMBACHi7hW6fta E+4vp+xeJealpoZ94u13duJGP9o4wAbV4e6FV1Z6PHvWiubIpN00HZhXnpumwTcl D8qEG5gOjQ1KRGep4zZL4R/tpkSDpDji5cbnamoJlSV20J5h86zdosJH1IyVzpjf OalLAHXAo/Tn6033Ou41hUooEtYQgUBjtbQrTWljaGFlbCBQYXVsIEpvaG5zb24g PG0ucC5qb2huc29uQGllZWUub3JnPokAlQMFEC8LDn/VMiHPX2OluQEBiGkD/0Qu BxvMErp6BCaQVmh1Zxp0dghYZmAPK/15xDGLoTLcv7+hltDqntlZcH3Pb8UGTYmW /v/+e0wPErTl3Fp+KV/tzcGqo/n2GwKAcrk6cYpMVysLr6c47Sf1c0/EE4Xhczx3 sfPxLBoJ6z8n/sq5WNfjgfOM9ol/hXUZpaJ+Ykf9tCBNaWNoYWVsIEpvaG5zb24g PG1wakBuZXRjb20uY29tPokAlQMFEC8LDpTVMiHPX2OluQEBNWYD/iwuOas0LcM/ 7UFhWc6qZBTaQ2i0/fLdSq1NbnqZ/qAga4Gp+wNmBI3xvNBnF1Vm76Ss9G2PWgIE qzcJWLYULGVoT/rFwOLST4TXYK8m/juVKfinmntkwWeDRkXqlGWnvbndjNTYGwEn D+gTouzLAeYrd955OqxaIaVaNRWGlZBbtChNaWtlIEpvaG5zb24gPDcxMzMxLjIz MzJAY29tcHVzZXJ2ZS5jb20+iQCVAwUQLwsOqdUyIc9fY6W5AQGWsgP/dq1QNJ/1 ZsD3CJlcIGF/bbQwd6tozd2eXS4GQMwvuanHIuraGRVvAd1QodmWMQnVVOPOat5r Wq9vOBGan2GFp/OTNCBJTS664Ezdi8cpIdcLYasHJEBZ1mWCrTXLdvRlvNtL80x3 SmZH28m9Z3QMghzUg3q6KuZUy58UCgnMAx20K01pY2hhZWwgUC4gSm9obnNvbiA8 bXBqb2huc29Abnl4LmNzLmR1LmVkdT6JAJUDBRAvCw6+1TIhz19jpbkBAa77A/4q SsVT/+VsAHwmAn/JuXnNDOIqkqRlMMFWoB1QySEI8QHljrFJU5UphqWbVGhVNazv FSMAtTkgbM6R6n1BTx9EObR4y3ZmfRHTZbSsDOYmtF2pWxCG/qfg9cOKJBD4oxB2 ORo74hXecb0dGrDwBgl0OEJ7BF4FMr1wzWhgodsP97QtRG8gbm90IHVzZSBmb3Ig ZW5jcnlwdGlvbiBhZnRlciAyNyBKdW5lIDE5OTYuiQCVAwUQLwsO09UyIc9fY6W5 AQFyvgQAhPbYYVsYiyv67rKOEhROw/QKluloHZIvx53eWxVQ7KNpp/jg+KBVjL7N yoteDcofbVseBugAiAFPJgNQVCGfG5w6rtvMm4tN8oTz/4Q+vf6DyCkQnj+Qu6KO Fo80TgazVGeteODtCDiZg4wMUv0TNTd80NV6hm0Ygd/pmw+7A7w= =htAN - -----END PGP PUBLIC KEY BLOCK----- TIME STAMP SERVICES Mail sent to Time S. Tamp <timestamp(a)lorax.mv.com> will be returned, signed with its own private key. REPRODUCING THIS FAQ Permission is granted to distribute unmodified copies of this FAQ. To get the latest version of this FAQ, get ftp://ftp.netcom.com/pub/mp/mpj/getpgp.asc or send mail to ftp-request(a)netcom.com with the line SEND mp/mpj/getpgp.asc in the body of the message, or send blank mail to mpjohnso(a)nyx.cs.du.edu. This FAQ is also archived at rtfm.mit.edu with a very long file name. There are many other frequently asked questions. Most of them are covered in the documentation that comes with PGP or in one of the books about PGP. Send corrections to mpj(a)netcom.com. I regret that I lost some of the corrections people sent me on the last round of this FAQ, so if I missed yours, please send it again. Thanks. ___________________________________________________________ |\ /| | | | | \/ |o| | Michael Paul Johnson Colorado Catacombs BBS 303-772-1062 | | | | / _ | mpj(a)csn.org aka mpj(a)netcom.com m.p.johnson(a)ieee.org | | |||/ /_\ | ftp://ftp.csn.net/mpj/README.MPJ CIS: 71331,2332 | | |||\ ( | ftp://ftp.netcom.com/pub/mp/mpj/README -. --- ----- .... | | ||| \ \_/ |___________________________________________________________| -----BEGIN PGP SIGNATURE----- Version: 2.7 iQCVAgUBLxvrHPX0zg8FAL9FAQHz9AQAjdyLzJ2L+PSkqL0nZ4ULiq4ReHdYfLrX DlBvkM9JG0jCgpDmcWkWg4IEUwJ8VoKnjFYaUgbw3CkCoIZYRekXrUkRgoZSq5TV BdADxEXJabF7It3e6jH2ICVNSYdsfe/4xh+8F7v7CKzSZubtwaLOIbZ+CSBVi3D0 3iyn6+zrZVo= =5zak -----END PGP SIGNATURE-----

1 0

Lance Rose writes anti-cryptoanarchy in WIRED
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

I've missed recent traffic so forgive me if this has already come up. Lance Rose writes a particularly twisted piece in the Idees Fortes section of WIRED 3.02 (February). His basic premise is that tradritional forms of copyright law are sufficient to ensure that the Net poses only limited problems to mass content producers such as Time Warner. I agree with this, as most people feel uncomfortable about 'stealing' however impossible it is to detect. Lance Rose, though, goes on to insist that the reason for the copyright law's strength will be the power of the omnipresent Net Cops (sic). So that you don't consider him entirely ignorant, he acknowledges the increasing use of anon remailers. However, he adds (repeatedly), "Can't we all use anonymous remailers to keep the Net knee-deep in infringing copies? Nope. Net cops can swiftly clean each new infringement out of the major online markets as soon as it appears." How will they do this so efficiently? By "deploying software agents" net-wide to "search out anonymous infringements." He later admits the possibility of "friend-to-friend" markets, but rejects the possibility of such markets growing out of hand, as "few or none of the participants will know everyone else in the circle" allowing cops to join them undetected (as if the Information Liberation Front would mind giving the _cops_ pirated software). "A symbolic legal attack" every once in a while will scare would-be black-marketeers. Later, he does discuss the hidden costs of acquiring pirated versus genuine stuff - "the time and effort needed to track down pirate dealers [...] who are so deep underground even the cops can't find them." Sheesh. And here we are, post-BlackNet, discussing untraceable paid-for anon-remailers (which exist today on Sameer's c2.org blind server) and data havens. I haven't bothered to hunt for Lance's address, which is not given, but really I thought someone as prominent a SysLawyer as him would be clued in. Nor have I found the time to send WIRED a letter. OTOH maybe ignorance, for LEA-friendly legislators who read WIRED, is bliss? Let the sleeping dog lie, etc, just finish your data haven code ;-] ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "In between the breaths is rishab(a)dxm.ernet.in the space where we live" rishab(a)arbornet.org - Lawrence Durrell Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

7 9

Surety Technologies announces: Digital Notary System is on-line
by stuart＠surety.com 17 Dec '03

17 Dec '03

Many readers of this list have heard about the work that Scott Stornetta and I have done, beginning as Bellcore researchers a few years ago, on the problem of cryptographically secure digital time-stamping. In 1993 Bellcore spun off a company in order to commercialize this work. The company is called Surety Technologies, and we call our product and service the Digital Notary(tm) System. I am happy to report that we have just launched the product. To read about it, as well as to get the software, please visit our World-Wide Web home page: http://www.surety.com You can get the software and installation instructions directly by anonymous ftp to ftp.surety.com in the directory /dns/windows. Scott and I would both like to thank those readers of the list who have offered us their support, encouragement, and advice over the years. Stuart Haber | Surety Technologies provides Chief Scientist | the Digital Notary(tm) System. Surety Technologies, Inc. | General info: info(a)surety.com stuart(a)surety.com | (201) 701-0600, fax -0601

1 0

internet mag
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

This month's issue of Internet World Magazine deals primarily with internet security. I'm am not going to review everything in the mag but I'll list the table of content: Better Safe: Danger lurks on the Info Highway. You must take precaution to reduce your riks. By Dave Taylor and Rosalind Resnick Getting Cryptic: Phil Zimmermann's PGP gives you powerful encryption to keep your messages safe from prying eyes. Read all about it. By William Stalling. (Introductory article about PGP. Nothing we, here, don't already know) Securing the Enterprise: Connectiong your corporation to the Internet can be a security nightmare. Firewalls are the main line of defense. By Alton Hoover (An overview of Firewalls, application-layer gateways and token-based authentication schemes) Beyond the Firewall: The latest firewall technology not only detects intruders, but strikes back. By Winn Schwartau (Very interesting article. Here are some quotes to wet your appetite: Wouldn't it be nice if a computer system attacked from the Internet responded to the attack by striking back at the intruder? This is exactly what Sidewinder's implementation of type enforcement does.....It will detect the intrusion immediately....As soon as a violation occurs, a silent alarm is activated....sidewinder can be configured to react in any number of ways, once an attack has been detected...it can shut the intruder cold...(or)...it can invoke a mechanism that would record all the information from whence came the attack....By luring the attacker into a false sense of security, the hacker would continue trying to break in, unaware that every step was being recorded... Cashing In: As Internet commerce expands, a host of companies are vying to establish their system as the basis for cyberbanking and credit-card transactions. By Lisa Morgan Business Browser: New versions of Mosaic with built-in encryption promise to keep your transactions safe. By Richard W. Wiggins Unlawful Entry Crackers can feasts on your data if you fail to plug your leaky Unix system By Aaron Weiss (Five Ways to crack a Unix System) It's Alive: Although the furor has subsided, reports of Clipper's death are greatly exaggerated. The government's controversial eavesdropping effort lives on. By Steven Vaughan-Nichols Building Trust The chief executives of Trusted Information Systems -Steve Crocker and Steve Walker- talk about encryption, CyberCash, Clipper, and more. By Jeff Ubois. All in all a rather interesting mag. Check it out. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ wizard(a)alpha.c2.org Give me the liberty to know, to utter, and to argue freely according to conscience, above all liberties. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Anonyous Cash through Options Trading
by pcw＠access.digex.com 17 Dec '03

17 Dec '03

Several months ago, there was a discussion at length about how one could use the futures and options markets to transfer funds anonymously. This week's edition of Forbes magazine (Jan 30, 95) has the headline, "OIL! GUNS! GREED! Was Chase Manhattan ripped off by arms traffickers?" In the story, Forbes guesses that some suspiciously large losses in the options market could have been a smoke screen for money laundering: Oil traders do big business in unlisted options, providing a further smoke screen. Perkins points to deals in which Harris would buy a put option on a cargo of crude from a friendly counterpart like Bayoil and resell a similar contract in the oil market. If oil prices climbed, the put would expire worthless and Bayoil would pocket the price of the option, while Arochem would break even. If oil prices dropped, and the ultimate buyer exercised the put, Arochem could absorb the loss while conveniently neglecting to exercise its put against Bayoil, Perkins theorizes. (pg 87)

1 0

Re: JP vs Homer
by jalicqui＠prairienet.org 17 Dec '03

17 Dec '03

> We are capable of controlling mail bombs, for instance, in the >following way: > > Take an incoming message, capture From: line. Strip header. MD5 body. >Add to sorted table [From: MD5(message) date]. Check for repetition of >first two fields. If reps = 1, forward message. If reps = 2, send message >to From: "Possible error. Two copies of message <message> received." If >reps = 0 mod 5, send letter to postmaster@From:. "Possible mailbomb or >spam. <reps> copies of <message> received from <From:> at your site in the >past week." Clear table of entries more than a week old every midnight. > > > If all remailers did this, then no matter where the net was entered, >the messages would be rejected. And spammers/bombers would be spamming/ >bombing their own postmaster. Probably a bad idea. If not all did it, >then add special handling to hit remailer-operator@. This would encourage >the operator to auto-magically handle the spam-bomb himself. This works only if one assumes that the exact same message is posted using the exact same path. Granted, it would probably be effective for novice spammers. Consider a premail/chain type script and a cleartext spam message. The script is executed once every five minutes, say. When it runs, it creates a new random path through the remailers, adding encryption wrappers for each hop. Your spam detector would miss this one completely unless your remailer was used as the terminal remailer for a significant number of spams. More significantly, the MD5 hashes of each message would be different even if the same path were used more than once because the PGP session key would be different (again, unless your remailer would be the terminal remailer in the particular path that repeated).

1 0

WSJ on CIA Dump
by John Young 17 Dec '03

17 Dec '03

The Wall Street Journal January 18, 1995, p. A14. Get Smart -- Eliminate the CIA By Angelo Codevilla Over the past several years, U.S. intelligence agencies in general and the CIA in particular have proved themselves incompetent in peacetime and of little use in conflict. Stripped of their mystique and lacking the capacity to reform themselves, these organizations are virtually in receivership. The maladies ailing the intelligence community are numerous. Independent quality control was never more than a pretense, and competition among intelligence agencies was nonexistent. Producers of intelligence -- rather than the soldiers and diplomats who have to use it -- have also become its judges. All this has spawned a complex of habits, procedures, mentalities and people too entrenched to be repaired and too noxious for any part to form the nucleus of a new, healthy system. Hence, we should take Sen. Daniel Patrick Moynihan's advice, and rethink our intelligence from the ground up. A good place to start is with the fact that about half of the $28 billion U.S. intelligence budget pays for units directly controlled by military commanders, which routinely provide precise information for the armed forces' operations close to the front lines. The Treasury and State Departments also have their own intelligence units, which fit their needs quite well. So why do we need a national system headed by the CIA? The original justification for the creation of the CIA in 1947 was that intelligence would be best if its gathering and evaluation were divorced as much as possible from the operating departments of government -- State, Defense, etc. -- and placed under the president. This judgment has turned out to be wrong. Because presidents have relied on the CIA to run the system, the result has been a system dominated by the priorities of the producers -- not the users -- of intelligence. A basic failing is that the CIA has primary responsibility for intelligence and none at all for real world events. The CIA prefers to place its career employees in U.S. embassies, where they pretend to be employees of other parts of the government. Such "case officers" must acknowledge that they are gathering information for the U.S. Another disadvantage is that they don't speak foreign languages well. And unlike successful reporters, they virtually never know the substantive fields about which they are seeking information. Thus it is unsurprising that they are usually outdone in economic reporting by economic reporters, in military reporting by military reporters, and so forth. The Aldrich Ames case shows how much more highly the CIA values the smooth functioning of its system than what the system produces. Mr. Ames handed the KGB the capacity to shape the intelligence flowing to top U.S. officials during the endgame of the Cold War. Thus disinformation made presidents and secretaries of state more vulnerable to Gorbomania than the average citizen informed by newspaper accounts. How could the CIA fail to notice the fishiness of reports generated by a network controlled by the other side? The same way that, in the 1970s and 1980s, the agency had failed to notice that it was passing along reports from a network of agents in Cuba totally controlled by Castro's DGI, and from a network in East Germany all but a few of whose agents were working for the Stasi. In other words, while the Ames case was unusually destructive, it was a typical example of bureaucratic sclerosis. In the Gulf War, intelligence worsened the farther one got away from the front lines. The national system headed by the CIA misperceived the nature of Saddam Hussein's regime, failed to grasp the obvious signs of attack, and has yet to learn Saddam's military and political reasoning. Our imaging satellites failed to find mobile Scud launchers, and our communications intelligence antennas failed to shed light on the diplomatic intercourse between Saddam and the Soviets. National analysts misjudged Iraq's nuclear program, and were fooled by elementary camouflage. Gen. H. Norman Schwarzkopf's public belittling of CIA-run intelligence was matched by unprintable epithets from field commanders. What happened in the Gulf would have happened in any conflict because the intelligence community's cameras and antennas were conceived, and its people trained, on the CIA's assumption that cooperative competition with the Soviet Union would last forever and that the basic designs of weapons would not change. Thus cameras, for example, were optimized to take pictures of fixed installations rather than to keep track of attacking military forces or mobile missile launchers. Long before the Soviet collapse, however, it had become clear that the CIA made bad bets. The age of mobile missiles arrived long ago, and modern weapons are defined by the software they contain rather than by observable features. So what's the point of, for example, analyzing a radar signal that a computer can change in an instant? Divorce from operational responsibility also tends to make the reports that flow to top officials less valuable than the information used to compile them. (In any given subject, the CIA delivers a consensus of the system's several agencies. It takes far more time for a paper to go through the interagency process than for someone to write the paper. Considering the elementary errors and ignorance that often come out, it is clear that the conferees do not spend much time fact-checking. Intelligence analysts become spin doctors, concerned not with facts but with pushing policy makers in the direction of their parent agencies' prejudices. Hence the ultimate irony: A system whose ostensible reason for being was to eliminate from intelligence the parochial interests of tank drivers, diplomats, bomber pilots, etc. ended up aggregating the prejudices of the analysts -- prejudices unrelieved by the sobering prospect of having to carry out the policies they are pushing for. The CIA has maintained a monopoly on judging the quality of the system's operations and products. It does not heed presidents, much less their appointees. A decade ago, the agency ignored President Reagan's executive order to reorganize counterintelligence. Two decades ago, President Ford, shocked by how far intelligence estimates were diverging from reality, asked a group of distinguished outsiders (the B team) to see whether the intelligence community's data on Soviet nuclear forces could support conclusions different from those of the insider analysts. The B Team, despite resistance from the agency, came up with results far superior to the insider A Team's. A better intelligence system should be built on a model radically different from the 1947 original. Each of the major departments of the U.S. government (State, Defense, etc.) should be responsible for gathering and evaluating the information it needs to operate in the new world disorder. Intelligence, in short, should be franchised out to its consumers. There is reason to believe that the departments would do better without the ClA's tutelage than with it. In the past, the armed forces have asked to deploy officers who speak foreign languages, who could blend in with the local population, and who would be experts in the military fields on which they were reporting. U.S. military leaders have also clamored for satellites whose products they could use. Each time, the CIA made sure such requests were denied. If those requests had been granted, the country would be better informed. In all this there is a need for some central coordination. The several agencies have to mesh their quest for agents abroad, lest they stumble over each other. The information that any part of the government collects must be available to properly cleared people in all other parts, so that any and all analysis can be based on all the facts. Fortunately, maintaining a central registry nowadays requires computers, rather than the bureaucratic monster that arose a half century ago. Finally the president of the United States' own intelligence needs should be provided by his own staff. Among its duties should be to make sure that all the agencies get each others' estimates. The availability to the president and other top decision makers of contrasting estimates from through out the government would stimulate better performance all around. So, while there is a role for a central intelligence agency in a system based on consumer sovereignty, there is none for the CIA. Mr. Codevilla, a fellow at the Hoover Institution, is the author of "Informing Statecraft" (Free Press, 1992). End

1 0

BYTE on PGP WoT
by John Young 17 Dec '03

17 Dec '03

William Stallings writes in the BYTE February issue on "The PGP Web of Trust."

1 0