December 2003 - cypherpunks-legacy

Re: Data Haven problems
by pstemari＠erinet.com 17 Dec '03

17 Dec '03

At 07:25 PM 1/9/95, dfloyd(a)io.com wrote: > ... Of course, the DH will be hidden by a good remailer (anon.penet.fi), but >it is trivial to use traffic analysis to find where the DH lies. Just >monitor traffic from/to the remailer and do a series of store/retrives. >Then for confirmation, forge a mail from the dh site to the remailer with >the password (obtained from sniffing) to yourself. ... Hmm, hmm. Using c'punk remailers with encrypted send blocks fixes one problem, especially if the c'punk mailers do some sort of file splitting and reassembly along the lines of what happens to IP packets that are too large for a given link. What would also help would be a mechanism for randomly varying the encrypted send-to block. The password replay attacks can be fixed by encrypting the transmitted password along with a timestamp/sequence number. One problem that remains would be a trail left by the increased traffic to/from a DH vs a normal user. That could only be fixed by a multitude of DH sites. --Paul J. Ste. Marie pstemari(a)well.sf.ca.us, pstemari(a)erinet.com

2 1

PRESS RELEASE - RSA Licenses Commercial Distribution Rights to RSAREF (long)
by Christopher Allen 17 Dec '03

17 Dec '03

-----BEGIN PRIVACY-ENHANCED MESSAGE----- Proc-Type: 4,MIC-CLEAR Content-Domain: RFC822 Originator-Certificate: MIICRjCCAdsCBQJTAAAEMA0GCSqGSIb3DQEBAgUAME4xCzAJBgNVBAYTAlVTMRMw EQYDVQQIEwpDYWxpZm9ybmlhMSowKAYDVQQKEyFDb25zZW5zdXMgRGV2ZWxvcG1l bnQgQ29ycG9yYXRpb24wHhcNOTQwNjI3MDAwMDAwWhcNOTUwNjI2MjM1OTU5WjCB 4DELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExKjAoBgNVBAoTIUNv bnNlbnN1cyBEZXZlbG9wbWVudCBDb3Jwb3JhdGlvbjETMBEGA1UEERMKOTQxMTQt MzYxNTETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNU2FuIEZyYW5jaXNj bzEeMBwGA1UECRQVNDEwNC0yNHRoIFN0cmVldCCmNDE5MRIwEAYDVQQMEwlQcmVz aWRlbnQxGjAYBgNVBAMTEUNocmlzdG9waGVyIEFsbGVuMHAwDQYJKoZIhvcNAQEB BQADXwAwXAJVKa43Pd6AhLaYGRLMwvGGvZ7dtzK+XpsRtwKYEDQKHE8swS09ViEg MKuMa/+weQXDBpqQ6SDj/xgHGzmwGhkbeitPWr/6Du5gemMLrhhTs8eMhAXLXwID AQABMA0GCSqGSIb3DQEBAgUAA1YAEkQDfJmroAMZD5v1F7fPK38y4waoX0FSpdsf jcXf04URcEJc5dCFm0DzrMPMdVpNz5tpSBy0ZUeg/xqbwRfHIW34bMAVLc9kojIi AGXlHL/q8HRCIx== Issuer-Certificate: MIIB6TCCAVYCBQJBAAAKMA0GCSqGSIb3DQEBAgUAMFwxCzAJBgNVBAYTAlVTMSAw HgYDVQQKExdSU0EgRGF0YSBTZWN1cml0eSwgSW5jLjErMCkGA1UECxMiQ29tbWVy Y2lhbCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw05NDA1MDUwMTEwMDRaFw05 OTA0MzAwMTEwMDRaME4xCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlh MSowKAYDVQQKEyFDb25zZW5zdXMgRGV2ZWxvcG1lbnQgQ29ycG9yYXRpb24wcDAN BgkqhkiG9w0BAQEFAANfADBcAlUpc+2/Ec+bydwsB6enemznB/aQwd4gp2YSI3FW PHl2tc/aa7HZFA0qCL/0Ol6ituC+yUEO3IWKQ5U8hhl1RVqmW7mzwNOr2yeHIFA5 rqXvAvMvlGpvAgMBAAEwDQYJKoZIhvcNAQECBQADfgA2QEssX/nG3spHBpbkU4KV oQdVhxtQEmjuIrqBVI9jQRntacJ0tw1m5MsLV6hNMV/mD0yKmDc9ywSF7ZWIipVY tz8E52yQEprR+JxTad+/ZtTI0wEvEM5313jUF4ivF86eOuZDqHd4zbRHk6ggIAGH 86GFbMaWDaKoGUrde2== MIC-Info: RSA-MD5,RSA, J9l0zSgqnVqK8a9QQ3Ml+O6tv58PsVmCELOQTqj1i8HCQoHpJ+bEmayf4WyIbqoY y4xFecAPQfP5hpHPLVoLX4IM7kNT0UhDHW8XklfhhAVE1+Y0Og== Date: Mon, 09 Jan 1995 09:00:00 -0800 Subject: PRESS RELEASE - RSA Licenses Commercial Distribution Rights to RSAREF From: Christopher Allen <ChristopherA(a)consensus.com> Organization: Consensus Development Corporation, San Francisco, CA USA Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" X-Text-Source: ftp://ftp.consensus.com/pub/consensus/pr/RSAREF-PR.txt X-HTML-Source: http://www.consensus.com:8300/RSAREF-PR.html Summary: RSA announces that it is licensing commercial distribution rights of its RSAREF software to Consensus Development, allowing for implementation of commercial Privacy Enhanced Mail (PEM) applications. Keywords: press release, consensus development corporation, rsa data security, rsaref, commercial license, support, marketing, maintenance, encryption, digital signature, source code, tool kit, PEM, privacy enchanced mail RSA Licenses Commercial Distribution Rights to RSAREF ===================================================== RSA announces that it is licensing commercial distribution rights of its RSAREF software to Consensus Development, allowing for implementation of commercial Privacy Enhanced Mail (PEM) applications. Press Release - ------------- REDWOOD SHORES, CALIFORNIA--JANUARY 9, 1995--RSA Data Security, Inc. and Consensus Development Corporation jointly announce today at the RSA Data Security Conference that Consensus Development is licensing the commercial distribution rights of RSAREF from RSA Data Security. RSAREF (pronounced "R.S.A. reff") is short for "RSA reference implementation" and is a cryptography source code toolkit designed to allow developers to create PEM (Privacy-Enhanced Mail)software and other encryption/authentication tools. Until now, RSAREF has been an unsupported RSA product approved for use only as part of freeware and not-for-profit software applications. Consensus Development will now be able to market and license RSAREF to commercial software developers, and provide software support and future enhancements to the RSAREF source code library. This announcement is significant because it is the first program of its kind to make the RSAREF implementation of RSA's popular patented authentication technology available to commercial vendors. "Data mailed, posted, or put on servers on the Internet is inherently untrustable today, " said Jim Bidzos, president of RSA. "Tampering with electronic documents takes no special skills, and leaves no trace.With the availability of RSAREF for both free software as well as commercial software there is no need for this situation to continue." Now that a commercial license to RSAREF is available, applications may now be developed and sold that incorporate Privacy-Enhanced Mail's authentication and encryption capabilities. Christopher Allen, President of Consensus Development adds "The PEM standards have been under development for a couple of years and only now are coming to fruition. The ability to offer both freeware developers and commercial software vendors a license to RSAREF will kickstart the adoption of PEM-capable mail software." Consensus Development will be creating an email discussion list for software developers interested in RSAREF. To join the discussion, send a message to <listproc(a)consensus.com> with the body of the message requesting "subscribe RSAREF-DEV-L firstname lastname". Background - ---------- The RSA cryptosystem was invented and patented in the late 1970's by Drs. Rivest, Shamir, and Adleman, at the Massachusetts Institute of Technology, who started RSA Data Security in Redwood City, California, in 1982. Digital signatures are produced using the RSA Cryptosystem, which is a public-key cryptosystem. Each user has two keys - one public and one private. The public key can be disclosed without compromising the private key. Electronic documents can be "signed" with an unforgeable signature by using a document/private-key combination to produce a signature unique to the author and particular document. Anyone using an application that supports RSAREF and has the public key of the author can subsequently verify the authenticity of the document. Applications of digital signatures are endless: expense reports, electronic forms and purchase orders, contract revisions, engineering change orders, even tax returns can be electronically signed to speed electronic document flow and eliminate fraud. Furthermore, digital signatures can also be used to detect any virus before a program is executed, since any change whatsoever is detected. One reason that the paperless office has never materialized is that paper must still be printed so that handwritten signatures can be applied. RSAREF eliminates that necessity. Applications supporting RSAREF could have prevented last year's computer fraud at Dartmouth College, in which students were tricked into missing an important midterm by a fraudulent electronic mail message claiming to be from university faculty. Corporate Profiles - ------------------ RSA Data Security, Inc. <URL=http://www.rsa.com/> is the acknowledged world leader in encryption technology, with over three million copies of its software encryption and authentication installed and in use worldwide. RSA is a defacto standard for encryption and digital signatures, and is part of existing and proposed standards for the Internet, CCITT, ISO, ANSI, IEEE and business and financial networks around the globe. RSA develops and markets platform-independent software developers' kits, end-user products, and provides comprehensive consulting services in the cryptographic sciences. RSA technology has been embedded in the products of many companies, including Microsoft, IBM, Apple, Oracle, General Magic, DEC, Sun, Novell, Lotus, Motorola, Northern Telecom, AT&T, WordPerfect, General Electric, Hughes Aircraft, and many others. The company is headquartered in Redwood City, California. Consensus Development Corporation <URL=http://www.consensus.com:8300/> is a software development and consulting firm specializing in the support of organizations that need long-distance collaboration via wide-area networks and the Internet.Consensus Development has been offering consulting and software tools in the area of collaboration support since 1988 and is based in San Francisco, California. Clients include Aladdin Systems, American Information Exchange (AMIX), America Online, Apple Computer, Attain, Authorware, Berrett-Koehler Publishers, Claris Corporation, Component Integration Laboratories, Connectix Corporation, Digicash bv, Group Technologies, InterCon, ON Technology, Portfolio Systems, RSA Data Security, Ronin Publishing, Software Ventures, Visa International, and Xanadu Operating Company. Contact - ------- Kurt Stammberger RSA Data Security, Inc. 415/595-8782 <kurt(a)rsa.com> Christopher Allen Consensus Development Corporation 415/647-6383 <ChristopherA(a)consensus.com> $$ - ------------------------------------------------------------------------ ...Christopher Allen Consensus Development Corporation.. ...<ChristopherA(a)consensus.com> 4104-24th Street #419.. ... San Francisco, CA 94114-3615.. ... o415/647-6383 f415/647-6384.. ...Mosaic/WWW Home Page: .. ...Consensus Home Page .. -----END PRIVACY-ENHANCED MESSAGE----- Created with RIPEM Mac 0.8.5 b1

2 1

Re: DH Traffic Volume Analysis
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Paul J. Ste. Marie writes: > One problem that remains would be a trail left by the increased traffic > to/from a DH vs a normal user. That could only be fixed by a multitude of > DH sites. Ubiquitous remailing -- having a significant portion of the net population bouncing around randomly fluctuating encrypted traffic as background noise -- should help to cover both remailers and data havens. It would be nice to have more people firing off occasional encrypted stuff to muddy the waters. (Picture yourself in Bridge over the River Kwai if it helps ;) -L. Futplex McCarthy; PGP key by finger or server - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLxIkLGf7YYibNzjpAQGZfgQAp464Szt+W1pvcHQRLH39kmato3tQaHIn mNSNjeXBwWqrgIXYoLAQfcX1qvVb0NJQikGc4P7Xo/o7Aa2LOIWTt6TRxXlUkaod gmYr6XGvoCST1eciMeMTKRjVRJgA6p4/GmQwQwmvFtTus1waS5T+RsNX0nbCu3ng eg3sZ5s7pKI= =973H - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLxIlNCoZzwIn1bdtAQFGBQF/Zl+lLTMyM55oRF2PSsA0ld13i/I1uyvW sD3C3JkqgQ9XsDjGquKXoPwDCsAEgN6E =7MWJ -----END PGP SIGNATURE-----

1 0

Re: for-pay remailers and FV
by Hal 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- From: Pierre Uszynski <pierre(a)shell.portal.com> > Finally, I do not believe that introducing payment in the remailer > system would curb abuse in any significant way. Significant abuse is > that which causes significant problems for the operators: posting > secret religious technology, forging prime minister mail, harrassing a > member of any number of opposite persuasions, etc... Do you think for a > minute that a 5 cents postage is going to stop these messages now? And > how about when remailers do attain good reliability and untraceability, > for 3 cents? I had suggested an idea a while back where you would try to address the abuse issue directly rather than charging per message. I agree with Pierre that any reasonable per-message charge will not help in many forms of abuse, although it should address the worst spam attacks. The idea is to have a sort of digital cash token, but it is free. The key is that each person just gets one of these, but they are reusable. After a remailer sends a message, it waits and sees if it gets any complaints. If not, the token is re-blinded and made available to the original user via some kind of pool. He can then send another message. But if he commits abuse, he doesn't get his token back. Obviously there are problems with this, the worst probably being how we can keep people from acquiring lots of tokens under different names. Perhaps you could charge some small amount for them, but require VISA payment, and check the names on the VISA cards. (This doesn't hurt anonymity when the tokens are actually used because of the blinding.) To get multiple tokens a person would have to commit some serious real world name trickery, a considerably higher barrier than making up a pseudonym on the net. Another problem is that as stated above, you could only send one anonymous message every day or two. Perhaps we relax the rules and let people have a few of these tokens; they can then abuse the system a few times but each time they lose a token. A similar idea might work for the data haven problem, although I don't understand exactly what is intended there. This approach is a variation on the "is a person" credential, which attempts to make sure that each person only gets one of something. A lot of situations would benefit from such a credential, although some people don't like them. Hal -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBVAwUBLxIw2RnMLJtOy9MBAQGWCgH6A1SFyzZDDhd/NVrMck5SAf3mS4IOl5On aJNFKUopZi4Fb7tqQfbFukDl/lF+clnBDBNh/yXAsFcABJaWaTUzZA== =pLOT -----END PGP SIGNATURE-----

1 0

Re: Traffic generation
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Joe Block writes: > As an added security measure, when a valid control message is received, > an identical length stream of random garbage should then be encrypted and > passed into the remailer pool. This would be easier if remailers supported > some sort of bit sink command to trash a message rather than pass it along. Lance Cottrell's Mixmaster software supports this -- just use Anon-To: null - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLxI43yoZzwIn1bdtAQFNJwGAyLeVNnXjphXZFF9tznd4BI09+e4ec3z7 XjLgNg3qtNoxUM44ZkW0xsME+ot5B4A/ =q5OQ -----END PGP SIGNATURE-----

1 0

Re: "Judgement Proof" and Putting Up or Shutting Up
by tim werner 17 Dec '03

17 Dec '03

>Date: Wed, 5 Jul 1995 04:32:41 +0000 (GMT) >From: attila <attila(a)PrimeNet.Com> >and, conspiracy theories non-withstanding, we the people do not govern >America --we are only given a short list of politicians who have sold >their soul to CFR's satanist inner circle. What's CFR? tw -- Well, Bust My Britches! Eggs Almondine and a Bottle of Beaujolais!

4 3

Perl Shirts
by Samuel Kaplin 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Anyone know when Joel is going to ship the perl shirts? Thanks, Sam -----BEGIN PGP SIGNATURE----- Version: 2.6.1 Comment: PGP Signed with PineSign 1.0 iQCVAwUBMAq/xe5wXwthmZO1AQEeoQP/dnmJNi+yz5HwPVU3BCOlqLWrQlGHIGjW LcREDkaXaOWIqJB+5wr/Sc59l54niivh+PifgS72kreLgiw+Im1rF0ftAIUa1f9x 2NUvp+v1yMNB20By25jEhZHwGgMo1dKe67xOhOBVukoEhe1VLg4YO9i7XIqPCh0E WUlLMj38itQ= =zz5B -----END PGP SIGNATURE-----

1 0

Re: Zimmerman legal fund
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Anon writes: > Could someone in the know talk about the relationship between FV and > the ZLDF? I don't like to spread misinformation, so I won't answer > based on conjectures. I'd be interested to hear this too, but what I am concerned about is that the whole thing is too strongly tied to first virtual. I mean there was the Yellow Ribbon Campaign but all URLs out of that page point to FV, no mention of the at least two other (more convenient for most people, and hence in Phil Zs interests) methods: a) PGPed email CC no. to Phil Dubois (Phil Zs chief legal counsel) b) similar PGPed email CC no. to some guy in Europe who was offering to collect up all of the European donations, and send them to Dubois in lump sums to save on currency exchange costs. Both of these I believe have been signed by people who directly have their keys signed by Phil Z himself, I have a copy of PGP signed a) saved from the original post made by Hugh Miller <hmiller(a)orion.it.luc.edu> and this is what I show to people who ask. (copy of the bank details from Hugh's post pasted below as [1] original PGP signed post by Hugh by email). Geoffrey Kidd <kalothi1(a)violet.berkeley.edu> has the details from Hugh's post in his Phil Z Blood Bank which he posts to alt.security.pgp periodically, the idea being that enough folks give money to the Phil Z legal defense fund on a regular small donation basis, if enough people did this he could be supported indefinately. What I would like to know is why neither of these [a) or b)], and especially why a) has not been mentioned on any of the widely advertised yellow ribbon campaign pages... is it for Phil Z ... or is it for Phil Z with the provision that you start a FV account something which not everyone who wants to contribute to Phil Z is likely to want to be bothered doing. No slur on FV, just it adds unnecesary complications to donations, through what now must be _the_ most widely publisized USENET based effort to raise funds for Phil. Adam [1] ====================================================================== [...] To send a check or money order by mail, make it payable, NOT to Phil Zimmermann, but to "Philip L. Dubois, Attorney Trust Account." Mail the check or money order to the following address: Philip Dubois 2305 Broadway Boulder, CO USA 80304 (Phone #: 303-444-3885) To send a wire transfer, your bank will need the following information: Bank: VectraBank Routing #: 107004365 Account #: 0113830 Account Name: "Philip L. Dubois, Attorney Trust Account" Now here's the neat bit. You can make a donation to the PZDF by Internet mail on your VISA or MasterCard. Worried about snoopers intercepting your e-mail? Don't worry -- use PGP. Simply compose a message in plain ASCII text giving the following: the recipient ("Philip L. Dubois, Attorney Trust Account"); the bank name of your VISA or MasterCard; the name which appears on it (yours, hopefully :-)); a telephone number at which you can be reached in case of problems; the card number; date of expiry; and, most important, the amount you wish to donate. (Make this last item as large as possible.) Then use PGP to encrypt and ASCII-armor the message using Phil Dubois's public key, enclosed below. (You can also sign the message if you like.)i E-mail the output file to Phil Dubois (dubois(a)csm.org) ^^^^^^^^^^^^^^ [this is a mistake Hugh made Dubois' address is dubois(a)csn.org as can be easily verified from his PGP key, which is signed by Phil Z also] Please be sure to use a "Subject:" line reading something like "Phil Zimmermann Defense Fund" so he'll know to decrypt it right away. Here is Phil Dubois's public key: - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.7 mQCNAiyaTboAAAEEAL3DOizygcxAe6OyfcuMZh2XnyfqmLKFDAoX0/FJ4+d2frw8 5TuXc/k5qfDWi+AQCdJaNVT8jlg6bS0HD55gLoV+b6VZxzIpHWKqXncA9iudfZmR rtx4Es82n8pTBtxa7vcQPhCXfjfl+lOMrICkRuD/xB/9X1/XRbZ7C+AHeDONAAUR tCFQaGlsaXAgTC4gRHVib2lzIDxkdWJvaXNAY3NuLm9yZz6JAJUCBRAsw4TxZXmE uMepZt0BAT0OA/9IoCBZLFpF9lhV1+epBi49hykiHefRdQwbHmLa9kO0guepdkyF i8kqJLEqPEUIrRtiZVHiOLLwkTRrFHV7q9lAuETJMDIDifeV1O/TGVjMiIFGKOuN dzByyidjqdlPFtPZtFbzffi9BomTb8O3xm2cBomxxqsV82U3HDdAXaY5Xw== =5uit - -----END PGP PUBLIC KEY BLOCK----- * * * This campaign letter will be posted in a number of Usenet groups. I will also be turning it into a FAQ-formatted document, which will be posted monthly in the relevant groups and which will be available by anonymous ftp from ftp://ftp.math.luc.edu/pub/hmiller/PGP/pzdf.FAQ. If you come upon, or up with, any other ways in which we can help raise funds for Phil, drop me a line at hmiller(a)luc.edu and let me know, so that I can put it in the FAQ. [...] ====================================================================== -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQCVAwUBMAvXCSnIuJ1VakpnAQEicgP7Bn6ryN540LbdneN4PXyrODCzjy4fgW9b XP5PG8ledoro374I/ZuOJvL8HLcSNBRRrJE1MpIRykEHi8cXlpINLdsxqVlat+OI TxsEPntsH5WJJsaFb+xFdcAj681IEGFLJWdfx44SlH0eHVcsmQLmj5P3e/XUeIYr 1W3pyym0a0E= =bzs2 -----END PGP SIGNATURE-----

2 1

Re: RC4 crack
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

Robert Hayden <hayden(a)krypton.mankato.msus.edu> writes on cpunks: > So what was the result of the RC4 key cracking thing that happened last > week? It's at 100% but that's all it says. [I answered this in email but the answer is: all will be told soon] A brief explanation is called for, basically the 100% is %age allocated, and there are still a few stragglers being swept. For a brief explanation have a look at the brute-rc4.html page which I have now updated: http://dcs.ex.ac.uk/~aba/brute-rc4.html A more detailed report will be posted to cpunks when the last keyspace has been swept. We are expecting that no key will be found at this stage, as it was not sure to being with that the supplied plaintext/ciphertext was a correct pair of RC4-40. Lack of open Micro$oft specs on the workings of Micro$oft Access meant that we were guessing, and hoping that we got it right. The original brute rc4 project was started on the basis of 'lets brute it and see'. Looks like nothing will come out. Several folks have various parts of an RC4 SSL bruter (netscape secure sockets layer) and are working on sockets based farming tools to allow this one to be more automated, as there have been key space management problems with the bruterc4 effort. Also means a better % of idle time will be soaked on particpating machines, as we will not need to wait for operators to get in the next morning, or rely on people to remember which space they have swept to paste back into the confirm box. Soon ( a week maybe ) the respective parties hope to have all this sorted out, and get ready for a SSL breaking effort. So outcome of RC4 soon, followed by SSL effort announce in a while. In the RC4 outcome announce will be a % break down of how much compute people swept, even some folks on single PCs have swept as much as 1% of keyspace alone in 1 week. Adam

3 4

Is it legal for commercial companies to use PGP?
by tim werner 17 Dec '03

17 Dec '03

Hi, I was reading in some Where to Get PGP Web page that "PGP2.6.2 is legal to use in the U.S. for non-commercial purposes (i.e., you cannot sell it or the functionality it provides)". Can anyone on the list say whether this is true? That is, was the use of "i.e." correct, or should it have been "e.g."? Or, to put it more succinctly, I was talking to one of the sys admins at A-B, and he said that we weren't allowed to use PGP to encrypt our mail, because Viacrypt owned the commercial rights. But, according to the bit I quoted, it would only be a violation if A-B tried to put PGP into one of their products. Has anyone heard a (hopefully legal, but I'll listen to anyone's opinion) answer to this? thanks, tw -- Well, Bust My Britches! Eggs Almondine and a Bottle of Beaujolais!

1 0