December 2003 - cypherpunks-legacy

SecureWeb
by nobody＠myriad.pc.cc.cmu.edu 17 Dec '03

17 Dec '03

We'll just see.... =========Begin forwarded message========= >Date: Fri, 16 Dec 94 07:51:27 -0800 >From: more(a)newsmaster.tgc.com >To: SQUEAL(a)eek.eek.com >Subject: 4989 Web Security Toolkits Available Late December from Terisa >Systems Dec. 16 > >Web Security Toolkits Available Late December from Terisa Systems Dec. 16 >SUPERHIGHWAY REPORT HPCwire >============================================================================= > >A news release from Terisa Systems and SPRY -- > > Washington, D.C. -- Terisa Systems has announced that its SecureWeb >Toolkits for World Wide Web transaction security will be available later >this month. > > The company also said that CyberCash Inc., Open Market Inc., O'Reilly & >Associates, SPRY Inc., Spyglass Inc. and Verity Inc. will be the first >companies to use the toolkits to build Web servers or clients with security >features. > > Terisa Systems was launched earlier this year by RSA Data Security Inc. >(RSA) and Enterprise Integration Technologies Corp. (EIT). The company's >toolkits provide an implementation of Secure HTTP (HyperText Transfer >Protocol) for commercial products. Secure HTTP (S-HTTP), which was developed >by EIT, is a security-enhanced version of the World Wide Web's internal >communications language. > > David Pool, president of SPRY, said S-HTTP will be incorporated into the >company's Internet software -- Internet In A Box, the AIR Series and AIR >Mosaic Express -- in the first quarter of 1995. Consumers using Internet In >A Box will be able to purchase products safely over the Internet with a >credit card. In addition, companies or publishers using the AIR Series and >AIR Mosaic Express can market, sell and support their products. Pool said, >"Currently, the Internet is a vast, untapped marketplace still lacking >security and payment services. However, the S-HTTP protocol addresses both >encryption and authentication making electronic commerce a reality for our >customers." > > According to Douglas Colbeth, president of Spyglass, his company will offer >S-HTTP as a module in its Enhanced Mosaic Security Framework, making Mosaic >suitable for applications requiring confidentiality and authentication. >Enhanced Mosaic is the commercial version of NCSA Mosaic, the popular World >Wide Web browser from the National Center for Supercomputing Applications at >the University of Illinois. Colbeth said, "Our customers see the huge >potential in commerce on the Internet, but are very concerned about security. >An industrial strength solution such as Secure HTTP will let Mosaic handle >a wide range of applications requiring uncompromising security." > > At O'Reilly, Dale Dougherty, publisher for the Digital Media Group, said >S-HTTP will be used for a secure version of the GNN Direct service, that >allows subscribers to order from publishers or advertisers who market and >sell products over GNN Direct. He said, "We've been looking for a security >solution that will allow our subscribers to order safely online. Secure HTTP >provides the capabilities needed for our GNN service." > > Concerning plans of other licensees, CyberCash will use the technology to >provide a system for safe electronic payments over the Internet and Open >Market, a developer of electronic commerce solutions, plans to sell a Web >server that incorporates S-HTTP. Verity is introducing Verity Mosaic, a >Mosaic client offering user authentication and secure communications for use >with Verity's Topic Information Server for the World Wide Web, also announced >today. > > SecureWeb Toolkits include an implementation of EIT's Secure HTTP, which >ensures the authenticity of transactions and the confidentiality of >information exchanged via the World Wide Web. With a secure HTTP-enabled >application, users and information providers can encrypt and sign messages >and other material digitally. Binding agreements are possible because >communications are secret and tamper-proof and cannot be repudiated. > > SecureWeb kits incorporate RSA public key cryptography technology to permit >spontaneous, secure communications between unfamiliar correspondents. >SecureWeb also supports other cryptography systems such as traditional shared >password and Kerberos. A SecureWeb run-time license is required; run-time >license pricing is volume-based. Toolkits will be available on a limited >basis in December 1994. > > Additional information on Terisa Systems is available at URL >http://www.terisa.com. Those interested can also send e-mail to >infoterisa.com or telephone 415/617-1836. Additional information on Secure >HTTP is available by sending email to <shttp(a)infoeit.com>. > > For more information, contact Deanna Leung of SPRY, Inc. at 206/442-8231 >or email her at: <deannaspry.com>, or contact Nancy Teater of Terisa Systems >at 415/321-0252, or email her at: <nrthamilton.com>. > >***************************************************************************** > H P C w i r e S P O N S O R S > Product specifications and company information in this section are > available to both subscribers and non-subscribers. > > 900) Ampex 915) Genias Software 905) Maximum Strategy > 912) Avalon Computer 930) HNSX Supercomputers 906) nCUBE > 921) Cray Research Inc. 902) IBM Corp. 932) Portland Group > 907) Digital Equipment 904) Intel SSD 935) Silicon Graphics > 909) Fujitsu America 916) MasPar Computer *931) Sony Corporation > > *Updated information within last 30 days >***************************************************************************** >Copyright 1994 HPCwire. >To receive the weekly HPCwire at no charge, send e-mail without text to >"trial(a)hpcwire.tgc.com". ==========end forwarded message========== ==================Thomas Jefferson================== The strongest reason for the people to retain their right to keep and bear arms is, as a last resort, to protect themselves against tyranny in government. ==================================================== _/_/_/ _/_/_/ _/ _/ _/_/_/ _/ _/ _/ _/ _/ _/ _/ _/ _/_/ _/ _/_/_/ _/ _/ _/ _/ _/_/_/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/_/_/_/ _/ _/_/_/ _/_/_/ _/_/_/ _/_/_/ _/ _/ _/_/_/ _/

1 0

Hey Martha! It's "The Invasion from Outer First Virtual" -rated Y (for Y-not)
by nsyfrig＠wppost.depaul.edu 17 Dec '03

17 Dec '03

eric(a)remailer.net (Eric Hughes) wrote (among other things): Regardless of the security, users need to understand what it gives them. This is orthogonal to the choice of security, as well as to the persistence of thick-headedness in society. _________________(non-automatic divider line)___________________ I believe this is definitely a proverbial nail, and it has just been hit where it counts! Some evangelizing, education, and teamwork is definitely in order here. As implied, it doesn't just apply to the virtual world, but the real one as well.

1 0

Low power/bandwidth machines
by xpat＠vm1.spcs.umn.edu 17 Dec '03

17 Dec '03

"JEFF LICQUIA (CEI)" <JLICQUIA(a)mhc.uiuc.edu> writes: >this from work, but it's running into bandwidth problems. There is no >local SLIP provider that provides to home users. Thus, I am trapped in >a VT100 environment, where a shell would be a great luxury. If and whe >I get SLIP, I'll have to do it on a 386SX/20 with 4M of RAM, not exactl >your speed demon kind of machine. >1. While I, too, have experienced the head rush that comes with fully >graphical interfaces to high-bandwidth Net, I am also painfully aware o >the reality that too many people are stuck with less. Given a few week, If you have access to a SLIP line, but frustrated with perhaps less of a machine than you would like, give MINUET a try. It is a DOS based tool designed for students with cheap/old computers so they can access the Internet. It includes embedded POPmail, news, ftp, telnet, ping etc. It is available anonymous FTP from boombox.micro.umn.edu /pub/pc/minuet/beta16/minuarc.exe or /pub/pc/minuet/shaky/minuarc.exe <--beta17 SLIP software that goes with it is at /pub/pc/slip/latest/sliparc.exe The beta17 has caused no problems for me yet. Beta17 has some performance advantages. A 386 should be no problem at all. --------------------------------------------------------------- P M Dierking xpat(a)vm1.spcs.umn.edu

1 0

Re: Tim May the Luddite--His Last Message for A While
by Amanda Walker 17 Dec '03

17 Dec '03

> The consensus of the active posters in this latest thread (Perry, > Amanda, Lucky, Jim, others) is that I am a hopeless fuddy-duddy, > unwilling to begin posting in the latest modality. Actually, that's not my feeling at all. I haven't (at least intentionally) been making or intending to make the kinds of "get with the program" remarks that Lucky, Perry, and some other have been. I've just been trying to explain why I think that MIME isn't necessarily bunk. There is a middle ground between "the one true way" and "utter crap," after all, and I found your assertions that MIME was useless to be just as annoying as assertions that it's a panacea. I'm not telling you (or anyone else) to use MIME. Even I don't use the fancy features MIME for most of my off-site email, especially mailing lists, for exactly the reasons you describe. I'm just tired of people deciding the because they're not able to take advatange of something, that it is therefore useless. That's all I've been intending to complain about, and I'm sorry if I've come across more strongly. I certainly don't want to chase you off the list. You're one of the people I take pains to read, even on high-volume email days... > Bluntly, I'm fucking sick and tired of these cheap shots and > personal innuendos. Maybe it's the "young guns" syndrome, with a > codger like me whose first Net account was in 1972 being a ripe target > for the newest pistoleros with their .486-caliber Linux boxes in > their holsters. Well, I came onto the net after the NCP/TCP flag day, so you've got some seniority on me, but I'm hardly a young gun, and I hate Intel processors and UNIX :). I started in the spring of 1982 on a VAX 11/780 with real live DEC VT100s, and an ADDS Viewpoint on a 1200 baud modem (at the time, this was really fast) in my dorm room. I was just awful to come back from a week's vacation and spend a whole hour catching up with Usenet--and that was before you could unsubscribe to individual groups :). To a large degree, it's this dozen years of experience with the net that makes me optimistic about things like encryption, MIME, and so on. Every time the baseline moves up, people complain. It happened moving from NCP to TCP/IP. It happened when moving from A News to B News (my site was actually an A News holdout for a long time). It happened when net.* got broken up into a set of hierarchies (alt.* is a remarkably long-lived fragment of that changeover), and it's happening now with things like PGP & MIME. Plus ca change, plus c'est la meme chose. Part of the cypherpunks mission, as I understand it, is to help to keep moving that baseline, concentrating on one particular direction (privacy). I'll stop posting on side issues if it will help keep the focus on privacy, and help keep folks like you from giving up in frustration. After all, cypherpunks is far from the only soapbox I subscribe to :). Amanda Walker InterCon Systems Corporation

1 0

something NOT MIME-related
by harveyrj＠vt.edu 17 Dec '03

17 Dec '03

Hello: Not to distract from the entertaining MIME thread, but I've got a question that's a little closer to a crypto topic (i.e., software psueudo-random number generators). In the aftermath of the Pentium-can't-divide-accurately flap, I modified a random-number generation routine I'd written to check for the presence of the Pentium divide errors. In the process, I put in a routine that did an elementary benchmarking of the chip's performance in both integer (speed to repeatedly execute an empty for-loop 1 million times) and floating point operations (inserting a divide operation in the loop, and adjusting the resulting execution time by subtracting the time required for the empty loop before computing divide-calculations-per-second performance). This is an admittedly very crude benchmark, but I wanted to get some rough idea how many divides could be performed per minute of program execution (i.e., to estimate how long the program could run before a Pentium-problem might occur). Anyway, I found what appeared to be very strange results when comparing performance on my 486/66 versus a 486/25 and 386/20: namely, although the 386 was dead last on both the primarily integer-based empty- for-loop and for-loop-with-divide timings, the 486/25 and 486/66 turned in effectively identical times in the empty-loop benchmark (the 486/66 was about 33% faster than the 486/25 in the divide-based benchmark). All machines were running essentially equivalent versions of Windows for Workgroups). My question is, why would the 486/66 and 25 produce comparable integer- based empty loop performance? I haven't tried a comparable program running under plain-DOS to see if this is somehow Windows related. I supsect there's an easy explanation, but it escapes me. Any suggestions would be greatly appreciated. rj ------------------------------------------------------------------ R. J. Harvey (mail: harveyrj(a)vt.edu) (PGPkey 0BADDDB5: 82 42 53 EA 97 B0 A2 B2 FC 92 90 BB C2 26 FD 21)

1 0

PGP key checking
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

I just signed and checked some pgp keys (using pgp 2.6.1) and I found something unexpected: Keys can be checked with the -kc option. To identify the key to be checked either a string or the KeyID (with 0x-prefix) can be given as an argument. If I do now pgp -kc name_of_anyone pgp -kc 0xanyones_key_id for the very same key (once identified by substring, once by keyid, which should both do the same job) the first command checks many more signatures than the second command. The second command stops earlier, but I couldn't find out yet, whether this stops after finding a trusted path to the checked key or what else could be the reason for this. Any ideas? Hadmut

1 0

Re: Question for remailer operators
by lcottrell＠popmail.ucsd.edu 17 Dec '03

17 Dec '03

>I see about 200 messages a day through my remailer, sizes averaging a >couple of K. I had the impression at one point that the VAST majority of >this was "cover" traffic that someone is generating just to keep the >network busy. I don't know if this is still the case. It might be >possible to opt out of the cover traffic generator to reduce your load >to a politically manageable level. Maybe people generating cover traffic >could estimate how many messages they are generating. > <SNIP> > >Hal I have a script generating covering traffic. It creates a message at random intervals between 1 and 20 min. The messages are encrypted, and padded with cutmarks for all remailers which support that. The messages are sent through six hops. The remailers are chosen from all reasonably reliable remailers on Raph Levine's list (except for those which have asked to be excluded). -------------------------------------------------- Lance Cottrell who does not speak for CASS/UCSD loki(a)nately.ucsd.edu PGP 2.6 key available by finger or server. Encrypted mail welcome. Home page http://nately.ucsd.edu/~loki/ Home of "chain" the remailer chaining script. For anon remailer info, mail remailer(a)nately.ucsd.edu Subject: remailer-help "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche

2 1

Privtool 0.83 Released
by Mark Grant 17 Dec '03

17 Dec '03

Sorry to bring the list back to cryptography, but there's now a new version of Privtool (PGP-aware mailer for Xview) on ftp.c2.org in /pub/privtool/privtool-0.83.tar.Z. This version has two major fixes which greatly improve performance and reduce memory usage, along with a number of minor fixes. In the next few days I'll upload it to ftp.dsi.unimi.it and update the on-line documentation on my WWW site. Mark P.S. No, it doesn't support MIME.

1 0

Kaufman/Eastlake DNS changes
by Rich Salz 17 Dec '03

17 Dec '03

You should probably drop a line to Paul Vixie, vixie(a)vix.com, the current maintainer of BIND. Tell him I sent you... As a side note, it's too bad that Digital seems to have lost all of their crypto-folks. The only one left is John Wray; at least he's good. /r$

2 1

[Cynthia Clark: RE: I-D ACTION:draft-pgp-pgpformat-00.txt]
by Derek Atkins 17 Dec '03

17 Dec '03

I think that most cypherpunks would be interested in this. I realize that many of you are on the IETF announcement list and probably have already seen this, but I thought that I'd forward it for those of you who aren't on it... -derek ------- Forwarded Message A New Internet-Draft is available from the on-line Internet-Drafts directories. Title : PGP Message Exchange Formats Author(s) : D. Atkins, W. Stallings, P. Zimmermann Filename : draft-pgp-pgpformat-00.txt Pages : 21 Date : 12/13/1994 PGP (Pretty Good Privacy) uses a combination of public-key and conventional encryption to provide security services for electronic mail messages and data files. These services include confidentiality and digital signature. PGP is widely used throughout the global computer community. This document describes the format of "PGP files", i.e., messages that have been encrypted and/or signed with PGP. PGP was created by Philip Zimmermann and first released, in Version 1.0, in 1991. Subsequent versions have been designed and implemented by an all-volunteer collaborative effort under the design guidance of Philip Zimmermann. PGP and Pretty Good Privacy are trademarks of Philip Zimmermann. Internet-Drafts are available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-pgp-pgpformat-00.txt". A URL for the Internet-Draft is: ftp://ds.internic.net/internet-drafts/draft-pgp-pgpformat-00.txt Internet-Drafts directories are located at: o Africa Address: ftp.is.co.za (196.4.160.2) o Europe Address: nic.nordu.net (192.36.148.17) o Pacific Rim Address: munnari.oz.au (128.250.1.21) o US East Coast Address: ds.internic.net (198.49.45.10) o US West Coast Address: ftp.isi.edu (128.9.0.32) Internet-Drafts are also available by mail. Send a message to: mailserv(a)ds.internic.net. In the body type: "FILE /internet-drafts/draft-pgp-pgpformat-00.txt". NOTE: The mail server at ds.internic.net can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e., documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. For questions, please mail to Internet-Drafts(a)cnri.reston.va.us. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. - --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" - --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv(a)ds.internic.net" Content-Type: text/plain Content-ID: <19941213160355.I-D(a)CNRI.Reston.VA.US> ENCODING mime FILE /internet-drafts/draft-pgp-pgpformat-00.txt - --OtherAccess Content-Type: Message/External-body; name="draft-pgp-pgpformat-00.txt"; site="ds.internic.net"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <19941213160355.I-D(a)CNRI.Reston.VA.US> - --OtherAccess-- - --NextPart-- ------- End of Forwarded Message

1 0