December 2003 - cypherpunks-legacy

Photuris
by amanda＠intercon.com 17 Dec '03

17 Dec '03

> Ah, the hazards of not going to IETF... Good thing the proceedings get publicized in electronic format, eh? :) --Amanda

1 0

RE: Crypto Declaration of Independence
by nobody＠jpunix.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- James A. Donald <jamesd(a)netcom.com> wrote: >Anonymous writes >> I have a proposal for you all. >> >> I have started work on a Crypto Declaration of Independence, based on the >> famous American work which represents Independence. > >This is unwise and unnecessary. > >It is unwise because we do not wish to alert the government >to the fact that the net is largely ungoverned and ungovernable. I do not think it is unwise because we do want to state a position for ourselves. We need to let everyone, including the government, know that we will not stand for crypto-policy which is not in our best interest. No matter what comes, we will continue to use PGP, SHTTP, link-encryption and every method which we have determined to be in our best interest, not what we must have faith in what we are told is in our best interest. >It is unnecessary because crypto is already covered by various >existing declarations on rights. > > > >THE BILL OF RIGHTS This is bullshit, and you know it as well as I do. A steady stream of misinformation has mislead government officials into 'ignoring' these rights when dealing with electronic documents, and encryption specifically. When the administration has something which might be unfavorable in the public eye (ie, Clipper), they quickly try to pass it through, ignoring public cries in the process. How many letters did it take before there were any open hearings about the EES, and then the words of respected professionals were seemingly ignored as the policy was pushed ahead. This was not thought to be an extremist attempt at breaking off from our current government. It's also not supposed to be a confrontational attack. It was intended to be a strong statement, letting all know what we believe in and why we do. We need to declare our independence from being governed by policy which encroaches on our rights, rights which this country was founded in, and rights which are being ignored. Asynchronous -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLuwXDFG1rORFKstdAQEc2wP/Ytq8crc/8YiHlYeO9eoF/Mrx4Q39be9t Y1vD/Hn2qcvXUlWqtqfSPZXzpBV10rNH2qZ0L1A7j/ErUxqXm4Xqz36fWDgxht2m t/KWBXydSBzGDt3HEgmXQ29XE0Ka8w9iaXXq0bKfx87l5XPuknOnAyu8ZBEPj4wM dN5Gc4uMdtM= =vrB+ -----END PGP SIGNATURE-----

1 0

Re: Real-time surveillance of the police
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

Tim wrote: >(The longer-than-I'd-planned section above is meant to show that even >a cop-disliking skeptic like me can be convinced that some good is >done is by them, and that not all cops are bad. Perhaps my on-day >exposure co-opted me the way certain folks in D.C. got co-opted?) Yup! -- Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred.

1 0

Winsock & PGP Integration
by Johnathan Corgan 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- It has been a long discussed and desired feature for MS-Windows users to be able to integrate PGP functionality into the various Windows Sockets based mail and news readers. After a discussion with Raph and Pierre at the cypherpunks meeting this weekend, I took a look at the paradigm that premail uses and gave some thought to how this same concept could be applied in the Windows environment. On a Un*x machine, premail works by impersonating the mail transfer agent and intercepting the flow of mail in each direction, adding encryption, signing, and anonymous remail services in a rather elegant fashion. As the mail system under Un*x (indeed, the entire OS) is designed to be a "piped and glued together" batch of smaller utilities, premail's method works well and is very 'unix-like'. How to achieve the same under Windows with winsock based SLIP or PPP access? The various mail agents such as Eudora and Chameleon are integrated packages that do everything from using SMTP and POP for mail transfer to providing the user agent that reads and writes mail. There really is no simple way to wedge into the package and replace or supplement functionality. Except one. What all of these agents have in common is that they interface with the Windows Sockets API to establish TCP streams that are used in the POP and SMTP protocols. Since these are well known and standardized protocols, this gives us our toehold. Picture this. Using a replacement WINSOCK.DLL, we can intercept those specific API calls that an application would use to open the appropriate sockets and establish a TCP stream to a particular remote socket. For all other API calls, we hand these off to the "real" WINSOCK.DLL (that we have renamed and loaded after our DLL has loaded). Our replacement DLL now has the ability to make the mail application think it is talking to a remote SMTP or POP process, when in fact, it is talking to our agent on the local machine. Our local agent spoofs the SMTP protocol, accepts the mail, does all the neat crypto stuff, and stores the mail in an outbound queue. At whatever preprogrammed intervals, _our_ agent makes the _real_ SMTP call to the remote and delivers the mail. The reverse process would work as well. Our local agent periodically makes a POP call to the remote end, retrieves mail, and stores it in an inbound queue. Again, we do all the neat crypto stuff, and finally the next time Eudora or whatever mail agent is in use makes its POP run, we spoof POP and deliver the mail to the mail program. A little thought on this and I realized that this could be a generalized process. Want to implement an anonymous remailer under Windows? Use this mechanism and replace "neat crypto stuff" with "even neater anonymous remailing stuff." Majordomo for Windows? No problem, same method. By intercepting the flow of mail in each direction, there is no limit to the stuff you could come up with. Why bother fiddling with Windows anyway, when one has all the beauty and power of Un*x at one's disposal (such as Linux)? Well, think about where the personal computing sector is going to grow in about six months or so with the advent of Windows95. Okay, it's a great OS for what it is designed for, but it doesn't have pipes or perl or twenty or thirty command line parameters for every executable. So what. I garauntee that there will be more laptops and desktop PC's with Windows95 than with any flavor of Un*x. If we are to promote and encourage, as well as make the tools for, the use of strong crypto by the average Joe, then Windows is where it is at. I've just enough Windows programming experience to know that the scheme I worked out above is feasible and would work well. On the other hand, I have no experience with Windows Sockets at the api level, nor with any implementation of SMTP or POP (though I know the protocols themselves well.) Yep. It would be cool to write a message in Chameleon (such as this one), press the send button, and have a dialog box pop up asking me if I wanted to sign, encrypt, or remail this message. Or to have it done automatically for me. And this would work with existing mailers today. Sheesh, somebody burst my bubble. Comments, criticisms, suggestions, and especially financial donations, are quite welcome :) ======================================================================= Johnathan Corgan "Violence is the last refuge of the incompetent" jcorgan(a)netcom.com -Isaac Asimov PGP Public Key: http://www-swiss.ai.mit.edu/~bal/pks-toplev.html Or send email to: pgp-public-keys(a)pgp.ai.mit.edu Subj: GET jcorgan ======================================================================= -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLu0w2k1Diok8GKihAQGdnQP8DiqQt3820dhKHY3dbXAZnl/11eEce4z+ /oFZMKVBHlCJAxCSucnK31dcyRbvXiOkAt9x9EMinXC26VWh3sETd+YbaJNznkx6 VmM1UNID2bQ+Xpcc4ANJQx6CgPrRxspr3reVeuFv7QLtKGMy5Mucl5mXGp829f6i Gj7NMlhcu+s= =rgyq -----END PGP SIGNATURE-----

3 2

re: IPSP and Netscape
by John Giannandrea 17 Dec '03

17 Dec '03

Eric Hughes writes: > It may be that IPSP is not the quickest or best way to link security, but > that is not the point I am making here. The original denial of IPSP's > potential utility was made in complete ignorance Widespread acceptance of IPSP may well make SSL irrelevant. I do not believe that anyone at Netscape is claiming otherwise. Nonetheless, widespread implementation of IPSP simply does not exist at this time. We need a solution for our customers _today_. SSL is one working solution to the problem of link security. By publishing our specification of SSL we are inviting others to share in our work, or criticize us for being foolish. I do not believe that we are either arrogant nor ignorant in creating SSL. The market will, of course, help decide. -jg

2 1

What, exactly is elliptic encryption?
by dfloyd＠io.com 17 Dec '03

17 Dec '03

What, exactly is elliptic curve encryption? (Only thing I knew that the NeXT nearly had it in its OS, but the heavy hammer of ITAR squashed that...)

5 6

Re: Broadcasts - addressing
by lcottrell＠popmail.ucsd.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >> I have been contemplating how to mark broadcast messages as being >> 'for' someone. To foil traffic analysis, you don't want to include >> their nym or key-id, for the sake of the your poor CPU, you want to >> avoid the need to attempt decryption on everything that passes through. > >The main problem is how to avoid decrypting _most_ of the traffic, >without giving away significant information about the recipient. >One approach is to do something some political users have been asking for - >implement support for very short keyids (e.g. 4 bits instead of 24-32), >so that the keyid isn't a good identifier for the user. >Another approach is to include a tag in the Subject: with either a hash >of the key (substantially reducing the number of bits), >or simply the last hex or two of the keyid - that lets you ignore >15/16th or 255/256th of the traffic, without giving away much. I am not completely clear on what sort of communication you are trying to protect, and what your threat model is. Are you worried about an attacker noticing that an anonymous ID is getting a lot of messages? If you are using PGP and a message pool, any attacker can decrypt all the messages, and see which correspond to which key, and therefor to which anonymous ID. The only way around this is to use private key crypto. If you are doing that, then you can also use a shared secret to generate a stream of one use message IDs. -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLu09tlVkk3dax7hlAQHLkAP+L8j+9eLcwC7oPpq+OPxDb+C6QJ/H0OX5 3O7uQnU8OZY9YgHsMETh6AY7aTMZYrm9+p3wJu9znFYOwXRIzF+spfyxDDzLVuE1 kQBwGKQt/5YQd6i/jc1Jias6rb/GOBvckYcHKERjSBL638Gi65cC4OFEff5k6ujQ YkkQXkh3JWg= =o5nF -----END PGP SIGNATURE----- -------------------------------------------------- Lance Cottrell who does not speak for CASS/UCSD loki(a)nately.ucsd.edu PGP 2.6 key available by finger or server. Encrypted mail welcome. Home page http://nately.ucsd.edu/~loki/ Home of "chain" the remailer chaining script. For anon remailer info, mail remailer(a)nately.ucsd.edu Subject: remailer-help "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche

2 1

Standard Packet size.
by lcottrell＠popmail.ucsd.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I am about to release Mixmaster as a beta test. Before I do, I would like some input on what size message packet to standardize on. Each message includes twenty 1k headers, and a block with the message text. Right now I have the text block size set to 4k. That seems small, but I am worried about mail systems choking on big messages. Messages over the minimum size are sent separately (through the same chain), and only recombined by the last remailer in the chain. Previous remailers do not know that the message parts are associated. This is quite secure, but not as good as a single packet, so the fewer messages that get split up, the better. Mixmaster compresses the contents of the text block. So, any thoughts on what size the text block should be? BTW Mixmaster still only runs on Sun. Several people are working on porting it to linux. Help with porting to PC and Mac would be appreciated. -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLu1Ml1Vkk3dax7hlAQHWfAP+Kj2LyWBySVHfI0QTBBhEvF3b+ru/hywm kALdnXWUkbcSgRHQAMdSpwYza44M7Tc6sX++kDASSjwWyV80cTPHqFEPFmoEcbRV 1BPJB7SAkhwHGpRB5e0daLe0LAuS9KRHbTQcN//n0pUrbqMS2sVJCrDQ7kwrFC8L 3QEzCjWHsAQ= =Dc4G -----END PGP SIGNATURE----- -------------------------------------------------- Lance Cottrell who does not speak for CASS/UCSD loki(a)nately.ucsd.edu PGP 2.6 key available by finger or server. Encrypted mail welcome. Home page http://nately.ucsd.edu/~loki/ Home of "chain" the remailer chaining script. For anon remailer info, mail remailer(a)nately.ucsd.edu Subject: remailer-help "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche

1 0

Re: James vs. Eric
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Eric # Perhaps you don't know the meaning of whitespace and paragraph breaks. James > And then he contradicts himself: # I did claim you were arguing from libertarian correctness. Now that's # just an insult, which I do not retract. [...] # Oh, please. Go back and read what I originally wrote. Perhaps I # overestimate your ability to ascertain relevance, though. > You do not demonstrate much ability to think rationally > in this posting. A self contradiction in three lines, > above, and some interesting logic to follow: [...] # This is not an argument. This is a premise. > I see: So you start off with the assumption that what > I was arguing was false, and because that is a premise > not an argument, you do not have to defend it or support it. "I do not need to PROVE these FACTS because they are INCORRECT and because I do not NEED to PROVE them they must be TRUE!!!" --James `Kibo' Parry, 2/22/94 > Nice piece of logic there. > I accused you of flaming before reading. Now you claim > that you did read it, but the laws of logic exempt you > from having to make rational criticism of what I wrote. > I think your defense denigrates you more than my original > accusation did. > Now back to some slight crypto relevance: [...] *heavy sigh* Eric & James, how about taking the "You're flaming me !" "No, I'm just insulting you !" portion of this debate to private email ? I sincerely doubt that very many people on the list give a damn about any of the above jousting. > Each posting I made was about the standards making process. Sticking to flaming about Internet standards, rather than flaming about who didn't read whose argument carefully, would be much more productive IMHO. - - -L. Futplex McCarthy; PGP key by finger or server "We've got computers, we're tapping phone lines; I know that that ain't allowed" --Talking Heads - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLu1NHmf7YYibNzjpAQFJgwQAy/kPXuCrUb8mQSviXXJJC1USTuJqRhfS gHKtIjveZne4JRdkjzjK6O/hNcNwuKQrMefvgeTlVu4w7HE6geSTMrTogH8r2fF0 VjNe3XN90ad9QrO4Zk0y9NGKYEd5/LOnN5tlcM5ij2yjbVDDZMgWzj0pY1JTrtFJ /uvUSdsHHxU= =4lge - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLu1OZSoZzwIn1bdtAQE5XgGAnqIZqNarnXwzvKkJfy3WPmNW6nwJOJjb nliPNeRmomtgeI27HJqrIYhzUXn40voS =K3HK -----END PGP SIGNATURE-----

1 0

New zealand meetings?
by Tony.Gurnick＠nzdairy.co.nz 17 Dec '03

17 Dec '03

Does any of the kiwis on the list want to start some sort of informal meeting, (at georgie pie?) as going to the states for there meetings is a tad difficult. (all 5 of us that is) T

1 0