December 2003 - cypherpunks-legacy

Re: Stego Standards Silly
by monty.harder＠famend.com 17 Dec '03

17 Dec '03

LM> I think I need to clarify my threat model. I'm positing a scenario in which LM> transmission of ciphertext and stegoed anything is illegal, but transmission LM> and use of "conspicuous" digital signatures is legal. Furthermore, the govt. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Ah. No big deal then. After stegoing, you sign the GIF. LM> sanitizes the LSBs of digital images for our protection, perhaps distorting LM> a mean of X% of the LSBs of a mean of Y% of transmitted images. Out-of-stego- LM> channel checksummation would IMHO be crucial in such a situation. Sending multiple copies of the same GIF would go a long way toward solving this, if X% and Y% were low enough. Say I get 5 copies, and reconstruct the origial via a "voting" protocol. Also, if we break down the file into smaller blocks, and sign each block individually, we can narrow down the errors. But I am having a real problem with an overt policy of fiddling with people's mail. If they did that, it would likely cause a huge backlash that would be felt at the ballot box. * --- * Monster(a)FAmend.Com *

2 1

FWD:Speaker needed
by corbeau＠seanet.com 17 Dec '03

17 Dec '03

>Sender: html-authors-guild-owner(a)lists.Stanford.EDU >Status: > >Two topics to this post: > >1. I have been asked to speak at an Internet/WWW conference that will be >held in Charlotte, NC on October 23rd. Is the SC gonna jump on me for >mentioning my membership in the Guild in the bio that they will print in the >advertising flyers? <g> > >2. I have been contacted by the producer of the conference and asked to >contact the Guild for help in finding an Internet Security Guru to speak at >the conference... If interested, point of contact is: > >rstoker(a)accunet.com > > >I will be posting more info (costs, location, times, etc.) as they come to me. > >BTW: Speaking of security, I have asked a question that has gone unanswered >(possibly due to being sidetracked by flamewars & whatnot)... anyone out >there know how to set up password security on pages running off >MacHTTP/WebStar servers? Any help is appreciated! > >TIA > > -AL GORDON > ProEMail Internet Services **************************** Thot one o' y'all might fit this bill... -corbeau

1 0

Re: (Cracking) Netscape (is) the Big Win
by Andrew Roos 17 Dec '03

17 Dec '03

Peter Trei says: > This is why it's imperative for cpunks to work on the SSL challenge > recently posted. Cracking 40 bit RC4 will provide a strong industry > incentive to move towards stronger crypto standards, and to pressure > the government to relax ITAR. The SSL project is at an advanced stage. I am regression testing the third (and, I hope, final) version of the SSL bruter, while Adam and others are working on the key distribution mechanism. It is important in a project of this nature that everything be thoroughly tested before we start, so we don't waste thousands of hours of CPU time... Andrew ___________________________________________________________________________ #!/usr/local/bin/perl -s-- -export-a-crypto-system-sig -RSA-in-3-lines-PERL ($k,$n)=(a)ARGV;$m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2% Sa2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*' ,$_)while read(STDIN,$m,($w=2*$d-1+length($n||die"$0 [-d] k n\n")&~1)/2) Andrew Roos Realtime PO Box 15170 Vlaeburg 8018 Phone: +27-21-244350 Cape Town Cape Town Fax: +27-21-221507 South Africa

1 0

Re: "Hey Phil! Stop telling people *not* to use PGP!"
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 02:00 PM 7/19/95 -0500, Robert A. Hayden wrote: >> I am fond of saying that we PGP enthusiasts have two choices ahead of us >> within a couple of years: either 5,000 enthusiasts using PGP with >> MAXIMAL SECURITY at all times, or 5,000 enthusiasts with MAXIMAL >> SECURITY and 10,000,000 computer-illiterate e-mail users using PGP with >> push-button interfaces and multi-user remote systems. >I said it last week, and I'll say it again. From a sociological >standpoint, it's those 10,000,000 computer-illiterate e-mail users that we >need to focus all of our efforts towards. Those 5,000 literate people we >really don't have to care about. But there are two different classes of issues here - the convenience-only issues, which can be fixed with bells and whistles and GUIs and audio-enhanced-RTFM-buttons, and the security-related issues. For security, there are three classes of users: 1 - folks with standalone systems and dial-up mail - no problem This is a _lot_ of users - AOL, Compuserve, etc. 2 - folks with single-user systems on networks - they need to make sure they've got PGP installed right (relatively easy, with local disks, but fancy install widgets may help), but beyond that they've got to know that PGP is only as secure as their machine and network configuration. Mostly ok, and to the extent it's not, they've got other serious problems. This is also a lot of users. 3 - folks with shared machines - these folks (mostly Unix users and college students, plus people who have web-space they need to telnet to, like me) do need to know their limitations, and currently have the most problems with convenience, having to haul files back to a secure machine to encrypt securely. The first step is education - manuals that say "Don't Panic Unless You Need To Be Paranoid" instead of "Panic Immediately", that can make them aware of the risks and tradeoffs. It's about two pages of well-written stuff, if someone wants to write it. The next step is either building convenient tools to help them with encryption, or building convenient installation scripts for the tools that already exist (e.g. mail, or scriptable terminal emulators which can automate a lot of the hauling around.) The big payoffs are for groups 1 and 2, but a lot of the technically savvy people who read manuals and have to convince system administrators to install stuff are in group 3. So this is basically a writing job, plus talking the PGP 3.0 people and maybe Phil into including the discussion with the manuals. Remailers, btw, are in this class, since they need to leave their passphrases out in relatively unprotected shell scripts. I used to run PGP on a diskless workstation (at least I was one of the people with the root password :-), but I was aware of the risks. I'm now using it both on my Netcom+Eudora+PrivateIdaho system and on the machine where I have web space, which I have to telnet to across Netcom. I take care of the trust problem there by using a short key with a big ugly "untrustable" string in the user name, and using S/Key to log in; if I had an encrypted telnet to run on both ends I'd probably want to use it, so I'm watching the Stel and other new stuff coming out. Bill Stewart -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: You can get PGP by anonymous ftp from ftp.ox.ac.uk iQBVAwUBMA4HvfthU5e7emAFAQFrMwH9Hh1oYQKvsuV/IyVUskv2aZbmuh8fXQgK XpSpucrJV27tlFbjIDVqmapMR77arZVOm2Hs0/NTB2uT2jDG1r5+Lw== =fRtS -----END PGP SIGNATURE----- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com

1 0

Re: Is it legal for commercial companies to use PGP?
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 10:30 PM 7/19/95 -0400, tim werner wrote: >>From stewarts(a)ix.netcom.com Tue Jul 18 02:51:50 1995 >>Selling software containing the code is pretty clearly commercial. >>Non-commercial messages from your personal non-business machine are >>clearly non-commercial. Providing a service of encrypting and decrypting >>messages for people for money sounds like it's _very_ probably commercial. >>Encrypting and decrypting messages to/from your business that deal with money >>are a very gray area. > >Maybe "commercial company" is the wrong expression. All I meant was >that my company is not non-profit, or a university, or a government >organization. It is an engineering firm. What I have in mind is >nothing to do with a commercial use of encryption per se. That's what I thought you meant. >1) I have some email pen-pals that I would like to be able to use PGP to That would be fine to use PGP 2.6.2 for; there's realky no question. >2) It's entirely likely that people within the company may wish to get > into the habit of transmitting company data in encrypted form. This > is not a question of incorporating the encryption technology into a > product, or even into the sale of a product -- it's just a question > of keeping intra-company information transfers private. >The first is the one I'm really concerned with. The second would be >sort of a natural extension that, if legal, would be nice. I can't >imagine that these uses are subject to the ViaCrypt license, but I need >some reassurance/ammunition in order to be a little more open about >getting it installed on the machines in my department. The ViaCrypt license only matters if you're using ViaCrypt. The question of whether you can use PGP 2.6.2 for these is something you _do_ need to read the RSAREF license about, and maybe ask Jim Bidzos <jim(a)rsa.com> or a company lawyer-type about; encrypted mail within the company is probably ok, encrypted mail sending credit card numbers to pay for stuff is more questionable. # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com

1 0

Name misspelling
by perry＠imsi.com 17 Dec '03

17 Dec '03

I've been informed that the proper spelling was Taher Elgamal. Perry

1 0

Why no action alert, coalition opposing S. 974?
by Paul Elliott 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have read the EFF analysis of Senate bill 974, which is designed to inhibit encryption on Networks. I think that it is a thoughtful document but I am concerned that there has been no action alert produced to tell people the most effective way to oppose this horrible Bill. People who are concerned about the bill need to know what Senators could most profitably be contacted. Also why has no coalition been formed to oppose this bill? I am aware that many people are busy opposing S314, but S974 is equally terrible as it attempts to suppress free expression. I could try to produce an action alert myself, but I would probably make errors as I am not up on the legal subtleties and the intricacies of Congress. Could some of the savvy people please write an action alert? Otherwise I will be forced to take a stab at it. - -- Paul Elliott Telephone: 1-713-781-4543 Paul.Elliott(a)hrnowl.lonestar.org Address: 3987 South Gessner #224 Houston Texas 77063 -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBMA10YfBUQYbUhJh5AQFMBAQAgUJAj1nNdG54IxIFAboCw+Q/E8WWOvEO 9Aazj9hjHK7VeHi+vpTY7eJRbQq7LyQq/ex41PE+QXu+mjWe3c1si8HmhherA22i CUGv3UI8L/Z43zLtN2TI9reJsizeYnmHlO3uUffP3vnhwBJm1G7EAlXvKFqikC90 q1DUqqgq7k4= =4yQ7 -----END PGP SIGNATURE-----

3 2

BUS_gut
by John Young 17 Dec '03

17 Dec '03

7-20-95. NYPaper: "Clinton Assails Officers' Racist Event. Gathering Is Defended by the Organizer as Get-Acquainted Party." Mr. Rightmyer, organizer of the event, said he believed the criticism of the roundups was part of a politically motivated "setup" by the paramilitary group, the Gadsden Minutemen, who harbor intense hostility toward the ATF for its role in regulating the manufacture and sale of guns. Morris Dees, head of a prominent civil-rights organization, supported his view, and one Federal law-enforcement official said Mr. Rightmyer might be correct. JIV_tun "Montana Tax Protester Is Shot During a Raid." Local law-enforcement authorities, who had waited for more than three years to arrest a tax protester, Gordon Sellner, accused of trying to kill a lawman, shot and wounded him in a raid on his home. JAK_but [OpEd] "Terror In Montana: Judges do their jobs and risk their lives." Martha A. Bethel has been a municipal judge in Montana for nine years. This article is adapted from a statement she made last week at a Congressional forum on the militia movement. JUG_hug Trio: BUS_gut

1 0

IITF Report
by Carl Ellison 17 Dec '03

17 Dec '03

The Information Infrastructure Task Force (IITF) National Information Infrastructure Security Issues Forum draft report can be found at: http://ntiaunix1.ntia.doc.gov:70/0/iitf/security/fedrole.txt

1 0

Re: Netscape the Big Win
by Rich Salz 17 Dec '03

17 Dec '03

> Luckily, Netscape recently hired Taher Elgamal > and he's a smart guy. Unfortunately, he seems to be in a > position where he has to defend the fairly bad work they did already. When I first saw him speak at the Danvers IETF I thought "gee, does this bozo know he shares the same last name as a real bright guy"? I think it was Perry, for example, that pointed out that using one RC4 stream for each comm half was more-or-less obvious and standard practice. At last month's World Wide Web Consortium working group meeting on security, everyone trashed SSL. Everyone trashed the W3C for not just picking SHTTP but instead trying to invent something new that "borrowed from" SHTTP. Tahir was silent on the former, but didn't disagree on the latter. During a break, in the hallway he mentioned how he's gonna have to do some politicking back at the office, and that he's glad someone reasonable like him came, and not other folks he could name. > Netscape is a closed system. You can't write code for it unless you > work for Netscape. I thought they announced their intent to support java. /r$

1 0