December 2003 - cypherpunks-legacy

some points on weak codes
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

various points have been made about the undesirability of weak voice scrambling mechanisms. I'd like to advance the position that the use of trivially-broken codes is better than no codes at all, as long as the owner is aware of the distinction. one of the goals of cypherpunks is not necessarily to get a secure world (that is a *long* term goal), but to get a world in which people are aware of the issues that cypherpunks are interested in. Encryption, privacy, etc. now, along these lines, even a widespread trivially broken code penetration would be better than none at all. this is a similar concept to that advocated by someone else on this list, namely PRZ's manual that talks about how you shouldn't use PGP on a shared system, and how you should only exchange keys in person, as being a little to extreme for the common man, for whom insecure crypto, along with the *understanding* that it is not totally secure. I think everyone here agrees on long term goals of widespread encryption penetration. but one way to bridge that gap is to just have "toy crypto". I see this deroated frequently on the list but it is probably a very, very valuable public relations mechanism. I mean, it's hard to imagine that in politics that distributing little plastic symbols called "buttons" would have any social effect, yet it has persisted since the invention of buttons. things like a cheap "purple" kit, promoted by the cypherpunks, not foolproof but easy to build and cheap to buy, would advance the agenda in the long run in a very valuable way. what we need to do is give people a variety of options to the interested public laypeople, just like Ford and that anecdote demonstrates. are we saying, "you can have any crypto that you want, as long as the NSA can't break it in 1000 years"? that's the equivalent of saying, "you can have any car you want, as long as its black". we must resist the illusion that there are only 2 kinds of crypto: insecure or secure. there is a continuum of crypto, and casual users should not have to worry about the capabilities of the NSA. IMHO we are sabotaging our main goals, launching into a deep discussion of the NSA's supercomputers and the theory of numbers whenever a newbie asks about what is available. again, weak crypto is probably better than no crypto in most cases, just because it helps improve public awareness. people can't even comprehend the idea of what is "weak" or what is "strong" until they even have a mental framework of what they are dealing with. ~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^ \ / ~/ |\| | | |> | : : : : : : Vladimir Z. Nuri : : : : <vznuri(a)netcom.com> \/ ./_.| | \_/ |\ | : : : : : : ftp://ftp.netcom.com/pub/vz/vznuri/home.html

1 0

Re: Significance of PGPFone?
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:51 AM 8/12/95 -0700, you wrote: >* Finally, I have a "fax modem" on my Macintosh, as many of you do. Guess >what? I went and got a real fax machine. Lots of reasons. First, my fax >modem had to be installed just right...if inits or preferences got subtly >shifted, it stopped working properly. Second, sending things was a bitch. >(Had to have the scanner up and working, which was not often, etc.) Third, >robustness. We've got a box sitting next to the laser printer that receives faxes and prints them on real paper, which is more reliable (and quieter and lower-powered) than leaving the computer on, though it does require leaving the printer on. But for outgoing faxes, much of what I send is from the computer anyway, so it's less of a problem (though, without a scanner, I'm more likely to only fax stuff that I generated on the computer than drive to Kinkos...) Perhaps we also need to build PGPfax? #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- Storyteller makes no choice - soon you will not hear his voice. His job was to shed light, and not to master. RIP, Jerry

1 0

IETF working to define a public key infrastructure
by Rich Salz 17 Dec '03

17 Dec '03

Help define the internet's web of trust model ... >From: "warwick (w.s.) ford" <wford(a)bnr.ca> Message-Id: <"21210 Sat Aug 12 15:15:59 1995"@bnr.ca> To: pem-dev(a)tis.com, cat-ietf(a)mit.edu, ipsec(a)ans.net, e-payment(a)cc.bellcore.com, www-security(a)ns2.rutgers.edu, ietf-payments(a)cc.bellcore.com, pki-twg(a)nist.gov Subject: Proposal for New IETF WG on PKI Over the past couple of weeks, a group of interested individuals has been putting together a proposal for a new IETF Working Group to develop Internet standards for an X.509-based public-key infrastructure. The result is the draft WG Charter attached below. Since plans were announced last year to form this WG (and to shut down the PEM WG) it is considered reasonable to start up the new WG without the usual preliminary BOF at the next IETF. Steve Kent and I have offered our services to co-chair this group, and Chandra Shrivastava has offered to run a mailing list. The following mailing list has now been established for discussion of this proposal: ietf-pkix(a)tandem.com. To subscribe to the mailing list, send a messsage to listserv(a)tandem.com with the following in the body: subscribe <e-mail address> ietf-pkix Warwick Ford -------------------------------------------------------------------- Public-Key Infrastructure (X.509) Group IETF Working Group Charter --------------------------------------- Chair(s): Applications Area Director(s) Area Advisor: Mailing lists: General Discussion: To Subscribe: In Body: Archive: Description of Working Group: Many Internet protocols and applications which use the Internet employ public-key technology for security purposes and require a public-key infrastructure (PKI) to securely deliver public keys to widely-distributed users or systems. The X.509 standard constitutes a widely-accepted basis for such an infrastructure, defining data formats and procedures related to distribution of public keys via certificates digitally signed by certification authorities (CAs). RFC 1422 specified the basis of an X.509-based PKI, targeted primarily at satisfying the needs of Internet Privacy Enhanced Mail (PEM). Since RFC 1422 was issued, application requirements for an Internet PKI have broadened tremendously, and the capabilities of X.509 have advanced with the development of standards defining the X.509 version 3 certificate and version 2 certificate revocation list (CRL). The task of the Working Group will be to develop Internet standards needed to support an X.509-based PKI. The goal of this PKI will be to facilitate the use of X.509 certificates in multiple applications which make use of the Internet and to promote interoperability between different implementations choosing to make use of X.509 certificates. The resulting PKI is intended to provide a framework which will support a range of trust/hierarchy environments and a range of usage environments (RFC1422 is an example of one such model). Candidate applications to be served by this PKI include, but are not limited to, PEM, MOSS, GSS-API mechanisms (e.g., SPKM), ipsec protocols, Internet payment protocols, and www protocols. This project will not preclude use of non-infrastructural public-key distribution techniques nor of non-X.509 PKIs by such applications. Efforts will be made to coordinate with the IETF White Pages (X.500/WHOIS++) project. The group will focus on tailoring and profiling the features available in the v3 X.509 certificate to best match the requirements and characteristics of the Internet environment. Other topics to be addressed potentially include: - Alternatives for CA-to-CA certification links and structures, including guidelines for constraints - Revocation alternatives, including profiling of X.509 v2 CRL extensions - Certificate and CRL distribution options (X.500-based, non-X.500-based) - Guidelines for policy definition and registration - Administrative protocols and procedures, including certificate generation, revocation notification, cross-certification, and key-pair updating - Naming and name forms (how entities are identified, e.g., email address, URN, DN, misc.) Goals and Milestones: Sep, 95 Agreement on draft Working Group charter Nov, 95 Completion of initial strawman PKI specification Dec, 95 First Working Group meeting (Dallas IETF) Jul, 96 Submit PKI (X.509) specification for consideration as Proposed standard.

1 0

Re: Yet another self-labeling system (do you remember -L18?)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

At 02:05 PM 7/26/97 -0400,James Love wrote: > Suppose on the other hand that someone had a page that people thought >should have a rating=adult tag. Well, the person who didn't use the tag >would just have to deal with whatever crap you would get for not >labeling. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^ That's not voulntary, as Tim stated. >If you thought your site had some constitutional right not to >label the content adult, then just don't label it. I really don't think >this will be that big an issue, Unless you believe that voluntary ratings in order to get listed in a search engine are wrong. >but I don't know (no one knows). I >think that a significant percent of porn sites would use the >rating=adult label in a second if they thought it would get people off >their back. Those that didn't use the label could just put up with the >consequences, whatever they are. I would expect (and hope) that the >rating=adult label would be used infrequently, mostly for sites >involving explicit sexual images. I don't think a rating=adult label >would be much of a barrier to teenagers who wanted access to this type >of material, since one could download a browsers in a few minutes that >wouldn't block the data. But like a childproof top on aspirin, it would >work pretty well with pre-teens, I imagine. Some pre-teens are smarter than that, and may thwart the system. Whose fault it it then if they see a page with porn on it? > Well, I for one don't like a Y=7 type system. It involves too much >information from the person rating the wage page. The more precision >you put in a rating system, the more trouble you get in. Keep it >simple, very simple. What if someone was a sex with sheep web site, >unlabeled? I don't care much. I wouldn't be surprised, however, if >Yahoo didn't give them the prominent listing they wanted, in the absence >of the rating=adult label. Therefore, don't use yahoo. Use one that doesn't promote censorship. > Maybe. Maybe not. Maybe it would "solve" the problem, without >legislation. I think it would be nice if the problem was solved >without legislation. But if the problem (and I think there is a problem) >isn't solved voluntarily, don't be shocked when Congress acts. And I won't be shocked when the Supreme court strikes that down. The problem can be solved, just let parents monitor their kids access. If that happened, there would be no need for this censorware and rating crap. > Are you calling me a lazy parent? What is the obligation of a >parent? To supervise a kids web browsing? Please, I think kids are >better off with more privacy, and less parental (and teacher) >supervision when they browse the web. Well, if they have that privacy, they often go to a site with images that some people consider obscene. That's when the parents, unable to accept their mistake for not being responsible, blame the webpage's author. > This simply isn't true. A lot of support for content labeling, >including systems which I find appalling, is from fairly typical >parents. This isn't a right wing or born again issue. Those parents probably are lazy in the first place. > Nothing will satisfy everyone. But reasonable people will support >reasonable solutions, and it might be the case that there are enough >reasonble people around to come up with a resonable system. You seem to favor the "Let's just do this to avoid hassle" thing that law enforcement and government types try to promote. If we were to, "avoid the hassle" with webpage ratings, we might as well "avoid the hassle" of using PGP and such so that we don't anger the government anymore. I'm not labeling my webpage, and no dickhead is going to tell me to.

2 1

EYE_see
by John Young 17 Dec '03

17 Dec '03

8-13-95. NYPaper: "One Source, Many Ideas In Foster Case: Publisher Bankrolls Cover Up Theories." The theory of a Vincent Foster murder and a cover-up has been promoted by a handful of foundations and publications united by a common denominator: the money of Richard Mellon Scaife. "The death of Vincent Foster: I think that's the Rosetta Stone to the whole Clinton Administration," said Mr. Scaife, a newspaper publisher with half a billion dollars in the bank, during a two-hour interview. EYE_see (about 5K)

1 0

New Crypto Application
by Guillotine 17 Dec '03

17 Dec '03

Greetings fellow Cyphers... I'm creating a new _text_ cryptography program. The encryption algorithm, using a symmetrical is going to be as strong as legally allowed, and after copyrighting the program, I'm going to release the source code and explain everything about it (since it can be reverse engineered anyways). The reason I'm sending this e-mail to you is my request for more knowledge, and if you're like me, then you have an extreme thirst for knowledge! Any algorithm, key hashing, user interface, or other important suggestions you might have will help me immensely, and hey, maybe you'll get a free copy of this program when it comes out, but otherwise you will just have to wait until someone cracks the copyprotection because I'm going to make that extremely hard to do. I was going to call the program AlphaNumeric Encryption, but that says pretty much nothing... I might just call it something like Cipher Pad (or Cypher Pad if nobody cares that I use "cypher") , since it's only for text encryption. If you have a better idea for a name for this program, then please suggest it to me. Thanks, Guillotine

11 12

No Subject
by Andrew.Spring＠ping.be 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Anonymous says .... >will someone just CUT THE @#$%^&* FOSTER CONSPIRACY THEORIES?? >I'm getting F---ING SICK AND TIRED of all the BULL**** that and says.... >any good drill instructer. oh yes, so many of you pansies >need to get into a serious digital BOOT camp. learn some real and says... >"mind masturbating and drug fondling" parties every few >days with all the Hoi Poilloi Holier-Than-Thou pricks of >the world, the "cum of the net" ejaculating all over each >other, hehehehehehe what a bunch of effeminate nobodies... and says... >the most scurrilous swine for taking up PARRY's time with >your filling up this mailing list with GARBAGE? TRASH? >EXCREMENT? ODIOUS EFFLUVIA??? don't you know that it cuts and says... >UNIX SOFTWARE AND HOW TO WRITE A CORRECT DNS LOOKUP VIA >SOCKET LIBRARIES. are we cypherpunks, or cypherprogrammers? >GET A CLUE, PEOPLE. and says... >I'M GOING TO MAILBOMB THE WHOLE LIST. that'll teach the >@#$^%^&* bastards to mess with MY VALUABLE TIME. I say: Anonymous, you could learn to relax a little. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMC0LjI4k1+54BopBAQGGBwQAgovXJ5zJKFWs8h/hdwOW91MT22BBZwCf jo9WRwzuM2x6C2cDPM5ti5V0CNEG5RY64jXbd6By4At5ALN1Y671Mb2Eh51c9K6R EjG0Ihm1um0Knv50fsta0UqcH5r9YHl1AZAVAe2f7xPPYBA6M/0f5S7KUGhfcOgX yqX8pM5pKOI= =efaH -----END PGP SIGNATURE----- -- Thank you VERY much! You'll be getting a Handsome Simulfax Copy of your OWN words in the mail soon (and My Reply). <Andrew.Spring(a)ping.be> PGP Print: 0529 C9AF 613E 9E49 378E 54CD E232 DF96 Thank you for question, exit left to Funway.

1 0

Why does the feed always get hosed on a weekend?
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- It seems that everytime majordomo goes down is on a weekend. Why is that? - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMC5K9yoZzwIn1bdtAQH3igF+OiLvo0hfV8cGyATot6QF82UZVVc8JMTm yfoD6JSv0bUondWXt/4kVk/cUzEWFOz7 =/FnW -----END PGP SIGNATURE-----

1 0

SKIP (Security on the IP Layer) Sources
by Germano Caronni 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hello everybody, I am not in the cyberpunks mailing list, but I feel you might perhaps be interested in this: the Swiss version of SKIP is now available as a pre-alpha source code release for IRIX, NetBSD, Nextstep and Solaris. You may get it from ftp://ktik0.ethz.ch/~ftp/pub/packages/skip. Have fun, Germano Excerpt from the README: ======================================================================== This is ENskip, pre-alpha 0.10. ENskip is a security module for the TCP/IP stack. It provides encryption, authentication and sequencing of packets on the IP layer between two or more machines. For more information on the SKIP protocol, see the Internet Draft draft-ietf-ipsec-aziz-skip-00.txt and following. You might also want to check http://skip.incog.com for information about the background, the protocol itself and future directions of it. ENskip is pre-alpha. If you are not absolutely sure what this is all about, you might want to read the draft, and perhaps reconsider using this package. No bug-fixes, installation help or any other support is granted. If you have any suggestions, comments or contributions to make ENskip work better, mail to skip(a)tik.ee.ethz.ch. Enjoy! M. Hauber and Ch. Schneider G. Caronni ======================================================================= - -- <...cookie space for rent...> Germano Caronni caronni(a)tik.ee.ethz.ch http://www.tik.ee.ethz.ch/~caronni PGP-Key-ID:7B7AE5E1 997C6DC4AF930A5D2D5D6AEAA196C33B -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMC5akrH8jId7euXhAQE2ugQApLxGxEyzZ3+dj+nC/QSoW97fErMevWcY pJ96Ge2Jk6Ct06qMgIsuQCEY8/SA9iZX4VYe7Pmg/orvc2kStgs3ApeV97ocLoWo 8YzFRH06K/X6Vrrps8vSBy0vtUD2FGQWvbiUviNDnN2O2kf7FqyoNbX3lIzdHQBF NVhs/+bMqHQ= =gozW -----END PGP SIGNATURE-----

1 0

Who Else is Reading your Email? (From Cu Digest, #7.67)
by Robert A. Hayden 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Normally, I don't like reposting things to this list. However, I am going to report this from the most recent version of CuD, because I think it hits a very important nail right on the head. Not just that PGP is going, but it puts all of the terms we on this list have been bantering around for the last couple of years into ones that laymen can understand. I sincerely thing that this is the kind of push we need to make as a whole to bring about social change on the net (and social change is what is needed). Ie, PGP is good because 1) it keeps people from reading your email (like an envelope) and 2) it makes sure nobody forges your messages by allowing you to digitally sign them. Anyways, sorry for the report, please flame lightly :-) - --------------------------------------------------------------------- Date: Wed, 09 Aug 1995 19:25:49 -0400 From: kkc(a)INTERLOG.COM(K.K. Campbell) Subject: File 1--Who Else is Reading your Email? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ eye WEEKLY June 29 1995 Toronto's arts newspaper .....free every Thursday ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ eye.NET eye.NET WHO ELSE IS READING YOUR EMAIL? Part 1 of a 2-part series on PGP by K.K. CAMPBELL I recently conducted an overseas interview with a "computer security person at a highly sensitive facility." Mr. Security explained that the potential misuse of the computer resources of this site was a serious concern, a danger to thousands. This instilled in him a peppery dash of paranoia about who was using what machine for what purpose. In discussing this, the name of a certain, rather net.famous individual arose. I was surprised to learn this individual was well-known in international security circles. This individual is considered a "risk." I was informed that this person's email is "monitored." To spell it out: people were reading and collecting all the email the "risk" wrote. Without the target's knowledge. Without any form of warrant. Most netters think such intrusion involves someone "hacking a password." Wrong. When you hit the "send" command for email, your missive seems to (poof!) magically appear in the recipient's mailbox. Person to person. The ultimate intimacy. Wrong again. Email is actually passed through a number of computers. The operator of one of those machines can effortlessly read your email. Any one who "breaks into" such a machine can inspect your mail. Once in, they can tamper with files so that all your email is copied to another location, without you being aware of it. But not everyone wants to "break into" a computer. In the above case, email was copied "in transit." When email is transferred from machine to machine, it is made readable. So if you intercept a copy (through "sniffers"), you can read it. Everything this individual had written over the last couple of years has apparently been intercepted and read. His file is huge. With Canada news media in a tizzy about "regulating the net," how long before CSIS requests funds to start collecting posts with buzzwords in the network data flow? POSTCARDS It should be the first lesson every newbie learns: email ain't secure. An email is like a postcard: it travels through the many sets of hands in delivery and any set of hands can read it if so inclined. Most postal employees don't, for two reasons: there is so much mail they haven't the time, and most postcards are so boring, who the hell wants to? The same goes with the system administrators who oversee the shunting around of all your cyberscribbling. Most don't snoop, but some do. Need I remind you that, er, sysadmins are not a monolithically mature-and-well-adjusted breed imbued with highly developed moral principles... What can you, the lowly downtrodden, rights-less end-user, do? You have three strategies: -- no precautions: who cares if anyone reads what you write/receive; -- minimal coding, easy to crack, but enough to stop casual snoops -- kind of like "virtual envelopes"; and -- PGP. PGP stands for Pretty Good Privacy -- a humble title to be sure, considering that the U.S. government/military wants to ban the thing. And why? Because PGP has the power to thwart their zillion-dollar spy efforts by imbuing everyday folk with the cryptographic might of the best "puzzle palaces" around the world. The elegantly powerful encryption device is the offspring of Colorado resident Phil Zimmermann (prz(a)acm.org) He basically took all the (very public) papers on cryptography, stirred it together and voil=E1: instant "threat to democracy" -- if you buy the government/military propaganda. (More on Zimmermann and the cryptographic spook backlash next issue [below].) What PGP does is solve that decades old spy/cryptography dilemma: How can one send secure messages to absolute strangers over an insecure medium? PGP exploits two historical developments: -- home computers gave commoners the computational power to use the sophisticated cryptography algorithms; and -- the advent of public key encryption in the late '70s bade farewell to Ilya Kuryakin and Napoleon Solo. Computers were originally designed (back in World War II) to be sophisticated code breakers. Today, government/military bureaucracy (especially in the U.S.) still operate with that attitude: computer cryptography is a military weapon. In those Cold War days, the only way to send secure messages over insecure channels (telegraphs, phones, mail, etc.) was to first deliver a "cryptographic key" via secure channels. The key was something like a little code book; the secure delivery channel was usually a dour-faced courier with a black bag handcuffed to his wrist. "Deliver this or die doing so, 007..." BE AN INTERNATIONAL ARMS DEALER! Governments and mega-corps could afford to send satchel-toting couriers overseas, but us proles had little hope of doing that. So citizens were always vulnerable to mail-opening, phone-tapping spooks. PGP uses two keys -- a public key and a secret key. Anyone can use your public key to encrypt a message to you, and only you can then decrypt it with your secret key. As long as your secret key remains secret, no one can read that message -- not even the person who encrypted. The idea is to spread your public key around in Key Exchanges, like phone books. For details on this complex subject, try _PGP: Pretty Good Privacy_ by Simson Garfinkel (O'Reilly & Assoc., http://www.ora.com, $29.95 paper). Or _The Computer Privacy Handbook_ (Peachpit Press, http://www.peachpit.com/peachpit, $31.95 paper). Both go beyond technical details and delve into the sociopolitical issues around privacy. Where can you get PGP? All around the world. PGP is freeware -- you can use it endlessly without cost. But remember: The U.S. State Department export restrictions classify cryptographic materials to be munitions. Exporting it from the U.S. is a serious matter. For those uninterested in becoming international arms smugglers, do an Archie search for "PGP" or try Toronto's Interlog at ftp://ftp.interlog.com/pub/pgp . Read newsgroups alt.security.pgp and sci.crypt for discussions. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: PGP Signed with PineSign 2.2 iQCVAwUBMC5FqjokqlyVGmCFAQEIogQAqMhbVQnCI9ElX0rVYQO/7cuY+YWqLQhh 9bZOsis9Tfp2ko9KJ9Dpek8wHo/I3ODCPbY3flxwE/q6ogU1DJvJXYzWtc7fmbOH QI2038hRnnt8bsMei/WQEunuo5iGCAzrTuOG/PkfkB2GsM4/5b6jaHlWCCSIdGoz JzyXt0dMJoE= =kR1W -----END PGP SIGNATURE----- ____ Robert A. Hayden <=> hayden(a)krypton.mankato.msus.edu \ /__ Finger for Geek Code Info <=> Finger for PGP Public Key \/ / -=-=-=-=-=- -=-=-=-=-=- \/ http://krypton.mankato.msus.edu/~hayden/Welcome.html -----BEGIN GEEK CODE BLOCK----- Version: 3.0 GED/J d-- s:++>: a-- C++(++++) ULU++ P+! L++ E---- W+(-) N++++ K+++ w--- O- M+ V-- PS++>$ PE++>$ Y++ PGP++ t- 5+++ X++ R+++>$ tv+ b+ DI+++ D+++ G++++>$ e++ h r-- y++** ------END GEEK CODE BLOCK------

1 0