December 2003 - cypherpunks-legacy

Re: Rethinking the utility of netnews "cancel" control messages
by Rich Salz 17 Dec '03

17 Dec '03

Cancel/Supercede is a useful model -- architecting them out of Usenet is a very bad idea. Ask Clarinet.

1 0

re. GAK - (was Re: Europe)
by Carl Ellison 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >Date: Wed, 04 Oct 1995 12:58:24 +0100 >From: Christian Wettergren <cwe(a)it.kth.se> >| Sweden: The authorities have not yet said anything at all about >| where they stand in the GAK controversy. Probably very few have >| heard about it. [...] >So lets go off and think hard about good (culture-related) arguments >why this is a bad idea. We'll gonna have to look really nice, and >say some sensible things. :-) Crypto is used for making sure that insiders get in while outsiders are kept out of encrypted files/messages. Strong crypto does a better job of keeping outsiders out. Things like TIS CKE are mechanisms for making sure that insiders continue to get in, in spite of mishaps with their keys. Any such system can be evaluated on its technical merits (does it really separate the insiders from the outsiders as well as it claims to?) (does it survive various disasters (because if it doesn't survive, it can't keep insiders in)?) This is a separate topic from GAK -- which boils down to the Government's claim that it should be listed as an insider for everybody. That's what needs to be brought to everyone's attention. - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)tis.com http://www.clark.net/pub/cme | |Trusted Information Systems, Inc. http://www.tis.com/ | |3060 Washington Road PGP 2.6.2: 61E2DE7FCB9D7984E9C8048BA63221A2| |Glenwood MD 21738 Tel:(301)854-6889 FAX:(301)854-5363 | +--------------------------------------------------------------------------+ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMHQP11QXJENzYr45AQGLTwQAnZheg0W7qMbX4SuWExsFuVj9K4bVeBQ0 KV0B+xVY259TMRBU/U6seneQ9hY/xxsqBb+fKLBI99GRcT0+4bun21TprfBiPR2v bsH/ZK6g3v5pexY8NlOv1bl9FIa1EoytMOVAsJhBtW4hddFa+tcsQSRNAWN2yoXk u5cGLzUSIx4= =BY+c -----END PGP SIGNATURE-----

1 0

Re: Certificates, Attributes, Web of Trust
by tcmay＠got.net 17 Dec '03

17 Dec '03

I have often said "You are your key." That is, keys have priority over names, even True Names. The biometric True Name identity of a person holding a key is only _another attribute_ of the key. Maybe important, maybe not. It depends on the nature of the transaction. But I go further: a huge number of interesting applications of strong crypto have no connections at all with physical persons, let alone with True Names. Agents in computer transactions, applets fired across networks, agoric entities in computational ecologies, BlackNet sorts of markets, and on and on. The notion that a cryptographic key needs to be tied to a physical person is deeply flawed. The talk of certification authorities is OK, so long as the practice is _completely_ and "strongly" voluntary (*). (* I think maybe we need a term like "strongly voluntary," to parallel "strong crypto." A key escrow system which can have arbitrary escrow holders--company lawyers, grandmothers, computers in other buildings, etc.--is "strongly voluntary." A government-sanctioned program which authorizes, approves, regulates, and controls escrow holders is *not*. GAK is not strongly voluntary, even though it will be sold as a "voluntary" system.) --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Re: Rethinking the utility of netnews "cancel" control messages
by Rich Salz 17 Dec '03

17 Dec '03

I would like to put my corporate legal infrastructe on an internal secure conferencing system. News (with crypto-signed articles) is ideal. Without a "destroy all copies" concept I cannot do this. /r$

2 1

SSL telnet vs. SSH. Comparison?
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Would somebody please compare for me SSL telnet vs. SSH in terms of security, advantages, and disadvantages? Thanks, - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMHQbESoZzwIn1bdtAQFgxgF/bx0sbAWQ2mFbwaSqcKSolepKNCC/kiNm 22gizTztznICXRPxh17VxkpiWwzcRZPv =QD3j -----END PGP SIGNATURE-----

2 1

Re: Restrictions on Munitions _Imports_
by John Gilmore 17 Dec '03

17 Dec '03

Peter D. Junger--Case Western Reserve University Law School--said: > There is a United States Munitions List for imports that is > administered by the Treasury Department, but cryptographic devices and > software are not included on that list. I agree with Peter. I looked this up at one point. The government has considered trying to impose import controls on crypto, like they've considered every other option they could think of. The question is what it would buy them except more trouble from the public. NSA can't sustain a claim that it would help them, since they aren't supposed to be spying on Americans anyway. But in Clipper-II, NSA risks effective export controls to advance FBI wiretapping interests. Now that NSA is in fully naked in bed with the FBI, they could jointly claim some governmental interest in killing off domestic privacy. But that's what would land them in trouble with the public. I really think they would have done better to have just shut up about crypto and not pushed the issue. The more they tighten the screws, the more agitated and educated the public gets. For every Clipper chip that has sold to a non-governmental party, ten Cypherpunks or 'punk sympathyzers have risen up and started writing code, investigating, talking to their friends, publishing articles in the press, and filing lawsuits. Ten years ago it was pretty lonely to be a cryptographer. Most of us wouldn't be on this mailing list -- the list itself would probably not exist -- if the government had just quietly let the export criteria advance, year after year, and had let the quaint academics play with their toys. But they tried alternating between stonewalling us and forcing crap down our throats. The result has been that the public now *cares* about crypto policy. And the public will get what it wants, in the long run, no matter what the impact on the privileges of the current crop of bureaucrats. John

1 0

subjective names and MITM
by Wei Dai 17 Dec '03

17 Dec '03

Neither certification hiearchies nor the PGP web-of-trust are very useful because they try to bind True Names to keys and True Names have many problems. People can have duplicate names and can change their names (what happens if I legally change my name to Bill Clinton and try to get Verisign to certify my key under that name?), and often we don't care about someone's True Name. Perhaps it is better to think of names as subjective identifiers, and public keys as global ids. That is, a person who has a collection of public keys gives each of them a name, but different people can name their keys differently. Of course the holder of the corresponding private key can help in the naming process (e.g., "Please call me Wei"). If two people need to talk about a third party, they can refer to him by an arbitrary name after establishing a common binding between his key and that name. In this scheme, the man-in-the-middle problem goes away because you are no longer trying to communicate with a True Name, whose binding with a key can be spoofed, but rather with the key itself. If the holder of that key chooses to act as a middle-man by relaying messages around, that is his business, and there is really nothing you can do about it. Wei Dai

7 12

Re: Rethinking the utility of netnews "cancel" control messages
by Erik E. Fair 17 Dec '03

17 Dec '03

At 10:34 10/5/95, Rich Salz wrote: >I would like to put my corporate legal infrastructe on an internal secure >conferencing system. News (with crypto-signed articles) is ideal. >Without a "destroy all copies" concept I cannot do this. > /r$ This, presumably, is a lawyer, discovery, lawsuit thing, right? Erik

1 0

AEgis Windoze PGP Shell (with location...sorry)
by Adam Philipp 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Aegis can be reached at: http://iquest.com/~aegisrc/ sorry for leaving that out las time.... -Adam -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMHOOA2/ZTaRmpgTFAQFioQf/WYR7o5SACijZpdZ1XZHtP4X/BXprVkVV /GX/eB8jbkDaCffuIWoz34dxN5PpSXQPAbE53ZGcJEiIuYdl9CLloJj12yZFS3Bx wa0988Fz374xmgL2VA6HllQwTBjab7v6vk565RG+Rtf7t7DWGIORP5WFDbDKJ4FR yhxnPhFi/LA20aBrBjY9bfPMuFdUm+teBVjzNsgGmsTQov72iosuMh0IYhqcaBpR ndaRdpp1ntcD6A2xPn+wfEYLcLUR34YbJVHmYwN3WJuhbNbhS4x4Aa0KFE9Sbi5W bYt9wnqE0+uywTJb2Z8WUaH+0UfgeE/GNZvDe8jEp6oSUhaBs0R0LA== =9ZIj -----END PGP SIGNATURE----- --=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\ |PGP key available on my home page|Unauthorized interception violates | | http://www.rosa.com/~adam |federal law (18 USC Section 2700 et| |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-|seq.). In any case, PGP encrypted | |SUB ROSA: Confidential, |communications are preferred for | |secret, not for publication. |sensitive materials. | \-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-/

1 0

is this a bug of Netscape
by John Cheng 17 Dec '03

17 Dec '03

If you go to http://c.gp.cs.cmu.edu:5103/prog/webster, you will get a input textbox and two buttons, leave textbox blank and push Look Up Definition button, you will get a GPF? I am using Netscape V1.2N for windows. Sorry if you have knew it. J

1 0