December 2003 - cypherpunks-legacy

Feds Seek PKI Bids
by John Young 17 Dec '03

17 Dec '03

USG published a solicitation today in the CBD for a Public Key Infrastructure which outlines the system requirements: http://jya.com/pkicbd.htm

1 0

Re: SSL trouble
by ab411＠detroit.freenet.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- "Daniel R. Oelke" <droelke(a)rdxsunhost.aud.alcatel.com> writes: >someone, probably either patrick(a)Verity.COM or hallam(a)w3.org, writes: >>Piete.Brooks(a)cl.cam.ac.uk, stripes(a)va.pubnix.com writes: >> >>> I'd like to get the raw date in brloop (a sh script). In perl I'd just >>> use "time", and I can't see a way to get "date +" to yield the raw time. >>> I could use "date=`perl -e 'print time'`" but that seems OTT, and perl >>> may not be on teh users PATH. Any suggestions ? >> >>"date '+%s'" does it under BSDI, but I'm not sure how portable it is. >> > >That doesn't work under SunOS 4.1.x, but this does: > > date "+%S %M 60 * + %H 3600 * + %j 86400 * + %y 31536000 * + p" | dc > >This assumes 365 days/year, so if you jump from a leap year to a non-leap >year it won't work right. Hey - a 1/1460 failure rate is better >than most Windoze programs I've used ;-) > >It also isn't the "absolute" time, (as given by time()), but >gives a number of seconds that constantly increases. > >With a little more work you should be able to adjust this to be close >to time() functionality. This was, of course, originally one long line: date +"%S %M 60 * + %H 3600 * + %j 1 - 86400 * + %y 70 - 31536000 * + %y 69 - 4 / 86400 * + 3600 4 * + p" |dc Differences: %j 1 -, because days of the year are numbered from 1, not zero, and we don't want to count 86400 seconds for today before today has finished. %y 70 -, because 1970 is the epoch, of course. %y 69 - 4 / 86400 * +, takes into account all leap days in all leap years up through last year. Why? Left as an exercise for the reader. ;-) 3600 4 * +, this is a bit of ugliness. date +%s returns GMT for me. I'm in EDT, so that's four hours away from GMT. So this is necessary to make this return the same number as date +%s. But if you're in another time zone, you need to change that 4 above appropriately. If this whole section is deleted we are left with: date +"%S %M 60 * + %H 3600 * + %j 1 - 86400 * + %y 70 - 31536000 * + %y 69 - 4 / 86400 * + p" |dc which returns local time, which is probably what you wanted anyway. By the way, date --version, on my system, returns "GNU shellutils 1.9.4", just in case you were wondering what date I'm using. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMEKT+REcrOJethBVAQEXgAQAx9HLiR+LPvclEYRFrliqOugj9cbzGwLD HCWOC8/MfrXuS3MPLQj1HugA18LH/LGy3BTp7cSnSNXDoL2/7UkLeAspGejRrEG4 WgQ8HIC2weVDP66PqioFD6lAELatRWk4Xl/mLgVrxluBrKtRnADtCX/VdHPw1ZiU YDfiWBtKRGU= =i1Di -----END PGP SIGNATURE----- -- David R. Conrad, ab411(a)detroit.freenet.org, http://www.grfn.org/~conrad Finger conrad(a)grfn.org for PGP 2.6 public key; it's also on my home page Key fingerprint = 33 12 BC 77 48 81 99 A5 D8 9C 43 16 3C 37 0B 50 Jerry Garcia, August 1, 1942 - August 9, 1995. Requiescat in pace.

1 0

Re: Florida Drivers Permits
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:55 AM 8/29/95 +1000, you wrote: >>>Better would be to figure out the encoding scheme and post it here. >>I like this, myself. It'd be nice to be able to have the picture of my >>choosing instead of a digitized thumbprint... > >I think the officer arresting you would frown if your license dumped a nudie >picture of Cindy Crawford instead of your identification details. Yeah, but your basic thumb-shaped black smudge might look believable... #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

2 1

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash middle latent cut ek"; $remailer{"winsock"} = "<winsock(a)rigel.cyberpass.net> cpunk pgp pgponly hash cut ksub reord ?"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp pgponly hash latent cut ek"; $remailer{'weasel'} = '<config(a)weasel.owl.de> newnym pgp'; $remailer{"reno"} = "<middleman(a)cyberpass.net> cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{"cracker"} = "<remailer(a)anon.efga.org> cpunk mix remix pgp hash esub latent cut ek reord"; $remailer{'redneck'} = '<config(a)anon.efga.org> newnym pgp'; $remailer{"bureau42"} = "<remailer(a)bureau42.ml.org> cpunk mix pgp hash latent cut ek"; $remailer{"neva"} = "<remailer(a)neva.org> cpunk pgp pgponly hash cut ksub ?"; $remailer{"lcs"} = "<mix(a)anon.lcs.mit.edu> mix"; $remailer{"medusa"} = "<medusa(a)weasel.owl.de> mix middle" $remailer{"McCain"} = "<mccain(a)notatla.demon.co.uk> mix middle"; $remailer{"valdeez"} = "<valdeez(a)juno.com> cpunk pgp pgponly hash ek"; $remailer{"arrid"} = "<arrid(a)juno.com> cpunk pgp pgponly hash ek"; $remailer{"hera"} = "<goddesshera(a)juno.com> cpunk pgp pgponly hash ek"; $remailer{"htuttle"} = "<h_tuttle(a)rigel.cyberpass.net> cpunk pgp hash latent cut post ek"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. remailer(a)crynwr.com is _not_ a remailer. There is no remailer at relay.com. Groups of remailers sharing a machine or operator: (cyber mix reno winsock) (weasel squirrel medusa) (cracker redneck) (nym lcs) (valdeez arrid hera) The remailer list here has been out of date for some time, but should be up to date now. I'm still working on updating the web page. Last update: Mon 11 Aug 97 6:48:21 PDT remailer email address history latency uptime ----------------------------------------------------------------------- cracker remailer(a)anon.efga.org +++**+++++-+ 32:17 100.00% redneck config(a)anon.efga.org **#**#*#++-* 9:35 100.00% nym config(a)nym.alias.net ####+#---### 33:53 99.99% cyber alias(a)alias.cyberpass.net ***+*++**+-* 19:55 99.96% mix mixmaster(a)remail.obscura.com *+*+*+-+*+-* 40:19 99.95% winsock winsock(a)rigel.cyberpass.net --------.--- 6:12:35 99.92% replay remailer(a)replay.com ***-*****-* 15:02 99.48% weasel config(a)weasel.owl.de -+---+++--- 2:11:39 99.36% arrid arrid(a)juno.com - + - --+-+ 1:59:27 99.31% valdeez valdeez(a)juno.com ____ __ _ * 72:57:16 99.10% hera goddesshera(a)juno.com - -------- 3:59:28 97.40% reno middleman(a)cyberpass.net +++-++ -- 58:16 96.38% neva remailer(a)neva.org ++**--- -* 2:04:57 90.02% jam remailer(a)cypherpunks.ca +*++--- +* 2:13:07 89.14% squirrel mix(a)squirrel.owl.de ----- - - 4:12:37 74.34% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Can't touch this, ugly Americans! (PGP License file)
by Adam Shostack 17 Dec '03

17 Dec '03

First off, congratulations and thanks to Stale and everyone else for scanning in the source to PGP5.0i (http://www.ifi.uio.no/pgp/) However, theres an ugly problem with the license. (http://www.ifi.uio.no/pgp/pgp50i-license.txt) In Section 1.c.(d), permission is given to port PGP to other platforms. However, permission to distribute those ports is explicitly denied. Could the license be modified to allow people who port the software to redisctribute ports? There is enough FUD about using PGP without PGP, Inc contributing to that by overly tight licensing. Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

3 3

Re: North American Crypto Archive status
by Ariel Glenn 17 Dec '03

17 Dec '03

Okay, I have a list of files which I couldn't get off the North American Crypto Archive site before it closed, and couldn't find anywhere else; see http://www.columbia.edu/~ariel/news/mpj-missing.html Get out all your old floppies and see if you or your friends or even your enemies downloaded any of these. I've listed the original file names and the byte counts; I'd like to get the original files all in place before worring about newer/different versions of them. Ariel Glenn / AcIS R&D / Columbia University ariel(a)columbia.edu blah blah blah blah...

1 0

No Subject
by Alex de Joode 17 Dec '03

17 Dec '03

Subject: Re: Can't touch this, ugly Americans! (PGP License file) Newsgroups: list.cypherpunks Organization: Replay and Company UnLimited. Adam Shostack sez: : First off, congratulations and thanks to Stale and everyone else for : scanning in the source to PGP5.0i (http://www.ifi.uio.no/pgp/) It was mostly an Brit effort (with some dutch and german help). They did sweat labour for two days, so a thank you guys is certainly in order. T H A N K Y O U A L L ! ! -aj-

1 0

List of crypto-related courses
by Avi Rubin 17 Dec '03

17 Dec '03

For the last year or so, I have built and maintained a list of graduate level courses on cryptography and security. The current list can be found at http:/www.cs.ny.edu/~rubin/courses.html I would like to keep this list as current as possible, so if you have any additions/corrections, etc, please let me know. I am only interested in full-semester courses at universities. Thank you, Avi ********************************************************************* Aviel D. Rubin rubin(a)research.att.com Secure Systems Research Dept. Adjunct Professor at NYU AT&T Labs - Research 180 Park Avenue http://www.research.att.com/~rubin/ Florham Park, NJ 07932-0971 Voice: +1 973 360-8356 USA FAX: +1 973 360-8809 --> Check out http://www.clark.net/pub/mjr/websec/ for a new book on web security (The Web Security Sourcebook). *********************************************************************

1 0

[Fwd: fwd: Digital Signature Amendment in US House Today]
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text MIME-Version: 1.0 Date: Thu, 7 Aug 1997 14:03:23 -0400 Reply-To: Digital Signature discussion <DIGSIG(a)VM.TEMPLE.EDU> Sender: Digital Signature discussion <DIGSIG(a)VM.TEMPLE.EDU> From: Dan Greenwood <dan(a)CIVICS.COM> Subject: [Fwd: fwd: Digital Signature Amendment in US House Today] To: DIGSIG(a)VM.TEMPLE.EDU FYI Received: from mailhub.state.ma.us (mailhub.state.ma.us [146.243.12.156]) by maildeliver0.tiac.net (8.8.0/8.8) with ESMTP id NAA19610 for <dan(a)civics.com>; Thu, 7 Aug 1997 13:51:57 -0400 (EDT) Received: from vinesgw1.state.ma.us by mailhub.state.ma.us; Thu, 7 Aug 1997 13:57:05 -0400 Received: by vinesgw1.state.ma.us; Thu, 7 Aug 97 13:51:10 EDT Date: Thu, 7 Aug 97 12:44:41 EDT Message-ID: <vines.KW59+shTunA(a)vinesgw1.state.ma.us> X-Priority: 3 (Normal) To: <digsig(a)lists.state.tx.us> Cc: "Gutierrez-ANF, Louis" <Louis.Gutierrez(a)state.ma.us> (louis gutierrez) From: "Greenwood-ITD, Dan" <Dan.Greenwood(a)state.ma.us> (dan greenwood) Subject: fwd: Digital Signature Amendment in US House Today MIME-Version: 1.0 Content-type: text/plain; charset=US-ASCII Hello, Below, please find a NIST legislative effort to set national PKI standards - including CA and digital signature standards ("The Panel shall develop . . standards to ensure consistency among jurisdictions that license certification authorities"). To the credit of the drafters of this amendment, they do seek some participation by state gov. and other stockholders to inform the process. Also to their credit, they are seeking ways to develop national uniformity in this area generally. Questions: why is this focused on the license of CAs and not on the more desirable "accreditation" standards that must be developed? Perhaps it is for the good that accreditation of CAs remain primarily a private sector activity (outside the scope of Federal government direct control and regulation) - but this NIST language seems to assume multi-jurisdictional license of CAs (what other requirements will the federal government seek to impose through license - key escrow? pricing? particular technological implementations? pre-conceived business models?) What will be the market impacts of such license requirements? This raises some interesting questions about where to strike the optimal balance between top-down federal government's national consistent standards versus working with private sector leadership/self-governance organizations to develop national standards (hence allowing more innovation, responsiveness to change and (I believe) better standards for this very dynamic and young area). Can this be done through "license" - perhaps so. Assuming we create the right license criteria - such as: "you are deemed to be licensed if you have been accredited by XXX") - then we just need to make sure that accreditation (or some level of accred) is minimally adequate for the interests that would have been served by license. For that matter, the question should be asked "licensed to do what?" If the federal government has a particular federal agency that needs to accept outside certificates to authenticate a citizen or business, then I can see them requiring that the issuing CA be licensed. Beyond such a scenario, why should the federal government require CAs to be licensed just to do business? If license is voluntary and not mandatory - what government benefits or harms would follow from being licensed or not? Will export control be used to force compliance with license requirements? The federal government can lend a helpful hand in the process of designing appropriate license criteria for federal programs, and that criteria could be useful at the state gov. and private sector levels as well. However, it seems to me that it would be unwelcome and unwise at this point in time for the federal government to arrogate to itself the power and jurisdiction to regulate this industry in a complete way through license (it has been said that the power to tax is the power to destroy - that goes double for the power to license). In the future, if there develops a demonstrable problem with consistent CA practices evolved by market based solutions (as facilitated by accreditation), then I think a credible case could be made at that time for the federal government to step in with some standards in the interests of inter-state commerce. At that time, any standards should be narrowly tailored to actual market failures and specific non-uniformity issues. Until then, we should use the considerable resources envisioned by the amendment (see below) to encourage private sector leadership and innovation in this area. Of course, through purchase power, the public sector has the right and the obligation to apply pressure through aggregation of demand as a way to get interoperable products. Any such pressure should be exerted in a manner that is consistent with current private sector electronic commerce practices and needs. It is relevant to point to the NASIRE CA accreditation initiative in this regard, is an important effort to work with the private sector to create voluntary standards for the use of digital signature technology. Regards, Dan ------------- Original Text From: Adam White Scoville <adville(a)cdt.org>, on 7/28/97 5:56 PM: To: ""Greenwood-ITD Hello - I'm glad we touched base at the NIST conference - I still would like to ask you a couple questions on the pre-emption issue. But first, the point of _this_ message is that I though you would be interested to know that the Technology Subcommittee of the House Committee on Science added about an hour ago this amendment (among others) to HR 1903, the NIST "Computer Security Enhancement Act of 1997." (a) National Policy Panel - The Under Secretary of Commerce for Technology shall establish a National Policy Panel for Digital Signatures, composed of nongovernment and government technical and legal experts on the implementation of digital signature technologies, individuals from companies offerring digital signature products and services, State officials, including officials from States which have enacted statutes establishing digital signature infrastructures, and representative individuals from the interested public. (b) Responsibilities - The Panel shall serve as a forum for exploring all relevant factors associated with the development of a national digital signature infrastructure based on uniform standards that will enable the widespread availability and use of digital signature systems. The Panel shall develop - (1) Model practices and procedures for certification authorities to ensure accuracy, reliability, and security of operations associated with issuing and managing certificates; (2) standards to ensure consistency among jurisdictions that license certification authorities; and (3) audit standards for certification authorities. Adam White Scoville Center for Democracy & Technology Adam White Scoville adville(a)cdt.org adam.scoville(a)bc.edu If you wish to send me a secure message, encrypt it with PGP, using my public key available at <http://www2.bc.edu/~scovilad/pgp.txt>. For more information about PGP and encryption, visit <http://www.pgp.com>. A free version of PGP (for MacOS and Windows) is available at <http://web.mit.edu/network/pgp.html>. A free version of the popular Eudora mail program (also for both MacOS and Windows) which incorporates PGP is available at <http://www.eudora.com/export>. --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

Encrypting same data with many keys...
by Ray Arachelian 17 Dec '03

17 Dec '03

What are the dangers of taking a small block of data - say upto 1K in size, then producing many files, each being the same data encrypted by other keys? i.e.: Plain data: 1K in size or smaller File 1: Data encrypted with Key1 File 2: Data encrypted with Key2 File 3: Data encrypted with Key3 File 4: Data encrypted with Key4 File 5: Data encrypted with Key5 File 6: Data encrypted with Key6 File 8: Data encrypted with Key8 .... File N: Data encrypted with KeyN A known plaintext attack won't help you to break the keys unless you have one of the eight keys, but will having many keys that encrypt the same data significanltly weaken the security of that tiny chunk of data? And no, I don't mean, there's N keys so the odds of brute forcing the data is now N times easier. Assume we're using 128 bit Blowfish/Idea or better, and discarding weak keys. Are there any differential or other cryptanalysis methods to use the eight resulting cyphertexts to get at the data other than brute forcing it if you don't know any of the keys? What if instead of using a private key cypher, we used a public key cypher? Would that make any difference in attack methods? The data won't contain any text, or identifiers (i.e "GIF89" in GIF files, "MZ" in wintel executables, etc...) known or guessable to the attacker... =====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian |Prying open my 3rd eye. So good to see |./|\. ..\|/..|sunder(a)sundernet.com|you once again. I thought you were |/\|/\ <--*-->| ------------------ |hiding, and you thought that I had run |\/|\/ ../|\..| "A toast to Odin, |away chasing the tail of dogma. I opened|.\|/. .+.v.+.|God of screwdrivers"|my eye and there we were.... |..... ======================= http://www.sundernet.com ==========================

7 14