December 2003 - cypherpunks-legacy

Re: Rethinking the utility of netnews "cancel" control messages
by Rich Salz 17 Dec '03

17 Dec '03

I would like to put my corporate legal infrastructe on an internal secure conferencing system. News (with crypto-signed articles) is ideal. Without a "destroy all copies" concept I cannot do this. /r$

2 1

SSL telnet vs. SSH. Comparison?
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Would somebody please compare for me SSL telnet vs. SSH in terms of security, advantages, and disadvantages? Thanks, - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMHQbESoZzwIn1bdtAQFgxgF/bx0sbAWQ2mFbwaSqcKSolepKNCC/kiNm 22gizTztznICXRPxh17VxkpiWwzcRZPv =QD3j -----END PGP SIGNATURE-----

2 1

Re: Restrictions on Munitions _Imports_
by John Gilmore 17 Dec '03

17 Dec '03

Peter D. Junger--Case Western Reserve University Law School--said: > There is a United States Munitions List for imports that is > administered by the Treasury Department, but cryptographic devices and > software are not included on that list. I agree with Peter. I looked this up at one point. The government has considered trying to impose import controls on crypto, like they've considered every other option they could think of. The question is what it would buy them except more trouble from the public. NSA can't sustain a claim that it would help them, since they aren't supposed to be spying on Americans anyway. But in Clipper-II, NSA risks effective export controls to advance FBI wiretapping interests. Now that NSA is in fully naked in bed with the FBI, they could jointly claim some governmental interest in killing off domestic privacy. But that's what would land them in trouble with the public. I really think they would have done better to have just shut up about crypto and not pushed the issue. The more they tighten the screws, the more agitated and educated the public gets. For every Clipper chip that has sold to a non-governmental party, ten Cypherpunks or 'punk sympathyzers have risen up and started writing code, investigating, talking to their friends, publishing articles in the press, and filing lawsuits. Ten years ago it was pretty lonely to be a cryptographer. Most of us wouldn't be on this mailing list -- the list itself would probably not exist -- if the government had just quietly let the export criteria advance, year after year, and had let the quaint academics play with their toys. But they tried alternating between stonewalling us and forcing crap down our throats. The result has been that the public now *cares* about crypto policy. And the public will get what it wants, in the long run, no matter what the impact on the privileges of the current crop of bureaucrats. John

1 0

subjective names and MITM
by Wei Dai 17 Dec '03

17 Dec '03

Neither certification hiearchies nor the PGP web-of-trust are very useful because they try to bind True Names to keys and True Names have many problems. People can have duplicate names and can change their names (what happens if I legally change my name to Bill Clinton and try to get Verisign to certify my key under that name?), and often we don't care about someone's True Name. Perhaps it is better to think of names as subjective identifiers, and public keys as global ids. That is, a person who has a collection of public keys gives each of them a name, but different people can name their keys differently. Of course the holder of the corresponding private key can help in the naming process (e.g., "Please call me Wei"). If two people need to talk about a third party, they can refer to him by an arbitrary name after establishing a common binding between his key and that name. In this scheme, the man-in-the-middle problem goes away because you are no longer trying to communicate with a True Name, whose binding with a key can be spoofed, but rather with the key itself. If the holder of that key chooses to act as a middle-man by relaying messages around, that is his business, and there is really nothing you can do about it. Wei Dai

7 12

Re: Rethinking the utility of netnews "cancel" control messages
by Erik E. Fair 17 Dec '03

17 Dec '03

At 10:34 10/5/95, Rich Salz wrote: >I would like to put my corporate legal infrastructe on an internal secure >conferencing system. News (with crypto-signed articles) is ideal. >Without a "destroy all copies" concept I cannot do this. > /r$ This, presumably, is a lawyer, discovery, lawsuit thing, right? Erik

1 0

AEgis Windoze PGP Shell (with location...sorry)
by Adam Philipp 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Aegis can be reached at: http://iquest.com/~aegisrc/ sorry for leaving that out las time.... -Adam -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMHOOA2/ZTaRmpgTFAQFioQf/WYR7o5SACijZpdZ1XZHtP4X/BXprVkVV /GX/eB8jbkDaCffuIWoz34dxN5PpSXQPAbE53ZGcJEiIuYdl9CLloJj12yZFS3Bx wa0988Fz374xmgL2VA6HllQwTBjab7v6vk565RG+Rtf7t7DWGIORP5WFDbDKJ4FR yhxnPhFi/LA20aBrBjY9bfPMuFdUm+teBVjzNsgGmsTQov72iosuMh0IYhqcaBpR ndaRdpp1ntcD6A2xPn+wfEYLcLUR34YbJVHmYwN3WJuhbNbhS4x4Aa0KFE9Sbi5W bYt9wnqE0+uywTJb2Z8WUaH+0UfgeE/GNZvDe8jEp6oSUhaBs0R0LA== =9ZIj -----END PGP SIGNATURE----- --=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\ |PGP key available on my home page|Unauthorized interception violates | | http://www.rosa.com/~adam |federal law (18 USC Section 2700 et| |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-|seq.). In any case, PGP encrypted | |SUB ROSA: Confidential, |communications are preferred for | |secret, not for publication. |sensitive materials. | \-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-/

1 0

is this a bug of Netscape
by John Cheng 17 Dec '03

17 Dec '03

If you go to http://c.gp.cs.cmu.edu:5103/prog/webster, you will get a input textbox and two buttons, leave textbox blank and push Look Up Definition button, you will get a GPF? I am using Netscape V1.2N for windows. Sorry if you have knew it. J

1 0

Oct 14 mtg - focus on java
by mrm＠netcom.com 17 Dec '03

17 Dec '03

Hi - The Oct 14 cypherpunks meeting will be focussing on Java topics. I'm putting together an agenda, and finalizing the meeting location. It looks like we'll have someone from the Java group at Sun to talk about what the current Java security policy is, and about Java and HotJava security mechanisms. Doug Barnes and Amanda Chou will talk about JCrypt, which is a set of Java wrappers for existing C encryption routines. If you'd like to talk at the Oct 14 meeting, please send me email with a description of your project, and I'll schedule you in. I'll send out mail early next week with the agenda, and letting you know where the meeting will be held. I'm trying to get a large conference room at one of the Sun facilities. Marianne mrm(a)netcom.com mrm(a)eng.sun.com

1 0

NetManage & Cylink Crypto
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

NetManage & Cylink In Internet Encryption Deal Guildford, Surrey, England, Oct 5 -- NetManage, a TCP/IP specialist company, has signed a licensing deal with Cylink Corporation. NetManage says the Cylink public key cryptography technology will be incorporated in future editions of NetManage's Internet applications software. The move is significant since it marks the beginnings of a competitor to the Netscape "secure" Web browsing software, which has had two security flaws identified in recent weeks. Initially, NetManage's Chameleon Enterprise TCP/IP applications suite will incorporate the Cylink public key encryption technology, and later will include encryption facilities in Internet Chameleon, a UKP139 PC-Windows access suite designed for dial-up access to the Internet. Both NetManage and Cylink plan to support an open interface for Internet security which addresses the flaws found in Netscape. The idea is to establish an open set of standards to which Internet access packages of all types will adhere to, and so ensure that companies developing Internet software do not "re-invent the wheel" when writing their software, and possibly open their applications up to flaws. According to NetManage, establishing a secure Internet connection requires an Internet application to perform two functions: authenticating the user, and encrypting the data flow. The link with Cylink will allow NetManage to license and include the Cylink public key encryption technology in its applications with a variety of ciphering systems to be used in the NetManage suite, including: DES, Triple DES, Safer, IDEA, Skipjack, RC-2, and RC-4. NetManage claims the current implementations of security proposed as standards by Netscape and RSA Data Security are flawed, and fail to fully accommodate "open and interoperable secure communications" between computers which use different bulk encryption ciphers. These problems, the company claims, have limited the adoption of Internet security as a widespread interoperable feature of all Internet software and hardware products, including end-user applications, servers, firewalls, and secure routers. Later this month, NetManage and Cylink plan to announce a next-generation "plug and play" Internet encryption system. The implementation will be open and will not lock software or hardware developers into the use of encryption technology from any one vendor, as is the case with Netscape, say the companies. The related APIs, key exchange technology, and encryption, will be made publicly available to other software and hardware vendors. Licensing will include source code and no per-copy royalty fees. Further information can be downloaded from NetManage's World Wide Web site at <http://www.netmanage.com>. Contact: NetManage Europe, +44-1483-302333; NetManage US, 408-973-7171.

1 0

Re: Comments on STT Spec Implementation Details
by anonymous＠robo.remailer 17 Dec '03

17 Dec '03

Responding to msg by perry(a)piermont.com: [snip] >The belief that companies can make more money by >following proprietary solutions and imposing them on >the world as standards is falling away. It is in >Microsoft's interest that the standard that is adopted >for commerce be open, publically discussed at length, >and brutally critiqued. Losing a bit of control in >exchange for actually getting something that works out >for you and your customers is in your interest. The spew through the proprietary dike on this is swelling: MasterCard's consortium yesterday and the NetManage/Cylink today both emphasize public availability of specs in counter-response to the flaws helpfully discovered in Netscape by the ever public spirited cypherpunks. Whether any of these vaunted "superior" systems respond to attacks as constructively as Netscape will be the challenge. BTW, has anyone reviewed the promised MasterCard specs supposedly released on Tuesday?

1 0