December 2003 - cypherpunks-legacy

Re: Encrypted Email
by James M. Cobb 17 Dec '03

17 Dec '03

Connie, On 11 27 95 you asked Can anybody briefly summarize for me some options for encrypting email that are secure? I know about PGP but I need something for (my environment) with an easy to use interface (PC-Windows) - for use by people who really aren't very computer literate. The following item from 11 27 95 Computerworld 58 may be helpful: CommTouch Software, Inc. in San Mateo, Calif., announced a secure Internet E-mail package called Pronto Secure. It allows connected and disconnected users to send and encrypt Internet mail. It supports many Internet security protocols, such as Power One-Time Pad, Pretty Good Privacy, Privacy Enhanced Mail, Secure Multipurpose Internet Mail Extensions (S / MIME) and MIME Object Security Services. Pronto Secure, which will ship in March, will require users to replace their existing Internet mail systems.... Comm- Touch plans to ship by mid-1996 a security module that is Messaging Application Programming Interface-compliant and works with a user's existing mail [system]. At p 66 of the same issue, there's a listing of "Recent in- formation security product announcements." CommTouch is listed there; its Internet address is micheleb(a)ipri.com and a single copy of Pronto Secure is US $299 list. ipri.com = InterActive Public Relations, Inc in 'Frisco. Cordially, Jim

1 0

WAY_lad
by John Young 17 Dec '03

17 Dec '03

11-29-95. FiTi: "Information highway needs rules of the road, says report." Pointing out the possibility of technical incompatibilities and trade friction if companies are treated differently in different markets, the report outlines the case for a "global regulator" within the structure of the new World Trade Organisation. It points out that issues such as intellectual property rights, encryption and government control on cross-ownership have global rather than national aspects. "Encryption, for example, raises tricky and emotive issues connected with organised crime and national security and cannot be treated simply as a business problem." No revolution for software [Editorial] Today's software market is the way it is not because of some evil conspiracy in Seattle, Microsoft's home town, but because it meets most consumers' interests most of the time. The power to set standards follows from that success. Changing technology widens the range of possible market structures, but does not affect customers' underlying needs and preferences. In the battle between the technologically possible and the economically attractive, economics always wins. WAY_lad (7 kb) FiTi on-line at <www.ft.com> for waylaying top article.

1 0

NOH_ide
by John Young 17 Dec '03

17 Dec '03

11-29-95. Washrag: "Postal Service Awards Contracts to Develop Computer Kiosks." The Postal Service predicted "more than 10,000" kiosks could be installed in post offices, libraries and shopping malls "within the next few years." The Postal Service is the lead government agency on the project, one of several administration initiatives designed to provide the public with computer access to government information. "CIA, Pentagon Back NIMA 'Concept' Combining Spy Satellite Photo Units." The Pentagon and the CIA announced an agreement yesterday endorsing the "concept" of consolidating eight defense and intelligence agencies -- those responsible for managing spy satellite photos and related tasks -- into a new National Imagery and Mapping Agency. NOH_ide (10 kb)

1 0

Re: key for Alice as promised (not)
by Adam Shostack 17 Dec '03

17 Dec '03

> > >Can you imagine?? I'm simply not willing to fool myself into thinking > > >that I ahve security by posting a key and using PGP. > > > > Unless you can post some proof that PGP is insecure, stop insisting it is. > > PGP is really not the issue. The issue is more my security and the > environment that I use PGP in. I don't have a trusted machine to run PGP > on. Anyone who wants to can come up to machine and copy my secret keyring > or they can even watch me typing my password in. Threat, please?? Do people often stand over your shoulder as you type? Enter your office, point guns at you, and take a backup of your entire computer? Have you considered putting the secret keyring on a floppy and locking it in your desk/safe when you're not actually in the office? (Or home..) > So, I don't fool myself, and I don't use PGP, except for things like > exchanging a one-time pad with someone when I've already sent the message > out across another delivery mechanism, like on a floppy delivered my > courier. I don't follow. You're claiming that PGP is good enough to transfer OTPads, but not good enough to sign pseudononymous messages? Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

Re: key for Alice as promised (not)
by ahupp＠primenet.com 17 Dec '03

17 Dec '03

>Can you imagine?? I'm simply not willing to fool myself into thinking >that I ahve security by posting a key and using PGP. Unless you can post some proof that PGP is insecure, stop insisting it is. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQBtAzCNppQAAAEDALhWZl7IuGZ9zZT5bACo0b/1L0Nv0C72vKHIO3IHh+cwpHHa 2Ozb9aeO0UvXGwkkZIYgUm0EvmzKh7yb1GTLvBp5kXpR3I9w+Yj4LGlBDERpUWw6 x4ED49pwDnz1Hl5FBQAFEbQYYXNoIDxhaHVwcEBwcmltZW5ldC5jb20+ =PtJK -----END PGP PUBLIC KEY BLOCK-----

2 1

Re: The future will be easy to use
by James A. Donald 17 Dec '03

17 Dec '03

At 01:03 PM 11/28/95 EST, Carl Ellison wrote: >That's true. What the user would have to see is some icon (or, for >text-bound folks, a temporary unique string) until the user chooses and >assigns the appropriate alias. That icon would have no meaning by itself. >It would acquire a meaning by being associated with some message or set of >messages: Better method: Creator of the key names it: Usually after himself or his role: The recipients key database detects and resolves cases where two different keys have identical names in accordance with certification rules. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

Re: SKIP Source Release is out!
by smithmi＠dev.prodigy.com 17 Dec '03

17 Dec '03

Perry Metzger writes: >Anyone who'd like to help me put the sources to the NRL IPsec + IPv6 >implementation up for FTP is invited to get in touch. It will runs on >4.4BSD machines (i.e. BSDI, NetBSD, FreeBSD, etc) and should be >pretty portable to other similar Berkeley based machines. What licensing requirements exist for people who might want to use this code in their products? In particular, does one need to obtain any licensing from RSA or Cylink? --Michael Smith smithmi(a)dev.prodigy.com

2 1

Re: The future will be easy to use (fwd)
by Rev. Mark Grant 17 Dec '03

17 Dec '03

On Tue, 28 Nov 1995, Patiwat Panurach wrote: > I feel sad when they say that the market for <1000 $ machines is nill, I > had so much fun and learned so much from my old machines. Personally, I just bought a 486/66 laptop, which would have cost almost $1000 with 170 MB hard disk, 4 MB of RAM and Linux (I paid a couple of hundred extra for a 500 MB disk)... I could have got a Pentium desktop for the same price if I'd wanted one. So I don't see that there's really a great advantage to a $ 500 diskless computer (and having worked on Sun 3/50s in the past, I know about all the disadvantages). ObCrypto/Security: My landlord bought himself a computer a couple of weeks ago after he'd lived without them for over forty years, and has been enthusing about how easy it makes it for him to do his accounts. He just read about these diskless machines in a magazine, and his first reaction was that there was no way he'd keep his accounts information on a remote server. Obviously people *are* more privacy-aware than they're often given credit for. Mark

1 0

SKIP Source Release is out!
by markson＠osmosys.incog.com 17 Dec '03

17 Dec '03

Hi, Check out http://skip.incog.com. We've released the source to the SKIP key management and IP layer encryption package for SunOs 4.x. Here's a piece of the README file: ALPHA 1 Release of SKIP Reference Source for SunOS 4.1.3 -------------------------------------------------------- SKIP is a Key-management protocol for IP based protocols. It is an acronym for Simple Key-management for Internet Protocols. SKIP is documented in the SKIP IETF IPSEC draft included in this directory as draft-ietf-ipsec-skip-05.txt. The most recent SKIP draft is always available at http://skip.incog.com and the Internet-Drafts directories. >From this public domain source release, you can build a fully functional IP-layer encryption package which supports DES and Triple-DES for SunOS 4.1.3. This means that every IP networked application can have it's network traffic encrypted. Unlike application level encryption packages, this package encrypts IP packets. Thus, applications do not need to be recompiled or modified to take advantage of encryption. The SKIP source is possible through the efforts of engineers in Sun Microsystems Internet Commerce Group. The developers and designers are Ashar Aziz, Tom Markson, Martin Patterson, Hemma Prafullchandra and Joseph Reveane. Linda Cavanaugh worked on the documentation. The package compiles under both the SunPro compiler and GCC. We expect that this release should port without too much pain to any operating system which uses BSD style networking (mbufs). A legal warning: Because this package contains strong encryption, the Software must not be transferred to persons who are not US citizens or permanent residents of the US, or exported outside the US (except Canada) in any form (including by electronic transmission) without prior written approval from the US Government. Non-compliance with these restrictions constitutes a violation of the U.S. Export Control Laws. This source release may be used for both commercial and noncommercial purposes, subject to the restrictions described in the software and patent license statements. Furthermore, Sun Microsystems has licensed the Stanford public key patents from Cylink Corp. which are available to users of this package on a royalty free basis. The patent statement is in README.PATENT. Be sure to read this, as it contains some restrictions and other important information. Also included in this release is a high speed Big Number package written by Colin Plumb. bnlib/legal.c contains Colin's software license statement. Features -------- 1. SKIP V2 compliant implementation using ESP encapsulation. 2. Support for DES/3DES for traffic and key encryption. 3. Diffie-Hellman Public Key Agreement based system. 4. Full Support for manual establishment of master keys. 5. Support for multiple NSIDs and multiple local certificates. 6. GUI tool for user friendly manipulation of access control lists and key statistics. 7. Command line tools for manipulating access control lists, etc. 8. Implementation of the Certificate Discovery protocol fully integrated into SKIP. 9 Implementation of X.509 public key certificates. 10. Implementation of DSA signature algorithm for certificate signatures. 11. Implementation for MD2, MD5 and SHA message digest algorithms. 12. Implementation of ASN.1 DER encoding/decoding. 13. SunScreen(tm) SKIP compatibility mode. 14. Implementation of hashed public keys as defined in the SKIP draft. Implementation of programs to generate hashed public keys. 15. Certificate utilities to convert X.509 Certificates to hashed keys and print both X.509 and Hashed certificates. 16. High performance Big Number library for Diffie-Hellman calculations. 17. Implementation is effectively "public domain" and may be used both commercially and non-commercially. 18. Patent Agreement with Cylink allows roylaty-free use of the Diffie-Hellman and other Stanford patents with this package for commercial and non-commercial use. Read README.PATENT for some restrictions. 19. Inclusion of prime generation program used to generate the primes in SKIP draft.

3 5

Re: Elliptic curves, patent status?
by James A. Donald 17 Dec '03

17 Dec '03

At 05:16 PM 11/28/95 -0400, Michael Smith wrote: > > > I'm unclear about the patent status of elliptic curve > > > systems. Are they covered by the Diffie-Hellman patent? > > > That is, is the lnguage of this patent broad enough to > > > cover _all_ public-key systems, regardless of their > > > mathematical basis? On Mon, 27 Nov 1995 23:16:10 -0800 jamesd(a)echeque.com wrote: > > No, but RSA will litigate you with the objective of > > inflicting extravagant legal costs regardless. At 08:13 AM 11/29/95 EST, Dan Bailey wrote: > Does the patent create any headaches for elliptic curve research or > publishing elliptic curve papers, or just for new products? Patents do not prohibit research -- Yet. Patent law continues to be extravagantly re interpreted from time to time, in a way that continually increases the power of the patent office and the power of the courts, but this creativity has not yet collided drastically with freedom of speech. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0