December 2003 - cypherpunks-legacy

FIZ_zle
by John Young 17 Dec '03

17 Dec '03

10-4-95. W$Japer: "MasterCard, Backed by IBM and Others, Enters Fight for Internet-Payment Rules." MasterCard said it entered into a collaborative effort with IBM, Netscape, CyberCash and GTE to release a draft of technical requirements for any software companies and financial institutions that want to develop programs for electronic commerce. "Lockheed Plans Satellite System For $4 Billion." Lockheed Martin proposed to build a $4 billion satellite system for two-way global computer networking, videoconferencing and other on-demand services in a challenge to plans by the Hughes unit of GM and the separate Teledesic venture. Lockheed disclosed that it has filed for FCC authority to place nine large satellites in high-altitude orbits by about the year 2000 to form a new system called Astrolink for high-data-rate transmissions. "Morgan Stanley Puts $200 Million In Telecom Venture." In an effort to ride the global telecommunications boom, Morgan Stanley Capital Partners is investing $200 million in Sita Group in a move to allow the world-wide airline cooperative to create a for-profit telecommunications unit. Trinity: FIZ_zle (11 kb)

1 0

PIZ_zaz
by John Young 17 Dec '03

17 Dec '03

10-4-95. NYPaper: "AT&T Puts New Emphasis On Satellites. 12-Spacecraft Network Proposed to Regulators." The AT&T Corporation, in an early sign of how it plans to pursue its Internet and global communications strategy after the company's planned divestiture, has quietly filed a Federal application to build and launch a multibillion-dollar global satellite network. The system would let computer users bypass local telephone networks and connect directly to the Internet via satellite dish antennas slightly larger than two feet in diameter. "Satellite Services Hear the Naysayers." The concept has great promise: a string of satellites offering global wireless telephone service, where the caller is never out of range. Making the concept reality, however, is proving stubbornly difficult. The four major services in the nascent global wireless business are on the defensive for the first time in their brief history. A pair of troubled debt offerings have raised questions about the viability of so-called global personal communications. "A New Computer Dazzles a Jaded Industry Crowd." The BeBox is incompatible with everything now on the market. But the sheer dazzle of the new personal computer by Jean-Louis Gassee, the former engineering head of Apple Computer Inc., drew a standing ovation from a normally skeptical crowd of 500 of some of the most discerning executives in technology. Trio: PIZ_zaz (16 kb)

1 0

Re: New Windoze PGP Shell (freeware) worth checking out
by Weld Pond 17 Dec '03

17 Dec '03

The program can be found at http://iquest.com/~aegisrc/utils.shtml Weld Pond - weld(a)l0pht.com - http://www.l0pht.com/~weld L 0 p h t H e a v y I n d u s t r i e s Technical archives for the people - Bio/Electro/Crypto/Radio

1 0

ACLU Cyber-Liberties Update 10/4
by Ann Beeson 17 Dec '03

17 Dec '03

October 4, 1995 ACLU CYBER-LIBERTIES UPDATE **Premiere Issue** A bi-weekly online zine on cyber-liberties cases and controversies at the state and federal level. ---------------------------------------------------------------------------------------------------------------------- FEDERAL PAGE (Congress/Agency/Court Cases) ---------------------------------------------------------------------------------------------------------------------- * "Virtual" Child Pornography Bill is Overbroad and Fails to Protect Real Children Despite the FBI's apparent success in raiding alleged child pornographers on America Online, Senator Orrin Hatch decided we needed a new child pornography law. Hatch's bill would expand the existing child porn law to include materials that are: -visual depictions of what "appears to be . . . a minor engaging in sexually explicit conduct;" and -visual depictions "advertised, promoted, presented, described, or distributed in such a manner that conveys the impression that the material is or contains a visual depiction of a minor engaging in sexually explicit conduct." In its effort to outlaw "virtual" child pornography, the bill would criminalize a wide range of constitutionally protected expression. Hatch attempts to justify the new bill by reference to a widely-publicized Canadian case in which a pornographer copied pictures of clothed children from catalogs and morphed them into child pornography. Senator Hatch claims that the case would not be covered under the existing federal child porn statute, but that issue has never been decided by a United States court. While the application of the existing statute to these facts is far from clear, the Hatch bill covers *much more* than just this case scenario. The statute would cover *any* image of a child engaged in sexual behavior, including non-computer-generated drawings, cartoons, and visual images created without the use of photos of real children or even real adults. In upholding child pornography laws, the Supreme Court has stated that "the nature of the harm to be combated requires that the state offense be limited to works that visually depict sexual conduct by children below a specified age. . . . [T]he distribution of descriptions or depictions of sexual conduct, not otherwise obscene, which do not involve live performance or photographic or other visual reproduction of live performances, retains First Amendment protection." _New York v. Ferber_, 458 U.S. 747, 764-65 (1982). Hatch's "virtual child porn" law is clearly unconstitutional because it would outlaw images produced without any involvement by an actual child. Bruce Taylor of the National Law Center for Families and Children argued at a recent conference at Brooklyn Law School that a "virtual child porn" law was needed because pedophiles use virtual porn to lure children. Under that rationale, if a pedophile used a piece of candy to lure a child into sex we would have to outlaw candy. In a free society, we cannot use censorship laws to try to control "bad thoughts." Outlawing all images that might be stimulating to pedophiles would require a massive amount of censorship and would *not* cure pedophilia. The ACLU reiterates its position on child pornography laws: "The ACLU believes that the First Amendment protects the dissemination of all forms of communication. The ACLU opposes on First Amendment grounds laws that restrict the production and distribution of any printed and visual materials even when some of the producers of those materials are punishable under criminal law." "The ACLU views the use of children in the production of visual depictions of sexually explicit conduct as a violation of childrens' rights when such use is highly likely to cause: a) substantial physical harm or, b) substantial and continuing emotional or psychological harm. Government quite properly has the means to protect the interest of children in these situations by the use of criminal prosecution of those persons who are likely to cause such harm to children." The Hatch proposal only demonstrates the dangers of trying to protect children indirectly through censorship laws. ---------------------------------------------------------------------------------------------------------------------- * Clipper II? Your electronic privacy rights are at stake . . . again. In 1993, the ACLU and an overwhelming majority of industry condemned the Clipper Chip -- the Administration's key escrow encryption scheme to equip every telecommunications device with a "chip" that would allow anyone to secure his private communications as long as the U.S. government held the descrambling key. The government insisted that Clipper would be merely a voluntary standard, but government documents requested under the Freedom of Information Act now confirm the suspicions of civil liberties advocates that the government really believes key escrowed encryption will only meet law enforcement standards if it is mandatory. (See URL:http://www.epic.org/crypto/) Now the Administration has returned with another scheme -- commercial key escrow ("Clipper II"). At close range, Clipper II is a lot like Clipper I: * Although supposedly "independent" of the government, key escrow agents will have to meet standards set by the U.S. government, and will have to reside in the U.S. or in a country with which the U.S. has entered a bilateral agreement. * The proposal provides no privacy safeguards to prevent the compromise of the key escrow agent or the key. * Offered as a "voluntary" standard, the proposal nevertheless forbids interoperability with non-escrowed encryption in exported products. * While the government says it recognizes industry's need for strong encryption, the proposal limits exportable encryption to 64 bits -- a length widely recognized to provide inadequate security. On September 6, 7, and 15, 1995, the ACLU attended meetings held by the National Institute for Standards and Technology (NIST) in Gaithersberg, Maryland. The meetings were called to solicit input from industry on the Clipper II proposal. Draft export criteria were considered on September 6-7, and the general industry response was very lukewarm -- except for a few industries that have been meeting with the Administration and are preparing to announce products that would fit the suggested criteria. The ACLU led one working group to vote 7-7 in favor of condemning the entire proposal. On September 15th, NIST discussed the implementation of a federal key escrow encryption standard. By requiring federal agencies to use commercial key escrow as a FIPS (Federal Information Processing Standard), the Administration clearly hopes to drive industry to accept commercial key escrow as the export standard as well. The ACLU issued the following statement on the current key escrow proposal: The American Civil Liberties Union's Position on the Administration's Current Key Escrow Proposal: * Encryption is speech protected by the First Amendment. The Administration's current key escrow proposal, like the Clipper proposal, continues to tread on the First Amendment rights of American individuals and businesses to use encryption technologies to secure their private communications. The current proposal, like Clipper, should be rejected on First Amendment grounds alone. * The current proposal will not accomplish its stated objectives because a wide array of encryption is available around the globe and will continue to be employed in place of American government-approved key escrow software. * The only key escrow proposal that could begin to satisfy the government's objectives would be an outright ban on the sale of encryption technologies other than those approved by the government and key escrowed. The ACLU fears that the current proposal, and similar proposals, are merely the first step towards mandatory key escrow of encryption. Mandatory key escrow is completely unacceptable to both industry and privacy advocates. * The Administration should abandon its fruitless and unconstitutional efforts to control the export of encryption technology. No legislation is needed -- the Administration has the power to lift the regulatory restrictions that it created. ---------------------------------------------------------------------------------------------------------------------- * Call for Plaintiffs in Suit to Challenge Online Indecency Legislation Most of you know that the House and Senate have now passed two different versions of the telecommunications bill that would outlaw "indecent" speech over the Internet and other online services. This fall, a conference committee of House and Senate members will work out the differences between the two telco bills and will probably approve some form of online censorship legislation. [For a copy of the legislation, send a message to infoaclu(a)aclu.org, with "Online Indecency Amendments" in the subject line.] While the ACLU and other advocacy groups continue to lobby Congress to remove the censorship provisions from the telco bill, it is highly likely that some restriction on online indecency will appear in the final bill that emerges from the conference committee. A coalition of civil liberties organizations are preparing a constitutional challenge to this legislation now. The coalition includes the ACLU, Electronic Frontier Foundation, Electronic Privacy Information Center, Media Access Project, and People for the American Way. We plan to be ready to file a lawsuit as soon as the statute is signed into law -- which could be as early as October. An important first step in planning the lawsuit is the selection of plaintiffs. We need to put together a set of plaintiffs that disprove the stereotype created by proponents of the legislation that people opposed to the bill are "pedophiles and pornographers." We believe that the best plaintiffs for this challenge will be persons or entities that provide material that some may deem "indecent" but that has serious artistic, literary, and educational value to our society. We need plaintiffs who use online networks to discuss or distribute works or art, literary classics, sex education, gay and lesbian literature, human rights reporting, abortion information, rape counseling, and controversial political speech. Please contact Ann Beeson at the ACLU if your organization is interested in being a plaintiff in this ground-breaking litigation that will define First Amendment rights in cyberspace. 212-944-9800 x788, beeson(a)aclu.org. ---------------------------------------------------------------------------------------------------------------------- STATE PAGE (Legislation/Agency/Court Cases) ---------------------------------------------------------------------------------------------------------------------- * Overbroad Searches and Seizures Threaten Electronic Privacy The latest threat to your civil liberties results from law enforcement's overzealous attempts to find evidence of crime or wrongdoing in cyberspace. As we move into the information age, traditional search and seizure rules will need to be refined to ensure fairness and respect for electronic privacy rights. Several recent cases illustrate how privacy rights can be violated when law enforcement conducts investigations in cyberspace. * The ACLU recently wrote to America Online to inquire about their cooperation in the FBI's recent raid of alleged child pornographers who used the online service. The ACLU asked, among other things, whether AOL revealed any information about individual users that was not sought by subpoena or court order; whether AOL turned over all private e-mail messages of suspects or whether they turned over only messages related to the alleged crime; whether AOL also turned over the names, addresses, and e-mail messages of persons who had communicated with the suspects; whether AOL set up accounts for the purpose of allowing government investigators to have access to public chat rooms; and what information AOL regularly keeps about its users' online activity and how long the information is kept. * In Cincinnati, Ohio, a computer bulletin board operator filed a civil rights suit against the Hamilton County Sheriff's Department after the department raided the BBS and seized computer equipment, files, and personal communications. The case argues that the indiscriminate search and seizures violated the BBS operator's free speech and privacy rights. See _Emerson v. Leis_, S.D. Ohio, No. C-1-95-608. The subscribers to the BBS have filed a separate class action suit against the sheriff's department. See _Guest v. Leis_, S.D. Ohio. Law enforcement seized the entire BBS -- all the hardware, software, files, and private communications -- in an effort to obtain 45 files on the BBS that were allegedly obscene. The case asserts that the 45 files represented only 3% of the total resources on the board. * In California, Colorado, and Virginia, the Church of Scientology has brought three copyright infringement actions against anti-scientologists who use online communications to criticize the church. The cases raise important questions about the breadth of computer communications seizures in civil cases. The ACLU of Southern California and the ACLU of Colorado continue to monitor the cases in their states. ---------------------------------------------------------------------------------------------------------------------- * Nine States This Year Passed Online Censorship Legislation While online activists have been busy fighting the pending federal attempts to censor online communications, state legislatures have been carelessly crafting online censorship bills at home. And if you think Congress is full of Luddites, just wait until to hear what your state legislators have come up with. At least nine states (CT, GA, IL, KS, MD, MT, NJ, OK, VA) have passed legislation this year to regulate online content, and several others considered such bills, with some still pending. These bills seek to criminalize a wide range of online speech and content, including: * speech that "harasses, annoys, or alarms" * materials deemed "indecent," "obscene" or "harmful to minors" * information related to "terrorist acts" or "explosive materials" The state bills, like the federal bills, raise serious free speech and privacy concerns. None of the bills indicates an understanding of the unique nature of the online medium. Some bills purposefully, and other bills inadvertently, fail to clarify that only the initiators of the illegal images may be held liable -- so service providers can be held liable for the pedophiles and pornographers that use their networks. The laws would, at best, require service providers to snoop in private e-mail in order to avoid criminal liability. At worst, these laws would force providers to shut down their networks altogether. The draconian effect of these state bills doesn't stop at state borders. A message you post to the Internet today in New York City could travel the fifty states and the globe by tomorrow. You'd better be careful that the message isn't "obscene" according to an Oklahoman, "annoying" to a Connecticutter, "solicitous" of a minor in Illinois, or related to "terrorism" as defined by a Georgian. The wave of online censorship at the state level is far from over. The ACLU is considering constitutional challenges to the online censorship laws that passed this year. But given the continuing media hype over "cyber-porn," we are certain to see more censorship bills from the states next year. With the help of affiliate offices in fifty states, the ACLU continues to monitor these state attempts to infringe on your online free speech rights. [For a synopsis of all the online censorship bills passed or considered by the states this year, send a message to infoaclu(a)aclu.org with "Update of State Bills" in the subject line of the message.] ---------------------------------------------------------------------------------------------------------------------- * Saving the Best for Last: Good News on Cyber-Liberties ARIZONA: Another troubling application of existing obscenity laws to cyberspace was averted when charges were dropped against Arizona Department of Public Safety Officer Lorne Shantz. Shantz, who ran a community bulletin board, lost his job and endured several months of hassle and humiliation when he was arrested for allegedly "obscene" files on the board. Shantz maintains that he was unaware of the existence of the files, which represented only a minuscule fraction of all the information on the board. COLORADO: Federal Judge John Kane ordered the Church of Scientology to return computers and hundreds of files seized by Federal marshals and Scientology officials in a copyright infringement action. The judge ruled that the seizures were overbroad, and said that "The public interest is best served by the free exchange of ideas." ---------------------------------------------------------------------------------------------------------------------- ONLINE RESOURCES FROM THE ACLU ---------------------------------------------------------------------------------------------------------------------- Stay tuned for news on the ACLU's world wide web site, under construction at http://www.aclu.org. In the meantime, you can retrieve ACLU documents via gopher at gopher://aclu.org:6601 (forgive the less-than-updated state of our gopher -- we've devoted all our resources to WWW construction!). If you're on America Online, check out the live chats, auditorium events, *very* active message boards, and complete news on civil liberties, at keyword ACLU. ---------------------------------------------------------------------------------------------------------------------- ACLU Cyber-Liberties Update Editor: Ann Beeson (beeson(a)aclu.org) American Civil Liberties Union National Office 132 West 43rd Street New York, New York 10036 To subscribe to the ACLU Cyber-Liberties Update, send a message to infoaclu(a)aclu.org with "subscribe ACLU" in the subject line of your message. To terminate your subscription, send a message to infoaclu(a)aclu.org with "unsubscribe ACLU" in the subject line. For general information about the ACLU, write to infoaclu(a)aclu.org. ----------------------------------------------------------------------------------------------------------------------

1 0

Re: Netscape hole without .Xauthority (fwd)
by Michael J Gebis 17 Dec '03

17 Dec '03

Robert Owen Thomas wrote: > more and more, networks are becoming flooded with X traffic. although X > has always been known to be a potential security hole, i think X-attacks > are going to increase dramatically in the coming months. > > i commonly hear of sights with Xauthority enabled, only to have the user > community type "xhost +" at the prompt. bad karma. the days of pumping > rude & crass noises to someone else's workstation will soon graduate to > more nefarious and insidious attacks. > > is anyone looking into a means of securing X (above and beyond the current > weak solutions)? I have not used it for this purpose, but ssh claims to do "Secure X11 sessions." Actually, I'm interested in what the cypherpunks think of ssh in general; I'm not able to do a strong analysis of the code myself. If it does everything it claims to do, it's a very powerful tool; however, I don't know of any in-depth studies of ssh security. -- Mike Gebis gebis(a)ecn.purdue.edu

1 0

[Fwd] Security Threat to Internet shopping (DT)
by Holger.Reif＠PrakInf.TU-Ilmenau.DE 17 Dec '03

17 Dec '03

>Security threat to Internet shopping > >Daily Telegraph (paper edition), 3 October 1995, p. 12 > >[...] >However, users of Microsoft's Windows 95 have found that it ignores the >security passwords on private electronic mail sent or received using >software other than Windows 95. Never heard of this before, but it seems that MS assumes there's no mail like windows'95 mail? If all use it, you have no holes any longer. You or your partners don't use Windows'95? That's your problem not ours! read you later - Holger Reif http://remus.prakinf.tu-ilmenau.de/Reif/

1 0

Re: New Netscape bug (in version 1.12)
by tomw＠orac.engr.sgi.com 17 Dec '03

17 Dec '03

In article <DFv6uo.4so(a)sgi.sgi.com>, Ray Cromwell <rjc(a)clark.net> writes: > C'punks, > I just got back from a vacation in Raleigh, and downloaded the > new "fixed" Netscape 1.12. It took me about an hour, but I've > discovered another bug and potential security hole. This one relates > to mailto:. > The bug is as follows. Create a HTML file with a hyperlink containing > the following URL > foo > This bug doesn't seem to crash Netscape, instead, it crashes my XServer > as soon as the mail window pops op. I'm too tired right now to try to > analyze it, but it might be another stack bug, this time, in the X > libraries because Netscape isn't doing any sanity checking. This is a bug in your X server, not in netscape. The X server should never crash no matter what you send to it. > I need help testing this bug on other platforms. I have created > a test page. Go to http://www.gl.umbc.edu/~rcromw1/crash.html > to test. This doesn't crash my X server (SGI Irix 6.2), so it's probably specific to XAccel. -- Sure we spend a lot of money, but that doesn't mean | Tom Weinstein we *do* anything. -- Washington DC motto | tomw(a)engr.sgi.com

6 7

Random number generators
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

http://www.uni-karlsruhe.de/~RNG/ > Random number generators > > -------------------------------------------------------------------- > Diese Seite gibt es noch nicht in Deutsch. > -------------------------------------------------------------------- > > Classification of random numbers > > Random numbers for use in computer programs can be classified into 3 > different categories: > > * Truely random numbers: > Truely random numbers obviosly cannot be produced by computer > programs, they must be supplied by an external source like > radioactive decay. Such sequences are available (e.g. on > magnetic tape), but clumsy to use and often not sufficient in > terms of speed and number. > * Pseudorandom numbers: > A sequence of numbers is generated by an algorithm in a way > that the resulting numbers look statistically independent and > uniformly distributed. This is the prevailing method used in > random number generators. > * Quasirandom numbers: > These are generated by algorithms tuned to optimize the > sequences uniform distribution, which can improve the accuracy > of Monte-Carlo integration. These numbers are not independent > and thus cannot be used generally. > > Other than uniform distributions can be generated by suitable > transformations of the basic uniformly distributed sequence. > Numerical libraries often offer a rich set of distributions. > > Desirable properties of (pseudo) random numbers > > A good random number generator (RNG) should have the following > properties: > > * Good statistical properties: > There are theoretical and empirical tests to judge a RNGs > quality. Every generator should always be tested with one's > actual application: the standard tests can only disqualify a > RNG and may not check for the properties the application > requires. > * Long period: > RNG algorithms are iteration formulae. The state is often > stored in a single integer, in this case there cannot be more > states than representable integers (recall 2^30 \approx 10^9). > * Reproducibility: > All generators can initialize the sequence by a starting seed. > Storing and reloading a generator's internal state is also > useful. > * Portability: > This concerns both programming language (e.g. Fortran 90 or > ANSI C) as well as machine-dependent (e.g. floating point > representation) aspects. The ideal RNG produces (bit-) > identical results in every environment. > * Efficient implementation: > This may be irrelevant for "general purpose" generators. But > time-critical applications may require inline coding and/or the > generation of whole vectors of random numbers at once. Vector > and parallel computers need special RNG methods. > > Which of these aspects is most important depends on the actual > application, of course. > > Miscellaneous RNG material > > What follows is a collection of material on pseudorandom number > generators. I hope to improve this soon... > > * The RNG Chapter of Designing and Building Parallel Programs by > Ian Foster > * The pLab pages at Salzburg University > * The RNG Document of ORNL's Computational Science Education > Project > * My publications on RNGs are available online, also some slides > * My BiBTeX-bibliographies of articles and books on random number > generation > * The RAND/VP package contains a RNG tuned for our vector > computer SNI S600/20 > * The NAG and IMSL Fortran libraries contain random number > generators for various distributions > * Popular public-domain sources include the StatLib and NetLib > libraries > * My publications on RNGs and the RANEXP library are available by > anonymous ftp also. > URL: ftp://ftp.rz.uni-karlsruhe.de/pub/misc/random/ > * A good source of RNG codes and articles is the journal Computer > Physics Communications, ISSN 0010-4655, published by > North-Holland. > > -------------------------------------------------------------------- > Michael Hennecke / 21.07.1995

1 0

Re: `Hack Microsoft' challenge is NYT Computer News Daily's top story
by MIGUELDIAZ＠megaweb.com 17 Dec '03

17 Dec '03

>MIGUEL DIAZ writes: >> I don't know about everyone else, but a T-shirt seems a > very >> small reward for uncovering a "hole" in the encryption >> algorithm of Microsoft products. > >I don't know about anyone else, but helping to protect the > confidential data >of millions of users around the world seems a very large > reward for >uncovering a hole in the encryption algorithms of M$ > products. > >Clearly, YMMV. > >-Futplex <futplex(a)pseudonym.com> If it means protection only when using a proprietary product owned by Microsoft then no, I still don't see it as much of a reward. If we are talking a system which can be used by everyone at no cost, then yes that would be motivating.

1 0

No Subject
by mg5n+alias!rngaugp＠andrew.cmu.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- There is now support for using a hardware random number generator with the most recent versions of PGP. Versions pgp 2.62 unofficial international versions, pgp 2.62 international version and pgp 2.62 (from mit) are supported. The files for this modification of pgp are at the export controled ftp site in the directory: ftp://ftp.csn.net/mpj/I_will_not_export/crypto_????????/pgp/rng the files are: rg262mit.zip rg262i.zip (Can be used in Canada) rg262ui.zip (Can be used in Canada) Sources for the modifications are included. Executables are included for OS/2 and MSDOS. In the above ????????? varies because of the export control scheme. To get the files if you are in the U.S. and Canada first get the file ftp://ftp.csn.net/mpj/README.MPJ and follow the instructions. Many thanks to mpj(a)netcom.com for providing storage at the export controled ftp site. Here is the README file that comes with the modifications. - ---------------------------------------- Hardware Random Number Support for PGP. Version Ever get tired of typing in keyboard timing strokes while generating a PGP key? Ever want to use PGP unattended, but be foiled because there is no one there to type the keyboard timing strokes? Ever wonder if PGP's method of generating random number might have some subtle flaw which would expose it to cryptanalysis? This is a modified version of PGP which allows it to be used with a hardware random number generator. Two kinds of RNG are supported: First, any RNG with a IO driver that makes the RNG look like a file that can be opened (fopen) such that each byte read is a random byte. Second, a bus RNG under the x86 architecture such that random bytes my be obtained with a simple "IN" instruction. The CALNET/NEWBRIDGE RNG is an example of this kind of RNG. A crude sanity check is done to check that the bytes appear to be random. To use the hardware random number generator feature of this software, you must define _ONE_ of the new configuration file parameters RNGDRIVER or RNGPORT in config.txt or from the command line. If you have a RNG of the first type, define RNGDRIVER to be the complete path to the RNG driver. If you have a RNG of the second type, define RNGPORT to be the port number from which to get random numbers. You can use hexadecimal i.e. 0x300. Examples: RNGDRIVER=/dev/random or RNGPORT=0x300 If neither of these are defined the modified PGP will get its RANDOM numbers in exactly the same way that regular PGP does, through keyboard timing. If one of these parameters is set correctly, the modified PGP will get its random numbers from the RNG and you will never be asked to type keyboard timing stokes. I have compiled a version of PGP that supports a hardware RNG for MSDOS and OS/2. I have included the source files for each file that has been modified. To compile get the original source files, put in the modified files and compile as usual. The new source files and this software are covered by the same license as the original, LICENCE. There are similar available modifications for the other two major versions of PGP, OTHERS. If someone out there has an PSI-LINE random number generator that attaches to a RS-232 port as if it were a modem, please test it with this software. If the software line characteristics (baud rate, flow control, stopbits, ect) are set correctly (You will have to do this yourself, as this modified PGP does not do this) then all you should have to do is set RNGDRIVER to the RS232 device name. I have not tested this because I do not have this kind of RNG. Someone may wish to add code to set the software line characteristics, but this may be difficult, as the code would vary by operating system and even among the various flavors of UNIX. If you do such a test please report the results to alt.security.pgp and cypherpunks. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMHK/Sc29s2mG+tTVAQE0hwQAoDsgqF6AoIGCNOSOdWZemrGRl4/MVvjR xiwhgROtjFM1FEL4Ak/j8YlR/LSCbOdeF3hZzesaZq8xC25qwlXFEtDX8kqim3zh bOglEMW/x3M9uBQLm0Nyc8FTickaAD3L1Gsa/YMY2slmN3PrZiY0/KSVpPXEMHjK GjeM2U7XJSk= =E5gC -----END PGP SIGNATURE-----

1 0