December 2003 - cypherpunks-legacy

Re: protecting against impersonation (was: CANADIAN PRESS REPORTS)
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

>anonymous writes: >> I still feel such a sense of violation with what LD did, such an >> utter sense of helplessness at the character assassination I've >> suffered at his hands, > >So use PGP, sign your messages. Simple solution. Absolutely! Anybody who uses anonymous remailers to post to public areas, and does not use digital signatures to prevent spoofing when it is obviously needed, is a fool or worse.

1 0

SA: Confidential Communication on the Internet
by Aleph One 17 Dec '03

17 Dec '03

On the December issue of Scientific American there is an article by Thomas Beth, "Confidential Communication on the Internet". Lite on the technical side but good reading anyway. Aleph One / aleph1(a)dfw.net http://underground.org/ KeyID 1024/948FD6B5 Fingerprint EE C9 E8 AA CB AF 09 61 8C 39 EA 47 A8 6A B8 01

2 2

Re: Crypto-law etc
by John Kelsey 17 Dec '03

17 Dec '03

> From: Chuck McManis <cmcmanis(a)FreeGate.net> > To: cypherpunks(a)toad.com > Subject: Crypto-law etc > Date: Wednesday, September 17, 1997 2:35 PM > The longer I follow the crypto "debate" the more I begin to > understand what must have been the real intent behind the > 2nd amendment of the constitution. > > If the White House can get crypto code defined in the true > legal sense (that is backed up by case law) as a munition, > do US citizens then have a constitutional right to "bear" it? Sure. We get the same right to bear it as we have to own rocket launchers, machine guns, or flame throwers--none. The second amendment hasn't protected our right to possess those things, which pretty clearly fall into the realm of its direct intentions--why would it protect our right to use crypto, which isn't even that clear cut? > Just curious, > --Chuck --John Kelsey, kelsey(a)counterpane.com

2 1

Design proposal: crypto-capable generic interface
by Raph Levien 17 Dec '03

17 Dec '03

Hi to cypherpunks who write code, The recent discussion of "plug-in" crypto is reminding me of some design work I did earlier this year. This post presents the motivation and some of the details of that design, slightly updated. First, a few words about what I consider to be good interface that can support plug-in crypto. It has to support both email and the Web; I feel that everything else follows. It should support completely transparent integration, by which I mean no extra clicking or commands or anything like that. Finally, it should be generic in that it will support a number of other plug-in applications besides cryptography. Two specific applications which interest me are file format conversions and external-body resolving. The design is based partly upon .mailcap, which is perhaps the best example of a generic interface we have today. However, while .mailcap is a nice interface for popping up windows to present semi-interesting multimedia types, it certainly cannot support transparent cryptography. I feel that its primary weakness is the inability to support MIME to MIME rewriting. However, .mailcap has some good ideas which are worth stealing. For the purposes of this proposal, I will assume that all objects are MIME encapsulated. I think that's a reasonable assumption, as it handily covers all cryptographic protocols that have any hope of surviving. I will propose my design at a very high level. Please forgive me for leaving out the juicy details. I propose that the new interface lives as a sort of daemon, rather than a static collection of command line script pieces. A reasonable way for applications to talk to the daemon would be Unix domain sockets, or whatever the equivalent is on Mac and Windows platforms. There should be a simple protocol for automatically starting up a daemon if there isn't one already running. The first part of the interface is the negotiation. The daemon tells the application what MIME types it can understand (this part is very similar to the .mailcap file, but doesn't include the corresponding command lines). In reply, the application tells the daemon what MIME types it can understand (this is like the Http-Accept: field in HTTP). Once the negotation has been established, the application can send the daemon MIME objects that the app does not understand but the daemon does (for example, an image/fractal). The daemon can return a MIME object that the app does understand (for example, an image/ppm). Alternatively, the daemon may request an authentication. This is useful when resolving external bodies that require authentication, including non-anonymous FTP, and standard authenticated HTTP. In this case, the daemon sends a message to the app requesting the authentication. It specifies whether it needs both username and password, or just password. In the latter case, it hands a username to the application. The application can then query the user for the authentication data. It hands this back to the daemon. In reply, the daemon indicates success or failure. In case of success, it hands the object back to the app. I'm quite pleased with this protocol as outlined. It's fairly simple, which means it might actually get implemented. It's also easy to see that it does exactly what you want for file format conversions, external body resolving, and decryption of encrypted messages. Encryption is a bit more tricky, but in essence you just hang a premail-alike off this kind of protocol. The hard part is specifying the key, but you just call it a "parameter" and put in hooks for the daemon to ask for whatever parameters it needs. This requires that keys have some nonforgeable names, which is unfortunately not a feature of PGP 2.6.2. S/MIME will do it just fine, if you buy into the Certifcation Authority (<wink> at Nick Szabo). One final aside: I've been fairly frustrated with this mailing list as a forum for talking about real design proposals and implementation issues. Ignorant posts by the likes of Dr. Fred and Alice d'Clueless tend to attract far more attention than real crypto work. I want a forum for, and just for, cypherpunks who write code. If I had just a smidgen more free time (as if), I'd be trying to start one myself. Anyone else? Raph

6 9

WRITTEN CODE
by Daniel 'genius' Charpentier 17 Dec '03

17 Dec '03

In Raph Levien's Subject : Design proposal : crypto-capable generic interface he mentioned his desire to see more cryptographic program code and I didn't want to see this initiative die. I am a new commer to cryptography and I know I shouldn't be posting yet but that is what I thought cypherpunk postings was supposed to be in the first place ( program code, protocols, and algorithms ). Please don't flame me to badly for this message. I am doing everything I am supposed to before posting ( reading the FAQ's, the entire cypherpunk archive, and APPLIED CRYPTOGRAPHY by Bruce Schneier ) but I could not let this slip by. Let's talk more about the cryptographic algorithms, program code, and chips than politics. I hope this did not upset to many people

3 2

Recompiling PGP 2.6.2i under microsoft.
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

I am trying to recompile PGP 2.6.2i under Microsofts VC 1.5. Unfortunately the makefile pgp.mak is configured for borlands C compiler and linker, and the makefile pgppwb.mak gives me a bunch of link time errors. Is there someone around who has been there and done that. Is this just a trivial edit or a serious rewrite? C:\PGP\PGP.SRC\SRC> nmake -f pgppwb.mak [....] Libraries [.lib]: Definitions File [nul.def]: /NOI /STACK:12288 /BATCH /ONERROR:NOEXE /EXE /FAR / PACKC; RSAGEN.obj(rsagen.c) : error L2029: '_rsa_public_decrypt' : unresolved external CRYPTO.obj(crypto.c) : error L2029: '_rsa_public_decrypt' : unresolved external RANDOM.obj(random.c) : error L2029: '_randPoolGetByte' : unresolved external RANDOM.obj(random.c) : error L2029: '_randPoolStir' : unresolved external CRYPTO.obj(crypto.c) : error L2029: '_rsa_public_encrypt' : unresolved external IDEA.obj(idea.c) : error L2029: '_randPoolGetBytes' : unresolved external RANDOM.obj(random.c) : error L2029: '_randPoolAddBytes' : unresolved external RSAGEN.obj(rsagen.c) : error L2029: '_rsa_private_encrypt' : unresolved external CRYPTO.obj(crypto.c) : error L2029: '_rsa_private_encrypt' : unresolved external RANDOM.obj(random.c) : error L2029: '_sleep' : unresolved external RANDOM.obj(random.c) : error L2029: '_noise' : unresolved external PGP.obj(pgp.c) : error L2029: '_noise' : unresolved external CRYPTO.obj(crypto.c) : error L2029: '_rsa_private_decrypt' : unresolved external NMAKE : fatal error U1077: 'LINK' : return code '0x2' Stop. --------------------------------------------------------------------- We have the right to defend ourselves and our property, because of the kind of animals that we are. True law derives from this right, not from the arbitrary power of the omnipotent state. http://www.jim.com/jamesd/ James A. Donald jamesd(a)echeque.com

1 0

protecting against impersonation (was: CANADIAN PRESS REPORTS)
by aba＠atlas.ex.ac.uk 17 Dec '03

17 Dec '03

anonymous writes: > I still feel such a sense of violation with what LD did, such an > utter sense of helplessness at the character assassination I've > suffered at his hands, So use PGP, sign your messages. Simple solution. > that I feel that I must take some token action to "set the record > straight". Something which clears my name. This post wasn't signed off, but I presume you are "Alice d'nonymous", it would help lots if you could get yourself an account with a nym server, such as alpha(a)c2.org. That would have the advantages that your email address would be recognizable, and that people could reply to you if they wanted to. If having a working reply address bothers you, well at least sign your posts, if you're concerned about a persistant identity, the tools are available to do it. Complaining about things which have simple technological solutions won't get you much sympathy. Adam

2 1

Give us your wired, your poor, your HTML hacker, yearning to web , freely (fwd)
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S'punks, Anyone need a job in the Bay Area? I think a Cypherpunk would be ideal for this job. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ---------- Forwarded message ---------- Date: 17 Nov 95 17:29:42 From: Steve Gibson <Steve_Gibson(a)bionomics.org> To: Friends of Bionomics <Friends_of_Bionomics(a)notes.worldcom.com> Subject: Give us your wired, your poor, your HTML hacker, yearning to web freely Dear Friends, We need help. We need a combination web-cultivator, researcher, editor, conference assistant and Notes/Mac wizard. In sum, a typical enterpreneurial utility infielder. Finding people who comfortably straddle the worlds of public policy and high technology can be tricky. We look to you, as someone familiar with The Bionomics Institute, for assistance in this key search. (After all, this one hire represents a 33% increase in our staff.) If you know of such a person, please get the following information to them, or get them in touch with us. Thanks, Steve * * * * * * * * * * * * * * * * * * * * * * * * * JOB OPENING * * * * * * * * * * * * * * * * * * * * * * * * * WHO WE ARE The Bionomics Insitute is non-profit educational foundation (aka Think Tank) dedicated to replacing the conventional mechanistic model of the economy with a living, ecosystem one, as described in Michael Rothschild's book <Bionomics: Economy as Ecosystem>. QUALIFICATIONS Must be comfortable (1) all over the WWW, and inside the HTML of our web site, and (2) researching economics, technology, history, biology, public policy and ??? using libraries, on-line data sources, phone calls and brainpower, and 3) familiar with free-market thinking. JOB DESCRIPTION (1) Nurture Institute web site. (2) Provide primary research support for free-market think tank/high-tech columnist. (3) Maintain research library. (4) Assist in general operations of Institute, including conferences, etc. (5) etc. (6) see 5. ORGANIZATIONAL CULTURE Informal but intense work environment, self-starters only. Teamwork and communication trite but very necessary. Technical knowledge must be matched with broad interests and strong English skills. Small staff, medium salary, large hours. IF YOU MADE IT THIS FAR Do your research on Bionomics (www.bionomics.org would be a good place to start), then email resume to Research(a)bionomics.org. (November 17, 1995) Steve Gibson, Executive Director, The Bionomics Institute, 415/454-1000, www.bionomics.org

1 0

Oracle's "internet terminal"
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

The recent issue of _Computer Reseller News_ has a couple of items on the "internet terminal" being readied by Oracle. I'll quote a couple of crypto-relevant excerpts: 1. Interview with Larry Ellison (Oracle Corp's Chairman/CEO) Q. How far along are you in the development of the $500 Internet Network Terminal? A. We'll be delivering the prototype machines this year with full production in the third quarter next year. ... Q. Will you release Application Programing Interfaces for the Oracle browser and server? A. We will use industry-standard APIs that are accepted by everybody, not Microsoft-proposed APIs. ... Q. What differentiates the Oracle Web products from competitive offerings in terms of pricing and technology? A. There will be standard Web payment schemes. We'll use them, as will everybody else. We won't differentiate ourselves on basic payment schemes. The thing that will differentiate us is security protocols, the ability to use text processing, database processing, video processing, our video server technology and our powerful client. 2. Ellison's field of dreams - $500 PC (by Ken Yamada) ... Oracle's chairman and chief executive, Lawrence Ellison, previewing his latest futuristic vision at a trade show last month in Geneva, said Oracle is developing the computer and that it will be shown early next year. The desktop version of the new system, called a "network computer" and referred to as an "NC" rather than a PC, is expected to sell for about $500 and will use Internet servers to do the bulk of its computing. Basic hardware will include an inexpensive microprocessor, a small amount of memory, a monitor and a keyboard, but the device will lack storage and software. [I guess, they mean no permanent storage or software other than the browser in ROM. No remembered state, no viruses... -DV] ... The Redwood Shores, Calif., company is developing the computer's operating system and technical design, but the unit will be produces by hardware manufacturers, said Farzad Dibachi, an Oracle senior vice president. While Dibachi would not name specific manufacturers, he explained that Oracle's participation in the device's technical development was similar to the role it played in developing a digital television set-top box with Apple Computer, which produced the box's hardware. ... Oracle plans to sell software that turns World Wide Web sites essentially into central processing units for the new computers. ... "If computing is to go to the masses and we're doing electronic commerce," said Dibachi in a telephone interview from Geneva, "you have to have devices that are simpler." Oracle's Laursen said he expectes that eventually many different companies will manufacture the devices, which he described as an entire line of products encompassing two-way pagers, intelligent telephones, mobile computers, desktop systems and television set-top boxes. Each of these devices would rely on the Internet to do its core processing work. He said he expected Oracle to develop as many as 50 working prototypes by early next year. ... Oracle also plans to leverage its wireless communications software products and give some of the devices wireless capabilities. "We're still trying to figure out what processor to put in," Laursen said. Under consideration are chips from Mips Technologies and Motorola Inc. --- Dr. Dimitri Vulis Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: WRITTEN CODE
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 10:51 AM 11/18/95, Daniel 'genius' Charpentier wrote: >I didn't want to see this initiative die. I am a new commer to >cryptography and I know I shouldn't be posting yet but that is >what I thought cypherpunk postings was supposed to be in the first >place ( program code, protocols, and algorithms ). Please don't ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ The list is about several things, some of which overlap the topics routinely discussed in sci.crypt and sci.crypt.research. Algorithms, code, etc. _does_ get discussed a lot, as you'll surely see as you peruse the archives. Volume-wise, it is a drop in the bucket. But this is not surprising, as primarily mathematical questions and answers tend to be brief. (You'll see this in the many one-line answwers to questions about cryptographic algorithms....) Also, technical questions tend to have precise answers, usually with answers in the various crypto texts and proceedings of the Crypto and EuroCrypt conferences. And technical questions which _don't_ have simple answers in the texts tend of course to be _research_ questions, and the dynamics mitigate against lively discussion until some progress is made. The social, political, and economic aspects are seldom discussed adequately elsewhere, and one thing the Cypherpunks group has really led in is the discussion of digital money, anonymous systems, pseudonyms, reputation, markets, and a host of other such topics. These topics can border on pure politics if people are not careful, but are generally close to the topics discussed at the first meeting over three years ago, before there was even a mailing list. >flame me to badly for this message. I am doing everything I am >supposed to before posting ( reading the FAQ's, the entire >cypherpunk archive, and APPLIED CRYPTOGRAPHY by Bruce Schneier ) >but I could not let this slip by. Let's talk more about the >cryptographic algorithms, program code, and chips than >politics. So, go ahead and talk. I mean this seriously, not sarcastically. No one will chastise you or anyone else for discussing technical cryptography. There are obviously folks interested in this. Experts, even. Published experts, even. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0