December 2003 - cypherpunks-legacy

PGP
by Daniel 'genius' Charpentier 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I've tried to find out the answers to my questions myself but I haven't been very successful. Actually, I haven't been successful at all. First of all, I've been using PGP on my computer but when I tried to port it over to my unix account it didn't work. I took the source code and tried to compile it using the unix g++ compiler but it gave me all of these errors. Where can I find PGP that is already compiled for unix or at the very least will compile for unix? Secondly, if I create a program that makes using PGP more user friendly can I let other people have it ( for FREE )? Lastly, what is considered overkill with cryptography? I don't believe anything is. My programs accept what the user inputs for how large prime numbers should be ( my public key programs ) but I make them able to accept values that go up to 30720 bits ( I don't believe a number can ever be large enough ). You can never be to safe...never. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMMXVhDMGe42brZbVAQEo/Qf7BSshqKJAmxVzyGSyAp2Qkj+/dqh1Zon1 xDqMnvU6ihLimHZ/uXGiQE2jM6N8FRbYu7psQ/iPJ+gX5/VKfrxlxjCfDM0Jx2s9 vucgMQz1KYbELA8Fo1QUEsDuTMzJ80VoTicXfZZmILhr7cBJH4pHa5RgkgrS2Lun iodQ+F7BXdio86TnctQgoKJ+78qOYDuV4Vfha/a290ZoZmPRcqArYv7tU6X3KMjf DGxqgugiwpHnkTO1B9wypoePbbJZSNzFYYvZKMI8Ntg7yFkMl/lSxcLh6oYq0ACe R9NfZR9x11H/fIrn8HZlq0Q86OptWhZz53p77VNN+sVZJOktHJIWqg== =WK6x -----END PGP SIGNATURE-----

1 0

Re: Solution for US/Foreign Software?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:50 PM 12/6/95, Ernest Hua wrote: >The main point is that there is no such thing as the "letter of the law". >What they enforce is much broader than that, and how they enforce it is much >more subtle than clear-cut criminal prosecution. Therefore, you cannot just >use literal loop holes just because it's not clear, because the law they are >enforcing is not clear either. > >This response should almost be an FAQ for this crowd. Indeed. In fact, my Cyphernomicon FAQ contains numerous discussions about ITAR and hooks. For example: - Dan Bernstein has argued that ITAR covers nearly all aspects of exporting crypto material, including codes, documentation, and even "knowledge." (Controversially, it may be in violation of ITAR for knowledgeable crypto people to even leave the country with the intention of developing crypto tools overseas.) and 10.10.6. "Can ITAR and other export laws be bypassed or skirted by doing development offshore and then _importing_ strong crypto into the U.S.?" - IBM is reportedly doing just this: developing strong crypto products for OS/2 at its overseas labs, thus skirting the export laws (which have weakened the keys to some of their network security products to the 40 bits that are allowed). + Some problems: - can't send docs and knowhow to offshore facilities (some obvious enforcement problems, but this is how the law reads) - may not even be able to transfer knowledgeable people to offshore facilities, if the chief intent is to then have them develop crypto products offshore (some deep Constitutional issues, I would think...some shades of how the U.S.S.R. justified denying departure visas for "needed" workers) - As with so many cases invovling crypto, there are no defining legal cases that I am aware of. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Barring access to Netscape
by Alan Olsen 17 Dec '03

17 Dec '03

At 03:28 PM 12/1/95 -0500, you wrote: >You can get your server to simply put that at the top of every page >served to a Netscape client, followed by a horizontal line and the >normal web page. It should be easy to put together the hacks to do >that and get them out to lots of people. Watch how fast people would >switch from Netscape, especially were it widely deployed. You would >then watch a fast fall in Netscape stock, which would likely piss Jim >Clark off far more than anything else one could do. This type of page hack is pretty easy. Take a look at _HTML & CGI Unleashed_ from Netsams press. Page 410 has a script that can be easily modified to do something similar. (Great book, but lacks some of the more advanced server redirect tricks I have seen elsewhere.) The example is for displaying an optional display for browsers that cannot deal with image maps. It can be altered to do the same to any browser. >We need HTML 3.0 capable browsers for all platforms, though. They (the W3O) need to agree what HTML 3.0 consists of before that will happen soon... | What is the Eye in the Food Pyramid? | alano(a)teleport.com | |"The moral PGP Diffie taught Zimmerman unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | <fnord> |

1 0

Microsoft Internet Announcements Thursday, December 7, 1995
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- "A day that will live in infamy." Anyone have the exact time that Bill will begin speaking? I think it would be "neat" if we timed the release of a complete rewrite of the win95netbugs FAQ (with a new security section), improvements to the hackmsoft page, and other stuff for 15 minutes after Bill begins. The win95netbugs FAQ, version 4.00.950, will be posted to the following places tomorrow morning (I'll probably be up all night): http://www-leland.stanford.edu/~llurch/win95netbugs/faq.html [canon URL; multiple load-balancing SPARCServers] http://www-dccs.stanford.edu/NetConsult/Win95Net/faq.html [use this if you have an old Sun DNS server that barfs on the www-leland lbnamed tricks] news.answers, comp.answers, comp.protocols.tcp-ip.ibmpc, and several higher-traffic groups (this will be the first approved and rtfm-archived posting; the news-answers folks got back to me last week). I'll probably create the throwaway w95netbugs(a)aol.com for posting purposes. gopher://quixote.stanford.edu/1m/win95netbugs An email autoresponder to be named later (finger this account in the morning). An ezine or three to be named later. - -rich -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMMXlBY3DXUbM57SdAQFnzwP/ZaFJsyz7H/uViPAetTiaBnLxvgZBFmiE mURZdUHU7vVPZ1cIjdO2j0ARoulwQvzXUywezTHusIBGgbxdMf0/NpErpAbFktvA /A7uBGo38scSaYIATLpMEMx8aomoeDiwRxUyzXTCAaRnBHfHf0l0/egDUYPWnK3D ZTF1cFzv+jA= =cHCp -----END PGP SIGNATURE-----

1 0

Re: Solution for US/Foreign Software?
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

>At 8:06 AM 12/6/95, jim bell wrote: > >>>"Crypto hooks," basically the scheme you are proposing, were thought of by >>>the authorities and are not a bypass of the crypto export laws. >>>--Tim May >> >> >>I'm not saying they are a "bypass" of the laws. Rather, I'm saying that >>if the goal is to: >> >>1. Let companies like Netscape make foreign sales. >> >>2. Still comply with the letter of the law. >> > >And I'm saying that your proposal does NOT comply with the letter of the >law. There's no point in arguing this, as the facts are clear. Consult the >ITARs and the previous discussions here and elsewhere on the practice of >leaving "hooks" that crypto modules can later be attached to. NO! You didn't read my commentary carefully enough. These "hooks" (your words) will, in effect, already be connected to encryption software weak enough to make NSA happy. You know, 40 bit keys or something like that. But instead of being in one large file, embedded into a program, it'll be TWO files. Simple programming change. Everything that implements/defines/limits the encryption to 40 bits will be in the smaller file. This really isn't a "hook," it's an internal connection between two portions of the same program. (actually, it wouldn't need to be in two separate files; a file which implements a patch for the first file would work great.) It'll be exportable, because its key size is "acceptable." At the time the export license is requested, the replacement module to increase key size probably won't even exist, in order to avoid giving the USG an excuse to deny the export license. After the license is obtained, the replacement module is written and shipped to domestic users. I fully realize the USG won't "like" this kind of thing. But if they are trying to take the position that certain kinds of encryption software CAN be exported, and some can't, they're going to have to approve SOME programs for export, using criteria which at least pretend to be objective. In view of the nearly limitless possibility of patches, how would YOU distinguish between programs?

1 0

Re: GAK
by David E. Smith 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 11:56 AM 12/6/95 EST, SBinkley(a)atitech.ca wrote: >I heard a while back about being able to "split" up a PGP key. I suppose you could, with some variant of Shamir's secret- sharing scheme. I'm not familiar with any specific applications that do this. (But that's irrelevant.) >What about splitting up the key into many parts, and giving >them out to multiple INDEPENDANT agencies. ie: One piece >goes to the FBI, one to the NSA, one to some other committee, >and so on. That way, no goverment body could just tap your >conversations without getting approval from others, and >gaining the pieces of your key. That still doesn't address the basic issue - that the government has NO RIGHT to access our _private_ keys. If you want to assume a fairly paranoid threat model, each of these different agencies will instantly combine their parts to generate the whole key. If you trust the government, it might work. Personally, I trust the government about as far as I can throw the typical Man In Black. Dave -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMMXoeAwyfvCScyE5AQEFqQQAihutub3GQDi/FtiDkAfxgb8dzFAEnZ/H LD588iuIxX3G3M0fLmAkRuUKE7fdhExkAO1IYFwH0oM/bI8KdSrY/RyeqnQFRwVo /Vvr6nwVMdLP94Vt9Gi4QXJ4dVBHXwfvRUm5/HdLqqh8UH2HLKO1jdt82H539paM ZhiZkMmNlCs= =0kWW -----END PGP SIGNATURE----- ----- David E. Smith, c/o Southeast Missouri State University 1210 Towers South, Cape Girardeau MO USA 63701-4745 +1(573)339-3814, "dsmith(a)midwest.net", PGP ID 0x92732139 http://www.midwest.net/scribers/dsmith/

1 0

Re: PGP
by David E. Smith 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 12:54 PM 12/6/95 -0500, you wrote: > I've tried to find out the answers to my >questions myself but I haven't been very successful. >Actually, I haven't been successful at all. First of all, >I've been using PGP on my computer but when I tried to port it >over to my unix account it didn't work. I took the source code >and tried to compile it using the unix g++ compiler but it gave >me all of these errors. Where can I find PGP that is already >compiled for unix or at the very least will compile for unix? >Secondly, if I create a program that makes using PGP more >user friendly can I let other people have it ( for FREE )? >Lastly, what is considered overkill with cryptography? >I don't believe anything is. My programs accept what the user >inputs for how large prime numbers should be ( my public >key programs ) but I make them able to accept values that go >up to 30720 bits ( I don't believe a number can ever be large >enough ). You can never be to safe...never. Firstly - and don't take this personally - how much computer knowledge do you have? The PGP sources use all sorts of #ifdefs and other kludges. A fair amount of C coding ability is needed to get the damn things to do much of anything. (Hell, I can't read most of it - my precompiled MSDOS version does what I need it to do.) If you make PGP more user friendly... well, PGP 3.0 is still coming Real Soon Now (TM) and it will include an API that will make hooking into it ridiculously simple. Beyond that, there are already a number of good DOS and Windows shells for it, and nobody on unix-flavoured systems expects a clean user interface anyway :) (Well, except for XWindows...) But, if you write it - and I'm cautioning you to be sure you don't reinvent the wheel - you can distribute it freely. I suggest using the terms of the GNU GPL. And the key values - well, you can give it 32k bits, but 1. generating a key pair could take a prohibitively long time; 2. nobody else can use it (the default PGP distributions are capped off at 2047 bits). Good luck. Dave -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMMXoSwwyfvCScyE5AQEwtQQA0IHRhQiBej05B8KfFMJh95+XVvzW5ax1 SgQGrNABIdnyOkDSgPLA97vQ04agU8ytOyaDMW/X4IuI/zZgsqOzegsb57+TEcAz sB7mvzmW0tTrEEdMRjBkaZRAnf0wTrf2EqtR3lshJCgzK1MB6szG3w4N8yb26YKD 2VyBrX10nRY= =sRw4 -----END PGP SIGNATURE----- ----- David E. Smith, c/o Southeast Missouri State University 1210 Towers South, Cape Girardeau MO USA 63701-4745 +1(573)339-3814, "dsmith(a)midwest.net", PGP ID 0x92732139 http://www.midwest.net/scribers/dsmith/

3 2

Re: PGP
by DANIEL CHARPENTIER 17 Dec '03

17 Dec '03

On Wed, 6 Dec 1995, david d `zoo' zuhn wrote: > Also, you can have keys that are too large. Do you want to take hours to > encrypt a simple file, just because you have a 30000 bit key? Do you > expect your recipients to take the same amount of time (or more) to > decrypt it? > The tradeoff between cost & security is probably too high in that case (I > surely wouldn't bother to decrypt anything you sent me if I had to wait > hours or more). Now be practical. You do have options. Just because you have the capability to encrypt with a 30000 bit key does NOT mean that it is mandated that you encrypt with a 30000 bit key. The reason that cypherpunks is even in existence is that sometimes privacy is a must. Sometimes you want to make sure that a common thief can not read your files and others you want to make sure the N.S.A. can not read your files. This is not in dispute. We all know this. Having the option is comforting ( in my opinion of course ).

1 0

Re: Geodesic Payment Systems? (was Re: Meeting notes from ANSI X.9Meeting on Electronic Payment)
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"nsb+limbo(a)nsb.fv.com" "Nathaniel Borenstein" 6-DEC-1995 07:21:19.03 I had assumed that there was a market discount, but it's still not quite that simple. It's very hard for markets to deal with *unbounded* risk. The biggest problem I see with most of the crypto-cash schemes is that there is a legitimate scenario -- however low-probability you might assess it to be -- of break-the-bank catastrophic failure, i.e. in which someone gains the keys that allow him to essentially print money. This kind of low-probability, infinite-cost risk is the kind of thing that gives underwriters the heebie jeebies. There's a good reason that most companies have "Ltd" after their name instead of "Unlimited", in those countries where that's the naming convention. -------------------------- The risk in question is not infinite-cost. If the person who gets ahold of the keys starts simply making lots and lots of money, in a free market the prices in digital cash for everything will start going up. This phenomenon will be spotted, and those taking the particular variety in question will stop accepting it. Losses are limited to however much was out there at a given time, and if there are multiple systems with free-market interconversion between them, that may not be very much. People will move out of a decaying monetary system if: A. the new system is as easy to get as the old; and B. the new system is as easy to spend as the old. If the person who gets the keys simply uses them on a small scale, then the resulting inflation and loss of value can simply be dealt with using the discount mechanism. It's no longer infinite risk. -Allen

1 0

Re: GAK Flap Happening at a Good Time--Journalists Read!
by tien＠well.sf.ca.us 17 Dec '03

17 Dec '03

Sameer wrote: There was no Netscape (or RSADSI, for that matter [an RSADSI employee showed up, but it was on his own time]) representative at the recent Bernstein hearing in SF. I think that shows how much they really care. Actually, this is not entirely correct. An attorney for a firm which is outside counsel (crypto-related) to Netscape did attend the Bernstein hearing. Lee Tien

1 0