December 2003 - cypherpunks-legacy

Test
by Duncan Frissell 17 Dec '03

17 Dec '03

Dead or alive? --- WinQwk 2.0b#1165

1 0

MacPGP 2.6 (fwd)
by Dan Harmon 17 Dec '03

17 Dec '03

Just food for thought! ---------- Forwarded message ---------- Date: Sun, 12 Jun 1994 12:44:52 -0700 From: Eric Bear Albrecht <ebear(a)presto.com> To: Dan Harmon <harmon(a)tenet.edu> Subject: MacPGP 2.6 That signature block in your message seemed awfully short -- does that indicate a wimpy system? Read the following excerpt and cogitate on it: ------ Computer underground Digest Sun June 5, 1994 Volume 6 : Issue 49 ISSN 1004-042X ... CONTENTS, #6.49 (June 5, 1994) File 1--AT&T Lab Scientist Discovers Flaw in Clipper Chip File 2--Jacking in from the SNAFU Port (Clipper Snafu update) File 3--Jacking in from the "We Knew It All Along" Port (Clipper) File 4--Crackdown on Italian BBSes Continues File 5--Norwegian BBS Busts / BitPeace File 6--BSA: Software Piracy Problem Shows no Sign of Easing File 7--Re: "Problems at TCOE" (CuD 6.47) File 8--Is there an MIT/NSA link-up for PGP 2.6? Some Info ... ------------------------------ Date: Mon, 30 May 1994 18:04:50 -0500 (CDT) From: tlawless(a)WHALE.ST.USM.EDU(Timothy Mark Lawless) Subject: File 8--Is there an MIT/NSA link-up for PGP 2.6? Some Info For the past week our Unix machine has been down (Might have gotten some mail bounces) because of a security violation. Durring that week i re-discovered bbs's. One peice of info i found (And also got the authors's permission to reprint (At the end) relevent to pgp I thought i would pass on. D Area: CypherMail DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD Msg#: 19 Date: 05-24-94 19:47 From: Leland Ray Read: Yes Replied: No To: All Mark: Subj: More on PGP 2.5 & 2.6 DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD -----BEGIN PGP SIGNED MESSAGE----- The following is the complete, unedited plaintext of a message I received via CompuServe from Christopher W. Geib, a software developer who spent several years as a military intelligence officer. Chris has written a very fine Windows interface for PGP which I'll be uploading as soon as I get the newest release (with Chris's permission, of course). I trust his judgment on this one. ~~~ =====(Begin plaintext)===== Leland, I sent this to Mich Kabay of the NCSA Forum. Thought you might find it of interest. Note that 2.5 is also a MIT/NSA concoction. Chris ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Mich, As I reflected on more and more on this posting, it occurred to me that I was smelling a rat. The NCSA Forum members and others who visit here should give thought to this issue. A puzzle of sorts seems to be developing regarding PGP in general, and private possession of crypto in particular. Let me provide some pieces to this puzzle, and perhaps you and others may begin to see the bigger picture that seems to be unfolding. Piece #1: As you may already know, MIT is the single largest ($'s) outside contractor to the NSA. Piece #2: MIT is frustrated they feel that they have been somehow cheated financially by the proliferation of PGP 2.3a as freeware. (I still think that is insane as RSA was developed using public funding) Piece #3: NSA is frustrated because of the apparent strength of the imported Idea(tm) cipher. Piece #4: NSA is pushing the Clipper crypto technology so that Big Brother can have a free and easy backdoor to violate the privacy of Americans. Note too, that Clipper technology was assisted along by MIT. Piece #5: PGP 2.6 will *not* be compatible with 2.3a after Sept 1994 for 2-way encryption. This accomplishes reduced international secure traffic by private individuals and businesses. This is exactly the same problem that Clipper has. Have you begun to see the big Puzzle Palace picture yet? Unless my eyes deceive me, I would say this, MIT and NSA have teamed up together on PGP 2.6! This version, until proven otherwise (through examination of the source code, etc.), is likely to contain a backdoor big enough to drive a Mack truck through it. The back door is likely similar to Clipper and for the same intent. Given how much flak NSA has gotten over Clipper, NSA will very likely stay very mum about the whole issue. The big winners are NSA and MIT. They both get exactly what each has wanted all along. MIT gets royalties they think they deserve, NSA gets what they intend to have anyway, a means to continue listening into citizens private conversations. NSA also wins on the international front by reducing it's workload of analyzing international encrypted traffic. Business and the citizens lose because it isolates the US from Europe and the international marketplace. I strongly recommend that anyone who acquires PGP 2.6 do so with a jaundiced eye. Until the private sector can review, and analyze this new MIT/NSA system, one *must* assume that it is as if it contained a virus, one you may never know it has. I for one will continue with the present version as it's inventors have no reason to capture private communications. If you think appropriate, please upload to Internet Risks with my blessings. Respectfully, Christopher W. Geib ~~~ =====(End of plaintext)===== So you decide, guys. Is it worth the risk? Again, just some thoughts, but remember this: if you go to either ver. 2.5 or 2.6, you'll probably have to revoke your ver. 2.3 keys and start afresh with new ones, which might not be secure in the first place. LR ... If the Pope's phones weren't secure, PGP would be a sacrament. ((Post obtaining reprint permission deleted)) ... ** The wonderful thing about standards ** ** is that there are so many to choose from. ** Eric Bear Albrecht ebear(a)presto.com W5VZB Box 6040 505-758-0579 fax 505-758-5079 Taos, NM 87571

1 0

Patent Numbers
by norm＠netcom.com 17 Dec '03

17 Dec '03

Does anyone have the US Patents numbers for Chaum's DigiCash scheme?

1 0

Warning: Don't run MacPGP 2.6 on a 68000 based Macintosh
by Jeffrey I. Schiller 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Warning. MacPGP 2.6 (1.1.1) will *not* work on a 68000 based Macintosh. It will bomb. I was unaware of the nasty hack you have to do when compiling MacPGP in order to get it to be 68000 aware. People who have the source distribution can compile it for either machine. -Jeff -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBVAgUBLfupN1UFZvpNDE7hAQHY7QH5AWxYbjgSGhV45R6MTWQ43HytC7ZdlPdQ E9dCNnmKK2NvPdJOOq/ZLEbSE0jjmcMzKDT3crL5yulYTAAcgfojFQ== =IVv2 -----END PGP SIGNATURE-----

1 0

URGENT Action required (NJ folks only)
by Shabbir J. Safdar 17 Dec '03

17 Dec '03

Estimated time for this good deed: Two minutes Do you live in one of the following zip codes in New Jersey? 07010 07014(part) 07020 07022 07024 07026 07029(part) 07031 07032(part) 07047(part) 07057 07070 07071 07072 07073 07074 07075 07087(part) 07094 07096 07306(part) 07307 07308 07310(part) 07407 07410(part) 07452(part) 07601 07602 07603 07604 07605 07606 07607 07608 07631 07632 07643 07644 07646 07649(part) 07650 07657 07660 07661 07662(part) 07666 07670(part) If your zip code is listed above then you are one of Rep. Torricelli's constitutents. "part" means your zip code is split between two districts, one of them Rep. Torricelli's. Rep. Torricelli is on the House Intelligence Committee and needs to hear from you about HR 3627, which would permit cryptography exports. The attached file explains all about the bill and why you should support it. Call Rep. Torricelli today and ask him to send Rep. Maria Cantwell's bill, HR 3627, to the House Floor! Dist ST Name, Address, and Party Phone Fax ==== == ======================== ============== ============== 9 NJ Torricelli, Robert (D) 1-202-224-5061 1-202-225-0843 2159 RHOB Here is a sample communique you might use: Dear Representative Torricelli, Please report Maria Cantwell's Cryptography export bill (HR 3627) out of committee. Its passage will both assist American industries competing globally, as well as allow American consumers to purchase products to enhance their privacy. Sincerely, ______________ Table of contents: Introduction & Alert Status of the bill What you can do right now List of legislators supporting HR 3627 List of legislators wavering on HR 3627 List of legislators opposing HR 3627 What is the Cantwell bill? ------------------------------------------------------------------------------- INTRODUCTION & ALERT The Cantwell cryptography export bill has entered a critical stage in its travels through Congress. The bill, which would loosen controls on the export of encryption software, has been referred to the House Select Committee on Intelligence, and must be be reported back from committee by June 16th or it will die. This alert details the provisions of the bill, its history, and what you can do to show your support. Voters Telecomm Watch keeps scorecards on legislators' positions on legislation that affects telecommunications and civil liberties. If you have updates to a legislator's positions, from either: -public testimony, -reply letters from the legislator, -stated positions from their office, please send them to vtw(a)panix.com so they can be added to this list. General questions: vtw(a)panix.com Mailing List Requests: vtw-list-request(a)panix.com Press Contact: stc(a)panix.com Gopher URL: gopher://gopher.panix.com:70/1/1/vtw WWW URL: Be patient; we're working on it. :-) ------------------------------------------------------------------------------- STATUS OF THE BILL (updated 6/3/94) The office of the House Select Committee on Intelligence reports that HR 3627 has been referred to the the committee and must be reported out by June 16th or it will die in committee for the year. May 20, 94 Referred to the House Select Committee on Intelligence May 18, 94 Passed out of the House Foreign Affairs Committee on May 18 Dec 6, 93 Referred to the Subcommittee on Economic Policy, Trade and Nov 22, 93 Referred to the House Committee on Foreign Affairs. ------------------------------------------------------------------------------- WHAT YOU CAN DO RIGHT NOW Estimated time to do this good deed: Two minutes Show your support for HR 3627 by contacting a member of the House Select Committee on Intelligence, especially if your one of your state's representatives is on the committee. The end of this alert contains a sample message on which you can base your contact. The following list, sorted by state, shows the full membership of the committee and how to reach them. Remember, the deadline for the bill to pass out of committee is June 16th, so it is important to act quickly! If you live in one of the states listed below call your legislator. Otherwise, call Rep. Glickman. Here's a sample communication: Dear Representative ___________, Please report Maria Cantwell's Cryptography export bill (HR 3627) out of committee. Its passage will both assist American industries competing globally, as well as allow American consumers to purchase products to enhance their privacy. Sincerely, ______________ All addresses are Washington, D.C. 20515 Dist ST Name, Address, and Party Phone Fax ==== == ======================== ============== ============== 5 AL Cramer Jr, Robert E. (D) 1-202-225-4801 1-202-225-4392 1318 LHOB 8 CA Pelosi, Nancy (D) 1-202-225-4965 1-202-225-8259 240 Cannon 32 CA Dixon, Julian C. (D) 1-202-225-7084 1-202-225-4091 2400 RHOB 40 CA Lewis, Jerry (R) 1-202-225-5861 1-202-225-6498 2312 RHOB 46 CA Dornan, Robert K. (R) 1-202-225-2965 1-202-225-3694 2402 RHOB 2 CO Skaggs, David E. (D) 1-202-225-2161 1-202-225-9127 1124 LHOB 10 FL Young, C. W. (R) 1-202-225-5961 1-202-225-9764 2407 RHOB 4 KS Glickman, Daniel (D) 1-202-225-6216 1-202-225-5398 2371 RHOB 1 NE Bereuter, Douglas (R) 1-202-225-4806 1-202-226-1148 2348 RHOB 9 NJ Torricelli, Robert (D) 1-202-224-5061 1-202-225-0843 2159 RHOB 3 NM Richardson, William (D) 1-202-225-6190 1-202-225-1950 2349 RHOB 1 NV Bilbray, James H. (D) 1-202-225-5965 1-202-225-8808 2431 RHOB 17 PA Gekas, George W. (R) 1-202-225-4315 1-202-225-8440 2410 RHOB 2 RI Reed, John F. (D) 1-202-225-2735 1-202-225-9580 1510 LHOB 14 TX Laughlin, Gregory H. (D) 1-202-225-2831 1-202-225-1108 236 Cannon 16 TX Coleman, Ronald D. (D) 1-202-225-4831 None 440 Cannon 19 TX Combest, Larry (R) 1-202-225-4005 1-202-225-9615 1511 LHOB 1 UT Hansen, James V. (R) 1-202-225-0453 1-202-225-5857 2466 RHOB 6 WA Dicks, Norman D. (D) 1-202-225-5916 1-202-226-1176 2467 RHOB ------------------------------------------------------------------------- LIST OF LEGISLATORS SUPPORTING HR 3627 The following legislators have formally registered support for the Cantwell cryptography export bill, HR 3627. Call them with your cheers. All addresses are Washington, D.C. 20515 Dist ST Name, Address, and Party Phone Fax ==== == ======================== ============== ============== 1 WA Cantwell, Maria (D) 1-202-225-6311 1-202-225-2286 1520 LHOB HR 3627's sponsor; thank her for her work! 16 IL Manzullo, Donald (R) 1-202-225-5676 1-202-225-5284 506 Cannon Cosponsored on 11/22/93 3 UT Orton, William H. (D) 1-202-225-7751 1-202-226-1223 1122 LHOB Cosponsored on 03/22/94 3 OR Wyden, Ronald (D) 1-202-225-4811 1-202-225-8941 1111 LHOB Cosponsored on 03/22/94 16 CA Edwards, Donald (D) 1-202-225-3072 1-202-225-9460 2307 RHOB Cosponsored on 03/22/94 19 OH Fingerhut, Eric D. (D) 1-202-225-5731 1-202-225-9114 431 Cannon Cosponsored on 03/22/94 4 MA Frank, Barney (D) 1-202-225-5931 1-202-225-0182 2404 RHOB Cosponsored on 03/22/94 2 UT Shepherd, Karen (D) 1-202-225-3011 1-202-226-0354 414 Cannon Cosponsored on 03/22/94 3 WA Unsoeld, Jolene (D) 1-202-225-3536 1-202-225-9095 1527 LHOB Cosponsored on 03/22/94 19 FL Johnston II, Harry (D) 1-202-225-3001 1-202-225-8791 204 Cannon Cosponsored on 03/22/94 9 WA Kreidler, Mike (D) 1-202-225-8901 1-202-226-2361 1535 LHOB Cosponsored on 03/22/94 4 WA Inslee, Jay (D) 1-202-225-5816 1-202-226-1137 1431 LHOB Cosponsored on 03/22/94 7 WA McDermott, James A. (D) 1-202-225-3106 1-202-225-9212 1707 LHOB Cosponsored on 03/22/94 8 IN McCloskey, Frank (D) 1-202-225-4636 1-202-225-4688 306 Cannon Cosponsored on 03/22/94 14 CA Eshoo, Anna G. (D) 1-202-225-8104 1-202-225-8890 1505 LHOB Cosponsored on 03/22/94 10 NC Ballenger, Thomas C. (R) 1-202-225-2576 1-202-225-0316 2238 RHOB Cosponsored on 05/04/94 2 WA Swift, Al (D) 1-202-225-2605 1-202-225-2608 1502 LHOB Cosponsored on 05/04/94 ------------------------------------------------------------------------------- LIST OF LEGISLATORS WAVERING ON HR 3627 [Feel free to use the sample communique at the end of the FAQ when calling or writing a legislator.] 26 NY Hinchey, Maurice D. (D) 1-202-225-6335 1-202-226-0774 1313 LHOB Recently told a constituent that he is taking the Cantwell bill under consideration, but has "national security concerns" about allowing encryption to be exported outside the United States. 1 IA Leach, James (R) 1-202-225-6576 1-202-226-1278 2186 RHOB Has yet to answer a constituent letter with a stated position. 13 NY Molinari, Susan (D) 1-202-225-3371 1-202-226-1272 123 Cannon Has yet to answer a constituent letter with a stated position. (has taken inordinately long) 8 NY Nadler, Jerrold (D) 1-202-225-5635 1-202-225-6923 424 Cannon Met with lobbying constituent in April '94; no position taken yet 25 CA McKeon, Howard P. (R) 1-202-225-1956 1-202-226-0683 307 Cannon Responded to a constituent with a "non-position", May '94 ------------------------------------------------------------------------------- LIST OF LEGISLATORS OPPOSING HR 3627 [Feel free to use the sample communique at the end of the FAQ when calling or writing a legislator.] None on file yet. ------------------------------------------------------------------------------- What is the Cantwell bill? The Cantwell bill would permit companies to export products with encryption technology in them. US companies are currently not permitted to export products (hardware or software) with this technology in them. What is encryption technology? Encryption technology, or cryptography, is the art of scrambling a conversation so that only the people communicating can decode it. Other people (such as eavesdroppers) cannot learn about the conversation. Where is cryptography being used? Cryptography is used to encrypt electronic mail to protect its confidentiality in transit. It's used by bank automatic teller machines to protect sensitive data (such as your account number, your Personal Identification Number, and your bank balance). It can be implemented into software (such as electronic mail programs and word processors) as well as hardware (such as telephones and "walkie-talkies") to ensure your privacy. Why is there a restriction on exporting products with technology in them? For many years the United States was a leading researcher in cryptography. High quality cryptographic technology was available only within the United States. The US government thought that if they did not let this technology be exported, foreign individuals would not be able to obtain it and use it against us (by keeping US intelligence agencies from eavesdropping on their communications) Since then, cryptography research has been published in international journals. Companies have been created throughout the world who export cryptographic technology from countries that do not have these restrictions. You can now buy the same, high-quality cryptographic technology from many international firms. Although the marketplace has changed, the regulations have not. Why should the regulations be changed? US companies compete in a global marketplace. Because of the export regulations, they often compete alongside products with superior cryptographic capabilities built into them. The result is that US companies build their products with an inferior encryption technology. The result of this is that you, as an American consumer, have great difficulty obtaining products with strong encryption in them. Because US products cannot compete against products with better privacy features, and because the laws are outdated, the regulations should be changed. The Cantwell bill fixes these regulations to more accurately resemble the current situation of the world marketplace. How can I help encourage more privacy-enhanced products and pass the Cantwell bill? Call or write your representative and ask them to support or cosponsor the Cantwell bill, HR 3627. You can base your letter on the sample communication below. SAMPLE LETTER OR PHONE CALL The Honorable ____________ address Washington DC, 20515 Dear Congressman or Congresswoman, As a citizen concerned for my privacy, as well as a supporter of American business, I urge you to cosponsor the Cantwell cryptographic export bill, HR 3627. The bill would allow US companies to produce and export products with cryptographic privacy-enhancing technology in them. These products are already available from firms throughout the world. US companies lose nearly $100 million per year in exports to them. By encouraging this industry, ordinary citizens like you and me would be able to purchase products with better privacy features. Please support or co-sponsor HR 3627. Sincerely, ___________________________________ [updated May 28, 1994, shabbir(a)panix.com] -------------------------------------------------------------------------------

1 0

CERT warning about majordomo
by adwestro＠ouray.Denver.Colorado.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Regarding the list going down again: I was just informed that CERT has issued a warning about a security hole in majordomo. Anyone have any info on this? Alan Westrope <awestrop(a)nyx.cs.du.edu> __________/|-, <adwestro(a)ouray.denver.colorado.edu> (_) \|-' finger for pgp 2.6 public key "Silent, We the Empire Await, Trystero!" -- Pynchon (sorta...) S,W.E.A,T! -- graffito at Moe's Pretty Good Gym -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLfu61lRRFMq4NZY5AQESBQP/fn0lhPeUgVk+abGqQzNSOG+7895AvWFQ oWguun145cEB93NxL4vZyHOg5OgtEod7M33uvOGCVssEj3ux8iv8aW96LJOmc6ph kWIlXieNnvsR9WUXk2mapoYsakwz0VkwL4rsCLQhHcbQbFhlnJbKXOtw9n1h7Q8V Fas0G695ZyE= =C8+V -----END PGP SIGNATURE-----

1 0

Online/offline transactions
by nelson＠crynwr.com 17 Dec '03

17 Dec '03

Don't worry about online vs offline transactions. The credit card companies are moving toward all online transactions. A company down in NJ called RAM Mobile Data is helping them on this. They have base stations in 90% of urban business areas. The radios are fairly cheap (even though they need an appropriate thing to plug them into) and the per-transaction charges are about a dime. So I would say that the important problem to solve is "how do we make accounts anonymous?" rather than "how do we avoid double-spending?" -russ <nelson(a)crynwr.com> ftp.msen.com:pub/vendor/crynwr/crynwr.wav Crynwr Software | Crynwr Software sells packet driver support | ask4 PGP key 11 Grant St. | +1 315 268 1925 (9201 FAX) | Quakers do it in the light Potsdam, NY 13676 | LPF member - ask me about the harm software patents do.

1 0

list of spiffy places to put your money
by Vincent.Cate＠FURMINT.NECTAR.CS.CMU.EDU 17 Dec '03

17 Dec '03

Dan Harmon: >Robert Hettinga wrote: >> [...] But we knew this already, from a list of spiffy places >> to put your money published here a few weeks ago. > >Maybe we could get the list republished? The list is in: ftp://furmint.nectar.cs.cmu.edu/security/banks And for easy access to all sorts of fun stuff, try mosaic on: ftp://alex.sp.cs.cmu.edu/links/security/vac-security.html -- Vince

1 0

Re: list of spiffy places to put your money
by Vincent.Cate＠FURMINT.NECTAR.CS.CMU.EDU 17 Dec '03

17 Dec '03

I wrote: >And for easy access to all sorts of fun stuff, try mosaic on: > > ftp://alex.sp.cs.cmu.edu/links/security/vac-security.html But I really meant to give the following URL (more fun): ftp://furmint.nectar.cs.cmu.edu/security/README.html -- Vince

1 0

Re: back to programming projects...
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> > On a related note, should encrypting remailers have the keys changed > > regularly? The RSA-IDEA combination isn't very suspectible to known > > plaintext attacks, right? Right. There are two sets of encryption used in the RSA-IDEA combo: 1) RSA, encrypting a random session key with a public-key algorithm. By definition, RSA-like public key algorithms can easily have known or chosen plaintext generated, since you can encrypt anything you like. RSA isn't susceptible to known-plaintext (except for verifying that a (presumably stolen) private key is correct, or by factoring very large numbers of very large prime numbers and checking them, which is computationally infeasible), and any other public key system that *were* susceptible to known-plaintext attacks wouldn't be very useful. Major breakthroughs in factoring theory could always change this, earning mathematical fame and fortune for the discoverer. Short RSA keys can be factored; you're better off with 1024-bit keys or longer for anything you're real serious about. 2) IDEA, encrypting the message itself using the session key. IDEA is not known to be susceptible to anything better than brute force, so known-plaintext attacks require trying 2**128 keys, which is computationally infeasible. Perhaps someone can find a hole in IDEA, but there's nothing major at present. 3) There's a third component that might use encryption - generating the "random" session key. Obviously, if you use the same session key to send different messages to different people, they might notice. If you use different session keys to send messages to people, but the session keys are easily derived from each other, and one recipient notices the pattern from several messages sent to him, he might try guessing the key for the next messages you send to other people. So use a genuine high-quality random number generator. There is one more special case, which is sending the same message to multiple recipients, with the message encrypted once with the session key, and multiple versions of the session key encrypted with each different recipient's public key. I've forgotten the details, but if there are more than e recipients, it's possible to crack this. (e is the encryption exponent, typically 3 or 17.) That's why PGP and other well-designed systems will pad the session key with random stuff before encrypting with RSA (which is an essentially free operation, since the RSA blocksize is much larger than the session key for IDEA.) Bill

1 0