December 2003 - cypherpunks-legacy

No Subject
by Douglas F. Elznic 17 Dec '03

17 Dec '03

How does an actual key signing work? What are some pointers and guidelines for one? -- ==================Douglas Elznic=================== delznic(a)storm.net http://www.vcomm.net/~delznic/ (315)682-5489 (315)682-1647 4877 Firethorn Circle Manlius, NY 13104 "Challenge the system, question the rules." =================================================== PGP key available: http://www.vcomm.net/~delznic/pgpkey.asc PGP Fingerprint: 68 6F 89 F6 F0 58 AE 22 14 8A 31 2A E5 5C FD A5 ===================================================

1 0

Re: January 22 Infoworld
by llurch＠networking.stanford.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- stainles(a)bga.com (Dwight Brown) kindly shared with the group: > >Nicholas Petreley's "Down To the Wire" column is a short take on the >insecurity of encryption schemes used by most commercial software. >There shouldn't be much new here to cypherpunks (he discusses the >vulnerabilities of WordPerfect, Word for Windows, Excel, and Compuserve's >CIS.INI, and uses some out of date examples "to protect the integrity of >current software": bad move, Nicholas), but it'd make a good introduction >for people who aren't familiar with the issues. > >Petreley also announces that InfoWorld is planning a "network-cracking >event", in which they plan to set up various network OS'es, make them as >secure as they can, invite "a small number of accomplished hackers" to >attack them, and publish the results. He says they're looking for >participants... > >InfoWorld's web site is http://www.infoworld.com. Petreley can be reached at >nicholas_petreley(a)infoworld.com. Unfortunately, Petreley's latest article isn't on the Web yet. But it's worth checking out last midweek's column, if only t see Sameer's name. This was only posted online. - -rich - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMQVSWSoZzwIn1bdtAQHMFAGAhQrzSNtsRsv79f9dTKeLDb1eYB5NHUHT ZJHY+unUNYCOhrJpxa0FRrQU8CxEKNV9 =zWhM -----END PGP SIGNATURE-----

1 0

Re: IPSEC == end of firewalls
by Frank Willoughby 17 Dec '03

17 Dec '03

At 03:01 PM 1/23/96 -0500, you wrote: >Frank Willoughby writes: Egads. Let's take this off-line & stop bothering the cypherpunks folks with this discussion. Those not interested in this thread are kindly requested to hit the <delete> key now. Thanks. 8^) >Yes, certainly. You can bribe someone, get physical access to >machines, etc. > >However, unless you know a way to crack RSA, it is unlikely that >a system using Photuris+IPsec will permit IP spoofing. I re-iterate, any system can be gotten around - and frequently will. As far as IPsec goes, it is probably just a matter of time before we see the first CERT Advistory (maybe in a couple of years) on this. Nothing is invincible. > >> The creativity of hackers is succeeded only by their motivation and >> ability to put many hours into trying to solve a problem. Including >> the word "probably" was deliberate. Kerberos was also thought to be >> secure - 'til it was compromised. > >Kerberos was compromised? When? By whom? Are you talking about >Bellovin's paper on weaknesses in Kerberos (most of which are >avoidable or fixed in K5), or are you talking about a real break? If >the latter, its the first that I've heard of it. Actually, I was refering to Bellovin's paper. Surely you don't think that the bugs that were discovered are the only ones which can be exploited and that Kerberos (or any other software product) is invincible? I don't. >> >> I suspect even when firewalls are embedded in the O/S, >> > >> >That would be somewhat meaningless. The point of a firewall, as others >> >here have noted, is that it is easier to secure one machine than five >> >hundred or ten thousand. >> Of course it is easier to secure one machine that 500 or 10K. However, NOT securing the 500 or 10K systems still leaves them vulnerable to network attacks. Providing the O/S with rudimentary firewalling capabilities helps to increase the security of those systems. Like many of my colleagues in the Information Security field, I have (grossly) modified/hacked/butchered my systems to provide the system with some rudimentary firewalling capabilities and the extra security I needed. In many cases, it meant taking advantage of strange behaviours of the systems to achieve the capabilities & results I wanted. >> I disagree here also. Systems by themselves are fairly useless. >> Their power (and main vulnerability) comes from their ability to >> network with other systems. A system connected to a network is >> vulnerable. The fact that a corporate firewall protects the system >> from the Internet in no way decreases the vulnerability of that >> system (and other systems) from *internal* attacks which can be as >> devastating as an Internet attack. >> >> Including firewall capabilities as part of the Operating System's network >> applications would help the system protect itself from abuses from the >> Internet - as well as from internal. > >These last two paragraphs are gibberish. > Beats me. They make sense to me. What part about Information & Network Security don't you understand? These are fairly basic concepts. I can go explain these concepts either in another forum or off-line via e-mail or phone (your dime, my time), but not here. This is the cypherpunks mailing list, not the firewalls mailing list. >You can't "firewall" every machine -- the act is meaningless. A >Firewall is a filter designed to protect you from bugs in the setup or >implementation of the software on the machines on the inside. What >would it mean for a machine to have "firewall software" in the >operating system? Systems already attempt to prevent unauthorized >access -- the reason you have firewalls is because that software is >sometimes buggy. "Firewall software" in the OS is a meaningless >concept. > Perhaps this is where you are getting mixed up. A firewall isn't just a box which you plug into a network between the company's WAN and the Internet - it's a capability. Many "firewalls" are systems which implement this capability. The main characteristics of the firewall are (paraphrasing rather liberally from Steve Bellovin's book): o The firewall is designed to protect an entity from a particular network connection. Usually, we think of the entity as being another network. In this particular case, we are putting in a firewall (or the ability to filter out what we don't to deal with) on the O/S itself to reduce the risks of potential attacks from a network (internal LAN, Internet, etc). o All traffic from the insecure network has to go through the firewall. Logical. If the "firewall" is a piece of software which is installed on the O/S to "filter out" certain network connections, then we have "firewalled" our system. Commercial firewall products such as: DEC's DECseal, Raptor's Eagle, V-ONE's SmartWall, etc, actually provide two levels of protection: 1) They protect the internal network from hazards of the Internet (or untrusted network) 2) The protect themselves from hazards of the Internet or other untrusted network (such as the internal LAN) Implementing a firewall as part of an O/S provides the protection mentioned in point number 2: It protects itself from the internal LAN to some degree. Granted not as much as it possibly can, due to the fact that you have users & applications on the system which aren't secure, however, an added measure of protection will be provided to the system. >Perry Perry, (and others who may be interested in this thread) This is my last mail on this thread in this list. If you or others would like to discuss this further, please feel free to send me an e-mail directly or join me in discussing this in the firewalls mailing list. Fellow cypherpunks, I'm sorry about the bandwidth used in responding to Perry's question. Unfortunately, it was addressed to the list and required a response from me. Thanks for your patience. Back to the subject at hand (cryptography) Best Regards, Frank Fortified Networks Inc. - Management & Information Security Consulting Phone: (317) 573-0800 - http://www.fortified.com/fortified/ <standard disclaimer> The opinions expressed above are of the author and may not necessarily be representative of Fortified Networks Inc.

3 2

DC-Nets and Noise
by Travis Corcoran 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Message-Signature-Date: Tue Jan 23 17:18:12 1996 In article <ad21e7f60202100476b7(a)[205.199.118.202]> tcmay(a)got.net (Timothy C. May) writes: > Date: Wed, 17 Jan 1996 01:38:47 -0800 > From: tcmay(a)got.net (Timothy C. May) > Newsgroups: omi.mail.cypherpunks > > (In any case, even for those who disagree, modern filtering techniques make > it trivial for the "gurus" to filter out all messages except by the several > of themselves, so I've never understood the point about how the list must > purge itself of "noise.") To support Tim's thesis, I'll point out that I use the following lisp configuration directives (among others) along with a news-highlighting package that I hacked up (gnus-live.el) in order to make reading this list (bridged to a newsgroup at my site) a much nicer experience. When I enter the newsgroup, the authors and topics that I like are highlighted. I read this 5% of the list in about 15 min, skim another 5%, and then delete the other 90%. - From my perspective cypherpunks seems to be pretty * HIGH * bandwidth! ------------------------------ snip! ------------------------------ (gnus-live "Subject" "GAK Hacks and Position Surveillance") (gnus-live "Subject" "Libertarian Party and Crypto Anarchy") (gnus-live "Subject" "List of reliable remailers") (gnus-live "Subject" "^[A-Z][A-Z][A-Z]_[a-z][a-z][a-z] *$") ; jya's <FOO>-paper articles (gnus-live "From" "Steven Levy <steven(a)echonyc\\.com>") (gnus-live "From" "Bruce Schneier <schneier(a)winternet\\.com>") (gnus-live "From" "payne(a)openmarket\\.com") (gnus-live "From" "tjic@.*openmarket\\.com") (gnus-live "From" "[a-z\.]+@.*openmarket\\.com") (gnus-live "From" "tcmay(a)[mail\.]?got\\.net") (gnus-live "From" "bsg(a)basistech\\.com (Bernard S\\. Greenberg)") (gnus-live "From" "rah(a)shipwright\\.com (Robert Hettinga)") ------------------------------ snip! ------------------------------ - -- TJIC (Travis J.I. Corcoran) http://www.openmarket.com/personal/tjic/index.html Member EFF, GOAL, NRA. opinions (TJIC) != opinions (employer (TJIC)) "Buy a rifle, encrypt your data, and wait for the Revolution!" PGP encrypted mail preferred. Ask me about mail-secure.el for emacs. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Auto-signed by mail-secure.el 1.006 using mailcrypt Comment: Processed by Mailcrypt 3.3, an Emacs/PGP interface iQCVAwUBMQVepoJYfGX+MQb5AQGC+AP/ZgiOzJKNuz3ifGCsS4VHEqbA74D1NuT3 auOTUPi7qIUuGLy4GlNGTdv+tPileNuk66FCzAQ8jU+WjVjcUrqFHLoiGCEAAPeX kOJYIf0McaMNO0osz4pJU3//BzHz9HAP2YF8kCfytA+nfPihOtMaCfSpal66ALfl o9kWE4ue1+Q= =fRtA -----END PGP SIGNATURE-----

1 0

re: [local] Report on Portland Cpunks meeting
by Weld Pond 17 Dec '03

17 Dec '03

>There was a key signing. It was a bit rough as for many of us it was our >first key signing. (I think Neal was the only person who had been to an >organized key signing.) Still, it went fairly well. Only a couple of >people brought their key fingerprints on disk instead of paper. As of >today, I have only recieved signed keys back from a couple of people >though... The next key signing will be done a bit differently. (Live and >learn.) There was also a suggestion for a nym signing at some point. This begs the question, "How would you conduct an efficient key signing given what you have learned?" I am in the process of organizing one and would like to get input as to the best way that this should take place. Should people bring key fingerprints and public keys on floppy? Would it be nice to be online and grab public keys off of a key server? How would you conduct a nym signing? Weld Pond - weld(a)l0pht.com - http://www.l0pht.com/ L 0 p h t H e a v y I n d u s t r i e s Technical archives for the people - Bio/Electro/Crypto/Radio

3 2

Re: Crippled Notes export encryption
by jpb＠miamisci.org 17 Dec '03

17 Dec '03

At 9:06 AM 1/23/96, Herb wrote: >Careful... what would YOU have done, with your customers demanding stronger >crypto today and you unable to legally give it to them? Umm - contract the crypto overseas somewhere it would be legal to export it from? Then import the code to the USA, with a press release to WSJ & NYT stating that American programmers were being put out of work by ITAR. Joseph Block <jpb(a)miamisci.org> "We can't be so fixated on our desire to preserve the rights of ordinary Americans ..." -- Bill Clinton (USA TODAY, 11 March 1993, page 2A) 2048bit-Fingerprint: F8 A2 A5 15 56 42 9B 16 3F BD 57 0F 8A ED E3 21 No man's life, liberty or property are safe while the legislature is in session.

1 0

Re: Crippled Notes export encryption
by matts＠pi.se 17 Dec '03

17 Dec '03

At 11.00 1996-01-23 -0600, Alex Strasheim wrote: >There's probably a big opportunity here for some enterprising cypherpunk >who's willing to move to Amsterdam (or who lives there already). Set up a >company that provides crypto guts and distribution services for American >software companies. You don't have to. PGP already exists in an international version as well as a US version. Just make your software call PGP to do all encryption and ask the user to download PGP from his favorite web site (on his side of the US border). matts

1 0

re: [local] Report on Portland Cpunks meeting
by Bruce Baugh 17 Dec '03

17 Dec '03

>This begs the question, "How would you conduct an efficient key signing >given what you have learned?" I am in the process of organizing one and >would like to get input as to the best way that this should take place. >Should people bring key fingerprints and public keys on floppy? Would it >be nice to be online and grab public keys off of a key server? How would >you conduct a nym signing? I'd go for somewhat clearer instructions than seem available. To wit: 1) Each participant, send your public key in ASCII armored form to the one coordinating the signing. 2) The coordinator will collate these into a single key file and have a list of key IDs and fingerprints. 3) Bring a printout of your key's fingerprint. You will read this off for others to compare with their copies of the coordinator's list. Have ID and such to show that you're you, or some other way of establishing that you are who you say you are. (In our case, everyone could be vouched for by at least one other person known to the others.) 4) The coordinator will [send by email|pass out on disk|whatever] the collated key file. Back home, sign each of the keys that actually got verified at the signing. Mail this back to the coordinator. 5) The coordinator will collate the results of this, and send you the new version. Add these. Now you've got your key and the other keys, all signed by everyone there. Grabbing keys off a server would certainly be doable, too. The key (no pun intended) thing is that people have their fingerprints in a useful form - so when we do it again, I hope Alan specifies printout, handwritten text, or something else that doesn't require a computer. And of course folks shouldn't bring their actual secret keys with them. The nym signing is an idle thought of mine. I have a nym key which is, at the moment, signed only by itself. I know friends of mine have nym accounts. if we could assemble a group of folks whom I can trust enough to link the nym and myself, it'd be nice to add some more signatures to the nym key, and vice versa. On the other hand, the accumulated signatures would probably point right back at any group talking about such a thing, like me right now. :-) Maybe it's infeasible. Bruce Baugh bruceab(a)teleport.com http://www.teleport.com/~bruceab

1 0

Re: IPSEC == end of firewalls
by Frank Willoughby 17 Dec '03

17 Dec '03

At 01:40 PM 1/23/96 -0800, Simon Spero allegedly wrote: >This thread definitely belongs as cypherpunks, as the whole point of the >discussion is to debate the limits of what cryptography on its own can >achieve. > Back, by popular demand... I didn't really want to continue this discussion here, but I received a couple mails requesting that I continue in this thread. I'm still uncomfortable with this, but I'll oblige. >What do you need as well as crypto before you can remove all firewalls? I don't think this will ever happen. However, as long as we're dreaming, here's my 2 cents worth on a good start for a secure environment would look like. It's not complete by any stretch of an imagination, but it's a start: o Start with a Secure Operating System - Secure Computing's firewall is a good example of this. They have done some pretty neat things with Type Enforcement. o Add in some decent authentication/encryption/verification mechanisms/digital sigs, etc V-ONE's SmartGate, Fortezza, & Persona would do nicely. Hand-held token devices such as the ones mentioned above should work well. Of course, the user interface to these should be user-friendly. o Throw in a secure method of communication PGP, PGPphone, etc - which is *user-friendly* and which helps automate & manage the key-distribution process (securely, of course) o Mix in applications which have been re-written to be secure, fast, intuitive, user-friendly & interact well with encryption (various kinds). o Add in a central clearinghouse (don't care where) where the latest key expirations/compromises can be checked automatically to confirm that the e-mail you just received is still valid also wouldn't hurt. o Combine the best capabilities of Checkpoint's (firewall) lower-level filtering capabilities with V-0NE's upper-level filtering capabilities and add these to the secure Operating System's network defense mechanisms o Add a good dose of IPsec (sprinkling lightly) to secure the pipe (kindly omitting the Watergate plumbers) o Add user-friendly single sign-on capability (Kerberos, et al) o Mix in heavy encryption with (ridiculously long) keys (say the number of grains of sand stretched end-to-end to make a light year). 8^) o Make all of the above user-friendly & easy-to-implement on a large scale 8^) Throw the ingredients into a pot & stir briskly. Like I said earlier, it's just a start & not a whole solution by any stretch of the imagination. It's probably a nice wish list, though. It'd sure be nice if it came true. (If you think the above list is optimistic, you ought to see my Christmas Wish List). 8^) 8^) 8^) > >Simon > >(defun modexpt (x y n) "computes (x^y) mod n" > (cond ((= y 0) 1) ((= y 1) (mod x n)) > ((evenp y) (mod (expt (modexpt x (/ y 2) n) 2) n)) > (t (mod (* x (modexpt x (1- y) n)) n)))) Best Regards, Frank Fortified Networks Inc. - Management & Information Security Consulting Phone: (317) 573-0800 - http://www.fortified.com/fortified/ <standard disclaimer> The opinions expressed above are of the author and may not necessarily be representative of Fortified Networks Inc.

1 0

KDM_tsu
by John Young 17 Dec '03

17 Dec '03

Cypherpunks is featured in a story in The New Yorker of January 29 on the Mitnick/Shimomura books by Littman and Markoff. The writer, Robert Wright, terms cpunks "an amorphous group that gets its name from its militant devotion to the widesrpead use of encryption." He refers to the comments here about Mitnick/Shimomura. More generally, Wright compares the two books, muses on career-boosting and Big Brother purposes of the media's melodramatic build-up of Mitnick and Shimomura, and outlines what might be done about Internet insecurity: 1. Police -- by legislation for officials to monitor cyberspace. 2. Privatize -- by IPs policing their own turf. 3. Encrypt -- like cypherpunks. He comments on PRZ's case, notes possible infowar-type threats and closes: Given that federal officials who would constrain encryption seem to be swimming against the nearly inexorable tide of technological history, these are the [cyber-terrorism] kinds of scenarios they have to conjure up to justify their efforts. And these scenarios aren't entirely implausible. As cyberspace expands, we may see reasons to try to give the government the sort of power it seeks here. But those reasons won't look much like Kevin Mitnick. KDM_tsu

1 0