December 2003 - cypherpunks-legacy

LET'S ROCK!!!!
by weinberg＠accessus.net 17 Dec '03

17 Dec '03

Ok, here is the situation. I have a person mad at me in one of my mailing lists. Turns out, this person was the owner of the mailing list! Well now I'm stuck, knocked out of the list. The owner can not see any of my mail, no matter how hard I try. I need some ideas to eather get through to her, or really fuck up the mailing list. Any ideas? WThinker P.S. please E-Mail directly to me. If you can. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ WThinker Social Deviant, W.W., and CHIPs expert! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

3 2

Re: Kid Gloves or Megaphones
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"stewarts(a)ix.netcom.com" "Bill Stewart" 16-MAR-1996 01:55:32.07 >Depending on the details of Ian's method, I don't think the debate >needs to be taken to the public, or even done - it may simply be a >done deal once the technology's out there. If Mark Twain Bank or >Merita Bank or the Federal <Exonive-Deleted> Reserve wants to offer Digicash(tm) with Payee-Non-Anonymity, they can always make it a contractual >requirement that their payees not use anonymity techniques in return for >being paid. Wouldn't the viability of such a clause depend on the anonymizing scheme in question? If the bank's cooperation isn't needed (i.e., going through a proxy), then such a limit would be empty. -Allen

1 0

Ecash API about to be released
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

With the Ecash API due to be released within a matter of days, I would welcome anyone on this list interested in building applications on top of such an API to contact me. The API will determine the calls to a libecash that DigiCash will provide. Try to send emails that contain "I would like to code..." and please don't send the ones that contain "it would be nice if someone coded..." :-) -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

Re: A funny story [noise]
by hoz＠univel.telescan.com 17 Dec '03

17 Dec '03

>... someone had left thier keys in the door lock. > So being the good cypherpunk that I am I jumped out and grabbed the >keys from the lock, then knocked on the window. The passenger rolled >down the window and accepted the keys back. Much to my surprise the >passenger was none other than Whitfield Diffie. Let me get this straight. You performed a key exchange with Whitfield Diffie? His keys were publicly available, and you securely transferred them back again? What a concept! Rick F. Hoselton (who doesn't claim to present opinions for others)

1 0

Re: NT's C2 rating
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:21 AM 3/21/96 -0800, David Loysen <dwl(a)hnc.com> wrote: >>The fine print says its insecure as soon as its connected to a network. >Ain't nothing fine about that print. An operating system or piece of >hardware may be C2 certifiable. But only a complete system in a specific >configuration can be certified as C2 compliant. The way I read the orange >book, no system with a network connection can ever be C2. A system with a network connection _can_ be C2 or higher rated - *if* it can adequately verify that it knows who its users are. That's hard, but it's doable, if it restricts access to a limited set of users, and has enforcement mechanisms to support it. For instance, connection over an encrypted, crypto-authenticated LAN which can enforce session ownership or trustably label all data packets could work; you'd typically do that with some kind of wrapper over IP or TCP and a bullet-proofed OS interface. It's far cleaner if you can do networking in user space rather than the kernel; I think the UUCP-equipped configurations for AT&T's B1-rated System V/MLS were part of the rated configuration, though it's been a while since I've been near that world. It's also easier if you limit each system (or at least level) to one local user per machine so machine ID tells you user ID. Compartmentd Mode Workstations were just coming out when I last did that stuff, so I don't know quite how much of the Red Book they implement, but they had goals of supporting networked above-B1 computing. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissible." - US government statement on China... "SigFiles of Unusual Size? I don't believe they exist!"

1 0

Re: Dorothy Denning attacks Leahy's crypto bill
by Bill Stewart 17 Dec '03

17 Dec '03

Hey, wait, are Jim Bell and I supposed to be in fairly complete agreement on something? :-) At 12:09 AM 3/20/96 -0800, jim bell <jimbell(a)pacifier.com> wrote: >At 09:45 PM 3/19/96 -0800, Declan McCullagh wrote: ... >>From: denning(a)cs.cosc.georgetown.edu (Dorothy Denning) >"Far easier"? That's an odd statement, because the export of encryption is >easy with or without restrictive laws. How much trouble is a "criminal or >terrorist" going to risk by violating a few measly export laws? It probably would make it much easier for Designated Scary People to use crypto without having to take special precautions. If IPv6 security was part of the standard Microsoft Win2000 networking stack (ok, without major botches, and with a convenient user interface :-), and PGPphone came on the Soundblaster N+1 installation disk, all those tax-evaders and pharmaceutical wholesalers and, and, and father-rapers could talk to their accountants in private and chat with each other about tax-evadin' and father-rapin' and _crime_, and it'd be much harder to Federalize their money and arrest their clients. And a lot of that probably won't happen if Microsoft and Soundblaster have to make domestic and international versions of their software. >>I am concerned that the proposed legislation responds only to a loud >>cry for assistance and is not the reasoned and practiced position of >>our multinational corporations. Well, certainly not the position of MNCs who are big players in the military-industrial complex. But what's this _our_ terminology? In particular, cryptography offers the only technical defense against the ability of computers to centralize and correlate information from many sources, which is one of the primary threats to personal privacy today, and MNCs are generally supportive of centralizing any information they can. >> At the International Cryptography >>Institute, which I chaired in September 1994 and 1995, our discussions >>did not find that this unrestricted distribution of encryption >>technology was required to satisfy business objectives. Well, I'd expect not. It wasn't exactly an unbiased crowd; there were a couple people there on Our Side, but it was largely people who agreed with Dr. Denning on the political objectives, and the business contingent included companies like TIS which _sell_ so-called escrow software. > >Notice that we've already established that this bill in no way produces an >"unrestriction distribution of encryption technology." Wish it did, but it >doesn't. Yeah. >>The Commerce/NSA study did acknowledge that the existence of foreign >>products claiming strong encryption could have a negative effect on >>U.S. competitiveness. However, by allowing encryption services to be >>sold separately from the applications software that uses them, CAPIs >>will make it extremely unlikely that general-purpose software will be >>substantially effected by export controls. Which side is Dr. Denning _on_ here? At present, software using CAPIs is not exportable under the ITAR, since the CAPI is a "component of a munitions system"; is she now advocating legalized export of software using government-approved CAPIs only? >Notice that she seems to be making policy for the government, yet again. She seems to have been the big public advocate of it for years.... >>Export controls are often blamed for the lack of security in our public >>infrastructure. Sure - the fact that Microsoft Office built-in file protection isn't even up to RC4/40 standards isn't primarily the fault of export controls, but the lack of a clearly defined official export standard doesn't _help_ them make a business case for including good encryption. >>Encryption policy is a difficult and often emotional issue. > >It's only emotional because of malicious and counter-productive efforts by >government, and government suck-ups like Denning. She certainly hasn't helped, and she's aided and abetted and provided assistance to the folks like Freeh who want to stop free speech and privacy, but it's also emotional because many of us really don't want our privacy compromised and our freedom of speech restricted. The Bill of Rights isn't perfect, but it's far better than what the government is using today, and it's got provisions like the 9th and 10th amendments to remind readers that it's just a set of examples of civil rights, not an exhaustive inventory. >>I will be pleased to meet with you and the committee for comment and >>questioning, or to assist in any way I can with the development of a >>balanced approach to encryption legislation. I've always enjoyed discussing issues with people who offer an outrageously extreme set of proposals, then back off to a still offensive level and call it "balanced". The status quo already gives too much effective power to the government, and she's proposing to give in where it the alternatives are unenforceable and strenghten her position where there's new power to be seized. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissible." - US government statement on China... "SigFiles of Unusual Size? I don't believe they exist!"

1 0

Re: A funny story [noise]
by David E. Smith 17 Dec '03

17 Dec '03

At 08:52 PM 3/21/96 PST, hoz@univel wrote: >>... someone had left thier keys in the door lock. >> So being the good cypherpunk that I am I jumped out and grabbed the >>keys from the lock, then knocked on the window. The passenger rolled >>down the window and accepted the keys back. Much to my surprise the >>passenger was none other than Whitfield Diffie. > >Let me get this straight. You performed a key exchange with >Whitfield Diffie? His keys were publicly available, and you >securely transferred them back again? What a concept! Weren't those his _private_ keys, though? You probably shouldn't be able to transfer those in a secure system. ObCrypto: would the transfer of private keys be necessarily a good thing? Or would a transfer of "reputation" be a better idea? Example: suppose, and this is _very_ hypothetical, that the President of the U.S. has a PGP key. (We can dream, eh?) Would it be wiser to transfer that key from one President to the next, or have the President sign the President-elect's new key? (I'm stretching here - feel free to killfile me.) dave --- David Smith, Intellecutal Terrorist http://www.midwest.net/scribers/dsmith/

1 0

Mac Keystroke Capture
by kkirksey＠appstate.campus.mci.net 17 Dec '03

17 Dec '03

I've always warned my network users and other clients against using software that "protects" you from data loss by capturing your keystrokes, e.g. NowSave, Last Resort, and Thunder 7's Ghostwriter feature. NowSave 6.0 adds a new wrinkle to the problem, as I discovered yesterday when I installed the Now Utilities 6.0 public beta. NowSave 6.0 has a new feature: when you re-start your machine after a system crash, NowSave automatically opens at startup a SimpleText file containing all the keystrokes it captured before the crash. My machine crashed yesterday during an internet session, and when it re-started I was greeted with a SimpleText window containing my internet account password, two CryptDisk passphrases, and my PGP passphrase. This is not a good thing. But it could be a good thing, IMHO. Most people install these programs without realizing exactly what they do. With this new version of Now Utilities, users are likely to be greeted with a screenful of information, as I was, that they would just as soon not have saved anywhere on their hard drive. This kind of incident would, hopefully, encourage them not to use key capture software. One can only hope... Ken = Ken Kirksey | If Pat Buchanan is elected President of the = = Mac Developer & | United States, at least the trains will run = = Resident Cypherpunk | run on time. = = kkirksey(a)appstate.campus.mci.net - Me =

1 0

Re: ASN.1 Tools/Compilers
by John Lowry 17 Dec '03

17 Dec '03

Not to toot my own horn, but take a look at http://ests.bbn.com for a free ASN.1 to C++ compiler that runs on solaris 1 and 2 and has been ported (with relatively little effort) to Windows. Free for non-commercial use. Commercial use terms have unrestricted rights for runtime. > From <@relay3.uu.net:owner-cypherpunks@toad.com> Fri Mar 22 06:36 EST 1996 > Mime-Version: 1.0 > Date: Fri, 22 Mar 1996 01:12:27 -0800 > To: cypherpunks(a)toad.com > From: tim(a)dierks.org (Tim Dierks) > Subject: Re: ASN.1 Tools/Compilers > Cc: frederick_zarndt(a)novell.com (Frederick Zarndt) > > At 10:29 AM 3/21/96, Frederick Zarndt wrote: > >Does anyone know of reliable ASN.1 tools/compilers suitable for use on a > >wide range > >platforms? > > > >I already know about the following tools/compilers, but I would appreciate > >comments > >anyone cares to make: > > > > ISODE (who to contact for the DE?) > > Snacc > > > >Thanks. > > > >Frederick Zarndt > >Senior Software Engineer > >Novell, Inc > >122 East 1700 South > >Provo UT 84606 > >USA > > > >Tel 801 429-3348 > >Fax. 801 429-3500 > > I've recently been looking into this as well. I haven't looked at ISODE > yet. Snacc looks reasonable, but can't handle big integers (> 2^32), which > may make it hard to use for certificates, due to embedded RSA keys; I > haven't yet checked to see what could be done about this. It's free; the > compiler is under the GNU license, but the runtime is redistributable > without fee or onerous restriction. > > I also spoke to a company in NJ, Open Systems Solutions (609.987.9073), but > their licensing terms were too expensive for my purposes. Their product > runs on a lot of platforms and sounds very complete, but requires a > licensed run-time environment. They currently support C and Pascal; C++ is > coming. Their development environment starts at $11,500. > > I'm also searching for an ASN.1 product. We can afford to pay for a > compiler, but we need unrestrained distribution of the runtime in source > form. Any information would be greatly appreciated. > > You may wish to examine the ASN.1 homepage @: > http://www.inria.fr/rodeo/personnel/hoschka/asn1.html > > Best, > - Tim > > Tim Dierks - Software Haruspex - tim(a)dierks.org > Hastening the heat-death of the universe since 1968. > > >

1 0

executable e-$ code for DOS
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

Hi. I would like to toy around with a e-cash program. I got Magic Money but it is only sources and I have no compiler. Is there a location I where I can get the executables for DOS? I want to do nothing serious with it, so the security aspect of pre-compiled code does not bother me too much. Thanks JFA Public Key at http://w3.citenet.net/users/jf_avon Jean-Francois Avon <jf_avon(a)citenet.net> 2048 bits key ID:C58ADD0D 1996/03/01 fingerprint=52 96 45 E8 20 5A 8A 5E F8 7C C8 6F AE FE F8 91

2 1