December 2003 - cypherpunks-legacy

RE:
by galvin＠eit.com 17 Dec '03

17 Dec '03

At 8:19 PM 2/27/96, Blake Ramsdell wrote: >> Further there is a good implementation of MOSS. > >Is there a version that can be used in commercial applications? There is for >PGP, S/MIME, and (I think) for MSP. Beauty is in the eyes of the beholder I'm told. TIS will happily license their source code to you. In this case you get the advantage of seeing and actually trying what you will get in advance with no hassle whatsoever. As to whether that is a better choice than writing the code yourself, well, you get the idea. Jim ---------------------------------------------------------------------------- James M. Galvin galvin(a)eit.com VeriFone/EIT, PO Box 220, Glenwood, MD 21738 +1 410.795.6882

1 0

Re: RE: [ Death of MOSS? ]
by galvin＠eit.com 17 Dec '03

17 Dec '03

At 12:44 AM 2/28/96, Brad Knowles wrote: > And if you look at what I've said previously, it is my firm belief >that if we are to succeed in giving users a truly interoperable secure >email standard, then said standard must be fully and completely >integrated into MIME and do everything it does in the proper MIME way, >as opposed to just being security grafted on. Allow me to make a contentious statement: MOSS is the only secure email protocol integrated with MIME. You see, integrated to me means that the base is security aware. MIME is only security aware when the security multiparts are used. In all other cases, MIME is not security aware. The use of the application content-type with experimentally defined subtypes gives the appearance of MIME being security aware, but it provides nothing more than a mechanism for carrying a protected object. In addition, the fact that the security service itself must do a callback in order to support recursive services, unlike MOSS which uses the security multiparts framework and thus lets MIME do all the work it was designed to do, further supports my position. Jim ---------------------------------------------------------------------------- James M. Galvin galvin(a)eit.com VeriFone/EIT, PO Box 220, Glenwood, MD 21738 +1 410.795.6882

1 0

RE:
by galvin＠eit.com 17 Dec '03

17 Dec '03

At 8:16 PM 2/27/96, Blake Ramsdell wrote: >> James M. Galvin said: >> It's my impression that MOSS suffered from lack of representation at this >> workshop. I got that view from at least 6 different people, so I believe >> it to be true. That said, I think it's unfair to declare its demise. > >I agree with this impression -- I think that MOSS was not represented in any >meaningful way. The question that begs to be asked is: why? Your comment seems to suggest that the only way to meaningfully contribute to a discussion of technologies is via face to face meetings. While I agree there is a certain expediency to face to face meetings, insofar as we're talking about email shouldn't we be able to use the technology for our deliberations? I'm reminded of my participation in X.400 implementor meetings where I derived great pleasure from the fact that you couldn't communicate with most of the members via email at all, let alone X.400. In response to your question, I don't think there is any one answer any more than I think there is any one reason why PEM failed. However, I don't think the question is moot, since no decision has been made yet and at least I haven't given up yet, although I know it's uphill from here. Jim ---------------------------------------------------------------------------- James M. Galvin galvin(a)eit.com VeriFone/EIT, PO Box 220, Glenwood, MD 21738 +1 410.795.6882

1 0

Re: "wisecrackers" by Levy in March Wired
by dmandl＠panix.com 17 Dec '03

17 Dec '03

At 6:16 PM 2/27/96, Vladimir Z. Nuri wrote: >I sent this to <steven(a)echoync.com> but the address bounced. ^^^ Hmmm...When did Echo move to York New City? -- Dave Mandl dmandl(a)panix.com http://www.wfmu.org/~davem

1 0

Re: Internet shutdown Feb 29? (fwd)
by Charles Gimon 17 Dec '03

17 Dec '03

Brief article on last summer's Minnesota outage is available at http://www.info-nation.com/burnin.html . There's a link in there (I think it still works) to a local IRC log of U of M people trading info during the blackout. *********************************************************************** --The Interview-- | gimonca(a)skypoint.com George Clinton: "Suck on my soul, | Minneapolis MN USA and I will lick your funky emotions!"| http://www.skypoint.com/~gimonca Dave Letterman: "Yuck!!" | A lean, mean meme machine. *********************************************************************** ---------- Forwarded message ---------- Date: Wed, 28 Feb 1996 08:11:36 -0600 (CST) From: Kevin L Prigge <Kevin.L.Prigge-2(a)tc.umn.edu> A few months back, some winos took most of Minnesota off the net for a couple days. Upset with being kicked out from under a bridge, they started a fire that took out the main fiber cable from downtown to MRNet + the U of M. Backup? Due to a mistake at a CO, the backup link was routed thru the same area, and was also burned. Interesting scrambling as nameservers puked and died.

1 0

But liars sure can...
by A. Padgett Peterson P.E. Information Security 17 Dec '03

17 Dec '03

I rote: >>Finally, no cost is allocated to the sustem required to program/evaluate >>the ponderings of these 100's of ASICs. As anyone who has ever programmed >>a massively parallel computer (which is what they are talking about in their >>brute force machine, it is the boundary communications that kill you. Bill wreplied: >And the Inmos Transputer, with its 4 communications channels, would do >just fine as well - you could either build the things into large grids >or build a large ternary tree, or get fancy and build cubes of 6 chips >that you make hypercubes out of, or whatever. A modern version of the same >chip, built out of FPGAs or ASICs with enough memory and program on chip, >would blaze just fine. Oh I agree it *can* be done (thouse who follow RISKS and SCI.CRYPT will note that I was talking about cascadable single bit boolean processors and DSPs for brute force engines several years ago. We seem to be miscommunicating a bit though. I agree that such an engine is easier to design than something like a MASPAR or Alliance since each set of kerchunkers can operate independantly once started and all that is necessary is to be able to signal success and pass the found code. Still, the logistics of initializing each processor set (and ones I have dealt with have primarily been matricies of single bit devices), providing communications, power, and control is a non-trivial task: once you have a general purpose ASIC, you are only half way there, particularly if it is to be usable for more than one fixed algorithm/key length. Will further stipulate that a single PC (8088 even) would probably be sufficient to load/start/retrieve data from such a beast but design of the I/O would still need to be accomplished. Not difficult, just necessary. My point was not that it couldn't be done, but that the costs mentioned were probably off by a factor of at least two and that for a 40 bit code, setup for each run would probably take longer than the cracking ( assuming a court order from Podunk could even get in the queue for a U$300 million device in an even more expensive facility - students in a University will *always* be able to do things faster/cheaper than a corporation/government). Doing something *once* is a lot different from putting it into production. Warmly, Padgett

1 0

Re: PGP to PC mail integration
by jpb＠miamisci.org 17 Dec '03

17 Dec '03

At 12:18 AM 2/28/96, you wrote: >Instead of messing with user interfaces, you set the POP and SMTP >addresses of your mail program to "localhost". You run locally a Visual >Basic program that sits on ports 110 (POP) and 25 (SMTP) listening for >connections. The VB program is configured with the addresses of your >real SMTP and POP servers, and acts as a proxy. > >When your mail program retrieves POP mail, it goes through the VB >program, and the VB program decrypts any PGP mail it sees. When it >sends mail, the VB program encrypts any mail it has a PGP key for the >recipient of. > >Once this is set up, the user burden is near zero, and it works with >any winsock-based mail program. What do you think of the idea? Brilliant. You could even set it up so that it also proxies your smtp out going, and compares each destination to a list of people you want to automatically encrypt to. I suggest a list because while you may have some people's keys in your keyring, for a variety of reasons they may not want to receive trivial pgp mail. Joseph Block <jpb(a)miamisci.org> "We can't be so fixated on our desire to preserve the rights of ordinary Americans ..." -- Bill Clinton (USA TODAY, 11 March 1993, page 2A) PGP 2048bit-Fingerprint: F8 A2 A5 15 56 42 9B 16 3F BD 57 0F 8A ED E3 21 No man's life, liberty or property are safe while the legislature is in session.

1 0

PGP 3.0/4.0
by A. Padgett Peterson P.E. Information Security 17 Dec '03

17 Dec '03

Subj: Re: ViaCryptPGP 4.0?! (was Re: PGP integrated into Z-Mail) For those who have joined us recently, PGP v 2.6x is essentially free for individual use under MIT's (and the gov's) exemption/permission for the use of patents helt at the moment by PKP/Cylink/RSA (not even going to get into that mess). For commercial use a license to use the RSA and IDEA components is necessary through fate or some such ViaCrypt obtained such a license before PGP became a Big Thing and with Phil's blessing formed a commercial unit to distribute what is called ViaCrypt PGP. Because of what I do, I spent the money to purchse the first product, ViaCrypt PGP v2.4 (PGP 2.3 analogue). In due course, when PGP v2.5 and 2.6x came out, Viacrypt followed suit with v2.7 and then 2.71 for Windows and I upgraded. Because the next "public" release is scheduled to be 3.0, the next ViaCrypt which will include the corporate featured (with escrow capability) Business Edition will be known as 4.0 with versions for PC, Mac, Unix, and VMS. Both 2.7 and what I have seen of 4.0 (not released yet) have a switch that allows backwards compatability if desired (know back to 2.3, not sure about earlier ones). The most compelling features of 4.0 are the floating toolbar or "Enclyptor" which allows use inside any Windoze program that supports cut & paste (have used it inside a Telnet session with a remote host and inside ccMail) and the "group" feature. Have no connection with Viacrypt other than knowing some of the people and "putting my money where my mouse is". Warmly, Padgett

1 0

DES hooks in Linux kernel
by Ian Goldberg 17 Dec '03

17 Dec '03

(aeb(a)cwi.nl is included, as he seems to be the last person to have touched loop.c before it was put into the standard Linux kernel sources, but I may be wrong.) The file loop.c, included in recent Linux kernel sources, includes calls to DES routines, such as: #ifdef DES_AVAILABLE static int transfer_des(struct loop_device *lo, int cmd, char *raw_buf, char *loop_buf, int size) { <snip> des_ecb_encrypt((des_cblock *) tmp,(des_cblock*) loop_buf,lo->lo_des_key,DES_ENCRYPT); <snip> } #endif AFAIK, the presence of these hooks (even if surrounded by the ifdef's) makes this file illegal to export from the United States. Its presence on ftp sites in the US could get someone in trouble. - Ian "this ITAR thing is really silly..."

1 0

Using PGP for pseudo random numbers?
by Sean A. Walberg 17 Dec '03

17 Dec '03

2 1