December 2003 - cypherpunks-legacy

GTE's Virtual CA
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

GTE's CyberTrust For Web Electronic Commerce Washington, D.C., 6 February 1996 -- GTE officials say that the company's new CyberTrust electronic commerce program will allow companies for the first time to handle most of the CA (Certification Authority) function by themselves, by means of secure Web servers. At the Comnet press conference, reporters were told that GTE, a partner of both Mastercard and Visa, will introduce its new "Virtual CA" capability for Webmasters in conjunction with a trio of related services. The four new services from GTE are aimed at financial institutions, online merchants, and government agencies, as well as at the corporate and consumer markets, said Charles S. Walton, Jr., CyberTrust's program director, speaking at the Comnet press event. One component of CyberTrust, called the Electronic Commerce Service, will provide an "infrastructure" for credit card companies using new secure payment standards for online transactions, Walton added. Another new service, the Partner Forum, will provide online test services and tech support for developers and integrators in the electronic commerce arena. Through GTE's new Cybersign service, GTE will directly handle the maintenance of public key certificates, as well as the issuance, renewal, and revocation of these certificates. But with Virtual CA, GTE will manage certificate management only, permitting Webmasters at subscribing companies to do their own issuance, renewal, and revocation of certificates. Walton acknowledged that GTE's new suite of services will be targeted at the same market now dominated by Verisign. But the GTE services, he maintained, will be differentiated on the basis of general "operational environment," as well as by Virtual CA. In a follow-up interview later, Walton said that GTE, a long-time consultant to Mastercard, began working with both Mastercard and Visa last November on development of SET (Secure Electronic Transactions), a new joint standard for online credit card transactions. GTE, he added, hosted both Mastercard and Visa last week at GTE headquarters in Needham, Massachusetts. Aside from GTE, Mastercard and Visa, other partners in the SET effort include Verisign, IBM, Microsoft, Netscape, SAIC, and Terisa Systems. GTE had previously helped Mastercard to create the SEPP standard, according to Walton. GTE's new CyberTrust, first announced as supporting SEPP, will now support its "successor," SET, he noted. CyberTrust will also comply with the SSL protocol for Web security. During the press event at Comnet, Walton reported that Cybersign and Virtual CA will implement a "dual card, split RSA key design," with "strong access controls." The two systems will use PCMCIA cryptographic hardware token technology and X.509-certificate-compatible software. Virtual CA, he continued, will initially be available on Sun Solaris-based secure Web servers, but will be ported to Windows NT-based secure Web servers by the end of 1996. End users will be able to access Virtual CA through Netscape browsers. The Web server-based service will introduce "verification at the server level, which is really where you want it to be," asserted the GTE official. On-site Webmasters are in a particularly good position to confirm that users "are who they say they are," the journalists were told. As a result, Virtual CA will use a technique called "pre- verification," in which the Webmaster, or RA (Registration Authority), will validate and approve users' certificate requests before the requests go to CyberTrust. CyberTrust will then return a certificate for the end user, in the form of an algorithm, either direct to the end user or through the RA. Companies subscribing to Virtual CA will receive custom home pages for certificate data entry, and for issuing, renewing, and revoking certificates, Walton said. The CyberTrust program director said that the special PCMCIA hardware will be used at the "CA level" only, and will not be required by either end users or Webmasters. No "actual cards" will be issued to, or needed by either group, he added. GTE plans to begin offering both Virtual CA and Cybersign in the second quarter. --

1 0

Re: Reasons in support of crypto-anarchy WAS Re: Why am I wrong?
by lunaslide＠loop.com 17 Dec '03

17 Dec '03

>>>1. Governments will no longer be "necessary," if they ever were. >>2. Protection will no longer depend on having a "government." >>>3. Anonymous networking technology will protect our rights, to the extent >>>they can be protected. >>>4. Your statement, "...anarchy is a massive step backward..." is absolutely >>>incorrect. > >>That's fine that you believe the things, but for acceptance by others you >>will have to provide support for your position. I, personally, would like >>to see your premises so that I may evualuate your claims. You may indeed >>be correct in your assessment. > >Well, here's my "Assassination Politics" essay. > You all should have a copy of this, so I won't waste bandwidth posting it again. If you didn't read it, I encourage you do to so, no matter what your initial reaction is. It is a facinating proposal and it brings to mind a multitude of questions about privacy, anonymity, ethics and the nature of human beings in general. Now, in respose to Mr. Bell. As I stated above, I found your proposal absolutely facinating, to say the least. As with many others, I'm sure, it struck an initial chord in me that tempted me to disregard it out of hand. However, I was determined to read it through thoroughly and without bias. I have done so and I have the following thoughts about it. The plan it self is feasable, and with more thought, all the wrinkles could be ironed out. I am impressed with the detail of it. I would be curious to see what an open minded laywer would say about it's legality under close scrutiny. However, I must point out, and I'm sure you realize this, that it would not be adopted by the public at large for some time to come, or more likely never. There are too many people who believe that it is wrong to take a life for any reason and that no action justifies death. I count myself among these people. The barganing power of death is indeed great, but some would still realize that a vote would make them responsible, at least in part, for a murder. There is an ethical stumbling block here that may never be overcome. Further, I don't believe you have enough support for your claim that other targets would not be sought. It is one thing to say that enough people won't vote for someone picked out of the phone book, but what if the predicted individual is a doctor who performs abortions, or an activist for gay rights (or *against* gay rights), or Bill Gates ;-). There are also the individuals who are trying to bring about change in society that is unpopular, but is still in the interest of humanity. Abraham Lincoln surely would have been killed by this system, for example. Also, big corporations would be able to cut down their political enemies such as envornment activists, fair business practice activists and competetors' high ranking officers. Even if only one person in charge of such a business were to put out a digital contract, he would have no problem suppling the money for the hit. People who have tried to make changes for humanity that went against the social norm at the time are revered today for their efforts. In this system, they would likely be assasinated. Nothing would ever change because people are always afraid of change and afraid of things they do not understand and the people who fight that ignorance will likely be killed. Your statement that Organization B, the one that collects for any target, is not well supported. They would still be doing *plenty* of business, in spite of the higher prices. Organization B would thrive, make no mistake. And the people who would be getting in on all the action are the rich. All the politicians who oppose their interests would be hit immediately. Anyone trying to change the status quo would be eliminated. Why do you think we are still using combustion engines in the last decade of the 20th century? We could have had better alternatives 20 years ago, but the oil companies would loose out so they have either bought out these ideas or had killed the inventors and bought their patents and are sitting on them. A capitalist economy does not always breed competition that brings out the best and most desireable products because some advancements are bad for all the businesses involved in that market. Big business and the rich would benifit the most from the Assination Politics model. But what if OrgB stops taking donations for "predictions" for "Non-Initiation Of Force Principle" (NIOFP) offenders? Some other organization will crop up to take their place AND the people operating OrgB could be hit for their "ethical" action. There is simply too much opportunity offered by OrgB type organizations for people to pass up. They will not let the higher prices stop them. If the answer to that problem is to regulate the lists of "victims", then the next question is who are these people who are regulating and what guidelines are they following? Who decides who gets to be the moderators? Could there be exceptions to the (NIOFP)-offender standard? Who would they be and why? Could the organizations be anonymous as well? How would the money be transmitted to them in that case? How can we trust or redress grivances with an organization? There are still many concerns regarding the organizations. If the organizations fail, the whole system fails. That's all I can think of at the moment. Like I said before, once one can get past the bias, it is an endlessly intriguing proposal bristling with questions and issues concerning our very beings. This is precisely why I would like to know if I may take a copy of your proposal to my ethics class. I think this is a great topic for discussion and I would like your approval. Respectfully, Jeff Conn lunaslide On the meridian of time there is no injustice, only the poetry of motion creating the illusion of truth and drama. Henry Miller -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQBvAzD3EHEAAAEDAMVwZzXozPjX18mCenA5fJsdWZXcrhJCxPR+SoVCmR7d4ZVU mwITzPTHo/GyLvJrWyk5YdhheczyY2VSawaMrCN/nWA7K9lwAylbKyPxqBhRYJ3C 2wi2uD5LY2wypNOQyQARAQABtB5KZWZmIENvbm4gPGx1bmFzbGlkZUBsb29wLmNv bT6JAHUDBRAw+1bqS2NsMqTTkMkBAQkTAwCersFbCyk8O0MbGlNcZDAe24CLEWQ0 0C5EHni33W76UsG1bybcLsuMH6HVwLF7IqZivnzc7wkujYPQvCqn8HEYYTld8V9V Cou4dOvA8kV7rHvAn/LuLx7DRruLFrRoPSk= =OIT9 -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Need a "warning" graphic of some kind for CDA
by Greg Broiles 17 Dec '03

17 Dec '03

At 01:48 PM 2/4/96 EST, you wrote: >"David K. Merriman" <merriman(a)arn.net> writes: >> >Now that we all have web pages that are naughty and might be seen by >> >little children, I'd like to hve some kind of a graphic that can >> >universally be seen as a "Warning: The following material is unsuitable >> >for children and close-minded twits". (or words to that effect). >> >> Hmmmmm. Maybe a doll with an international 'no' sign superimposed? > >Either the 'no' sign (red crossed circle) or a wide red cross over one of: > rattle > baby bottle / pacifier > disposable diapers (with contents visible) > safety pin? How about the circle-slash "no" symbol superimposed on the Constitution? -- "The anchored mind screwed into me by the psycho- | Greg Broiles lubricious thrust of heaven is the one that thinks | gbroiles(a)netbox.com every temptation, every desire, every inhibition." | -- Antonin Artaud |

2 1

Re: has this been on cypherpunks? (fwd)
by zinc 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- cpunks, i particularily like this quote: "Role Of Encryption For added protection, users of Anonymous Re-mailers tend to encrypt their messages just in case one of the remailing links are compromised. PGP (Pretty Good Privacy) encryption is favored because it is freely available and easy to use. A typical digital signature would look like this: [...]" hell, i'd like to see these guys hang out on alt.security.pgp answering questions all day... pjf, 'easy to use' my ass "Those that give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -- Benjamin Franklin (1773) finger for PGP key zifi runs LINUX 1.3.57 -=-=-=WEB=-=-=-> http://zifi.genetics.utah.edu -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by mkpgp1.6, a Pine/PGP interface. iQCVAwUBMRha1E3Qo/lG0AH5AQESIwP9HUKUmvlVqOteom2xWLKW7az4V1lH4lex e3MJMK1e5a6C2JRbs6JeoEj2o3hUIKwcF8DF0HmnAeETfXyM2qtY6PdkLQlWy+Qh 9w3BDi+m6cxy7TmADcLyBtg0bc6imdJGHyeTtcsT7XUyrKlf/O+o6QX9ip4FOqZz 5/OZ8j8KwK0= =6K1U -----END PGP SIGNATURE-----

1 0

Re: paper on remailers in the intelligence community
by tbyfield＠panix.com 17 Dec '03

17 Dec '03

At 12:37 AM 2/7/96, Timothy C. May wrote: >But more seriously, any mil-info complex effort to demonize remailers must >of course invoke one of the Horsemen. At this time, "Russian Mafia >terrorists" is the putative focus of joint U.S.-Russian intelligence >activities, and was even the plot of the latest James Bond movie. Yup. <sigh> In essence, remailers and other anonymizing/pseudonymizing techniques democratize "deniability"--the MO of circumventing the law that states have arrogated to themelves. Institutional dynamics aside, the proverb that "A man reveals his character best when describing that of another" applies to governments, too, I think: we can expect governmental and paragovernmental anti-anonymity arguments to focus on the most extreme ways in which governments have used their power to modulate identity--i.e., law-breaking. I don't want to start up a Cypherpunk[TM]-approved PR debate, but I do think we (quote unquote) might do well to think a bit about some arguments that can sidestep the arguments we can reasonably anticipate. Plenty of folks have very recognizable nyms, so... nym as PO box, nym as a way of tracking who's tracking you (like misspelling your name this or that way when you know the organization you're giving it to will sell it), nym as backup (for when your mailserver's down [yeah, I know...]). Anonymity, after all, is only one of many possible uses for a remailer. No one could possibly require that your email address bear your first and last names in recognizable form--so what's so different about a nym? In terms of the fundamental issues, these are sidelights, obviously, but they could come in handy. US culture has a deep-seated mistrust of unstable identities (viz., the "con man") going back a century or more; fighting on behalf of unstable and multiple identities will be an upstream swim. But we might do pretty well arguing that remailers are more similar to than different from net.staples--nutty email addresesses, multiple addresses, etc. Sometimes the best way to win an argument is to refuse to have it. Ted

1 0

Re: has this been on cypherpunks? (fwd)
by lmccarth＠cs.umass.edu 17 Dec '03

17 Dec '03

I just sent this to the remailer operators' list, but it may be of interest here too. I think Tim or Lucky or someone suggested something like GAI (Government Access to Identities) here a while back.... Forwarded message: > Lance writes: > > Is it just me, or does this guy make a convincing case for the need for > > remailers without ever showing one shred of evidence to back up his fear > > mongering? > > Exactly. Ted Byfield mentioned on cpunks that it reads like a free > association session. I find the piece quite schizophrenic. (IANA > psychologist :) They alternate between fairly eloquent arguments for the > roots of remailers in fundamental principles of freedom and privacy, and > the bizarre "anonymity as a disease" analogy. > > I hypothesize that the Strassmann & Marlow paper is meant to lay the > groundwork for some sort of eventual Government Access to Identities proposal > (which would more likely be termed "identity escrow" by the Feds). It's > about the only way I can reconcile statements like the following > (juxtaposed by me, not them): > > "...it becomes politically unacceptable to suppress remailers > as potential sources of criminal acts. Such absolute > prohibitions would never pass through a legislative process...." > > "As in the case of [various diseases] it will take disasters > before the public may accept that some forms of restrictions > on the electronic freedom of speech and privacy may be > worthwhile." > > "We trust that this will be seen as a useful contribution to an > already raging debate of how to find a balance between the > desirable and the dangerous." > > I suspect the key phrases there are "absolute prohibitions", "some forms of > restrictions", and "find a balance". > > I'm still surprised that the paper takes such a conciliatory stance towards > anonymity and pseudonymity. Strong crypto and GAK-free crypto have big > corporate constituencies, but I see strong and GAI-free anonymity/pseudonymity > as much more vulnerable. I'm tempted to declare this a guarded preliminary > success of the cpunks remailer community -- we are seen as a viable player > in "the game", potentially capable of forcing at least a compromise on > nymity issues. > > -Lewis >

1 0

Re: How to prevent a virus infection :-)
by Deranged Mutant 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Lucky Green wrote: > > Just watched an "expert" on Bay TV (SF Cable). He stressed that websites > without firewalls pose the risk of spreading viruses when downloading files > from them. A GIF was being downloaded in the background... (chuckling) I remember when one of the Michaelangelo scares was going on (hey, is it that time of year again?) the place where I was working got a telemarketing call selling anti-virus software. String that one up with conspiracy theories... - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMRimFioZzwIn1bdtAQHyIAF/YKlGvU0JeP9V4+VoDHksXn0SCd6wE86x 1HptGTwiHjH1I/BhjRLyY9xiCFqNLwSf =Kqj2 -----END PGP SIGNATURE-----

1 0

Re: Reasons in support of crypto-anarchy WAS Re: Why am I wrong?
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 03:43 AM 2/7/96 -0800, lunaslide(a)loop.com wrote: > Now, in respose to Mr. Bell. As I stated above, I found your proposal > [assasination politics] absolutely facinating, to say the least. > [...] > However, I must point out, and I'm sure you realize this, that it would not > be adopted by the public at large for some time to come, or more likely > never. There are too many people who believe that it is wrong to take a > life for any reason and that no action justifies death. This, of course, explains why war is impossible these days and why the public is outraged whenever the government executes a murderer. :-) --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

A Warning Re: Hardware RNG support for PGP 2.63
by Deranged Mutant 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- rngaugp(a)alpha.c2.org wrote: > Here is the README file that comes with the modifications. > - ------------------------------------------ > Hardware Random Number Support for PGP. > PGP 263 international version > > Ever get tired of typing in keyboard timing strokes while generating a > PGP key? Ever want to use PGP unattended, but be foiled because there is > no one there to type the keyboard timing strokes? > > Ever wonder if PGP's method of generating random number might have some > subtle flaw which would expose it to cryptanalysis?[..] Ever wonder that a random number device driver or hardware will have a subtle flaw??? Relying on the /dev/random NOISE.SYS driver now while it's still in beta isn't nec. a good idea. For experimentation, sure. I'm also rather concerned as to how this version of PGP handles it. Very much so. The current and latter versions of NOISE.SYS parallels the Linux random.c driver in that there are two devices, /dev/random and /dev/urandom... the older versions (pre version 0.4) will return as many bytes as are requested (from /dev/random) whereas the current version returns only as many bytes as are conservatively estimated to be "truly random". If you are using the older NOISE.SYS /dev/random or the newer version's /dev/urandom for key generation then essentially you're using a pseudo-RNG based on SHA rather than real random data. The implementation should try to get as many bits as are needed from the driver and then request some keystrokes, collect more data, etc. until you have enough bits (advantage over older PGP method? You only need to sample from driver, and not worry about processing raw samples yourself; driver also samples from other sources than keystrokes as well...) I'd be wary of relying on NOISE.SYS or any similar driver for PGP-key generation until the driver gets more thorough examination; I'd also be VERY wary of an improper use of the driver. - --Rob (who wrote NOISE.SYS). - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMRjSNSoZzwIn1bdtAQEn+wF/ZxQKqOCRyKrJjmdtYtE2kVG6v+3NkOOb 84JMpWkpzkMVe8L7LHr7bLdgzkVxDB+8 =m54+ -----END PGP SIGNATURE-----

1 0

Re: [noise] the individual and the tribe
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

>Rob said: >> ... in the sense that >>tribal societies are individualist. Jean-Francois Avon (JFA Technologies, QC, Canada) wrote: >I absolutely don't agree. The subordination of the individual to the tribe >is fundamental of their vision of the world. Some tribal societies are individualist, some are not: Most of the myths and legends of the Australian Aboriginals have a lone ranger character as the hero or villain, or at least most of the ones that I have read feature a person whose life is dramatic or heroic in part because he is tribeless, perhaps for the same reason as most heroes in Disney cartoons are orphans. Individualism is not about the >personnal opinions, it is about the vision of Man as an entity in itself, not >a type of cattle that owe his service to the collectivity of the tribe. > >Crypto makes the tribe (and it's sorcerers) loose their grip... :) > >JFA > > > --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0