December 2003 - cypherpunks-legacy

Re: E$? Whatever
by jim bell 17 Dec '03

17 Dec '03

At 10:23 PM 2/27/96 EST, Dr. Dimitri Vulis wrote: >A GLIMPSE INTO THE FUTURE OF MONEY, AS CITI SEES IT >Known inside Citicorp as the Electronic Money System, the bank's >version of electronic currency for cyberspace is the result of >four years of mostly top-secret toil by technical wizards who >report to Colin Crook, the New York money-center's top technology >officer. You know, if I were a bank, I'd think twice before I hired a person named "Crook" as the "top technology officer." Jim Bell jimbell(a)pacifier.com

1 0

Re: Numbers don't lie...
by Bill Stewart 17 Dec '03

17 Dec '03

At 07:23 AM 2/27/96 -0800, jamesd(a)echeque.com wrote: >At 11:18 AM 2/18/96 -0500, A. Padgett Peterson P.E. Information Security wrote: >>Finally, no cost is allocated to the sustem required to program/evaluate >>the ponderings of these 100's of ASICs. As anyone who has ever programmed >>a massively parallel computer (which is what they are talking about in their >>brute force machine, it is the boundary communications that kill you. > >Again: Interprocess communication is trivial. A brute force key cracking >machine is *not* a general purpose massively parallel computer. Yeah - the interprocess communications includes handing out keyspace (pretty simple, especially if each chip has a way to find out its name), broadcasting the cyphertext and known plaintext, letting the winner forward the successful key, and broadcasting the "you can stop now" message. Back when the AT&T DSP-32 was new and hundred-CPU machines were exciting, AT&T made a box that had 128 DSPs in a binary tree; each one had a couple flavors of RAM and some communications glue. It would work just fine for this sort of applications (except that the DSP32 was a floating-point DSP and what you really need here is big integers.) And the Inmos Transputer, with its 4 communications channels, would do just fine as well - you could either build the things into large grids or build a large ternary tree, or get fancy and build cubes of 6 chips that you make hypercubes out of, or whatever. A modern version of the same chip, built out of FPGAs or ASICs with enough memory and program on chip, would blaze just fine. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281

1 0

Diffie-Hellman for Matchmaking?
by Dimitris Tsapakidis 17 Dec '03

17 Dec '03

sci.crypters and cypherpunks: This is a followup to my "Dating Problem" question I posted on sci.crypt, some months ago. I am trying to find or design some matchmaking protocols (and implement one of them, eventually) that have all the nice properties, like privacy and fairness. I came up with two or three candidate protocols, but they all rely on the Diffie-Hellman "common key" for mutual authentication. I haven't seen it used for such purposes in the literature, and I am suspicious. The setup is the same as in Diffie-Hellman key exchange. Assume global: prime n and primitive element g mod n. All the participants have a pair of (secret, public) keys, where public=g^secret mod n. By common key I mean g^(secret_a*secret_b)mod n. Person A is interested to match person B, so he computes g^(AB)mod n. B is interested in X, where X may or may not be A, and calculates g^(BX)mod n. Now, they compare these two "common keys" either using some Zero Knowledge scheme that ensures fairness (at no point one party has significantly more information than the other) or through a Trusted Third Party. If they are the same, then this means X=A, so A and B have a match (e.g. a date). The common keys must remain secret (hence the ZK above): if g^(BX)mod n "escaped" to the public, then the real X would find out that B is interested in him. Is anything wrong with this, specificaly with the use of the "common key"? Dimitris -- Dimitris Tsapakidis PGP keyID: 735590D5 dimitrt(a)dcs.rhbnc.ac.uk MSc in Information Security, This space reserved Royal Holloway, University of London for future use. Origin: Thessaloniki, Macedonia, Hellas

2 1

RE:
by brad＠his.com 17 Dec '03

17 Dec '03

At 7:16 PM 2/27/96, Blake Ramsdell wrote: > This also reminds me of a time when a call went out for the MOSS implementors > to raise their hands (on the pem-dev list) -- and only Ned Freed answered. > This could very well be because MOSS implementors don't hang out on the > mailing list, which is somewhat strange since the timeframe in which this > question was posed was very close to the release date of the specification > (10/95). In fact, Dave Crocker recently said that "Clear, corporate > commitments from product vendors ought to confirm or dispel the rumor of the > MOSS demise", and we have not had *any* vendors step up since that statement. Interestingly, I talked to the folks developing the Simeon IMAP-based MUA (the only cross-platform IMAP MUA that I know of; if anyone else knows of one, please tell me), and they told me that they knew of the conference and instead decided to focus on getting the next version of their client out the door. And they're claiming to be implementing MOSS, S/MIME, and PGP (PGP/MIME, I hope?). Pretty surprising answer, coming from a company that I think will be so radically affected by the outcome of that workshop and the continuing work done by the same community of folks. I don't even know if they've got someone subscribed to this mailing list (it sounds like they don't). I have no idea if the rest of the PEM/MOSS commercial community is like this, but I'm not sure it bodes well for them in particular. I mean, if it really is a matter of them being small enough that one key guy can't afford to take a few days out (like both Qualcomm and Z-Code did), then maybe they're too small to survive the shakeout. And if it's a matter of them not caring, well.... > Don't get me wrong -- I don't consider myself to be prejudiced away >from MOSS. > Near the end of the meeting, I specifically pointed out that: First we had > PEM, and it died. Now we have MOSS, which is 47 pages long, and less than > *four months* old, and we are calling it dead also. Somebody else made this observation about the age of MOSS at the workshop, and as I recall Dave's response was something to the effect of "Uh, it's actually a heck of a lot older than that, the difference is that the RFC has only been on the streets for four months." -- Brad Knowles, MIME/PGP: brad(a)his.com comp.mail.sendmail FAQ Maintainer <http://www.his.com/~brad/> finger brad(a)his.com for my PGP Public Key and Geek Code The comp.mail.sendmail FAQ is at <http://www.his.com/~brad/sendmail/>

1 0

Re: PGP to PC mail integration
by Matts Kallioniemi 17 Dec '03

17 Dec '03

At 05:09 1996-02-28 -0500, lmccarth(a)cs.umass.edu wrote: >Mike Ingle writes: >> Instead of messing with user interfaces, you set the POP and SMTP >> addresses of your mail program to "localhost". You run locally a Visual >> Basic program that sits on ports 110 (POP) and 25 (SMTP) listening for >> connections. The VB program is configured with the addresses of your >> real SMTP and POP servers, and acts as a proxy. >> >> When your mail program retrieves POP mail, it goes through the VB >> program, and the VB program decrypts any PGP mail it sees. When it >> sends mail, the VB program encrypts any mail it has a PGP key for the >> recipient of. > >Would you be stuck if you wanted to send something unsigned and/or >unencrypted ? Nope. The VB program should give a popup window where you can enter your passphrase to sign/decrypt the message. Such a popup can have a <NO> button if you don't want it to do its thing. But how often do you receive an encrypted letter for which you have the secret key, and don't want the letter decrypted? Actually, I was already working on such a program when these posts came by, so any suggestions to functionality are welcome! Matts

2 1

Re: PGP source code book sold out!
by frantz＠netcom.com 17 Dec '03

17 Dec '03

On Tue, 27 Feb 1996, John Gilmore wrote:[..] > The PGP Source Code book is now out of print. We assumed there > would only be limited interest in the source code, so we printed > only 1500 copies. When we sold out of this run (just last month), There are still copies on the shelf at Computer Literacy Bookshops (408)435-1118 (they mailorder too). ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: "Physical Reality"
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

> > Boiled down to its essentials, this argument can be expressed by the lyrics > > of the song "Bad Boys" as used as the theme song of the reality TV show > > "Cops." For those who no longer participate in the previous culture, they > > are: > > > > Bad Boys, Bad Boys > > Whatcha gonna do? > > Whatcha gonna do when they come for you? > > Bad Boys, Bad Boys At 08:41 AM 2/28/96 +1100, Mark wrote: > the bad boys are the > criminals, the song is about what will you do when the cops come for you. > The cops are not the "bad boys" in the song. Trust me. Clearly, one of the purposes of the show "Cops" is to intimidate. Even though the police have total editorial control they often show thuggish and perhaps illegal behavior. (though they also sometimes show cops displaying hard to believe forbearance) Since the show is, in part, intimidatory, it seems reasonable to suppose that the cops are the bad boys who are going to come for you. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

PGP to PC mail integration
by Mike Ingle 17 Dec '03

17 Dec '03

Mail user interface integration remains the biggest barrier to widespread PGP use. As long as it's inconvenient each time you want to send a mail message, people won't use it. Existing efforts to fix this are usually mail-program specific (elm-pgp port, some Pegasus and Eudora hacks) and/or not terribly convenient (ViaCrypt and similar win-pgp front ends). It seems to me that people are attacking this problem from the wrong end of the pipe. Almost all internet mail programs (Eudora, Pegasus, Netscape, Exchange client with Internet mail, you name it) talk to a POP server and an SMTP server. They allow you to specify the hostnames of each. Instead of messing with user interfaces, you set the POP and SMTP addresses of your mail program to "localhost". You run locally a Visual Basic program that sits on ports 110 (POP) and 25 (SMTP) listening for connections. The VB program is configured with the addresses of your real SMTP and POP servers, and acts as a proxy. When your mail program retrieves POP mail, it goes through the VB program, and the VB program decrypts any PGP mail it sees. When it sends mail, the VB program encrypts any mail it has a PGP key for the recipient of. Once this is set up, the user burden is near zero, and it works with any winsock-based mail program. What do you think of the idea? Mike

2 1

Re: Simpler solutions (was Re: Stealth PGP work)
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:45 AM 2/28/96 +0000, "Deranged Mutant" <WlkngOwl(a)UNiX.asb.com> wrote: >Adam Back <aba(a)dcs.ex.ac.uk> wrote: > >[lots of stuff about stealth PGP snipped] > >This seems to be quite a lot of effort that complicates things. It >would be simpler for two stealth communicators to use other means of >hiding the fact that a message is PGP'd... (1) stego, in various >forms, if done properly would make most attackers not suspect a PGP >message is inside something, One point of stealth-pgp is to make an encrypted message you _can_ safely hide with stego. Since the Bad Guys can take your stegofied picture, destego it, and see the string ------ BEGIN PGP CONTRABAND DATA, you can't get away with saying "no, that's just a picture of my cat, blurred a bit because he was moving", which you can if you use a true stealth version of PGP or other crypto program. Another major point is to make PGP messages that you can post in public, which the recipient can decode, but which _don't_ say "From 007 To 86 and 99" in the headers. That's easier, but still a bit of work. >(2) use another encryption program, with >a known key shared by two users, that turns the PGP message into pure >unmarked 'randomness', >[.... (3) a pad-based variant ...] You're down to key exchange; the big reason for public-key systems is to avoid it. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281

2 1

RE:
by galvin＠eit.com 17 Dec '03

17 Dec '03

At 8:19 PM 2/27/96, Blake Ramsdell wrote: >> Further there is a good implementation of MOSS. > >Is there a version that can be used in commercial applications? There is for >PGP, S/MIME, and (I think) for MSP. Beauty is in the eyes of the beholder I'm told. TIS will happily license their source code to you. In this case you get the advantage of seeing and actually trying what you will get in advance with no hassle whatsoever. As to whether that is a better choice than writing the code yourself, well, you get the idea. Jim ---------------------------------------------------------------------------- James M. Galvin galvin(a)eit.com VeriFone/EIT, PO Box 220, Glenwood, MD 21738 +1 410.795.6882

1 0