December 2003 - cypherpunks-legacy

Re: "Louis Freeh is a Cocksucker"
by jimb＠alpha.c2.org 17 Dec '03

17 Dec '03

Alan Horowitz says: > OVer on alt.something.somesomething-or-other.whitewater, there > are people keeping track of dates and events. It has been > noticed that Freeh was sworn in _just before_ Vincent Foster's > body was found. That's certainly very suspicious! I bet that Freeh *is* Vince Foster with plastic surgery! -- JimB "I feel good!"

1 0

SAIC Offers SET
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

SAIC Is @Yourservice for Secure Electronic Transactions on the Internet San Diego, 29 Feb 1996 -- Science Applications International Corp. (SAIC), a leading provider of information and network security services, today announced that it will offer a wide range of business solutions based on the new Secure Electronic Transactions (SET) standard for safeguarding bankcard purchases over the Internet. Through its @Yourservice business unit, SAIC will provide consulting, integration and digital certification services to financial institutions, network operators and merchants doing business over open networks. SAIC helped Visa and Microsoft in their pioneering effort to bring security to on-line commerce, and played a major role in crafting the SET standard, working for Visa and in close association with MasterCard and other SET technology partners. SAIC has long been one of the largest and most trusted suppliers of information, network and data security solutions in the world, as well as being a major information systems integrator for government and commercial clients. "We're bringing these skills, and our understanding of SET complexities such as digital signatures, public key cryptography, certificate management and network protocols together to help businesses transition smoothly into the world of electronic commerce," said Nick DiGiacomo, who oversees @Yourservice. "What we offer is seamless integration from the cardholder's computer over the networks to the merchants and banks, and back again. We're here to make this easy." --

1 0

Re: PGP to PC mail integration
by tomservo＠access.digex.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- An entity known as "E. ALLEN SMITH" <EALLENSMITH(a)ocelot.Rutgers.EDU> writes: > You'd put something into the mail message itself that would tell it >"don't encrypt this" and/or "don't sign this". Hmm... you'd need to put in >messages to be signed and/or encrypted your passphrase, or have it gotten some >other way... which doesn't look very safe. exmh on Unix systems goes the other way. It adds a header line that includes the sender and recipient, plus the action to be performed ("encrypt," "sign" or "encryptsign"). No header, no encryption/signature. I'm reasonably sure it strips off that line before it passes the message off to sendmail -- but I usually don't send messages to myself that way. :- ) For incoming mail, it looks for standard PGP structure and figures out what it needs from the user. If, for instance, you don't have a public key on your keyring, it allows you to send a mail message to a server to grab it - - - otherwise it performs the operation and shows you the results. If what you're doing requires a password (signing or decrypting), it pops up a window to ask you for it. When it's done, it prompts you to press Return and disappears. It was written in tcl/Tk, but some of it may be applicable for what you want to do. (Sorry, I'm not an expert on either.) Scott -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMTZk4evEnOI8TfM9AQGiKwL6A+XCKH68tfqJNE6cDRR7KClbXuSchBF3 UW6lY5ZzQIkZSTEKLm6EK2uEg6h9wafO38Dzm61PAdLZ0te67Kqtb4V4seTW4k4M +YBLuUAiutVgZayj2OdrWjvlc43M495w =GrDt -----END PGP SIGNATURE-----

1 0

PARTY PICTURES!
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, At long last pictures from my costume party are available on the Web. The URL is: http://www.c2.org/party/masquerade/ Special thanks are in order to Sameer for donating the Web page and loading it up with all the pictures. See Sameer for all your Internet privacy needs. Bart Nagel spent several hours scanning, cropping, digitally editing and sweetening the original pictures I took. Bart (and I) want you to contact him for all your *expensive* image editing needs. He can be reached at egon(a)aol.com or barticus(a)well.com. Thanks to Gracie and Zarkov for the use of their lovely homes. And a big thank you to all the attendees who made the party a might to remember. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

Re: going back to stone axes
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:32 PM 3/1/96 +1100, Steven Legg <s.legg(a)trl.telstra.com.au> wrote: >DistinguishedName wasn't defined the way it was because of ASN.1. I'd always assumed it was just the ugly X.400 email naming convention. >No one at Telstra Research would want to replace DistinguishedName with >a byte string because of all the constant reparsing, cutting and splicing >that would entail. We would end up writing more code, not less. Given the >sort of heavy duty processing we do to DNs, trying to pack a DN into a >string is considered brain dead. Those rich semantics matter to us. I don't see how a DN is any better than an Internet-style Domain Naming Service name, except that it puts a bunch of pre-defined labels on subdomain parts which can generally be guessed from context and aren't very relevant to computer programs. Compare joeuser(a)purchasing.fnord.edu.au vs. /FN=Joseph/Ln=User/NN=Joe/OU=Purchasing/O=First.National.Organization.- [for].Research.[and].Development/S=Academic/C=AU/ Is there really any additional information in the latter, except possibly some detail you could have looked up with a "whois" request? #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281

1 0

HYP_not
by John Young 17 Dec '03

17 Dec '03

3-1-96. NYT: "Speed Record: One Trillion Bits a Second." Fujitsu, NTT and AT&T have succeeded, each separately, for the first time in transmitting information at the rate of one trillion bits a second through optical fiber. "Microsoft Backs Ratings System For the Internet." The system, called RSAC-1, will enable parents and teachers to censor Web sites due to violence, sexual themes, nudity or offensive language. Other companies support the PICS form of censorship in terror of market- share loss to the tele-vigilantes. [Gates told a Mexican sports stadium audience that no real money can be made on the Internet until it has the speed to interactively out-hypnotize television.] HYP_not

1 0

Problems with certificates.
by A. Padgett Peterson P.E. Information Security 17 Dec '03

17 Dec '03

I suspect the real danger would come from issuance of duplicate certificates. MasterCard conrols MarterCard numbers by issuing all of them (and I suspect that there is coding to separate MC from Visa from AmEx). Today, each person generates their own PGP key. While it is unlikely that any two will match, it is likely that at some point some two will match (see matching birthdays in a bar - number is less than you would think). Next rage might well be "vanity" PGP keys. While at the moment it is not known how to create a specific match key to a sequence, if you generate enough keys, there will be some interesting sequences found. Possibly some PGP signatures will even be in violation of the CDA (now that should start a rush 8*). For some time I have been concerned about the scalability of PGP. It works well in small groups but after trying once to create a 6,000 member keyring (took over three days on a 386 & was several meg when done) I decided that areas were going to need work to be a real anyone/anywhere/anytime mechanism. Not saying I have a good answer, just that at some point there will be a problem. Warmly, Padgett

2 1

Re: a brief comparison of e-mail encryption protocols
by A. Padgett Peterson P.E. Information Security 17 Dec '03

17 Dec '03

Derek rites: >Oh, of course the central keyserver model would disappear, but I'm >still trying to design a system which is as compact as possible. I disagree but then my worldview is different. For personal use the compact distributed system is workable however when you start thinking in terms of a large distributed organization, the quanta changes. Mention was made of the difficulty of handling 20,000 keys. I am looking at over 80,000 today and over 200,000 tomorrow *for a single organization*. For quantities like this, a hierarchial system of management seems inevitable. First, I am not about to give up my personal PGP key, it is trustworthy and effective for my needs. It is not necessarily incompatable with an organizational structure. However *for the organization* something else is needed. I can see a future in which the bulk of the population has only two keys: their own and the punlic key of their post office (not talking USNail - private ones though not saying the US might not operate one as well). Messages are composed with addressing and encrypted with the PO key. PO decrypts message key (NOT necessarily message but that will have to rely on trust - nothing will stop double wrapping anyway), checks address list, retrieves key for each adressee, adds header & sends copy (may use single mailing for group at distant post office but that is getting ahead). If recipient key is not found, adressee wil be removed from list and notice sent back to originator. If plaintext is desired, special operation will be required. As noted, a hierarchal mechanism will be needed for key retrieval - only local keys and "frequent fliers" will be kept locally. Not new concept, just not used by post offices that I know of today. Will need a bit of fleshing out and expect the end-state to be 2-4 years out but is a good time to think about it. Warmly, Padgett

2 1

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

John Pettitt writes:: # The SET transaction spec is now available on www.visa.com (and presumably on # www.mastercard.com although I didn't check). Norman Hardy writes: > I am unable to find the specs. Anyone have an URL? http://www.mastercard.com still works for me. I haven't looked at the Visa site in a few days. -Lewis

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

At 1:17 PM 2/29/96, Housley, Russ wrote: >Jim, in what way does the end user distinguish between the MOSS-like >integration and the S/MIME-and-MSP-like integration? It seems to me that a >good user agent implementation provides the same services to the user. Russ, since you weren't present at the workshop I'll repeat the very first words I said in the presentation I gave there. Functionally, from a user's perspective, there is for all practical purposes no difference between any of these technologies. Today I would add that we could pick one out of hat and just move on. However, there are differences in the technologies. Some are easier to implement, some are more flexible, some perform better, and the list goes on. We need to explore those differences to develop a criteria for evaluating the technologies so we can provide the best possible solution to the user community. I proposed one possible criteria in my presentation, by no means the only one and by no means complete. Jim ---------------------------------------------------------------------------- James M. Galvin galvin(a)eit.com VeriFone/EIT, PO Box 220, Glenwood, MD 21738 +1 410.795.6882

1 0