December 2003 - cypherpunks-legacy

PGP commercial usage
by Dave Roberts 17 Dec '03

17 Dec '03

I have read and reread the documentation that is included with the PGP distribution (although my copy is over a year old now), and am still trying to work out if commercial use of 2.6ui is allowed outside the USA. Could someone elaborate for me, or perhaps point me to some up to date reference documentation. TIA - Dave. Dave Roberts | "Surfing the Internet" is a sad term for sad people. Unix Systems Admin | Get a board, find a beach, surf some REAL waves and SAA Consultants Ltd | get a *real* life. Plymouth, U.K. | -=[For PGP Key, send mail with subject of "get pgp"]=-

2 1

PoM 3: Angry Females
by John Young 17 Dec '03

17 Dec '03

Today's third article of The Washington Post series on "The Politics of Mistrust" is: "Angry Female Voters a Growing Force." Remember angry white males? Well, hear now from the women. They are more likely than men to have become anxious about the economy and distrustful of govermnent. But what separates men from women in this worried segment of the electorate is that they seem less concerned with their own plight than they are with the economic prospects for their children and their neighbors, including the poor. Next: The anti-government electorate. Series to date available at: http://www.replay.com/young/

1 0

x-app/pgp-encrypted
by gorkab＠sanchez.com 17 Dec '03

17 Dec '03

Does anyone know of a web server that uses PGP instead of SSL or STT or whatever is the new acronym of the week for secure web transactions? A server would have its public key available for anyone get. All transactions that need encrypting would be encrypted to the server by using the public key. PGP 3.0's API would make this even easier (or so I've heard). The reverse could also be implemented. By using some identifying characteristic of the user (maybe a user defined name) and the corresponding PGP key, data could be transmitted securely to the user. ---------- Brian Gorka Key fingerprint = ED 7D 78 7E 95 E8 05 01 27 01 A1 74 FA 4B 86 53

1 0

Re: KOH "Helpful" Crypto Virus
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 21:29 1/30/96, Laszlo Vecsey wrote: >> While you are at it, you might also want to pick up their famous collection >> CD-ROM full of virus code, live viruses, virus creation engines, etc. From >> their catalog: "For starters, you get a fantastic virus collection >> consisting of 574 families [...] about 3700 carefully tested and cataloged >> viruses in all...$99 + $5 S&H. >> > >I take it its completely legal to set up a Virus ftp site then? AFIK, in the US it is legal to set up a virus ftp site. I don't know if someone has actually done it. Don't count on it lasting. Some European countries have already outlawed virus (read knowledge) distribution. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: CONTEST: Name That Program! -- ESCROW
by Bill Stewart 17 Dec '03

17 Dec '03

ESCROW - Easily Stolen Creditcard Recorder Or Whatever Easily Stolen Creditcard Recording {Obnoxious, Obsequious, Obscure, Obfuscator } Widget (one objective is to find a way to insult the "Key Escrow" people, of course. And besides, this _is_ escrow - you're giving your credit card number to your trusted computer to hold on to and deliver to someone else.) BCCI - Basic Credit Card Interceptor CIA - Card Intercepting Agent NSA - Nathaniel's Security Attack, Network Stealing {Agent, Accessory}, Not Secure Anough Bill Stewart, 2555 W. Middlefield Rd #882, Mountain View CA 94043 T-Shirt Size: XXL Cash Size: Small Unmarked Bills or anonymous digital cash? #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # http://www.idiom.com/~wcs

1 0

Re: encrypted cellphones
by Bill Stewart 17 Dec '03

17 Dec '03

At 07:18 PM 1/30/96 -0500, prmoyer(a)magpage.com (Philip R. Moyer) wrote: >Well, I'm discouraged. I'm looking for strongly encrypted cellular telephones, >but I can't seem to find many. Are you looking for cellphones, or cordless phones? There aren't a lot of strongly encrypted cordless phones out there, but there may be some. Digital spread spectrum is probably the best that's easy to find; other kinds of "digital" phones usually pick a not-too-busy frequency and transmit digitized voice, which is mildly secure against other people using your base unit to make their phone calls, but doesn't protect your privacy against anyone with digital-capable equipment. The middle ground between cordless phones and cellphones includes cordless phones with ranges of about a mile (AT&T and some other vendors have sold them); they're typically in the $300-500 range, and use spread spectrum to avoid interference to/from other phones. It also includes phone services that can handle portable phones that you have to stay in one place to use (i.e. once you start your phone call, if you go out of range your call gets dropped rather than handed off to another cell.) I'm not aware of commercial service like this in the US, but there are wireless PBXs that work this way (which can be cheaper than stringing phone wires around buildings.) Cellphones, of course, can only (usefully) use encryption if the cellular service provider uses it (i.e. if the end that's listening to your radio transmission can decode it :-) American cell-phone providers don't. The GSM phones used in much of the world have encryption, but it's apparently not very strong. >I would really like to avoid using a GAK enabled product, >if there's any way to avoid it (even if it means paying lots of extra $$$). I'm not aware of any GAKed cordless phones, though I supposed there could be such. US cellular phones don't need GAK because the government's strong-armed the standards committees into using appallingly trivial crypto - none of this strong 40-bit RC for you :-) #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # http://www.idiom.com/~wcs

5 4

Silver Linings and Monkey Wrenches
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:13 AM 1/31/96, Futplex wrote: >Bill Frantz writes: >> One other small advantage I can see to using Lotus's crippled encryption. >> It disguises the fact that a message is actually (double) encrypted with >> PGP. Attackers have to break the 40 bits before they see the PGP encrypted >> data. > >I don't understand. Are you saying that there's a special benefit to doing >superencryption (GAK encryption over non-GAK encryption) when the GAK layer >is Lotus Notes ? Maybe what Bill was getting at is that a widely-deployed system of "fairly good" crypto (a la Clipper/Tessera) could have a silver lining. As many, many of us have noted for the past several years, if the authorities have to first jump through hoops (ostensibly), getting court orders, obtaining the LEAF/LEEF, etc., and only then do they determine that some kind of superencryption has been added, then this could make things worse for them than before. There are of course wrinkles: -- superencryption could be banned -- enforcement is problematic, and if there is only a tiny chance of catching that Fifth Horseman (the Superencryptor), then the penalties would have to be astronomically high, to satisfy the Basic Equation: (risk of getting caught) x (penalty if caught) > (payoff of the crime) -- interoperability. Hard to block it if done in text mode, PGP-style, but Lotus Notes will presumably be designed to make superencryption harder to do. And of course we can never cheer on a mandatory crypto scheme, for a variety of reasons. I'm just saying that we can look for silver linings, a way to make lemonade out of lemons. It may even be possible to nuke these NSA-enabled programs by publicizing ways of monkeywrenching them, as with superencryption. --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

ANNOUNCE: CryptDisk 1.2 for Macintosh
by wprice＠primenet.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm pleased to announce that version 1.2 of CryptDisk for Macintosh is now available. The Winner of MacUser's 1995 Shareware Award for Personal Tools, CryptDisk is a soft partition encryptor for the Macintosh. It lets you create "files" of any size which can be mounted as if they were hard drives on your desktop. These files are encrypted/decrypted on the fly using the IDEA encryption algorithm. IDEA is an internationally known algorithm that uses 128-bit keys. Most cryptographers consider it significantly superior to the government's DES standard. CryptDisk makes data security a seamless integrated component of your desktop allowing you instant access to huge numbers of encrypted files including the ability to play QuickTime movies directly from CryptDisks. IMPROVEMENTS IN 1.2: * CryptDisks can now be used on read-only volumes allowing CryptDisks to be mounted from CD-ROMs. Locking a CryptDisk in the Finder will also mount it as a read only volume. * New interface for specifying disk sizes allows arbitrarily sized disks from 64K on up. CryptDisks can now be sized to take up all the space on a floppy disk. * CryptDisk now dynamically informs the user for each volume how much contiguous space is available to create a CryptDisk before specifying the passphrase. * The public distribution now contains native PowerPC code for the application itself. Previously, only the driver was native in the public release. * A serious security hole was plugged that should affect only a very small number of users. Please follow the release notes to make sure you are not affected and to take appropriate steps if you are. * CryptDisk is now much more robust about mounting disks and will inform the user of the nature of any problems it has mounting disks. Information on obtaining the latest version is available to US and Canadian citizens from: ftp://ftp.primenet.com/users/w/wprice/README or by visiting the web page: http://www.primenet.com/~wprice/cdisk.html You may also be able to obtain it from other export controlled FTP sites around the US as it gets distributed. CryptDisk is shareware for $20. The source code is also available for an extra $20. Registered users receive access to beta versions of CryptDisk and are sent announcements about its status periodically. All CryptDisk release are signed by my public key: - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQBvAy8TO8gAAAEDAM4+RCTIFa3XIH67EgwsQa2pOE/1++pn4Kd7J9qiKmMRMfEp PU4bIvLhhMUltHgHcDYOlTbKJuf1mQ33PAHuSB8dp4bDJP5CE0yzCxm7tBbwcZIo 6uTlB9BNtgY6eimbWQARAQABtCBXaWxsIFByaWNlIDx3cHJpY2VAcHJpbWVuZXQu Y29tPokAlQMFEC/FQHtleYS4x6lm3QEBKbED/39GQWceDT8j5ClnsM9/A7fOC4I8 cf50N/Tb2gYpHsNUhZDq+FlWShytyTN0AFPPusogBwS9Ee9YeY97jaM5K0i7Kl2k CUmrR/QxMO0gZrZLEyYb5mIu0qJ7OuZEvsxACd01HptUfbf+yomH9qlebHJQaBmW hUiqm3D9n2vnP4Cz =plkF - -----END PGP PUBLIC KEY BLOCK----- - -Will -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMQ7FcU22Bjp6KZtZAQGRHwL/ZeVQ5dDmIrjd1AD25T4rPDizXpF50KoC uHvMSgRIE9Md5azfvLDADWF6ro0QlZ7WeeYRNTiEHBPDaGcrc49pOmJ6b79SWS3I YreAd9krnNSON4KSwqv9xnwPxVPDZkSL =8H43 -----END PGP SIGNATURE----- _______________________________________________________ | Will Price | wprice(a)primenet.com | | ________ | http://www.primenet.com/~wprice | | \ / | PGP key available by finger. | | \ / | | |____\ /______|_______________________________________| \/

1 0

Re: Lotus Notes
by Rich Salz 17 Dec '03

17 Dec '03

>So from who did Lotus license RC4? RSA, of course. I don't know the arrangements of RSA's license with Lotus, of course, but where did someone say that RSA mandated the keylength that Lotus uses?

1 0

Re: Lotus Notes
by Rich Salz 17 Dec '03

17 Dec '03

>I find this very interesting. RSA prohibits its licencees from using RSA >software with truly secure keylenghts. Hunh? I could find no mention of keylength or keysize in the RSAREF documents I had around. I'm at home now, but I also recall no mention of keysize or keylength in the license OSF has, either. /r$

3 2