December 2003 - cypherpunks-legacy

Re: Word lists for passphrases
by camcc＠abraxis.com 17 Dec '03

17 Dec '03

At 02:12 AM 7/5/96 -0700, you wrote: :Greg, : :>Are there any publically available word lists which contain just about :>every word in the English language? : :I would try this site out. It is very complete and should fill the bill. : :ftp://sable.ox.ac.uk/pub/wordlists/ : :Good Luck! : : :-William Knowles : erehwon(a)c2.org : Finger for public key : I am not sure of your purposes, but I suggest you take a look at Arnold Reinhold's Diceware page. http://world.std.com/~reinhold/diceware.page.html The list it contains certainly is not "every word in the English language," but the list he offers is large and well set up; I load mine from Wordpad. It is part of a randomness system he espouses. Alec

1 0

Re: Lack of PGP signatures
by geoff＠commtouch.co.il 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: bshantz(a)nwlink.com, markm(a)voicenet.com, cypherpunks(a)toad.com Date: Fri Jul 05 17:10:11 1996 On 7/3 Brad Shantz Wrote: > Once upon a time last year or the year before, Tim May posted why he > doesn't use PGP very often. And I have always stood by that same > sentiment. Yes, it is a good encryption product, but it is not > integrated seamlessly into other applications. Tim, feel free to > whack me if you think I'm speaking for you. If, as cypherpunks, we > want to spread the use of strong crypto, we need to have a better > interface than what currently exists on PGP 2.6.2. I strongly urge anyone who uses PGP on a regular basis to take a look at Pronto Secure. It is a fully featured Windows e-mail client with complete & seamless PGP integration in its native implementation. Security features include: Single click for encrypt sign or decrypt, on the fly authentication, key management, talks to the keyservers, intuitive & flexible certification / trust management, automated key exchange between Pronto Secure clients & more. The product is in final beta & this will probably be the last opportunity to get a free registered copy. We believe that we have a pretty secure e-mail client. However before releasing Pronto Secure to a less security aware public, we would like to submit the product for additional scrutiny by the members of this list. With this objective in mind, we have decided to extend our special offer to beta testers: Any tester providing us with feedback on the product will automatically be eligible for a free copy of the soon to be released Pronto Secure 1.0. For a detailed specification see http://www.commtouch.com/s-mail.html To check out what our existing beta testers have said about Pronto Secure: http://www.commtouch.com/testers.htm To apply for the beta send signed mail to secure(a)commtouch.com. Also please attach your PGP key. I take this opportunity to thank all members of the list who have up to now assisted in beta-testing the product. Your input has helped make Pronto Secure into what we believe is a truely usable secure e-mail client. - --------------------------------------------------------------- Geoff Klein, Pronto Secure Product Manager; www.commtouch.com My PGP public Key 1814AD45 can be obtained by sending a message to geoff(a)commtouch.co.il with "Get Key" as the subject. - ---------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBMd0iTELv5OMYFK1FAQG8dQQAo2pgG+JIyHFLT/g6stvFnb+MAIpr8Ut7 43uPtRP6xSCztG1T48V/a4jIHzCYcXiYOrGdalJSRc+alpndFfehD+Ky+nzAsgKu WZPISfieWb0wQDUygi1DFkKTddzhjlStAdtwZ0J0E4fHHrZgc3NpzfoRvyVUvdtS cgmH6neWNjs= =yUlH -----END PGP SIGNATURE-----

1 0

Re: Net and Terrorism.
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

At 05:43 PM 7/4/96 -0700, Timothy C. May wrote: >Anyway, I should point out that Mormons (or Latter Day Saints, I guess) are >spreading quickly around the world...all WITHOUT using "conversion by the >sword," as some other well-known religions are wont to do. Perhaps you've read this before (or it's even been mentioned here before) but an excellent book exists that discusses some of the points you touch upon (suicide, martyrs, religion (meme) propagation). See Bloom, "The Lucifer Principle." _______________________ Regards, He who knows others is wise. He who knows himself is enlightened. Joseph Reagle http://rpcp.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0

Re: What remains to be done.
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

At 12:58 PM 7/4/96 +0000, Deranged Mutant wrote: >Another need is for file/disk-encryption utilities. I'm not familiar >with what's out there for Macs, but for PCs there's SFS and ASPICRYP >for SCSI drives (with no source!) and SFS, SecureDrive and SecureDevice >for HD (or FD). The latter won't work on Win95. AFAIK, SFS and >SecureDrive aren't 100% friendly with Win95 either, though they'll work. I'll just add that Jetico puts out BCrypt, which works perfectly with Win95. Of course it costs, but one can try out the software only version, then upgrage to hardware encryption! _______________________ Regards, He who knows others is wise. He who knows himself is enlightened. Joseph Reagle http://rpcp.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0

Re: Restrictions on crypto overseas
by um＠c2.org 17 Dec '03

17 Dec '03

> What about other nations that have recently passed restrictions on the use > of crypto? Other than Russia, which are they? Is there a list anywhere? http://cwis.kub.nl/~frw/people/koops/lawsurvy.htm

1 0

Re: CWD -- Jacking in from the "Keys to the Kingdom" Port
by David Rosoff 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 02.09 PM 7/4/96 -0400, you wrote: >On Wed, 3 Jul 1996, Mark Rogaski wrote: > >> I would assume that the filters look for regexp's in the query string, too. >> How about a nice little Nutscape plugin that uses a rot13'd query string? > > Do you have a copy of that plugin? If it exists. > >> http://www.one.site.com/cgi-bin/sneaky-rd?uggc://jjj.cbeab-fvgr.pbz/ >> >> Hmmm, no bad words in the query string. Of course the filter package would >> start looking for rot13'd stuff in the next release. So the next logical >> step is to use the URL encrypted with the redirector's public key ... or >> better yet, a dynamically generated key. Just convert it to radix64 so >> as to avoid ?'s &'s or ='s, and use that as the query string. >> >> The plug-in would only be necessary to generate the first request. Any >> URL preparation could be handled by passing the output of netcat through >> a stream filter before sending it to the client. > > That "creative child" would have to be pretty damn smart to do >what you described. It would actually take less creativity to do the other things, bypass the config.sys, etc. The child would thus be perhaps a little TOO creative. :) =============================================================================== David Rosoff (nihongo o sukoshi dekiru) ----------------> drosoff(a)arc.unm.edu For PGP key 0xD37692F9, finger drosoff(a)acoma.arc.unm.edu 0xD37692F9 Key fingerprint = 25 7D AA 01 85 41 43 89 50 5A 33 76 F1 F1 99 67 Do you know who's reading your email? ---> http://www.arc.unm.edu/~drosoff/pgp/ Anonymous ok, PGP ok. If it's not PGP-signed, you know that I didn't write it. === === === === === === === === === === === === === === === === === === === === "Truth is stranger than fiction, especially when truth is being defined by the O.J. Simpson Defense Team." -Dave Barry -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMdxKohguzHDTdpL5AQEFIwQAuK9Ca8ImcDka9mYWht35h8NMSr2A/tfB zvusZ8P5HIEYTbQ8GyRDQ3R+X58+k2pQmaCnO66EtI83mrVs+J9C8B7LoobroZpO u2R0SnMMJVU6eQAnkABkgYaMLVamqEMG+n6qmk7NePjsawSBvOdtuH9dmccR1/Pi +sGpQvT6RvI= =vTir -----END PGP SIGNATURE-----

4 3

Re: The Net and Terrorism
by Duncan Frissell 17 Dec '03

17 Dec '03

At 06:33 PM 7/3/96 -0700, Timothy C. May wrote: >My article made my points, so I won't rewrite it here. You are of course >not required to agree. You are free to live in crowded cites--near "soft >targets." You are welcome to lobby for world peace and for economic changes >to lessen terrorism. > >(I think this is mostly hopeless. No matter how "nice" conditions get, for >game-theoretic reasons there will be some groups seeking changes.) I am not sure who is right in this debate. I know that the "why can't we all just get along?" crowd is asking a stupid question. There are lots of reasons people can't get along and there have been enough "top-down" imposed social changes this century to suggest that "changing society" won't preserve the peace. On the other hand, I'm not sure that Tim's pessimism is warranted. This argument that cities will become completely unlivable and the only way to survive is to move out into less populated areas has been going on in the libertarian, survivalist, and right-wing-nut communities since the 1960s. The magazines Vonulife and Libertarian Connection used to talk a lot about the relative merits of Nomadism or Troglodytism, suitcase nukes, and such. Those who took the advice and moved into caves in 1969 have sure had an uncomfortable 30 years. Mel Tappan (author of Survival Guns) may have died from a heart attack which he could have survived had he not moved into the boonies. I note as well that Tim is not all that far away from civilization and its discontents. North Dakota or Labrador would be better choices if separation were really desired. Those of us in the Techno-Libertarian Panglossian Community argue that it is at least possible that the spread of markets will serve to bend the world's population to bourgeois values before nanotech gives everyone the power to destroy the world. Note that markets (like networks) can expand faster than outside observers can believe once a critical mass of participants is achieved. We see that happening all around the world in the case of both markets and networks. Even hard cases like Africa and the Middle East will find themselves swept up in a short time (by historical standards). It's hard to get people who are making lots of dough to strap dynamite to their bodies and go blow up a bus. Then Larry said: >>because it is a fact of life, is erroneous in my view. it is a common >>libertarian argument that goes, "criminality is everywhere, so why try >>to stop it?" a rather juvenile ideology. In all my years of reading and listening to libertarian agitprop, I've never heard this argument. And back to Tim: >(And my point about moving out of cities referred to what *I* am doing; >others are of course free to mingle in crowded markets, hoping that the >bombs won't come that day. Others are free to send their children to day >care centers located in likely targets for ZOG's enemies to bomb, and so >on.) Kids sent to day care centers operated by the federal government or schools operated by local governments are going to be in a bad way in any case whether or not they are blown up or shot (as in Stockton and Scotland). I *love* the Volvo ads which feature mom driving her kids to school in a Volvo with all of its safety features and then turing the kids over to the government for indoctrination. Much better she should drive them to private schools in a Chevy Corvair. They'll live longer (certainly in the spiritual sense of "live"). DCF

1 0

What remains to be done.
by Black Unicorn 17 Dec '03

17 Dec '03

Because I am not myself much of a programer, and because I have to find excuses to feel useful, I thought I would annoy everyone with my ideas about where c'punks might want to direct their efforts at encryption development. Of course any suggestion at direction tends to require a disclosure of the assumptions one is working from. The following are mine: 1. The most interesting crypto uses and implementations seem to come from grassroots programers, not large organizations. Remailers, PGP, Curve Encrypt, Private Idaho, mixmaster, premail, and magic money all were the results of "grassroots" efforts. None of these have been produced from massive corporate R and D programs, and most have been the result of predominately a single programmer's efforts. 2. The most useful crypto applications out there have tended to survive by using crypto that looks forward, not to the past, or the present. This is generally manifest in the inclusion or easy use of multiple methods. Zimmerman's selection of IDEA over DES, PGP's multiple key sizes, Curve Encrypt's 3DES/IDEA option, are all examples of an effort to design systems which will be useful tommorow, not just today. PGPlib seems to pick up this trend where PGP 2.x went awry. 3. In so far as proliferation is important, the impact of crypto applications and implementations is directly tied to ease of use. If PGP has failings, one must be that it can be immensely intimidating to the novice. 4. Increasingly cryptography is defying attempts at conventional regulation. 5. #4 will eventually spur sovereigns to rather drastic methods to defy #4. 6. Secure Communications, and transparent crypto are a Good Thing. Assuming the above, I think it is apparent that crypto development should be focused on a few general points and a few key areas. As to general points, I think the clear concentrations include: A. Increasing the ease of use. Perhaps I should have put this as #1, because really among those things which I suggest in this post, I think this is of primary importance. It cannot be stressed enough that encryption must be transparent, easy to use, but at the same time make its presence just apparent enough to encourage its use, and to make users note its absence. Crypto will have its most significant impact, its most liberating results, and be self assuring only to the extent that it is not a novelty, but an assumption. Please, authors, coderpunks, make crypto easy to use, but flexible enough so that adept and expert users can modify functional aspects. (Key generation, key size, exponent size, algorithm selection, level of verbosity and suchlike should find their way into an expert menu somewhere). B. Multiple encryption method support/larger key sizes. While I may be more paranoid than some, or even most, I think it is crucial to provide for the possibility that strong encryption may one day face a total ban in more countries. To avoid the chilling effect that this would certainly have on development, it is of key importance to permit applications and implementations to nexus with several methods, and to allow what may today seem like extrodinarily large key sizes. (256 bits would not be unreasonable in my view, particularly so where the user was given the option of selecting a ~128 or so bit method like IDEA or 3DES at their option (consistent with A. above). C. Anonymous communication. I'm not sure this needs much explanation. D. True stego. Today it is a simple matter to identify encrypted traffic. This is the key flaw in what I will call (at risk of sounding like a white paper) the NEI (National Encryption Infrastructure). It subjects users to very effective and easy to implement traffic analysis. While I understand the temptation to use checksum like methods to speed the key checking process, at some point I am of the view that this convenience will come back to haunt crypto. Given these areas, what specific applications might be the best to look into for the grassroots crypto advocate/coder? A. Methods to run secure websites on insecure servers. A thread on 'punks last month, I am of the view that local decryption of web pages is essential to the development of coercion free web pages. Estlablishing a truely secure web page today requires the server to be extra-terratorial, in a secure physical location, and requires such lengths to defeat traffic analysis (which lengths must be applied to the actual network logistics, rather than the software logistics) so as to be impractical to all but institutional resources. The best effort I have seen is in European Union Bank (www.eub.com) or (www.eub.net) [neither of which I recommend you use for deposits] and it still falls quite short. A software solution which permits local decryption makes traffic analysis less useful, presents the opportunity to use front end and disposable www pages on domestic ISPs while imposing no liability on the ISP itself, and opens several more effective traffic analysis deterants. Ideally, both web proxies (for servers as well as clients) and local decryption will be written allowing both server and user a degree of double blind operation as well as easy disposability of front ends. A Netscape plugin for local decryption of web pages and proxy forwarding of WWW form submissions to the server is a MUST. Is anyone considering work on these? B. More effective message pools. Really this is the only practical and most effective method to defeat traffic analysis of e-mail communications. Why do you think it is that informants always communicate with the FBI in the classified ads? This has been discussed again and again, yet I am aware of no serious effort to construct an effective server or client to implement it more effectively than USENET (which seems to be hopelessly slow and prone to drop postings regularly) I am encouraged by the new mixmaster model, but I have yet to read the entire abstract carefully. If the goal is, as I believe it should be, to make encryption accessible and understood by, if not everyman and joe sixpack, joe digitalsixpack, then it strikes me that the focus should be on WWW browsers and servers, (Netscape like material), popular mailing programs (Eudora), and the building blocks of the network, the point of origin, and the point of final destination. Point to point, grassroots plug ins to existing de facto standards, and ease of use, ease of use, ease of use. cypherpunks write code. Call me "half a cypherpunk" -- I hate lightning. (unicorn(a)schloss.li)

2 2

Re: Lack of PGP signatures
by Clay Olbon II 17 Dec '03

17 Dec '03

>It is not possible to clear-sign binaries with PGP. The point of clear- >signing >is to have signed text that is readable to people who don't have the >software >necessary to process the text. It would make sense to clearsign a file that >is base64'ed or uuencoded, which wouldn't alter the contents of the file. I >can't see how such an option would be harmful, except that it might lose >some >characters that are important to the context of the message. > Mark, Of course you can use pgp to sign binaries. How else did the pgp binary itself get signed? You can either sign it in a separate file, or in the same file. PGP sorts it out for you. What do you use it for? Same reasons you sign text. "I signed this file" means that you vouch for it in some undefined way (maybe I wrote and compiled it, or somesuch). Clay *************************************************************************** Clay Olbon II * Clay.Olbon(a)dynetics.com Systems Engineer * PGP262 public key on web page Dynetics, Inc. * http://www.msen.com/~olbon/olbon.html ***************************************************************** TANSTAAFL

2 1

I confess [Was: Who was that Masked Cypherpunk?]
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Duncan Frissell <frissell(a)panix.com> wrote: >OK, fess up. Who was it who amended the anti-key-escrow language of the >Libertarian Party Platform live on CSPAN? Specific reference to >cypherpunks. 'Twas me, the guardian of the *original* definition of the fine old term "escrow" against the slick denizens of Newspeak. I have found this Libertarian convention to be a super-fun experience, and I will be demonstrating PGP, Private Idaho, and lots of other fun stuff on Saturday at 3PM. All are invited to attend. Watch for "Pennies for Perot" this afternoon! ;) JMR -- Dade Chairman and Florida Delegate. Regards, Jim Ray -- DNRC Minister of Encryption Advocacy "It is long past time to end the laughable presumption that voters who can easily cope with the choices offered at Burger King are somehow 'confused' by more than two choices at the voting booth." -- me [From my Miami Herald article.] "Truth is stranger than fiction, especially when 'truth' is being defined by the O.J. Simpson Defense Team." -- Dave Barry 6/16/96 ___________________________________________________________________ PGP id.E9BD6D35 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 <mailto:liberty@gate.net> http://www.shopmiami.com/prs/jimray Coming soon, "Pennies For Perot" page! CYA with http://www.anonymizer.com ___________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh. iQCVAwUBMd1Ii21lp8bpvW01AQEBWAQAoWqyLNe921Dx9HXbMFVoW2ReNGp0Qo6r mZd3FvNcJDw4bOeI434sekDwAEg9G2SiCCnBMBFrilZnKscMZpZp0XdNV6+b52FN MtyYW9yYQSRRgixjf3+j6O6jecPynztdugnnWY7Y8jWcb3ukipYYt4cQAVL13sX4 Aknxd4DXtzc= =lvW8 -----END PGP SIGNATURE-----

1 0