December 2003 - cypherpunks-legacy

SECURE + PGP
by Remo Pini 17 Dec '03

17 Dec '03

I played around with secure (eudora plugin) a little bit, but it seems to be unable to decrypt anything it encrypted. (eudora 16-bit on winnt 4.0) Any hints? Also, I wan't to write a mail-program (like eudora), with built-in PGP. Is the algorithm published anywhere (including the protocols)? ie.: key generation, signing, en- and de-crypting, u.s.w. I presume the algorithms are of the shelf (DES and IDEA), but what about the hash-algorithms and key-ring management? ----------< fate favors the prepared mind >---------- Remo Pini Fon 1: +41 1 350 28 82 mailto:rp@rpini.com Fon 2: +41 1 465 31 90 http://www.rpini.com/remopini/ Fax: +41 1 350 28 84 --------< words are what reality is made of >--------

2 1

Re: I@Week on crypto export loophole 6/24/96
by Will Rodger 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 01:03 PM 7/13/96 +0200, you wrote: >Will Rodger wrote: >> >> The odds the US would go after a foreign company would seem pretty remote, >> unless based in a country that strongly suppported US policy. > >Er, right ... Just like they don't go after the Swiss bankers who >choose to have dealings with Columbians, or German businessmen who >have dealings with Cubans ... > You're right. I should have be more specific: I was thinking the odds the US could successfully prosecute a non-US citizen for violating those laws seems pretty remote if that person was from a country not in agreement with US crypto policy. "Go after" is a bit vague. Shame on me. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMefTA0cByjT5n+LZAQFPIAgA1CePSpY1wJm8CCQEloxIZMQMXNuaOC3U Un6JpPtIIDY8X/uSFP7wg8Mgbt+bKBNp1Ehgx6dPMavs8JnMTQWZGGuSDlIdc+5Y 41sTEA6ig6iIls3NqnnVz+0F6JTRF20gKCR1KH++7EdG/zJKJJN833N9NU4QP3od vXQ8jkaNILWzawsh83d9ZngC3ublDFU9onDOx6XIJAoSFNUn39hN8198BCtixCSq FzIDsR2cuiWe4k1PcrUAtKCOlqRxjNqrgc/sy5Gf56qIdjbgJ/rfvO9Rf6JVFZ3i 6dIqw37OEZZ89+pm5hWnjjRQUj2O3oFgO6psBdLkfXkYF6w9ryVbAw== =+1IU -----END PGP SIGNATURE-----

1 0

e-mail spam solution by Bryce Re: ADMIN: Please ignore HLD publishing
by Bryce 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [this is an e-mail reply to a Usenet post, carbon-copied to cypherpunks list.] In comp.os.linux.announce you, Lars Wirzenius <liw(a)iki.fi>, wrote: > >Meanwhile, I'm beginning to feel rather annoyed by the general spam >problem, especially e-mail spam. Me too. > During the worst days, about half of my non-mailing-list mail is spam. > I am in the process of installing a filter that will make it more > difficult to reach me via e-mail. I am going to require strangers to > use a password in the subject line to reach me (people I know will be > put onto a whitelist). It will be easy to get the password, but > I doubt that spammers will bother. This filtering is not in effect > yet. I'll inform you when it is. I have a great idea for an upgrade to your filter, for that fateful day when spammers start using your password: Have your filter reject any incoming mail which is not 1) from one of your white-listed friends or 2) accompanied by a one U.S. Dollar "good faith" deposit. Spammers will not find it worthwhile to send unwanted mail, because it costs them one dollar each time. But people who sincerely have interesting information for you, even if they are not people on your whitelist, can send the one dollar "good faith" deposit with a good chance that you will give the money back to them once you have read their letter. Just another example of how Ecash(tm) is going to improve the Net. Regards, Bryce -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: www.c2.net/~bryce -- 'BAP' Easy-PGP v1.1b2 iQCVAwUBMejncPWZSllhfG25AQEypAQAkiC1O4nab+aLMo6v3stbHUm/VLtHo+lC kIOD+UU+ckc4/vHEMLWgT4LfQ2EH338GxOkA7zgcBe9nhcBxIqvlqU5BurmLie/X j7xXFcQTzf+D+fIaD3xBjQrs/g2oOwqiGrCKCkEf3MWzYu1J7Bw1W458vjziizyu +Q8VBY6cVV0= =nRLB -----END PGP SIGNATURE-----

1 0

Re: ANNOUNCEMENT: PGPfone Beta 7 Now Available for Download
by Harry Hochheiser 17 Dec '03

17 Dec '03

On 12 Jul 96 at 21:31, Arun Mehta wrote: > At 23:38 10/07/96 -0700, Will Price wrote: > >ANNOUNCEMENT: PGPfone Beta 7 Now Available for Download > > Sorry if this has been discussed before (please point me in the > right direction if that is the case), but VSNL, my government-owned > ISP (which also has a monopoly on all international traffic) made me > sign that I will not use my Internet connection for voice traffic. > Is there any way they could find out if I were using PGPfone, or > rather, could I prevent them from finding out? Arun: I can't give you a definitive answer here, but I'll take a shot. Most Internet telephony systems use UDP packets to transfer speech, since the lower overhead of UDP (as opposed to TCP) allows for better throughput. I assume (but I'm not certain) that PGPfone works the same way. Unfortunately, most of your other TCP/IP communication will be based on TCP packets. Therefore, it's theoretically possible for your ISP to monitor your traffic, watching for large numbers of UDP packets. --------------- Harry Hochheiser harry(a)tigger.jvnc.net 08 3A B5 F6 47 7F C7 C4 28 B4 8D D2 2E DF F6 1E

4 3

Re: ANNOUNCEMENT: PGPfone Beta 7 Now Available for Download
by Harry Hochheiser 17 Dec '03

17 Dec '03

On 12 Jul 96 at 21:31, Arun Mehta wrote: > At 23:38 10/07/96 -0700, Will Price wrote: > >ANNOUNCEMENT: PGPfone Beta 7 Now Available for Download > > Sorry if this has been discussed before (please point me in the > right direction if that is the case), but VSNL, my government-owned > ISP (which also has a monopoly on all international traffic) made me > sign that I will not use my Internet connection for voice traffic. > Is there any way they could find out if I were using PGPfone, or > rather, could I prevent them from finding out? Arun: I can't give you a definitive answer here, but I'll take a shot. Most Internet telephony systems use UDP packets to transfer speech, since the lower overhead of UDP (as opposed to TCP) allows for better throughput. I assume (but I'm not certain) that PGPfone works the same way. Unfortunately, most of your other TCP/IP communication will be based on TCP packets. Therefore, it's theoretically possible for your ISP to monitor your traffic, watching for large numbers of UDP packets. While a large amount of UDP traffic wouldn't _prove_ that you were using Internet telephony, they might _assume_ that the UDP traffic was voice traffic. It all depends on how sophisticated and heavy-handed they wanted to be about it. Now, I don't know if PGPfone uses UDP. However, if it did, it would be as easy to detect as any other Internet telephony product. An encrypted bunch of UDP bits is as easy to spot as an un-encrypted bunch, even if the contents can't be interpreted. I hope this helps. If any of this content is incorrect, my apologies. -Harry --------------- Harry Hochheiser harry(a)tigger.jvnc.net 08 3A B5 F6 47 7F C7 C4 28 B4 8D D2 2E DF F6 1E

1 0

Re: Execution of signed scripts received by e-mail
by Hal 17 Dec '03

17 Dec '03

That sounds very impressive! The one problem I've run into with mail filtering software is that each message asynchronously spawns a separate filter process. This can cause some conflicts with accessing disk files. I haven't used procmail so I don't know if it has this problem. But if so you may need to be careful if there are any cases where two processes could be accessing the same disk files. For example, what if two copies of an identical email message arrive at almost the same time, would your dup detection work. The other issue is the possibility of mail arriving out of order. Looking for increasing timestamps may cause spurious rejection of some messages. On the other hand this is a difficult problem to handle in general so probably the current solution is OK. Hal

2 1

Re: MIT harassed over publication of PGP book
by Carl Ellison 17 Dec '03

17 Dec '03

Hal, would such review have any material effect on MIT behavior? I appreciate the point about the sneakiness of the State Dept. However, I can't imagine publication of the next PGP source (or whatever) to be funded by Sandia. I would also hope they would have no fingers into any crypto research. Prior review of crypto research publications is what Adm. Inman wanted back in 1978, in response to which both Cryptologia and ICAR were founded (from my POV). MIT was a strong force in backing NSA down on its attempt to get prior review of publications and I'd hate to see them knuckle under in any way on this point. - Carl

1 0

Singapore
by William "Bud" Kennedy 17 Dec '03

17 Dec '03

SINGAPORE (ITN) * Singapore announced rules Thursday aimed at blocking anti-government views and pornography on the Internet, adding to the thicket of laws that regulate books, movies and public discussion here. But authorities insisted the latest rules -- one of the first attempts by any country to screen the Internet -- do not amount to censorship. The government will hand out annual licenses to Singapore's three Internet providers, as well as to political parties that maintain Web sites, groups and individuals who run discussion sites on politics and religion, and on-line newspapers. Beginning Monday, these groups will be responsible for blocking out material deemed objectionable by the government. Violations will result in licenses being revoked. "We are not censoring discussion groups. By registering these groups, we are asking that they behave responsibly," said the Singapore Broadcasting Authority, a governmental regulatory body. The free-wheeling global computer link up has provided the Singapore government a major dilemma. Singapore promotes the Internet as part of its objective to make the city of 3 million people the hub of high-tech industry. One in three homes has a computer, and the number of Internet accounts doubled last year to 100,000. A government plan calls for connecting each home to a computer network by 2000. But the Internet has also brought into Singapore what the government had successfully kept out for years -- criticism of the administration and the judiciary, pornography and discussions on race and religion. About 10 SBA officials will surf the net daily for objectionable material. A government-appointed panel of prominent citizens will decide what is objectionable, said Goh Liang Kwang, chief executive of the Broadcasting Authority. But he admitted that even with regulations, the SBA cannot completely police the Internet. "We don't claim we can regulate the Internet. We just don't want objectionable material to be easily available. We want to keep our immediate neighborhood clean," said Goh. Still, a lot of rules remain vague. Although political parties will need licenses, it is not clear if individual politicians would be allowed to post anti-government views on bulletin boards. The SBA guidelines say it will not allow contents that "tend to bring the government into hatred or contempt, or which excite disaffection against the government." The definition of hatred or contempt has not been spelled out. The government will also ban: -- contents that jeopardize public security or national defense. -- anything that ridicules racial or religious groups. -- the promotion of religious deviations or occult practices. -- the "gross exploitation" of violence, nudity, sex or horror. -- the depiction of "sexual perversions" such as homosexuality. All these are already banned from books, magazines, newspapers, movies and public forums.

1 0

Dep. AG Gorelick on CSPAN2 advocating escrow
by Deranged Mutant 17 Dec '03

17 Dec '03

Saw Jamie(?) Gorelick, Dep. Attny Gen. on CSPAN2 talking about needs for key escrow. Emphasized the what if people lose their keys, or someone dies, or if an employee steals company secrets & encrypts them... rather than the usual what if terrorists use crypto line (though she did mention that too). Guess they're taking a new tack to sell it to the public. A lot of bunkum... (project left to the reader how these can be handled in a non-GAK manner). Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

2 1

Re: A case for 2560 bit keys
by David F. Ogren 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com Date: Sat Jul 13 12:51:36 1996 > On Thu, 11 Jul 1996, Chris Adams wrote: > > > check your setup. I used to run a 386-20 (5MB RAM) and it took about > 3 > > seconds for a 1024 bit key. Given it didn't even have a copro (not > sure > > when/if PGP uses one) and that it was off of a Stackered drive, I'd > > expect you to have much better times. > > That's consistent with the timings I've been getting. It should take > about > 9 seconds to decrypt an arbitrary message with a 2048-bit key with the > setup > you describe. Of course, I usually use X, so that probably does throw > off > the timings a bit. > This is an issue that is connected with the "Need PGP awareness" thread. If everyone is decrypting their messages by hand then nine seconds is a hinderance. On the other hand, if everyone is using an off-line reader that checks signatures/decrypts as it receives messages then nine seconds (or less for a newer machine) is less significant. I'll refrain from making any product plugs here, but I could barely notice the difference moving from a 1024 bit key to a 2047 bit key. - -- David F. Ogren | ogren(a)concentric.net | "A man without religion is like a fish PGP Key ID: 0x6458EB29 | without a bicycle" - ------------------------------|---------------------------------------- Don't know what PGP is? | Need my public key? It's available Send a message to me with the | by server or by sending me a message subject GETPGPINFO | with the subject GETPGPKEY -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMefUGeSLhCBkWOspAQGuPgf+I2A0a3F6OeBMA9MGUp0ww13Xiq3+LdS4 pOEvhz7Ub1tBUcl5Ko8/y/7pIZE1pZom0fOoyDOD9HX9OrHrY7sDkKbDY2sirfEl dovFKKImIJaMzxDgKhxAdlrmrLq/xrz2rAXv9FvA/KSkCJys/A7ydu9AprKA7Esf E6qRDmQFuuTcNvEVC5WOoDLVQoNZQUe1gVs97YFYFabTMA0bXr8bI/RdHcFy8vIj 51jBSI3Ib2WgcGOa2dKrmU7TRMQk5UHGGxKuKGGgIaOZ4uvPVUmNwHVg9wADbnzX fjkZBvk8/sIqvD4Z4rHWulpHVJxCgKHzVgsh7exCVoZlffITu0SHqw== =kHRX -----END PGP SIGNATURE-----

1 0