December 2003 - cypherpunks-legacy

Securing Internet mail at the MTA level
by C Matthew Curtin 17 Dec '03

17 Dec '03

Hi, Recently, I've been looking into securing email at the MTA level, and would like to get your thoughts on implementation possibilities and related issues. The problems that I'm trying to solve are: 1. Host authentication 2. Data privacy In order for the widespread encryption to work, several things need to occur: 1. Phase-in of the new stuff 2. Backward compatibility (ability to continue to work in the clear) for a period of years 3. A single worldwide mechanism, defined by an RFC, and freely available, except, perhaps, in the case of commercial MTAs. (i.e., the use of RSA seems appropriate for host and session key management, and is free via RSAREF in the US, free outside of the US, but not free for commercial use. This seems acceptable to me.) Two types of approaches are possible: 1. Adding to the SMTP protocol itself, allowing for MTAs to identify crypto-capable peers, and then performing authentication and session encryption where possible. 2. Waiting for a cryptographic transport layer network protocol (such as what is being proposed in draft-ietf-tls-ssh-00), allowing SMTP to remain untouched, and only requiring MTAs to add support for the new network protocol. I like the second approach better, because it allows more problems to be solved with one move, and it would be easier to add crypto functionality to our common network utilities by simply making them aware of the new transport layer protocol. The first approach would require redefinitions of RFCs for each of the services, and lots of redundant work. I mentioned my interest in an SSH-capable MTA to Tatu Ylonen <ylo(a)ssh.fi>, and he as also expressed interest. The word from him on the status of the SSH Internet Draft is that a reference implementation should be available early next month. I'm considering using that reference implementation to add SSH capability to an MTA, perhaps sendmail. My questions are: 1. Which of the two approaches seems to make the most sense to you? 2. Is there another approach that could work better? 3. Is there interest in adding SSH functionality to sendmail in the near future (either by the draft spec, or once the RFC has been published)? Please feel free to pass this around, if you deem appropriate. I'm interested in lots of feedback before deciding if and how to go ahead with the project. Thanks. -- C Matthew Curtin MEGASOFT, LLC Director, Security Architecture I speak only for myself. Don't whine to anyone but me about anything I say. Hacker Security Firewall Crypto PGP Privacy Unix Perl Java Internet Intranet cmcurtin(a)research.megasoft.com http://research.megasoft.com/people/cmcurtin/

4 3

Re: BlackNet: Commercial Posts?
by Ross Wright 17 Dec '03

17 Dec '03

On Or About 19 Aug 96, 18:40, Timothy C. May wrote: > At 1:05 PM 8/19/96, Ross Wright wrote: > > > >My question to the list: > > > >Who benefits from all this publicity and brew-ha-ha? Who makes all > >the BlackNet money? Who really cares if it is a Data Haven or just > >a remailer? I'm just asking. > > Well, obviously I do. I receive $1.42 for every posting which > mentions BlackNet, 7% of gross sales for all commercial > transactions, and 12.5% plus a sliding finder's fee for all military > and intelligence secrets sold via BlackNet. > > But all true paranoiacs knew this. > > --Aldrich Ames > Hey, It's not funny. So this is freeware? I thought someone offered 3 mil for the program. Tim, you wrote this thing? So who owns it now? Can it be owned? Maybe I misunderstand. Ross =========== Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: 415-206-9906

1 0

[NOISE] other distributed searches
by morgan＠keilin.helsinki.fi 17 Dec '03

17 Dec '03

Two distributed searches on the net are described in Science (9 August 1996 p. 743). One is a search for "Mersenne" prime numbers: http://ourworld.compuserve.com/homepages/justforfun/prime.htm The other is called SETI@home and apparently going to use idle time on people's computers (a screen saver) to search for patterns in data from Arecibo. The report says the project will be set up by Woody Sullivan of University of Washington, Seattle and will operate out of a server in Berkeley. (I wasn't able to locate any information about this on the web.) -- ===================================================================== Joel.Morgan(a)Helsinki.FI http://blues.helsinki.fi/~morgan "Over the mountains there are mountains." -- Chang-rae Lee =====================================================================

1 0

Re: US Taxes on X-Pats (getting off topic)
by Stephen Cobb 17 Dec '03

17 Dec '03

At 05:32 PM 8/19/96 -0400, you wrote: >It sounds unfair, for sure. However, the whole thing is a fraud based >upon a myth. FICA witholding is NOT credited to an individual's account, >or even to Social Security benefits in general. By statutory law, all >such receipts go into the Treasury's general fund. > >So, they are NOT "social security contributions". Period. > Very true...what I am saying is that, as far as my reading goes, LEGAL aliens are going to be required to pay social security "taxes" while not having any "entitlement" in return. They pay income taxes and get certain things, like law and order, in return. They will be paying soc sec money to the government without getting anything in return. This sounds not only unfair but wrong, part of an isolationist, "we killed the natives so this land is our land and the rest of you f@*k-off" revival that includes the recent posting about requiring proof of citizenship before issuing drivers licenses. Stephen

4 4

ok ok ok i know
by Ryan M. Leach 17 Dec '03

17 Dec '03

sorry to bother the list with this but i lost the message describing the "unsubscribing" methods for this list (it's way to big for me) can some one mail me instr. on unsubscribing? TIA

1 0

Re: Taxes on Internet access prediction
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:07 AM 8/20/96, Mike McNally wrote: >States and municipalities are taxing internet access. Who wants to >make a prediction about if/when the IRS will start to count net access >as a taxable fringe benefit of employment? > >(At a small company where I once worked, a tax accountant visiting >one day noticed that we had a weight bench set up in a back corner of >the big "back room". He advised us to be careful, because the IRS >could count that as a taxable employee benefit.) I think the test of whether something is a "perq" (or is it "perk"?), and thus possibly taxable to the employee, is whether it is outside the normal bounds of work. Thus, one's office cubicle, computer, office supplies, etc., are not taxable fringe benefits. Membership in a country club is, though. Net access, if primarily used for work-related things, would not be. Just as company phone calls are not treated as a fringe benefit for the employees making the phone calls. Or business trips. And so on. At least one community has tried to treat _parking places_ (and I don't mean special, tree-shaded, reserved, V.I.P. parking places) as taxable benefits. This is to try to get more people to car-pool, or telecommute, or somesuch. Howls of protest pretty much drove this idea back into the hole from whence it came. Many of my Intel friends have Net accounts, obviously, and yet the number of posts on the Usenet or elsewhere from "*.intel.com" are relatively low. I asked a couple of friends of mine about this, and they confirmed that Intel management has discouraged public postings and comments from *.intel.com domain accounts. Understandable, for reasons I have discussed many times. Many employees of companies find it easier to purchase their own account from Netcom, Earthlink, Best, etc., and so have a Net name unaffiliated with their employer. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re:phoneco vs X-phone
by Brian D Williams 17 Dec '03

17 Dec '03

Jim bell writes: >What do you mean, "doesn't really fit the facts"?!? What part of >it was incorrect? Fiber-optic _is_ commonly used in inter-office >trunks, right? It doesn't wear out, right? Higher usage doesn't >entail greater costs, right? The capacity, while not strictly >infinite, is high enough so expanded usage doesn't strain most >links, right? Finally, modern phone switches have sufficient >connect capacity so that they can handle usage which would have >been considered "unusual" by yesteryear's standards. All >of this points to an obvious conclusion: Telephone companies do >not, in general, have increased costs as a consequence of >increased telephone usage. Fiber does not wear out per se, but it does need replacing, partly from the inevitable contractor accidents (landscapers) and occasional entropic events. Mux cards and repeaters do go bad on a regular basis, there is a correlation between usage and increased maintenance, and of course increased usage means increased electricity usage. One point that seems to be missed here is the very high cost of compliance with government regulations. If the internet phone people have to comply with the same regulations it will drive up their costs dramatically, and if the regulations are lifted for all, the RBOC's think they can out compete them. Thank you for your interesting post. Brian "Zazen? Well it beats sitting around on your ass all day doing nothing."

1 0

Re: Billy boy's satellites [Was - Floating DataHaven]
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:26 PM 8/20/96, Brian Davis wrote: >On Mon, 19 Aug 1996, Timothy C. May wrote: >> There's some obvious crypto/GAK/New World Order issues: many countries may >> not care for a communications system which allows citizen-units or enemy >> agents to make phone calls from the middle of the Kalahari desert or from >> within the jungles of Burma. >> > >Or the streets of New York or Washington. Not too long ago, in my former >life as a federal prosecutor, I attended a Computer Crimes conference at >Quantico (the FBI part, not the Marine part). One of the speakers >discussed LEO satellites and satellite cellular phones. The "difficulty" >in wiretapping those phones was of grave concern to most of those present.... I am sure this is a very real concern and a very real motivation for some of the work being done on international key escrow (GAK--Global Access to Keys?). The various governments may be trying to get the several LEO satellite projects to incorporate GAK circuitry now, before it's too late. Once the satellites are up, and the handheld units sold in Fry's and CompUSA, it's too late. I'd hate to see the U.S. on the same side of the issue of free and open communications (which means encrypted, if people so choose) as Burma, Libya, Singapore, and France. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Securing Internet mail at the MTA level
by Stephen Cobb 17 Dec '03

17 Dec '03

At 11:29 AM 8/20/96 -0400, you wrote: > >Hi, > >Recently, I've been looking into securing email at the MTA level, and >would like to get your thoughts on implementation possibilities and >related issues. > >The problems that I'm trying to solve are: > 1. Host authentication > 2. Data privacy > Hmmm, have you thought about how this might fit/mesh/work with the security mechanisms in IPv6? Just a thought...Stephen

1 0

Re: Securing Internet mail at the MTA level
by Erik E. Fair 17 Dec '03

17 Dec '03

SSH, while a quite useful tool, is not the right long-term solution for transport layer security - IP security is. It's also clear to me that for E-mail, you don't want transport level security for the system; you want "object" security, that is, digital signature and encryption of the mail message. That way, no matter how many MTAs the message passes through (and pretty much regardless of how trustworthy they are) you have end-to-end authentication, integrity and privacy. Erik Fair <fair(a)clock.org>

3 3