December 2003 - cypherpunks-legacy

No Subject
by Lurker 17 Dec '03

17 Dec '03

Could someone tell me where I can find a text file of *all* usenet newsgroups?

1 0

Re: The Rise and Fall of Cypherpunks WAS [Re: the Dennings]
by Dave Hayes 17 Dec '03

17 Dec '03

SANDY SANDFORT wrote: > On Tue, 3 Dec 1996, Dave Hayes wrote: > > The very existance of the "profane" keeps the "sacred" in > > existance as well. If you cannot see that, then John Grubor's > > lesson is wasted on you. > If this bit of verbal legerdemain makes any sense at all > (Logos?), then Grubor must be personally responsible for the > existance of every saint on the Catholic calendar...not. Now there's an example of properly used logic...not. Why didn't you be honest and just say "I don't understand this, please explain"? This could be because you *want* to be hostile, and you *want* to produce meaningless flames. ------ Dave Hayes - Altadena CA, USA - dave(a)jetcafe.org Freedom Knight of Usenet - http://www.jetcafe.org/~dave/usenet "A terrorist is someone who has a bomb and doesn't have an air force." --some letter-writer in the Manchester Guardian, some years ago

2 1

Confirmation for subscribe cryptography
by Majordomo＠c2.net 17 Dec '03

17 Dec '03

-- Someone (possibly you) has requested that your email address be added to or deleted from the mailing list "cryptography(a)c2.net". If you really want this action to be taken, please send the following commands (exactly as shown) back to "Majordomo(a)c2.net": auth 727e8b91 subscribe cryptography cypherpunks(a)toad.com If you do not want to this action taken, just ignore this message and no action will be taken. If you have any questions about the policy of the list owner, please contact "cryptography-approval(a)c2.net". Thanks! Majordomo(a)c2.net

1 0

No Subject
by Jose Luis Delgado 17 Dec '03

17 Dec '03

unsuscribe cypherpunks

1 0

RE: Anyone considered adding crypto into Microsoft Outlook?
by Robert Barnes 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have downloaded, and strongly recommend, Jon S. Whalen's Microsoft Exchange Client PGP Command Extension. It adds PGP functionality to Exchange Client in a very neat and clean way. Rob -----BEGIN PGP SIGNATURE----- Version: 2.63ui iQCVAwUBMqYkarl39AMaT2JtAQHmtQP/Yu8rh5OkkMC1GVEnz4hY6xFczeDM0Y3U 7toMIDZLVnDwRXuoo9+10sUMnB289mkjoi54fuAhbkjDKYejXVIFilJoSFq+s5FZ K0Rdcaj8qv6VkJwL63gXMdXsFlxHIyQ/oK9/3r7tBgFyzab3tcjVXUGRy/NE5sLD osrJm4WzfVU= =+ffh -----END PGP SIGNATURE-----

1 0

Suggestion for "the serious encryption customers" to end ITAR battle
by Ernest Hua 17 Dec '03

17 Dec '03

I think we can all agree that the level of confidence in software-only approaches to security is clearly lower than combination software plus hardware approaches. It is clear that what is available over the Internet is software. (It is much harder to distribute "hardware" as you can only really distribute design information. The closest analogy could be a FPGA program, a Verilog description or some other ASIC net list.) How about the following as an approach to resolving the dispute over encryption exports: 1. Allow arbitrary exports of software-only encryption. This means that PGP is exportable as is DES crypt libraries. 2. Restrict exports of hardware-only or hardware/software encryption. This means that smart cards, HP's crypto policy cards, crypto processors with tamper-resistant casing, etc ... are restricted. Why does this make sense? 1. Reality check on export control of software: Software is just too transportable to be restricted, no matter WHAT the software does. Any restriction on WHERE software may be or may go is just not feasible, and it's not going to get any easier in the foreseeable future. 2. Take John Deutch at his word: Deutch has claimed that "serious users of cryptography" would not trust software downloaded over the Internet. We clearly do not agree with him on this aspect, but if he truly believes it (and is not just making PR spin statements for the NSA), then he must believe that allowing software exports will not significantly increase the user base (and therefore, harm CIA's or NSA's intelligence capabilities), but it will shut up the software companies' complaints. 3. Give the NSA what it wants: Software tends to standardize. Encryption is only a small part of the chain of security measures. Other weaknesses are surely part of the NSA's target for intercepts (no self-respecting codebreaking agency should stick to exploiting only one class of failures; if it is, we should question the value we are getting out of the billions of dollars we blindly give to the NSA). If the NSA stops whining about what is too hard to break, then protocol weakness and other non-encryption problems could easily creep into standards, and the NSA would surely have an analytical advantage over anyone else. Since the NSA is happily bragging that it does not even need to crack the code to break in, it should be able to live with hardware-only export restriction. The fact that the NSA is no longer drawing any lines anywhere for software will leave the bad guys guessing as to what it can really decode. In addition, hardware manufacturers will probably have a tougher overturning export restrictions on hardware-enhanced solutions after that because software companies will probably not care. It is clear that the NSA only trusts hardware implementations, as it required Clipper to be manufactured in tamper-resistant cases. All constructive replies welcome. Ern

2 1

Re: Strong-crypto smart cards in Singapore and Germany
by um＠c2.net 17 Dec '03

17 Dec '03

Peter Gutmann writes: >The standardisation committee of the German banks have also produced >an electronic wallet which should have 25 million (yes, 25M) users by >January of next year. Again, this is a pure electronic wallet, with >2-key triple DES and 768-bit (to become 1024-bit) RSA encryption. >[...] This looks like a very nice system, and unlike Mondex doesn't >rely entirely on the hope that criminals can't get at the data on the >card. For 'security reasons', all transactions are logged in what is called 'shadow accounts'. Not what I would call a very nice system.

1 0

RE: Microsoft & Key Escrow
by Tom Albertson (LCA) 17 Dec '03

17 Dec '03

These issues are also addressed at somewhat greater length than in the FAQ in "Microsoft Policy on Export Controls on Encryption" at http://www.microsoft.com/intdev/security/export/expcont1.htm (updated since the recent Administration announcements). rgds tom >-----Original Message----- >From: Blake Coverett [SMTP:blake@bcdev.com] >Sent: Wednesday, December 04, 1996 6:12 PM >To: 'cypherpunks(a)toad.com' >Subject: Microsoft & Key Escrow > >Following are some of the relevent snippets from >http://www.microsoft.com/intdev/security/export/exporfaq-f.htm. >The comments in square brackets are mine. > >---cut here--- >What is Microsoft's position on supporting key escrow? > >Key escrow encryption is not a market-driven solution and it raises serious >privacy concerns for many customers. It is also new, undeveloped, untested, >and uncosted, and it will take a long time to be worked out. Additionally, >customers have expressed hesitation about mandatory key escrow, especially if >they have to give the keys to the government or a government-selected third >party. Therefore, we are not actively adding support for key escrow in our >products and technologies. > >[About as good as we can ask for. I would, however, like that last sentence > better if the word 'actively' was missing.] > >Shouldn't the U.S. government be able to access information that could >prevent terrorist acts and crime? > >Strong non-key escrow encryption is already available from retail outlets, >foreign companies, and off the Internet. Thus the U.S. government is already >having--and will continue to have--a harder time in the future accessing >plain text regardless of U.S. export restrictions. > >[I suppose it would be too much to expect a third sentence > reading. 'This is a good thing.'] > >What is key recovery? How does it relate to key escrow? > >Market-driven data recovery refers to a product feature that allows users to >maintain a spare private encryption key in a safe place. Generally, a data >recovery system escrows a copy of the session key with the message or file >and the user (or perhaps his employer) controls the decision whether to >utilize this feature. With key escrow the U.S. government holds or has access >to a user's private encryption key. > >It is not yet clear whether such systems are exportable. In the October 1 >announcement, the U.S. government referred to "key recovery" without defining >it; in all likelihood, however, they still have in mind government key >escrow, and not market-driven data recovery. > >[Hmm... it's just possible that Microsoft's spin doctors are > better than those of the US government. Perhaps they can > sell the world on their definition of 'key recovery' instead of > the one we know the TLAs intended.] >---cut here--- > >regards, >-Blake >

1 0

Chippen@Dale
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

At 07:37 AM 12/4/96 -0800, Dale Thorn wrote: : :If you, Sandy, and the other offenders *really* want to keep the noise :down, then next time ask John directly for a reply, and if none is :forthcoming, say to the list *once*, "John will not answer up", etc., :and let the subscribers draw their own conclusions from the silence, :instead of from your inane "defenses". : Dale, John has no obligation to say anything. In all fairness, no conclusions should be drawn based on any individual's saying nothing. Such thinking is from the Dark Ages. Lighten up, and let go of it.

1 0

PGPfone list
by Jim Ray 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: jmr(a)shopmiami.com Date: Thu Dec 05 22:54:33 1996 [My apologies for cross-posting this, but it's important IMO.] The list owners have given me permission to post an announcement of a list for those of us who wish to play with the new PGP-fone software. This is a list solely for the discussion of PGP-fone. It is to be low volume and on topic, with none of the garbage that the cypherpunks are presently enduring (my killfile filter gets enough of a daily workout as it is). Usual rules apply on the posting of private mail without the other author's consent, polite discussion, etc. Violators of these policies will likely be *truly* "censored," (booted off the list, *and* unable to post). To subscribe to the list, use the web based gateway at: http://www.rivertown.net/cgi-bin/lwgate [To prevent abuse, your subscription will be verified.] PGPfone for Macintosh and Windows 95/NT can be obtained at these locations: US/Canada users [like PGP, PGPfone falls under ITAR export restrictions.]: http://web.mit.edu/network/pgpfone International users: http://www.ifi.uio.no/pgp/PGPfone.shtml Current versions are: Macintosh - version 1.0b7 Windows 95/NT - version 1.0b2 These versions DON'T talk to previous versions. Presently, the PGPfone Owner's manual is a MAC file and unfortunately it won't open in the Windows environment. Those of us who are MAC-impaired can use the on-line manual available at: http://www.pgp.com/products/fone_01.cgi There is also a "PGP Fone Registry" at the Rivertown.net PGP-users site (which is quite extensive and worth a look for other crypto-related stuff). At this site, people willing to test PGP Fone with others can leave their names and e-mail addresses, along with their area code and local telephone exchange (first three digits) which indicates willingness to be contacted via e-mail to possibly set up a time and place to use PGP Fone with each other. It's very basic right now. You can access it at: http://pgp.rivertown.net/pgp-fone and follow the instructions to sign up. The biggest problem folks have had with PGP Fone is finding someone else to use it with. This site can help alleviate this. Rivertown.net also has a fine PGPfone icon by Mike Acklin. P.S. I concur with Peter Trei on the Forbes ASAP big issue. Try to find a Forbes subscriber and read it all. He left out one author, cypherpunk Bill Frezza. I liked Bill's article best of all. IMO, Buckley and Paglia unwittingly proved in their ASAP articles that it's much easier to fashionably label yourself a "libertarian" than it is to actually *be* one. JMR Regards, Jim Ray DNRC Minister of Encryption Advocacy One of the "legitimate concerns of law enforcement" seems to be that I was born innocent until proven guilty and not the other way around. -- me Please note new 2000bit PGPkey & address <jmr(a)shopmiami.com> PGP id.A7D63DA9 98 1F 39 BA 93 86 B4 F5 57 52 64 0E DA BA 2C 71 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEPAwUBMqeZATUhsGSn1j2pAQFFOQfQzF0pGgGKt9/VR44TzGxAq9yk7dUs0JPK 4G9TIRePcnZ+IYqBFiqGaCws9EGrK/1ztv7ryl0FstROmldTxFj197lSsEysPMQb M8DUbKsDbsLYlNJNCFJkYz9tihM5w5h1YNj4jPwjec3Js/Bh4T3ab6d+h4Ax1ku0 wsWlVv0keP2yXhcFFHPRkkyXmPtTL31/zkGKkwU9dY/efYSf4GeIApfvnYXzInFD vraFSVd0Qi+8py86RZBauKO/vt7mj9r32HCZevPE89AUDVgVnb9Y5SeT9J0f2pXT qHrpDEguBofvsU/q436Vgla+wrHme2rNYqEPqDslSkNzgg== =FH37 -----END PGP SIGNATURE-----

1 0