December 2003 - cypherpunks-legacy

(fwd) New keyserver available
by frogfarm＠yakko.cs.wmich.edu 17 Dec '03

17 Dec '03

>From: tage(a)cc.uit.no (Tage Stabell-Kulo) Newsgroups: comp.security.pgp.tech Subject: New keyserver available Date: 24 Jan 1997 16:11:26 GMT Lines: 12 Message-ID: <5camve$3d4(a)news.uit.no> A new PGP keyserver, still _very_ experimental, is available at host dslab1.cs.uit.no at port 24162, use telnet(1). In general it will find a key in a few seconds. Your comments and suggestions are solicited. -- //// Tage Stabell-Kuloe | e-mail: Tage(a)ACM.org //// /// Department of Computer Science/IMR | Phone : +47-776-44032 /// // 9037 University of Tromsoe, Norway | Fax : +47-776-44580 // / "'oe' is '\o' in TeX" | URL:http://www.cs.uit.no/~tage/ -- http://yakko.cs.wmich.edu/~frogfarm ...for the best in unapproved information "We think people like seeing somebody in a uniform on the porch." -US Postal spokeswoman, quoted in AP, 1/27/96. I don't know about you, but most people I know who saw someone in uniform on their porch would pull out the shotgun...

1 0

(fwd) Re: PGP implementation source code
by Damaged Justice 17 Dec '03

17 Dec '03

[The discussion started with Pretty Safe Mail, the recent "PGP-compatible" Mac program, and whether or not it was safe. Source code is not available. Some authors noted that PSM was much slower than PGP, but so far lives up to its promise of user-friendliness. A Win95 version is in the works.] >From: Ian_Miller(a)bifroest.demon.co.uk (Ian Miller) Newsgroups: comp.security.pgp.discuss,comp.security.pgp.resources Subject: Re: PGP implementation source code (was "Imminent Death of PGP?" revisited) Date: Fri, 24 Jan 1997 19:55:46 +0000 Lines: 66 Message-ID: <AF0EC44296683DACD(a)bifroest.demon.co.uk> In article <5c2kap$1tu(a)topcat.uk.gdscorp.com>, Steve Gilham <steveg(a)uk.gdscorp.com> wrote: >PGP defines, but, IIRC does not inspect, a comment packet type. This >packet type could be added to a .pgp file and contain anything the >implementor wished (your plaintext secret key if it has been used in >this instance of the program, any IDEA key used, your passphrase, if >given) without any standard PGP implementation being aware of it The IDEA initialisation vector could also be used as a subliminal channel, it is only 8 bytes but it could (for example) leak a random 60 bits of one prime in your secret key with the remain 4 bits saying which set of 60 bits. Worse is the possibility that the program could put a back door into RSA key generation to make the modulus trivially factorisable by someone in the know. There are a number of mechanisms for this of varying detectability up to detectable only by reverse-engineering. Here are some of the (endless) possibilities in order of increasing sophistication:- 1) Make one of the primes a constant. Factorise by dividing by this number. Detectable by inspection of public keys alone. (For more details, see my article "There are no common factors in the Public keyring", 13th Jan in comp.security.pgp.announce.) 2) Select the first prime P at random but make second prime Q the smallest prime larger than PK where K is a constant. Factorise by searching from root(N/K). Probably detectable by suitable inspection of several secret keys generated by the product, but (I think) undetectable from public keys alone. 3) Select a random seed and using a good PRNG, make the rest of generation process deterministic based on the seed. Use the "deadbeef" technique to select a modulus that has this seed as its least significant bytes. Factorise by extracting the seed from the modulus and repeating the deterministic key generation. This is detectable only by reverse engineering. 4) Select a random seed and use a short key PKE key exchange system (e.g. Elliptic curve) to generate a session key and a key exchange cyphertext. Use a key generation similar to (3) except that you seed the PRNG with the session key and deadbeef to make a key ending in the key exchange cyphertext. Factorise by extracting and decrypting the session key (requires a secret key), and repeating the key generation. Again this is only detectable by reverse engineering, but even after executing the reverse engineering you still cannot factor the keys generated because the program only contains the public key not the secret key. Method (4) is an interesting example of a "locked back-door". There is often an unstated assumption that back-doors have to be open. i.e. If you can find them you can get in. It isn't always true. Whereas it seems intuitively unlikely, it is not inconceivable that there is a way of putting a locked back-door into some forms of Feistel ciphers. The NSA would have been reluctant to put an open back-door into DES, but they would not have hesitated to put in a locked back-door. In my opinion the only safe assumption is that they could and they did. In cryptography you shouldn't trust your intuition, code with source or unexplained algorithm components. Ian Ian_Miller(a)bifroest.demon.co.uk FAI-D10204 PGP key 1024/FCE97719 FP: 2A 20 46 10 E5 96 27 40 91 B1 95 BA CA D3 BC 14 Antworten auf Deutsch waeren mir angenehm. -- http://yakko.cs.wmich.edu/~frogfarm ...for the best in unapproved information Tell your friends 'n neighbors you read this on the evil pornographic Internet "Where one burns books, one will also burn people eventually." -Heinrich Heine People and books aren't for burning. No more Alexandrias, Auschwitzs or Wacos.

1 0

Re: Homo/bi/sexuals Most Destructive (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Fri, 24 Jan 97 21:33:41 +0000 > From: "Attila T. Hun" <attila(a)primenet.com> > Subject: Re: Homo/bi/sexuals Most Destructive Much drivel about AIDS deleted. > One of the saddest commentaries on the entire problem is the > man, a Pan-American flight steward, who was identified as carrier > #1 by the Communicable Disease Center (CDC) in Atlanta; he died The correct term is 'Patient 0'. Jim Choate CyberTects ravage(a)ssz.com

1 0

(fwd) New keyserver available
by Damaged Justice 17 Dec '03

17 Dec '03

>From: tage(a)cc.uit.no (Tage Stabell-Kulo) Newsgroups: comp.security.pgp.tech Subject: New keyserver available Date: 24 Jan 1997 16:11:26 GMT Lines: 12 Message-ID: <5camve$3d4(a)news.uit.no> A new PGP keyserver, still _very_ experimental, is available at host dslab1.cs.uit.no at port 24162, use telnet(1). In general it will find a key in a few seconds. Your comments and suggestions are solicited. -- //// Tage Stabell-Kuloe | e-mail: Tage(a)ACM.org //// /// Department of Computer Science/IMR | Phone : +47-776-44032 /// // 9037 University of Tromsoe, Norway | Fax : +47-776-44580 // / "'oe' is '\o' in TeX" | URL:http://www.cs.uit.no/~tage/ -- http://yakko.cs.wmich.edu/~frogfarm ...for the best in unapproved information "We think people like seeing somebody in a uniform on the porch." -US Postal spokeswoman, quoted in AP, 1/27/96. I don't know about you, but most people I know who saw someone in uniform on their porch would pull out the shotgun...

1 0

Re: Homo/bi/sexuals Most Destructive (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Fri, 24 Jan 97 21:33:41 +0000 > From: "Attila T. Hun" <attila(a)primenet.com> > Subject: Re: Homo/bi/sexuals Most Destructive Much drivel about AIDS deleted. > One of the saddest commentaries on the entire problem is the > man, a Pan-American flight steward, who was identified as carrier > #1 by the Communicable Disease Center (CDC) in Atlanta; he died The correct term is 'Patient 0'. Jim Choate CyberTects ravage(a)ssz.com

2 1

Re: Airport security [no such thing]
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, On Thu, 23 Jan 1997 ichudov(a)algebra.com wrote: > Is it really true that my response was tossed out as flames? a) NO posts have been "tossed out." Your response was sorted into the "flames" list--not because it flamed directly, but because it was part of the threat started by Dimitri in which he engaged in flaming. b) While I realize this is a judgment call that others might dispute, I don't think it makes much sense to post to the moderated list only the parts of threads that are not flamish. I would rather keep thread intact on one list or the other. There are exceptions. I put one of Dimitri's post on this thread into the moderated list because the point he made did not require particular knowledge of the entire thread and had non-inflamatory relevance. > It was crypto-relevant. Perhaps, but crypto-relevance is NOT the criterion by which I am moderating the list. I am sort on the basis of (a) emotional, non-relevant personal attacks on list members, and (b) spam. I believe (and so far the postings have borne me out) that in an atmosphere of civil, reasoned discourse, the relevance issue will largely take care of itself. By the way, contrary to what Dimitri has alleged, I have posted every message from him in which he was able to restrain himself with regard to gratuitous insults and/or spam. In other words, the set of Dimitri posts that have appeared on the moderated list is not the null set. By the way number two, this response will be posted to the flames list and NOT the moderated list. Even though I have not flamed anyone, two things keep it off the moderated list: (1) my policy about keeping thread on the same list where possible (see above), and (2) basic precepts of fairness. Though Dimitri has stated-- without a scintilla of evidence--that my moderation policy would be used to attack him and not give him the opportunity or forum to defend himself, I am keeping ALL personal attacks off the moderated list. Those who are subscribed to the "flam" postings can see numerous unkind posts about Dimitri that I have not allowed on the moderated list. That policy applies to me just as much as to anyone else. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

Comments
by satan_is_a_hacker＠juno.com 17 Dec '03

17 Dec '03

All comments on my article will be welcome and replied to.

1 0

Anyone have info on foreign "ITARS"
by Bill Campbell 17 Dec '03

17 Dec '03

Does anyone have any pointers to info about the import/export restrictions on encryption products in various countries. I know any such summary would be very dynamic, but perhaps there's something out there. Thanks! =Bill=

1 0

Re: greed and the internet
by azur＠netcom.com 17 Dec '03

17 Dec '03

> The Internet will no no longer be the peoples net, and the > commercial greedies are establishing a faster, more secure > network with controlled access points; leaving the common man's > access in the mud, still paying the exorbitant rates on a pay > before play basis. That, and it gives control of information to > the government --which, as we all know. is 'heavenly white' > -above sin. > Rather than being forced by pressures from the market, smaller ISPs appear to be holding their own and in many cases thriving. A significant number of them have begun to form their own cooperatives to operate mini-NAPs, mosty to aggregate local traffic and reduce unnecessary traffic to the NAPs. It isn't too far a stretch to envision that should this practive become commonplace, these smaller ISPs could band together to create their own Net overlay, bypassing the NAPs. This trend could spell trouble for gov't agencies expecting to monitor Net traffic from only a few convenient locations (i.e., NAPs). --Steve

1 0

Scandinavian Goverments provide PGP to postal customers...
by Hugh Daniel 17 Dec '03

17 Dec '03

FYI: >From: jsp(a)betz.biostr.washington.edu >Sent: Friday, January 24, 1997 2:31 PM >Subject: Meanwhile, back in the Free World... > > >Encrypted Email For Finns, Swedes, Danes > by Sami Kuusela > > 4:43 pm PST 23 Jan 97 - While keeping a watchful eye on the emerging > American encryption policy, Scandinavian countries are embarking > on a joint project to implement the first international email security > service. > > Nordic Post Security Service (NPSS) - involving Finland, Norway, > Sweden, and Denmark - hopes to provide secure email, and > officials say that soon every Nordic citizen can walk into the > nearest post office and sign up for it. > > But no matter the success of the secure email system, the NPSS > project is a clear sign that, unlike the United States, Northern > Europe is moving forward with exporting encryption technology > across national barriers. > > "Finnish policy has not been to start with regulations and fear of > Net issues," says Anu Lamberg, the head of the Information > Network Unit in the Finnish Ministry of Transport and > Communications. "The American discussion on this matter has > been funny to watch, but I hope nobody in Europe or Finland starts > to question the very basics of democracy." > > Based on PGP, with no "third-party" key holder, the Nordic system > uses unbreakable RSA-algorithm encryption with a 1024-bit key. > > However, some hardware is required. Because the key is on a > smartcard, users must have smartcard readers installed on their > computers, which aren't yet widely available. But Pdr Andler of > Finnish Hewlett Packard says that later this year, smartcard readers > will become standard on computers in Scandinavia. "It is a really > big help for users, who don't have to remember dozens of > passwords when using different kind of services," Andler says. > > The project has been moderately successful in Finland - the first > Nordic country to offer the secure email - as the system isn't any > more difficult to use than a standard email program. All the user > has to do is click "send." > > For project developers, using strong crypto was never an issue. > "From the very beginning we've been basing this on strong crypto," > says Vesa-Pekka Moilanen, technical director for Finland Post, and > mastermind of the email project. "At first, the customers are going > to be mainly professionals," he says, "but quite soon private > individuals will start using it." But the use of secure email probably > won't be widespread until 1998 - if then. > > "If strong crypto is banned it's going to have major effects on the > development of information society," says Risto Siilasmaa, the > CEO and president of DataFellows, one of the only makers of > encryption programs in Finland. The Finnish government awarded > DataFellows "most innovative company" honors in 1996. "But > nobody is going to limit strong crypto. I haven't met a single > leading Nordic official who says otherwise." > > One question, though: What if a Nordic citizen enters the United > States with the email program installed on his or her laptop? For > now, Nordic officials are only beginning to contemplate the > ramifications.

1 0