December 2003 - cypherpunks-legacy

subscribe
by Dinesh Mahtani (Dino) 17 Dec '03

17 Dec '03

subscribe mahtani(a)vaxvmsx.babson.edu _______________________________________________________________ | | | TEMPORARY EMAIL ADDRESS: mahtani(a)vaxvmsx.babson.edu | |_______________________________________________________________| _______________________________________________________________ | | | Please note that our company will be changing our Internet | | Service Provider in the very near future. I may be unable | | to view messages sent to mahtani(a)mozart.inet.co.th. To | | avoid any possible problems please update your address | | books and/or send carbon copies of all correspondance to my | | old school address during this transition. | |_______________________________________________________________| _______________________________________________________________ | | | TEMPORARY EMAIL ADDRESS: mahtani(a)vaxvmsx.babson.edu | |_______________________________________________________________|

1 0

Re: Dems Critique Crypto Policy
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

John Young wrote: ADDITIONAL MINORITY VIEWS > > John Conyers, Jr. > Rick Boucher. > Zoe Lofgren. > Maxine Waters. > William Delahunt. > Martin T. Meehan. > We need to be honest about this situation. We don't expect > most narcotics traffickers, terrorists, or criminals to respect > export restrictions on encryption when they don't respect our > underlying drugs or weapons laws. And we don't generally expect > anyone who employs encryption in furtherance of a crime to > readily give their keys to some third party so they may be made > available to the government. The government doesn't expect it, either. As a matter of fact, they are probably sitting back laughing their asses off over your eloquent statements of logic which any rational person could reproduce if they weren't programmed to feed unthinkingly off of government media sound bytes. All of your points are well-taken and they will make no more difference than similar ones have made in the past. You will speak your mind politely while the government goes about usurping the few remaining privacies and freedoms we have. In the meantime, the nation is keeping busy bemoaning the fact that not everyone is going to be so polite in their protest of the government assault on the liberty and freedom of the citizens. The nation is busy venting their rage on a government mandated monster, as always, instead of admitting that there is a much greater monster in our midst which is slaying more of our citizens in a variety of ways than McVeigh could ever dream of. TruthMonger

1 0

Intro to Cyptosystems talk 6/23 7pm
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: net-thinkers(a)thumper.vmeng.com Reply-To: Vinnie Moscaritolo <vinnie(a)webstuff.apple.com> Mime-Version: 1.0 Precedence: Bulk Date: Mon, 9 Jun 1997 14:32:34 -0700 From: Vinnie Moscaritolo <vinnie(a)webstuff.apple.com> To: Multiple recipients of <net-thinkers(a)thumper.vmeng.com> Subject: Intro to Cyptosystems talk 6/23 7pm ever wondered what the buzz about cryptography is all about.. You are all welcome to attend my "Introduction to Cyptosystems" tutorial at the BMUG South meeting.. It's open to the public. When: Monday, Jun 23 Time: 7:00 PM Where: Town Hall, Apple R&D Campus (blding 5) How long: 60 mins or so? --------------- Q: Why should you care about this stuff..? A: The internet is not a secure channel, It's easy intercept your email or files or even know what webpages youve been looking at. Cryptography is a tool that provides you privacy and protection from competitors and the news media scum. How much do you trust to the internet? Cryptography is also the best protector of the most cherished civil liberty: "the freedom of speech" Q: But I have no secrets to keep? A: Cryptography is not just about secrets, In addition to providing confidentiality, modern cryptography holds the building blocks necessary for successful electronic commerce. Authentication: The receiver of a message can ascertain it's origin; an intruder should not be able to masquerade as someone else. Integrity The receiver of a message can ensure that the data has not been modifed in transit; an intruder should not be able to substitute a false message for a legitimate one. Nonrepudiation A sender should not be able to falsely deny that he sent a message Q:Why should I care about electronic commerce. Apple hasnt done anything with it? A: That the point of this talk. E-Commerce will be a bigger market than anything we have ever been in before. Ask yourself, What is the biz proposition for anyone publishing on the NET and the answer will be net commerce. Q: what will you talk about What is Cryptography What it's used for How Cryptosystems work secret/public key encyption, digital signitures, modern crypto systems key management, e-commerce, Governement Issues This talk is NOT about Theoretical Mathematics Programming APIs Specific Products Who this talk is for Marketing Evangelist Engineer Anyone who needs to be Crypto competent There is a PDF of the slides at http://www.vmeng.com/vinnie/papers.html Vinnie Moscaritolo That Crypto Guy at Apple... http://www.vmeng.com/vinnie/ Fingerprint: 4FA3298150E404F2782501876EA2146A --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

AES Comments to NIST
by John Young 17 Dec '03

17 Dec '03

NIST has published the 33 comments received on the proposed Advanced Encryption Standard (AES) intended to replace DES. Several are quite extensive. In addition to those exemplars we've seen here by Bill Stewart and Bruce Schneier, there are remarks by several crypto luminaries, such as Ron Rivest and Clifford Adams (author of CAST), by NSA, by Canada's CSE, and by Certicom, 3Com, TIS, MasterCard, the ANSI X9 Standards Committee, the ABA and so on. http://jya.com/aes-comments.txt (103K)

1 0

Who is an encrypted message for? [PGPtray/Eudora]
by Bill Stewart 17 Dec '03

17 Dec '03

[Fred, could you forward this to pgp-users? Thanks.] PGP 5.0 GUI on Win95 does this for both PGPtray and the Eudora plug-in. When you want to decrypt a message, it doesn't tell you who the message is TO when asking you for the passphrase. Therefore, if you have more than one user id with different passphrases, you don't know which one to type in. Also, from a security perspective, this is bad, because what you do with the contents of a message may be different depending on who it came to or from - was that mail asking for the Secret Plans addressed to your individual Work key, your department key, your home key, or your Illuminati Conspiracy key? This appears to be Versionb b14c3, though it's not easy to find out, and I'm not sure if that's the version of PGPtray, PGPkeys, or both... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list or news, please Cc: me on replies. Thanks.)

1 0

Re: Access to Storage and Communication Keys
by William H. Geiger III 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In <3.0.1.32.19970609000938.00756910(a)popd.ix.netcom.com>, on 06/09/97 at 12:09 AM, Bill Stewart <stewarts(a)ix.netcom.com> said: >I've been using PGP Inc.'s PGP5.0 Eudora Plug-In, >and it decrypts the mail into the mail message buffer itself. When you >finish with that particular message (e.g. go to the next, or just close >it), you get asked it you want to save the modified message, and if you >say "yes" you'll have the decrypted message in your mailbox. However, >there's a negative about this - if you receive mail that's signed and >encrypted, and save the modified version, it loses the signature >information - so it may be more valuable to save the encrypted >version... Well this is why I tell everyone to clear sign the message first and then encrypt it. In my PGP GUI/E-Mail integration E-Secure this is the default behavior. IMHO encrypting & signing (-sea) is a PITA (for the reciever). I also verify signatures of all signed inbound messages and append the output from PGP to the bottom of the message so that you can see the results when the message is opened without having to re-run PGP. The user also has the option to either decrypt messages as they are retreived or to store them encrypted. I just released the first beta of my auto-encrypt code. That was quite fun to write. Myself am rather disturbed by how many PGP/E-Mail implmentations handle signing/encrypting of messages. One of my biggest pet peeves is when only the plain text of a message is signed/encrypted. I have seen this with more than 1 implementation and I see it as a serrious security flaw. Another issue that is usally missed is Bcc's. The whole purpose of using Bcc's is that you don't want the rest of your distribution to know that you have sent a copy to the addresses on the Bcc line. If you encrypt a message with multiple keys including keys for your Bcc's then your Bcc's will be known to everyone who recieves a copy of the message. What I have done to address this is to send seperate copies of the message to each address on the Bcc list each encrypted with only the one key for the address. You can have the strongest algorithms in the world but they do you no good if they are poorly implemented. - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBM5u7uo9Co1n+aLhhAQH/sgP/V/ulJSLuNEV+sBW1hAnRsbYizxUb3tbc eJtG6YZnhszgjmj0ybgA/yfIC3i9uXjvuZeRdyrD9YSTf0a0gWOkcAzhhB/A5XBj Kf80HEXiJhd9dLSxYUGD55QFQNtz1QGbEGCURLyCchuWa0KrpLUofvUZ0cfatk+3 VKbfYn0KMTA= =vvGI -----END PGP SIGNATURE-----

1 0

Get your site Noticed!
by wgrip＠arcturus.net 17 Dec '03

17 Dec '03

Hello, Do you have a webpage that's just sitting there? Need more hits and visibility? Now you can promote your pages like the pros! The WebSeek Promotion Spider puts your pages on the TOP of the Search Engines! Get your FREE Shareware Version today and see what this powerful program can do for your site!! For more info please respond to our Autoresponder at: netnow(a)arcturus.net and say "Promo-Now" Resellers Needed! thanks, Web Promotions! ~~~~~~~~~~~~~~~~~~~~~~~ Note: You will not receive another message BUT we do utilize the Remove List at: remove(a)cyberpromo.com

1 0

Re: Fraud and free speech
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Tim May wrote: > > At 5:51 AM -0700 6/8/97, William H. Geiger III wrote: > >Well I think that there are some that would confuse the issue between 1st > >Amendment free speech and the issues surrounding fraud. Especially those > >in government who write the laws that regulate commercial speech. > > The mistake has been to extend "fraud" laws to non-contract situations, > e.g., ordinary speech (as distinguished from contracts). Any time that you see a thread in which Kent Crispin accuses someone of trying to "muddy the waters" you can pretty much guarantee he is trying to throw a logical curveball of his own. Kent added some tripe to the thread supporting his favorite theme, which is that it is the job of government to "enforce" contractual agreements. Naturally, he also extends the format of these contracts to include government authority to enforce criminal penalties for statements made by the great grandfather of the second cousin of the spouse of one of the person making the contract. Follow any thread after a Crispin post and you will find people arguing over issues he raises which have little basis in reality. > Contracts, with clearly stated conditions and with judgeable or > falsifiable/testable conditionals, are a matter for the courts (private > courts, in fact), but vague promises, advertisements, propaganda, etc. are > not. Dimitri wrote a couple of posts which dealt well with the original concept of two parties agreeing on an arbitrator/judge to settle contractual disputes (e.g. the court of Prince X) and the following usurpment of these free-will agreements by people in power who decree that _they_ are now the only valid arbitrator/judge in contractual matters. We now have a system where if someone breaks agreement with you the government locks them in a cage where there is no possibility of them paying you what they are contractually obligated to. The government doesn't give a fat rat's ass what your desires are for resolution of the dispute. They are always busy protecting the nebulous "other" rather than someone real, with a real interest in the situation. The government mandates that contractual agreements must be settled in a forum where the corporation with an army of lawyers can bury the attorney that Joe Average picked out of the yellow pages. When you enter into a contractual agreement with someone who has a guy named "Big Louie" as arbitrator, however, the government calls it organized crime. Pardon me if I fail to see the distinction. TruthMonger

3 2

ZDNet Announces Computer Magazine Archive!
by announce＠lists.zdnet.com 17 Dec '03

17 Dec '03

---------------------------------------------------------------- ZDNET ANNOUNCEMENT 6/10/97 ---------------------------------------------------------------- Introducing Computer Magazine Archive: Subscribe today--FREE until June 30th! Need an easy way to track the latest computer industry trends, research your competitors, follow the latest IPO's or research just about anything related to high-tech? Computer Magazine Archive, a new service from ZDNet, puts over 55,000 articles from 70 of the most popular computer publications at your fingertips. You won't need to search through piles of old publications or your overstuffed clipping file for information anymore. Simply log on to http://cma.zdnet.com for a faster, more effective way to access the information you need. ----SPECIAL LIMITED-TIME OFFER---- Similar information databases typically sell for thousands of dollars a year. With Computer Magazine Archive, you can access the same information for only $4.95 a month! And as a special introductory offer, it's FREE until June 30th when you sign up today. Try it risk-free and if you're not completely satisfied, simply cancel before June 30th and pay absolutely nothing. Log on to http://cma.zdnet.com to test-drive Computer Magazine Archive today. It's the most comprehensive database of computing articles you'll find online! Computer Magazine Archive: http://cma.zdnet.com ________________________________________________________________ ZDNet Announcements are periodic notices of new features, special events and free offers available to members of ZDNet. --To subscribe to ZDNet Announcements, please send mail to: announce-on(a)lists.zdnet.com You can leave the subject and body blank. --To unsubscribe to ZDNet Announcements, please send mail to: announce-off(a)lists.zdnet.com You can leave the subject and body blank. ________________________________________________________________ Powered by Mercury Mail: http://www.merc.com

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; $remailer{"lucifer"} = "<lucifer(a)dhp.com> cpunk mix pgp hash latent cut ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash middle latent cut ek"; $remailer{"winsock"} = "<winsock(a)rigel.cyberpass.net> cpunk pgp pgponly hash cut ksub reord"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"balls"} = "<remailer(a)huge.cajones.com> cpunk pgp hash latent cut ek"; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp pgponly hash latent cut ek"; $remailer{"middle"} = "<middleman(a)jpunix.com> cpunk mix pgp hash latent cut ek reord"; $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{"dustbin"} = "<dustman(a)athensnet.com> cpunk pgp hash latent cut ek mix reord middle"; $remailer{'weasel'} = '<config(a)weasel.owl.de> newnym pgp'; $remailer{"reno"} = "<middleman(a)cyberpass.net> cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{"wazoo"} = "<remailer(a)wazoo.com> cpunk mix pgp hash latent cut ek"; $remailer{"shaman"} = "<remailer(a)lycaeum.org> cpunk pgp hash latent cut ek"; $remailer{"hidden"} = "<remailer(a)hidden.net> cpunk pgp hash latent cut"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. remailer(a)crynwr.com is _not_ a remailer. There is no remailer at relay.com. Groups of remailers sharing a machine or operator: (cyber mix) (weasel squirrel) The alpha and nymrod nymservers are down due to abuse. However, you can use the nym or weasel (newnym style) nymservers. The cyber nymserver is quite reliable for outgoing mail (which is what's measured here), but is exhibiting serious reliability problems for incoming mail. The squirrel and winsock remailers accept PGP encrypted mail only. 403 Permission denied errors have been caused by a flaky disk on the Berkeley WWW server. This seems to be fixed now. The penet remailer is closed. Last update: Mon 9 Jun 97 6:45:22 PDT remailer email address history latency uptime ----------------------------------------------------------------------- hidden remailer(a)hidden.net #-##*---#### 38:53 99.99% weasel config(a)weasel.owl.de ++++--++--+ 2:09:06 99.95% squirrel mix(a)squirrel.owl.de +-++--++-++ 2:05:06 99.95% jam remailer(a)cypherpunks.ca ****** ***** 10:29 99.83% balls remailer(a)huge.cajones.com ###.-## #### 38:28 99.71% replay remailer(a)replay.com ***** ** ** 5:44 99.35% mix mixmaster(a)remail.obscura.com *.-.-----. 7:30:50 97.83% reno middleman(a)cyberpass.net -+--------+- 1:19:13 97.76% winsock winsock(a)rigel.cyberpass.net -+-------- 3:48:43 95.95% lucifer lucifer(a)dhp.com +++ +++ + 51:30 91.29% cyber alias(a)alias.cyberpass.net ***** ** * 15:59 88.67% nym config(a)nym.alias.net 3:02 0.05% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0