December 2003 - cypherpunks-legacy

wanted dead or alive: pgp5.5 key pair
by Adam Back 17 Dec '03

17 Dec '03

Could some kind soul who has downloaded pgp5.5 for business (I think it is available in the US from www.pgp.com) create a key with a CMR key extension. I guess this means generating two keys: XYZ Corp recovery key <snoopy(a)xyz.com> and then: XYZ Corp Sales <sales(a)xyz.com> with the sales person's key set up to have a strict requirement to encrypt to the XYZ "message recovery" key. Could this kind soul then mail me, (or post here I guess would be even more useful) both the private and public keys of both of them. Enciphering minds want to find out how pgp5.0 reacts to this key :-) (The question is really does pgp5.0 encrypt to the CMR key). (btw for the curious as to why my previous message was had a date of 22nd Feb ... I had to set my clock back to get pgp5.0 beta to function as the one I have had expired, and I forgot to set the clock forward again). Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

3 2

None
by Anonymous 17 Dec '03

17 Dec '03

Everyone has a "right" to speak to the government on any subject whatsoever, which cannot be abrogated by contracts, agreements or willful desire. A populace that holds no secrets is a safe populace. This is why we are officially announcing the formation of a federal agency, the Government Agency of Knowledge. Its role will be to obtain - by whatever means necessary - any and all knowledge of all actions, desires, means and ways of everything transpiring on US soil. Duties will include holding cryptographic keys in escrow, monitoring and assuring the wholesomeness of private and encrypted data traffic, and analyzing all available "knowledge patterns" of US citizens. Since honest, good citizens have nothing to hide, GAK will be a major advance toward protecting American citizenry from crime, terrorism and other human-meditated harm. After all, your government has a right and duty to protect you.

1 0

No Subject
by rka2＠hotmail.com 17 Dec '03

17 Dec '03

To: rka2(a)hotmail.com From: rka2(a)hotmail.com Subject: Simple Reply-to:rka2@hotmail.com Comments: Authenticated sender is <rka2(a)hotmail.com> Received: from hotmail.com (hotmail.com [000.000.000.000]) by hotmail.com (0.0.0./0.0.0.) with SMTP id AAA000000 for <rka2(a)hotmail.com>; Tue, 30 Sep 1997 23:37:27 -0500 (EST) Message-Id: 0000000000.AAA000(a)hotmail.com X-UIDL: 54956195511931597781388792848969 This may be the most important message of your life! You're not going to believe what you hear when you call this Toll Free number: 1-800-811-2141 (CODE 45434). We realize that almost everyone hates selling so we decided to solve that problem! Let our team of over 250 professional telemarketers work the phones, mail out brochures on your behalf, and most importantly "Close The Sale For You." This is a truly simple business that anyone can do which is why it works so well. You just give out the 800 number and your code and that's it. Everything else is done for you. No meetings, no presentations, no selling! Many are making over $8000/month! Call Today! You'll Be Glad You Did!! Toll Free: 1-800-811-2141 (CODE 45434) ============================================================== For name removal information please visit http://www.iemmc.org/remove.htm or send an email to globalremove(a)iemmc.org and you will be permanently removed from our mailing list as well as many others at the same time. Thank you very much.

1 0

PGP 5.5 CMR key examples, mini-review
by Greg Broiles 17 Dec '03

17 Dec '03

An acqaintance of mine received an evaluation copy of the new PGP For Business Security 5.5 suite, and I was able to generate some test keys to play with the message recovery features. I've uploaded them to the cert servers so folks with the 5.0 client software can experiment with them for interoperability, etc. The recovery key is "Little Brother <snoop@localhost>", fingerprint 26A5 667A 97D4 7018 1B18 2B15 D631 4776 B670 E1D0; a test user whose incoming and outgoing mail is forced to include the recovery key is "CMR User <snooped@localhost>, fingerprint EC79 A170 8BAE 60A1 3CAC C517 34A4 6056 EE42 30E3. Both keys are 768-bit DH keys, as I don't expect that anyone will use them for anything other than testing. Installation of the package involves multiple steps - there's an "administrator install package" (my term, not theirs), which installs a version 5.5 of PGP, including the PGPTools, PGPKeys and PGPTray apps, as well as a PGPAdmin program. To implement CMR, the ordinary PGPKeys app is used to create an otherwise ordinary PGP key pair; the administrator then runs the PGPAdmin app, which asks questions about security/recovery policy. The admin can force incoming messages to use a recovery key, can force outgoing messages to use a recovery key, can enable/disable conventional encryption, can enable/disable key generation (and RSA key generation), can force a key to be trusted and to act as a trusted meta-introducer. The admin can also force the user to use a strong passphrase. (PGP 5.5 includes a neat passphrase-strength-meter which changes depending on the length and apparent alphabet-space used in the passphrase for user keys.) Finally, the admin can force the user to sign/trust a designated Corporate Signing Key. After the administrator sets those policy choices, the PGPAdmin tool can be used to generate a customized installer application for distribution to users. That installer creates a local copy of PGP, which will enforce the policy choices made by the administrator. The user is warned upon key generation that a message recovery key will be used (if the app is thus configured) and that the behavior isn't optional. The recovery key ID is displayed but not modifiable. The user interface for 5.5 is much improved over that in 5.0, which was a big improvement over the command line. There's an indicator (initially preferenced to OFF, along with other information) in the PGPKeys application which marks CMR'd keys with a red button; the interface between PGPKeys and the key server is much improved. It's now possible to mark & retrieve many unknown keys, then approve adding them to the local keyring in one step, instead of approving the addition of each additional key. The icons & screen design have been updated and are now more colorful and easier to decipher. When a user with CMR-only client software encrypts data, the ID of the recovery key appears in the "encrypt to" box, and cannot be dragged out. A CMR-client will (apparently) still do conventional encryption with no recovery key if the admin allows this. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | Export jobs, not crypto. http://www.io.com/~gbroiles | http://www.parrhesia.com

1 0

Searching_for_representatives
by casinomarket＠correy.com 17 Dec '03

17 Dec '03

Dear Friend! We are offering an exclusive, unprecedented opportunity to earn money, and even start your own marketing business in the field of online gambling. We are a legitimate highly regarded firm, which has now developed a technologically advanced web product that is a completely unique and new introduction to the Internet - the first 3D multi-player on line casino. We are searching for representatives, who are well connected and have proven marketing abilities, to cooperate with us in marketing our unique product. Get more information at : http://www.casino-on.net/market Best Regards, Casino On Net Marketing Department CASSAVA ENTERPRISES LTD. ----------------------------------------------------- This email is for adults only! It concerns you only if the Internet qambling is legal in your country. -----------------------------------------------------

1 0

See the Seasons's Hottest Video Games on VideoGameSpot!
by announce＠lists.zdnet.com 17 Dec '03

17 Dec '03

----------------------------------------------------------------- ZDNET ANNOUNCEMENT 10/22/97 ----------------------------------------------------------------- Video games are going to be on everyone's Christmas list this year, and there are so many hot titles coming out, it'll make your head spin. If you need help finding something for yourself or the right gift for someone special, there is one site that will be your guide to the best games of the season - VideoGameSpot: http://www.zdnet.com/chkpt/zdna971022001/www.videogamespot.com/ VideoGameSpot is the leading video game information site on the Web. With the largest editorial staff in the business, you'll find everything you need to be in the know this holiday season. VideoGameSpot gives you: * Hard-hitting, critical reviews of the latest games played on the Sony PlayStation, Nintendo 64 and Sega Saturn console systems * Previews of games you've been waiting for and other new releases * Hints and strategy guides to help you play better and win * Custom Quick Time trailers so you can see games before you buy them * Monthly contests and promotions with thousands of dollars in prizes given out each month If you like video games (or know someone that does) and want to buy smarter and play better, then click on the URL listed below (or enter it into your browser): http://www.zdnet.com/chkpt/zdna971022002/www.videogamespot.com/ You'll also find us on the Games Channel at ZD Net: http://www.zdnet.com/chkpt/zdna971022003/www.zdnet.com/games _________________________________________________________________ ZDNet Announcements are periodic notices of new features, special events and free offers available to members of ZDNet. --To subscribe to ZDNet Announcements, please send mail to: announce-on(a)lists.zdnet.com You can leave the subject and body blank. --To unsubscribe to ZDNet Announcements, please send mail to: announce-off(a)lists.zdnet.com You can leave the subject and body blank. _________________________________________________________________ Powered by InfoBeat: http://www.infobeat.com

1 0

Re: the migration path (was Re: Your "RIGHT" to Speak to Big Brother)
by Blanc 17 Dec '03

17 Dec '03

Adam Back wrote: >Perhaps this is what they are busy building at their top-sikrit crypto >software development/research center at Cambridge, UK under the >guidance of new head of research cryptographer Roger Needham. >Looks like an export embargo end-run by Bill Gates. > >Maybe Bill Gates is a cypherpunk after all, well we can live in hope, >anyway. ................................................................. He's no anarcho-cypherpunk: he and his father just contributed a great amount of money to support a gun-law initiative which would place all sorts of requirements on gun-owners (mandatory licensing, mandatory training, mandatory gun-locks, and many privacy-intrusive reductions of personal authority, etc.) in Washington state. I don't precisely know where he stands regarding crypto, but I know that he puts business requirements and customer acceptance above the arguments of GAK advocates, as do the VIPs who work in encryption and who totally reject the idea of Big Brother. .. Blanc

1 0

Re: everybody wants a piece of Microsoft's monopoly
by Blanc 17 Dec '03

17 Dec '03

It is intruiging to observe how alarmed certain companies get about Microsoft's methods (as though sellers of bundled MS software couldn't themselves just say "no" to such business proposals, without the government's assistance), and how Billg (and his legal advisors) deal with the govmt as they get further and more precisely investigated. It should be instructive and inspiring for everyone else, when MS wins, to see how (if) they do it. I would sympathize, but Billg is a great believer in "lawful" ways of doing things, often cooperating in regard of hiring practices and monopoly watch-dogs, among other things, so it is of great interest to me to see how he deals with these "lawful" types who believe they have cause to stick it to him. 'Tis a fine line he walks, between supporting the methods of The Law, using its services, and also being highly successful in beyond the limits set forth in the Official U.S. Rules for Success, Section 0.123, p. 26.930. Anyway, it's all "for the customer", you know. .. Blanc

1 0

30� a click, paid weekly!
by brian＠firstgear.com 17 Dec '03

17 Dec '03

Send More, Convert More & Earn More! Want to get paid what your traffic is really worth? Sign up and we'll show you how! http://www.More4Clicks.com This message is intended for Webmasters, we want to help you make your site profitable. We apologise for any intrusion. mailto:emissary@lostvegas.com?subject:remove

1 0

PGP 5.5 CMR/GAK: a possible solution
by mark＠unicorn.com 17 Dec '03

17 Dec '03

[Posted to cypherpunks, cc:-ed to Jon Callas] You know, in the last few days I've read a lot of messages on both sides of this debate, and I've umm-ed and ahh-ed and slowly gone from thinking that what PGP are doing is evil to thinking that it's just bad. While I believe that Adam Back's suggestions for alternate systems are good and neccesary ideas for the long-term, I'm coming to the conclusion that PGP are heading in the right direction for the short-term, but have things backwards. The current system sends out a user's personal key, with a tag to say that if I don't encrypt to the company as well, my mail will bounce. But think about this: how often do I want to send email to a particular person in a company, and ensure that only they see it? And how often do I want to send mail to a particular group inside a company? All I want is to ensure that I get a response from the company, I usually don't care who I talk to in the process. So PGP's "everything private unless you choose to make it public" system seems backwards. Surely what we really need to meet these customer demands is an "everything public (within the company) unless you choose to make it private" system? That is, all mail to my department inside the company should be encrypted to a department key, shared by all members, *unless* it is confidential, in which case it should *only* be encrypted to me. Here's how I see this working: when Joe Blow joins Foo-Bah Cryptosystems, he creates his own personal PGP key. He also gets a copy of the department key, which he can use to decrypt any mail which is encrypted to his department; or this decryption could be handled automatically by a department email server to ensure that individuals never have access to the department's private key. PGP then creates a public key for 'Joe Blow <joe.blow(a)foo-bah.com>', which would be the department key with a signed tag linking it to his personal public key. This is the tagged corporate public key which he would give out to any customers. When a customer wishes to send email to Joe, he would use this public key. When encrypting, PGP would detect the tag and put up a dialog box pointing out that this is a corporate key and if they click on the 'confidential' button it will be encrypted to the user's personal key prior to encrypting to the corporate key (by which I mean superencryption, to avoid traffic analysis). The default would be not to superencrypt; and as a side effect this system would be compatible with any version of PGP for non-confidential mail (assuming that version understands the encryption algorithms in use). The effect of this is that if someone wants to send email about an urgent bug and I'm out at lunch, any of my co-workers can read that mail. But if they want to send *me* mail about confidential inter-company negotiations, the co-workers could decrypt the outer layer of the message, but would be blocked by the inner layer encryption to my personal key. As I see it, this system is simple, solves the problems which PGP claim they need to solve without creating the snooping problems Tim and others have discussed, cannot easily be adapted to GAK ('This message is to be encrypted to the FBI public key. If it is confidential, click here to superencrypt to the recipient's personal key'), and won't require a massive change to the PGP source code. There are some obvious security issues with having the department key shared amongst the members of the department, but I don't see that they are any worse than PGP's current CMR implementation, which has already discussed the use of department keys; it's certainly better than using plaintext. There are also problems with encrypting confidential mail to multiple recipients, but they're surmountable; an easy solution, if you don't care about traffic analysis, is to only encrypt confidential mail to the personal key rather than superencrypt with the corporate key. In most cases such mail wouldn't be sent to multiple recipients anyway. So here's how I'd see the simple system working: A PGP CMR key would consist of 1. A corporate key; this might be company-wide, department-wide, or an individual escrowed key; this choice is a seperate key-management issue for the corporation. 2. Optionally a personal key, which could only be decrypted by the individual. 3. A signature from the corporate key linking the personal key to it and the specified User Id. 4. Optional flag to indicate which key to encrypt to by default. 5. User Id, signatures, etc When PGP was asked to encrypt to such a key, it would check for the optional personal key. If it wasn't there, it would put up a warning box to tell the user that the message can be read by people other than the recipient. If it is, then it would put up a dialog box allowing the user to choose whether to encrypt to the corporate key or the individual key, normally defaulting to the corporate key. This system could not easily become GAK because it will only encrypt to one of the keys and not both; the FBI could create FBI CMR keys from all our public keys, but then PGP would either encrypt to the FBI and I wouldn't be able to read it, or encrypt to me and the FBI wouldn't be able to read it. Anyone care to pick any holes? Mark |-----------------------------------------------------------------------| |Mark Grant M.A., U.L.C. EMAIL: mark(a)unicorn.com | |WWW: http://www.unicorn.com/ MAILBOT: bot(a)unicorn.com | |-----------------------------------------------------------------------|

7 10