December 2003 - cypherpunks-legacy

Re: New PGP "Everything the FBI ever dreamed of"
by Bill Frantz 17 Dec '03

17 Dec '03

At 9:52 AM -0700 10/3/97, Robert Hettinga wrote: >Comments? > >From: Martin Minow <minow(a)apple.com> >"The new version also includes some of the most sophisticated techniques >for enforcing this policy through the corporation. The most novel may be a >new version of software controlling a company's SMTP server, the machine >that acts as the central mailroom for a corporation. PGP provides a >software agent that will read all of the mail to make sure that it complies >with the corporate policy. This may include requiring all messages to be >signed with digital signatures or include a backdoor that the management >can use to read the message. If the software agent discovers a message >violates the policy, it can either return it to sender or simply log a copy. I wonder if it can handle the following: (1) Encrypt real message (e.g. use PGP or Entrust). (1a) Strip the headers. (2) UUEncode the message. (3) Encrypt the message with the corporate system including CAK. (4) Send it thru the SMTP server. ------------------------------------------------------------------------- Bill Frantz | Internal surveillance | Periwinkle -- Consulting (408)356-8506 | helped make the USSR the | 16345 Englewood Ave. frantz(a)netcom.com | nation it is today. | Los Gatos, CA 95032, USA

1 0

Re: Sameer Parekh and C2Net offer a $50,000 reward for the killing of Zionist Vulis
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Anonymous wrote: > Allah akbar! God is great! Sameer Parekh and C2Net have placed a $50,000 > contract on the life of the miserable Zionist Dimitri Vulis residing at: > 67-67 Burns St > Forest Hills, NY 11375 > U.S. of A. > Sameer Parekh is the official supplier of cryprographic software to the > Palestine Liberation Organization and Hamas. This would explain the "Infidel Inside!" sticker on the Stronghold software packaging. > Death to the Zionist aggressors! Death to Vulis! God is great!

1 0

Transmission Management
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Lucky Green wrote: >And PGP's Policy Enforcer has another side to it: have you ever >forgotten to encrypt email that should have been encrypted? I >have. With the Policy Enforcer installed, that can't happen. Which >may well save big hassles in the future. (This feature is independent of the GAK aspects of the product.) It's probably a good idea to set up your mailer so that it discourages transmission of unencrypted mail. This could be as simple as a sequence of questions: "Do you want to do this?", "Do you really want to do this?", and "Are you absolutely one hundred percent sure that it is a good idea to put this message on tape at Fort Meade for eternity?" But, you could make more amusing warnings. For example, the mailer could convert your message into a front page article for the New York Times and show you what it will look like. Agencies which handle encrypted communications typically track every message sent. We should do the same thing. Most people probably do this in an informal way, but really slick tools for doing this would have their uses. This is especially true when managing an identity. Not only would it be nice to track every transmission in a nice easy to assess way, but also track exactly how it was transmitted, the precise time of transmission, and the remailers used to deliver it. This raw information would be neat to have, but it wouldn't get really useful without an analysis tool. For instance, you could see how much your identity depends on the security of certain remailers. If you use one remailer in your chains a lot, you might want to have something which warns you that you are becoming overly dependent on that remailer. Or, you might want to run "what if" scenarios to see if you would be vulnerable if a particular set of remailers were compromised. If the analysis tool were really good, it would hunt for weaknesses based on known remailer attacks. And, naturally, for proper identity management it would be important to keep a running score for the odds that each identity were compromised and by which threats. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDh0V5aWtjSmRH/5AQFyFwf+OhIbig7B/njU1yTlDdIuBHs3jpYyH6Ol /+Cjk9X2MbFkYGec3vm8muf1alGI/8ZH+NV73cXry1rN8FqdIY/eoJX5OoRhTQpa ajQFNnSaufbY2xgx45o7S+jFCFGaasInjsvl7q78iH8JL2seXgG3t7HNsK/SZOqD lZynyUqCaVssiSTkDHiZx72TUPJbhUCOvkoKdiy5evQlN7PPyKNmajB9INbzin7z qKqfyyHyFR+Gu618IojassyZ9wuEzbjMStTRMf8TGOo8yJWaH0+W7KX9JHVF3Zdv EjINSw7EBxMAOk83AY9YP0nuLJnwaEoloKifX6D+MmQ+Jx9Js2ocuA== =HUZ7 -----END PGP SIGNATURE-----

1 0

Re: Unicorn an NSA agent? WAS: New PGP "Everything the FBI ever dre
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Black Unicorn wrote: >Remember when the phone company used to lease you your phone? Surely >that doesn't make the data that goes over the phone their property? >If my doctor calls me at work with the results of a critical test, >you believe that data is no longer private? I hope not. You think >whatever goes on in a rental car I drive is the property of the >rental company? That if some company rented the car they are >entitled to read whatever papers I have in there? What about a >hotel? A leased apartment? A restraunt back room? I challenge the >"ownership gives the owner the right to all that occurs or is >produced on or in the property" premise because it is just not a >valid one, legally or (in my opinion) ethically. Mr. Avon is talking about agreements, I believe, although he is using the private property approach to argue that there is certainly a meeting of the minds between the two parties. It seems reasonable that employees may agree to give up their rights, for example their inalienable right to stay at home and watch TV, in exchange for employment. When the employment agreement is at will, as most are, it seems reasonable that the company may change it whenever it pleases: "If you wish to continue working here, you will have to let the company read your mail." This is complicated by the bizarre legal environment which employers face in the United States. In practice one would have difficulty terminating an employee by changing the "at will" agreement. More generally, it seems a good guess that Mr. Avon would not object to an agreement with a company in which the company was able to continuously monitor the employees communications or activities. (This is why the private property approach can confuse people: this is not the core issue.) >[I'm not on cypherpunks anymore, anyone there who wants to put me >through the wringer without having to endure my response might not >want to CC: me.] Guess you miss out, then. ;-) Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDh325aWtjSmRH/5AQFfWwf/RfjQ38YvvqNAxkcSTWKhFM09fySjgCvG PlSrimP30jC/dWHAH3iZavS5fn8LE+rfHSHBy5UZyE6xyuyAsJHpMYXDjoQ7gMau vKWHCPCKoxNoi/UNFJ6FQXAEy3o+nBp1pRVupOr/gGFaegCd0tglEyzxCEiFguOf utUGX2X7C5wK2Lwhe+lVJqqlvzkwLXt9UKYzanJc8LZmlAjmcmrPySXC+KSnvfve YHGGqD6+jxxqNxqRVpvCpO4JeJ8O+95O3oCxrOKg7b5SwtOo21qnxkBkFNGyuTq9 YGzQJs/0Ha8Gr9Vk+QiT5CjUAdw+N/uahaPkNWjf1f4SztKpz3y0ZA== =FlvU -----END PGP SIGNATURE-----

1 0

MISTY encryption
by Nobuki Nakatuji 17 Dec '03

17 Dec '03

MISTY Misty is a cryptographic algorithm developed by Mitsubishi Electric after they broke DES in 1994.It is designed to withstand linear and differential cryptanalysis, but has not yet been cryptanalysed. As it has not undergoneintensive peer review, the usual caution is recommended. It is being considered for inclusion into the SET 2.0 standard. http://www.mach5.com/crypto/algorithms.html ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

Moderation Revisionism (Try to forget!)
by TruthMonger 17 Dec '03

17 Dec '03

Those who are so quick to act as apologists for the C2Nut blitzkreig on the anarchistic freedom of the CypherPunks list forget that by the end of the 'moderation experiment,' the mailing list had lost an estimated 6 million Jewish subscribers. It is likely that we would have lost even more, had it not been for the valiant efforts of Dimitri Vulis to warn us about murdering Armenian bastards in our midst. When the Johnboot of Fascism descended on the CypherPunks mailing list, the evil Dr. Sandfort was given free reign to do bizarre experiments with twin mailing lists, severing parts of toad.com's electronic brain into seperate sections, and producing a mutant clone which was passed off as the original entity. Unfortunately, the Electronic DNA of the mutant strain of the list was not stable, and began to disintegrate, resulting in a denigration of the mutant list body to the point where parts of its electronic body began to become corrupted, even falling completely off, at times. After the nuking of toad.com and Nagasaki, the list CypherSpace was divided up among the winners, with the Eastern Block under control of Comrade Chewd-Off, the Western Block was apparently liberated under the flag of InfoNex (although their ties to the C2Nut secret government remain in place), and Texas, as always, remained a seperate CypherPunk nation just south of Intel, with Commander in Chief Choate launching a bandwidth race to keep ahead of the Eastern Block. Currently there are calls for crypto disarmament coming from the peace-loving folks in DC, in the interests of making the world a safer place, but they are meeting resistance from crypto-guerillas who refuse to recognize that the war is over and it is time for us to ask, "Why can't we all just get along (a long toilet plunger and shove it up somebody's ass)." DigiCash remained neutral during the moderation experiment and denies that they are in possession of large sums of eca$h left with them for safekeeping by the missing Jewish members of the mailing list. There have been rumors that many of the leaders of the attack on the CypherPunks list escaped to Anguilla, a small island in the Caribbean, where they plotted an even greater conspiracy to take over all of cryptography by seizing control of the financial cryptography arena, but Herr Hettinga claims that it was simply a meeting of the Bavarian Illuminati. He denies any claim that there were closed meetings in which a secret alliance was formed with the Japanese, but recent activity by Jochi Ito has led many to suspect that this is indeed the case. In my private meetings with the remaining members of the CypherPunks mailing lists, each of them confirmed that they are members of one three-letter organization or another, although most of them continue to deny it in public. Kent Crispin and Phillip Hallam-Baker asked me to please not blow their 'covers,' so I will not comment on them directly. I hope that this clears things up for everybody. Now just try to forget all about it. RevisionMonger

1 0

Re: Unicorn an NSA agent? WAS: New PGP "Everything the FBI ever dre
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Lucky Green wrote: >Meanwhile, I can understand the desire of a company to be able to >read old outgoing email even after the employee quit or forgot their >passphrase. After all, it might contain valuable information about >details surrounding past negotiations with clients. Information that >I would not want to be without. I have never seen or even heard of an instance where it was necessary to go through an employee's electronic mail. Has anybody else ever witnessed such a situation? While we can construct hypothetical circumstances, in practice the need for this feature is rare. What, then, are some sources of the (alleged) demand? 1. PGP is preparing to compromise with The Great Satan, and to have a viable company after The Fall. 2. Secure software is becoming perceived as naughty. Given the insecure legal and regulatory environment in which companies operate, a perception as a naughty company can be expensive. 2.1 Drug testing is an example of similar behavior. In practice, few companies implement an effective drug testing program. External image, then, is the likely motivation. 3. Many companies have a corporate culture of dominance over their employees. This is yet another way of expressing their perceived position. (Perceived, that is, by the employees and the employers, but not perhaps by outsiders.) 3.1 Common drug testing techniques have sado-sexual overtones. 4. Companies may not wish to have their right to read employee mail challenged. (Were employees to commonly protect their mail from employers, the common practice could, in time, be transformed into a right, regardless of contractual agreements.) Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDhuUZaWtjSmRH/5AQFflAf5AWr65whT2ZM9yzaHxs5lX9ViocBCqr6A O+1FG/2xPzk+o4hf9zeXMTThyKu+iQ5NgcCWd+ocRRPwIsIB3TJuAmxBJ2tgLISZ dqtgDkEyXmoD4Mq+ALpNy0wcJ0Z/q1LUhZErm6gGOPGhkVeVTn8Gscj+qDHJPu2M ji8/9v8pjYRKe1BsS8ZJlirNwMdC5Use6Ig/Z3uOHmEcnMh+jeZmbAyLcGupNzd9 hjh/q7hThyEIN7v5mJVjg16oXJ0ryN1SkbIvnMimx8b8dYs47z5C5HaUZYX2CZDc XicfmAv5w+Y87dE7HQh9hKmOH36c2Ajfw0hdbQTxWWkFmPys6hDdvQ== =cJtj -----END PGP SIGNATURE-----

1 0

Re: Pretty Good Piracy
by Brian B. Riley 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 10/5/97 6:37 PM, Anonymous (nobody(a)REPLAY.COM) passed this wisdom: >Ryan Anderson wrote: >> Okay - the only difference between this and a normal version of >> PGP is that it always encrypts to a certain key-id, in addition >> to all others. >> >> That's the only weakness you'll see in it. > >It's the only weakness that's needed to compromise all the keys. It seems to me that it should not necessarily compromise all keys, though it does in effect provide for a goodly number of 'known plaintext' objects. Could some of our hardcore crypto experts comment on IDEA's susceptability to known plaintext which then provides 'plaintext' to the DH/DSS or RSA keys and what is their susceptability to 'known plaintext' It occured to me while proofreading the above that in effect a digitally signed cleartext document provides 'known plaintext' every time its used, since the SHA-1/MD-5 can be computed the hash is a 'known plaintext' on the DH/DSS and RSA keys ... is this one of the reasons for the two key types in PGP5 ??? -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNDgmJcdZgC62U/gIEQIvgwCg/kybc9ons3ji3cbi9jtSnQ3kptkAn3IC 90pwzjjpt2qqhpjn8VRlrOGR =IIkE -----END PGP SIGNATURE----- Brian B. Riley --> http://www.macconnect.com/~brianbr For PGP Keys <mailto:brianbr@together.net?subject=Get%20PGP%20Key> "Never ask what sort of computer a guy drives. If he's a Mac user, he'll tell you. If not, why embarrass him?" - Tom Clancy

3 2

Zergo Report
by John Young 17 Dec '03

17 Dec '03

Thanks to Adam Back and Ross Anderson the full Zergo Report on encryption use by the NHSnet is online at: http://www.dcs.ex.ac.uk/~aba/ukcrypto/zergo.html (139K) There may be action by HMG to prohibit publication in the UK (and maybe elsewhere) so we've mirrored it at: http://jya.com/zergo-aba.htm Other mirrors encouraged.

3 2

C2Net offers Vulis $100,000 for not talking about Stronghold
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Sameer Parekh called Dmitry Vulis on the phone today and offered him $100,000 if Vulis promises not to publicize the security flows that Vulis has found in Stronghold, C2Net's only remaining product.

3 2