March 2004 - cypherpunks-legacy

Mixmaster 3.0b1 released
by Len Sassaman 20 Mar '04

20 Mar '04

Mixmaster 3.0b1 has just been released. This release includes two year's worth of development on the Mixmaster software, numerous stability improvements, anonymity benefits, bug fixes, and feature enhancements. We would like to agressively move this out of beta into final release as quickly as possible, so we're highly encouraging users and remailer operators to send us their feedback. Mixmaster can be obtained from: https://sourceforge.net/projects/mixmaster/ The change history for this release can be viewed here: https://source.mixmaster.anonymizer.com/svn/mixmaster/branches/mixmaster_3_… Thanks, Len

1 0

Challenge-response port knocking for TCP
by Thomas Shaddack 20 Mar '04

20 Mar '04

The idea of advertising opportunistic crypto presence in TCP/SYN inspired me to another one: authenticated connection handshake for TCP protocol. Scenario: Application listening on port P of server S, only for authenticated users. Unknown user sends TCP/SYN to S:P, gets back TCP/RST, with challenge in MD5 field of TCP options. The user doesn't support this scheme, so considers the port closed. Unknown-now known user sends TCP/SYN, gets back TCP/RST with the challenge, sends another TCP/SYN, this time with calculated response using a shared secret, again in TCP MD5 option field, gets back TCP/SYNACK. The random challenge should be sent back in all TCP/RST packets, otherwise port scanning will still be possible. Is it a good idea? Could it work? Why not?

2 1

FSTC Feb/March Project Update
by Jim Salters 19 Mar '04

19 Mar '04

1 0

FSTC Feb/March Project Update
by Jim Salters 19 Mar '04

19 Mar '04

1 0

FSTC Feb/March Project Update
by R. A. Hettinga 19 Mar '04

19 Mar '04

--- begin forwarded text

1 0

Al Qaeda backs Bush-Cheney 2004
by Major Variola (ret.) 19 Mar '04

19 Mar '04

http://wireservice.wired.com/wired/forms/printstory.asp?section=RelatedStor… The statement [sent to the Arabic language daily al-Hayat, the Abu Hafs al-Masri Brigades, which claimed responsibility for the Madrid bombings that killed 201 people,] said it supported President Bush in his reelection campaign, and would prefer him to win in November rather than the Democratic candidate John Kerry, as it was not possible to find a leader "more foolish than you (Bush), who deals with matters by force rather than with wisdom." .......... Nice to see that someone understands psyops, and how supporting other-than-Bush would be abused by Bush. ......... Explosives for a barracks-bomb in Lebanon, $30,000 SAMs for Somalia 144 x $12,000 Spanish bombs, 10 x $8,000 Watching Bush allies lose their elections: priceless. Some things money can't buy. For everything else there's Hawala

1 0

[Users] ANNOUNCE: strongswan-2.0.0 released
by R. A. Hettinga 19 Mar '04

19 Mar '04

In English, even... Cheers, RAH --- begin forwarded text

1 0

FreeS/WAN-->StrongSwan
by Eugen Leitl 19 Mar '04

19 Mar '04

FreeS/WAN is dead, long live StrongSwan... <kraut> ------------------------------------------------------------------------ IPSec-Implementierung FreeS/WAN bekommt Verstdrkung Andreas Steffen, langjdhriger Maintainer der X.509-Patches f|r FreeS/WAN, hat angek|ndigt, ein eigenes Nachfolgeprojekt namens StrongSwan zu starten. FreeS/WAN ist eine populdre IPSec-Implementierung f|r Linux; mit Internet Protocol Security lassen sich verschl|sselte und authentifizierte Verbindungen |ber das Internet realisieren und damit Netze und Rechner kosteng|nstig und sicher vernetzen. Das Entwicklerteam von FreeS/WAN hatte allerdings vor kurzem ank|ndigt, die Weiterentwicklung von FreeS/WAN einzustellen[1]. StrongSwan[2] setzt nun auf das FreeS/WAN-Release 2.04 auf, lduft wahlweise mit den FreeS/WAN-Kernel-Erweiterungen KLIPS oder den nativen IPSec-Funktionen des 2.6er-Kernels und enthdlt die aktuelle Version der X.509-Patches f|r den Einsatz von X.509-Zertifikaten. Des weiteren kommen NAT-Traversal und die Verschl|sselungsverfahren AES, Serpent, Blowfish und Twofish hinzu. Die X.509-Erweiterungen funktionierten seit Jahren stabil und wurden im wesentlichen aus politischen Erwdgungen nicht in FreeS/WAN integriert. So hat Steffen sie |ber Jahre hinweg weiterentwickelt und immer wieder an den FreeS/WAN-Code angepasst. Nach dem Ende von FreeS/WAN[3] hat er sich jetzt entschieden, ein eigenes Linux-IPSec-Projekt zu starten. Dabei will er den Schwerpunkt auf die einfache Konfiguration und Administration gerade in Bezug auf den Einsatz mit Zertifikaten und PKIs legen. Von einer direkten Zusammenarbeit mit dem bereits existierenden FreeS/WAN-Nachfolgeprojekt OpenSwan[4] hat Steffen Abstand genommen. Das OpenSwan-Team hat zwar die X.509-Patches integriert, den Code aber dabei so weit verdndert, dass eine Synchronisierung mit seinen Weiterentwicklungen zu aufwendig erschien. (ju[5]/c't) URL dieses Artikels: http://www.heise.de/newsticker/meldung/45769 Links in diesem Artikel: [1] http://www.heise.de/security/news/meldung/45176 [2] http://www.strongswan.org [3] http://www.heise.de/security/news/meldung/45176 [4] http://www.openswan.org [5] mailto:ju@ct.heise.de ------------------------------------------------------------------------ Copyright 2004 Heise Zeitschriften Verlag ----- End forwarded message ----- </kraut> -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

None
by Andreas Steffen 18 Mar '04

18 Mar '04

Gecko/20040113 To: FreeS/WAN <users(a)mj2.freeswan.org>, users <users(a)lists.openswan.org> Cc: Juergen Schmidt <ju(a)ct.heise.de> Subject: [Users] ANNOUNCE: strongswan-2.0.0 released List-Subscribe: <https://mj2.freeswan.org/cgi-bin/mj_wwwusr?user=&passw=&func=lists-long-ful…> List-Post: <users(a)lists.freeswan.org> List-Id: Discussion on the day to day usage of FreeS/WAN IPsec <users(a)lists.freeswan.org> List-Archive: <https://mj2.freeswan.org/archives> Sender: users-owner(a)mj2.freeswan.org Dear FreeS/WAN users, for three years in a row I've been releasing my X.509 patch, starting out in the year 2000 with a very rudimentary X.509 support for freeswan-1.3 up to the feature-rich X.509-1.5.3 release for the latest and last FreeS/WAN versions 2.04/2.05. The official announcement of the discontinuation of the FreeS/WAN project made me reflect on the future direction my X.509 project should take. One alternative was to contribute directly to the Openswan project and the second one to start a distribution of my own. My personal experience with the freeswan-2.0x releases over the last year that involved continuous and very tiresome adaptations of my patches against an ever moving target convinced me to take the distribution into my own hands. Therefore I officially announce the strongSwan OpenSource project hosted at http://www.strongswan.org The objectives of strongSwan will be: * simplicity of configuration * strong encryption and authentication methods * powerful IPsec policies facilitating the management of large and complex VPN networks The current release strongswan-2.0.0 is based on freeswan-2.04 and the latest X.509 patch 1.5.3. In addition to that NAT traversal and the additional encryption algorithms AES, Serpent, Blowfish and Twofish, as well as SHA-2 authentication are supported. Dead Peer Detection (DPD) will be added in one of the next releases. strongswan-2.0.0 runs both on Linux 2.4 (with KLIPS) and Linux 2.6 (with the native IPsec stack). The forthcoming release strongswan-2.1.0 will bring some powerful tools for the management of Certification Authorities (CAs), allowing e.g. to define CRL and OCSP URLs per CA in ipsec.conf. The Openswan team is heartily invited to integrate all or parts of my future X.509 extensions into their project since all code will be put under the GPL licence. Also contributions to strongSwan are welcome as long as they fit the three objectives listed above. Kind regards Andreas ======================================================================= Andreas Steffen e-mail: andreas.steffen(a)strongsec.com strongSec GmbH home: http://www.strongsec.com Alter Z|richweg 20 phone: +41 1 730 80 64 CH-8952 Schlieren (Switzerland) fax: +41 1 730 80 65 ==========================================[strong internet security]=== _______________________________________________ FreeS/WAN Users mailing list users(a)lists.freeswan.org https://mj2.freeswan.org/cgi-bin/mj_wwwusr --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

None
by Andreas Steffen 18 Mar '04

18 Mar '04

Gecko/20040113 To: FreeS/WAN <users(a)mj2.freeswan.org>, users <users(a)lists.openswan.org> Cc: Juergen Schmidt <ju(a)ct.heise.de> Subject: [Users] ANNOUNCE: strongswan-2.0.0 released List-Subscribe: <https://mj2.freeswan.org/cgi-bin/mj_wwwusr?user=&passw=&func=lists-long-ful…> List-Post: <users(a)lists.freeswan.org> List-Id: Discussion on the day to day usage of FreeS/WAN IPsec <users(a)lists.freeswan.org> List-Archive: <https://mj2.freeswan.org/archives> Sender: users-owner(a)mj2.freeswan.org Dear FreeS/WAN users, for three years in a row I've been releasing my X.509 patch, starting out in the year 2000 with a very rudimentary X.509 support for freeswan-1.3 up to the feature-rich X.509-1.5.3 release for the latest and last FreeS/WAN versions 2.04/2.05. The official announcement of the discontinuation of the FreeS/WAN project made me reflect on the future direction my X.509 project should take. One alternative was to contribute directly to the Openswan project and the second one to start a distribution of my own. My personal experience with the freeswan-2.0x releases over the last year that involved continuous and very tiresome adaptations of my patches against an ever moving target convinced me to take the distribution into my own hands. Therefore I officially announce the strongSwan OpenSource project hosted at http://www.strongswan.org The objectives of strongSwan will be: * simplicity of configuration * strong encryption and authentication methods * powerful IPsec policies facilitating the management of large and complex VPN networks The current release strongswan-2.0.0 is based on freeswan-2.04 and the latest X.509 patch 1.5.3. In addition to that NAT traversal and the additional encryption algorithms AES, Serpent, Blowfish and Twofish, as well as SHA-2 authentication are supported. Dead Peer Detection (DPD) will be added in one of the next releases. strongswan-2.0.0 runs both on Linux 2.4 (with KLIPS) and Linux 2.6 (with the native IPsec stack). The forthcoming release strongswan-2.1.0 will bring some powerful tools for the management of Certification Authorities (CAs), allowing e.g. to define CRL and OCSP URLs per CA in ipsec.conf. The Openswan team is heartily invited to integrate all or parts of my future X.509 extensions into their project since all code will be put under the GPL licence. Also contributions to strongSwan are welcome as long as they fit the three objectives listed above. Kind regards Andreas ======================================================================= Andreas Steffen e-mail: andreas.steffen(a)strongsec.com strongSec GmbH home: http://www.strongsec.com Alter Z|richweg 20 phone: +41 1 730 80 64 CH-8952 Schlieren (Switzerland) fax: +41 1 730 80 65 ==========================================[strong internet security]=== _______________________________________________ FreeS/WAN Users mailing list users(a)lists.freeswan.org https://mj2.freeswan.org/cgi-bin/mj_wwwusr --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0