- cypherpunks-legacy - lists.cpunks.org

Digital rights organisation
by Stephan Schmidt 17 Dec '03

17 Dec '03

Hi, thinking about what happend in Germany, are there any 'digital rights' organisations in Germany ? If not, we would like to found one. Are there any international orgs (EFF?,...) who can help us ? What goals do they have ? To Germans: How do I found an e.V. in Germany ? Thanks for the help in advance, -stephan

1 0

167 business and financial reports -53016
by 77224.who＠cygnus.com 17 Dec '03

17 Dec '03

//////////////////////////////////////////////////// If you wish to be removed from this advertiser's future mailings, please reply with the subject "Remove" and this software will automatically block you from their future mailings. /////////////////////////////////////////////////// To: ENTREPRENEUR From: REGINALD J. WILLIAMS Subject: 167 BUSINESS REPORTS I WILL SEND YOU A POWERFUL, MONEY-MAKING COMPUTER DISK AND A SPECIAL REPORT ENTITLED "HOW TO MAKE $100,000 IN 100 DAYS". YOU JUST PAY $10.00 FOR YOUR ONE-TIME REGISTRATION FEE AND SHIPPING COST. Dear Entrepreneur: In the most recent "Richest People In America" survey published by Forbes Magazine, the richest man in America IS NOT in the real estate business. He IS NOT an oil tycoon, and he DOES NOT own an airline or an automobile company. The richest man in America is Bill Gates, with an estimated net worth of around 29.9 BILLION. His business: COMPUTER SOFTWARE. Bill Gates founded Microsoft, the largest computer software company on planet Earth. This is clear proof that the "computer revolution" is finally here, bringing exceptional opportunities that are creating millionaires out of ordinary people like me and you every day. Recently, I received in the mail this computer disk which contains 167 business and financial reports which I can sell to people for around $1.00 to $5.00 per report. That's quite attractive considering that the disk contains 167 reports. However, for me that was like trying to peddle bananas by the piece, and I didn't get to excited with the idea. HOWEVER, WHEN THE COMPANY WHO DEVELOPED THE DISK, SAID THAT I CAN ACTUALLY MAKE EXACT COPIES OF THE DISK, AND SELL THEM TO OTHER PEOPLE AT ANY PRICE I WANT, I KNEW THAT I HIT THE JACKPOT. You see, selling how to reports and information by mail is an old and established business. What's new is the way information is being packaged, sold and delivered. From ordinary paper and ink (printed format) to computer floppy disks (electronic format), INFORMATION HAS GONE HIGH-TECH. So here's what I will do for you when registering for my "computer disk business package"... upon receipt of your $10.00 one-time only registration fee, I will send you the following: 1. A high density 3.5" computer disk which contains all 167 business and financial reports. 2. A sample sales letter and sample camera - ready print ads which you can use to get people to order copies of the reports & the disk from you. 3. A step-by-step plan on how and where to make copies of this disk, and how to get people to order copies of the disk - direct from you- and pay you anywhere from $20.00 to $49.00 each (you set your own price.) 4. Most importantly A Duplication License which grants you the right to reproduce copies of the disk and the printed materials that come with it. Please include $10.00 cash, check, or money order (U.S.Funds Only). If you would like to receive your package via Priority Mail, please add $4.00 (total of $14.00). PLEASE TAKE A MOMENT TO SEND IN THIS OFFER. IT IS SUCH A SMALL INVESTMENT FOR THE KNOW-HOW, EXPERIENCE AND FINANCIAL REWARDS YOU WILL GAIN THROUGH THIS PACKAGE. ALSO ALL ORDERS RECEIVED, WILL RECEIVE A FREE COPY OF ENVELOPE FOR WINDOWS, (A $29.95 VALUE). AN EXCELLENT RATED ENVELOPE ADDRESSING PROGRAM. (SPECIFY LASER OR DOT MATRIX) LASER___ OTHER____ SEND ORDER AND REGISTRATION FEE TO: REGINALD J. WILLIAMS POST OFFICE BOX 42091 FREDERICKSBURG, VA 22407-2091 (540) 972-0903 ________________________________________________________________________ ORDER FORM NAME_____________________________________________ ADDRESS_________________________________________APT# CITY____________________________STATE___________ POSTAL ZIP+4__________________ SPECIFY DISK SIZE 3.5____ 5.25______ IBM PC COMPATIBLE ONLY SPECIAL OFFER: Free INTERNET advertising !!! Free with your purchase of 167 Business and Financial Reports, 3 months of INTERNET advertising- your 40 word classified ad will be included in an electronic magazine (e-mag) for entrepreneurs. Your ad can contain any ad content you wish, and will run for a minimum of 3 months absolutely free. This alone can save you hundreds of dollars on ad placement, so act today free ads will only be offered for a limited time. THANKS RJW SPECIAL 1\2 PRICE SALE ; PURCHASE WITHIN 72 HOURS AND PAY ONLY $5.00 FOR YOUR COMPLETE PACKAGE GET Paid for your SPAM! New and HOT. Signed up over 250 the first day. Now you can profit with "SPAM" Bulk email with no risk, and make a small fortune at the same time! THIS ONE IS A NO-BRAINER! Really, Check it out http://wasi.com/spamaddress/info.idc?reg=1953 PRELAUNCH !! HOT !! HOT OFF THE PRESSES!! Secure your position Now.. Free sign up with Free Self-Replicating Webpages for your Downline. Awesome Opportunity for '98. Join now in my website and ask questions later.. It is FREE. Please browse and sign up at; http://globalads.com/gfn-prelaunch/rjwilliams

1 0

Commercial delegate in Egypt
by awbd＠awbd.com 17 Dec '03

17 Dec '03

Feb. 18th 1998. . Dear Sirs, I have the pleasure to enclose herewith a copy of my C.V. introducing myself to you as a person of very good experience in Freight Forwarding & International Transportation and in the different commercial services related thereto; and proposing myself for representing your company in Egypt and the Middle East as its own local resident COMMERCIAL DELEGATE looking after your interests and projects in this area. As a matter of fact, among lots of investors, many international freight forwarding & transportation companies have started their own presence in Egypt seizing the opportunity of the economic reformation achieved in this area; as now is the right time for business starting in Egypt. Starting with Commercial Delegation I foresee our final target, in case my proposal meets your interest, is to develop that delegation into the full operating companys branch in Egypt. That is to be achieved gradually by time, but as quickly as possible, through building a good account of clients and by selecting and training an efficient professional work team. In addition to my qualifications shown in my enclosed C.V., I am actually a USA resident as per the Green Card I have got for lawful admission for permanent residence in America (Employment Authorized). Such advantage is considered as a good asset for a person appointed by an American company to represent it as its own Commercial Delegate in the area where he was grown up. Speaking their own language and understanding their mentality and the way they think, such delegate can move among the companys correspondents & agents, its clients, the local official authorities, and any other concerned parties to intervene, for his companys favor, to avoid any probable problems and to enhance the companys achievements in this area. For any further details and/or information, please feel free and do not hesitate to contact me through any of the contact means listed among my personal data in my C.V. attached hereto. You may also contact me, for the time being and until Feb. 24th when I leave back to Egypt, through my address in USA which is as follows: 915 Mount Olive Dr. #3 Duarte, CA 91010 Tel & Fax (626) 357 0243 E-mail: info(a)awbd.com Looking forward to getting the honor of working with your esteemed company, I wish you all the best and remain faithfully yours. Isaac Youssef CURRICULUM VITAE PERSONAL DATA: Name: Isaac Youssef Atiya Nationality; Egyptian Place and date of birth: Cairo, On Oct. 5th 1951 Marital Status: Single Education Degree: B.Sc. Cairo University Contact Address: PO Box #15 Al- Afdal Post Office Cairo-11627, Egypt. Tel: 00202-235-3997 Fax: 00202-236-7413 E-mail: andyeg(a)eis.egnet.net JOB HISTORY & BUSINESS EXPERIENCE: Jan. 1st. 94 - Currently: PARTNER and MANAGER of CFT Int1., CENTRE DU FRET ET DU TRANSPORT INTERNATIONAL, which is actually an extension of GONDRAND Egypt (A former company mentioned below). As CFT Intl., I represented the following companies: = SDV group, including SCAC, TTA, & ATT France = TRANSCAP INTERNATIONAL France = GEFCO France Aug, 15th 91 - May 31st 94 The GENERAL MANAGER, and the only ACTIVE PARTNER of GONDRAND Egypt, one of the most leading freight forwarding agents and the international transport companies working in Egypt. As GONDRAND Egypt, I was the agent of many world wide companies such as : = S.F.T. GONDRAND FRERES France = MACH + France = SAVING SHIPPING & FORWARDING Italy = UTC, UNION TRANSPORT CORPORATION USA = UAT, UNION AIR TRANSPORT Europe = DSL, DISTRIBUTION SERVICES LTD USA = GEFCO France = TRUST FREIGHT USA Sep. 1st 88 - Aug. 14th 91: During that period, besides managing an export- import group consisting of 3 sister companies, I worked in the following companies: = DMC, the Egyptian daughter company of DOLLFUS MIEG ET CIE, one of the most leading world wide French threads manufacturers, in which I worked as the MATERIALS / INFORMATION FLOW & PURCHASING MANAGER. My duties included the following: 1- Supplying and furnishing both of the clients of the company and its employees with whatever they needed of information, materials, services, and /or products. 2- Controlling the flow of all the materials imported or locally purchased. 3- Supervising the import formalities and regulations with Banks, Customs and Governmental authorities, Air and Maritime lines, and Freight Forwarding agents. 4- Supervising purchasing and maintenance of the company assets through different contractors, suppliers, and services companies. 5- Controlling the circulation of raw materials and products. = AMECO, an Egyptian freight forwarder which, in the same time, represents ships owners. In AMECO I had the position of the ASSISTANT MANAGER of Cairo branch. = MEDTRANS, The Egyptian correspondent of a group of European and American freight forwarding companies, such as the French company S.F.T. GONDRAND FRERES, And the American company DANIEL F. YOUNG Inc.. In MEDTRANS I had the position of the EXECUTIVE MANAGER. Feb. 1st 80 - Aug. 31st 88 : A SUPERVISOR and a DEPARTMENT HEAD in MFA - MISR FREIGHT AGENCIES - The Egyptian branch of the world wide DANZAS company for international transportation and freight forwarding - which had, at that time, 450 offices distributed in 42 countries with the head office in Switzerland. In MFA- DANZAS Egypt - I supervised the following departments: 1- Sea Freight Dep. (Conventional and General Cargo, and Containerized Shipments). 2- Air Freight Dep. 3- Projects Transport Dep. 4- Transit Goods & Distribution Dep. 5- Fairs & International Exhibitions Transport Dep. 6- The Local Operations & Inland Road Transport Dep. 7- Besides the above, I supervised some special inter-branches relations between MFA and the other world wide branches of DANZAS group. Before MFA was founded, I worked in the above capacities for the COMMERCIAL DELEGATION OF DANZAS in Egypt. Sept. 78 - Jan. 31st 80: The DIRECTOR ASSISTANT of CENTER FOR EGYPTIAN CIVILIZATION STUDIES, in which I supervised the following: 1- Planning & Execution of programs 2- Administration 3- Public Relations 4- Correspondence 5- Translation OTHER QUALIFICATIONS: = Courses in MANAGEMENT SKILLS FOR SUPERVISORS AND DEPARTMENT HEADS organized by Monadonck International Limited - London, for International Management Development. = A seminar and a long training course in PROJECTS TRANSPORT, SEA FREIGHT, and INLAND ROAD TRANSPORT in DANZAS branch in Zurich city, and in AIR FREIGHT in its branch in Kloten airport of Zurich. = Courses in BUSINESS ADMINISTRATION including FINANCE FOR NON- FINANCIAL MANAGERS, AN INTRODUCTION TO COST ACCOUNTING, and BASIC PRINCIPLES OF FEASIBILITY STUDIES. These courses were organized by The Egyptian-German Association for Economical and Social Development of The Arab-German Chamber of Commerce in Cairo, among the Business Administration Program in Egypt sponsored by Konrad-Adenauer Foundation. = Write and Speak English language. = Some courses in French language, and still studying. = Traveled in Business Trips to many countries, such as Switzerland, UK, France, Germany, Turkey, and USA. = Active, Head Working, Ambitious, and willing for constant movement & traveling. = Fond of creating new businesses in Egypt. Signature Isaac Youssef PS: Besides the ordinary transport activities and the services related to the freight forwarding business, I represent my clients in the various official authorities, e.g. Customs Authority; Investment Authority, General Organization for Fairs & International Exhibitions, Egyptian General Petroleum Corporation, National Authority for Wire and Wireless Communications, Traffic Administration, The Import Rationalization Committee of the Ministry of Foreign Trade, Banks, Embassies, and Chambers of Commerceetc..

1 0

your request
by jenni＠biznetandmarketing.com 17 Dec '03

17 Dec '03

Thank you for your request. You can now: 1. Get more hits to your website for FREE! Win 1,000,000 banner impressions on thousands of websites! (worth $10,000) 2. Download the Internet Biz Startup Kit FREE! (Worth $95) 3. Download Web-Traffic's guide to listing your URL on top of search engines FREE! Touted as the world's Best Web and Hits Resource. (worth $95) 4. Win Astro-Space's Virtual Web Server with 75 MB space, and unlimited pop, autoresponders, telnet, ftp, domains, etc. (worth $1195) ALL of these at: http://www.free-banners.com Best Regards, Jenni LR -------------------------------------------------------- * This is an autoresponded message. * --------------------------------------------------------

1 0

RE: I was auto-outed by an IMG tag in HTML spam
by Trei, Peter 17 Dec '03

17 Dec '03

This can also happen with embedded tags in news messages, if you use Netscape to read news while 'autoload images' is turned on. It's an interesting form of entrapment. Peter > -----Original Message----- > From: Anonymous [SMTP:anon@anon.efga.org] [Trei, Peter] [edited] > They sent a message to my > off-site address (along with those of other critics about whom > they wanted to know more). It was an HTML message with an > embedded IMG tag. > > When Netscape saw that IMG > tag, it happily connected to marketing's "customer" tracking > server, and downloaded the keyed graphic. > > My boss just let me see the log he got from the marketing VP, > showing clearly that my workstation read the message.

2 1

EVEN MORE FREE PORN: STUFFED HAS 10 LINKS TO 100S OF FREE PICS, NEW EVERY DAY
by STUFFED SAT OCT 10 17 Dec '03

17 Dec '03

+ 30 SUPERB, HI-RES, HOT PHOTOS + 5 SUPER SEXY STORIES + DAARIA'S DEVILISH DYKES + NUTS N HONEY + HOIHOI GIRLS + SIBERIAN DAWGY DAWG + LAND O LEZ + A SEXY GIRL + FREE XXX SMUT + DEBBIE'S SEX SITE + WHORES INC + ALL THAT ASS + BONUS PIC 1 -> http://www.stuffed.net/home/17970.htm + BONUS PIC 2 -> http://www.stuffed.net/home/6896.htm + BONUS PIC 3 -> http://www.stuffed.net/home/20802.htm + BONUS PIC 4 -> http://www.stuffed.net/home/17597.htm + BONUS PIC 5 -> http://www.stuffed.net/home/25803.htm + MUCH, MUCH MORE! ----> http://stuffed.net/home/ <---- If you haven't visited STUFFED in the last few days, you're in for a real treat. It's faster than ever before and now, as a subscriber, you get 35 FREE new pics every day, plus over 100 more at carefully selected FREE sites we link to. This email is never sent unsolicited. Stuffed is the supplement for the Eureka newsletter you subscribed to. Full instructions on unsubscribing are in every issue of Eureka! ----> http://stuffed.net/home/ <----

1 0

Page one, NY Times, 29 January 1996
by Matt Blaze 17 Dec '03

17 Dec '03

One of those microscopic bottom-of-page-one ads from John Young: "BOYCOTT ESPIONAGE-ENABLED SOFTWARE", with phone number and email address to contact for more information. I'd be curious as to what the response has been like. -matt

2 1

Re: Here's how you put your key on the keyservers...
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 07:39 AM 1/29/96 -0500, Ted Garrett wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >I got a message in response to a request I made to someone for their public >key. I wanted to check the signatures that they included with their posts >to cypherpunks, but their key was not on the keyservers. The key they >included was completely unsigned, and when I use it to validate their >previous posts as well as the message they sent which included the key, the >signatures come back as bad, the contents of the file changed. Names are >appropriately withheld (I hope). At this point, I think it would be appropriate to declare that I am the person Ted was communicating with, and the one he is referring to and (correctly, as I recall my own posts) quoting. I am, yes, a real newbie, and I appreciate the indirect lesson in "nettiquette" he is showing by not identifying my private email to him. I'm identifying myself for a number of reasons: 1. I REALLY am a newbie (at least to most of Internet, and common usage of PGP, etc.), and haven't learned much of the ways of Internet. (with a strange, short, early exception, which I will relate in another message if anybody has any interest in Internet history.) 2. I want to solve the problems Ted presumably correctly identified in my signing. (I use freebie Eudora, and WPGP, etc.) I only started signing my posts when I got a copy of WPGP by Gostl, and it made things much easier. 3. I did not want to make it difficult for him to fight off a potential MITM attack while, at the same time, complying with "nettiquette", especially seeing as how my key is not (yet) in any keyserver, which is obviously MY fault, not his! I want him to be able to point (and, repost, with my full permission) any messages allegedly from me that he receives by private email, so that others might check the signature too with their own software. This permission to him applies to any prior messages I've sent him, too, ideally so that anyone else can check the signature status against my sig. Ted may be right; there may be a MITM attack. More likely, it's a case of galloping NEWBIE-ITIS on my own part, sorry. Earlier, when I just began using WPGP to sign Eudora stuff, I was told that my signature didn't match. On the other hand, I was told by others that this is a common flaw of signing messages, having to do with line lengths. When I first started sending messages, I didn't use the "Wrap" selection of Eudora (under the EDIT selection), meaning that my lines were as long as the paragraphs were typed. Most people didn't seem to notice, I guess, because it took somebody a few weeks to eventually complain. After that, I RTFM'd and adopted the practice of WRAPping my paragraphs to limit their length to "reasonable" values. (although I would appreciate somebody explaining to me why this DAMN EUDORA can't seem to correctly re-wrap a paragraph after modification. Hell, Wordstar Version 3.0 for CP/M (shows you how long _I've_ been into computers!) reformatted paragraphs just fine back in 1982 on a 12.5 MHz Z-80 (ask me how I did this and I'll tell you a LONG story!) 3. Ted began to suspect a "MITM attack." While I'm a newbie, I'm well aware this is "man in the middle" and am aware of the potential (dangerous!) implications. Needless to say, I can't even say for certain that such an attack isn't happening. Yes, I am on no keyservers, yet, but I will try my best to follow his kind instructions and accomplish this feat. And yes, I am reminded that I need to sign my OWN public key, which (being a f______ newbie), I haven't even done yet! (This message will contain, however, BOTH my 1024-bit and 2047 bit public keys, unsigned, and I will sign the whole message with my 1024-bit key. I'd sign it with BOTH, but I don't know if WPGP will even do this. I'd sign a second copy with the 2047-bit key, except that would be wasting bandwidth. > As I understand the bcc: definition, only >I and the first smtp server this message hits should know who it's to. I >don't know if anyone else reading this mailing list needs this info, but >just in case... here's my reply to the message. > >At 10:03 PM 1/28/96 -0800, you wrote: >>Sorry, I'm a newbie to Internet, and also the Internet usage of PGP. I just >>participated in a local keysigning meeting, so maybe my key will find its >>way to a server. I wrote that. >Don't worry about being a 'newbie'. Everyone starts somewhere. However, >your key will usually not 'find its way' to a server without you >specifically sending it. Thanks; I sorta assumed that, but until recently my usage of PGP was between me and my friends who knew me by face and voice, and who have my keys from hand-carried floppy disks that I gave them myself. > The keyserver I usually use is accessed by sending >a mail message which fits the following format. As far as I know, all the >keyservers use this format to add or update keys in their databases. You >only have to send it to one keyserver, and it will propagate to all the >others. I have indented the text so that no handlers decide to interpret it >as a new message. Okay, thanks for the details. > >- - To: pgp-public-keys(a)pgp.iastate.edu >- - Subject: ADD >- - >- - -----BEGIN PGP PUBLIC KEY BLOCK----- >- - Version: 2.6.2 >- - >- - [key deleted to protect the innocent] >- - >- - -----END PGP PUBLIC KEY BLOCK----- > >>I'm sorry to have to admit that I don't even know how to do this! Newbie >>alert! Again, I wrote that. >If you don't admit you don't know something, nobody will usually tell you >how to do it. Also, you should sign your own key. That will make it harder >to forge, I think. Okay, up until now I've generally given out my key in messages, and signed the entire message with the key. > The reasons were spelled out in a couple of the web >pages I read, but I've forgotten them. It has something to do with either a >denial of service attack or a man in the middle attack, or both. The >command to do this is: Someday I'm gonna understand this stuff! > >pgp -ks 0xHEXKEYID > >Honestly, I've only just begun to use pgp myself. Also, you should add your >e-mail address to the user-id of your key. The command to do so is: > >pgp -ke 0xHEXKEYID > Again, much appreciated. I hate to RTFM. Lazy bum, I. >You will be asked if you wish to add a user id to the key. Say yes, and >give it your e-mail address. What this does is it allows people who are >using pgp-enabled mailers to directly encrypt messages to you without >choosing your key manually. > >The reason that I have not encrypted this message to you using the key you >provided is that when I extracted the key and re-checked your message, the >signature was no good. I've found that (using eudora) I must turn off the >word wrap feature of my mailer to allow for good signed messages out. Of >course, having said this, I'll probably not get a good signature on this >message. Let me know if it signs ok. I didn't check the signature of his message, admittedly. Guess I need to give him some feedback, huh? >Now, I have a question. Which attack(s) is/are a person vulnerable to when >distributing an unsigned public key in the open? Could this actually be a >complex man-in-the-middle attack? Am I paranoid? Unfortunately, the more I learn about encryption, the more "paranoid" I get! Of course, I have a few more reasons than most, but... [I deleted Ted Garrett's signature. My own will follow my own two public keys.] My 1024-bit key. - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAi1zvWcAAAEEAKmSqngLWK2N2gOJKPtjF9VCfSkXY+XUZBRCbbFU71uH/dLX C2Uq6wFS8alRgMc3rp90JnnJ/6eJqXwMjCunogwucWOaU7S/w+OwjOG9fUqsXIA6 2j25Wtjce65mbp0TKLAzwMb/P/Qq7BlclqhuKzfVBH7dIHnVAvqHVDBboB2dAAUR tBFKYW1lcyBEYWx0b24gQmVsbA== =G3LA - -----END PGP PUBLIC KEY BLOCK----- My 2047-bit key. - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQENAzDCFH4AAAEH/15sMvnnK1BIvLkxQsKwUHP7dKNFbKrQOtOoyLOFTk4/0Zlr gXkKw6NciDYaOKwW9dsIL3N3rjAlWtioQ/gg+5vMNoJOQXpp95mKBzpWYLeaB8MF Km6H/NGWISx5cz06NOGutWcaezO/S4xm8ay7W8HaZ4EmHQdXtSKIAL41PBQyyuhR wIKX+QwsAgKS1LALr9MuW7nXL6/h139QeNRAR+ubXyftoklFHC+HF+jcTTDuNjmU 4p7BEMp9cmYHh6WEYTZyOz5F8/8gtEbPA0IKsQH1LGdf+2APLqMdciuU8ALZA+ZM bbaBaxshqHbYfCQ8+ATCrBjsU0nO8RKjhSx91vkABRG0DUphbWVzIEQuIEJlbGw= =uncA - -----END PGP PUBLIC KEY BLOCK----- James Dalton Bell. Klaatu Burada Nikto Something is going to happen.... Something... Wonderful! -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQ1PZ/qHVDBboB2dAQE+AAP+MP5hM2j1Z3z+7cdZ/U12qH/uu6Dq2NEP LgKJ8Nm0idN7oiBZpYD2zuT22mhsIhCJzzmC3XIBiyX1AP4voDqrIwgLmvPgogcp Cr9p75xi2/UqV1mrYIWeHG4KJc+/x5V4PxeYg5iz0jjnLKN1mzmnjPRDqAOaaBhK 08MMgOkqxFs= =jU9M -----END PGP SIGNATURE-----

1 0

Re: [Fwd: Netscape, CAs, and Verisign]
by Peter Williams 17 Dec '03

17 Dec '03

>I'd like to see a less centralized CA that's tied into the existing system >of notaries. The idea is to make it necessary to spoof a notary in order >to spoof the CA. That won't make spoofing the CA impossible (nothing >will), but it will make spoofing the CA illegal. You might wish to look at the Apple DigiSign design. RSA DSI ran a CA under contract as a notary enrollment system for 2 years. The people from RSA DSI, now at Verisign, have a certain amount of experience with this system. I dont understand how you intend to make CA spoofing illegal. Who who perform the enforcement? (By illegal, I assume you mean that there is a criminal offence involved, rather than a tort.) > >A notary could apply to the CA for the right to work as an agent, for a >nominal fee (<$100/year). Only notaries could be agents. If a person >wants a certificate, they'd come in and present ID and a key to the >notary/agent. The person would have to present a form document stating >that he's requesting the cert. The notary would stamp the form and affix >a signature to the key which would enable it to be processed automatically >by the CA. This has been tried, and many certificates issued under a variant of this scheme. it seems likely that only an ABA-certified notary would be reasonaby secure from professional liabilities. Good efforts have been made to qualify what the professional procedures would be. > >Fees for the whole procedure ought to be less than $30. The CA ought to >operate off of the fees from the agents as a non-profit organization, and >the agents ought to keep the fees paid by the people requesting the >certificates. Notary fees might be best controlled by the notary, not the CA. Seems an unreasonable restriction of trade to price-fix, even at the low-end. > >Would any of the lawyers on the list be willing to comment on whether or >not it's possible or practical to tie a CA into the notary system? Does >anyone have any thoughts as to how difficult/risky spoofing my CA is >compared to spoofing Netscape or Verisign? There is indeed a large body of legal ramifications in this area. The best way to learn about it is to become a CA and do it. Risk taking is part of being in the CA business, however you operate it, even for free. > >I could put up a server and I think I know a laywer who would help me set >up a non-profit organiation on a shoestring, but I don't want to do it if >the plan is impractical. Running as a not-for-profit may not prevent general liability. You can give the service away for free and will still be liable for the mis-representations you or your agents make. There are DARPA reports written about the issue (though these do not usually constitute advice.) > >Morevover, although I don't think it's reasonable to expect Netscape to >agree to include a non-existent CA in their browsers sight unseen, at the >same time it doesn't seem smart to sink money into setting up the CA >without some indication from Netscape that they're willing to give the >idea good faith consideration. Navigator betas seem to already facilitate users configuring their own trust points in a manner rather similar to adding a key to your personal PGP keyring. IBM browsers allow formal configuration of trust points. CAs as a business and economic growth area are just happening. We have two declared companies; Verisign and GTE. I personally expect another 10-20 to declare soon. The large (phone company) networks seem to be where the current action is, followed by the large accounting firms. As a small software company, I personally back the other similarly small software companies making and selling organizational CA systems to help people manage their own community of interest as they see fit.

1 0

RC2 source code
by Anonymous User 17 Dec '03

17 Dec '03

Reposted from sci.crypt: /**********************************************************************\ * To commemorate the 1996 RSA Data Security Conference, the following * * code is released into the public domain by its author. Prost! * * * * This cipher uses 16-bit words and little-endian byte ordering. * * I wonder which processor it was optimized for? * * * * Thanks to CodeView, SoftIce, and D86 for helping bring this code to * * the public. * \**********************************************************************/ #include <string.h> #include <assert.h> /**********************************************************************\ * Expand a variable-length user key (between 1 and 128 bytes) to a * * 64-short working rc2 key, of at most "bits" effective key bits. * * The effective key bits parameter looks like an export control hack. * * For normal use, it should always be set to 1024. For convenience, * * zero is accepted as an alias for 1024. * \**********************************************************************/ void rc2_keyschedule( unsigned short xkey[64], const unsigned char *key, unsigned len, unsigned bits ) { unsigned char x; unsigned i; /* 256-entry permutation table, probably derived somehow from pi */ static const unsigned char permute[256] = { 217,120,249,196, 25,221,181,237, 40,233,253,121, 74,160,216,157, 198,126, 55,131, 43,118, 83,142, 98, 76,100,136, 68,139,251,162, 23,154, 89,245,135,179, 79, 19, 97, 69,109,141, 9,129,125, 50, 189,143, 64,235,134,183,123, 11,240,149, 33, 34, 92,107, 78,130, 84,214,101,147,206, 96,178, 28,115, 86,192, 20,167,140,241,220, 18,117,202, 31, 59,190,228,209, 66, 61,212, 48,163, 60,182, 38, 111,191, 14,218, 70,105, 7, 87, 39,242, 29,155,188,148, 67, 3, 248, 17,199,246,144,239, 62,231, 6,195,213, 47,200,102, 30,215, 8,232,234,222,128, 82,238,247,132,170,114,172, 53, 77,106, 42, 150, 26,210,113, 90, 21, 73,116, 75,159,208, 94, 4, 24,164,236, 194,224, 65,110, 15, 81,203,204, 36,145,175, 80,161,244,112, 57, 153,124, 58,133, 35,184,180,122,252, 2, 54, 91, 37, 85,151, 49, 45, 93,250,152,227,138,146,174, 5,223, 41, 16,103,108,186,201, 211, 0,230,207,225,158,168, 44, 99, 22, 1, 63, 88,226,137,169, 13, 56, 52, 27,171, 51,255,176,187, 72, 12, 95,185,177,205, 46, 197,243,219, 71,229,165,156,119, 10,166, 32,104,254,127,193,173 }; assert(len > 0 && len <= 128); assert(bits <= 1024); if (!bits) bits = 1024; memcpy(xkey, key, len); /* Phase 1: Expand input key to 128 bytes */ if (len < 128) { i = 0; x = ((unsigned char *)xkey)[len-1]; do { x = permute[(x + ((unsigned char *)xkey)[i++]) & 255]; ((unsigned char *)xkey)[len++] = x; } while (len < 128); } /* Phase 2 - reduce effective key size to "bits" */ len = (bits+7) >> 3; i = 128-len; x = permute[((unsigned char *)xkey)[i] & (255 >> (7 & -bits))]; ((unsigned char *)xkey)[i] = x; while (i--) { x = permute[ x ^ ((unsigned char *)xkey)[i+len] ]; ((unsigned char *)xkey)[i] = x; } /* Phase 3 - copy to xkey in little-endian order */ i = 63; do { xkey[i] = ((unsigned char *)xkey)[2*i] + (((unsigned char *)xkey)[2*i+1] << 8); } while (i--); } /**********************************************************************\ * Encrypt an 8-byte block of plaintext using the given key. * \**********************************************************************/ void rc2_encrypt( const unsigned short xkey[64], const unsigned char *plain, unsigned char *cipher ) { unsigned x76, x54, x32, x10, i; x76 = (plain[7] << 8) + plain[6]; x54 = (plain[5] << 8) + plain[4]; x32 = (plain[3] << 8) + plain[2]; x10 = (plain[1] << 8) + plain[0]; for (i = 0; i < 16; i++) { x10 += (x32 & ~x76) + (x54 & x76) + xkey[4*i+0]; x10 = (x10 << 1) + (x10 >> 15 & 1); x32 += (x54 & ~x10) + (x76 & x10) + xkey[4*i+1]; x32 = (x32 << 2) + (x32 >> 14 & 3); x54 += (x76 & ~x32) + (x10 & x32) + xkey[4*i+2]; x54 = (x54 << 3) + (x54 >> 13 & 7); x76 += (x10 & ~x54) + (x32 & x54) + xkey[4*i+3]; x76 = (x76 << 5) + (x76 >> 11 & 31); if (i == 4 || i == 10) { x10 += xkey[x76 & 63]; x32 += xkey[x10 & 63]; x54 += xkey[x32 & 63]; x76 += xkey[x54 & 63]; } } cipher[0] = (unsigned char)x10; cipher[1] = (unsigned char)(x10 >> 8); cipher[2] = (unsigned char)x32; cipher[3] = (unsigned char)(x32 >> 8); cipher[4] = (unsigned char)x54; cipher[5] = (unsigned char)(x54 >> 8); cipher[6] = (unsigned char)x76; cipher[7] = (unsigned char)(x76 >> 8); } /**********************************************************************\ * Decrypt an 8-byte block of ciphertext using the given key. * \**********************************************************************/ void rc2_decrypt( const unsigned short xkey[64], unsigned char *plain, const unsigned char *cipher ) { unsigned x76, x54, x32, x10, i; x76 = (cipher[7] << 8) + cipher[6]; x54 = (cipher[5] << 8) + cipher[4]; x32 = (cipher[3] << 8) + cipher[2]; x10 = (cipher[1] << 8) + cipher[0]; i = 15; do { x76 &= 65535; x76 = (x76 << 11) + (x76 >> 5); x76 -= (x10 & ~x54) + (x32 & x54) + xkey[4*i+3]; x54 &= 65535; x54 = (x54 << 13) + (x54 >> 3); x54 -= (x76 & ~x32) + (x10 & x32) + xkey[4*i+2]; x32 &= 65535; x32 = (x32 << 14) + (x32 >> 2); x32 -= (x54 & ~x10) + (x76 & x10) + xkey[4*i+1]; x10 &= 65535; x10 = (x10 << 15) + (x10 >> 1); x10 -= (x32 & ~x76) + (x54 & x76) + xkey[4*i+0]; if (i == 5 || i == 11) { x76 -= xkey[x54 & 63]; x54 -= xkey[x32 & 63]; x32 -= xkey[x10 & 63]; x10 -= xkey[x76 & 63]; } } while (i--); plain[0] = (unsigned char)x10; plain[1] = (unsigned char)(x10 >> 8); plain[2] = (unsigned char)x32; plain[3] = (unsigned char)(x32 >> 8); plain[4] = (unsigned char)x54; plain[5] = (unsigned char)(x54 >> 8); plain[6] = (unsigned char)x76; plain[7] = (unsigned char)(x76 >> 8); }

3 2