- cypherpunks-legacy - lists.cpunks.org

Re: what I can say...
by Graham Toal 17 Dec '03

17 Dec '03

From: "Perry E. Metzger" <perry(a)imsi.com> 3) If the NSA actually worked for years designing this thing, someone wasn't thinking. I still maintain that the FOIA'd docs extracted by gnu imply that there's a *real* backdoor as well as the key escrow, and I suspect the key escrow/ Law Enforcement Abuse Field stuff was hurriedly tacked on as an afterthought. Personally I wouldn't rely on clipper ever *with* a private session key. G

2 1

Re: CEB 5 - The Hangover
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

>>It looked more like someone saying "Hey! Let's have rabbit for >>dinner! Now, you there, go kill us a rabbit. And you, over there, >>start a fire. And you..." I realize that you think that you brought >>a rabbit home, but others seem to think that you only brought a menu. > >No, Mr. Jeffers is _too_ _busy_ debugging his TSR to bring a menu. He Come on, cut the guy some slack! He fucked up and got suitably flamed. There's no need to pile it on. Jim_Miller(a)suite.com

1 0

Matt Blaze's Clipper attack -- details
by smb＠research.att.com 17 Dec '03

17 Dec '03

I spoke with Matt Blaze; he gave me permission to post a summary of his attacks. But the paper is not yet available for ftp. Matt's work was done using a prototype Tessera card, with a SCSI-PCMCIA interface on a Sun 4. That may (or may not) have implications for some of the performance numbers. There are two classes of ways to foil key escrow. The less interesting class of attacks are non-interoperable. That is, two rogue implementations can talk security, but can't talk to a conforming key escrow device. But there's another attack possible, wherein a rogue application talks to a conforming device, but without presenting a valid LEAF. The LEAF contains a 32 bit unit id, an 80-bit session key encrypted with the per-device secret key, and a 16 bit checksum. The whole thing is encrypted with the family key. The checksum field is based on both the session key and the IV. A receiving device will not decrypt unless it's handed a valid LEAF. But it can only base its judgment on the checksum and on its external knowledge of the key and IV; the actual key in the LEAF is encrypted in a way that it cannot read. LEAFs are sent out of band by the application; they're not concealed in the encrypted data stream. Non-interopable applications work by generating a LEAF/IV pair and not transmitting it. (Users cannot control the IV; the Tessera interface (and maybe the Capstone chip) generates it.) The receiving end does the same thing. You don't need an IV for ECB mode, so you have at least some access to Skipjack that way. But that's too slow; at least in the configuration tested, it took ~50 ms to do an ECB encryption. In CBC mode, if you have the wrong IV, the first block of plaintext will be garbled. But the error recovery properties of CBC guarantee that all subsequent blocks will be decrypted correctly. (Derivation is left as an exercise for the reader.) The solution, then, is simple: just pad your messages with an 8-byte garbage header. OFB and CFB modes can be implemented as well. The obvious way is via ECB mode, but that's too slow. It turns out that with a bit of work, you can use CBC mode as a primitive to build OFB and CFB. I'll describe that if anyone's really interested. The more interesting attack on key escrow is a rogue implementation that can interoperate with a conforming one. The checksum is only 16 bits; it's possible to brute-force it. That is, generate random 128-bit strings, and see if your own Tessera card will accept it as a valid LEAF. Again, recall that it knows only the unencrypted key and the IV. On average, you'll find a hit in 2^15 tries; at 50 ms per try, that's 28 minutes. You can speed this up by running in parallel with multiple Tessera cards. --Steve Bellovin

2 1

Re: Black Eye for NSA, NIST, and Denning
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Keywords: rant Tim writes: > If Matt's attack works, and Clipper/Capstone/Tessera/etc. has to be > redesigned, some issues are pretty apparent: Capstone/Tessera already had to be redesigned to use the new Secure Hash Standard revision (one can speculate about whether the NSA's revision was to remove an old weakness or install a new one, or both :-) Of course, if they do redesign Clipper instead of junking it, the chances of them making it *more* genuinely secure by having the two wiretap keys installed separately instead of having them combined (and probably stolen) by the NSA and then the XOR loaded in are probably pretty low... > * Combined with Micali's talk of a lawsuit, the slow acceptance of > Clipper (Cypherpunks and others have helped to make Clipper a very > dirty word, thus slowing any corporate acceptance that I suspect the > NSA was hoping for), and these problems, the Clipper program seems to > be in disarray. It's especially enjoyable seeing that coming from Micali - his patent on "Fair Cryptosystems" is just *dripping* with the collectivist use of "fair" as meaning "Do what we tell you". His system also fails to carry out the claims made by his patent that say it permits the government to access the keys of suspected lawbreakers while protecting the privacy of law-abiding users, unless you accept the Ed Meese position that people who are law-biding aren't suspects... > So, NSA's vaunted crypto capabilities seem to be waning. > (I'm sure there are still many competent folks at the Fort, of course.) > Their venture into the commercial world seems pretty flawed. While the SHS problems are crypto-related, the primary incapabilities of the NSA's Clipper project aren't technical, but political - they're trying to tell the public "We don't trust you, but you can trust us, because we're from the Government and we're here to help you!", which is a hard sell for anyone :-) Bill

1 0

Re: Black Eye for NSA, NIST, and Denning
by koontzd＠lrcs.loral.com 17 Dec '03

17 Dec '03

> At today's talk at MIT (Morris & Unkenholz of the NSA) Morris >said several times that the escrow system had to be produced in a >hurry, on top of the Skipjack algorithim, which was designed >previously and 'sitting in a storeroom.' (boy, I'd like to FOIA that >storeroom. :) Gee, now that mab(a)research.att.com (Matt Blaze), knows where to find the checksum, and by extension the unit id (Which shows up on labels in photos on the literature from Mykotronx) - providing a known plaintext, maybe someone will start working on the family key? (I won't hold my breath waiting for it to be announced)

4 7

Where to get PGP (correction on PGP 2.6ui)
by mpj＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- WHERE TO GET THE PRETTY GOOD PRIVACY PROGRAM (PGP) (Last modified: 2 June 1994 by Mike Johnson) WHAT IS THE LATEST VERSION? Platforms | Released | Version | Notes & restrictions | by and for | | Other restrictions may apply. - ----------------------------------------------------------------------------- Dos & Unix | MIT | 2.6 | Uses RSAREF. Not for use in any | for use in | | application that you get paid for. | North | | FREE. Complete source code available. | America | | Patents licensed for personal use only. | | | Not for export from the USA or Canada. | | | RSA key limited to 1024 bits (probably | | | strong enough for most things, but not | | | as strong as the IDEA session key). | | | Not fully compatible with PGP 2.3a or | | | Viacrypt PGP 2.4. - ----------------------------------------------------------------------------- Dos & Unix | mathew@ | 2.6ui | Does NOT use RSAREF. No RSA patent | mantis.co | | problems outside the USA. | .uk for use| | FREE. Complete source code available. | outside | | IDEA licensed for personal use only in | the USA | | countries where the IDEA patent holds. | | | RSADSI claims this product would | | | infringe on its patents if used in the | | | USA. Compatible with all current PGPs. | | | Contact mathew(a)mantis.co.uk if you have | | | contributions or suggestions for the | | | coming version 2.7ui, which will feature | | | a longer RSA key length limit. | | | If imported to the USA, don't export. - ----------------------------------------------------------------------------- DOS & Unix | Viacrypt | 2.4 | 100% Legal for both personal and | for use in | | commercial use. Not for export from | North | | the USA and Canada. It is commercial | America | | copyrighted software, prices below. | | | Source code not available. | | | Viacrypt will soon release version 2.7 | | | that will be compatible with MIT's 2.6 - ----------------------------------------------------------------------------- Amiga | | 2.3a2 | Use extremely limited by patents in USA. - ----------------------------------------------------------------------------- Macintosh | | 2.3aV1.1 | Use extremely limited by patents in USA. | | or | A pair of 2.6-compatible versions | | 2.3aV1.2 | (USA/Canada & Non-USA) still not ready. - ----------------------------------------------------------------------------- All others | Branko | 2.3a | Use extremely limited by patents in USA. | Lankaster | | Not fully compatible with version 2.6 | | | or greater. - ----------------------------------------------------------------------------- Note: there are other version numbers floating around on the net from code that has been altered by individuals for their own use. The versions listed above are the ones I trust. WHERE CAN I GET VIACRYPT PGP? If you are a commercial user of PGP in the USA or Canada, contact Viacrypt in Phoenix, Arizona, USA. The commecial version of PGP is fully licensed to use the patented RSA and IDEA encryption algorithms in commercial applications, and may be used in corporate environments in the USA and Canada. It is fully compatible with, functionally the same as, and just as strong as the freeware version of PGP. Due to limitations on ViaCrypt's RSA distribution license, ViaCrypt only distributes executable code and documentation for it, but they are working on making PGP available for a variety of platforms. Call or write to them for the latest information. The latest version number for their version of PGP is 2.4. Prices shown include release of version 2.7 if you buy your copy after May 27, 1994 (otherwise the upgrade will be about US$10). Viacrypt's licensing and price information is as follows: ViaCrypt PGP for MS-DOS 1 user $ 99.98 ViaCrypt PGP for MS-DOS 5 users $ 299.98 ViaCrypt PGP for MS-DOS 20 users or more, call ViaCrypt ViaCrypt PGP for UNIX 1 user $ 149.98 ViaCrypt PGP for UNIX 5 users $ 449.98 ViaCrypt PGP for UNIX 20 users or more, call ViaCrypt ViaCrypt PGP for WinCIM/CSNav 1 user $ 119.98 ViaCrypt PGP for WinCIM/CSNav 5 user $ 359.98 ViaCrypt PGP for WinCIM/CSNav 20 users or more, call ViaCrypt If you wish to place an order please call 800-536-2664 during the hours of 8:30am to 5:00pm MST, Monday - Friday. They accept VISA, MasterCard, AMEX and Discover credit cards. If you have further questions, please feel free to contact: Paul E. Uhlhorn Director of Marketing, ViaCrypt Products Mail: 2104 W. Peoria Ave Phoenix AZ 85029 Phone: (602) 944-0773 Fax: (602) 943-2601 Internet: viacrypt(a)acm.org Compuserve: 70304.41 WHERE CAN I GET THE PGP FROM MIT THAT USES RSAREF? MIT-PGP is for U. S. and Canadian use only, but MIT is only distributing it within the USA (due to some archaic export control laws). 1. Read ftp://net-dist.mit.edu/pub/PGP/mitlicen.txt and agree to it. 2. Read ftp://net-dist.mit.edu/pub/PGP/rsalicen.txt and agree to it. 3. Telnet to net-dist.mit.edu and log in as getpgp. 4. Answer the questions and write down the directory name listed. 5. QUICKLY end the telnet session with ^C and ftp to the indicated directory on net-dist.mit.edu (something like /pub/PGP/dist/U.S.-only-????) and get the distribution files (pgp26.zip, pgp26doc.zip, and pgp26src.tar.gz). If the hidden directory name is invalid, start over at step 3, above. You can also get PGP 2.6 from: ftp.csn.net/mpj ftp://ftp.csn.net/mpj/I_will_not_export/crypto_???????/pgp/pgp26.zip ftp://ftp.csn.net/mpj/I_will_not_export/crypto_???????/pgp/pgp26src.tar See ftp://ftp.csn.net/mpj/README.MPJ for the ??????? See ftp://ftp.csn.net/mpj/help for more help on negotiating this site's export control methods. ftp.netcom.com/pub/mpj ftp://ftp.netcom.com/mpj//I_will_not_export/crypto_???????/pgp/pgp26.zip ftp://ftp.netcom.com/mpj//I_will_not_export/crypto_???????/pgp/pgp26src.tar See ftp://ftp.netcom.com/pub/mpj/README.MPJ for the ??????? See ftp://ftp.netcom.com/pub/mpj/help for more help on negotiating this site's export control methods. TO GET THESE FILES BY EMAIL, send mail to ftp-request(a)netcom.com containing the word HELP in the body of the message for instructions. You will have to work quickly to get README.MPJ then the files before the ??????? part of the path name changes again (several times a day). ftp.eff.org Follow the instructions found in README.Dist that you get from one of: ftp://ftp.eff.org/pub/Net_info/Tools/Crypto/README.Dist gopher.eff.org, 1/Net_info/Tools/Crypto gopher://gopher.eff.org/11/Net_info/Tools/Crypto http://www.eff.org/pub/Net_info/Tools/Crypto/ Colorado Catacombs BBS Mike Johnson, sysop Mac and DOS versions of PGP, PGP shells, and some other crypto stuff. Also the home of some good Bible search files and some shareware written by Mike Johnson, including DLOCK, CRYPTA, CRYPTE, CRYPTMPJ, MCP, MDIR, DELETE, PROVERB, SPLIT, ONEPAD, etc. v.FAST/v.32bis/v.42bis, speeds up to 28,800 bps 8 data bits, 1 stop, no parity, as fast as your modem will go. Use ANSI terminal emulation, of if you can't, try VT-100. Free access to PGP. If busy or no answer, try again later. Log in with your own name, or if someone else already used that, try a variation on your name or pseudonym. You can request access to crypto software on line, and if you qualify legally under the ITAR, you can download on the first call. Download file names: pgp26.zip (DOS version with documentation) pgp26src.tar (Unix version and source code) pgp26doc.zip (Documentation only -- exportable) (303) 772-1062 Longmont, Colorado number - 2 lines. (303) 938-9654 Boulder, Colorado number forwarded to Longmont number intended for use by people in the Denver, Colorado area. Verified: This morning. Other BBS and ftp sites will no doubt pick this version up rapidly. WHERE TO GET THE FREEWARE PGP FOR USE OUTSIDE OF THE USA The freeware version of PGP is intended for noncommercial, experimental, and scholarly use. It is available on thousands of BBSes, commercial information services, and Internet anonymous-ftp archive sites on the planet called Earth. This list cannot be comprehensive, but it should give you plenty of pointers to places to find PGP. Although the latest freeware version of PGP was released from outside the USA (England), it is not supposed to be exported from the USA under a strange law called the International Traffic in Arms Regulations (ITAR). Because of this, please get PGP from a site outside the USA if you are outside of the USA and Canada. This data is subject to change without notice. If you find that PGP has been removed from any of these sites, please let me know so that I can update this list. Likewise, if you find PGP on a good site elsewhere (especially on any BBS that allows first time callers to access PGP for free), please let me know so that I can update this list. Source code (gzipped tar format): * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/pgp26ui-src.tar.gz * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/pgp26ui-src.tar.gz.sig * _IT:_ ftp://ftp.dsi.umimi.it/pub/security/crypt/pgp26ui-src.tar.gz * _IT:_ ftp://ftp.dsi.umimi.it/pub/security/crypt/pgp26ui-src.tar.gz.sig.gz Source code (zip format): * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/pgp26uis.sig * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/pgp26uis.zip * _IT:_ ftp://ftp.dsi.umimi.it/pub/security/crypt/pgp26uis.sig * _IT:_ ftp://ftp.dsi.umimi.it/pub/security/crypt/pgp26uis.zip Executable for DOS (zip format): * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/pgp26uix.sig * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/pgp26uix.zip * _IT:_ ftp://ftp.dsi.umimi.it/pub/security/crypt/pgp26uix.sig * _IT:_ ftp://ftp.dsi.umimi.it/pub/security/crypt/pgp26uix.zip Other sites (may or may not have the latest versions): ftp.informatik.uni-hamburg.de /pub/virus/crypto ftp.ee.und.ac.za /pub/crypto/pgp soda.berkeley.edu /pub/cypherpunks/pgp (DOS, MAC) Verified: 21-Dec-93 ftp.demon.co.uk /pub/amiga/pgp /pub/archimedes /pub/pgp /pub/mac/MacPGP ftp.informatik.tu-muenchen.de ftp.funet.fi ftp.dsi.unimi.it /pub/security ftp.tu-clausthal.de (139.174.2.10) wuarchive.wustl.edu /pub/aminet/util/crypt src.doc.ic.ac.uk (Amiga) /aminet /amiga-boing ftp.informatik.tu-muenchen.de /pub/comp/os/os2/crypt/pgp23os2A.zip (OS/2) black.ox.ac.uk (129.67.1.165) /src/security/pgp23A.zip (MS-DOS executables & docs) /src/security/pgp23srcA.zip (Unix, MS-DOS, VMS, Amiga sources, docs, info on building PGP into mailers, editors, etc.) /src/security/pgp23A.tar.Z (Same as PGP22SRC.ZIP, in Unix tar format) /src/security/macpgp2.3.cpt.hqx (Macintosh version) iswuarchive.wustl.edu pub/aminet/util/crypt (Amiga) ftp.csn.net /mpj/public/pgp/ contains PGP shells, faq documentation, language kits. ftp.netcom.com /pub/dcosenza -- PGP 2.3a and an unofficial version that allows longer RSA keys. /pub/gbe/pgpfaq.asc -- frequently asked questions answered. /pub/qwerty -- How to MacPGP Guide, largest steganography ftp site as well. PGP FAQ, crypto FAQ, US Crypto Policy FAQ, Steganograpy software list. MacUtilites for use with MacPGP. Stealth1.1 + other steganography programs. Send mail to qwerty(a)netcom.com with the subject "Bomb me!" to get the PGP FAQ and MacPGP guide if you don't have ftp access. nic.funet.fi (128.214.6.100) /pub/crypt/pgp23A.zip /pub/crypt/pgp23srcA.zip /pub/crypt/pgp23A.tar.Z van-bc.wimsey.bc.ca (192.48.234.1) /m/ftp2/crypto/RSA/PGP/2.3a/pgp23A.zip /m/ftp2/crypto/RSA/PGP/2.3a/pgp23srcA.zip ftp.uni-kl.de (131.246.9.95) qiclab.scn.rain.com (147.28.0.97) pc.usl.edu (130.70.40.3) leif.thep.lu.se (130.235.92.55) goya.dit.upm.es (138.4.2.2) tupac-amaru.informatik.rwth-aachen.de (137.226.112.31) ftp.etsu.edu (192.43.199.20) princeton.edu (128.112.228.1) pencil.cs.missouri.edu (128.206.100.207) StealthPGP: The Amiga version can be FTP'ed from the Aminet in /pub/aminet/util/crypt/ as StealthPGP1_0.lha. Also, try an archie search for PGP using the command: archie -s pgp23 (DOS Versions) archie -s pgp2.3 (MAC Versions) ftpmail: For those individuals who do not have access to FTP, but do have access to e-mail, you can get FTP files mailed to you. For information on this service, send a message saying "Help" to ftpmail(a)decwrl.dec.com. You will be sent an instruction sheet on how to use the ftpmail service. Another e-mail service is from nic.funet.fi. Send the following mail message to mailserv(a)nic.funet.fi: ENCODER uuencode SEND pub/crypt/pgp23srcA.zip SEND pub/crypt/pgp23A.zip This will deposit the two zipfiles, as 15 batched messages, in your mailbox with about 24 hours. Save and uudecode. For the ftp sites on netcom, send mail to ftp-request(a)netcom.com containing the word HELP in the body of the message. World Wide Web URLs: (Thanks to mathew(a)mantis.co.uk) UNIX PGP 2.3a Compiles best with GCC 2.4.x or higher. A straight port from DOS, so hardened UNIX users find it a bit chatty. * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/pgp23A.tar.Z * _UK:_ ftp://black.ox.ac.uk/src/security/pgp23A.tar.Z * _NL:_ ftp://svin02.info.win.tue.nl/pub/misc/pgp23A.tar.gz * _SE:_ ftp://ftp.sunet.se/pub/security/tools/crypt/pgp23A.tar.gz * _SE:_ ftp://isy.liu.se/pub/misc/pgp/2.3A/pgp23A.tar.Z * _IT:_ ftp://ftp.dsi.unimi.it/pub/security/crypt/pgp23A.tar.Z * _FI:_ ftp://ftp.funet.fi/pub/crypt/pgp23A.tar.Z * _FI:_ ftp://ftp.funet.fi/pub/crypt/ghost.dsi.unimi.it/pgp23A.tar.Z _________________________________________________________________ MS-DOS PGP 2.3 Program * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/pgp23A.zip * _UK:_ ftp://black.ox.ac.uk/src/security/pgp23A.zip * _SE:_ ftp://isy.liu.se/pub/misc/pgp/2.3A/pgp23A.zip * _IT:_ ftp://ftp.dsi.unimi.it/pub/security/crypt/pgp23A.zip * _FI:_ ftp://ftp.funet.fi/pub/crypt/pgp23A.zip * _IT:_ ftp://ftp.funet.fi/pub/crypt/ghost.dsi.unimi.it/pgp23A.zip Source code Designed to compile with Turbo C; compiles fine with Microsoft Visual C++ also. * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/pgp23srcA.zip * _UK:_ ftp://black.ox.ac.uk/src/security/pgp23srcA.zip * _SE:_ ftp://isy.liu.se/pub/misc/pgp/2.3A/pgp23srcA.zip * _IT:_ ftp://ftp.dsi.unimi.it/pub/security/crypt/pgp23srcA.zip * _FI:_ ftp://ftp.funet.fi/pub/crypt/pgp23srcA.zip * _FI:_ ftp://ftp.funet.fi/pub/crypt/ghost.dsi.unimi.it/pgp23srcA.zip _________________________________________________________________ MACPGP 2.3 A slightly souped-up port of PGP to the Mac. Has help menus and other goodies, but is still not a real Mac application. However, it works. Note that the version 2.3 release of MacPGP contains the major bug-fix which was later added to UNIX/DOS PGP 2.3. There was therefore no need for a MacPGP 2.3A release; version 2.3 already had the bug fix by the time it was released. There is no MacPGP 2.3A. Program * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/MacPGP/MacPGP2.3.cpt.hqx * _UK:_ ftp://black.ox.ac.uk/src/security/macpgp2.3.cpt.hqx * _SE:_ ftp://isy.liu.se/pub/misc/pgp/2.3A/macpgp2.3.cpt.hqx * _IT:_ ftp://ftp.dsi.unimi.it/pub/security/crypt/macpgp2.3.cpt.hqx * _FI:_ ftp://ftp.funet.fi/pub/crypt/ghost.dsi.unimi.it/macpgp2.3.cpt.hqx * _US:_ ftp://soda.berkeley.edu/pub/cypherpunks/pgp/macpgp2.3.cpt.hqx.gz Source code Requires Think C. * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/MacPGP/MacPGP2.2src.sea.hqx -- version 2.2 only * _IT:_ ftp://ftp.dsi.umimi.it/pub/security/crypt/macpgp2.3src.sea.hqx.pgp * _FI:_ ftp://ftp.funet.fi/pub/crypt/ghost.dsi.unimi.it/macpgp2.3src.sea.h qx.pgp Documentation PGP is rather counter-intuitive to a Mac user. Luckily, there's a guide to using MacPGP in ftp://ftp.netcom.com/pub/qwerty/Here.is.How.to.MacPGP. _________________________________________________________________ OS/2 PGP You can, of course, run the DOS version of PGP under OS/2. Program * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/pgp22os2.zip -- version 2.2 only, native binaries * _DE:_ ftp://ftp.informatik.tu-muenchen.de/pub/comp/os/os2/crypt/pgp23os2 A.zip Source code * _DE:_ ftp://ftp.informatik.tu-muenchen.de/pub/comp/os/os2/crypt/pgp23src A.zip _________________________________________________________________ AMIGA PGP * _UK:_ ftp://ftp.demon.co.uk/pub/amiga/pgp/pgp21ami.lha -- version 2.1 only * _DE:_ ftp://faui43.informatik.uni-erlangen.de/mounts/rzsuna/pub/aminet/u til/crypt/pgp21ami.lha -- version 2.1 only * _DE:_ ftp://ftp.uni-kl.de/pub/aminet/util/crypt/PGPAmi23a_2.lha * _US:_ ftp://ftp.wustl.edu/pub/aminet/util/crypt/PGPAmi23a_2.lha Source * _DE:_ ftp://ftp.uni-kl.de/pub/aminet/util/crypt/PGPAmi23a2_src.lha * _US:_ ftp://ftp.wustl.edu/pub/aminet/util/crypt/PGPAmi23a2_src.lha _________________________________________________________________ ARCHIMEDES PGP * _UK:_ ftp://ftp.demon.co.uk/pub/archimedes/ArcPGP23a _________________________________________________________________ DOCUMENTATION ONLY * _US:_ ftp://net-dist.mit.edu/pub/PGP/pgp26doc.zip * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/pgp26doc.zip * _US:_ ftp://ftp.netcom.com/pub/mpj/public/pgp/pgp26doc.zip * _US:_ ftp://ftp.ftp.csn.net/mpj/public/pgp/pgp26doc.zip * _US:_ ftp://soda.berkeley.edu/pub/cypherpunks/pgp/pgp23docA.zip _________________________________________________________________ LANGUAGE MODULES These are suitable for most PGP versions. I am not aware of any export/import restrictions on these files. German * _UK:_ ftp://black.ox.ac.uk/src/security/pgp_german.txt * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp_german.txt * _US:_ ftp://ftp.csn.net/mpj/public/pgp/PGP_german_docs.lha Italian * _IT:_ ftp://ftp.dsi.umimi.it/pub/security/crypt/pgp-lang.italian.tar.gz * _FI:_ ftp://ftp.funet.fi/pub/crypt/ghost.dsi.unimi.it/pgp-lang.italian.tar.gz * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp-lang.italian.tar.gz Japanese * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp-msgs-japanese.tar.gz Lithuanian * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp23ltk.zip Russian * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp26ru.zip Spanish * _IT:_ ftp://ftp.dsi.umimi.it/pub/security/crypt/pgp-lang.spanish.tar.gz * _FI:_ ftp://ftp.funet.fi/pub/crypt/ghost.dsi.unimi.it/pgp-lang.spanish.tar.gz * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp-lang.spanish.tar.gz Swedish * _UK:_ ftp://black.ox.ac.uk/src/security/pgp_swedish.txt * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp_swedish.txt _________________________________________________________________ OTHER SITES Some cryptographic software is available from ftp://van-bc.wimsey.bc.ca/pub/crypto/software/. Read the README file and proceed from there. BBS sites: Colorado Catacombs BBS (See also the entry above for PGP 2.6) (303) 772-1062 Longmont, Colorado (2 lines) (303) 938-9654 Boulder, Colorado (free call from Denver CO, but 1 line) Verified: This morning. Hieroglyphics Voodoo Machine (Colorado) DOS, OS2, and Mac versions. (303) 443-2457 Verified: 5-2-94 For free access for PGP, DLOCK, Secure Drive, etc., log in as "VOO DOO" with the password "NEW" (good for 30 minutes access to free files). Exec-Net (New York) Host BBS for the ILink net. (914) 667-4567 The Ferret BBS (North Little Rock, Arkansas) (501) 791-0124 also (501) 791-0125 Special PGP users account: login name: PGP USER password: PGP This information from: Jim Wenzel <jim.wenzel(a)grapevine.lrk.ar.us> PGP 2.3A has been posted to the FidoNet Software Distribution Network and should on most if not all Canadian and U.S. nodes carrying SDN software. It has also been posted on almost all of the major private North American BBS systems, thence to countless smaller boards. Consult a list of your local BBSes; most with a sizeable file inventory should carry the program. If you find a version of the PGP package on a BBS or FTP site and it does not include the PGP User's Guide, something is wrong. The manual should always be included in the package. If it isn't, the package is suspect and should not be used or distributed. The site you found it on should remove it so that it does no further harm to others. ARCHIE WHO? There are many more sites. You can use archie and/or other "net-surfing" tools to find a more up-to-date listing, if desired. - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.4 mQCNAi0aFSUAAAEEAOCOKpaLepvJCFgIR4m+UvZe0IN8g7Guwc+6GH4u6UGTPxQO iAhk/MJ7E8LE4c55A1G8to2W4y3aKAHvi9QCYKnsLV8Ag0BYWo3bGGTPEfkS7NAI N+Zy6vSjuF1D6MUnbvrQJ5p4efz7a28iYRKoAdan2bfnvIYWUD9nBjyFM+vFAAUR tDdNaWNoYWVsIFBhdWwgSm9obnNvbiA8bXBqQGNzbi5vcmc+IG1wajQgW2V4cCAz MSBEZWMgOTRdiQCVAgUQLTqfXj9nBjyFM+vFAQGU7wP/ZuuHfdAnCIblNCtbLLG8 39CSg6JIVa3KWfe0WIz6dXFU3cvl2Wt094kJgZ+Nmq01INWlib2lTOznbkA9sV1W q0aJSBHFWQH29qGmIdEqThs7A5ES2w8eRjJD80lxHodRIkBcC5KI6x4Mxo8cib5V BrwsvtG0+81HD6Mrpvc+a0GJAJUCBRAtJc2rZXmEuMepZt0BAe4hA/9YANYPY4Z3 1pXv2mT6ReC09cZS5U3+xxC5brQdLsQGKuH6QVs/b5oc6NV84sh8A9tZyHG2067o 3XIEyN7PPQzRm2UUnHHqw9lBCNhMiFQsAJi4W+m8zXrVrpJWK0Wv61eV2/XIQl0V d4lxu0r+MNRP6ID6FBzA4C9rO+RYEZmwOIkAlQIFEC0aGRzb/VZRBVJGuQEBfaUD /3c2h//kg843OIcYHG4gMDqdeeZLzGlp3RVvh0Rs3/T0YylJZGjPL2L/BF/vfLlB 9E2Urh9mDG/7hiB5FncrUnkmN63IkSj+K9YyfPyYxBVx06Srj8ZzYynh0N+zledd 6cnwxRXhaD3Wc4EfSNR7BH9M2rjkGzyb5to9cgBb0ng+ =BLg5 - -----END PGP PUBLIC KEY BLOCK----- I didn't have to generate a new key to use version 2.6, but I think keys should be changed periodically anyway to limit damages just in case a key got compromised and I didn't know about it. - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCNAi3s6gIAAAEEALCnDYox7v0T3EDm7LlL6w/tlU6wm51QEZd/anrRHLkRaYi2 NtoNa7AcEGlArVlV0wSWvKU/IoLQOTU3mvl4SD3wVRI1aZ3NMFSkm+VntQeDBULO mKqupduhXivNwwST8wzBvKvmtryGWaHClSoFLDNxpyr/tyw6JaAvIUiYSSpBAAUR tCdNaWNoYWVsIFBhdWwgSm9obnNvbiA8bXBqQGNzbi5vcmc+IG1wajeJAJUCBRAt 7O1fP2cGPIUz68UBAYKZBAC19BqRfVQpasOPKn32d31Ez9dQZKzw8svLUhPRVX5t nWtYPbH+PyBt/b8A1keQtcY5Y6fYOtZgU5qUhDaHavwQAdp3xzOckm7H3W2L5goI P7vf39wDtpw07x6+lknnwcQcfYYuuoiY1R8rSIE3gOLVtySDCu2KihcPRMp77FF5 +IkAlQIFEC3s7SSgLyFImEkqQQEBqkED/iBV2jbAdFIcEFSZhWHf3aZCJsQBKmv+ V0yuXWrw0gq5v35ZJbLeB7h/W3EqfKvLdGzLgpM0fi6EOgel2ilTOmkdICmCLERc t/xXkSwIsYtlOjkjSkGeASSphdwDRJw+j+1e/PBeZz7XwAfKZcKwqlbFSAmc2DAk 9wPp29+MqvqltCtEb24ndCB1c2UgZm9yIGVuY3J5cHRpb24gYWZ0ZXIgMSBKdW5l IDE5OTYutC1NaWNoYWVsIFBhdWwgSm9obnNvbiA8bXBqb2huc29Abnl4LmNzLmR1 LmVkdT60K01pY2hhZWwgUGF1bCBKb2huc29uIDxtLnAuam9obnNvbkBpZWVlLm9y Zz60ME1pY2hhZWwgUGF1bCBKb2huc29uIDw3MTMzMS4yMzMyQGNvbXB1c2VydmUu Y29tPrQdTWlrZSBKb2huc29uIDxtcGpAbmV0Y29tLmNvbT4= =Lf60 - -----END PGP PUBLIC KEY BLOCK----- ___________________________________________________________ |\ /| | | | | \/ |o| | Michael Paul Johnson Colorado Catacombs BBS 303-772-1062 | | | | / _ | mpj(a)csn.org aka mpj(a)netcom.com m.p.johnson(a)ieee.org | | |||/ /_\ | ftp://ftp.csn.net/mpj/README.MPJ --... ...-- -.. .| | |||\ ( | ftp://ftp.netcom.com/pub/mpj/README.MPJ -. --- ----- ....| | ||| \ \_/ |___________________________________________________________| -----BEGIN PGP SIGNATURE----- Version: 2.4 iQCVAgUBLe47Jz9nBjyFM+vFAQFP9wQA322KC92MHLdGH1ma9kdnrZ9ExSNp5heM di67wZgAGBmxJxlKhCgD0jWWvH5PLkhxVdi/F9k9NaJm3zcARZ9Elc0vCToADORq TuohOYPv2bAQO0zcwuOyZLKCRhaXCOHFu8rF74luYJnUblNDl//YFIZyo1L15j52 lHb5i/yd6Ig= =ZffA -----END PGP SIGNATURE-----

1 0

Clipper on Gene Burns?
by Duncan Frissell 17 Dec '03

17 Dec '03

Someone told me that Gen Burns, the libertarian syndicated talk show host, was supposed to focus on Clipper a few days ago but was missing a guest so he may do it at some time in the very near future. Perhaps today. Those interested should listen in. He does one topic per three-hour show so it could be good. DCF

1 0

Who was...
by cknight＠crl.com 17 Dec '03

17 Dec '03

Who was the CP on Live 105 Wednesday morning who kept interrupting Alex? -ck

2 1

Re: News Flash: Clipper Bug?
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

>> One thing this shows, even if the application of the technique turns out >> to be too difficult to be practical, is that Dorothy Denning's evaluation >> of the design was worthless. That team should have found this themselves. >> No wonder she was trying to play it down in the NYT. > >It was my understanding that Denning was just looking at the Skipjack >algorithm, and not the clipper unit as a whole. I wouldn't be too quick >to condemn her on this point. Of course, Dorothy Denning could simply say, "Gosh, the Blaze result shows how to make Clipper _more_ secure for the average user. Now they don't have to worry about the government. I stand by my assessment that it is secure."

1 0

Re: HACK - U HAVE NO PRIVACY
by Vinod Valloppillil 17 Dec '03

17 Dec '03

> One question: What's MJ12? British Intelligence was still MI5, >right? >-- >Michael Brandt Handler <grendel(a)netaxs.com> >Philadelphia, PA, USA PGP v2.6 public key via server / finger / mail >"I am iron, I am steel, nobody can touch me when I'm on the wheel" -- Curve MJ12 is (supposedly) the ultra-secret high-level national security group for the free world in charge of advanced military projects and most importantly -- UFO phenomena. In UFO conspiracy circles this group has supposedly sold the American public to alien abductors in exchange for technology, science, etc. No list of good conspirators is complete without it ! :) These opinions are mine, not Microsoft's. Vinod Valloppillil

1 0