- cypherpunks-legacy - lists.cpunks.org

Does PGP scale well?
by A5113643667＠attpls.net 17 Dec '03

17 Dec '03

Perry has repeated a litany here that I have been hearing for years on the pem-dev list with never a hint of a justification. That is that PGP does not scale well. One of the reasons that I consider this to be untrue is my empirical experience with two groups that are constantly interested in exactly who I am: the government and the credit bureaus. They both chose to use my SSN even though that has all the same attributes of a KeyID, except that it is somewhat denser. Now if this is what happens when the real world tries to identify me, why is the KeyID such a bad way to identify keys? Please note that I do understand that identifying me and finding me are separate issues. I'm not sure that the pem-dev folk clearly discriminate these. Peace. Tom

4 4

Fwd: Re: West (just a minute)
by Alan Pugh 17 Dec '03

17 Dec '03

the most reasonable and easiest to implement solution to eliminating the need for west's page number system is to just number each paragraph. anyone can do this. ----------------- Forwarded Message Date: Sat Feb 11, 1995 5:57 am EST Source-Date: Sat, 11 Feb 1995 05:49:47 -0500 (EST) From: Craig Hubley EMS: INTERNET / MCI ID: 376-5414 MBX: craig(a)passport.ca TO: * Alan Pugh / MCI ID: 370-1548 Subject: Re: West (just a minute) Message-Id: 81950211105718/0003765414DC2EM Source-Msg-Id: <m0rdFOe-0002IhC(a)forged.passport.ca> U-Mime-Version: 1.0 U-Content-Type: text/plain; charset=US-ASCII Hmm, how hard could it be to eliminate West page numbers? There couldn't be more than a couple of cases on each page, if each page number were replaced by links to each case, a lawyer could tell on the first glance which of the three was right and mark it, assuming a reasonable HTML/SGML editor or something. Seems like it could be done as a part of daily work and the results accreted somewhere. -- Craig Hubley Business that runs on knowledge Craig Hubley & Associates needs software that runs on the Web craig(a)passport.ca 416-778-6136 416-778-1965 FAX

1 0

Laws, Feds, & the Internet
by Richard F. Dutcher 17 Dec '03

17 Dec '03

The following was in today's San Francisco Chronicle. BTW, quoting the entire article as I have done is probably a violation of "fair use" - but de minimis ... All under *current* law, folks. [hmmm -- encryption doesn't do much for exhibitionists and braggarts, does it? ;-] ============================== MAN JAILED FOR INTERNET MESSAGES Associated Press Detroit A college student was charged yesterday with posting computer messages describing the imaginary binding, rape, torture and murder of a woman who used to be in his Japanese class. "Torture is foreplay, rape is romance, snuff (killing) is climax," prosecutors say one of Jake Baker's messages read. The student, 20, was charged with the federal crime of transmitting a threat to injure. He was jailed pending a bond hearing today. Baker, who was suspended from the University of Michigan last week, told reporters he was within his rights to post the messages on the Internet. By posting the messages, he gave other Internet users access to them. If convicted, Baker could be sentenced to up to five years in prison. The name of the woman was not released. ================================== =================================== Rich Dutcher, San Francisco Greens P.O. Box 77005, San Francisco, California 94107 USA "That's libertarians for you - anarchists who want police protection from their slaves." Kim Stanley Robinson, "Green Mars" Greens, of course, only enslave plants - so weed-whackers work better than cops ... ====================================

2 1

why pgp sucks
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Matt Blaze, quoting Greg Morgan, wrote: > >Doesn't having some kind of central record of keys go against > >the principle of PGP? > The only "principle" of which I'm aware (and particularly interested > in supporting) is that of having widely fielded, useful and strong > privacy and authentication tools that work properly and transparently. I think the centralization/decentralization confusion comes from PGP's decentralized approach to key generation and authentication, which has been hailed as a good thing. As long as folks can generate their own keys, sign their friends' keys, and upload their keys to servers at their own discretion, I can't see what would make a centralized or standardized distribution method harmful. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLzv7I33YhjZY3fMNAQGVbAP/Sm8rXLFDXU4te0mBEhmi6CaAbvHTPqRZ kce6+auO1T/3ypEi0c0D2QCJ7mS3Xx/g/n42mHhJHzt5ClhuHlhDRyjOV2rGBpWX OElxuVFpcSIlUnnQ2cvju9k8cDtHnXN+crmmjUXxvqmUB371eyOZ6E140nxfxo2/ JqWBXLFPvpI= =AL3C -----END PGP SIGNATURE-----

1 0

Re: Q: ref. for DNA used to solve math. network prob. (fwd)
by cactus＠seabsd.hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- The Adleman paper is on the web (I put it up). The url is: http://www.hks.net/~cactus/doc/science/molecule_comp.html I never completed typing the perspectives article since an article appeared in Science that implied that Science doesn't consider it kosher to reprint their articles. As a member of the AAAS, I'm a bit appalled by this position but for the moment I've stopped any progress on entering Science articles into the Web. Enjoy, - - -- Todd Masco | "Let me get this straight. You're making a crypto toolkit, cactus(a)hks.net | and you're worried about it being _obscure_?" - Eric Hughes Cactus' Homepage - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLz7VORNhgovrPB7dAQHd3gQAgXnpCEQRIxzO6VQSarHhK7nH9j4kncbi IlJawMbNnCf1RD9P3OD7art0w+180luFRJW9d93C5lq3Z36XhCOCgrcHrnGausCM D87DWCEYECMxjuMa362NC1u79UGQ5MThwb4Tl6/kttYzLYyRfCiJLRwexJs5B6mX 6PaKGuNQDV4= =Vgdm - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLz8OFCoZzwIn1bdtAQFC3QGA39rHlZeQgpkQwtsTv0JUEK4UyftbMqSK I8IHti1XiwbwSGgc6zzg5ga0ChRg0B8P =pXZq -----END PGP SIGNATURE-----

1 0

Re: MIME based remailing commands
by Rich Salz 17 Dec '03

17 Dec '03

> It doesn't matter if they disagree. If you don't have a To: >line in the header then "Apparently-To:" gets tacked on using the "To" >from the envelope. ... And all CC recipient and all BCC recipients as well. /r$

1 0

why pgp sucks
by Eric Hollander 17 Dec '03

17 Dec '03

if i use a command like pgp filename it will automatically figure out the right thing to do with the file. if it's encrypted, and i have the key, it will attempt to decrypt it. if it contains keys, it will ask if i want to add them to my keyring. if it's signed, it checks the signature. this sucks! if i'm trying to write a program to automatically process incoming mail (for instance, to see if it's encrypted with a specific key), i certainly don't want to have the possibility of people being able to add garbage to my keyring just by mailing it to me. is there a way of saying pgp -decrypt-with-key user_id filename and have it return some error code indicating whether or not the file was in fact encrypted with user_id, and also gauranteeing that it won't do other fun stuff with the file, like add it to my keyring? is there a way of using pgp in a diagnostic mode, to just inform me of what the file contains (is it signed and/or encrypted, from who and to whom?), without processing it, and without interaction, and without messing around with the keyring? has anyone written some scripts to do this kind of thing? or should i just wait until some of the groups working on the other encryption software get it out? e

9 21

Privacy vs. Ubiquitous Video: NetCam; Wearable WebCam, etc
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Saw this in technomads. Not necessarily crypto, but certainly privacy related... Cheers, Bob Hettinga >Date: Fri, 10 Feb 95 19:11:08 -0500 >From: Steve Mann <steve(a)media.mit.edu> >To: technomads(a)ucsd.edu >Subject: NetCam; Wearable WebCam, etc >Cc: steve(a)media.mit.edu > > >I am an amateur television (ATV) hobbyist, interested in things like >driving radio-controlled cars using a head mounted display (HMD) >(which involves putting myself into the ``usual'' perspective >of the car), or playing tennis with an HMD linked to a stand >mounted camera (which is exactly the opposite: the radiocar is >like a flight simulator from the cockpit, while the tennis example >is like switching to the ``control tower''). I've also been >interested in wearable photographic equipment (such as a wearable >2400J flashlamp I use for ``lightpainting''). > >More recently, I've become interested in sending and receiving >video (and digital stills) over the WWW (e.g. Wearable WebCam, >and WebCar -- radiocar on the WWW). > >I would like to hear from any other ATV hobbyists, people into >packet radio, and those interested in wearable cameras, and >combining wearable cameras with wearable computing. Another >application I was interested in was wearable vision (e.g. for >the visually impaired, or simply to augment the regular human >visual system). > >Therefore, I've started a new mailing list, ``netcam(a)media.mit.edu'', >to discuss issues related to wearable cameras, as well as communications >and computation issues associated with wearable cameras. I am also >interested in some of the privacy issues associated with wearable >cameras (as I touch on in http://www-white.media.mit.edu/~steve) >and the social implications of a society in which there are >ubiquitous cameras (both wearable and fixed) connected to various >high speed communications networks. > >If you would like to be added to netcam(a)media.mit.edu, please >email netcam-request(a)media.mit.edu > >--steve ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

Design my protocol
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

Here's a question for all the gurus out there: I work for a company that manufactures a new concept in telephony hardware. The system we developed essentially replaces PBXs with an off-the-shelf computer, some special cards, and some software. Our system will offer all the features that you'd expect from current PBXs, such as least cost routing, as well as other features that can't be provided by a standard PBX. When a customer sets up a site, the system connects via a modem to our server, from which the system retrieves software, routing tables, etc. We also offer periodic software updates, and software based add-on features for an additional free. We would like to be able to upgrade, and in some cases control, the sites by remote and we would like the customer to be able to purchase extra software from us via modem or over the net. We use TCP/IP and SNMP to comunicate with the sites. We want to include strong crypto from the begining for several purposes: -Link encryption between the customer sites and us. -Authentication of the upgrade software. -Secure purchases and transmision of software both via dial-up and the Internet. -Optional encryption of the (telephony) data carried between sites. I understand that the last issue is somewhat different from the others, I just mentioned it to complete the picture. For now I need a solution for the first two or three questions. We need something that can be delivered to the customer six months from now, not something that may make it out of a standard comittee years from now. Thanks in advance, -- Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred.

1 0

the problem that destroyed PGP
by peace＠BIX.com 17 Dec '03

17 Dec '03

Return-path: <peace(a)BIX.com> Received: by bix.com (CoSy3.31.1.50) id <9502112132.memo.28092(a)BIX.com>; Sat, 11 Feb 1995 21:32:20 -0500 (EST) From: peace(a)BIX.com Date: Sat, 11 Feb 95 21:32:20 EST To: cyperpunks(a)toad.com Message-ID: <9502112132.memo.28092(a)BIX.com> Subject: the problem that destroyed PGP So finding a KeyID is the problem that destroys PGP eh? Well I would just take that as the problem to solve, not a reason to throw the baby out with the bath water. All we need to do is design a distributed, hashed database. Should be a piece 'o cake, right? Let's see, first of all the problem is the receiver of a message who gets just the KeyID. First of all, the trusted keys should be expected to be local (in some webby sense). But lets assume that the key is new, not in our local cache. Now my scheme would put a net of keyservers that ALL know each other. The local environment puts in a request to its usual keyserver. That is the keyserver that typically has the keys that the receiver is likely to trust. Now it is certainly possible to imagine a case where a key is not in the receiver's expected server, so what's next. Well the keyserver knows ALL the other servers, right, so just copy the original receiver's request to all the other keyservers. If that gets to be too big, just build a real net where every keyserver is at most two hops away from any other one, then the intermediate servers that could not honor the request would forward it to all the servers it knew. I purposely propose that only two steps would ever be necessary to limit the explosion, but I see that as no real limitation, the rule could even be modified if there was really any need. Hey look, the net supports archie and a host of other non-structured search mechanisms. Why create a search hierarchy where such things are not natural. Why create a naming hierarchy where such things are not natural. By the way, the dockmaster.ncsc.mil note is a good example of a naming hierarchy that has nothing to do with the employment of the person. Anyone working in the security field can get an address there. And any member can get acm.org or ieee.org. But I can post from any of there different net addresses which do not even agree at the very most basic level. So why would my KeyID be naturally associated with any one of .net, .org or .com? Peace ..Tom

5 7