- cypherpunks-legacy - lists.cpunks.org

remail@c2.org key
by sameer 17 Dec '03

17 Dec '03

The previous posting of the remail(a)c2.org key was wrong. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCNAi3/6FIAAAEEANggWtLprhvPDAdv503F5vChmF5jadD16dBke2yuP5iJwt0i X0eJC7dFoimNp03Cm7pkn5SkGr3i3hjtKLQGtneKNfdp29ELisOc9wMLiBMP46q3 Sr/9RseAt5Nnt4fW2Efi6xO8QLiMVG837gd5pEpXOqJ2FMCikEMvwOz0/VotAAUR tCtUaGUgTkVYVVMtQmVya2VsZXkgUmVtYWlsZXIgPHJlbWFpbEBjMi5vcmc+iQCV AgUQLf/owHi7eNFdXppdAQEctAP/aK+rTQxs5J8ev1ZtnYpGZPIEezQeC8z8kRdN jUKF7CutVLy09izYDSdonuHFyWoHtLb1RUj5fGUFhOzwmJTMlTRzEx8i2a1bKdmQ qPGNu2iVKIitkSSVZvz7vHXM+ZUFTSC4LGWsECukEONEeyGy+ehG3ON0vx1ATqY5 /ATzPpo= =N0yt -----END PGP PUBLIC KEY BLOCK-----

1 0

Niemoeller and remailer chaining
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

> From: Ezekial Palmer <vikram!an60011(a)anon.penet.fi> > Reply-To: Ezekial Palmer <vikram!na60011(a)anon.penet.fi> > > ----Father Niemoeller > > So, why'd you "forget" the start of the quote?? > > Zeke > > In Germany they first came for the Communists, and I didn't speak up because I > wasn't a Communist. Then they came for the Jews, and I didn't speak up because > I wasn't a Jew. Then they came for the trade unionists, and I didn't speak up Actually I didn't have a written reference, so I really _did_ forget the first line. Though I think the quote is a appropriate for all of us, particularly in this forum, I'll probably excise it from my .sig. I find other people's 20 line sigs irritating, so... PS. Why do you remail through extropia when you advertise your penet ID? Isn't the advantage of chaining that only the final remailer is known? ----------------------------------------------------------------------------- Rishab Aiyer Ghosh First they came for the communists, and I did not speak out, for I was not one They came for the Jews, and I was silent because I was not a Jew; rishab(a)dxm.ernet.in They came for the Trade Unionists, and I did not protest, because I did not Voice/Fax/Data +91 11 6853410 belong to a trade union; Voicemail +91 11 3760335 They came for the Catholics, and I said nothing because I was not a Catholic; H 34C Saket And then they came for me. New Delhi There was no one left to say anything... INDIA ----Father Niemoeller

1 0

Maricopa archive is WAIS indexed
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

whitaker(a)dpair.csd.sgi.com (Russell Whitaker): > On Jun 15, 2:51pm, Gary Jeffers wrote: > > Subject: Cypherpunks' mail database does exist > > Vincent, you state that a fully archived, indexed cypherpunks > > mailing list exists as: > > http://pmip.maricopa.edu/crypt/cypherpunks/cypherpunks.src As Russell says, this is a web site. Actually, it isn't. The archive is not a web, in that it isn't the ideal hypertexted dream we all have. But it does have an extensive index, through wais. If you want to search for something in particular, you can try (with a URL browser, like lynx/mosaic) wais://pmipii.dist.maricopa.edu:210/crypt/Cypherpunks.src?remailer I forget the path, it'll show up when you try the http; the ? after the filename is followed by a wais search string, such as 'remailer'. You should be able to use a wais client to access this. I don't know how _old_ the archive is... ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

Where to ftp fips181.txt
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Mikolaj Habryn <dichro(a)tartarus.uwa.edu.au>: Subject: Re: [ANSWER] NIST's ftp site > Also, apparently, source for DES was in Appendix A of the file > "/pub/nistpubs/fips181.txt". However, it was removed and replaced with > the following: > > Did anyone actually grab it while it was around? If it's still > available anywhere, i'd appreciate a tip-off... ftp.eff.org/pub/EFF/Policy/Crypto/Newin/New_nist/fips181.txt I haven't seen it but it's a 127k file dated March 6th. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

Re: [ANSWER] NIST's ftp site
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

> I have a copy of FIPS181 with Appendix A intact. I can mail a copy if > you like. > > Why bother just find it on another site, there are plenty out there. > The point of my NIST ftp site question was not to find a place to get DES source, I know I can get DES source in lots of places. I was just trying to find out if the NIST site still had FIPS-181 with DES code. Its presence on a internationally accessible *US government* site would be an embarrassment to the anti-export camp. > > I wonder if [NIST will] ship [hard copies of DES source > > code] to an address outside of the US or Canada? I wonder if > > the people who package and mail the stuff even look at it? > > > > Doesn't really matter, does it? Printed source code is > available in hundreds of places, and doesn't require a > CJR for export. Schneier's _book_ never had trouble; > just the disk. > I know, but I thought it would be kind of ironic if anyone could get DES source directly from the federal government. Jim_Miller(a)suite.com

1 0

Re: Time Stamp Server (Was: Re: Another dumb question... proving dates)
by dfloyd＠runner.utsa.edu 17 Dec '03

17 Dec '03

> From grendel(a)netaxs.com Thu Jun 16 10:40 CDT 1994 > Date: Thu, 16 Jun 1994 11:38:55 -0400 (EDT) > From: Michael Handler <grendel(a)netaxs.com> > Subject: Time Stamp Server (Was: Re: Another dumb question... proving dates) > To: "Douglas R. Floyd" <dfloyd(a)runner.utsa.edu> > Cc: cypherpunks(a)toad.com > Mime-Version: 1.0 > > On Thu, 16 Jun 1994, Douglas R. Floyd wrote: > > > In the RSA FAQ, it states how one can set up a server to do time and date > > stamping of documents, but I know of no Internet service that will > > do this. > > > > Is there a way I can send a document to some agency/server and have it > > time and date stamped with their public key? > > This appeared on alt.security.pgp a while ago. The server works > quite nicely... Getting the key for the timestamp server is left as an > exercise for the reader. ;) > > ----- BEGIN INCLUDED FILE: /usr/users/grendel/timestam.ser ----- [Burp-o-rama] > ----- END INCLUDED FILE ----- > > -- > Michael Brandt Handler <grendel(a)netaxs.com> > Philadelphia, PA PGP v2.6 public key on request > Thanks for this... I could not find any information on a time stamper site. BTW: Would a timestamp like this stand up in US court assuming that the lawyers were equal in their BS ratios? (Kinda-smiley for the humor impaired ;)

1 0

"The Virtual Hand": Free-market Internet guide
by Competitive Enterprise Institute 17 Dec '03

17 Dec '03

[Please distribute this as widely as you see fit. Thanks -- Sasha Volokh] The Competitive Enterprise Institute is pleased to announce: THE VIRTUAL HAND CEI'S FREE-MARKET GUIDE TO THE INFORMATION SUPERHIGHWAY Now, under one cover (over 50 pages!), all the Internet places of interest to free-marketeers. Do you want to find the complete electronic text of "The Wealth of Nations"? How many places can *you* list where you can discuss the words of Ayn Rand? (The Virtual Hand can name five.) Do you want to know the latest in conservative or libertarian politics, or would you rather sit around griping about gun control? All this -- and more! -- is available from the Competitive Enterprise Institute. TABLE OF CONTENTS 1. Policy chatter (mainly Republican and Libertarian politics) 2. Cultural and philosophical (Objectivism, free-market literary journals, "fan" newsgroups, electronic books) 3. Student-oriented (college groups) 4. Single-issue forums (taxes, land rights, firearms, telecommunications policy, education, health care, feminism, law, Congressional reform, kids' rights) 5. Of local interest (statewide free-market groups) 6. Internet addresses of free-market groups 7. Miscellaneous 8. Other computer systems (BBS'es) 9. Government resources (how to get White House press releases, text of legislation, Federal Register, C-SPAN schedules, etc.) To find out how you can get your very own copy of "The Virtual Hand," drop a line to Alexander "Sasha" Volokh at cei(a)digex.com.

1 0

Unofficial Excerpt from InfoSecurity News
by NetSurfer 17 Dec '03

17 Dec '03

To: Cypherpunks: The following is unofficially extracted from the Infosecurity News, May/June 1994. * Please forward this on to EFF and CPSR, * * but please strip out all info remaining to me * (I don't want to lose my subscription. Know thy enemy and all that.) Avoid Encryption Anarchy =======================Tim: like the title? -NS BY DONN B. PARKER Encryption is a powerful tool for protecting data stored in workstations, LANs and mainframe systems and in transit between systems. In fact, it is so powerful that its misuse may cause great damage to tomorrow's informa- tion owners and users. Unfortunately, this "en- cryption anarchy" may come very soon if work- station and network encrYPtion is allowed to proliferate unchecked in its present form. What is encryption anarchy and how might it happen in your organization? Here are some examples: Hidden by voice encryp- tion, an employee could leak valuable information over phone lines, without worry- ing about wire taps or call monitoring/recording. Also, Privacy-Enhanced Mail is increasing on the Internet. But its encryption-based cer- tificates protect individual end-users by shielding their activities from managers. En- cryption technologies such as these could reduce or elimi- nate management control over voice and data communi- cations with the outside world. Large amounts of worksta- tion, LAN and mainframe in- formation may be lost if it is encrypted incorrectly, if de- cryption fails or if encryption keys are lost. As a result, many users may adopt less- secure practices. These in- clude backing up copies of files in cleartext or storing encryption keys where they can be compromised. Both practices can result in more exposure of information to unauthorized parties. Corporate deception also could become easier. If false information is given to audi- tors, for example, the true data could be hidden behind an encryption barricade. In one company, an ex-execu- tive's alleged theft of trade se- crets only after the company reviewed his e-mail. The executive's actions might never have been known if he had encrypted his e-mail and kept the key. An employee could leave a company and take copies of valuable data. If no one else knows the encryption keys, the remaining en- crypted data will be lost. As international companies turn to en- cryption to protect communications with trading partners, sup- pliers, contractors and customers in different countries, it will be- come increasingly diffi- cult to manage and control the many dif- ferent algorithms and keys that will be used in the organizations' workstations, LANs and mainframe sys- tems. Countries'differ- ing import/export controls, encryption laws and restrictions on data exchange will cre- ate both operational and man agement headaches. Without centralized, en- forced encryption standards, workstations, LANs and wide- area networks will include varying products,technolo- gies and key-management ap- proaches. Today's transitory data will be encrypted in dif- ferent ways, as will critical databack-ups and archives. Years from now, however, these files could become unavailable if encryption algorithms and key changes are not carefully tracked and controlled. A matter of control. These examples reveal that encryption anarchy may occur when the people who control and use information are not accountable for it or have no jurisdiction over it, or when people who rightfully own in- formation lose control over it. Encryption anarchy may also occur through the indiscrimi- nate use of encryption without standardized key manage- ment or managerial oversight. But even the proper use of encryption could, in the future, create unan- ticipated technical problems in network settings. For example, LAN maintenance and diagnosis often requires that information be checked for authentici- ty and integrity. This is done by comparing in- formation sent with in- formation received. If ny a this is done in real time on an encrypted net- work, special testing systems and additional network encryption/de- cryption operations may be required. Similarly, LAN managers may have to install special back-up and recovery products tabdlty as LANs become in- creasingly encrypted. These could add unexpected operat- ing costs, and the additional key management may intro- duce new security exposures. How can infosecurity man- agers avoid encryption anar- chy in the coming years? First, make sure that information (whether encrypted or not) re- mains accessible to all man- agers, boards of directors, reg llators and auditors who are held accountable for it or have jurisdiction over it. No one person should possess ex- clusive encrypted access to an information asset. Encryption also should be managed using a hierarchy of override decryption keys cor- responding to information ownership and accountability in the organization. This over- ride hierarchy should extend beyond the organization-- under careful control--to any government or regulatory body overseeing the enter- prise The U.S. government's Clipper escrowed-key propos- al, although a step in that di- rection, does not go far enough in providing these hi- erarchical override capabili- ties. Encryption keys must be escrowed in business organiza- tions as well. Infosecurity managers also could avoid encryption anar- chy by enforcing related poli- cies and standards, choosing technologies with assured Iongevity and training users to handle encryption properly. When not to encrypt. In some cases, encryption may even be inadvisable. Much business information may be adequately protected with commercially available data- compression utilities, and not full-fledged encryption. Other information may be accessed so often that encryption or compression is imprac- tical due to its cost, in- convenience and processing time. If in- formation is ubiquitous, it makes no sense to protect it in one place and not in another. There also may be valid business reasons to not encrypt. A newspa- per, for example, may deliberately exchange cleartext messages with correspondents in a for- eign country, to avoid any impression that these individuals are spying or otherwise working against the country. Even if encryption is im- plemented and managed properly, infosecurity man- agers should assume that their adversaries--industrial spies, thieves, burglars and even kid- nappers and murderers-- will try to obtain information through the easiest possible route. If they encounter en- cryption, an easier route may be through inside informants, human engineering or dump- ster diving. In fact, interviews with more than 200 computer criminals reveal that the most vulnerable form of information is spoken, followed by printed/ dlsplayed, removable media, and finally information that is communicated elec- tronically or stored in computers. In the coming years, do not overlook the many such ways in which information can be compromised. Donn B. Parker is senior consultant for SRI inter- national, Menlo Park, Calif. He can be reached at Internet ad- dress dparker(a)sri.com. Also by the author: Which crypto to use? Most encryption products using the Data Encryption Standard (DES) will be acceptable for at least thc next five years. After that time, DES will be discontinued as a U.S. federal standard and will no longer have the same strong due-care status it enjoys today. This is because increasing computing speeds will make the algorithm too weak for some applications. Many claim that DES and Rivest- Shamir-Adleman (RSA) algorithms will remain acceptable indefinitely. New encryption products and technologies, however, probably will encour- age a migration to new algorithms beyond the next five years. For example, in spite of recent protests, Clipper/Skipjack, Digital Signature Algorithm and their hardware implementations will see greater acceptance, but only in the U.S. govern- ment and among government Contractors. Other methods, such as DES triple encryption, will provide alternatives in commercial settings. However, international acceptance of Clipper/Skipjack may take longer, due to various countries' import export restrictions and U.S. control of the technology's algorithm and es- crowed keys. The underlying purpose of this control is not just to facilitate court-approved wire taps, but also to discourage criminals and foreign entities from using Clipper/Skipjack technology. This control mechanism would force them to use other, less powerful, algorithms and key management. Over time, the effectiveness, change frequency and management of encryption keys probably will prove more important than the specific algorithms chosen. New encryption products that automate these activities and make them transparent to users may help strengthen encryption management, even though fhey may introduce more opportunities for technical compromise. Infosecurity managers would be wise to delay the use of any of these new encryption technologies. This would allow time for products to fully develop and early adopters to report their experiences. Donn B. Parker. dparker(a)sri.com

1 0

Re: "The Virtual Hand": Free-market Internet guide
by willhoek＠halcyon.com 17 Dec '03

17 Dec '03

>[Please distribute this as widely as you see fit. Thanks -- Sasha Volokh] > >The Competitive Enterprise Institute is pleased to announce: > > THE VIRTUAL HAND > > CEI'S FREE-MARKET GUIDE TO THE > INFORMATION SUPERHIGHWAY >... Alright, who let the spammer in? I subscribe to net-resources for this sorta crud; I don't need to see it here in cypherpunks. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Parker's Third Rule of Tech Support: If you can't navigate a one-level, five-item phone tree, you didn't need a computer anyway. willhoek(a)halcyon.com =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

1 0

Andy Grove on Clipper
by Vinod Valloppillil 17 Dec '03

17 Dec '03

I saw Larry King Live last night on CNN and the guests were Al Gore, Andy Grove (CEO/Intel), Dan Sussman (? -- I think that's his name, he was an editor at Newsweek), and Reed Hundt from the FCC. As can be expected, it was another talk show about the "Data Superhighway". It got interesting on two points: First, Larry King asked Andy Grove what he thought Intel should do for the Data Superhighway and he told Larry that since Al Gore was on the show, he'd rather get into what he thought the Feds _shouldn't_ do and discussed the path towards universal access to PC's without any federal involvement. Al Gore tried to get involved by arguing that the Fed's were originally responsible for the computer revolution b/c of the Apollo program. The two hit back and forth a couple of times on the issue. At this point, I was patting Andy on the back for being a non-statist. Then, the editor from Newsweek said that in any show about the "Data Superhighway" the Clipper chip had to be discussed. He then went on to say (and occasionally apologizing to Gore for being blunt) how the chip and the whole program were "loathed" by the industry and privacy advocates. Larry asked Groves what he thought about it and he went off talking about the govt's legitimate right to tap analog media and how all this chip did was to extend that right into the digital realm. I was shocked. Even worse, Al Gore supported Andy's position and then when Larry King got back to the editor, he backed off saying "well, I just heard that people in the industry didn't like it." Larry asked for his opinion on it as a provider of information services and he said, "we just report on public opinions in our magazine and don't try to take positions on the issues. Yuck.

1 0