- cypherpunks-legacy - lists.cpunks.org

ssh won the Sampo Data Security Prize!
by Kauto Huopio 17 Dec '03

17 Dec '03

The local TV news just announced that Tatu Ylonen won the Sampo Insurance Company's Data Security Prize 1996. Ssh will have a lot of good publicity here in Finland.. --Kauto *********************** Kauto Huopio (Kauto.Huopio(a)lut.fi) ****************** *Mail: Kauto Huopio, Laserkatu 3 CD 363, FIN-53850 Lappeenranta, Finland * *Tel : +358-53-4126573, GSM(mobile): +358-40-5008774 * *****************************************************************************

1 0

Re: Canada's ISO standards body?
by Peter Trei 17 Dec '03

17 Dec '03

Simon Spero <ses(a)tipper.oit.unc.edu wrote: > > On Thu, 28 Mar 1996 s1113645(a)tesla.cc.uottawa.ca wrote: > > > Speaking of which, could someone tell me who Canada's standards body and > > rep to the ISO is (and if that's where I've gotta go to get my hands on X.509 > > and all those other X.docs.). Any addresses would be helpful too. > > Try www.itu.org (X. series docs come from the ITU, not ISO. Same text > though). While the International Triathlon Union may be a standards body in it's own field, it has shockingly little influence on the X series of communications standards. You might try the International Telecommunications Union, at www.itu.ch. > I don't think v3 has been balloted yet - that gives you a chance to > explore one of the more amusing twists of OSI standardisation- you can > get copies for free of most drafts from the editor right up until it gets > standardised. Silly, isn't it. Haven't located it yet. > Simon Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

1 0

Re: Cypherpunks investigated, FOIA?
by rodger＠interramp.com 17 Dec '03

17 Dec '03

If it's been done, it won't likely make any difference. Information that would affirm or refute the existence of an investigation by law enforcement is exempt from FOIA. Will Rodger Interactive Week <---- Begin Included Message ----> Date: Tue, 2 Apr 1996 00:26:29 -0500 (EST) From: "Declan B. McCullagh" <declan+(a)CMU.EDU> To: cypherpunks(a)toad.com Subject: Cypherpunks investigated, FOIA? Cc: sgs(a)well.com >From sgs(a)well.com: Have the cypherpunks requested data on whether they are being investigated by the same agencies under the FOIA individually or as a group listed by that name? If so, what are the results, if any, so far? Does anyone know if this has been done? The FOIA, that is. -Declan <---- End Included Message ---->

1 0

Re: (fwd) Russians Break RSA?
by stillson＠ashd.com 17 Dec '03

17 Dec '03

at Kryptogorodok, the secret city of Soviet cryptographers >hidden in the Urals (and first visited by an outsider, Stephen >Wolfram, only a couple of years ago). > Nice touch. I worked at Wolfram Research a few years ago, and wolfram actually was in Russia for a tour. Chris ############################################ Chris Stillson Chief Rocket Scientist Resident Web Geek Hip Young Nerd Second Rate graphic designer Unix Guru In other words, Webmaster American Software & Hardware Distributors fluffy(a)ashd.com Check out our web site-> http://www.ashd.com Cause I did it all.... stop the CDA. Check http://www.eff.org ############################################

1 0

software with "hooks" for crypto
by me＠muddcs.cs.hmc.edu 17 Dec '03

17 Dec '03

Hello all, I'm trying to figure out exactly what the laws are regarding the export of software which contains "hooks" for PGP. In various forms, I've heard that it's not the ITAR which prevents this, but more a "suggestion" by the NSA that we "shouldn't do it." Does anyone have any pointers to real legislation/laws regarding this? Also, since we all know that our gov't thinks it perfectly legal to export source code in hardcopy form (albeit with a license, right?) I was wondering... I've written a Unix e-mail client which contains support for PGP/MIME and also a front end for mixmaster. Right now I basically reap all the "bad" code before I distribute it (at _least_ 50% of my testers are outside the US). However, this has been annoying for those users because they want to be able to use the PGP support (so do I!). So, what I'm wondering is what the laws are regarding snail-mailing source code to these people. The actually pgp/remailer stuff isn't more than a few pages of code, which could easily be transcribed or scanned in with OCR software. Would I have to get a "license for export" in order to send the code outside the US? It's worth the $1.00 it would cost to do this if it really is legal... me -- Michael Elkins <me(a)cs.hmc.edu> http://www.cs.hmc.edu/~me PGP key fingerprint = EB B1 68 32 3F B5 54 F9 6C AF 4E 94 5A EB 90 EC

1 0

National id already here?
by Yap Remailer 17 Dec '03

17 Dec '03

http://www.aamva.net/AAMVAnet_New_Systems.html says: Coman said [police] officers can use "CDLISCheck" to access commercial driver license status, history and AKA information. She noted that the new service was developed in response to a Congressional mandate that requires access to commercial carrier and driver information by at least 100 roadside sites by 1996 and at least 200 locations by 1997. There's a congressional mandate for nationwide online id???

1 0

[MagicMoney] Passwords of various PGP keys.
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

I played with Magic Money recently. I wondered: Where are the passwords of the various PGP keys stored? Now, suppose you want to use this system for serious use: What, if any, are the critical files that must be protected from outsiders to prevent tempering (altering without the owner's ability to quickly discover the manipulation) with the system data? Is is necessary to encrypt the whole client directory when you don't use it? Ditto, for the server? JFA PGP key at: http://w3.citenet.net/users/jf_avon Jean-Francois Avon <jf_avon(a)citenet.net> ID:C58ADD0D 96/03/01 fingerprint: 52 96 45 E8 20 5A 8A 5E F8 7C C8 6F AE FE F8 91 Unsollicited commercial e-mail will be proofread at a rate of 165 $ U.S. per hours. Any sender of unsollicited commercial e-mail will be considered as to have accepted the above ment- ionned terms.

1 0

Video retraces as a source of entropy...
by Deranged Mutant 17 Dec '03

17 Dec '03

Quickie blurb on using video card retraces as a source of entropy... I've done some brief testing in the last couple of days on using the timing drift between video retrace events as a source of randomness. It seems comparable to truerand() spinners that check the system's timer ticks [which makes me leary of relying on it since it has similar strange attractors when plotted in a noise sphere, but that's another post...]. Assuming one trusts truerand spinners, this method could have some advantages over a 'pure software' method, since the video controller (and other hardware controllers which could be adapted to this) runs in 'parallel' [although it's liable to the samefluctuations in current or memory-access and other interfaces with the main system, or possibly tempest attacks for the paranoid...]. In pseudo-C: int retrace(void) { // test for video retrace #ifdef __MSDOS__ return (port[0x3da] & 8); // Some VGA, maybe EGA cards #else // your OS here #endif } [..] x = 0; while (!retrace()) x++; I've tested it as standalone routines (in Pascal and assembler) as well as a hook to the DOS idle in the background [See note about strange atteactors above]. It also seems to work while in Windows (but not OS/2?!), which is an advantage over using the system's microsecond timer alarm (which Win3 takes over). Comments? (other than "truerand is an oxymoron"....) Rob. --- Send a blank message with the subject "send pgp-key" to <WlkngOwl(a)unix.asb.com> for a copy of my PGP key.

1 0

Re: software with "hooks" for crypto
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 02:31 PM 4/2/96 -0800, Michael Elkins wrote: >Hello all, > >I'm trying to figure out exactly what the laws are regarding the export of >software which contains "hooks" for PGP. In various forms, I've heard >that it's not the ITAR which prevents this, but more a "suggestion" by >the NSA that we "shouldn't do it." Does anyone have any pointers to >real legislation/laws regarding this? Evidently you are under the impression that we are still governed in accordance with the rule of law. Since the legislation in question was intended to prohibit gun running, it naturally contains no such thing. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: Why Americans feel no compulsion ...
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:41 PM 4/2/96 -0500, Rabid Wombat wrote: >Yeah, and some americans speak C, and FORTRAN, and FORTH, and ... This discussion is about languages for communications between _humans_ - like ALGOL, and the lambda calculus :-) #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 1995: Chat rooms, espresso, and Linux 1996: Exon, melatonin, and Java.

1 0