- cypherpunks-legacy - lists.cpunks.org

Re: key for Alice as promised (not)
by Adam Shostack 17 Dec '03

17 Dec '03

> > >Can you imagine?? I'm simply not willing to fool myself into thinking > > >that I ahve security by posting a key and using PGP. > > > > Unless you can post some proof that PGP is insecure, stop insisting it is. > > PGP is really not the issue. The issue is more my security and the > environment that I use PGP in. I don't have a trusted machine to run PGP > on. Anyone who wants to can come up to machine and copy my secret keyring > or they can even watch me typing my password in. Threat, please?? Do people often stand over your shoulder as you type? Enter your office, point guns at you, and take a backup of your entire computer? Have you considered putting the secret keyring on a floppy and locking it in your desk/safe when you're not actually in the office? (Or home..) > So, I don't fool myself, and I don't use PGP, except for things like > exchanging a one-time pad with someone when I've already sent the message > out across another delivery mechanism, like on a floppy delivered my > courier. I don't follow. You're claiming that PGP is good enough to transfer OTPads, but not good enough to sign pseudononymous messages? Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

Re: SKIP Source Release is out!
by smithmi＠dev.prodigy.com 17 Dec '03

17 Dec '03

Perry Metzger writes: >Anyone who'd like to help me put the sources to the NRL IPsec + IPv6 >implementation up for FTP is invited to get in touch. It will runs on >4.4BSD machines (i.e. BSDI, NetBSD, FreeBSD, etc) and should be >pretty portable to other similar Berkeley based machines. What licensing requirements exist for people who might want to use this code in their products? In particular, does one need to obtain any licensing from RSA or Cylink? --Michael Smith smithmi(a)dev.prodigy.com

2 1

Re: The future will be easy to use (fwd)
by Rev. Mark Grant 17 Dec '03

17 Dec '03

On Tue, 28 Nov 1995, Patiwat Panurach wrote: > I feel sad when they say that the market for <1000 $ machines is nill, I > had so much fun and learned so much from my old machines. Personally, I just bought a 486/66 laptop, which would have cost almost $1000 with 170 MB hard disk, 4 MB of RAM and Linux (I paid a couple of hundred extra for a 500 MB disk)... I could have got a Pentium desktop for the same price if I'd wanted one. So I don't see that there's really a great advantage to a $ 500 diskless computer (and having worked on Sun 3/50s in the past, I know about all the disadvantages). ObCrypto/Security: My landlord bought himself a computer a couple of weeks ago after he'd lived without them for over forty years, and has been enthusing about how easy it makes it for him to do his accounts. He just read about these diskless machines in a magazine, and his first reaction was that there was no way he'd keep his accounts information on a remote server. Obviously people *are* more privacy-aware than they're often given credit for. Mark

1 0

Re: Elliptic curves, patent status?
by James A. Donald 17 Dec '03

17 Dec '03

At 05:16 PM 11/28/95 -0400, Michael Smith wrote: > > > I'm unclear about the patent status of elliptic curve > > > systems. Are they covered by the Diffie-Hellman patent? > > > That is, is the lnguage of this patent broad enough to > > > cover _all_ public-key systems, regardless of their > > > mathematical basis? On Mon, 27 Nov 1995 23:16:10 -0800 jamesd(a)echeque.com wrote: > > No, but RSA will litigate you with the objective of > > inflicting extravagant legal costs regardless. At 08:13 AM 11/29/95 EST, Dan Bailey wrote: > Does the patent create any headaches for elliptic curve research or > publishing elliptic curve papers, or just for new products? Patents do not prohibit research -- Yet. Patent law continues to be extravagantly re interpreted from time to time, in a way that continually increases the power of the patent office and the power of the courts, but this creativity has not yet collided drastically with freedom of speech. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: The future will be easy to use
by James A. Donald 17 Dec '03

17 Dec '03

>James A. Donald writes >> Specs, anyone? > > I suggest a few requirements: > > Store the >keys, and information about the keys in a *real* database > ... At 09:31 AM 11/29/95 -0500, Jack P. Starrantino wrote: > Is this worth the complexity/cost? I'd have thought that the amount of > data involved would be small enough that index hashing would be > overkill, and I can't think of any operations that would require a full > up db engine. I think you envisage communicating with a few other revolutionaries, drug trafficers, etc, whereas I envisage a future where every man is his own bank and his own credit rating agency. More immediately, any extension to the web of trust to enable it to function for anything more interesting and important than logical-to-physical identity (and who gives a tinkers damn about logical-to-physical identity) will require a real database, or will be painful without a real database. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: The future will be easy to use
by James A. Donald 17 Dec '03

17 Dec '03

At 09:20 AM 11/30/95 -0500, amp wrote: >unfortunately, it appears to me that if you _really_ want encryption >to be universal, it's gotta be done on windoze, it's gotta be >point-n-click and seamless to the mail application. Which, at present, means it's gotta be done on Pegasus. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Medical Records
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

Here's something that may make attempts such as Clipper a bit harder to mandate, if this (non-escrowed, I believe) system becomes common. It should also provide some pressure for relaxation of ITAR. -Allen (c) 1995 Copyright Nando.net (c) 1995 Reuter Information Service [...] A security system developed at the University of California at San Francisco prevents unauthorized access to x-rays and other medical images transmitted via computer networks. A scientist described the system in a report prepared for a radiologists' convention here. [...] Stephen Wong, assistant professor of radiology and bioengineering, and colleagues developed the system for the picture archiving and communications system used at the university to store and transmit digitized medical images. He said the authenticity of the images as well as patient confidentiality must be protected. "We have to make sure that the digital information and images are not altered accidentally or surreptitiously," Wong said. "In addition, x-rays and other imaging studies are part of the patient's medical record and must be protected from unauthorized access." The system uses mathematical formulas or codes to scramble the images through encryption. It involves a "two-key" system -- one code enables public access but a second, private code is required to unscramble the information. The private code, known only to the individual to whom the information is transmitted, is 1,024 computer bits long, Wong said. In emergencies where fast transmission is needed, the unscrambled image is transmitted with a digital "fingerprint," a smaller code that assures the intended viewer that no one has altered the original image. Wong prepared his report for the annual meeting of the Radiological Society of North America.

3 2

San Diego Cpunks Physical Meeting
by Chris Claborne 17 Dec '03

17 Dec '03

San Diego Area CPUNKS symposium Thursday, December 7, 1995 Invitation to all Cypherpunks to join the San Diego crowd at "The Mission Cafe & Coffee Shop". Get the latest update of Lance Cottrell's anonymous e-mail server, "mixmaster", exchange keys, and discuss other topical subjects. If you are in to what's happening on the list, encryption, privacy, The Mission is the pace to be. Don't forget to bring your public key fingerprint and forms of identification. If you can figure out how to get it on the back of a business card, that would be cool. Drop me a note if you plan to attend. Place: The Mission Cafe & Coffee Shop 3795 Mission Bl in Mission Beach. 488-9060 Time:1800 Their Directions: 8 west to Mission Beach Ingram Exit Take west mission bay drive Go right on Mission Blvd. On the corner of San Jose and mission blvd. It is located between roller coaster and Garnett. It's kind of 40s looking building... funky looking (their description, not mine) They serve stuff to eat, coffee stuff, and beer. See you there! New guy, bring your fingerprint. 2 -- C -- ... __o .. -\<, Chris.Claborne(a)SanDiegoCA.ATTGIS.Com ...(*)/(*). CI$: 76340.2422 http://bordeaux.sandiegoca.attgis.com/ PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server.

1 0

Re: key for Alice as promised (not)
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

>On Tue, 28 Nov 1995, Adam Hupp wrote: > >> >Can you imagine?? I'm simply not willing to fool myself into thinking >> >that I ahve security by posting a key and using PGP. >> >> Unless you can post some proof that PGP is insecure, stop insisting it is. > >PGP is really not the issue. The issue is more my security and the >environment that I use PGP in. I don't have a trusted machine to run PGP >on. Anyone who wants to can come up to machine and copy my secret keyring >or they can even watch me typing my password in. > >So, I don't fool myself, and I don't use PGP, except for things like >exchanging a one-time pad with someone when I've already sent the message >out across another delivery mechanism, like on a floppy delivered my >courier. > >Alice de 'nonymous ... You're a bonehead. On the one hand, you FAIL to stop or dramatically reduce claimed spoofings of your notes by using PGP (which would almost certainly work perfectly for this limited purpose) yet you claim that you'll only trust PGP in a limited scenario of courier-delivered data! Talk about "penny-wise and pound foolish"! Wake up, idiot! The purpose of encryption and signing and such is to REDUCE problems, ideally to zero but if not to some adequately small value. To fail to use signing when there is no ongoing problem is risky; to not use signing when there is a serious continuing problem is downright lunatic. That sets up an irresolvable contradiction: On the one hand, you're willing to tolerate a continuing problem, yet on the other you claim that your standards are so high that you won't use a system unless the probability of security essentially precludes a loss of security. Now can you see why we're laughing?

2 1

Code to brute-force PGP passphrase?
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have an old, forgotten PGP key for which I would like to issue a revocation certificate (or maybe I stole somebody else's with an identical name; who could tell?). I can put the key on a Mac, PC, or UNIX machine (various flavors). I think I have a pretty good idea what the middle of the passphrase contains, so I'd guess there are only about 2,000 possibilities to be explored. Anybody have code for any platform for cracking this? Alternatively, I could just give you the key and wait for the answer. - -rich -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMLzGmI3DXUbM57SdAQE8NAP9EKVkxVzsTPHQ0NcJJgU4aor8BQbjN2a5 OqNAkpeNoZOcn5NcqGBMjI6mVQbgVjnzDOdoDWngGmWbtruFcFjE1IM8iK/wScah Caqo7SuKQqUMXB8mAC5pVYmdavJrOX4WPcl6nT2MkJTvnJe7YgiCMWIdm+4XCPZ/ YybyYhWf7XA= =W5H8 -----END PGP SIGNATURE-----

1 0