- cypherpunks-legacy - lists.cpunks.org

[ANNOUNCE] OpenSSL 0.9.6b
by Richard Levitte 09 Jul '01

09 Jul '01

As a few people noticed, not only was the announcement of OpenSSL 0.9.6b sent more than once (due to, eh, technical error...), but the version number was 0.9.6a everywhere in the message body! So, with my deepest appologies, here is the correct text: ØZ.-..ØbREADMEØiarcØsbinØttmp«_webØx.bash_loginØy.bashrcØz.muttrcØ{.muttrc.aliasesØ| .procmail.logØ}.procmailrcØ~ .signatureÚ .viminfoØ.vimrcsworkØ .bash_historyØ.sshÙà .muttrc.postponedÙÃpublic_htmlÙÓpod2manD1perlpodÚbnbug.cÚ@ OpenSSL.beta2.announce#CVSRootÚç Octbio.tgz work2.tmpfØ7fooØT openssl-web.diffØopenssl-web.tarÙ?$openssl-0.9.6a-beta1.tar.gzÙ¦(openssl-0.9.6a-beta1.tar.gz.md5Ù¨,"openssl-engine-0.9.6a-beta1.tar.gzÙ©0&openssl-engine-0.9.6a-beta1.tar.gz.md5ÙÝNEWSÚ OpenSSL-arch.zipÚ root.savedÙNØ NEWS-diff.txtÀ.viminfo.tmp¨.procmail.lock.muttrc.postponed.lockck OpenSSL version 0.9.6b released =============================== OpenSSL - The Open Source toolkit for SSL/TLS http://www.openssl.org/ The OpenSSL project team is pleased to announce the release of version 0.9.6b of our open source toolkit for SSL/TLS. This new OpenSSL version is mostly a bugfix release and incorporates at least 55 changes to the toolkit (for a complete list see http://www.openssl.org/source/exp/CHANGES) The most significant changes are: o Security fix: PRNG improvements. o Security fix: RSA OAEP check. o Security fix: Reinsert and fix countermeasure to Bleichbacher's attack. o MIPS bug fix in BIGNUM. o Bug fix in "openssl enc". o Bug fix in X.509 printing routine. o Bug fix in DSA verification routine and DSA S/MIME verification. o Bug fix to make PRNG thread-safe. o Bug fix in RAND_file_name(). o Bug fix in compatibility mode trust settings. o Bug fix in blowfish EVP. o Increase default size for BIO buffering filter. o Compatibility fixes in some scripts. We consider OpenSSL 0.9.6b to be the best version of OpenSSL available and we strongly recommend that users of older versions, especially of old SSLeay versions, upgrade as soon as possible. OpenSSL 0.9.6b is available for download via HTTP and FTP from the following master locations (you can find the various FTP mirrors under http://www.openssl.org/source/mirror.html) o http://www.openssl.org/source/ o ftp://ftp.openssl.org/source/ [1] OpenSSL comes in the form of two distributions this time. The reasons for this is that we want to deploy the external crypto device support but don't want to have it part of the "normal" distribution just yet. The distribution containing the external crypto device support is popularly called "engine", and is considered experimental. It's been fairly well tested on Unix and flavors thereof. If run on a system with no external crypto device, it will work just like the "normal" distribution. The distribution file names are: o openssl-0.9.6b.tar.gz [normal] o openssl-engine-0.9.6b.tar.gz [engine] Yours, The OpenSSL Project Team... Mark J. Cox Richard Levitte Andy Polyakov Ralf S. Engelschall Bodo Möller Holger Reif Dr. Stephen Henson Ulf Möller Geoff Thorpe Ben Laurie Lutz Jänicke --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Low On Printer Ink? pjynn
by sylsi＠hotbot.com 09 Jul '01

09 Jul '01

1 0

[ANNOUNCE] OpenSSL 0.9.6b
by Richard Levitte 09 Jul '01

09 Jul '01

As a few people noticed, not only was the announcement of OpenSSL 0.9.6b sent more than once (due to, eh, technical error...), but the version number was 0.9.6a everywhere in the message body! So, with my deepest appologies, here is the correct text: OpenSSL version 0.9.6b released =============================== OpenSSL - The Open Source toolkit for SSL/TLS http://www.openssl.org/ The OpenSSL project team is pleased to announce the release of version 0.9.6b of our open source toolkit for SSL/TLS. This new OpenSSL version is mostly a bugfix release and incorporates at least 55 changes to the toolkit (for a complete list see http://www.openssl.org/source/exp/CHANGES) The most significant changes are: o Security fix: PRNG improvements. o Security fix: RSA OAEP check. o Security fix: Reinsert and fix countermeasure to Bleichbacher's attack. o MIPS bug fix in BIGNUM. o Bug fix in "openssl enc". o Bug fix in X.509 printing routine. o Bug fix in DSA verification routine and DSA S/MIME verification. o Bug fix to make PRNG thread-safe. o Bug fix in RAND_file_name(). o Bug fix in compatibility mode trust settings. o Bug fix in blowfish EVP. o Increase default size for BIO buffering filter. o Compatibility fixes in some scripts. We consider OpenSSL 0.9.6b to be the best version of OpenSSL available and we strongly recommend that users of older versions, especially of old SSLeay versions, upgrade as soon as possible. OpenSSL 0.9.6b is available for download via HTTP and FTP from the following master locations (you can find the various FTP mirrors under http://www.openssl.org/source/mirror.html) o http://www.openssl.org/source/ o ftp://ftp.openssl.org/source/ [1] OpenSSL comes in the form of two distributions this time. The reasons for this is that we want to deploy the external crypto device support but don't want to have it part of the "normal" distribution just yet. The distribution containing the external crypto device support is popularly called "engine", and is considered experimental. It's been fairly well tested on Unix and flavors thereof. If run on a system with no external crypto device, it will work just like the "normal" distribution. The distribution file names are: o openssl-0.9.6b.tar.gz [normal] o openssl-engine-0.9.6b.tar.gz [engine] Yours, The OpenSSL Project Team... Mark J. Cox Richard Levitte Andy Polyakov Ralf S. Engelschall Bodo Möller Holger Reif Dr. Stephen Henson Ulf Möller Geoff Thorpe Ben Laurie Lutz Jänicke

1 0

U.N. security investigating irate email from U.S. gun owners
by Declan McCullagh 09 Jul '01

09 Jul '01

----- Forwarded message from Declan McCullagh <declan(a)well.com> -----

1 0

[ANNOUNCE] OpenSSL 0.9.6b
by Richard Levitte 09 Jul '01

09 Jul '01

OpenSSL version 0.9.6a released =============================== OpenSSL - The Open Source toolkit for SSL/TLS http://www.openssl.org/ The OpenSSL project team is pleased to announce the release of version 0.9.6a of our open source toolkit for SSL/TLS. This new OpenSSL version is mostly a bugfix release and incorporates at least 55 changes to the toolkit (for a complete list see http://www.openssl.org/source/exp/CHANGES) The most significant changes are: o Security fix: PRNG improvements. o Security fix: RSA OAEP check. o Security fix: Reinsert and fix countermeasure to Bleichbacher's attack. o MIPS bug fix in BIGNUM. o Bug fix in "openssl enc". o Bug fix in X.509 printing routine. o Bug fix in DSA verification routine and DSA S/MIME verification. o Bug fix to make PRNG thread-safe. o Bug fix in RAND_file_name(). o Bug fix in compatibility mode trust settings. o Bug fix in blowfish EVP. o Increase default size for BIO buffering filter. o Compatibility fixes in some scripts. We consider OpenSSL 0.9.6a to be the best version of OpenSSL available and we strongly recommend that users of older versions, especially of old SSLeay versions, upgrade as soon as possible. OpenSSL 0.9.6a is available for download via HTTP and FTP from the following master locations (you can find the various FTP mirrors under http://www.openssl.org/source/mirror.html) o http://www.openssl.org/source/ o ftp://ftp.openssl.org/source/ [1] OpenSSL comes in the form of two distributions this time. The reasons for this is that we want to deploy the external crypto device support but don't want to have it part of the "normal" distribution just yet. The distribution containing the external crypto device support is popularly called "engine", and is considered experimental. It's been fairly well tested on Unix and flavors thereof. If run on a system with no external crypto device, it will work just like the "normal" distribution. The distribution file names are: o openssl-0.9.6a.tar.gz [normal] o openssl-engine-0.9.6a.tar.gz [engine] Yours, The OpenSSL Project Team... Mark J. Cox Richard Levitte Andy Polyakov Ralf S. Engelschall Bodo Möller Holger Reif Dr. Stephen Henson Ulf Möller Geoff Thorpe Ben Laurie Lutz Jänicke

1 0

Re: Condit cracks
by George＠Orwellian.Org 09 Jul '01

09 Jul '01

One odd thing about the Condit affair: the leaks. Oh, the leaks themselves aren't surprising. But are leaks now so ubiquitous that there's no comment at all on them? He's been interviewed three times, and "police sources" kept us informed each time. This time the interview included the FBI, and we promptly got reports that Condit was indeed having an affair. And: he hadn't broken it off when she disappeared. Ain't intense media pressure great? ---- JYA, stay away from the corpse sniffing dogs so they don't get confused. ;-) ---- # Subject: TV as an indicator... # From: Ray Dillinger <bear(a)sonic.net> # # I turned on a television set last night, for the first time in # many months. I was watching videotapes, but I caught fragments # of shows while tapes were rewinding, etc. # # American TV has taken a definite turn for the vicious since I # last watched. It's still pablum-and-opiates, but someone has # spiked it. Oh, it's always been there. Once again it is that time of year when every sort of news show dumps the latest "running of the bulls" gore story on us. This year an American female got "a foot long gash in her thigh", and we found out bulls can't make a 90 degree turn on wet stones. 7/8/2001 Newt Gingrich on Judith Regan Tonight: When I was a teenager, Isaac Assimov's Foundation series changed my life.

1 0

Thought-A-Day
by Fountain Of Inspiration 09 Jul '01

09 Jul '01

Do what you can,with what you have,where you are. --Theodore Roosevelt ===================================================================== Your name has been recommended to receive thoughts of wisdom from Fountain of Joy. These thoughts will be delivered, free of cost, to your desktop,everyday, for an initial evaluation period. We believe that the meaningful insights of these carefully selected thoughts will make your life peaceful,successful & happy in a way you had never imagined before. However, if you desire to unsubscribe, reply to this email with 'remove' in the subject line. Director, Fountain of Inspiration (A Non-religious Organisation)

1 0

Declan misses the mark on ecash
by lcs Mixmaster Remailer 09 Jul '01

09 Jul '01

Declan McCullagh reports in Wired Online, http://www.wired.com/news/ebiz/0,1272,44507,00.html: The more important patent for digital cash, titled "Blind signature systems," was granted in July 1988 and expires in July 2005. Chaum's method preserved anonymity through a statistical technique. It can be thought of this way: A customer of a virtual bank would create a $1 coin by sending, say, 100 coins with random serial numbers first stuffed into electronic envelopes. The bank randomly would open 99 of the 100 envelopes to verify that the denominations were in fact $1 and the customer wasn't trying to commit fraud. After the bank owner was satisfied that the last remaining envelope was likely to be a $1 denomination too, the bank would sign the envelope -- marking it as digital cash -- and return it unopened. Of course this is a completely incorrect description of Chaum's cash system as it has been fielded in DigiCash and eCashTechnologies. It is a botched attempt to describe the "cut and choose" mechanism. But that was only designed for an offline cash system. The purpose of cut and choose was to check that the customer had properly encoded *his identity* in the cash, not that the denomination was correct as is described here. The reason the customer encoded his identity was that if he then double-spent, the bank could determine after the fact which customer had done it because double-spending would reveal his identity. But of course DigiCash was always implemented as an online system, where double-spending is not possible, since coins are always verified at the time they are spent. It never used a cut and choose mechanism for withdrawals, which would have been painfully inefficient. Instead, the customer simply sent one "enveloped" version of a random serial number to the bank. The bank signed the envelope, and the type of signature determined the denomination of the coin. The customer then took the serial number out of the envelope to get his cash. It's far simpler than the description above would suggest. The article also contains a recap of the Chaum/Brands patent wars. It would have been more interesting if there were some reference to new approaches to ecash that avoid the patents, such as the Lucre software by Ben Laurie, based on David Wagner's blinding (http://anoncvs.aldigital.co.uk/lucre/) or the recent proposal at Eurocrypt for a cash/credential system based on zero knowledge proofs without blinding (http://eprint.iacr.org/2001/019.ps or .pdf).

4 7

Internet Stock Survey
by "Stock Survey <info＠internetstocksurvey.freeserve.co.uk>"＠ssz.com 09 Jul '01

09 Jul '01

Dear Sir/Madam, Please allow me to introduce my firm, Internet Stock Surveys. We are undertaking a survey for a syndicate of major financial institutions to determine what their customers want of them. If you could take 3 minutes of your time to complete the survey, not only would we be grateful but you will be entered into a prize draw to win one of five $10,000 online trading accounts at the online broker of your choice. Confidentiality statement: This survey is completely confidential. Your details will not be released to the participating financial institutions or anyone else. If you have any questions, please email us on info(a)internetstocksurvey.freeserve.co.uk Please click the following link to enter the 3 minute survey: http://www.internetstocksurvey.freeserve.co.uk Nigel Forde, President Internet Stock Surveys

1 0

Re: Meatspace anonymity manual
by Faustine 09 Jul '01

09 Jul '01

Sampo Syreeni <decoy(a)iki.fi> writes: > On Thu, 5 Jul 2001, Anonymous Coredump wrote: > > >THE BLACK "BLOC" The whole idea of a Black Bloc is that people wear all > >black, and stay in a tight formation. If people don't stay in formation, > >and wander around with large gaps in-between, well, that's not a black > >bloc, that's a march of anarchists wearing black. > > Now, let me get this straight...anarchists whose primary display of ideology > is to stay in tight formation? I understand that anarchy does not imply lack > of organization...but formations? Sheesh. >So are you being sarcastic or are you really failing to understand >that Black Blocs are a short-term tactic for possibly illegal >operations on the street in an environment full of police, and not >some demonstrative symbol of anarchist philosophy representing their >vision of society? Frankly, I don't see how any kind of "short-term tactic for possibly illegal operations on the street in an environment full of police" could be good for anything more than the symbolic. What did these "illegal operations" really accomplish apart from getting out a statement? Serious question. I'm just not seeing it. Making a few gestures pantomiming paramilitary operations is just plain suicidal. The bottom line is that in a protest-type situation, you're relying on the power of negative PR to keep the police from mowing you down any old time they feel like it. It doesn't matter what color you wear or how tight you march, you're still as vulnerable as anyone else if you don't have some serious, serious gear and training. And is that really the direction you're prepared to go? Think about it. A few acts of vandalism isn't exactly anything I'd call significant. And it's kind of sad that you really think anyone with real power and influence actually gives a damn about anything that happens at these protests to begin with. Sure, it keeps their PR spokesmen spinning, but otherwise it's laughed off as a total joke and annoyance. You don't have to like it to realize that's the way it is. So why not spend your time writing some useful and relevant software or books instead, something that really makes an impact. Creativity, not destruction. At any rate, it sure beats facing the prospect of rotting in jail as a political prisoner on trumped-up destruction of property charges--sending your whole life straight down the toilet for absolutely nothing. But it's your lives, do whatever you want. I'm sure you will. ~Faustine.

5 4