- cypherpunks-legacy - lists.cpunks.org

Re: no ftpd on soda.berkeley.edu ?
by collins＠newton.apple.com 29 Aug '93

29 Aug '93

>Has anyone else tried to ftp soda in the past 2 days or so? I've been >unable to establish a connection. Ditto.

1 0

Whit Diffie on Sept 27th Sunergy Satellite TV Broadcast
by gnu 29 Aug '93

29 Aug '93

---------------------------------------------------------------------------- The Florida SunFlash Sept 27th Sunergy Satellite Broadcast SunFLASH Vol 56 #26 August 1993 ---------------------------------------------------------------------------- 56.26 Sept 27th Sunergy Satellite Broadcast 7th Sunergy Broadcast will be on September 28, 1993 from 9:00 - 10:45 am PDT. Title: "Cyberjockying in the 21st Century". How will supernetworks and the Internet affect you ? ---------------------------------------------------------------------------- If you have satellite receive capabilities and wish to downlink this program please send email to david.howard(a)Sun.COM. We will add your name to our alias and send the appropriate satellite and transponder information when it becomes available. Sunergy #7 September 28, 1993 9:00 - 10:45 am PDT Cyberjockying in the 21st Century How will supernetworks transport you to the far reaches of the data galaxy? What is the current status of the internet and other "information highways"? What can these "highways" do for you today? This next Sunergy live broadcast will focus on the issues and technologies surrounding the worldwide movement of information. It will take a look at the internet, information suppliers, information retrievers and the other related resources. Discussions will also include regulation and security on the internet. Some current technologies will be demonstrated. Guests include: John Gage - Director of the Science Office, SMCC Whitfield Diffie - Distinguished Engineer, Security - SMCC Carl Malamud - President, Internet Multicasting Service Brewster Kahle - President, WAIS Inc If you wish to downlink this broadcast, please send email to david.howard(a)Sun.COM or phone the Sunergy office at +1 415/336-5847 Program is available on satellites over Europe (west, central and east), Canada, Latin America and the US. +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Biographies: John Gage Director, Science Office Sun Microsystems Computer Corporation John Gage works for Bill Joy, the Chief Technical Officer of Sun, and is responsible for Sun's relationships with the world scientific and public policy communities, international scientific institutions and groups developing new forms of scientific research involving computing. He is on scientific and advisory panels of the United States National Science Foundation, the US Congress Office of Technology Assessment, the European institute of Technology and the United States National Academy of Sciences. He has recently been appointed to the US National Research Council Mathematical Sciences Education Board. He is a member of ACM, IEEE, SIAM, AMS, AAAS, and SMPTE. He attended the Harvard Business School and the Harvard Graduate School of Public Policy. He did doctoral work in economics and mathematics at the university of Berkeley at the same time as Bill Joy. Gage subsequently left Berkeley with Joy to start Sun in 1982. Gage is on the Board of Directors of Unicode, an industry consortium of IBM, Microsoft, Apple, Novell, Sun, GO Corporation, and others to provide multilingual capability in all world scripts for all documents and applications. +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Carl Malamud President Internet Multicasting Service Carl Malamud is the author of seven professional reference books including STACKS (Prentice Hall), Analyzing Sun Networks (Van Nostrand Reinhold), and Exploring the Internet: A Technical Travelogue (Prentice Hall). Currently, Carl is producing the Internet Town Hall and Internet Talk Radio series for the Internet Multicasting Service and conducts research on integration of telephone systems into the Internet. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Whitfield Diffie Distinguished Engineer Sun Microsystems Whitfield Diffie is best known for his 1975 discovery of the concept of public key cryptography, for which he was recently awarded a Doctorate in Technical Sciences (Honoris Causa) by the Swiss Federal Institute of Technology. For a dozen years prior to assuming his present position in 1991, Diffie was Manager of Secure Systems Research for Northern Telecom, functioning as the center of expertise in advanced security technologies throughout the corporation. Among his achievements in this position was the design of the key management architecture for NT's recently released PDSO security system for X.25 packet networks. Diffie received a Bachelor of Science degree in mathematics from the Massachusetts Institute of Technology in 1965. Prior to becoming interested in cryptography, he worked on the development of the Mathlab symbolic manipulation system --- sponsored jointly at Mitre and the MIT Artificial Intelligence Laboratory --- and later on proof of correctness of computer programs at Stanford University. He is the recipient of the IEEE Information Theory Society Best Paper Award for 1979 and the IEEE Donald E. Fink award for 1981. +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Brewster Kahle President Wide Area Information Servers, Inc. Inventor and architect of the WAIS electronic publishing system, Brewster Kahle has lead the multi-company effort to build a practical system for end-users to find and retrieve information from servers worldwide. Before this work, he helped design and build parallel supercomputers at Thinking Machines Corporation. Brewster was schooled at MIT in Computer Science and Artificial Intelligence. ********************************************************************** For information about SunFlash send mail to info-sunflash(a)Sun.COM. Subscription requests should be sent to sunflash-request(a)Sun.COM. Archives are on draco.nova.edu, ftp.uu.net, sunsite.unc.edu, src.doc.ic.ac.uk and ftp.adelaide.edu.au All prices, availability, and other statements relating to Sun or third party products are valid in the U.S. only. Please contact your local Sales Representative for details of pricing and product availability in your region. Descriptions of, or references to products or publications within SunFlash does not imply an endorsement of that product or publication by Sun Microsystems. Send brief articles (e.g. third party announcements) and include contact information (non-800#, fax #, email, etc) to: John McLaughlin, SunFlash editor, flash(a)Sun.COM. +1 305 351 4909

1 0

Mailer hooks for PGP
by snark!esr＠gvls1.VFL.Paramax.COM 29 Aug '93

29 Aug '93

I've now uploaded and made PGP. It looks mondo cool, but also kind of a pain to use because the existing interface requires one to perform encryption and decryption manually. I'm considering writing patches for Elm 2.4 that would allow it to (a) check your public ring and automatically sign/encode outgoing mail to eligible users, and (b) automatically decode incoming mail. Elm is a very popular mailer. If I could get these patches into the distribution, the hassle barrier to widespread use of PGP would drop significantly. And the prospects for that are good; I'm friendly with the Elm development group moderator. Also, there's precedent for Elm to delegate message decoding --- it has MIME hooks that shell out to metamail. (That brings up another point. Has anyone worked on getting armored PGP registered as an official MIME encoding type? Getting pgp support into metamail would be a massive win --- probably better than hooks in Elm itself. If no one else is working this angle, I'd be willing to get in touch with Nathaniel Borenstein and use whatever zorch I have with him to make it happen.) Now, before I begin hacking. Has anything like this been done before? Are there any known design problems or pitfalls in integration with a mailer such as Elm? And, finally, if prz is listening, would you be willing to accept minor hacks for this purpose such as the addition of a new pgp interface mode tailored for use from mailers? -- >>eric>>

7 6

Re: Free Electronic Cash
by Duncan Frissell 29 Aug '93

29 Aug '93

To: cypherpunks(a)toad.com T >> Michael Elansky Defense Fund T >> 25 Maiden Lane T >> West Hartford, CT 06117 T > T >I just sent $10 cash to them. Better them than the corrupt EFF which T >has been accepting kickbacks/bribes from AT&T and Pac Bell. Speaking T >of which, has anyone bothered to contact the EFF/CPSR/ACLU about this T >case? It seems like a perfect 1st Ammendment issue, and I would T >personally love to see the pigs who raided Mr. Elansky lose their jobs T > because of these outrageous civil rights violations. They have been in contact with the EFF and received some moral support but they mostly have to depend on their own resources. I did determine that the BBS was not siezed, BTW. It was missing when the Geheime Staats Polizei arrived. Duncan Frissell (Net Prime - 01000001st Fiberborne) "A Machine Age army can no more defeat an Information Age army than a Muscle Age army can defeat a Machine Age army." Join in the fun as Slick Willie and the other spearcarriers of the New World Order charge the machine guns of the Info Army. Cyberspace Wants You. Join the 01000001st Fiberborne - recruiting depot open at this address. Phase One guerilla operations have already begun... --- ~ WinQwk 2.0b#0 ~ Unregistered Evaluation Copy

1 0

Free Electronic Cash
by Duncan Frissell 29 Aug '93

29 Aug '93

To: cypherpunks(a)toad.com Be the first on your block to spend some electronic "near" cash. If you are the first to read this post, you may be able to use up to $5 of electronic pseudo-cash. I wanted to be the first to post some so it was worth $5 to me. Yesterday I bought a Western Union Phone Card (tm) from my nearest Western Union money transfer agent. It is good for about 8 minutes of phone calls anywhere in the continental US (fewer minutes of international calls). To use the "cash:" Call 1 (800) 374-8686 Wait for the tone Dial the code 428 22 601 When you get a dial tone, dial the (area code) + phone-number of the number you wish to reach. The system will tell you how many minutes you have available for the call. Western Union Phone Cards (tm) are available from any agent in $5, $10, $20, and $50 denominations. They can be (must be) purchased for cash. I have no idea whether Western Union saves the ANI info of incoming calls and cross indexes it with the outgoing number and the "account" number. All that I ask is that the user(s) of this card send me email (anonymously if you like) so I can send back privacy consulting solicitations. Duncan Frissell Michael Elansky Defense Fund 25 Maiden Lane West Hartford, CT 06117 --- ~ WinQwk 2.0b#0 ~ Unregistered Evaluation Copy

3 2

Re: AT&T Home Security Plus
by doug＠netcom.com 29 Aug '93

29 Aug '93

"George A. Gleason" <gg(a)well.sf.ca.us> said: >Cross-list directories: having served as a key witness against a very deadly >local stalker here, I have taken great pains to let PacBell know that my >service address is not to be released in any form for any reason; I've gone >over this with service reps every single year at directory-compiling season. Yes, unfortunately there are institutions that are obnoxious about this. Here's an innocent anecdote that shows how bad things can be. Last year I got to know a woman via her nome de plume on a mud. She was highly privacy-conscious, to the point where she told no one there anything about her real life (this is common on many muds, but not on that particular one). We'd had a bunch of heart-to-heart's, and since I'm a smart ass, at one point I called her up. Since she hadn't told me her real name nor what city she was in, let alone given me her phone number, she naturally wanted to know how I'd managed this. (I underscore that this was innocent; we talked for 6 hours that time and she recently visited me while passing through the area where I live, which is to say that she wasn't bent out of shape by my doing the above.) Anyway the scary part is that her university lists both *residence* phone and address for all students in their phone directory services. She said that she had tried to get unlisted but that university policy *forbade* that, so she was stuck with being listed. (Yes, this is a U.S. university.) That's the sort of policy that ought to be prevented by law. Even non-deadly stalkers can be a serious nuisance. Doug

1 0

Re: Examination of ViaCrypt's PGP by members of this group
by smb＠research.att.com 29 Aug '93

29 Aug '93

A group of even the most competent reviewers can overlook some problems in the code. It may take a long time before a flaw is discovered. The stamp of approval by some members of this list to a commercial PGP with a secret source code would therefore be little more than a marketing scheme. It would be no different from the expert review marketing scheme used to sell us Clipper, as --I think it was John Gillmore-- has recently explained. No, there is an important difference: you'd be starting from known- good source. That might make the task feasible. That doesn't mean it's easy, of course. A fair number of years ago, I participated in a review of some code which had been developed, in part, by someone who was later convicted of assorted {h,cr,chr}acking- related offenses. There was far too much source code to check it all; however, we knew when this person had first had access, so we could use diff on many modules. That tremendously reduced the scope of the effort. We did find one curious construct -- a combination of two bugs that together constituted a security hole. Either alone was harmless. And to this day, I don't know if they were inserted deliberately.

2 1

Examination of ViaCrypt's PGP by members of this group
by mbriceno＠aol.com 29 Aug '93

29 Aug '93

A number of posts have proposed that perhaps some of the more astute members of this list should be allowed by ViaCryp to examine the source of the commercial PGP. The idea is that if some of the people we are likely to trust give their O.K. to the code then we can all go out and buy the program without fear of hidden back doors. Unfortunately this proposal has the same fundamental flaws that the recent review of the Clipper chip by Denning et al had. A group of even the most competent reviewers can overlook some problems in the code. It may take a long time before a flaw is discovered. The stamp of approval by some members of this list to a commercial PGP with a secret source code would therefore be little more than a marketing scheme. It would be no different from the expert review marketing scheme used to sell us Clipper, as --I think it was John Gillmore-- has recently explained. ---Marc

1 0

Re: AT&T Home Security Plus
by George A. Gleason 29 Aug '93

29 Aug '93

Re Doug's response to my item on this topic: please don't get the idea that I thought AT&T were going after *me* for any reason, or trying to trap hackers deliberately, or anything like that. I may be dumb but I'm not one of those raving paranoids who assumes that everything that happens means someone is out to get me....! Nor did I mean to suggest that AT&T would actually have a backdoor in their home security systems. I was using that point as a cynical joke with the dude who called me. It was *not* intended to be serious. It *was* intended to make a sarcastic poke at Clipper. Cross-list directories: having served as a key witness against a very deadly local stalker here, I have taken great pains to let PacBell know that my service address is not to be released in any form for any reason; I've gone over this with service reps every single year at directory-compiling season. What I would really like to do is force the issue legally, i.e. serve them with some kind of court order or something, which would bar them from releasing that information. Anyway, enough for now... -gg

1 0

Re: Total RSA in PGP
by collins＠newton.apple.com 29 Aug '93

29 Aug '93

>Am I mistaken in believing RSA is more secure than the present hybrid? .....SHORT ANSWER..... You are mistaken. .....MEDIUM ANSWER..... You are mistaken not because the statement 'RSA is more secure than the present hybrid' is false, but because it is a mistake to put your belief in this statement, which has not been proved true. RSA alone would represent a great increase in computational effort, without risk of a decrease in security, after which you couldn't prove you were any better off (though, in practice, against currently known attacks, and with a large key, you might be). .....LONG ANSWER..... RSA alone is no _less_ secure than the PGP's combination of RSA and IDEA: if you can break RSA, you can extract the IDEA key and decipher the message; if you can break IDEA, you don't need the key. I am guessing that you share a widely echoed predjudice that public-key ciphers are better than secret-key ciphers (I apologize if I have mis-labeled you :). Public-key ciphers have gained a reputation for being more secure, as a class, than secret-key ciphers. Perhaps because public-key ciphers afford 'better' key management, the world at large has gotten the impression that they provide 'better' security. Public-key ciphers as a class are _not_ more secure than secret-key ciphers. One counter example, which periodically rears its ugly head here, is the (truly random) one-time-pad. This secret-key cipher offers perfect security in the Shannon sense. No public-key cipher can make that claim. To prove RSA _more_ secure than the hybrid, RSA must be proved more secure than IDEA. Unfortunately, we don't really know how secure the RSA algorithm is (or IDEA, for that matter). It is known that RSA is no _more_ secure than factoring a component of the public key (readily available to an attacker). To my knowledge, it has not been proved that either a) RSA is at least this secure; or b) factoring is hard. Despite a paucity of formal proof, I know of know better attack on a message enciphered with well chosen keys than factoring, which both man and machine currently find taxing. RSA with well chosen keys is 'empirically' computationally secure. While IDEA has been designed specifically to resist differential cryptanalysis (thanks to those who pointed me to the IDEA papers explaining this), more formal proof of its security awaits further understanding of the information theory aspects of its foundation: mixing operations from incompatible groups. In the end, IDEA is also 'empirically' computationally secure. I know of no comparisons of the security offered by RSA and IDEA against practical attacks. .....FINAL ANSWER..... In theory: theory is as good as practice; but in practice... it isn't. Hope this helps, Scott Collins | "Few people realize what tremendous power there | is in one of these things." -- Willy Wonka ......................|................................................ BUSINESS. voice:408.862.0540 fax:974.6094 collins(a)newton.apple.com Apple Computer, Inc. 1 Infinite Loop, MS 301-2C Cupertino, CA 95014 ....................................................................... PERSONAL. voice/fax:408.257.1746 1024/669687 catalyst(a)netcom.com

1 0