- cypherpunks-legacy - lists.cpunks.org

Attacks on remailers
by hfinney＠shell.portal.com 27 Aug '93

27 Aug '93

From: b44729(a)achilles.ctd.anl.gov (Samuel Pigg) > On the user side, I think a good tool to augment this would be a > mailer program which kept a list of the functioning remailers with > keys, and randomly selected a route through them using a random > (reasonable) number of hops, and performing the necessary nested > encryptions. Then it could start the remailer hopping process via > special socket connection to the first remailer in the chain. This seems like a good idea. Note that on the ftp site there are scripts and a program which will set up a chained remailing if you are willing to type in the names or numbers of the remailers to use. Extending these to use a random route or set of hops would not be a major job. > Perhaps a protocol could be worked out for the mailer program to > request from any one of the remailers a current list of the > functioning remailers? (in an effort to transparentize the process > some more, as manually maintaining a list of current remailers would > be tedious.) More and more I think this would be a good idea. People are always complaining about temporary "down time" among the remailers. Perhaps someone could run a service which would run every night, ping all the remailers, and keep a file with a list of those remailers which have responded in the last 24 hours. This file could be made available by finger, ftp, or some other method. Perhaps someone could volunteer to write such a beast? This is another project that seems doable in a moderate amount of time. Putting these two together, as Sam suggests, would produce a more robust and convenient way of using the remailers. Nice ideas, Sam. Hal Finney hfinney(a)shell.portal.com

1 0

Re: .Comparing ViaCrypt and freeware.
by bill＠twwells.com 27 Aug '93

27 Aug '93

If you're worried about backdoors, reverse engineer it and verify that it works as advertised. Given that the program has to largely duplicate an existing set of source, this should be trivial.

1 0

Apology
by cjl＠micro.med.cornell.edu 27 Aug '93

27 Aug '93

Sorry for the last post. It was sent to the board in error. cjl

1 0

viacrypt and freeware
by cjl＠micro.med.cornell.edu 27 Aug '93

27 Aug '93

>> As for why bother when the freeware is available, plausible deniability was >> mentioned and I think that is probably the most convincing argument. The >> Jackson Games seizure, and other computer confiscations by law enforcement >Note that the seizure had *nothing* to do with copyright or other IP >infringement; no incriminating material was ever found, and we were >completely cleared. Also, the name of the company is "Steve Jackson Games" >That aside, I agree with your basic analysis. It was not my intent to speak to the *specifics* of the Steve Jackson Games case, although your point is well taken. My reference was more to the point that as a reasonably well publicized event, particularly among the computer cognescenti, that people (i.e. sysops and owners) have every reason to fear completely outrageous and unconstitutional behavior from government agencies. The law enforcement agencies are well aware of the value of making a high profile example of how much they are able to get away with and be completely free from any redress of grievances. cjl

1 0

Cisco routers backdoor
by L. Detweiler 27 Aug '93

27 Aug '93

===cut=here=== Date: Wed, 25 Aug 1993 12:56:54 -0700 (PDT) From: Al Whaley <Al.Whaley(a)sunnyside.com> Subject: Cisco routers Rumors abound that Cisco routers have a back door; that is when a TCP port is disabled, it can still be accessed from Cisco's IP number. I have personally verified this with the sendmail port. Al Whaley al(a)sunnyside.com +1-415 322-5411(Tel), -6481 (Fax) Sunnyside Computing, Inc., PO Box 60, Palo Alto, CA 94302 [Private trapdoors for developers and maintenance folks are remarkably common, and in many other cases represent more serious risks than this one. WarGames was not pulling your leg. PGN] ------- End of Forwarded Message

1 0

Crypto Consulting / Employment Opportunities at Microsoft
by gnu 27 Aug '93

27 Aug '93

Posted at CRYPTO '93 in Santa Barbara this week were these two job offers, FYI: CRYPTOGRAPHER -- Advanced Technology and Business Development, Advanced Consumer Technology Group, reporting to Group Manager, Research Group Primary responsibilities include the research, analysis, verification, and recommendation of cryptographic methods; designing and proving new methods; and working with a development team to implement such methods. Candidate should be familiar with authentication techniques, blind signatures, digital signature and time-stamping techniques, public key encryption systems, hashing methods, and encryption standards. Familiarity with RSA, LUC, DES, minimum knowledge systems, and Digital Cash/Smart Card technology a plus. A MS/Phd degree in Mathematics, with a focus on cryptography, desired. Do you need a research challenge which results in tangable (sic) product? Then Microsoft is the place for you! Microsoft looking (sic) to challenge the brightest mathematical minds with the latest advances in cryptography. The ideal candidate will be responsible for the reserach, analysis, verification, and recommendation of cryptographic standards as well as the design of new standards. Candidate should be familiar with ... [repeats itself here] COMPUTER SECURITY EXPERT -- Advanced Technology and Business Development, Advanced Consumer Technology Group, reporting to Group Manager. Primary responsibilities include the reserach, analysis, verification, and recommendation of computer and communication security techniques; designing new methods; and working with a development team to implement such methods. Some programming responsibilities also will be assumed. Qualifications should include a minimum of 5 years experience with secure transaction systems, data security, authentication techniques, basic encryption technology, and knowledge of security standards. Famililarity with electronics funds transfer systems (SWIFT, ...), Smart Card technology, C/C++ language, and RSA encryption a plus. A BS/MS/Phd degree in Computer Science or related field preferred. Contact: Lester Waters, +1 206 936 4288, lesterw(a)microsoft.com Gideon Yuval, gideony(a)microsoft.com

1 0

Re: Commercial PGP: Verifying Trustworthiness
by norm＠netcom.com 27 Aug '93

27 Aug '93

cdodhner(a)indirect.com (Christian D. Odhner) says: > I could very well be wrong about this one, but since pgp uses a random > idea session key each time you encrypt, wouldn't that in fact ensure that > no two encryptions of the same file with the same public key are ever the > same? Why then would random stuff be needed? I knew that! I forgot that! Thanks for reminding me. Back to the drawing board! A protocol where the user controlled the session key would be more awkward but would solve that problem. On the otherhand that isn't the PGP protocol.

1 0

Re: Commercial PGP: Verifying Trustworthiness
by norm＠netcom.com 27 Aug '93

27 Aug '93

Forwarding for cdodhner(a)indirect.com (Christian D. Odhner) > > peter honeyman <honey(a)citi.umich.edu> says: > > pgp and viacrypt will always generate differnt outputs: pgp > > adds some pseudo-random stuff to the start of the file it is > > encrypting to ensure that a file encrypts differently each time. > This means that I am trusting the "pseudo-random" stuff not to be > some secrets that PGP has read from my disk. The only benefit > that I see to the pseudo-random stuff is to send the same message > to several people without revealing the fact that the messages are > the same except to those that can decode the messages. > I could very well be wrong about this one, but since pgp uses a random idea session key each time you encrypt, wouldn't that in fact ensure that no two encryptions of the same file with the same public key are ever the same? Why then would random stuff be needed? Happy Hunting, -Chris <cdodhner(a)indirect.com> PGP public key available upon request.

1 0

.Comparing ViaCrypt and freeware.
by cjl＠micro.med.cornell.edu 27 Aug '93

27 Aug '93

{Refering to my earlier post about the possibility of black-boxing the commercial ViaCrypt and comparing it to freeware PGP} I've been most gratified by the response (private and posted) to my question. Thanks for the enlightenment. The first few responses were diametrically opposite in their conclusions, but after that what I have taken away as the message is that the session key is generated on-the-fly and would be different every time, although I guess I still don't understand enough to figure out why no matter what the program uses as randomness input some really bright boy capable of working real down close to the silicon couldn't fake up some sort of a test bed to spoon-feed the "randomness" to the program. It's not like this thing runs on quantum randomness. Is it? As for why bother when the freeware is available, plausible deniability was mentioned and I think that is probably the most convincing argument. The Jackson Games seizure, and other computer confiscations by law enforcement are enough to keep any company from allowing a copy of PGP on the premises, it also has a fairly chilling effect on those less brave souls who don't have the power of their convictions and are willing to trust the government not to snoop on their E-mail or phone conversations. The right to privacy can be eroded away because most people don't care to learn how the box on the desk works, let alone worry about exercising their civil liberties. Hell, most people don't even bother to vote. I found out about PGP from the WIRED article on the cypherpunks, and I have been doing as someone else suggested, turning other people on to privacy. I have converted several friends already and they in turn are spreading the encrypted word. eep-Kay o-nay rypting-'Cay, cjl

1 0

Re: Coming Soon: Commercial version of PGP!
by mbriceno＠aol.com 27 Aug '93

27 Aug '93

gg(a)well.sf.ca.us writes: > How soon before a Mac compatible version is available? Or will the > current version run under Soft PC on the Mac, which is essentially a > PC-emulator...? If yes to either, sign me up...! Have you tried the freeware version of MacPGP yet? It is very easy to use. The next release (now in beta) will even support AppleEvents. I think it will be quite a while before you can buy something similar. [And why would you want to pay if you can get for free?] --Marc

1 0