- cypherpunks-legacy - lists.cpunks.org

re: query...
by eichin＠cygnus.com 10 Jun '93

10 Jun '93

A query -- I understand that the MIT Athena people implemented a DES encrypted telnet/telnetd for use with Kerberos. Anyone out there know where its sources live and how I could hack it to take a user specified DES key? Perry The first one was done by Paul Borman at Cray. A snapshot was up for FTP on uunet (named telnet.91.03.25.tar.Z) though I don't know what was done with it; the authentication and encryption options draft standard that it conformed to has been modified since then, although all of the implementations (such as the utexas version for the Mac) I've seen so far conform to Borman's version. It shouldn't be too hard to specify a key (of course you have the problem of securely getting the key to the other end of the connection -- that is, after all, one of the major side-benefits of Kerberos...) The last release of Kerberos from MIT included a "kstream" library, written by Ken Raeburn, which could be dropped in to an existing telnet or kermit or other application to provide this kind of feature. There is also Derek Atkins' S.B. Thesis project, which included modifications to telnet for accessing Kerberos via the remote host, without having IP access on the client to the KDC (such as on a dialup or with a firewall or something.) I'm sure he'll announce something here about how to get the sources, if they're in a releasable yet. _Mark_ <eichin(a)athena.mit.edu> MIT Student Information Processing Board Cygnus Support <eichin(a)cygnus.com> Cygnus Network Security

1 0

TIS/PEM FAQ as of 8 June 1993
by gnu 10 Jun '93

10 Jun '93

------- Forwarded Message From: James M Galvin <tispem-support(a)TIS.COM> To: ietf-announce(a)cnri.reston.va.us, psrg-interest(a)isi.edu, pem-dev(a)TIS.COM, rsaref-users(a)rsa.com, saag(a)TIS.COM, tispem-users(a)TIS.COM Subject: TIS/PEM FAQ as of 8 June 1993 Date: Tue, 08 Jun 93 16:21:10 -0400 - -----BEGIN PRIVACY-ENHANCED MESSAGE----- Proc-Type: 4,MIC-CLEAR Content-Domain: RFC822 Originator-ID-Asymmetric: MFMxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJNRDE kMCIGA1UEChMbVHJ1c3RlZCBJbmZvcm1hdGlvbiBTeXN0ZW1zMREwDwYDVQQLEwh HbGVud29vZA==,02 MIC-Info: RSA-MD5,RSA,BpCu5i/vNJFNX64bj4KuRr8Jm05gdfjIIO5WQaSTXAG kx09ivq97GtmdksgshOkdqynlLxTSph0s6DtNN5girn2Q/u08q44XLYbk6vYxA9g 37w/L1leqw7CldPLPOtQT Many of you will recall the announcement of the availability of TIS/PEM, the Internet reference implementation of PEM, distributed last week. Included below is the first TIS/PEM FAQ. We are posting it this one time to the same mailing lists that received the announcement last week. In the future, it will be posted to the <tispem-users(a)tis.com> mailing list and several appropriate newsgroups. We hope you find this useful. Thanks. TIS/PEM FAQ Last updated 8 June 1993 Send questions and comments to tispem-support(a)tis.com Questions answered: 1) What is Privacy Enhanced Mail (PEM)? 2) Where are the PEM standards defined? 3) Is there a forum for PEM developers and others interested in the PEM standards? 4) Are there implementations of PEM available? 5) How do I get TIS/PEM? 6) Why is TIS/PEM only available in the US and Canada? 7) Are special privileges (e.g., root access) required to install TIS/PEM? 8) What about integrating TIS/PEM into mail user agents? 9) What about DOS and other non-UNIX platforms? 10) What about certificates? 11) What is a distinguished name? 12) What is a Certification Authority (CA)? 13) What does a PCA do and how are they differentiated? 14) What PCAs are available? 15) How much does it cost to sign up under a PCA? 16) What if I have questions about TIS PCA? 17) Is there a mailing list for TIS/PEM users? 18) What if I have questions about or problems with TIS/PEM? 1 Q: What is Privacy Enhanced Mail (PEM)? A: PEM is an Internet standard for providing security services to electronic mail. It uses cryptographic techniques to provide message integrity checking, originator authentication, and confidentiality. It lets you know that a message hasn't been changed, who it's from, and, optionally, allows you to keep it secret from all but the intended recipients. 2 Q: Where are the PEM standards defined? A: There is a set of Proposed Standard RFCs (Internet standards documents) that specify PEM. The four new documents are RFCs 1421 (obsoletes 1113), 1422 (obsoletes 1114), 1423 (obsoletes 1115), and 1424 (new). These documents may be found in your favorite RFC repository. Details on obtaining RFCs via FTP or EMAIL may be obtained by sending an EMAIL message to "rfc-info(a)ISI.EDU" with the message body "help: ways_to_get_rfcs". For example: To: rfc-info(a)ISI.EDU Subject: getting rfcs help: ways_to_get_rfcs 3 Q: Is there a forum for PEM developers and others interested in the PEM standards? A: Yes, there is an electronic mailing list that is used to discuss the PEM specifications, implementation issues, and it is used to conduct some of the business of the Internet Engineering Task Force (IETF) PEM working group. Send a message to "pem-dev-request(a)tis.com" if you would like to be added to the list. 4 Q: Are there implementations of PEM available? A: Yes, implementations are being made available as you read this. Trusted Information Systems (TIS), under ARPA sponsorship and in cooperation with RSA Data Security Incorporated (RSADSI), has released a reference implementation of Privacy Enhanced Mail (TIS/PEM) to the Internet community. TIS/PEM is a UNIX-based implementation that has been integrated with Rand MH 6.7.2 and is easily integrated into other mail user agents. TIS/PEM is distributed in source form. It is openly available within the United States and Canada for non-commercial use (not for resale). 5 Q: How do I get TIS/PEM? A: TIS/PEM is available via anonymous ftp in the United States and Canada to US and Canadian citizens and people with a US "green card." To retrieve TIS/PEM please FTP to host: ftp.tis.com login: anonymous and retrieve the files pub/PEM/README pub/PEM/LICENSE pub/PEM/BUGS The README file contains further instructions. 6 Q: Why is TIS/PEM only available in the US and Canada? A: The export from the United States of the cryptography used in TIS/PEM is controlled by the United States government. 7 Q: Are special privileges (e.g., root access) required to install TIS/PEM? A: TIS/PEM can be installed in multi-user mode, which is identified by the use of a single, system-wide, shared database of cryptographic and administrative information maintained by one or more privileged users called certificate administrators, and single-user mode, which allows individuals to maintain their own databases of cryptographic and administrative information. Multi-user mode installation requires privileges, while single-user mode installation does not. 8 Q: What about integrating TIS/PEM into mail user agents? A: TIS/PEM has been integrated with MH 6.7.2 and is easily integrated with other mail user agents. If you integrate TIS/PEM with a popular mail user agent, we would be happy to make it available to others. Additionally, a set of filters, similar to the UNIX cat command, that allow you to apply and remove PEM enhancements (enhance and de-enhance) text files are provided. These filters make it possible to use PEM with mail user agents that are not PEM aware. 9 Q: What about DOS and other non-UNIX platforms? A: TIS/PEM is currently limited to UNIX, but we are pursuing porting it to other operating systems. 10 Q: What about certificates? A: While PEM uses X.509 certificates to bind distinguished names to RSA public keys, it is not necessary to join the Internet certification hierarchy or otherwise pay to use TIS/PEM. TIS/PEM is capable of generating the certificates that you need. Joining the Internet certification hierarchy has the benefit of making it easier to verify others' mail and for them to verify yours. To join the Internet certification hierarchy, you must sign up your Certification Authority (CA) under a Policy-level Certification Authority (PCA). 11 Q: What is a distinguished name? A: A distinguished name is a hierarchical, globally unique name used to identify something or someone. RFC 1255 and several North American Directory Forum (NADF) documents describe how to select appropriate distinguished names. The distinguished name for Earl Sinclair (a fictional character, geographically displaced) might be Country=US State or Province=CA Organization=Wesayso Corporation Organizational Unit=Tree Pushing Division Common Name=Earl Sinclair 12 Q: What is a Certification Authority (CA)? A: A Certification Authority (CA) vouches for the binding between users' distinguished names and RSA public keys within an organization or organizational unit. The CA's distinguished name is that of the organization or organizational unit and users' distinguished names are created by starting with the CA distinguished name and adding something to uniquely and unambiguously identify the user, like a common name. 13 Q: What does a PCA do and how are they differentiated? A: PCAs vouch for the binding between a CA's distinguished name and RSA public key. By joining a PCA, others can verify your PEM messages by following the certification path to the Internet Policy-level Certification Authority certificate without having to have retrieved your RSA public key using secure, out of band means. PCAs may also make CA Certificate Revocation Lists (CRLs) and certificates available and provide other services for its members. PCAs can be differentiated by the policy that they advertise. The policy includes the level of effort -- and associated assurance -- that a PCA uses to insure the correctness of the binding and the requirements they place on CAs which issue certificates under them. They can also be differentiated by the other services they offer and their price. 14 Q: What PCAs are available? A: Several PCAs exist as part of the Internet certification hierarchy, including PCAs at RSADSI and TIS, and more may come online in the near future. 15 Q: How much does it cost to sign up under a PCA? A: Individual PCAs will have their own price schedules. Signing up under the TIS PCA is free during 1993. 16 Q: What if I have questions about TIS PCA? A: Sent them to tispca-info(a)tis.com. 17 Q: Is there a mailing list for TIS/PEM users? A: Yes, it's tispem-users(a)tis.com. Send mail to tispem-users-request(a)tis.com to be added to or deleted from the list. 18 Q: What if I have questions about or problems with TIS/PEM? A: Send them to tispem-support(a)tis.com. - -----END PRIVACY-ENHANCED MESSAGE----- ------- End of Forwarded Message

3 2

crypto print drivers for email
by Jeff Ubois 10 Jun '93

10 Jun '93

Forgive me if I've missed it on alt.security.pgp, but what would people think of implementing PGP or other crypto schemes using a print driver ? A model could be some of the fax software that lets you fax directly from other applications by issuing a print command. These packages have print drivers that let you enter the name and phone number of the person you are faxing, or select a name from an address book after you give the print command. You can also select high or low resolution, what kinds of headers you want added to the message, and make file attachments. This is a very easy way to send faxes, and seems like it would be an easy way to create and send encrypted messages too. For persons who aren't technically adept, this would be a lot simpler than say pem -e -r recipient(a)bighost.edu -p bigpubkeyfile -s mysecret or even PGP equivalents. --Jeff

1 0

Re: CERT: the letter from CERT to berkeley.edu admin
by Peter Honeyman 10 Jun '93

10 Jun '93

> It resulted in soda being > closed down for a while to the detriment of all the users. very similar circumstances resulted in penet shutting down for a lengthy period; penet is still operating under severe restrictions. the cert letter could have produced the same result. interestingly, i believe the penet letter was sent to the same address as the earlier, infamous "famous net personality" letter. another coincidence? peter

2 1

My poll....
by nobody＠alumni.cco.caltech.edu 10 Jun '93

10 Jun '93

Uu> I was shocked to find that people still use pgp v2.1. I don't know where you've been, but version 2.2 has a notorious bug that locks up the box under numerous situations. In my experience, version 2.2 locks up 8088-based computers. Version 2.1 does not. There is an unauthorized bug fix version, 2.21. I use 2.2 as it runs well on my system. ********************************************************************* * <m..stirner(a)f28.n125.z1.fidonet.org> - PGP Key D30909 via servers * * > What country can preserve its liberties if its rulers are not <* * > warned from time to time that their people preserve the spirit <* * > of resistance? Let them take arms!" - Thomas Jefferson, 1787 <* ********************************************************************* ... Protect your right to privacy --- Say no to Clipper/Capstone! ___ Blue Wave/QWK v2.12 -- M. Stirner - via FidoNet node 1:125/1 UUCP: ...!uunet!kumr!shelter!28!M..Stirner INTERNET: M..Stirner(a)f28.n125.z1.FIDONET.ORG

3 2

Re: Encrypting the list
by Hal 10 Jun '93

10 Jun '93

To: cypherpunks(a)toad.com If we could encrypt the list, and if we could subscribe via Julf's remailer or get our remailers to accept address aliases of some sort, then list subscribers could have "local" privacy. Local sysops and roots would not be able to see our incoming mail, and would not see that we were subscribing to a group like "cypherpunks". My long-term goal would be to have all mail be encrypted, and all mail be sent via anonymous remailers (or equivalent technology), so that the content and routing of our messages is truly private. Hal 74076.1041(a)compuserve.com

1 0

None
by None 10 Jun '93

10 Jun '93

1 0

None
by None 10 Jun '93

10 Jun '93

1 0

None
by None 10 Jun '93

10 Jun '93

1 0

None
by None 10 Jun '93

10 Jun '93

1 0