- cypherpunks-legacy - lists.cpunks.org

PGP
by MaxDemon＠cup.portal.com 02 Jun '93

02 Jun '93

How do I get the server to send me PGP22.ZIP and PGP22SRC.ZIP without breaking up each file into pieces? I'm on a DOS machine and can't recombine them.

1 0

Software infrastructure
by nobody＠shell.portal.com 02 Jun '93

02 Jun '93

-----BEGIN PGP SIGNED MESSAGE----- Eric writes: > The second distinction is between stream and file encryption.If you > want to encrypt the underlying channel, you need a stream cipher and a > D-H key exchange. If you want file encryption, you want a block > cipher and public keys for communications. I don't think we should try to put stream encryption into this product. A problem with stream encryption is that it requires special SW on both ends. We would have to not only write a terminal program, but also write software which would transparently encrypt/decrypt which ran on the host and then passed the characters on to whatever command shell would normally run. I could see doing this with Unix (using pty's, a variant on the "script" program many systems have) but it may not be too portable. Stream encryption defends against wiretappers, and may provide some protection against the more trivial root-based attacks on the host computer (ones which just monitor the serial port - although if you use the pty idea there may be an internal serial port that has cleartext and which can be monitored). But you are still vulnerable to being monitored by root. I don't think the benefit gained is great enough, given the cost, to make this a good initial feature for the product. > This also implies the existence of offline mail readers. It is going to be hard to provide an offline mail reader with the friendliness of what the user is used to. Also, offline news reading is probably out of the question in this environment due to the great volume of news. Offline mail also has the problem that some people send great, huge messages that you aren't interested in. Online you just look at the first couple of pages and then delete it. Offline you download the whole thing, often paying for it, before you look at it. Another approach would be to have a "paranoid PGP" available on your host computer. This works much like regular PGP, except it will never ask you for your pass phrase. Any time it would, it instead outputs a magic escape sequence. This is recognized by your Cypherpunks terminal program and causes it to run a local program which includes PGP. The paranoid PGP on the host automatically downloads the file it was going to decrypt or sign to the local machine, which runs PGP, asks for your pass phrase, does the operation, and (perhaps) uploads the results back to the host. The whole thing is transparent if you are running the CP term, and your secret key and pass phrase never left your computer. (You might or might not want the plaintext to be uploaded after decryption - perhaps it could be previewed locally and if it's not too "hot" you can upload it and reply to it on the host.) Under this approach, message ENCRYPTION could be just done on-line since paranoid PGP doesn't need a pass phrase for that. So you can compose and mail your messages without needing any special support, as long as you don't sign them. You are still trusting the host, but not as much as if you left your secret key there and typed your pass phrase into the host computer. This is less secure than if you did everything on your PC but lets you use the powerful editing and mail/news handling capabilities of your host. This approach does have the same disadvantage I listed with respect to stream encryption, that it requires some special software on the host. However, this software should have many fewer host dependencies than a transparent stream encryptor would. Hal Finney 74076.1041(a)compuserve.com -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLAypvagTA69YIUw3AQECTgQAq/dvZ1EExP1GYzKlQcxhMIPT9TExxIes 25L8ZwG5syA6+KEcL2pSfnoPe1l9ZixCjefUnNiy9MYAHBh8uo8IEZ/IoCArSbvs ImUjayxZjWugHZaBIUsOo/dk5VbX/1tY3CW1eN2wItvtF1RQYk1QPjCYFgECqKeY UtRAd2p/JqI= =GAGr -----END PGP SIGNATURE-----

1 0

[galvin@TIS.COM: Privacy Enhanced Mail available via anonymous FTP]
by eichin＠ATHENA.MIT.EDU 02 Jun '93

02 Jun '93

It is interesting to note that the LICENSE says: >> This license permits you to: >> b. create and sign certificates for people and entities >> within your own organization; _Mark_ Message-Id: <9306022052.AA09067(a)TIS.COM> Reply-To: James M Galvin <galvin(a)TIS.COM> To: TISPEM.Announcement:;@TIS.COM, ietf(a)cnri.reston.va.us, pem-dev(a)TIS.COM, rsaref-users(a)rsa.com, saag-interest(a)TIS.COM, psrg-interest(a)isi.edu Subject: Privacy Enhanced Mail available via anonymous FTP Date: Wed, 02 Jun 93 16:51:17 -0400 From: James M Galvin <galvin(a)TIS.COM> Sender: pem-dev-relay(a)TIS.COM -----BEGIN PRIVACY-ENHANCED MESSAGE----- Proc-Type: 4,MIC-CLEAR Content-Domain: RFC822 Originator-ID-Asymmetric: MFMxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJNRDE kMCIGA1UEChMbVHJ1c3RlZCBJbmZvcm1hdGlvbiBTeXN0ZW1zMREwDwYDVQQLEwh HbGVud29vZA==,02 MIC-Info: RSA-MD5,RSA,ndrjfb54QirydT4/KLgg9HJh+5k0ON+bj9Wil5LeVTE 3E0ST0Bmv12KbChUn5MhxpH556ur0TbWTjl8/csLK52ARxGs0VJlzKfNOWL00SbB JfuyLIM6RLF9uE2ZBNNjP Trusted Information Systems, in cooperation with RSADSI, is pleased to announce the availability of Version 6.0 of TIS/PEM, the Internet reference implementation of Privacy Enhanced Mail. This software is available to US and Canadian organizations and citizens via anonymous ftp. All source code is included, including Version 6.7 of the Rand MH message handling system and Version 1.02 of RSAREF. To retrieve TIS/PEM please FTP to host: ftp.tis.com login: anonymous and retrieve the files pub/PEM/README pub/PEM/LICENSE The README file contains further instructions. The LICENSE file contains the restrictions and rules governing use of TIS/PEM. Please read this file before retrieving the code. Send questions to tispem-support(a)tis.com -----END PRIVACY-ENHANCED MESSAGE-----

1 0

Newsweek article, "The Code of the Future"
by fergp＠sytex.com 02 Jun '93

02 Jun '93

-----BEGIN PGP SIGNED MESSAGE----- On Tue, 1 Jun 93 18:56:10 -0700, Timothy C. May <uunet!netcom.com!tcmay> wrote - > Subject: "Newsweek" Article on Clipper and Encryption When I read this message this morning, I made a bee-line down to the kiosk in the lobby and bought it (the June 7th issue of Newsweek). It must've just hit the stand, because the issues were still bound with rubber bands. (Thanks, Tim, for taking the time to commit it to ASCII, BTW.) This is good. Clipper articles have appeared in The New York Times, The Washington Post and now, Newsweek. This is exactly the exposure that is needed. One thing that you didn't include (its rather trivial), that I tacked onto the end of this post, is a very, very brief history of Cryptography - - - -- "Great Moments in Cryptography 1900 B.C. Menet Khufu, Egypt Into the rock of a nobleman's tomb, a master scribe carved unusual symbols rather than the standard hieroglyphics. The intent was to impart a grandeur to the message, the oldest known cryptographic text. Jan. 17, 1917 London Britain decodes the 'Zimmerman' telegram from Berlin to the German ambassador in Washington. Describing a plan to give Mexico the U.S. Southwest, it helped draw an outraged America into World War I. Dec. 7, 1941 Washington, D.C. Navy spies crack a message from Tokyo to its embassy in Washington saying it will break off talks with the U.S. at 1 p.m. -- dawn at Pearl Harbor. The navy spies miss the import of this; Tojo strikes unopposed. Nov. 4, 1952 Washington, D.C. Truman creates National Security Agency, master of math-based codes." - - -- To which, I add my own date to remember - "Infamous Moments in Cryptography Apr. 16, 1993 Washington, D.C. The Clinton Administration announces introduction of the 'Clipper Chip,' a cryptographic scheme developed by the NSA under the auspices of the National Institute of Standards and Technology (NIST). Under 'Clipper,' monitoring high-tech communications is made simpler for law enforcement agencies and privacy becomes a secondary triviality." I can only keep my fingers crossed that we see more articles like this geared to informing the public of this ruse. -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLA0R05RLcZSdHMBNAQE5JgP/TFsJ6aF7+4lMIQjHSQw3qevwT45R+FIg rw5wNDIi7BO3A2rLyDE35rhJsekj6MB3Jg002K1Dy4W0lzT7pb9fkUcwt0H0mQXK 3BuZti59/grD6gfPPgkBHnC8XsH7sHnOV6OsZM1T8eusWofEp541l5bI9RsfnRsM qYnv1S3i+2c= =H9UT -----END PGP SIGNATURE----- Paul Ferguson | The future is now. Network Integrator | History will tell the tale; Centreville, Virginia USA | We must endure and struggle fergp(a)sytex.com | to shape it. Stop the Wiretap (Clipper/Capstone) Chip.

1 0

RE: Work the Work!
by fergp＠sytex.com 02 Jun '93

02 Jun '93

-----BEGIN PGP SIGNED MESSAGE----- Date: Tue, 1 Jun 93 21:32:24 -0700 Eric Hughes <uunet!soda.berkeley.edu!hughes> wrote - > Paul, you of all people don't need to feel slighted when I urge > people to do something, anything, about the wiretap chips. Agreed. There are many, many things that we need to do to support opposition to this ruse. > Here is my own very short version of my policy toward the wiretap > chips: > "The government has no right to restrict my use of cryptography in > any way. They may not forbid me to use whatever ciphers I may like, > nor may they require me to use any that I do not like." Hear, hear. > The hypothetical backdoor in clipper is a charlatan's issue by > comparison, as is discussion of how to make a key escrow system > 'work.' Do not be suckered into talking about an issue that is not > important. If someone want to talk about potential back doors, refuse > to speculate. The existence of a front door (key escrow) make back > door issues pale in comparison. > If someone wants to talk about how key escrow works, refuse to > elaborate. Saying that this particular key escrow system is bad has a > large measure of complicity in saying that escrow systems in general > are OK. Always argue that this particular key escrow system is bad > because it is a key escrow system, not because it has procedural > flaws. > This right issue is that the government has no right to my private > communications. Every other issue is the wrong issue and detracts > from this central one. If we defeat one particular system without > defeating all other possible such systems at the same time, we have > not won at all; we have delayed the time of reckoning. Very lucid and wise observation. I have suggested several times that attention should also be directed to the (what I call) "potential factor" in regards to the entire "key escrow" system. The potential for abuse and unconstitutional invasions of personal privacy are ripe for the picking under this scheme. In my own public comment letter to the Computer System Security and Privacy Advisory Board, I stressed this fact and also pointed out that although the system was probably designed with good intentions (right), it will not prevent zealots and spooks from monitoring communications under certain circumstances. My other peeve is that after this "technology" has been entrenched (read: forced) on the public, I see the rug being pulled out from under the feet of any other crypto system available. That's also why I attach a great deal of importance to some form of PGP being developed where all parties (Phil Z., Jim B., and me) are happy (excluding Uncle S.). (But I suppose that's another topic...) Patriotically yours, -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLAzzZJRLcZSdHMBNAQEzEwP7BVrQ4KxuFgf19Dq0avHEq8fN4+k2lVFU UBPAZYWNwzyPV3IkmrFf4RGR84H/pdWm09GmYH5wptOuKEut0M5NzO30Z9+c2SW3 7FYr5TF2rygg0mHn6SDSiZZBLuLt/XqWIwGOzJBtrTnPsrLMqZ18Xk60lH3yqUme FzTiDxDnjqA= =wnNa -----END PGP SIGNATURE----- Paul Ferguson | The future is now. Network Integrator | History will tell the tale; Centreville, Virginia USA | We must endure and struggle fergp(a)sytex.com | to shape it. Stop the Wiretap (Clipper/Capstone) Chip.

1 0

Crypto/Clipper debate rages on in comp.risks
by fergp＠sytex.com 02 Jun '93

02 Jun '93

-----BEGIN PGP SIGNED MESSAGE----- For those of you who don't follow RISKS Digest (comp.risks): you're really missing some good stuff. At the risk of redundantly posting messages which may have already been discussed, I couldn't resist the opportunity to cross-post this portion of a response to Peter Junger's original post on "Risks of teaching the law without breaking it," where Mr. Junger expresses his displeasure and confoundedness of the export restrictions on simple (and all) cryptography. 8<----- Snip, Snip ------------ RISKS-LIST: RISKS-FORUM Digest Tuesday 1 June 1993 Volume 14 : Issue 67 >Date: Tue, 1 Jun 93 14:17:52 BST From: jharuni(a)micrognosis.co.uk (Jonathan Haruni) Subject: Re: Peter D. Junger's risks of teaching... (RISKS-14.6)5 Organization: Micrognosis International, London Peter D. Junger (junger(a)samsara.law.cwru.edu) wrote: > [ about his amusing and sad conundrum of being unable to teach law > students about a law without breaking it. ] I think that if you give your students copies of your comp.risks article, they should all be sufficiently disheartened with American law that they will quit the program and you can then present your lectures to a class devoid of foreign (or any) students. Alternatively, you could check passports at the door, and boot out foreign students during the parts of your class which are essential to American Sickurity. By doing so you will raise eyebrows well outside of the computer-and-law sphere of interest and you may bring this ludicrous situation into the limelight. But then, you may get sacked. Probably a much more effective solution to your problem, and one which has recently been proven perfectly legal and acceptable in an American court, would be for you to merely shoot dead all the foreigners in your class, after which you can speak freely. - ----[ remainder of post omitted ]------- -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLAz9X5RLcZSdHMBNAQHQnwP9F8asul5g8tl4hhb9cLJZ9rz+0UeNUQb2 aGK+Bhx6onigi/HwseMjZP3BFSDHUzB3IuzpIjkIBj1BBEB24ZCtZVx9i4M9cIwI wObnkA7YQ0LIr2Ut4d37vQRU36VyltprRB7toqhuGWpv1ZMAp91uNQ4H3tIgXMYL 6sUplUkFMGQ= =C1Qo -----END PGP SIGNATURE----- Paul Ferguson | The future is now. Network Integrator | History will tell the tale; Centreville, Virginia USA | We must endure and struggle fergp(a)sytex.com | to shape it. Stop the Wiretap (Clipper/Capstone) Chip.

1 0

Security in a VR world
by poier＠sfu.ca 02 Jun '93

02 Jun '93

-----BEGIN PGP SIGNED MESSAGE----- For anyone interested, there is a discussion on the multiverse maillist at multiverse(a)medg.lcs.mit.edu about "portal security", that is, the ability / inability for certain users passing through certain "portals", as well as verification of user identity... Unfortunately, the developer is in Europe, and as we all know, PGP is export-controlled... :( Skye - -- - -----====> Skye Merlin Poier <====----- Undergrad in CMPT/MATH (Virtual Reality) |||| |||| email: poier(a)sfu.ca p-OO <--> OO-q THINK PGP Public Key available on finger \== ==/ -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLAzWoy0bkpXW3omvAQFpVQQAvN+Q+fj+04DGgjXAyDhsBcRG5QEXES3a u6/lTKzhyqZEOCVX+ObivZOLUrc7OsbED0hGE4Wn/jIEeoeM//b9cA10JmTYu1Ce WgXPPuAa+YKAin9dMdIxNNiTzSaQhx+dQ3saPssQ45ErYWCPiix4ceBJWuITZJEG 9RfehK/yLws= =rHJv -----END PGP SIGNATURE-----

2 1

Re: Clipper replacement chip
by fnerd＠smds.com 02 Jun '93

02 Jun '93

RYAN Alan Porter <rtfm!rtfm.mlb.fl.us!ryan(a)mlb.semi.harris.com> sez > Just out of curiosity, does anyone on the cypherpunks list posess the > technical skills that would be necessary to begin a project of hacking out > a pin compatible version of the Clipper that didn't have the backdoors > once the chip is out, a la AMD and CYRIX? > ... > So I guess the really important question is: does anybody know how to > reverse engineer a chip and build a duplicate, pin-compatible device from > the ground up while hiding from the feds the whole time and still managing > to make a living? Well, there's an easier end-run: a piggyback board. This would plug into the Clipper's slot, and the Clipper would plug into it. Then it could either run in Clipper or PGP/DH-IDEA/Whatever mode. I don't understand enough about the Clipper protocols and interface to know whether there's room to squeeze in bits to signal which of these two modes, unbeknownst to the rest of the phone, but you could certainly attach a Clip vs. Secure switch. -fnerd

1 0

CryptoStacker
by RYAN Alan Porter 02 Jun '93

02 Jun '93

Thanks for all of the responses on my questions concerning the CryptoStacker idea. I am kind of sick of talking about it though, and so I went out today and did some research on drivers and such. I am planning to create a software implementation of a PGP driver starting maybe tomorrow (I am being payed real dollars to write other code at the moment) for on-the-fly HD encryption. I haven't quite figured out how to create a commercially distrubutable system yet, but there really is no point sitting around arguing about this and that detail until somebody actually goes out and tries it... I have a feeling that this version will be slow as balls without hardware support, but that's not really the problem, is it? The main focus that I have right now is making the thing work. There have been lots of neat suggestions about multiple layers and suchlike tooalso, which are all fine and dandy, but they kind of missed the point: mainly what I am interested in is preventing access to the data on my HD by anyone but ME, screw LANs and multi-user problems and all of that, I just want to create a system whereby if the Secret Service busts down my door tomorrow while I am not here to throw the drive across the room, they will never be able to fetch out any incriminating evidence by picking apart my system in some lab somewhere. I can also see the advantage of a business worrying about spying, or even government agencies (wouldn't that be ironic) worrying about security and considering networks insecure. Anyway, we can add bells and whistles like network support and multiple layers and suchlike after we figure out how to get the basic engine to work, right? I have also seen everyone suggesting DES instead of PGP. I suppose that would really be a great idea for speed and suchlike, for some reason I was kind of attached to the whole public key idea, but I suppose that would be kind of close-to-worthless in this context, wouldn't it? I suppose we are to the point where I can use some actual technical advice, no need to reinvent the wheel, right? If anyone has any information of the overall architecture of projects like Stacker or DoubleStor, I would appreciate the input. I have used both in the past and I am kind of leaning toward a system like DoubleStor (which maintains directory structures and such, but compresses each file in place) for simplicity, but I am kind of hesitant to leave even a hint of the overall structure of the disk laying around for prying eyes. Trouble is, I don't have much experience screwing around with the FAT and such so I wouldn't want to do anything so bold as munching the entire disk into a single file and suchlike. Any ideas? -Ryan the Bit Wallah

2 1

Re: Electronic Contracts
by wcs＠anchor.ho.att.com 02 Jun '93

02 Jun '93

Don't know if there have been specific tests of it in courts, but, yes, signing contracts is definitely something people want digital signatures for. Also, anything else that requires a signature, we'd like to be able to sign digitally, so we can do it online instead of hauling paper around. That's not just a cypherpunk thing, it's what a large fraction of the business community would like to be able to do - it speeds business cycles, cuts ordering time, and means we don't have to keep all this paper around, especially in storage; while the paperless office won't be reality for a while, it would really be nice if we could store the important stuff digitally, where it's easy to retrieve later, and save paper for transient uses like convenient reading, unlike the current situation where digital is for convenience but the important stuff is paper that has to be stored somewhere MIME-Insert-Video-Clip: Indiana Jones, Government Warehouse Scene..... A certain amount of this has been done with the various telex networks; I get the impression from somewhere that a telex can be a legal document for things like sending purchase orders, just like paper can; it will be interesting to see if fax acquires the same status, but forging a fax is terribly easy, just as email is. Bill Stewart

3 2