- cypherpunks-legacy - lists.cpunks.org

The new PEM release supports non-authoritarian certificates
by gnu＠cygnus.com 01 Jun '93

01 Jun '93

You can generate your own certificates using the new PEM code from TIS. This, in some ways, models the PGP "web of trust" model. At least it's a lot closer than the original PEM "you trust us, we don't trust you" model. They have also done something with the email address space, but I'm not sure what. Previously PEM required that you abandon your Internet email address and use an X.400 based address in certificates and such. More details will be available when the PEM release is out for FTP (within days, I think). John

1 0

Re: Verifying Privacy as an Upload/AI?
by peb＠PROCASE.COM 01 Jun '93

01 Jun '93

>From marc(a)GZA.COM Tue Jun 1 15:44:15 1993 >But if you don't give me the password, the guy >holding the phone has some very unpleasant looking surgical equipment Alarm systems use duress codes for this that trigger a silent alarm when the password is entered. I'm not sure the proposed system here (a capability system) could have an extra channel that the bad guys don't know about. Using a hierarchy of escrow agents would be interesting--then by calling me up for part of the key would require me to get back to you after I called up the person at the next level. (Note that a hierarchy is a special case of a general graph, so the webs of trust idea is important here (could provide some redundancy).) Now, back to Steve's actual question, >From: fnerd(a)smds.com (FutureNerd Steve Witham) >given that you SEEM to be inside a secure system, how can you know >that you are not inside a simulation Ultimately, there is no proof you are not currently a simulation on a big computer. Why is time travel is not possible? It's too expensive on the current platform. (E.g, if SimEarth inhabitants could time travel, you would have a hard time keeping track of what they did and your machine would slow down considerably). On an upload, how many people can be in the same room? Can you make arbitrary video phone calls? Anything that stretches the compute resources could potentially make the bad guys impatient and blow their trojan horse universe. Paul E. Baclace peb(a)procase.com

1 0

wimsey.bc.ca archive is back on line
by markh＠wimsey.bc.ca 01 Jun '93

01 Jun '93

Due to a disk failure the anonymous ftp cryptography archive at wimsey.bc.ca (/pub/crypto) was off line for a couple of months. Well, it is back. (If you haven't used it before, we're on the other end of a slip link, so be please be patient, downloads take a while). As usual I'm asking that this archive not be used to illegally export cryptographic products from Canada and the U.S. -- Mark Henderson markh(a)wimsey.bc.ca (personal account) RIPEM key available by key server/finger/E-mail MD5OfPublicKey: F1F5F0C3984CBEAF3889ADAFA2437433

1 0

things
by bakunin＠gnu.ai.mit.edu 01 Jun '93

01 Jun '93

In re: tested telexes for those who don't know, telexes have been made 'secure' by use of a simple testing system for, say, banks to 'wire' money with. This extant paradigm gives me hope that electronic contracts are coming. In re: Wilde, ptui Pascal, SCHMASCAL. "Schlup.. schlup schlup." -WSB In re: govmnt nastiness Well, gee, I thought Carter was a pig, too. Lookit East Timor. But as Slick Willie goes, I dunno. I believe propagation of technology may outflank any intentions he may have. Maybe. be cool, michael

1 0

Re: Clipperpunks Write Code?
by Clark Reynard 01 Jun '93

01 Jun '93

Actually, I think that writing letters is somewhat useful; especially those of us who aren't very good at writing real code. I plug cypherpunks a bit in a Phrack article I just finished concerning my bust by the police a few years back; maybe you'd like to check it out, since it may be YOU if this damn Clipper thing goes through. This makes me glad I voted Marrou/Lord, and that I resisted the temptation to be suckered by that sellout bastard Clinton. I was worried that he would turn out to be a Jimmy Carter, but it's far worse than that. Carter, at least, had some human decency. Clinton has turned into the nightmare resurrection of Lyndon B. Johnson, and is probably stupid enough to get us into a war. Damn all politicians. If any of you read the Phrack article (I will not forward my article to the cypherpunks list, as it is well over 100K; those who wish to check it out can see it when and if it comes out; in all likelihood, Phrack 43, which is due to be out in a week or so), and believe that there is another publication which might be interested in it (I am willing to re-write for lay-persons); send me the info. Anyone who just absolutely can't WAIT to read it can request a copy from me, and I'll send it in three parts. While my article touches only tangentially on the issue of encryption (and my experience with weak encryption and with NOT having encryption), it may be of interest. Simply for your interest in cryptography, it is apparent that we are about to face a McCarthyesque witch-hunt. The government has already defined the terms of this conflict, and has declared war on basic human liberty. We must act accordingly. I advocate that the Clipper algorithm be discovered, if at all possible, by the comparison of the unlimited plaintext/ciphertext pairs which will be available to anyone with a Clipper phone and a computer, and the skills for differential cryptanalysis and/or IC Reverse Engineering. If the algorithm is made public, anonymously, within a year, and in so many copies that it is impossible to stop its distribution in electronic or samizdat form, Clipper is doomed. And it must be doomed. It's them or us. ---- Robert W. Clark Just Say No! to the rclark(a)nyx.cs.du.edu Big Brother Chip

1 0

Re: Verifying Privacy as an Upload/AI?
by peb＠PROCASE.COM 01 Jun '93

01 Jun '93

I think you are headed in the right direction wrt a capability system, however, they are predicated on tamper proof hardware. Since you stipulate human being copying and torturing (sounds like tampering to me), I think this is not ultimate privacy. Hmm, perhaps you should set up a key escrow system (!) so that you need to call your most trusted friends to assemble your session key. The session key works only once, assuming a tamper proof, capability system. When you call them, they can quiz you on your mental and physical health to determine whether they should give you the keys...thus limiting the ability of a torturer. Paul E. Baclace peb(a)procase.com

2 1

Re: Verifying Privacy as an Upload/AI?
by fnerd＠smds.com 01 Jun '93

01 Jun '93

Just want to reinforce that my question is not how can an AI or upload BE secure, but how can they KNOW that they are secure. That is, given that you SEEM to be inside a secure system, how can you know that you are not inside a simulation that actually has a trap door? -fnerd

1 0

Re: crypto '93
by John (FuzzFace/Fast-Eddie) McMahon 01 Jun '93

01 Jun '93

*Sigh* Crypto '93 conflicts with Interop San Francisco (apparently).

1 0

Re: Software infrastructure
by jthomas＠kolanut.mitre.org 01 Jun '93

01 Jun '93

Eric Hughes <hughes(a)soda.berkeley.edu> writes: > I propose that interested cypherpunks write a DOS terminal program > which _is_ free software. In order to overcome the inertia which Hal > properly observes is endemic to any software change, I submit that to > have source code available to fix or add features deemed desirable > will be a key factor in acceptance of this software. I have my own > ideas about multiplexing the channel to support background POP and > file transfer, but I'll leave that for later. Such software, of > course, would be properly layered to be able to add encryption at the > key junctures. I may be able to help out in a DOS project (though I seem to be migrating quickly to Linux as it stabilizes...) Perhaps the GPL'ed program term would be useful in serial multiplexing applications. It's quite nice for Unix boxes, letting all kinds of streams coexist (even redirecting TCP/IP ports over serial without the overhead of SLIP/PPP). I believe I've heard someone on comp.os.linux or gnu.misc.discuss talk about hacking DES into term, so it sounds doable. I'm not sure how much the code assumes Unix serial device handing, but I'll have a look at the code. Joe

2 1

PGP vs. RIPEM
by nobody＠rosebud.ee.uh.edu 01 Jun '93

01 Jun '93

-----BEGIN PGP SIGNED MESSAGE----- ( >>>>>>'s inserted for the benefit of George Gleason ;-) From: Michael Edward Marotta <mercury(a)well.sf.ca.us> >>>>>> (This is for an article in the 1994 Loompanics catalog.) That's great that Loompanics is covering encryption. >>>>>> I don't know about you guys, but I find PGP much easier to use. >>>>>> RIPEM has all the hallmarks of unix wizardry. It is poorly >>>>>> documented. The interface is difficult. It grew in ways the >>>>>> designer never contemplated. And I haven't even RUN anything >>>>>> yet... Mark told me that it was primarily a MAILER. OK, I can >>>>>> accept that. But I just don't see it catching on. PGP, on the >>>>>> other hand, shows all the evidences of shareware. It's hard to >>>>>> comment on the obvious. I think the existance of two programs is good, helping to promote some rivalry and a certain amount of borrowing of good ideas from each other. PGP now has a contrib directory with information and scripts to help integrate it into mailers, an area which RIPEM has focussed on from the beginning. >>>>>> So, I assume that I am in the normal range for a netrunner. I >>>>>> typically log in to fidonet bbses from home. I have a PC clone. >>>>>> I have had accounts on CompuServe, Prodigy and Delphi. I have a >>>>>> couple of email addresses. I can't see myself using RIPEM. I >>>>>> can indeed see myself using PGP. PGP was originally developed on a PC and then ported to Unix, while for RIPEM it was the other way around, I believe. The workings of RIPEM are more Unix-ish while PGP is more DOS-ish. Which program seems more natural may depend on your background. The user community is more diverse than most people realize. You sound like you have somewhat more of a PC orientation than many people on the net. Most of the people I run into have the opposite problem - they think everything is Unix and that the PC is just some little corner of the world which isn't really relevant. They think that Usenet and Unix workstations are the de facto target environment for any communications utility. Actually, I think your experience is more relevant - PC's at home, hooking up to BBS's, Fidonet, and the commercial services for communications; also, people using PC's at home and dialing into Unix boxes at school or work. Another big area is people using networked PC's at work, although since we are mostly talking about freeware packages here we haven't paid much attention to that. Especially with encryption, which generally can't run securely on multi- user workstations, it makes more sense to think of PC's as the target platform. Some people are starting to have single-user systems which can run Unix, and this may increase with time, but for now DOS is where the emphasis should be. Many of the PC magazines predict that Unix is dead in that market and that Windows is the platform of choice in the future, so that is where we should be aiming, IMO. As Phil Zimmermann says, "skate to where the puck will be." I didn't really mean to open up the standard OS wars here, but it's important to realize that encryption has unique requirements for secrecy and security which may affect the DOS vs Unix debate. (And yes, I know I'm leaving out Macs, Amigas, Ataris, and who knows what else.) >>>>>> Here are my questions: >>>>>> How do you relate to the above? >>>>>> Do you see "everyone" on the Net happy as clams with privacy- >>>>>> enhanced mailers? >>>>>> Do you expect more people to find out about and rely on PGP? >>>>>> Do you see something else working here that I haven't perceived? The big problem, as Eric Hughes has frequently mentioned here, is the need to integrate encryption with mailing. I think what is really needed is some way of dealing with people who read mail on their PC while using some kind of terminal program or similar package to connect to a BBS, commercial service, or Unix box. The problem is that there are so many different programs in use and people probably won't be willing to switch just to get encryption. A lot of programs have fancy features including scripting, macro keys, etc., and switching requires learning new ways of doing all your old stuff. Hal Finney 74076.1041(a)compuserve.com -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLAi+1agTA69YIUw3AQGPLgQAlyIQOjmSo/Aq+aAUcTClfSVKXKMJiWk1 rYJ5qWiUYhkyyxRzTcLLUcGHg7kMlBwX1Xm8ptdq+/9FRUPXC8zGQjfD+Fn5AoHU FjItmAk6t4JEDRiaYTQAhVlJZnt3LHmnvMADxwCm36He6svjQTWDDXyob0giWw9s 2bQbGLGZG9Y= =yYIN -----END PGP SIGNATURE-----

4 3