- cypherpunks-legacy - lists.cpunks.org

discount datacom rates?
by George A. Gleason 30 Mar '93

30 Mar '93

I've discovered there may be a way to provide late night (1am - 4am) dialup data communication at a substantial discount in long distance charges. We'd need something like a few thousand users in order to get this running. Feedback...? Ideas...? Email gg(a)well.sf.ca.us

1 0

Re: PGP Secure?
by baumbach＠atmel.com 29 Mar '93

29 Mar '93

> This has been recently hashed over in sci.crypt. Here are a few > generalities, read the articles in sci.crypt for the real numbers. For those of us who don't have access to USENET, is there a mailing-list that echo's it's content and allows posting? > -If you did 1000 attempts to break a 1024 bit RSA key every second > and started your calculations at the beginning of the universe, you > would still have several trillion years to go. > -If you stored every attempted key in a single atom, you would run > out of atoms in the universe long before you ran out of keys. Couldn't this argument also be made about a simple substitution code? How secure is PGP with current smarter attacks? Peter Baumbach baumbach(a)atmel.com

1 0

anon email/caller id
by Mr. Noise 29 Mar '93

29 Mar '93

Phil Karn's anology between anonymous e-mail & caller i.d. gets it right, I think. If you don't want to read it, don't, just as you may block calls without caller i.d. There are two concerns I'd like to see addressed, though: first, what about those who use anon email to get away with behavior that wastes net resources? When the identity of the poster is know, they can be 'disciplined' by other net.citizens (call it frontier justice if you like...). second, from the opposite end, won't the availability of caller i.d. mean that it will become more diffuclt to engage in truly anonymous conversations over the telephone network, as revealing one's identity becomes the norm? As to the first objection, I suppose we could continue to rely on the site administrators (& remailer admins) to discipline the offenders. After all, the sites are still subject to the same discipline we can inflict on the individual poster if known. As to the second, I suppose we can always observe that those who won't accept our anonymous call aren't worth talking to in the first place, but that evades the question IMHO. Also, having the capability in the phone system means someone can still abuse it without our knowledge. I would suggest another solution to this dilemma: 'handles'. Having a semi-secret identity means having control over your Real Life exposure to risk, whiel still allowing those you come in contact with to indentify you-- & ignore you if they wish with minimal trouble. It also means that you can set different levels of security: anyone who cares to can find out who Mr. Noise is, but how many of you know the *other* 'real mes'? Well, just some rambling thoughts at lunchtime as a way of saying hello to all of you on this list, since I just joined a week ago & didn't want to 'lurk'. :-) Have an anonymous day! Mr. Noise

1 0

a blackmail opportunity
by Eli Brandt 29 Mar '93

29 Mar '93

While writing some appropriate paranoia for a canned response to remailer info requests, I realized that running a remailer is a perfect prelude to blackmail. An unscrupulous person running a remailer can obviously keep records of truenames, along with messages that their senders do not want associated with them. Making use of this information could involve a scenario to the crypto-extortion previously discussed, but blackmail would be far more believable than anonymous threats. Alternatively, the blackmailer could be low-tech and resort to present techniques. Always encrypting helps with mail, but not with news. PGP 2 key by finger or e-mail Eli ebrandt(a)jarthur.claremont.edu

2 1

anonymous services
by Lord Krieg 29 Mar '93

29 Mar '93

-----BEGIN PGP SIGNED MESSAGE----- After reading Mr. Finney's response to my comments, I can see that I really shouldn't try to make suggestions on how an anonymous service should be implemented. I clearly don't have the knowledge necessary to address this subject without sounding like an idiot. :-) So... I'll instead simply say what I would like to see in an anonymous service, and I'll leave discussion of the technicalities to people who know what they're talking about. I'd like to see something which combines the strengths of the different types of anonymous services while reducing or eliminating the weaknesses. A service which can be used as easily as anon.penet.fi would certainly be nice. I'd also like to see encryption available as an option. Ideally, messages would not _have_ to be encrypted. Making encryption optional would be good for paranoid individuals such as myself, while making the service more accessible to people who are willing to sacrifice security. This would also accomodate people within the U.S. who want to use the service put are afraid of Mr. Sternlight. :-) I like the way the Cypherpunks Remailers let users chain and encrypt their messages so that even the remailers can't know both the sender and recipient. This is something I'd also like to see in a new anonymous service. I still think that one or more back-up servers would not be a totally bad idea. I realize that I don't know what I'm talking about, but I just don't understand why it would be impossible to have a back-up server (with a copy of the active server's database) on standby. I'm not saying that the existence of such a back-up should be advertised--I just think that it should be possible to have somebody set up a backup _without actually running it_ so that when the active server gets shut down, it can quickly step in to take over. Oh, and on a unrelated subject... Could anybody with information on $50/month UUNET connections please send it to me, or tell me who I should write to about it? Thanks in advance. Kenneth G. Hagler ********************************************************************** * Internet: cvadsaav(a)csupomona.edu * My insurance company * * Phone: (909) 865-7751 * is Beretta U.S.A. * * PGP 2.2 key available on request * * *--------------------------------------------------------------------* * ...study of the military arts will make one who is naturally * * clever more so and one who is born somewhat dull rather less * * so. * * --Daidoji Yuzan Shigesuke, _Budo Shoshinshu_ * ********************************************************************** -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBK7aFnSipatcRAyu9AQF6UgQAwmchM/JwJS16i/FA6MF0yVAhUg2gpkX2 osLEPpPrlISCwy1dulBxpHJhFyIVSshTx2J5962efiw4pR9+/1F47tOESFHbGLN1 yfKU1pJo1pNyh2ZX72YKK2AvOvAtgz22sXZK01I7jDJbCZdvfoha2T1c5H4KfRQ6 23ddGKcUOVc= =VXNO -----END PGP SIGNATURE-----

2 1

PGP Secure?
by uni＠acs.bu.edu 29 Mar '93

29 Mar '93

Forgive my slow math mind, but I pose the following question, knowing in advance that it's a FAQ, but I can't find an answer anywhere.... Given a brute force attack on ciphertext encrypted with PGP2.2 using the 1024 bit key, how many operations are required to hit on the session key...? (The session key being used with the IDEA cipher) What about derriving the RSA key pair from the public key and message? How many operations might this require? Along these lines, what's the best guess at the highest technology level available today with regard to speed? How many operations per second might the most resourced orginization be expected to achieve? The real meat of this question boils down to: What are the capabilities currently, and what is required to brute force the various stages of PGP? Also: What does 1024 bit refer to? The IDEA session key? or the RSA key? Thanks in advance... uni

3 2

PGP: Improvements needed.
by thug＠phantom.com 29 Mar '93

29 Mar '93

I like PGP 2.2 a lot, but I think there is still much room for improvement. I would like to throw the following suggestions on the table and open up a discussion on them: Here is what I think needs to be done: - PGP needs the talked about "stealth" mode, wherein PGP encrypted files and documents contain no PGP header. This would allow the embedding of PGP documents into files containing "white noise static" data, or into the LSBs of graphic and sound files. - PGP needs to use a better compression algorithm. From what I know, I believe PGP currently uses LZW (the same algorithm as in the Unix compress utility). Anyone who has used Gnuzip (aka: gzip) knows that LZW typically compresses text files down to only 40-45% of their original size, while LZ77 (the algorithm in gzip) compresses text files down to 30% or less of their original size. Clearly LZ77 not only saves space, but improves the entropy/randomness of the cyphertext, making PGP that much harder to crack. - PGP needs a version or front end for the masses. A point-and-click version or front end that runs under DOS. I know there are really good front ends for pkzip for DOS, so how come someone doesn't write a front end for pgp2.2? I would also suggest a Windows version, but that is not as important as having a really user friendly DOS version. Hopefully, by PGP 2.5 or 3.0, these things will happen. But I'd like to see them in 2.3 if possible. Thug

1 0

UUNET connections
by greg＠ideath.goldenbear.com 29 Mar '93

29 Mar '93

My previous message re my UUCP connection to UUNET has generated several questions in E-mail, as well as a recently posted question about "the $50 connections to UUNET", so I feel like I oughta answer the question(s) apparently created by my quick summary of my use of UUNET's services. UUNET will allow you to make a UUCP connection to their machines for an "administrative fee" of $36 per month, plus hourly connect rates. These rates are (as of my booklet rcvd from them in 1/93) $2.60/hr if you call their local dialup (NPA 703), and $5.60/hr if you dial in via the Compuserve packet network. Their local dialups support the PEP protocol as well as v.32 connections; I average around 700 cps when I dial in directly with v.32, and around 450 cps when I dial in via Compuserve. The $50 figure I quoted is my average monthly cost for a slow but steady trickle of mail (roughly 7K per day) and approximately 20 newsgroups, none of which are binary-oriented and none of which are super-high traffic. This includes my hourly cost for both direct-dial and Compuserve connections; I prefer to dial in directly, but have my Systems file set up to use Compuserve as a backup means of connection when the direct lines are busy (which happens with some frequency.) UUNET will register a domain name for you for free if you are a subscriber; if you do not subscribe to their service, the cost is $50. (I incorrectly quoted $25 for this to someone via E-mail.) UUNET sends a free copy of O'Reilly & Associates' _Managing uucp & Usenet_ when you sign up with them; great book, nice touch, probably saves them money for all of the questions it answers. To get in touch with UUNET: info(a)uunet.uu.net or 800-488-6384 I think you could also probably find some information files if you FTP'd to ftp.uu.net; I'm unsure about that and offer no guarantees. UUNET also offers a "low-volume" agreement that I don't know much about since I don't subscribe to it. I know that PSI offers similar service; my recollection is that they want $75/3mos for mail, and $225/3mos for news, flat-rate. PSI can be reached at 'info(a)psi.com' or 703-620-6651. I have no connection with UUNET beyond being a happy & satisfied customer; I've found them to be friendly & helpful and generally good to work with. The folks at PSI seem nice too but their prices for what I want right now are higher. UUNET and PSI both offer realtime IP connections, in addition to UUCP links like the one I use; call them for more information. -- Greg Broiles greg(a)goldenbear.com Golden Bear Consulting +1 503 465 0325 Box 12005 Eugene OR 97440 BBS: +1 503 687 7764

1 0

REMAIL: "Stealth" Remailers
by edgar＠spectrx.Saigon.COM 28 Mar '93

28 Mar '93

-----BEGIN PGP SIGNED MESSAGE----- In the wake of the forced demise of penet.fi, Dave del Torto said: >>> The anonymous service at anon.penet.fi has been closed down. This is a dark day indeed. The forces of Repression are upon us yet again. OK, where do we set up the next one? I guess the solution here is to have a floating set of difficult-to-detect anon remailers and switch between them regularly. I have an idea for making remailers more difficult to find. This applies only to systems where the remailer operator owns the system, such as at wimsey.com. (But a "system" can be just a PC/XT with hard disk and modem - maybe under $1000). Where the remailer operator controls the system, it's easy to "forge" net headers. The problem is that once you send mail, other systems are going to add "Received:" lines to the net headers that point back to you. I don't know how to stop this once the mail leaves your control. But it should be possible to add -extra- "Received:" headers, indicating you received the message from some system "behind" you. Should the "net police" trace an "offensive" message back to you, you can point to the added net headers and say, "Oh, but this came from -him-, not -me-; -I'm- just an innocent forwarder (not remailer) of this message. That SOB down at the end there must be running one of those infernal remailers; Go get him!!" By the way, these phony added headers should all have -real- system names. It's fairly easy to trace messages along the "mainline" internet, because those are all "hard-wired" leased lines. But there's another class of system called UUCP which sends and receives messages over the - -switched- network (ordinary dialup telephone lines). Many of the mainline systems accept UUCP accounts, so UUCP systems usually have the same internet connectivity as the mainline systems for E-mail. (They can't do FTP and Telnet). Furthermore, UUCP systems can allow other systems UUCP accounts, creating long chains over the dial-up net. Furthermore, a UUCP system can be set up with a minimal investment in hardware. A single hardware system can be -many- different UUCP "systems" by just dialing into different UUCP "accounts". A good strategy is to accept mail for remailing at one well-publicized UUCP address, but -never- use that same account for -sending- remailed mail. Just use one of several -other- UUCP accounts for that, adding phony "From:" and "Received:" net headers as explained above. Be generous in accepting UUCP accounts from other systems; don't take too much trouble verifying the registration info they give you. Once they've been on a while, start using their names in the phony "Received:" headers you generate. Well, I'm not an expert on either the net or the "Waffle" software used to run small UUCP systems (like this one). But perhaps the above ideas will prove useful to those of you who are. -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBK7RidN4nNf3ah8DHAQG1/AP/dphEH+j0pou/jZ86PhQEffyVyzcHBm0A lwEnJFhX7RXx3l4RNlhv9dTRwQwaQPiaZ7qfWhdtqIsWwBSD39krfv7RwZDVI6Rs nuzE67BvLljl4N1rEqUdW/ln3gFvUBo/ud+b3DBFJFZEOMRPJFFkE5hux5RBxG+N wk3X28rUUM8= =BVPy -----END PGP SIGNATURE----- -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Silicon Valley, Ca

3 2

Penet.fi replacement up
by Dan McGuirk 28 Mar '93

28 Mar '93

I just wanted to let everyone know that another penet.fi-style anonymous service has been set up. It works the same as anon.penet.fi did for anonymous mail, but it only allows anonymous posting to about ten newsgroups. For information, send a message to "anonymus+info(a)charcoal.com" (yes, anonymous should be misspelled).

1 0