- cypherpunks-legacy - lists.cpunks.org

Distributed distribution of PGP 2.2
by grady＠netcom.com 27 Mar '93

27 Mar '93

Since most of us live in widely-separated places, it might really help broaden the popular support and use of PGP by distributing it to your local BBS. Most of these people are disjoint from Unix people with Internet connections and so would welcome access to whatever versions and platforms of PGP you can upload. I've just finished uploading the MSDOS, Mac, and Unix (with source) versions to the local rural BBS. If many people did the same for their areas it is hard to imagine how PGP could ever be "stamped out". Lists of BBS for your area code are available from your favorite platform archive site. Not negligibly, many more people exposed to and using PGP means that many more eyes and fingers finding bugs, suggesting patches and improvments and generally playing with the PGP concept. Apple Computer is reputed to be readying the release of their new "cyclone" computers during the next month or so. This top-end line of machines has been said to incorporate licensed RSA technology at the operating system level. With the usual marketing hoopla this will mean that security in general but specifically RSA and public key technologies will get a big public push. It would be great if at the time of this marketing blitz people could turn to their local bbs and satisfy their curiosity about RSA and public keys with PGP 2.2... -- grady(a)netcom.com 2EF221 / 15 E2 AD D3 D1 C6 F3 FC 58 AC F7 3D 4F 01 1E 2F

1 0

Re: How secure is an anonomous mail-server
by Peter Honeyman 27 Mar '93

27 Mar '93

one way to defeat traffic analysis is to maintain a steady stream of traffic. to this end, avi and i are considering a "remailer tax" -- if you send a message through a remailer, you pay a tax of (say) ten additional messages sent and ten received. so if you send a message via a remailer, your software is obliged to send out an additional ten nonce messages, spaced out over time. that's not so onerous ... but those messages have to *go* somewhere, so you will also be taxed by receiving ten nonce messages. this remailer tax is not completely thought out ... what do you think? if remailers catch on, the nonce traffic can be cut back. i'm also still enamored of the probabilistic remailer notion i proposed a few months ago, where a remailer flips a coin to determine whether to deliver a message to it's destination or whether to throw it back into a pool of like remailers. peter

1 0

PGP: Key Updates
by edgar＠spectrx.Saigon.COM 27 Mar '93

27 Mar '93

-----BEGIN PGP SIGNED MESSAGE----- I'm re-posting my 512 and 1024 bit public keys. They haven't changed, but some new signatures have been added. - --Type bits/keyID Date User ID - --pub 1024/87C0C7 1992/10/17 Edgar W. Swank <edgar(a)spectrx.saigon.com> - --sig AF00E5 David Del Torto <deltorto(a)aol.com> - --sig DD98D9 Vesselin V. Bontchev - -- <bontchev(a)fbihh.informatik.uni-hamburg.de> - --sig 67F70B Philip R. Zimmermann <prz(a)sage.cgd.ucar.edu> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.1 mQCNAirfypkAAAEEAKe2jziPeFw6hY19clR2GtQ4gtGCSSVOTgPKEJzHfuC74Scf 9PEuu1kebLhHk43A9wo1vr52o4jpH/P/tnFmRtBQOMzLUzAt5rMucswtSVviMQS2 hBuc9yGJKWHVcyfA79EARKEYTdhx+2qKI+hFJcPE+rmD8wVoF94nNf3ah8DHAAUR tClFZGdhciBXLiBTd2FuayA8ZWRnYXJAc3BlY3RyeC5zYWlnb24uY29tPokAlQIF ECuXMhOhwThfSq8A5QEBqF0D/itGhJWncb4qLTC+RwC+mfC3u9IRikddKTKgLwt0 Cqz1t+3k0NM7KSDDkfWoUbUOiqTqhHTLFjST3V5WgFVyUtYNv3iw07cmMcko79B0 4OKTkOmZcSdCEF8uW6O5iQK0mOgG/X5B0iaee/1o2J0a4sCd429n5Q02p8TchFKH M3DciQCVAgUQK2PmLDZWl8Yy3ZjZAQEMRgP/aIwyaXrl4Vo1as0/tptiHxBbf4ye PKXkI2kCMaTF6OYibidkqpQc3kO4bOkkOey1HBvPp1pcrXldygzWbyC6G7pTMjAe z36FsoTqKdMLPgLSYTnk9Ka8X96ON7GcbOyIWm4WeM3+xGtIdznt+U4hRYEJkPwe LPPdpgHGa/AnzreJAJUCBRArERcc4nXeDv9n9wsBAbJiA/9qly/1XYxscWBTSGXQ PgwuoaMFF5R8OujFAKyCxNv/SevVb3KW0Eypg+APtOEsB/avEg81sbIPtVQDbstP BBNLqfaZu2Qc68ZBXDsnYbBMDrfX0Z/RCd7QzWHtUlaMVfRXOO6H+eTpu3Eza5Mt IXadSwNd7n/03ld56wWGttc2sw== =F7iK - -----END PGP PUBLIC KEY BLOCK----- - --Type bits/keyID Date User ID - --pub 512/4F0C47 1992/09/26 Edgar W. Swank <edgar(a)spectrx.saigon.com> - --sig! DD98D9 1993/02/02 Vesselin V. Bontchev <bontchev(a)fbihh.informatik.uni-hamburg.de> - --sig! 67F70B 1992/10/14 Philip R. Zimmermann <prz(a)sage.cgd.ucar.edu> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.1 mQBNAirEvxwAAAECAMUkLHrx6JH45BMd4bxZDNQO3HrLmhZSvsHJzLH9+90BTbuX 3Kvo0pSLCh98m2Abu/LtoHDggJOKxRGee+5PDEcABRG0KUVkZ2FyIFcuIFN3YW5r IDxlZGdhckBzcGVjdHJ4LnNhaWdvbi5jb20+iQCVAgUQK27LwjZWl8Yy3ZjZAQHi 5AP6AwciH+ZSRaeBF0Qrt6yNOTkYiM4BxyKQ3GldPbcXlIU9p2fSsaMHzGwnn4ka hekEWAXM76PR3i/wwrFKehwCBrRqawUKZZonomDAQYkmQoVVTU/PWCvv8XveDaOb NMEAJ1klELvORoCx+HMirJPzLD0GQHCaZFmnmPHfQYn8T7SJAJUCBRAq27WH4nXe Dv9n9wsBAWCcBACNGUqaZK8MxlRYozYFAWamocGJoKDs4soQWeD2lkbHarNgcJk4 v5r0DR7E309EC1XpsSb34XxWg4SlXIXfjpcnDATV7/XcgRMcWLsl319uOzDy+hAW rPr1fanzGgQvFi2pKXB85DdLsk7LLHj+nTh8b8lm5EmJxVpQhGUMock8nQ== =XtlP - -----END PGP PUBLIC KEY BLOCK----- I can receive messages encrypted with either key, but I will usually -sign- messages with the 1024-bit key. -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBK7RY1N4nNf3ah8DHAQHB4QP+LE70bsNtOy1TjpV73P5xHHib4wH/LGX5 rMoU5w8t4p8q8OCUhUaQG5OmtE79nZFt2q49rIg9FQZH1NlhKlfpZa5JSCMcs4Ls IOY2BKDw2voxAIpooueqUTHMwRNGakMA3utUnVTQ8gf001Ie8GRpdomDxbsmW6uG PtXkyQpuRQo= =TGiw -----END PGP SIGNATURE----- -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Silicon Valley, Ca

1 0

Re: your note on sci.crypt
by John Coryell. 27 Mar '93

27 Mar '93

Very nicely stated, Phil. John Coryell.

1 0

Comments on anonymous servers
by Lord Krieg 27 Mar '93

27 Mar '93

-----BEGIN PGP SIGNED MESSAGE----- Joe Thomas has suggested that a group of penet-style anonymous servers be set up to act as "front ends" for the Cypherpunk remailers. This seems like a good idea (provided that the technical problems can be overcome), but I'd like to propose an addition. Having more than one of the penet-style front ends active at once will only provide more targets for (anonymous) net.fascists. I suggest that instead of having a handful of front ends operating, have only one front end actually operational at a time. Other servers would be on standby, and would constantly update their database with the active server. That way, the moment someone trashed the active server, another could be activated. This way the service would be interupted only briefly. Since it has thus far taken some time for anonymous servers to be brought down, this should allow the front ends to keep up. If someone out there trashes a new front end every month, we would only need to find a new server every month, with a "cushion" of servers waiting on standby. Now, as I understood the suggestion from Joe Thomas, the Cypherpunk remailers behind the front ends would only be "visible" to the people involved in running the service. This would certainly make the remailers more secure, since the net.fascists would not know who to terrorize to can the remailers. Although I certainly may be misunderstanding something, I don't really see why the users of the service would ever need to see a message about "if mail to here bounces, try there." Shouldn't the loss of a remailer be dealt with entirely "behind the scenes," by the service administrators? If I've said something really stupid or obvious here, please bear with me. The whole idea of anonymity only became of interest to me a few days ago. (It's amazing how badly some people react to fascist slime telling them they can't do something, even if they never thought of doing it before.) Kenneth G. Hagler ********************************************************************** * Internet: cvadsaav(a)csupomona.edu * My insurance company * * Phone: (909) 865-7751 * is Beretta U.S.A. * * PGP 2.2 key available on request * * *--------------------------------------------------------------------* * ...study of the military arts will make one who is naturally * * clever more so and one who is born somewhat dull rather less * * so. * * --Daidoji Yuzan Shigesuke, _Budo Shoshinshu_ * ********************************************************************** -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBK7PzpiipatcRAyu9AQGqfAQAlO2qB1QkrUg4oRA03nQw3qhPnIz8GpQt jFBKGdlXFYgVRbVQsG2ZvkUFwSZe9UOnFn8YXsCimRKA/9V7L0tpIeDRdAJvApvs Wfg0AsJ0toV+O8M1zw0Rfni1zy/HBvfJbc9rAJoRKR+3JaeFoqNI3KZ68jqa5Lk4 Lm7EYHHQXT0= =aB5h -----END PGP SIGNATURE-----

1 0

Availability of filtering scripts
by stig＠transam.ece.cmu.edu 27 Mar '93

27 Mar '93

In message <9303260732.AA23550(a)soda.berkeley.edu> you write: >Were such a utility posted to alt.sources, and if all a user had to do >was ftp it from an archive, unpack it, and run it once, we would be in >a much better position politically, (even if the utility received very >little use). > >It is difficult to install mail filters. Our argument for user >filtering would be much stronger if installation were simple. > >A similar argument holds for anonymous posting filters in a global >KILL file. > two points: 1. An even more convienient way to distribute this filter would be by having it available from the anonymizing server itself. Mail to filter-request(a)anon.foonet.bar to get a copy. This is better for sites that do not have ftp available. 1.5 A variant on this approach would be for the server itself to do the blocking of mail. Mail to block-my-mail(a)anon.foonet.bar. Would prevent that server from sending anonymous mail to you. (the server would, of course, send a receipt for the transaction to the user who's mail is blocked...just in case of request forgery.) 2. This would be a political win, but it would really be just a step in the right direction since many people don't read their mail from UNIX boxes.... PCs, Macs, Fidonet boards, VMS, etc. Stig

1 0

Re: Many Important Items in the News
by peter honeyman 27 Mar '93

27 Mar '93

this seems to have fizzled out somewhere along the line. ------- Forwarded Message Date: Thu, 25 Mar 93 11:54:30 EST From: Peter Honeyman <honey(a)citi.umich.edu> Subject: Re: Many Important Items in the News To: cypherpunks(a)toad.com marc, if article cancellation is made cryptographically secure, there is the possibility that articles can be made uncancellable. of course, if there is some wild card that allows the backbone cabal to cancel articles remotely and after the fact, then i suspect usenet will remain vulnerable to forged cancellation messages. but maybe not. i see your point about backbone admins refusing to traffic in certain kinds of messages, but as a veteran of usenet from before it was even called usenet, i assure you that other admins would quickly fill in the gaps in connectivity. this has happened many times. i don't agree, btw, that we can rely on the backbone admins to be very strong supporters of speech, nor should we. as for "the guy with the disk" wanting macpgp to go away, that's not what happened here. everyone i've talked to that has a direct role in the decision agrees that there is a valid research and education function served by distributing macpgp. ah well, sometimes the dragon wins. and regarding the network providers decision to pull penet's plug, i believe this decision was based principally on the opinion of ... how did julf put it? ... oh yes, "a very well-known and extremely highly regarded net personality" (i doubt that i would regard him as a strong supporter of free speech, btw). i suspect that when we get to the bottom of this, we'll discover that many people's interests were being represented without their knowledge, assent, or agreement. regarding your comments about net abuse and megabytes of trash, i agree that we need to brainstorm and find ways to address these problems. i am optimistic that technical solutions hold a lot of promise; it's just a matter of discovering them. let's put our shoulder to the wheel! peter ------- End of Forwarded Message

3 3

Remailers
by rubin＠citi.umich.edu 27 Mar '93

27 Mar '93

I contacted Eric Hughes, and he suggested that my question was of general enough interest to share with the group. Here is my question followed by Eric's response: ---------- Hi, You pointed me in the direction of hal's remailer at soda.berkeley.edu:pub/cypherpunks and I have the code now. However, since I'm not that familiar with perl, I'm having trouble figuring out exactly how it works. Do you know if anyone has written a technical description of how the remailer works? I would like to build a remailer too, and I wanted to try and understand how Hal's remailer works first. Also, do you know if there is code available for any other remailers in shell script or C? Thanks a lot, Avi Rubin ----------- Chael Hall wrote a remailer in C. He should be willing to share his code. Ask on the list. The question you asked me about understanding the remailer operation is of general enough interest that you ought to just ask the list at large. In specific, I don't know of any such theory of operation. Eric

3 2

Re: we need a faq.
by tcmay＠netcom.com 27 Mar '93

27 Mar '93

J. Michael Diehl writes: >I will mantain the faq if people will send my usefull information, such as ftp >sites, remailer-reposter sites, short answers to "obvious" questions, etc. I >will mail it out on a regular basis and perhapse to new subscribers, if that is >possible. > >Come on folks give me a hand here! ;^) The problem with FAQs is that someone almost always volunteers to put together a FAQ if people will "send them stuff." Then he realizes what an enormous job it is, as the submissions are either a) not there, b) are too brief or confusing, c) require lots of editing, or d) other problems exist. Then that volunteer just sort of lets it all slide--and several months later some new eager beaver makes a similar proposal. I've seen this happen on several groups and mailing lists. Someone on this list boldly stepped forward last September, begged for submissions (some of us even sent stuff in), then let it slide. Officially, I suppose he is still working on it, but nothing has appeared. I'm not holding my breath. Since we are an anarchy, nobody can force him--or you, for that mattter--to finish it. The way FAQs traditionally get done is for someone to just write the whole damn thing...this will of course mean that someone must become quite knowledgeable about remailers, PERL, Chaum's work, the math of crypto, the politics and jargon of crypto privacy, and on and on. Not trying to scare you off, just pointing out that a FAQ will not write itself, nor can you count on others to "contribute" (for the reasons mentioned above). (Sometimes a "stone soup" approach works, where a "Rev. 0" FAQ is posted and then the critics come out of the woodwork to suggest improvements. If I was writing the FAQ, that's how I'd approach it...just get *something* out as quickly as possible and then see if anyone wants to change anything or make additions.) If you publicly announce your plans to do the FAQ, and begin soliciting contributions, PLEASE make sure it gets finished! By the way, in my opinion, the Cypherpunks FAQ is *essentially* available already in the regular postings of list members Lance Detweiler (he posts a long article to sci.crypt describing privacy on the Internet) and Karl Barrus (he keeps an updated list of remailers). Good luck. -Tim May -- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: MailSafe and PGP available.

1 0

How secure is an anonomous mail-server
by baumbach＠atmel.com 27 Mar '93

27 Mar '93

Suppose somone wanted to compromise an anonomous mail-server. Couldn't it be possible without the owner of the mail-server knowing? The attack might consist of monitoring all traffic to and from that address. Unless the server waits a long and random time to forward the incoming mail, couldn't a mapping be made of real-name/possible-anon-names? If a users uses the same anonomous name for long enough (2 times?) couldn't the attacker be very confident of the mapping? If the attacker uses the server themselves creatively, wouldn't the task be even easier? This seems like a simple cipher easily broken. I am new to this, so I appologize if this is a dumb question. Peter Baumbach baumbach(a)atmel.com

3 2