- cypherpunks-legacy - lists.cpunks.org

PGP: informal faq for eknipp
by wcs＠anchor.ho.att.com 04 Mar '93

04 Mar '93

Eknipp asked for an overview of PGP; my reply to him bounced, but it's of enough possible general use that I'm inflicting it on the list. It's rough and rambling, but believe it if you need it...., and please send me any corrections if there are offensive errors. The details of corporate relationships regarding PKP and RSA are especially haphazard. Thanks; Bill -- "He wouldn't have wanted that _thing_ walking around with his name on it" ------ well, here's a rough overview and definitions, ignore the parts you know already. You can get a proper faq by ftp from rsa.com, in the directory pub/faq. Cryptography = writing stuff only authorized people can read. Real crypto depends on algorithms that are secure as long as the Bad Guys don't know the keys, even if they know everything else. Most of the interesting stuff depends on mathematical processes that take exponential amounts of time, so a 56-bit key would take 2**56 attempts to guess - you can't guess it a bit at a time in 56 steps. Factoring large numbers is believed to take roughly expontential time. M = plaintext message Cyphertext C = E(k, M), E = encryption function, k = key. Plaintext M = D(k, C) ITAR - International Traffic In Armaments Regulations - the US has a bunch of laws about exporting munitions, and crypto hardware and software count as munitions - algorithms are OK, but our Benevolent Govt KNOWS that foreigners aren't bright enough to turn algorithms into code. Lots of flamewars discuss exactly the boundaries, and the laws are contradictory about which bureaucrats are really in control, but nobody's wanted to get thrown in jail for arms dealing badly enough to force a court case .... Appears to apply to importing crypto also, though that hasn't been something anybody's made a big deal about. Other countries besides the US may have major restrictions as well. Alice and Bob - the people sending messages to each other. Eve may be eavesdropping, and Charlie may be around also, Secret-Key Cryptosystem, also called Symmetric-key or private-key - the same key k is used for E and D, or at least a closely related key that's easy to derive if you know the other one. DES = Data Encryption Standard = IBM/NSA-designed secret-key system, very widely used, keys 56 bits long which may be a bit short, some people worry there may be an trapdoor put there by NSA, but if I told you I'd have to kill you :-) Banks use it, for instance. IDEA - a Swiss-written secret-key system, maybe more secure than DES, newer anyway. Patented in Switz but not US, easy licensing. Public-Key CryptoSystem - Encryption key ke and Decryption key kd are related, but in a way that you can't determine kd knowing only ke. ke is called the public key and kd the private key - you can publish ke where everyone can see it and encrypt stuff to mail to you, you can decrypt with private key kd. (If you want to reply, you've got to get their public key.) Public-key algorithms are pretty slow, so generally people use create a random secret key, encrypt their message with a secret-key algorithm like DES, and encrypt the secret key with the recipient's public key; recipient decrypts the secret key with his private key, then uses it to decrypt the message. Digital Signatures - if you can do public-key crypto, then you can do the reverse as well to sign a message - you *decrypt* the message with your private key, and the recipient encrypts it with your public key - if it restores the original message, she knows it's good and knows that *you* sent it, because only you have your private key. For speed, you normally make a "hash" checksum of the message, and sign the hash instead of the whole thing. Some public-key algorithms can only be used for encryption, some only for signatures, some for both but you need different keys. MD-4 and MD-5 - Message Digest hashing algorithms from (?) Rivest, which are thought to be unforgeable, unlike the CRC checksums used by many programs which are easily forged. RSA - A public-key algorithm developed by Rivest, Shamir, and Adelman. It's the only well-known public-key algorithm that does everything everybody wants, including signatures and public-key, that's secure enough that you can't crack it as long as you use reasonably long keys. Unfortunately, it's patented in the US, by Public Key Partners, a company R, S, A, and friends started that owns most of the interesting patents related to public-key. On the other hand, to avoid having the NSA classify their patent right when they applied (the NSA can do that), they published the algorithm before applying, which means that it's public-knowledge in most of the world and you can't patent it there, even in places that do allow algorithm patents. Their claims about what techniques their patents cover are *very* broad; if you want to do anything public-key related in the US, you've got to deal with them or carry a BIG lawyer, and so far everybody's chosen to deal with them rather than risk a long expensive difficult court case, or else chosen to ignore or infringe their patent but not sell their products for cash, and hoped to get away with it. RSAREF - an RSA implementation from PKP, which you may use free for personal non-commercial use as long as you agree to follow a set of rules that are much less restrictive than they used to be; you can't export it outside the US and Canada, and can't change the interface without their permission, and a few other terms. Better implementations of RSA's algorithms have been done, but you can use this one free, with their permission. Or you can pay them money and get support for incorporating their techniques into your products. Key certification - Public Keys are usually long - RSA keys are often 1024 bytes. Public keys crypto is only secure if you can be SURE you have the public key for the person you're trying to send a message to, like Bob, and that Eve hasn't handed you HER public key instead - she could be intercepting all your mail to Bob, decrypting it, and re-encrypting with Bob's key. So you need to find a secure way to transmit public keys, where "secure" means it can't be forged without you knowing about it (though anybody can read them.) Publishing in the New York Times classified ads is one approach, as is any other broadcast method you can be SURE everyone gets correctly. Another method is to use digital signatures - somebody you trust, whose public key you can be sure you know accurately, gets Bob's public key from Bob, and signs it with their public-key. Since not everybody knows somebody who knows Bob, the problem can be handled by a chain or hierarchy of key certifications - Charlie signs Bob's, Dave signs Charlie's ... and You know Xerxes yourself. Or George Bush signs all the general's keys, the generals all sign the keys for the colonels under them, the colonels sign for the majors under them, .... and you can check some sergeant's key because it's got a certificate from his lieutenant on up to Bush, and Bush's key is in the Phone Book. PGP - Phil's Pretty Good Privacy program - a nice packaging of this technology that can be used easily to prepare secure email. The original version used RSA and a choice of DES or a home-brew secret-crypto system; the current version uses RSA and IDEA. For certification, the method is non-hierarchical - you have a "keyring" containing public keys you know, maybe with certificates, and you can sign the ones *you* trust and give your signed keyring to your friends. Hierarchies imply the potential for control; this is cooperative anarchy, and there's no chain of people you HAVE to obey to exchange keys. When PGP version 1 first came out, RSA yelled at Phil Zimmerman, the author, and told him he was risking patent infringement lawsuits and such if he didn't cease and desist, so he's no longer distributing it. But some of those SNEAKY FOREIGNERS *somehow* got a copy, and so ongoing development of PGP is taking place outside the US, unhindered by patent problems. Version 2.1 is out, 2.2 real soon. Parts of PGP are probably not covered by PKP's patents, and parts are clearly not covered by ITAR, but some parts are a problem. RIPEM - Mark Riordan's public-key email system, which uses RSAREF to do RSA, so it's legally kosher but not exportable, and is related to the internet Privacy Enhanced Mail stuff that was being developed for a while. Still real new, but probably Pretty Good also; I seem to remember its key certification was more hierarchical. ---- More PGP info - PGP was originally written for a DOS environment (there are problems trusting any system you don't totally control, and it's tough to say you totally control a multi-user system), but it's been ported to lots of things by now, including UNIX and some early Mac ports (work is in progress to make the Mac port feel like Mac-stuff rather than Unix-stuff.) You can get the source, compile it, play with it, and do anything you want that doesn't infringe PKP's patent, so remember not to use it to exchange keys with anyone or send them mail unless you've got a licensing agreement..... Once it's compiled, type pgp -h to get help, and/or read the documentation. Where to get things: The fun place to shop is nic.funet.fi, by anonymous ftp, but if you telnet to an archie server like archie.rutgers.edu (login as archie) you can ask it wher to find anything. Using a US site would be potentially better legally, and also cuts down on the bandwidth used between here and Finland.... Bill Stewart

1 0

META/PERSONAL: Thanks for mailing.
by Alexander Chislenko 04 Mar '93

04 Mar '93

I am grateful to both people who sent me the mail I lost; I don't think I have a right to disclose their identity ;-) but I am grateful to them anyway, as well as to all those who might want to send it to me later - please don't - too bad I'll never know your names... Thanks anyway! BTW, I missed the point when people started using prefixes in message titles; was there an 'official' suggestion for it? Alex.

1 0

REMAIL: updated list
by Karl Barrus 03 Mar '93

03 Mar '93

(I intend to send this message to the list about once a month, or when "emergencies" arise) -----BEGIN PGP SIGNED MESSAGE----- Q1: What cypherpunk remailers exist? A1: The list of cypherpunk remailers known to me: 1: hh(a)pmantis.berkeley.edu 2: hh(a)cicada.berkeley.edu 3: hh(a)soda.berkeley.edu 4: nowhere(a)bsu-cs.bsu.edu 5: ebrandt(a)jarthur.claremont.edu 6: hal(a)alumni.caltech.edu 7: remailer(a)rebma.mn.org 8: elee7h5(a)rosebud.ee.uh.edu 9: phantom(a)mead.u.washington.edu 10: hfinney(a)shell.portal.com 11: remail(a)extropia.wimsey.com NOTES: #1-5 no encryption of remailing headers #6-11 support encryption of remailing headers #2 requires remailing request to appear in header #11 requires text to be encrypted along with remailing request #7,#11 introduce larger than average delay ============================================================ Q2: How do I use the cypherpunk remailers? A2: Instructions and helper scripts are available via anonymous ftp at soda.berkeley.edu (128.32.149.19) in the pub/cypherpunks directory. hal's.instructions instructions on how to use the remailers scripts.tar.Z various Unix scripts to assist remailer use anonmail.arj various MSDOS batch files to assist remailer use /-----------------------------------\ | Karl L. Barrus | | elee9sf(a)menudo.uh.edu | <- preferred address | barrus(a)tree.egr.uh.edu (NeXTMail) | \-----------------------------------/ -----BEGIN PGP SIGNATURE----- Version: 2.1 iQCVAgUBK5U6XoOA7OpLWtYzAQEuJgQAx3qgMv9ZTG0LXWuaUgfT+27NB9gQAFga 8f3L4Ew41JlaIqXAUqo8JUra9NjE9Xrgg5DFN31j1pTiGZOdCUc0qzq+R8Tvw8iC ujWvWKkoVExrPQqyArh+DSDeJdfykopL2I0W7NF0Z66Y13h89aNF1NN6H2W3Pf+I naWmJL6Oxd8= =S3XH -----END PGP SIGNATURE-----

1 0

ANON: un-filterable pseudonyms
by root＠rmsdell.ftl.fl.us 03 Mar '93

03 Mar '93

> In my off-line newsreader, Eudora, (which ironically is also the subject of > the message attached below--must be a plot), it's easy enough to mark all > the stuff from some anonymous site for deletion. This is only possible if there are few, well known, anonymous sites, and/or if all anonymous aliases look similar, such as an1234. How do you know if KSDF32@KMUVAX is an anonymous address, or a real user login? I also expect to see pseudonyms that look like real names. I don't think it would be too hard to pick a random first and last name from a list of real names, and create a From: line like jsmith(a)someplace.edu (John Smith) which will look just like a regular address. Even the remailers that don't create reply-able aliases could generate random real-looking From: lines, just to make the posts look non-anonymous. The only possible solution would be to ignore all messages not from addresses you trust. This is basically the "don't talk to strangers" policy. -- Yanek Martinson yanek(a)novavax.nova.edu

1 0

PGP: Help!
by eknipp＠lobo.rmhs.colorado.edu 03 Mar '93

03 Mar '93

Not to be stupid, but could somebody email me a plainspeak (Ok, I know some UNIX- I'm not *that* outta it) msg on what exactly pgp is, how to use it, and a copy of it. Thanx -- T'han The Unbeliever | "Fear is the mind killer."- Dune eknipp(a)lobo.rmhs.colorado.edu | Nobody believes what I say. | Laugh when life sucks. It helps. Future Autopian |

1 0

ANON: My remailer
by babani＠cs.Buffalo.EDU 03 Mar '93

03 Mar '93

Due to circumstances beyond my control, I have had to take down the remailer that is running in my account. (read: If I put it back up again... my account will be taken away.) I only got a brief message from the system administrator stating "Running anonymous remailers is against University policy." Thus, since my account is more important (considering I need it for projects and the like...) than a remailer, I have taken it down. I'd appreciate it if you spread the word. -- +==== Internet: babani(a)cs.buffalo.edu ===+======== Amateur-Radio: N2LYC ======+ ! Bitnet: V078LNGT(a)ubvms.BITNET | UUCP: rutgers!ub!babani ! ! Alternate: an173(a)cleveland.freenet.edu | Plsure dpnds on the othrs prmison. ! +== PGP key available. (If you don't know what a PGP key is... find out!) ==+

1 0

Re: Handling Abuses of Remailers
by tcmay＠netcom.com 03 Mar '93

03 Mar '93

(Sorry, Cypherpunks, for the ">" in this message--I made the classic mistake of sending this message only to Fen, hence this forwarded form. I'll try to watch this in the future!) >Fen Labalme believes Eric's "penny a hop" is still too expensive, especially >for "the poor": > >>Geeez, Eric! I'd think a penny a hop would be a pretty high price... And >>given that most messages go through two hops, then you'd really be giving >>your 2 cents worth! >> >>Note that there can be about 50 cypherpunks messages a day -- if each went >>through 2 hops at $0.10 / hop, as you proposed, that would be $10 / day in >>revenues for the remailers. Seems like a lot to me. >> >>I would support the idea if I felt that the system would quiet the flame >>wars, but I think rather it would simply quiet the poor... >> >>Fen > >You don't have to support the idea, Fen, you just have to open your own >remailing node! If you think you can do it more cheaply--perhaps subsidizing >the costs from your other income, or perhaps just doing it as charity--you are >completely free to do so. > >The "liquidity" of remailer hops (with the "Mark V" software that handles the >grunge automatically) will be quite interesting to see. Some will go for >minimum cost (one cheap hop), others will route messages through dozens of >hops. > >Services will arise which "rate" the quality of remailers, in terms of >pricing, security, latency, message sizes accepted, past experiences, etc. > >Bandwidths are increasing so rapidly and computer hardware is getting so >cheap, that I doubt even the poorest of the poor, in the U.S. at least, will >be unable to send these kinds of messages. The costs of transmission are just >so trivial compared to other costs that even poor people routinely pay. > >(Whether the poor and downtrodden will _want_ to participate in this Brave New >World is another matter. My guess is they will.) > >-Tim

1 0

REPS: Filters Against Unwanted Messages
by tcmay＠netcom.com 03 Mar '93

03 Mar '93

Attached below is a message wherein the author advertises in his .sig this item: "(anon. postings not read)" Simple, but it gets the point across. Expect to see more such declarations. In my off-line newsreader, Eudora, (which ironically is also the subject of the message attached below--must be a plot), it's easy enough to mark all the stuff from some anonymous site for deletion. Such "filters" are a basic kind of positive reputation system and are in use in many places. Some on this list have asked for this kind of filtering to be incorporated (somehow) into NetNews readers. Maybe this will come someday, but for now the best approach is to simply not read anonymous postings, if that's important to you. I want to also describe an important use of filters: Publishers almost never accept unsolicited material. Manuscripts "thrown over the transom," as the saying goes, are returned _unopened_ or sometimes just thrown away. And the publishers are careful to publicize this fact. Why? Mainly to head off charges that they or one of their writers "stole" an idea. Merely by opening the manuscript's envelope, they are exposing themselves, potentially, to lawsuits from would-be authors who claim to see elements of their ideas in someone else's "Movie of the Week" or Great American Novel. So publishers and editors scrupulously refuse to look at unsolicited manuscripts. (I have heard, anecdotally, that the onset of electronic submissions is causing them great distress. Without the option of "returned unopened," what are they to do? Various cryptographic solutions suggest themselves...this could be a small niche market for some cypherentrepreneur to fill, and could also be a way to get some P-K and reputation-filtering software out in the world.) Some forms of crypto-extortion can be handled the same way. (I described this approach to Dean Tribble a while back.) Simply advertise widely--like in your .sig--that you do not read messages unless they come from known sources. Would-be extortionists ("Deposit 10 kilocrypts in this account or I will do X") come to realize that they cannot easily contact their victim. To be sure, other channels exist (anonymous postal mail, phone calls, routing through other sources, etc.), but the lack of a direct channel makes the initial threat harder to issue. It's a kind of crypto speed bump. This approach, "I don't listen to extortion threats," is akin to "We don't negotiate with hostage takers." Far from perfect, but still a "damping" force. -Tim Here's the posting I cited earlier: >Newsgroups: netcom.general >Path: netcom.com!pfeiffer >From: pfeiffer(a)netcom.com (Kevin Pfeiffer) >Subject: Re: EUDORA for DOS? >Message-ID: <1993Mar3.171249.26738(a)netcom.com> >Organization: Pfeiffer Design Assoc. >X-Newsreader: TIN [version 1.1 PL8] >References: <1993Mar3.062411.9712(a)netcom.com> >Date: Wed, 3 Mar 1993 17:12:49 GMT > > You might look into pceudora... Can't speak for it, but Eudora (Mac) >seems well-designed. No matter what seems to break my connections (me, the >phone company, etc.) Eudora (and unix) leaves my mail intact at Netcom. >Knock on wood. >-- > * Kevin Pfeiffer <pfeiffer(a)netcom.com> (anon. postings not read) * >--

1 0

Re: Let's look at this ....
by fen＠genmagic.genmagic.com 03 Mar '93

03 Mar '93

fergp(a)sytex.com (Paul Ferguson) writes: > The one topic that _does_ interest me is the nonsensical fodder > stemming from a post regarding the (actual?) governmental > consideration to license keys. That just drops my carrier. > This is probably the one reason why I tolerate the wasted bandwidth > here -- there are many powerful souls amongst you (us) who can keep this > bullshit from happening. Me too. It's not the only topic of interest to me, but one that I feel strongly about. Is there any suggested action that we can take? Fen

2 1

Wasted BAndwidth
by kelly＠netcom.com 03 Mar '93

03 Mar '93

Forwarded message: > You are right that because of the right free speach, it is > impossible to prohibit remailers. However, while I don't believe in > prior restraint; but I do believe in personal responsibility. It is > certainly true that it is possible to construct a remailer service, > using cryptography, such that it would be impossible to trace it back to > the original sender. This class of remailer would generally not provide Well Ted I am not here to make ad-hominen attacks AND... there are a number of issues raised... Personal responsibility is a choice accepted by the person exercising THEIR right of free speech... it is important to remember that it is #1 and foremost a CHOICE... you CANT force an attitude of personal responsibility > So in this model, how can you provide personal responsibility? Well, I > would argue that the buck should stop at the remailer site. They are > the closest link to the chain of liability, and they have intentionally > performed measures which make it impossible find the next link in the > chain of liability. So, let the liability rest with the remailer site! > Now, I'm not a lawyer, and as far as I know, this legal theory hasn't > been tested in a court. So only time will tell what happens when these > remailers hit the real world. > > As far as remailers like Julf's are concerned, I very much like the idea > which Tim Moors suggested --- which is to have some method which the > identity between the input and output address could be revealed. This > provides general anonymity, but one that can be breached when someone > has abused that anonymity, as convicted by a jury of their peers. > Perhaps the way this could be reflected into the "real world" legal > system is that remailers which do keep a mapping between input and > output addresses, and which are willing to reveal them under appropriate > circumstances, would be exempt from being held liable for what comes out > of their remailer. > > Perhaps these are not the right sets of tools to be used to provide some > sort of controls over remailers so that the negative effects of these > remailers can be controlled. But it is our responsibility to consider > them, and not just pretend they don't exist. I hope we don't have the > attitude of "Vonce the rockets go up, who cares vere they come down? > That's not my department....." > > - Ted > Ted , you seem more concerned with how you and the particular cabal who agrees with you are going to control how others use their machines and software to ensure THEIR right of choice... Sorry but the attitudes you personally espouse just dont wash in the real world...Liability law is civil LAW... in most cases there are NO treaties between countries for laws such as libel... Anonymity will flourish... and in the VERY near future... it wont be dependent on the good-will of a sysadm or a government... there simply WONT be the means to control spread of anonymity tools Your viewpoint brings to mind an OLD saying "Those who would trade a little freedom for security deserve neither" and I apologize if I have misquoted here...I am afraid the scam of social control and responsibilty that you and others such as government practice and espouse is about over... "may you have an Interesting life" cheers kelly p.s. Atlas is shrugging --

2 1