- cypherpunks-legacy - lists.cpunks.org

RE: S/MIME
by Ian Clysdale 17 Dec '03

17 Dec '03

I'm sorry, but I have to disagree on that one. S/MIME DOES use 40 bit RC2, by the standard, but the standard specifically states the weakness of those keys, and recommends using another implementation. The standard strongly recommends the use of triple-DES, and apparently the Communicator and Outlook S/MIME triple-DES now interoperates properly. Deming has also had a plugin which does triple-DES for quite a while. In addition, individual vendors are allowed to put in any other algorithms into an S/MIME implementation that they desire - for example, the default algorithm in Entrust's S/MIME implementation is CAST-128. The point that I'm trying to make here is that while PGP defines both algorithm and protocol, S/MIME just defines protocol. As long as you have two clients which share common algorithms, then you can use any algorithms that you like with S/MIME. ian ---------- From: Jonathan Wienke [SMTP:JonWienk@ix.netcom.com] Sent: Monday, November 03, 1997 9:34 PM To: Nobuki Nakatuji; cypherpunks(a)toad.com Subject: Re: S/MIME At 08:49 PM 11/2/97 PST, Nobuki Nakatuji wrote: >Is S/MIME secure than PGP ? No. S/MIME uses 40 bit keys, which are trivially breakable by paralell brute-force key search attacks. Jonathan Wienke

2 1

RE: S/MIME
by Ian Clysdale 17 Dec '03

17 Dec '03

This is not true. If you read the S/MIME specs it says one MUST implement the RC2/40 algorithm. A MUST in an RFC has a very definate purpose: If an aplication does not implement all MUST sections of the RFC then it is not compliant! To create an S/MIME compliant application one MUST implement RC2/40 and one MUST pay RSA to do so!! Umm.... If you read what I wrote, you will see that I said "S/MIME DOES implement 40 bit RC2, but it ALSO implements XXXXXXXX. Personally, I'd rather see even weak crypto getting world-wide deployment than seeing no crypto getting out because of stupid draconian export laws. However much you may dislike their "weak crypto", Netscape and Microsoft are getting more seats of crypto-compliant software out there than PGP ever has. And once the infrastructure is out there where everyone can use weak crypto, people will (hopefully) realize that it is insecure, and shift to stronger algorithms that ARE supported currently in domestic US/Canada versions, and which I'm sure someone outside of the States will have coming out in the near future, if they're not already there. Netscape, Microsoft, and RSA are letting thier greed get in the way of developing a message encryption protocol that provides strong crypto to ALL users. Either that, or Netscape, Microsoft, and RSA are being practical and doing something that will legally put SOME cryptography in the hands of everyone today. It's all in how you look at it. ian

2 1

RE: S/MIME
by Ian Clysdale 17 Dec '03

17 Dec '03

There is an old saying in the Security Field: "Poor Security is worse than no security at all". I doubt that you would find few if any that would agree with you that it is a good thing having the masses using weak crypto. At least the US members of the Open-PGP group are willing to sacrifice overseas sales in the effort to provide STRONG crypto to EVERYONE. It is the right thing to do. I am sorry to see that you do not uderstand this. Sorry, I'm going to continue to take a viewpoint that I suspect is rather unpopular in this list, and argue for the advantages of weak crypto in certain circumstances, when it is KNOWN to be weak. The phrase "Poor security is worse than no security" refers to the dangers in assuming that your communications are secure, even when they're not. If you know that your cryptography is weak, it can still sometimes be sufficient for your purposes. What weak cryptography does is protect from passive attacks, such as simple wire-tapping. While an RC2/40 message can be trivially broken in a matter of hours, it can't be broken in real-time. If EVERYONE used even RC2/40, then passive attacks would be foiled, because the <insert evil NSA/CSIS/etc here> just isn't going to bother breaking every single transmitted message. Now, of course, if you're doing something where you don't want your communications to be intercepted under any circumstances, then you want to be using something stronger than RC2/40. However, S/MIME doesn't prevent that at all. DES is a published standard, and I'm waiting for somebody outside of the USA to implement triple-DES with S/MIME. This will inter-operate with Outlook and Netscape clients inside the USA (theoretically). Including a minimum baseline of weak cryptography is NOT denying strong cryptography to everyone. Once the patent on RC2 expires (which is very soon) or if RSA gets dropped on their head and finally does the intelligent move of releasing it to the public domain, then S/MIME provides an expandable infrastructure for secure mail, with a huge user base already out there, and in a form much more spoonable to the unwashed masses. Ian

3 2

No Subject
by bureau42 Anonymous Remailer 17 Dec '03

17 Dec '03

Adam Back writes: > People copy commercial software all the time. I suspect only some > small fraction of personal use software is ever paid for. Companies > are less likely to do this Companies do it because the boss can instruct the underlings to do multi installs and then deny he did so. Doesn't work on pig-headed "Can I have that in writing" types (like me). > One idea which I did like was the open bidding for a product to be > developed, people interested in the feature or product pay how much it > is worth to them up front, developers bid to take the job on. After > it's done the software is freeware. Supporting ideas discussed before > on this topic are that first to complete gets paid, or lowest bidder > presents completion bond, and that there are independent aribitrators > checking quality. > There was someone who posted to the list that he was going to set this > up. He even purchased the domain name if I recall. What happened, > did anything come of it? Bounty Software Group (BOUNTY3-DOM) 818 West Sunnyside, Apt 3b. Chicago, IL 60640 US Domain Name: BOUNTY.ORG Administrative Contact: Petro, Christopher (CP588) petro(a)SUBA.COM 312.784.0099 Technical Contact, Zone Contact: Strasheim, Alex R. (AS55) alex(a)SUBA.COM (312) 929-8008 Billing Contact: Petro, Christopher (CP588) petro(a)SUBA.COM 312.784.0099 Record last updated on 23-Nov-96. Record created on 23-Nov-96. Database last updated on 4-Nov-97 05:29:24 EDT. Domain servers in listed order: SUBA01.SUBA.COM 198.87.202.2 BIRD.SUBA.COM 198.87.202.33

1 0

Re: Forging your return address.
by Toto 17 Dec '03

17 Dec '03

Sympatico Admin wrote: > Hi Larry, > > We have determined that you have be trying set your email program to > be anonymous; ie forging your return address. If you wish to be > anonymous then get a free email account with hotmail.com or rocketmail. Dan, The Sympatico Netscape software you provide has features that allow the user to choose not to give out their email address to those that they wish to keep it from, such as spammers, criminals and sex-shop operators. I have not been made aware of any Sympatico policy which requires your users to make themselves vulnerable to anyone and everyone who has connections to the InterNet. > Your forged reply-to addresses 'fred(a)dev.null' get rejected by our > email system and sit in our mail queue. My chosen reply-to addresses at 'dev.null' are a traditional UNIX method of directing files and email to /dev/null, which is the equivalent of the Trash Bin on a Mac. You seem to have set up your UNIX system to emulate a Win95 Recycle Bin, in that it assumes that the user doesn't know what he or she is doing, so saves deleted items. Dev.null addresses are designed to get rejected by the email system, so it seems rather useless to keep them in your mail queue. > Also please do not set your > email program to relay through someone else's server in another domain as > there have been complaints. We do not allow this to be done from anyone > outside our domain. You will have to explain to me what exactly you are talking about here, as it is unclear to me what you are referring to. Please forward me copies of the complaints. > Please note: this note is being sent to our security dept. as we deem this type > of activity to be mis-use of the mail system and as such you could loose > your access privleges. Since this seems to be of such serious concern to you, I would certainly appreciate it if you could explain to me in greater detail exactly what it is about my use of my account that Sympatico has a policy problem with, and why. > If you have any question or concerns then please reply to this note! I notice that your reply to address, 'Sympatico Admin <deckd>', is not a valid InterNet email address. Is this an internal system address? Toto

3 2

Senate Commerce cmte approves tax freedom bill 14-5
by Declan McCullagh 17 Dec '03

17 Dec '03

[Right now I'm over at the Digital/Altavista summit to discuss rating systems in search engines so I missed the vote. (Barry Steinhardt from the ACLU just finished speaking. Sen. Judd Gregg, a CDA fan, spoke this morning.) This bill limits local and state governments' ability to tax the Net. --Declan] ---- (forwarded to me by a House staffer) >The full Senate Commerce Committee voted today 14-5 to approve an amended >version of the Internet Tax Freedom Act. Here's how members voted: > >14 Yes: McCain, Stevens, Burns, Snowe, Ashcroft, Frist, Abraham, Brownback, >Hollings, Inouye, Rockefeller, Kerry, Breaux, Wyden >5 No: Gorton, Hutchinson, Ford, Bryan, Dorgan >1 Did not vote: Lott

2 1

mixmaster...
by lars.hornell＠ornskoldsvik.mail.telia.com 17 Dec '03

17 Dec '03

Is mixmaster not avalible to download or what??? If it IS avalible to download. Where can I download it then???

1 0

Re: S/MIME
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

William H. Geiger III wrote: > >>There is an old saying in the Security Field: "Poor Security is worse > >>than no security at all". > at 11:24 AM, Ian Clysdale <iancly(a)entrust.com> said: > > > Sorry, I'm going to continue to take a viewpoint that I suspect is > >rather unpopular in this list, and argue for the advantages of weak > >crypto in certain circumstances > This is nothing but selfserving bullshit in a vain effort to justify YOUR > sellout for a paycheck. Nortel is nothing more than a Canadian schill for the SnoopSpooks. Just as the INSLAW Thieves & Murderers used Indian Reservations in an attempt to pretend that they weren't breaking US law because their actions were taking place on the soil of a Soverign Nation, the US criminals use the same bullshit logic to circumvent the laws that apply to their illegal actions. It is no coincidence that Nortel is the nesting place of a wide variety of censorship vermin such as Chris Lewis, and his ilk. An analysis of a number of employees of Nortel and their bum buddies shows that the time spent in their output of UseNet cancels and FUD posts and emails corresponds to the hours of a corporate work schedule. Nortel is nothing more than a front for the SnoopSpooks who want to capitalize on Canada's image as a Soverign Country to push their backdoor products in the global community. These are the same lame fuckers who pulled off this act in Switzerland, with governments and corporations buying security products from a country noted for its neutrality, and then finding out later that it was a front for a German company that had the CIA's nose up their butt. It amazes me that corporations and governments put their trust in any company with the word 'Security' in its name, without doing a check on their backgrounds and connections that is at least as intensive as they would do for a new employee.

1 0

Congress values your opinion
by ed＠justanote.com 17 Dec '03

17 Dec '03

Visit this URL: http://www.netline-to-congress.com/ and cast a vote that really counts.

1 0

UCE - Puts money in YOUR pocket!
by star＠1daystar.com 17 Dec '03

17 Dec '03

*********************************************************************************************************** This list has been run through all known remove lists. If we missed you and want to removed from this list, reply to neweb(a)1daystar.com with "remove" in the subject field. *********************************************************************************************************** Work SMART......not hard! Make $THOUSANDS$ a week and do absolutely NOTHING except pass out this 800 number with your code number. NO SELLING! NO HASSLE! A NO BRAINER!! This company does the selling for you, closes the deal, and sends you your money every Friday. Don't miss this opportunity! Call now! 1-800-811-2141 Code #44737 (This is HOT! If it is busy, keep trying). In Canada call 1-800-588-9786 Code #44737 PS. The company is Fortune 5000. They have been in business 15 months and are registered with the BBB in Junction City, KS.

1 0