- cypherpunks-legacy - lists.cpunks.org

PGP interfaces for MS Internet Mail
by ! Drive 17 Dec '03

17 Dec '03

Does anyone know of any PGP programs that interface well with Microsofts Internet Mail (not Exchange mail) Thanks

1 0

Public domain SHA-1 in C
by Steve Reid 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I've written an implementation of SHA-1 in C. Public domain, so you can hack it to your hearts content and/or use it however you want. You can download it from http://www.edmweb.com/steve/sha1.c It's not hard to use. Allocate a SHA1_CTX, initialize it with SHA1Init() run over the data with SHA1Update() and finally extract the result using SHA1Final(). Or just compile the program as-is and use it to hash files. It's reasonably fast (the 80 core SHA operations look good) but I'm certain that there's room for improvement. Tested under FreeBSD 2.1.0-RELEASE on an i486SX. The three test vectors from FIPS PUB 180-1 hash correctly. ===================================================================== | Steve Reid - SysAdmin & Pres, EDM Web (http://www.edmweb.com/) | | Email: steve(a)edmweb.com Home Page: http://www.edmweb.com/steve/ | | PGP (2048/9F317269) Fingerprint: 11C89D1CD67287E68C09EC52443F8830 | | -- Disclaimer: JMHO, YMMV, TANSTAAFL, IANAL. -- | ===================================================================:) -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: noconv iQEVAwUBMksSsNtVWdufMXJpAQFV3AgApaK+upwWtBJZUwq5Pr4cpvjWQcxFHxv6 XEoZmwgwzR94lpjdEK5GPXt7U9HTp+xiwiaeQ7Hjg+iuR/qtofwZlZhQ5EmyBl2M 8rnFSRgwR4NH1y2PwAxQKSo2SaHU8JZ3X3D6Yk1WXAqk90vN8dzQAIa8B409IuhM tBPixrS6d0KsySSOHQkWO7Mqij43wZOnrgikJF3IDCvSf0us8gGC9wZjdIax3Rgr soswtQvT6QpZDZ/+39UiA2RSMFuER/S3NbZZSJdfIGK1XzUeU2MUC4NmURlc/ntz 3B1pd+jovxuHW1D/TQ2jHSIdg1Yol/zeu1OeuuhL37QOQAVkupgVUA== =B73M -----END PGP SIGNATURE-----

2 1

CWD -- Wiretap In the Night
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Thu, 26 Sep 1996 16:32:01 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: fight-censorship(a)vorlon.mit.edu Subject: CWD -- Wiretap In the Night CyberWire Dispatch // September // Copyright (c) 1996 // Jacking in from the "Smoked Filled Room" Port: Washington, DC -- Federal provisions funding the digital telephony bill and roving wiretaps, surgically removed earlier this year from an anti-terrorism bill, have quietly been wedged into a $600 billion omnibus spending bill. The bill creates a Justice Department "telecommunications carrier compliance fund" to pay for the provisions called for in the digital telephony bill, formally known as the Communications Assistance in Law Enforcement Act (CALEA). In reality, this is a slush fund. Congress originally budgeted $500 million for CALEA, far short of the billions actually needed to build in instant wiretap capabilities into America's telephone, cable, cellular and PCS networks. This bill now approves a slush fund of pooled dollars from the budgets of "any agency" with "law enforcement, national security or intelligence responsibilities." That means the FBI, CIA, NSA and DEA, among others, will now have a vested interest in how the majority of your communications are tapped. The spending bill also provides for "multipoint wiretaps." This is the tricked up code phase for what amounts to roving wiretaps. Where the FBI can only tap one phone at a time in conjunction with an investigation, it now wants the ability to "follow" a conversation from phone to phone; meaning that if your neighbor is under investigation and happens to use your phone for some reason, your phone gets tapped. It also means that the FBI can tap public pay phones... think about that next time you call 1-800-COLLECT. In addition, all the public and congressional accountability provisions for how CALEA money was spent, which were in the original House version (H.R. 3814), got torpedoed in the Senate Appropriations Committee. Provisions stripped out by the Senate: -- GONE: Money isn't to be spent unless an implementation plan is sent to each member of the Judiciary Committee and Appropriations committees. -- GONE: Requirement that the FBI provide public details of how its new wiretap plan exceeds or differs from current capabilities. -- GONE: Report on the "actual and maximum number of simultaneous surveillance/intercepts" the FBI expects. The FBI ran into a fire storm earlier this year when it botched its long overdue report that said it wanted the capability to tap one out of every 100 phones *simultaneously*. Now, thanks to this funding bill, rather than having to defend that request, it doesn't have to say shit. -- GONE: Complete estimate of the full costs of deploying and developing the digital wiretapping plan. -- GONE: An annual report to Congress "specifically detailing" how all taxpayer money -- YOUR money -- is spent to carry out these new wiretap provisions. "No matter what side you come down on this (digital wiretapping) issue, the stakes for democracy are that we need to have public accountability," said Jerry Berman, executive director of the Center for Democracy and Technology. Although it appeared that no one in congress had the balls to take on the issue, one stalwart has stepped forward, Rep. Bob Barr (R-Ga.). He has succeeded in getting some of the accountability provisions back into the bill, according to a Barr staffer. But the fight couldn't have been an easy one. The FBI has worked congress relentlessly in an effort to skirt the original reporting and implementation requirements as outlined in CALEA. Further, Barr isn't exactly on the FBI's Christmas card list. Last year it was primarily Barr who scotched the funding for CALEA during the 104th Congress' first session. But Barr has won again. He has, with backing from the Senate, succeeded in *putting back* the requirement that the FBI must justify all CALEA expenditures to the Judiciary Committee. Further, the implementation plan, "though somewhat modified" will "still have some punch," Barr's staffer assured me. That includes making the FBI report on its expected capacities and capabilities for digital wiretapping. In other words, the FBI won't be able to "cook the books" on the wiretap figures in secret. Barr also was successful in making the Justice Department submit an annual report detailing its CALEA spending to Congress. However, the funding for digital wiretaps remains. Stuffing the funding measures into a huge omnibus spending bill almost certainly assures its passage. Congress is twitchy now, anxious to leave. They are chomping at the bit, sensing the end of the 104th Congress' tortured run as the legislative calender is due to run out sometime early next week. Then they will all literally race from Capitol Hill at the final gavel, heading for the parking lot, jumping in their cars like stock car drivers as they make a made dash for National Airport to return to their home districts in an effort to campaign for another term in the loopy world of national politics. Congress is "going to try to sneak this (spending bill) through the back door in the middle of the night," says Leslie Hagan, legislative director for the National Association of Criminal Defense Lawyers. She calls this a "worst case scenario" that is "particularly dangerous" because the "deliberative legislative process is short-circuited." Such matters as wiretapping deserve to be aired in the full sunlight of congressional hearings, not stuffed into an 11th hour spending bill. This is legislative cowardice. Sadly, it will most likely succeed. And through this all, the Net sits mute. Unlike a few months ago, on the shameful day the Net cried "wolf" over these same provisions, mindlessly flooding congressional switchboards and any Email box within keyboard reach, despite the fact that the funding provisions had been already been stripped from the anti-terrorism bill, there has been no hue-and-cry about these most recent moves. Yes, some groups, such as the ACLU, EPIC and the Center for Democracy and Technology have been working the congressional back channels, buzzing around the frenzied legislators like crazed gnats. But why haven't we heard about all this before now? Why has this bill come down to the wire without the now expected flurry of "alerts" "bulletins" and other assorted red-flag waving by our esteemed Net guardians? Barr's had his ass hanging in the wind, fighting FBI Director Louis "Teflon" Freeh; he could have used some political cover from the cyberspace community. Yet, if he'd gone to that digital well, he'd have found only the echo of his own voice. And while the efforts of Rep. Barr are encouraging, it's anything from a done deal. "As long as the door is cracked... there is room for mischief," said Barr's staffer. Meaning, until the bill is reported and voted on, some snapperhead congressman could fuck up the process yet again. We all caught a bit of a reprieve here, but I wouldn't sleep well. This community still has a lot to learn about the Washington boneyard. Personally, I'm a little tired of getting beat up at every turn. Muscle up, folks, the fight doesn't get any easier. Meeks out... ------------ Declan McCullagh <declan(a)well.com> contributed to this report. ###

1 0

Re: An idle thought on CBC and block lengths
by craigw＠dg.ce.com.au 17 Dec '03

17 Dec '03

Well I do believe that your spam would be illegal if that was the case. And secondly there are no laws here in australia that you can use to prosecute me from the US for an email bomb, not that this is one, and if it is than so is your spam. >> It is illegal to use a invalid return email address. If this continues, I >> will >> be forced to prosecute the return email address - which they are >> making to look like you. >Is it? I beleive that if you look closely, you will discover hat all the >laws which would have made lying illegal on the 'Net have now been >repealed by more Federal judges than I can count on 1 hand... ,'~``. \|/ ,'``~. (-o=o-) (@ @) ,(-o=o-), +--.oooO--(_)--Ooo-----oOO-(_)-OOo-------oooO--(_)--Oooo.------+ | | | Soon, we may all be staring at our computers, wondering | | whether they're staring back. | | | | [Network Admin For WPA Business Products. aka doshai >;-) ] | | .oooO http://pip.com.au/~doshai/ Oooo. | | ( ) Oooo. .oooO ( ) | +-----\ (----( )-------oooO-Oooo--------( )--- ) /---------+ \_) ) / \ ( (_/ (_/ \_) Key fingerprint = 2D F4 54 BB B4 EA F1 E7 B6 DE 48 92 FC 8D FF 49 Send a message with the subject "send pgp-key" for a copy of my key. (if I want to give it to you)

1 0

NIST conference
by P. J. Ponder 17 Dec '03

17 Dec '03

Following is an announcement about a NIST conference on leveraging the distributed nature of the Internet to accomplish tasks that might be otherwise not feasible. The abstract notes that this type of activity has 'important economic, social, and political consequences'. This may already be old news, I was off the list for the past few days. Date: Thu, 26 Sep 1996 15:18:08 -0400 From: Liz Lennon <elizabeth.lennon(a)NIST.GOV> Subject: Cyber Conference Announcement To: csl-bulletin(a)NIST.GOV >Return-Path: <moline(a)sst.ncsl.nist.gov> >Date: Thu, 26 Sep 1996 15:00:46 -0400 (EDT) >From: Judi Moline <moline(a)sst.ncsl.nist.gov> >Subject: Cyber Conference Announcement >To: elizabeth.lennon(a)NIST.GOV >Cc: moline(a)sst.ncsl.nist.gov > > >Event: Conference on Leveraging Cyberspace > >Date: October 8-9, 1996 > >Purpose: People with shared interests are using the Internet to >solve problems, accomplish tasks, and create resources that would be well >beyond the reach of any one person or organization. The ability to leverage >the efforts of large numbers of networked users has important economic, >social, and political consequences. This conference is designed to explore >this phenomenon from both a technical and social science perspective. >Additionally, the closing session of the conference will cap off several >weeks of virtual discussions on the conference's web site. > >Location: Xerox Palo Alto Research Center (PARC) > Palo Alto, Calif. > >Keynote by: John Seely Brown, Vice President and Chief Scientist, > Xerox > >Program: Web: http://nii.nist.gov/cyber/cyber_conf.html > >Registration: $200 > >Sponsors: White House National Economic Council > Commerce's National Institute of Standards and > Technology > Xerox Palo Alto Research Center > >Technical contact: Judi Moline, NIST > (301) 975-4601 > email: jmoline(a)nist.gov > >Information: Web: http://nii.nist.gov/cyber/cyber_conf.html > >To register: Print registration form from web site and return with > payment to: > Office of the Comptroller > NIST > A807 Administration Building > Gaithersburg, Md. 20899-0001 USA > > Or fax to: > Lori Phillips, NIST > fax: (301) 948-2067 > > Or: > Lori.Phillips(a)nist.gov > > >

1 0

Re: Hallam-Baker demands more repudiations or he'll write!
by jim bell 17 Dec '03

17 Dec '03

At 04:51 PM 9/26/96 -0700, Declan McCullagh wrote: >Anonymity and nonescrowed crypto are the linchpins of AP and its more >general case, Maysian crypto anarchy. The withering of the nation-state. >Whatever you want to call it. >To prevent it, governments will ban both. A criminal law, passed in the >wake of say a bombing this fall in Washington, DC, banning nonescrowed >crypto. (Freeh will assert he has evidence the terrorists used PGPhone.) >And another law banning online anonymity. >What then, Mr. Bell? While we should continue resist such developments, I (like many others) tend to believe that the government is going to have a great deal of difficulty implementing such restrictions, for reasons which have been discussed here ad nauseum. I happen to believe that the really crucial reason Clipper was proposed is so that it would exclude non-escrowed encryption using market forces, because they understood that banning encryption or non-escrowed encryption would be essentially impossible. Remember the VHS/Beta VCR wars? With a fairly equal market in about 1978, Beta died 10 years later because the market couldn't support two incompatible standards. It wasn't that one was dramatically better than the other, it was simply that having two standards forced the market to duplicate stocks, for the machines as well as tapes, particularly pre-recorded tapes. Notice, however, that VCR's are relatively "isolated": It doesn't really matter if you have one format and your neighbor has another, unless you want to swap tapes. But crypto telephones inherently require (in the long term) full intercompability. If you didn't have that, there'd be half a world of people you couldn't call! (This kind of situation is remeniscent of a recollection my mother has of a small town she grew up in, in which there were two competing telephone companies serving the same area, but customers of company "A" couldn't call company "B." The most popular girl in town was the daughter of a doctor, who as a consequence of his profession had telephones from both companies. That girl was constantly being called to relay information between people on opposite telephone companies!) The government understood this, and realized that the best way to derail the advent of a good crypto telephone standard was to produce one of their own, which they figured would pre-empt and kill off any competing system. It turns out that an essential element to this killing-off process is to ensure that the telephones aren't compatible, so I was a bit surprised to have to wait a long time to hear that one of the requirements for Clipper-phone approval is that they NOT co-operate with non-escrowed telephones. (I was surprised to have to WAIT to hear this, NOT that they said it eventually...) I think they realize that Clipper was their last opportunity to implement a de-facto market ban on good encryption, but it isn't working. As for a ban on anonymity I don't think that'll fly either. There are too many interactions we do today (off the 'net as well as on) which are already anonymous, even if we don't normally think of it that way. Visit a theater, pay cash, and nobody records your name, for instance. Buy groceries, pay cash. Throw coins in toll booth. Put coins in Coke machine, ride on bus, etc. It would be very hard to prohibit non-anonymous interactions on the net, with so many opportunities for unrestricted anonymity. There's even less reason to ID non-economic transactions too. Since most interactions on the 'net are not a financial transaction, there is even less reason to identify the people involved. So at the risk of being overly optimistic, I think the government isn't going to be able to pull off the kind of anti-crypto/anti-anonymity coup you describe. But nevertheless, I think that if they "progress" towards that goal against the odds, that could easily be an excellent justification for actions which you know they'll describe as "terrorism." Jim Bell jimbell(a)pacifier.com

2 1

NISSC
by jya＠pipeline.com 17 Dec '03

17 Dec '03

The National Information Systems Security Conference in Baltimore on October 22-25 is bountifully described at: http://csrc.nist.gov/nissc/program Section No. 10, Solutions, will interest those who want a peek at what the Puzzle Palace gang is up to. The other nine sessions cover everything the info-sec gov-biz wants to do to make the infoworld safe from everyone except them.

1 0

Re: CWD--Wiretap In the Night
by jya＠pipeline.com 17 Dec '03

17 Dec '03

Adding to the CWD wiretap alarm by Brock and Declan: The Washington Post, September 26, 1996, p. A30. Wiretaps and Money Bills [Editorial] Legislators who have pet projects but not enough support to get them passed have a way of turning desperate during the closing days of the congressional session. Their thoughts turn ineluctably to unrelated appropriations bills. Only last week, Rep. Frank Wolf used the transportation funding bill as a vehicle for usurping the courts' role in a specific domestic relations dispute. Now senators working on the Commerce, State and Justice appropriations bill have slipped in provisions relating to wiretaps that have been before the Congress for 18 months but have not been adopted. The law should not be changed by means of these stealthy riders. One of the substantive changes in the criminal laws ordered by the money committee, for example, would make it easier to obtain court orders authorizing "roving" wiretaps. This would permit putting taps on any phone a suspect might use -- including unspecified public phones -- without requiring, as the law now does, that the government show that the suspect is attempting to thwart a home or office tap by repeatedly changing phones. This may or may not be reasonable, but Congress considered and rejected it earlier this year. It shouldn't be shoved through on an appropriations bill. The committee bill also increased the number of crimes for which a wiretap can be issued, adding a list of new, relatively imprecise offenses related to terrorism such as "providing material support to terrorists" and "terrorist acts transcending national borders." Taps already are allowed for just about every major crime in which a terrorist might engage, including bombing, arson, murder, kidnapping, extortion, espionage, sabotage, treason, hostage-taking and the destruction of trains ships, aircraft and aircraft facilities. What, then, is the reason for adding these new elastic terms, which could include far less serious offenses that someone thinks might be linked to terrorism? The committees that dealt with the subject in April did not see fit to do so. Why now has the Appropriations Committee intervened? The competing values of security and privacy rights require a much better sorting out. It's best done by people who have had the benefit of relevant testimony and experience. The appropriations committees are the wrong setting to deal with such questions, which should not be presented in a take-it-or-leave-it package with the government's continued operation at stake. [End]

1 0

Re: Cuba, Iraq, AP...
by James A. Donald 17 Dec '03

17 Dec '03

At 09:08 AM 9/26/96 -0500, Phil Fraering wrote: > Shortly after the Gulf War elements in the Iraqi military tried to > overthrow Hussein; they apparently tried to co-ordinate with the U.S., who > tried to co-ordinate with Saudi Arabia, who warned Saddam that there was > going to be a coup attempt; gotta stop that Ol' power vaccuum... > > The fact that the people who performed the Bay of Pigs were enticed into > it by promised but withdrawn U.S. military support is a matter of public > record; would Castro still be in power had the United States not > (intentionally? I don't know) destroyed the core resistance against him > in that fashion? Two rulers, one of whom is a communist, have more in common than two communists, one of whom is a ruler. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Is "Black Unicorn" a lawyer, or just a nym used by a lawyer?
by Bill Stewart 17 Dec '03

17 Dec '03

Tim May said, in a discussion on another topic While BU is a lawyer, and I am not, I maintain [........] Is it correct to say that "Black Unicorn is a lawyer", or only that the nym "Black Unicorn" is used by a person who's a lawyer under another name? "Black Unicorn" at least doesn't appear to be a _practicing lawyer_, though maybe [name used for legal work by person who also uses nym "Black Unicorn"] is a practicing lawyer. Tim's signature file no longer asserts that he's a Licensed Ontologist, but this seems to be the kind of question you'd ask a L.O. if you knew one. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

4 4