- cypherpunks-legacy - lists.cpunks.org

Re: Having your own computer means never having....
by khijol!erc 17 Dec '03

17 Dec '03

> Actually, Apple has some really good concepts, using AOCE digital > signatures and products currently out for the corporate environment. The > automatic routing of digitally signed forms from one desk to another, with > the appropriate digital signatures on them, replacing normal forms. This > is the kind of thing I think you'll see making cryptographic inroad with > business. I think you're right. The ability to verify a signature that would be impossible to repudiate is a strong one. Tamperproof documents that preserve privacy are all powerful incentives for a company to adopt strong crypto and DSS. -- Ed Carp, N7EKG/VE3 ecarp(a)netcom.com, Ed.Carp(a)linux.org "What's the sense of trying hard to find your dreams without someone to share it with, tell me, what does it mean?" -- Whitney Houston, "Run To You"

1 0

Re: public accounts / PGP / passphrases
by collsc＠snowbird.aud.alcatel.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > From owner-cypherpunks(a)toad.com Thu Dec 1 20:25:31 1994 > Date: Thu, 1 Dec 1994 21:18:55 -0500 > Subject: public accounts / PGP / passphrases > To: cypherpunks(a)toad.com > From: lmccarth(a)ducie.cs.umass.edu > X-Server-Version: Cactus-Serv 1.1 > Reply-To: cypherpunks(a)bb.hks.net > Sender: owner-cypherpunks(a)toad.com > Content-Length: 1705 > Rather than assume that the "Reply-To:" field shown above is appropriate, I have Cc'ed your originating address as well. So, if you get two copies of this, you'll know why. > > Could someone please elaborate on the foolishness of using PGP with a > passphrase on a public machine (as I do) ? Am I wrong in thinking that my > secret key is useless to an intruder until she guesses my passphrase ? I > have no net access except via an account on a public machine, so I'm not > about to start storing my secret key elsewhere, but I'll change my passphrase > to <null> if it's irrelevant anyway. I just reviewed the PGP docs a bit and > Phil says "Nobody can use your secret key file without this pass phrase.", > which seems to contradict what many people on the list have said. > Postulate an unscrupulous sysadmin (or anyone who manages to get the password for 'root' via fair means or foul). Let's call him Charlie (since we know that neither Alice nor Bob would do such a thing :). Charlie could easily install a process which logs each keystroke you enter, thus capturing your passphrase in said log. Alternately, he could substitute a rogue version of PGP for the real version. This rogue version would function exactly like the real version (to avoid suspicion on your part), but would surreptitiously copy your secret key and passphrase into a log file. Admittedly, this kind of attack is far-fetched. As long as you are aware of the possibility, you are free to assess the likelihood of such an attack and proceed accordingly. - -- Scott Collins "Now, thanks to the computer revolution, many Alcatel Network Systems geeks make ten times as much money as you do." Richardson, Texas Canter & Siegel, the Green Card Lawyers -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBFAwUBLt8tgyoZzwIn1bdtAQFxDAF/Vu1A4jQ5R0hW2OODcMMPCjeCFZG0aRvB OJDeQZi5hBGAVjVk2QOeCZR//zWvp1lC =Rpnk -----END PGP SIGNATURE----- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address belonging to the signature and forwarded.]

1 0

Re: FYI: Eudora and PGP
by merriman＠metronet.com 17 Dec '03

17 Dec '03

> > > All of MacPGP 2.3v1.1, MacPGP2.6ui, and Viacrypt PGP 2.7 can >be driven via the use of AppleEvents, by the macpgp kit. This leads >one to believe that all three use the same suite of events. My >scripting environment is broken, so I can't actually test to see that >the entire suite is the same. > > The macpgp kit can be found at >duke.bwh.harvard.edu:/pub/adam/mcip Now, if there was just something for us PC Eudora users...... Dave Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)feenix.metronet.com for PGP public key and fingerprint. PGP encrypted Email welcome, encouraged, and preferred. "Those who make peaceful revolution impossible will make violent revolution inevitable." John F. Kennedy

1 0

Tim May is RIGHT!!!
by Anonymous User 17 Dec '03

17 Dec '03

I'm sorry I can't say so under my real name, but I *vehemently agree* with Tim May about the authoritarian, heavy handed, generally outrageous egotism of Eric Hughes of recent. This is REALLY UPSETTING. Eric should be ASHAMED OF HIMSELF for strutting around like a peacock. he is EMBODYING THE DICTATORIAL APPROACH HE CLAIMS TO DEFY VIA CYPHERPUNK PHILOSOPHY. this is truly the most HYPOCRITICAL AND EGOMANIACAL action I have seen by anyone in recent times on this list. Tim May will leave the list? GOOD FOR YOU, TIM. Get the hell out of here. Eric Hughes may have had some good ideas ONCE UPON A TIME but hasn't kept up his end of the bargain of the cypherpunk agenda for a LONG, LONG TIME. just a WASHED-UP HAS BEEN, who defies the very ideals that he claims to espouse in the most dictatorial manner possible. oh, what's this? you're just going to DELAY the messages that don't have signatures? well, I'm sure the government would just love to slightly DELAY THE MAIL of people who don't have the proper ESCROWED KEYS. what's this? you aren't going to move to any more "serious" measures, such as actually BANNING UNSIGNED MAIL, at least, NOT YET? oh, THANK YOU, MR. ALMIGHTY GOD OF CYBERSPACE. ah, I'm sure Louis Freeh feels the same way---we aren't proposing any minor change that PREVENTS YOUR FREEDOMS, are we? gosh, the government is starting to look awfully nice in comparison to the TYRANNY OF A DICTATOR. this scene is getting REALLY STALE. oh, Mr. CYPHERPUNK FOUNDER, please tell me once again how you started this list, and how the volumes of posts by the public are really YOUR PERSONAL PROPERTY, and this is YOUR LIST. we are your "guests"???? BULLSHIT. any host that treats his guests like this is NOT A HOST. this is not graciousness but the crabby and cranky bossiness of a STELLAR INGRATE and a EGOTISTICAL JERK.

3 2

Stealth Crypto (Was: Re: Andy Grove on Clipper)
by jamiel＠sybase.com 17 Dec '03

17 Dec '03

At 2:28 AM 06/20/94 -0400, Ed Carp [Sysadmin] wrote: >I've read about (with interest) the so-called "stealth viruses", and how they >adapt to their environment - might crypto do the same thing? There is no way to to translate the idea that I can see. Stealth viruses work by patching the interrupts that AV programs watch- (on a PC- Macs and other platforms are conceptually different) INT 21h, etc. and the file attributes repoting mechanisms in DOS, and lie. It is hardware specific, and I don't see anyway to translate the concept to a networked environment in order to fool 'traffic cops.' I wonder about the mutation engine concept, though... -j

1 0

autodecrypting incoming mail
by Alex Strasheim 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I've been fooling around with scripts which automatically decrypt incoming mail, and I'm curious about how others are approaching the problem. In particular, I'm interested in how Mime gets mixed in. A problem with using a script which acts as a PGP aware pager to display mail is that it would choke on certain types of Mime data, an attached binary, for example. The best solution to this problem would be a PGP aware Mime mailer, but that's too hard for me, so I've been playing around with scripts which will transform mail spool files with cyphertext in them into mail spool files which are all plaintext. First of all, I'm assuming that premail was used to encrypt the mail automatically. To try to get a handle for what's going on with the headers, I've been sending mail from elm, pine, and /bin/mail and seeing how they vary as encryption is added. When encryption is used, premail always uses Mime headers, with a Content-Type field that says "application/x-pgp; format = mime". When encryption isn't used, elm doesn't use Mime headers, but Pine does. There are a few other differences between the various mail programs as well. Elm, for example, has header fields which say how long the body is, while Pine doesn't. This makes me wonder if the transformation that premail uses on outgoing mail is a reversible process. Is it possible to transform a mail spool file so that it's exactly as it would have been if premail encryption hadn't been used? It's pretty obvious that we don't need it to be completely reversible: all that's needed is a header that will match the plaintext body. But what factors need to be considered when the new header is constructed? Specifically, which header fields would have to be modified? Signatures complicate things further, because they add information to the letter which has to be included in the plaintext somehow. If the same letter is sent twice with the same software, one signed and encrypted by premail and the other sent normally, it's not good enough to transform the first into a copy of the second. Somehow the user has to be told if the signature checked out. Is it possible to add a Mime section that would contain this information? Suppose, for example, we use Pine to send a letter. The letter contains normal text and an attached binary. This would mean that it would contain two sections in the body. Does it make sense to decrypt the letter, check the signature, and construct a new three section body, with the added section containing the results of the signature check? If we do that, how can we make the mailer display it? I'm sorry to ask so many basic questions, but I don't know much about Mime. I started using elm a long time ago, and I've stuck with it because it's comfortable. I don't have a lot of experience with Mime mailers. (If anyone could suggest a good cutting edge unix Mime mailer, I'd appreciate the pointer: I think just using the software would help a lot.) Thanks, == Alex Strasheim | finger astrashe(a)nyx.cs.du.edu alex(a)omaha.com | for my PGP 2.6.1. public key -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLt6FUxEpP7+baaPtAQGbrAQAoWCj9ilFdE59fj+6beOYdv8MGQ3BtlMP ClfdJkQhbUheJx+vKtlvfw3/Cz8qiHpxy0QHqLbXzpTKrdN36xp1IbnAmFDGoFBz pjaBZdLMI/Izjein6aeardeKnwnhgVC1X6jgrQUhYfRsa0fHzx1Hl9PXucgckHHn gkQKsuIauR0= =82Jv -----END PGP SIGNATURE-----

1 0

something I've always wondered
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

Does DES (or name your favorite encryption algorithm) produce as output all possible cyphertexts of length L, given all possible conbinations of keys and plaintexts of length L? Since there are more combinations of key and plaintext than there are possible cyphertexts outputs of length L, you know there must be some combinations of key and plaintext that produce the same cyphertext. Just curious, Jim_Miller(a)suite.com

3 2

Problems with Definitions in Escrow
by blancw＠pylon.com 17 Dec '03

17 Dec '03

Responding to msg by James A. Donald: If you *define* reputations to be something formal and explicit, and say that the system will work because people guard their reputations, then reputations become something that can be most efficiently granted and withdrawn by some centralized authority. . . . . . . . . . . . I am complaining about dangerous carelessness in your use and definition of words. Your use of the word reputation is as fraught with frightful consequences as Marx's use of the word "value". ................................................................. .... Perhaps when you decry the establishment of 'definitions' you mean that a concept should not be circumbscribed tightly within the boundaries of a pre-determined range of meaning? I thought what Hal intended by 'examining & defining' a term, was simply to assess what it means to those who are seeking to apply it, rather than intending to confine it in advance of any real knowledge of its actual reference. Blanc

1 0

Re: Beware of Roman Catholic Corruption
by gbe＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > Don't let them lure you into following them into Hell. The 1611 > Authorized (King James) Version of the Holy Bible is the only book > that God ever wrote. All other alleged translations are frauds > written by the Devil himself. So what version of the scriptures did Jesus quote from? Gary B. Edstrom | Sequoia Software | PGP fingerprint: Internet: gbe(a)netcom.com | Programming Services | 2F F6 1B 28 6E A6 09 6C CompuServe: 72677,564 | P.O. Box 9573 | B0 EA 9E 4C C4 C6 7D 46 Fax: 1-818-247-6046 | Glendale, CA 91226 | Key available via finger What is PGP? Subscribe to alt.security.pgp and find out! -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLgaIwkHZYsvlkKnJAQHfJAP+NBbcCDGzobs2IKuBCro9+Cka9VtMrbqi NQY1SZRv6ZMUb7UwF5dd6J0rPJCwjzs9bLNWDxG643BHww0LWlc8+jfw0N6eZX7U jYeso6+jKwSA3+sVfygyI5WTOUe5dUqFQfzHuxDFzZrgej3eejLw16WiwuCRpViL sk345Pw5dQQ= =SlzJ -----END PGP SIGNATURE----- -- Gary B. Edstrom | Sequoia Software | PGP fingerprint: Internet: gbe(a)netcom.com | Programming Services | 2F F6 1B 28 6E A6 09 6C CompuServe: 72677,564 | P.O. Box 9573 | B0 EA 9E 4C C4 C6 7D 46 Fax: 1-818-247-6046 | Glendale, CA 91226 | Key available via finger What is PGP? Subscribe to alt.security.pgp and find out!

2 1

INFORMATION WARFARE
by Brian D Williams 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Winn Schwartau's new book is out, "Information Warfare" and I am enjoying it a great deal. I thought the list might be interested. Here are the contents: an introduction to information warfare 11 1. The Econo-Politics of Information Warfare 27 2. Computers Everywhere and the Global Network 49 3. Binary Schizophrenia 65 4. On The Nature of Insidious 82 5. Influenza, Malicious Software, and OOPS! 95 6. Sniffers and the Switch 114 7. The World of Mr van Eck 137 8. Cryptography 148 9. Chipping: Silicon-Based Malicious Software 160 10. HERF Guns and EMP/T Bombs 171 11. Hackers: The First Information Warriors in Cyberspace 190 12. Who are The Information Warriors? 215 13. The Military Perspective 249 14. Class 1: Personal Information Warfare 258 15. Class 2: Corporate Information Warfare 271 16. Class 3: Global Information Warfare 291 17. Defense Before Defeat 312 18. Outline of a National Information Policy: A Constitution for Cyberspace and an Electronic Bill of Rights. 316 19. The Future of Information Warfare 354 Afterword: Practical Proactive Security and Privacy 367 Resources 384 -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLgdUGdCcBnAsu2t1AQHuOQQAnUItVChxiifCuLyU91B5QxysJ2FuFUfT bL0S3y2z8L6HXDZ7fMJQOsBY6/xM8Pl71Ak8EzEupF26UrEAUvpSlQRo1DDA2fp6 XfAZMqDWOBj9hLYvrzBj4etH9LB8s1h2iYkJrTt7M5nuaOrJVnw8Et3ysUSwlrAR D6w0vfVDXp0= =bBAW -----END PGP SIGNATURE-----

1 0