- cypherpunks-legacy - lists.cpunks.org

PGP on AOL
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi there, I want to help a friend of mine to set up PGP. She's using Win 95 and is on AOL. Can anybody recommend some good shells, that would make make it easier for her? Thanks already in advance... Ciao Harka -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMzJqzTltEBIEF0MBAQHIqwf/R5pOkHW87Nvjk2zSiVk9NRTbzrrPLaaG lOsGmY5m6t0A5wLLaIAYiVYG0ygF00Zau8YvUUkEB8dBw2ufItMWAcSMeYQnkKTU m3koJo6miy0EH3wyaaL2I44IM9q77b0jpZPxX+8kfYry2tLTYoCCyHdC/BGDdYTd M0jwM+VXPmrw+xnX3TUr2y5ggweR0zIBCuD+V0JodHiXg8x5GYsQ/uXKhtd9a4rJ QkIm9MU6gf0lPvzXFA6mjk6DDz7YqM4hoywn+4Dc4wJ/DaO6ZU5EXhkg2Q1vYBSN Jp7k6ZAoBPl8rsPem0C5t7Q7V3YRp3qeD6jV/K3YuMW6VgYJynDs6Q== =B09F -----END PGP SIGNATURE-----

4 3

Re: FBI Visits JPUNIX
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

In regard to an email which was purported to be subjected to suppression Anonymous wrote: > The first time it was sent via a remailer, it was bounced for ill- > defined reasons. The second time it was sent, the remailer was shut > down, and remains shut down. Mark M. wrote: > Speaking as "XXXXXXXXX" (or, at least, one of the "XXXXXXXXXs"), I did receive > the following message which originated from "TruthMonger." Shortly after I > received the message, anon.nymserver.com closed down all of its free, > anonymous accounts due to "abuse." Anonymous continued: > Efforts to send it through a second remailer also failed, with no > notice from the server of any problems being received. Other email > sent through the remailer at the same time encountered no difficulties. Later the same day John Perry wrote: > Due to an FBI investigation that was opened recently naming > myself and jpunix as suspects, I have decided that the heat taken by > remailer operators due to those individuals that can't control > themselves has become unacceptable. The message in question is below. Draw your own conclusions. XXXXXXXXX, I thought I would reply privately to you, since you seem to at least have a willingness to allow the possibility of compromises to the security of the encryption methodologies behind PGP programs, among others. To begin with, I'm not sure whether you realize it, or not, but the Navy's spook tenacles run deeper, and extend further, than those of any of the more notable or visibly involved agencies who lurk in the background of security and privacy issues. One of the reasons for this is that their physical existence could be said to mirror the Internet in many respects. The very nature of their 'global' home (the sea), has always permitted them access to people and regions which are denied to others. Also, they are often in the position to be involved in what looks to be merely the 'transporting' of people and information. Whether providing escort services or getting drunk in foreign bars, the expertise of naval intelligence has always lain in the area of observation, first and foremost. By far the greatest tool of intelligence agencies on the Internet, has been traffic analysis. Their techniques are sufficiently sophist- icated that I would not be surprised to find out that they can tell more about us from our Internet activity than can be learned from the satellites capable of reading the newspaper over our shoulder as we sit in the park. Traffic analysis involves all measurable quantum of information, the chief concerns being the patterns and timing of data transfer, from which everything ranging from content and motivation can be deduced. If you wish to think in terms of back-doors, then you would be well advised to go beyond the concepts of 'passwords' and 'holes' and try to think in terms of patterns and timing, and other such 'structures' which are peripheral to concerns regarding 'code' and 'mathematics.' i.e. As well as considering the 'content' of what a program returned, you must also consider 'when' the program returned the result, and the patterns in the timing, as well as the content. An analogy could be made to a person who, being interrogated, answers all questions with a predictable rhythm and then 'pauses,' however slightly, in answering a certain question. You can see that what is revealed by the 'content' of the answer can be greatly insignificant compared to what is revealed by the 'delay' in answering. To expand your concept of 'back-doors' and 'holes,' you have to ask questions such as: "Does it take a program or hardware longer to return a result of '0', than to return a result of '1'?" "What factors can be introduced into the hardware and/or software that can influence the patterns and/or timing of various processes and the results they return?" "Can key searches be made more efficient by analyzing such things as rhythm, syntax, etc? What 'details' or 'qualities' of an individual, group, or 'arena of concern' can be analyzed for the purpose of being able to group them into structures which can be searched for?" "How can 'assigning' a value to certain sequences of numbers be used as a pattern to 'filter' the input data into a form which is easier to analyze?" You are aware of 'tricks and techniques' that apply to mathematics and are widely known. i.e. The process of shifting and adding numbers when multiplying by the number '11'. However, what about those quantum of information which are of no consequence to those seeking for the 'final result' of that multi- plication? Can the peripheral effects of mathematic calculations be used to analyze what has taken place, to narrow the scope of inquiry? My nephew describes numbers as getting 'wider' as they get larger, and he does quick checks of his result through his 'feel' for how much 'wider' a number should be when he is done, even in complicated equations which he ill-understands. (He reminds me of Steven Wright, who claims that someone told him that his socks didn't match, and he replied, "Sure, they do. I go by thickness.") I am currently working on a project which involves merging chaos theory with traffic analysis and other processes to analyze the effects that algorithms display when processed through the filters of varying hardware and software structures and methodologies. The RSA algorithm and accompanying RSAREF subroutines were our first focus, for the very reason that there were certain factions behind the scenes of the Zimmerman/RSA agreement who seemed to have an inordinate amount of interest in the subroutines being chained to the algorithm (for reasons that have nothing to do with patent protection). Those whose expertise goes far beyond my own in this area look at the initial results of the analysis as confirming that their is a 'relationship' between the RSA algorithm and the RSAREF subroutines which will enable them to break the system down into workable units for fairly quick analysis. What is interesting is that the results from small probes into other encryption systems show the same potential for exploitation using varying analysis methodologies and processes. (One fairly well-known encryption routine is almost lame enough to reveal its secrets to anyone with a pencil and a stopwatch, as well as the file size and time it takes to encrypt.) While I would rather you didn't publicize the preceding information, as a general rule, I think that is something that should be shared with anyone who is seriously focusing their efforts on better methods of encryption and analysis of encryption methodologies. I am aware of two other groups who are working along the same lines, although with a narrower range of variables than ourselves, and I am certain that there must be more than a few other entities out there who are also pursuing this line of research.

2 1

Re: your mail
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

mpd(a)netcom.com (Mike Duvos) writes: > Graham-John writes: > > > On Mon, 7 Apr 1997, Mix wrote: > > > I think Vulis needs each of us to send ten copies of this back to him. > > [Silly Timmy May insult deleted] > > You do realize you are doubling the amount of noise by responding to > each and every one of these posts, don't you? Perhaps he doesn't. A prefrontal lobotomy does that to people. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: FINALLY, "SOME" TRUTH Re: Anonymous Nymserver: anon.nymserver.com
by Toto 17 Dec '03

17 Dec '03

Kent Crispin wrote: > > On Fri, Mar 21, 1997 at 03:06:41AM -0600, Toto wrote: > > Attila T. Hun wrote, in blood: > [...] > > > > > > you got that one right! > > > just the ability to _backtrack_ into the algorithms is a art. > > > One piece of clear text and you're toast. > > You can't tell me the guy who designed the Rubik cube didn't know > > how to 'beat' it when he was done. > With all due respect, Toto, this is not a valid point. It is easy > for someone to design and implement something they can't beat. > Whether PKZ designed in, or was coerced into installing, a backdoor > into PGP is an interesting speculation, but immaterial. The only > real data you have is the code itself. I wasn't referring to either PKZ or PGP, but to 'systems', in general. In designing systems of any type, one can often have elements of design which aren't in the blueprint. An example would be an architect who designs a room to echo (or not echo) sound in a certain way, for use as a concert hall or music studio. No amount of analysis of the blueprints will show this 'hidden' design unless the person looking is thinking in the same terms as the designer. Certainly, if the blueprints described the room as a 'sound room', then this might give some a clue as to the hidden elements, but still would not inherently reveal every aspect of what was involved in the design. -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

1 0

WebWorld 9
by Bubba Rom Dos 17 Dec '03

17 Dec '03

1 0

UK TTP Paper
by John Young 17 Dec '03

17 Dec '03

Forward from Cyberia-L: Making absolutely no comment on the subject of licensing of certification authorities, you may be interested in a UK paper entitled LICENSING OF TRUSTED THIRD PARTIES FOR THE PROVISION OF ENCRYPTION SERVICES - Public Consultation Paper on Detailed Proposals for Legislation, March 1997. You can obtain a full document at http://www.dti.gov.uk/pubs. E. Michael Power Coordonnateur Secrétariat au commerce électronique Ministère de la Justice Canada ---------- This paper links to David Herson, the reputed GCHQ spy who admitted the EU/FBI wiretap pact: Information on any of the current TTP projects can be obtained from David Herson (DG XIII/7) at the European Commission (e-mail david.herson(a)bxl.dg13.cec.be) or from the Commission Web site at www.cordis.lu/infosec/

2 1

Jackboots in Canada
by camcc＠abraxis.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- AP 3/21/97 Quebec Spurred by a new outbreak of bombings, the Canadian government agreed Thursday to toughen laws to help Quebec stamp out a war between motorcycle gangs that has killed more than 30 people. [snip] ...Hell's Angels and Rock Machine...have been battling for control of the illegal drug trade in Canada. Canadian justice minister, Allan Rock, said the measures would include broadening laws on search warrants, electronic eavesdropping and bail conditions for arrested gang members. -----BEGIN PGP SIGNATURE----- Version: 4.5 iQCVAgUBMzKOOiKJGkNBIH7lAQHrAwP+P/0YSzXsLKlLe5YAzOVC0QB31uNhmvim HsSdPbulXccXCV0WIeG5uCtzCLXliR759KunfxEs2GithcIpfcDDKa4SFJv9+SVi PqmWXAxs+qNQ/uQqsDo97zuk+tNhO0631XRkh1LS+tL9Q6pCJfSpNl3Ntvhtyafv OD01c5tLwts= =AqwJ -----END PGP SIGNATURE-----

6 6

NYU's PGP Key-Signing Seminar - a critique
by Sergey Goldgaber 17 Dec '03

17 Dec '03

I am writing regarding the PGP Seminar to be held on the 27th of March. Your informative session is laudible. And, I would like to take full advantage of the key-signing session to follow. However, there is a certain concern which it would be prudent to address first. http://www.nyu.edu/pages/advocacy/awareness/pgp.html provides instructions for the session, which state: "8. At the seminar Tim and Ilya will confirm the identity of all participants and the participants will identify their own keys. 9. After the seminar Ilya will e-mail all the participants the keyring with all the keys, along with the instructions on how to sign them." This conflicts with the guidelines for hosting pgp key signing sessions as presented in the alt.security.pgp FAQ (a relevant excerpt is attached to this message). The FAQ states: "6. Each person securely obtains their own fingerprint, and after being vouched for, they then read out their fingerprint out loud so everyone can verify it on the printout they have." ~~~~~~~~ The concern I have is that this discrepancy undermines the web of trust model for PGP. The participants of the NYU session will not have the opportunity for verifying the identity of the owners of the keys that they are signing. They must rely on a central authority ("Tim and Ilya"). I realize that this may be a simpler, and perhaps a more convenient method of conducting a key-signing session, perhaps ideally suited to a session aimed at novices. However, I feel that the security provided by PGP is thereby undermined. We must not forget that security is the whole reason that even the novices at your session are using PGP for in the first place. I hope this issue can be addressed before the session begins. ............................................................................ . Sergey Goldgaber <sergey(a)el.net> System Administrator el Net . ............................................................................ . To him who does not know the world is on fire, I have nothing to say . . - Bertholt Brecht . ............................................................................ 6.8. How do I organize a key signing party? Though the idea is simple, actually doing it is a bit complex, because you don't want to compromise other people's private keys or spread viruses (which is a risk whenever floppies are swapped willy-nilly). Usually, these parties involve meeting everyone at the party, verifying their identity and getting key fingerprints from them, and signing their key at home. Derek Atkins <warlord(a)mit.edu> has recommended this method: _________________________________________________________________ There are many ways to hold a key-signing session. Many viable suggestions have been given. And, just to add more signal to this newsgroup, I will suggest another one which seems to work very well and also solves the N-squared problem of distributing and signing keys. Here is the process: 1. You announce the keysinging session, and ask everyone who plans to come to send you (or some single person who *will* be there) their public key. The RSVP also allows for a count of the number of people for step 3. 2. You compile the public keys into a single keyring, run "pgp -kvc" on that keyring, and save the output to a file. 3. Print out N copies of the "pgp -kvc" file onto hardcopy, and bring this and the keyring on media to the meeting. 4. At the meeting, distribute the printouts, and provide a site to retreive the keyring (an ftp site works, or you can make floppy copies, or whatever -- it doesn't matter). 5. When you are all in the room, each person stands up, and people vouch for this person (e.g., "Yes, this really is Derek Atkins -- I went to school with him for 6 years, and lived with him for 2"). 6. Each person securely obtains their own fingerprint, and after being vouched for, they then read out their fingerprint out loud so everyone can verify it on the printout they have. 7. After everyone finishes this protocol, they can go home, obtain the keyring, run "pgp -kvc" on it themselves, and re-verify the bits, and sign the keys at their own leisure. 8. To save load on the keyservers, you can optionally send all signatures to the original person, who can coalate them again into a single keyring and propagate that single keyring to the keyservers and to each individual. This seems to work well -- it worked well at the IETF meeting last month in Toronto, and I plan to try it at future dates. http://www.nyu.edu/pages/advocacy/awareness/pgp.html Awareness Week 1997 Pretty Good Privacy Seminar Thursday, March 27 at 12:00 pm Warren Weaver Hall, Room 313 [INLINE] This is a Blue-Ribbon event, CANYU will distribute Blue Ribbons to participants This seminar sponsored by the Computer Advocacy @ NYU and the Academic Computing Facility. The seminar will explore the need for use of cryptography for communications in every day life, and demonstrate how PGP (Pretty Good Privacy) can be used at NYU. This workshop is a part was preceded by another seminar titled "Encryption: Padlocks for the digital age". Speakers: * Tim O'Connor * Ilya Slavin A key signing session will follow the seminar. The instructions follow: 1. If you have already created your key, skip to the following step. + You can create your new key on one of the IS machines (and, most likely, many other computers at NYU) by following the steps outlined in the following document. 2. Once your key is generated and signed by yourself, extract your public key from the key ring by typing pgp -kxat userid keyfile.asc where keyfile.asc is a name of the file you want to copy your key to. 3. Send this file with your name and a mention of the seminar to slavin(a)acf2.nyu.edu before 7:00 PM on March 26, 1997. 4. Ilya will compile a master keyring with all the keys before the seminar starts. 5. Please write down (or print out) the output of the following command: pgp -kvc where <userid> is your name or e-mail address that appears in your key. 6. Ilya will have printouts of userids and fingerprints of all keys sent to him. 7. Bring two photo IDs (either a passport or other respectable form of ID) to the seminar so that we can verify your identity. 8. At the seminar Tim and Ilya will confirm the identity of all participants and the participants will identify their own keys. 9. After the seminar Ilya will e-mail all the participants the keyring with all the keys, along with the instructions on how to sign them. 10. Once the keys are signed, the participants will e-mail their signed keyrings to Ilya, who will add their signatures to the master keyring. 11. As soon as Ilya receives all the signed keys, he will e-mail the complete keyring to all the participants, who can add the new signatures to their own keyrings. ______________________________________________________________________ Computer Awareness Week '97 / Ilya Slavin / Last Modified: 3/6/97

2 2

PGP as disinformation
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Sergey Goldgaber wrote: >This is only a practical problem related to PGP's lack of popularity. >The proposed solution will work in the long run, assuming PGP achieves >great popularity. Thus, education of the public concerning PGP and remailers >will help make this solution more effective. > Has this list not considered the very real possibility that PGP is itself a rogue program released by the intelligence apparatus to detour we cyberpunks? As I have been arguing, the obvious is often false. While certain statists on this list are arguing in vain that I lack expertise in cryptographic matters, the truth is apposite this. Ask not for whom Bell toils, Dr. Roberts -- --

2 1

Re: Cypherpunks & Ecash in WSJ, Chaum,and Amazing Revelation by NSA
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Hal Finney <hal(a)rain.org> writes: ... > In my travels around the web, I find that First Virtual is being > relatively successful for small amounts like shareware fees. It is > easy to get started with FV; you fill out their web page and make a call > to their 800 number with your credit card info. You're ready to go in > a few minutes. I'm sure there are a lot more people buying things with > FV than with Digicash. ... I just had an idea for an interesting demo project. Perhaps someone wants to take it up and to put a spin on it to promote privacy/cryptography. Most (perhaps all) states' motor vehicle departments allow you to connect to their computer (usually via a modem) and map licence plate numbers into names/addresses. Typically you must first set up an account and pay, e.g., $200, and then something like $4 is deducted from the account for each query. Obviously, only someone who performs a lot of queries (like a p.i. or a lawyer) would set up an account. It occurred to me that it might be "interesting" for someone to set up accounts with all the states that have this service; and to establish a Web site that would do quantity 1 queries for a reasonable fee, like $FV10. I recall that someone got hold of the Washington State database and operated such a service for free for a few days as a demo. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0