- cypherpunks-legacy - lists.cpunks.org

RE: WARNING!
by nobody＠ds1.wu-wien.ac.at 17 Dec '03

17 Dec '03

+++++++++++++++++++++++++++++++++ dcosenza(a)netcom.com wrote: > I spoke with Phil Zimmermann today at some length, and he has informed me > that users who decide to use the jumo keys generated by the hack of 2.6ui > will be running a risk of incompatibility on down the line with future > releases he has planned. You have been warned! > > Ever forward, Doesn't part of "ever forward" sometimes involve something "non-standard" and "running the risk of incompatibility"? Unless there's something flawed with the implementation of longer keys, why shouldn't the first to implement them become the de-facto standard? If a leter release turns out to be incompatible with an older one, but it's cryptographically superior, then it's time to switch, even if it means generating and distributing new keys. Anyone concerned enough about security to want the "latest and greatest" crypto package, with longer/stronger keys or whatever, should already be practicing good key management and generating new keys periodically, anyway. My only concern would be whether the implementation of longer keys might possibly "push the envelope" of the math routines used, and thus introduce subtle, hidden weaknesses. Two examples might be an RNG that became non-random with larger numbers, or a primality tester that failed to detect larger non-primes. If you have evidence for any of those scenarios, I'd love to hear it. Personally, I'm staying with PGP 2.3a until the dust settles a bit. I've FTPed the RSAREF 2.6 release, and it remains in its zipped archive for now. Just as an aside, can some of the PGP-aware-anon-remailer operators comment on what they plan to do with respect to the various PGP versions? ++++++++++++++++++++++

4 3

Re: PGP is Product of the
by Duncan Frissell 17 Dec '03

17 Dec '03

To: cypherpunks(a)toad.com J >A person in the group to which I refer is ``in the US'' by the J >commonly understood geographical definition of that phrase, but has as J >a matter of conscience renounced any citizenship he may have had. He J >refuses on principle to affirm that he is a national person, and J >therefore cannot use PGP 2.6 because such affirmation is supposed to be J >required in order to obtain PGP 2.6, and may therefore be implicit in J >each use of PGP 2.6. On the other hand, if he uses PGP 2.6ui, he risks J >being accused of violating RSADSI's patent rights, because they will J >take him to be "in the US", even though he has disaffiliated himself. J >What version of PGP can such a person use? Even though your friend is no longer a U.S. Citizen he is a "legal resident of the U.S." in that he could not be deported. Residence is defined at law as equal to "domicile" and is under the legal control of the individual rather than the State. "Domicile" is defined as "Actual physical presence plus intent to make the place one's home." Once domicile is gained, it persists even if you are away until one acquires a new domicile by one's own action. So he could use the MIT version of PGP. When their lawyers came up with their spastic language about users having to be U.S. Citizens or Green Card holders they weren't trying to be exhaustive. They were clearly trying to mirror the ITAR crypto regs. Since your friend, while not a citizen, is not an alien he can possess crypto technology under ITAR and thus under the MIT license. DCF "If Nicole had had a Colt Mk IV Govt. Model, she'd be alive today." --- WinQwk 2.0b#1165

1 0

Re: RE: WARNING!
by usura＠vox.hacktic.nl 17 Dec '03

17 Dec '03

nobody(a)ds1.wu-wien.ac.at writes: >Just as an aside, can some of the PGP-aware-anon-remailer operators comment >on what they plan to do with respect to the various PGP versions? The remailers at vox.hacktic.nl are running PGP 2.6 ui. Regz, -- Exit! Stage Left. Alex de Joode <usura(a)vox.hacktic.nl>

1 0

Re: Cellular Telephone Experimenter's Kit (2600 article)
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

>>This CTEK sounds like a fun toy and I guess I'm glad that it can't be >>used for cellular phone fraud. That would be an illegitimate use. But, >>monitoring cell phone traffic is a crime now, right? Is there a legitimate >>use for the device? Can anyone think of one? > >Several companies make cellular test sets (or optional modules for >more general purpose RF test sets) that perform functions very much >like those of the CTEK package. Since we manufacture cell phones, we >have a perfectly legitimate reason to have a few of those test sets >around here. And I know of no special licensing requirements to buy >them (other than having $20,000 or so in cash). Sure, I know that Qualcomm could easily justify having the toys around the place. But what would I say to the cops/FCC when they came knocking? I was just waiting to get the capital together to set up a phone manufacturing program? Is there any legitimate use for someone not in the business? The best I can come up with is: a wife who wants to track her husbands progress home so she knows when to throw the steaks on the grill. ("He always arrives 12 minutes after the he moves into our cell.") > >Phil

1 0

Re: PGP is the product of the week!
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

>> 4. Mentioned earlier... "Attack the NSA budget". This can be a win and a >> loose since a smaller budget could lower our countries defenses. It is >> possible that an attack on the budget would get them to lay off without any >> real action needing to be taken. > This isn't truly an issue. The NSA had it's hey-day during the Cold >War. Now that that's over, and the same level of effort can be attuned to >fewer enemies, one would think that they don't NEED a bigger budget. "Fewer" enemies? Yugoslavia is now split into at least 5 pieces. Before we only needed to monitor the line from Moscow to Tito. All the orders came down this line and Yugoslavia did what they were told, more or less. No one in the US had to seriously wonder about the differences between Bosnia, Serbia, Croatia etc... We didn't need to monitor the different governments in the different regions. The ex-SU is now split into too many pieces for me to count. Some of them have nuclear weapons that they don't want to turn over. Others have military ships. Before, it was enought to have a good presence in Moscow. Now you need to be in Kiev, Lvov, Talinn, etc... North Korea, the Mid East and Cuba are the only places that still need the same amount of attention that they needed during the Cold War. This is because they're already maxed out. > > --Jeff >-- >====== ====== +----------------jgostin(a)eternal.pha.pa.us----------------+ > == == | The new, improved, environmentally safe, bigger, better,| > == == -= | faster, hypo-allergenic, AND politically correct .sig. | >==== ====== | Now with a new fresh lemon scent! | >PGP Key Available +---------------------------------------------------------+

1 0

remail@c2.org supports X-Anon-To and Request-Remailing-To
by sameer 17 Dec '03

17 Dec '03

I forgot when I moved the code over from remailer@soda over here to accept X-Anon-To: and Request-Remailing-To: I prefer Anon-Send-To: because it differentiates between Send and Post, such as with Anon-Post-To: Well here's a list of the commands remail(a)c2.org supports: Subject "remailer-info" pipe A instructions.pl X-Ping "--PING--" pipe A pinger.pl # anon block response header Response-Key "" pipe A reply.pl # remailing headers - non-anon Send-To "" pipe A send.pl # remailing headers - anon Anon-To "" pipe A anon-send.pl Request-Remailing-To "" pipe A anon-send.pl X-Anon-To "" pipe A anon-send.pl Anon-Send-To "" pipe A anon-send.pl # posting headers - not anon Post-To "" pipe A post.pl # posting headers - anon Anon-Post-To "" pipe A anon-post.pl Resp-To "" pipe A resp-send.pl Resp-Send-To "" pipe A resp-send.pl Resp-Post-To "" pipe A resp-post.pl Encrypted PGP pipe A pgpmail.pl # * "" pipe ? recurse.pl -- sameer Voice: 510-841-2014 Network Administrator Pager: 510-321-1014 Community ConneXion: The NEXUS-Berkeley Dialin: 510-841-0909 http://www.c2.org (or login as "guest") sameer(a)c2.org

1 0

Re: WARNING!
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

mgream(a)acacia.itd.uts.edu.au (Matthew Gream) writes: >"ER CRAMER" wrote: >> But what are we talking about here. A 1024 bits >> key should be save for at least the next 10000 years so who cares if a 5000 >> bits key could be save for maybe a 1000000 years!!! After the RSA-129 factoring there was considerable discussion on sci.crypt about how much harder a 1024 bit key would be using current algorithms. There was some disagreement, but it did not seem that a 1024 bit key would be good for 10000 years; as I recall, the time scale was more like a few decades before it would fall to an attack as expensive as RSA-129. Larger keys with 2K bits, OTOH, were good for thousands or millions of years (of course it's hard to extrapolate computer power out that far). Does anyone have more precise numbers? >And if a near polynomial time method is developed for factoring or >breaking RSA (or any other PKCS you care to mention), super large keys >aren't going to matter a hoot. People have been talking as though the only possible improvements to factoring algorithms would be to jump to polynomial or near-polynomial time. Obviously it is equally possible that improvements will occur as they have in the past, reductions to the exponents or constant factors but still an exponential algorithm. In such a scenario it is very plausible that 1K bit keys would be unsafe while keys of a few K would be fine. Hal

1 0

PGP public key for soda.berkeley remailer?
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

Does somebody have the correct PGP public key for the remailer(a)soda.berkeley.edu remailer? Nothing I've sent there for posting has ever shown up, and I suspect I've got a bad key on my ring for them!

1 0

MacPGP2.6
by Joseph R. Rach 17 Dec '03

17 Dec '03

Hello, Does anyone know how to get MacPGP to sign with a different secret key then it's orginal one? I have two different keys in secring.pgp, but MacPGP refuses to accept the new one. I even made two seperate secret rings (one for each) and when I try the ring with the newer key in it, it tells me that it can't find my other key. This is fustrating for me. 2.3 lets me pick my key, and 2.6 will only let me use one. Anybody have a solution??? Thanks in advance. ps - I wish MIT had come out with a MacPGP2.5 release. ________________________________________________________________________________ Joseph R. Rach <r6788(a)hopi.dtcc.edu> Delaware Technical and Community College

1 0

FYI
by dcosenza＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I spoke to Phil Zimmermann again today, and as per his request I have removed the hack of 2.6ui from ftp given that PGP is Phil's intellectual property and I respect him. In its place I have ftp'd Mathew's 2.6ui, I recommend it to all of you who want upward and downward compatibility with official versions of the software. Ever forward, David PS, I know that an 8176 bit key is absurd from a security standpoint, for that matter so might a 4096 bit key, but there are users who feel they need such a capability and for their sake I sincerely hope that a future version of PGP addresses this concern at least up to 4096 bits. :-) - -- - --------------------------------------------------------------------------- David Cosenza dcosenza(a)netcom.com PGP 2.3a Public Key available by finger _or_ ftp.netcom.com:/pub/dcosenza PGP 2.3a Key fingerprint = BF 6C AA 44 C6 CA 13 3F 4A EC 0A 90 AE F3 74 6D "When encryption is outlawed, only outlaws will have encryption." -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCzAgUBLgzbqCjdpAfJZzihAQGplwTvQhu5SdwRhzBC1PDRpv+w51Z6iJU3VPY3 qhWH3neM6nlzA3sICdkQDW2EuifoaQ5un1zLGG1UMvITSDFpmDvEraenHyY0wa1e Tz3Wlm2mAmHdA82nSv6IEN52cQahPo11XjK6a0kuRuGLK3rF87ldoToQ91fhJ+dI Ycsijo627a36OzgIiNSPeGiWVID59kqp/F0suhgq4esQNHHRyN0= =FFy4 -----END PGP SIGNATURE-----

1 0