- cypherpunks-legacy - lists.cpunks.org

News_dal_Ragno_Italiano.
by Samuele Landi 17 Dec '03

17 Dec '03

Questo e' un messaggio informativo automatico per un servizio gratuito di pubblico interesse. Viene spedito una sola volta per lo stesso indirizzo e-mail anche se sono presenti piu' pagine. Il "Ragno Italiano" e' lieto di comunicarle che le pagine da lei pubblicate sul WWW sono state catalogate nel nostro motore di ricerca. Saranno visibili a indicizzazione completata di di tutti i siti italiani prevista per il 30/10/96. Il "Ragno Italiano" e' il motore di ricerca per l'italia con oltre 500.000 pagine catalogate e ricercabili subito all'indirizzo: http://ragno.ats.it -------------------------------------------------------- Sponsor permanente: http://www.webspace.it ====================== 50 mb di spazio WWW con dominio proprietario (www.nome_azienda.it/.com) per 150.000 Lire al mese -------------------------------------------------------- Il "Ragno Italiano" e' motore di ricerca anche per: - Indirizzi e-mail in Italia - Newsgroups Italiani - Meta-Interfaccia per tutti i maggiori motori di ricerca mondiali Cordiali Saluti. Samuele Landi - WebMaster ragno.ats.it

1 0

Re: SPA sues C2, other ISPs and users
by Douglas Barnes 17 Dec '03

17 Dec '03

I just wanted to weigh in on a couple of points that have been raised with respect to the SPA lawsuit against C2Net: 1) I don't think this is some sort of evil plot by SPA members because we hadn't joined or because we're competing with some of their members. A lot of their members compete with other members and non-members and nothing like this has happened before. It's pretty clear that they were oblivous to a great many things, including the fact that we're primarily a software company these days. 2) As obnoxious as the lawsuit is, we don't miss the humor in the fact that we've been grumbling (on-line and off) about folks who pirate Stronghold (our commercial, secure version of the Apache web server). We really were looking into joining the SPA, to see if it would do us any good in dealing with this problem. 3) If you run across any mention of this lawsuit in the media, either on-line or in print, it would be great if you could forward it to me at cman(a)c2.net, or fax it to me at: 510 986 8777. I want to be tracking the press coverage very closely, and our clipping services takes about 5-10 days to read and process clippings for us. Thanks for your help, Douglas Barnes VP Sales & Marketing C2Net

2 1

WOW!
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, I just totaled up the "Bring Dimitri to San Francisco" pledges. The pledges add up to an amazing US$681 and some guava pastries. Airfair should be around US$300. That, plus hotel should come in under the amount pledged so far. I'd still like additional pledges, however, I want to be certain we're covered and as an expression of the mood of the list. I intend to front the entire amount myself and then ask the "pledge partners" for a pro rated payment based on the actual cost and their proportionate pledge amount. It's interesting to me that several pledges have come from list members who are far removed from San Francisco. One or two of them plan to attend Dimitri's meeting, but most just want to have it happen. I've only had one request for anonymity, but I have kept names confidential without a clear go-ahead from them. (If you have already pledged or pledge in the future, please let me know if you mind if I post your name/nym.) Now there's only one thing missing--Dimitri's response. My open letter to him contained an explicit and unambiguous invitation to address a Cypherpunk meeting on any topic he wanted. I asked him for a clear yes or no, but have received nothing. Perhaps Dimitri prefers shooting from ambush. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

5 6

[Repost] PipeNet
by Lucky Green 17 Dec '03

17 Dec '03

Below is a repost of the original PipeNet article from February, 1995. The author is Wei Dai. -----BEGIN PGP SIGNED MESSAGE----- A week ago I made a suggestion for a new protocol for untracibility, but only got one response. I'll try again, this time more forcefully. I'm not trying to convince anyone to implement this (though of course you're welcome to!), but just to think about it and give me feedback. Why is another protocol needed? Right now we have only two, each of which has its own set of tradeoffs. To summarize: Mix-Net (i.e., remailer-net): high latency, moderate bandwidth costs, and low complexity DC-Net: moderate latency, high bandwidth costs, and high complexity While the DC-Net will probably never be widely used, the remailer-net has a fair chance of one day providing a way for many people to send e-mail that not even governments can trace. However, I don't think this is enough. Efficient social and business relationships require that people be able to converse to each other in real time. Cryptoanarchy will not come about if people cannot do this anonymously. How well can two pseudonymous agents negotiate a contract if each message they send must be delayed several hours? The protocol I sugguested would have low latency, moderate bandwidth costs, and moderate complexity. It would be well suited for people to interact anonymously in a textual environment. This is what I wrote: > Imagine a server that allows you to open a > low bandwidth (let's say around 100 cps, in order to reduce costs) > link-encrypted telnet session with it, and provides you with a number > of services, for example a link-encrypted talk session with another > user. You'll need to maintain the link 24 hours a day to defend > against statistical analysis, and of course you can chain a number of > these servers together in a way similiar to chaining remailers. Lance pointed out the chain cannot be built quickly. This is not a problem if servers connect to each other with relatively wide link-encrypted pipes and multiplex your connection into these pipes. In this system, latency would never be more than a few seconds, bandwidth cost is N*100 cps (point to point), N being the number of links in your chain. Implementation would probably be harder than remailers, but much easier than DC-Nets. The protocol would also provide both sender and receiver untracibility without any need for broadcasting. Wei Dai P.S. I never gave a name for the protocol... let's call it Pipe-net. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLzgewDl0sXKgdnV5AQGzvAQAgFaOxOzFPgS031z4jZRYUJp/+3BS5Con Kza7WsvZPvxzaNLh9ecD3aCx5dtf4muaiUKjC2HIItaLKEdZZPdzUGFd4wg1cY8G k8mvYNzDImr3ZtQ0HiqQ59PWhznad0GuhjQajB7RtpI+K/Z4uBaUEZGVoZZT+LHN MSjOl/k/yfg= =jgq6 -----END PGP SIGNATURE-----

1 0

cryptlib 2.00 free encryption library released
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

Version 2.00 of cryptlib is now available from ftp://garbo.uwasa.fi/pc/crypt/crypl200.zip and also from ftp://ftp.franken.de/pub/crypt/misc/cryptl200.zip. The library provides an easy-to-use interface which allows even inexperienced crypto programmers to easily add strong encryption and authentication services to their software. The library contains DES, triple DES, IDEA, MDC/SHS, RC2, RC4, RC5, SAFER, SAFER-SK, Blowfish, and Blowfish-SK conventional encryption, MD2, MD4, MD5, RIPEMD-160 and SHA hash algorithms, and Diffie-Hellman, DSA, and RSA public-key encryption, as well as a comprehensive high-level interface with functions such as cryptCreateSignature() and cryptExportKey(). The library is supplied as source code for Unix (shared or static libraries), DOS, Windows (16- and 32-bit DLL's), and the Amiga. The library provides a standardised interface to a number of popular encryption algorithms, as well as providing a high-level interface which hides most of the implementation details and provides an operating-system-independant encoding method which makes it easy to transfer encrypted data from one system to another. Although use of the the high-level interface is recommended, experienced programmers can directly access the lower-level encryption routines for implementing custom encryption protocols or methods not provided by the library. The library API serves as an interface to a range of plug-in encryption modules which allow encryption algorithms to be added in a fairly transparent manner. The standardised API allows any of the algorithms and modes supported by the library to be used with a minimum of coding effort. As such the main function of the library is to provide a standard, portable, easy-to-use interface between the underlying encryption routines and the user software. In addition the easy-to-use high-level routines allow for the exchange of encrypted session keys and the creation and checking of digital signatures with a minimum of programming overhead. The library has been written to be as idiot-proof as possible. On initialization it performs extensive self-testing against test data from encryption standards documents, and the API's check each parameter and function call for errors before any actions are performed, with error reporting down to the level of individual parameters. The library implements a security perimeter around the encryption functions, with encryption contexts consisting of an arbitrary handle referring to (hidden) data held within the library. No outside access to state variables or keying information is possible, provided the underlying OS provides some form of memory protection. If the OS supports it, all sensitive information used by the library will be page-locked to ensure it is never swapped to disk. There is one small bug I found about an hour after it was released (sigh), you can't use CRYPT_USE_DEFAULT as a parameter to cryptCreateContext() due to missing parentheses in crypt.c. Incidentally, if someone in Europe with a high-bandwidth link to the rest of the world could provide a permanent site for cryptlib betas that'd be useful, since the current beta distribution system is rather ad hoc. Peter.

1 0

Re: COMMUNITY CONNEXION SUED IN FRIVOLOUS LAWSUIT
by Bill Stewart 17 Dec '03

17 Dec '03

At 06:03 PM 10/14/96 -0700, Steven L Baur <steve(a)miranova.com> wrote: > http://www.spa.org/piracy/CODE.htm > ... > 8. Do not sponsor, endorse, or advertise access to infringing > software. I wonder how a "Hack Netscape" or "Hack Microsoft" contest fits in with this, to name two major public services run by C2...... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

1 0

AS2805.65 standard?
by Min-Ming Chin 17 Dec '03

17 Dec '03

Hi, there, Anyone heard of the Australian security standard AS2805.65? Beats me...

1 0

GAK Naive or Shrewd?
by John Young 17 Dec '03

17 Dec '03

Ern Hua's letter is ultimate. ----- The New York Times, October 15, 1996. Is Clinton's Encryption Policy Naive or Shrewd? To the Editor: There is something strange going on with the Clinton Administration's policy on data-scrambling software and Secretary of Commerce Mickey Kantor's defense of it (letter, Oct. 11). If the Administration really wanted to prevent encryption software from falling into hostile hands, it would try to pass a law limiting the type of encryption that can be sold domestically, not just exported. The cumbersome system the Administration proposes may be a measure of its computer naivete. People who are familiar with computer encryption know that strong encryption can be readily had here in the United States over the Internet or telephone lines from dial-up computer bulletin boards. Not long ago I downloaded a copy "Pretty Good Privacy," a system similar to the Rivest-Shamir-Adelman "strong" public-key method. Anyone with a computer, a modem and a phone line could do the same. Or the Government may not be naive at all but merely Machiavelian. Suppose the code breakers at the National Security Agency had managed to develop efficient solutions to "strong" methods. Would it be in the Government's interest to keep that fact a secret and to create a distracting furor by pushing another, weaker (and exportable) encryption system it knows has not a chance being adopted? Then encryption usrs would be lulled into using compromised systems while the National Security Agency decrypts their mail. Warren Wetmore,Hazel Crest, Ill., Oct. 11,1996 ----- To the Editor: Mickey Kantor's Oct. 11 letter is unconvincing. Instead of trying to prohibit strong cryptography, governments should encourage its use. It is the best tool for defending our privacy on the information highway. Jeffrey Shallit, Kitchener, Canada, Oct. 11,1996 The writer is an associate professor of computer science at the University of Waterloo. ----- To the Editor: Mickey Kantor (letter, Oct. 11) says that your Oct. 4 editorial ignores the trend -- especially in Europe -- to require use of key-recovery products and bar the import of stronger encryption products. This ignores that no one wants mandated key recovery. Some important uses of encryption, like secure telephone conversations, do not need key recovery for any reason other than law enforcement intercepts. Mr. Kantor's point on other nations' barring imports is absurd. Since when do we tailor our export limits to the import limits of other nations? The "trend" Mr. Kantor refers to is artificially created by the United States through lobbying efforts. Mr. Kantor uses the word "trend" as if other nations were independently pursuing the key-recovery path, when, in fact, only a few are considering such a move. Some, like Japan, have opposed such a direction. Others, like Sweden, have considered such a move secretly because such a policy cannot withstand democratic scrutiny. Mr. Kantor's letter is a blatant attempt by the Administration to get what it wants for law enforcement and national security agencies without any concern for the nature of the technology or the economic effect of such policies. Ernest Hua, Sunnyvale, Calif., Oct. 11, 1996 The writer is a software engineer. -----

1 0

Threats from FOTM (Friends of Timmy May)
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

I've been receiving multiples copies of threats of frivolous lawsuits in connection with Sandy Sanford's kind offer to address the San Francisco Gay and Lesbian Cypherpunks Meeting (and Meating). Therefore I'm regrettably forced to postpone taking advantage of said kind offer until Timmy May is actually indicted for possession of controlled substances (to wit, Ritalin) and/or sexually molesting two feline minors and/or practicing cryptography without a licence. (Given Timmy May's total ignorance of cryptography, I find the latter to be the least likely.) Hope to see you all then, Dimitri ]Date: Tue, 15 Oct 1996 06:04:16 -0500 ]From: "Douglas B. Renner" <dougr(a)skypoint-gw.globelle.com> ]Subject: Abuse from Dimitri Vulis ]To: root(a)bwalk.dm.com, postmaster(a)bwalk.dm.com ]Message-Id: <Pine.3.89.9610150547.A858-0100000(a)skypoint-gw.globelle.com> ]Mime-Version: 1.0 ]Content-Type: TEXT/PLAIN; charset=US-ASCII ] ]Attached is a tiny example of the type of uncalled-for slander that Mr. ]Dimitri Vulis has been sending unsolicited to a list of subscribers to a ]cryptography forum. ] ]You are hereby notified of this illegal activity by one of your subscribers. ]If you fail to take corrective measures, the Boardwalk Brighton Beach ]BBS and its sysops may be named in a civil lawsuit. ] ]---------- Forwarded message ---------- ]Date: Thu, 10 Oct 96 21:51:57 EDT ]From: Dr.Dimitri Vulis KOTM <dlv(a)bwalk.dm.com> ]To: cypherpunks(a)toad.com ]Subject: Re: LET'S MEET DIMITRI ] ]Sandy Sandfort <sandfort(a)crl.com> writes: ]> his choice of topic, of course. ] ]"Timmy May and his sexual perversions". Illustrated with slides. ] ]--- ] ]Dr.Dimitri Vulis KOTM ]Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps ]

2 1

VOO_doo
by John Young 17 Dec '03

17 Dec '03

October 25 Science reports on the latest teleportation research in "To Send Data, Physicists Resort to Quantum Voodoo." It describes a laser-driven apparatus for transmitting highly secure encoded (but not encrypted) messages via entangled photon states. IBM's Charles Bennett says, "as other researchers work to harness quantum mechanics for computation and cryptography, teleportation could become the equivalent of a quantum mail service." ----- http://jya.com/voodoo.htm VOO_doo (txt) Science is at: http://www.sciencemag.org/

1 0