- cypherpunks-legacy - lists.cpunks.org

PGP 2.6 ???
by dat＠ebt.com 17 Dec '03

17 Dec '03

What's the story with PGP 2.6? I haven't (yet) gotten any hard information about it -- is there mail I should have gotten but didn't? I'm sure glad MIT put out 2.5, before putting out 2.6. It would have been much worse if they went right to 2.6. It does seem fortuitous that 2.5 ever got released at all, or am I missing something? This whole process backs up the point that the whole cryptography infrastructure is important. Maybe the world will split into 2.6+ and 2.5- camps, with the 2.6+ camps being locked onto a bandwagon they can't get off of. Maybe all software in the future will have 2.6+ built into it, making life really unmanagable for the dwindling 2.5- crowd[sic]. How can you get cryptography to the masses when they all have Clipper? You can't -- if it gets that bad, we've lost the battle (although we can keep our own antique 2.5- copy if we want to, as a relic from the "good old days"). I'd bet that 2.6 doesn't have a backdoor in it, but that 2.7 or 2.8 or 3.9 or 123.456 eventually will... And, as I pointed out before, if the world gets saddled with a key length restriction in whatever evolves to become the standard, eventually that will be equivalent to a back door. Maybe I'm too pessimistic, but how can we fight the infrastructure battle? I'm sore afraid that our brand of crypto is like trying to peddle a new OS to compete with Unix/NT/... -- it just ain't real easy to displace a "standard", flawed though it may be... Any ideas are welcome -- I'm just running a little low now. -- dat(a)ebt.com (David Taffs)

2 1

[ANON] War in rec.guns
by anonymous＠extropia.wimsey.com 17 Dec '03

17 Dec '03

[[Reply-To: john.nieder(a)tigerteam.org]] * Original msg to: Thomteach(a)aol.com -=> Quoting Thomteach(a)aol.com to John Nieder <=- Th> Frankly, if anyone should be discreet, I wish it would be the folks Th> who use my personal E-mail address. Getting exposed to the message Th> involuntarily is something of a drag. At least when such messages are Th> posted to the rec.guns address, I am left with the _choice_ of whether Th> or not to access the post. Alas, Tom, this is untrue. My posts to rec.guns are being stopped by the moderator, as are at least some of the other pro-anon messages going to the group. I put a Bcc: list up including you and others who had commented on the [ANON] thread there or to me by netmail so you would have an unfiltered source for my posts in the continuing discussion. You may get two more posts from a mailing I already sent out tonight, but in that you are apparently requesting that you receive no more netmail on this I will delete your name. Any others receiving these posts netmail who do not wish to, please let me know and I will delete them from the Bcc: list, with my apologies. If indeed the moderator was following his philosophy of - what was it? - "sunlight" or "openness," in the newsgroup instead of selective suppression of dissenting messages, these mailings would have been unnecessary. Thanks for your patience. |%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%| | <john.nieder(a)tigerteam.org> * CP2A * PGP Key # E27937 on all servers | |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| |"If you love wealth better than liberty, the tranquility of servitude | | better than the animating contest of freedom, go home from us in | | peace. We ask not your counsels or arms. Crouch down and lick the | | hands which feed you. May your chains set lightly upon you, and may | |posterity forget that ye were our countrymen." -- Samuel Adams, 1776| |=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-| |BOYCOTT: Pepsico <KFC - Taco Bell - Frito-Lay - Pepsi-Cola> & Gillette| |%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%|

1 0

Hmm
by Robert A. Hayden 17 Dec '03

17 Dec '03

Hmm, since I brought up the idea, can I take a flat 10% off the top of any winnings? Sorta a finders fee or someting? Robert "momma needs a new hard drive" Hayden -- ____ Robert A. Hayden <=> hayden(a)krypton.mankato.msus.edu \ /__ -=-=-=-=- <=> -=-=-=-=- \/ / Finger for Geek Code Info <=> Political Correctness is \/ Finger for PGP 2.3a Public Key <=> P.C. for "Thought Police" -=-=-=-=-=-=-=- (GEEK CODE 1.0.1) GAT d- -p+(---) c++(++++) l++ u++ e+/* m++(*)@ s-/++ n-(---) h+(*) f+ g+ w++ t++ r++ y+(*)

1 0

Barlow Liberty Essay Airs on PBS May 17
by Stanton McCandlish 17 Dec '03

17 Dec '03

Forwarded message: Date: Mon, 16 May 1994 10:34:42 -0800 From: John Perry Barlow <barlow(a)eff.org> Subject: Barlow Liberty Essay Airs on PBS Tomorrow Night Folks, I commend to your attention a video essay on Liberty which I did for PBS last summer. It will air tomorrow May 17 at 10:00 PM EST (your listings may vary) as part of a program called Declarations. Could I please persuade those of you who re-post to put this in any places where there might be people interested? Thanks much. Enduring, Barlow -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich Partners, two-thirds said it was more important to protect the privacy of phone calls than to preserve the ability of police to conduct wiretaps. When informed about the Clipper Chip, 80% said they opposed it." - Philip Elmer-Dewitt, "Who Should Keep the Keys", TIME, Mar. 14 1994

1 0

Fixing pgp 2.6
by Mike Ingle 17 Dec '03

17 Dec '03

>In order to fully protect RSADSI's intellectual property rights in >public-key technology, PGP 2.6 will be designed so that the messages it >creates after September 1, 1994 will be unreadable by earlier versions >of PGP that infringe patents licensed exclusively to Public Key Partners >by MIT and Stanford University. PGP 2.6 will continue to be able to read >messages generated by those earlier versions. So it will produce readable messages before Sept 1, 1994? Then there must be an if somewhere in the program to check the date. That should be fix- able with a patch of a few bytes to the object code. The best way to uncripple it would be to distribute a small .exe program which patches your version of PGP in place. Also include the source for the .exe so nobody thinks it does anything evil. We are being divided and conquered. If PGP 2.6 succeeds, our goal of a worldwide strong crypto standard is dead. This needs to be stopped. --- Mike

2 1

Re: Fixing pgp 2.6
by Hal 17 Dec '03

17 Dec '03

I think there are some things being overlooked in this discussion. First, note the strong hint in Schiller's message about operators of key servers who accept pre-2.6 keys being guilty of contributory infringement of the RSA patent. I think we can expect strong legal pressure from RSA to shut down the remaining U.S. key servers, even those which don't use illegal versions of PGP. They succeeded once in shutting down the key servers which used PGP; they will succeed again in shutting down the others due to the contributory infringement threat. For the same reason, hopes of getting a non-RSA-approved "2.6a" (hacked to be backwards compatible with 2.3) widely available in the U.S. are not well founded. FTP sites which hold programs or even patch files to allow 2.6 to interoperate with 2.3 will be targetted by RSA as contributory infringers. In short, the legal advantages PGP 2.6 will have over unapproved versions will be strong enough that it will be widely used in the U.S. However, this does not mean the loss of international encrypted communications. The solution is simple. PGP 2.3a will be patched to be compatible with PGP 2.6. I don't know what we'll call it, "PGP2.3e", perhaps, where "e" is for Europe. 2.3e will have the speed advantages of 2.3a, no copyright problems with RSAREF use, be perfectly legal outside the U.S., and will interoperate with 2.6. Converting from 2.3a to 2.3e will be no more difficult than converting from 2.2 to 2.3 was. Although I hate Jim Bidzos' guts for what he has done to Phil, he holds the legal upper hand for the next few years. The present course does allow for wider use of encryption by the public, which we can all support. Look at it rationally, and 2.6 is a step in the right direction. Hal P.S. It's possible that pre-2.6 keys will not interoperate with 2.6, in which case users of both 2.6 and what I am calling 2.3e will have to generate new keys. This is no great problem; people should make new keys and retire their old ones every year or two anyway, IMO.

2 1

PGP outside the US
by SINCLAIR DOUGLAS N 17 Dec '03

17 Dec '03

A repeated comment that I see in cypherpunks is that "PGP 2.5 is illegal for use outside the US" and thus communications cannot take place between those in the US and outside using PGP 2.5. However, as I see it PGP 2.5 (or 2.6) is only illegal for use outside the US by US law. Most of us ouside the US really don't care about US law. The only problem is the export of PGP 2.5 from the US, which need only occur once. I can't believe that this hasn't already happened. So: US users can legally use PGP 2.5. Foreign users can also use PGP 2.5 until the US decides to kidnap them. As far as I know there are no laws against sending encrypted traffic across the border. Where lies the problem? -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.5 mQCNAi2LQpQAAAEEAMHIQtQtNi657RDTxpiBAXIonSlwjQJMM/jHbxLlk+bntkEJ g2y4ymguOpdlfEfnSud170Rnc1u04RoCM2CNBlEaNrjBAFTHXzjR6+X7JJ0rj53j 6Ju9U57GiWp+8e0RP/gUADnsplPZeYBlMpTT7Mt93AM2ZTSxFcyi36CIyUXVAAUR tCdEb3VnIFNpbmNsYWlyIDxzaW5jbGFpQGVjZi50b3JvbnRvLmVkdT6JAJUCBRAt i0PDIQX2Z9wex38BAdLMA/4g7HZQq7d3wC0jWoJL5XP7hiegXLT/8WenhBwL2DrR ILDvw2Pe1LGjBtmx4ynFq0Mplo6rIw/uSbMjMX+8AnF8Tei6tRaKj9N97YwziU2B B7AsLWRAnyAzaVoz2vYTPv0IiEbRguvFEem5yakMIfNM7+3dVlQFL4DSCjr8P4Qa qYkAlQIFEC2LQxnoHJmBi3GtGQEBbn4EAI0BynCzIfZFUaH+SeuoHovwsVt4ahZ9 YlqmwzN9Bfd/O4UKIvvYMQc9WnqmbX+I+LNduimIl/XAnUHANXF2ABcx+lbfw5wf j3U/9tkvfqB2Z4Ogtrf5XLN5wAnX8kaWvEqPiMzmxvPQlHIY75GGzhFCVocyBJV0 pRspTpUraoNR =JT40 -----END PGP PUBLIC KEY BLOCK-----

3 2

Re: PGP 2.6 and the future
by lefty＠apple.com 17 Dec '03

17 Dec '03

>Allan Bailey says: >> I'm willing to wager that this 2.6 and maybe 2.5 versions are >> hacked by the NSA to put in their spiffy key-escrowed backdoor. > >How much are you willing to wager? I'll take the bet at any size. I'll pick up any piece of this action which Perry is unwilling, or unable, to cover. -- Lefty (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

1 0

Re: Rabin
by Karl Lui Barrus 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- About Rabin (and you're welcome, Mr. Anonymous!) Well, I looked at Schneier on p. 290 and I have to confess I'm puzzled. I'm sure these formulas weren't invented out of this air, but I'm not sure why one of them must equal M. (In the example worked none are equal to M). I would bet that this is a typo in the book; check the errata sheet I think the formulas are trying to say the following facts: For the kinds of problems we are considering, If m1 = CRT(n,p,q,x1,x2) m2 = CRT(n,p,q,x1,q-x2) m3 = CRT(n,p,q,p-x1,x2) m4 = CRT(n,p,q,p-x1,q-x2) then m4 = n - m1, m3 = n - m2 So you really don't need to do CRT four times; twice is good enough. (In the example, m1 = 71, so m4 = 77 - 71 = 6 m2 = 50, so m3 = 77 - 50 = 27) Karl Barrus klbarrus(a)owlnet.rice.edu -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLdhB04OA7OpLWtYzAQEV3wQAjgcz1AI1ufFfzUpQmh35E0xbeD+PB4FV mc72TL0v7lvjeK4aiGwEK8j/1vtzvw+1QCkSRTY6ATElx4HnskdV0yp4CT8WycPC X/QmeYkqOr+Q4ed0dXgvjYOO++4FOBaqQUqRaTLLgB/BKndfDVbM683MGxtbLOSe gCi3SP86CuU= =REkP -----END PGP SIGNATURE-----

1 0

PGP 2.5 Beta Release Over, PGP 2.6 to be released next week
by Jeffrey I. Schiller 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The beta version of PGP 2.5 is now being removed from MIT file servers. In about a week, MIT will begin distribution of a new release numbered PGP 2.6. PGP 2.6 will incorporate a new version of RSAREF, scheduled for release by RSA Data Security next week, and will also correct bugs that were reported in PGP 2.5. In order to fully protect RSADSI's intellectual property rights in public-key technology, PGP 2.6 will be designed so that the messages it creates after September 1, 1994 will be unreadable by earlier versions of PGP that infringe patents licensed exclusively to Public Key Partners by MIT and Stanford University. PGP 2.6 will continue to be able to read messages generated by those earlier versions. MIT's intent is to discourage continued use of the earlier infringing software, and to give people adequate time to upgrade. As part of the release process, MIT has commissioned an independent legal review of the intellectual property issues surrounding earlier releases of PGP and PGP keyservers. This review determined that PGP 2.3 infringes a patent licensed by MIT to RSADSI, and that keyservers that primarily accept 2.3 keys are mostly likely contributing to this infringement. For that reason, MIT encourages all non-commercial users in the U.S. to upgrade to PGP 2.6, and all keyserver operators to no longer accept keys that are identified as being produced by PGP 2.3. -----BEGIN PGP SIGNATURE----- Version: 2.5 iQBVAgUBLdezEVUFZvpNDE7hAQGRhAH+KACuaOfMynsL9QGmJpp9ToWEJB+1OFGb whoZbHbw/H268zIrFoCcm24UITcBiIcuSsk3ydpMyFTb/YBgIbzgqQ== =EbV1 -----END PGP SIGNATURE-----

10 9