- cypherpunks-legacy - lists.cpunks.org

Re: making public keys public
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Eric Hughes writes: > > If you're not going to make the public key public, why use public key > > cryptography at all ? Save time and effort and use a symmetric cipher. > > You can't do authentication with a shared secret key, because there's > nothing to differentiate the two sides of the link. Is it really important to distinguish the two sides ? The additional threat is that an attacker could spoof my correspondent to me, once she's grabbed my secret key. But a) I thought we were assuming that other people being spoofed is _their_ problem, not ours, and b) if she's nabbed my key, odds are she's hacked my account anyway, leaving me with much larger problems. > In addition, a closely held public key might be held by 10 people; Hmm, `closely-held' suggests that the `public' key is being passed around as a secret over some channels, in which case it might as well be a secret key being passed around over those channels to the 10 people. > with secret keys there are 90 different private keys instances to > manage. Wouldn't there only be 45 ? I agree that this is quite a few, but it's a reasonable tradeoff between disk space and processing speed unless you're communicating with a large number of people. - - -L. Futplex McCarthy; PGP key by finger or server "We've got computers, we're tapping phone lines; I know that that ain't allowed" --Talking Heads - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLuLvdWf7YYibNzjpAQG0GQP9FIJkCLF4XbZEoydrVfCnHg32FGL5EQ1A 2286GqvVQuy6hwtqV888TOZmLkQpMjrmq+paTQpozu5s8L4z/L9WZbbyk0C/alMv faTwpUe1neSStR3KbrxK0BuP70OBKBbdZZfHI/t4Kn8jTimeBA/IG2Iou/8gecX2 g8d0otexmwI= =FtUZ - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuLwpyoZzwIn1bdtAQFUfgGAsdDHynQfWLxX+cmCz9vxkzwQ0sIikuVG XCp0rwhl/C1P1HXBF2Xk135HXa7RO6kC =OnyQ -----END PGP SIGNATURE-----

1 0

Re: public accounts / PGP / passphrases
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Thanks to Derek, Jonathan, Rich, Mike Duvos, and Scott Collins for the responses to my query. It seems everyone agrees that the PGP private key is not trivially breakable without the pass phrase, so I'm keeping my pass phrase. All of the techniques mentioned were familiar to me, except this bit from Mike Duvos: > Given the state of Unix security, I would certainly not want to > type my passphrase into a Unix box unless I was the only user, > was directly connected to the box through a wire I could see, and > had just done a fresh boot after verifying the MD5 hash on all > the OS binaries. Could you clarify where the `clean' copy of the hash of the OS is being stored, if not on the machine in question ? I must confess that I'm not personally prepared to push my machine into an early grave by rebooting before I sign or encrypt anything. Besides, I'd be pushing _myself_ into an early grave if I did that. YMMV. I have a 386 at home, on which I suppose I could run PGP, but that doesn't help. Why ? Simply because going home to dial in is a major inconvenience. Leaving aside my unwillingness to stay home in the evening just to use my public account, it's utterly impossible for me to leave work during the day whenever I want to use PGP. The only solution I can imagine is to keep a notebook computer running Linux at work, and dial in to the DECstation five feet away from my desk at work. I've no idea how to convince the tech staff here to add a dedicated phone line to my lab for this purpose. Any better suggestions on using PGP safely during the workday ? - - -L. Futplex McCarthy; PGP key by finger or server "We've got computers, we're tapping phone lines; I know that that ain't allowed" --Talking Heads - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLuLpDGf7YYibNzjpAQEu5gP8CVtFJwKVGalnl8c4F52vrfzK7NV3JRMh AB2w9L8ePbpggSM65YGN4kkuUyS8BMi6sbLUS2GtupVK6/vaKK/kDngKMIB+XS5D GOLbKy8iieEm7NEwO5C4cwV8qnRorQ1Ox+l+LaGPOc/pl+ecT4rJtEGlBbj9NZV0 4p8E6Kw/66w= =BMWc - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuLqOCoZzwIn1bdtAQHdcwF9FjHQgEomyI/m8ShddvEhCCbq4qbhPwEQ NMk4ookuD8nTs0/ov3DKqDHfQrxwjeTU =5rbF -----END PGP SIGNATURE-----

2 1

backing ecash
by Alex Strasheim 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [Standard disclaimer: all of this may be based on some misunderstanding of the underlying situation on my part.] I've been thinking about what Eric and others have written about the apparent problems Digicash is having hooking up with financial partners. I agree that it would be encouraging if some large banks or a credit card company were on board, but I'm not sure their absence is as big of a problem for a digital currency system like Digicash as it would be for other types of systems. If a transaction system uses credit card numbers to process purchases, then you need to have either a credit card company that's willing to participate, or someone with a merchant account to submit purchases to the system. Obviously, if the credit card company doesn't want to allow the online system, they can prevent people with merchant accounts from participating, so it's important to have them onboard. But digital currency is a commodity, or at least an incredibly lifelike simulation of one. If someone's willing to make a market for it, it will have value, assuming the system's secure and the mint behaves responsibly. Suppose Digicash opened up a digital currency exchange in Amsterdam. They agree to make a market in edollars. Specifically, they agree to sell edollars for $1US, and they agree to buy edollars for $0.99. This prices are good for all time, for all comers. The promise to sell is easy to keep, because they can mint as many edollars as they want. The promise to buy is backed up by cash reserves, which they create with revenues from sales. Let's suppose, just for the sake of argument, that the currency exchange doesn't even conduct business over the net. You have to walk into a storefront in Amsterdam with a floppy disk to buy or sell edollars. Edollars would still have value here in Lincoln, NE USA. I could find a partner and set up a local currency exchange here in Lincoln; my partner would set up shop in Amsterdam. We'd offer to sell edollars for $1.01 and buy them for $0.98. We'd keep reserves of both edollars and US dollars on hand, from which we'd do our trading. If we started to run low on edollars, my partner would go to the storefront and buy some more. If we started to accumulate too many, he'd sell. The prices are set up so that we'd always make a profit, assuming our volume was high enough to cover expenses. Now suppose that Bob, who runs a local business here in town, wants to sell widgets over the net. He decides to use digicash software. Alice lives in Hoboken, and she wants to buy a widget. She goes to a digital currency exchange in Hoboken and buys some edollars, and then she uses her digicash client to transfer the funds to Bob at Widgets 'R Us. Every day, Bob goes to the bank and deposits the day's checks at the drive through window. Once he started selling online, he stops at my drive through window every day on the way to the bank. He gives me the edollars, and I give him a check. Then he deposits my check along with all the others at the bank. If my check is good, the bank can't say much about things one way or another. You don't need Visa or Citibank or anyone else onboard. They're not part of the loop. You just (just?) need the government to agree to stay out of the way. Now obviously, things would work a lot more smoothly if you didn't need me or my digital currency exchange. It would be nice if Bob and Alice could buy and sell edollars from their banks online. But it's not essential. I could extend credit to Alice so that she could buy edollars from me online, without having to go out and physically buy them. If Bob and I have been doing business for a while, maybe he'll trust that I'll mail him a check after he transfers edollars to me online. I suspect that if I started to make money, banks would decide to put people like me out of the business by moving into it themselves. It seems to me that one of the main strenghts of the digicash system is that it can take off slowly as more and more people decide to use it. It doesn't need to be embraced by anyone except the regulators. If it's cheaper and provides a better service, it will win. == Alex Strasheim | finger astrashe(a)nyx.cs.du.edu alex(a)omaha.com | for my PGP 2.6.1. public key -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLuKXVBEpP7+baaPtAQEaLwP+K0MU9agIOaLb9SI9Bwv9732P5ltsdeJ5 45z2IUPzOPRJn/o+ivXJv7sjP1hIlTXMKjA2Q0Lpy2gplDIa8/cqz9WmqSku837o nJc13tdsJevfNjtEUztC1kfrTsrZjwxW2L+hg0uL9GJSxFhU6G+eKqsXYH5nlEFZ b1w2wFbzf5c= =4/Jz -----END PGP SIGNATURE-----

3 2

RE: Date?
by Johnathan Corgan 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > Is it really Christmas eve already where you are? Hehe, you caught me fiddling with my system date to generate a 2048 bit key with PGP. Actually, if it were Christmas Eve already, that would mean that the pain of holiday shopping had already past.... ======================================================================= Johnathan Corgan "Violence is the last refuge of the incompetent" jcorgan(a)netcom.com -Isaac Asimov PGP Public Key: http://www-swiss.ai.mit.edu/~bal/pks-toplev.html Or send email to: pgp-public-keys(a)pgp.ai.mit.edu Subj: GET jcorgan ======================================================================= -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLuMiW01Diok8GKihAQFs0QP/UplPL2g2t86goL1o5xK3gkv9IM6nGeEW GCe41PX3Q4yiYkopIz+1bXe9kGYvrd9jJ0fusM9CRp+QnaiizzZxudAL7BGRlsGD 9c0jLLR9KtFmiiSQM5pgBIMEzXC3zPY+Xm+hPhV6/URx84qxrcjneOrnOJjBtjkO ekZ8ApHUhxo= =wNu9 -----END PGP SIGNATURE-----

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.30.tar.gz For the PGP public keys of the remailers, as well as some help on how to use them, finger remailer.help.all(a)chaos.bsu.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"vox"} = "<remail(a)vox.xs4all.nl> cpunk pgp. post"; $remailer{"avox"} = "<anon(a)vox.hacktic.nl> cpunk pgp post"; $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"rebma"} = "<remailer(a)rebma.mn.org> cpunk pgp hash"; $remailer{"jpunix"} = "<remailer(a)jpunix.com> cpunk pgp hash latent cut post ek"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash"; $remailer{"soda"} = "<remailer(a)csua.berkeley.edu> eric post"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub"; $remailer{"usura"} = "<usura(a)xs4all.nl> cpunk pgp. hash latent cut post"; $remailer{"desert"} = "<remail(a)desert.xs4all.nl> cpunk pgp. post"; $remailer{"nately"} = "<remailer(a)nately.ucsd.edu> cpunk pgp hash latent cut"; $remailer{"myriad"} = "<remailer(a)myriad.pc.cc.cmu.edu> cpunk pgp hash latent cut ek"; $remailer{"xs4all"} = "<remailer(a)xs4all.nl> cpunk pgp hash latent cut post ek"; $remailer{"flame"} = "<tomaz(a)flame.sinet.org> cpunk pgp hash latent cut post ek"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk"; $remailer{"mix"} = "<mixmaster(a)nately.ucsd.edu> cpunk hash latent cut ek"; catalyst(a)netcom.com is _not_ a remailer. Last ping: Mon 5 Dec 94 6:00:01 PST remailer email address history latency uptime ----------------------------------------------------------------------- xs4all remailer(a)xs4all.nl ++##******+* 7:31 99.99% usura usura(a)xs4all.nl ++##******-* 13:31 99.99% alumni hal(a)alumni.caltech.edu +##**-*+*+** 11:24 99.99% penet anon(a)anon.penet.fi +++++++++*** 1:00:13 99.99% c2 remail(a)c2.org +****-++++-- 37:40 99.96% flame tomaz(a)flame.sinet.org ***#***+*++* 8:43 99.92% nately remailer(a)nately.ucsd.edu ++++++++++++ 44:54 99.92% portal hfinney(a)shell.portal.com ###*-****** 6:46 99.85% jpunix remailer(a)jpunix.com ###****+*++* 8:11 99.83% vox remail(a)vox.xs4all.nl .-.-------- 10:32:31 99.99% desert remail(a)desert.xs4all.nl ----------- 8:03:49 99.99% myriad remailer(a)myriad.pc.cc.cmu.edu ###*****+** 5:11 99.70% rahul homer(a)rahul.net ###**** **** 4:32 99.37% bsu-cs nowhere(a)bsu-cs.bsu.edu #*.# ** *+-* 50:33 99.05% mix mixmaster(a)nately.ucsd.edu -+-+- 59:51 98.94% ideath remailer(a)ideath.goldenbear.com ###**** *** 8:21 98.77% extropia remail(a)extropia.wimsey.com +---.--+++ 3:59:21 98.42% rebma remailer(a)rebma.mn.org -_.--..*-.. 22:38:33 98.13% soda remailer(a)csua.berkeley.edu -....-. 12:55:27 86.22% For more info: http://www.cs.berkeley.edu/~raph/remailer-list.html History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). Options and features cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. oldpgp Remailer does not like messages encoded with MIT PGP 2.6. Other versions of PGP, including 2.3a and 2.6ui, work fine. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. special Accepts only pgp encrypted messages. ek Encrypt responses in relpy blocks using Encrypt-Key: header. Comments and suggestions welcome! Raph Levien

1 0

crypto, why not catching on?
by William A. Kennedy 17 Dec '03

17 Dec '03

internet: kennned09(a)ssw.alcoa.com This is a response to Tim May's well-thought-out piece on "why cryptography has not caught on." I think cryptography _has_ caught on. There are people in the crypto debate now that weren't there two years ago; perhaps even one. I think we should not measure the commitment to the cryptography debate buy counting the amount of encrypted traffic . There just isn't that much that people send that needs to be encrypted. Our debate should, and does, focus on the rights of people to have the technical tools to insure the privacy of messages and other communication that they deem to be worthy of special handling. Thanks to people like Phil Zimmermann and Romana Michado, and many others I'm sure that I don't even know about, we have those technical tools and should now be fighting for the right to use them. Interestingly enough, I sent a message to Phil and got a response from his vacation program. In it he tells us that, if we think that our message to him needs to be encrypted, then please allow more time to get it read.

1 0

Re: public accounts / PGP / passphrases
by merriman＠metronet.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >> Leaving aside my unwillingness to stay home in the evening just to use my >> public account, it's utterly impossible for me to leave work during the >> day whenever I want to use PGP. The only solution I can imagine is to keep >> a notebook computer running Linux at work, and dial in to the DECstation >> five feet away from my desk at work. I've no idea how to convince the tech >> staff here to add a dedicated phone line to my lab for this purpose. Any >> better suggestions on using PGP safely during the workday ? > >What's the matter with running a serial cable from your laptop to the DEC? I may have missed earlier bits of this thread, so I'll simply point out that it is quite possible to run PGP from a floppy disk - either having the entire program on floppy, or just the keys. It's what I do when I may need access from an 'unsecure' machine. Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLuNCcMVrTvyYOzAZAQGpQwQAl6YMhg3oRGYnrfzpIDwTPGEEfyrGTrdO 0JR6Y/p0QAXKL5RjsOI8CdN2EBBZpOhNwGdxsttOr7wD/cXODty2Dw+U2RVNzj1X FAAnznFzvafROW8OfZo8+aCqS3ThYWWIme1D8seqEVsVfpD10us7SNoMkwSJLY8Y CMSxGy4rY6k= =gm/4 -----END PGP SIGNATURE----- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAi3uZ2MAAAEEALWQtxX77SZSaFls6cVbPp+fZS4MNyKK3ZFYQo0qWyj+0tMq YgRTPRJRaCQixo63RttknogfPp514qdVMZw5iPeOXmD+RxrmTTwlbGqA7QUiG1x5 LG2Zims5zk4U6/rt8hwLh0/8E4lIb9r5d31qc8L1A9Twk/cmN8VrTvyYOzAZAAUR tClEYXZpZCBLLiBNZXJyaW1hbiA8bWVycmltYW5AbWV0cm9uZXQuY29tPokAlQMF EC6sAl+SAziJlog3BQEBxX8D/05ub986Io1PaGJgDtVlbMOPh2pjdB3QSpA8T7bh ngpsTbogz7LnFY6nLTH24dVswnzRGzX2XYN2FXQzYLEKpbuJPF85620EqEJt7eck kDSr0MdCorCZ3ntHGlaRIEOG8En7r/NUxtPJSbeANHyKV0pZTJ0ZF3p71yAZoCU1 JJWoiQCVAwUQLqcRtKljmJBIq8VdAQFFCQQAidBWF05UfZ3HdLTZ2BjhkiztbHIL fCMVAzMkNobRLH0jcQ+o4N9Ny7gAP2bHreadCYQAiyx24LWZaWB+LkG48vVXvSa1 Zv+ksrEp19U30jReTaDHMRg2IDQ0S7T/+YykWf4cx/L4x0ll55zfT29THWHVqpeA 4w0PnSBJubMsG6iJAJUCBRAt7mhNxWtO/Jg7MBkBAWyPA/9BYsA3G33jcg1SfuxC Fh4yMVZCBrvgK2FBJZUdxkgR1WfVYe5/GzV3jRzJxuXGdt0yzFb8HsocRUvnA4vi O6Jngza+seuc+dNC8X1LyyuW0rkogVZE6ds/v4qI2P+uticCh8xBLp7ieAjvGIcc tdQnXrMxF+w6V80cSy/dqxJjtg== =WVf6 -----END PGP PUBLIC KEY BLOCK----- - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)feenix.metronet.com for PGP public key and fingerprint. PGP encrypted Email welcome, encouraged, and preferred. "Those who make peaceful revolution impossible will make violent revolution inevitable." John F. Kennedy

1 0

;-) The definitive argument for e$: tainted cash
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Fun Facts to Know and Tell About *Your* Legal Tender... > >From the August 1993 American Bar Association Journal >> >> > >> >"The mere presence of trace amounts of cocaine on a common object ... >> > is insufficient to support a felony conviction of cocaine." Lord v. >> > Florida, 91-2147. >> > >> >"[T]he evidence of the narcotic-trained dog's alert to [tainted] currency >> > is of extremely little probative weight. . . . It cannot be doubted >>that >> > contaminated currency is widespread. The presence of trace narcotics on >> > currency does not yield any relevant information whatsoever about the >> > currency's history." US District Court Judge Thomas Wiseman of >>Nashville, >> > Jones v. DEA, No. 3:91-0520 (April 21, 1993). >> > >> >"The probability that every single person in the United States is >> > carrying drug-tainted money is almost certain." -- Dr. James Woodford, >> > forensic chemist in Atlanta. Woodford cites a 1989 experiment by Miami >> > toxicologist Dr. William Hearn, who gathered 135 dollar bills from banks >> > in twelve cities. 131 had traces of cocaine. >> > >> >It also cites a 1985 study by the Miami Herald, which asked eleven >>prominent >> >local citizens to supply a $20 bill for testing, including the Catholic >> >archbishop, George Bush's son Jeb, and Janet Reno. Ten out of the eleven >> >bills had traces of cocaine. >> > >> >Finally, there's a reference to an until-now secret 1987 DEA study >>showing >> >that 1/3 of the money at the Federal Reserve Building in Chicago was >> >tainted with cocaine. It's thought that cocaine is transferred from some >> >bills to agencies' high-speed sorting equipment [...] Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

PGP on a VAX
by peace＠BIX.com 17 Dec '03

17 Dec '03

ViaCrypt PGP is now running on a VAX. It will be released after all quality control is complete, in about 2 weeks.

1 0

Re: Oceania?
by Rich Salz 17 Dec '03

17 Dec '03

>They find government by Singapore particularly comforting >because Singapore has demonstrated expertise in minimizing >the dangerous infection of freedom that accompanies >capitalism. Here's something kinda spooky. An OSF staffer doing consulting with the Singapore gov't was asking about how well the DCE security server scales. They're starting a pilot program to make, from birth, every Singaporese an entity known to their server. Based on other questions, I gather the DCE identity card will be used by all gov't services. /r$

1 0