- cypherpunks-legacy - lists.cpunks.org

DNS key distribution/keyservers
by root 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- A while ago, Peter Trei <trei(a)toad.com> said: >Don Eastlake has actually done a draft RFC on >using the DNS for key distribution. > >It may be found at > >ftp://ietf.cnri.reston.va.us/internet-drafts/draft-ietf-dnssec-secext-04.txt [snip] I'm sure everyone agrees that a 5 meg keyfile is a bit big, but has anyone considered working on the QUALITY of the keyfile instead of making it easier to retrive QUANTITIES of keys.. Ie: What about creating one big web of trust out of current keys. Or maybe allowing keys only if they have some connection to some other key previously submitted, or simultaneously submitted. Currently, having one big keyfile creates the impression that keys distributed over a keyserver are more valid. In a sense they are, but only because someone who's being spoofed could learn of the key that is supposedly theirs. However, there's really no reason to trust a key as anything but a nym unless it's signed by someone in _your_ web of trust. I believe that modifying keyservers to accept only keys that are linked to currently known keys would encourage everyone to become part of that web of trust. After all, the public key of a nym can be obtained from the nym themself. Anybody have any thoughts on this? Don -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMEF2psLa+QKZS485AQHo/QL9GIEsboNghINgrzE5mnW/2d9i/sn4tgzw 5Ne9zerIdT0QcUWOI/ETw4pYMf8CBPD7iSU1oHxv+qoa/vgxGJCPW9fKYKPURYzE Aev2zw5Js4BnQqYKhhvPpnEEsGqnuuAd =0h+o -----END PGP SIGNATURE----- <don(a)cs.byu.edu> fRee cRyPTo! jOin the hUnt or BE tHe PrEY PGP key - http://bert.cs.byu.edu/~don or PubKey servers (0x994b8f39) June 7&14, 1995: 1st amendment repealed. Death threats ALWAYS pgp signed * This user insured by the Smith, Wesson, & Zimmermann insurance company *

1 0

Re: (Fwd) Re: Law enforcement and PGP ban in Australia
by Mark 17 Dec '03

17 Dec '03

>X-News: uqvax aus.net.policy:286 >From: Peter Merel <pete(a)extro.su.oz.au> >Subject:Open Letter from Steve Orlowski >Date: 18 Aug 95 06:52:32 GMT > >I've received something that purports to be an open letter from Steve >Orlowski. Be warned that the letter has no digital authentication with it, >so it may have been forged. However it reads like the real magilla, so I'll >post it here in the hope that it might inform debate a little. > > >--------------------- cut here ---------------------------- > > >Dear > >Thank you for your comments on the subject of the use of encryption by private >individuals. > >Firstly I would like to make the point that the debate has arisen from one >person's interpretation of a paper I gave at a conference on "Cryptography >Policies and Algorithms" The full text of that paper is now available on the >net at > > http://commerce.anu.edu.au/comm/staff/RogerC/RogersHome.html > >The paper carries a disclaimer at the top that the views are mine and do not >necessarily represent the views of the Australian Government. The paper sets >out the Government's policy on telecommunications interception, which includes >the issue of the use of cryptography as: > >"As a result of the Report, Australia is, among other TI issues, monitoring the >impact of encryption in the telecommunications interception area and will >re-examine matters in 1997 following the opening of the telecommunications area >to full competition." > >Telecommunications covers both voice and data communications. > >The last paragraph of the paper says that there is a need to expand the >cryptography debate to cover the needs of individual users in the context of >the information superhighway rather than current Internet users. The paper >also points out that issues such as cost, convenience and public confidence in >cryptography systems will be the main issues. Public confidence is explained >in terms that as long as it meets the general requirement for privacy it will >be acceptable. I still maintain that the general user of the superhighway in >the next century will be satisfied with a lower level of encryption which will >meet that and cost and user friendliness requirements. > >On specific point made in the Internet message, the paper does not suggest, >either directly or by implication, that individuals should be banned from using >encryption. > >Regarding the use of higher level encryption, the paper supports the concept of >commercial key escrow where organisations hold their own keys but may be >required to provide them in response to a court order. the same would apply to >individuals who could either hold there own keys or store them with a >commercial body. Access to those keys would be by court order and in that >respect is no different to existing procedures for the interception or seizure >of telephone conversations or paper records. There is no suggestion that these >basic principles, and protection of individual's rights in general, should be >changed > >If individuals were to use lower level encryption there would be no need for >them to maintain copies of any keys for such systems. To my mind this is >preferable to a requirement for keys to be maintained for all encryption >systems, which could be the result if universal key escrow were introduced. > >Finally on the question of interception, the general public expects a >reasonable level of law enforcement to ensure the protection of their person >and property. Governments are required to find a balance between this and the >rights of individuals to privacy. Part of this balance is to ensure that law >enforcement authorities convince a court that there is a need to carry out an >interception. There is no suggestion that this fundamental approach should be >changed. The paper certainly does not suggest that the Attorney-General's >Department should become a centralised interception authority. In fact such a >role would not be consistent with its role as a source of advice to Government. > >I hope the above clarifies both the Government's policy and my personal views >on these matters. > >I consider this to be an open letter and have no objection to it being used as >such. > >Yours sincerely >Steve Orlowski

1 0

SSl challenge - it was fun!
by Sherry Mayo 17 Dec '03

17 Dec '03

> Hi > > Someone asked about the SSL challenge. Well if you're interested > here is a personal view from a "client" participant. > > Despite criticisms posted to this > list I think it worked pretty well for a first attempt, > mainly due to Piete for hacking out new code and fixing things > pretty quickly when things went wrong. > > There was very little time to test software initially and > get problems ironed out. I couldn't get brutessl to compile > without tinkering and had timeout problems with brclient > due to the sometimes slow > link from Austalia. Later versions of client software (that I didn't > get till half way through the challenge) seemed to run without > any problems and without losing ACKs. But my old client had failed > to ACK quite a few of its earlier keyspaces and due to lack > of a logfile I ended up writing a script to redo them and > ACK them with the new version of the client software. > > One problem with being in Australia was that I was asleep when > new software updates were announced and tended to get them later > than everyone else, and because of this an auto-update would > be particularly useful to me if we do this again. > > In the end it needed a bit of user intervention to get all > my keyspaces ACKed but the problems were sorted out by the > time the challenge was half way through and I think the next > time we try this (and I hope we will) it will run much more > smoothly. It was a good "learning" experience for all of us > (especially Piete!) and should be regarded as what it was: > an experiment that didn't run completely smoothly but was > ultimately successful. > > Taking part in the challenge was fun and I hope we can do > another challenge sometime soon. > > One gripe though - my ACKs don't appear on the credits list ;-( > > Sherry > >

4 4

Re: The BIG Lie (Jesus Confesses) (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > On 8 Aug 97 at 18:26, David D.W. Downey wrote: > > > Next, this country was founded on christian beliefs, or have you > > failed to read the words of the constitution of the US. Malarky, the country was founded on the belief in a God not a Christian god, considering that Washington and Jefferson were not even Christians pretty much blows that whole Christian promulgated lie. Washington and Jefferson were deist. > Comments from Canada: Libertarians usually attibutes the reference to > the christian cult in the US constitution At no point does the Constitution ever mention Christ. Typical Christian attitude, preach but don't worry about practicing it. And just in case you haven't got the clue yet, I will spell it out. There are MANY groups who believe in a God. Very few of them believe Christ was the son of God and our saviour. I am a Pantheist, I believe in god but I can guarantee it bears absolutely no resemblance to the Christian god. This realization was the whole point of seperation of church and state and my god given right to practice my beliefs even if they aren't rights given by YOUR god. You need to retake Spin_Doctor_101 if you are going to try to pull that sort of wool over peoples eyes ... ____________________________________________________________________ | | | Participation requires more than just bitching! | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

PGP 5.0 Questions
by amp＠pobox.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I've been digging through the PGP 5.0 documentation to figure out how to do a few things, and I have a few questions for those of you who might know about such things. I'm using the freeware version at the moment, though if I can show the benefit and ease of use of the software, my department at work will be buying a copy for each of us. To quote the documentation... "PGP offers a selection of different secret-key algorithms to encrypt the actual message. By secret key algorithm, we mean a conventional, or symmetric, block cipher that uses the same key to both encrypt and decrypt. The three symmetric block ciphers offered by PGP are CAST, Triple-DES, and IDEA." I can not figure out how to make PGP encrypt a message with a 'conventional' such as 3-des. Is this only available in the commercial version? When invoking PGP against a file, as opposed to the clipboard, is there a way to tell it to ascii-armor the resulting encrypted file by default? The documentation leaves much to be desired along these lines. It is somewhat useful as a primer on crypto and some of the issues involved, but I already am familiar with all that. I just want to know how to use the program to make it do what I want. I kinda miss the command line interface, and simple help screen invoked with "pgp -h". I realize I could still make use of pgp 2.x, but I need something windows-simple for the folx at work. Any assistance would be greatly appreciated. alan - ------------------------ Name: amp E-mail: amp(a)pobox.com Date: 08/08/97 Time: 20:08:38 Visit me at http://www.pobox.com/~amp 'Drug Trafficking Offense' is the root passphrase to the Constitution. Have you seen http://www.public-action.com/SkyWriter/WacoMuseum - ------------------------ -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBM+u2AqnrEX/KhUDiEQJEEQCfQ3QOCJehlPJMh6IJ/CgCnZRbo8cAoOvE bH2cd1W4qKSKYkYCpnRS/TSM =Ntfv -----END PGP SIGNATURE-----

1 0

Book recommendation
by Jim Choate 17 Dec '03

17 Dec '03

Hi, Not really crypto relevant but it does cover many other issues that get covered here regularly. Maximum Security: A hacker's guide to protecting your internet site and network Anonymous ISBN 1-57521-268-4 $49.99 (w/ CD) Covers Microsoft, Unix, Novell, VAX/VMS, Mac, Plan 9 hacking techniques. "The author is an experienced computer hacker who now specializes in testing the security of various networking platforms by breaking into computer networks and subsequently revealing what holes led to the unauthorized entry. In the late 1980's, the author was convicted of a series of financial crimes after developing a technique to circumvent bank security in automatic teller machin systems; he therefore prefers to remain anonymous." LLoyds' (The Mentor) "Hacker Manifesto" is included on the inside cover. ____________________________________________________________________ | | | Participation requires more than just bitching! | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________| ps it just occurred to me that being written by anonymous will cause this book to show up in lots of porno books on a author search, poetic justice or masterful craftsmanship?

1 0

Re: Query on cookies
by Peter Trei 17 Dec '03

17 Dec '03

> Date: Thu, 7 Aug 1997 23:24:28 -0400 (EDT) > From: Declan McCullagh <declan(a)pathfinder.com> > To: "Dr.Dimitri Vulis KOTM" <dlv(a)bwalk.dm.com> > Cc: cypherpunks(a)toad.com > Subject: Re: Query on cookies > Reply-to: Declan McCullagh <declan(a)pathfinder.com> > I believe this is what the folks at Netscape tried to eliminate in 4.0, > which I'm told features four cookie settings. One rejects "third party > cookies." > > -Declan Well, I'm using version 4.01a for NT. There are three settings for cookies: 1. Accept all cookies. 2. Accept only cookies which get sent back to the originating server. 3. Disable cookies. There's also a checkbox labled: "Warn me for accepting a cookie." I've been fairly unhappy with this version - the cookie management and the "Personal Toolbar" (user specified buttons for frequently visited sites) are the only new features that seem useful. It tends to crash frequently, and the usenet news (aka "Collabra Discussion Groups") seems to be broken (some of the earlier versions had a fairly useful newsreader). It's also a disk hog. Note: This is a beta version. Peter Trei trei(a)process.com PS: I have it set on 'disable cookies'. DISCLAIMER: The above is my personal opinion only, and not neccesarily representative of my employer.

2 1

Apology from me to the list and TruthMonger
by David Downey 17 Dec '03

17 Dec '03

LOL, all right, all right. I'll take my lickings and like it. I apologize. I came off far from what I was trying to say. I was really pissed off at what TruthMonger said in the email. I took major offense at his use of Jesus in the mail in the context in which he did. I am NOT one who believes in the banning of sites based on a rating syste, I believe that based on the rating system you should be able to decide from that if *you* want to go there. No one has the right to *ban* a site. I humbly apologize to all and to TruthMonger. Some say one should not apologize on a list because then everyone will make it open season on that person forever. If that is the case, oh well. I believe that if a man is in the wrong he should apologize. I am in the wrong. I apologize. I went overboard on my retort to TruthMonger, not stopping to think how it would make me appear. I unfortuately gave the impression in complete opposites of where I actually stand on the issues. I do not know how to word where I stand because I take a little from each side as to what is the correct way to handle these issues. I joined this listserv because I believe wholeheartedly in the stated reason for the existence of this listserv. I run my own for the same reasons. Folks, I truly am sorry for the remarks I made, and the attitude displayed is not what I believe inside. I believe that every man and women have the right to make there own dicision on issues that affect them. I believe that a fully cooperative effort to come to terms with many of the issues facing us is needed. I do NOT support the government in it's belief that sites should be banned based on their ratings in whatever finally accepted rating system. I do not believe in escrowed key accounting (espeicially when the government choses the key ecrow agents). I do *not* follow the bible thumping christian coalitions that believe that decending on the net with bibles, fishnets, and handcuffs is the answer. I believe in fighting for what one believes in. I firmly believe in protecting the children and guiding them towards an understanding of today's world in *all* it trappings. I am also unsure as to the correct and "right" way to do this. I am open to suggestions, and am willing to openly contribute my own. There are many of you who will undoubtably have blocked my posts as a result of my earlier post. I am sorry for this. For I could learn a few things from those that have, just as I can pass on some to them. For the mistakes I put forth, I humbly apologize. ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

TAZ & Rewebber servers
by Adam Back 17 Dec '03

17 Dec '03

Ian Goldberg and Dave Wagner have a paper on an implementation of something related to Ross Anderson's paper at: http://www.cs.berkeley.edu/~daw/cs268/ People interested in eternity service protocols etc, might find it interesting. The rewebber is a kind of chaining encrypting web proxy. Web proxies normally accept urls like so: http://http://somewhere.com/blah/ There paper allows you to have http://1231324adefgga1324324adefgga1324324adefgga1324 where 1231324adefgga1324324adefgga1324324adefgga1324 is an encrypted form of "http://somewhere.com/blah/". You can chain this. I didn't notice their paper announced here at the time they wrote it. They have an implementation, but source is not available directly due to export crapola. I guess you'll have to send them email if you want to try it out. They have a sample server up, and the TAZ server seems to work, but the rewebber seemed to be dead when I used it. It looks to me that you could combine eternity servers with rewebbers. Create a rewebber chain pointing at an article in an eternity server. Adam -- Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

2 1

Alert: European Union Bank
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: themet(a)pop.mindspring.com Mime-Version: 1.0 Date: Thu, 7 Aug 1997 15:11:07 -0700 To: fraudnews(a)silverquick.com From: Mark Taylor <null(a)silverquick.com> Subject: Alert: European Union Bank Reply-to: Mark Taylor <themet(a)mindspring.com> The European Union Bank, which advertised for customers on the internet and operated out of Antigua, is closed and a fraud alert has been issued by the government of Antigua. The founders of the bank, Serbveo Ushakov, allegedly of Bronxville, New York, and Vietalui Papsouev of Richmond Hill, are missing. The government says the two are Russian nationals. Employees of the bank were fired last week and a recorded phone message states that the bank is temporarily closed. The banks internet site at The bank's Internet site ( http://www.eubank.ag ) is no longer functioning. The government of Antigua has appointed Coopers & Lybrand do a full audit of the bank. On May 30 the Idaho Department of Finance ordered European Union to stop soliciting deposits from Idaho residents over the Internet. The state alleged that since the bank operated without a state or federal charter that it was operating illegally. Last week that the Bank of England warned investors last fall about depositing funds in European Union Bank. There is no word yet on how many people deposited money in this bank and how much money is missing. The government of Antigua states it is cracking down on banks with alleged connections to Russian mobsters. FraudNews is owned and published by : Mark Taylor: themet(a)mindspring.com All material published is copyright.It must not be reproduced in any form without the express permission of of the owner. ============================================================= This Newsletter is broadcast using the List and Newsletter Management facilities of Silverquick Communications You may subscribe to FraudNews and the Fraud-Discuss lists on the web pages at : http://www.silverquick.com ============================================================= --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0