- cypherpunks-legacy - lists.cpunks.org

MIT AI Lab PGP keyserver back up...
by Brian A. LaMacchia 17 Dec '03

17 Dec '03

The PGP public key server at the MIT AI lab is now back up, running PGP 2.6. You can access the keyserver via e-mail to: public-key-server(a)pgp.ai.mit.edu, or pgp-public-keys(a)pgp.ai.mit.edu Please use the alias "pgp.ai.mit.edu" when sending mail to the server. I expect the keyserver to move from its current host (martigny.ai) to another machine sometime this summer. The CNAME pgp.ai.mit.edu will always point to the right place. If you have a WWW client with forms support (Mosaic, Lynx, Emacs-W3) you can also use my WWW interface to the keyserver. The URL is: http://www-swiss.ai.mit.edu/~bal/pks-toplev.html [www-swiss is another alias. Our WWW server is moving soon, too.] NOTE: As a result of MIT's legal review of the patent issues surrounding PGP 2.3 and PGP keyservers, this keyserver has been configured to not accept "add" requests containing keys identified as being produced by PGP 2.3 or earlier versions. If you're running a PGP keyserver and would like to sync with this server, drop me a note. --Brian LaMacchia pgp-public-keys-request(a)pgp.ai.mit.edu

1 0

IBM's NetSP
by Adam Shostack 17 Dec '03

17 Dec '03

(This is a set of excerpts from a 1000 line file I got from a guy @IBM. If anyone wants the whole thing, just ask.) | Network Security Program Version 1 Release 2 is a distributed authentication | and key distribution program. The Network Security Program authenticates the | identity of two communicating principals in the network and provides each | with the ability to verify the identity of the other via a common third-party | server. | Network Security Program provides secured single sign-on (SSO) to 3270 host | applications via an EHLLAPI emulator interface to a RACF* host system. | Through the implementation of PassTickets, the user at the client workstation | need only provide one log-on password that will allow secured access to | multiple host applications. In addition to the TCP/IP transfer protocols for | these platforms NetBIOS is supported on AIX*, OS/2*, DOS*, and Windows; LU6.2 | is supported on AIX and OS/2. | | Network Security Program provides distributed security services that user | applications may invoke through the Generic Security Services Application | Programming Interface (GSSAPI). GSSAPI is approved as an Request for Comment | (RFC) by the Internet Engineering Task Force (IETF). The underlying security | mechanism is based on KryptoKnight, an advanced authentication technology | developed by IBM Research Laboratories in Zurich, Switzerland and Yorktown | Heights, New York. | | In V1R2 we are extending our platforms from the AIX/6000, OS/2 and DOS | operating systems to include HP, SUN, and DOS/Windows for client and | application server workstations. IPX/SPX is supported on OS/2 and Windows | for authentication servers and clients running on workstations with Novell | Netware. TCP/IP is supported on all the specified platforms. Single sign-on | (SSO) support for OS/2 has been extended to LanServer and Novell. | In DCE environments, Network Security Program is offered to customers whose | environments pose authentication problems at the transport layer and below. | Because of its compact tickets and flexible authentication protocols, Network | Security Program can be more effective in satisfying this set of | requirements. Network Security Program also provides secure LU2 sign-on to | RACF host applications without requiring re-entry of host user names or | passwords. Single sign-on to LANServer and Novell is also available. DCE is | the recommended solution for customers requiring authentication above the | transport layer (through secure RPC), for use by the application layer, for | more complete security services, or for integration with other services, such | as data access control or integration with resource managers. | DATA CONFIDENTIALITY | | Commercial Data Masking Facility (CDMF) is a new technology recently | developed by the IBM Crypto Competence Center. CDMF has a scrambling | algorithm that will be supported under the GSS-API (GSS-SEAL / GSS-UNSEAL API | calls). It provides the application programmer the capability to easily | scramble selected packets of data sent in the network. Data confidentiality | is secured from indiscriminate use and your assets stay protected. | | CDMF alleviates the worry of having your data flow across the network in | clear text. The degree of security is equivalent to encryption using DES but | with keys limited to 40 bits. IBM has obtained approval from the US | Government to export CDMF in products without the license required to export | products containing DES. | TEXT | | TECHNICAL DESCRIPTION | | Network Security Program was developed to exploit key distribution and | authentication technologies based on a third party authentication server. | Several technologies exist in the industry today, one of which is | KryptoKnight, which was developed by the IBM Research Division laboratories | in Yorktown Heights, NY, and Zurich, Switzerland. The KryptoKnight | technology, from a user viewpoint, appears on the surface much the same as | another security service developed at MIT, Kerberos. Though Kerberos has | been made widely available through public access, it presents several | limitations in certain network environments. Network Security Program | provides extensions to the Kerberos technology that can prove most desirable | to customers operating such networks environments. For example, the smaller | KryptoKnight tokens make implementation of security at lower networking | layers possible. Other technical advantages include a use of cryptography | that is not subject to export controls, flexibility in authentication | protocols for situations in which the client cannot contact the | authentication server directly and the reduced dependency on clock | synchronization among communicating principals. | Network Security Program is being developed as an 'open' multi-platform | security solution. The intent is to provide a port to as many different | systems as is possible given the time and resource constraints. In the | workstation environment, a customer typically will have many varieties of | hardware/software in their network. Interoperability is a key requirement | for any security solution. This release of the Network Security Program will | address the AIX/6000, OS/2, DOS, DOS/Windows, SUN and HP platforms. | | Network Security Program is developed with a user-friendly Graphical User | Interface (GUI). The security mechanisms residing below the Application | Programming Interface (API) are transparent to the client. At the | Authentication Server, there is also an administration interface. Industry | standards are supported to provide as seamless a transition among all | platforms as possible; MOTIF standards for AIX/6000 and CUA91 standards for | OS/2 and DOS. | RISC System/6000* POWERstation*. The client code shipped with the Network | Security Program runs on the following workstations: OS/2, DOS/Windows, | AIX/6000, SUN, and HP. The minimum machine requirements are: | o DOS Workstation | Approximately 400KB of free disk space is required for the Network | Security Program. If the Network Security Program software is installed | o SUN Workstation | - A SUN microsystem spark [sic] station running Solaris 1.1 or later. (Most UNIX systems req. 5mb disk, 8mb ram. Seems that Solaris 2 is not later enough to count as 'solaris 1.1 or later;' It was not listed as a supported OS.) -- Adam Shostack adam(a)bwh.harvard.edu Politics. From the greek "poly," meaning many, and ticks, a small, annoying bloodsucker.

1 0

Re: clipper & corp. espionage
by lefty＠apple.com 17 Dec '03

17 Dec '03

>Hi, I'm new to the list. I was wondering >if the clipper chip passed. what's stopping >corrupt government people from selling access >to the encryption to the highest bidders to spy >on competitors communications. > >just curious. Um, the goodwill and general trustworthiness of our elected officials and their duly-designated appointees? Just a guess, mind you. -- Lefty (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

1 0

SRA telnet and ftp (FYI)
by Richard Johnson 17 Dec '03

17 Dec '03

A note about a package that uses D-H to generate a key for telnet and ftp authentication. Has anyone here played with it? Richard ------- Forwarded Message Subject: SRA telnet and ftp Date: Tue, 24 May 1994 08:57:40 -0400 To: Firewalls(a)GreatCircle.COM From: bukys(a)cs.rochester.edu After hearing about David Safford's SRA telnet/ftp package from numerous sources, I finally went and got a copy (from ftp://net.tamu.edu/pub/security/TA MU). It's nice work. I would like to clarify one point, though: This package uses the Diffie-Hellman code from the Secure RPC implementation, to securely compute a session key which the SRA code uses to encrypt an authentication transaction. The code does NOT use the session key to encrypt the whole session. It would probably be relatively easy to add, but it's not in there in the current code. This is from my perusal of the code, and correspondence with the author. FYI ------- End of Forwarded Message

1 0

Re: Smart Bombs
by Marshall Clow 17 Dec '03

17 Dec '03

jbugden(a)smtplink.alis.ca wrote: >Smart Use for Smart Cards > >"UBIQ announced that its software has been selected by American Express to >personalize smart cards that will be issued ... for ticketless travel on >American Airlines. ... Airline travelers with these smart card holders will be >able to proceed directly to an airport gate, insert their smart card into a gate >reader, receive seat confirmation, and board the plane without touching a single >piece of paper. > Does this mean that you can fly without showing any identification? It sounds like it. What is to prevent my company from getting a half dozen of these cards, and when someone in the company needs to travel, loading a card with the travel info and giving it to the traveller? Note that (as far as the airline or FCC is concerned) there is no person <<-->> card mapping. Other scenarios: Will travel agents be able to issue these cards? How about airport ticket agencies? Will people be able to buy cards for cash? James wrote: >Of course, not having a card may subject you to greater scrutiny at check-in >time due to the reduced tracking ability. > I think that you have this backwards. There will be less tracking ability for people flying w/o tickets. -- Marshall Marshall Clow Aladdin Systems <mailto:mclow@mailhost2.csusm.edu> "We're not gonna take it/Never did and never will We're not gonna take it/Gonna break it, gonna shake it, let's forget it better still" -- The Who, "Tommy"

1 0

Re: Complaint against beker@netcom.com (fwd)
by Brian Beker 17 Dec '03

17 Dec '03

With this and the previous response to Mr. Sternlight from Netom, this matter is for now laid to rest. Brian Beker ---------- Forwarded message ---------- Date: Fri, 20 May 1994 13:46:29 -0700 (PDT) From: Netcom Support <support(a)netcom.com> To: david(a)sternlight.com Cc: Brian Beker <beker(a)netcom.com> Subject: Re: Complaint against beker(a)netcom.com David Sternlight writes: > From strnlght Thu May 19 12:31:19 1994 > Return-Path: <strnlght> > Received: by netcom.com (8.6.8.1/SMI-4.1/Netcom) > id MAA01913; Thu, 19 May 1994 12:30:20 -0700 > From: strnlght (David Sternlight) > Message-Id: <199405191930.MAA01913(a)netcom.com> > Subject: Complaint against beker(a)netcom.com > To: support (Netcom Support) > Date: Thu, 19 May 1994 12:30:18 -0700 (PDT) > In-Reply-To: <199405191033.EAA29745(a)spot.Colorado.EDU> from "Richard Johnson" at May 19, 94 04:33:51 am > Reply-To: david(a)sternlight.com > X-Mailer: ELM [version 2.4 PL23] > MIME-Version: 1.0 > Content-Type: text/plain; charset=US-ASCII > Content-Transfer-Encoding: 7bit > Content-Length: 6613 > > I mailed a complaint to netcom support. At the suggestion of the netcom > support person I spoke to on the phone, I sent a copy to the user in > question as well. > > That user posted a copy of the complaint to a newsgroup without my > permission. This is, of course, a violation of my copoyright. Thus he has > compounded his violation of RSADSI's patent in PGP with a violation of my > copyright in my e-mail. > > By trying to make what should be a private matter between the user and > netcom support, and myself and netcom support into a public cause celebre, > and generate pressure mail on netcom support such as that below, I believe > the user in question has further violated his agreement, and request netcom > to take appropriate action. This time I have a personal interest in seeing > this resolved. Postng another person's email, while annoying, is not necessarily a violation of copyright in our eyes. Again, we have no intention of taking action at this time; if you want to pursue the matter legally, then have your lawyer talk to him. ___________________________________________________________________________ Support support(a)netcom.com Technical Support Staff NETCOM On-line Communication Services

1 0

Re: PGP 2.5--some questions.
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

: From: m1tca00(a)newfed.frb.gov (Thomas C. Allard) : > > To respond to the sender of this message, send mail to : > > remailer(a)soda.berkeley.edu, starting your message with : > > the following 7 lines: : > > :: : > > Response-Key: ideaclipper : > : > > ====Encrypted-Sender-Begin==== : > > MI@```$US^P;+]AB?X9TW6\8WR:>P&2'9,7.YM5[D5-D0)[3;\@M3L:625SRF : > > E&M(.3FCF)SX,HK/F!CHPO!/>L.D#Z=4(++Q872W\KAK[:?GOT``` : > > ====Encrypted-Sender-End==== : > : > Thus the NSA just needs to crack the "soda" key in order to get hold : > of a person who knows something about an ITAR infringement. : > : > Is there a way to instruct a cypherpunk remailer to omit the last : > seven lines? : He most likely used a chain of remailers. That's the REASON for : the last seven lines (instead of a simple anonXXXX-type address. : When you send those 7 lines to the soda remailer, it decrypts it : and finds ANOTHER address to send it to. It can do this as many : times as you like. When this feature was put in recently, in response to a suggestion of mine (which I now regret because of...), I intended for each posting to be encrypted with a different randomly-generated key, and for the key to be deleted after being reused on reply. Unfortunately Eric chose not to implement it that way, and although he promised to cycle the keys periodically, he seems not to have done so. I agree with whoever it was above that was in fear of the key being compromised - it *is* a possibility, and that's why I wouldn't use that remailer, if I ever had to use a remailer. G

1 0

Re: Is crypto cash patented?
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

>The blind signature algorithm is patented by David Chaum. > >Eric I'm also told that Citibank is processing a patent for a form of digital cash that was, for most intents and purposes, anonymous. The patent is still in process, which means you can find out what's in it. But I'm told that they filed it in Europe more than 1.5 years ago, which means it should be open to public inspection. I wish I knew more. If anyone knows how to fish it out of the bureaucracy, I would like to hear more.

1 0

other stuff David Sternlight has posted
by Tom Allard 17 Dec '03

17 Dec '03

Favorite posts from David Sternlight: ------- Forwarded Message Newsgroups: sci.crypt Date: Sun, 08 May 94 05:34:13 -0400 From: strnlght(a)netcom.com (David Sternlight) Subject: Re: Someone Get The Classified Docs and Post Them Please! [...] Something did snap, and it did so with the death of Richard Nixon. On thinking of his achievements, and the way he was savagely hounded by the left all his life (not without cause, but not deserving of the extreme demonizing he got), I decided it was time to stop pussy-footing around here, and start calling jerks, cowards, hoodlums, and defamers for what they were. [...] David ------- End of Forwarded Message

1 0

Re: Patent infringement (fwd)
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

: This is the argument Schiller's message on 2.6 foreshadowed. However, : there are some counterarguments you can make: : - It's not clear that RSADSI has actually said that merely posting a key with : the words "Version: 2.3a" in and of itself constitutes inducement or : conspiracy to infringe the patent. Schiller speculated that running a key : server which accepted pre-2.4 keys could represent contributory infringement : but I haven't seen any statements from Bidzos that agree with this, let : alone the stronger statement Sternlight is making. Excuse me folks - I think we're missing a big point here: there's no such crime as 'conspiracy to infringe' nor is it a civil offense. What PKP are talking about is agrravated damages - *if* you are *breaking* one of their patents, eg by *running* pgp, then because you are encouraging others to do so by, say, also offering a keyserver service, they can ask for larger damages because they'll say you're *flagrantly* violating their patent and encouraging others to do so. However, if you're *not* violating their patent, there's nothing they can do about the 'encouraging others to do so' part. Running a keyserver, as long as it doesn't run pgp to do its key management, is not infringing PKP's patents, and they can't do anything about it - it's a question of publishing and free speech. It's not even the more restricted commercial speech - keyservers aren't a business. I think if you read the MIT announcements closely you'll see what they say is compatible with this view. G

1 0