- cypherpunks-legacy - lists.cpunks.org

Crypto anarchist getting through customs
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:21 PM 1/15/96, Simon Spero wrote: >When I was a student and had long hair, I used to always get questioned >when going throught customs. After graduating, and having normal length >hair, I had a lot less trouble. Long serving customs officers develop >models of characteristics that in the past have been indicative of >smuggling or wrong doing. Given that most points of entry are >under-staffed, there's not much else they can do. I was returning from France and Monte Carlo, where I'd given a talk about crypto anarchy, through U.S. Customs at San Francisco. Having just heard of Matt Blaze's experiences, I figured I'd be truthful and see what happened. (I can't recall the exact words, naturally, so this is just a rough version. Things were uncrowded at the Customs gate, and I was the only one in his line, in case it matters.) Young Customs Officer (YCO): "Where are you coming from?" Me: "Monte Carlo. And France." YCO: "Business or pleasure?" Me: "Business." YCO: "What was the business?" Me: "I met with cryptographers and bankers to discuss cryptography and political implications." YCO: " 'Cryptography'? " (A look of no comprehension.) Me: "Yes, cryptography. You know, secret codes, ciphers, stuff like that." YCO: "Were there any foreigners present?" Me: "Yes, it was in Monte Carlo. There were some Russians there, and lots of others." YCO: [brief pause] "Did you bring anything back with you?" Me: "No." YCO: [waved me through] In my carry-on luggage I had half a dozen magneto-optical disks, carring about a gigabyte of stuff. (As props to use during my talk on the France/Monte Carlo side, ironically, to show that borders are fully transparent.) By the way, there were no outgoing checks [unlike Matt, I didn't seek out permission to export anything], of course, and no checks at my entry point at De Gaulle Airport in Paris. [Though there were lots of cops with machine guns, and lots of dire warnings that bags left unattended might be destroyed, a precaution against bombs.] No checks into Monte Carlo, of course (I lived for a year near Monaco, so I knew this would be the case). Frequent travellers to Europe will no doubt confirm what I'm saying. I travelled to dozens of countries in Europe a while back, and never was checked at any borders, save for a quick glance at my passport. --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

7 13

Where to get PGP (short version of FAQ)
by Michael Paul Johnson 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- WHERE TO GET PGP FAQ (SHORT VERSION) Revised 15 January 1996 For questions not covered here, please see alt.security.pgp FAQs at rtfm.mit.edu. For the long version of this FAQ, get ftp://ftp.csn.net/mpj/getpgp.asc or send mail to mpjohnso(a)nyx.cs.du.edu or point your web browser at http://www.csn.net/~mpj. WHAT IS THE LATEST VERSION OF PGP? Platform(s) Latest Version Distribution File Names __________________________________________________________________________ | | | | |DOS, Unix, | Viacrypt PGP 2.7.1 | disk sets | |Mac, Windows, | | | |or WinCIM/CSNav | | | |________________|_____________________|_________________________________| | | | | |Hardware-based | Viacrypt 2.7.1 | disk sets | |PGP/Token | | | |________________|_____________________|_________________________________| | | | | |DOS, Unix, VAX, | MIT PGP 2.6.2 | pgp262.zip (DOS + docs) | |others | | pgp262s.zip (source) | | | | pg262s.zip source on CompuServe | | | | pgp262s.tar.gz (source) | | | | pgp262s.tar.Z (source) | | | | pgp262dc.zip (documentation) | | | | pg262d.zip (docs on CompuServe) | |________________|_____________________|_________________________________| | | | | |Macintosh | MIT PGP 2.6.2 | MacPGP2.6.2-130v1.hqx | | | Mac version 1.3.0 | m262pgp.hqx (same as above) | | | | MacPGP2.6.2-130v1.source.asc | | | | m262pgps.asc (same as above) | | | PGPfone 1.0 beta 5 | | |________________|_____________________|_________________________________| | | | | |Power Mac | Zbigniew's "beta" | Fatmacpgp262b131.sea.hqx | | | | f262pgp.hqx (same as above) | | | | Fatmacpgp262b131.src.hqx | | | | f262pgps.hqx (same as above) | |________________|_____________________|_________________________________| | | | | |Amiga | PGP 2.6.2 Amiga 1.4 | pgp262-a14-000.lha | | | | pgp262-a14-020.lha | | | | pgp262-a14-src.lha | | | | PGPAmi262is.lha (international) | |________________|_____________________|_________________________________| | | | | |Atari | Atari MIT PGP 2.6.2 | pgp262st.zip | | | Atari International | pgp262ib.zip | |________________|_____________________|_________________________________| | | | | |OS/2 | MIT PGP 2.6.2 | pgp262-os2.zip | | | | on ftp.gibbon.com | |________________|_____________________|_________________________________| | | | | |Non-USA version | PGP 2.6.2i from | pgp262i.zip (DOS executable) | |to avoid RSAREF | Stale Schumacher, | pgp262ix.zip (32-bit DOS) | |license. | Kai Uwe Rommel, | pgp262i-os2.zip (OS/2 exe) | | | Harald Denker, and | pgp262ib.zip (Atari) | | | Peter Simons | PGPAmi262is.lha (Amiga) | | | | pgp262is.zip (source) | | | | pgp262is.tar.gz (Unix source) | | | | | | | Canadian "mutant" | MacPGP262ca124.exe.sea.hqx | | | not for USA use | MacPGP262ca124.src.sea.hqx | |________________|_____________________|_________________________________| | | | | |Unofficial | PGP 2.6.2ui | pgp262iu.zip | |non-USA version | Not for use in the | | |fully under Gnu | USA because of | | |public license | probable patent | | |(based on 2.3a | infringement | | |code) | problems. | | |________________|_____________________|_________________________________| WHERE CAN I GET VIACRYPT PGP? Just call 800-536-2664 and read them your credit card number and your address. WHERE IS PGP ON THE WORLD WIDE WEB? * http://web.mit.edu/network/pgp-form.html (U. S. PGP primary distribution site) * http://web.mit.edu/network/pgpfone (PGP Fone primary distribution site) * http://www.ifi.uio.no/~staalesc/PGP/home.html (International PGP primary distribution site) * http://www.epic.org/privacy/tools.html * http://www.csua.berkeley.edu/cypherpunks/home.html * http://www.leo.org/archive/os2/crypt/ WHERE CAN I FTP PGP IN NORTH AMERICA? If you are in the USA or Canada, you can get PGP by following the instructions in any of: * ftp://net-dist.mit.edu/pub/PGP/README * ftp://ftp.csn.net/mpj/README.MPJ * ftp://miyako.dorm.duke.edu/pub/GETTING_ACCESS * ftp://ftp.csua.berkeley.edu/pub/cypherpunks/pgp/ * ftp://ftp.gibbon.com/pub/pgp/README.PGP * ftp://ftp.wimsey.bc.ca/pub/crypto/software/README WHERE IS PGP ON COMPUSERVE? GO NCSAFORUM. Follow the instructions there to gain access to Library 12: Export Controlled. AOL It is possible to get PGP from ftp sites with hidden directories with the following trick: (1) View the README file with the hidden directory name in it, then quickly (2) Start a new ftp connection, specifiying the hidden directory name with the ftp site's address, like ftp.csn.net/mpj/I_will_not_export/crypto_xxxxxxx (where the xxxxxxx is replaced with the current character string). WHAT BULLETIN BOARD SYSTEMS CARRY PGP? MANY BBS carry PGP. The following carry recent versions of PGP and allow free downloads of PGP. 303-772-1062 Colorado Catacombs BBS, Longmont CO 317-887-9568 Computer Virus Research Center (CVRC) BBS, Indianapolis, IN Login First Name: PGP Last Name: USER Password: PGP 914-667-4567 Exec-Net, New York, NY 915-587-7888, Self-Governor Information Resource, El Paso, Texas WHERE CAN I FTP PGP CLOSE TO ME? * DE ftp://ftp.informatik.uni-hamburg.de/pub/virus/crypt/pgp ftp://ftp.uni-kl.de/pub/aminet/util/crypt ftp://ftp.westfalen.de/pd/Atari/Pgp(Atari) * ES ftp://encomix.es/pub/pgp/pgp262i/pgp262i.zip * IT ftp://ftp.dsi.unimi.it/pub/security/crypt/PGP * FI ftp://ftp.funet.fi/pub/crypt * NL ftp://ftp.nl.net/pub/crypto/pgp ftp.nic.surfnet.nl/surfnet/net-security/encryption/pgp * SE ftp://leif.thep.lu.se * UK ftp://ftp.demon.co.uk/pub/amiga/pgp ftp://ftp.ox.ac.uk/pub/crypto/pgp HOW CAN I GET PGP BY EMAIL? If you have access to email, but not to ftp, send a message saying "help" to ftpmail(a)decwrl.dec.com, mailserv(a)nic.funet.fi, or ftp-request(a)netcom.com To get pgp 2.6.2i by email: Send a message to pgp(a)hypnotech.com with your request in the Subject: field. Subject What you will get GET pgp262i.zip MS-DOS executable (uuencoded) GET pgp262is.zip MS-DOS source code (uuencoded) GET pgp262is.tar.gz UNIX source code (uuencoded) For FAQ information, send e-mail to mail-server(a)rtfm.mit.edu with send usenet/news.answers/ftp-list/faq in the body of the message. WHAT ARE SOME GOOD PGP BOOKS? Protect Your Privacy: A Guide for PGP Users by William Stallings Prentice Hall PTR ISBN 0-13-185596-4 US $19.95 PGP: Pretty Good Privacy by Simson Garfinkel O'Reilly & Associates, Inc. ISBN 1-56592-098-8 US $24.95 E-Mail Security: How to Keep Your Electronic Mail Private "Covers PGP/PEM" by Bruce Schneier Wiley Publishing The Computer Privacy Handbook: A Practical Guide to E-Mail Encryption, Data Protection, and PGP Privacy Software by Andre Bacard Peachpit Press ISBN 1-56609-171-3 US $24.95 800-283-9444 or 510-548-4393 THE OFFICIAL PGP USER'S GUIDE by Philip R. Zimmerman MIT Press April 1995 - 216 pp. - paper - US $14.95 - ISBN 0-262-74017-6 ZIMPP PGP SOURCE CODE AND INTERNALS by Philip R. Zimmerman April 1995 - 804 pp. - US $55.00 - 0-262-24039-4 ZIMPH Ordering information for the last two books: Call US Toll Free 1-800-356-0343 or 617-625-8569. Cite code 5CSC and number 661. Allow 4-6 weeks for delivery within North America. Allow 8-12 weeks for delivery outside of North America. How to Use PGP, 61 pages, (Pub #121) from the Superior Broadcasting Company, Box 1533-N, Oil City, PA 16301, phone: (814) 678-8801 (about US $10-$13). WHERE CAN I GET PGP LANGUAGE MODULES? http://www.ifi.uio.no/~staalesc/PGP/language.html ftp://ftp.ifi.uio.no/pub/pgp/doc/ IS PGP LEGAL? Yes. See ftp://ftp.csn.net/mpj/getpgp.asc for some of the issues. WHAT IS PHILIP ZIMMERMANN'S LEGAL STATUS? Philip Zimmermann was under investigation for alleged violation of export regulations, with a grand jury hearing evidence for about 28 months, ending 11 January 1996. The Federal Government chose not to comment on why it decided to not prosecute, nor is it likely to. The Commerce Secretary stated that he would seek relaxed export controls for cryptographic products, since studies show that U. S. industry is being harmed by current regulations. Philip endured some serious threats to his livelihood and freedom, as well as some very real legal expenses, for the sake of your right to electronic privacy. Although there was no direct and open legal battle, there was a lot of behind the scenes work by Phil's legal team, headed by Philip L. Dubois (dubois(a)dubois.com) GREAT JOB! If you ever are in the situation of needing a good lawyer to help you with similar Federal harassment, consider yourself fortunate if Mr. Dubois will take your case. Philip Zimmermann is breathing more easily these days, still a free man and able to work to support his family. The battle is won, but the war is not over. The regulations that caused him so much grief and which continue to dampen cryptographic development, harm U. S. industry, and do violence to the U. S. National Security by eroding the First Ammendment of the U. S. Constitution and encouraging migration of cryptographic industry outside of the U. S. A. are still on the books. If you are a U. S. Citizen, please write to your U. S. Senators, Congressional Representative, President, and Vice President pleading for a more sane and fair cryptographic policy. WHERE CAN I GET WINDOWS & DOS SHELLS FOR PGP? http://www.ifi.uio.no/~staalesc/AutoPGP.html http://www.dayton.net/~cwgeib ftp://oak.oakland.edu/SimTel/msdos/security/apgp22b.zip ftp://oak.oakland.edu/SimTel/win3/security/pgpw40.zip http://alpha.netaccess.on.ca/~spowell/crypto/pwf31.zip ftp://ftp.netcom.com/pub/dc/dcosenza/pgpw40.zip ftp://Sable.ox.ac.uk/pub http://www.firstnet.net/~cwgeib/welcom.html ftp://ftp.netcom.com/pub/ec/ecarp/pgpwind.zip http://www.eskimo.com/~joelm(Private Idaho) ftp://ftp.eskimo.com/~joelm http://www.xs4all.nl/~paulwag/security.htm http://www.LCS.com/winpgp.html ftp://mirrors.aol.com/mir01/circa/pub/pc/win3/util/pwf31.zip ftp://ftp.leo.org/pub/comp/os/os2/crypt/gcppgp10.zip ftp://ftp.leo.org/pub/comp/os/os2/crypt/pmpgp.zip WHERE DO I GET PGPfone(tm)? PGPfone is in beta test for Macintosh users. A Windows 95 version is being developed. http://web.mit.edu/network/pgpfone ftp://net-dist.mit.edu/pub/PGPfone/README ftp.hacktic.nl/pub/pgp/pgpfone WHERE DO I GET NAUTILUS? Bill Dorsey, Pat Mullarky, and Paul Rubin have come out with a program called Nautilus that enables you to engage in secure voice conversations between people with multimedia PCs and modems capable of at least 7200 bps (but 14.4 kbps is better). See ftp://ripem.msu.edu/pub/crypt/GETTING_ACCESS ftp://ripem.msu.edu/pub/crypt/other/nautilus-phone-0.9.2-source.tar.gz ftp://ftp.csn.net/mpj/README ftp://ftp.csn.net/mpj/I_will_not_export/crypto_???????/voice/naut092.zip ftp://miyako.dorm.duke.edu/pub/GETTING_ACCESS ftp://miyako.dorm.duke.edu/mpj/crypto/voice/naut092.zip ftp://ftp.dsi.unimi.it/pub/security/crypt/cypherpunks/nautilus ftp://ftp.ox.ac.uk/pub/crypto/misc The Colorado Catacombs BBS 303-772-1062 HOW DO I ENCRYPT MY DISK ON-THE-FLY? Rather than manually encrypting and decrypting files, it is sometimes easier (and therefore more secure, because you are more likely to use it) to use a utility that encrypts or decrypts files on the fly as you use them in your favorite applications. This also allows you to automatically encrypt temporary files generated by your applications if they are on the encrypted volume. http://www.cs.auckland.ac.nz/~pgut01/sfs.html ftp://ftp.informatik.uni-hamburg.de/pub/virus/crypt/disk/ ftp://ftp.csn.net/mpj/I_will_not_export/crypto_???????/disk/ ftp://ftp.csn.net/mpj/README for the ???????) ftp://miyako.dorm.duke.edu/mpj/crypto/disk/ ftp://ftp.nic.surfnet.nl/surfnet/net-security/encryption/disk/ ftp://ftp.demon.co.uk/pub/ibmpc/secdev/secdev14.arj HOW DO I PUBLISH MY PGP PUBLIC KEY? Send mail to one of these addresses with the single word "help" in the subject line to find out how to use them. These servers sychronize keys with each other. pgp-public-keys(a)keys.pgp.net pgp-public-keys(a)keys.de.pgp.net pgp-public-keys(a)keys.no.pgp.net pgp-public-keys(a)keys.uk.pgp.net pgp-public-keys(a)keys.us.pgp.net pgp-public-keys(a)fbihh.informatik.uni-hamburg.de pgp-public-keys(a)kiae.su pgp-public-keys(a)pgp.ai.mit.edu pgp-public-keys(a)pgp.iastate.edu pgp-public-keys(a)pgp.mit.edu pgp-public-keys(a)pgp.ox.ac.uk pgp-public-keys(a)sw.oz.au WWW interface to the key servers: http://www-swiss.ai.mit.edu/~bal/pks-toplev.html For US $20/year or so, you can have your key officially certified and published in a "clean" key database that is much less susceptible to denial-of-service attacks than the other key servers. Send mail to info-pgp(a)Four11.com for information, or look at http://www.Four11.com/ CAN I COPY AND REDISTRIBUTE THIS FAQ? Yes. Permission is granted to distribute unmodified copies of this FAQ. Please e-mail comments to mpj(a)netcom.com -----BEGIN PGP SIGNATURE----- Version: 2.7.1 iQCVAwUBMPoQzfX0zg8FAL9FAQEKUgQAl2nu1KMT1txZV87pgiiSMmuZcHSIyGvY 0maabI+pPg8FjtxJwcrfWjVVgQVyQGSBsh+NC0eQvGpW4DFWt1p7bCaINunBcohn jf4xdqmejuIy0e52P0+Jgs88Y3UzudYcWnjAXP//fH569ThxlQoJmLiZI/IeKRk+ 9pAVQAmPLec= =YMrS -----END PGP SIGNATURE-----

1 0

Re: COMMUNITY CONNEXION REFUSES TO CENSOR INTERNET SERVICES
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: Rich Graves <llurch(a)networking.stanford.edu> >To play Devil's Advocate here, I don't think this is as big a deal as either side is making it out to be. At least according to dgillmor's column in today's San Jose Mercury News, SW meant (or has "clarified" his statements to mean) that he favors only limited remedial (not prior) restraints on "hate speech" (whatever the hell that means) on Web pages that approach "publishing" quality and distribution. SW does not favor and in fact opposes censoring newsgroups and email. ---------- Yes, it's good that he's favoring less restraint on speech than had previously appeared to be the case... but that still doesn't mean it's right. Is the censorship of broadcast media any better (of "indecent" speech) any better because after some time in the evening it doesn't apply? ---------- >I don't think any media outlet should be forced to carry something it finds objectionable. Libertarian notions like freedom of association and the fact that freedom of the press belongs to the guy who owns the damn press come into play here. ------------ What the SWC appears to be doing is not saying that they'd refuse certain groups access if they were running an ISP. They're trying to make it look like any ISP that carries certain web pages is evil... and, to some degree, this appears to me that they're putting pressure on governments to ban the speech in question. I would guess that they support the ban in Germany, for instance. In addition, the fewer ISPs are carrying the information, the easier it is to ban entirely. ----------- >I very much applaud Sameer for his principles and hard work, but SW and the like have their own principles. They're not incompatible in a free society. ----------- The problem is not the principles of the SWC... it's their tactics. -Allen

1 0

Where to get PGP FAQ update
by Michael Paul Johnson 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- WHERE TO GET THE PRETTY GOOD PRIVACY PROGRAM (PGP) FAQ Revised 14 January 1996 Disclaimer -- I haven't recently verified all of the information in this file, and much of it is probably out of date. If you discover inaccurate or out of date information, please let me know at mpj(a)netcom.com. Thanks! For questions not covered here, please see the MAIN alt.security.pgp FAQ at rtfm.mit.edu. WHAT IS THE LATEST VERSION OF PGP? Platform(s) Latest Version Distribution File Names __________________________________________________________________________ | | | | |DOS, Unix, | Viacrypt PGP 2.7.1 | disk sets | |Mac, Windows, | | | |or WinCIM/CSNav | | | |________________|_____________________|_________________________________| | | | | |Hardware-based | Viacrypt 2.7.1 | disk sets | |PGP/Token | | | |________________|_____________________|_________________________________| | | | | |DOS, Unix, VAX, | MIT PGP 2.6.2 | pgp262.zip (DOS + docs) | |others | | pgp262s.zip (source) | | | | pg262s.zip source on CompuServe | | | | pgp262s.tar.gz (source) | | | | pgp262s.tar.Z (source) | | | | pgp262dc.zip (documentation) | | | | pg262d.zip (docs on CompuServe) | |________________|_____________________|_________________________________| | | | | |Macintosh | MIT PGP 2.6.2 | MacPGP2.6.2-130v1.hqx | | | Mac version 1.3.0 | m262pgp.hqx (same as above) | | | | MacPGP2.6.2-130v1.source.asc | | | | m262pgps.asc (same as above) | | | PGPfone 1.0 beta 5 | | |________________|_____________________|_________________________________| | | | | |Power Mac | Zbigniew's "beta" | Fatmacpgp262b131.sea.hqx | | | | f262pgp.hqx (same as above) | | | | Fatmacpgp262b131.src.hqx | | | | f262pgps.hqx (same as above) | |________________|_____________________|_________________________________| | | | | |Amiga | PGP 2.6.2 Amiga 1.4 | pgp262-a14-000.lha | | | | pgp262-a14-020.lha | | | | pgp262-a14-src.lha | | | | PGPAmi262is.lha (international) | |________________|_____________________|_________________________________| | | | | |Atari | Atari MIT PGP 2.6.2 | pgp262st.zip | | | Atari International | pgp262ib.zip | |________________|_____________________|_________________________________| | | | | |OS/2 | MIT PGP 2.6.2 | pgp262-os2.zip | | | | on ftp.gibbon.com | |________________|_____________________|_________________________________| | | | | |Non-USA version | PGP 2.6.2i from | pgp262i.zip (DOS executable) | |to avoid RSAREF | Stale Schumacher, | pgp262ix.zip (32-bit DOS) | |license. | Kai Uwe Rommel, | pgp262i-os2.zip (OS/2 exe) | | | Harald Denker, and | pgp262ib.zip (Atari) | | | Peter Simons | PGPAmi262is.lha (Amiga) | | | | pgp262is.zip (source) | | | | pgp262is.tar.gz (Unix source) | | | | | | | Canadian "mutant" | MacPGP262ca124.exe.sea.hqx | | | not for USA use | MacPGP262ca124.src.sea.hqx | |________________|_____________________|_________________________________| | | | | |Unofficial | PGP 2.6.2ui | pgp262iu.zip | |non-USA version | Not for use in the | | |fully under Gnu | USA because of | | |public license | probable patent | | |(based on 2.3a | infringement | | |code) | problems. | | |________________|_____________________|_________________________________| BUG Digital signatures made with keys 2034-2048 bits in length may be corrupt if made by MIT PGP 2.6.2, but I think this has been fixed in PGP 2.6.2i. To fix this in the source code, change the line in function make_signature_certificate in crypto.c from byte inbuf[MAX_BYTE_PRECISION], outbuf[MAX_BYTE_PRECISION]; to byte inbuf[MAX_BYTE_PRECISION], outbuf[MAX_BYTE_PRECISION+2]; See also http://www.ifi.uio.no/~staalesc/PGP/bugs.html. and http://www.mit.edu:8001/people/warlord/pgp-faq.html WHERE CAN I GET VIACRYPT PGP? Viacrypt has versions of PGP complete with licenses for commercial use of the RSA and IDEA encryption algorithms. Viacrypt PGP comes in executable code only (no source code), but it is based on (and just as secure as) the freeware PGP. Viacrypt PGP for Windows is the only real Windows PGP (and even it is partially a quickwin executable that looks like a DOS port). Still, it is much better from an interface standpoint than all the others. Please contact ViaCrypt for pricing (about US $100 up), the latest platforms, and availablity at 800-536-2664 8:30am to 5:00pm MST, Monday - Friday. They accept VISA, MasterCard, AMEX and Discover credit cards. Viacrypt is currently working on preparing the release of version 4.0 (personal) and version 4.0 (business). The business edition adds a few extra key management features (like master keys) that are of use to businesses, but not really useful for persnal email. ViaCrypt Products Mail: 9033 N. 24th Avenue Suite 7 Phoenix AZ 85021-2847 Phone: (602) 944-0773 Fax: (602) 943-2601 Internet: viacrypt(a)acm.org Compuserve: 70304.41 WHERE IS PGP ON THE WORLD WIDE WEB? * http://web.mit.edu/network/pgp-form.html (U. S. PGP primary distribution site) * http://web.mit.edu/network/pgpfone (PGP Fone primary distribution site) * http://www.ifi.uio.no/~staalesc/PGP/home.html (International PGP primary distribution site) * http://www.ifi.uio.no/~staalesc/PGP/language.html (Language file master list) * http://www.epic.org/privacy/tools.html * http://rschp2.anu.edu.au:8080/crypt.html * http://www.eff.org/pub/Net_info/Tools/Crypto/ * http://community.net/community/all/home/solano/sbaldwin * http://www.cco.caltech.edu/~rknop/amiga_pgp26.html * http://www.csua.berkeley.edu/cypherpunks/home.html * http://www.leo.org/archive/os2/crypt/ * http://colossus.net/wepinsto/wshome.html * http://www.cs.hut.fi/ssh/crypto/ WHERE CAN I FTP PGP IN NORTH AMERICA? If you are in the USA or Canada, you can get PGP by following the instructions in any of: * ftp://net-dist.mit.edu/pub/PGP/README * ftp://ftp.csn.net/mpj/README.MPJ * ftp://miyako.dorm.duke.edu/pub/GETTING_ACCESS * ftp://ftp.netcom.com/pub/dd/ddt/crypto/READ_ME_FIRST! * ftp://ftp.netcom.com/pub/dd/ddt/crypto/pgp_ftp_instructions.txt * ftp://ftp.eff.org * Follow the instructions found in README.Dist that you get from one of: * ftp://ftp.eff.org/pub/Net_info/Tools/Crypto/README.Dist * gopher.eff.org, 1/Net_info/Tools/Crypto * gopher://gopher.eff.org/11/Net_info/Tools/Crypto * http://www.eff.org/pub/Net_info/Tools/Crypto/ * ftp://ftp.csua.berkeley.edu/pub/cypherpunks/pgp/ * ftp://ftp.gibbon.com/pub/pgp/README.PGP * http://www.gibbon.com/getpgp.html (OS/2 users see also /pub/gcp/gcppgp10.zip) * ftp://ftp.wimsey.bc.ca/pub/crypto/software/README WHERE IS PGP ON COMPUSERVE? GO NCSAFORUM. Follow the instructions there to gain access to Library 12: Export Controlled. Compuserve file names used to be seriously limited, so look for PGP262.ZIP, PG262S.ZIP (source code), PGP262.GZ (Unix source code) and PG262D.ZIP (documentation only). AOL Go to the AOL software library and search "PGP" or ftp from ftp://ftp.csua.berkeley.edu/pub/cypherpunks/pgp or another site listed above or below. It is possible to get PGP from ftp sites with hidden directories with the following trick: (1) View the README file with the hidden directory name in it, then quickly (2) Start a new ftp connection, specifiying the hidden directory name with the ftp site's address, like ftp.csn.net/mpj/I_will_not_export/crypto_xxxxxxx (where the xxxxxxx is replaced with the current character string). WHAT BULLETIN BOARD SYSTEMS CARRY PGP? MANY BBS carry PGP. The following carry recent versions of PGP and allow free downloads of PGP. * US 303-343-4053 Hacker's Haven, Denver, CO Lots of crypto stuff here. 303-772-1062 Colorado Catacombs BBS, Longmont CO 8 data bits, 1 stop, no parity, up to 28,800 bps. Use ANSI terminal emulation. For free access: log in with your own name, answer the questions. 314-896-9309 The KATN BBS 317-887-9568 Computer Virus Research Center (CVRC) BBS, Indianapolis, IN Login First Name: PGP Last Name: USER Password: PGP 501-791-0124, 501-791-0125 The Ferret BBS, North Little Rock, AR Login name: PGP USER Password: PGP 506-457=0483 Data Intelligence Group Corporation BBS 508-668-4441 Emerald City, Walpole, MA 601-582-5748 CyberGold BBS 612-690-5556, !CyBERteCH SeCURitY BBS! Minneapolis MN, - write a letter to the sysop requesting full access. 914-667-4567 Exec-Net, New York, NY 915-587-7888, Self-Governor Information Resource, El Paso, Texas * UK 01273-688888 * GERMANY +49-781-38807 MAUS BBS, Offenburg - angeschlossen an das MausNet +49-521-68000 BIONIC-BBS Login: PGP WHERE CAN I FTP PGP CLOSE TO ME? * AU ftp://ftp.cc.adfa.oz.au/pub/security/pgp23/macpgp2.3.cpt.hqx ftp://ftp.iinet.net.au:mirrors/pgp(Australia ONLY) ftp://plaza.aarnet.edu.au/micros/mac/umich/misc/documentation/howtomacpgp2.7.txt * DE ftp://ftp.informatik.tu-muenchen.de/pub/comp/os/os2/crypt ftp://ftp.informatik.uni-hamburg.de/pub/virus/crypt/pgp ftp://ftp.fu-berlin.de/mac/sys/init/MacPGP2.6uiV1.2en.cpt.hqx.gz ftp://ftp.tu-clausthal.de/pub/atari/misc/pgp/pgp261b.lzh ftp://ftp.uni-kl.de/pub/aminet/util/crypt ftp://ftp.uni-paderborn.de/pub/aminet/util/crypt ftp://ftp.westfalen.de/pd/Atari/Pgp(Atari) ftp://tupac-amaru.informatik.rwth-aachen.de * ES ftp://goya.dit.upm.es ftp://encomix.es/pub/pgp/pgp262i/pgp262i.zip * IT ftp://ftp.dsi.unimi.it/pub/security/crypt/PGP * FI ftp://ftp.funet.fi/pub/crypt * NL ftp://ftp.nl.net/pub/crypto/pgp ftp.nic.surfnet.nl/surfnet/net-security/encryption/pgp * NZ ftp://ftphost.vuw.ac.nz ftp://rs950.phys.waikato.ac.nz/pub/incoming/pgp(New Zealand ONLY) * SE ftp://leif.thep.lu.se * TW ftp://nctuccca.edu.tw/PC/wuarchive/pgp/ * UK ftp://ftp.demon.co.uk/pub/amiga/pgp ftp://ftp.ox.ac.uk/pub/crypto/pgp ftp://src.doc.ic.ac.uk/aminet/amiga-boing ftp://unix.hensa.ac.uk/pub/uunet/pub/security/virus/crypt/pgp * USA ftp://atari.archive.umich.edu/pub/atari/Utilities/pgp261st.zip (Atari) ftp://ftp.leo.org/pub/comp/os/os2/crypt ftp://wuarchive.wustl.edu/pub/aminet/util/crypt ftp://ftp.netcom.com/pub/gr/grady/PGP_NOT_FOR_EXPORT/MacPGP262ca124.exe.sea… ftp://ftp.netcom.com/pub/gr/grady/PGP_NOT_FOR_EXPORT/MacPGP262ca124.src.sea… * ZA ftp://ftp.ee.und.ac.za/pub/crypto/pgp /pub/archimedes /pub/pgp /pub/mac/MacPGP HOW CAN I GET PGP BY EMAIL? If you have access to email, but not to ftp, send a message saying "help" to ftpmail(a)decwrl.dec.com, mailserv(a)nic.funet.fi, or ftp-request(a)netcom.com To get pgp 2.6.2i by email: Send a message to pgp(a)hypnotech.com with your request in the Subject: field. Subject What you will get GET pgp262i.zip MS-DOS executable (uuencoded) GET pgp262is.zip MS-DOS source code (uuencoded) GET pgp262is.tar.gz UNIX source code (uuencoded) For FAQ information, send e-mail to mail-server(a)rtfm.mit.edu with send usenet/news.answers/ftp-list/faq in the body of the message. WHERE IS MACPGP? ftp://ftp.csn.net/mpj/README.MPJ ftp://ftp.confusion.net/pub/pgp/mac-pgp/README ftp://highway.alinc.com/users/jordyn/mac-pgp/README ftp://miyako.dorm.duke.edu/pub/GETTING_ACCESS WHERE IS VAX PGP? Get the full PGP distribution, then get VAXPGP262.TAR.Z from the berkeley site for additional files needed to compile PGP for the VAX and a precompiled version for VAX/VMS 5.5-2. WHERE CAN I GET MORE PGP INFORMATION? http://www.csn.net/~mpj ftp://ftp.prairienet.org/pub/providers/pgp/pgpfaq.txt ftp://starfire.ne.uiuc.edu/preston/pgpquick.ps(and pgpquick.doc) http://www.prairienet.org/~jalicqui/ http://www.mit.edu:8001/people/warlord/pgp-faq.html http://draco.centerline.com:8080/~franl/crypto.html http://draco.centerline.com:8080/~franl/pgp/bug0.html http://www.eff.org/pub/EFF/Issues/Crypto/ITAR_export/cryptusa_paper.ps.gz http://www.eff.org/pub/EFF/Issues/Crypto/ITAR_export/cryptusa.paper http://www.cco.caltech.edu/~rknop/amiga_pgp26.html Email pgp-help(a)hks.net ftp://ds.internic.net/internet-drafts/draft-pgp-pgpformat-00.txt ftp://ds.internic.net/internet-drafts/draft-ietf-pem-mime-08.txt http://www.cis.ohio-state.edu/ ftp://ftp.csn.net/mpj/public/pgp/MacPGP262_manual.sit.hqx http://www-mitpress.mit.edu/mitp/recent-books/comp/pgp-source.html http://web.cnam.fr/Network/Crypto/(c'est en français) http://web.cnam.fr/Network/Crypto/survey.html(en anglais) http://www2.hawaii.edu/~phinely/MacPGP-and-AppleScript-FAQ.html ftp://ftp.prairienet.org/pub/providers/pgp/pgpbg11.asc(Beginner's Guide) http://pluto.cc.umr.edu/~steve/Privacy_Page.html/Where_is_PGP.html http://www.netresponse.com/zldf http://bookweb.cwis.uci.edu:8042/Orders/ubipgp.html http://www.geopages.com/Athens/1802/pgpfaq.html http://www.pgp.net/pgp http://www.sydney.sterling.com:8080/~ggr/pgpmoose.html Beginner's Guide: send email to slutsky(a)lipschitz.sfasu.edu, subject: bg2pgp WHAT ARE SOME GOOD PGP BOOKS? Protect Your Privacy: A Guide for PGP Users by William Stallings Prentice Hall PTR ISBN 0-13-185596-4 US $19.95 This is a good technical manual for PGP for most users, and makes a better reference than the "official" documentation that comes with PGP. I recommend it highly. PGP: Pretty Good Privacy by Simson Garfinkel O'Reilly & Associates, Inc. ISBN 1-56592-098-8 US $24.95 E-Mail Security: How to Keep Your Electronic Mail Private "Covers PGP/PEM" by Bruce Schneier Wiley Publishing The Computer Privacy Handbook: A Practical Guide to E-Mail Encryption, Data Protection, and PGP PRivacy Software by Andre Bacard Peachpit Press ISBN 1-56609-171-3 US $24.95 800-283-9444 or 510-548-4393 This is an interesting book on the sociology and politics of privacy in the computer age as well as a practical manual on using PGP. Must reading for all members of Congress, presidential staff, members of Parliament, and ordinary citizens who would like to take reasonable steps to protect themselves from some forms of crime that have been made easy by technology. THE OFFICIAL PGP USER'S GUIDE by Philip R. Zimmerman MIT Press April 1995 - 216 pp. - paper - US $14.95 - ISBN 0-262-74017-6 ZIMPP Standard PGP documentation neatly typeset and bound. PGP SOURCE CODE AND INTERNALS by Philip R. Zimmerman April 1995 - 804 pp. - US $55.00 - 0-262-24039-4 ZIMPH This is a handy printed reference with commented source code for PGP 2.6.2 with great educational value. This is a great way to study some of the computer science and information theory behind the world's best email privacy tool without having either a computer or reams of printouts handy. Recommended reading on long airline flights for serious students of computer science and computer security. Ordering information for the last two books: Call US Toll Free 1-800-356-0343 or 617-625-8569. Cite code 5CSC and number 661. Allow 4-6 weeks for delivery within North America. Allow 8-12 weeks for delivery outside of North America. How to Use PGP, 61 pages, (Pub #121) from the Superior Broadcasting Company, Box 1533-N, Oil City, PA 16301, phone: (814) 678-8801 (about US $10-$13). WHERE CAN I GET PGP LANGUAGE MODULES? These are suitable for most PGP versions. http://www.ifi.uio.no/~staalesc/PGP/language.html ftp://ftp.ifi.uio.no/pub/pgp/doc/ * German ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp23_german.txt ftp://ftp.csn.net/mpj/public/pgp/pgp_german.txt ftp://ftp.csn.net/mpj/public/pgp/PGP_german_docs.lha ftp://ftp.informatik.uni-hamburg.de:/pub/virus/crypt/pgp/language/pgp_german.asc ftp://ftp.leo.org/pub/comp/os/os2/crypt/pgp262i-german.zip * Italian ftp://ftp.dsi.unimi.it/pub/security/crypt/PGP/pgp-lang.italian.tar.gz ftp://ftp.funet.fi/pub/crypt/ghost.dsi.unimi.it/PGP/pgp-lang.italian.tar.gz</A * ftp://ftp.csn.net/mpj/public/pgp/pgp-lang.italian.tar.gz * Japanese ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp23_japanese.tar.gz ftp://ftp.csn.net/mpj/public/pgp/pgp-msgs-japanese.tar.gz * Lithuanian ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp23_lithuanian.zip ftp://ftp.csn.net/mpj/public/pgp/pgp23ltk.zip * Norwegian ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp23_norwegian.tar.gz ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp26i_norwegian.zip * Romanian ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp26_romanian.tar.gz ftp://ftp.encomix.es/pub/pgp/lang/pgp-romanian.zip http://www.info.polymtl.ca/zuse/tavi/www/archive/ro_2.6.2.zip http://www.info.polymtl.ca/zuse/tavi/www/archive/language.txt * Russian ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp26_russian.zip ftp://ftp.kiae.su/unix/crypto/pgp/pgp26ru.zip ftp://ftp.csn.net/mpj/public/pgp/pgp26ru.zip * Spanish ftp://ftp.dsi.unimi.it/pub/security/crypt/PGP/pgp-lang.spanish.tar.gz ftp://ftp.funet.fi/pub/crypt/ghost.dsi.unimi.it/pgp-lang.spanish.tar.gz ftp://ftp.csn.net/mpj/public/pgp/pgp-lang.spanish.tar.gz ftp://ftp.encomix.es/pub/pgp/lang/pgp262i-spanish.zip * Swedish ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp23_swedish.txt ftp://ftp.csn.net/mpj/public/pgp/pgp_swedish.txt IS PGP MORALLY RIGHT? PGP itself is morally neutral. What you do with it is not. Protecting privacy, prevention of criminal theft, and taking due diligence to protect certain business information (like credit card numbers, customer lists, etc.) are good uses for PGP. Concealing criminal or other immoral activity is wrong. You can fool the police some of the time, but you can't fool God. IS PGP LEGAL? Pretty Good Privacy is legal if you follow these rules: * Don't export PGP from the USA except to Canada, or from Canada except to the USA, without a license. * If you are in the USA, use either Viacrypt PGP (licensed for commercial use) or MIT PGP using RSAREF (limited to personal, noncommercial use). Outside of the USA, where RSA is not patented, you may prefer to use a version of PGP (2.6.i) that doesn't use RSAREF to avoid the restrictions of that license. * If you are in a country where the IDEA cipher patent holds in software (including the USA, Canada, and some countries in Europe), make sure you are licensed to use the IDEA cipher commercially before using PGP commercially. (No separate license is required to use the freeware PGP for personal, noncommercial use). For direct IDEA licensing, contact Ascom Systec. Ascom Systec has taken over the distribution of IDEA licenses effective April 1, 1995. Erhard Widmer is the person responsible for the sales aspects, and Peter Hartmann is responsible for the technical aspects. They can be reached as follows: Erhard Widmer, Ascom Systec AG, Dep't. CMVV Phone +41 64 56 59 83 Peter Hartmann, Ascom Systec AG, Dep't. CMN Phone +41 64 56 59 45 Fax: +41 64 56 59 90 e-mail: IDEA(a)ascom.ch Mail address: Gewerbepark, CH-5506 Maegenwil (Switzerland) * Don't sell PGP based on Philip Zimmermann's source code in North America unless you are reselling for Viacrypt (because they have an exclusive marketing agreement on Philip Zimmermann's copyrighted code). (Selling shareware/freeware disks or connect time is OK). This restriction does not apply to PGP 3.0, since it is a complete rewrite by Colin Plumb. Distribution and use restrictions on that version are still to be determined. * If you modify PGP (other than porting it to another platform or adapting it to another compiler), don't call it PGP (TM) or Pretty Good Privacy (TM) without Philip Zimmermann's permission. WHAT IS PHILIP ZIMMERMANN'S LEGAL STATUS? Philip Zimmermann was under investigation for alleged violation of export regulations, with a grand jury hearing evidence for about 28 months, ending 11 January 1996. The Federal Government chose not to comment on why it decided to not prosecute, nor is it likely to. The Commerce Secretary stated that he would seek relaxed export controls for cryptographic products, since studies show that U. S. industry is being harmed by current regulations. Philip endured some serious threats to his livelihood and freedom, as well as some very real legal expenses, for the sake of your right to electronic privacy. Although there was no direct and open legal battle, there was a lot of behind the scenes work by Phil's legal team, headed by Philip L. Dubois (dubois(a)dubois.com) GREAT JOB! If you ever are in the situation of needing a good lawyer to help you with similar Federal harassment, consider yourself fortunate if Mr. Dubois will take your case. Philip Zimmermann is breathing more easily these days, still a free man and able to work to support his family. The battle is won, but the war is not over. The regulations that caused him so much grief and which continue to dampen cryptographic development, harm U. S. industry, and do violence to the U. S. National Security by eroding the First Ammendment of the U. S. Constitution and encouraging migration of cryptographic industry outside of the U. S. A. are still on the books. If you are a U. S. Citizen, please write to your U. S. Senators, Congressional Representative, President, and Vice President pleading for a more sane and fair cryptographic policy. WHERE CAN I GET WINDOWS & DOS SHELLS FOR PGP? http://www.ifi.uio.no/~staalesc/AutoPGP.html http://www.dayton.net/~cwgeib ftp://oak.oakland.edu/SimTel/msdos/security/apgp22b.zip ftp://oak.oakland.edu/SimTel/win3/security/pgpw40.zip http://alpha.netaccess.on.ca/~spowell/crypto/pwf31.zip ftp://ftp.netcom.com/pub/dc/dcosenza/pgpw40.zip ftp://Sable.ox.ac.uk/pub http://www.firstnet.net/~cwgeib/welcom.html ftp://ftp.netcom.com/pub/ec/ecarp/pgpwind.zip http://www.eskimo.com/~joelm(Private Idaho) ftp://ftp.eskimo.com/~joelm http://www.xs4all.nl/~paulwag/security.htm http://www.LCS.com/winpgp.html ftp://mirrors.aol.com/mir01/circa/pub/pc/win3/util/pwf31.zip http://netaccess.on.ca/~rbarclay/index.html http://netaccess.on.ca/~rbarclay/pgp.html ftp://ftp.leo.org/pub/comp/os/os2/crypt/gcppgp10.zip ftp://ftp.leo.org/pub/comp/os/os2/crypt/pmpgp.zip http://iquest.com/~aegisrcs Compuserve: Library 3, European Forum. Library 6, NCSA Forum PCWorld Online Forum. WUGNET Forum. WinShare Forum See also the BBS list for PGP, above. WHERE CAN I GET THE MACPGP KIT? ftp://duke.bwh.harvard.edu:/pub/adam/mcip/MacPGP_icons.sit.hqx ftp://duke.bwh.harvard.edu:/pub/adam/mcip/MacPGPkit.hqx ftp://duke.bwh.harvard.edu:/pub/adam/mcip/MacPGPkitSources.sit.hqx ftp://ftp.netcom.com/pub/dd/ddt/crypto/pgp_tools/MacPGPkit1.6.sit OTHER MAC ADD-ONS ftp://ftp.netcom.com/pub/dd/ddt/crypto/pgp_tools/ChainMail.0.7.sit ftp://ftp.netcom.com/pub/dd/ddt/crypto/pgp_tools/Eudora->PGPScripts1.5.sit ftp://ftp.csn.net/mpj/I_will_not_export/crypto_???????/pgp/mac/AppleScripts WHAT OTHER FILE ENCRYPTION (DOS, MAC) TOOLS ARE THERE? PGP can do conventional encryption only of a file (-c) option, but you might want to investigate some of the other alternatives if you do this a lot. Alternatives include Quicrypt and Atbash2 for DOS, DLOCK2 for DOS & UNIX, Curve Encrypt (for the Mac), HPACK (many platforms), and a few others. Quicrypt is interesting in that it comes in two flavors: shareware exportable and registered secure. Atbash2 is interesting in that it generates ciphertext that can be read over the telephone or sent by Morse code. DLOCK is a no-frills strong encryption program with complete source code. Curve Encrypt has certain user-friendliness advantages. HPACK is an archiver (like ZIP or ARC), but with strong encryption. A couple of starting points for your search are: ftp://ftp.csn.net/mpj/qcrypt11.zip ftp://ftp.informatik.uni-hamburg.de/pub/virus/crypt/file/ ftp://ftp.csn.net/mpj/I_will_not_export/crypto_???????/file/ ftp://ftp.csn.net/mpj/README for the ???????) ftp://ftp.miyako.dorm.duke.edu/mpj/crypto/file/ HOW DO I SECURELY DELETE FILES (DOS)? If you have the Norton Utilities, Norton WipeInfo is pretty good. I use DELETE.EXE in del110.zip, which is really good at deleting existing files, but doesn't wipe "unused" space. ftp://ftp.csn.net/mpj/public/del120.zip ftp://ftp.demon.co.uk/pub/ibmpc/security/realdeal.zip WHAT DO I DO ABOUT THE PASS PHRASE IN MY WINDOWS SWAP FILE? The nature of Windows is that it can swap any memory to disk at any time, meaning that all kinds of interesting things could end up in your swap file. ftp://ftp.firstnet.net/pub/windows/winpgp/wswipe.zip WHERE DO I GET PGPfone(tm)? PGPfone is in beta test for Macintosh users. A Windows 95 version is being developed. http://web.mit.edu/network/pgpfone ftp://net-dist.mit.edu/pub/PGPfone/README ftp.hacktic.nl/pub/pgp/pgpfone WHERE DO I GET NAUTILUS? Bill Dorsey, Pat Mullarky, and Paul Rubin have come out with a program called Nautilus that enables you to engage in secure voice conversations between people with multimedia PCs and modems capable of at least 7200 bps (but 14.4 kbps is better). See ftp://ripem.msu.edu/pub/crypt/GETTING_ACCESS ftp://ripem.msu.edu/pub/crypt/other/nautilus-phone-0.9.2-source.tar.gz ftp://ftp.csn.net/mpj/README ftp://ftp.csn.net/mpj/I_will_not_export/crypto_???????/voice/naut092.zip ftp://miyako.dorm.duke.edu/pub/GETTING_ACCESS ftp://miyako.dorm.duke.edu/mpj/crypto/voice/naut092.zip ftp://ftp.dsi.unimi.it/pub/security/crypt/cypherpunks/nautilus ftp://ftp.ox.ac.uk/pub/crypto/misc The Colorado Catacombs BBS 303-772-1062 HOW DO I ENCRYPT MY DISK ON-THE-FLY? Rather than manually encrypting and decrypting files, it is sometimes easier (and therefore more secure, because you are more likely to use it) to use a utility that encrypts or decrypts files on the fly as you use them in your favorite applications. This also allows you to automatically encrypt temporary files generated by your applications if they are on the encrypted volume. Secure File System (SFS) is a DOS device driver that encrypts an entire partition on the fly using SHA in feedback mode. Secure Drive also encrypts an entire DOS partition, using IDEA, which is patented. Secure Device is a DOS device driver that encrypts a virtual, file-hosted volume with IDEA. Cryptographic File System (CFS) is a Unix device driver that uses DES. http://www.cs.auckland.ac.nz/~pgut01/sfs.html ftp://ftp.informatik.uni-hamburg.de/pub/virus/crypt/disk/ ftp://ftp.csn.net/mpj/I_will_not_export/crypto_???????/disk/ ftp://ftp.csn.net/mpj/README for the ???????) ftp://miyako.dorm.duke.edu/mpj/crypto/disk/ ftp://ftp.nic.surfnet.nl/surfnet/net-security/encryption/disk/ ftp://ftp.demon.co.uk/pub/ibmpc/secdev/secdev14.arj WHERE IS PGP'S COMPETITION? RIPEM is the second most popular freeware email encryption package. I like PGP better for lots of reasons, but if for some reason you want to check or generate a PEM signature, RIPEM is available at ripem.msu.edu. There is also an exportable RIPEM/SIG. ftp://ripem.msu.edu/pub/GETTING_ACCESS HOW DO I PUBLISH MY PGP PUBLIC KEY? Send mail to one of these addresses with the single word "help" in the subject line to find out how to use them. These servers sychronize keys with each other. pgp-public-keys(a)keys.pgp.net pgp-public-keys(a)keys.de.pgp.net pgp-public-keys(a)keys.no.pgp.net pgp-public-keys(a)keys.uk.pgp.net pgp-public-keys(a)keys.us.pgp.net pgp-public-keys(a)burn.ucsd.edu pgp-public-keys(a)pgp.cc.gatech.edu pgp-public-keys(a)goliat.upc.es pgp-public-keys(a)demon.co.uk pgp-public-keys(a)dsi.unimi.it pgp-public-keys(a)ext221.sra.co.jp pgp-public-keys(a)fbihh.informatik.uni-hamburg.de pgp-public-keys(a)jpunix.com pgp-public-keys(a)kiae.su pgp-public-keys(a)kr.com pgp-public-keys(a)kram.org pgp-public-keys(a)kub.nl pgp-public-keys(a)nexus.hpl.hp.com pgp-public-keys(a)pgp.ai.mit.edu pgp-public-keys(a)pgp.barclays.co.uk pgp-public-keys(a)gondolin.org pgp-public-keys(a)pgp.dhp.com pgp-public-keys(a)pgp.hpl.hp.com pgp-public-keys(a)pgp.iastate.edu pgp-public-keys(a)pgp.kr.com pgp-public-keys(a)pgp.mit.edu pgp-public-keys(a)pgp.ox.ac.uk pgp-public-keys(a)pgp.pipex.net pgp-public-keys(a)srce.hr pgp-public-keys(a)sw.oz.au pgp-public-keys(a)uit.no pgp-public-keys(a)vorpal.com pgp-public-keys(a)nic.surfnet.nl WWW interface to the key servers: http://www-swiss.ai.mit.edu/~bal/pks-toplev.html http://www-lsi.upc.es/~alvar/pks/pks-toplev.html For US $20/year or so, you can have your key officially certified and published in a "clean" key database that is much less susceptible to denial-of-service attacks than the other key servers. Send mail to info-pgp(a)Four11.com for information, or look at http://www.Four11.com/ PGP public keys which are stored on SLED's Four11 Key Server are now retrievable by fingering UserEmailAddress(a)publickey.com. Example: My e-mail addresses is mpj(a)csn.org finger mpj@csn.org@publickey.com My key (mpj8) is at Four11.com, at ftp://ftp.csn.net/mpj/mpj8.asc, on the key servers, on my BBS, and available by finger. CAN I COPY AND REDISTRIBUTE THIS FAQ? Yes. Permission is granted to distribute unmodified copies of this FAQ. Please e-mail comments to mpj(a)netcom.com -----BEGIN PGP SIGNATURE----- Version: 2.7.1 iQCVAwUBMPoQnvX0zg8FAL9FAQHgAwP+Of94tn35tUAaXsZXk4yDLZaOsk0YEgpT 3sSKrvYS78iHjNgRQDE+cAntOHeexYDQZ17ecSGAMqvcC1oOiPoeb0lV4lxGRCPK plOnVQLSjgKyshb1mrOPnl25kZhiCOt6Std3nsNICgnMtz+SafRI5+hCLA+l+xUH 7fqHR8Dq6b0= =sbwR -----END PGP SIGNATURE-----

1 0

Re: Bignum support added to XLISP 2.1h
by Ulf_Moeller＠public.uni-hamburg.de 17 Dec '03

17 Dec '03

Rick Busdiecker <rfb(a)lehman.com> writes: > it is quite easy to write cryptographic algorithms that use very large > numbers without adding extra support. The downside is that the language is >Yup. I've written some code that generates large numbers, tests for >primality and does RSA. The basic RSA enclode is just (mod-expt m e >n) and decrypt is (mod-expt c d n) where mod-expt is just an optimized >version of (mod (expt x p) n), ala Schneier, page 200 (1st edition). Actually, there is a modexpt (and a Fermat test) implementation in chapter 1 of Abelson/Sussman, with a footnote mentioning cryptography. I do wonder if they have an export license... :)

1 0

RE: Net Control is Thought Control
by D.R.Madden 17 Dec '03

17 Dec '03

DIa!?ayyyyyyyyyyyyyyyyRyyyyyyyyyyyyyyyyNDyyyyyyyyyyyyyyyyyyyytNSe useful to set out, as I see it anyway, the main questions that need answering. Thanks for any info/insight that you can provide. 1. How is it possible -- in a legal sense -- for the laws of one state (Germany) to be imposed globally. I suspect the answer to this is : it isn't -- CompuServe seems to have pulled the plug without recourse to any legal battle (?). This makes it's protestations that it's all Germany's fault a little thin. 2. Even granted that Germany can impose it's porn laws on the world, how is CompuServe violating German law: it is *not* the case that CompuServe is producing the offending material *within* Germany. Rather , German netties are able to import the offending material from outwith. Hence it is the German netties (or at most the German connection banks) who are violating the pornography laws. Analogy: if a German stationary retailer buys a stack of smutty mags in Sweden, which wall foul of the German smut laws, and then brings them into Germany for resale in his store, do the Germans then have a case for closing down the Swedish publisher of the mags? Surely it is up to the German connection banks to comply with German law. CompuServe doesn't export anything -- users import. This kills the Satellite porn channel analogy which some people are using (UK censors some such channels). The Germans no doubt will argue that the above analogy is faulty in that whereas the import of smutty mags is (or can be) subject to border controls, the internet is, well, a net -- either the offending material is pulled at source or not at all. Not true: the offending material could be pulled from the German net servers. Of course, there are ways around the ban (cf. Duncan Frissel's emails passim) but the number of minors capable of effecting these would be negligible -- certainly not enough to justify 1. above (assuming that 1 can be justified upon any principle) 3. Why has Germany picked on CompuServe alone -- not only is it a daft law but one which quite obviously fails to capture the rationale behind the law (Thankfully). (Possibly a case of the Bavarians blowing the puritanical horn without actually wishing to upset the German cyber community too much. Although, interestingly, the silence on this issue amongst the German PC community is deafening -- I'll see if I can garner any response to this, and the other points, by sending this email to the Max-Planck Institute fuer Infomatik in Germany where I used to work). 4. 1 and 3 raise the question: why did CompuServe cave in so easily? The issue could have been in the European courts for the next few aeons allowing CompuServe to proceed as per normal (and since the whole of the EU is effected, surely this is precisely the sort of issue that should be settled by their courts). Can any lawyers out there give an indication of the chances CompuServe would have in such a case? 5. Bearing above, and previous cypherpunk emails on this issue, in mind, has anyone, or group actually challenged the German decision on legal grounds (as opposed to just discussing it)? 6. Has anyone heard any arguments emanating from Germany itself along the "thin end of the wedge" lines? There are plenty of dodgey states out there who will be only too willing to point at Germany, a "civilised Western culture", as a precedent to justify the removal of all sorts of topics which do not accord with their definitions of acceptability. I initially thought that Duncan's correlation of net control with thought control (cf. his email of 10th Jan, 12.52pm) was over-stepping the mark (on the grounds that we're not yet eating Clockwork Oranges in a Brave New World). But, bearing 6. in mind, if totalitarian states are able to dictate what appears on the net (and what is read by precisely the "young minds" which Germany purports to protect) then I'm beginning to think he's accurately characterised a potential state of affairs a few years down the line. Food for thought control. Peter Madden (formally of MPI, Germany, soon to be DRA, UK). P.S. Pity the average German nettie -- they're excruciatingly embarrassed by this whole business. yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy

1 0

Eggs, or, To Get Some Entropy You Gotta Break Some Eggs...
by tcmay＠got.net 17 Dec '03

17 Dec '03

(Amazing that a discussion of eggs could come back to crypto...) At 2:17 AM 1/16/96, Rich Graves wrote: >Kind of analogous to an engineer like Paul Kocher taking a hard look at >crypto systems that had only been analyzed by pure mathematicians. You >need to feed the sniffers real entropy, not just highly evolved math. I keep thinking of different ways of looking at Kocher's timing attack. (Paul Kocher gave a nice talk at the Bay Area Cypherpunks meeting on Saturday.) Rich's point above suggests yet another way of looking at this: that a chip or algorithm that can be "instrumented" (timing measured) is in some sense too predictable. The chip itself lacks sufficient entropy. (Before the purists, especially those who've read the paper closely, jump on me here, I'm not saying adding random delays is the best way to deter the attack. In fact, a variation of blinding is the best approach it seems. (Though blinding does not affect attacks which monitor the crypto chip's or CPU's power dissipation.)) My point, or this angle on it, is that to some extent the mechanistic nature of the encryption process (such as Diffie-Hellman) can leak information to an attacker who can watch the mechanistic process unfolding. This is a result which is not surprising, in retrospect. --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Netly News on Nutly News
by Declan McCullagh 17 Dec '03

17 Dec '03

http://cgi.pathfinder.com/netly/0,2326,201980909-14593,00.html The Arrest of the Nutly Bomber By Declan McCullagh (declan(a)well.com) [Part I of a Series For two years a pair of anonymous Net crackpots have been posting angry tirades to a cryptography discussion list under a takeoff of Netly called "Nutly News." Now the FBI and Royal Canadian Mounted Police say that a digital signature connects them to a bomb discovered last June in a Canadian courthouse.] It was about 5 p.m. on August 18. Carl Johnson, 49, was beating the heat inside the Rialto Theater in what passes for downtown Tuscon, Ariz. That morning a friend had tipped off Johnson that the police were trying to find him, but for now he had something else on his mind: his music. The itinerant musician and writer had spent the last month furiously scribbling lyrics, friends say, and he wanted a loan from someone he knew who worked at the theater. It was for some recording work, Johnson explained. This was going be his third album, after "My Way or the Highway" and "Please! Stop Me Before I Sing Again." But when Johnson left the Rialto, his musical career was cut short by two federal agents from the IRS's internal security division. They arrested him on charges of Internet threats against federal judges and police. The Canadians wanted Johnson, too, on charges of planting a bomb in a Saskatchewan courthouse. [...]

1 0

Re: Phil Z getting through customs
by jim bell 17 Dec '03

17 Dec '03

At 08:32 AM 1/15/96 +0000, Brad Shantz wrote: > attila <attila(a)primenet.com> wrote: >> answer the questions truthfully and they can not detain you??? > >Not true, I've been detained by Canadian customs for doing just that. >Everything went reasonably smoothly thanks to the customs officials >lack of knowledge of NAFTA. However, one of my travelling partners >had trouble with customs due to ...hmmm... their lack of knowledge of >NAFTA. > >> Rule 1: smile regardless of the adversity > >That's a good rule for things other than customs dealings. I haven't driven to Canada for well over a decade. But last time I did, when I was addressed the Canadian border guy, he asked me whether I had brought any firearms along. I said to him, "No. I didn't think I'd be needing them!" He didn't as much as crack a smile.

1 0

SCADA in power grid
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

this is from http://www.garynorth.com/y2k/detail_.cfm/2439 Gary North's Y2K Links and Forums Summary and Comments (feel free to mail this page) ---------------------------------------------------------------- Category: Power_Grid Date: 1998-08-29 13:57:30 Subject: The Convenient Lie: Link: http://y2ktimebomb.com/PP/RC/dm9834.htm Comment: On August 27, I spoke before a meeting of 500 people -- 5% of a local town. At that meeting, representatives of several industries spoke: banking, telephone, electrical power. When pressed by someone in the audience, the representative of the power company insisted they could run the entire company on manual systems without compliant computers. Forget about noncompliant chips. The company can do it manually. I asked him straight: Can they run the SCADA (supervisory control and data acquisition) system without telecommunications? That's the computerized system that tells them how much power is running through the lines. "Yes," he said. A week before I had been told by an engineer with a large urban power company that without SCADA, they would fry the lines permanently. "There is no way we could run the system manually." I guess engineers don't agree. I told the audience this: "No system can be switched to pre-computer manual operations without training. Any outfit that claims that it can be run manually had better have a highly trained technical staff to take over in 2000. Does the outfit have a training manual? How much training money has it budgeted?" Any outfit that does not have the staff being trained right now is lying when it says that it can be run manually. It cannot be run manually by phantom workers. The men who knew how to run it manually were fired 30 years ago. The manual systems were replaced. The industry did not spend hundreds of billions of dollars on computerization so as to have two separate operation systems. They spent the money to get rid of manual systems. Any time you hear some representative tell you his public utility can be run manually, ask five questions: 1. How many trained personnel do you need, including substitutes, to run your system manually? 2. How many are currently undergoing training for this task, and how many have finished it? 3. May I come in and see your training manual that you use to train these people? 4. How much money has your company budgeted to train this staff? 5. How much has already been spent? You must call their bluff. They're lying. They have no intention of trying to run anything manually. It's just a PR ploy. It's Monica Lewinsky syndrome. Nobody suffers any consequences for lying to the public. But can't they be sued for lying, i.e., misleading the public? Not if all companies in the industry collapse for the same reason. They will share the blame, or pass it on to a higher authority: "An act of God." When you catch one of them in a lie this big, you can rest assured: he knows that it can't be fixed by anyone, so he knows he can't be successfully sued. Training to convert to manual systems won't work, of course. The power industry can't be run manually, and it's too late to fix the code. Besides, nobody in the industry will pay any attention to such warnings. But at least it lets the industry know that you don't believe the lie any more. Dick Mills, who is a public optimist about the power grid, recently issued a warning to the industry: begin contingency planning. This includes training. This is the best advice that anyone could give the power industry -- not because the advice could work at this late date, but because it's time to call their bluff. This is from Westergaard's site. * * * * * * * * * . . . Isn't there already a national emergency plan in place for such as critical infrastructure such as power? No, not to my knowledge. Please write and tell me if I'm wrong. Never before, has there been a threat to the power system of such sweeping scope and magnitude as Y2K. There was no need for a national electric-power emergency plan. Prudence requires that we have such a plan, not only for Y2K but also for other future threats. I foresee that this plan will need to span national, state, local, public, private, utility and non-utility boundaries. How might we accomplish that? I've been told that existing presidential executive orders allow the entire industry to be nationalized at the stroke of a pen in case of emergency. Thus the authority exists, but it will do no good unless there are plans and trained organizations in place to use it effectively. There are numerous mitigating possibilities to be considered. That is true of not only to electric power but also to all industries and all facets of the Y2K problem. . . . It is already too late to finish Y2K remediation for many companies, but it is not too late for disaster preparations. To actually get practical and practiced disaster preparedness plans in place, we must accomplish three things. I see these three as my working goals. I hope you do the same. . . . We must plan, train, and practice the implementation of emergency procedures. Those are key elements of all emergency services like fire and police. In the Y2K case, we have to combine strangers into teams, invent new roles, and practice. That takes time. Link: http://y2ktimebomb.com/PP/RC/dm9834.htm ---------------------------------------------------------------- Return to Category: Power_Grid Return to Main Categories Return to Home Page

1 0