- cypherpunks-legacy - lists.cpunks.org

cryptlib 2.00 free encryption library released
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

Version 2.00 of cryptlib is now available from ftp://garbo.uwasa.fi/pc/crypt/crypl200.zip and also from ftp://ftp.franken.de/pub/crypt/misc/cryptl200.zip. The library provides an easy-to-use interface which allows even inexperienced crypto programmers to easily add strong encryption and authentication services to their software. The library contains DES, triple DES, IDEA, MDC/SHS, RC2, RC4, RC5, SAFER, SAFER-SK, Blowfish, and Blowfish-SK conventional encryption, MD2, MD4, MD5, RIPEMD-160 and SHA hash algorithms, and Diffie-Hellman, DSA, and RSA public-key encryption, as well as a comprehensive high-level interface with functions such as cryptCreateSignature() and cryptExportKey(). The library is supplied as source code for Unix (shared or static libraries), DOS, Windows (16- and 32-bit DLL's), and the Amiga. The library provides a standardised interface to a number of popular encryption algorithms, as well as providing a high-level interface which hides most of the implementation details and provides an operating-system-independant encoding method which makes it easy to transfer encrypted data from one system to another. Although use of the the high-level interface is recommended, experienced programmers can directly access the lower-level encryption routines for implementing custom encryption protocols or methods not provided by the library. The library API serves as an interface to a range of plug-in encryption modules which allow encryption algorithms to be added in a fairly transparent manner. The standardised API allows any of the algorithms and modes supported by the library to be used with a minimum of coding effort. As such the main function of the library is to provide a standard, portable, easy-to-use interface between the underlying encryption routines and the user software. In addition the easy-to-use high-level routines allow for the exchange of encrypted session keys and the creation and checking of digital signatures with a minimum of programming overhead. The library has been written to be as idiot-proof as possible. On initialization it performs extensive self-testing against test data from encryption standards documents, and the API's check each parameter and function call for errors before any actions are performed, with error reporting down to the level of individual parameters. The library implements a security perimeter around the encryption functions, with encryption contexts consisting of an arbitrary handle referring to (hidden) data held within the library. No outside access to state variables or keying information is possible, provided the underlying OS provides some form of memory protection. If the OS supports it, all sensitive information used by the library will be page-locked to ensure it is never swapped to disk. There is one small bug I found about an hour after it was released (sigh), you can't use CRYPT_USE_DEFAULT as a parameter to cryptCreateContext() due to missing parentheses in crypt.c. Incidentally, if someone in Europe with a high-bandwidth link to the rest of the world could provide a permanent site for cryptlib betas that'd be useful, since the current beta distribution system is rather ad hoc. Peter.

1 0

Re: COMMUNITY CONNEXION SUED IN FRIVOLOUS LAWSUIT
by Bill Stewart 17 Dec '03

17 Dec '03

At 06:03 PM 10/14/96 -0700, Steven L Baur <steve(a)miranova.com> wrote: > http://www.spa.org/piracy/CODE.htm > ... > 8. Do not sponsor, endorse, or advertise access to infringing > software. I wonder how a "Hack Netscape" or "Hack Microsoft" contest fits in with this, to name two major public services run by C2...... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

1 0

AS2805.65 standard?
by Min-Ming Chin 17 Dec '03

17 Dec '03

Hi, there, Anyone heard of the Australian security standard AS2805.65? Beats me...

1 0

GAK Naive or Shrewd?
by John Young 17 Dec '03

17 Dec '03

Ern Hua's letter is ultimate. ----- The New York Times, October 15, 1996. Is Clinton's Encryption Policy Naive or Shrewd? To the Editor: There is something strange going on with the Clinton Administration's policy on data-scrambling software and Secretary of Commerce Mickey Kantor's defense of it (letter, Oct. 11). If the Administration really wanted to prevent encryption software from falling into hostile hands, it would try to pass a law limiting the type of encryption that can be sold domestically, not just exported. The cumbersome system the Administration proposes may be a measure of its computer naivete. People who are familiar with computer encryption know that strong encryption can be readily had here in the United States over the Internet or telephone lines from dial-up computer bulletin boards. Not long ago I downloaded a copy "Pretty Good Privacy," a system similar to the Rivest-Shamir-Adelman "strong" public-key method. Anyone with a computer, a modem and a phone line could do the same. Or the Government may not be naive at all but merely Machiavelian. Suppose the code breakers at the National Security Agency had managed to develop efficient solutions to "strong" methods. Would it be in the Government's interest to keep that fact a secret and to create a distracting furor by pushing another, weaker (and exportable) encryption system it knows has not a chance being adopted? Then encryption usrs would be lulled into using compromised systems while the National Security Agency decrypts their mail. Warren Wetmore,Hazel Crest, Ill., Oct. 11,1996 ----- To the Editor: Mickey Kantor's Oct. 11 letter is unconvincing. Instead of trying to prohibit strong cryptography, governments should encourage its use. It is the best tool for defending our privacy on the information highway. Jeffrey Shallit, Kitchener, Canada, Oct. 11,1996 The writer is an associate professor of computer science at the University of Waterloo. ----- To the Editor: Mickey Kantor (letter, Oct. 11) says that your Oct. 4 editorial ignores the trend -- especially in Europe -- to require use of key-recovery products and bar the import of stronger encryption products. This ignores that no one wants mandated key recovery. Some important uses of encryption, like secure telephone conversations, do not need key recovery for any reason other than law enforcement intercepts. Mr. Kantor's point on other nations' barring imports is absurd. Since when do we tailor our export limits to the import limits of other nations? The "trend" Mr. Kantor refers to is artificially created by the United States through lobbying efforts. Mr. Kantor uses the word "trend" as if other nations were independently pursuing the key-recovery path, when, in fact, only a few are considering such a move. Some, like Japan, have opposed such a direction. Others, like Sweden, have considered such a move secretly because such a policy cannot withstand democratic scrutiny. Mr. Kantor's letter is a blatant attempt by the Administration to get what it wants for law enforcement and national security agencies without any concern for the nature of the technology or the economic effect of such policies. Ernest Hua, Sunnyvale, Calif., Oct. 11, 1996 The writer is a software engineer. -----

1 0

Threats from FOTM (Friends of Timmy May)
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

I've been receiving multiples copies of threats of frivolous lawsuits in connection with Sandy Sanford's kind offer to address the San Francisco Gay and Lesbian Cypherpunks Meeting (and Meating). Therefore I'm regrettably forced to postpone taking advantage of said kind offer until Timmy May is actually indicted for possession of controlled substances (to wit, Ritalin) and/or sexually molesting two feline minors and/or practicing cryptography without a licence. (Given Timmy May's total ignorance of cryptography, I find the latter to be the least likely.) Hope to see you all then, Dimitri ]Date: Tue, 15 Oct 1996 06:04:16 -0500 ]From: "Douglas B. Renner" <dougr(a)skypoint-gw.globelle.com> ]Subject: Abuse from Dimitri Vulis ]To: root(a)bwalk.dm.com, postmaster(a)bwalk.dm.com ]Message-Id: <Pine.3.89.9610150547.A858-0100000(a)skypoint-gw.globelle.com> ]Mime-Version: 1.0 ]Content-Type: TEXT/PLAIN; charset=US-ASCII ] ]Attached is a tiny example of the type of uncalled-for slander that Mr. ]Dimitri Vulis has been sending unsolicited to a list of subscribers to a ]cryptography forum. ] ]You are hereby notified of this illegal activity by one of your subscribers. ]If you fail to take corrective measures, the Boardwalk Brighton Beach ]BBS and its sysops may be named in a civil lawsuit. ] ]---------- Forwarded message ---------- ]Date: Thu, 10 Oct 96 21:51:57 EDT ]From: Dr.Dimitri Vulis KOTM <dlv(a)bwalk.dm.com> ]To: cypherpunks(a)toad.com ]Subject: Re: LET'S MEET DIMITRI ] ]Sandy Sandfort <sandfort(a)crl.com> writes: ]> his choice of topic, of course. ] ]"Timmy May and his sexual perversions". Illustrated with slides. ] ]--- ] ]Dr.Dimitri Vulis KOTM ]Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps ]

2 1

VOO_doo
by John Young 17 Dec '03

17 Dec '03

October 25 Science reports on the latest teleportation research in "To Send Data, Physicists Resort to Quantum Voodoo." It describes a laser-driven apparatus for transmitting highly secure encoded (but not encrypted) messages via entangled photon states. IBM's Charles Bennett says, "as other researchers work to harness quantum mechanics for computation and cryptography, teleportation could become the equivalent of a quantum mail service." ----- http://jya.com/voodoo.htm VOO_doo (txt) Science is at: http://www.sciencemag.org/

1 0

AW: binding cryptography
by Eric Verheul 17 Dec '03

17 Dec '03

On dinsdag 15 oktober 1996 14:09, Roy M. Silvernail[SMTP:roy@sendai.scytale.com] wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >In list.cypherpunks, everheul(a)NGI.NL writes: > >> BTW, some people on the cypherpunks list seem to think that you can't = >> fraude with a *voluntary* system. However, that is possible: when you do = >> not comply with the *agreed* rules of conduct then the phrase "fraude" = >> is appropriate. >If the system is *voluntary* and I do not *agree* to participate, then I >*cannot* be breaking any "rules". That is correct. Sorry that the BTW-statement is so evident. Some people did not understand that if you *do* agree, then you *can* be breaking any rules... >>> Can you imagine what would happen if governments would (help to) set up = >> a system that has no safeguards at all, i.e. that could give criminals = >> all the anonimity and confidentiality they need? Governments can't = >> probably prevent criminals and the like to use encryption to stay out of = >> sight of law enforcement agencies, but they should not facilitate them = >> either. In the next few years all kinds of "standard" commerical = >> software will come on the market with all kinds of standard security in = >> it. I don't want criminals to be happy with Custom of The Shelf products = >> for security, let them work for their security. > >Which they will, and presumably already do. Therefore, your proposal >does not and cannot hamper criminals. Therefore, your proposal only >hampers law abiding citizen-units' access to uncompromised crypto. I do not agree. For instance, the encryption possibilities of wordperfect, and MS-word are weak; my mail-system (ms-exchange) does not have any encryption at all. The security of these important Custom of The Shelf products can and will be enhanced.. >No institution can expect compliance from a sector of society that, >by definition, does not agree to or follow the social contract. >Therefore, any and all such attempts to do so must be for the purpose of >controlling those citizen-units that do abide the social contract. To >claim otherwise is absurd. The point is that public available systems should *aid* not them in their criminal activities, let them search for alternatives. Compare it with the legislation we have here on the sell of guns. You sort of say: hey, that does not help cause criminals will get it somewhere. I say, that is true, but it will make their lifes more difficult, or maybe I should say less easy. > >> The bottom line is that law-abiding citizens = >> always have to give up some of their freedom to stop criminals (that is = >> why you have to have registration plates on your car, a lock on your = >> car, bicycle, house etc.). That is a fact of life; one I hate. > >Registration plates do not "stop criminals". Locks do not "stop >criminals" (although they might slow a criminal down). Neither will >compromised crypto "stop criminals". But all the above impinge on my >liberty. Am I to give up yet another freedom? Our system slows down criminals too, or maybe I'd better say does not speed them up. Locking my house and my car, certainly limits my freedom too because it gives me the risc of losing the key (happened a few times). Finding the middle of losing freedom by law-abiding citizens on the one hand and stopping criminals on the other hand is an important issue in any democracy. We believe our system gives a solution in which every democratic country on his own implement to their middle, without losing connectivity with countries that think otherwise.

1 0

Key Exchange Request
by Mike Babcock 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Type Bits/KeyID Date User ID pub 1280/FA4C5DB1 1996/06/13 Michael T. Babcock <mbabcock(a)tyenet.com> Michael T. Babcock <mbabcock(a)cyberbeach.net> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i Comment: http://www.cyberbeach.net/~mbabcock/PGP/ mQCtAzHAhC8AAAEFAMG+C+yN8q7KDT5TUSdyQNZlDDlTGuF4vUzPEq52lrqx7NAA YwJuj0dtOnnU2GAAonNutYF7nbbsS5yjWWgENioKOzIdjgDpq+YBZDkX4kFTD/+5 PM5EZhS1kT54zDpbjlZHtu9ViL3xUD/vp5zmp7Mlxqdd5SbkM0bpIBlBIqfpij59 hOVgc837YtAMmAbuRzwzy06/5ne221MLA/pMXbEABRG0KE1pY2hhZWwgVC4gQmFi Y29jayA8bWJhYmNvY2tAdHllbmV0LmNvbT6JAJUDBRAx2dcPTeL4zy9PtLMBAZ0+ A/9T8thIB2MW/0X0H4HTPNQ5TJlXM/56wxEtWNrr0Veku+lJvMdm6JvCDHqIfNC8 lTsWCg1Hot7EyNWhtXPp29A2fgLK/8hVJiFDs55ClWk9E4x3ug2mLZESid3qJO6U 3AnnzbI1ZuAelcX6tzJAYtJlbUz3t2y0pUloDUz7Uj4oGIkAlQMFEDHAhI2lZOCu UMiZpQEBcr0EAJP1lU3gJCidTwyHNlc16kybaTfECQz/TV7W+OqOcdH3mD3HKxUk J5KHRqTL4mS/tiiTmFEuFnwJaa36f+8ARkjq2EgmUX74ItfpcdplU3Sxe04om7Oy 7XNrgqWWpt+dEqQQqOLEVCTfuwNQck96GLLu1hZUXfrgDkpBT0rsl6cMiQC1AwUQ McCEMNtTCwP6TF2xAQGj3AT/VMMu5yZZTychDeLMfxsMse/xQ1/Ioi2UzApBdyiQ 7EVXWWHG0q5GGwGMiIsPeIFcbvF39DwSBX2BsBcnQh90wERdRsCo2BkG7Sw9Pk5a 13FDiXv+5eUDRsc0Z7z874vvpurzV1afuL+LKCAgOlxJhinikKqbR89AVLx4xRzl /BAyE4OBUfZZNIpshmtJdhSO/027WEAd6jXEHu3IkIl4+LQsTWljaGFlbCBULiBC YWJjb2NrIDxtYmFiY29ja0BjeWJlcmJlYWNoLm5ldD6JAJUDBRAxwIpqpWTgrlDI maUBAXnqA/0X+RTykzFUl0IMVVfJeb1JPMTBlq4vMwAdsipYTtHPMNfWNfp7hsUO Sk4/v1IzX0pEysHvQhD/Q56s0MYDd+gxMV17v0JnBI36wTgIEjOITMKUKShlHyWx RGCs0KmCt8NJ958IwRErbCw9EIdObX9JChzXTvGA91kpXYxOwpr6XokAtQMFEDHA ij/bUwsD+kxdsQEBtc4E+wUYFsgqjThhUxpBFBdRc0k1oXKzbVl+itKUtdfqOH1d Wc99PMkdttqVi3ME0xLNOfVLYg0lROyZqR8xZKLfKCGLoFWUE8kOFoL+VuZQ/Nuz VS0bArNMk8+ghbSiC82IFScQkFcvISkuDgMOyaDviNPbeb2QMhjkhP20NDLaX5tW UNSXfjUMJLCp33yNaM9/fwGAs6V21qeViJh9IFxUh04= =OAVt - -----END PGP PUBLIC KEY BLOCK----- This message was sent by Pronto Secure Mail. Above is my public key. Please send your public key by return mail. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMmOzQyoZzwIn1bdtAQFCUQF9E1ggA7yYJ/mwRD98YF5ZFh+5yUz5YJy4 qCA7f+rprv4llxArrYTlZU/fAOwHmQ64 =OFUM -----END PGP SIGNATURE-----

1 0

Re: PLEDGES
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Paul, You wrote: > What the hell, I'll spring for $200. It would be the needed > excuse to leave San Diego anyway. Wah whoo! This, plus some other new pledges puts us over the $1000 mark. Now all we need is some show of intestinal fortitude from Dimitri. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

Re: "Right to Privacy" and Crypto
by Duncan Frissell 17 Dec '03

17 Dec '03

>I'm of course just a layman, not a law professor or scholar. But I feel it >best that we not invoke a "right to privacy" to protect our crypto >abilities, when such a "right" apparently does not exist. > >However, certain things which _look_ like a "right to privacy" do exist: I agree with your analysis. It certainly matches what I was taught in law school. The rhetorical point I was making however is that a *practical* not constitutional right to privacy exists as long as your questioner eschews torture. I think it is useful to point out -- in response to government types who assert that "there's no absolute right to privacy" -- that they have actually set aside a zone of privacy by their rejection of torture as an interrogation technique. What this does is to remind listeners that coerced speech has an unsavory history and it turns the argument from one between absolute positions into one in which we are just arguing which sanctions should be applied when. DCF "Note that many governments have officially given up rape and torture as sanctions. (These were once universal.) All we have to do is get them to give up murder, imprisonment, and robbery as sanctions and we'll have civilized them completely."

3 2