- cypherpunks-legacy - lists.cpunks.org

Where to get PGP (correction on PGP 2.6ui)
by mpj＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- WHERE TO GET THE PRETTY GOOD PRIVACY PROGRAM (PGP) (Last modified: 2 June 1994 by Mike Johnson) WHAT IS THE LATEST VERSION? Platforms | Released | Version | Notes & restrictions | by and for | | Other restrictions may apply. - ----------------------------------------------------------------------------- Dos & Unix | MIT | 2.6 | Uses RSAREF. Not for use in any | for use in | | application that you get paid for. | North | | FREE. Complete source code available. | America | | Patents licensed for personal use only. | | | Not for export from the USA or Canada. | | | RSA key limited to 1024 bits (probably | | | strong enough for most things, but not | | | as strong as the IDEA session key). | | | Not fully compatible with PGP 2.3a or | | | Viacrypt PGP 2.4. - ----------------------------------------------------------------------------- Dos & Unix | mathew@ | 2.6ui | Does NOT use RSAREF. No RSA patent | mantis.co | | problems outside the USA. | .uk for use| | FREE. Complete source code available. | outside | | IDEA licensed for personal use only in | the USA | | countries where the IDEA patent holds. | | | RSADSI claims this product would | | | infringe on its patents if used in the | | | USA. Compatible with all current PGPs. | | | Contact mathew(a)mantis.co.uk if you have | | | contributions or suggestions for the | | | coming version 2.7ui, which will feature | | | a longer RSA key length limit. | | | If imported to the USA, don't export. - ----------------------------------------------------------------------------- DOS & Unix | Viacrypt | 2.4 | 100% Legal for both personal and | for use in | | commercial use. Not for export from | North | | the USA and Canada. It is commercial | America | | copyrighted software, prices below. | | | Source code not available. | | | Viacrypt will soon release version 2.7 | | | that will be compatible with MIT's 2.6 - ----------------------------------------------------------------------------- Amiga | | 2.3a2 | Use extremely limited by patents in USA. - ----------------------------------------------------------------------------- Macintosh | | 2.3aV1.1 | Use extremely limited by patents in USA. | | or | A pair of 2.6-compatible versions | | 2.3aV1.2 | (USA/Canada & Non-USA) still not ready. - ----------------------------------------------------------------------------- All others | Branko | 2.3a | Use extremely limited by patents in USA. | Lankaster | | Not fully compatible with version 2.6 | | | or greater. - ----------------------------------------------------------------------------- Note: there are other version numbers floating around on the net from code that has been altered by individuals for their own use. The versions listed above are the ones I trust. WHERE CAN I GET VIACRYPT PGP? If you are a commercial user of PGP in the USA or Canada, contact Viacrypt in Phoenix, Arizona, USA. The commecial version of PGP is fully licensed to use the patented RSA and IDEA encryption algorithms in commercial applications, and may be used in corporate environments in the USA and Canada. It is fully compatible with, functionally the same as, and just as strong as the freeware version of PGP. Due to limitations on ViaCrypt's RSA distribution license, ViaCrypt only distributes executable code and documentation for it, but they are working on making PGP available for a variety of platforms. Call or write to them for the latest information. The latest version number for their version of PGP is 2.4. Prices shown include release of version 2.7 if you buy your copy after May 27, 1994 (otherwise the upgrade will be about US$10). Viacrypt's licensing and price information is as follows: ViaCrypt PGP for MS-DOS 1 user $ 99.98 ViaCrypt PGP for MS-DOS 5 users $ 299.98 ViaCrypt PGP for MS-DOS 20 users or more, call ViaCrypt ViaCrypt PGP for UNIX 1 user $ 149.98 ViaCrypt PGP for UNIX 5 users $ 449.98 ViaCrypt PGP for UNIX 20 users or more, call ViaCrypt ViaCrypt PGP for WinCIM/CSNav 1 user $ 119.98 ViaCrypt PGP for WinCIM/CSNav 5 user $ 359.98 ViaCrypt PGP for WinCIM/CSNav 20 users or more, call ViaCrypt If you wish to place an order please call 800-536-2664 during the hours of 8:30am to 5:00pm MST, Monday - Friday. They accept VISA, MasterCard, AMEX and Discover credit cards. If you have further questions, please feel free to contact: Paul E. Uhlhorn Director of Marketing, ViaCrypt Products Mail: 2104 W. Peoria Ave Phoenix AZ 85029 Phone: (602) 944-0773 Fax: (602) 943-2601 Internet: viacrypt(a)acm.org Compuserve: 70304.41 WHERE CAN I GET THE PGP FROM MIT THAT USES RSAREF? MIT-PGP is for U. S. and Canadian use only, but MIT is only distributing it within the USA (due to some archaic export control laws). 1. Read ftp://net-dist.mit.edu/pub/PGP/mitlicen.txt and agree to it. 2. Read ftp://net-dist.mit.edu/pub/PGP/rsalicen.txt and agree to it. 3. Telnet to net-dist.mit.edu and log in as getpgp. 4. Answer the questions and write down the directory name listed. 5. QUICKLY end the telnet session with ^C and ftp to the indicated directory on net-dist.mit.edu (something like /pub/PGP/dist/U.S.-only-????) and get the distribution files (pgp26.zip, pgp26doc.zip, and pgp26src.tar.gz). If the hidden directory name is invalid, start over at step 3, above. You can also get PGP 2.6 from: ftp.csn.net/mpj ftp://ftp.csn.net/mpj/I_will_not_export/crypto_???????/pgp/pgp26.zip ftp://ftp.csn.net/mpj/I_will_not_export/crypto_???????/pgp/pgp26src.tar See ftp://ftp.csn.net/mpj/README.MPJ for the ??????? See ftp://ftp.csn.net/mpj/help for more help on negotiating this site's export control methods. ftp.netcom.com/pub/mpj ftp://ftp.netcom.com/mpj//I_will_not_export/crypto_???????/pgp/pgp26.zip ftp://ftp.netcom.com/mpj//I_will_not_export/crypto_???????/pgp/pgp26src.tar See ftp://ftp.netcom.com/pub/mpj/README.MPJ for the ??????? See ftp://ftp.netcom.com/pub/mpj/help for more help on negotiating this site's export control methods. TO GET THESE FILES BY EMAIL, send mail to ftp-request(a)netcom.com containing the word HELP in the body of the message for instructions. You will have to work quickly to get README.MPJ then the files before the ??????? part of the path name changes again (several times a day). ftp.eff.org Follow the instructions found in README.Dist that you get from one of: ftp://ftp.eff.org/pub/Net_info/Tools/Crypto/README.Dist gopher.eff.org, 1/Net_info/Tools/Crypto gopher://gopher.eff.org/11/Net_info/Tools/Crypto http://www.eff.org/pub/Net_info/Tools/Crypto/ Colorado Catacombs BBS Mike Johnson, sysop Mac and DOS versions of PGP, PGP shells, and some other crypto stuff. Also the home of some good Bible search files and some shareware written by Mike Johnson, including DLOCK, CRYPTA, CRYPTE, CRYPTMPJ, MCP, MDIR, DELETE, PROVERB, SPLIT, ONEPAD, etc. v.FAST/v.32bis/v.42bis, speeds up to 28,800 bps 8 data bits, 1 stop, no parity, as fast as your modem will go. Use ANSI terminal emulation, of if you can't, try VT-100. Free access to PGP. If busy or no answer, try again later. Log in with your own name, or if someone else already used that, try a variation on your name or pseudonym. You can request access to crypto software on line, and if you qualify legally under the ITAR, you can download on the first call. Download file names: pgp26.zip (DOS version with documentation) pgp26src.tar (Unix version and source code) pgp26doc.zip (Documentation only -- exportable) (303) 772-1062 Longmont, Colorado number - 2 lines. (303) 938-9654 Boulder, Colorado number forwarded to Longmont number intended for use by people in the Denver, Colorado area. Verified: This morning. Other BBS and ftp sites will no doubt pick this version up rapidly. WHERE TO GET THE FREEWARE PGP FOR USE OUTSIDE OF THE USA The freeware version of PGP is intended for noncommercial, experimental, and scholarly use. It is available on thousands of BBSes, commercial information services, and Internet anonymous-ftp archive sites on the planet called Earth. This list cannot be comprehensive, but it should give you plenty of pointers to places to find PGP. Although the latest freeware version of PGP was released from outside the USA (England), it is not supposed to be exported from the USA under a strange law called the International Traffic in Arms Regulations (ITAR). Because of this, please get PGP from a site outside the USA if you are outside of the USA and Canada. This data is subject to change without notice. If you find that PGP has been removed from any of these sites, please let me know so that I can update this list. Likewise, if you find PGP on a good site elsewhere (especially on any BBS that allows first time callers to access PGP for free), please let me know so that I can update this list. Source code (gzipped tar format): * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/pgp26ui-src.tar.gz * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/pgp26ui-src.tar.gz.sig * _IT:_ ftp://ftp.dsi.umimi.it/pub/security/crypt/pgp26ui-src.tar.gz * _IT:_ ftp://ftp.dsi.umimi.it/pub/security/crypt/pgp26ui-src.tar.gz.sig.gz Source code (zip format): * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/pgp26uis.sig * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/pgp26uis.zip * _IT:_ ftp://ftp.dsi.umimi.it/pub/security/crypt/pgp26uis.sig * _IT:_ ftp://ftp.dsi.umimi.it/pub/security/crypt/pgp26uis.zip Executable for DOS (zip format): * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/pgp26uix.sig * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/pgp26uix.zip * _IT:_ ftp://ftp.dsi.umimi.it/pub/security/crypt/pgp26uix.sig * _IT:_ ftp://ftp.dsi.umimi.it/pub/security/crypt/pgp26uix.zip Other sites (may or may not have the latest versions): ftp.informatik.uni-hamburg.de /pub/virus/crypto ftp.ee.und.ac.za /pub/crypto/pgp soda.berkeley.edu /pub/cypherpunks/pgp (DOS, MAC) Verified: 21-Dec-93 ftp.demon.co.uk /pub/amiga/pgp /pub/archimedes /pub/pgp /pub/mac/MacPGP ftp.informatik.tu-muenchen.de ftp.funet.fi ftp.dsi.unimi.it /pub/security ftp.tu-clausthal.de (139.174.2.10) wuarchive.wustl.edu /pub/aminet/util/crypt src.doc.ic.ac.uk (Amiga) /aminet /amiga-boing ftp.informatik.tu-muenchen.de /pub/comp/os/os2/crypt/pgp23os2A.zip (OS/2) black.ox.ac.uk (129.67.1.165) /src/security/pgp23A.zip (MS-DOS executables & docs) /src/security/pgp23srcA.zip (Unix, MS-DOS, VMS, Amiga sources, docs, info on building PGP into mailers, editors, etc.) /src/security/pgp23A.tar.Z (Same as PGP22SRC.ZIP, in Unix tar format) /src/security/macpgp2.3.cpt.hqx (Macintosh version) iswuarchive.wustl.edu pub/aminet/util/crypt (Amiga) ftp.csn.net /mpj/public/pgp/ contains PGP shells, faq documentation, language kits. ftp.netcom.com /pub/dcosenza -- PGP 2.3a and an unofficial version that allows longer RSA keys. /pub/gbe/pgpfaq.asc -- frequently asked questions answered. /pub/qwerty -- How to MacPGP Guide, largest steganography ftp site as well. PGP FAQ, crypto FAQ, US Crypto Policy FAQ, Steganograpy software list. MacUtilites for use with MacPGP. Stealth1.1 + other steganography programs. Send mail to qwerty(a)netcom.com with the subject "Bomb me!" to get the PGP FAQ and MacPGP guide if you don't have ftp access. nic.funet.fi (128.214.6.100) /pub/crypt/pgp23A.zip /pub/crypt/pgp23srcA.zip /pub/crypt/pgp23A.tar.Z van-bc.wimsey.bc.ca (192.48.234.1) /m/ftp2/crypto/RSA/PGP/2.3a/pgp23A.zip /m/ftp2/crypto/RSA/PGP/2.3a/pgp23srcA.zip ftp.uni-kl.de (131.246.9.95) qiclab.scn.rain.com (147.28.0.97) pc.usl.edu (130.70.40.3) leif.thep.lu.se (130.235.92.55) goya.dit.upm.es (138.4.2.2) tupac-amaru.informatik.rwth-aachen.de (137.226.112.31) ftp.etsu.edu (192.43.199.20) princeton.edu (128.112.228.1) pencil.cs.missouri.edu (128.206.100.207) StealthPGP: The Amiga version can be FTP'ed from the Aminet in /pub/aminet/util/crypt/ as StealthPGP1_0.lha. Also, try an archie search for PGP using the command: archie -s pgp23 (DOS Versions) archie -s pgp2.3 (MAC Versions) ftpmail: For those individuals who do not have access to FTP, but do have access to e-mail, you can get FTP files mailed to you. For information on this service, send a message saying "Help" to ftpmail(a)decwrl.dec.com. You will be sent an instruction sheet on how to use the ftpmail service. Another e-mail service is from nic.funet.fi. Send the following mail message to mailserv(a)nic.funet.fi: ENCODER uuencode SEND pub/crypt/pgp23srcA.zip SEND pub/crypt/pgp23A.zip This will deposit the two zipfiles, as 15 batched messages, in your mailbox with about 24 hours. Save and uudecode. For the ftp sites on netcom, send mail to ftp-request(a)netcom.com containing the word HELP in the body of the message. World Wide Web URLs: (Thanks to mathew(a)mantis.co.uk) UNIX PGP 2.3a Compiles best with GCC 2.4.x or higher. A straight port from DOS, so hardened UNIX users find it a bit chatty. * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/pgp23A.tar.Z * _UK:_ ftp://black.ox.ac.uk/src/security/pgp23A.tar.Z * _NL:_ ftp://svin02.info.win.tue.nl/pub/misc/pgp23A.tar.gz * _SE:_ ftp://ftp.sunet.se/pub/security/tools/crypt/pgp23A.tar.gz * _SE:_ ftp://isy.liu.se/pub/misc/pgp/2.3A/pgp23A.tar.Z * _IT:_ ftp://ftp.dsi.unimi.it/pub/security/crypt/pgp23A.tar.Z * _FI:_ ftp://ftp.funet.fi/pub/crypt/pgp23A.tar.Z * _FI:_ ftp://ftp.funet.fi/pub/crypt/ghost.dsi.unimi.it/pgp23A.tar.Z _________________________________________________________________ MS-DOS PGP 2.3 Program * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/pgp23A.zip * _UK:_ ftp://black.ox.ac.uk/src/security/pgp23A.zip * _SE:_ ftp://isy.liu.se/pub/misc/pgp/2.3A/pgp23A.zip * _IT:_ ftp://ftp.dsi.unimi.it/pub/security/crypt/pgp23A.zip * _FI:_ ftp://ftp.funet.fi/pub/crypt/pgp23A.zip * _IT:_ ftp://ftp.funet.fi/pub/crypt/ghost.dsi.unimi.it/pgp23A.zip Source code Designed to compile with Turbo C; compiles fine with Microsoft Visual C++ also. * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/pgp23srcA.zip * _UK:_ ftp://black.ox.ac.uk/src/security/pgp23srcA.zip * _SE:_ ftp://isy.liu.se/pub/misc/pgp/2.3A/pgp23srcA.zip * _IT:_ ftp://ftp.dsi.unimi.it/pub/security/crypt/pgp23srcA.zip * _FI:_ ftp://ftp.funet.fi/pub/crypt/pgp23srcA.zip * _FI:_ ftp://ftp.funet.fi/pub/crypt/ghost.dsi.unimi.it/pgp23srcA.zip _________________________________________________________________ MACPGP 2.3 A slightly souped-up port of PGP to the Mac. Has help menus and other goodies, but is still not a real Mac application. However, it works. Note that the version 2.3 release of MacPGP contains the major bug-fix which was later added to UNIX/DOS PGP 2.3. There was therefore no need for a MacPGP 2.3A release; version 2.3 already had the bug fix by the time it was released. There is no MacPGP 2.3A. Program * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/MacPGP/MacPGP2.3.cpt.hqx * _UK:_ ftp://black.ox.ac.uk/src/security/macpgp2.3.cpt.hqx * _SE:_ ftp://isy.liu.se/pub/misc/pgp/2.3A/macpgp2.3.cpt.hqx * _IT:_ ftp://ftp.dsi.unimi.it/pub/security/crypt/macpgp2.3.cpt.hqx * _FI:_ ftp://ftp.funet.fi/pub/crypt/ghost.dsi.unimi.it/macpgp2.3.cpt.hqx * _US:_ ftp://soda.berkeley.edu/pub/cypherpunks/pgp/macpgp2.3.cpt.hqx.gz Source code Requires Think C. * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/MacPGP/MacPGP2.2src.sea.hqx -- version 2.2 only * _IT:_ ftp://ftp.dsi.umimi.it/pub/security/crypt/macpgp2.3src.sea.hqx.pgp * _FI:_ ftp://ftp.funet.fi/pub/crypt/ghost.dsi.unimi.it/macpgp2.3src.sea.h qx.pgp Documentation PGP is rather counter-intuitive to a Mac user. Luckily, there's a guide to using MacPGP in ftp://ftp.netcom.com/pub/qwerty/Here.is.How.to.MacPGP. _________________________________________________________________ OS/2 PGP You can, of course, run the DOS version of PGP under OS/2. Program * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/pgp22os2.zip -- version 2.2 only, native binaries * _DE:_ ftp://ftp.informatik.tu-muenchen.de/pub/comp/os/os2/crypt/pgp23os2 A.zip Source code * _DE:_ ftp://ftp.informatik.tu-muenchen.de/pub/comp/os/os2/crypt/pgp23src A.zip _________________________________________________________________ AMIGA PGP * _UK:_ ftp://ftp.demon.co.uk/pub/amiga/pgp/pgp21ami.lha -- version 2.1 only * _DE:_ ftp://faui43.informatik.uni-erlangen.de/mounts/rzsuna/pub/aminet/u til/crypt/pgp21ami.lha -- version 2.1 only * _DE:_ ftp://ftp.uni-kl.de/pub/aminet/util/crypt/PGPAmi23a_2.lha * _US:_ ftp://ftp.wustl.edu/pub/aminet/util/crypt/PGPAmi23a_2.lha Source * _DE:_ ftp://ftp.uni-kl.de/pub/aminet/util/crypt/PGPAmi23a2_src.lha * _US:_ ftp://ftp.wustl.edu/pub/aminet/util/crypt/PGPAmi23a2_src.lha _________________________________________________________________ ARCHIMEDES PGP * _UK:_ ftp://ftp.demon.co.uk/pub/archimedes/ArcPGP23a _________________________________________________________________ DOCUMENTATION ONLY * _US:_ ftp://net-dist.mit.edu/pub/PGP/pgp26doc.zip * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/pgp26doc.zip * _US:_ ftp://ftp.netcom.com/pub/mpj/public/pgp/pgp26doc.zip * _US:_ ftp://ftp.ftp.csn.net/mpj/public/pgp/pgp26doc.zip * _US:_ ftp://soda.berkeley.edu/pub/cypherpunks/pgp/pgp23docA.zip _________________________________________________________________ LANGUAGE MODULES These are suitable for most PGP versions. I am not aware of any export/import restrictions on these files. German * _UK:_ ftp://black.ox.ac.uk/src/security/pgp_german.txt * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp_german.txt * _US:_ ftp://ftp.csn.net/mpj/public/pgp/PGP_german_docs.lha Italian * _IT:_ ftp://ftp.dsi.umimi.it/pub/security/crypt/pgp-lang.italian.tar.gz * _FI:_ ftp://ftp.funet.fi/pub/crypt/ghost.dsi.unimi.it/pgp-lang.italian.tar.gz * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp-lang.italian.tar.gz Japanese * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp-msgs-japanese.tar.gz Lithuanian * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp23ltk.zip Russian * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp26ru.zip Spanish * _IT:_ ftp://ftp.dsi.umimi.it/pub/security/crypt/pgp-lang.spanish.tar.gz * _FI:_ ftp://ftp.funet.fi/pub/crypt/ghost.dsi.unimi.it/pgp-lang.spanish.tar.gz * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp-lang.spanish.tar.gz Swedish * _UK:_ ftp://black.ox.ac.uk/src/security/pgp_swedish.txt * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp_swedish.txt _________________________________________________________________ OTHER SITES Some cryptographic software is available from ftp://van-bc.wimsey.bc.ca/pub/crypto/software/. Read the README file and proceed from there. BBS sites: Colorado Catacombs BBS (See also the entry above for PGP 2.6) (303) 772-1062 Longmont, Colorado (2 lines) (303) 938-9654 Boulder, Colorado (free call from Denver CO, but 1 line) Verified: This morning. Hieroglyphics Voodoo Machine (Colorado) DOS, OS2, and Mac versions. (303) 443-2457 Verified: 5-2-94 For free access for PGP, DLOCK, Secure Drive, etc., log in as "VOO DOO" with the password "NEW" (good for 30 minutes access to free files). Exec-Net (New York) Host BBS for the ILink net. (914) 667-4567 The Ferret BBS (North Little Rock, Arkansas) (501) 791-0124 also (501) 791-0125 Special PGP users account: login name: PGP USER password: PGP This information from: Jim Wenzel <jim.wenzel(a)grapevine.lrk.ar.us> PGP 2.3A has been posted to the FidoNet Software Distribution Network and should on most if not all Canadian and U.S. nodes carrying SDN software. It has also been posted on almost all of the major private North American BBS systems, thence to countless smaller boards. Consult a list of your local BBSes; most with a sizeable file inventory should carry the program. If you find a version of the PGP package on a BBS or FTP site and it does not include the PGP User's Guide, something is wrong. The manual should always be included in the package. If it isn't, the package is suspect and should not be used or distributed. The site you found it on should remove it so that it does no further harm to others. ARCHIE WHO? There are many more sites. You can use archie and/or other "net-surfing" tools to find a more up-to-date listing, if desired. - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.4 mQCNAi0aFSUAAAEEAOCOKpaLepvJCFgIR4m+UvZe0IN8g7Guwc+6GH4u6UGTPxQO iAhk/MJ7E8LE4c55A1G8to2W4y3aKAHvi9QCYKnsLV8Ag0BYWo3bGGTPEfkS7NAI N+Zy6vSjuF1D6MUnbvrQJ5p4efz7a28iYRKoAdan2bfnvIYWUD9nBjyFM+vFAAUR tDdNaWNoYWVsIFBhdWwgSm9obnNvbiA8bXBqQGNzbi5vcmc+IG1wajQgW2V4cCAz MSBEZWMgOTRdiQCVAgUQLTqfXj9nBjyFM+vFAQGU7wP/ZuuHfdAnCIblNCtbLLG8 39CSg6JIVa3KWfe0WIz6dXFU3cvl2Wt094kJgZ+Nmq01INWlib2lTOznbkA9sV1W q0aJSBHFWQH29qGmIdEqThs7A5ES2w8eRjJD80lxHodRIkBcC5KI6x4Mxo8cib5V BrwsvtG0+81HD6Mrpvc+a0GJAJUCBRAtJc2rZXmEuMepZt0BAe4hA/9YANYPY4Z3 1pXv2mT6ReC09cZS5U3+xxC5brQdLsQGKuH6QVs/b5oc6NV84sh8A9tZyHG2067o 3XIEyN7PPQzRm2UUnHHqw9lBCNhMiFQsAJi4W+m8zXrVrpJWK0Wv61eV2/XIQl0V d4lxu0r+MNRP6ID6FBzA4C9rO+RYEZmwOIkAlQIFEC0aGRzb/VZRBVJGuQEBfaUD /3c2h//kg843OIcYHG4gMDqdeeZLzGlp3RVvh0Rs3/T0YylJZGjPL2L/BF/vfLlB 9E2Urh9mDG/7hiB5FncrUnkmN63IkSj+K9YyfPyYxBVx06Srj8ZzYynh0N+zledd 6cnwxRXhaD3Wc4EfSNR7BH9M2rjkGzyb5to9cgBb0ng+ =BLg5 - -----END PGP PUBLIC KEY BLOCK----- I didn't have to generate a new key to use version 2.6, but I think keys should be changed periodically anyway to limit damages just in case a key got compromised and I didn't know about it. - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCNAi3s6gIAAAEEALCnDYox7v0T3EDm7LlL6w/tlU6wm51QEZd/anrRHLkRaYi2 NtoNa7AcEGlArVlV0wSWvKU/IoLQOTU3mvl4SD3wVRI1aZ3NMFSkm+VntQeDBULO mKqupduhXivNwwST8wzBvKvmtryGWaHClSoFLDNxpyr/tyw6JaAvIUiYSSpBAAUR tCdNaWNoYWVsIFBhdWwgSm9obnNvbiA8bXBqQGNzbi5vcmc+IG1wajeJAJUCBRAt 7O1fP2cGPIUz68UBAYKZBAC19BqRfVQpasOPKn32d31Ez9dQZKzw8svLUhPRVX5t nWtYPbH+PyBt/b8A1keQtcY5Y6fYOtZgU5qUhDaHavwQAdp3xzOckm7H3W2L5goI P7vf39wDtpw07x6+lknnwcQcfYYuuoiY1R8rSIE3gOLVtySDCu2KihcPRMp77FF5 +IkAlQIFEC3s7SSgLyFImEkqQQEBqkED/iBV2jbAdFIcEFSZhWHf3aZCJsQBKmv+ V0yuXWrw0gq5v35ZJbLeB7h/W3EqfKvLdGzLgpM0fi6EOgel2ilTOmkdICmCLERc t/xXkSwIsYtlOjkjSkGeASSphdwDRJw+j+1e/PBeZz7XwAfKZcKwqlbFSAmc2DAk 9wPp29+MqvqltCtEb24ndCB1c2UgZm9yIGVuY3J5cHRpb24gYWZ0ZXIgMSBKdW5l IDE5OTYutC1NaWNoYWVsIFBhdWwgSm9obnNvbiA8bXBqb2huc29Abnl4LmNzLmR1 LmVkdT60K01pY2hhZWwgUGF1bCBKb2huc29uIDxtLnAuam9obnNvbkBpZWVlLm9y Zz60ME1pY2hhZWwgUGF1bCBKb2huc29uIDw3MTMzMS4yMzMyQGNvbXB1c2VydmUu Y29tPrQdTWlrZSBKb2huc29uIDxtcGpAbmV0Y29tLmNvbT4= =Lf60 - -----END PGP PUBLIC KEY BLOCK----- ___________________________________________________________ |\ /| | | | | \/ |o| | Michael Paul Johnson Colorado Catacombs BBS 303-772-1062 | | | | / _ | mpj(a)csn.org aka mpj(a)netcom.com m.p.johnson(a)ieee.org | | |||/ /_\ | ftp://ftp.csn.net/mpj/README.MPJ --... ...-- -.. .| | |||\ ( | ftp://ftp.netcom.com/pub/mpj/README.MPJ -. --- ----- ....| | ||| \ \_/ |___________________________________________________________| -----BEGIN PGP SIGNATURE----- Version: 2.4 iQCVAgUBLe47Jz9nBjyFM+vFAQFP9wQA322KC92MHLdGH1ma9kdnrZ9ExSNp5heM di67wZgAGBmxJxlKhCgD0jWWvH5PLkhxVdi/F9k9NaJm3zcARZ9Elc0vCToADORq TuohOYPv2bAQO0zcwuOyZLKCRhaXCOHFu8rF74luYJnUblNDl//YFIZyo1L15j52 lHb5i/yd6Ig= =ZffA -----END PGP SIGNATURE-----

1 0

Clipper on Gene Burns?
by Duncan Frissell 17 Dec '03

17 Dec '03

Someone told me that Gen Burns, the libertarian syndicated talk show host, was supposed to focus on Clipper a few days ago but was missing a guest so he may do it at some time in the very near future. Perhaps today. Those interested should listen in. He does one topic per three-hour show so it could be good. DCF

1 0

Who was...
by cknight＠crl.com 17 Dec '03

17 Dec '03

Who was the CP on Live 105 Wednesday morning who kept interrupting Alex? -ck

2 1

Re: News Flash: Clipper Bug?
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

>> One thing this shows, even if the application of the technique turns out >> to be too difficult to be practical, is that Dorothy Denning's evaluation >> of the design was worthless. That team should have found this themselves. >> No wonder she was trying to play it down in the NYT. > >It was my understanding that Denning was just looking at the Skipjack >algorithm, and not the clipper unit as a whole. I wouldn't be too quick >to condemn her on this point. Of course, Dorothy Denning could simply say, "Gosh, the Blaze result shows how to make Clipper _more_ secure for the average user. Now they don't have to worry about the government. I stand by my assessment that it is secure."

1 0

Re: HACK - U HAVE NO PRIVACY
by Vinod Valloppillil 17 Dec '03

17 Dec '03

> One question: What's MJ12? British Intelligence was still MI5, >right? >-- >Michael Brandt Handler <grendel(a)netaxs.com> >Philadelphia, PA, USA PGP v2.6 public key via server / finger / mail >"I am iron, I am steel, nobody can touch me when I'm on the wheel" -- Curve MJ12 is (supposedly) the ultra-secret high-level national security group for the free world in charge of advanced military projects and most importantly -- UFO phenomena. In UFO conspiracy circles this group has supposedly sold the American public to alien abductors in exchange for technology, science, etc. No list of good conspirators is complete without it ! :) These opinions are mine, not Microsoft's. Vinod Valloppillil

1 0

Anonymous mail pool
by Matthew Ghio 17 Dec '03

17 Dec '03

russ <nelson(a)crynwr.com> wrote: >Now that's an interesting idea for contacting people anonymously. >Have a big mailing list where you know certain people are subscribed. >Everyone gets all the mail, but they put a filter on it so that only >mail directed to their anonym is delivered to them. Or, if they're >really paranoid, they filter them by eye. > >But it's so obvious that someone probably already thought of it... Yes, I think you can subscribe to a mailing list for that purpose by sending mail to pool0-request(a)extropia.wimsey.com (Please correct me if that address is wrong.)

1 0

Re: Faster way to deescrow Clipper
by Matthew Ghio 17 Dec '03

17 Dec '03

russ <nelson(a)crynwr.com> wrote: > From: Derek Atkins <warlord(a)MIT.EDU> > > ...not be able to decrypt the communications, but they still get your ID. > >"your ID"? You mean your phone's ID. Goodness gracious, if you were >a criminal, you wouldn't go out and steal someone else's Clipper >phone, would you? Let's not get too high tech here, just because we >have the ability. Or you could just steal someone else's LEAF, by keeping a copy of it, and use that for spoofing. Then you could have a valid IV too...

1 0

NYT article
by Ezekial Palmer 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- This is essentially the same as what David posted, but it's directly from the New York Times and it includes a few bits that were edited out of the San Jose version. I'd already typed this in when David's version showed up here, so I decided to compare the two -- which helped me to find some typos (in both versions :-) and to see the odd collection of minor stylistic differences between the two papers. Zeke ============================================================================== The New York Times Vol. CXLIII Copyright (c) 1994 The New York Times Thursday, June 2, 1994 FLAW DISCOVERED IN FEDERAL PLAN FOR WIRETAPPING ---------------- CLIPPER CHIP IS AT ISSUE ---------------- Scientist at Bell Laboratories Says Criminals Can Close an Electronic Backdoor ---------------- By JOHN MARKOFF A computer scientist at AT&T Bell Laboratories has discovered a basic flaw in the technology that the Clinton Administration has been promoting as a way to allow law enforcement officials to eavesdrop on electronically scrambled telephone and computer conversations. Someone with sufficient computer skills can defeat the Government's technology by using it to encode messages so that not even the Government can crack them, according to the Bell Labs researcher, Matthew Blaze. For more than a year, the Clinton Administration has been advocating the encoding technology as the best way to insure the privacy of telephone and computer conversations while retaining the traditional right of law-enforcement officials to use court-authorized wiretaps to eavesdrop on the conversations of suspected criminals or terrorists. The technology, based on what is known as the Clipper chip, has been widely criticized by communications executives and privacy-rights advocates, who fear its Big Brother potential. The industry also fears foreign customers might shun equipment if Washington keeps a set of electronic keys. But now Dr. Blaze, as a result of his independent testing of Clipper, is putting forth perhaps the most compelling criticism yet: the technology simply does not work as advertised. Dr. Blaze detailed his findings in a draft report that he has been quietly circulating among computer researchers and Federal agencies in recent weeks and which he made available on Tuesday to the New York Times. ``The Government is fighting an uphill battle,'' said Martin Hellman, a Stanford University computer scientist who has read Dr. Blaze's paper and who is himself an expert in data encryption, as the field is known. ``People who want to work around Clipper will be able to do it.'' But the National Security Agency, the Government's electronic spying agency, which played a lead role in developing the technology, said yesterday that Clipper remained useful, despite the flaw uncovered by Dr. Blaze. Agency officials do not dispute the flaw's existence. ``Anyone interested in circumventing law-enforcement access would most likely choose simpler alternatives,'' Michael A. Smith, the agency's director of policy, said in a written statement in response to a reporter's questions. ``More difficult and time-consuming efforts, like those discussed in the Blaze paper are very unlikely to be employed.'' Since announcing the Clipper coding technology 13 months ago, White House and Justice Department officials have argued forcefully that it is a necessary information-age compromise between the constitutional right to privacy and the traditional powers of law enforcement officials. The Clinton Administration intends to use Clipper, which is [sic] is trying to promote as an industry standard, for the Government's sensitive nonmilitary communications. The Federal Government is the nation's largest purchaser of information technology. But industry executives have resisted adopting Clipper as a standard for several reasons. Because the underlying mathematics of the technology remain a classified Government secret, industry officials say there is no way to be certain that it is as secure as encoding techniques already on the market. They also fear that Clipper's electronic ``backdoor,'' which is designed for legal wiretapping of communications, could make it subject to abuse by the Government or unscrupulous civilian computer experts, who might eavesdrop without first obtaining a court order and the electronic ``keys'' that are to be held in escrow by two Government agencies. Privacy-rights advocates have cited similar concerns. Industry executives have also worried that making Clipper a Federal Government standard would be a first step toward prescribing the technology for private industry or requiring that it be included in sophisticated computing and communications devices that are to be exported. Dr. Blaze said that the flaw he discovered in the Clipper design would not permit a third party to break a coded computer conversation. But it would enable two people to have a secret conversation that law enforcement officials could not unscramble. And that could render Clipper no more useful to the Government than encryption technology already on the market to which it does not hold the mathematical keys. Circumventing Surveillance ``Nothing I've found affects the security of the Clipper system from the point of view of people who might want to break the system,'' Dr. Blaze said in a telephone interview yesterday. ``This does quite the opposite. Somebody can use it to circumvent the law-enforcement surveillance mechanism.'' Dr. Blaze said that several simple changes to the Clipper design could correct the flaw, but that they might be difficult to adopt because they would require the Government to start over in designing the Clipper. The Government has already begun ordering telephones containing the Clipper chip for use by Federal agencies, and it is designing another Clipper-based device, called the Tessera card, for use in personal computers. Dr. Hellman at Stanford said that the Government was counting on most crooks and terrorists not to go to the trouble of modifying the Clipper design or otherwise seeking to disable it -- if they used it at all. Oliver North Cited He cited the example of the Reagan Administration aide Oliver North, who he said was both intelligent and security conscious; yet he ignored the existence of computer back-up tapes of his electronic mail messages, which were later obtained by Federal investigators in the Iran-Contra inquiry. One computer scientist who has been a proponent of the Clipper plan and who is familiar with Dr. Blaze's paper said that the flaw would not immediately subvert the system. ``I don't think this undermines the Clipper,'' Dorothy Denning, a computer scientist at Georgetown University and part of a team chosen by the Government to evaluate the technology, said. ``But it's good to know what the vulnerabilities are.'' Clipper was designed by researchers at the National Security Agency in cooperation with computer scientists at the National Institute of Standards and Technology, a civilian agency that is responsible for setting computer standards for nonmilitary Government applications. The Clipper chip is known as an ``escrowed encryption system.'' It is designed so that law enforcement officials wishing to eavesdrop on Clipper-encoded communications must present a court warrant and a special number -- or key -- generated by a Clipper chip to two separate Government escrow agencies. Each of the agencies would hold portions of a special number, which can be used together to decode the conversation. The flaw found by Dr. Blaze exploits the technology feature of the Clipper system that creates the number key that can later be used by law enforcement officials to generate the second key number. The first number is known as the Law Enforcement Access Field, or LEAF. The LEAF elements includes a unique number known as the encrypted session key and a separate number -- called a checksum -- that mathematically verifies that the session key is valid for Clipper. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLe4igxVg/9j67wWxAQGV3AP7BYrXK/G1YKwwCwzgjSsMDXaDiG6s8oY9 jCKKOGNKNX5X5EhpuzrdNDOEEjGTEvQEONZR9scc77Fx1ZSaR629QlykRIzAY3WA hd1mbgYcfwznY/oAPgoLkTWamMSpuyYK1fIPU/RMVh4RQypfcbUzcZDf42Ho25tI WL1l1isAFio= =aID9 -----END PGP SIGNATURE-----

2 1

Clipper infringes patents
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

ddt(a)lsd.com (Dave Del Torto) > >ENCRYPTION: The Clinton administration's encryption > > plans are having licensing troubles: The US Commerce > > Department's NIST is having licensing discussions > > with inventors over its Digital Signature Standard, > > and an MIT scientist claims that the Clipper chip > > infringes on his patents. <WSJ 5/31 p.B6> > > Can someone please post the id of this "MIT Scientist?" Micali. He claims Clipper (and escrowed systems in general) violate his 2 year old "fair" crypto patent. -------------------------------------------------------------------------- Rishab Aiyer Ghosh rishab(a)dxm.ernet.in Voicemail +91 11 3760335; Vox/Fax/Data 6853410 H-34C Saket New Delhi 110017 INDIA The National Fairness to Game Animals Association says: Support your right to arm bears! --------------------------------------------------------------------------

1 0

Multiple encryption
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

perry(a)imsi.com: > Jay Prime Positive says: > > If you suspect that some of the non DOD/NSA cyphers might be broken, > > but you are not ready to employ one-time-pads, then you should > > threshold you mesages into N parts so that all N are needed to recover > > the original. Then encrypt each part under a different cypher. > > Its far simpler to encrypt your message with multiple systems, one > after another, than to break it up in the manner you suggest, and the > security is in fact better that way than in the manner you suggest. > It's not a good idea to encrypt binaries unless you know what they are. It's not a good idea to apply one encryption system over another unless you're sure of what you're doing, and know the effect of the two interacting. -------------------------------------------------------------------------- Rishab Aiyer Ghosh rishab(a)dxm.ernet.in Voicemail +91 11 3760335; Vox/Fax/Data 6853410 H-34C Saket New Delhi 110017 INDIA The National Fairness to Game Animals Association says: Support your right to arm bears! --------------------------------------------------------------------------

1 0