January 1993 - cypherpunks-legacy@lists.ogf.org

RSAREF now available via anonymous FTP (fwd))
by yanek＠novavax.nova.edu 06 Jan '93

06 Jan '93

In case someone's interested: Forwarded message: > Date: Tue, 5 Jan 93 17:15:58 PST > Message-Id: <9301060115.AA18302(a)RSA.COM> > To: rsaref-users(a)RSA.COM > From: burt(a)RSA.COM > Subject: RSAREF now available via anonymous FTP > Sender: rsaref-users-request(a)RSA.COM > > Dear RSAREF user -- > > RSAREF is now available via anonymous FTP to 'rsa.com'. Along with > RSAREF you can get RIPEM, Mark Riordan's RSAREF-based privacy-enhanced > mail application, and an Emacs command interface to RIPEM. See the > file 'README' in the FTP directory 'rsaref' for more information. > > -- Burt Kaliski > RSA Laboratories > -- Yanek Martinson mthvax.cs.miami.edu!safe0!yanek uunet!medexam!yanek this address preferred -->> yanek(a)novavax.nova.edu <<-- this address preferred Phone (305) 765-6300 daytime FAX: (305) 765-6708 1321 N 65 Way/Hollywood (305) 963-1931 evenings (305) 981-9812 Florida, 33024-5819

1 0

Re: purloined letter -- mimic functions
by wcs＠anchor.ho.att.com 05 Jan '93

05 Jan '93

Peter Wayner sent along the following note about mimic functions: ------- cut here ------ Original-From: wayner(a)cs.cornell.edu (Peter Wayner) Cool. I'm not a member of the mailing list. You can tell them if they want a copy of the code they should send me a note. They can get it in either C or Pascal. The C comes with tar wrapping paper for the faux industrial tech look. (I can't wait until Crate and Barrel start mining the Civil Defencse era for new retro-trendy styles. ) -Peter ------ cut here ------- At the risk of sounding like Peter G Neumann, I should comment that the combination of mimic functions and Mime mail could lead to lots of silliness and hand-waving .... Bill

1 0

Re: Anonymous thanks ;-)
by Mark Turner 05 Jan '93

05 Jan '93

-----BEGIN PGP SIGNED MESSAGE----- On Tue, 05 Jan 93 11:00:49 BST, "Russell E. Whitaker" <whitaker(a)eternity.demon.co.uk> wrote: > In the meantime, Mark Turner (mt(a)kram.org) is hard at work 1.) > porting PGP to 386BSD and 2.) developing a telnettable PGP Key > Server. Details as they happen. I was beaten too it with the port by Graham Toal (gtoal(a)gtoal.com) and Adrian Hall (adrian(a)rachel.ibmpcug.co.uk) It's available for anon ftp from rachel.ibmpcug.co.uk:/usr/local/src/pgp. Regards, Mark. p.s. I'll announce the PGP server here once it's fully operational. It will also have a mail server. -----BEGIN PGP SIGNATURE----- Version: 2.1 iQCVAgUBK0n6NUER4WTv6d3nAQHorAP/ekT7fQYOSBBuS3vcBXJ7FG7RtwoID8QP NxspuGGrXcFSkKR4pCIzAArhWpxN3/gIqELiMQuEF2oGkzVomZBxmnyXvQxOjTtl e1x42EISp06qgMplwx4xu1FyPtF00BYI+WLlzeELvJ4DEvej8A5o+WVqQyjn8Ah7 /fAWIx4JSaE= =/ja0 -----END PGP SIGNATURE----- -- /\/\ark Turner Demon Systems / Demon Internet Office: mark(a)demon.co.uk (+44 81 349 0063) 42 Hendon Lane, London Home: mt(a)kram.org (+44 831 823 212) N3 1TT, England ------------------ PGP version 2.1 Public Key available ------------------- *** IP level dial-up connectivity to the Internet for a tenner a month! ***

1 0

Anonymous thanks ;-)
by whitaker＠eternity.demon.co.uk 05 Jan '93

05 Jan '93

-----BEGIN PGP SIGNED MESSAGE----- Some kind U.S. cypherpunk sent me a copy of his public keyring last week. Unfortunately - mea culpa! - after having integrated his keyring, I deleted his original message from my mailbase, and thus lost his contact info. I wish to thank this person for sending the keyring, whoever you are... my memory is faulty: so much email to catch up on! In the meantime, Mark Turner (mt(a)kram.org) is hard at work 1.) porting PGP to 386BSD and 2.) developing a telnettable PGP Key Server. Details as they happen. -----BEGIN PGP SIGNATURE----- Version: 2.1 iQCVAgUBK0lqRITj7/vxxWtPAQGKeQQAo45IcgvBRON49bxyRtPSyHEpi4InsXQA oNxAE+iN+mGTRYRov8a9twgPXp+i7YHv+Xx+A8+c0ZilJV/954uPFy22xAqxl+4P kpUaITTt+oo/3no7g2cBPC2JhOZS7QTkokBvILhoofjNzRZJ+qTUScpyZ4QVlRvP smkZ8WWQg6o= =uvOA -----END PGP SIGNATURE----- Russell Earl Whitaker whitaker(a)eternity.demon.co.uk Communications Editor 71750.2413(a)compuserve.com EXTROPY: The Journal of Transhumanist Thought AMiX: RWHITAKER Board member, Extropy Institute (ExI) ================ PGP 2.0 public key available =======================

1 0

MEETING: Cypherpunks UK (2nd; last announcement)
by whitaker＠eternity.demon.co.uk 05 Jan '93

05 Jan '93

-----BEGIN PGP SIGNED MESSAGE----- 2nd Meeting, Cypherpunks UK - --------------------------- Chris Tame, of FOREST and the Libertarian Alliance, has generously offered the use of the meeting room at his offices for our gathering, Sunday, 10 January 1993, from 1300 onwards, at: FOREST 4th Floor 2 Grosvenor Gardens London SW1W 0DH 071-823-6550 This is just around the corner from Victoria Station, at the end of the mansion block near Hobart Place. There's a dark green cabbie shelter across the street from the entrance, and some British Telecom payphones. Can't miss it, really. However, if you have trouble, call the telephone number above, or call my pager, on 081-812-2661. If it helps, we're in the direction of Buckingham Palace, which is (very) partially visible from our windows. If you wish to attend, you should bring a 3.5" DOS-formatted diskette (sorry! My UN*X machine is an Intergraph workstation, and I can't use it for crypto) with a copy of your PGP 2.0+ public key. I'll sign it there. Mac users: if you don't have Apple File Exchange (what!?), I'll be extra nice and take your keys anyway ( ;-)) for AFE conversion on my IIcx. Not to fear. It might not be a bad idea to copy your public key on each of several diskettes, so you've got a copy to distribute to each of the others. Don't trust me to copy *your* key to others! As a matter of fact, as there are plenty of power points in the meeting room, you should bring your laptop, and/or a desktop PC: when someone hands you a disk-with-key, you can sign her key, and hand her back her diskette, with your own pubkey added. [Note to the novice: don't hand another person your secret key... the one named secring.pgp. Read the documentation.] This should be a lively meeting. Among the topics likely to be discussed are: o The proliferation of public key cryptography in the U.K. o The local development of anonymous remailers and a proposed automated public key repository at Demon Internet Systems o Electronic networking/email security for the novice o Pro-active proliferation of PGP 2.1+ to interesting European, African, and Asian sites - ftp placement - BBS distribution - sneakernet across borders o The use of HPACK in securing local file installations .. and much more! Mark Turner, from Demon Internet Systems, is likely to be on hand to demo DIS for non-DIS users. We've set up our own local, high-quality newsgroups: demon.security demon.security.keys and established the /pub/pgp and /pub/ibmpc/pgp archives on gate.demon.co.uk (expanding recently to include all versions of PGP, and interesting related files). Hope to see you there! Semper vigilans, -----BEGIN PGP SIGNATURE----- Version: 2.1 iQCVAgUBK0lmwYTj7/vxxWtPAQFtVQQAna8vfz6LqC5J5fhlgE1FB+m4GpkvU4o9 HrpFd5NKTc+JrKZEuv/sEDbJvXScc5N38n9KCyIEKdPEUxsjSA58CffcLLEW4xnb w3zAIMyr3wdsD0sxw0gqSi3sx6MbGP5fXwbUb+LyNJzCvpzt3MLYA5tYWZkvIbl9 ONV1PIPtB60= =8qA3 -----END PGP SIGNATURE----- Russell Earl Whitaker whitaker(a)eternity.demon.co.uk Communications Editor 71750.2413(a)compuserve.com EXTROPY: The Journal of Transhumanist Thought AMiX: RWHITAKER Board member, Extropy Institute (ExI) ================ PGP 2.0 public key available =======================

1 0

Re: purloined letter
by wcs＠anchor.ho.att.com 05 Jan '93

05 Jan '93

The hiding-data-in-bogus-text system that Phil referred to is Peter Wayner's Mimic functions, which let you represent data using a Huffman code or context-free-grammar set of productions that matches innocuous text. The examples in the paper used baseball game radio narration (hiding a message "Paul is dead" :-) and political speeches by Mr. Neil Kinnock, the raving Labour Party honcho whose speeches were plagiarized by Joe Biden. (Biden, btw, was a nice guy when he was elected to the Senate at age just-under-30, but he's apparently gone Big Brotherish as he's aged. I'm not bothered by one politician borrowing another's speeches, but stooping to Neil Kinnock's syrupy ranting is a bit much :-) The papers on the mimic functions are in ftp.cs.cornell.ecu, under /pub/wayner/Mimic. There are also a couple of papers on building a highly parallel des-cracker out of content-addressable memory, Until encryption becomes widely used, if yuo want to hide encrypted data, mimic functions or low-bits-of-gifs are good ways to go. Bill Stewart

1 0

RFC-822 header processing in perl
by eric＠parallax.com 05 Jan '93

05 Jan '93

I've written a perl script to parse RFC-822 style headers. It was a good deal harder than I had thought it would be. Since it's over 300 lines (with comments) I won't post it, but will mail it to anyone who wants to play with it. It has the following features: Doesn't touch anything unless you ask it to. Leaves the ordering and whitespace/folding of header lines unchanged. Allows you to replace any header line (which appears only once) with an arbitrary value, which is appropriatly folded on output. Allows you to delete any header line, or add a header line to the end of the header. These are special cases of replacing a header line. Allows you to access the value (stuff after the :) of any header line. Given a list of addresses, returns an array of canonicalized addresses. The last item is the hard part. It correctly parses the sample addresses in the RFC-822 paper, as well as some really gnarly looking junk that I threw at it. It correctly handles the various types of quoted strings, and backslash quoting, not splitting addresses at quoted commas. It removes nested comments from addresses. It deletes the group name from a list of addresses without screwing up quoted colons. It should be useful as a first step in alias processing. That's what I'll be adding next, when I figure out exactly how I want to do it. -- eric messick eric(a)toad.com

6 5

Re: purloined letter
by karn＠qualcomm.com 05 Jan '93

05 Jan '93

A couple of years ago somebody posted some clever programs to sci.crypt that hid arbitrary (cipher)text in seemingly innocuous "plaintext". You had two options: plaintext that looked like a running commentary on a baseball game (with the ciphertext encoded in the choices of names of players at bat, the sequence of balls and strikes, etc) or plaintext that looked like the writings of a particular legal scholar (I think). I don't remember his name, but he was chosen because Senator Joseph Biden of Delaware plagairized his works during law school, and Biden had recently introduced S.266 with the now-infamous "resolution" against cryptography. A nice touch. :-) Another approach to this problem is this: if you can't make the needles inconspicuous by themselves, generate some big haystacks to hide them in. I.e., write a program that produces bogus PGP "messages" and execute it frequently to produce background traffic. I wrote a first-order bogus PGP message generator and posted it to sci.crypt two weeks ago. I say "first order" because it looks like a PGP message to the naked eye, but is clearly invalid when fed to PGP - I didn't bother generating correct checksums on the ciphertext. The ideal bogus message generator would produce a message indistinguishable from a real PGP message encrypted with an unknown public key, or perhaps with a known public key chosen at random. Anybody want to write this? Phil

1 0

Re: RE: Acceptance of Keys
by Matt Willis 05 Jan '93

05 Jan '93

From: "Karl L. Barrus" <barrus(a)tree.egr.uh.edu> writes: > You posted some very good questions. The reason why it is >"unacceptable" to accept keys electronically is that you may be >vulnerable to spoofing. Okay, in reality, you have to realize that >attacking cryptographic protocols is a paranoid view of things, and >that you may not be attacked, but... if you send your public key to >somebody, it could be possible for someone to eavesdrop, grab your >key, substitute their own, and send that one along. Then when someone >responds to "you", the eavesdropper could read the message, re-encrypt >it with the public key they stole, and send it along to you. Then, >you don't even know you are the victim of eavesdropping. But we both call the same system (at least the people I x-change keys with) usually mindvox or a private system with a respected name... and in the case of Minvox, we do a DCC on IRC... straight person-to-person... to be eavesdropping... one, they'd have to tap my line, heavy equipment needed to tap a 16.8k HST v.42bis connection, seeing as I pretty much max out a phone line and HST's are really picky... or two, they'd intercept a DCC on the IRC at berkeley... but that's a 57.6k connection... however, that does seem possible... does anyone have any suggestions on how to make e-transfers of keys more secure, because, besides snail-mail (which would please the feds a lot) I have no other way of getting my key to them... > Anyway, it all boils down to validating the keys you receive. >Which makes it tough unless you can meet people face to face. >However, the latest version of pgp contains an option which computes >the md5 hash of your public key - which allows you to call someone, >and read each others hashes, thus completing the verification over the >phone. Of course, now you have to worry about receiving their correct >phone number... :-) geez, I didn't know it was this complicated... if someone screws with the key, it just doesn't decode, correct? nowadays, with MNP and ARQ-retries and all of our little .bis buddies, not to mention the CRC's in transfer protos, wouldn't that make an error in transfer EXTREMELY remote... so the only other way'd be tampering and even then it just wouldn't decode, so what... you get the key again... but I oversimplify the situation, I guess... Oh, and I know this is going to make me sound like a complete idiot in front of my peers, but I've always did straight tranfers of keys... how do you put ascii keys into your keyring? I can't seem to make MacPGP do it... sniffle... and if ihe reason I can't decode the key is due to an error in transmission, forget this entire message... +-------Matt-Willis--------------------------------+ | Matt Willis ASTMWILL(a)STETSON.BITNET | elsewhere: | Matt Willis Head of the Underground | mwill(a)mindvox.phantom.com | Matt Willis Robotech PBM List | +-------Matt-Willis--------------------------------+ "Absolutely alone in awareness of the mechanism." -Agrippa by WG

1 0

Hiding PGP code
by Matt Willis 05 Jan '93

05 Jan '93

Peter Breton <pbreton(a)cs.umb.edu> writes: > In using encrypted communications, how does one avoid the problem of >calling attention to the message BECAUSE it is encrypted? "If he went to >the trouble of coding it, there MUST be something in there!!" Granted that >if everyone begins encrypting, this problem will vanish... are there >practical solutions in the meantime? (eg, Codes that look like plaintext?) Here's an interesting solution... You can program a message filter to add extract letters to each PGP character to make it a word. I'm sure you could find any database of words and have it randomly make first letters... it'd be pretty simple... and then the receiver would just take every letter followed by a space... and if you wanted to be ultra-sneaky (who, us) you could have null words that change conditions in the letter... like switching to the second letter in the word, or skipping the next word altogether... but what to do with no-letter PGP codes... ok, the first TWO letters of the word indicate a character... sort of like a byte... hey, I think I might just write this sucker... Code will follow! carpe crypto +-------Matt-Willis--------------------------------+ | Matt Willis ASTMWILL(a)STETSON.BITNET | elsewhere: | Matt Willis Head of the Underground | mwill(a)mindvox.phantom.com | Matt Willis Robotech PBM List | +-------Matt-Willis--------------------------------+ "Absolutely alone in awareness of the mechanism." -Agrippa by WG

1 0