- cypherpunks-legacy@lists.ogf.org

ARAs
by Johann Faust 05 Aug '93

05 Aug '93

-----BEGIN PGP SIGNED MESSAGE----- Ben Weiss wrote: > BTW, do you remember who it was that was talking about pgp mail headers who > has not yet responded to my groovy idea of using rfc822's "Encrypted:" > field? So far, the only responses I've seen are from others saying "Yea, > when ya find out, let me know too..." Any thoughts? Huh, I guess that was me... I thought that was a nice idea, the reason I "forgot" to reply was that I've read it , thought about it, yes, that would be a nice idea, as long as you don't have to see the ugly 64-radix-junk in your editor you don't care about the bandwidth... Then it hit me ... Shit, I gotta go and study so I can get accepted to MIT and work out a Ph.D under (hopefully) the almighty hero Ron Rivest. That's the problem , soo much things to do, and soo little time... (I happend to be one of those students who belives that 1 semester is AT LEAST equal to 2 semesters :-)). Anyhow, I'm learning perl now, and working on "improving" (eh, well "hack") the cypherpunk remailing software, but for the moment my devilish Linux kernel barfs core as soon as it sees the chain-program... Anyhow, keep on working on those rfc822 fields, and please keep us informed, I think it's a good idea, but still, remailers with capability to store headers associated with a username and forward mail to them are better. And remember: NSA says that all American citizens are criminals, NSA consists of American citizens... Stop the Clipper/Skipjack/Jackpot/Crackpot/Potshot chip! Signed in Primes, Johann. -----BEGIN PGP SIGNATURE----- Version: 2.3 iQBVAgUBLGE97jxzhCdu2hFdAQEYIwH/cMBwxiLIECKQlKKgPOifvP0PE8yZHLHG LULAH3eFjf/SxgWLv1vKkPsVp6FVP8rkbtmHdc93Y1khrHKsii325w== =sXsi -----END PGP SIGNATURE-----

1 0

Cypherpunks
by M..Stirner＠f28.n125.z1.FIDONET.ORG 05 Aug '93

05 Aug '93

Please netmail the address for requesting subscribe/unsubscribe for this mailing. Thanks. ********************************************************************* * <m..stirner(a)f28.n125.z1.fidonet.org> - PGP Key D30909 via servers * * > What country can preserve its liberties if its rulers are not <* * > warned from time to time that their people preserve the spirit <* * > of resistance? Let them take arms!" - Thomas Jefferson, 1787 <* ********************************************************************* ___ Blue Wave/QWK v2.12 -- M. Stirner - via FidoNet node 1:125/1 UUCP: ...!uunet!kumr!shelter!28!M..Stirner INTERNET: M..Stirner(a)f28.n125.z1.FIDONET.ORG

1 0

help with encryptor - please?!?!
by IE63＠vaxb.acs.unt.edu 05 Aug '93

05 Aug '93

I've been working on a program for MS-DOS machines that will encrypt and/or password protect .COM and .EXE files. The way it works is this: It encrypts the entire file specified by the user, then it uses a polymorphic encryptor to encrypt the decryption code for the file and put it in a decryption envelope filled with anti-debugging code. IT then attaches the entire module/decryption code to the file so that it is executed initially when the file is run - at which point it decrypts the file and does whatever relocation is needed (for .EXE files). In the case of a password - it asks for the password, encrypts it and checks it against the stored version, then if they match it decrypts restoration code using the password as a key and continues on. I've got it working really well at this point - but my encryption algorithms are rather simple. I'm fairly new in the encryption biz, and I was wondering what would be good to use for the file encryption algorithm to make it as secure as possible? Of course - the code to decrypt it MUST be present in the file, so if you can bypass the anti- debugging code it's yours, but the polymorphism makes it difficult to do this on more than a case-by-case basis. Still - I'd like to make it to where one can't just run a "decrypt-em-all" analysis program on it and be able to read the included text - but I need a good algorithm for it. Any help/suggestions would REALLY be appreciated. Oh - if you are interested in the protection utilities, email me at the address below - it's freeware. Thanks a lot, Michael Ellison ie63(a)vaxb.acs.unt.edu If you wish to encrypt any messages E-mailed to me, please use the following key..... -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCNAixUuYYAAAEEAKNllAee26qGqxJck3Bftdkrz0MUQLABGMZqVem9UW9kjjS+ rMAafauqYTE5/Kdnx+4Asj0Wgfon0YBtRMT0crMcBYNqVp4//RUh7wrxQNvKFeeO ZGuQp2hyHQqh1FDfWsHG4ldGqIV1YuOXq6oeIDkmbwgf8BRgPcZkwUqsF4b1AAUR tCpNaWNoYWVsIEEuIEVsbGlzb24gPGllNjNAdmF4Yi5hY3MudW50LmVkdT4= =0rss -----END PGP PUBLIC KEY BLOCK-----

2 1

Re: CAKE--Citizens Against Key Escrow
by lazylion＠netcom.com 05 Aug '93

05 Aug '93

>The cypherpunks remailer was designed to be run out of a user account, >and can be modified to be just such an email server. The remailer as >it is now is just such an email server, whose only function is to >remail. Handling lists and votes as above is straightforward. > >I do take it that you're a patriotic cypherpunk, no? > >Eric So Eric, how's bout we all send messages to cypherpunk-cake(a)toad.com with a valid reply-to and it sends back a response such as "Please confirm that this is a valid signiture by ... (doing something random?) BTW, do you remember who it was that was talking about pgp mail headers who has not yet responded to my groovy idea of using rfc822's "Encrypted:" field? So far, the only responses I've seen are from others saying "Yea, when ya find out, let me know too..." Any thoughts? +---------------------------- Ben Weiss -------------------------------+ ! Telephone: (510) 841-5709 voice Internet: LazyLion(a)Netcom.com ! ! (415) 325-9600 fax Ben_D._Weiss(a)bmug.org ! +-------------- Packet Radio: WB5QAL(a)N6EEG.#NOCAL.CA.US ---------------+ ! This message is protected by 18 USC 2511 and 18 USC 2703. Monitoring ! ! by anyone other than the recipient is absolutely forbidden by US Law ! +---------------------------- Ben Weiss -------------------------------+

1 0

CAKE--Citizens Against Key Escrow
by L. Detweiler 05 Aug '93

05 Aug '93

Hey cypherfolks. It seems to me that the fundemental issue of the acceptability of key escrow is not getting debated well enough in the mainstream media. The Clipper debate keeps getting framed in terms of `who will be the escrow agencies' or `how secure is the algorithm really' or whatever. Also, I'm a bit disappointed in both EFF and CPSR not coming out with firm positions *against* key escrow systems in general (CPSR spokesman: `I don't want to sound too stridently opposed...'). We have something of a void. The problem is that the stance is seen as anti-law enforcement by these organizations (or they are afraid it will be perceived that way). Anyway, as part of the propaganda effort, I am proposing starting a new `group' called the Citizens Against Key Escrow. (Now, don't get too excited.) To start out, what would be ideal is just a document describing Clipper, a lot of anti-Clipper propaganda, and the appended *signatures* of everyone who is a `member' of CAKE and affirms the position `unlimited and unrestricted use of strong cryptography is an inalienable right.' Please do *not* mail me saying that you want to sign it. I'm not ready. In particular, I'd like to propose that a patriotic cypherpunk set up a mini-email server to handle signature additions, so that people can send automated messages. Then, when this is posted to sci.crypt and circulated to every dark corner of Cyberspace, the ability to handle the traffic will be automatic, and hopefully we will collect *many* signors. (Yes, there could be tricky authentication issues with names. I would like to see the utmost attention given to the veracity of signors if possible. If `David Sternlight' makes it to the list we know its fake, and people could criticize it on that ground. Maybe some way to `contest signatures' via email--if a signature is contested it is removed?) By the way, the supposed `comprehensive policy review' blared in the Clipper announcement by the Clinton adminstration regarding cryptographic policies (export, freedom of use, etc.) is rumored to be over in mid-September. Surprise, they haven't contacted us yet! This document would be something tangible to present and herald to them *prior* to a big ugly hand-me-down announcement. If we got press coverage of our view, saying that we're being excluded, that these are the real issues at stake, and then the real announcement came out shortly thereafter with all the inevitable bad news, it would be a great PR coup. Anyway, here are some propaganda items that will be included in the final document if this actually happens. I'd really appreciate if anyone would contribute *specific* paragraphs. (I've never really gotten great response from this kind of query, despite a lot of lip service and excitement, and judging by the current Cypherpunk FAQ this is not uncommon, but I'm the eternal optimist.) - Description of Clipper - Emphatic terms: we think Skipjack could be a strong algorithm, but key escrow is inappropriate for a civilized cyberspatial society - of course, we're not against law enforcement in general! we just believe that just as the government currently has the capability to wiretap insecured communications, the public has a right to thwart wherever it wants with it secured - Debate on security of key agencies, who will be `it' etc. are smokescreen decoys by the NSA - Indications that key escrow is not the actual fundamental motivation of Clipper, from FOIA documents (the classification of the national security reasons), the rather pathetic circumlocutions about vaults and the agencies, etc. - Maybe a little history of NSA and the abuses from Bamford - Jefferson as cryptographic innovator, other revolutionaries requiring anonymity and security in their writing - Constitutional issues: freedom of speech and illegal search & seizure - cryptographic device export restriction by the NSA - Quotes from the FBI and NSA: cryptography is like nitroglycerin, we might have a lot of dead bodies lying around, all the waffling quotes about whether cryptography should be regulated, etc. If you have anything on the above, please send it! In particular I need `mini-essays'. This is another project that everyone can contribute to and prove we're not just a bunch of listless, noisy, inconsequential nihilists. (Once again, my optimism overshadows my memory.)

3 2

mail-to-news error (fwd)
by nowhere＠bsu-cs.bsu.edu 05 Aug '93

05 Aug '93

This is what was in my mailbox... Just so you know, the anonymous remailer here strips out your ENTIRE header. It will process commands in the header, but the original message's subject won't get passed on. Anything in the pasted "::" header block will get tacked onto the outgoing header unless it is a command to the remailer. So put a "Subject:" line in the pasted header block and it will get through the news gateway barring any other difficulties. Chael Hall Forwarded message: >From daemon(a)cs.utexas.edu Wed Jul 32 23:59:59 1993 >Delivery-Date: Wed, 32 Jul 93 23:59:39 -0600 >Date: Wed, 32 Jul 93 10:00:00 -0600 >From: daemon(a)cs.utexas.edu >Message-Id: <9312345678.AA00001(a)cs.utexas.edu> >To: nowhere(a)bsu-cs.bsu.edu >Subject: mail-to-news error > >The post failed. >Required "Subject" header is missing or empty. >(Article not posted.) > >------- original message appended ------- > >>From nowhere(a)bsu-cs.bsu.edu Wed Jul 32 23:59:59 >Received: from bsu-cs.bsu.edu by deepthought.cs.utexas.edu (5.64/1.2/relay) with SMTP > id AA00001; Wed, 32 Jul 93 10:00:00 -0600 >Received: by bsu-cs.bsu.edu (5.57/Ultrix3.0-C) > id AA00001; Wed, 32 Jul 93 11:00:00 -0600 >Date: Wed, 32 Jul 93 10:00:00 -0600 >Message-Id: <9312345678.AA00001(a)bsu-cs.bsu.edu> >From: Anonymous <nowhere(a)bsu-cs.bsu.edu> >To: alt-test(a)cs.utexas.edu >X-Remailed-By: Anonymous <nowhere(a)bsu-cs.bsu.edu> >X-Ttl: 0 >X-Notice: This message was forwarded by a software- > automated anonymous remailing service. > >[Remains of the bounced message] -- Chael Hall nowhere(a)bsu-cs.bsu.edu, 00CCHALL(a)BSUVC.BSU.EDU, chall(a)bsu.edu (317) 776-4000 from 8 am - 5 pm CST

1 0

Anon remailer to USENET gate bogus
by fergp＠sytex.com 05 Aug '93

05 Aug '93

I have been experimenting the past few days with anon remailer to USENET gateway systems to see what the results would be -- nada. I used Chael's BSU system (nowhere(a)bsu-cs.bsu.edu) to attempt a usenet post which never (magically?) appeared in the desired group (alt.privacy, I believe). I waited for several days for the post, but nada, zilch, zero. I retried the bsu remailer with a test message to make sure it was still active, and yes, it seemed to work perfectly. My guess is that the usenet gateway at utexas refuses anon e-mail. Anyone got any other suggestions? I haven't tried any other gateways -- yet. Cheers. Paul Ferguson | "Government, even in its best state, Network Integrator | is but a necessary evil; in its worst Centreville, Virginia USA | state, an intolerable one." fergp(a)sytex.com | - Thomas Paine, Common Sense I love my country, but I fear its government.

3 2

Re: InfoWorld Letter
by wcs＠anchor.ho.att.com 05 Aug '93

05 Aug '93

Paul Goggin sent the list a copy of Steven Fisher's letter to InfoWorld about NSA harassment for offering commercial crypto back in 1981. The NSA is supposedly a bit better behaved these days, at least in public :-), but it's no surprise. Sometime around then, they slapped patent secrecy orders on a guy who had designed an analog scrambler for CB radio; a real crypto-system must have been a much more significant threat to them. A couple of comments were interesting: One was the assertion in the letter he received from the BATF that their product, as munition, could not only not be exported, but could also not be sold to *multinational companies*. Was that the law then? Or was the BATF just a bit over-enthusiastic about what they could get away with? It's also interesting that it was the BATF. Another was that the NSA asked them to put in a trapdoor. These days, escrow is the politically correct way of implementing a trapdoor, but - I wonder if it would be possible to make a trapdoor/weak escrow system, which escrows the keys for *some* kinds of keys, enough to make the bureaucrats think it's ok, but which also has a class of keys for which the escrow is non-effective, bogus, or otherwise doesn't let the cops in, which could be revealed to users after the system has been approved and sold? Perhaps a system which requires 2**N steps to retrieve most keys from escrow, but has a small set that can be gotten quickly for demos? Could you do a system like that and hide it from the NSA for a while? Some alternative approaches would be a system that obscured the escrow (easy to build from clipper if you've got a programmable phone; you just encrypt the Wiretap Field with your session key), or worked fine with a bogus Wiretap Field, or a system where the escrow can be made ineffective administratively (either lost by the escrow agents, or requiring the participation of the telephone owner, or tampered by the owner) At the very minimum, having a system that doesn't let the NSA cheat during the escrow process would be a good start - where each part of the escrow key is really installed separately, and verifiable hardwarily-random numbers are used to seed the key generation. Since the NSA\b\b\bNIST hasn't announced their plans for how to select escrow agents, much less who they are, or how they *really* plan to set the keys, I suppose it's premature to ask them to announce what the rules will be for approval of escrow procedures or agencies or guarantee that if you follow them, you'll be allowed to export your products? :-) Bill Bill Stewart wcs(a)anchor.ho.att.com +1-908-949-0705 fax-4876 ROT13 public key available upon request

1 0

Re: Anon remailer to USENET gate bogus
by edgar＠spectrx.Saigon.COM 04 Aug '93

04 Aug '93

Paul Ferguson wrote: I have been experimenting the past few days with anon remailer to USENET gateway systems to see what the results would be -- nada. ... My guess is that the usenet gateway at utexas refuses anon e-mail. Anyone got any other suggestions? I haven't tried any other gateways -- yet. I had a similar experience with utexas. It worked the first time I tried it, but failed on a subsequent attempt. I suspect that after some complaint utexas was modified to reject anonymous input. Here is my list of E-mail/Usenet gateways: group-name(a)ucbvax.berkeley.edu * (blocked from non-bky sites) group-name(a)cs.utexas.edu * (was working but now blocked???) group-name(a)pws.bull.com * (Bounced to remailer) group-name(a)demon.co.uk group.name.usenet(a)decwrl.dec.com group.name(a)news.cs.indiana.edu Note that some of these require trans-literation of periods to dashes in the newsgroup name; others do not. Ucbvax is supposed to block mail from non-Berkely sites; it might work from these Cypherpunks remailers (I haven't tried it): 1: hh(a)pmantis.berkeley.edu 2: hh(a)cicada.berkeley.edu 3: hh(a)soda.berkeley.edu Utexas see above, bull bounced to the (wimsey) remailer; I haven't tried the others yet. But I'm afraid that the utexas story will be repeated for any gateway that continues to allow anonymous posting to newsgroups. I see the obvious solution is for the Cypherpunks remailers to support direct anonymous posting. Certainly the programming should be trivial. The "political" risk is something to consider, however. But we are supposed to be the fearless leaders to crypto-anarchy. "If not us, who? If not now, when?" -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Cupertino, Ca

1 0

Re: Anon Bank Accounts?
by edgar＠spectrx.Saigon.COM 04 Aug '93

04 Aug '93

Duncan Frissell said: Did you know that it is still possible -- in 1993 -- to open a bank account in the United States in a nome de guerre? No, I sure didn't know that. My wife works in a bank, & she tells me that she needs to see two forms of ID to open a new account. So please, Duncan, elucidate! -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Cupertino, Ca

1 0