- cypherpunks-legacy@lists.ogf.org

Re: Macpgp 2.3
by lefty＠apple.com 23 Jul '93

23 Jul '93

>I just fetched macpgp 2.3 from soda, and wound up with a file ending in >the suffix "gz". This is a new one on me, and I don't know how to decode >it. Can anybody inform me? Inside whatever it is is a binhexed compactor >file, and I can deal with those formats, but the outside wrapper defies >every decompressing utility I've got. It's compressed with the gnu utility gzip, as Tim May and Paul Goggin have pointed out. However, as they failed to mention, soda at least will decompress .gz files on the fly. If you want to pull down the file "xxxx.yyyy.gz", issue the command "get xxxx.yyyy" (i.e. leave off the .gz suffix) and soda will unzip it for you as it ftp's it down. -- Lefty (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

1 0

Your Input Requested for Article
by mulivor＠orion.crc.monroecc.edu 23 Jul '93

23 Jul '93

Hello Cypherpunks; I'm a newspaper journalist now writing a piece for the American Journalism Review (formerly Washington Journalism Review). In case you're not familiar with AJR, it's a mass-circulation monthly magazine that's available at many large newsstands. Journalists in the U.S. consider it a principal source of professional news. My article is tentatively scheduled for publication in the Oct. 93 issue. I am looking for: 1. Examples of how and why anonymous e-mail has been used to communicate with journalists. 2. Your comments concerning anon-mail's role in the future of newsgathering, particularly investigative reporting. I need to receive your comments directly, not posted to this list. Kindly include your telephone and fax numbers. Please do not send me responses containing requests to remain partly or completely off-the-record. I won't be able to use those. The less technical your remarks, the more of them I might be able to use, since the magazine has a non-technical readership. (However, in the interest of interview etiquette and personal disclosure, I'll mention that I have a technical degree and teach computer science part-time at a branch of the State University of New York.) I already have the alt.whistleblowers sizeable FAQ. Please do not cross-post this to any other list. Thank you in advance for your kind cooperation. I will acknowledge every reply that I receive from Cypherpunks. ------------------------------ Philip Mulivor mulivor(a)orion.crc.monroecc.edu 716 256-2222 voice 716 271-4052 fax

1 0

Re: Pgp help.
by peter honeyman 23 Jul '93

23 Jul '93

i use a script, which i call sign, as follows: #!/bin/sh exec pgp -sta +clearsig=on ${1+"$@"} please excuse my unix idioms. peter

1 0

Pgp help.
by J. Michael Diehl 23 Jul '93

23 Jul '93

Hi all! I've got YAPP (Yet Another Pgp Problem!) I want to know how people are signing their messages and keeping the message in plaintext. I see the message and the pgp sig on the end. Could someone outline how this is done so I can implement it in my mailing system. BTW, I sure like being able to compose email in WordPerfect.... ;^) +-----------------------+-----------------------------+---------+ | J. Michael Diehl ;-) | I thought I was wrong once. | PGP KEY | | mdiehl(a)triton.unm.edu | But, I was mistaken. |available| | mike.diehl(a)fido.org | | Ask Me! | | (505) 299-2282 +-----------------------------+---------+ | | +------"I'm just looking for the opportunity to be -------------+ | Politically Incorrect!" <Me> | +-----If codes are outlawed, only criminals wil have codes.-----+ +----Is Big Brother in your phone? If you don't know, ask me---+

1 0

Remailers/PayPhones and Today's NYT
by Peter Wayner 23 Jul '93

23 Jul '93

Today's NYT has an article on PayPhone salons that offer phone booths to their customers. They buy the long distance connection in bulk and resell them to the customers so the customer doesn't have to pay the high payphone charge. They're quite common in poor sections of town. The article mentions that the phones can be problematic because drug dealers can use them to avoid phone taps, but it seems to conclude that this is a small price to pay for bringing the connection to the poor. Most customers use the service to call their home country and speak to relatives. I thought it was interesting that the danger of untraceable drug dealers popped into the reporters mind when they were researching the article. After all, they don't tend to mention illegal problems when they speak about used car dealers or other services. -Peter

2 1

STEG: subliminal messages
by Karl Barrus 23 Jul '93

23 Jul '93

[I'm forwarding mail from Eric which was meant for the list as well] From: Eric Hughes <hughes(a)soda.berkeley.edu> To: elee9sf(a)Menudo.UH.EDU >An interesting related topic is subliminal channels and messages. A >subliminal channel is one in which communication takes place without >an external observer realizing it. [summary deleted] Gus Simmons has recently written a paper on subliminal channels in the DSA (the one PKP is about to license). The paper as of yet is not officially published, but likely will be at Crypto '93 next month. I've seen a copy of the paper, but don't have a copy. I do, however, remember this one line. "The DSA provides the most hospitable environment for subliminal channels in any system yet seen." (Almost verbatim, but not quite.) Assume this is true. (I believe Simmons, myself.) What might this mean? Suppose some agency of the government makes digital signatures on some certificate for individuals. To take a concrete example, take driver's licenses. The subliminal channel in the signature might be used to encode, say, the following: 1. number of drunk driving convictions 2. number of drunk driving arrests 3. insurance rating 4. whether this person is suspected of habitually a. merchandising narcotics b. carrying large amounts of cash c. looking at child pornography d. wanting to kill police officers e. carrying concealed messages Since the signature itself contains this information, and since the channel is subliminal, the only way to know whether the channel carries data is to see the software. For this reason the DSA should not be used by government agencies to make certificates for individuals. It should be scrapped for this purpose and some other algorithm designed which has a provable upper bound on the subliminal channel of less than one bit. Eric

1 0

more on FBI credit search access
by L. Detweiler 23 Jul '93

23 Jul '93

Hm, maybe someone could just check out the article (Sat Jul 17 NYT p. 7). This is a distinctly different interpretation. ===cut=here=== From: Shari Steele <ssteele(a)eff.org> Date: Wed, 21 Jul 1993 09:17:28 -0400 Subject: New law on FBI and credit records Hi Peter. Your post in alt.privacy was forwarded to me. I don't know of any legislation that will permit the FBI to obtain your credit report without a search warrant. While it is possible that such legislation exists, what you describe from the NY Times article sounds an awful lot like a proposed amendment to the Electronic Communications Privacy Act (ECPA) introduced this year that would allow the FBI access to *telephone calling data* with a letter (rather than a search warrant) certifying that the person was being investigated for engaging in terrorism or international espionage, or cohorting with such folks. The telephone calling data includes the names and telephone numbers of all calls made from the phone number being investigated, as well as the duration of the calls. While this in itself may be cause for alarm, it is not the same as FBI access to credit reporting information. Shari ****************************************************************************** Shari Steele Director of Legal Services Electronic Frontier Foundation 1001 G Street, NW Suite 950 East Washington, DC 20001 202/347-5400 (voice), 202/393-5509 (fax) ssteele(a)eff.org ------- End of Forwarded Message

2 1

Re: Encrypted postings.
by hfinney＠shell.portal.com 23 Jul '93

23 Jul '93

From: Chris Claborne <claborne(a)ccgate.sandiegoca.NCR.COM> Could we send our postings to the mailer in encrypted format? That is... I would encrypt the message with the public key for the mailer, the mailer would decrypt and re-post to the clear-text mailer and to the PGP group. You can already do this, in a way. Just post to the list using one of the existing encrypted remailers like the one at extropia (or the one at portal, for that matter). You need to put: :: Request-Remailing-To: cypherpunks(a)toad.com Subject: <your subject here> And a blank line at the top of your message, encrypt the whole thing with the public key of the remailer, and add: :: Encrypted: PGP and a blank line to the PGP file just before the "-----BEGIN PGP MESSAGE-----" line. There are some scripts on the cypherpunks ftp site (soda.berkeley.edu, /pub/cypherpunks/remailer) to automate this process. The one disadvantage with this approach is that the source of the message (namely, you) gets stripped off. We might want to think about changing our remailers to have a non-anonymous remailing command as well as an anonymous one. This way you could have "local" privacy from any sysop who snoops on your mail going out, while still making it easy for people to reply to you. Hal

2 1

Re: PGP progress report
by markh＠wimsey.bc.ca 23 Jul '93

23 Jul '93

> > PGP-RSAREF negotiations are plodding along with J. Berman of EFF as > an intermediary. The developers are unsure of the reasons for the slow > pace. J. Bidzos is supposed to make a major public announcement on > this avenue very soon. This is good news. I believe I've managed to overcome the legal obstacles to RSAREF+GNU MP. This is of interest because PGP+RSAREF+GNU MP is actually considerably faster than PGP on a number of platforms (at least Sun Sparc, IBM RS6000, 80486 Linux). Mark (for those who are interested, overcoming the obstacles involved my writing a public domain implementation of a subset of the functionality of libgmp with the same interface. The subset is, in fact, pretty much what you want to do RSA, LUC &c. My free code is slower than GNU gmp, but it is functional. For more details, see the last few weeks of gnu.misc.discuss). -- Mark Henderson markh(a)wimsey.bc.ca (personal account) RIPEM key available by key server/finger/E-mail MD5OfPublicKey: F1F5F0C3984CBEAF3889ADAFA2437433

1 0

No Subject
by UCX_SMTP＠crc.monroecc.edu 23 Jul '93

23 Jul '93

---- Transcript of session follows ---- 196608 %NONAME-W-NOMSG, Message number 00000000 -SYSTEM-S-NORMAL, normal successful completion ---- Unsent message follows ---- Received: from toad.com by relay2.UU.NET with SMTP (5.61/UUNET-internet-primary) id AA06943; Wed, 21 Jul 93 23:22:44 -0400 Received: by toad.com id AA21927; Wed, 21 Jul 93 19:16:03 PDT Received: by toad.com id AA21680; Wed, 21 Jul 93 19:02:20 PDT Received: from decwrl.UUCP by toad.com id AA21676; Wed, 21 Jul 93 19:02:19 PDT Received: by uucp-gw-2.pa.dec.com; id AA18750; Wed, 21 Jul 93 19:00:31 -0700 Received: from emory.UUCP by merlin.gatech.edu with UUCP id AA03218 (5.65c/IDA-1.4.4 for decvax!decwrl!hoptoad!CYPHERPUNKS); Wed, 21 Jul 1993 21:36:21 -0400 Received: from indigo.UUCP by emory.mathcs.emory.edu (5.65/Emory_mathcs.3.4.11) via UUCP id AA16552 ; Wed, 21 Jul 93 21:27:59 -0400 Resent-Message-Id: <9307220127.AA16552(a)emory.mathcs.emory.edu> Received: by indigo.mese.com (DECUS UUCP /2.0/2.0/2.0/); Wed, 21 Jul 93 21:25:09 EDT Resent-Date: Wed, 21 Jul 1993 21:21:26 EDT Resent-From: <cypherpunks(a)indigo.mese.com> Resent-To: <CYPHERPUNKS(a)toad.com> Received: by INDIGO.MESE.COM (MX V3.1) with UUCP; Wed, 21 Jul 1993 21:21:18 EDT Received: from relay2.UU.NET by emory.mathcs.emory.edu (5.65/Emory_mathcs.3.4.11) via SMTP id AA12591 ; Wed, 21 Jul 93 20:34:47 -0400 Received: from toad.com by relay2.UU.NET with SMTP (5.61/UUNET-internet-primary) id AA14330; Wed, 21 Jul 93 20:31:29 -0400 Received: by toad.com id AA18642; Wed, 21 Jul 93 16:09:44 PDT Received: by toad.com id AA18609; Wed, 21 Jul 93 16:07:26 PDT Return-Path: <lock60!snark!boojum!esr(a)gvls1.VFL.Paramax.COM> Received: from gvls1.VFL.Paramax.COM ([128.126.220.104]) by toad.com id AA18605; Wed, 21 Jul 93 16:07:15 PDT Received: from lock60.UUCP by gvls1.VFL.Paramax.COM (4.1/mls/4.0) id AA04653; Wed, 21 Jul 93 19:07:13 EDT X-Info: VFL.Paramax.COM is the new name for GVL.Unisys.COM Please change any mailing lists or aliases. Both the old and the new addresses will work for a short time. Received: by lock60.Canal.Org (smail2.5) id AA16551; 21 Jul 93 18:50:24 EDT (Wed) Received: by snark.thyrsus.com (/\==/\ Smail3.1.21.1 #21.19) id <m0oIjLP-00020KC(a)snark.thyrsus.com>; Wed, 21 Jul 93 14:56 EDT Received: by boojum.uucp (Smail3.1.28.1 #2) id m0oIiVK-000BQZC; Wed, 21 Jul 93 14:03 EDT Message-Id: <m0oIiVK-000BQZC(a)boojum.uucp> From: <boojum!esr(a)gvls1.VFL.Paramax.COM> Subject: FAQ, round 2 To: boojum!cypherpunks(a)uunet.uu.net Date: Wed, 21 Jul 93 14:03:02 EDT X-Mailer: ELM [version 2.3 PL11] I've written some more material for it. Criticisms and additions welcome. --- DRAFT VERSION ---- DRAFT VERSION ---- DRAFT VERSION ---- DRAFT VERSION --- From: esr(a)snark.thyrsus.com (Eric S. Raymond) Newsgroups: news.answers Followup-To: poster This is the Cypherpunks FAQ. It explains the projects and purposes of the Cypherpunks mailing list. It is also intended to serve as a general introduction to privacy and encryption issues. For details on the technical and theoretical aspects of computer cryptography, see the sci.crypt FAQ, available for FTP from rtfm.mit.edu (18.172.1.27) in the directory pub/usenet-by-group/sci.crypt. The cypherpunks archive is available for FTP at soda.berkeley.edu:pub/cypherpunks This site contains code, information, rants, and other miscellany, including the most up-to-date version of this FAQ. This FAQ is maintained by Eric S. Raymond <esr(a)snark.thyrsus.com>; send additions and corrections to that address. Sections contributed by others are credited to individual authors. We gratefully acknowledge, in addition, feedback and comments from David Mandl <dmandl(a)lehman.com> and Eric Hughes <hughes(a)soda.berkeley.edu>. Here is a table of contents for this FAQ: 1. Why cypherpunks? 2. What are the essentials of privacy software? a. Public-key cryptosystems for secure communication. b. Unforgeable electronic signatures for message authentication. c. DC-net or similar protocols to thwart spoofing. 3. What are the potential applications of good privacy software? a. Secure communications. b. Digital cash. c. Electronic voting. d. Electronic contracts. e. Secure anonymous remailers and posters. f. <more?> 4. What are the key algorithms, tools, and implementations for privacy software? a. RSA b. DES c. Clipper/Capstone/DSS d. PGP e. Possible non-RSA trapdoor functions. 5. What are the social and political implications of good privacy software? a. Drastically lower transaction costs for trade. b. Expansion of the counter-economy. c. Disempowerment of government. d. Anonymity for whistleblowers. 6. What are the legal, political, and technical obstacles? a. The Clipper/Capstone/DSS power grab. b. The RSA patent and the PGP/RSA fight. c. RSA's base problem may not be NP-complete. 7. What can I do to help? a. Work on cryptographic software. b. Agitate against the Clipper/Capstone/DES proposals. c. Promote the use of encrypted communication. To join the cypherpunks mailing list, send a request to: cypherpunks-request(a)toad.com Working with us could be your best shot at stopping Big Brother. So if you have skills to contribute, act now. The freedom you save could be your own. 1. Why cypherpunks? Because privacy is essential to freedom. If the government (or any other oppressor that behaves like one) can effectively monitor communications, it can control or suppress them. And it will do so, because the natural tendency of controllers is always to seek more control. The government cannot be relied on to protect your privacy rights. Nor can anyone else --- certainly not your employer, or the corporations that want to know all about you so they can sell you things. Given half the chance, governments and corporations will always push for security standards that protect *them*, but not *you*. Computer technology can help protect you against would-be snoopers, but only if somebody is sufficiently smart and dedicated to build the tools. The Cypherpunks list exists to build and propagate privacy software. Our aim is to give you the tools to keep your private information private, and to communicate with other people and computers in ways snoopers cannot tap. 2. What are the essentials of privacy software? a. Public-key cryptosystems for secure communication. A conventional cryptosystem consists of an encoding/decoding method and a single key. Two users who share a key can exchange private messages. A public-key cryptosystem uses a *pair* of keys; one private, one public. Anyone with either key can decode messages encoded with the other. For privacy, it must be impossible (or at least impractical) to deduce the private key from the public one. Public-key cryptosystems imply many exciting things --- unforgeable electronic signatures, digital cash, and secure electronic contracts are among them. The basic idea behind all of these is that, as long as your private key is secure, people can verify that an encoded message containg known text came from you by decoding with your public key. In the remainder of this FAQ we use `PKC' as an abbreviation for `Public Key Cryptosystem'. The best-known PKCs are the RSA system, the Federal Government's DES standard, and the government's Clipper proposal. We'll discuss these, and others, in more detail below. b. Unforgeable electronic signatures for message authentication. There are many circumstances in which you want to be able to check a public clear-text message for tampering. To do this, the message must contain a `digital signature' or `message digest code' or `message hash' derived from its clear text, which can be checked against the clear text by a receiver. For security, the message hash should have the property that no one knows how to modify a message in a way that preserves its hash. PKCs give you unforgeable signatures as a side-effect. Unfortunately, known PKCs are too slow to use practically for message hashing. Thus, there is a separate category of `Digital Signature Systems'. The three major DSS techniques are Snefru, MD5, and DSS. Snefru, invented by Ralph Merkle at Xerox PARC, is of historical interest only as it has been broken. MD5 is described in Internet RFC 1321, which also gives a reference implementation in C. As of July 1993 it is believed to be secure, but has not been *proved* to be secure. DSS is a Federal Government proposed standard associated with the Clipper proposal. <more needed here> c. DC-net or similar protocols to thwart spoofing. <more needed here> 3. What are the potential applications of good privacy software? a. Secure communications. With a PKC, you can send a message that no one but the intended receiver can decrypt by encoding it with the receiver's public key. If you encode it with *your* public key, the receiver can verify that it came from you. This means that it is possible to do secure communications even over public channels. Neither nosy neighbors, business competitors, nor the government or any (other) criminal gang can interfere with it. b. Digital cash. Unforgeable messages also imply digital cash. You could use a PKC to send to the receiver a code permitting them to draw a particular amount of money from your bank account. The bank, with access to both yours and the payee's public keys, can verify that the order is genuine. This means that it is possible to do trade over electronic links, without any part trusting any other party beyond the bounds of normal commercial risk. c. Electronic voting. Unforgeable messages also imply secure electronic voting. If you encode your voting form with a PKC, the vote-collecting authority can verify it with your public key. d. Electronic contracts. If two or more people encode known text with their private keys applied in succession, all their public keys will be required to decode it. This is an unforgeable contract. Furthermore, it is an unforgeable *private* contract. e. Secure anonymous remailers and posters. <more needed here> 4. What are the key algorithms, tools, and implementations for privacy software? a. RSA RSA stands for `Rivest-Shamir-Adelson', the names of the three computer scientists who developed the technique. RSA has withstood determined attacks for over a decade and is widely believed to be secure. It has been proposed as an Internet standard. The RSA technique is patented. The patents are held by RSA, Inc. <contact information should go here>. An implemenation in C called RSAREF is available for research and certain noncommercial uses. b. DES <more needed here> c. Clipper/Capstone/DSS <more needed here> d. PGP <more needed here> e. Possible non-RSA trapdoor functions. <more needed here> 5. What are the social and political implications of good privacy software? a. Drastically lower transaction costs for trade. <more needed here> b. Expansion of the counter-economy. <more needed here> c. Disempowerment of government. <more needed here> d. Anonymity for whistleblowers. <more needed here> 6. What are the legal, political, and technical obstacles? <more needed here> a. The Clipper/Capstone/DSS power grab. <more needed here> b. The RSA patent and the PGP/RSA fight. <more needed here> c. RSA's base problem may not be NP-complete. <more needed here> 7. What can I do to help? a. Work on cryptographic software. <list of current projects should go here> b. Agitate against the Clipper/Capstone/DES proposals. <more needed here> c. Promote the routine use of encrypted communication. <more needed here> You can help spread PGP and other appropriate tools far and wide (both to help get a better foothold to thwart the Clipper proposal and its ilk, and to work towards making crypto as commonplace as envelopes). --- DRAFT VERSION ---- DRAFT VERSION ---- DRAFT VERSION ---- DRAFT VERSION --- -- >>eric>>

1 0