- cypherpunks-legacy@lists.ogf.org

PINE
by me 12 Jul '93

12 Jul '93

One of the many neat features of PINE is that it allows one to talk to the SMTP server _directly_, bypassing sendmail (and its security checks). What this means is that instead of doing a "telnet xxxx smtp", you can build and configure a PINE client to do it for you, and retain all the nice features. PINE source code is freely available, and does not require root privs to run (any more than it requires root privs to "telnet xxx smtp"). The pine executable does take up a Meg and a half though, which could be a problem for folks without a lot of space to play with. Coming down the pike though, I see SMTP, maybe even NNTP protocols being secured (check out the magazine someone mentioned earlier: INFO-SECURITY. You just have to fill out a bingo card to get it, Write:INFO-SECURITY NEWS 498 Concord St, Framingham MA 01701-2357). If that happens, the days of EZ phreaking are over.....

2 1

Re: Secure comm program, Sockets + LINK
by jpp＠markv.com 11 Jul '93

11 Jul '93

From: Timothy Newsham <newsham(a)wiliki.eng.hawaii.edu> I assume you're talking about the link program I wrote. Yes, I was talking about your program Link. If so: I never really considered the RSA exchange as authentication although it can be thought of that way I guess. Right. The only person who can participate (on one side) of the exchange is the one with the private key which matches the other side's public key. This does provide a weak level of authentication. (An opponent can record 'authentication' sequences, and replay them later. For this to be usefull, the opponent will have to have discovered the session key which is/was being selected by the sequence.) If (when) I implement DH key exchange I guess I should add some sort of authentication. I was concidering a different authentication, and secret session key selection protocol (the one that got away :>). It would only use RSA (or any other suitable public key system) to sign and check signatures, as well as encrypt and decrypt data. No new number theory. However, it would require both parties to know the public key of the other. This sort of protocol would be ideal for logins. Both parties authenticate the other, and no-one else can read the channel. No passwords are ever transmitted over the channel either. You and I use a "sum" (xor perhaps?) of our two key halves as the session key. At any time one of us can simultaneously request changeing the sesion key, and chalange the identity of the other. To do this, I send you a new key half encrypted under your public key. You respond with a signature of the resulting session key encrypted under my public key. We then start using the new sesion key. At this point both directions are authenticated, and observers can't determin the new sesion key. Things are complicated a little by the fact that all comunication is done under a secret session key. Things also become a bit more complex because there may be data you sent before recieving my key change request. j'

2 1

Re: encrypted email software
by Timothy Newsham 11 Jul '93

11 Jul '93

> > > DES isnt secure? And where was it that you got this precious > > little piece of information? > > > You mean to tell me you believe what your government tells you about DES? > Come on now! It's been public knowledge for quite some time that the NSA > has a backdoor to DES and the FBI and other agencys know it. Its public knowledge? were's the proof? Not one academic researcher has found it (and lived to publish about it). On the other hand some very respectable cryptographers have been able to show that the design critereon has made for very well chosen parameters. The FBI has shown that they dont know a backdoor in DES or at least they wont use it against suspects. There have been cases were data was encrypted with DES and the suspect refused to turn over the keys. > > I certainly hope you were kidding! > > -- > Bob Tannen > Borland International > 1800 Greenhills Rd. > Scotts Valley, CA. 95066 > > rtannen(a)borland.com > RTANNEN @ BORLAND (MHS) >

8 10

PGPcompose, a mail wrapper
by nate＠VIS.ColoState.EDU 11 Jul '93

11 Jul '93

-----BEGIN PGP SIGNED MESSAGE----- CypherPunks, I have been looking for a good mailer lately, or at least a mail wrapper to sign and encrypt my mail easily. I was not completely satisfied with the wrappers that I could find, and especially since they mostly need perl. So, in a fit of frustration, I did what any good CypherPunk would do: I wrote one. It is called "PGPcompose" and if you invoke it with a username, it will prompt for the subject, open vi for editing, then ask you if you want to sign the message, and encrypt it (either, or both), then it asks for the key to use for encryption (if you choose to encrypt the message). It will then ask if you want to send, edit, or abort the message. it uses /usr/ucb/mail instead of sendmail, since I could not figure out how to parse the ~/.mailrc file, and since it took less than a few hours to hack out. Anyway, here it is, it's free, so do whatever you want with it. - ---------------------BEGIN PGPcompose------------------- /* "PGPcompose" (comp) -- a replacement for the mail composition */ /* program. It allows for PGP signatures and encryption */ /* for mail. It asks for the ID of who the file is to be */ /* encrypted for... I did this because I have lots of */ /* public keys, and some of the other mailers became */ /* confused on occation and did not find the right key to */ /* use for the encryption. It also asks if you want to continue, */ /* abort or edit the message... */ /* */ /* This software is free for the taking... if you modify it, send */ /* me the modification, since I'll be curious. */ /* -nate sammons, July 11, 1993, nate(a)vis.colostate.edu */ #include <stdio.h> main(int argc, char *argv[]) { int intPID; int signMess, cryptMess; char subject[130]; char cryptWho[100]; char charPID[10]; char theChoice[5]; char messageName[100]; char messageHeaderName[100]; char messageCypherName[100]; char commandLine[300]; char scriptName[100]; FILE *tmp; FILE *script; FILE *message; intPID = getpid(); tmp = fopen("/tmp/PID.tmp", "w"); fclose(tmp); tmp = fopen("/tmp/PID.tmp", "a"); fprintf(tmp, "%d", intPID); fclose(tmp); tmp = fopen("/tmp/PID.tmp", "r"); fscanf(tmp, "%s", charPID); fclose(tmp); strcpy(messageName, "/tmp/message.tmp."); strcat(messageName, charPID); strcpy(messageCypherName, "/tmp/message.cypher."); strcat(messageCypherName, charPID); strcpy(scriptName, "/tmp/message.script."); strcat(scriptName, charPID); message = fopen(messageName, "w"); switch(argc) { case 2: printf("PGPcompose, (c)1993 Nate Sammons\n"); printf("Subject: "); gets(subject); editIt: strcpy(commandLine, "vi "); strcat(commandLine, messageName); system(commandLine); signIt: printf("Sign this message? [y,n] : "); gets(theChoice); switch(theChoice[0]) { case 'y': case 'Y': signMess = 1; break; case 'n': case 'N': signMess = 0; break; default: goto signIt; break; } cryptIt: printf("Encrypt this message? [y,n] : "); gets(theChoice); cypherWithWho: switch(theChoice[0]) { case 'y': case 'Y': printf(" With whose key? : "); gets(cryptWho); if (cryptWho[1] == NULL) { goto cypherWithWho; } cryptMess = 1; break; case 'n': case 'N': cryptMess = 0; break; default: goto cryptIt; } Continue: printf("send, abort, edit? : "); gets(theChoice); switch(theChoice[0]) { case 's': case 'S': goto sendIt; case 'a': case 'A': system("/bin/rm -rf /tmp/message*"); system("/bin/rm -rf /tmp/PID.tmp"); exit(0); case 'e': case 'E': goto editIt; default: goto Continue; } sendIt: if((signMess == 1) && (cryptMess == 1)) { script = fopen(scriptName, "w"); fprintf(script, "cat %s | pgp -feast +clearsig=on \"%s\" > %s\n", messageName, cryptWho, messageCypherName); fclose(script); strcpy(commandLine, "chmod +x "); strcat(commandLine, scriptName); system(commandLine); system(scriptName); script = fopen(scriptName, "w"); fprintf(script, "cat %s | /usr/ucb/mail -s \"%s\" %s", messageCypherName, subject, argv[1]); fclose(script); system(commandLine); system(scriptName); } if((signMess == 1) && (cryptMess == 0)) { script = fopen(scriptName, "w"); fprintf(script, "cat %s | pgp -fast +clearsig=on > %s\n", messageName, messageCypherName); fclose(script); strcpy(commandLine, "chmod +x "); strcat(commandLine, scriptName); system(commandLine); system(scriptName); script = fopen(scriptName, "w"); fprintf(script, "cat %s | /usr/ucb/mail -s \"%s\" %s", messageCypherName, subject, argv[1]); fclose(script); system(commandLine); system(scriptName); } if((signMess == 0) && (cryptMess == 1)) { script = fopen(scriptName, "w"); fprintf(script, "cat %s | pgp -fea \"%s\" > %s\n", messageName, cryptWho, messageCypherName); fclose(script); strcpy(commandLine, "chmod +x "); strcat(commandLine, scriptName); system(commandLine); system(scriptName); script = fopen(scriptName, "w"); fprintf(script, "cat %s | /usr/ucb/mail -s \"%s\" %s", messageCypherName, subject, argv[1]); fclose(script); system(commandLine); system(scriptName); } if((signMess == 0) && (cryptMess == 0)) { script = fopen(scriptName, "w"); fprintf(script, "cat %s | /usr/ucb/mail -s \"%s\" %s", messageName, subject, argv[1]); fclose(script); strcpy(commandLine, "chmod +x "); strcat(commandLine, scriptName); system(commandLine); system(scriptName); } system("/bin/rm -rf /tmp/message*"); system("/bin/rm -rf /tmp/PID.tmp"); break; default: printf("Useage: comp username\n"); exit(0); } } - ---------------------END PGPcompose--------------------- - -nate sammons +-------------------------------------------------------------------- | Nate Sammons email: nate(a)VIS.ColoState.Edu | Colorado State University Computer Visualization Laboratory | Finger me at nate(a)monet.VIS.ColoState.Edu for my PGP key | #include <std.disclaimer> | "I have but one single desire - to tear down the sky" -A. Toomba +----------------------+ -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLECF4NTgi1fmrpxlAQGhbgP6AiZCyU2+qf5O06r3mE1JB4XWDocuK175 CO/HJU/8+QekgBG7+6PewERnqLt0pVPuTVmdWkHJyQ+VJyrPRiDlWzI7G2yJqwvG sTCI9CT6cHbp0jBRzQhj48SFcN+Gr+nZ06Nc8/93X7/+QGZVtz+0MMTFXz8oVcEe TWYeBNkXhDg= =P0IW -----END PGP SIGNATURE-----

1 0

No Subject
by akcs.brendan＠vpnet.chi.il.us 11 Jul '93

11 Jul '93

Unsubscribe

1 0

Re: Secure comm program, Sockets + LINK
by jim＠tadpole.com 11 Jul '93

11 Jul '93

> Supose you opened up a socket on the local machine. And that you > ran your usual telnet to connect to it. The program listening on the > local socket would be responsible for running one end of a 'LINK' like > secure protocol. It would connect to either the remote telnet socket, > or a special purpose socket at the remote end. There either you can > use a pipe to a pty (standard telnet -> login shell -> LINK -> pty), > or in a special socket through LINK out the telnet socket. (There is > an obvious extention with multiple hops through LINK-socket programs > which should provide the same kind of anonymity that is provided by > the CP remailers.) This is the kind of thing which is just perfect for a streams-based tty/networking environment. Create a streams module that implements Link and DH key excng. Push it on your tty stream at both ends. Works over modems, telnet/rlogin, what-have-you. A similar module could be created to sit below the IP module in SVRx-based Un*xes. > It is also likely to be obsoleted as soon as secure-ip gets out. And once the vendors for both endpoints update to it. Could be a while. > Infact it would be nice to see some socket (perhaps 32?) become the > standard for the secure telnet service. I think it would be much better to develop something that will work with the current port numbers, else we stand a good chance of asking for a 'new' secure port foreach well-known service. (Secure SMTP, Secure ftp-cmd, secure ftp-data,...) Jim

2 1

Re: REMAILER: really anon?
by Carlos Macedo Gomes 11 Jul '93

11 Jul '93

> If you can trace the origin (sender) of this message please send me mail > personally rather than to the list. I'm using my favorite remailer here > and I want to make sure it's working right. [stuff deleted] > My main curiosity in this quest is to determine what each header will look > like when the mail is recieved. I think this is important in determining > which remailer to use. [stuff deleted] > Thanks! > -z > **Please take note of remailer 12 of this list.** 12: remail(a)tamsun.tamu.edu > From: remail(a)tamsun.tamu.edu > Remailed-By: Anonymous <remail(a)tamsun.tamu.edu> > > Received: by tamsun.tamu.edu id AA04104 > (5.65b/IDA-1.4.3 for you@yourhost); Tue, 6 Jul 93 04:15:57 -0500 > > you@yourhost = your address! ...really! > > 13: remail(a)tamaix.tamu.edu > > From: remail(a)tamsun.tamu.edu > Remailed-By: Anonymous <remail(a)tamsun.tamu.edu> The remailed email from tamsun and tamaix have the same format, but you have interpreted the headers incorrectly. Please note that you@yourhost mentioned above is not the sender's address but rather the recipients address. You might have been confused by this if you were sending and reading from the same account. The mail from tamsun and tamaix IS anonymous. Take a look at this piece of the header for your message to the cypherpunks list: Received: by tamsun.tamu.edu id AA24627 (5.65b/IDA-1.4.3 for cypherpunks(a)toad.com) Fri, 9 Jul 93 16:21:06 -0500 As you can see you@yourhost as you demarked in your message actually refers to the recepient's address and not the sender's. If I have misunderstood your message, please excuse. I just felt compelled to clear any doubts about the anonymity of these two remailers. Please feel free to reply to me personally if you'd like to get a close look at the remailers. ciao, Carlos -- [ Carlos Macedo Gomes ][ Quis Costodiet ][: .8. :]------ [ gomes(a)tamu.edu ][ Ipsos Custodes? ][ . ooo . ]000000 [ cmghelp(a)tamsun.tamu.edu ][ ----------- ][ : =o(Y)o= : ]000000 [ PGP 2.2 key by finger ][30 37 40 N, 96 20 03 W][oo .ooooo. oo]------

1 0

Re: Secure comm program, Sockets + LINK
by jpp＠markv.com 11 Jul '93

11 Jul '93

Oops, ignore that previous message. It got away from me (*blush*). j'

1 0

Re: Secure comm program, Sockets + LINK
by jpp＠markv.com 11 Jul '93

11 Jul '93

Andrew Betty KCA=Initial key K0 in s/w KCB=Initial key K0 in s/w KCB=Initial key K0 in s/w KCA=Initial key K0 in s/w KCi= KCA + KCB KCi= KCA + KCB KCo= KCA + KCB KCo= KCA + KCB Use KCi for reading, and Use KCi for reading, and KCo for writeing to the KCo for writeing to the chanell for a while chanell for a while Requset a new sesion key Requset a new sesion key DES(KCo,RSA(BP,K1A)) KRB=DES(KCo,RSA(AP,K1B)) \_____________ ______________/ KCi=KCA+KCB \ / KCi=KCB+KCA KCo=K1A+KCB X KCo=K1B+KCA _____________/ \______________ / \ Sevice new key request TA=DES(KCi,KRB) K1B=RSA(AS,TA) KCi=K1A+K1B

1 0

My Poll....
by J. Michael Diehl 10 Jul '93

10 Jul '93

Well, I finally got to look at the responses to my poll. FYI, I got 33 replies. This is a small number considering there are (I think) 400+ people on this list. I didn't take the time to actually tally the results for each question. I'm inherently lazy... ;^) I can make some comments about what we use, tho. Note that the lists are in no particular order. Since this was certainly not a scientific poll, I opted to not include any statistics, sorry. I was kinda hoping to have a more homogeneous environment than what we have. Kinda naive, huh? Well, this is what I have to say after reading each of your replies. I would like to thank everyone who participated in my informal poll. I hope the results are usefull to any software-developer-cypherpunks out there. The systems that we use tended to be (IMHO) hi-end PC's, 386's and better. Macs were a close second, with various *nix's forming a large block. This isn't any suprise. The actuall list: PC, NCube, Sun, Mac, IBM RT, IBM RS/6000, DEC/MIPS, VAX, NeXT, HP 7xx, Cray, SGI Indigo, Amiga. As for OS's, MSDOS was, again, the clear winner. It would seem that many people are going from dos, to one of the various (free) unix's for the PC. I didn't know it was so widespread. The list: MSDOS, BSDI BSD/386, SunOS, A/UX, 4.3BSD, UNICOS, Ultrix, Linux, MacOS, HP/UX, NeXTStep, Solaris, AIX, System, IRIX, AmigaDos, vm, DESQview. There are more Cypherpunks who refuse to use online services than use them. Of those who do use online systems, and I counted bbs's and internet as an online system, these are the systems we use: The WELL, MCI, Prodigy, Compuserve, GEnie, AOL, BBSs, netcom, Internet, Fido. I didn't know there were so many mail readers..... SLMR, MH, pine, elm, emacs, Cyberdesk, Mush, NeXTMail, NUpop, GRn, QWK, Eudora, dxmail, LOCALLY DEVELOPED I was shocked to find that people still use pgp v2.1. Why? Also, unix pgp made a strong showing, considering it probably isn't very secure in that environment. The only versions mentioned are: 2.2, 2.1, MacPGP 2.1, unix. I know of other versions, tho. This poll was motivated by all of the talk about writing a secure comm program. Judging from how many different programs in use now, it will be hard to write a program which will please everybody. I also wonder if any of the telix users find telix to be very much like procomm; I did. Of the telix users, would you be interested in helping me test my mail scripts, and perhapse writing extensions for other mail readers, if needed? Hope to hear from you. Anyway, here is the list of the comm programs which we use: MacSamson, JComm, Term, QuickLink II, PPP/SLIP, Seyon, UUPC, Telix, Z-Term, procomm, Kermit, vlt, White Knight, Eudora, QModemPro, Procomm Plus, Telemate, tapcis. +-----------------------+-----------------------------+---------+ | J. Michael Diehl ;-) | I thought I was wrong once. | PGP KEY | | mdiehl(a)triton.unm.edu | But, I was mistaken. |available| | mike.diehl(a)fido.org | | Ask Me! | | (505) 299-2282 +-----------------------------+---------+ | | +------"I'm just looking for the opportunity to be -------------+ | Politically Incorrect!" <Me> | +-----If codes are outlawed, only criminals wil have codes.-----+ +----Is Big Brother in your phone? If you don't know, ask me---+

4 3