- cypherpunks-legacy@lists.ogf.org

Re: Term software development/design
by Mark 03 Jun '93

03 Jun '93

Those of you with a 386 or greater and over 40Mb Hd (most of the pc's these days are usable) might want to take a look at running linux/386bsd/netbsd at home and then running term(1). It's a program with it's own packetising, compression of data (which is good for a quick and nasty anti-tap system) and you can telnet, rsh, ftp, finger etc all from the unix command line of your home machine. Uploads etc can all be done at the same time as you read mail on a remote host. the lastest version is term107.tar.z and should be avaliable from most archie sites. It has #defs for suns, nexts, hps, linux etc. When i find the guy who wrote the telnet client for it I'll probably add des encryption to it. The above is for plain modem usage, it's a semi tcp link at home and you can dial anywhere and link up in seconds, no special system file changes, just compile the remote binary and you're away. If you're just using the dialup host as a bouncer then all that is running is one innocuous looking binary, even though you might have several ftp's and telnets etc running at once. Honestly it's an admins nightmare. Linux etc also has slip and inet options if you want to explore those. The only problems I find are people being unable to listen (usefully) to your sessions and killing the line :) Most of the tools are written I find, all thats needed is the adding of encryption to them for a totally secure session. No need to write another term program, just use whats out there. Mark mark(a)coombs.anu.edu.au

1 0

Re: WH email petition.
by dmandl＠lehman.com 02 Jun '93

02 Jun '93

> In general, petitions are a notoriously ineffective way to lobby. > That's doubly so for email versions, for obvious reasons. Even > without that problem, an electronic petition will (rightly) be ignored > on the grounds that it represents the opinions of a small elite > minority. With signatures collected in the streets and shopping malls > of America, you have at least some chance of reaching a cross-section > of people. But on the net? (And even if I'm wrong about the net's > population, would they know it?) > --Steve Bellovin In general, I agree that petitions are a major waste of time and energy; I'm also pretty convinced that this White House email link is a big scam. Why are they any more likely to take your mail seriously just because it comes over the phone lines and not in an envelope? Seems like a pretty transparent PR ploy (also an attempt to make it seem like the White House isn't a bunch of dinosaurs now that everybody and her nephew has an email address). But since it won't take much more than a couple of minutes of any of our time, I can't see an electronic petition hurting our cause any--especially because it'll certainly include the names of many esteemed professionals and braniacs with fancy scientific, corporate, and academic credentials. I think this could be a nice propaganda coup if it got publicised. It could at the very least give a big black eye to the forces of evil. --Dave.

2 1

Mail probs
by miron＠extropia.wimsey.com 02 Jun '93

02 Jun '93

----- Transcript of session follows ----- uux: creat (TMP0000001297): Permission denied 554 elee7h5(a)rosebud.ee.uh.edu... unknown mailer error 1 ----- Unsent message follows ----- Hopefully the originator of this anon message is on the list. Miron

1 0

help: P.S.
by John_David_Galt＠cup.portal.com 02 Jun '93

02 Jun '93

We have ftp here, but pax.tpa.com.au will not accept an ftp connection. If you know of a site that will, that has PGP, please, where is it? thanks. John David Galt

1 0

PGP
by MaxDemon＠cup.portal.com 02 Jun '93

02 Jun '93

How do I get the server to send me PGP22.ZIP and PGP22SRC.ZIP without breaking up each file into pieces? I'm on a DOS machine and can't recombine them.

1 0

Software infrastructure
by nobody＠shell.portal.com 02 Jun '93

02 Jun '93

-----BEGIN PGP SIGNED MESSAGE----- Eric writes: > The second distinction is between stream and file encryption.If you > want to encrypt the underlying channel, you need a stream cipher and a > D-H key exchange. If you want file encryption, you want a block > cipher and public keys for communications. I don't think we should try to put stream encryption into this product. A problem with stream encryption is that it requires special SW on both ends. We would have to not only write a terminal program, but also write software which would transparently encrypt/decrypt which ran on the host and then passed the characters on to whatever command shell would normally run. I could see doing this with Unix (using pty's, a variant on the "script" program many systems have) but it may not be too portable. Stream encryption defends against wiretappers, and may provide some protection against the more trivial root-based attacks on the host computer (ones which just monitor the serial port - although if you use the pty idea there may be an internal serial port that has cleartext and which can be monitored). But you are still vulnerable to being monitored by root. I don't think the benefit gained is great enough, given the cost, to make this a good initial feature for the product. > This also implies the existence of offline mail readers. It is going to be hard to provide an offline mail reader with the friendliness of what the user is used to. Also, offline news reading is probably out of the question in this environment due to the great volume of news. Offline mail also has the problem that some people send great, huge messages that you aren't interested in. Online you just look at the first couple of pages and then delete it. Offline you download the whole thing, often paying for it, before you look at it. Another approach would be to have a "paranoid PGP" available on your host computer. This works much like regular PGP, except it will never ask you for your pass phrase. Any time it would, it instead outputs a magic escape sequence. This is recognized by your Cypherpunks terminal program and causes it to run a local program which includes PGP. The paranoid PGP on the host automatically downloads the file it was going to decrypt or sign to the local machine, which runs PGP, asks for your pass phrase, does the operation, and (perhaps) uploads the results back to the host. The whole thing is transparent if you are running the CP term, and your secret key and pass phrase never left your computer. (You might or might not want the plaintext to be uploaded after decryption - perhaps it could be previewed locally and if it's not too "hot" you can upload it and reply to it on the host.) Under this approach, message ENCRYPTION could be just done on-line since paranoid PGP doesn't need a pass phrase for that. So you can compose and mail your messages without needing any special support, as long as you don't sign them. You are still trusting the host, but not as much as if you left your secret key there and typed your pass phrase into the host computer. This is less secure than if you did everything on your PC but lets you use the powerful editing and mail/news handling capabilities of your host. This approach does have the same disadvantage I listed with respect to stream encryption, that it requires some special software on the host. However, this software should have many fewer host dependencies than a transparent stream encryptor would. Hal Finney 74076.1041(a)compuserve.com -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLAypvagTA69YIUw3AQECTgQAq/dvZ1EExP1GYzKlQcxhMIPT9TExxIes 25L8ZwG5syA6+KEcL2pSfnoPe1l9ZixCjefUnNiy9MYAHBh8uo8IEZ/IoCArSbvs ImUjayxZjWugHZaBIUsOo/dk5VbX/1tY3CW1eN2wItvtF1RQYk1QPjCYFgECqKeY UtRAd2p/JqI= =GAGr -----END PGP SIGNATURE-----

1 0

[galvin@TIS.COM: Privacy Enhanced Mail available via anonymous FTP]
by eichin＠ATHENA.MIT.EDU 02 Jun '93

02 Jun '93

It is interesting to note that the LICENSE says: >> This license permits you to: >> b. create and sign certificates for people and entities >> within your own organization; _Mark_ Message-Id: <9306022052.AA09067(a)TIS.COM> Reply-To: James M Galvin <galvin(a)TIS.COM> To: TISPEM.Announcement:;@TIS.COM, ietf(a)cnri.reston.va.us, pem-dev(a)TIS.COM, rsaref-users(a)rsa.com, saag-interest(a)TIS.COM, psrg-interest(a)isi.edu Subject: Privacy Enhanced Mail available via anonymous FTP Date: Wed, 02 Jun 93 16:51:17 -0400 From: James M Galvin <galvin(a)TIS.COM> Sender: pem-dev-relay(a)TIS.COM -----BEGIN PRIVACY-ENHANCED MESSAGE----- Proc-Type: 4,MIC-CLEAR Content-Domain: RFC822 Originator-ID-Asymmetric: MFMxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJNRDE kMCIGA1UEChMbVHJ1c3RlZCBJbmZvcm1hdGlvbiBTeXN0ZW1zMREwDwYDVQQLEwh HbGVud29vZA==,02 MIC-Info: RSA-MD5,RSA,ndrjfb54QirydT4/KLgg9HJh+5k0ON+bj9Wil5LeVTE 3E0ST0Bmv12KbChUn5MhxpH556ur0TbWTjl8/csLK52ARxGs0VJlzKfNOWL00SbB JfuyLIM6RLF9uE2ZBNNjP Trusted Information Systems, in cooperation with RSADSI, is pleased to announce the availability of Version 6.0 of TIS/PEM, the Internet reference implementation of Privacy Enhanced Mail. This software is available to US and Canadian organizations and citizens via anonymous ftp. All source code is included, including Version 6.7 of the Rand MH message handling system and Version 1.02 of RSAREF. To retrieve TIS/PEM please FTP to host: ftp.tis.com login: anonymous and retrieve the files pub/PEM/README pub/PEM/LICENSE The README file contains further instructions. The LICENSE file contains the restrictions and rules governing use of TIS/PEM. Please read this file before retrieving the code. Send questions to tispem-support(a)tis.com -----END PRIVACY-ENHANCED MESSAGE-----

1 0

Newsweek article, "The Code of the Future"
by fergp＠sytex.com 02 Jun '93

02 Jun '93

-----BEGIN PGP SIGNED MESSAGE----- On Tue, 1 Jun 93 18:56:10 -0700, Timothy C. May <uunet!netcom.com!tcmay> wrote - > Subject: "Newsweek" Article on Clipper and Encryption When I read this message this morning, I made a bee-line down to the kiosk in the lobby and bought it (the June 7th issue of Newsweek). It must've just hit the stand, because the issues were still bound with rubber bands. (Thanks, Tim, for taking the time to commit it to ASCII, BTW.) This is good. Clipper articles have appeared in The New York Times, The Washington Post and now, Newsweek. This is exactly the exposure that is needed. One thing that you didn't include (its rather trivial), that I tacked onto the end of this post, is a very, very brief history of Cryptography - - - -- "Great Moments in Cryptography 1900 B.C. Menet Khufu, Egypt Into the rock of a nobleman's tomb, a master scribe carved unusual symbols rather than the standard hieroglyphics. The intent was to impart a grandeur to the message, the oldest known cryptographic text. Jan. 17, 1917 London Britain decodes the 'Zimmerman' telegram from Berlin to the German ambassador in Washington. Describing a plan to give Mexico the U.S. Southwest, it helped draw an outraged America into World War I. Dec. 7, 1941 Washington, D.C. Navy spies crack a message from Tokyo to its embassy in Washington saying it will break off talks with the U.S. at 1 p.m. -- dawn at Pearl Harbor. The navy spies miss the import of this; Tojo strikes unopposed. Nov. 4, 1952 Washington, D.C. Truman creates National Security Agency, master of math-based codes." - - -- To which, I add my own date to remember - "Infamous Moments in Cryptography Apr. 16, 1993 Washington, D.C. The Clinton Administration announces introduction of the 'Clipper Chip,' a cryptographic scheme developed by the NSA under the auspices of the National Institute of Standards and Technology (NIST). Under 'Clipper,' monitoring high-tech communications is made simpler for law enforcement agencies and privacy becomes a secondary triviality." I can only keep my fingers crossed that we see more articles like this geared to informing the public of this ruse. -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLA0R05RLcZSdHMBNAQE5JgP/TFsJ6aF7+4lMIQjHSQw3qevwT45R+FIg rw5wNDIi7BO3A2rLyDE35rhJsekj6MB3Jg002K1Dy4W0lzT7pb9fkUcwt0H0mQXK 3BuZti59/grD6gfPPgkBHnC8XsH7sHnOV6OsZM1T8eusWofEp541l5bI9RsfnRsM qYnv1S3i+2c= =H9UT -----END PGP SIGNATURE----- Paul Ferguson | The future is now. Network Integrator | History will tell the tale; Centreville, Virginia USA | We must endure and struggle fergp(a)sytex.com | to shape it. Stop the Wiretap (Clipper/Capstone) Chip.

1 0

RE: Work the Work!
by fergp＠sytex.com 02 Jun '93

02 Jun '93

-----BEGIN PGP SIGNED MESSAGE----- Date: Tue, 1 Jun 93 21:32:24 -0700 Eric Hughes <uunet!soda.berkeley.edu!hughes> wrote - > Paul, you of all people don't need to feel slighted when I urge > people to do something, anything, about the wiretap chips. Agreed. There are many, many things that we need to do to support opposition to this ruse. > Here is my own very short version of my policy toward the wiretap > chips: > "The government has no right to restrict my use of cryptography in > any way. They may not forbid me to use whatever ciphers I may like, > nor may they require me to use any that I do not like." Hear, hear. > The hypothetical backdoor in clipper is a charlatan's issue by > comparison, as is discussion of how to make a key escrow system > 'work.' Do not be suckered into talking about an issue that is not > important. If someone want to talk about potential back doors, refuse > to speculate. The existence of a front door (key escrow) make back > door issues pale in comparison. > If someone wants to talk about how key escrow works, refuse to > elaborate. Saying that this particular key escrow system is bad has a > large measure of complicity in saying that escrow systems in general > are OK. Always argue that this particular key escrow system is bad > because it is a key escrow system, not because it has procedural > flaws. > This right issue is that the government has no right to my private > communications. Every other issue is the wrong issue and detracts > from this central one. If we defeat one particular system without > defeating all other possible such systems at the same time, we have > not won at all; we have delayed the time of reckoning. Very lucid and wise observation. I have suggested several times that attention should also be directed to the (what I call) "potential factor" in regards to the entire "key escrow" system. The potential for abuse and unconstitutional invasions of personal privacy are ripe for the picking under this scheme. In my own public comment letter to the Computer System Security and Privacy Advisory Board, I stressed this fact and also pointed out that although the system was probably designed with good intentions (right), it will not prevent zealots and spooks from monitoring communications under certain circumstances. My other peeve is that after this "technology" has been entrenched (read: forced) on the public, I see the rug being pulled out from under the feet of any other crypto system available. That's also why I attach a great deal of importance to some form of PGP being developed where all parties (Phil Z., Jim B., and me) are happy (excluding Uncle S.). (But I suppose that's another topic...) Patriotically yours, -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLAzzZJRLcZSdHMBNAQEzEwP7BVrQ4KxuFgf19Dq0avHEq8fN4+k2lVFU UBPAZYWNwzyPV3IkmrFf4RGR84H/pdWm09GmYH5wptOuKEut0M5NzO30Z9+c2SW3 7FYr5TF2rygg0mHn6SDSiZZBLuLt/XqWIwGOzJBtrTnPsrLMqZ18Xk60lH3yqUme FzTiDxDnjqA= =wnNa -----END PGP SIGNATURE----- Paul Ferguson | The future is now. Network Integrator | History will tell the tale; Centreville, Virginia USA | We must endure and struggle fergp(a)sytex.com | to shape it. Stop the Wiretap (Clipper/Capstone) Chip.

1 0

Crypto/Clipper debate rages on in comp.risks
by fergp＠sytex.com 02 Jun '93

02 Jun '93

-----BEGIN PGP SIGNED MESSAGE----- For those of you who don't follow RISKS Digest (comp.risks): you're really missing some good stuff. At the risk of redundantly posting messages which may have already been discussed, I couldn't resist the opportunity to cross-post this portion of a response to Peter Junger's original post on "Risks of teaching the law without breaking it," where Mr. Junger expresses his displeasure and confoundedness of the export restrictions on simple (and all) cryptography. 8<----- Snip, Snip ------------ RISKS-LIST: RISKS-FORUM Digest Tuesday 1 June 1993 Volume 14 : Issue 67 >Date: Tue, 1 Jun 93 14:17:52 BST From: jharuni(a)micrognosis.co.uk (Jonathan Haruni) Subject: Re: Peter D. Junger's risks of teaching... (RISKS-14.6)5 Organization: Micrognosis International, London Peter D. Junger (junger(a)samsara.law.cwru.edu) wrote: > [ about his amusing and sad conundrum of being unable to teach law > students about a law without breaking it. ] I think that if you give your students copies of your comp.risks article, they should all be sufficiently disheartened with American law that they will quit the program and you can then present your lectures to a class devoid of foreign (or any) students. Alternatively, you could check passports at the door, and boot out foreign students during the parts of your class which are essential to American Sickurity. By doing so you will raise eyebrows well outside of the computer-and-law sphere of interest and you may bring this ludicrous situation into the limelight. But then, you may get sacked. Probably a much more effective solution to your problem, and one which has recently been proven perfectly legal and acceptable in an American court, would be for you to merely shoot dead all the foreigners in your class, after which you can speak freely. - ----[ remainder of post omitted ]------- -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLAz9X5RLcZSdHMBNAQHQnwP9F8asul5g8tl4hhb9cLJZ9rz+0UeNUQb2 aGK+Bhx6onigi/HwseMjZP3BFSDHUzB3IuzpIjkIBj1BBEB24ZCtZVx9i4M9cIwI wObnkA7YQ0LIr2Ut4d37vQRU36VyltprRB7toqhuGWpv1ZMAp91uNQ4H3tIgXMYL 6sUplUkFMGQ= =C1Qo -----END PGP SIGNATURE----- Paul Ferguson | The future is now. Network Integrator | History will tell the tale; Centreville, Virginia USA | We must endure and struggle fergp(a)sytex.com | to shape it. Stop the Wiretap (Clipper/Capstone) Chip.

1 0