- cypherpunks-legacy@lists.ogf.org

Security in a VR world
by poier＠sfu.ca 02 Jun '93

02 Jun '93

-----BEGIN PGP SIGNED MESSAGE----- For anyone interested, there is a discussion on the multiverse maillist at multiverse(a)medg.lcs.mit.edu about "portal security", that is, the ability / inability for certain users passing through certain "portals", as well as verification of user identity... Unfortunately, the developer is in Europe, and as we all know, PGP is export-controlled... :( Skye - -- - -----====> Skye Merlin Poier <====----- Undergrad in CMPT/MATH (Virtual Reality) |||| |||| email: poier(a)sfu.ca p-OO <--> OO-q THINK PGP Public Key available on finger \== ==/ -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLAzWoy0bkpXW3omvAQFpVQQAvN+Q+fj+04DGgjXAyDhsBcRG5QEXES3a u6/lTKzhyqZEOCVX+ObivZOLUrc7OsbED0hGE4Wn/jIEeoeM//b9cA10JmTYu1Ce WgXPPuAa+YKAin9dMdIxNNiTzSaQhx+dQ3saPssQ45ErYWCPiix4ceBJWuITZJEG 9RfehK/yLws= =rHJv -----END PGP SIGNATURE-----

2 1

Re: Clipper replacement chip
by fnerd＠smds.com 02 Jun '93

02 Jun '93

RYAN Alan Porter <rtfm!rtfm.mlb.fl.us!ryan(a)mlb.semi.harris.com> sez > Just out of curiosity, does anyone on the cypherpunks list posess the > technical skills that would be necessary to begin a project of hacking out > a pin compatible version of the Clipper that didn't have the backdoors > once the chip is out, a la AMD and CYRIX? > ... > So I guess the really important question is: does anybody know how to > reverse engineer a chip and build a duplicate, pin-compatible device from > the ground up while hiding from the feds the whole time and still managing > to make a living? Well, there's an easier end-run: a piggyback board. This would plug into the Clipper's slot, and the Clipper would plug into it. Then it could either run in Clipper or PGP/DH-IDEA/Whatever mode. I don't understand enough about the Clipper protocols and interface to know whether there's room to squeeze in bits to signal which of these two modes, unbeknownst to the rest of the phone, but you could certainly attach a Clip vs. Secure switch. -fnerd

1 0

CryptoStacker
by RYAN Alan Porter 02 Jun '93

02 Jun '93

Thanks for all of the responses on my questions concerning the CryptoStacker idea. I am kind of sick of talking about it though, and so I went out today and did some research on drivers and such. I am planning to create a software implementation of a PGP driver starting maybe tomorrow (I am being payed real dollars to write other code at the moment) for on-the-fly HD encryption. I haven't quite figured out how to create a commercially distrubutable system yet, but there really is no point sitting around arguing about this and that detail until somebody actually goes out and tries it... I have a feeling that this version will be slow as balls without hardware support, but that's not really the problem, is it? The main focus that I have right now is making the thing work. There have been lots of neat suggestions about multiple layers and suchlike tooalso, which are all fine and dandy, but they kind of missed the point: mainly what I am interested in is preventing access to the data on my HD by anyone but ME, screw LANs and multi-user problems and all of that, I just want to create a system whereby if the Secret Service busts down my door tomorrow while I am not here to throw the drive across the room, they will never be able to fetch out any incriminating evidence by picking apart my system in some lab somewhere. I can also see the advantage of a business worrying about spying, or even government agencies (wouldn't that be ironic) worrying about security and considering networks insecure. Anyway, we can add bells and whistles like network support and multiple layers and suchlike after we figure out how to get the basic engine to work, right? I have also seen everyone suggesting DES instead of PGP. I suppose that would really be a great idea for speed and suchlike, for some reason I was kind of attached to the whole public key idea, but I suppose that would be kind of close-to-worthless in this context, wouldn't it? I suppose we are to the point where I can use some actual technical advice, no need to reinvent the wheel, right? If anyone has any information of the overall architecture of projects like Stacker or DoubleStor, I would appreciate the input. I have used both in the past and I am kind of leaning toward a system like DoubleStor (which maintains directory structures and such, but compresses each file in place) for simplicity, but I am kind of hesitant to leave even a hint of the overall structure of the disk laying around for prying eyes. Trouble is, I don't have much experience screwing around with the FAT and such so I wouldn't want to do anything so bold as munching the entire disk into a single file and suchlike. Any ideas? -Ryan the Bit Wallah

2 1

Re: Electronic Contracts
by wcs＠anchor.ho.att.com 02 Jun '93

02 Jun '93

Don't know if there have been specific tests of it in courts, but, yes, signing contracts is definitely something people want digital signatures for. Also, anything else that requires a signature, we'd like to be able to sign digitally, so we can do it online instead of hauling paper around. That's not just a cypherpunk thing, it's what a large fraction of the business community would like to be able to do - it speeds business cycles, cuts ordering time, and means we don't have to keep all this paper around, especially in storage; while the paperless office won't be reality for a while, it would really be nice if we could store the important stuff digitally, where it's easy to retrieve later, and save paper for transient uses like convenient reading, unlike the current situation where digital is for convenience but the important stuff is paper that has to be stored somewhere MIME-Insert-Video-Clip: Indiana Jones, Government Warehouse Scene..... A certain amount of this has been done with the various telex networks; I get the impression from somewhere that a telex can be a legal document for things like sending purchase orders, just like paper can; it will be interesting to see if fax acquires the same status, but forging a fax is terribly easy, just as email is. Bill Stewart

3 2

ADMIN: incoming ftp site works now
by Eric Hughes 02 Jun '93

02 Jun '93

I've arranged so that the pub/cypherpunks/incoming directory will accept uploads now. So if you have stuff to send, please ftp it to that directory rather than using e-mail. Of course, if you don't have ftp access, please continue to use email. For those of you who tried this before, the problem was that the wuarchive ftpd that the system was running needs a line in its configuration file to say that uploads are peritted in a directory. Eric

1 0

RE: Software infrastructure
by Pat Farrell 02 Jun '93

02 Jun '93

In Message Tue, 1 Jun 1993 22:13:48 -0500, Eric Hughes <hughes(a)soda.berkeley.edu> wrote: >Let's go back to the DOS-as-terminal issue. The politics and >economics of DOS shareware is such that source code is almost never >made available. > >I propose that interested cypherpunks write a DOS terminal program >which _is_ free software. I think writing a "terminal" program, such as Kermit, is not particularly useful. I am writing a SMTP/POPPER client program that will work over standard serial (dial-up) lines. It will not require SLIP, PPP, or any other magic (mostly because getting _my university_ to provide competent TCP/IP access is impossible). Enhancing it to support SLIP or PPP will be simple, but it is not the market that I'm aiming at. Clearly any decent mail client has to have a roledex of commonly accessed coorespondents. It is trivial to enhance the data structure to add a flag that says "Use encryption" and another with "PGP (or RIPEM) key available" and another to hold a handle (PGP's 0x123456) that identifies the key. Spawning your favorite encryption program is then also trivial. The audience is not the cypherpunks. The audience for strong cryptography is the art, history, econ or english major. It has to be "pig easy" and reliable. My program is written for Windows. Like it or not, Windows has 80% or more of the total computers being sold. I want my mailer client to reach mass markets. The program will be free, and sources will be available under some restrictions that I haven't yet figured out. In a while, I'll be looking for beta testers. Pat Pat Farrell Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

1 0

Re: FYI: White House Mail
by Mark 02 Jun '93

02 Jun '93

> President Clinton Vice President Gore > > PRESIDENT(a)WHITEHOUSE.GOV VICE.PRESIDENT(a)WHITEHOUSE.GOV Hmm, 10 bucks says some larrikin sends fakemail from PRESIDENT to VICE.PRESIDENT asking him 'what this little red button does' etc. Though in real.life I suspect 10 press secretaries sitting behind the mail alias. They're going to need them. Lets hope no one is stupid enough to try busting into there... Mark mark(a)coombs.anu.edu.au

1 0

GIMME YOUR GOODIES!
by Stanton McCandlish 02 Jun '93

02 Jun '93

NitV is still hoarding all sorts of PGP utils for any and all platforms, mail systems, and potential uses. If you make anything new, please send it along (uu it, or upload it to the board, or whatever). I get QUITE a few calls for such material (suprisingly much of the Unix stuff is downloaded, and long distance at that, so I guess there is a lot of value in having a BBS-based, multi-platform crypto-tools site.) I MUCH prefer to get the new material direct from the author, so please do send it!! Help spread crypto to the OtherNets! -- When marriage is outlawed only outlaws will be inlaws! Stanton McCandlish, SysOp: Noise in the Void DataCenter Library BBS Internet anton(a)hydra.unm.edu IndraNet: 369:1/1 FidoNet: 1:301/2 Snail: 1811-B Coal Pl. SE, Albuquerque, New Mexico 87108 USA Data phone: +1-505-246-8515 (24hr, 1200-14400 v32bis, N-8-1) Vox phone: +1-505-247-3402 (bps rate varies, depends on if you woke me up...:)

1 0

Another chaining utility
by nobody＠soda.berkeley.edu 02 Jun '93

02 Jun '93

I am working on a utility I call "chain" which is inspired by Karl Barrus's hopmail and related scripts. I am sending this message with the command: chain -m -s "Another chaining utility" cypherpunks(a)toad.com caltech jarthur extropia soda The "-m" means for chain to pipe its output into sendmail so that it is actually sent (otherwise it just writes to standard out and you have to arrange to mail it on your own). The "-s" sets the subject for the last leg of the message to the following arg. Then comes the destination address, then a list of remailer nicknames, which are just substrings of the remailers, read from an initialization file. This message is passing through four remailers. The "-m" feature is implemented only on Unix systems. On DOS you always get the output in a file and then send that however you normally would. I also have a "-e" switch which encrypts the message using a public key looked up by the destination address. Cypherpunks doesn't have a public key so that's not appropriate here. But if I wanted to send an encrypted note to, say, Phil Zimmermann, I could just do: chain -em prz(a)sage.cgd.ucar.edu portal mead Hi, Phil, give me a call when you have a chance -- Hal ^D and it would go via the Portal and Mead remailers, encrypted at each step, and finally to Phil, encrypted with his public key. Pretty easy. I couldn't get Karl's hopmail.bat to run on my PC (not enough environment space?) so I wrote this in C and it works OK. I'll be sending the code to Eric to be archived in a few days. If anyone has any wish lists for features I will be glad to try adding them. (I am composing this on a Unix system in order to demonstrate the -m switch, so I can't cleartext sign as I normally would. I am in the vi editor and I am sending the message with "1G!G", which tells vi to pipe the whole file into a command, followed by the "chain" command line above, verbatim. That's all there is to it.) Hal Finney 74076.1041(a)compuserve.com

1 0

EFF, AT&T, Clipper, and $
by greg＠ideath.goldenbear.com 02 Jun '93

02 Jun '93

Eric Hughes writes: > The EFF is going to be involved with the cryptography issue. More > than that and I defer to John Gilmore, who is on the EFF board and > this list and who can speak more authoritatively than I. The 5/24/93 issue of "The New Republic" has a (largely uninteresting) cover story about Mitch Kapor and the EFF. One interesting tidbit gleaned from that article, however, was that AT&T has contributed money to the EFF. I am particularly curious to see how AT&T and the EFF will deal with each other with respect to the Clipper chip, and the politics around that. If anyone knows anything more about this, I'd love to hear it. -- Greg Broiles greg(a)goldenbear.com Golden Bear Computer Consulting +1 503 465 0325 Box 12005 Eugene OR 97440 BBS: +1 503 687 7764

1 0