- cypherpunks-legacy@lists.ogf.org

PGP: Environment protection for UNIX
by stig＠netcom.com 24 May '93

24 May '93

Phil & Cypherpunks: Here's a little program that demostrates a fairly simple way to immprove pgp security on multi-user systems.... main (int argn, char **argv, char **envv) { for ( ; *envv ; ++envv) { if (!strncmp(*envv,"PGP",3)) { char *c=*envv; while (*c) *c++=' '; } /* end of if */ } /* end of for */ system("printenv"); sleep(10); } It deletes from it's own environment any environment variable that begins with the string "PGP". It ain't bullet-proof but just by grepping the environment of netcom, I've identified several PGP users: yonder nickt centaur henderso This hack would prevent that... 'Course for UNIX, PGPPATH should default to $HOME/.pgp anyway. Not doin' the work I oughta be doing, Stig... /* Jonathan Stigelman, Stig(a)netcom.com, PGP public key on request */ /* fingerprint = 32 DF B9 19 AE 28 D1 7A A3 9D 0B 1A 33 13 4D 7F */

1 0

Re: cypto + compression
by bbyer＠BIX.com 24 May '93

24 May '93

In-Reply-To: <199305212303.AA21876(a)joes.GARAGE.COM> > In fact there are not. You can test this out; use PGP to encrypt any > file you please, and then use any compression software you like to > compress it. You will get no significant compression. I don't know if there will be any new redundancies or not, but PGP compresses it's output so you would naturally get no further compression. Ben Byer <bbyer(a)bix.com>

2 1

Re: Police protection
by mbriceno＠aol.com 24 May '93

24 May '93

> I've never felt safer than in such places [where lawabiding citezens are armed], and most would say > most such places are desirable, compared to say Washington DC > or New York where guns have been outlawed for ages. Except for > of course, those in the hands of the state and the criminals. > > Why in the world would you say otherwise? -- > > I think because he's thinking of places like Beirut, Somalia, Bosnia, > and so on. You know -- places without any effective central > government. Perhaps my post needed some clarification: I do not believe that a lawfull governmental police force becomes unneccessary once we hand every citizen a gun. Just as the police can not grant an unarmed public's security, an armed populace alone is no guarantee for safe streets. Only the combination of a well prepared public working together with a responsible government can make our lifes truely safe from infringementes by anti-social individuals. I beleive that if people were allowed to used crypto in all communication and carry a gun at all times, crime-be it street crime or white collar- would be reduced to levels far below the present rate. --Marc

1 0

draft FAQ
by esr＠snark.thyrsus.com 24 May '93

24 May '93

Here's the first draft of the FAQ. You'll see that it's basically a frame, an outline, and an intro. If you can fill in one of the sections, please do so and mail it to me. --- DRAFT VERSION ---- DRAFT VERSION ---- DRAFT VERSION ---- DRAFT VERSION --- This is the Cypherpunks FAQ. It explains the projects and purposes of the Cypherpunks mailing list. It is also intended to serve as a general introduction to privacy and encryption issues. For details on the technical and theoretical aspects of computer cryptography, see the sci.crypt FAQ, available for FTP from rtfm.mit.edu (18.172.1.27) in the directory pub/usenet-by-group/sci.crypt. The cypherpunks archive is available for FTP at soda.berkeley.edu:pub/cypherpunks This site contains code, information, rants, and other miscellany, including the most up-to-date version of this FAQ. This FAQ is maintained by Eric S. Raymond <esr(a)snark.thyrsus.com>; send additions and corrections to that address. Sections contributed by others are credited to individual authors. We gratefully acknowledge, in addition, feedback and comments from David Mandl <dmandl(a)lehman.com> and Eric Hughes <hughes(a)soda.berkeley.edu>. 1. Why cypherpunks? Because privacy is essential to freedom. If the government (or any other oppressor that behaves like one) can effectively monitor communications, it can control or suppress them. And it will do so, because the natural tendency of controllers is always to seek more control. The government cannot be relied on to protect your privacy rights. Nor can anyone else --- certainly not your employer, or the corporations that want to know all about you so they can sell you things. Given half the chance, governments and corporations will always push for security standards that protect *them*, but not *you*. Computer technology can help protect you against would-be snoopers, but only if somebody is sufficiently smart and dedicated to build the tools. The Cypherpunks list exists to build and propagate privacy software. Our aim is to give you the tools to communicate with other people and computers in ways snoopers cannot tap. 2. What are the essentials of privacy software? a. Public-key cryptosystems for secure communication. b. Unforgeable electronic signatures for message authentication. c. DC-net or similar protocols to thwart spoofing. 3. What are the potential applications of good privacy software? a. Secure communications. b. Digital cash. c. Electronic voting. d. Electronic contracts. e. Secure anonymous remailers and posters. f. <more?> 4. What are the key algorithms, tools, and implementations for privacy software? a. RSA b. DES c. Clipper/Capstone/DSS d. PGP e. Possible non-RSA trapdoor functions. 5. What are the social and political implications of good privacy software? a. Drastically lower transaction costs for trade. b. Expansion of the counter-economy. c. Disempowerment of government. d. Anonymity for whistleblowers. 6. What are the legal, political, and technical obstacles? a. The Clipper/Capstone/DSS power grab. b. The RSA patent and the PGP/RSA fight. c. RSA's base problem may not be NP-complete. 7. What can I do to help? a. Work on cryptographic software. <this subsection should list current projects> b. Agitate against the Clipper/Capstone/DES standard. c. Promote the use of encrypted communication, help spread PGP and other appropriate tools far and wide (both to help get a better foothold to thwart the Clipper monopoly and its ilk, and to work towards making crypto as commonplace as envelopes). To join the cypherpunks mailing list, send a request to: cypherpunks(a)toad.com Working with us could be your best shot at stopping Big Brother. So if you have skills to contribute, act now. The freedom you save could be your own. --- DRAFT VERSION ---- DRAFT VERSION ---- DRAFT VERSION ---- DRAFT VERSION --- -- >>eric>>

1 0

Police protection
by bcox＠gmu.edu 24 May '93

24 May '93

>I'm sure lots of people could give examples of areas where "everyone" >*is* armed, and while they certainly don't rely on "the government" >(i.e., local police forces) for protection, most would agree the >situation is not desirable ... Yep. Switzerland for sure (every draft age citizen keeps an assault rifle and ammo). Similarly for most US rural states; Oregon, South Carolina, Texas and Arizona come to mind. So do shooting ranges and guns shows most anywhere. I've never felt safer than in such places, and most would say most such places are desirable, compared to say Washington DC or New York where guns have been outlawed for ages. Except for of course, those in the hands of the state and the criminals. Why in the world would you say otherwise? -- Brad Cox; bcox(a)gmu.edu; 703 968 8229 Voice 703 968 8798 Fax George Mason Program on Social and Organizational Learning

2 1

Re: Police protection
by smb＠research.att.com 23 May '93

23 May '93

I've never felt safer than in such places, and most would say most such places are desirable, compared to say Washington DC or New York where guns have been outlawed for ages. Except for of course, those in the hands of the state and the criminals. Why in the world would you say otherwise? -- I think because he's thinking of places like Beirut, Somalia, Bosnia, and so on. You know -- places without any effective central government.

1 0

Unix Security
by Mr. Paul Danckaert (ACS) 23 May '93

23 May '93

Hey all.. I'm writing a program to see just how secure some of this unix password security is, and I would like to know more about how the final result in the passwd file is encrypted.. where could I get such information? Thanks.. (We are going kerberos here so that should help matters some atleast.. :) Paul --- Paul Danckaert - pauld(a)umbc.edu ---------------------------------------

1 0

Meeting: Suggest Meeting at Comdex Wednesday Afternoon
by mlshew＠dixie.com 23 May '93

23 May '93

A number of people on cypherpunks and extropians will be in Atlanta at Comdex next week, so we have an opportunity to get together. One great location would be in the Omni food court (Now the CNN Center), which is right by the World Congress Center where Comdex will be held. There are a lot of fast food places and a very large commons dining area. I'd suggest meeting, say, at 1:00 Wednesday afternoon or so, not for any formal meeting, but just to get together for a while at lunch to talk, trade keys, and so forth. (You'll have probably been there before Wednesday, as it's a convenient place to go for lunch at the convention. If you don't know which building it is by Wednesday, ask anyone anywhere around you to point you towards "The Omni" or "CNN Center" or "where CNN is", go in the building, and you can't miss the food court.) Don't forget to bring copies of your public keys, or some pieces of paper or business cards with your PGP fingerprint hash written on them.

1 0

Dolphin Encrypt.
by J. Michael Diehl 23 May '93

23 May '93

Hi all. I just received my demo version of Dolphin Encrypt which was shamelessly advertised on this list. ;^) I haven't had much time to play with it yet, but I thought I'd post my initial reactions. BTW, I don't think I've ever received anything in such a timely manner. Good job guys. The disk came with several pages of documentation, and advertising. The docs indicate that "the encryption process relies partly on the RSA Data Security, Inc., MD5 Message Digest Algorithm." I wonder what they mean by "partly." Interestingly, a decrypt-only version is available. Apparently, a C/C++ library of functions is available for $128 with commercial licensing offered. The documentation indicates that the encryption key can be from 10 to 60 characters in length, with case NOT SIGNIFICANT. I ran the demo but didn't have time, at the moment, to really get into it, yet. The demo indicated that the package supports a script language, which seemed to be very powerfull. In fact, part of the demo was writen with the scripting language. I think this is a novel idea. The demo seemed fairly intuitive and presented all (maybe too much?) of the needed information and status indicators. This is the extent of my comments after a VERY superficial examination of the software. I will take a better look at it later this week. If there is any interest, I will write a more in depth review. ...just my $.02 worth. +-----------------------+-----------------------------+---------+ | J. Michael Diehl ;-) | I thought I was wrong once. | PGP KEY | | mdiehl(a)triton.unm.edu | But, I was mistaken. |available| | mike.diehl(a)fido.org | | Ask Me! | | (505) 299-2282 +-----------------------------+---------+ | | +------"I'm just looking for the opportunity to be -------------+ | Politically Incorrect!" <Me> | +-----If codes are outlawed, only criminals wil have codes.-----+ +----Is Big Brother in your phone? If you don't know, ask me---+

1 0

WB: alt.whistleblower
by Eric Hughes 23 May '93

23 May '93

This is an open letter to L. Detweiler. You've been hot to trot, eager to go, and ready for action. What you have interpreted as silence from others has in some case been work. As you may recall, we were getting ready to go online two months ago, with Julf's machine as the server. Right after that, the penet controversy started and things were put on the back burner for a time. Let me review some of the arguments about the mechanisms of the alt.whistleblower newsgroup: 1. We want all postings to be anonymous. 2. That every posting be anonymous requires software intervention. 3. The software has to sit on some machine or machines, because it cannot easily be put into every posting client. 4. Someone will own these machines. 5. Whoever owns them must agree with the political goals of the service and be willing to take some heat for it. 6. This excludes most machines. 7. Whatever mechanism the servers use to connect with the net must also be reasonably proof against pressure. 8. The link between the newsgroup posting and the anonymity server was to be the group moderator's address, which in this case maps to a piece of software ratherthan a person. 9. A further desideratum is that multiple machines be able to perform the service, given the constraints of the deployed base of news software, which require (to my knowledge) a single address. 10. In order to have multiple machines be able to map to a single address, you need to involve DNS, Domain Name Service. 11. In order to use DNS, you need a primary server and some secondaries and someone with access to the primary DNS server to do maintenance. Now, I'll tell you what I've been doing. I've put a machine on the Internet in the last two months. Never having been a Unix system-level weenie before, I can say that I've learned a lot the details of batty software. This machine, because of the details of its connectivity, is not suitable as a worldwide server, but it would be suitable as a server for alt.whistleblower.ba, a Bay Area distribution version of the same. I've also gotten up to speed on DNS, and in fact, am running name service on said machine. (For all of you who want to know what this machine is, I'm not telling. There are still too many half configured things, like sendmail. I hate sendmail.) I would recommend that if you are interested in newsgroup creation that you read RFC 1036, which is the format for Usenet news messages. (RFC's are available from nic.ddn.mil via anon-ftp.) That plus knowing that anybody can create an alt group, and you'll be set. I hope you have your server system set up correctly before you proceed. The internet world has been without a whistleblower's newsgroup for many years; a delay of a few months will not matter much. Eric

4 3