- cypherpunks-legacy@lists.ogf.org

ANON: list of remailers Apr 7, 1993
by Karl Barrus 07 Apr '93

07 Apr '93

Sorry this is late, but I was delaying waiting for the uclink remailer's public key to be released, plus, I'm still not getting responses from remailer(a)dis.org (but at least I'm not getting bounced mail). Some users have informed me that they were able to use remailer(a)dis.org, so that's good! -----BEGIN PGP SIGNED MESSAGE----- Q1: What cypherpunk remailers exist? A1: 1: hh(a)pmantis.berkeley.edu 2: hh(a)cicada.berkeley.edu 3: hh(a)soda.berkeley.edu 4: nowhere(a)bsu-cs.bsu.edu 5: ebrandt(a)jarthur.claremont.edu 6: hal(a)alumni.caltech.edu 7: remailer(a)rebma.mn.org 8: elee7h5(a)rosebud.ee.uh.edu 9: phantom(a)mead.u.washington.edu 10: hfinney(a)shell.portal.com 11: remailer(a)utter.dis.org 12: 00x(a)uclink.berkeley.edu 13: remail(a)extropia.wimsey.com NOTES: #1-#5 remail only, no encryption of headers #6-#12 support encrypted headers #13 special - header and message must be encrypted together #7,#13 introduce larger than average delay #11 CANNOT CONFIRM OPERATION YET! TEST BEFORE ATTEMPTING TO USE. * #12 public key not yet released ====================================================================== Q2: What help is available? A2: Check out the pub/cypherpunks directory at soda.berkeley.edu (128.32.149.19). Instructions on how to use the remailers are in the remailer directory, along with some unix scripts and dos batch files. Mail to me (elee9sf(a)menudo.uh.edu) for further help and/or questions. ====================================================================== * I've had others tell me that they have successfully used this remailer, but I still don't get any responses...will keep trying! -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBK8MS/YOA7OpLWtYzAQGgvwQAll6hwIfabxKGdtCSNPUa3M3RCBaqzPT2 VM+k8O94IVxAqX+RUMzRGUVJigrj+5XcNicX1ZvE61rh5InLbzqvUS8mQNbss6wr b098F0uHyCQCKCF13lzkLU0Gu+HxE+LoBuhaTiwonvcbQYgH+2+lhoU9yAbfduIq 9Syr3gaf3fk= =W8vL -----END PGP SIGNATURE-----

1 0

Remailers
by sean＠gomez.Jpl.Nasa.Gov 07 Apr '93

07 Apr '93

Would someone be so good as to mail me the list of anonymous remailers? My copy was lost in a backup-restore cycle. Thanks.

1 0

Smaller is better.
by fergp＠sytex.com 07 Apr '93

07 Apr '93

On Mon, 05 Apr 93 12:36:09 PST, Jonathan Stigelman <uunet!transam.ece.cmu.edu!stig> writes - JS> Yeah.... So if your key can be snooped off the net, so can your JS> cleartext. To decript online, then, is akin to using only weak JS> encription...which indicates only the desire for limited privacy. JS> But if even if you do decript online, you're still protected from JS> file snooping. JS> What's needed is PGP decription built into your terminal program. I think that you guys are missing the point here. IMHO, if you wish maximum assurance of security, than I'd suggest not trying to run programs such as PGP on a multi-user system to begin with! What's wrong with using a PC for this? It offfers a maximum convenience, single-user secure system quite unlike the security problems associated with your university's mainframe. The PC offers the communications availability and the flexibilty to provide an extremely high level of privacy, if you know what you're doing. You should try it sometime .... Cheers. Paul Ferguson | "Sincerity is fine, but it's no Network Integration Consultant | excuse for stupidity." Centreville, Virginia USA | -- Anonymous fergp(a)sytex.com (Internet) | sytex.com!fergp (UUNet) | 1:109/229 (FidoNet) | PGP 2.2 public encryption key available upon request.

3 2

PHRACK: my draft reply to the crypt article
by robichau＠lambda.msfc.nasa.gov 07 Apr '93

07 Apr '93

Attached is a short rebuttal or reply to the PHRACK article I posted last week. I'd appreciate comments and suggestions on how to improve it- my knowledge is far behind Marc, Tim, Perry, and many of the others on this list. So, I got off my butt. Hopefully this will satisfy Doug :) -Paul My background: I've been into the scene for about 12 years. My day job is writing unix s/w for a NASA contractor. My night job... well, never mind that. I have a strong amateur interest in crypto, and I'd like to share some of what people in the usenet/internet community have been kind enough to teach me. Racketeer sez: > If you think that the world of the Hackers is deeply shrouded with >extreme prejudice, I bet you can't wait to talk with crypto-analysts. These >people are traditionally the biggest bunch of holes I've ever laid eyes on. In >their mind, people have been debating the concepts of encryption since the >dawn of time, and if you come up with a totally new method of data encryption, > -YOU ARE INSULTING EVERYONE WHO HAS EVER DONE ENCRYPTION-, mostly by saying >"Oh, I just came up with this idea for an encryption which might be the best >one yet" when people have dedicated all their lives to designing and breaking >encryption techniques -- so what makes you think you're so fucking bright? One real reason for this reaction is that people _have_ been studying encryption for 100 years or so. As a result, many simple cryptosystems are continuallly being reinvented by people who haven't ever made even a simple study of cryptosystems. Imagine if someone came up to you and said "Wow! I just found a totally K00L way to send fake mail! It's radical! No one's ever thought of it before!" You'd laugh, right? _Anyone_ can figure out how to forge mail. Well, _anyone_ can come up with the n-th variation of the Vigniere or substitution cipher. An even more important reason for their 'tude is that cypherpunks are suspicious by nature. A key principle of crypto is that you can only trust algorithms that have been made public and thoroughly picked over. Without that public scrutiny, how can you trust it? The feds' Digital Signature Standard (DSS) got raked in the crypto and industry press because the feds wouldn't disclose details of the algorithm. "How do we know it's secure?" the cypherpunks asked. "We won't use it if we don't know it's secure!" Point being: (for those of you who skipped over) cypherpunks trust NO ONE when the subject is encryption algorithms. Maybe J. Random Hacker has come up with a scheme faster and more secure than, say, RSA. If JRH won't share the details, no one will use it. Racketeer goes on to talk about DES. It's fairly clear that for a known-ciphertext attack (i.e. you have a block of encoded text, but neither the key nor the plaintext) will, at worst, require 2^56 decryption attempts. Various schemes for parallel machines and so forth have been posted in sci.crypt. Does the NSA have something that can crack DES? Probably. My claim would be that cracking passwords is (at minimum) order-of-magnitude faster than a known-ciphertext attack against a "typically secure" ciphertext. By typically secure, I mean one encrypted with DES in CBC mode (_not_ the more common and easier-to-implement ECB mode) using a strong key (not a password of "123", for example.) Remember that DES is mostly used for short-lived session keys. ATMs are a good example; they typically use a DES key for one communication session with the central bank. New session, new key. DES is _not_ very well suited for long-term encryption, since it can probably be attacked in "reasonable" time by a determined, well-equipped opponent. Now, on to PGP. Pretty Good Software was indeed threatened with a lawsuit by Public Key Partners (PKP). PKP holds the patent on the RSA public-key algorithm. (Many people, me included, don't think that the patent would stand up in court; so far, no one's tried.) The nice thing about PGP is that it offers IDEA and RSA in a single, well-integrated package. When you encrypt a file, PGP generates an IDEA session key, which is then encrypted with RSA. An opponent would have to either a) exhaustively search the entire IDEA key space or b) break RSA to decrypt the file without the password. Racketeer also mentions that PGP can optionally compress files before encryption. There's a solid crypto reason behind this, too. One well-known and successful way to attack an encrypted file is to look for patterns of repeated characters. Since the statistical frequencies of word and letter use in English (and many other languages; some folks have even compiled these statistics for Pascal & C!) are well-known, comparing the file contents with a statistical profile can give some insight into the file's contents. By compressing files before encrypting them, PGP is moving the redundancy out of the text and into the small dictionary of compression symbols. You'd still have to decrypt the file before you could do anything useful with that dictionary, or even to determine that it _had_ a signature! -- Paul Robichaux, KD4JZG | May explode if disposed of improperly. NTI Mission Software Development Div. | RIPEM key on request.

1 0

Re: Mac PGP 2.2 Sites?
by cls6＠midway.uchicago.edu 07 Apr '93

07 Apr '93

>Anyone know of any ftp sites where I could find the new 2.2 version? Try soda.berkeley.edu /pub/cypherpunks/pgp. If that's, for some reason impossible, I will send it (Binhexed) to anyone who wants a copy. Cory Cory L. Scott ----------------------------------------------------------- Computing Assistant and Consultant Phoenix Project, Biological Sciences Division University of Chicago cls6(a)midway.uchicago.edu ----------------------------------------------------------- Member, U of C Student Computing Issues Committee

1 0

Re: PHRACK: Article from PHRACK 42 on encryption
by Douglas Mason 07 Apr '93

07 Apr '93

> groups like sci.crypt already have some pretty good documents. > There is no need for spreading of misinfomation like phrack. The problem is that Phrack has a distribution that goes in other directions, where a simple Usenet newsgroup can not reach. I've seen files from past Phrack issues available on Public Domain archive sets for BBS's. Phrack has been around for quite a while now and unlike a lot of the other series on-line mags, it is probably going to be around for a while longer. CuD and the likes are great for news, but where else can you find somewhat lengthy papers on various topics? Even if most of it is elementary, there is always something interesting in each issue, even if it is just to see some of the personalities that are out there. Like it or not, piece of crap or otherwise, it does get around. It's going through ownership changes and probably would like to find some people that would be willing to help out with "cleaning" it up. Why not help? --Doug --- Douglas Mason douglas(a)approach.com Network Administration CompuServe: 76646,3367 Approach Software Corporation +01 415.306.7890

1 0

Mac PGP 2.2 Sites?
by Doug.Brightwell＠Corp.Sun.COM 07 Apr '93

07 Apr '93

Anyone know of any ftp sites where I could find the new 2.2 version? Thanks, Doug

2 1

hello?
by fnordbox!loydb＠cs.utexas.edu 07 Apr '93

07 Apr '93

I hate messages like this one, but is this list sick? I haven't gotten anything for many days . . . Loyd *************************************************************************** * loydb(a)fnordbox.UUCP SJ Games: 1 * Loyd Blankenship * * GEnie: SJGAMES US Secret Service: 0 * PO Box 18957 * * Compu$erve: [73407,515] * Austin, TX 78760 * * cs.utexas.edu!dogface!fnordbox!loydb * 512/447-7866 * ***************************************************************************

1 0

Mac PGP on The Well
by dlr＠world.std.com 07 Apr '93

07 Apr '93

I was just reading in the EFF conference on the Well that they have asked that the pgp version for the mac be removed ...at least temporarily because of the possible legal problems. I don't use a mac and already have a copy thankak you anyway

1 0

Re: "hacker" publications
by Peter shipley 07 Apr '93

07 Apr '93

> >> PHRACK or 2600? > >Does anyone have a phone number and/or address for these or any >other "hackers" publications? > 2600: 2600(a)well.sf.ca.us phrack: phrack(a)stormking.com (also see included file) InfoHax: see nestey(a)csn.org there is also a list called zardoz but I suspect it is dead. the main problem with these lists is that people want info but do not want to give up any of their secret. Some security lists I have been on insist that all members contribute something or they are droped from the list. -Pete ---- Included file - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - HOW TO SUBSCRIBE TO PHRACK MAGAZINE The distribution of Phrack is now being performed by the software called Listserv. All individuals on the Phrack Mailing List prior to your receipt of this letter have been deleted from the list. If you would like to re-subscribe to Phrack Inc. please follow these instructions: 1. Send a piece of electronic mail to "LISTSERV(a)STORMKING.COM". The mail must be sent from the account where you wish Phrack to be delivered. 2. Leave the "Subject:" field of that letter empty. 3. The first line of your mail message should read: SUBSCRIBE PHRACK <your name here> 4. DO NOT leave your address in the name field! (This field is for PHRACK STAFF use only, so please use a full name) Once you receive the confirmation message, you will then be added to the Phrack Mailing List. If you do not receive this message within 48 hours, send another message. If you STILL do not receive a message, please contact "SERVER(a)STORMKING.COM". You will receive future mailings from "PHRACK(a)STORMKING.COM". If there are any problems with this procedure, please contact "SERVER(a)STORMKING.COM" with a detailed message. You should get a conformation message sent back to you on your subscription. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ---- End of Included file

1 0