- cypherpunks-legacy@lists.ogf.org

No Subject
by treason＠gnu.ai.mit.edu 22 Feb '93

22 Feb '93

Does anyone know the status of this product? Is it proprietary? What encryption algorityhms does it use? Are there any flaws in it? treason@gnu

1 0

Key Registration
by tcmay＠netcom.com 22 Feb '93

22 Feb '93

>Recently there was a thread on a public-key program that would involve a >central, government-backed-or-authorized agency to issue key pairs and >serve as a repository. Could someone please post some details on this -- >I seem to have gotten it into my head that this is how PEM works, and I >don't know whether I'm right or just medicated. :-) > >Loyd The proposal was slightly different and has not been officially proposed as any kind of law. Here are some more details: * Dorothy Denning, noted cypto and security expert, floated a trial balloon at the Computer Security Conference last fall. (I summarized it and posted it to sci.crypt, where more than 1000 messages related to this thread, "A Trial Balloon to Ban Encryption?," eventually appeared.) * Under her proposal, a user of P-K methods would take his _private_ key and encrypt it to the _public_ key of an agency like the Justice Department (which I'll use from now on to represent the government side). The encrypted key would then be placed in a repository with another agency, perhaps a private agency like the CPSR or even the EFF. The key storage agency obviously could not read the messages (as they would be encryped to the Justice Deparment's key). * A properly-obtained warrant could then be presented to the key repository, obtaining the specific key. The Justice Department could then decrypt with its private key and thus have the private key of the user. * Ostensibly, this prevents the Justice Department from simply snooping through whatever messages it wishes to read. * There are some obvious practical and constitutional issues: - What happened to constitutional rights to privacy? Analogously, must one escrow personal diaries? Install tape recorders in all private places and escrow copies of all tapes? (Lots of comparisons to free speech, to gun control, etc.) - What happens when people register the "wrong" key? Is this even detectable? - If "noise" is sent, will the Justice Department demand the "key" be presented? How? And what penalties for noncompliance? - Many applications demand dynamic generation of keys---many public keys, many session keys, etc. How will these be registered? What fees? - It seems likely that a key registration scheme will also place limits on many of the things we hold dear on this list--digital money, anonymous systems, remailers, and all the other wonders of crypto anarchy. There's a lot more. And there was a lot of debate in sci.crypt about this. Fortunately, I don't see any further moves to make this a law. But it may come in a few years. -Tim May -- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: MailSafe and PGP available.

1 0

Bug in the anon.penet.fi remailer
by an5877＠anon.penet.fi 22 Feb '93

22 Feb '93

-----BEGIN PGP SIGNED MESSAGE----- I believe I have uncovered a serious bug in the Finnish anonymous remailer, one that allows me to piece together anonymous id's and actual email addresses. I'm reluctant to publish the details here, but I'll explain how it works if you send me your email address. > DEADBEAT -----BEGIN PGP SIGNATURE----- Version: 2.1 iQBFAgUBK4kCn/FZTpBW/B35AQEOkgF/euVoBz+q3iOb8oAFWaF5n/lPIIv76L0y eT0bYJl7RebSiyV8tWzXWNibZrPn1aPc =6ZVT -----END PGP SIGNATURE----- ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind system, any replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi. *IMPORTANT server security update*, mail to update(a)anon.penet.fi for details.

1 0

Cancel subsciption
by eric_r＠zeus.c-engr2.siu.edu 22 Feb '93

22 Feb '93

please unsubscribe me from the mailing list ejr

1 0

subscribe
by Bruce.Baugh＠p23.f40.n105.z1.fidonet.org 22 Feb '93

22 Feb '93

Please add me to your mailing list. Thanks! UUCP !qiclab!therose INTERNET: therose.fidonet.org FIDONET: 1:105/7.0 UUCP <> FidoNet(tm) Gate is a public service provided by therose.pdx.com. **Reply messages should not be sent to/through therose.pdx.com**

1 0

list of remailers
by Karl Barrus 22 Feb '93

22 Feb '93

Paul Ferguson asks for a list of remailers. Here's it the latest one I have: 1: hh(a)pmantis.berkeley.edu 2: hh(a)cicada.berkeley.edu 3: hh(a)soda.berkeley.edu 4: nowhere(a)bsu-cs.bsu.edu 5: ebrandt(a)jarthur.claremont.edu 6: hal(a)alumni.caltech.edu 7: remailer(a)rebma.mn.org 8: elee7h5(a)rosebud.ee.uh.edu 9: phantom(a)mead.u.washington.edu 10: hfinney(a)shell.portal.com 11: babani(a)cs.buffalo.edu 12: remail(a)extropia.wimsey.com NOTES: #1-#5 no encrypted remailing requests #5-#12 support encrypted remailing requests; public key available #2 requires remailing request to appear in header (am working on a PERL script which will do this) #12 requires encryption (message and header together) #7,#12 introduce larger than average time delay (which is probably a desirable thing!) It's been a good week for remailers - three of them came to my attention (nowhere@bsu, ebrandt@jarthur, babani@cs)! /-----------------------------------\ | Karl L. Barrus | | elee9sf(a)menudo.uh.edu | <- preferred address | barrus(a)tree.egr.uh.edu (NeXTMail) | \-----------------------------------/

1 0

PGP question
by scott＠shrug.dur.ac.uk 22 Feb '93

22 Feb '93

I'm sure this isn't the right place for this question, but what the hell. I've added a second mailing address to my public key, but this causes a validity error (unknown sigantor) when checked with -kc. How can I go about making that go away so that people who check will not be greeted by this message? Only been in PGP a week, Scott

1 0

msdos perl
by Eli Brandt 22 Feb '93

22 Feb '93

> Slight complaint: The only available port of perl to DOS is 386 or > higher only, The perl419x.zip in simtel:msdos/perl doesn't even use the 386. However, those without 386 + memory manager may have a bit of a hard time with memory. I don't know about the perl4019.zip in the same directory; I snarfed it to check, but it has no docs (and I don't care to disassemble for 386 code!) > CrysRides Eli ebrandt(a)jarthur.claremont.edu

2 1

Defending Free Speech and Liberty
by tcmay＠netcom.com 22 Feb '93

22 Feb '93

Cheers for John Gilmore in his defense of free speech and liberty! The Net.Nazi who apparently criticized him for inappropriate use of the Net clearly understands neither the nature of free exchange of ideas nor the relative innocuousness of Murdering Thug's article on viruses. Thug's article on polymorphic viruses was factual and made some good points, and certainly was not very controversial. And even if it was controversial, so what? Frankly, Thug's article was pretty tame (no offense, Thug...a lot of our postings are pretty tame). I've seen more details elsewhere on the Dark Avenger Mutation Engine, so big deal! (The "virus construction kit" idea was also recently the subject of an article in one of the trade rags, and I recall Steve Gibson writing at least two fairly alarmist and detailed articles on polymorphic viruses for "Infoworld." And the trade journal "Computers and Security" has extensive coverage of all of these virus technologies.) As with so many things that the cop and spy mentalities want kept secret from the riffraff, who gains by keeping the secrets? The Bulgarian virus writers (could this whole "Bulgarian" thing be just part of the propaganda campaign by the SPA and GoreTechs to ensure a "safe" network, a la NREN? Just a thought.) certainly will be a lot more current than casual readers of a brief article. If discussion of viruses is discouraged--or even banned--who will benefit? Ordinary citizens will be kept in the dark, while the virus guys at Los Alamos and the Army Center for Signal Warfare (Vint Hill Station, VA) will continue to let out contracts for virus warfare to MITRE and their ilk, while bogus stories get out (like the supposed viruses planted in equipment bound for Iraq just before the war started), and while the supposed "good guys" like Fred Cohen (he wrote the first big study of viruses and brunnering) are busy proposing "good viruses" that would seek out tax evaders, deadbeat Dads, and other subversives! (Lord, save us from the fools!). Meanwhile, the French SDECE is spying on everyone they can and probably was behind CLODO (Comite Liquidant ou Detoumant les Ordinateurs), the anti-computer terrorist group. The better to scare the populace, don't you know? I say, let's expand the scope of the Cypherpunks list to include more discussion of viruses. We can't let it become a monopoly of the Authorities (the Brunner Authority instead of the Turing Authority?) The "Cypherpunk Ethic" says we don't trust authority to tell us how to compute, and we don't understand defense methods until we understand attack methods. QED. Frankly, I expect the next target of the powerfreak authorities to be our work on anonymous remailers and digital money. They'll come to see that as a bigger threat than mere viruses. -Tim May -- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: MailSafe and PGP available.

3 2

New Directions on the Internet-Privacy what are the threats...
by Kelly Goen 22 Feb '93

22 Feb '93

Hi all, to John Gilmore in particular... John I would like to use the incident I discussed with you in encrypted mail as a start to discussing what the technical/programmed threats to privacy on the Internet using just simple scripts and programs available on the Internet. I agree that is does range somwhat far from the usual fare of crypto but it began as a PGP-key-server to mailing list correlation and it definitely illustrates the current threat there is to privacy... I would like to use the toad.com site as an example while not revealing the list contents in the open posting due to personal feelings and ethics about privacy... how do you and the list feel about this new topic area... thanx and cheers kelly (oklahoma) goen p.s. The response I have gotten for my call to action has been gratifying indeed I will get back to everyone of you as time and preparation of the FAQ permits... I welcome ALL of your suggestions, critiques and help as well as pointers to programs and information... btw is "Digital Privacy" off the presses yet and if so where can I get a copy in the silicon valley area... best of luck to all the members of this list and thanx again... --------

1 0