- cypherpunks-legacy@lists.ogf.org

Re: +-=*^
by George A. Gleason 10 Oct '92

10 Oct '92

I've seen a number of postings so far about "secure *and* authenticated" requiring advance in-person distribution of key material. This would seem to eliminate the main advantage of public key systems, i.e. open distribution of public keys. So as long as we're handling key material in person, how about one-time systems, eh? Absolutely secure, provably so, obsolescence-proof, simple & straightforward. Not particularly exciting from a theoretical point of view, but one-time systems are practical and on the bottom line, they work. What do y'all think...? -gg(a)well.sf.ca.us

2 1

a key
by marc＠kg6kf.ampr.org 10 Oct '92

10 Oct '92

A key... -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.0 mQA9AirWaLMAAAEBgMlJILifxrXH8fkJwJbeSHXAY1Q9/AzPybGVy0Dx/q70Fr3d KhM6XoSEgaw2Ezzn2QAFEbQWTWFyYyBkZSBHcm9vdCAoY2FzdWFsKbQjTWFyYyBk ZSBHcm9vdCA8bWFyY0BrZzZrZi5hbXByLm9yZz4= =LL6T -----END PGP PUBLIC KEY BLOCK----- This is a casual key for me. Perhaps a causal key for me too. -Marc de Groot <marc(a)kg6kf.ampr.org>

1 0

Better directions to the meeting on Saturday at noon
by gnu＠cygnus.com 10 Oct '92

10 Oct '92

Someone asked for better directions, and the original ones were pretty skimpy anyway. Here's a better try. Cygnus Support 1937 Landings Drive Mt. View, CA 94043 There's no phone service there yet. Take US 101 toward Mt. View. From San Francisco, it's about a 40-minute drive. Get off at the Rengstorff Ave/Amphitheatre Parkway exit. If you were heading south on 101, you curve around to the right, cross over the freeway, and get to a stoplight. If you were heading north on 101, you just come right off the exit to the stoplight. The light is the intersection of Amphitheatre and Charleston Rd. Take a right on Charleston; there's a right-turn-only lane. Follow Charleston for a short distance. You'll pass the Metaphor/Kaleida buildings on the right. At a clump of palm trees and a "Landmark Deli" sign, you can take a right into Landings Drive; this gets you into the complex from the north. Or you can go slightly further along Charleston and take the next right, into a driveway with a big "Landmark" sign in the middle. No matter which way you got into the complex, follow around it until you are on the side that faces the freeway. There's a clock tower that rises out of one of the buildings, to the right (south) of the deli. Enter through the doors immediately under the clock tower. They'll be open between noon and 1PM at least. (See below if you're late.) Once inside, take the stairs up, immediately to your right. At the top of the stairs, turn right past the treetops, and we'll be in 1937 on your left. If you are late and the door under the clock tower is locked, you can go to the deli (which will be around a building and left, as you face the door), cut between the buildings to the right of the deli, and into the back lawns between the complex and the farm behind it. Walk around the buildings until you see a satellite dish in the lawn. Go up the stairs next to the dish, which are the back stairs into the Cygnus office space. We'll prop the door (or you can bang on it if we forget). Or, you can find the guard who's wandering around the complex, who knows there's a meeting happening and will let you in. They can be beeped at 965 5250, though you'll have trouble finding a phone. Don't forget to eat first, or bring food at noon! I recommend hitting the burrito place on Rengstorff (La Costen~a) at about 11:45. To get there, when you get off 101, take Rengstorff (toward the hills) rather than Amphitheatre (toward the bay). Follow it about ten blocks until the major intersection at Middlefield Road. La Costen~a is the store on your left at the corner. You can turn left into the narrow lane behind the store, which leads to a parking lot, and enter by the front door, which faces the intersection. To get to the meeting from there, just retrace your route on Rengstorff, go straight over the freeway, and turn right at the stoplight onto Charleston; see above. See you there! John Gilmore

1 0

PGP Key
by Angry_Poodle＠BBQ.COM 10 Oct '92

10 Oct '92

If you see any msgs from 'me' saying "here's my PGP PK key," then it's an imposter! I don't have a PGP key, much less PGP! -- Angriest Dog in the World.

1 0

Ha ha
by Secret_Squirrel＠Treehouse.COM 09 Oct '92

09 Oct '92

Whoah. That's helarious. NOT! Secret Squirrel does not cotton to imposters, and that sure as hell ain't my Public Key. So don't even bother trying to write any encrypted messages with it. My key remains: 23l1t34u -- SHRDLU

1 0

*Economist* on encryption
by whitaker＠eternity.demon.co.uk 09 Oct '92

09 Oct '92

The following is intended for limited-distribution, educational purposes only.... Citation: The Economist, Sept 21, 1991 v320 n7725 p104(2) COPYRIGHT Economist Newspaper Ltd. (UK) 1991 ---------------------------------------------------------------------- Title: A cure for the common code: computer cryptography. ---------------------------------------------------------------------- Subjects: Public key cryptosystems_Standards Digital signatures_Standards Data encryption_Research United States. National Institute of Standards and Technology_Laws, regulations, etc. Reference #: A11286848 ====================================================================== Summary: Advances in the mathematics of prime factorization algorithms have led to a technology that, once standardized, will dramatically improve public-key cryptography. The RSA algorithm is popular in the computer industry, but the government favors an alternative. ====================================================================== ANYONE can sign a postcard, but how do you sign a piece of electronic mail? Without a "signature" to demonstrate that, say, an electronic transfer of funds really comes from someone authorised to make the transfer, progress towards all-electronic commerce is stymied. Ways of producing such signatures are available, thanks to the technology of public-key cryptography. They will not work to everyone's best advantage, though, until everyone uses the same public-key system. It is an obvious opportunity for standards-makers - but in America they have turned up their noses at all the variations on the theme currently in use. The alternative standard for digital signatures now offered by America's National Institute of Standards and Technology (NIST) has brought a long-simmering controversy back to the boil. Public-key cryptography could become one of the most common technologies of the information age, underpinning all sorts of routine transactions. Not only does it promise to provide the digital equivalent of a signature, it could also give users an electronic envelope to keep private messages from prying eyes. The idea is to create codes that have two related keys. In conventional cryptography the sender and receiver share a single secret key; the sender uses it to encode the message, the receiver to decode it. In public-key techniques, each person has a pair of keys: a disclosed public key and a secret private key. Messages encoded with the private key can only be decoded with the corresponding public key, and vice versa. The public keys are published like telephone numbers. The private keys are secret. With this technology, digital signatures are simple. Encode your message, or just the name you sign it with, using your private key. If the recipient can decode the message with your public key, he can be confident it came from you. Sending a confidential message - putting electronic mail in a tamper-proof envelope - is equally straightforward. To send a secret to Alice encode it with her public key. Only Alice (or someone else who knows her private key) will be able to decode the message. The heart of any system of public-key cryptography is a mathematical function which takes in a message and a key, and puts out a code. This function must be fairly quick and easy to use, so that putting things into code does not take forever. It must be very hard to undo, so that getting things out of code does take forever, unless the decoder has the decoding key. Obviously, there must be no easy way to deduce the private key from the public key. Finding functions that meet these criteria is "a combination of mathematics and muddle", according to Roger Needham of the Cambridge Computer Laboratory. The greatest successes to arise from the muddle so far are those using functions called prime factorisation algorithms. They are based on the mathematical insight that, while it is easy to multiply two numbers together, it is very hard to work backwards to find the particular two numbers which were multiplied together to produce some given number. If Alice chooses two large prime numbers as her private key and publishes their 150-digit product as her public key, it would probably take a code-breaker thousands of years to work backwards to calculate her private keys. A variety of schemes have been worked out which use this insight as the basis for a workable public-key code. Most popular of these is the so-called RSA algorithm, named after the three MIT professors who created it - Ronald Rivest, Adi Shamir and Len Adleman. It has been patented and is sold by a Silicon Valley company, called RSA, that employs 15 people, most of them ex-MIT graduate students. Faculty firms are to computer start-ups what family firms were to the industrial revolution. RSA has attracted both academic praise and a range of heavyweight commercial customers: Microsoft, Sun Microsystems, Digital Equipment and Lotus Development. But, despite repeated applications, it has never been endorsed by those in government. Rumours abound that the code-breakers in the National Security Agency have discouraged standard-setters from recommending RSA because they do not want to promote the use of codes they cannot break. RSA, for obvious reasons, does not discourage the rumours. Whatever the reason, the standard-setters at the NIST have side-stepped the debate over RSA with their new algorithm, DSA. As set out in the standard, DSA verifies the identity of the sender, but does not encrypt the message. It appends to the message a number calculated from the message and the sender's private key. The recipient can then use this number, the message and the sender's public key to verify that the message is what it seems. The NIST says that this technique is well suited to "smart cards" and other applications where there is not a lot of computing power available for working out codes. Because it hopes that DSA Will be used for verifying the identity of everyone from welfare recipients to military contractors, its flexibility is a boon. Meanwhile, however, more and more companies are choosing a public-key cryptography system for communicating confidentially - often RSA, sometimes something different. Someday, probably soon, governments will want to choose, too. Watch out for fireworks when they do. ------------------end forwarded article-------------------------- Russell Earl Whitaker whitaker(a)eternity.demon.co.uk Communications Editor 71750.2413(a)compuserve.com EXTROPY: The Journal of Transhumanist Thought AMiX: RWHITAKER Board member, Extropy Institute (ExI) [.sig revised 1 October 1992 /// Send mail to eternity node] -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.0 mQCNAiqwg10AAAEEAMVNMI766ljeuW01xqXKYYV5lmDPvb+6dCQK3m1iBQdan0no pm35j1DIRp3UJZogAe5eimsQg1TALDhTq310OZs9+L6B/HxeX3+4BadIDad4g+xI lvaFY1Ut/hMdZNkw0tzNZOdUPiO4jYIyirReAUiMCm6jXzkTRITj7/vxxWtPAAUR tDNSdXNzZWxsIEUuIFdoaXRha2VyIDx3aGl0YWtlckBldGVybml0eS5kZW1vbi5j by51az4= =LOCL -----END PGP PUBLIC KEY BLOCK-----

1 0

Anonymity
by Secret_Squirrel＠Treehouse.COM 09 Oct '92

09 Oct '92

Anonymity is good. Anonymity works. >> U> 23l1t34u U> -----END PGP PUBLIC KEY BLOCK----- Now I feel very unsecure, because the above is all I got. It ain't no public key...\ << Uh... it's kind of an inside joke. Uh. Sorry. Anyway, why would you want to reply only directly to me and not to the list in general?

1 0

Re: +-=*^
by nobody＠soda.berkeley.edu 09 Oct '92

09 Oct '92

Since there has been complaints about the size of my public key here is a more secure 512bit version, please discard the prevous key -Secret_Squirrel PS: please redistribute this key asap. to others. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.0 mQBNAirV2r0AAAEB/i78BfdkmEIqKt2EhdlFAJc44rB3ZMzChez5zVcB9jRpUz1o MY2M2GnucGRUcvMSvZeF/aqCVIHuodDfqyGYYTkABRG0L1NlY3JldF9TcXVpcnJl bCA8U2VjcmV0X1NxdWlycmVsQFRyZWVob3VzZS5DT00+ =Byn9 -----END PGP PUBLIC KEY BLOCK-----

1 0

+-=*^
by Secret_Squirrel＠Treehouse.COM 09 Oct '92

09 Oct '92

re: Interface for re-mailer; why not hitch it to emacs or something? re: problem with key distribution; right, OK, I hadn't thought that there might be a security problem with casually giving someone your key without them being able to authenticate that it came from you. Good point. Here's my public key. If you feel it is not secure enough, we can always use the cone of silence: -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.0 23l1t34u -----END PGP PUBLIC KEY BLOCK-----

2 1

re: +-=*^
by Tom.Jennings＠f111.n125.z1.FIDONET.ORG 09 Oct '92

09 Oct '92

U> re: problem with key distribution; right, OK, I hadn't U> thought that there might be a security problem with U> casually giving someone your key without them being able U> to authenticate that it came from you. Good point. But as Eric pointed out, and I realized later, the underlying social structure will allow detection of bum keys (presuming the scammed person or someone s/he knows notices, etc, and so on, a wholew world resides here...) U> Here's my public key. If you feel it is not secure U> enough, we can always use the cone of silence: U> U> -----BEGIN PGP PUBLIC KEY BLOCK----- U> Version: 2.0 U> U> U> 23l1t34u U> -----END PGP PUBLIC KEY BLOCK----- Now I feel very unsecure, because the above is all I got. It ain't no public key... PS: Too much anonymity? I have to reply in hte mailing list to this person cuz it's a faked From... (trust me) * Origin: World Power Systems / FidoNews / San Francisco CA (1:125/111) -- Tom Jennings - via FidoNet node 1:125/555 UUCP: ...!uunet!hoptoad!kumr!fidogate!111!Tom.Jennings INTERNET: Tom.Jennings(a)f111.n125.z1.FIDONET.ORG

1 0