- cypherpunks-legacy@lists.ogf.org

viacrypt and freeware
by cjl＠micro.med.cornell.edu 27 Aug '93

27 Aug '93

>> As for why bother when the freeware is available, plausible deniability was >> mentioned and I think that is probably the most convincing argument. The >> Jackson Games seizure, and other computer confiscations by law enforcement >Note that the seizure had *nothing* to do with copyright or other IP >infringement; no incriminating material was ever found, and we were >completely cleared. Also, the name of the company is "Steve Jackson Games" >That aside, I agree with your basic analysis. It was not my intent to speak to the *specifics* of the Steve Jackson Games case, although your point is well taken. My reference was more to the point that as a reasonably well publicized event, particularly among the computer cognescenti, that people (i.e. sysops and owners) have every reason to fear completely outrageous and unconstitutional behavior from government agencies. The law enforcement agencies are well aware of the value of making a high profile example of how much they are able to get away with and be completely free from any redress of grievances. cjl

1 0

Cisco routers backdoor
by L. Detweiler 27 Aug '93

27 Aug '93

===cut=here=== Date: Wed, 25 Aug 1993 12:56:54 -0700 (PDT) From: Al Whaley <Al.Whaley(a)sunnyside.com> Subject: Cisco routers Rumors abound that Cisco routers have a back door; that is when a TCP port is disabled, it can still be accessed from Cisco's IP number. I have personally verified this with the sendmail port. Al Whaley al(a)sunnyside.com +1-415 322-5411(Tel), -6481 (Fax) Sunnyside Computing, Inc., PO Box 60, Palo Alto, CA 94302 [Private trapdoors for developers and maintenance folks are remarkably common, and in many other cases represent more serious risks than this one. WarGames was not pulling your leg. PGN] ------- End of Forwarded Message

1 0

Crypto Consulting / Employment Opportunities at Microsoft
by gnu 27 Aug '93

27 Aug '93

Posted at CRYPTO '93 in Santa Barbara this week were these two job offers, FYI: CRYPTOGRAPHER -- Advanced Technology and Business Development, Advanced Consumer Technology Group, reporting to Group Manager, Research Group Primary responsibilities include the research, analysis, verification, and recommendation of cryptographic methods; designing and proving new methods; and working with a development team to implement such methods. Candidate should be familiar with authentication techniques, blind signatures, digital signature and time-stamping techniques, public key encryption systems, hashing methods, and encryption standards. Familiarity with RSA, LUC, DES, minimum knowledge systems, and Digital Cash/Smart Card technology a plus. A MS/Phd degree in Mathematics, with a focus on cryptography, desired. Do you need a research challenge which results in tangable (sic) product? Then Microsoft is the place for you! Microsoft looking (sic) to challenge the brightest mathematical minds with the latest advances in cryptography. The ideal candidate will be responsible for the reserach, analysis, verification, and recommendation of cryptographic standards as well as the design of new standards. Candidate should be familiar with ... [repeats itself here] COMPUTER SECURITY EXPERT -- Advanced Technology and Business Development, Advanced Consumer Technology Group, reporting to Group Manager. Primary responsibilities include the reserach, analysis, verification, and recommendation of computer and communication security techniques; designing new methods; and working with a development team to implement such methods. Some programming responsibilities also will be assumed. Qualifications should include a minimum of 5 years experience with secure transaction systems, data security, authentication techniques, basic encryption technology, and knowledge of security standards. Famililarity with electronics funds transfer systems (SWIFT, ...), Smart Card technology, C/C++ language, and RSA encryption a plus. A BS/MS/Phd degree in Computer Science or related field preferred. Contact: Lester Waters, +1 206 936 4288, lesterw(a)microsoft.com Gideon Yuval, gideony(a)microsoft.com

1 0

Re: Commercial PGP: Verifying Trustworthiness
by norm＠netcom.com 27 Aug '93

27 Aug '93

cdodhner(a)indirect.com (Christian D. Odhner) says: > I could very well be wrong about this one, but since pgp uses a random > idea session key each time you encrypt, wouldn't that in fact ensure that > no two encryptions of the same file with the same public key are ever the > same? Why then would random stuff be needed? I knew that! I forgot that! Thanks for reminding me. Back to the drawing board! A protocol where the user controlled the session key would be more awkward but would solve that problem. On the otherhand that isn't the PGP protocol.

1 0

Re: Commercial PGP: Verifying Trustworthiness
by norm＠netcom.com 27 Aug '93

27 Aug '93

Forwarding for cdodhner(a)indirect.com (Christian D. Odhner) > > peter honeyman <honey(a)citi.umich.edu> says: > > pgp and viacrypt will always generate differnt outputs: pgp > > adds some pseudo-random stuff to the start of the file it is > > encrypting to ensure that a file encrypts differently each time. > This means that I am trusting the "pseudo-random" stuff not to be > some secrets that PGP has read from my disk. The only benefit > that I see to the pseudo-random stuff is to send the same message > to several people without revealing the fact that the messages are > the same except to those that can decode the messages. > I could very well be wrong about this one, but since pgp uses a random idea session key each time you encrypt, wouldn't that in fact ensure that no two encryptions of the same file with the same public key are ever the same? Why then would random stuff be needed? Happy Hunting, -Chris <cdodhner(a)indirect.com> PGP public key available upon request.

1 0

.Comparing ViaCrypt and freeware.
by cjl＠micro.med.cornell.edu 27 Aug '93

27 Aug '93

{Refering to my earlier post about the possibility of black-boxing the commercial ViaCrypt and comparing it to freeware PGP} I've been most gratified by the response (private and posted) to my question. Thanks for the enlightenment. The first few responses were diametrically opposite in their conclusions, but after that what I have taken away as the message is that the session key is generated on-the-fly and would be different every time, although I guess I still don't understand enough to figure out why no matter what the program uses as randomness input some really bright boy capable of working real down close to the silicon couldn't fake up some sort of a test bed to spoon-feed the "randomness" to the program. It's not like this thing runs on quantum randomness. Is it? As for why bother when the freeware is available, plausible deniability was mentioned and I think that is probably the most convincing argument. The Jackson Games seizure, and other computer confiscations by law enforcement are enough to keep any company from allowing a copy of PGP on the premises, it also has a fairly chilling effect on those less brave souls who don't have the power of their convictions and are willing to trust the government not to snoop on their E-mail or phone conversations. The right to privacy can be eroded away because most people don't care to learn how the box on the desk works, let alone worry about exercising their civil liberties. Hell, most people don't even bother to vote. I found out about PGP from the WIRED article on the cypherpunks, and I have been doing as someone else suggested, turning other people on to privacy. I have converted several friends already and they in turn are spreading the encrypted word. eep-Kay o-nay rypting-'Cay, cjl

1 0

Re: Coming Soon: Commercial version of PGP!
by mbriceno＠aol.com 27 Aug '93

27 Aug '93

gg(a)well.sf.ca.us writes: > How soon before a Mac compatible version is available? Or will the > current version run under Soft PC on the Mac, which is essentially a > PC-emulator...? If yes to either, sign me up...! Have you tried the freeware version of MacPGP yet? It is very easy to use. The next release (now in beta) will even support AppleEvents. I think it will be quite a while before you can buy something similar. [And why would you want to pay if you can get for free?] --Marc

1 0

Re: Further PGP Security Doubts
by an31185＠anon.penet.fi 27 Aug '93

27 Aug '93

an31144(a)anon.penet.fi writes: ["Raymond Paquin"] >.. claims that PGP is fatally flawed, though the flaw is in niether >RSA or IDEA, but rather somewhere within the PGP part of the program. > >Copping the "I can say no more! I have said too much already!" >melodrama, no more detailed information is forthcoming. Yes, this seems to be a persistent rumour, though I've no idea how true it might be. I uploaded PGP to a bulletin board a few months back and received a message from another user claiming the same thing. (And taking the same copout...) I've been meaning to take a good look at the source for a while, I think it's about time to investigate the key generation code..... ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Re: Coming Soon: Commercial version of PGP!
by an31185＠anon.penet.fi 27 Aug '93

27 Aug '93

>How soon before a Mac compatible version is available? Or will the current >version run under Soft PC on the Mac, which is essentially a PC-emulator...? >If yes to either, sign me up...! > >-gg(a)well.sf.ca.us Well, it works on SoftPC on my workstation, so I guess it would work on the Mac as well. I don't think I'd trust the key generation though, as if I remember correctly the PC version sets the PC timer to a high rate which SoftPC probably doesn't support. ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Re: Commercial PGP: Verifying Trustworthiness
by norm＠netcom.com 26 Aug '93

26 Aug '93

peter honeyman <honey(a)citi.umich.edu> says: > pgp and viacrypt will always generate differnt outputs: pgp > adds some pseudo-random stuff to the start of the file it is > encrypting to ensure that a file encrypts differently each time. This means that I am trusting the "pseudo-random" stuff not to be some secrets that PGP has read from my disk. The only benefit that I see to the pseudo-random stuff is to send the same message to several people without revealing the fact that the messages are the same except to those that can decode the messages.

1 0