Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id NAA10718 for ietf-open-pgp-bks; Thu, 18 Feb 1999 13:20:02 -0800 (PST) Received: from riemann.iam.uni-bonn.de (root@riemann.iam.uni-bonn.de [131.220.223.83]) by mail.proper.com (8.8.8/8.8.5) with ESMTP id NAA10714 for ; Thu, 18 Feb 1999 13:19:42 -0800 (PST) Received: from sobolev.rhein.de (root@mathphysppp0.iam.uni-bonn.de [131.220.223.84]) by riemann.iam.uni-bonn.de (8.8.8/8.8.8/Debian/GNU) with ESMTP id WAA02842 ; Thu, 18 Feb 1999 22:23:42 +0100 Received: (from roessler@localhost) by sobolev.rhein.de (8.8.8/8.8.8/Debian/GNU) id WAA24209 ; Thu, 18 Feb 1999 22:09:14 +0100 Date: Thu, 18 Feb 1999 22:09:13 +0100 From: Thomas Roessler To: "John W. Noerenberg" Cc: ietf-open-pgp@imc.org, "Jeffrey I. Schiller" Subject: Re: to be done Message-ID: <19990218220913.H19120@sobolev.rhein.de> References: <19990126224933.J11060@sobolev.rhein.de> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii User-Agent: Mutt/0.96i In-Reply-To: Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: On 1999-02-18 12:25:34 -0800, John W. Noerenberg wrote: > Write up the motivation for multiple signatures, and publish it to > the list. Generally, it may be practical to have the possibility to have multiple entities same one and the same document. Possible applications include: - Transit periods in which one person is using multiple signature keys and wants to make sure that every recipient can verify a signature. - Four-eye-principle: Messages may have to be revised and signed by two or more persons to be considered valid. Multiple signatures give a simple implementation of this. - Multi-protocol signatures: A message may be signed with different algorithms or protocols, e.g., MOSS, S/MIME, and PGP/MIME. There seem to be essentially three different solutions from a PGP point of view: - Put multiple signature packets into the application/pgp-signature part of a multipart/signed; protocol=pgp-signature body. I have not tested this. It may or may not work, and it doesn't satisfy application 3, as it's PGP specific. - Permit multiple application/pgp-signature parts in a mult/sign; prot=pgp-sig body. This would be an extension of RFC 1847, it would be simple, but it would be PGP-specific once again. - Define a multipart/mixed protocol in the spirit of RFC 1847. This would not require any changes to RFC 1847, and it would be usable for all applications I listed above. I prefer this solution for the reason that it is not specific to any of the underlying signature protocols. Modifications to MUAs to support this on the receiving side are minimal if these MUAs are able to handle multi-level MIME structures. I've done a testbed implementation in the unstable tree of the Mutt MUA. For the details of this protocol, see Michael Elkins' message from Tue, 1 Dec 1998 17:15:18 -0800 to this list. tlr -- http://home.pages.de/~roessler/ Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id MAA10229 for ietf-open-pgp-bks; Thu, 18 Feb 1999 12:30:14 -0800 (PST) Received: from mage.qualcomm.com (mage.qualcomm.com [129.46.174.16]) by mail.proper.com (8.8.8/8.8.5) with ESMTP id MAA10225 for ; Thu, 18 Feb 1999 12:30:14 -0800 (PST) Received: from [129.46.222.186] (jnoerenberg-mac.qualcomm.com [129.46.222.186]) by mage.qualcomm.com (8.8.5/1.4/8.7.2/1.14) with ESMTP id MAA18009; Thu, 18 Feb 1999 12:33:23 -0800 (PST) Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" ; format="flowed" X-Sender: jwn2@mage.qualcomm.com Message-Id: In-Reply-To: <199902161407.JAA014.84@whgiii> References: <199902161247.HAA014.13@whgiii> X-Mailer: Eudora [Macintosh version 4.1b70-3.99] X-PGP-RSA-Fingerprint: EA53 01A6 C076 F9C2 09E8 9480 645A 8857 X-PGP-DH-Fingerprint: 4F5E 56C9 BD4D 0227 331F 6AEE 9590 24F9 6FD7 04F8 Date: Thu, 18 Feb 1999 12:11:47 -0800 To: "William H. Geiger III" From: "John W. Noerenberg" Subject: Re: Abandon e-mail and go to direct connections? Cc: ietf-open-pgp@imc.org Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: At 9:05 AM -0500 2/16/99, William H. Geiger III wrote: > > Sorry about that last post, I don't know why it got cross-posted here, > user error I guess. :( Apology accepted. There are worse sins. best, john noerenberg jwn2@qualcomm.com ---------------------------------------------------------------------- The man that can most truly be accounted brave is he who best knows the meaning of what is sweet in life and what is terrible, and then goes out undeterred to meet what is to come. -- Pericles, "Funeral Oration", 479 B.C. ---------------------------------------------------------------------- Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id MAA10223 for ietf-open-pgp-bks; Thu, 18 Feb 1999 12:30:05 -0800 (PST) Received: from mage.qualcomm.com (mage.qualcomm.com [129.46.174.16]) by mail.proper.com (8.8.8/8.8.5) with ESMTP id MAA10219 for ; Thu, 18 Feb 1999 12:30:04 -0800 (PST) Received: from [129.46.222.186] (jnoerenberg-mac.qualcomm.com [129.46.222.186]) by mage.qualcomm.com (8.8.5/1.4/8.7.2/1.14) with ESMTP id MAA17924; Thu, 18 Feb 1999 12:33:04 -0800 (PST) Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" ; format="flowed" X-Sender: jwn2@mage.qualcomm.com Message-Id: In-Reply-To: <19990126224933.J11060@sobolev.rhein.de> X-Mailer: Eudora [Macintosh version 4.1b70-3.99] X-PGP-RSA-Fingerprint: EA53 01A6 C076 F9C2 09E8 9480 645A 8857 X-PGP-DH-Fingerprint: 4F5E 56C9 BD4D 0227 331F 6AEE 9590 24F9 6FD7 04F8 Date: Thu, 18 Feb 1999 12:25:34 -0800 To: Thomas Roessler From: "John W. Noerenberg" Subject: Re: to be done Cc: ietf-open-pgp@imc.org, "Jeffrey I. Schiller" Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: At 10:49 PM +0100 1/26/99, Thomas Roessler wrote: > Since things don't look like we are ever getting the minutes from > the IETF meeting, I'd like to give a push for some work which should > be done by this WG. > > - Revise RFC 2015. I'm hearing that the agreement in Orlando was to > do some small changes. While this isn't interesting or anything, > it should be done. Yes. > > - Define a multiple signature protocol. There are essentially two > possible paths to go. On the one hand, we may define a > multipart/mixed protocol as suggested by Michael Elkins, or we may > just extend the current multipart/signed. Personally, I'm in > favor of the fist approach. Write up the motivation for multiple signatures, and publish it to the list. Since reconciling handling of multiple signatures is one of the issues raised in concern with 2015, a separate protocol is a reasonable way to attack the problem. What are other opinions on settling this? We will not meet in Minneapolis. I hope y'all aren't greatly disappointed. I will stand in the email stocks so you can sling your rocks and arrows. I do want to meet in Oslo so we can consider 2015 revisions, and perhaps the multiple signature protocol if we decide that is best course. This means it would be good to have a 2015 revision and some debate over it in time for the that meeting. More on this soon. best, john noerenberg jwn2@qualcomm.com ---------------------------------------------------------------------- The man that can most truly be accounted brave is he who best knows the meaning of what is sweet in life and what is terrible, and then goes out undeterred to meet what is to come. -- Pericles, "Funeral Oration", 479 B.C. ---------------------------------------------------------------------- Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id CAA02818 for ietf-open-pgp-bks; Thu, 18 Feb 1999 02:29:36 -0800 (PST) Received: from ns1.via.at (ns1.via.at [194.41.60.10]) by mail.proper.com (8.8.8/8.8.5) with ESMTP id CAA02814 for ; Thu, 18 Feb 1999 02:29:34 -0800 (PST) Received: (from root@localhost) by ns1.via.at (8.7.5/8.7.3) id LAA13990; Thu, 18 Feb 1999 11:33:42 +0100 (MET) To: gkwagner@via.at Received: from mail.proper.com(206.86.127.224) by ns1.via.at via smap (V2.1+anti-relay+anti-spam) id xma000829; Wed, 17 Feb 99 12:49:57 +0100 Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id CAA16068 for ietf-open-pgp-bks; Wed, 17 Feb 1999 02:17:34 -0800 (PST) Received: from pompano.pcola.gulf.net (root@gulf.net [198.69.72.14]) by mail.proper.com (8.8.8/8.8.5) with ESMTP id CAA16064 for ; Wed, 17 Feb 1999 02:17:33 -0800 (PST) Received: from whgiii (humpback29.pcola.gulf.net [205.160.70.158]) by pompano.pcola.gulf.net (8.9.1a/8.9.1) with SMTP id EAA13840; Wed, 17 Feb 1999 04:21:44 -0600 (CST) Received: from whgiii by whgiii (IBM OS/2 SENDMAIL VERSION 2.03/2.0) id EAA020.61; Wed, 17 Feb 1999 04:35:18 -0500 Message-Id: <199902170935.EAA020.61@whgiii> From: "William H. Geiger III" Date: Wed, 17 Feb 1999 04:33:29 -0500 To: Andy Dustman In-Reply-To: Cc: ietf-open-pgp@imc.org, remailer-operators@anon.lcs.mit.edu Subject: Re: Abandon e-mail and go to direct connections? X-Mailer: MR/2 Internet Cruiser Edition for OS/2 v1.60 b60 List-Archive: List-Unsubscribe: Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: -----BEGIN PGP SIGNED MESSAGE----- In , on 02/16/99 at 12:39 PM, Andy Dustman said: >-----BEGIN PGP SIGNED MESSAGE----- >On Tue, 16 Feb 1999, William H. Geiger III wrote: >> Since we are talking about creating a mixmaster 3 has anyone thought of >> abandoning using e-mail and go to direct connections between the mixmaster >> servers? We could use something like TLS for encrypted links. I think that >> there would be some advantages in this approach against traffic analysis >> of the remailers. If the remailer links were reliable we could have a >> steady stream of traffic between the servers injecting messages when >> needed. We would still need pooling and mixing on the end remailers before >> they sent messages out for the final hop via sendmail. >That's actually been in the works for a long time, probably pre-2.0.3. >The idea was to use a DH key exchange. Another advantage of doing >something like this, probably often overlooked, is that mixmaster packets >can be exchanged in binary 8-bit format: No more ASCII armor and a 25% >reduction in size, at least. Not everyone will be able to make use of >this (you'll need to have at least a PPP connection). Even then, a >possibility is to list a remailer as intermittent, so that other >remailers don't try to transfer messages unless there is already an open >connection with that remailer, or try once per hour. Something like that. Well I guess for the remailers that are not on a direct connection we could switch back to the old format for transmitting messages. We will still need this ability for accepting messages from and send to the end users. - -- - --------------------------------------------------------------- William H. Geiger III http://www.openpgp.net Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 5.0 at: http://www.openpgp.net/pgp.html Talk About PGP on IRC EFNet Channel: #pgp Nick: whgiii - --------------------------------------------------------------- Tag-O-Matic: OS/2 means...CURTAINS for Windows! -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.0i OS/2 for non-commercial use Comment: Registered_User_E-Secure_v1.1b1_ES000000 Charset: cp850 wpUDBQE2yo1Tj0KjWf5ouGEBAXeoBAC7J+wIRNJg83X6PiM8T88JwVaqI76dde0s rAlcmZGTzBYDpJCQsyumOKUr8w0Cjc1QEEhQxRmZ2++Bjl/abcUz+ZBbWZSQwnan xc2US+Q9LFr11pR5S40mZJ/xouX5hTL6O5Ou+FcjGNqchLoRj6Kx6Ag8EabUTxLR 5IQ3/VEdog== =MxPQ -----END PGP SIGNATURE----- Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id CAA16068 for ietf-open-pgp-bks; Wed, 17 Feb 1999 02:17:34 -0800 (PST) Received: from pompano.pcola.gulf.net (root@gulf.net [198.69.72.14]) by mail.proper.com (8.8.8/8.8.5) with ESMTP id CAA16064 for ; Wed, 17 Feb 1999 02:17:33 -0800 (PST) Received: from whgiii (humpback29.pcola.gulf.net [205.160.70.158]) by pompano.pcola.gulf.net (8.9.1a/8.9.1) with SMTP id EAA13840; Wed, 17 Feb 1999 04:21:44 -0600 (CST) Received: from whgiii by whgiii (IBM OS/2 SENDMAIL VERSION 2.03/2.0) id EAA020.61; Wed, 17 Feb 1999 04:35:18 -0500 Message-Id: <199902170935.EAA020.61@whgiii> From: "William H. Geiger III" Date: Wed, 17 Feb 1999 04:33:29 -0500 To: Andy Dustman In-Reply-To: Cc: ietf-open-pgp@imc.org, remailer-operators@anon.lcs.mit.edu Subject: Re: Abandon e-mail and go to direct connections? X-Mailer: MR/2 Internet Cruiser Edition for OS/2 v1.60 b60 Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: -----BEGIN PGP SIGNED MESSAGE----- In , on 02/16/99 at 12:39 PM, Andy Dustman said: >-----BEGIN PGP SIGNED MESSAGE----- >On Tue, 16 Feb 1999, William H. Geiger III wrote: >> Since we are talking about creating a mixmaster 3 has anyone thought of >> abandoning using e-mail and go to direct connections between the mixmaster >> servers? We could use something like TLS for encrypted links. I think that >> there would be some advantages in this approach against traffic analysis >> of the remailers. If the remailer links were reliable we could have a >> steady stream of traffic between the servers injecting messages when >> needed. We would still need pooling and mixing on the end remailers before >> they sent messages out for the final hop via sendmail. >That's actually been in the works for a long time, probably pre-2.0.3. >The idea was to use a DH key exchange. Another advantage of doing >something like this, probably often overlooked, is that mixmaster packets >can be exchanged in binary 8-bit format: No more ASCII armor and a 25% >reduction in size, at least. Not everyone will be able to make use of >this (you'll need to have at least a PPP connection). Even then, a >possibility is to list a remailer as intermittent, so that other >remailers don't try to transfer messages unless there is already an open >connection with that remailer, or try once per hour. Something like that. Well I guess for the remailers that are not on a direct connection we could switch back to the old format for transmitting messages. We will still need this ability for accepting messages from and send to the end users. - -- - --------------------------------------------------------------- William H. Geiger III http://www.openpgp.net Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 5.0 at: http://www.openpgp.net/pgp.html Talk About PGP on IRC EFNet Channel: #pgp Nick: whgiii - --------------------------------------------------------------- Tag-O-Matic: OS/2 means...CURTAINS for Windows! -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.0i OS/2 for non-commercial use Comment: Registered_User_E-Secure_v1.1b1_ES000000 Charset: cp850 wpUDBQE2yo1Tj0KjWf5ouGEBAXeoBAC7J+wIRNJg83X6PiM8T88JwVaqI76dde0s rAlcmZGTzBYDpJCQsyumOKUr8w0Cjc1QEEhQxRmZ2++Bjl/abcUz+ZBbWZSQwnan xc2US+Q9LFr11pR5S40mZJ/xouX5hTL6O5Ou+FcjGNqchLoRj6Kx6Ag8EabUTxLR 5IQ3/VEdog== =MxPQ -----END PGP SIGNATURE----- Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id AAA11341 for ietf-open-pgp-bks; Wed, 17 Feb 1999 00:54:52 -0800 (PST) Received: from dnnit.com (pool050-max6.ds19-ca-us.dialup.earthlink.net [209.179.14.150]) by mail.proper.com (8.8.8/8.8.5) with SMTP id AAA11336 for ; Wed, 17 Feb 1999 00:54:37 -0800 (PST) From: justabuddy@aol.com Message-Id: <199902170854.AAA11336@mail.proper.com> To: Subject: Create $50000 in 90 days at home Date: Wed, 17 Feb 1999 02:38:49 Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: ***************************************************************** TO BE PERMANANTLY REMOVED FROM OUR MAILING LIST PLEASE GO TO FOLLOWING WEB SITE: http://creativecomm.freeservers.com/delete.htm This message is sent in compliance of the new e-mail bill: SECTION 301. Sender: Creative Communications, P.O. Box 14, Maidsville, WV 26541 ***************************************************************** EARN $100,000 PER YEAR SENDING E-MAIL!!! ***************************************************************** Dear Friend, You can earn $50,000 or more in next the 90 days sending e-mail, seem impossible? Read on for details (no, there is no 'catch')... ----------------------------------------------------------------- ----------------------- "AS SEEN ON NATIONAL T.V." Thank you for your time and Interest. This is the letter you've been reading about in the news lately. Due to the popularity of this letter on the internet, a major nightly news program recently devoted an entire show to the investigation of the program described below to see, if it really can make people money. The show also investigated whether or not the program was legal. Their findings proved once and for all that there are, absolutely no laws prohibiting the participation in the program. This has helped to show people that this is a simple, harmless and fun way to make some extra money at home. The results of this show has been truly remarkable. So many people are participating that those involved are doing, much better than ever before. Since everyone makes more as more people try it out, its been very exciting to be a part of lately. You will understand once you experience it. "HERE IT IS BELOW" ================================================ ================================================ *** Print This Now For Future Reference *** The following income opportunity is one you may be interested in taking a look at. It can be started with VERY LITTLE investment and the income return is TREMENDOUS!!! $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ If you would like to make at least $50,000 in less than 90 days! Please read the enclosed program...THEN READ IT AGAIN!!! $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ THIS IS A LEGITIMATE, LEGAL, MONEY MAKING OPPORTUNITY. It does not require you to come into contact with people, do any hard work, and best of all, you never have to leave the house except to get the mail. If you believe that someday you'll get that big break that you've been waiting for, THIS IS IT! Simply follow the instructions, and your dreams will come true. This multi-level e-mail order marketing program works perfectly...100% EVERY TIME. E-mail is the sales tool of the future. Take advantage of this non-commercialized method of advertising NOW!!! The longer you wait, the more people will be doing business using e-mail. Get your piece of this action!!! MULTI-LEVEL MARKETING (MLM) has finally gained respectability. It is being taught in the Harvard Business School, and both Stanford Research and the Wall Street Journal have stated that between 50% and 65% of all goods and services will be sold through multi-level methods by the mid to late 1990's. This is a Multi-Billion Dollar industry and of the 500,000 millionaires in the U.S., 20% (100,000) made their fortune in the last several years in MLM. Moreover, statistics show 45 people become millionaires everyday through Multi-Level Marketing. You may have heard this story before, but over the summer Donald Trump made an appearance on the David Letterman show. Dave asked him what he would do if he lost everything and had to start over from scratch. Without hesitating, Trump said he would find a good network marketing company and get to work. The audience started to hoot and boo him. He looked out at the audience and dead-panned his response "That's why I'm sitting up here and you are all sitting out there!" With network marketing you have two sources of income. Direct commissions from sales you make yourself and commissions from sales made by people you introduce to the business. Residual income is the secret of the wealthy. It means investing time or money once and getting paid again and again and again. In network marketing, it also means getting paid for the work of others. The enclosed information is something I almost let slip through my fingers. Fortunately, sometime later I re-read everything and gave some thought and study to it. My name is Johnathon Rourke. Two years ago, the corporation I worked at for the past twelve years down-sized and my position was eliminated. After unproductive job interviews, I decided to open my own business. Over the past year, I incurred many unforeseen financial problems. I owed my family, friends and creditors over $35,000. The economy was taking a toll on my business and I just couldn't seem to make ends meet. I had to refinance and borrow against my home to support my family and struggling business. AT THAT MOMENT something significant happened in my life and I am writing to share the experience in hopes that this will change your life FOREVER FINANCIALLY!!! In mid December, I received this program via e-mail. Six month's prior to receiving this program I had been sending away for information on various business opportunities. All of the programs I received, in my opinion, were not cost effective. They were either too difficult for me to comprehend or the initial investment was too much for me to risk to see if they would work or not. One claimed that I would make a million dollars in one year...it didn't tell me I'd have to write a book to make it! But like I was saying, in December of 1997 I received this program. I didn't send for it, or ask for it, they just got my name off a mailing list. THANK GOODNESS FOR THAT!!! After reading it several times, to make sure I was reading it correctly, I couldn't believe my eyes. Here was a MONEY MAKING PHENOMENON. I could invest as much as I wanted to start, without putting me further into debt. After I got a pencil and paper and figured it out, I would at least get my money back. But like most of you I was still a little skeptical and a little worried about the legal aspects of it all. So I checked it out with the U.S. Post Office (1-800-725-2161 24-hrs) and they confirmed that it is indeed legal! After determining the program was LEGAL and NOT A CHAIN LETTER, I decided "WHY NOT." Initially I sent out 10,000 e-mails. It cost me about $15 for my time on-line. The great thing about e-mail is that I don't need any money for printing to send out the program, and because all of my orders are fulfilled via e-mail, the only expense is my time. I am telling you like it is, I hope it doesn't turn you off, but I promised myself that I would not "rip-off" anyone, no matter how much money it cost me. In less than one week, I was starting to receive orders for REPORT #1. By January 13, I had received 26 orders for REPORT #1. Your goal is to "RECEIVE at least 20 ORDERS FOR REPORT #1 WITHIN 2 WEEKS. IF YOU DON'T, SEND OUT MORE PROGRAMS UNTIL YOU DO!" My first step in making $50,000 in 90 days was done. By January 30, I had received 196 orders for REPORT #2. Your goal is to "RECEIVE AT LEAST 100+ ORDERS FOR REPORT #2 WITHIN 2 WEEKS. IF NOT, SEND OUT MORE PROGRAMS UNTIL YOU DO. ONCE YOU HAVE 100 ORDERS, THE REST IS EASY, RELAX, YOU WILL MAKE YOUR $50,000 GOAL." Well, I had 196 orders for REPORT #2, 96 more than I needed. So I sat back and relaxed. By March 1, of my e-mailing of 10,000, I received $58,000 with more coming in every day. I paid off ALL my debts and bought a much needed new car. Please take time to read the attached program, IT WILL CHANGE YOUR LIFE FOREVER!!! Remember, it won't work if you don't try it. This program does work, but you must follow it EXACTLY! Especially the rules of not trying to place your name in a different place. It won't work, you'll lose out on a lot of money! In order for this program to work, you must meet your goal of 20+ orders for REPORT #1, and 100+ orders for REPORT #2 and you will make $50,000 or more in 90 days. I AM LIVING PROOF THAT IT WORKS!!! If you choose not to participate in this program, I am sorry. It really is a great opportunity with little cost or risk to you. If you choose to participate, follow the program and you will be on your way to financial security. If you are a fellow business owner and are if financial trouble like I was, or you want to start your own business, consider this a sign.I DID! Sincerely, Johnathon Rourke P.S. Do you have any idea what 11,700 $5 bills ($58,000) look like piled up on a kitchen table? IT'S AWESOME! A PERSONAL NOTE FROM THE ORIGINATOR OF THIS PROGRAM: By the time you have read the enclosed program and reports, you should have concluded that such a program, and one that is legal, could not have been created by an amateur. Let me tell you a little about myself. I had a profitable business for 10 years. Then in 1979 my business began falling off. I was doing the same things that were previously successful for me, but it wasn't working. Finally, I figured it out. It wasn't me, it was the economy. Inflation and recession had replaced the stable economy that had been with us since 1945. I don't have to tell you what happened to the unemployment rate... because many of you know from first hand experience. There were more failures and bankruptcies than ever before. The middle class was vanishing. Those who knew what they were doing invested wisely and moved up. Those who did not, including those who never had anything to save or invest, were moving down into the ranks of the poor. As the saying goes, "THE RICH GET RICHER AND THE POOR GET POORER." The traditional methods of making money will never allow you to "move up" or "get rich", inflation will see to that. You have just received information that can give you financial freedom for the rest of your life, with "NO RISK" and "JUST A LITTLE BIT OF EFFORT." You can make more money in the next few months than you have ever imagined. I should also point out that I will not see a penny of this money, nor anyone else who has provided a testimonial for this program. I have already made over 4 MILLION DOLLARS! I have retired from the program after sending out over 16,000 programs. Now I have several offices that make this and several other programs here and over seas. Follow the program EXACTLY AS INSTRUCTED. Do not change it in any way. It works exceedingly well as it is now. Remember to e-mail a copy of this exciting report to everyone you can think of. One of the people you send this to may send out 50,000...and your name will be on everyone of them! Remember though, the more you send out the more potential customers you will reach. So my friend, I have given you the ideas, information, materials and opportunity to become financially independent, IT IS UP TO YOU NOW! "THINK ABOUT IT" Before you delete this program from your mailbox, as I almost did,take a little time to read it and REALLY THINK ABOUT IT. Get a pencil and figure out what could happen when YOU participate. Figure out the worst possible response and no matter how you calculate it, you will still make a lot of money! You will definitely get back what you invested. Any doubts you have will vanish when your first orders come in. IT WORKS! Jody Jacobs, Richmond, VA HERE'S HOW THIS AMAZING PROGRAM WILL MAKE YOU THOUSANDS OF DOLLAR$ INSTRUCTIONS: This method of raising capital REALLY WORKS 100% EVERY TIME. I am sure that you could use up to $50,000 or more in the next 90 days. Before you say "BULL... ", please read this program carefully. This is not a chain letter, but a perfectly legal money making opportunity. Basically, this is what you do: As with all multi-level businesses, we build our business by recruiting new partners and selling our products. Every state in the USA allows you to recruit new multi-level business partners, and we offer a product for EVERY dollar sent. YOUR ORDERS COME BY MAIL AND ARE FILLED BY E-MAIL, so you are not involved in personal selling. You do it privately in your own home, store or office. This is the GREATEST Multi-Level Mail Order Marketing anywhere: This is what you MUST do: 1. Order all 4 reports shown on the list below (you can't sell them if you don't order them). * For each report, send $5.00 CASH, the NAME & NUMBER OF THE REPORT YOU ARE ORDERING, YOUR E-MAIL ADDRESS, and YOUR NAME & RETURN ADDRESS (in case of a problem) to the person whose name appears on the list next to the report. MAKE SURE YOUR RETURN ADDRESS IS ON YOUR ENVELOPE IN CASE OF ANY MAIL PROBLEMS! * When you place your order, make sure you order each of the four reports. You will need all four reports so that you can save them on your computer and resell them. * Within a few days you will receive, via e-mail, each of the four reports. Save them on your computer so they will be accessible for you to send to the 1,000's of people who will order them from you. 2. IMPORTANT-- DO NOT alter the names of the people who are listed next to each report, or their sequence on the list, in any way other than is instructed below in steps "a" through "f" or you will lose out on the majority of your profits. Once you understand the way this works, you'll also see how it doesn't work if you change it. Remember, this method has been tested, and if you alter it, it will not work. a. Look below for the listing of available reports. b. After you've ordered the four reports, take this advertisement and remove the name and address under REPORT #4. This person has made it through the cycle and is no doubt counting their $50,000! c. Move the name and address under REPORT #3 down to REPORT #4. d. Move the name and address under REPORT #2 down to REPORT #3. e. Move the name and address under REPORT #1 down to REPORT #2. f. Insert your name/address in the REPORT #1 position. Please make sure you copy every name and address ACCURATELY! 3. Take this entire letter, including the modified list of names, and save it to your computer. Make NO changes to the instruction portion of this letter. Your cost to participate in this is practically nothing (surely you can afford $20). You obviously already have an Internet connection and e-mail is FREE! To assist you with marketing your business on the internet, the 4 reports you purchase will provide you with invaluable marketing information which includes how to send bulk e-mails, where to find thousands of free classified ads and much, much more. In addition you will be provided with information on Internet Marketing Clubs such as INTERNET MARKETING RESOURCES(IMR): This is one the premiere internet marketing clubs on the INTERNET. This club provides a forum where internet marketers from all over the world can exchange ideas and secrets on Internet Marketing. In addition,this club specializes in providing free internet marketing tools and services for the Do-Yourself-Internet-Marketer. They will provide you with free bulk e-mail software and up to 1,000,000 fresh e-mail addresses each week. This club will provide you with hundreds of free resources which include: How to obtain free web sites, how to obtain top rankings in search engines for your web-site, how to send bulk e-mail into AOL and Compuserve, how to market your products on newsgroups, free classified ads, electronic malls, bulletin boards, banner ads and much more. IMR'S web address is: http://www.ixpres.com/imrs/marketing1.htm There are two primary methods of building your downline: METHOD #1: SENDING BULK E-MAIL Let's say that you decide to start small, just to see how it goes, and we'll assume you and all those involved send out only 2,000 programs each. Let's also assume that the mailing receives a 0.5% response. Using a good list the response could be much better. Also, many people will send out hundreds of thousands of programs instead of 2,000. But continuing with this example, you send out only 2,000 programs. With a 0.5% response, that is only 10 orders for REPORT #1. Those 10 people respond by sending out 2,000 programs each for a total of 20,000. Out of those 0.5%, 100 people respond and order REPORT #2. Those 100 mail out 2,000 programs each for a total of 200,000. The 0.5% response to that is 1,000 orders for REPORT #3. Those 1,000 send out 2,000 programs each for a 2,000,000 total. The 0.5% response to that is 10,000 orders for REPORT #4. That's 10,000 $5 bills for you. CASH!!! Your total income in this example is $50 + $500 + $5,000 + $50,000 for a total of $55,550!!! REMEMBER FRIEND, THIS IS ASSUMING 1,990 OUT OF THE 2,000 PEOPLE YOU MAIL TO WILL DO ABSOLUTELY NOTHING AND TRASH THIS PROGRAM! DARE TO THINK FOR A MOMENT WHAT WOULD HAPPEN IF EVERYONE, OR HALF SENT OUT 100,000 PROGRAMS INSTEAD OF 2,000. Believe me, many people will do just that, and more! By the way, your cost to participate in this is practically nothing. You obviously already have an internet connection and e-mail is FREE!!! REPORT #2 will show you the best methods for bulk e-mailing, tell you where to obtain free bulk e-mail software and where to obtain e-mail lists. METHOD #2 - PLACING FREE ADS ON THE INTERNET 1. Advertising on the 'Net is very, very inexpensive, and there are HUNDREDS of FREE places to advertise. Let's say you decide to start small just to see how well it works. Assume your goal is to get ONLY 10 people to participate on your first level. (Placing a lot of FREE ads on the internet will EASILY get a larger response.) Also assume that everyone else in YOUR ORGANIZATION gets ONLY 10 downline members. Follow this example to achieve the STAGGERING results below. 1st level--your 10 members with $5 ....................$50 2nd level--10 members from those 10 ($5 x 100)...............$500 3rd level--10 members from those 100 ($5 x 1,000)........ $5,000 4th level--10 members from those 1,000 ($5 x 10,000). $50,000 ----------- THIS TOTALS ---------------------------$55,550 Remember friends, this assumes that the people who participate only recruit 10 people each. Think for a moment what would happen if they got 20 people to participate! Most people get 100's of participants! THINK ABOUT IT! For every $5.00 you receive, all you must do is e-mail them the report they ordered. THAT'S IT! ALWAYS PROVIDE SAME-DAY SERVICE ON ALL ORDERS! This will guarantee that the e-mail THEY send out, with YOUR name and address on it, will be prompt because they can't advertise until they receive the report! ------------------------------------------ AVAILABLE REPORTS ------------------------------------------ *** Order Each REPORT by NUMBER and NAME *** Notes: - ALWAYS SEND $5 CASH (U.S. CURRENCY) FOR EACH REPORT CHEQUES NOT ACCEPTED - ALWAYS SEND YOUR ORDER VIA FIRST CLASS MAIL - Make sure the cash is concealed by wrapping it in at least two sheets of paper - On one of those sheets of paper, include: (a) the number & name of the report you are ordering, (b) your e-mail address, and (c) your name & postal address. PLACE YOUR ORDER FOR THESE REPORTS NOW: ______________________________________________________ REPORT #1 "The Insider's Guide to Advertising for Free on the Internet" ORDER REPORT #1 FROM: Larry Boone 7112 Kittyhawk Ave AptB Los Angeles, CA 90045 ______________________________________________________ REPORT #2 "The Insider's Guide to Sending Bulk E-mail on the Internet" ORDER REPORT #2 FROM: Creative Communications P.O. Box 14 Maidsville, WV 2654 ______________________________________________________ REPORT #3 "The Secrets to Multilevel Marketing on the Internet" ORDER REPORT #3 FROM: American United Marketing 3915 Mission Avenue Suite 7414 Oceanside, Ca. 92054-7801 ______________________________________________________ REPORT #4 "How to become a Millionaire utilizing the Power of Multilevel Marketing and the Internet" ORDER REPORT #4 FROM: MLH Enterprises 1450 N. Santa Fe Suite C-525 Vista, Ca. 92083 ______________________________________________________ ______________________________________________________ About 50,000 new people get online every month! ******* TIPS FOR SUCCESS ******* * TREAT THIS AS YOUR BUSINESS! Be prompt, professional, and follow the directions accurately. * Send for the four reports IMMEDIATELY so you will have them when the orders start coming in because: When you receive a $5 order, you MUST send out the requested product/report. * ALWAYS PROVIDE SAME-DAY SERVICE ON THE ORDERS YOU RECEIVE. * Be patient and persistent with this program. If you follow the instructions exactly, your results WILL BE SUCCESSFUL! * ABOVE ALL, HAVE FAITH IN YOURSELF AND KNOW YOU WILL SUCCEED! ******* YOUR SUCCESS GUIDELINES ******* Follow these guidelines to guarantee your success: If you don't receive 20 orders for REPORT #1 within two weeks, continue advertising or sending e-mails until you do. Then, a couple of weeks later you should receive at least 100 orders for REPORT#2. If you don't, continue advertising or sending e-mails until you do. Once you have received 100 or more orders for REPORT #2, YOU CAN RELAX, because the system is already working for you, and the cash will continue to roll in! THIS IS IMPORTANT TO REMEMBER: Every time your name is moved down on the list, you are placed in front of a DIFFERENT report. You can KEEP TRACK of your PROGRESS by watching which report people are ordering from you. If you want to generate more income, send another batch of e-mails or continue placing ads and start the whole process again! There is no limit to the income you will generate from this business! Before you make your decision as to whether or not you participate in this program. Please answer one question. DO YOU WANT TO CHANGE YOUR LIFE? If the answer is yes, please look at the following facts about this program: 1. YOU ARE SELLING A PRODUCT WHICH DOES NOT COST ANYTHING TO PRODUCE! 2. YOU ARE SELLING A PRODUCT WHICH DOES NOT COST ANYTHING TO SHIP! 3. YOU ARE SELLING A PRODUCT WHICH DOES NOT COST YOU ANYTHING TO ADVERTISE! 4. YOU ARE UTILIZING THE POWER OF THE INTERNET AND THE POWER OF MULTI-LEVEL MARKETING TO DISTRIBUTE YOUR PRODUCT ALL OVER THE WORLD! 5. YOUR ONLY EXPENSES OTHER THAN YOUR INITIAL $20 INVESTMENT IS YOUR TIME! 6. VIRTUALLY ALL OF THE INCOME YOU GENERATE FROM THIS PROGRAM IS PURE PROFIT! 7. THIS PROGRAM WILL CHANGE YOUR LIFE FOREVER. ******* T E S T I M O N I A L S ******* This program does work, but you must follow it EXACTLY! Especially the rule of not trying to place your name in a different position, it won't work and you'll lose a lot of potential income. I'm living proof that it works. It really is a great opportunity to make relatively easy money, with little cost to you. If you do choose to participate, follow the program exactly, and you'll be on your way to financial security. Steven Bardfield, Portland, OR My name is Mitchell. My wife, Jody, and I live in Chicago, IL. I am a cost accountant with a major U.S. Corporation and I make pretty good money. When I received the program I grumbled to Jody about receiving "junk mail." I made fun of the whole thing, spouting my knowledge of the population and percentages involved. I "knew" it wouldn't work. Jody totally ignored my supposed intelligence and jumped in with both feet. I made merciless fun of her, and was ready to lay the old "I told you so" on her when the thing didn't work... well, the laugh was on me! Within two weeks she had received over 50 responses. Within 45 days she had received over $147,200 in $5 bills! I was shocked! I was sure that I had it all figured and that it wouldn't work. I AM a believer now. I have joined Jody in her "hobby." I did have seven more years until retirement, but I think of the "rat race" and it's not for me. We owe it all to MLM. Mitchell Wolf MD., Chicago, IL The main reason for this letter is to convince you that this system is honest, lawful, extremely profitable, and is a way to get a large amount of money in a short time. I was approached several times before I checked this out. I joined just to see what one could expect in return for the minimal effort and money required. To my astonishment, I received $36,470.00 in the first 14 weeks, with money still coming in. Sincerely yours, Charles Morris, Esq. Not being the gambling type, it took me several weeks to make up my mind to participate in this plan. But conservative that I am, I decided that the initial investment was so little that there was just no way that I wouldn't get enough orders to at least get my money back. Boy, was I surprised when I found my medium-size post office box crammed with orders! For awhile, it got so overloaded that I had to start picking up my mail at the window. I'll make more money this year than any 10 years of my life before. The nice thing about this deal is that it doesn't matter where people live. There simply isn't a better investment with a faster return. Paige Willis, Des Moines, IA I had received this program before. I deleted it, but later I wondered if I shouldn't have given it a try. Of course, I had no idea who to contact to get another copy, so I had to wait until I was e-mailed another program, ...11 months passed then it came...I didn't delete this one!...I made more than $41,000 on the first try!! Violet Wilson, Johnstown, PA This is my third time to participate in this plan. We have quit our jobs, and will soon buy a home on the beach and live off the interest on our money. The only way on earth that this plan will work for you is if you do it. For your sake, and for your family's sake don't pass up this golden opportunity. Good luck and happy spending! Kerry Ford, Centerport, NY ORDER YOUR REPORTS TODAY AND GET STARTED ON YOUR ROAD TO FINANCIAL FREEDOM! NOW IS THE TIME FOR YOUR TURN DECISIVE ACTION YIELDS POWERFUL RESULTS PLEASE NOTE: If you need help with starting a business, registering a business name, learning how income tax is handled, etc., contact your local office of the Small Business Administration (a Federal agency) 1-(800)827-5722 for free help and answers to questions. Also, the Internal Revenue Service offers free help via telephone and free seminars about business tax requirements. Your earnings and results are highly dependant on your activities and advertising. This letter constitutes no guarantees stated nor implied. In the event that it is determined that this letter constitutes a guarantee of any kind, that guarantee is now void. Any testimonials or amounts of earnings listed in this letter may be factual or fictitious. If you have any question of the legality of this letter contact the Office of Associate Director for Marketing Practices Federal Trade Commission Bureau of Consumer Protection in Washington DC. Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id JAA23103 for ietf-open-pgp-bks; Tue, 16 Feb 1999 09:35:17 -0800 (PST) Received: from kenny.comstar.net (qmailr@kenny.comstar.net [205.244.188.12]) by mail.proper.com (8.8.8/8.8.5) with SMTP id JAA23099 for ; Tue, 16 Feb 1999 09:35:16 -0800 (PST) Received: (qmail 10434 invoked by uid 500); 16 Feb 1999 17:39:28 -0000 Date: Tue, 16 Feb 1999 12:39:24 -0500 (EST) From: Andy Dustman To: "William H. Geiger III" cc: ietf-open-pgp@imc.org, remailer-operators@anon.lcs.mit.edu Subject: Re: Abandon e-mail and go to direct connections? In-Reply-To: <199902161247.HAA014.13@whgiii> Message-ID: Copyright: 1999 by Andy Dustman Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: -----BEGIN PGP SIGNED MESSAGE----- On Tue, 16 Feb 1999, William H. Geiger III wrote: > Since we are talking about creating a mixmaster 3 has anyone thought of > abandoning using e-mail and go to direct connections between the mixmaster > servers? We could use something like TLS for encrypted links. I think that > there would be some advantages in this approach against traffic analysis > of the remailers. If the remailer links were reliable we could have a > steady stream of traffic between the servers injecting messages when > needed. We would still need pooling and mixing on the end remailers before > they sent messages out for the final hop via sendmail. That's actually been in the works for a long time, probably pre-2.0.3. The idea was to use a DH key exchange. Another advantage of doing something like this, probably often overlooked, is that mixmaster packets can be exchanged in binary 8-bit format: No more ASCII armor and a 25% reduction in size, at least. Not everyone will be able to make use of this (you'll need to have at least a PPP connection). Even then, a possibility is to list a remailer as intermittent, so that other remailers don't try to transfer messages unless there is already an open connection with that remailer, or try once per hour. Something like that. - -- Andy Dustman You should always say "spam" and "eggs" ComStar Communications Corp. instead of "foo" and "bar" (706) 549-7689 | PGP KeyID=0xC72F3F1D in Python examples. (Mark Lutz) -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: noconv iQEPAwUBNsmtTxOPBZTHLz8dAQEyYQfPSlWdmotMugIYR/QibZv/v0icgonwie3u /2rqamYNJKt+EqgdEM7dTq0gXHEaFy2JQtUxNn9uWeqy0vEaSBgOYT5RBDcle8/N kfgJiiUqUM0jtmuZRXV7BcXfps7edZeATFEUoCIT8cIonscs0v0ObFjSINcOH+Du M+SWF49w8+Q6Vq8O5MhwxyfcsQosjmdmlU5GxZeud1kDHmvip8Wnh7Ea9IoOYuyN jG7raw+mNjeQGYDzl4ujFlHNZ52VYh9FKJk/uqweOfM0E9+u2LU0jldHwpoizjvW uiFXareOYLF5pWYs5zttnNGK/IOqAV+r3wjuAvnqzTqQTQ== =xqoj -----END PGP SIGNATURE----- Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id GAA21598 for ietf-open-pgp-bks; Tue, 16 Feb 1999 06:50:15 -0800 (PST) Received: from pompano.pcola.gulf.net (root@gulf.net [198.69.72.14]) by mail.proper.com (8.8.8/8.8.5) with ESMTP id GAA21593 for ; Tue, 16 Feb 1999 06:50:14 -0800 (PST) Received: from whgiii (whgiii@minke23.pcola.gulf.net [205.160.71.38]) by pompano.pcola.gulf.net (8.9.1a/8.9.1) with SMTP id IAA11034 for ; Tue, 16 Feb 1999 08:54:24 -0600 (CST) Received: from whgiii by whgiii (IBM OS/2 SENDMAIL VERSION 2.03/2.0) id JAA014.84; Tue, 16 Feb 1999 09:07:57 -0500 Message-Id: <199902161407.JAA014.84@whgiii> From: "William H. Geiger III" Date: Tue, 16 Feb 1999 09:05:39 -0500 To: ietf-open-pgp@imc.org In-Reply-To: <199902161247.HAA014.13@whgiii> Subject: Re: Abandon e-mail and go to direct connections? X-Mailer: MR/2 Internet Cruiser Edition for OS/2 v1.60 b60 Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Sorry about that last post, I don't know why it got cross-posted here, user error I guess. :( If anyone is interested there are a few of us that are talking about re-writting the mixmaster code to make use of OpenPGP formats. Again sorry for the cross-post. - -- - --------------------------------------------------------------- William H. Geiger III http://www.openpgp.net Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 5.0 at: http://www.openpgp.net/pgp.html Talk About PGP on IRC EFNet Channel: #pgp Nick: whgiii - --------------------------------------------------------------- Tag-O-Matic: I don't do Windows, but OS/2 does. -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.0i OS/2 for non-commercial use Comment: Registered_User_E-Secure_v1.1b1_ES000000 Charset: cp850 wj8DBQE2yXu8lHpjA6A1ypsRAoRtAJ9WwU7LRlbvvNSS4H+I/HmhM0r1AACgxEs1 bvy3vGcPD2G0cZkjoqpKQF0= =g0U0 -----END PGP SIGNATURE----- Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id FAA20914 for ietf-open-pgp-bks; Tue, 16 Feb 1999 05:30:03 -0800 (PST) Received: from pompano.pcola.gulf.net (root@gulf.net [198.69.72.14]) by mail.proper.com (8.8.8/8.8.5) with ESMTP id FAA20907 for ; Tue, 16 Feb 1999 05:29:58 -0800 (PST) Received: from whgiii (whgiii@minke23.pcola.gulf.net [205.160.71.38]) by pompano.pcola.gulf.net (8.9.1a/8.9.1) with SMTP id HAA24132; Tue, 16 Feb 1999 07:33:59 -0600 (CST) Received: from whgiii by whgiii (IBM OS/2 SENDMAIL VERSION 2.03/2.0) id HAA014.13; Tue, 16 Feb 1999 07:47:28 -0500 Message-Id: <199902161247.HAA014.13@whgiii> From: "William H. Geiger III" Date: Tue, 16 Feb 1999 07:41:49 -0500 To: ietf-open-pgp@imc.org, remailer-operators@anon.lcs.mit.edu Subject: Abandon e-mail and go to direct connections? X-Mailer: MR/2 Internet Cruiser Edition for OS/2 v1.60 b60 Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Since we are talking about creating a mixmaster 3 has anyone thought of abandoning using e-mail and go to direct connections between the mixmaster servers? We could use something like TLS for encrypted links. I think that there would be some advantages in this approach against traffic analysis of the remailers. If the remailer links were reliable we could have a steady stream of traffic between the servers injecting messages when needed. We would still need pooling and mixing on the end remailers before they sent messages out for the final hop via sendmail. - -- - --------------------------------------------------------------- William H. Geiger III http://www.openpgp.net Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 5.0 at: http://www.openpgp.net/pgp.html Talk About PGP on IRC EFNet Channel: #pgp Nick: whgiii - --------------------------------------------------------------- Tag-O-Matic: Windows: The CP/M of the future! -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.0i OS/2 for non-commercial use Comment: Registered_User_E-Secure_v1.1b1_ES000000 Charset: cp850 wj8DBQE2yWjflHpjA6A1ypsRAmVzAJ9CEmtYZge51LWjd/mRpyzNhaKmPQCfTPFc 4rkk/jFDAyxbMsuSW9xRmj4= =Mpt9 -----END PGP SIGNATURE----- Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id PAA22548 for ietf-open-pgp-bks; Sat, 13 Feb 1999 15:22:54 -0800 (PST) Received: from mail-r2.shlink.de (mail-r2.shlink.de [194.64.6.19]) by mail.proper.com (8.8.8/8.8.5) with SMTP id PAA22544 for ; Sat, 13 Feb 1999 15:22:52 -0800 (PST) Received: from mail-r4.shlink.de (194.64.6.12) by mail-r2.shlink.de with esmtp id m10BoWQ-0006tmC; Sun, 14 Feb 1999 00:30:50 +0100 (MET) Received: by idril.shnet.org (Smail3.1.29.1 #1) id m10BpMh-001C8oC; Sun, 14 Feb 99 01:24 MET Message-Id: Subject: Re: GnuPG and trailing whitespace handling To: jcallas@NAI.com (Jon Callas) Date: Sun, 14 Feb 1999 01:24:51 +0100 (MET) Cc: ietf-open-pgp@imc.org In-Reply-To: <3.0.3.32.19990212162725.03ec1110@mail.pgp.com> from "Jon Callas" at Feb 12, 99 04:27:25 pm From: ulf@fitug.de (Ulf =?ISO-8859-1?Q?M=F6ller?=) X-Mailer: ELM [version 2.4 PL24] MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: > When you receive a message, don't go interpreting it. Do nothing. Compute > the signature. In the case where you have a non-blank-trimmed literal > packet, don't even look for the flaw here. It is not that simple for detached signatures (a detached signature is one where the PGP message consists of the signature packet only and the signed text is specified externally). When you verify a detached text-mode signature, you *have to* convert the text to canonical format first. And, conversely, when you generate a detached signature, modifying the original file usually is not an option. > It's my opinion that if a 2440 application wants to send a textmode message > with trailing blanks then the obvious, right way to do it is to put a > binarymode signature after the textmode literal. RFC 2440 doesn't expressly say whether or not you can do that, but as far as I remember, PGP just throws funny error messages at you when you try it. Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id QAA18369 for ietf-open-pgp-bks; Fri, 12 Feb 1999 16:24:27 -0800 (PST) Received: from fusebox.pgp.com (fusebox.pgp.com [161.69.1.11]) by mail.proper.com (8.8.8/8.8.5) with ESMTP id QAA18365 for ; Fri, 12 Feb 1999 16:24:26 -0800 (PST) Received: from jcallas (dhcp-47-64.dhcp.nai.com [161.69.47.64]) by fusebox.pgp.com (8.8.7/8.8.7) with SMTP id QAA20869 for ; Fri, 12 Feb 1999 16:27:50 -0800 (PST) Message-Id: <3.0.3.32.19990212162725.03ec1110@mail.pgp.com> X-Sender: jon@mail.pgp.com X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.3 (32) Date: Fri, 12 Feb 1999 16:27:25 -0800 To: ietf-open-pgp@imc.org From: Jon Callas Subject: Re: GnuPG and trailing whitespace handling In-Reply-To: References: <3.0.3.32.19990211123055.03ded010@mail.pgp.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: At 04:08 PM 2/11/99 -0800, Russ Allbery wrote: |Pardon me if I'm confused here, but wouldn't that involve checking any |failing detached text-mode signature a second time with the original data |without trailing whitespace stripped to see if it then passes? | |And isn't it impossible to both follow the RFC and generate detached |text-mode signatures that will verify correctly with PGP 5.0 if the data |has trailing whitespace? In that either the signatures will verify with |PGP 5.0 or they will verify with RFC-compliant checkers, but never with |both? Here's my interpretation of what you should do: Remember that we're not talking about clear-signed messages, we are talking about a message that is a literal packet and a signature packet (and possibly this pair has been encrypted). If you are constructing the message, construct it in canonicalized text. Line ends are CRLFs, and lines are blank-trimmed. Construct the signature, send the message. All things being equal (that is, excepting the cases where you have a DSS sig sent to 2.6 etc.), it will always work. The literal packet should be a text-mode literal packet. When you receive a message, don't go interpreting it. Do nothing. Compute the signature. In the case where you have a non-blank-trimmed literal packet, don't even look for the flaw here. The signature will work correctly for anyone who constructed it correctly, and it will work for anyone who was merely stupid. That's what I meant by rolling your eyes and proceeding. My suggestion is that by doing zero work, you handle all correctly contrusted messages, and many incorrectly constructed messages. There are a number of flawed cases, here, too. I'm using the word "flaw" only to avoid a more perjoritive term like "erroneous" because I don't want to get into those arguments. One flawed case is a text mode literal that has not been blank trimmed, but is otherwise correctly textmode. It's followed by a textmode sig packet. The "do no work" precept lets this one work. Another is a textmode literal that contains carriage control -- for example one that underscores by using a bare CR. The "do no work" precept lets this one work, and a smart implementation is likely to damage this packet. Another is a mal-formed textmode literal. For example, it just put unix text (LF endings) into a textmode packet. The DNW precept makes for a correctly formed signature, but there may be errors when the file is written out (or maybe not, if the texmode literal processor has error-adaptions in it). But that's a different problem. More problematic is a textmode literal with trailing blanks, with a sig calculated by trimming them. Here, DNW fails. This is also where the real crux of the problem is. I believe that it's possible to have "minimal" implementations and "friendly" implementations. A minimal implementation will fail to verify the signature. This is in my opinion fine, because I believe that a compliant 2440 application will be *generating* blank-trimmed signed text. If the trailing blanks were that important to you, there's always binary mode, y'know? A friendly implementation, however, is free to see that the signature failed and try again using a different strategy (such as blank trimming or blank trimming with line-end conversion) and see if the signature works with this. It's my opinion that if a 2440 application wants to send a textmode message with trailing blanks then the obvious, right way to do it is to put a binarymode signature after the textmode literal. That's what binarymode means -- don't mess with the content, just hash it straight. To me, textmode signatures are an *assurance* that the literal packet it signs met those criteria when it was generated. If it doesn't, you could have constructed a textmode message and signed it in binary mode. To tie in what I said before, this means that a 2440 app conservatively generates a message by trimming a textmode packet if it is going to textmode sign it, so there will be *no* *question* how to interpret it. Now then, having said that, reality is that we live in a world with a mass of implementations of PGP, all of which are more-or-less 2440ish. A friendly application can consider the textmode signature packet when it *receives* it to be an alert that it may have to futz with the hashing to be fully forwards compatible. Note that a 2440 application is not required to do that. That's the difference between minimal and friendly. No one says you have to be friendly. (Here's another comment of mine that only relates to comments that I've made here and before that you're permitted to go beyond the spec. 2440 says that textmode literals have CRLF line ends. It's my considered opinion that textmode should also trim blanks. You're free to disagree, but if I were writing a 2440 app, I'd trim blanks. I probably would also allow textmode conversions to do tab/blank conversions and possibly paragraph reformatting. 2440 is silent on all of these. That does not mean that one is forbidden from doing them. If you're the implementer, you get to make these decisions yourself.) Jon ----- Jon Callas jon@pgp.com CTO, Total Network Security 3965 Freedom Circle Network Associates, Inc. Santa Clara, CA 95054 (408) 346-5860 Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS) 665B 797F 37D1 C240 53AC 6D87 3A60 4628 (RSA) Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id DAA10188 for ietf-open-pgp-bks; Fri, 12 Feb 1999 03:48:19 -0800 (PST) Received: from koeln.shuttle.de (uucp@koeln.shuttle.de [194.95.247.252]) by mail.proper.com (8.8.8/8.8.5) with ESMTP id DAA10184 for ; Fri, 12 Feb 1999 03:48:14 -0800 (PST) Received: by koeln.shuttle.de (8.9.2/8.9.2) id MAA05260 for ietf-open-pgp@imc.org; Fri, 12 Feb 1999 12:51:29 +0100 (MET) Received: (qmail 11127 invoked from network); 12 Feb 1999 11:24:16 -0000 Received: from frodo.isil.d.shuttle.de (mail@172.20.1.4) by beren.isil.d.shuttle.de with SMTP; 12 Feb 1999 11:24:16 -0000 Received: from wk by frodo.isil.d.shuttle.de with local (Exim 1.92 #1 (Debian)) id 10BGev-0005Gv-00; Fri, 12 Feb 1999 12:21:21 +0100 Date: Fri, 12 Feb 1999 12:21:20 +0100 From: Werner Koch To: g10@net.lut.ac.uk, ietf-open-pgp@imc.org Subject: Re: GnuPG and trailing whitespace handling Message-ID: <19990212122120.D16155@frodo.isil.d.shuttle.de> Mail-Followup-To: g10@net.lut.ac.uk, ietf-open-pgp@imc.org References: <19990211110523.C15002@frodo.isil.d.shuttle.de> <3.0.3.32.19990211123055.03ded010@mail.pgp.com> Mime-Version: 1.0 X-Mailer: Mutt 0.95.1i In-Reply-To: <3.0.3.32.19990211123055.03ded010@mail.pgp.com>; from Jon Callas on Thu, Feb 11, 1999 at 12:30:55PM -0800 X-URL: http://www.d.shuttle.de/isil Content-Type: text/plain; charset=us-ascii Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: Jon Callas writes: > If you want to be forwards compatible (meaning that you accept things old > versions generate), all you have to do is not generate an error when an old > version fails to blank-trim. Ah right that's an idea how to handle it without calculating hashs of both versions - I have to see how I can do this with my streams like framework. Werner -- ceterum censeo RSA esse delendam Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id QAA08741 for ietf-open-pgp-bks; Thu, 11 Feb 1999 16:05:05 -0800 (PST) Received: from windlord.stanford.edu (windlord.Stanford.EDU [171.64.12.23]) by mail.proper.com (8.8.8/8.8.5) with SMTP id QAA08737 for ; Thu, 11 Feb 1999 16:05:04 -0800 (PST) Received: (qmail 13591 invoked by uid 50); 12 Feb 1999 00:08:44 -0000 To: g10@net.lut.ac.uk, ietf-open-pgp@imc.org Subject: Re: GnuPG and trailing whitespace handling References: <3.0.3.32.19990211123055.03ded010@mail.pgp.com> From: Russ Allbery In-Reply-To: Jon Callas's message of "Thu, 11 Feb 1999 12:30:55 -0800" Date: 11 Feb 1999 16:08:44 -0800 Message-ID: Lines: 20 X-Mailer: Gnus v5.4.66/Emacs 19.34 Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: Jon Callas writes: > If you follow the RFC, you will be backwards compatible. > If you want to be forwards compatible (meaning that you accept things > old versions generate), all you have to do is not generate an error when > an old version fails to blank-trim. Pardon me if I'm confused here, but wouldn't that involve checking any failing detached text-mode signature a second time with the original data without trailing whitespace stripped to see if it then passes? And isn't it impossible to both follow the RFC and generate detached text-mode signatures that will verify correctly with PGP 5.0 if the data has trailing whitespace? In that either the signatures will verify with PGP 5.0 or they will verify with RFC-compliant checkers, but never with both? -- Russ Allbery (rra@stanford.edu) Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id MAA06170 for ietf-open-pgp-bks; Thu, 11 Feb 1999 12:28:57 -0800 (PST) Received: from fusebox.pgp.com (fusebox.pgp.com [161.69.1.11]) by mail.proper.com (8.8.8/8.8.5) with ESMTP id MAA06165 for ; Thu, 11 Feb 1999 12:28:56 -0800 (PST) Received: from jcallas (dhcp-47-64.dhcp.nai.com [161.69.47.64]) by fusebox.pgp.com (8.8.7/8.8.7) with SMTP id MAA07449; Thu, 11 Feb 1999 12:31:04 -0800 (PST) Message-Id: <3.0.3.32.19990211123055.03ded010@mail.pgp.com> X-Sender: jon@mail.pgp.com X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.3 (32) Date: Thu, 11 Feb 1999 12:30:55 -0800 To: Werner Koch , g10@net.lut.ac.uk, ietf-open-pgp@imc.org From: Jon Callas Subject: Re: GnuPG and trailing whitespace handling In-Reply-To: <19990211110523.C15002@frodo.isil.d.shuttle.de> References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: At 11:05 AM 2/11/99 +0100, Werner Koch wrote: |Okay, so I implement it like PGP and make a remark that GnuPG does not |follow the RFC :-) I don't know how to interpret the smiley, so I apologize if this is a humor-impaired comment. If you follow the RFC, you will be backwards compatible. If you want to be forwards compatible (meaning that you accept things old versions generate), all you have to do is not generate an error when an old version fails to blank-trim. IETF standards are not handcuffs. You are always permitted to do more than them. This is especially true in cases where you accept as valid something that fails slightly. Jon ----- Jon Callas jon@pgp.com CTO, Total Network Security 3965 Freedom Circle Network Associates, Inc. Santa Clara, CA 95054 (408) 346-5860 Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS) 665B 797F 37D1 C240 53AC 6D87 3A60 4628 (RSA) Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id LAA05576 for ietf-open-pgp-bks; Thu, 11 Feb 1999 11:24:20 -0800 (PST) Received: from public.uni-hamburg.de (public.rrz.uni-hamburg.de [134.100.32.55]) by mail.proper.com (8.8.8/8.8.5) with ESMTP id LAA05572 for ; Thu, 11 Feb 1999 11:24:18 -0800 (PST) Received: from paris.public.uni-hamburg.de (max1-164.public.uni-hamburg.de [134.100.43.164]) by public.uni-hamburg.de (8.8.8/8.8.8) with SMTP id UAA79652 for ; Thu, 11 Feb 1999 20:28:04 +0100 Received: by ulf.mali.sub.org (Smail3.1.28.1 #1) id m10B0Nv-0003bDC; Thu, 11 Feb 99 18:58 +0100 Message-Id: Date: Thu, 11 Feb 99 18:58 +0100 From: ulf@fitug.de (Ulf =?iso-8859-1?Q?M=F6ller?=) To: ietf-open-pgp@imc.org Subject: Re: GnuPG and trailing whitespace handling In-Reply-To: <3.0.3.32.19990210142858.034130f0@mail.pgp.com> Organization: HR13 Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: >I didn't ignore it, I'm pretty sure we discussed it. Your reply didn't show up in my mailbox nor in the archive at www.imc.org, then. >Now, an *implementation* of OpenPGP has to be always generating thingies >trimmed. When it does, they will interoperate with the old versions just >fine. The only subtle gotcha here is that when *receiving* a signed text >object, a smart implementation won't throw a hissy fit if the text object >hasn't been trimmed; it will just roll its eyes and mutter "get with the >program, geezer" under its breath. This is the old principle of "be liberal >in what you accept and conservative in what you generate." That sort of makes sense, but the RFC should have contained a notice about the incompatibility. When you follow the letter of the RFC, the obvious thing to do when you verify signatures is to use the same function for tweaking the line ends for both signature types. Following the principle of "being liberal in what you accept" without knowing about this specific incompatibility (there are dozens of ways a signing implementation could fail) is impossible because there is no such thing as a "near miss" with a message digest. Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id CAA28280 for ietf-open-pgp-bks; Thu, 11 Feb 1999 02:47:24 -0800 (PST) Received: from koeln.shuttle.de (uucp@koeln.shuttle.de [194.95.247.252]) by mail.proper.com (8.8.8/8.8.5) with ESMTP id CAA28275 for ; Thu, 11 Feb 1999 02:47:20 -0800 (PST) Received: by koeln.shuttle.de (8.9.2/8.9.2) id LAA11148 for ietf-open-pgp@imc.org; Thu, 11 Feb 1999 11:50:58 +0100 (MET) Received: (qmail 8515 invoked from network); 11 Feb 1999 10:24:47 -0000 Received: from frodo.isil.d.shuttle.de (172.20.1.4) by beren.isil.d.shuttle.de with SMTP; 11 Feb 1999 10:24:47 -0000 Received: (qmail 25314 invoked by uid 501); 11 Feb 1999 10:22:04 -0000 Date: Thu, 11 Feb 1999 11:22:03 +0100 From: Werner Koch To: ietf-open-pgp@imc.org Subject: Re: GnuPG and trailing whitespace handling Message-ID: <19990211112203.G15002@frodo.isil.d.shuttle.de> Mail-Followup-To: ietf-open-pgp@imc.org References: <3.0.3.32.19990210142858.034130f0@mail.pgp.com> Mime-Version: 1.0 X-Mailer: Mutt 0.95.1i In-Reply-To: <3.0.3.32.19990210142858.034130f0@mail.pgp.com>; from Jon Callas on Wed, Feb 10, 1999 at 02:28:58PM -0800 X-URL: http://www.d.shuttle.de/isil Content-Type: text/plain; charset=us-ascii Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: Jon Callas writes: > hasn't been trimmed; it will just roll its eyes and mutter "get with the > program, geezer" under its breath. This is the old principle of "be liberal > in what you accept and conservative in what you generate." That's right, but it is quite complicated to do in an implementaion which gets it input from stdin. One would have to calculate hashs for boths "versions". Werner Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id CAA28060 for ietf-open-pgp-bks; Thu, 11 Feb 1999 02:18:00 -0800 (PST) Received: from koeln.shuttle.de (uucp@koeln.shuttle.de [194.95.247.252]) by mail.proper.com (8.8.8/8.8.5) with ESMTP id CAA28056 for ; Thu, 11 Feb 1999 02:17:52 -0800 (PST) Received: by koeln.shuttle.de (8.9.2/8.9.2) id LAA08106 for ietf-open-pgp@imc.org; Thu, 11 Feb 1999 11:21:26 +0100 (MET) Received: (qmail 8447 invoked from network); 11 Feb 1999 10:08:08 -0000 Received: from frodo.isil.d.shuttle.de (qmailr@172.20.1.4) by beren.isil.d.shuttle.de with SMTP; 11 Feb 1999 10:08:08 -0000 Received: (qmail 18657 invoked by uid 501); 11 Feb 1999 10:05:24 -0000 Date: Thu, 11 Feb 1999 11:05:23 +0100 From: Werner Koch To: g10@net.lut.ac.uk, ietf-open-pgp@imc.org Subject: Re: GnuPG and trailing whitespace handling Message-ID: <19990211110523.C15002@frodo.isil.d.shuttle.de> Mail-Followup-To: g10@net.lut.ac.uk, ietf-open-pgp@imc.org References: Mime-Version: 1.0 Content-Transfer-Encoding: 8bit X-Mailer: Mutt 0.95.1i In-Reply-To: =?iso-8859-1?Q?=3Cm10Agil-0003bDC=40ulf=2Emali=2Esub=2Eorg=3E=3B_from_Ul?= =?iso-8859-1?Q?f_M=F6ller_on_Wed=2C_Feb_10=2C_1999_at_09:58:00PM_+0100?= X-URL: http://www.d.shuttle.de/isil Content-Type: text/plain; charset=iso-8859-1 =?iso-8859-1?Q?f_M=F6ller_on_Wed=2C_Feb_10=2C_1999_at_09:58:00PM_+0100?= Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: Ulf Möller writes: > I reported that on the OpenPGP list before RFC 2440 was issued, but > for some reason the RFC authors ignored my post. Yep, I remember that post but it's long ago. > In PGP, trailing whitespace is removed as part of the clearsig > encoding (which is the only situation where trailing whitespace can > get lost in the transport). It is not part of the signing operation > and should not have been mentioned in the section quoted above. Okay, so I implement it like PGP and make a remark that GnuPG does not follow the RFC :-) Werner -- ceterum censeo RSA esse delendam Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id OAA27753 for ietf-open-pgp-bks; Wed, 10 Feb 1999 14:25:50 -0800 (PST) Received: from fusebox.pgp.com (fusebox.pgp.com [161.69.1.11]) by mail.proper.com (8.8.8/8.8.5) with ESMTP id OAA27749 for ; Wed, 10 Feb 1999 14:25:49 -0800 (PST) Received: from jcallas (dhcp-47-64.dhcp.nai.com [161.69.47.64]) by fusebox.pgp.com (8.8.7/8.8.7) with SMTP id OAA27063 for ; Wed, 10 Feb 1999 14:29:02 -0800 (PST) Message-Id: <3.0.3.32.19990210142858.034130f0@mail.pgp.com> X-Sender: jon@mail.pgp.com X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.3 (32) Date: Wed, 10 Feb 1999 14:28:58 -0800 To: ietf-open-pgp@imc.org From: Jon Callas Subject: Re: GnuPG and trailing whitespace handling In-Reply-To: References: Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by mail.proper.com id OAA27750 Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: At 09:58 PM 2/10/99 +0100, Ulf Möller wrote: |I reported that on the OpenPGP list before RFC 2440 was issued, but |for some reason the RFC authors ignored my post. | |In PGP, trailing whitespace is removed as part of the clearsig |encoding (which is the only situation where trailing whitespace can |get lost in the transport). It is not part of the signing operation |and should not have been mentioned in the section quoted above. I didn't ignore it, I'm pretty sure we discussed it. I believe that for OpenPGP, this is the right thing to do, and that for *any* object in "canonical text" form, trimming trailing white space is a Smart Thing To Do. Now, an *implementation* of OpenPGP has to be always generating thingies trimmed. When it does, they will interoperate with the old versions just fine. The only subtle gotcha here is that when *receiving* a signed text object, a smart implementation won't throw a hissy fit if the text object hasn't been trimmed; it will just roll its eyes and mutter "get with the program, geezer" under its breath. This is the old principle of "be liberal in what you accept and conservative in what you generate." Jon ----- Jon Callas jon@pgp.com CTO, Total Network Security 3965 Freedom Circle Network Associates, Inc. Santa Clara, CA 95054 (408) 346-5860 Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS) 665B 797F 37D1 C240 53AC 6D87 3A60 4628 (RSA) Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id NAA25765 for ietf-open-pgp-bks; Wed, 10 Feb 1999 13:10:52 -0800 (PST) Received: from public.uni-hamburg.de (public.rrz.uni-hamburg.de [134.100.32.55]) by mail.proper.com (8.8.8/8.8.5) with ESMTP id NAA25759 for ; Wed, 10 Feb 1999 13:10:48 -0800 (PST) Received: from paris.public.uni-hamburg.de (max1-182.public.uni-hamburg.de [134.100.43.182]) by public.uni-hamburg.de (8.8.8/8.8.8) with SMTP id WAA66634; Wed, 10 Feb 1999 22:14:17 +0100 Received: by ulf.mali.sub.org (Smail3.1.28.1 #1) id m10Agil-0003bDC; Wed, 10 Feb 99 21:58 +0100 Message-Id: Date: Wed, 10 Feb 99 21:58 +0100 From: ulf@fitug.de (Ulf =?iso-8859-1?Q?M=F6ller?=) To: g10@net.lut.ac.uk Subject: Re: GnuPG and trailing whitespace handling In-Reply-To: Organization: HR13 Cc: ietf-open-pgp@imc.org Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: >> 0x01: Signature of a canonical text document. >> Typically, this means the signer owns it, created it, or >> certifies that it has not been modified. The signature is >> calculated over the text data with its line endings converted >> to and trailing blanks removed. > >I can verify that PGP 2.6.2 and PGP 5.0 do *not* do this for detached >signatures. I reported that on the OpenPGP list before RFC 2440 was issued, but for some reason the RFC authors ignored my post. In PGP, trailing whitespace is removed as part of the clearsig encoding (which is the only situation where trailing whitespace can get lost in the transport). It is not part of the signing operation and should not have been mentioned in the section quoted above. Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id TAA17514 for ietf-open-pgp-bks; Tue, 9 Feb 1999 19:14:44 -0800 (PST) Received: from imo27.mx.aol.com (imo27.mx.aol.com [198.81.17.71]) by mail.proper.com (8.8.8/8.8.5) with ESMTP id TAA17483 for ; Tue, 9 Feb 1999 19:14:31 -0800 (PST) From: Orcanw@aol.com Received: from Orcanw@aol.com by imo27.mx.aol.com (IMOv18.1) id JMWOa26290; Tue, 9 Feb 1999 21:51:11 +1900 (EST) Message-ID: <59791cf8.36c0f41f@aol.com> Date: Tue, 9 Feb 1999 21:51:11 EST To: lao26@hotmail.com, cls2@inea.com.ar, jesus@sunserver.dsi.uaq.mx, serf@arnet.com.ar, systarob@bblanca.com.ar, rauljromanuttisa@datacop5.com.ar, goyajm@yahoo.com, alexisgarcia@datacop5.com.ar, angelheart_20@hotmail.com, type_one@majordomo.netcom.com, svlug@svlug.org, ietf-open-pgp@imc.org, cpsr-pdx@cpsr.org, current-users@netbsd.org, islandriver@egroups.com, jokeboss@egroups.com, familycornerjokes@egroups.com, cigars@egroups.com, cartmannews@egroups.com, michael-shanks@egroups.com, goodbye4now@egroups.com, lookhear@egroups.com, funjokes@egroups.com, fishtank@egroups.com, atlmusic@egroups.com, gnftalk@egroups.com, hum-s@egroups.com, swingmusic@egroups.com, ryla@egroups.com, pro_football@egroups.com, mhp@egroups.com, spanish_l@egroups.com, ramcoites@egroups.com, radiance@egroups.com, spanish-l@egroups.com Cc: NWORCAS@msn.com Mime-Version: 1.0 Subject: [pro_football] Hello!!Hola!! Content-type: text/plain; charset=US-ASCII Content-transfer-encoding: 7bit X-Mailer: AOL 4.0 for Windows 95 sub 4 Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: NORTHWEST ORCAS P.O. BOX 21481 SEATTLE,WASHINGTON 98111 - 3481 USA (206) 955 - 0186 / (253) 887 - 0135 E-Mail: NWORCAS@msn.com http://www.nworcas.com ______________________________________________________________________________ ___ February 9 , 1999 To : NORTHWEST ORCAS FOOTBALL FANS Hello; Thank you for writing to us here at NORTHWEST ORCAS FOOTBALL ORGANIZATION and we are in proccess in getting the team ready for the first inagural season , which is to start in year 2000 when the NORTH AMERICAN FOOTBALL LEAGUE (NAFL) starts it's inagural season as well. We have a website and invite you to visit our website at : http://www.nworcas.com We are still in need of completion of getting our investor group together in which we are going to have to meet a little less than $2,000,000 in U.S. DOLLARS in which will include complete operations costs and some towards the perpetual fund account . If you know of anyone who would like to become a part of this exciting football program , please contact us via e-mail at : NWORCAS @msn.com or ORCANW@aol.com Again , many thanks and look forward in hearing from you soon ! Sincerely Yours Stan Carey President / Head Coach NORTHWEST ORCAS Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id QAA14514 for ietf-open-pgp-bks; Tue, 9 Feb 1999 16:57:44 -0800 (PST) Received: from hotmail.com (law-f44.hotmail.com [209.185.131.107]) by mail.proper.com (8.8.8/8.8.5) with SMTP id QAA14510 for ; Tue, 9 Feb 1999 16:57:36 -0800 (PST) Received: (qmail 505 invoked by uid 0); 10 Feb 1999 01:00:42 -0000 Message-ID: <19990210010042.504.qmail@hotmail.com> Received: from 209.58.48.7 by www.hotmail.com with HTTP; Tue, 09 Feb 1999 17:00:41 PST X-Originating-IP: [209.58.48.7] From: "manuel soto" To: cls2@inea.com.ar, jesus@sunserver.dsi.uaq.mx, serf@arnet.com.ar, systarob@bblanca.com.ar, rauljromanuttisa@datacop5.com.ar, goyajm@yahoo.com, alexisgarcia@datacop5.com.ar, angelheart_20@hotmail.com, type_one@majordomo.netcom.com, svlug@svlug.org, ietf-open-pgp@imc.org, cpsr-pdx@cpsr.org, current-users@netbsd.org, islandriver@egroups.com, jokeboss@egroups.com, familycornerjokes@egroups.com, cigars@egroups.com, cartmannews@egroups.com, michael-shanks@egroups.com, goodbye4now@egroups.com, lookhear@egroups.com, funjokes@egroups.com, fishtank@egroups.com, atlmusic@egroups.com, gnftalk@egroups.com, hum-s@egroups.com, swingmusic@egroups.com, ryla@egroups.com, pro_football@egroups.com, mhp@egroups.com, spanish_l@egroups.com, ramcoites@egroups.com, radiance@egroups.com, spanish-l@egroups.com Subject: Hello!!Hola!! Date: Tue, 09 Feb 1999 17:00:41 PST Mime-Version: 1.0 Content-type: text/plain Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: http://dinero.cjb.net http://salman.nu/dinero ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id WAA22798 for ietf-open-pgp-bks; Sun, 7 Feb 1999 22:43:57 -0800 (PST) Received: from internetdevices.com (idi-fk-gw.abhiweb.com [205.138.236.250]) by mail.proper.com (8.8.8/8.8.5) with ESMTP id WAA22794 for ; Sun, 7 Feb 1999 22:43:56 -0800 (PST) Received: from docking-bay-three.rwthayer.com (localhost [127.0.0.1]) by internetdevices.com (8.8.7/8.8.7) with SMTP id WAA22119 for ; Sun, 7 Feb 1999 22:46:04 -0800 (PST) Message-Id: <4.1.19990207224529.0094f100@idi-fk-gw.abhiweb.com> X-Sender: rodney@postoffice.rwthayer.com X-Mailer: QUALCOMM Windows Eudora Pro Version 4.1 Date: Sun, 07 Feb 1999 22:46:46 -0800 To: ietf-open-pgp@imc.org From: Rodney Thayer Subject: win32 open pgp implementations, for real? Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: are there any non-NAI-based Win32 Open PGP implementations? Many of the ones listed in the survey don't really work on Win32 (win95/87/nt) platforms. Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id SAA11113 for ietf-open-pgp-bks; Sun, 7 Feb 1999 18:54:33 -0800 (PST) Received: from internetdevices.com (idi-fk-gw.abhiweb.com [205.138.236.250]) by mail.proper.com (8.8.8/8.8.5) with ESMTP id SAA11109 for ; Sun, 7 Feb 1999 18:54:32 -0800 (PST) Received: from docking-bay-three.rwthayer.com (localhost [127.0.0.1]) by internetdevices.com (8.8.7/8.8.7) with SMTP id SAA18769 for ; Sun, 7 Feb 1999 18:56:16 -0800 (PST) Message-Id: <4.1.19990207184658.04055f10@idi-fk-gw.abhiweb.com> X-Sender: rodney@idi-fk-gw.abhiweb.com X-Mailer: QUALCOMM Windows Eudora Pro Version 4.1 Date: Sun, 07 Feb 1999 18:48:11 -0800 To: ietf-open-pgp@imc.org From: Rodney Thayer Subject: LDAP and PGP? Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: Is there a 'standard' way to represent PGP keys in LDAP? Are there any OpenLDAP (or any other) public reference LDAP servers out there? I know NAI runs one, I'm interested in know if there are others, to learn if there are multiple alternative schemes. Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id BAA03364 for ietf-open-pgp-bks; Sat, 6 Feb 1999 01:13:20 -0800 (PST) Received: from fmol.5sigcmd.army.mil (fmol.5sigcmd.army.mil [147.40.43.21]) by mail.proper.com (8.8.8/8.8.5) with ESMTP id BAA03360 for ; Sat, 6 Feb 1999 01:13:18 -0800 (PST) Received: from rh51.localdomain (fmol-ppp0.5sigcmd.army.mil [147.40.43.22]) by fmol.5sigcmd.army.mil (8.8.7/8.8.7) with ESMTP id KAA13333 for ; Sat, 6 Feb 1999 10:16:06 +0100 Received: from localhost (greenea@localhost) by rh51.localdomain (8.8.7/8.8.7) with ESMTP id IAA02592 for ; Sat, 6 Feb 1999 08:43:40 +0100 X-Authentication-Warning: rh51.localdomain: greenea owned process doing -bs Date: Sat, 6 Feb 1999 08:43:40 +0100 (CET) From: "Anthony E. Greene" X-Sender: greenea@rh51.localdomain To: ietf-open-pgp@imc.org Subject: Re: PGP - non-nonrepudiation In-Reply-To: <3.0.3.32.19990205202010.0379b918@spiritone.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: On Fri, 5 Feb 1999, Carl Ellison wrote: >What do you (or does anyone else) mean by non-repudiation? > >To me, it means that I can take you into a courtroom and prove, somehow, >that you signed the digitally signed message I hold in the floppy in my hand. > >That means that the mechanisms we have set up defeat all your attempts to >defend yourself against that accusation. That is, you are unable to >repudiate the signature because of the mechanism we have established. > >Tell me how I can prove otherwise when you claim: [snip] You arguments apply as well to pen/ink signatures. What you're overlooking is that in this context 'non-repudiation' refers to legal proof, not logical proof. The references to enforcing a contract in court clearly set the context of the discussion. Even though it's possible for someone to forge a handwritten signature, if it looks enough like yours, and you don't have some independent evidence that you did not make the signature, you will be legally bound by it. We have not established the case law yet to support digital signatures. But when we do, the examples you gave will not hold up in court any more than making an *unsupported* claim that you're not responsible for the use of your ATM card. If the only evidence you have that it wasn't you is your own word, it won't be sufficient in court. -- Anthony E. Greene Homepage & PGP Key Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id WAA01713 for ietf-open-pgp-bks; Fri, 5 Feb 1999 22:51:48 -0800 (PST) Received: from ridge.spiritone.com (ridge.spiritone.com [205.139.108.2]) by mail.proper.com (8.8.8/8.8.5) with ESMTP id WAA01707 for ; Fri, 5 Feb 1999 22:51:46 -0800 (PST) Received: from cme (m6-237.spiritone.com [208.130.240.237]) by ridge.spiritone.com (8.8.8/8.8.8) with SMTP id WAA15075; Fri, 5 Feb 1999 22:54:29 -0800 (PST) Message-Id: <3.0.3.32.19990205225325.036cbc78@spiritone.com> X-Sender: cellison@spiritone.com X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.3 (32) Date: Fri, 05 Feb 1999 22:53:25 -0800 To: "Black Unicorn" From: Carl Ellison Subject: RE: PGP - non-nonrepudiation Cc: "Carl Ellison" , "William H. Geiger III" , "Edwin Cremer" , In-Reply-To: <000a01be518c$cfd35f00$06088818@zug> References: <3.0.3.32.19990205202010.0379b918@spiritone.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: -----BEGIN PGP SIGNED MESSAGE----- At 10:54 PM 2/5/99 -0600, Black Unicorn wrote: > >"But the agreement you signed with the brokerage waives the brokerage's >liability for transactions where your keys are used." > That's perfectly valid. It's the signer relinquishing his right to repudiate, because of a normal contract he signed with the verifier of the signature. What's enforced in court is the normal contract, not some fiction about non-repudiation as a side effect of using digital signatures. >I concede that non-repudiation and its definition are issues but this is >more than a bit defeatist. The excuse that "non-repudiation is too >non-defined for us to try and accommodate any functionality that approaches >it" is just silly. I'm quite happy with the contract approach you outlined. It's just the silly talk we occasionally hear about digital signatures giving non-repudiation -- or some certificate from a properly blessed CA giving non-repudiation that I contest. There are laws (e.g., Utah) that deprive you of the right to repudiate if you get a certificate from some CA they bless -- which is enough reason, in my mind, never to get a certificate from such a CA. It was, after all, the Reg E right to repudiate credit card bill line items that made electronic commerce thrive. >I could apply this approach to encryption. "Why bother to encrypt? I have >no idea who's at the other end. Anyone could be a man in the middle for my >friend. They could sniff it with a Trojan horse on his computer. They >could put a video camera in his ceiling and watch his screen, or his >keyboard." This is effectively the approach you are taking. In fact, I use that argument too. There is no such thing as a man in the middle attack if I'm communicating with someone I don't know already. If I have made contact with a stranger and some man in the middle is there, then I'm still communicating directly and privately with a stranger: the man in the middle. I have no reason to prefer him over the other stranger, given that I don't already have a relationship with either of them. One might argue that the MITM is dishonest while the other bloke is honest, but I defy someone to create a protocol that tests for honesty. >My point is that the brokerage does not now have the tools to even provide >evidence of the signature in the first place, which- in fact- makes use of >the signature pointless as it provides not even the slightest advance in >non-repudiation. Might as well just keep taking passwords or use >handwriting analysis. Don't run down handwriting too much. The handwritten signature is, after all, a biometric. >If you want this software to be utilized in places where it counts, which is >of course why we are in this game, or should be, then you have to improve >the product/protocol, not try to explain why functionality that is >needed/useful doesn't exist. Of course. >Mr. Geiger points out that this functionality, or lack thereof, is not a >consequence of the OpenPGP data structure itself. Insofar as that is so >this discussion is probably out of place anyhow. Probably. - Carl -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.5.3 iQCVAwUBNrvm5BN3Wx8QwqUtAQEx8wP+JufBsjh9g4aWpm+m7rnqQKDYgPW7+4Bw jg5XIhsUv59QOtNHWn3IDteFilnFNxYWLYpabX1iK8lQ/TJEcrvf+UUwnvYVLMxa 9Ov2v9LOm/7SV139DgaCOVxJ541fSKIPbN+F/Vr57jmsYggDrNz8lFNHuEYp/urj 13tMSqGKSnw= =AByS -----END PGP SIGNATURE----- +------------------------------------------------------------------+ |Carl M. Ellison cme@acm.org http://www.pobox.com/~cme | | PGP: 08FF BA05 599B 49D2 23C6 6FFD 36BA D342 | +--Officer, officer, arrest that man. He's whistling a dirty song.-+ Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id UAA24525 for ietf-open-pgp-bks; Fri, 5 Feb 1999 20:51:25 -0800 (PST) Received: from mailserv.desertsurf.com (q2.lamefree.com [209.84.189.90]) by mail.proper.com (8.8.8/8.8.5) with ESMTP id UAA24519 for ; Fri, 5 Feb 1999 20:51:24 -0800 (PST) Received: from zug (unverified [24.136.8.6]) by mailserv.desertsurf.com (Rockliffe SMTPRA 2.1.5) with SMTP id ; Fri, 05 Feb 1999 20:54:52 -0800 From: "Black Unicorn" To: "Carl Ellison" Cc: "William H. Geiger III" , "Edwin Cremer" , Subject: RE: PGP - non-nonrepudiation Date: Fri, 5 Feb 1999 22:54:43 -0600 Keywords: direct Message-ID: <000a01be518c$cfd35f00$06088818@zug> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook 8.5, Build 4.71.2377.0 In-Reply-To: <3.0.3.32.19990205202010.0379b918@spiritone.com> Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V4.72.2106.4 Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: > -----Original Message----- > From: Carl Ellison [mailto:cme@acm.org] > > At 06:02 PM 2/5/99 -0600, Black Unicorn wrote: > >Not a bad idea, maybe, if there were no requirement for > non-repudiation by > >the receiving party. (And if there isn't, then what's the point of this > >solution?) > > Sorry, but you hit one of my buttons. > > What do you (or does anyone else) mean by non-repudiation? I avoided getting into picking one of the 20 kinds of non-repudiation because non-repudiation is a process, not an event. It's moot anyhow as I quite directly defined what I was looking for. Specifically: "Take the example of a brokerage which needs to incontrovertibly prove a client (or a client's key) ordered a given transaction." > To me, it means that I can take you into a courtroom and prove, somehow, > that you signed the digitally signed message I hold in the floppy > in my hand. To digress: In your context that can't be proven even if you have witnesses to the act and a tape recording. (Witnesses are notoriously unreliable. The tape was out of context, or has been modified). There are always arguments against certain facts. If "truth" was really accessible we wouldn't need the judicial process. The point is to give one enough evidence to be persuasive of the truth, not to establish it. > That means that the mechanisms we have set up defeat all your attempts to > defend yourself against that accusation. That is, you are unable to > repudiate the signature because of the mechanism we have established. > > Tell me how I can prove otherwise when you claim: > > 1. my private key was on my computer, but I didn't sign that > message. I > never saw that message. It is quite possible that someone else found my > computer logged in while I was in the bathroom and signed that > message with > my computer. Therefore, you need to track down and bring in that > other person. "But the agreement you signed with the brokerage waives the brokerage's liability for transactions where your keys are used." This is, in fact, being done today with e.g., passwords and faxes. Historically this kind of risk allocation has been done with checks as well. If the signature is actually forged and the bank still cashes the check, they are liable. If it is not forged (the client put it on a blank check which was then lost) then the client eats it. I think this is unacceptable. This is impossible to do given the lack of functionality I have pointed out. "But you seem to have failed to follow the brokerage's password policy, which absolves the brokerage of liability." (Like leaving your keys in the car). Can't even get to this point if you can't establish that the signature was at least made from the client's key. > 2. I was at my computer when that message was allegedly > signed, but I never > saw it and never signed it. I did try to sign some other message -- even > put my thumb to the thumbprint reader to release the signing key > -- but that > signature attempt failed, so I had to do it again. There could > have been a > virus on my machine that used my unlocking of the private key to sign the > message in question. "But the agreement you signed with the brokerage waives the brokerage's liability for transactions where your keys are used." > etc. Yes, etc. > -------------------------------------------------- > > This is just the start of possible defenses. After I made a list > of them a > little longer than this, I came to the simplifying conclusion > that we should > never use the term "non-repudiation" and should, in fact, > strongly reprimand > anyone who tries to. I concede that non-repudiation and its definition are issues but this is more than a bit defeatist. The excuse that "non-repudiation is too non-defined for us to try and accommodate any functionality that approaches it" is just silly. I could apply this approach to encryption. "Why bother to encrypt? I have no idea who's at the other end. Anyone could be a man in the middle for my friend. They could sniff it with a Trojan horse on his computer. They could put a video camera in his ceiling and watch his screen, or his keyboard." This is effectively the approach you are taking. My point is that the brokerage does not now have the tools to even provide evidence of the signature in the first place, which- in fact- makes use of the signature pointless as it provides not even the slightest advance in non-repudiation. Might as well just keep taking passwords or use handwriting analysis. If you want this software to be utilized in places where it counts, which is of course why we are in this game, or should be, then you have to improve the product/protocol, not try to explain why functionality that is needed/useful doesn't exist. > - Carl Mr. Geiger points out that this functionality, or lack thereof, is not a consequence of the OpenPGP data structure itself. Insofar as that is so this discussion is probably out of place anyhow. Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id UAA22750 for ietf-open-pgp-bks; Fri, 5 Feb 1999 20:17:50 -0800 (PST) Received: from ridge.spiritone.com (ridge.spiritone.com [205.139.108.2]) by mail.proper.com (8.8.8/8.8.5) with ESMTP id UAA22743 for ; Fri, 5 Feb 1999 20:17:48 -0800 (PST) Received: from cme (m6-206.spiritone.com [208.130.240.206]) by ridge.spiritone.com (8.8.8/8.8.8) with SMTP id UAA25248; Fri, 5 Feb 1999 20:20:56 -0800 (PST) Message-Id: <3.0.3.32.19990205202010.0379b918@spiritone.com> X-Sender: cellison@spiritone.com X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.3 (32) Date: Fri, 05 Feb 1999 20:20:10 -0800 To: "Black Unicorn" From: Carl Ellison Subject: Re: PGP - non-nonrepudiation Cc: "William H. Geiger III" , "Edwin Cremer" , In-Reply-To: <000101be5163$fb8e6d20$06088818@zug> References: <199902052241.RAA025.30@whgiii> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: -----BEGIN PGP SIGNED MESSAGE----- At 06:02 PM 2/5/99 -0600, Black Unicorn wrote: >Not a bad idea, maybe, if there were no requirement for non-repudiation by >the receiving party. (And if there isn't, then what's the point of this >solution?) Sorry, but you hit one of my buttons. What do you (or does anyone else) mean by non-repudiation? To me, it means that I can take you into a courtroom and prove, somehow, that you signed the digitally signed message I hold in the floppy in my hand. That means that the mechanisms we have set up defeat all your attempts to defend yourself against that accusation. That is, you are unable to repudiate the signature because of the mechanism we have established. Tell me how I can prove otherwise when you claim: 1. my private key was on my computer, but I didn't sign that message. I never saw that message. It is quite possible that someone else found my computer logged in while I was in the bathroom and signed that message with my computer. Therefore, you need to track down and bring in that other person. 2. I was at my computer when that message was allegedly signed, but I never saw it and never signed it. I did try to sign some other message -- even put my thumb to the thumbprint reader to release the signing key -- but that signature attempt failed, so I had to do it again. There could have been a virus on my machine that used my unlocking of the private key to sign the message in question. etc. -------------------------------------------------- This is just the start of possible defenses. After I made a list of them a little longer than this, I came to the simplifying conclusion that we should never use the term "non-repudiation" and should, in fact, strongly reprimand anyone who tries to. - Carl -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.5.3 iQCVAwUBNrvC+RN3Wx8QwqUtAQHAPAP/QWgqgCl4EvqpgGfO0RvW5gTgOI3Ib+ge IrqVinHcOJJbJML7vC8rnM9seZB15KN0fToGmco8YLoFHfXeaVPVyrBVL53Pcczi LSn9SA0Z148IghoAwfNuA2HBThGCi7TGsrKDv8CVqvSyP3FkOCZ5bykO79LabHpi kviUeEIHMJA= =TgFJ -----END PGP SIGNATURE----- +------------------------------------------------------------------+ |Carl M. Ellison cme@acm.org http://www.pobox.com/~cme | | PGP: 08FF BA05 599B 49D2 23C6 6FFD 36BA D342 | +--Officer, officer, arrest that man. He's whistling a dirty song.-+ Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id SAA13681 for ietf-open-pgp-bks; Fri, 5 Feb 1999 18:44:54 -0800 (PST) Received: from fmol.5sigcmd.army.mil (fmol.5sigcmd.army.mil [147.40.43.21]) by mail.proper.com (8.8.8/8.8.5) with ESMTP id SAA13677 for ; Fri, 5 Feb 1999 18:44:52 -0800 (PST) Received: from rh51.localdomain (fmol-ppp0.5sigcmd.army.mil [147.40.43.22]) by fmol.5sigcmd.army.mil (8.8.7/8.8.7) with ESMTP id DAA12690 for ; Sat, 6 Feb 1999 03:47:23 +0100 Received: from localhost (greenea@localhost) by rh51.localdomain (8.8.7/8.8.7) with ESMTP id DAA01968 for ; Sat, 6 Feb 1999 03:34:43 +0100 X-Authentication-Warning: rh51.localdomain: greenea owned process doing -bs Date: Sat, 6 Feb 1999 03:34:42 +0100 (CET) From: "Anthony E. Greene" X-Sender: greenea@rh51.localdomain To: "OpenPGP List" Subject: Re: PGP - non-nonrepudiation In-Reply-To: <000101be5163$fb8e6d20$06088818@zug> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: On Fri, 5 Feb 1999, Black Unicorn wrote: >Not a bad idea, maybe, if there were no requirement for non-repudiation by >the receiving party. (And if there isn't, then what's the point of this >solution?) Falling back on a solution which requires a trusted server which >is still operated by the party which may later wish to present self serving >evidence to support itself in a suit is just a mistake. > >Take the example of a brokerage which needs to incontrovertibly prove a >client (or a client's key) ordered a given transaction. How will the above >help? Clearly, it won't. The bottom line is that in the mad rush to >implement "one pass" functionality PGP dropped the ball by killing this very >important functionality. > >An enterprise cannot now archive mail which can later be searched by keyword >in the message body and still be verifiable ex post with respect to origin >and message integrity. They could archive both the original message and the processed copy then tie the two together using the SMTP Message-Id or a locally generated substitute. -- Anthony E. Greene Homepage & PGP Key Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id QAA12957 for ietf-open-pgp-bks; Fri, 5 Feb 1999 16:49:25 -0800 (PST) Received: from coyote.rain.org (root@coyote.rain.org [198.68.144.2]) by mail.proper.com (8.8.8/8.8.5) with ESMTP id QAA12953 for ; Fri, 5 Feb 1999 16:49:24 -0800 (PST) Received: from hal.sb.rain.org (hal.sb.rain.org [198.68.144.57]) by coyote.rain.org (8.9.2/8.9.2) with ESMTP id QAA18533; Fri, 5 Feb 1999 16:52:39 -0800 (PST) Received: (from hal@localhost) by hal.sb.rain.org (8.8.7/8.8.7) id QAA09742; Fri, 5 Feb 1999 16:46:04 -0800 Date: Fri, 5 Feb 1999 16:46:04 -0800 From: hal@rain.org Message-Id: <199902060046.QAA09742@hal.sb.rain.org> To: ietf-open-pgp@imc.org Subject: Re: PGP - non-nonrepudiation Cc: unicorn@schloss.li Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: Black Unicorn writes: > Take the example of a brokerage which needs to incontrovertibly prove a > client (or a client's key) ordered a given transaction. How will the above > help? Clearly, it won't. The bottom line is that in the mad rush to > implement "one pass" functionality PGP dropped the ball by killing this very > important functionality. > > An enterprise cannot now archive mail which can later be searched by keyword > in the message body and still be verifiable ex post with respect to origin > and message integrity. > > Big mistake. > > I wonder (doubt) if it will ever be fixed. As far as I can see, the OpenPGP data structures are entirely adequate for this application. If there are deficiencies in the OpenPGP specification necessary for this functionality then we can discuss them. High level product functionality is not really relevant to this forum. Hal Finney NAI, Inc. Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id QAA12756 for ietf-open-pgp-bks; Fri, 5 Feb 1999 16:19:30 -0800 (PST) Received: from mailserv.desertsurf.com (q2.lamefree.com [209.84.189.90]) by mail.proper.com (8.8.8/8.8.5) with ESMTP id QAA12752 for ; Fri, 5 Feb 1999 16:19:29 -0800 (PST) Received: from zug (unverified [24.136.8.6]) by mailserv.desertsurf.com (Rockliffe SMTPRA 2.1.5) with SMTP id ; Fri, 05 Feb 1999 16:02:31 -0800 From: "Black Unicorn" To: "William H. Geiger III" , "Edwin Cremer" Cc: Subject: PGP - non-nonrepudiation Date: Fri, 5 Feb 1999 18:02:27 -0600 Keywords: openpgp Message-ID: <000101be5163$fb8e6d20$06088818@zug> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook 8.5, Build 4.71.2377.0 In-Reply-To: <199902052241.RAA025.30@whgiii> Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V4.72.2106.4 Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: William H. Geiger III: > > In <199901272040.VAA06373@m120.omikron.de>, on 01/27/99 > at 09:40 PM, Edwin Cremer said: > > >I have the same problem :-( > > >my solution is: > >the server check the signatur and decrypt the message. > >if both ok the server write a new footer with the output of the > >signcheck and then sign and encrypt the new message. if you have a > >trusted server, the sigcheck is trust ;-) and the members of the list > >don't need all the key's of all other members. it work's fine with > >(nearly) all of pgp version. > > Not a bad idea. :) Not a bad idea, maybe, if there were no requirement for non-repudiation by the receiving party. (And if there isn't, then what's the point of this solution?) Falling back on a solution which requires a trusted server which is still operated by the party which may later wish to present self serving evidence to support itself in a suit is just a mistake. Take the example of a brokerage which needs to incontrovertibly prove a client (or a client's key) ordered a given transaction. How will the above help? Clearly, it won't. The bottom line is that in the mad rush to implement "one pass" functionality PGP dropped the ball by killing this very important functionality. An enterprise cannot now archive mail which can later be searched by keyword in the message body and still be verifiable ex post with respect to origin and message integrity. Big mistake. I wonder (doubt) if it will ever be fixed. > I have proposed something similar to this for corporate mail servers where > incoming signed mail is verified at the server and stamped before it is > forwarded to the end-users mailbox. This way the end user is relieved from > the work involved in obtaining & verifying keys for incoming mail (this > job would be off-loaded to the resident company crypto zar). > > As an added step outbound messages can be auto-encrypted by the server > thus eliminating most of the public key management from the end user (the > end user doesn't even need PGP on his workstation execpt for signing & > decrypting). Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id PAA12321 for ietf-open-pgp-bks; Fri, 5 Feb 1999 15:24:43 -0800 (PST) Received: from pompano.pcola.gulf.net (root@gulf.net [198.69.72.14]) by mail.proper.com (8.8.8/8.8.5) with ESMTP id PAA12317 for ; Fri, 5 Feb 1999 15:24:42 -0800 (PST) Received: from whgiii (dugong19.pcola.gulf.net [205.160.71.82]) by pompano.pcola.gulf.net (8.9.1a/8.9.1) with SMTP id RAA19304; Fri, 5 Feb 1999 17:27:58 -0600 (CST) Received: from 100.100.100.1 by whgiii (IBM OS/2 SENDMAIL VERSION 2.03/2.0) id RAA025.30; Fri, 5 Feb 1999 17:41:07 -0500 Message-Id: <199902052241.RAA025.30@whgiii> From: "William H. Geiger III" Date: Fri, 05 Feb 1999 17:11:24 -0500 To: Edwin Cremer In-Reply-To: <199901272040.VAA06373@m120.omikron.de> Cc: ietf-open-pgp@imc.org Subject: Re: Secure mailing list service using OpenPGP X-Mailer: MR/2 Internet Cruiser Edition for OS/2 v1.52 b52 Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: In <199901272040.VAA06373@m120.omikron.de>, on 01/27/99 at 09:40 PM, Edwin Cremer said: >I have the same problem :-( >my solution is: >the server check the signatur and decrypt the message. >if both ok the server write a new footer with the output of the >signcheck and then sign and encrypt the new message. if you have a >trusted server, the sigcheck is trust ;-) and the members of the list >don't need all the key's of all other members. it work's fine with >(nearly) all of pgp version. Not a bad idea. :) I have proposed something similar to this for corporate mail servers where incoming signed mail is verified at the server and stamped before it is forwarded to the end-users mailbox. This way the end user is relieved from the work involved in obtaining & verifying keys for incoming mail (this job would be off-loaded to the resident company crypto zar). As an added step outbound messages can be auto-encrypted by the server thus eliminating most of the public key management from the end user (the end user doesn't even need PGP on his workstation execpt for signing & decrypting). I also have been using in my PGP E-Mail implemntaions of doing the PGP processing as the messages are downloaded by the mail client (decryption & sig verification) with the results being appended to the bottom of the messages. Below is an example: Return-Path: Received: from pompano.pcola.gulf.net (root@gulf.net [198.69.72.14]) by domains.invweb.net (8.9.1/8.9.1) with ESMTP id SAA17717 for ; Fri, 5 Feb 1999 18:14:56 -0500 Received: from whgiii (dugong19.pcola.gulf.net [205.160.71.82]) by pompano.pcola.gulf.net (8.9.1a/8.9.1) with SMTP id RAA16408 for ; Fri, 5 Feb 1999 17:14:53 -0600 (CST) Received: from 100.100.100.1 by whgiii (IBM OS/2 SENDMAIL VERSION 2.03/2.0) id RAA024.81; Fri, 5 Feb 1999 17:28:03 -0500 Message-Id: <199902052228.RAA024.81@whgiii> From: "William H. Geiger III" Date: Fri, 05 Feb 1999 17:27:30 -0500 Subject: sigh X-AutoCrypt: This Message AutoEncrypted With E-Secure v1.1b1 X-Distribution: whgiii@openpgp.net To: whgiii@openpgp.net X-Mailer: MR/2 Internet Cruiser Edition for OS/2 v1.52 b52 Status: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 sigh!! - -- - --------------------------------------------------------------- William H. Geiger III http://www.openpgp.net Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 5.0 at: http://www.openpgp.net/pgp.html Talk About PGP on IRC EFNet Channel: #pgp Nick: whgiii - --------------------------------------------------------------- Tag-O-Matic: Rumour: NT means Not Tested -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.0i OS/2 for non-commercial use Comment: Registered_User_E-Secure_v1.1b1_ES000000 Charset: cp850 wj8DBQE2u2JUlHpjA6A1ypsRAhkLAKCDuMwkyC6cvZH2Qz21fZwVAv4AEQCg5gmd gPVOxAEpHga48o2Hurw0Upk= =G2FM -----END PGP SIGNATURE----- -------------------------------------------------------------------- MR/2 PGP Decryption 5 Feb 1999 17:35:01 -------------------------------------------------------------------- Opening file "NUL" type text. Message is encrypted. Opening file "WHGIII\36BB7213" type text. Opening file "NUL" type text. -------------------------------------------------------------------- MR/2 PGP Signature Check 5 Feb 1999 17:35:01 -------------------------------------------------------------------- Opening file "NUL" type text. Opening file "WHGIII\36BB7213" type binary. Good signature made 1999-02-05 21:27 GMT by key: 1024 bits, Key ID A035CA9B, Created 1998-01-23 "William H. Geiger III " "William H. Geiger III " Opening file "NUL" type text. -- --------------------------------------------------------------- William H. Geiger III http://www.openpgp.net Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 5.0 at: http://www.openpgp.net/pgp.html Talk About PGP on IRC EFNet Channel: #pgp Nick: whgiii --------------------------------------------------------------- Tag-O-Matic: I use OS/2 2.0 and I don't care who knows! Tag-O-Matic: Windows: The CP/M of the future! Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id PAA12277 for ietf-open-pgp-bks; Fri, 5 Feb 1999 15:21:01 -0800 (PST) Received: from pompano.pcola.gulf.net (root@gulf.net [198.69.72.14]) by mail.proper.com (8.8.8/8.8.5) with ESMTP id PAA12273 for ; Fri, 5 Feb 1999 15:20:59 -0800 (PST) Received: from whgiii (dugong19.pcola.gulf.net [205.160.71.82]) by pompano.pcola.gulf.net (8.9.1a/8.9.1) with SMTP id RAA18402; Fri, 5 Feb 1999 17:24:15 -0600 (CST) Received: from 100.100.100.1 by whgiii (IBM OS/2 SENDMAIL VERSION 2.03/2.0) id RAA025.18; Fri, 5 Feb 1999 17:37:25 -0500 Message-Id: <199902052237.RAA025.18@whgiii> From: "William H. Geiger III" Date: Fri, 05 Feb 1999 17:11:24 -0500 To: Edwin Cremer In-Reply-To: <199901272040.VAA06373@m120.omikron.de> Cc: ietf-open-pgp@imc.org Subject: Re: Secure mailing list service using OpenPGP X-Mailer: MR/2 Internet Cruiser Edition for OS/2 v1.52 b52 Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: In <199901272040.VAA06373@m120.omikron.de>, on 01/27/99 at 09:40 PM, Edwin Cremer said: >I have the same problem :-( >my solution is: >the server check the signatur and decrypt the message. >if both ok the server write a new footer with the output of the >signcheck and then sign and encrypt the new message. if you have a >trusted server, the sigcheck is trust ;-) and the members of the list >don't need all the key's of all other members. it work's fine with >(nearly) all of pgp version. Not a bad idea. :) I have proposed something similar to this for corporate mail servers where incoming signed mail is verified at the server and stamped before it is forwarded to the end-users mailbox. This way the end user is relieved from the work involved in obtaining & verifying keys for incoming mail (this job would be off-loaded to the resident company crypto zar). As an added step outbound messages can be auto-encrypted by the server thus eliminating most of the public key management from the end user (the end user doesn't even need PGP on his workstation execpt for signing & decrypting). I also have been using in my PGP E-Mail implemntaions of doing the PGP processing as the messages are downloaded by the mail client (decryption & sig verification) with the results being appended to the bottom of the messages. Below is an example: Return-Path: Received: from pompano.pcola.gulf.net (root@gulf.net [198.69.72.14]) by domains.invweb.net (8.9.1/8.9.1) with ESMTP id SAA17717 for ; Fri, 5 Feb 1999 18:14:56 -0500 Received: from whgiii (dugong19.pcola.gulf.net [205.160.71.82]) by pompano.pcola.gulf.net (8.9.1a/8.9.1) with SMTP id RAA16408 for ; Fri, 5 Feb 1999 17:14:53 -0600 (CST) Received: from 100.100.100.1 by whgiii (IBM OS/2 SENDMAIL VERSION 2.03/2.0) id RAA024.81; Fri, 5 Feb 1999 17:28:03 -0500 Message-Id: <199902052228.RAA024.81@whgiii> From: "William H. Geiger III" Date: Fri, 05 Feb 1999 17:27:30 -0500 Subject: sigh X-AutoCrypt: This Message AutoEncrypted With E-Secure v1.1b1 X-Distribution: whgiii@openpgp.net To: whgiii@openpgp.net X-Mailer: MR/2 Internet Cruiser Edition for OS/2 v1.52 b52 Status: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 sigh!! - -- - --------------------------------------------------------------- William H. Geiger III http://www.openpgp.net Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 5.0 at: http://www.openpgp.net/pgp.html Talk About PGP on IRC EFNet Channel: #pgp Nick: whgiii - --------------------------------------------------------------- Tag-O-Matic: Rumour: NT means Not Tested -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.0i OS/2 for non-commercial use Comment: Registered_User_E-Secure_v1.1b1_ES000000 Charset: cp850 wj8DBQE2u2JUlHpjA6A1ypsRAhkLAKCDuMwkyC6cvZH2Qz21fZwVAv4AEQCg5gmd gPVOxAEpHga48o2Hurw0Upk= =G2FM -----END PGP SIGNATURE----- -------------------------------------------------------------------- MR/2 PGP Decryption 5 Feb 1999 17:35:01 -------------------------------------------------------------------- Opening file "NUL" type text. Message is encrypted. Opening file "WHGIII\36BB7213" type text. Opening file "NUL" type text. -------------------------------------------------------------------- MR/2 PGP Signature Check 5 Feb 1999 17:35:01 -------------------------------------------------------------------- Opening file "NUL" type text. Opening file "WHGIII\36BB7213" type binary. Good signature made 1999-02-05 21:27 GMT by key: 1024 bits, Key ID A035CA9B, Created 1998-01-23 "William H. Geiger III " "William H. Geiger III " Opening file "NUL" type text. -- --------------------------------------------------------------- William H. Geiger III http://www.openpgp.net Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 5.0 at: http://www.openpgp.net/pgp.html Talk About PGP on IRC EFNet Channel: #pgp Nick: whgiii --------------------------------------------------------------- Tag-O-Matic: I use OS/2 2.0 and I don't care who knows! Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id OAA12077 for ietf-open-pgp-bks; Fri, 5 Feb 1999 14:52:20 -0800 (PST) Received: from pompano.pcola.gulf.net (root@gulf.net [198.69.72.14]) by mail.proper.com (8.8.8/8.8.5) with ESMTP id OAA12073 for ; Fri, 5 Feb 1999 14:52:19 -0800 (PST) Received: from whgiii (dugong19.pcola.gulf.net [205.160.71.82]) by pompano.pcola.gulf.net (8.9.1a/8.9.1) with SMTP id QAA11734; Fri, 5 Feb 1999 16:55:26 -0600 (CST) Received: from 100.100.100.1 by whgiii (IBM OS/2 SENDMAIL VERSION 2.03/2.0) id RAA024.44; Fri, 5 Feb 1999 17:08:25 -0500 Message-Id: <199902052208.RAA024.44@whgiii> From: "William H. Geiger III" Date: Fri, 05 Feb 1999 17:07:29 -0500 To: "Masahiro Morita" In-Reply-To: <002701be4a83$778aaa20$cd683c81@vaio-luke.isl.ntt.co.jp> Cc: Subject: RE: Secure mailing list service using OpenPGP X-Mailer: MR/2 Internet Cruiser Edition for OS/2 v1.52 b52 Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: In <002701be4a83$778aaa20$cd683c81@vaio-luke.isl.ntt.co.jp>, on 01/28/99 at 03:00 PM, "Masahiro Morita" said: >In S/MIME, an I-Draft, "Enhanced Security Services for S/MIME" describes >secure mailing list services and defines the standerd process of mailing >list agents. We need the definitions like it for OpenPGP, don't we? >--hiro I don't think that we need it in the OpenPGP RFC but it would make a good secondary document. -- --------------------------------------------------------------- William H. Geiger III http://www.openpgp.net Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 5.0 at: http://www.openpgp.net/pgp.html Talk About PGP on IRC EFNet Channel: #pgp Nick: whgiii --------------------------------------------------------------- Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id HAA21965 for ietf-open-pgp-bks; Wed, 3 Feb 1999 07:42:56 -0800 (PST) Received: from smtp4.server.ibm.com (smtp4.ny.us.ibm.com [198.133.22.43]) by mail.proper.com (8.8.8/8.8.5) with ESMTP id HAA21960 for ; Wed, 3 Feb 1999 07:42:54 -0800 (PST) From: jaegert@us.ibm.com Received: from northrelay02.pok.ibm.com (northrelay02.pok.ibm.com [9.117.200.22]) by smtp4.server.ibm.com (8.8.7/8.8.7) with ESMTP id KAA81760 for ; Wed, 3 Feb 1999 10:30:51 -0500 Received: from D51MTA03.pok.ibm.com (d51mta03.pok.ibm.com [9.117.200.31]) by northrelay02.pok.ibm.com (8.8.7m1/NCO v1.8) with SMTP id KAA124698 for ; Wed, 3 Feb 1999 10:45:16 -0500 Received: by D51MTA03.pok.ibm.com(Lotus SMTP MTA Internal build v4.6.2 (651.2 6-10-1998)) id 8525670D.0056869D ; Wed, 3 Feb 1999 10:45:05 -0500 X-Lotus-FromDomain: IBMUS Message-ID: <8525670D.00568270.06@D51MTA03.pok.ibm.com> Date: Wed, 3 Feb 1999 10:44:32 -0500 Subject: Call for Papers: Fourth ACM Workshop on Role-based Access Control Mime-Version: 1.0 Content-type: text/plain; charset=us-ascii Content-Disposition: inline Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: CALL FOR PAPERS Fourth ACM WORKSHOP ON ROLE-BASED ACCESS CONTROL Date: Oct. 28-29, 1999 Place: George Mason University url: www.list.gmu.edu/rbac Sponsored By: ACM Sigsac Hosted By: George Mason University The essence of Role-Based Access Control (RBAC) is that permissions are assigned to roles rather than to individual users. Users acquire these permissions by virtue of being authorized to act in these roles. The driving motivation for RBAC is to simplify security policy administration while facilitating the definition of flexible, customized policies. Basic RBAC models have been successfully applied since the mainframe era, but emerging systems, which have greater numbers of users, roles, and systems, challenge the expressive power of these traditional models. Workshop Scope: The ACM workshops on RBAC bring together researchers, developers, and practitioners to discuss the application of RBAC to both traditional and emerging systems and the development of new access control paradigms for future applications. The workshop invites participation from the database, network, distributed systems, operating systems, security and application communities. Contributions reporting experiences with the implementation and use of RBAC systems are strongly encouraged. Attendance is limited to 40 participants to foster a workshop atmosphere. Topics of interest include, but are not restricted to: - Modeling and specification of RBAC systems - Administration of RBAC systems - RBAC in database security - Specification and enforcement of security policy - Delegation and inheritance of access rights in RBAC systems - Task-based access control and RBAC in collaborative environments - Application Areas e.g., health-care, WWW - Support for RBAC in traditional access control systems - RBAC and organizational control principles - Experiences with RBAC-based systems; case studies - Enabling technologies: Java, LDAP, intra-net environments - Implementation, integration and scalability of RBAC - End-user tools to support RBAC administration and engineering Submissions: Users, developers and researchers are invited to submit seven copies of their papers (in English and limited to 6000 words) to the Program Chair at the coordinates given below before the due date. Submissions can be either hard copy or electronic (postscript preferred). Papers must be original and should not be under consideration for publication elsewhere. Copyrights for accepted papers must be transferable to ACM (except for Government work). Papers will be published by ACM in a proceedings to be distributed at the workshop and mailed to all SIGSAC members. Outstanding papers will be considered for publication in ACM's new Transactions on Information and Systems Security (TISSEC). Proposals for panels and group discussions should be sent, preferably by email, to the Panels Chair at dferraiolo@nist.gov. Paper Submissions should be sent to: Sylvia Osborn, Program Committee Chair, Dept. of Computer Science, The University of Western Ontario, MC355, London, Ontario, Canada, N6A 5B7 email: sylvia@csd.uwo.ca SCHEDULE: Papers and Panel Proposals Due: May 15, 1999 Notification of acceptance and advance program: June 30, 1999 Deadline for final version of papers: July 31, 1999 Workshop: October 28-29, 1999 CONFERENCE STEERING COMMITTEE: Ed Coyne, Science Applications International Corporation David Ferraiolo, National Institute of Standards and Technology Trent Jaeger, IBM T.J. Watson Research Center Sylvia Osborn, The University of Western Ontario Ravi Sandhu, George Mason University Charles Youman, Blue Cross Blue Shield General Conference Chair: Charles Youman, Blue Cross Blue Shield Local Arrangements: Srinivas Ganta, CygnaCom Solutions Inc. Program Committee Chair: Sylvia Osborn, The University of Western Ontario Panels Chair: David Ferraiolo, National Institute of Standards and Technology Proceedings Chair: Vijay Atluri, Rutgers University Publicity Chair: Trent Jaeger, IBM T.J. Watson Research Center PROGRAM COMMITTEE: Vijay Atluri, Rutgers University Dave Ferraiolo, National Institute of Standards and Technology Luigi Giuri, Fondazione Ugo Bordoni Trent Jaeger, IBM T.J. Watson Research Center Carl Landwehr, U.S. Naval Research Laboratory Emil Lupu, Imperial College Ravi Sandhu, George Mason University Richard Simon Roshan Thomas, TIS Labs at Network Associates Dan Thomsen, Secure Computing Corp. Dan Wallach, Rice University REGISTRATION: Information on registration and accommodations will be provided. There will be a registration fee for all participants to cover meeting costs. Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id WAA25005 for ietf-open-pgp-bks; Mon, 1 Feb 1999 22:18:24 -0800 (PST) Received: from koeln.shuttle.de (uucp@koeln.shuttle.de [194.95.247.252]) by mail.proper.com (8.8.8/8.8.5) with ESMTP id WAA25001 for ; Mon, 1 Feb 1999 22:18:22 -0800 (PST) Received: by koeln.shuttle.de (8.9.2/8.9.2) id HAA07635 for ietf-open-pgp@imc.org; Tue, 2 Feb 1999 07:21:12 +0100 (MET) Received: (qmail 22001 invoked from network); 2 Feb 1999 06:00:11 -0000 Received: from frodo.isil.d.shuttle.de (qmailr@172.20.1.4) by beren.isil.d.shuttle.de with SMTP; 2 Feb 1999 06:00:11 -0000 Received: (qmail 3561 invoked by uid 501); 2 Feb 1999 05:57:31 -0000 Date: Tue, 2 Feb 1999 06:57:31 +0100 From: Werner Koch To: Jon Callas Cc: Max Inux , ietf-open-pgp@imc.org, g10@net.lut.ac.uk Subject: Re: Id 10 for Twofish Message-ID: <19990202065731.A3554@frodo.isil.d.shuttle.de> Mail-Followup-To: Jon Callas , Max Inux , ietf-open-pgp@imc.org, g10@net.lut.ac.uk References: <19990129203249.A1350@frodo.isil.d.shuttle.de> <3.0.3.32.19990201171558.033f2560@mail.pgp.com> Mime-Version: 1.0 X-Mailer: Mutt 0.95.1i In-Reply-To: <3.0.3.32.19990201171558.033f2560@mail.pgp.com>; from Jon Callas on Mon, Feb 01, 1999 at 05:15:58PM -0800 X-URL: http://www.d.shuttle.de/isil Content-Type: text/plain; charset=us-ascii Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: Jon Callas writes: > I believe our conjecture was > id: 10, keysize: 256 > > My belief concurs with Max. Okay. Werner Received: (from majordomo@localhost) by mail.proper.com (8.8.8/8.8.5) id RAA11339 for ietf-open-pgp-bks; Mon, 1 Feb 1999 17:15:25 -0800 (PST) Received: from fusebox.pgp.com (fusebox.pgp.com [161.69.1.11]) by mail.proper.com (8.8.8/8.8.5) with ESMTP id RAA11335 for ; Mon, 1 Feb 1999 17:15:24 -0800 (PST) Received: from jcallas (dhcp-47-64.dhcp.nai.com [161.69.47.64]) by fusebox.pgp.com (8.8.7/8.8.7) with SMTP id RAA01030; Mon, 1 Feb 1999 17:15:53 -0800 (PST) Message-Id: <3.0.3.32.19990201171558.033f2560@mail.pgp.com> X-Sender: jon@mail.pgp.com X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.3 (32) Date: Mon, 01 Feb 1999 17:15:58 -0800 To: Max Inux , Werner Koch From: Jon Callas Subject: Re: Id 10 for Twofish Cc: ietf-open-pgp@imc.org, g10@net.lut.ac.uk In-Reply-To: References: <19990129203249.A1350@frodo.isil.d.shuttle.de> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-ietf-open-pgp@imc.org Precedence: bulk List-Archive: List-Unsubscribe: At 03:50 PM 1/29/99 -0800, Max Inux wrote: On Fri, 29 Jan 1999, Werner Koch wrote: > 1) Did we agree on using the algorithm id 10 for Twofish? And > can I create preference lists with 10 in it. > > 2) What is the conclusion about the keysize: 128, 196 or 256 bit. I believe our conjecture was id: 10, keysize: 256 My belief concurs with Max. Jon ----- Jon Callas jon@pgp.com CTO, Total Network Security 3965 Freedom Circle Network Associates, Inc. Santa Clara, CA 95054 (408) 346-5860 Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS) 665B 797F 37D1 C240 53AC 6D87 3A60 4628 (RSA)