Subject: Re: to be done
From: Thomas Roessler <[email-masked]>
To: "John W. Noerenberg" <[email-masked]>
Cc: [email-masked], "Jeffrey I. Schiller" <[email-masked]>
Date: Thu, 18 Feb 1999 22:09:13 +0100

On 1999-02-18 12:25:34 -0800, John  W. Noerenberg wrote:

> Write up the motivation for multiple signatures, and publish it to
> the list.

Generally, it may be practical to have the possibility to have
multiple entities same one and the same document.  Possible
applications include:

- Transit periods in which one person is using multiple signature
  keys and wants to make sure that every recipient can verify a
  signature.

- Four-eye-principle: Messages may have to be revised and signed by
  two or more persons to be considered valid.  Multiple signatures
  give a simple implementation of this.

- Multi-protocol signatures: A message may be signed with different
  algorithms or protocols, e.g., MOSS, S/MIME, and PGP/MIME.

There seem to be essentially three different solutions from a PGP
point of view:

- Put multiple signature packets into the application/pgp-signature
  part of a multipart/signed; protocol=pgp-signature body.  I have
  not tested this.  It may or may not work, and it doesn't satisfy
  application 3, as it's PGP specific.

- Permit multiple application/pgp-signature parts in a mult/sign;
  prot=pgp-sig body.  This would be an extension of RFC 1847, it
  would be simple, but it would be PGP-specific once again.

- Define a multipart/mixed protocol in the spirit of RFC 1847.  This
  would not require any changes to RFC 1847, and it would be usable
  for all applications I listed above.

  I prefer this solution for the reason that it is not specific to
  any of the underlying signature protocols.  Modifications to MUAs
  to support this on the receiving side are minimal if these MUAs
  are able to handle multi-level MIME structures.  I've done a
  testbed implementation in the unstable tree of the Mutt MUA.

For the details of this protocol, see Michael Elkins' message from
Tue, 1 Dec 1998 17:15:18 -0800 to this list.  

tlr
-- 
http://home.pages.de/~roessler/

Date: Thu, 18 Feb 1999 12:11:47 -0800
To: "William H. Geiger III" <[email-masked]>
From: "John  W. Noerenberg" <[email-masked]>
Subject: Re: Abandon e-mail and go to direct connections?
Cc: [email-masked]
Sender: [email-masked]

At 9:05 AM -0500 2/16/99, William H. Geiger III wrote:
>
> Sorry about that last post, I don't know why it got cross-posted here,
> user error I guess. :(

Apology accepted. <grin>  There are worse sins.

best,

john noerenberg
[email-masked]
  ----------------------------------------------------------------------
  The man that can most truly be accounted brave is he who best
  knows the meaning of what is sweet in life and what is terrible,
  and then goes out undeterred to meet what is to come.
  -- Pericles, "Funeral Oration", 479 B.C.
  ----------------------------------------------------------------------

Date: Thu, 18 Feb 1999 12:25:34 -0800
To: Thomas Roessler <[email-masked]>
From: "John  W. Noerenberg" <[email-masked]>
Subject: Re: to be done
Cc: [email-masked], "Jeffrey I. Schiller" <[email-masked]>
Sender: [email-masked]

At 10:49 PM +0100 1/26/99, Thomas Roessler wrote:
> Since things don't look like we are ever getting the minutes from
> the IETF meeting, I'd like to give a push for some work which should
> be done by this WG.
>
> - Revise RFC 2015.  I'm hearing that the agreement in Orlando was to
>   do some small changes.  While this isn't interesting or anything,
>   it should be done.

Yes.

>
> - Define a multiple signature protocol. There are essentially two
>   possible paths to go.  On the one hand, we may define a
>   multipart/mixed protocol as suggested by Michael Elkins, or we may
>   just extend the current multipart/signed.  Personally, I'm in
>   favor of the fist approach.

Write up the motivation for multiple signatures, and publish it to 
the list.  Since reconciling handling of multiple signatures is one 
of the issues raised in concern with 2015, a separate protocol is a 
reasonable way to attack the problem.  What are other opinions on 
settling this?

We will not meet in Minneapolis.  I hope y'all aren't greatly 
disappointed.  I will stand in the email stocks so you can sling your 
rocks and arrows.

I do want to meet in Oslo so we can consider 2015 revisions, and 
perhaps the multiple signature protocol if we decide that is best 
course.  This means it would be good to have a 2015 revision and some 
debate over it in time for the that meeting.  More on this soon.

best,

john noerenberg
[email-masked]
  ----------------------------------------------------------------------
  The man that can most truly be accounted brave is he who best
  knows the meaning of what is sweet in life and what is terrible,
  and then goes out undeterred to meet what is to come.
  -- Pericles, "Funeral Oration", 479 B.C.
  ----------------------------------------------------------------------

To: [email-masked]
From: "William H. Geiger III" <[email-masked]>
Date: Wed, 17 Feb 1999 04:33:29 -0500
To: Andy Dustman <[email-masked]>
Cc: [email-masked], [email-masked]
Subject: Re: Abandon e-mail and go to direct connections?
Sender: [email-masked]

-----BEGIN PGP SIGNED MESSAGE-----

In <[email-masked]>, on
02/16/99 
   at 12:39 PM, Andy Dustman <[email-masked]> said:

>-----BEGIN PGP SIGNED MESSAGE-----

>On Tue, 16 Feb 1999, William H. Geiger III wrote:

>> Since we are talking about creating a mixmaster 3 has anyone thought of
>> abandoning using e-mail and go to direct connections between the mixmaster
>> servers? We could use something like TLS for encrypted links. I think that
>> there would be some advantages in this approach against traffic analysis
>> of the remailers. If the remailer links were reliable we could have a
>> steady stream of traffic between the servers injecting messages when
>> needed. We would still need pooling and mixing on the end remailers before
>> they sent messages out for the final hop via sendmail. 

>That's actually been in the works for a long time, probably pre-2.0.3.
>The idea was to use a DH key exchange. Another advantage of doing
>something like this, probably often overlooked, is that mixmaster packets
>can be exchanged in binary 8-bit format: No more ASCII armor and a 25%
>reduction in size, at least. Not everyone will be able to make use of
>this (you'll need to have at least a PPP connection). Even then, a
>possibility is to list a remailer as intermittent, so that other
>remailers don't try to transfer messages unless there is already an open
>connection with that remailer, or try once per hour. Something like that.

Well I guess for the remailers that are not on a direct connection we
could switch back to the old format for transmitting messages. We will
still need this ability for accepting messages from and send to the end
users.

- -- 
- ---------------------------------------------------------------
William H. Geiger III  http://www.openpgp.net
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 5.0 at: http://www.openpgp.net/pgp.html
Talk About PGP on IRC EFNet Channel: #pgp Nick: whgiii
- ---------------------------------------------------------------
 
Tag-O-Matic: OS/2 means...CURTAINS for Windows!

From: "William H. Geiger III" <[email-masked]>
Date: Wed, 17 Feb 1999 04:33:29 -0500
To: Andy Dustman <[email-masked]>
Cc: [email-masked], [email-masked]
Subject: Re: Abandon e-mail and go to direct connections?
Sender: [email-masked]

-----BEGIN PGP SIGNED MESSAGE-----

In <[email-masked]>, on
02/16/99 
   at 12:39 PM, Andy Dustman <[email-masked]> said:

>-----BEGIN PGP SIGNED MESSAGE-----

>On Tue, 16 Feb 1999, William H. Geiger III wrote:

>> Since we are talking about creating a mixmaster 3 has anyone thought of
>> abandoning using e-mail and go to direct connections between the mixmaster
>> servers? We could use something like TLS for encrypted links. I think that
>> there would be some advantages in this approach against traffic analysis
>> of the remailers. If the remailer links were reliable we could have a
>> steady stream of traffic between the servers injecting messages when
>> needed. We would still need pooling and mixing on the end remailers before
>> they sent messages out for the final hop via sendmail. 

>That's actually been in the works for a long time, probably pre-2.0.3.
>The idea was to use a DH key exchange. Another advantage of doing
>something like this, probably often overlooked, is that mixmaster packets
>can be exchanged in binary 8-bit format: No more ASCII armor and a 25%
>reduction in size, at least. Not everyone will be able to make use of
>this (you'll need to have at least a PPP connection). Even then, a
>possibility is to list a remailer as intermittent, so that other
>remailers don't try to transfer messages unless there is already an open
>connection with that remailer, or try once per hour. Something like that.

Well I guess for the remailers that are not on a direct connection we
could switch back to the old format for transmitting messages. We will
still need this ability for accepting messages from and send to the end
users.

- -- 
- ---------------------------------------------------------------
William H. Geiger III  http://www.openpgp.net
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 5.0 at: http://www.openpgp.net/pgp.html
Talk About PGP on IRC EFNet Channel: #pgp Nick: whgiii
- ---------------------------------------------------------------
 
Tag-O-Matic: OS/2 means...CURTAINS for Windows!

From: [email-masked]
To: <[email-masked]>
Subject: Create $50000 in 90 days at home
Date: Wed, 17 Feb 1999 02:38:49
Sender: [email-masked]

*****************************************************************
TO BE PERMANANTLY REMOVED FROM OUR MAILING LIST PLEASE GO TO
FOLLOWING WEB SITE:
http://creativecomm.freeservers.com/delete.htm
This message is sent in compliance of the new e-mail bill:
SECTION 301. Sender: Creative Communications, P.O. Box 14,
Maidsville, WV 26541
*****************************************************************

           EARN $100,000 PER YEAR SENDING E-MAIL!!!

*****************************************************************

Dear Friend,

You can earn $50,000 or more in next the 90 days sending e-mail,
seem impossible?  Read on for details (no, there is no
'catch')...

-----------------------------------------------------------------
-----------------------

 "AS SEEN ON NATIONAL T.V."

Thank you for your time and Interest.
This is the letter you've been reading about in the news lately.

Due to the popularity of this letter on the internet,
a major nightly news program recently devoted an entire show
to the  investigation of the program described below to see,
if it really can make people money.

The show also investigated whether or not the program was legal.
Their findings proved once and for all that there are,
absolutely no laws prohibiting the participation in the program.
This has helped to show people that this is a simple,
harmless and fun way to make some extra money at home.

The results of this show has been truly remarkable.
So many people are participating that those involved are doing,
much better than ever before.  Since everyone makes more as
more people try it out, its been very exciting to be a part of
lately. You will understand once you experience it.

"HERE IT IS BELOW"

================================================
================================================

             *** Print This Now For Future Reference ***

The following income opportunity is one you may be interested in
taking a look at.  It can be started with VERY LITTLE investment
and the income return is TREMENDOUS!!!

$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

If you would like  to make at least $50,000 in less than 90 days!
Please read the enclosed program...THEN READ IT AGAIN!!!

$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

THIS IS A LEGITIMATE, LEGAL, MONEY MAKING OPPORTUNITY.   It does
not require you to come into contact with people, do any hard
work, and best of all, you never have to leave the house except
to get the mail.  If you believe that someday you'll get that big
break that you've been waiting for, THIS IS IT!  Simply follow
the instructions, and your dreams will come true.  This
multi-level e-mail order marketing program works perfectly...100%
EVERY TIME.  E-mail is the sales tool of the future.  Take
advantage of this non-commercialized method of advertising NOW!!!
 The longer you wait, the more people will be doing business
using e-mail.  Get your piece of this action!!!

MULTI-LEVEL MARKETING (MLM) has finally gained
respectability.  It is being taught in the Harvard Business
School, and both Stanford Research and the Wall Street Journal
have stated that between 50% and 65% of all goods and services
will be sold through multi-level methods by the mid to late
1990's.  This is a Multi-Billion Dollar industry and of the
500,000 millionaires in the U.S., 20% (100,000)  made their
fortune in the last several years in MLM.  Moreover, statistics
show 45 people become millionaires everyday through Multi-Level
Marketing.

You may have heard this story before, but over the summer Donald
Trump made an appearance on the David Letterman show. Dave
asked him what he would do if he lost everything and had to start
over from scratch. Without hesitating, Trump said he would find a
good network marketing company and get to work. The audience
started to hoot and boo him. He looked out at the audience and
dead-panned his response  "That's why I'm sitting up here and you
are all sitting out there!"

With network marketing you have two sources of income. Direct
commissions from sales you make yourself and commissions from
sales made by people you introduce to the business.

Residual income is the secret of the wealthy. It means investing
time or money once and getting paid again and again and again.
In network marketing, it also means getting paid for the work of
others.

The enclosed information is something I almost let slip through
my fingers.  Fortunately, sometime later I re-read everything and
gave some thought and study to it.

My name is Johnathon Rourke.  Two years ago, the corporation I
worked at for the past twelve years down-sized and my position
was eliminated.  After unproductive job interviews, I decided to
open my own business.  Over the past year, I incurred many
unforeseen financial problems.  I owed my family, friends and
creditors over $35,000.  The economy was taking a toll on my
business and I just couldn't seem to make ends meet.  I had to
refinance and borrow against my home to support my family and
struggling business.  AT THAT MOMENT something significant
happened in my life and I am writing to share the experience in
hopes that this will change your life FOREVER FINANCIALLY!!!

In mid December, I received this program via e-mail.  Six month's
prior to receiving this program I had been sending away for
information on various business opportunities.  All of the
programs I received, in my opinion, were not cost effective.
They were either too difficult for me to comprehend or the
initial investment was too much for me to risk to see if they
would work or not.  One claimed that I would make a million
dollars in one year...it didn't tell me I'd have to write a book
to make it!

But like I was saying, in December of 1997 I received this
program. I didn't send for it, or ask for it, they just got my
name off a mailing list. THANK GOODNESS FOR THAT!!!  After
reading it several times, to make sure I was reading it
correctly, I couldn't believe my eyes.  Here was a MONEY MAKING
PHENOMENON.
I could invest as much as I wanted to start, without putting me
further into debt.  After I got a pencil and paper and figured it
out, I would at least get my money back.  But like most of you I
was still a little skeptical and a little worried about the legal
aspects  of it all. So I checked it out with the U.S. Post Office
(1-800-725-2161 24-hrs) and they confirmed that it is indeed
legal! After determining the program was LEGAL and NOT A CHAIN
LETTER, I decided  "WHY NOT."

Initially I sent out 10,000 e-mails.  It cost me about $15 for my
time on-line.  The great thing about e-mail is that I don't need
any money for printing to send out the program, and because all
of my orders are fulfilled via e-mail, the only expense is my
time.  I am telling you like it is, I hope it doesn't turn you
off, but I promised myself that I would not "rip-off" anyone, no
matter how much money it cost me.

In less than one week, I was starting to receive orders for
REPORT #1.  By January 13, I had received 26 orders for REPORT
#1. Your goal is to "RECEIVE at least 20 ORDERS FOR REPORT #1
WITHIN 2 WEEKS.  IF YOU DON'T, SEND OUT MORE PROGRAMS UNTIL
YOU DO!"  My first step in making $50,000 in 90 days was done.
By January 30, I had received 196 orders for REPORT #2.  Your
goal is to "RECEIVE AT LEAST 100+ ORDERS FOR REPORT #2
WITHIN 2 WEEKS. IF NOT, SEND OUT MORE PROGRAMS UNTIL YOU
DO. ONCE YOU HAVE 100 ORDERS, THE REST IS EASY, RELAX,
YOU WILL MAKE YOUR $50,000 GOAL."  Well, I had 196 orders for
REPORT #2, 96 more than I needed.  So I sat back and relaxed.
By March 1, of my e-mailing of 10,000, I received $58,000 with
more coming in every day.

I paid off ALL my debts and bought a much needed new car.
Please take time to read the attached program, IT WILL CHANGE
YOUR LIFE FOREVER!!!  Remember, it won't work if you don't try
it.  This program does work, but you must follow it EXACTLY!
Especially the rules of not trying to place your name in a
different place. It won't work, you'll lose out on a lot of
money!   In order for this program to work, you must meet your
goal of 20+ orders for REPORT #1, and 100+ orders for REPORT #2
and you will make $50,000 or more in 90 days. I AM LIVING PROOF
THAT IT WORKS!!!

If you choose not to participate in this program, I am sorry.  It
really is a great opportunity with little cost or risk to you.
If you choose to participate, follow the program and you will be
on your way to financial security.

If you are a fellow business owner and are if financial trouble
like I was, or you want to start your own business, consider this
a sign.I DID!

                      Sincerely,

                                                Johnathon Rourke

P.S. Do you have any idea what 11,700  $5 bills ($58,000) look
like piled up on a kitchen table?  IT'S AWESOME!

A PERSONAL NOTE FROM THE ORIGINATOR OF THIS
PROGRAM:

By the time you have read the enclosed program and reports, you
should have concluded that such a program, and one that is legal,
could not have been created by an amateur.

Let me tell you a little about myself.  I had a profitable
business for 10 years.  Then in 1979 my business began falling
off.  I was doing the same things that were previously successful
for me, but it wasn't working.  Finally, I figured it out.  It
wasn't me, it was the economy.  Inflation and recession had
replaced the stable economy that had been with us since 1945.  I
don't have to tell you what happened to the unemployment rate...
because many of you know from first hand experience.  There were
more failures and bankruptcies than ever before.

The middle class was vanishing.  Those who knew what they were
doing invested wisely and moved up.  Those who did not,
including those who never had anything to save or invest, were
moving down into the ranks of the poor.  As the saying goes,
"THE RICH GET RICHER AND THE POOR GET POORER."  The traditional
methods of making money will never allow you to "move up" or "get
rich", inflation will see to that.

You have just received information that can give you financial
freedom for the rest of your life, with "NO RISK" and "JUST A
LITTLE BIT OF EFFORT."  You can make more money in the next
few months than you have ever imagined.

I should also point out that I will not see a penny of this
money, nor anyone else who has provided a testimonial for this
program. I have already made over 4 MILLION DOLLARS!  I have
retired from the program after sending out over 16,000 programs.
 Now I have several offices that make this and several other
programs here and over seas.

Follow the program EXACTLY AS INSTRUCTED.  Do not change
it in any way.  It works exceedingly well as it is now.  Remember
to e-mail a copy of this exciting report to everyone you can
think of. One of the people you send this to may send out
50,000...and your name will be on everyone of them!  Remember
though, the more you send out the more potential customers you
will reach.

So my friend, I have given you the ideas, information, materials
and opportunity to become financially independent, IT IS UP TO
YOU NOW!

"THINK ABOUT IT"
Before you delete this program from your mailbox, as I almost
did,take a little time to read it and REALLY THINK ABOUT IT.  Get
a pencil and figure out what could happen when YOU participate.
Figure out the worst possible response and no matter how you
calculate it, you will still make a lot of money!  You will
definitely get back what you invested.  Any doubts you have will
vanish when your first orders come in.  IT WORKS!
                                     Jody Jacobs, Richmond, VA

HERE'S HOW THIS AMAZING PROGRAM WILL MAKE YOU THOUSANDS OF
DOLLAR$

INSTRUCTIONS:

This method of raising capital  REALLY WORKS 100% EVERY
TIME. I am sure that you could use up to $50,000 or more in the
next 90 days.
Before you say "BULL... ", please read this program carefully.
This is not a chain letter, but a perfectly legal money making
opportunity.  Basically, this is what you do:  As with all
multi-level businesses, we build our business by recruiting new
partners and selling our products.  Every state in the USA allows
you to recruit new multi-level business partners, and we offer a
product for EVERY dollar sent.  YOUR ORDERS COME BY MAIL
AND ARE FILLED BY E-MAIL, so you are not involved
in personal selling.  You do it privately in your own home, store
or office.  This is the GREATEST Multi-Level Mail Order
Marketing anywhere:

This is what you MUST do:

1. Order all 4 reports shown on the list below (you can't sell
   them if you don't order them).

     *  For each report, send $5.00 CASH, the NAME & NUMBER
OF THE REPORT YOU ARE ORDERING, YOUR E-MAIL ADDRESS, and
YOUR NAME & RETURN ADDRESS (in case of a problem) to the
person whose name appears on the list next to the report.
MAKE SURE YOUR RETURN ADDRESS IS ON YOUR ENVELOPE
IN CASE OF ANY MAIL PROBLEMS!

     *  When you place your order, make sure you order each of
        the four reports.  You will need all four reports so
        that you can save them on your computer and resell them.

     *  Within a few days you will receive, via e-mail, each of
        the four reports. Save them on your computer so they
        will be accessible for you to send to the 1,000's of
        people who will order them from you.

2.  IMPORTANT-- DO NOT alter the names of the people who are
    listed next to each report, or their sequence on the list,
    in any way other than is instructed below in steps "a"
    through "f" or you will lose out on the majority of your
    profits.  Once you understand the way this works, you'll
    also see how it doesn't work if you change it. Remember,
    this method has been tested, and if you alter it, it will
    not work.

    a.  Look below for the listing of available reports.

    b.  After you've ordered the four reports, take this
        advertisement and remove the name and address under
        REPORT #4. This person has made it through the cycle and
        is no doubt counting their $50,000!

    c.  Move the name and address under REPORT #3 down to
        REPORT #4.

    d.  Move the name and address under REPORT #2 down to
        REPORT #3.

    e.  Move the name and address under REPORT #1 down to
         REPORT #2.

    f.  Insert your name/address in the REPORT #1 position.

Please make sure you copy every name and address
ACCURATELY!

3.  Take this entire letter, including the modified list of
names, and save it to your computer.  Make NO changes to the
instruction portion of this letter.

Your cost to participate in this is practically nothing (surely
you can afford $20). You obviously already have an Internet
connection and e-mail is FREE!

To assist you with marketing your business on the internet, the 4
reports you purchase will provide you with invaluable marketing
information which includes how to send bulk e-mails, where to
find thousands of free classified ads and much, much more.

In addition you will be provided with information on Internet
Marketing Clubs such as INTERNET MARKETING RESOURCES(IMR): This
is one the premiere  internet marketing clubs on the INTERNET.
This club provides a forum where internet marketers from all over
the world can exchange ideas and secrets on Internet Marketing.
In addition,this club specializes in providing free internet
marketing tools and services for the
Do-Yourself-Internet-Marketer.  They will provide you with free
bulk e-mail software and up to 1,000,000 fresh e-mail addresses
each week.   This club will provide you with hundreds of free
resources which include:
How to obtain free web sites,   how to obtain top rankings in
search engines for your web-site, how to send bulk e-mail into
AOL and Compuserve, how to market your products on
newsgroups, free classified ads, electronic malls, bulletin
boards, banner ads and much more.

IMR'S web address is:

http://www.ixpres.com/imrs/marketing1.htm

There are two primary methods of building your downline:

METHOD #1: SENDING BULK E-MAIL

Let's say that you decide to start small, just to see how it
goes,
and we'll assume you and all those involved send out only 2,000
programs each.  Let's also assume that the mailing receives a
0.5% response.  Using a good list the response could be much
better. Also, many people will send out hundreds of thousands of
programs instead of 2,000.  But continuing with this example, you
send out only 2,000 programs.  With a 0.5% response, that is only
10 orders for REPORT #1.  Those 10 people respond by sending out
2,000 programs each for a total of 20,000.  Out of those 0.5%,
100 people respond and order REPORT #2.  Those 100 mail out 2,000
programs each for a total of 200,000.  The 0.5% response to that
is 1,000 orders for REPORT #3.  Those 1,000 send out 2,000
programs each for a 2,000,000 total.  The 0.5% response to that
is 10,000 orders for REPORT #4.  That's 10,000 $5 bills for you.
CASH!!! Your total income in this example is $50 + $500 + $5,000
+ $50,000 for a total of $55,550!!!

REMEMBER FRIEND, THIS IS ASSUMING 1,990 OUT OF THE 2,000 PEOPLE
YOU MAIL TO WILL DO ABSOLUTELY NOTHING AND TRASH THIS PROGRAM!
DARE TO THINK FOR A MOMENT WHAT WOULD HAPPEN IF EVERYONE,
OR HALF SENT OUT 100,000 PROGRAMS INSTEAD OF 2,000.
Believe me, many people will do just that, and more!  By the way,
your cost to participate in this is practically nothing.  You
obviously already have an internet connection and e-mail is
FREE!!!
REPORT #2 will show you the best methods for bulk e-mailing, tell
you where to obtain free bulk e-mail software and where to obtain
e-mail lists.

METHOD #2 - PLACING FREE ADS ON THE INTERNET

1.  Advertising on the 'Net is very, very  inexpensive, and
 there are HUNDREDS of FREE places to  advertise.
Let's say you decide to start small just to see how well it
works. Assume your goal is to get ONLY 10 people to participate
on your first level. (Placing a lot of FREE ads on the internet
will EASILY get a larger response.) Also assume that everyone
else in YOUR ORGANIZATION gets ONLY 10 downline members.
Follow this example to achieve the STAGGERING results below.

1st level--your 10 members with   $5      ....................$50
2nd level--10 members from those 10 ($5 x 100)...............$500
3rd level--10 members from those 100 ($5 x 1,000)........  $5,000
4th level--10 members from those 1,000 ($5 x 10,000).     $50,000
                                                      -----------
            THIS TOTALS        ---------------------------$55,550

Remember friends, this assumes that the people who participate
only recruit 10 people each.  Think for a moment what would
happen if they got 20 people to participate!  Most people get
100's of participants! THINK ABOUT IT!

 For every $5.00 you receive, all you must do is e-mail them
 the report they ordered.  THAT'S IT!  ALWAYS PROVIDE
 SAME-DAY SERVICE ON ALL ORDERS!  This will guarantee that
 the e-mail THEY send out, with YOUR name and address on it,
 will be prompt because they can't advertise until they
 receive the report!

------------------------------------------
AVAILABLE REPORTS
------------------------------------------

*** Order Each REPORT by NUMBER and NAME ***

Notes:

-  ALWAYS SEND $5 CASH (U.S. CURRENCY) FOR EACH
REPORT
   CHEQUES NOT ACCEPTED
-  ALWAYS SEND YOUR ORDER VIA FIRST CLASS MAIL
-  Make sure the cash is concealed by wrapping it in at least
   two sheets of paper
-  On one of those sheets of paper, include: (a) the number &
   name of the report you are ordering, (b) your e-mail address,
   and (c) your name & postal address.

PLACE YOUR ORDER FOR THESE REPORTS NOW:
______________________________________________________

REPORT #1  "The Insider's Guide to Advertising for Free on the
Internet"

ORDER REPORT #1 FROM:

Larry Boone
7112 Kittyhawk Ave AptB
Los Angeles, CA 90045
______________________________________________________

REPORT #2  "The Insider's Guide to Sending Bulk E-mail on the
Internet"

ORDER REPORT #2 FROM:

Creative Communications
P.O. Box 14
Maidsville, WV 2654
______________________________________________________

REPORT #3  "The Secrets to Multilevel Marketing on the Internet"

ORDER REPORT #3 FROM:

American United Marketing
3915 Mission Avenue Suite 7414
Oceanside, Ca. 92054-7801

______________________________________________________

REPORT #4 "How to become a Millionaire utilizing the Power
of Multilevel Marketing and the Internet"

ORDER REPORT #4 FROM:

MLH Enterprises
1450 N. Santa Fe Suite C-525
Vista, Ca.  92083
______________________________________________________

______________________________________________________

About 50,000 new people get online every month!

******* TIPS FOR SUCCESS *******

*  TREAT THIS AS YOUR BUSINESS!  Be prompt, professional,
   and follow the directions accurately.

*  Send for the four reports IMMEDIATELY so you will have them
   when the orders start coming in because:

        When you receive a $5 order, you MUST send out the
        requested product/report.

*  ALWAYS PROVIDE SAME-DAY SERVICE ON THE ORDERS YOU RECEIVE.

*  Be patient and persistent with this program. If you follow
   the instructions exactly, your results WILL BE SUCCESSFUL!

*  ABOVE ALL, HAVE FAITH IN YOURSELF AND KNOW YOU WILL SUCCEED!

******* YOUR SUCCESS GUIDELINES *******

Follow these guidelines to guarantee your success:

If you don't receive 20 orders for REPORT #1 within two
weeks, continue advertising or sending e-mails until you do.
Then, a couple of weeks later you should receive at least 100
orders
for REPORT#2.  If you don't, continue advertising or sending
e-mails
until you do.

Once you have received 100 or more orders for REPORT #2, YOU
CAN RELAX, because the system is already working for you, and
the cash will continue to roll in!

THIS IS IMPORTANT TO REMEMBER:

Every time your name is moved down on the list, you are placed
in front of a DIFFERENT report.  You can KEEP TRACK of your
PROGRESS by watching which report people are ordering from
you. If you want to generate more income, send another batch of
e-mails or continue placing ads and start the whole process
again!
There is no limit to the income you will generate from this
business!

Before you make your decision as to whether or not you
participate in this program.  Please answer one question.  DO YOU
WANT TO CHANGE YOUR LIFE?   If the answer is yes, please look at
the following facts about this program:

  1. YOU ARE SELLING A PRODUCT WHICH DOES NOT
      COST ANYTHING TO PRODUCE!

  2. YOU ARE SELLING A PRODUCT WHICH DOES NOT
      COST ANYTHING TO SHIP!

  3. YOU ARE SELLING A PRODUCT WHICH DOES NOT
      COST YOU ANYTHING TO ADVERTISE!

  4. YOU ARE UTILIZING THE POWER OF THE INTERNET
      AND THE POWER OF MULTI-LEVEL MARKETING TO
      DISTRIBUTE YOUR PRODUCT ALL OVER THE
      WORLD!

  5.  YOUR ONLY EXPENSES OTHER THAN YOUR
      INITIAL $20  INVESTMENT IS YOUR TIME!

  6.  VIRTUALLY ALL OF THE INCOME YOU GENERATE
       FROM THIS PROGRAM IS PURE PROFIT!

  7.  THIS PROGRAM  WILL CHANGE YOUR
       LIFE FOREVER.

******* T  E  S  T  I  M  O  N  I  A  L  S *******

This program does work, but you must follow it EXACTLY!
Especially the rule of not trying to place your name in a
different position, it won't work and you'll lose a lot of
potential income.  I'm living proof that it works. It really is
a great opportunity to make relatively easy money, with little
cost to you.  If you do choose to participate, follow the
program exactly, and you'll be on your way to financial
security.
                    Steven Bardfield, Portland, OR

     My name is Mitchell. My wife, Jody, and I live in Chicago,
IL. I am a cost accountant with a major U.S. Corporation and I
make pretty good money. When I received the program I grumbled
to Jody about receiving "junk mail." I made fun of the whole
thing, spouting my knowledge of the population and percentages
involved.  I "knew" it wouldn't work. Jody totally ignored my
supposed intelligence and jumped in with both feet. I made
merciless fun of her, and was ready to lay the old "I told you
so" on her when the thing didn't work... well, the laugh was on
me! Within two weeks she had received over 50 responses. Within
45 days she had received over $147,200 in $5 bills! I was
shocked!  I was sure that I had it all figured and that it
wouldn't work.  I AM a believer now. I have joined Jody in her
"hobby."   I did have seven more years until retirement, but I
think of the "rat race" and it's not for me. We owe it all to
MLM.
                    Mitchell Wolf MD., Chicago, IL

    The main reason for this letter is to convince you that this
system is honest, lawful, extremely profitable, and is a way to
get a large amount of money in a short time. I was approached
several times before I checked this out. I joined just to see
what one could expect in return for the minimal effort and money
required.  To my astonishment, I received $36,470.00 in the
first 14 weeks, with money still coming in.

                           Sincerely yours,
        Charles Morris, Esq.

    Not being the gambling type, it took me several weeks to
make up my mind to participate in this plan. But conservative
that I am, I decided that the initial investment was so little
that there was just no way that I wouldn't get enough orders to
at least get my money back. Boy, was I surprised when I found my
medium-size post office box crammed with orders! For awhile, it
got so overloaded that I had to start picking up my mail at the
window. I'll make more money this year than any 10 years of my
life before. The nice thing about this deal is that it doesn't
matter where people live. There simply isn't a
better investment with a faster return.
                 Paige Willis, Des Moines, IA

    I had received this program before. I deleted it, but later
I wondered if I shouldn't have given it a try. Of course, I had
no idea who to contact to get another copy, so I had to wait
until I was e-mailed another program, ...11 months passed then
it came...I didn't delete this one!...I made more than $41,000
on the first try!!
                    Violet Wilson, Johnstown, PA

     This is my third time to participate in this plan. We have
quit our jobs, and will soon buy a home on the beach and live
off the interest on our money. The only way on earth that this
plan will work for you is if you do it. For your sake, and for
your family's sake don't pass up this golden opportunity. Good
luck and happy spending!
                    Kerry Ford, Centerport, NY

ORDER YOUR REPORTS TODAY AND
GET STARTED ON YOUR ROAD TO
FINANCIAL FREEDOM!

NOW  IS THE TIME FOR YOUR TURN

DECISIVE ACTION YIELDS
POWERFUL RESULTS

PLEASE NOTE:  If you need help with starting a business,
registering a business name, learning how income tax is
handled, etc., contact your local office of the Small Business
Administration (a Federal agency) 1-(800)827-5722 for free
help and answers to questions.  Also, the Internal Revenue
Service offers free help via telephone and free seminars about
business tax requirements.  Your earnings and results are highly
dependant on your activities and advertising.  This letter
constitutes no guarantees stated nor implied.  In the event that
it is determined that this letter constitutes a guarantee of any
kind, that guarantee is now void.   Any testimonials or amounts
of earnings listed in this letter may be factual or fictitious.
If you have any question of the legality of this letter contact
the Office of Associate Director for Marketing Practices Federal
Trade Commission Bureau of Consumer Protection in Washington DC.

 

 

 

Date: Tue, 16 Feb 1999 12:39:24 -0500 (EST)
From: Andy Dustman <[email-masked]>
To: "William H. Geiger III" <[email-masked]>
cc: [email-masked], [email-masked]
Subject: Re: Abandon e-mail and go to direct connections?
Copyright: 1999 by Andy Dustman
Sender: [email-masked]

-----BEGIN PGP SIGNED MESSAGE-----

On Tue, 16 Feb 1999, William H. Geiger III wrote:

> Since we are talking about creating a mixmaster 3 has anyone thought of
> abandoning using e-mail and go to direct connections between the mixmaster
> servers? We could use something like TLS for encrypted links. I think that
> there would be some advantages in this approach against traffic analysis
> of the remailers. If the remailer links were reliable we could have a
> steady stream of traffic between the servers injecting messages when
> needed. We would still need pooling and mixing on the end remailers before
> they sent messages out for the final hop via sendmail. 

That's actually been in the works for a long time, probably pre-2.0.3. The
idea was to use a DH key exchange. Another advantage of doing something
like this, probably often overlooked, is that mixmaster packets can be
exchanged in binary 8-bit format: No more ASCII armor and a 25% reduction
in size, at least. Not everyone will be able to make use of this (you'll
need to have at least a PPP connection). Even then, a possibility is to
list a remailer as intermittent, so that other remailers don't try to
transfer messages unless there is already an open connection with that
remailer, or try once per hour. Something like that.

- -- 
Andy Dustman                    You should always say "spam" and "eggs"
ComStar Communications Corp.                 instead of "foo" and "bar"
(706) 549-7689 | PGP KeyID=0xC72F3F1D   in Python examples. (Mark Lutz)

From: "William H. Geiger III" <[email-masked]>
Date: Tue, 16 Feb 1999 09:05:39 -0500
To: [email-masked]
Subject: Re: Abandon e-mail and go to direct connections?
Sender: [email-masked]

Sorry about that last post, I don't know why it got cross-posted here,
user error I guess. :(

If anyone is interested there are a few of us that are talking about
re-writting the mixmaster code to make use of OpenPGP formats.

Again sorry for the cross-post.

- -- 
- ---------------------------------------------------------------
William H. Geiger III  http://www.openpgp.net
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 5.0 at: http://www.openpgp.net/pgp.html
Talk About PGP on IRC EFNet Channel: #pgp Nick: whgiii
- ---------------------------------------------------------------
 
Tag-O-Matic: I don't do Windows, but OS/2 does.

From: "William H. Geiger III" <[email-masked]>
Date: Tue, 16 Feb 1999 07:41:49 -0500
To: [email-masked], [email-masked]
Subject: Abandon e-mail and go to direct connections?
Sender: [email-masked]

Since we are talking about creating a mixmaster 3 has anyone thought of
abandoning using e-mail and go to direct connections between the mixmaster
servers? We could use something like TLS for encrypted links. I think that
there would be some advantages in this approach against traffic analysis
of the remailers. If the remailer links were reliable we could have a
steady stream of traffic between the servers injecting messages when
needed. We would still need pooling and mixing on the end remailers before
they sent messages out for the final hop via sendmail. 

- -- 
- ---------------------------------------------------------------
William H. Geiger III  http://www.openpgp.net
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 5.0 at: http://www.openpgp.net/pgp.html
Talk About PGP on IRC EFNet Channel: #pgp Nick: whgiii
- ---------------------------------------------------------------
 
Tag-O-Matic: Windows: The CP/M of the future!

Subject: Re: GnuPG and trailing whitespace handling
To: [email-masked] (Jon Callas)
Date: Sun, 14 Feb 1999 01:24:51 +0100 (MET)
Cc: [email-masked]
From: [email-masked] (Ulf =?ISO-8859-1?Q?M=F6ller?=)
Sender: [email-masked]

> When you receive a message, don't go interpreting it. Do nothing. Compute
> the signature. In the case where you have a non-blank-trimmed literal
> packet, don't even look for the flaw here.

It is not that simple for detached signatures (a detached signature is
one where the PGP message consists of the signature packet only and
the signed text is specified externally). When you verify a detached
text-mode signature, you *have to* convert the text to canonical
format first. And, conversely, when you generate a detached signature,
modifying the original file usually is not an option.

> It's my opinion that if a 2440 application wants to send a textmode message
> with trailing blanks then the obvious, right way to do it is to put a
> binarymode signature after the textmode literal.

RFC 2440 doesn't expressly say whether or not you can do that, but as
far as I remember, PGP just throws funny error messages at you when
you try it.

Date: Fri, 12 Feb 1999 16:27:25 -0800
To: [email-masked]
From: Jon Callas <[email-masked]>
Subject: Re: GnuPG and trailing whitespace handling
Sender: [email-masked]

At 04:08 PM 2/11/99 -0800, Russ Allbery wrote:

|Pardon me if I'm confused here, but wouldn't that involve checking any
|failing detached text-mode signature a second time with the original data
|without trailing whitespace stripped to see if it then passes?
|
|And isn't it impossible to both follow the RFC and generate detached
|text-mode signatures that will verify correctly with PGP 5.0 if the data
|has trailing whitespace?  In that either the signatures will verify with
|PGP 5.0 or they will verify with RFC-compliant checkers, but never with
|both?

Here's my interpretation of what you should do:

Remember that we're not talking about clear-signed messages, we are talking
about a message that is a literal packet and a signature packet (and
possibly this pair has been encrypted).

If you are constructing the message, construct it in canonicalized text.
Line ends are CRLFs, and lines are blank-trimmed. Construct the signature,
send the message. All things being equal (that is, excepting the cases
where you have a DSS sig sent to 2.6 etc.), it will always work. The
literal packet should be a text-mode literal packet.

When you receive a message, don't go interpreting it. Do nothing. Compute
the signature. In the case where you have a non-blank-trimmed literal
packet, don't even look for the flaw here. The signature will work
correctly for anyone who constructed it correctly, and it will work for
anyone who was merely stupid. That's what I meant by rolling your eyes and
proceeding. My suggestion is that by doing zero work, you handle all
correctly contrusted messages, and many incorrectly constructed messages.

There are a number of flawed cases, here, too. I'm using the word "flaw"
only to avoid a more perjoritive term like "erroneous" because I don't want
to get into those arguments.

One flawed case is a text mode literal that has not been blank trimmed, but
is otherwise correctly textmode. It's followed by a textmode sig packet.
The "do no work" precept lets this one work.

Another is a textmode literal that contains carriage control -- for example
one that underscores by using a bare CR. The "do no work" precept lets this
one work, and a smart implementation is likely to damage this packet.

Another is a mal-formed textmode literal. For example, it just put unix
text (LF endings) into a textmode packet. The DNW precept makes for a
correctly formed signature, but there may be errors when the file is
written out (or maybe not, if the texmode literal processor has
error-adaptions in it). But that's a different problem.

More problematic is a textmode literal with trailing blanks, with a sig
calculated by trimming them. Here, DNW fails. This is also where the real
crux of the problem is. I believe that it's possible to have "minimal"
implementations and "friendly" implementations. A minimal implementation
will fail to verify the signature. This is in my opinion fine, because I
believe that a compliant 2440 application will be *generating*
blank-trimmed signed text. If the trailing blanks were that important to
you, there's always binary mode, y'know? A friendly implementation,
however, is free to see that the signature failed and try again using a
different strategy (such as blank trimming or blank trimming with line-end
conversion) and see if the signature works with this.

It's my opinion that if a 2440 application wants to send a textmode message
with trailing blanks then the obvious, right way to do it is to put a
binarymode signature after the textmode literal. That's what binarymode
means -- don't mess with the content, just hash it straight. To me,
textmode signatures are an *assurance* that the literal packet it signs met
those criteria when it was generated. If it doesn't, you could have
constructed a textmode message and signed it in binary mode. To tie in what
I said before, this means that a 2440 app conservatively generates a
message by trimming a textmode packet if it is going to textmode sign it,
so there will be *no* *question* how to interpret it.

Now then, having said that, reality is that we live in a world with a mass
of implementations of PGP, all of which are more-or-less 2440ish. A
friendly application can consider the textmode signature packet when it
*receives* it to be an alert that it may have to futz with the hashing to
be fully forwards compatible. Note that a 2440 application is not required
to do that. That's the difference between minimal and friendly. No one says
you have to be friendly.

(Here's another comment of mine that only relates to comments that I've
made here and before that you're permitted to go beyond the spec. 2440 says
that textmode literals have CRLF line ends. It's my considered opinion that
textmode should also trim blanks. You're free to disagree, but if I were
writing a 2440 app, I'd trim blanks. I probably would also allow textmode
conversions to do tab/blank conversions and possibly paragraph
reformatting. 2440 is silent on all of these. That does not mean that one
is forbidden from doing them. If you're the implementer, you get to make
these decisions yourself.)

	Jon

-----
Jon Callas                                  [email-masked]
CTO, Total Network Security                 3965 Freedom Circle
Network Associates, Inc.                    Santa Clara, CA 95054
(408) 346-5860                              
Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS)
              665B 797F 37D1 C240 53AC 6D87 3A60 4628           (RSA)

Date: Fri, 12 Feb 1999 12:21:20 +0100
From: Werner Koch <[email-masked]>
To: [email-masked], [email-masked]
Subject: Re: GnuPG and trailing whitespace handling
Mail-Followup-To: [email-masked], [email-masked]
Sender: [email-masked]

Jon Callas <[email-masked]> writes:

> If you want to be forwards compatible (meaning that you accept things old
> versions generate), all you have to do is not generate an error when an old
> version fails to blank-trim.

Ah right that's an idea how to handle it without calculating hashs of both
versions - I have to see how I can do this with my streams like framework.

  Werner

-- 
ceterum censeo RSA esse delendam

To: [email-masked], [email-masked]
Subject: Re: GnuPG and trailing whitespace handling
From: Russ Allbery <[email-masked]>
Date: 11 Feb 1999 16:08:44 -0800
Lines: 20
Sender: [email-masked]

Jon Callas <[email-masked]> writes:

> If you follow the RFC, you will be backwards compatible.

> If you want to be forwards compatible (meaning that you accept things
> old versions generate), all you have to do is not generate an error when
> an old version fails to blank-trim.

Pardon me if I'm confused here, but wouldn't that involve checking any
failing detached text-mode signature a second time with the original data
without trailing whitespace stripped to see if it then passes?

And isn't it impossible to both follow the RFC and generate detached
text-mode signatures that will verify correctly with PGP 5.0 if the data
has trailing whitespace?  In that either the signatures will verify with
PGP 5.0 or they will verify with RFC-compliant checkers, but never with
both?

-- 
Russ Allbery ([email-masked])         <URL:http://www.eyrie.org/~eagle/>

Date: Thu, 11 Feb 1999 12:30:55 -0800
To: Werner Koch <[email-masked]>, [email-masked], [email-masked]
From: Jon Callas <[email-masked]>
Subject: Re: GnuPG and trailing whitespace handling
Sender: [email-masked]

At 11:05 AM 2/11/99 +0100, Werner Koch wrote:

|Okay, so I implement it like PGP and make a remark that GnuPG does not
|follow the RFC :-)

I don't know how to interpret the smiley, so I apologize if this is a
humor-impaired comment.

If you follow the RFC, you will be backwards compatible.

If you want to be forwards compatible (meaning that you accept things old
versions generate), all you have to do is not generate an error when an old
version fails to blank-trim.

IETF standards are not handcuffs. You are always permitted to do more than
them. This is especially true in cases where you accept as valid something
that fails slightly.

	Jon

-----
Jon Callas                                  [email-masked]
CTO, Total Network Security                 3965 Freedom Circle
Network Associates, Inc.                    Santa Clara, CA 95054
(408) 346-5860                              
Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS)
              665B 797F 37D1 C240 53AC 6D87 3A60 4628           (RSA)

Date: Thu, 11 Feb 99 18:58 +0100
From: [email-masked] (Ulf =?iso-8859-1?Q?M=F6ller?=)
To: [email-masked]
Subject: Re: GnuPG and trailing whitespace handling
Organization: HR13
Sender: [email-masked]

>I didn't ignore it, I'm pretty sure we discussed it.

Your reply didn't show up in my mailbox nor in the archive at
www.imc.org, then.

>Now, an *implementation* of OpenPGP has to be always generating thingies
>trimmed. When it does, they will interoperate with the old versions just
>fine. The only subtle gotcha here is that when *receiving* a signed text
>object, a smart implementation won't throw a hissy fit if the text object
>hasn't been trimmed; it will just roll its eyes and mutter "get with the
>program, geezer" under its breath. This is the old principle of "be liberal
>in what you accept and conservative in what you generate."

That sort of makes sense, but the RFC should have contained a notice
about the incompatibility. When you follow the letter of the RFC, the
obvious thing to do when you verify signatures is to use the same
function for tweaking the line ends for both signature types.
Following the principle of "being liberal in what you accept" without
knowing about this specific incompatibility (there are dozens of ways
a signing implementation could fail) is impossible because there is no
such thing as a "near miss" with a message digest.

Date: Thu, 11 Feb 1999 11:22:03 +0100
From: Werner Koch <[email-masked]>
To: [email-masked]
Subject: Re: GnuPG and trailing whitespace handling
Mail-Followup-To: [email-masked]
Sender: [email-masked]

Jon Callas <[email-masked]> writes:

> hasn't been trimmed; it will just roll its eyes and mutter "get with the
> program, geezer" under its breath. This is the old principle of "be liberal
> in what you accept and conservative in what you generate."

That's right, but it is quite complicated to do in an implementaion which
gets it input from stdin.  One would have to calculate hashs for boths
"versions".   

   Werner 

Date: Thu, 11 Feb 1999 11:05:23 +0100
From: Werner Koch <[email-masked]>
To: [email-masked], [email-masked]
Subject: Re: GnuPG and trailing whitespace handling
Mail-Followup-To: [email-masked], [email-masked]
Sender: [email-masked]

Ulf Möller <[email-masked]> writes:

> I reported that on the OpenPGP list before RFC 2440 was issued, but
> for some reason the RFC authors ignored my post.

Yep, I remember that post but it's long ago.

> In PGP, trailing whitespace is removed as part of the clearsig
> encoding (which is the only situation where trailing whitespace can
> get lost in the transport). It is not part of the signing operation
> and should not have been mentioned in the section quoted above.

Okay, so I implement it like PGP and make a remark that GnuPG does not
follow the RFC :-)

  Werner

-- 
ceterum censeo RSA esse delendam

Date: Wed, 10 Feb 1999 14:28:58 -0800
To: [email-masked]
From: Jon Callas <[email-masked]>
Subject: Re: GnuPG and trailing whitespace handling
Sender: [email-masked]

At 09:58 PM 2/10/99 +0100, Ulf Möller wrote:

|I reported that on the OpenPGP list before RFC 2440 was issued, but
|for some reason the RFC authors ignored my post.
|
|In PGP, trailing whitespace is removed as part of the clearsig
|encoding (which is the only situation where trailing whitespace can
|get lost in the transport). It is not part of the signing operation
|and should not have been mentioned in the section quoted above.

I didn't ignore it, I'm pretty sure we discussed it.

I believe that for OpenPGP, this is the right thing to do, and that for
*any* object in "canonical text" form, trimming trailing white space is a
Smart Thing To Do.

Now, an *implementation* of OpenPGP has to be always generating thingies
trimmed. When it does, they will interoperate with the old versions just
fine. The only subtle gotcha here is that when *receiving* a signed text
object, a smart implementation won't throw a hissy fit if the text object
hasn't been trimmed; it will just roll its eyes and mutter "get with the
program, geezer" under its breath. This is the old principle of "be liberal
in what you accept and conservative in what you generate."

	Jon

-----
Jon Callas                                  [email-masked]
CTO, Total Network Security                 3965 Freedom Circle
Network Associates, Inc.                    Santa Clara, CA 95054
(408) 346-5860                              
Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS)
              665B 797F 37D1 C240 53AC 6D87 3A60 4628           (RSA)

Date: Wed, 10 Feb 99 21:58 +0100
From: [email-masked] (Ulf =?iso-8859-1?Q?M=F6ller?=)
To: [email-masked]
Subject: Re: GnuPG and trailing whitespace handling
Organization: HR13
Cc: [email-masked]
Sender: [email-masked]

>>    0x01: Signature of a canonical text document.
>>          Typically, this means the signer owns it, created it, or
>>          certifies that it has not been modified.  The signature is
>>          calculated over the text data with its line endings converted
>>          to <CR><LF> and trailing blanks removed.
>
>I can verify that PGP 2.6.2 and PGP 5.0 do *not* do this for detached
>signatures.

I reported that on the OpenPGP list before RFC 2440 was issued, but
for some reason the RFC authors ignored my post.

In PGP, trailing whitespace is removed as part of the clearsig
encoding (which is the only situation where trailing whitespace can
get lost in the transport). It is not part of the signing operation
and should not have been mentioned in the section quoted above.

From: [email-masked]
Date: Tue, 9 Feb 1999 21:51:11 EST
To: [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked]
Cc: [email-masked]
Subject:  [pro_football] Hello!!Hola!!
Sender: [email-masked]

NORTHWEST ORCAS
P.O. BOX 21481
SEATTLE,WASHINGTON  98111 - 3481    USA
(206) 955 - 0186  / (253) 887 - 0135 
E-Mail: [email-masked] 
http://www.nworcas.com
______________________________________________________________________________
___

February  9 , 1999

To : NORTHWEST ORCAS FOOTBALL FANS 

Hello;

Thank you for writing to us here at NORTHWEST ORCAS FOOTBALL ORGANIZATION and
we are in proccess in getting the team ready for the first inagural season ,
which is to start in year 2000 when the NORTH AMERICAN FOOTBALL LEAGUE (NAFL)
starts it's inagural season as well.

We have a website and invite you to visit our website at :
http://www.nworcas.com 

We are still in need of completion of getting our investor group together in
which we are going to have to meet a little less than $2,000,000 in U.S.
DOLLARS in which will include complete operations costs and some towards the
perpetual fund account .

If you know of anyone who would like to become a part of this exciting
football program , please contact us via e-mail at : NWORCAS @msn.com   or
[email-masked]

Again , many thanks and look forward in hearing from you soon !

Sincerely Yours

Stan Carey
President / Head Coach
NORTHWEST ORCAS 

From: "manuel soto" <[email-masked]>
To: [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked]
Subject: Hello!!Hola!!
Date: Tue, 09 Feb 1999 17:00:41 PST
Sender: [email-masked]

http://dinero.cjb.net

http://salman.nu/dinero

______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com

Date: Sun, 07 Feb 1999 22:46:46 -0800
To: [email-masked]
From: Rodney Thayer <[email-masked]>
Subject: win32 open pgp implementations, for real?
Sender: [email-masked]

are there any non-NAI-based Win32 Open PGP implementations?
Many of the ones listed in the survey don't really work on
Win32 (win95/87/nt) platforms.

Date: Sun, 07 Feb 1999 18:48:11 -0800
To: [email-masked]
From: Rodney Thayer <[email-masked]>
Subject: LDAP and PGP?
Sender: [email-masked]

Is there a 'standard' way to represent PGP keys in LDAP?
Are there any OpenLDAP (or any other) public reference LDAP servers
out there?  I know NAI runs one, I'm interested in know if there
are others, to learn if there are multiple alternative schemes.

Date: Sat, 6 Feb 1999 08:43:40 +0100 (CET)
From: "Anthony E. Greene" <[email-masked]>
To: [email-masked]
Subject: Re: PGP - non-nonrepudiation
Sender: [email-masked]

On Fri, 5 Feb 1999, Carl Ellison wrote:
>What do you (or does anyone else) mean by non-repudiation?
>
>To me, it means that I can take you into a courtroom and prove, somehow, 
>that you signed the digitally signed message I hold in the floppy in my hand.
>
>That means that the mechanisms we have set up defeat all your attempts to 
>defend yourself against that accusation.  That is, you are unable to 
>repudiate the signature because of the mechanism we have established.
>
>Tell me how I can prove otherwise when you claim:
[snip]

You arguments apply as well to pen/ink signatures. What you're overlooking
is that in this context 'non-repudiation' refers to legal proof, not
logical proof. The references to enforcing a contract in court clearly set
the context of the discussion.

Even though it's possible for someone to forge a handwritten signature, if
it looks enough like yours, and you don't have some independent evidence
that you did not make the signature, you will be legally bound by it.

We have not established the case law yet to support digital signatures.
But when we do, the examples you gave will not hold up in court any more
than making an *unsupported* claim that you're not responsible for the
use of your ATM card. If the only evidence you have that it wasn't you is
your own word, it won't be sufficient in court.

-- 
 Anthony E. Greene <[email-masked]>
 Homepage & PGP Key <http://www.pobox.com/~agreene/>

Date: Fri, 05 Feb 1999 22:53:25 -0800
To: "Black Unicorn" <[email-masked]>
From: Carl Ellison <[email-masked]>
Subject: RE: PGP - non-nonrepudiation
Cc: "Carl Ellison" <[email-masked]>, "William H. Geiger III" <[email-masked]>, "Edwin Cremer" <[email-masked]>, <[email-masked]>
Sender: [email-masked]

-----BEGIN PGP SIGNED MESSAGE-----

At 10:54 PM 2/5/99 -0600, Black Unicorn wrote:
>
>"But the agreement you signed with the brokerage waives the brokerage's
>liability for transactions where your keys are used."
>

That's perfectly valid.  It's the signer relinquishing his right to 
repudiate, because of a normal contract he signed with the verifier of the 
signature.  What's enforced in court is the normal contract, not some 
fiction about non-repudiation as a side effect of using digital signatures.

>I concede that non-repudiation and its definition are issues but this is
>more than a bit defeatist.  The excuse that "non-repudiation is too
>non-defined for us to try and accommodate any functionality that approaches
>it" is just silly.

I'm quite happy with the contract approach you outlined.  It's just the 
silly talk we occasionally hear about digital signatures giving 
non-repudiation -- or some certificate from a properly blessed CA giving 
non-repudiation that I contest.  There are laws (e.g., Utah) that deprive 
you of the right to repudiate if you get a certificate from some CA they 
bless -- which is enough reason, in my mind, never to get a certificate from 
such a CA.  It was, after all, the Reg E right to repudiate credit card bill 
line items that made electronic commerce thrive.

>I could apply this approach to encryption.  "Why bother to encrypt?  I have
>no idea who's at the other end.  Anyone could be a man in the middle for my
>friend.  They could sniff it with a Trojan horse on his computer.  They
>could put a video camera in his ceiling and watch his screen, or his
>keyboard."  This is effectively the approach you are taking.

In fact, I use that argument too.  There is no such thing as a man in the 
middle attack if I'm communicating with someone I don't know already.  If I 
have made contact with a stranger and some man in the middle is there, then 
I'm still communicating directly and privately with a stranger: the man in 
the middle.  I have no reason to prefer him over the other stranger, given
that I don't already have a relationship with either of them.  One might 
argue that the MITM is dishonest while the other bloke is honest, but I defy 
someone to create a protocol that tests for honesty.

>My point is that the brokerage does not now have the tools to even provide
>evidence of the signature in the first place, which- in fact- makes use of
>the signature pointless as it provides not even the slightest advance in
>non-repudiation.  Might as well just keep taking passwords or use
>handwriting analysis.

Don't run down handwriting too much.  The handwritten signature is, after 
all, a biometric.

>If you want this software to be utilized in places where it counts, which is
>of course why we are in this game, or should be, then you have to improve
>the product/protocol, not try to explain why functionality that is
>needed/useful doesn't exist.

Of course.

>Mr. Geiger points out that this functionality, or lack thereof, is not a
>consequence of the OpenPGP data structure itself.  Insofar as that is so
>this discussion is probably out of place anyhow.

Probably.

 - Carl

+------------------------------------------------------------------+
|Carl M. Ellison         [email-masked]     http://www.pobox.com/~cme |
|    PGP: 08FF BA05 599B 49D2  23C6 6FFD 36BA D342                 |
+--Officer, officer, arrest that man. He's whistling a dirty song.-+

From: "Black Unicorn" <[email-masked]>
To: "Carl Ellison" <[email-masked]>
Cc: "William H. Geiger III" <[email-masked]>, "Edwin Cremer" <[email-masked]>, <[email-masked]>
Subject: RE: PGP - non-nonrepudiation
Date: Fri, 5 Feb 1999 22:54:43 -0600
Keywords: direct
Importance: Normal
Sender: [email-masked]

> -----Original Message-----
> From: Carl Ellison [mailto:[email-masked]]
>
> At 06:02 PM 2/5/99 -0600, Black Unicorn wrote:
> >Not a bad idea, maybe, if there were no requirement for
> non-repudiation by
> >the receiving party.  (And if there isn't, then what's the point of this
> >solution?)
>
> Sorry, but you hit one of my buttons.
>
> What do you (or does anyone else) mean by non-repudiation?

I avoided getting into picking one of the 20 kinds of non-repudiation
because non-repudiation is a process, not an event.

It's moot anyhow as I quite directly defined what I was looking for.
Specifically:

"Take the example of a brokerage which needs to incontrovertibly prove a
client (or a client's key) ordered a given transaction."

> To me, it means that I can take you into a courtroom and prove, somehow,
> that you signed the digitally signed message I hold in the floppy
> in my hand.

To digress:

In your context that can't be proven even if you have witnesses to the act
and a tape recording.  (Witnesses are notoriously unreliable.  The tape was
out of context, or has been modified).

There are always arguments against certain facts.  If "truth" was really
accessible we wouldn't need the judicial process.  The point is to give one
enough evidence to be persuasive of the truth, not to establish it.

> That means that the mechanisms we have set up defeat all your attempts to
> defend yourself against that accusation.  That is, you are unable to
> repudiate the signature because of the mechanism we have established.
>
> Tell me how I can prove otherwise when you claim:
>
> 1.	my private key was on my computer, but I didn't sign that
> message. I
> never saw that message.  It is quite possible that someone else found my
> computer logged in while I was in the bathroom and signed that
> message with
> my computer.  Therefore, you need to track down and bring in that
> other person.

"But the agreement you signed with the brokerage waives the brokerage's
liability for transactions where your keys are used."

This is, in fact, being done today with e.g., passwords and faxes.
Historically this kind of risk allocation has been done with checks as well.
If the signature is actually forged and the bank still cashes the check,
they are liable.  If it is not forged (the client put it on a blank check
which was then lost) then the client eats it.  I think this is unacceptable.

This is impossible to do given the lack of functionality I have pointed out.

"But you seem to have failed to follow the brokerage's password policy,
which absolves the brokerage of liability."  (Like leaving your keys in the
car).

Can't even get to this point if you can't establish that the signature was
at least made from the client's key.

> 2.	I was at my computer when that message was allegedly
> signed, but I never
> saw it and never signed it.  I did try to sign some other message -- even
> put my thumb to the thumbprint reader to release the signing key
> -- but that
> signature attempt failed, so I had to do it again.  There could
> have been a
> virus on my machine that used my unlocking of the private key to sign the
> message in question.

"But the agreement you signed with the brokerage waives the brokerage's
liability for transactions where your keys are used."

> etc.

Yes, etc.

> 	--------------------------------------------------
>
> This is just the start of possible defenses.  After I made a list
> of them a
> little longer than this, I came to the simplifying conclusion
> that we should
> never use the term "non-repudiation" and should, in fact,
> strongly reprimand
> anyone who tries to.

I concede that non-repudiation and its definition are issues but this is
more than a bit defeatist.  The excuse that "non-repudiation is too
non-defined for us to try and accommodate any functionality that approaches
it" is just silly.

I could apply this approach to encryption.  "Why bother to encrypt?  I have
no idea who's at the other end.  Anyone could be a man in the middle for my
friend.  They could sniff it with a Trojan horse on his computer.  They
could put a video camera in his ceiling and watch his screen, or his
keyboard."  This is effectively the approach you are taking.

My point is that the brokerage does not now have the tools to even provide
evidence of the signature in the first place, which- in fact- makes use of
the signature pointless as it provides not even the slightest advance in
non-repudiation.  Might as well just keep taking passwords or use
handwriting analysis.

If you want this software to be utilized in places where it counts, which is
of course why we are in this game, or should be, then you have to improve
the product/protocol, not try to explain why functionality that is
needed/useful doesn't exist.

>  - Carl

Mr. Geiger points out that this functionality, or lack thereof, is not a
consequence of the OpenPGP data structure itself.  Insofar as that is so
this discussion is probably out of place anyhow.

Date: Fri, 05 Feb 1999 20:20:10 -0800
To: "Black Unicorn" <[email-masked]>
From: Carl Ellison <[email-masked]>
Subject: Re: PGP - non-nonrepudiation
Cc: "William H. Geiger III" <[email-masked]>, "Edwin Cremer" <[email-masked]>, <[email-masked]>
Sender: [email-masked]

-----BEGIN PGP SIGNED MESSAGE-----

At 06:02 PM 2/5/99 -0600, Black Unicorn wrote:
>Not a bad idea, maybe, if there were no requirement for non-repudiation by
>the receiving party.  (And if there isn't, then what's the point of this
>solution?)  

Sorry, but you hit one of my buttons.

What do you (or does anyone else) mean by non-repudiation?

To me, it means that I can take you into a courtroom and prove, somehow, 
that you signed the digitally signed message I hold in the floppy in my hand.

That means that the mechanisms we have set up defeat all your attempts to 
defend yourself against that accusation.  That is, you are unable to 
repudiate the signature because of the mechanism we have established.

Tell me how I can prove otherwise when you claim:

1.	my private key was on my computer, but I didn't sign that message.  I 
never saw that message.  It is quite possible that someone else found my 
computer logged in while I was in the bathroom and signed that message with 
my computer.  Therefore, you need to track down and bring in that other person.

2.	I was at my computer when that message was allegedly signed, but I never 
saw it and never signed it.  I did try to sign some other message -- even 
put my thumb to the thumbprint reader to release the signing key -- but that 
signature attempt failed, so I had to do it again.  There could have been a 
virus on my machine that used my unlocking of the private key to sign the 
message in question.

etc.

	--------------------------------------------------

This is just the start of possible defenses.  After I made a list of them a 
little longer than this, I came to the simplifying conclusion that we should 
never use the term "non-repudiation" and should, in fact, strongly reprimand 
anyone who tries to.

 - Carl

+------------------------------------------------------------------+
|Carl M. Ellison         [email-masked]     http://www.pobox.com/~cme |
|    PGP: 08FF BA05 599B 49D2  23C6 6FFD 36BA D342                 |
+--Officer, officer, arrest that man. He's whistling a dirty song.-+

Date: Sat, 6 Feb 1999 03:34:42 +0100 (CET)
From: "Anthony E. Greene" <[email-masked]>
To: "OpenPGP List" <[email-masked]>
Subject: Re: PGP - non-nonrepudiation
Sender: [email-masked]

On Fri, 5 Feb 1999, Black Unicorn wrote:
>Not a bad idea, maybe, if there were no requirement for non-repudiation by
>the receiving party.  (And if there isn't, then what's the point of this
>solution?)  Falling back on a solution which requires a trusted server which
>is still operated by the party which may later wish to present self serving
>evidence to support itself in a suit is just a mistake.
>
>Take the example of a brokerage which needs to incontrovertibly prove a
>client (or a client's key) ordered a given transaction.  How will the above
>help?  Clearly, it won't.  The bottom line is that in the mad rush to
>implement "one pass" functionality PGP dropped the ball by killing this very
>important functionality.
>
>An enterprise cannot now archive mail which can later be searched by keyword
>in the message body and still be verifiable ex post with respect to origin
>and message integrity.

They could archive both the original message and the processed copy then
tie the two together using the SMTP Message-Id or a locally generated
substitute.

-- 
 Anthony E. Greene <[email-masked]>
 Homepage & PGP Key <http://www.pobox.com/~agreene/>

Date: Fri, 5 Feb 1999 16:46:04 -0800
From: [email-masked]
To: [email-masked]
Subject: Re: PGP - non-nonrepudiation
Cc: [email-masked]
Sender: [email-masked]

Black Unicorn writes:

> Take the example of a brokerage which needs to incontrovertibly prove a
> client (or a client's key) ordered a given transaction.  How will the above
> help?  Clearly, it won't.  The bottom line is that in the mad rush to
> implement "one pass" functionality PGP dropped the ball by killing this very
> important functionality.
> 
> An enterprise cannot now archive mail which can later be searched by keyword
> in the message body and still be verifiable ex post with respect to origin
> and message integrity.
> 
> Big mistake.
> 
> I wonder (doubt) if it will ever be fixed.

As far as I can see, the OpenPGP data structures are entirely adequate for
this application.  If there are deficiencies in the OpenPGP specification
necessary for this functionality then we can discuss them.  High level
product functionality is not really relevant to this forum.

Hal Finney
NAI, Inc.

From: "Black Unicorn" <[email-masked]>
To: "William H. Geiger III" <[email-masked]>, "Edwin Cremer" <[email-masked]>
Cc: <[email-masked]>
Subject: PGP - non-nonrepudiation
Date: Fri, 5 Feb 1999 18:02:27 -0600
Keywords: openpgp
Importance: Normal
Sender: [email-masked]

William H. Geiger III:
>
> In <[email-masked]>, on 01/27/99
>    at 09:40 PM, Edwin Cremer <[email-masked]> said:
>
> >I have the same problem :-(
>
> >my solution is:
> >the server check the signatur and decrypt the message.
> >if both ok the server write a new footer with the output of the
> >signcheck and then sign and encrypt the new message. if you have a
> >trusted server, the sigcheck is trust ;-) and the members of the list
> >don't need all the key's of all other members. it work's fine with
> >(nearly) all of pgp version.
>
> Not a bad idea. :)

Not a bad idea, maybe, if there were no requirement for non-repudiation by
the receiving party.  (And if there isn't, then what's the point of this
solution?)  Falling back on a solution which requires a trusted server which
is still operated by the party which may later wish to present self serving
evidence to support itself in a suit is just a mistake.

Take the example of a brokerage which needs to incontrovertibly prove a
client (or a client's key) ordered a given transaction.  How will the above
help?  Clearly, it won't.  The bottom line is that in the mad rush to
implement "one pass" functionality PGP dropped the ball by killing this very
important functionality.

An enterprise cannot now archive mail which can later be searched by keyword
in the message body and still be verifiable ex post with respect to origin
and message integrity.

Big mistake.

I wonder (doubt) if it will ever be fixed.

> I have proposed something similar to this for corporate mail servers where
> incoming signed mail is verified at the server and stamped before it is
> forwarded to the end-users mailbox. This way the end user is relieved from
> the work involved in obtaining & verifying keys for incoming mail (this
> job would be off-loaded to the resident company crypto zar).
>
> As an added step outbound messages can be auto-encrypted by the server
> thus eliminating most of the public key management from the end user (the
> end user doesn't even need PGP on his workstation execpt for signing &
> decrypting).

From: "William H. Geiger III" <[email-masked]>
Date: Fri, 05 Feb 1999 17:11:24 -0500
To: Edwin Cremer <[email-masked]>
Cc: [email-masked]
Subject: Re: Secure mailing list service using OpenPGP
Sender: [email-masked]

In <[email-masked]>, on 01/27/99 
   at 09:40 PM, Edwin Cremer <[email-masked]> said:

>I have the same problem :-(

>my solution is:
>the server check the signatur and decrypt the message.
>if both ok the server write a new footer with the output of the 
>signcheck and then sign and encrypt the new message. if you have a
>trusted server, the sigcheck is trust ;-) and the members of the list
>don't need all the key's of all other members. it work's fine with
>(nearly) all of pgp version.

Not a bad idea. :)

I have proposed something similar to this for corporate mail servers where
incoming signed mail is verified at the server and stamped before it is
forwarded to the end-users mailbox. This way the end user is relieved from
the work involved in obtaining & verifying keys for incoming mail (this
job would be off-loaded to the resident company crypto zar).

As an added step outbound messages can be auto-encrypted by the server
thus eliminating most of the public key management from the end user (the
end user doesn't even need PGP on his workstation execpt for signing &
decrypting).

I also have been using in my PGP E-Mail implemntaions of doing the PGP
processing as the messages are downloaded by the mail client (decryption &
sig verification) with the results being appended to the bottom of the
messages. Below is an example:

from 100.100.100.1 by whgiii (IBM OS/2 SENDMAIL VERSION 2.03/2.0) id
RAA024.81; Fri, 5 Feb 1999 17:28:03 -0500 Message-Id:
<199902052228.RAA024.81@whgiii> From: "William H. Geiger III"
<[email-masked]> Date: Fri, 05 Feb 1999 17:27:30 -0500
Subject: sigh
X-AutoCrypt: This Message AutoEncrypted With E-Secure v1.1b1
X-Distribution: [email-masked]
To: [email-masked]
X-Mailer: MR/2 Internet Cruiser Edition for OS/2 v1.52 b52 
Status:   

sigh!!

- -- 
- ---------------------------------------------------------------
William H. Geiger III  http://www.openpgp.net
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 5.0 at: http://www.openpgp.net/pgp.html
Talk About PGP on IRC EFNet Channel: #pgp Nick: whgiii
- ---------------------------------------------------------------
 
Tag-O-Matic: Rumour: NT means Not Tested

--------------------------------------------------------------------
MR/2 PGP Decryption  5 Feb 1999 17:35:01
--------------------------------------------------------------------

Opening file "NUL" type text.
Message is encrypted.
Opening file "WHGIII\36BB7213" type text.
Opening file "NUL" type text.

--------------------------------------------------------------------
MR/2 PGP Signature Check  5 Feb 1999 17:35:01
--------------------------------------------------------------------

Opening file "NUL" type text.
Opening file "WHGIII\36BB7213" type binary.
Good signature made 1999-02-05 21:27 GMT by key:
  1024 bits, Key ID A035CA9B, Created 1998-01-23
   "William H. Geiger III <[email-masked]>"
   "William H. Geiger III <[email-masked]>"
Opening file "NUL" type text.

-- 
---------------------------------------------------------------
William H. Geiger III  http://www.openpgp.net
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 5.0 at: http://www.openpgp.net/pgp.html
Talk About PGP on IRC EFNet Channel: #pgp Nick: whgiii
---------------------------------------------------------------
 
Tag-O-Matic: I use OS/2 2.0 and I don't care who knows!
 
Tag-O-Matic: Windows: The CP/M of the future!

From: "William H. Geiger III" <[email-masked]>
Date: Fri, 05 Feb 1999 17:11:24 -0500
To: Edwin Cremer <[email-masked]>
Cc: [email-masked]
Subject: Re: Secure mailing list service using OpenPGP
Sender: [email-masked]

In <[email-masked]>, on 01/27/99 
   at 09:40 PM, Edwin Cremer <[email-masked]> said:

>I have the same problem :-(

>my solution is:
>the server check the signatur and decrypt the message.
>if both ok the server write a new footer with the output of the 
>signcheck and then sign and encrypt the new message. if you have a
>trusted server, the sigcheck is trust ;-) and the members of the list
>don't need all the key's of all other members. it work's fine with
>(nearly) all of pgp version.

Not a bad idea. :)

I have proposed something similar to this for corporate mail servers where
incoming signed mail is verified at the server and stamped before it is
forwarded to the end-users mailbox. This way the end user is relieved from
the work involved in obtaining & verifying keys for incoming mail (this
job would be off-loaded to the resident company crypto zar).

As an added step outbound messages can be auto-encrypted by the server
thus eliminating most of the public key management from the end user (the
end user doesn't even need PGP on his workstation execpt for signing &
decrypting).

I also have been using in my PGP E-Mail implemntaions of doing the PGP
processing as the messages are downloaded by the mail client (decryption &
sig verification) with the results being appended to the bottom of the
messages. Below is an example:

from 100.100.100.1 by whgiii (IBM OS/2 SENDMAIL VERSION 2.03/2.0) id
RAA024.81; Fri, 5 Feb 1999 17:28:03 -0500 Message-Id:
<199902052228.RAA024.81@whgiii> From: "William H. Geiger III"
<[email-masked]> Date: Fri, 05 Feb 1999 17:27:30 -0500
Subject: sigh
X-AutoCrypt: This Message AutoEncrypted With E-Secure v1.1b1
X-Distribution: [email-masked]
To: [email-masked]
X-Mailer: MR/2 Internet Cruiser Edition for OS/2 v1.52 b52 
Status:   

sigh!!

- -- 
- ---------------------------------------------------------------
William H. Geiger III  http://www.openpgp.net
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 5.0 at: http://www.openpgp.net/pgp.html
Talk About PGP on IRC EFNet Channel: #pgp Nick: whgiii
- ---------------------------------------------------------------
 
Tag-O-Matic: Rumour: NT means Not Tested

--------------------------------------------------------------------
MR/2 PGP Decryption  5 Feb 1999 17:35:01
--------------------------------------------------------------------

Opening file "NUL" type text.
Message is encrypted.
Opening file "WHGIII\36BB7213" type text.
Opening file "NUL" type text.

--------------------------------------------------------------------
MR/2 PGP Signature Check  5 Feb 1999 17:35:01
--------------------------------------------------------------------

Opening file "NUL" type text.
Opening file "WHGIII\36BB7213" type binary.
Good signature made 1999-02-05 21:27 GMT by key:
  1024 bits, Key ID A035CA9B, Created 1998-01-23
   "William H. Geiger III <[email-masked]>"
   "William H. Geiger III <[email-masked]>"
Opening file "NUL" type text.

-- 
---------------------------------------------------------------
William H. Geiger III  http://www.openpgp.net
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 5.0 at: http://www.openpgp.net/pgp.html
Talk About PGP on IRC EFNet Channel: #pgp Nick: whgiii
---------------------------------------------------------------
 
Tag-O-Matic: I use OS/2 2.0 and I don't care who knows!

From: "William H. Geiger III" <[email-masked]>
Date: Fri, 05 Feb 1999 17:07:29 -0500
To: "Masahiro Morita" <[email-masked]>
Cc: <[email-masked]>
Subject: RE: Secure mailing list service using OpenPGP
Sender: [email-masked]

In <[email-masked]>, on 01/28/99 
   at 03:00 PM, "Masahiro Morita" <[email-masked]> said:

>In S/MIME, an I-Draft, "Enhanced Security Services for S/MIME" describes
>secure mailing list services and defines the standerd process of mailing
>list agents. We need the definitions like it for OpenPGP, don't we?
>--hiro

I don't think that we need it in the OpenPGP RFC but it would make a good
secondary document.

-- 
---------------------------------------------------------------
William H. Geiger III  http://www.openpgp.net
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 5.0 at: http://www.openpgp.net/pgp.html
Talk About PGP on IRC EFNet Channel: #pgp Nick: whgiii
---------------------------------------------------------------

From: [email-masked]
Date: Wed, 3 Feb 1999 10:44:32 -0500
Subject: Call for Papers: Fourth ACM Workshop on Role-based Access Control
Sender: [email-masked]

CALL FOR PAPERS
Fourth ACM WORKSHOP ON ROLE-BASED ACCESS CONTROL
Date: Oct. 28-29, 1999
Place: George Mason University
url: www.list.gmu.edu/rbac

Sponsored By: ACM Sigsac
Hosted By: George Mason University

The essence of Role-Based Access Control (RBAC) is that permissions
are assigned to roles rather than to individual users.  Users acquire
these permissions by virtue of being authorized to act in these roles.
The driving motivation for RBAC is to simplify security policy
administration while facilitating the definition of flexible,
customized policies.  Basic RBAC models have been successfully applied
since the mainframe era, but emerging systems, which have greater
numbers of users, roles, and systems, challenge the expressive power
of these traditional models.

Workshop Scope:

The ACM workshops on RBAC bring together researchers, developers, and
practitioners to discuss the application of RBAC to both traditional
and emerging systems and the development of new access control
paradigms for future applications.  The workshop invites participation from
the database, network, distributed systems, operating systems, security and
application communities.  Contributions reporting experiences with the
implementation and use of RBAC systems are strongly encouraged.
Attendance is limited to 40 participants to foster a workshop atmosphere.

Topics of interest include, but are not restricted to:

- Modeling and specification of RBAC systems
- Administration of RBAC systems
- RBAC in database security
- Specification and enforcement of security policy
- Delegation and inheritance of access rights in RBAC systems
- Task-based access control and RBAC in collaborative environments
- Application Areas e.g., health-care, WWW
- Support for RBAC in traditional access control systems
- RBAC and organizational control principles
- Experiences with RBAC-based systems; case studies
- Enabling technologies: Java, LDAP, intra-net environments
- Implementation, integration and scalability of RBAC
- End-user tools to support RBAC administration and engineering

Submissions:

Users, developers and researchers are invited to submit seven copies
of their papers (in English and limited to 6000 words) to the Program
Chair at the coordinates given below before the due date.  Submissions can
be either hard copy or electronic (postscript preferred). Papers must be
original and should not be under consideration for publication
elsewhere.  Copyrights for accepted papers must be transferable to ACM
(except for Government work).  Papers will be published by ACM in a
proceedings to be distributed at the workshop and mailed to all SIGSAC
members.  Outstanding papers will be considered for publication in ACM's
new Transactions on Information and Systems Security (TISSEC).

Proposals for panels and group discussions should be sent, preferably
by email, to the Panels Chair at [email-masked].

Paper Submissions should be sent to:
Sylvia Osborn, Program Committee Chair,
Dept. of Computer Science,
The University of Western Ontario,
MC355,
London, Ontario, Canada, N6A 5B7
email: [email-masked]

SCHEDULE:
Papers and Panel Proposals Due: May 15, 1999
Notification of acceptance and advance program: June 30, 1999
Deadline for final version of papers: July 31, 1999
Workshop: October 28-29, 1999

CONFERENCE STEERING COMMITTEE:
Ed Coyne, Science Applications International Corporation
David Ferraiolo, National Institute of Standards and Technology
Trent Jaeger, IBM T.J. Watson Research Center
Sylvia Osborn, The University of Western Ontario
Ravi Sandhu, George Mason University
Charles Youman, Blue Cross Blue Shield

General Conference Chair: Charles Youman, Blue Cross Blue Shield
Local Arrangements: Srinivas Ganta, CygnaCom Solutions Inc.
Program Committee Chair: Sylvia Osborn, The University of Western Ontario
Panels Chair: David Ferraiolo, National Institute of Standards and
Technology
Proceedings Chair: Vijay Atluri, Rutgers University
Publicity Chair: Trent Jaeger, IBM T.J. Watson Research Center

PROGRAM COMMITTEE:

Vijay Atluri, Rutgers University
Dave Ferraiolo, National Institute of Standards and Technology
Luigi Giuri,  Fondazione Ugo Bordoni
Trent Jaeger, IBM T.J. Watson Research Center
Carl Landwehr, U.S. Naval Research Laboratory
Emil Lupu, Imperial College
Ravi Sandhu, George Mason University
Richard Simon
Roshan Thomas, TIS Labs at Network Associates
Dan Thomsen, Secure Computing Corp.
Dan Wallach, Rice University

REGISTRATION:
Information on registration and accommodations will be provided.
There will be a registration fee for all participants to cover meeting
costs.

Date: Tue, 2 Feb 1999 06:57:31 +0100
From: Werner Koch <[email-masked]>
To: Jon Callas <[email-masked]>
Cc: Max Inux <[email-masked]>, [email-masked], [email-masked]
Subject: Re: Id 10 for Twofish
Mail-Followup-To: Jon Callas <[email-masked]>, Max Inux <[email-masked]>, [email-masked], [email-masked]
Sender: [email-masked]

Jon Callas <[email-masked]> writes:

>    I believe our conjecture was 
>    id: 10, keysize: 256
>    
> My belief concurs with Max.

Okay.

   Werner

Date: Mon, 01 Feb 1999 17:15:58 -0800
To: Max Inux <[email-masked]>, Werner Koch <[email-masked]>
From: Jon Callas <[email-masked]>
Subject: Re: Id 10 for Twofish
Cc: [email-masked], [email-masked]
Sender: [email-masked]

At 03:50 PM 1/29/99 -0800, Max Inux wrote:
   On Fri, 29 Jan 1999, Werner Koch wrote:
   > 1) Did we agree on using the algorithm id 10 for Twofish?  And
   >    can I create preference lists with 10 in it.
   >
   > 2) What is the conclusion about the keysize: 128, 196 or 256 bit.
   
   I believe our conjecture was 
   id: 10, keysize: 256
   
My belief concurs with Max.

	Jon

-----
Jon Callas                                  [email-masked]
CTO, Total Network Security                 3965 Freedom Circle
Network Associates, Inc.                    Santa Clara, CA 95054
(408) 346-5860                              
Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS)
              665B 797F 37D1 C240 53AC 6D87 3A60 4628           (RSA)