209 lines
8.4 KiB
Plaintext
209 lines
8.4 KiB
Plaintext
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
|
|
NoiseNet Privacy Echo
|
|
Frequently-Asked Questions
|
|
16 March 1994
|
|
'Copyleft' Rob Szarka (1:320/42)
|
|
mrnoise@econs.umass.edu
|
|
|
|
|
|
1. Why this FAQ?
|
|
|
|
While more than one excelent privacy-related FAQ is available on the
|
|
Internet, this FAQ is intended to be posted to the NoiseNet Privacy
|
|
Echo, Fidonet Public Keys Echo, & other appropriate amateur networks.
|
|
I will attempt to keep it a good deal shorter than the comparable
|
|
Internet versions to preserve bandwidth & allow frequent posting,
|
|
while providing information of particular concern to BBS users.
|
|
|
|
Please send pertinent information to me at the addresses above, or
|
|
search your nodelist for 'Szarka' or 'Mr. Noise'. I can also be reached
|
|
in NOISE_PRIVACY, PUBLIC_KEYS, or on my BBS at +1-203-886-1441. This
|
|
document is CopyLeft 1993 by Robert Szarka. Unattributed quotations
|
|
throughout are from the PGP documentation by Phil Zimmerman.
|
|
|
|
The latest copy of this FAQ is available for FREQ at 1:320/42 as PFAQ.
|
|
|
|
The following people have contributed to this FAQ (directly or
|
|
unknowingly by posting useful information):
|
|
|
|
christopher.baker@f14.n374.z1.fidonet.org
|
|
rudy.crespin@f101.n265.z1.fidonet.org
|
|
dt194@kanga.ins.cwru.edu (Kevin Lo)
|
|
|
|
Also, a big 'thank you' to the sysops who have volunteered to be listed
|
|
as sources for PGP below.
|
|
|
|
|
|
2. What is PGP? What is public-key cryptography?
|
|
|
|
PGP (Pretty Good Privacy) is a free public-key cryptography program
|
|
written by Phil Zimmerman. To use such a program, you must first
|
|
generate a 'key pair', consisting of a 'public key' & 'secret key'.
|
|
You then distribute the public key, which allows others to encrypt a
|
|
message so that it can be decoded only with your secret key; the secret
|
|
key, & the passphrase that you use with it, must be kept secure. The
|
|
PGP documentation gives an excellent discussion of the subject, & it is
|
|
recommend reading even if you're just interested & never intend to use
|
|
the program.
|
|
|
|
|
|
3. Is PGP illegal? What is ViaCrypt PGP?
|
|
|
|
There are two issues here: export controls & patent infringement.
|
|
|
|
Technically, it is illegal to export the executable versions of PGP from
|
|
the United States. The government takes the view that cryptography has
|
|
military applications, & is thus a 'munition'. Never mind that the most
|
|
recent versions of PGP originated in Europe & were *imported* to the
|
|
U.S.; our government has never been what you could call open-minded
|
|
about things like this. People are working to change this situation, &
|
|
you should certainly contact your Congresscritters to support their
|
|
efforts. Source code is a murkier matter. It ought to be exportable
|
|
under the technical data exception to the law, but the government is
|
|
currently investigating (i.e., harrassing) folks for doing so.
|
|
|
|
Public Key Partners also contends that PGP violates their patent on the
|
|
RSA algorithmn used as part of PGP (the text is encrypted using IDEA, but
|
|
the IDEA key is then encrypted using RSA). (Note that the U.S. is the
|
|
only country that allows patents on algorithms, so PGP is still legal is
|
|
the rest of the world!) Zimmerman, & others, tried to obtain a license
|
|
for PGP, but to no avail.
|
|
|
|
In November, ViaCrypt (+1-602-944-1543) released a commercial version of
|
|
PGP (at an introductory price of $100) under their license with Public
|
|
Key Partners. ViaCrypt PGP is compatible with PGP & solves the legal
|
|
questions for businesses & others that don't want to chance violating
|
|
the law. (Note that government employees can use the RSA algorithim for
|
|
official business anyway, as it was developed with tax dollars.)
|
|
|
|
|
|
4. Where do I get PGP? Is it available for (insert your OS here)?
|
|
|
|
Many sysops make PGP available for FREQ using the following magic names:
|
|
|
|
PGPFILES PGP/privacy/encryption filelist.
|
|
PGP Current version of MSDOS PGP executables and docs.
|
|
PGPSRC Current version of PGP source files.
|
|
PGPALL Both MS-DOS executables and source.
|
|
PGPAMIGA Amiga version of PGP.
|
|
PGPATARI Atari version of PGP.
|
|
PGPMAC Macintosh version of PGP.
|
|
PGPOS2 OS/2 version of PGP.
|
|
|
|
On Fido, the following sites have PGP available for FREQ (sites with an
|
|
asterix also have it available for download on the first call):
|
|
|
|
SOURCE CODE: 1:320/42; *1:102/903; 1:106/1776; 1:352/333; *1:273/937
|
|
MS-DOS EXECUTABLES: *1:102/903; *1:106/1776; 1:3607/25; 1:352/333;
|
|
*1:273/937; *1:3807/110
|
|
OS/2 EXECUTABLES: 1:352/333; *1:3807/110
|
|
MAC EXECUTABLES: *1:3807/110; *1:106/1776
|
|
AMIGA EXECUTABLES: 1:352/333; 1:374/14; *1:106/1776
|
|
ATARI EXECUTABLES: *1:3807/110; *1:106/1776
|
|
|
|
On Internet, the best place to start is the cypherpunks FTP site at
|
|
soda.berkeley.edu.
|
|
|
|
|
|
5. Where do I get public keys?
|
|
|
|
Those on Fidonet should pick up the PKEY_DROP echo, intended for the
|
|
posting of public keys. In addition, many sysops make public keys
|
|
available via FREQ using the following magic names:
|
|
|
|
PGPKEY The sysop's PGP public key. (Make the filename
|
|
distinctive with your node number or name.)
|
|
KEYRING Complete public keyring. (Make the filename
|
|
similarly distinctive.)
|
|
PEMKEY PEM public-key
|
|
PEMRING PEM public-keyring
|
|
|
|
You may FREQ KEYRING from 1:320/42 for a large collection of public
|
|
keys, including many from the Internet key servers. Those with HST may
|
|
wish to FREQ INETKRNG.ARJ from 1:376/74 or 1:376/76 for a complete
|
|
Internet keyring current to December 1993.
|
|
|
|
Several keyservers are available via Internet, including the following:
|
|
|
|
pgp-public-keys@demon.co.uk
|
|
pgp-public-keys@sw.oz.au
|
|
pgp-public-keys@dsi.unimi.it
|
|
pgp-public-keys@kiae.su
|
|
pgp-public-keys@fbihh.informatik.uni-hamburg.de
|
|
pgp-public-keys@pgp.ox.ac.uk
|
|
public-key-server@martigney.ai.mit.edu
|
|
|
|
If you don't know how to use a key server, send email to a server with
|
|
the subject 'HELP'.
|
|
|
|
|
|
6. How do I clearsign a message with PGP?
|
|
|
|
Remember that *second* doc file? ;-) Here's the relevant portion of
|
|
the docs:
|
|
|
|
To enable this feature, set CLEARSIG=ON, and set ARMOR=ON (or use
|
|
the -a option), and set TEXTMODE=ON (or use the -t option). For
|
|
example, you can set CLEARSIG directly from the command line:
|
|
|
|
pgp -sta +clearsig=on message.txt
|
|
|
|
|
|
7. I want to put my public key ring up for freq, but I don't want my
|
|
trust parameters available to anyone else. What's the easiest way to
|
|
extract all the keys on my keyring?
|
|
|
|
There is an undocumented feature in PGP for doing a wholesale
|
|
extraction using the * parameter:
|
|
|
|
pgp -kxa * publicringfilename
|
|
|
|
will extract all the keys you've collected to an ASCII output file. Such
|
|
output does not contain anything but keys and signatures. (Remember: a
|
|
large file like this may get split into chunks if ArmorLines is
|
|
different from zero in your config.) Leave the -a off, of course, if
|
|
you don't want ASCII encoding.
|
|
|
|
|
|
8. How do I view the 'fingerprint' of a public key?
|
|
|
|
Again, from volume 1 of the PGP documentation:
|
|
|
|
To view the "fingerprint" of a public key, to help verify it over
|
|
the telephone with its owner:
|
|
pgp -kvc [userid] [keyring]
|
|
|
|
|
|
9. How can I help the cause?
|
|
|
|
Phil Zimmerman has not yet been sued or charged with a crime, but
|
|
there's no telling what will happen tommorrow--sooner or later this
|
|
thing has got to come to a head. The Electronic Frontier Foundation has
|
|
already stepped forward to provide moral & financial support, and you can
|
|
do your part by mailing a contribution to Zimmerman's lawyer for his
|
|
defense:
|
|
|
|
Philip Dubois, Esq.
|
|
2305 Broadway
|
|
Boulder, CO 80304
|
|
+1-303-444-3885
|
|
|
|
Zimmerman, & the others who have stepped forward to help with PGP's
|
|
development over the years, have done us a great service. They deserve
|
|
our support. One idea that I'm trying here at Sea of Noise is to
|
|
earmark 10% of contributions to the BBS for Zimmerman's defense; I hope
|
|
other sysops will join me.
|
|
|
|
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: 2.3a
|
|
|
|
iQCVAgUBLYa66VMuzCoJtKg7AQHe4QQAl6cY2r0QlihwT4UyfE9ZUlfzNXzHaDls
|
|
XQ6cuJlsUIAWhkgRmjcrKGsIp/XVlmkz2MqoO5q+uD9Pm5oRNWKpnmfd86PzutKp
|
|
Cj7E17uvYdLfqsAV6qF7peNccs4UcHvZOMwJ7uEpPO4GFSD/RxKNO1dBp0K+/SjP
|
|
CQjSKWqC/Y4=
|
|
=DjR8
|
|
-----END PGP SIGNATURE-----
|