Phil Zimmermann

Wait, where's the hyphen in Crockford Base32? https://en.wikipedia.org/wiki/Base32#Crockford's_Base32 My favorite base-32 encoding is z-base-32, which I find just gentler on the eyes: https://philzimmermann.com/docs/human-oriented-base-32-encoding.txt The biggest problems with base58 are 1) it works for integers, less so for arbitrary binary data like crypto keys 2) case-sensitivity ISnOtNIcEtOLoOKaT (in my opinion).

True. But pretty good privacy might be worth considering in this context - it was at one point published as a book after all... https://philzimmermann.com/EN/essays/BookPreface.html

In one sense, the anti-crypto forces are not yet being as crazy as they have been at certain times in the past. People often forget that the federal government wanted to put Phil Zimmerman in prison over PGP in the nineties. [1] In another sense, this is much crazier. There wasn't much at stake commercially in the nineties, but today, legislatively screwing up crypto could compromise trillions of dollars worth of commercial transactions if something goes wrong. https://philzimmermann.com/EN/news/PRZ_case_dropped.html

Microsoft product keys were base-24 with the following alphabet: > B C D F G H J K M P Q R T V W X Y 2 3 4 6 7 8 9 they were 115 bits encoded in 24 characters see also human-oriented base32 encoding: https://philzimmermann.com/docs/human-oriented-base-32-encoding.txt which includes this nice trick: > We have permuted the alphabet to make the more commonly occuring characters also be those that we think are easier to read, write, speak, and remember. edit: to add, an interesting human-readable and memorable base52 alphabet that I've never found a use for is to use playing cards

This point bears repeating every so often: cryptography is difficult, and those of us who haven't spent years in its mathematical bowels are not qualified to create usable algorithms. Meaning: the encryption code you wrote yourself is probably hackable. Easily hackable. I first encountered this in a classic essay by PGP's Phil Zimmerman: http://www.philzimmermann.com/EN/essays/SnakeOil.html edit: fix incorrect link

> Web code written in any language without a well-integrated string data type. strcpy() is a target painted on my back if I did that. Writing a URI parser in C which extracts hostname, port, and path is about the upper limit of what I want to do there. I've done it, it works, I learned about strstr(3) in the process, and I don't want to do it again. http://man7.org/linux/man-pages/man3/strstr.3.html > Anybody who claims they've got amazing new data- or media= compression technology and wants funding for it. Encryption is probably worse for snakeoil, but I like reading about crypto snake oil. Schneier has a good series on it called The Doghouse. Example entry: https://www.schneier.com/blog/archives/2019/09/the_doghouse_cr_1.html Phil Zimmermann (PGP) has an essay on recognizing it: https://philzimmermann.com/EN/essays/SnakeOil.html djb even has a competition: https://snakeoil.cr.yp.to/

Well, ask the creator of PGP: > Whatever it is, you don't want your private electronic mail (email) or confidential documents read by anyone else. https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html It was designed for private electronic mail. Or the PGP FAQ linked by the MIT keyserver: > PGP is a program that gives your electronic mail something that it otherwise doesn't have: Privacy. https://pgp.mit.edu/info.html Where did you get your definition from? Because it's the first time I ever heard of it.

z-base-32 is one example: https://philzimmermann.com/docs/human-oriented-base-32-encoding.txt

That was Phil Zimmerman’s book containing the PGP source whixh was published a few years before the Deep Crack book. https://philzimmermann.com/EN/essays/BookPreface.html

People will need to publish commits in book form again, like the Phil Zimmerman did with PGP, to have freedom of expression. See: https://philzimmermann.com/EN/essays/BookPreface.html I'm picturing RISC-V processors being sold in boxes that are actually small bible-like books with ornate binding, full of paper printed source code, with small hollows inside where the chips fit.

The PGP source code was published as a book so that it could be exported under the theory that the first amendment beats ITAR. https://philzimmermann.com/EN/essays/BookPreface.html

https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html Governments make the same arguments. If you want encryption you are either a terrorist, or extremist. Everybody should be able to self host, and nobody should be looked down upon for selfhosting. It is not a bad thing that somebody wants not to rely on any centralized government or corporate system, or want their data to be private. Centralized bodies are prone to abuse power. We should work towards decentralized systems, and towards self hosting.

> I miss "hackers" from the 90s with some actual backbone. https://philzimmermann.com/EN/essays/WhyIWrotePGP.html It was a good time indeed.

Not as far as I know: > It was this bill that led me to publish PGP electronically for free that year [1991] https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html > It was on this day in 1991 that I sent the first release of PGP to a couple of my friends for uploading to the Internet. First, I sent it to Allan Hoeltje, who posted it to Peacenet, an ISP that specialized in grassroots political organizations, mainly in the peace movement. [...] Then, I uploaded it to Kelly Goen, who proceeded to upload it to a Usenet newsgroup that specialized in distributing source code. https://www.philzimmermann.com/EN/news/PGP_10thAnniversary.html Symantec later bought it and things changed, but thanks to there being an open standard (OpenPGP) and RFCs, people can and did write compatible software. With varying degrees of compatibility, admittedly.

I think you're thinking of Zimmermann: https://philzimmermann.com/EN/contact/index.html

It's not a legend, it's easy enough to confirm. https://philzimmermann.com/EN/essays/BookPreface.html

The PGP source code was published as a book to avoid this https://philzimmermann.com/EN/essays/BookPreface.html

Though it would appear the source of the original PGP software is no longer publicly accessible [1], so how would one know if it was vulnerable? I think the EFF probably meant people using various implementations right? [1] https://philzimmermann.com/EN/findpgp/

And zbase32 (https://philzimmermann.com/docs/human-oriented-base-32-encoding.txt), which is my own preference for still being case-insensitive and thereby able to be used in subdomain names or email addresses.

"What if everyone believed that law-abiding citizens should use postcards for their mail? If a nonconformist tried to assert his privacy by using an envelope for his mail, it would draw suspicion. Perhaps the authorities would open his mail to see what he's hiding. Fortunately, we don't live in that kind of world, because everyone protects most of their mail with envelopes. So no one draws suspicion by asserting their privacy with an envelope. There's safety in numbers. Analogously, it would be nice if everyone routinely used encryption for all their email, innocent or not, so that no one drew suspicion by asserting their email privacy with encryption. Think of it as a form of solidarity." ~ Philip Zimmermann, "Why I wrote PGP" https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html

Phil Zimmermann used postcards as the analogy in his Why I Wrote PGP essay in 1991: https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html

The line at the end that really hit me was this: > Almost all the attackers were known to the authorities, and if they had been watched, their use of encryption programs would have itself invited closer scrutiny. This is precisely the scenario that Phil Zimmermann (creator of PGP) and others have been warning about (and working against) for decades. As Zimmermann said in a 1999 essay linked here not long ago, "What if everyone believed that law-abiding citizens should use postcards for their mail?" (https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html) The scary part to me is not just that it's our present reality, but that it's so readily accepted. Crypto advocates need better PR. (And to be fair, better UI.)

To see the full quote, click on the loc.gov linked URL to Biden's bill, then "text of legislation," then "printer friendly." You'll see this text: "It is the sense of Congress that providers of electronic communications services and manufacturers of electronic communications service equipment shall ensure that communications systems permit the government to obtain the plain text contents of voice, data, and other communications when appropriately authorized by law." Vice President (then Senator) Biden's bill was what led Phil Zimmermann to publish PGP, as he wrote here in the original 1991 PGP User's Guide: *"It was this bill that led me to publish PGP electronically for free that year, shortly before the measure was defeated after vigorous protest by civil libertarians and industry groups." http://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html The more things change...

Total overreaction. E-mail is not insecure now because the NSA is scooping up all the traffic or making backroom deals with e-mail providers. It is, and always was, sent over the wire in plaintext. You're writing postcards. Read Phil Zimmermann's comments 22 years ago that seem especially relevant: http://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html Don't let the government intimidate you.

There is more to it than what you see. The NSA is known[1] to be able to take advantage of weaknesses found (or planted) in crypto algorithms, however, not in PGP[2] and other strong ones. 1. http://en.wikipedia.org/wiki/Cryptography#NSA_involvement 2. http://www.philzimmermann.com/EN/faq/faq.html (3rd question)

This was always the case, Phil Zimmermann was very open about it, even back in 1991. Sun fellows know the same. There were even case stories from Romania around the nineties, a country which is not even 250 years old. http://www.philzimmermann.com/EN/news/PGP_10thAnniversary.html

I remember the pushback in the 90s against the Clipper chip. PGP was one of the responses to the NSA's overreach. I think it's hard to find people who cares about this today because there appears to be both a general lack of historical literacy combined with the fact that a lot of people are just grinding to stay alive right now. "The government knows what a pivotal role cryptography is destined to play in the power relationship with its people. In April 1993, the Clinton administration unveiled a bold new encryption policy initiative, which had been under development at the National Security Agency (NSA) since the start of the Bush administration. The centerpiece of this initiative was a government-built encryption device, called the Clipper chip, containing a new classified NSA encryption algorithm. The government tried to encourage private industry to design it into all their secure communication products, such as secure phones, secure faxes, and so on. AT&T put Clipper into its secure voice products. The catch: At the time of manufacture, each Clipper chip is loaded with its own unique key, and the government gets to keep a copy, placed in escrow. Not to worry, though–the government promises that they will use these keys to read your traffic only "when duly authorized by law." Of course, to make Clipper completely effective, the next logical step would be to outlaw other forms of cryptography." -Phil Zimmerman, Why I Wrote PGP [0] [0]…

Woah, I didn't know that Joe Biden was the sponsor of the exact bill that Phil Zimmerman referenced in his essay, “Why I Wrote PGP”. From the OP: “On the other hand, as a senator in the 1990s, Vice President Joe Biden introduced a bill at the FBI's behest that echoes the bureau's proposal today. Biden's bill said companies should "ensure that communications systems permit the government to obtain the plain text contents of voice, data, and other communications when appropriately authorized by law." (Biden's legislation spurred the public release of PGP, one of the first easy-to-use encryption utilities.)” The bill: S.266 Latest Title: Comprehensive Counter-Terrorism Act of 1991 Sponsor: Sen Biden, Joseph R., Jr. [DE] (introduced 1/24/1991) Cosponsors (3) From Zimmerman's essay: “Senate Bill 266, a 1991 omnibus anticrime bill, had an unsettling measure buried in it. If this non-binding resolution had become real law, it would have forced manufacturers of secure communications equipment to insert special "trap doors" in their products, so that the government could read anyone's encrypted messages. It reads, "It is the sense of Congress that providers of electronic communications services and manufacturers of electronic communications service equipment shall ensure that communications systems permit the government to obtain the plain text contents of voice, data, and other communications when appropriately authorized by law." It was this bill that led me to…

Not sure what to believe here but we do know that the NSA and authorities do need to have access to data for security. If there are systems that aren't apt to putting in backdoors or trapdoors then they treat you like Phil Zimmerman in the 90's by dropping the DOJ on you: http://www.philzimmermann.com/EN/faq/index.html + http://en.wikipedia.org/wiki/Phil_Zimmermann or at least that was the MO at that time. But the DOJ and US Customs dropped the case against Zimmerman in '96. Obviously they would need to go with a new plan of attack after that method failed for intercepting messages in algorithms and software that is closed or running new algorithms like PGP. Backdoors and trapdoors in software that wraps crypto algorithms is one prong in that attack. The NSA neither confirms nor denies trapdoors, backdoors, etc but DOES employ some of the top cryptographers in the world. In 2000, the U.S. government lifted the export controls on strong crypto, so (pure speculation) other methods to intercept communications were/are needed. The alleged event here happened in 2000/2001 which might fit with a new MO.