From: jason carr Area: Public Key Encryption To: Shawn McMahon 19 Dec 94 08:36:28 Subject: KEY REVOKE UpdReq -----BEGIN PGP SIGNED MESSAGE----- SM> I told you guys that this would happen; and Brian isn't SM> stupid. The time and bandwidth that some are spending SM> urging people to pre-create key revocation certificates SM> would be better spent urging them to make backups and SM> memorize their key passwords. There's nothing that says you I dunno. A large amount of good operational security is forethought. Hmmm, what will happen when I do _this_??? Either the person has to have the ability to follow directions closely (ie "Extract a copy of your key =first=") or be able to think ahead. There are no easy fixes, and maybe there shouldn't be. Accidents like this show weaknesses in the chain: someone who would accidentally and irretrievably revoke their own key might also make other errors in judgement when handling other sensitive materials. (I've done far worse things, BTW...) jason ... Living proof that beautiful mutants exist among us. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: PGP_ECHO: CypherEcho to the gods... iQCVAwUBLvW4NUjhGzlN9lCZAQGmpgP/Uoddz9vlsEfAmqf7DZf2V7hCHzT2jlu6 XAngib0cgKpOsihhOG1dLTXDxrlbqjUZcKX6Y92sSY0RXAIa62mYaDj6rQPH4vcu q3r8fxAmXi0sXi6J+XwdJE4WW2RUUZgBe65Pi04GeRagkIlA4Sg/k/qD5h3dWbPq 04IWQcskxYI= =os+G -----END PGP SIGNATURE----- ... Key fingerprint = 60 97 B2 AE 7D 90 11 2F 05 1C 35 98 E9 B9 83 61 201434369420143436942014343694201434369420143436942014343694718 From: prz@acm.org Area: Public Key Encryption To: All 19 Dec 94 10:29:50 Subject: Name that phone UpdReq * Original Message Posted via CYPHERPUNKS * Date: 18 Dec 94 18:45:07 * From: prz@acm.org @ 1:102/825.111 * To: All * Forwarded by: Christopher Baker @ 1:374/14 * Message text was not edited! @MSGID: 1:102/825.111 0002b56a @REPLYTO 1:102/825 UUCP @REPLYADDR prz@acm.org @PID GIGO+ sn 154 at borderlin vsn 0.99 pl3 @Sender: quake!toad.com!owner-cypherpunks @Received: from relay2.UU.NET by netcomsv.netcom.com with ESMTP (8.6.4/SMI-4.1) @ id TAA07576; Sun, 18 Dec 1994 19:03:12 -0800 @Received: from toad.com by relay2.UU.NET with SMTP @ id QQxuwx12942; Sun, 18 Dec 1994 21:56:21 -0500 @Received: by toad.com id AA18182; Sun, 18 Dec 94 18:47:18 PST @Received: from ncar.UCAR.EDU by toad.com id AA18170; Sun, 18 Dec 94 18:46:00 PST @Received: from sage.cgd.ucar.EDU by ncar.ucar.EDU (NCAR-local/ NCAR Central Post Office 03/11/93) @ id TAA11410; Sun, 18 Dec 1994 19:45:55 -0700 @Received: from columbine.cgd.ucar.EDU by sage.cgd.ucar.EDU (8.6.4/ NCAR Mail Server 04/10/90) @ id TAA06653; Sun, 18 Dec 1994 19:45:42 -0700 @Received: by columbine.cgd.ucar.EDU (4.1/ NCAR Mail Server 04/10/90) @ id AA09967; Sun, 18 Dec 94 19:45:48 MST Message-Id: @Subject: Name that phone @To: cypherpunks@toad.com (Cypherpunks) Date: Sun, 18 Dec 1994 19:45:07 -0700 (MST) Cc: prz@acm.org (Philip Zimmermann), prz-list@voxbox.norden1.com (alt.security.pgp) From: Philip Zimmermann @Reply-To: Philip Zimmermann @Content-Type: text @Sender: owner-cypherpunks@toad.com @Precedence: bulk I'm trying to come up with a name for the secure phone software I'm planning on releasing. The software would turn any multimedia PC into a secure phone. I'm open to suggestions for the name. Some names that have been suggested: 1) Voice PGP 2) Pretty Good Secure Phone (PGSP) 3) PGP Phone I like 2 or 3. Does anyone want to suggest other names, or vote for which of these is better? Send your replies to prz@acm.org, with the subject line of "Name that phone". The winner will get a free copy. But then, so will a lot of other people. --- @PATH: 102/825 903 374/14 201434369420143436942014343694201434369420143436942014343694718 From: jason carr Area: Public Key Encryption To: all 19 Dec 94 09:18:26 Subject: REVOKE.BAT UpdReq -----BEGIN PGP SIGNED MESSAGE----- I was thinking about how easy it is to goof up a revocation, and how permanent the results are. Maybe we should write a little .bat for the newbies to use until they get more comfy with PGP? I'm doing this outta my head: DON'T use it until you've checked it for procedural and command-line errors. If Chris or Shawn would take a peek at it and make any corrections, I think it might be useful. rem REVOKE.BAT, an automation of the key revocation process. rem Please proofread and correct before use. rem jason carr, 1:124/3208 rem rem Make a backup of your keyring, in case things get weird. Then, rem put this .bat in your PGP directory, and call it from the DOS rem prompt thusly: rem REVOKE <"your name"> rem ie, I would say REVOKE "jason carr" rem rem rem Extant key is extracted to SAVE.IT! rem PGP -kx %1 SAVE.IT! rem rem Key is revoked rem PGP -kd %1 rem rem Revocation is extracted to REVOCATI.ON rem PGP -kx %1 REVOCATI.ON rem rem Revocation is DELeted rem PGP -kr %1 rem rem Original key is imported from SAVE.IT! rem PGP -ka SAVE.IT! rem End, REVOKE.BAT jason ... Please don't pour hot fudge on the cat. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: PGP_ECHO: CypherEcho to the gods... iQCVAwUBLvXCaUjhGzlN9lCZAQEjHAP+IFPUxLHeI0kZIQnO6F8x+7AHw40w4am+ 9Q6ONluNihDkcF8q5IuDPFDDNtgDWDG/ROu7o4fuYaT2RwnzZHRcOcAyq1aYTMtA sc4zayB9/8j+mpVtfF7SW4zSVwGtpClnk6xVsdz5JVu4fuFp9e5qvl9sNyC1agWh gk2N0xb44SE= =4ZkL -----END PGP SIGNATURE----- ... Key fingerprint = 60 97 B2 AE 7D 90 11 2F 05 1C 35 98 E9 B9 83 61 201434369420143436942014343694201434369420143436942014343694718 From: Shawn McMahon Area: Public Key Encryption To: jason carr 21 Dec 94 00:21:44 Subject: KEY REVOKE UpdReq Despite the stern warnings of the tribal elders, jason carr said this to Shawn McMahon: jc> judgement when handling other sensitive materials. (I've done far worse jc> things, BTW...) Me, too; that's why I made sure to include that part about Brian not being stupid. This is something that can happen all too easily; but pre-creating a revocation certificate, IMO, creates more security problem than it solves. A far better solution would be to change your password to something you *CAN'T* forget, backup your key, change your password back, and put that disk somewhere secure. Although some balk at the idea of a safety deposit box, it's my opinion that an adversary who can locate and penetrate your box is in a position to do far worse things to you than steal your PGP key. 201434369420143436942014343694201434369420143436942014343694718 From: Shawn McMahon Area: Public Key Encryption To: jason carr 21 Dec 94 00:44:32 Subject: REVOKE.BAT UpdReq Despite the stern warnings of the tribal elders, jason carr said this to all: jc> PGP -kx %1 SAVE.IT! jc> rem Key is revoked jc> PGP -kd %1 jc> rem Revocation is extracted to REVOCATI.ON jc> PGP -kx %1 REVOCATI.ON jc> rem Revocation is DELeted jc> PGP -kr %1 jc> rem Original key is imported from SAVE.IT! jc> PGP -ka SAVE.IT! I haven't tested this, but I don't think it'll work. When you try to re-import your key, it'll tell you that one's been revoked, won't it? (Man, I hate to test this. Grumble, gripe, bitch. ) [TESTING NOW] Ah; stupid me. You deleted it from the pubring in step 3. Potential pitfall there; the user should be warned to answer *NO* when prompted to delete it from his secring, or he's screwed even worse. (Secret key is removed, but public key is still there. If he doesn't know better, which we *MUST* assume, he could propagate that public key and then not be able to read the messages he gets!) Alternate idea: copy PUBRING.PGP %1.BAK PGP -kd %1 PGP -kx %1 REVOCATI.ON copy %1.BAK PUBRING.PGP Whatcha think of that one? 201434369420143436942014343694201434369420143436942014343694718