Breaking PGP?

[Wolstan Dixie]

Four Animal Liberation Front activists have been found guilty in
Britain. Guardian, 24 Dec 2008 p 6 "Officers deciphered encrypted
emails . . . . . . and deciphered spreadsheets found on their
computers . . . . "

Pretty certainly they were using PGP.

[David E. Ross]

Post by Wolstan Dixie
Four Animal Liberation Front activists have been found guilty in
Britain. Guardian, 24 Dec 2008 p 6 "Officers deciphered encrypted
emails . . . . . . and deciphered spreadsheets found on their
computers . . . . "
Pretty certainly they were using PGP.

In the UK, the law mandates that those accused of a crime (and perhaps
others) comply with a demand from the police for their passphrases and
private keys. Failure to comply is itself a crime punishable by
imprisonment. Thus, the news report in the Guardian does not mean that
PGP has been broken.

[Paul Vigay]

Post by David E. Ross
In the UK, the law mandates that those accused of a crime (and perhaps
others) comply with a demand from the police for their passphrases and
private keys. Failure to comply is itself a crime punishable by
imprisonment. Thus, the news report in the Guardian does not mean that
PGP has been broken.

Of course, you can also download utilities (such as my own FakeFiles - see
www.vigay.com/software/fakefiles.html) which use PGP to generate 100s of
genuinely encrypted but fake messages for which you *CANNOT* produce a key,
because the computer has randomly generated the key, encrypted junk data
and then deleted the key.

This provides a valid level of "plausible deniability", as you can prove
that you have genuinely PGP encrypted messages for which you do not know
(and have never known) the passphrase. These files/messages are
indistinguishable from genuine encrypted files.

[Nat Queen]

Post by Paul Vigay

Post by David E. Ross
In the UK, the law mandates that those accused of a crime (and perhaps
others) comply with a demand from the police for their passphrases and
private keys. Failure to comply is itself a crime punishable by
imprisonment. Thus, the news report in the Guardian does not mean that
PGP has been broken.

Of course, you can also download utilities (such as my own FakeFiles - see
www.vigay.com/software/fakefiles.html) which use PGP to generate 100s of
genuinely encrypted but fake messages for which you *CANNOT* produce a key,
because the computer has randomly generated the key, encrypted junk data
and then deleted the key.
This provides a valid level of "plausible deniability", as you can prove
that you have genuinely PGP encrypted messages for which you do not know
(and have never known) the passphrase. These files/messages are
indistinguishable from genuine encrypted files.

Or you can use software such as my utility Stealth (see
http://www.queen.clara.net/pgp/acorn.html), which provides plausible
deniability by hiding multiple directories inside a container file,
each encrypted with its own passphrase, in such a way that no one
without a knowledge of the passphrases can determine how many actually
exist. With the right software, Big Brother snooping can be defeated!

Nat

[Paul Vigay]

In article <***@clara.co.uk>,
Nat Queen <***@bham.ac.uk.invalid> wrote:

[Snip]

Post by Nat Queen
exist. With the right software, Big Brother snooping can be defeated!

Actually, you make a very valid point. It's all well and good having useful
software to hand, but the biggest problem I find is that of *educating*
people. Too many people seem to be apathetic to what's going on around them
in the world. Too many people have the "I've got nothing to hide so why
should I bother" type mentality.

Big Brother snooping will only be defeated when everyone routinely uses
secure encryption for all electronic communications, irrespective of how
trivial it may be.

Generations of people have fought and died for freedom and liberty, yet a
worryingly high percentage of the current generation seem to be squandering
(or trading) it away.

One of my favourite sayings is Benjamin Franklin's "Those who would give up
Essential Liberty to purchase a little Temporary Safety, deserve neither
Liberty nor Safety." which seems even more relevant today.

You owe it to yourself as well as future generations, to protect your
privacy and freedom. Make a New Year resolution to start using strong
encryption (such as GnuPG) NOW!!

Paul

[JTF]

Post by Paul Vigay
[Snip]

exist.  With the right software, Big Brother snooping can be defeated!

Actually, you make a very valid point. It's all well and good having useful
software to hand, but the biggest problem I find is that of *educating*
people. Too many people seem to be apathetic to what's going on around them
in the world. Too many people have the "I've got nothing to hide so why
should I bother" type mentality.
Big Brother snooping will only be defeated when everyone routinely uses
secure encryption for all electronic communications, irrespective of how
trivial it may be.
Generations of people have fought and died for freedom and liberty, yet a
worryingly high percentage of the current generation seem to be squandering
(or trading) it away.
One of my favourite sayings is Benjamin Franklin's "Those who would give up
Essential Liberty to purchase a little Temporary Safety, deserve neither
Liberty nor Safety." which seems even more relevant today.
You owe it to yourself as well as future generations, to protect your
privacy and freedom. Make a New Year resolution to start using strong
encryption (such as GnuPG) NOW!!
Paul
--
Paul Vigay                         __\\|//__                 Life,
                                   (` o-o ')             the Universe
---http://www.vigay.com/--------ooO-(_)-Ooo----------- & Everything ------
Quality Internet Services, Broadband & Hosting -www.orpheusinternet.co.uk

The plausible deniability of encrypted containers as well as the
containers themselves containing encrypted data is really the only
way. Almost like the two man nuke key idea...

[Christoph Burschka]

Post by Paul Vigay
Of course, you can also download utilities (such as my own FakeFiles - see
www.vigay.com/software/fakefiles.html) which use PGP to generate 100s of
genuinely encrypted but fake messages for which you *CANNOT* produce a key,
because the computer has randomly generated the key, encrypted junk data
and then deleted the key.
This provides a valid level of "plausible deniability", as you can prove
that you have genuinely PGP encrypted messages for which you do not know
(and have never known) the passphrase. These files/messages are
indistinguishable from genuine encrypted files.

Wait, is there any reason someone would use this tool if they were *not* also
storing files they actually have the key for? It would probably be tough to
convince a judge of this, let alone secret police. Depending on which one is
after you, you might risk obstruction or contempt charges (ianal), or
water-boarding.

[Morton D. Trace]

Post by Paul Vigay

Post by David E. Ross
In the UK, the law mandates that those accused of a crime (and perhaps
others) comply with a demand from the police for their passphrases and
private keys. Failure to comply is itself a crime punishable by
imprisonment. Thus, the news report in the Guardian does not mean that
PGP has been broken.

Of course, you can also download utilities (such as my own FakeFiles - see
www.vigay.com/software/fakefiles.html) which use PGP to generate 100s of
genuinely encrypted but fake messages for which you *CANNOT* produce a key,
because the computer has randomly generated the key, encrypted junk data
and then deleted the key.
This provides a valid level of "plausible deniability", as you can prove
that you have genuinely PGP encrypted messages for which you do not know
(and have never known) the passphrase. These files/messages are
indistinguishable from genuine encrypted files.

Cool,



There is a competition in randomnes here


http://www.cacert.at/random/

http://www.cacert.at/cgi-bin/rngresults


just go for any iso cd or dvd download from wherever you like.



and crypt that with mcrypt.

this command will also do.

openssl base64 -d -in file.b64

or

openssl enc -d -base64 -in file.b64

any binary iso can easily be converted to base64.

and that you can modify as you like.

save it as file

and crypt with mcrypt and a very long passphrase

like this one,
==> one line please!


jmb%0k7#4NxJ>}***@x=***@D](***@2hZHs_G]_F,%.zQLrSJk8Ao<{T*Bx"4kMW~&pvTGEq"_Iu\Q;P$J=d|=yD^FdIOd(dzfE##6J*ZOZopVyfA-
pEC'NJ("BfmsK+PI[EB5EYBkq?0[18>^K#VRi0`ks)a5hY>%w{gx!N#c&X>&6yn}P_&:Kb$:>|&DE+Fl=n&!8W854OyCo9['K\;gR?F5XA=0iK5LE!f|+L.O
+NM3Y'E[9Qxe0{.GWRU}70`ZXGVyTba\Ii4&.MT(B9'nr]pIwu^JB6AiQK*#*:~TXPNUff[2k!0\'0-TEHL;PuP$N}>>O[r`&1^r<}4S]DLbmo~o`*V~/9sq
$W32M,OB7x[^3x'&!AZ{ccc~K>!wMPc0/[G.ZRb%rw0g)`KbI-&nnP>3CF}KZT2~lTZ9nzah`+I#k>#f1h!4%`1(;,mG/#dR(([\goVjeCgsuOI-z6$$tDh`
!yw[ZBQ^&gRoh''%QWWW(i2q6zAg)6/J_Rh*(c.>aS+|H)aDD\JGr[IvZgK'6(lmyZGS!?`os14y0Gf*LW`OHX/NPf~m+qF62s~#BPB?ene7J$<%~q'N>nmY
KrHkshWH0IO@$mLOgo[_OaQti7X2W$<{63=Wzj,/KFd64iDFA(4j&n+][{zN[]}k+m{Sc#9sVVVa=J%1{|p9{`'|*8mfZ?b*dE?hd>F/ZBr\C3trCkHVWI}y


finally create a new pgp key do do the christmas gift.

All hackers would be happy to crack it.


Please don't use any journalling file system for this.

You can rename it and upload for randomness test at cacert.

That could be deniable because it simply does not exist any decrypt.

http://www.riscos.org/ looks interesting does that run under VMWare ?

Sincerely,

[Damaeus]

Reading from news:alt.security.pgp,

Post by David E. Ross
In the UK, the law mandates that those accused of a crime (and perhaps
others) comply with a demand from the police for their passphrases and
private keys. Failure to comply is itself a crime punishable by
imprisonment. Thus, the news report in the Guardian does not mean that PGP
has been broken.

Of course, law enforcement and military are definitely *not* ignorant
when it comes to psychological tactics. I trust Phil Zimmermann. I
trust his integrity and what he says about there being no back door in
PGP, and that he means it and believes it, himself. At the same time,
I've heard enough other things that have gone on to know that if there
is a "master key", to lull those using PGP for nefarious purposes into
a false sense of security, they would occasionally have news stories
published talking about their trouble with trying to break it. They
would think that this would attract the attention of others to start
using it.

Law enforcement could even be so sneaky as to not even act on
information they recover from PGP-encrypted files, but just use it as
evidence that something *IS* happening, so they just watch for more
that isn't encrypted. This would be so they could keep users thinking
they're actually hiding something. But reporters often get their
information by asking "trusted law enforcement" for answers. Law
enforcement, like the military, has rules about what they can and
can't say, or won't say publicly if it affects current or future
investigations. With something as strong as PGP, I imagine that
counts double and triple.

I'm not against PGP at all. But since I didn't see for myself
everything that went on and all the circumstances surrounding the
technology, to just accept someone's word that there's no way to
quickly decypher a message puts too much faith in the unknown.

I'm also not a privacy nut. I just like PGP.

Damaeus

[JTF]

Post by Damaeus
Reading from news:alt.security.pgp,

Post by David E. Ross
In the UK, the law mandates that those accused of a crime (and perhaps
others) comply with a demand from the police for their passphrases and
private keys.  Failure to comply is itself a crime punishable by
imprisonment.  Thus, the news report in the Guardian does not mean that PGP
has been broken.

Of course, law enforcement and military are definitely *not* ignorant
when it comes to psychological tactics.  I trust Phil Zimmermann.  I
trust his integrity and what he says about there being no back door in
PGP, and that he means it and believes it, himself.  At the same time,
I've heard enough other things that have gone on to know that if there
is a "master key", to lull those using PGP for nefarious purposes into
a false sense of security, they would occasionally have news stories
published talking about their trouble with trying to break it.  They
would think that this would attract the attention of others to start
using it.
Law enforcement could even be so sneaky as to not even act on
information they recover from PGP-encrypted files, but just use it as
evidence that something *IS* happening, so they just watch for more
that isn't encrypted.  This would be so they could keep users thinking
they're actually hiding something.  But reporters often get their
information by asking "trusted law enforcement" for answers.  Law
enforcement, like the military, has rules about what they can and
can't say, or won't say publicly if it affects current or future
investigations.  With something as strong as PGP, I imagine that
counts double and triple.
I'm not against PGP at all.  But since I didn't see for myself
everything that went on and all the circumstances surrounding the
technology, to just accept someone's word that there's no way to
quickly decypher a message puts too much faith in the unknown.
I'm also not a privacy nut.  I just like PGP.
Damaeus
--
Damaeus - Damon M.

I am sure some sort of keylogging was used if the encryption was
removed.

usually, such an investigation would be ongoing for months prior to
any action being taken. If the people are not very technical, such a
logging device or even rootkit would not be seen.

[Baal]

<5012ea4a2cinvalid-***@invalid-domain.co.uk> <***@clara.co.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Paul Vigay wrote in alt.security.pgp on December 25, 2008 03:12 in

Post by Paul Vigay
[Snip]

Post by Nat Queen
exist. With the right software, Big Brother snooping can be
defeated!

Actually, you make a very valid point. It's all well and good having
useful software to hand, but the biggest problem I find is that of
*educating* people. Too many people seem to be apathetic to what's
going on around them in the world. Too many people have the "I've got
nothing to hide so why should I bother" type mentality.

Paul, you've hit the nail right on the head, here. One of the dreams of the
Cypherpunks for was for universal adoption of crypto to render massive
surveillance of the type we've seen in recent years essentially impossible.

I well remember how law-enforcement officials, such as the FBI's then-
Director Louis Freeh, were publicly proclaiming how the sky was falling due
to the adoption (by criminals) of non-key-escrowed cryptographic software.
They were literally /terrified/ of this prospect.

What they (and the Cypherpunks) didn't count on was the exceeding sloth and
disinterest of the general public.

Even amongst those who /did/ have some desire to make use of encryption,
they didn't want to *learn* anything--they wanted instant gratification,
complete with a point-and-drool interface. As a result, they flocked en-
masse to services like Hushmail that violated the basic principle of public-
key cryptography--i.e. the separation of public and private key pairs. By
keeping both halves of the keypair, and using a modified Java applet to
snag the passphrase, Hushmail made it simple for law-enforcement to pierce
the veil of secrecy afforded by the encryption; additionally, since all the
alleged perpetrators were using Hushmail, they provided the authorities, in
essence, with one-stop-shopping or a single point of failure. [*]

Post by Paul Vigay
Big Brother snooping will only be defeated when everyone routinely
uses secure encryption for all electronic communications, irrespective
of how trivial it may be.

Precisely. This was the philosophy espoused by the Cypherpunks; they assumed
that: "If you build the tools, they will come" and unfortunately for all of
us, it didn't turn out that way.

Post by Paul Vigay
Generations of people have fought and died for freedom and liberty,
yet a worryingly high percentage of the current generation seem to be
squandering (or trading) it away.

The sad fact of the matter is that they don't know any better. I've spoken
with young people, and they've described the world wars as "ancient history."
Even in the former East Bloc nations, there is now a generation born and
raised after the fall of Communism, who know little of what their parents
and grandparents went through.

Here in the West, there are fewer and fewer people with direct experience
of fascism. I've read comments made by ostensible former East Bloc citizens
who spoke of wanting to return to their countries of origin. They stated
that the signs they were seeing in Bush's America post-9/11 reminded them
of what they had fled the East Bloc to get away from. Some further commented
that they felt more free back in their home countries now than they do in
the so-called 'free' United States. I've seen others comment that the
surveillance they'd experienced in Britain by far exceeded anything that
they had endured under the Communist regimes.

I've also seen travelers comment that travelling to the United States today
and dealing with U.S. Customs is more reminiscent of entering the Soviet
Union in the mid-1970s than anything else.

Post by Paul Vigay
One of my favourite sayings is Benjamin Franklin's "Those who would
give up Essential Liberty to purchase a little Temporary Safety,
deserve neither Liberty nor Safety." which seems even more relevant
today.

Excellent advice, then, and now--but then Franklin and his contemporaries
had direct experience of governmental abuses by the British Crown.

Post by Paul Vigay
You owe it to yourself as well as future generations, to protect your
privacy and freedom. Make a New Year resolution to start using strong
encryption (such as GnuPG) NOW!!

Agreed. I fear that you are preaching to the converted, however. The great
unwashed masses have their creature comforts, convenient enemies to hate,
e.g. Dateline NBC's "To Catch A Predator," (TCAP), etc. (I've described TCAP
as 1984's two-minute hate expanded to a full hour, including commercials.)

It's the old Roman maxim, as described by Juvenal: Panem Et Circenses or
Bread and Circuses.

Post by Paul Vigay
Paul

[*] Excellent summary of Hushmail debacle:

Posted by JimC to http://forum.no2id.net/viewtopic.php?t=20244

Posted: Sat, 12 Jan 2008 10:19:53 +0000
Post subject: Reasons to avoid Hushmail

Until September 2007, Hushmail received generally favorable reviews
in the press.[1] [2] It was believed that possible threats, such as
demands from the legal system to reveal the content of traffic through
the system, were not as imminent in Canada as they are in the United
States and if data were to be handed over encrypted messages would
only be available in encrypted form. However, recent developments
have led to doubts among security-conscious users about Hushmail's
security and concern over a backdoor in an OpenPGP service. Hushmail
has turned over cleartext copies of private e-mail messages associated
with several addresses at the request of law enforcement agencies under
a Mutual Legal Assistance Treaty with the United States.[3] One example
of this behavior is in the case of U.S. v. Tyler Stumbo. [4],[5], [6].
In addition, the contents of emails between Hushmail addresses were
analyzed, and a total of 12 CDs were turned over to US authorities.

The issue originally revolved around the use of the non-java version of
the Hush system. It performed the encrypt and decrypt steps on Hush's
servers and then used SSL to transmit the data to the user. The data
is available as cleartext during this small window; additionally the
passphrase can be captured at this point. This facilitates the
decryption of all stored messages and future messages using this
passphrase. Hushmail has stated that the java version is also
vulnerable in that they may be compelled to deliver a compromised
java applet to a user. [7] [8] Hushmail recommends using non web-
based services such as GnuPG and PGP Desktop for those who need
stronger security. [9]

References:

1 http://www.pcmag.com/article2/0,1895,1136652,00.asp
2 http://www.npr.org/templates/story/story.php?storyId=5227744
3 http://blog.wired.com/27bstroke6/2007/11/encrypted-e-mai.html
4 http://static.bakersfield.com/smedia/2007/09/25/15/steroids.source.prod_affiliate.25.pdf
5 http://blog.wired.com/27bstroke6/2007/11/encrypted-e-mai.html]
6 http://blog.wired.com/27bstroke6/hushmail-privacy.html
7 http://blog.wired.com/27bstroke6/2007/11/encrypted-e-mai.html
8 http://blog.wired.com/27bstroke6/hushmail-privacy.html
9 http://www.hushmail.com/about-security

SOURCE: http://en.wikipedia.org/wiki/Hushmail


Baal <***@Usenet.org>
PGP Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x1E92C0E8
PGP Key Fingerprint: 40E4 E9BB D084 22D5 3DE9 66B8 08E3 638C 1E92 C0E8
Retired Lecturer, Encryption and Data Security, Pedo U, Usenet Campus
- --

"Sed quis custodiet ipsos Custodes?" -- "Who will watch the Watchmen?"
-- Juvenal, Satires, VI, 347. circa 128 AD

[Cyberiade.it Anonymous Remailer]

In article <***@panta-rhei.eu.org>, Baal
<Use-Author-Supplied-Address-Header@[127.1]> wrote:

big snip

Post by Baal
Even amongst those who /did/ have some desire to make use of
encryption, they didn't want to *learn* anything--they wanted
instant gratification, complete with a point-and-drool
interface. As a result, they flocked en- masse to services
like Hushmail that violated the basic principle of public-
key cryptography--i.e. the separation of public and private
key pairs. By keeping both halves of the keypair, and using a
modified Java applet to snag the passphrase, Hushmail made it
simple for law-enforcement to pierce the veil of secrecy
afforded by the encryption; additionally, since all the
alleged perpetrators were using Hushmail, they provided the
authorities, in essence, with one-stop-shopping or a single
point of failure. [*]

big snip


Baal,

WADR, the "separation of public and private key pairs" is
meaningless, if somebody has your private key it is
trivial to extract your public key from it.

The danger is letting someone have your private key and
passphrase.

[Neil - Salem, MA USA]

Post by Cyberiade.it Anonymous Remailer
big snip

Post by Baal
Even amongst those who /did/ have some desire to make use of
encryption, they didn't want to *learn* anything--they wanted
instant gratification, complete with a point-and-drool
interface. As a result, they flocked en- masse to services
like Hushmail that violated the basic principle of public-
key cryptography--i.e. the separation of public and private
key pairs. By keeping both halves of the keypair, and using a
modified Java applet to snag the passphrase, Hushmail made it
simple for law-enforcement to pierce the veil of secrecy
afforded by the encryption; additionally, since all the
alleged perpetrators were using Hushmail, they provided the
authorities, in essence, with one-stop-shopping or a single
point of failure. [*]

big snip
Baal,
WADR, the "separation of public and private key pairs" is
meaningless, if somebody has your private key it is
trivial to extract your public key from it.
The danger is letting someone have your private key and
passphrase.

In the case of an RSA private key, the private key can be in the form of
(n,d) where n is the product of two prime number p and q, and d is the
decryption exponent, or the private key could be of the form (p,q,d), where
p and q are the two factors of n and d is the decryption exponent.

If the RSA private key is in the form (p,q,d) then you are correct that it's
a trivial matter to extract the public key from it. On the other hand, if
the private key is of the form (n,d), then the problem becomes intractable.
To derive the public key, one needs to factor n, which would take a long
time.

Neil - Salem, MA USA

[Unruh]

Post by Neil - Salem, MA USA

Post by Cyberiade.it Anonymous Remailer
big snip

Post by Baal
Even amongst those who /did/ have some desire to make use of
encryption, they didn't want to *learn* anything--they wanted
instant gratification, complete with a point-and-drool
interface. As a result, they flocked en- masse to services
like Hushmail that violated the basic principle of public-
key cryptography--i.e. the separation of public and private
key pairs. By keeping both halves of the keypair, and using a
modified Java applet to snag the passphrase, Hushmail made it
simple for law-enforcement to pierce the veil of secrecy
afforded by the encryption; additionally, since all the
alleged perpetrators were using Hushmail, they provided the
authorities, in essence, with one-stop-shopping or a single
point of failure. [*]

big snip
Baal,
WADR, the "separation of public and private key pairs" is
meaningless, if somebody has your private key it is
trivial to extract your public key from it.
The danger is letting someone have your private key and
passphrase.

In the case of an RSA private key, the private key can be in the form of
(n,d) where n is the product of two prime number p and q, and d is the
decryption exponent, or the private key could be of the form (p,q,d), where
p and q are the two factors of n and d is the decryption exponent.
If the RSA private key is in the form (p,q,d) then you are correct that it's
a trivial matter to extract the public key from it. On the other hand, if
the private key is of the form (n,d), then the problem becomes intractable.
To derive the public key, one needs to factor n, which would take a long
time.

Nope. If you know both e and d and n, then finding the factors of n is also
trivial
n=pq, ed-1=(p-1)(q-1)
Thus ed-2-n=-(p+q)
and (p+q)^2-2n=(p-q)^2
If you know both p+q and p-q finding p and q is trivial. (Minor problem is
that ed-1 is probably some low multiple of of (p-1)(q-1) but that multiple
is just Ceil((ed-1)/n)

Post by Neil - Salem, MA USA
Neil - Salem, MA USA

[Neil - Salem, MA USA]

Post by Unruh

Post by Neil - Salem, MA USA

Post by Cyberiade.it Anonymous Remailer
big snip

Post by Baal
Even amongst those who /did/ have some desire to make use of
encryption, they didn't want to *learn* anything--they wanted
instant gratification, complete with a point-and-drool
interface. As a result, they flocked en- masse to services
like Hushmail that violated the basic principle of public-
key cryptography--i.e. the separation of public and private
key pairs. By keeping both halves of the keypair, and using a
modified Java applet to snag the passphrase, Hushmail made it
simple for law-enforcement to pierce the veil of secrecy
afforded by the encryption; additionally, since all the
alleged perpetrators were using Hushmail, they provided the
authorities, in essence, with one-stop-shopping or a single
point of failure. [*]

big snip
Baal,
WADR, the "separation of public and private key pairs" is
meaningless, if somebody has your private key it is
trivial to extract your public key from it.
The danger is letting someone have your private key and
passphrase.

In the case of an RSA private key, the private key can be in the form of
(n,d) where n is the product of two prime number p and q, and d is the
decryption exponent, or the private key could be of the form (p,q,d), where
p and q are the two factors of n and d is the decryption exponent.
If the RSA private key is in the form (p,q,d) then you are correct that it's
a trivial matter to extract the public key from it. On the other hand, if
the private key is of the form (n,d), then the problem becomes
intractable.
To derive the public key, one needs to factor n, which would take a long
time.

Nope. If you know both e and d and n, then finding the factors of n is also
trivial
n=pq, ed-1=(p-1)(q-1)
Thus ed-2-n=-(p+q)
and (p+q)^2-2n=(p-q)^2
If you know both p+q and p-q finding p and q is trivial. (Minor problem is
that ed-1 is probably some low multiple of of (p-1)(q-1) but that multiple
is just Ceil((ed-1)/n)

Post by Neil - Salem, MA USA
Neil - Salem, MA USA

Hmmm ...you are probably right. I'm going to have to give my tired brain
some time to look at your math. It looks good.

Actually, for some reason, I was thinking of deriving the public key from
ONLY the private key, assuming one does not have the public key. (Silly me.
What was I thinking? That's not a reasonable scenario at all, especially
for PGP and GPG keys.)

In OpenSSL it's possible to generate keys and keep the private key and
public key totally separate, but in PGP and GPG, one's private key and
public key are stored together as a "key pair" and it is trivial to export
the public key from the key pair.

A more reasonable scenario, and thus a more reasonable question (though not
the question originally discussed in this thread), is whether it is possible
to derive the private key from knowledge of the public key alone, that is
with knowledge of n and e only. And of course, if one does not have
access to the private key and thus does not have access to d, it becomes a
mathematically intractable problem. But I'm stating the obvious.

Thanks for you reply. My apologies for my fuzzy thinking.

Neil - Salem, MA USA

[d***@csclub.uwaterloo.ca.invalid]

Post by Unruh

Post by Neil - Salem, MA USA
If the RSA private key is in the form (p,q,d) then you are correct that it's
a trivial matter to extract the public key from it. On the other hand, if
the private key is of the form (n,d), then the problem becomes intractable.
To derive the public key, one needs to factor n, which would take a long
time.

Nope. If you know both e and d and n, then finding the factors of n is also
trivial

That doesn't help you much if you've lost e and the point of the
exercise is to recover it.

(I'm not sure what real implementations do, but in every explanation of
the algorithm I've seen, e is quite small; so if you have d, and the
key generation followed that pattern, trying every possible value of e
in order might do the job fairly quickly. But that's exploiting a
property of the implementation that isn't inherent in the algorithm,
and doesn't help you if the implementation didn't have that property.)


dave

[Nomen Nescio]

"Cyberiade.it Anonymous Remailer"

Post by Cyberiade.it Anonymous Remailer
big snip

Post by Baal
Even amongst those who /did/ have some desire to make use
of encryption, they didn't want to *learn* anything--they
wanted instant gratification, complete with a
point-and-drool interface. As a result, they flocked en-
masse to services like Hushmail that violated the basic
principle of public- key cryptography--i.e. the separation
of public and private key pairs. By keeping both halves of
the keypair, and using a modified Java applet to snag the
passphrase, Hushmail made it simple for law-enforcement to
pierce the veil of secrecy afforded by the encryption;
additionally, since all the alleged perpetrators were
using Hushmail, they provided the authorities, in essence,
with one-stop-shopping or a single point of failure. [*]

big snip
Baal,
WADR, the "separation of public and private key pairs" is
meaningless, if somebody has your private key it is trivial
to extract your public key from it.
The danger is letting someone have your private key and
passphrase.

In the case of an RSA private key, the private key can be in
the form of (n,d) where n is the product of two prime number
p and q, and d is the decryption exponent, or the private key
could be of the form (p,q,d), where p and q are the two
factors of n and d is the decryption exponent.
If the RSA private key is in the form (p,q,d) then you are
correct that it's a trivial matter to extract the public key
from it. On the other hand, if the private key is of the
form (n,d), then the problem becomes intractable. To derive
the public key, one needs to factor n, which would take a
long time.
Neil - Salem, MA USA

Neil,

There is no math required, simply import the private key using
GPG and the public key is extracted and added to your keyring.
I have tested and confirmed this with both RSA and DHH keys.

In the words of David Shaw (GPG programmer and one of the

See RFC 4880, sections 5.5.3 and 11.2. ... in OpenPGP, a
secret key is actually the same thing as a public key with a
few extra fields tacked on (the ones specified in 5.5.3).

Forget "separation of public and private key pairs", protect
your private key & passphrase.

[Neil - Salem, MA USA]

Post by Nomen Nescio

"Cyberiade.it Anonymous Remailer"

Post by Cyberiade.it Anonymous Remailer
big snip

Post by Baal
Even amongst those who /did/ have some desire to make use
of encryption, they didn't want to *learn* anything--they
wanted instant gratification, complete with a
point-and-drool interface. As a result, they flocked en-
masse to services like Hushmail that violated the basic
principle of public- key cryptography--i.e. the separation
of public and private key pairs. By keeping both halves of
the keypair, and using a modified Java applet to snag the
passphrase, Hushmail made it simple for law-enforcement to
pierce the veil of secrecy afforded by the encryption;
additionally, since all the alleged perpetrators were
using Hushmail, they provided the authorities, in essence,
with one-stop-shopping or a single point of failure. [*]

big snip
Baal,
WADR, the "separation of public and private key pairs" is
meaningless, if somebody has your private key it is trivial
to extract your public key from it.
The danger is letting someone have your private key and
passphrase.

In the case of an RSA private key, the private key can be in
the form of (n,d) where n is the product of two prime number
p and q, and d is the decryption exponent, or the private key
could be of the form (p,q,d), where p and q are the two
factors of n and d is the decryption exponent.
If the RSA private key is in the form (p,q,d) then you are
correct that it's a trivial matter to extract the public key
from it. On the other hand, if the private key is of the
form (n,d), then the problem becomes intractable. To derive
the public key, one needs to factor n, which would take a
long time.
Neil - Salem, MA USA

Neil,
There is no math required, simply import the private key using
GPG and the public key is extracted and added to your keyring.
I have tested and confirmed this with both RSA and DHH keys.
In the words of David Shaw (GPG programmer and one of the

See RFC 4880, sections 5.5.3 and 11.2. ... in OpenPGP, a
secret key is actually the same thing as a public key with a
few extra fields tacked on (the ones specified in 5.5.3).

Forget "separation of public and private key pairs", protect
your private key & passphrase.

You are, of course, quite correct. In PGP and GPG, one's private key and
public key are stored together as a "key pair" and it is trivial to export
the public key from the key pair.

Also, see my reply to Unruh. My post was not well thought out for which I
apologize.

Neil - Salem, MA USA

[John Smith]

Post by Neil - Salem, MA USA

Post by Nomen Nescio

"Cyberiade.it Anonymous Remailer"

Post by Cyberiade.it Anonymous Remailer
big snip

Post by Baal
Even amongst those who /did/ have some desire to make use
of encryption, they didn't want to *learn* anything--they
wanted instant gratification, complete with a
point-and-drool interface. As a result, they flocked en-
masse to services like Hushmail that violated the basic
principle of public- key cryptography--i.e. the separation
of public and private key pairs. By keeping both halves of
the keypair, and using a modified Java applet to snag the
passphrase, Hushmail made it simple for law-enforcement to
pierce the veil of secrecy afforded by the encryption;
additionally, since all the alleged perpetrators were
using Hushmail, they provided the authorities, in essence,
with one-stop-shopping or a single point of failure. [*]

big snip
Baal,
WADR, the "separation of public and private key pairs" is
meaningless, if somebody has your private key it is trivial
to extract your public key from it.
The danger is letting someone have your private key and
passphrase.

In the case of an RSA private key, the private key can be in
the form of (n,d) where n is the product of two prime number
p and q, and d is the decryption exponent, or the private key
could be of the form (p,q,d), where p and q are the two
factors of n and d is the decryption exponent.
If the RSA private key is in the form (p,q,d) then you are
correct that it's a trivial matter to extract the public key
from it. On the other hand, if the private key is of the
form (n,d), then the problem becomes intractable. To derive
the public key, one needs to factor n, which would take a
long time.
Neil - Salem, MA USA

Neil,
There is no math required, simply import the private key using
GPG and the public key is extracted and added to your keyring.
I have tested and confirmed this with both RSA and DHH keys.
In the words of David Shaw (GPG programmer and one of the

See RFC 4880, sections 5.5.3 and 11.2. ... in OpenPGP, a
secret key is actually the same thing as a public key with a
few extra fields tacked on (the ones specified in 5.5.3).

Forget "separation of public and private key pairs", protect
your private key & passphrase.

You are, of course, quite correct. In PGP and GPG, one's private key and
public key are stored together as a "key pair" and it is trivial to export
the public key from the key pair.
Also, see my reply to Unruh. My post was not well thought out for which I
apologize.
Neil - Salem, MA USA

My web mail has never been with hushmail, I've used this with no
problems: www.privacyoffshore.net

They've got high security pgp set up

[Alfred Matej]

Post by John Smith

Post by Neil - Salem, MA USA

Post by Nomen Nescio

"Cyberiade.it Anonymous Remailer"

Post by Cyberiade.it Anonymous Remailer
big snip

Post by Baal
Even amongst those who /did/ have some desire to make use
of encryption, they didn't want to *learn* anything--they
wanted instant gratification, complete with a
point-and-drool interface. As a result, they flocked en-
masse to services like Hushmail that violated the basic
principle of public- key cryptography--i.e. the separation
of public and private key pairs. By keeping both halves of
the keypair, and using a modified Java applet to snag the
passphrase, Hushmail made it simple for law-enforcement to
pierce the veil of secrecy afforded by the encryption;
additionally, since all the alleged perpetrators were
using Hushmail, they provided the authorities, in essence,
with one-stop-shopping or a single point of failure. [*]

big snip
Baal,
WADR, the "separation of public and private key pairs" is
meaningless, if somebody has your private key it is trivial
to extract your public key from it.
The danger is letting someone have your private key and
passphrase.

In the case of an RSA private key, the private key can be in
the form of (n,d) where n is the product of two prime number
p and q, and d is the decryption exponent, or the private key
could be of the form (p,q,d), where p and q are the two
factors of n and d is the decryption exponent.
If the RSA private key is in the form (p,q,d) then you are
correct that it's a trivial matter to extract the public key
from it. On the other hand, if the private key is of the
form (n,d), then the problem becomes intractable. To derive
the public key, one needs to factor n, which would take a
long time.
Neil - Salem, MA USA

Neil,
There is no math required, simply import the private key using
GPG and the public key is extracted and added to your keyring.
I have tested and confirmed this with both RSA and DHH keys.
In the words of David Shaw (GPG programmer and one of the

See RFC 4880, sections 5.5.3 and 11.2. ... in OpenPGP, a
secret key is actually the same thing as a public key with a
few extra fields tacked on (the ones specified in 5.5.3).

Forget "separation of public and private key pairs", protect
your private key & passphrase.

You are, of course, quite correct. In PGP and GPG, one's private key
and public key are stored together as a "key pair" and it is trivial
to export the public key from the key pair.
Also, see my reply to Unruh. My post was not well thought out for
which I apologize.
Neil - Salem, MA USA

My web mail has never been with hushmail, I've used this with no
problems: www.privacyoffshore.net
They've got high security pgp set up

Be careful, because even Hushmail can be required by a court
order to intercept your passphrase on their web login. Also,
the laws in the country the servers are located may be
different. An example, the US govt needs more than just a
subpoena to get your emails that are held on the server.

If everything is encrypted, no big deal. But I would be wary
of having to enter your passphrase using your web browser since
that isn't as secure as just encrypting the message on your
computer vs having hushmail do it on their server.

[Marc Moisan]

This does not mean that PGP is broken. If the private key was stored on
that same machine, it would possible to crack it through brute-force
password guessing... And it would very easy if it wasn't a strong
passphrase. There might also be other explanations, but unless they had
access to the private key somehow I don't see how the authorities could
so easily decipher PGP encrypted files.

Marc Moisan, C.D.

Post by Wolstan Dixie
Four Animal Liberation Front activists have been found guilty in
Britain. Guardian, 24 Dec 2008 p 6 "Officers deciphered encrypted
emails . . . . . . and deciphered spreadsheets found on their
computers . . . . "
Pretty certainly they were using PGP.

[Box750]

Post by Wolstan Dixie
Four Animal Liberation Front activists have been found guilty in
Britain. Guardian, 24 Dec 2008 p 6 "Officers deciphered encrypted
emails . . . . . . and deciphered spreadsheets found on their
computers . . . . "
Pretty certainly they were using PGP.

The Animal Liberation Front has a different version of the story

http://www.animalliberationfront.com/ALFront/AgainstALF/ARAhitwithRIPA.htm

Animal rights activist hit with RIPA key decrypt demand

An animal rights activist has been ordered to hand over her encryption
keys to the authorities.

Section Three of the Regulation of Investigatory Powers Act (RIPA) came
into force at the start in October 2007, seven years after the original
legislation passed through parliament. Intended primarily to deal with
terror suspects, it allows police to demand encryption keys or provide
a clear text transcript of encrypted text.

Failure to comply can result in up to two years imprisonment for cases
not involving national security, or five years for terrorism offences
and the like. Orders can be made to turn over data months or even years
old.

The contentious measure, introduced after years of consultation, was
sold to Parliament as a necessary tool for law enforcement in the fight
against organised crime and terrorism.

But an animal rights activist is one of the first people at the
receiving end of a notice to give up encryption keys. Her computer was
seized by police in May, and she has been given 12 days to hand over a
pass-phrase to unlock encrypted data held on the drive - or face the
consequences.

The woman, who claims to have not used encryption, relates her
experiences in an anonymous posting on Indymedia.

"Now apparently they have found some encrypted files on my computer
(which was stolen by police thugs in May this year) which they think
they have 'reasonable suspicion' to pry into using the excuse of
'preventing or detecting a crime'," she writes.

"Now I have been 'invited' (how nice, will there be tea and biccies?)
to reveal my keys to the police so they can look at these files. If I
do not comply and tell them to keep their great big hooters out of my
private affairs I could be charged under RIPA."

The woman says that any encrypted data put on the PC must have been put
there by somebody else.

"Funny thing is PGP and I never got on together I confess that I am far
too dense for such a complex (well to me anyway) programme. Therefore
in a so-called democracy I am being threatened with prison simply
because I cannot access encrypted files on my computer."

She argues that even if she had used encryption she'd be disinclined to
hand over her pass phrase. "The police are my enemy, I know that they
have given information about me to Huntingdon Life Sciences (as well as
hospitalising me)," she writes. "Would I really want them to see and
then pass around private communications with my solicitors which could
be used against me at a later date in the civil courts, medical
records, embarrassing poetry which was never meant to be read by anyone
else, soppy love letters or indeed personal financial transactions?"

Indymedia reports that similar demands have been served against other
animal rights activists, a point we have not been able to verify.

[JTF]

Plausible Deniability as the files are on her computer, but could have
been placed there by another party through a windows share C$ is
always shared as is Admin$.

I have files on my kid's computer as well as my wife's computer that I
placed there via shares......

Encryption is useless if the law will require compliance to give up
keys which will then compromise other data not related to the "crime".

Post by Box750

Post by Wolstan Dixie
Four Animal Liberation Front activists have been found guilty in
Britain. Guardian, 24 Dec 2008 p 6 "Officers deciphered encrypted
emails . . . . . . and deciphered spreadsheets found on their
computers . . . . "
Pretty certainly they were using PGP.

The Animal Liberation Front has a different version of the story
http://www.animalliberationfront.com/ALFront/AgainstALF/ARAhitwithRIP...
Animal rights activist hit with RIPA key decrypt demand
An animal rights activist has been ordered to hand over her encryption
keys to the authorities.
Section Three of the Regulation of Investigatory Powers Act (RIPA) came
into force at the start in October 2007, seven years after the original
legislation passed through parliament. Intended primarily to deal with
terror suspects, it allows police to demand encryption keys or provide
a clear text transcript of encrypted text.
Failure to comply can result in up to two years imprisonment for cases
not involving national security, or five years for terrorism offences
and the like. Orders can be made to turn over data months or even years
old.
The contentious measure, introduced after years of consultation, was
sold to Parliament as a necessary tool for law enforcement in the fight
against organised crime and terrorism.
But an animal rights activist is one of the first people at the
receiving end of a notice to give up encryption keys. Her computer was
seized by police in May, and she has been given 12 days to hand over a
pass-phrase to unlock encrypted data held on the drive - or face the
consequences.
The woman, who claims to have not used encryption, relates her
experiences in an anonymous posting on Indymedia.
"Now apparently they have found some encrypted files on my computer
(which was stolen by police thugs in May this year) which they think
they have 'reasonable suspicion' to pry into using the excuse of
'preventing or detecting a crime'," she writes.
"Now I have been 'invited' (how nice, will there be tea and biccies?)
to reveal my keys to the police so they can look at these files. If I
do not comply and tell them to keep their great big hooters out of my
private affairs I could be charged under RIPA."
The woman says that any encrypted data put on the PC must have been put
there by somebody else.
"Funny thing is PGP and I never got on together I confess that I am far
too dense for such a complex (well to me anyway) programme. Therefore
in a so-called democracy I am being threatened with prison simply
because I cannot access encrypted files on my computer."
She argues that even if she had used encryption she'd be disinclined to
hand over her pass phrase. "The police are my enemy, I know that they
have given information about me to Huntingdon Life Sciences (as well as
hospitalising me)," she writes. "Would I really want them to see and
then pass around private communications with my solicitors which could
be used against me at a later date in the civil courts, medical
records, embarrassing poetry which was never meant to be read by anyone
else, soppy love letters or indeed personal financial transactions?"
Indymedia reports that similar demands have been served against other
animal rights activists, a point we have not been able to verify.
--
Privacylover:http://www.privacylover.com

[Marc Moisan]

Post by JTF
Encryption is useless if the law will require compliance to give up
keys which will then compromise other data not related to the "crime".

Indeed that would not only compromise all data encrypted with those keys
but can potentially compromise the key as a signing key as well... I am
not from the UK, but if I was I'd be very concerned with such a law...
Anyone knows where I can get the actual wording... I want to see if the
law actually ask to end over the private keys or only to make them
available to decrypt files as ordered by the Courts.

Marc Moisan, C.D.

[Paul Vigay]

Post by Marc Moisan
Indeed that would not only compromise all data encrypted with those keys
but can potentially compromise the key as a signing key as well... I am
not from the UK, but if I was I'd be very concerned with such a law...
Anyone knows where I can get the actual wording... I want to see if the
law actually ask to end over the private keys or only to make them
available to decrypt files as ordered by the Courts.

RIPA (Regulation of Investigatory Powers Act) 2000, section 3 - see
http://www.opsi.gov.uk/acts/acts2000/ukpga_20000023_en_1

[JTF]

Post by Marc Moisan
Indeed that would not only compromise all data encrypted with those keys
but can potentially compromise the key as a signing key as well... I am
not from the UK, but if I was I'd be very concerned with such a law...
Anyone knows where I can get the actual wording... I want to see if the
law actually ask to end over the private keys or only to make them
available to decrypt files as ordered by the Courts.

RIPA (Regulation of Investigatory Powers Act) 2000, section 3 - seehttp://www.opsi.gov.uk/acts/acts2000/ukpga_20000023_en_1
--
Paul Vigay                         __\\|//__                 Life,
                                   (` o-o ')             the Universe
---http://www.vigay.com/--------ooO-(_)-Ooo----------- & Everything ------
Quality Internet Services, Broadband & Hosting -www.orpheusinternet.co.uk

Unfortunately, once the police case is done, there are those who may
make copies of the keys and use them for fraudulent reasons........Say
it don't happen....look around at what happens when cops have access
to drug lockers or other things.......data theft is almost
undetectable unless there is constant forensics exams of systems.....

[Marc Moisan]

Thanks Paul,

BTW, the text states:

"...has given a direction that the requirement can be complied with only
by the disclosure of the key itself."

That makes the answer to my question quite clear... but that also makes
the whole electronic signature scheme in jeopardy if you ask me.

As JTF wrote, once the key is in the hand of the authorities (or anyone
else but the owner for that matter) we can only consider the key as
compromised. I am not a privacy rights activists, but I see many things
wrong with this. UK is a democracy right?

Marc Moisan, C.D.

[JTF]

Post by Marc Moisan
Thanks Paul,
"...has given a direction that the requirement can be complied with only
by the disclosure of the key itself."
That makes the answer to my question quite clear... but that also makes
the whole electronic signature scheme in jeopardy if you ask me.
As JTF wrote, once the key is in the hand of the authorities (or anyone
else but the owner for that matter) we can only consider the key as
compromised. I am not a privacy rights activists, but I see many things
wrong with this. UK is a democracy right?
Marc Moisan, C.D.

Actually, this is where having a revocation certificate in the hands
of a third party would help...Once the "phone call" is made, the
revocation can be made immediately from the outside.

[Kiko]

Post by Marc Moisan
As JTF wrote, once the key is in the hand of the authorities (or anyone
else but the owner for that matter) we can only consider the key as
compromised. I am not a privacy rights activists, but I see many things
wrong with this. UK is a democracy right?

No it isnt, the UK has no Constitution.

[NF_011909063216]

Post by Marc Moisan
As JTF wrote, once the key is in the hand of the authorities (or anyone
else but the owner for that matter) we can only consider the key as
compromised. I am not a privacy rights activists, but I see many things
wrong with this. UK is a democracy right?
Marc Moisan, C.D.

England is not a democracy and never has been - which is not to say that ALL
of our politicians are corrupt or incompetent.

[Unruh]

Post by NF_011909063216

Post by Marc Moisan
As JTF wrote, once the key is in the hand of the authorities (or anyone
else but the owner for that matter) we can only consider the key as
compromised. I am not a privacy rights activists, but I see many things
wrong with this. UK is a democracy right?
Marc Moisan, C.D.

England is not a democracy and never has been - which is not to say that ALL
of our politicians are corrupt or incompetent.

Corruption and incompetence does not nullify a democracy.
The problem is that most people support measures like that, and in a
democracy, majority rules. Limitations on government to support minority
rights are non-democratic. After all it is
only the terrorists and criminals that have to fear the law, isn't it:-)

[Borax Man]

Post by Unruh

Post by NF_011909063216

Post by Marc Moisan
As JTF wrote, once the key is in the hand of the authorities (or anyone
else but the owner for that matter) we can only consider the key as
compromised. I am not a privacy rights activists, but I see many things
wrong with this. UK is a democracy right?
Marc Moisan, C.D.

England is not a democracy and never has been - which is not to say that ALL
of our politicians are corrupt or incompetent.

Corruption and incompetence does not nullify a democracy.
The problem is that most people support measures like that, and in a
democracy, majority rules. Limitations on government to support minority
rights are non-democratic. After all it is
only the terrorists and criminals that have to fear the law, isn't it:-)

You can only truly use the term democracy, if the people are free to
support the government which best supports them. In this case, people
are coerced or tricked into believing that the proposed actions of a few
power mongers are in their best interests. Those that seek to oppose
the status quo are enemies of the state and treated accordingly.

In any population, 95% of the population tend to be passive and follow
the 5% who actively seek to change opinion, to change the status quo,
question and challenge. It is a fairly trivial challenge then to pick
out that small proportion of the population and make them out as agents
against the state, when in reality they are working for the interests of
the silent majority.

For true democracy to work, it requires a population where EVERY member
actively takes an interest in their government, where EVERY member
thinks independantly irresepetive of propaganda from media and where
EVERY member has the fortitide to stand in thier best interests.

I think quite clearly, this is not the case. Democracy is the cattle
dog leading the sheep, telling the sheep they are going where they
choose to go. So no, I do not believe England has ever had a true
Democracy, or Australia. The USA might have had, for a little while.

In this case, because most people either have little knowledge of PGP,
have little reason to, or more accurately the fortitude to resist
attemps to curtail their privacy and right to privacy, it really matters
very little what the opinion of the majority is.

Is there any democracy in the world where the government HAS to act
according to the opinions of the majority? Is there one where the
government MUST be subject to the will of the people and cannot use
their position to work around this?

I can't think of one.

[Borked Pseudo Mailed]

Post by Borax Man
I think quite clearly, this is not the case. Democracy is the
cattle dog leading the sheep, telling the sheep they are going where
they choose to go. So no, I do not believe England has ever had a
true Democracy, or Australia. The USA might have had, for a little
while.

Hell the "USA" has that now. England is a monarchy, Australia is a
penal colony. I mean what did you expect?

The American Constitution guarantees "to every State a Republican form
of Government..." You will not find the word democracy anywhere in the
Declaration of Independence or in the Constitution, but you will find
it in the debates and in the Federalist and Anti Federalist Papers. A
democracry is one of the evil forms of government the American
Founders wanted desperately to avoid.

America was a republic, it has since degenerated into a democracy.
Democracy is mob rule, if you must know. Fifty % + 1 vote rules.

[Charlie Kroeger]

Post by Borked Pseudo Mailed
America was a republic, it has since degenerated into a democracy.
Democracy is mob rule, if you must know. Fifty % + 1 vote rules.

In the USA the 'electoral college' solidifies this rule and opens
the way to voter fraud like what happened in Florida in 2000 and
Ohio in 2004. Voter machines with proprietary codes made it happen
in Ohio. Good old fashion fraud did the job in Florida. In my view
that curious device [electoral college] should be replaced with
proportional representation, an improved type of democracy.

PR Democracy would of course create a larger legislative body with
more noise and that's always anathema to the elite, i.e. those with
tendencies to rule, so I don't expect change will come.

[g***@humbug.net]

On Sun, 29 Mar 2009 14:15:23 -0400, Charlie Kroeger

Post by Charlie Kroeger

Post by Borked Pseudo Mailed
America was a republic, it has since degenerated into a democracy.
Democracy is mob rule, if you must know. Fifty % + 1 vote rules.

In the USA the 'electoral college' solidifies this rule and opens
the way to voter fraud like what happened in Florida in 2000 and
Ohio in 2004. Voter machines with proprietary codes made it happen
in Ohio. Good old fashion fraud did the job in Florida. In my view
that curious device [electoral college] should be replaced with
proportional representation, an improved type of democracy.

This is not a democracy and never has been, its a representative
republic. The electoral college was designed to prevent states with
large populations from having total sway over those with sparse
population thereby insuring all the people have a say in who
represents them in the presidency. The rest of your statement is pure
conspiratorial BS.

Post by Charlie Kroeger
PR Democracy would of course create a larger legislative body with
more noise and that's always anathema to the elite, i.e. those with
tendencies to rule, so I don't expect change will come.

If it ever changes tyranny will not be far behind.

[Charlie Kroeger]

Post by g***@humbug.net
If it ever changes tyranny will not be far behind.

do explain what you mean and how this will happen.

[g***@humbug.net]

On Mon, 30 Mar 2009 16:13:33 -0400, Charlie Kroeger

Post by Charlie Kroeger

Post by g***@humbug.net
If it ever changes tyranny will not be far behind.

do explain what you mean and how this will happen.

Take a look around you, its happening right now even without the
electoral college being abolished. The largely ignorant masses rose up
and elected a hard left president who is hell bent on socializing the
US economy no matter what the cost in dollars or freedom.

[Borax Man]

Democracy isn't really mob rule. Democracy is a system in place to
legitimize power. "Majority rule" does not apply as modern democracies
are representative democracies, where people cannot partake in politics,
but 'elect' someone to represent us. People are elected into power,
with the fact that they recieved more votes than the next fellow being
the 'legitimising factor'.

Quite simple, the Pharoah could do what he liked because the people
believed he was divine and this divinity game him licence. Catholocism
has its papal infalibility, Timarchies authorise their power by force
and Hitler had the 'Fuhrerprincip'. Unless you are willing to hold your
power completely by force, you need to create an ideological system
which you can refer to, and teach the people in to legitimise your power
and get the population to accept that you have authority over them.
Modern Democracy is one such system.

Post by g***@humbug.net
On Mon, 30 Mar 2009 16:13:33 -0400, Charlie Kroeger

Post by Charlie Kroeger

Post by g***@humbug.net
If it ever changes tyranny will not be far behind.

do explain what you mean and how this will happen.

Take a look around you, its happening right now even without the
electoral college being abolished. The largely ignorant masses rose up
and elected a hard left president who is hell bent on socializing the
US economy no matter what the cost in dollars or freedom.

[Charlie Kroeger]

Post by Borax Man
Democracy isn't really mob rule.

Post by g***@humbug.net
On Mon, 30 Mar 2009 16:13:33 -0400, Charlie Kroeger
The largely ignorant masses rose up
and elected a hard left president who is hell bent on socializing the
US economy no matter what the cost in dollars or freedom.

Hold on there Borax Man..careful who you quote. That piece at the end is
actually written by a member of the ignorant masses called ***@humbug.net

I do not wish to be associated with that member.

[g***@humbug.net]

On Sat, 25 Apr 2009 11:02:34 -0400, Charlie Kroeger

Post by Charlie Kroeger

Post by Borax Man
Democracy isn't really mob rule.

Post by g***@humbug.net
On Mon, 30 Mar 2009 16:13:33 -0400, Charlie Kroeger
The largely ignorant masses rose up
and elected a hard left president who is hell bent on socializing the
US economy no matter what the cost in dollars or freedom.

Hold on there Borax Man..careful who you quote. That piece at the end is
I do not wish to be associated with that member.

Nor do I wish to be associated with anyone who demonstrably either
doesn't understand and accept the confines of limited national
government laid out in the constitution or willfully ignores them.

[Casey]

Post by g***@humbug.net
On Sat, 25 Apr 2009 11:02:34 -0400, Charlie Kroeger

Post by Charlie Kroeger

Post by Borax Man
Democracy isn't really mob rule.

Post by g***@humbug.net
On Mon, 30 Mar 2009 16:13:33 -0400, Charlie Kroeger
The largely ignorant masses rose up
and elected a hard left president who is hell bent on socializing the
US economy no matter what the cost in dollars or freedom.

Hold on there Borax Man..careful who you quote. That piece at the end is
I do not wish to be associated with that member.

Nor do I wish to be associated with anyone who demonstrably either
doesn't understand and accept the confines of limited national
government laid out in the constitution or willfully ignores them.

Does this thread somehow lead to how to break PGP??
Casey

[h***@hotspot.net]

m.

Post by Casey
Does this thread somehow lead to how to break PGP??
Casey

Oh, PLEEEEZE! Don't get THAT started again!!

[Borax Man]

Post by h***@hotspot.net
m.

Post by Casey
Does this thread somehow lead to how to break PGP??
Casey

Oh, PLEEEEZE! Don't get THAT started again!!

Well it doesn't, and this is a GPG/PGP forum.