Crypto Free

INTERNATIONAL CRYPTOGRAPHY
FREEDOM

Last Updated 3 February 2001: Add USUC
20.

Please mirror this page, or scavenge it to make your own. Let us know about
additional sites or your page and we’ll make a link.

See also:

Cryptome for news

Ritter’s Learning About
Cryptography

Ritter’s Crypto Glossary
and Dictionary of Technical Cryptography

Mirror: http://come.to/SecureOffice

Available also at USUC 1

Use instead:

PGPFreeware v6.5.8 Windows
95/98/NT/2000

Michael

Paul

Johnson’s

Venerable

Crypto

Site

Diamond 2 Block Cipher source code in dlock2src.zip

Diamond 2 Block Cipher and Sapphire II Stream Cipher Delphi Component in
diacrypt_src.zip

One-time pad source code in onepad_src.zip

Crypto shareware object code in qcrypt11.zip

Ruby Mark 5 Hash Cipher source code in ruby_m5_src.zip

Sapphire II Stream Cipher source code in sapphire_src.zip

Pretty Good Privacy Source Code

Version 6.0.2 Macintosh source code and signature

Version 6.0.2 Windows source code and signature

RSA

RSAEuro RSA toolkit

http://cryptography.org/source/kerbnet/

http://cryptography.org/cgi-bin/crypto.cgi/KerbNet/docs/kerbnet-docs.tgz

http://cryptography.org/cgi-bin/crypto.cgi/KerbNet/release_notes

http://cryptography.org/cgi-bin/crypto.cgi/KerbNet/MD5SUMS

http://cryptography.org/cgi-bin/crypto.cgi/KerbNet/source/kerbnet-source.tgz

http://cryptography.org/cgi-bin/crypto.cgi/KerbNet/source/tcl-source.tgz

The Project was started to make open source cryptographic software freely
available in situations where it difficult to obtain the software from its
original authors.

http://the.wiretapped.net/security/cryptography/

ftp://the.wiretapped.net/pub/security/cryptography/

AusMac Crypto Library

Although the relaxing of US export regulations has reduced some of its
importance, Canada still has a more liberal cryptographic policy for export
and usage. Compared to both the USA (re: export) and UK (re: RIP) it is very
crypto-friendly.

233MB+; Apache-SSL, SSLeay, cryptlib, freeswan, gnupg, mozilla-crypto, pgpi,
ssh, more

See for access procedure:
ftp://ftp.mindlink.net/pub/crypto/README.html

Autosyncing mirrors:

http://munitions.dyn.org/dolphin.cgi?command=index
 — Amsterdam Science Park, The Netherlands

http://munitions.polkaroo.net
— Ottawa, Canada

http://munitions.cifs.org — Sydney,
Australia

http://uk1.munitions.net — Oxford,
UK

http://munitions.firenze.linux.it/
— Italy (Files-only mirror)

<network> <data haven> <email> <anonymizers>
<secure ip> <secure tcp> <ssh> <ssl> <www>
<key mgmt> <libraries> <maths> <pgp> <gnupg>
<system> <kernel> <kerberos> <unix>
<password> <filesystem> <steganography> <voice>

ftp://futuredynamics.com/freecrypto/;
or, if also busted

ftp://202.87.252.100/freecrypto/

Full description:

http://www.kfki.hu/ftp.html#Security

(Not yet active; meanwhile see NZ 1 above)

The archives (when ready) will be stored on a machine for which accesses
are not logged.  It may also allow SSL access (with strong encryption,
obviously), which will include making available dummy files of various sizes
so that it’s not possible to prove (based on traffic analysis) exactly what
was downloaded (« Crypto? Certainly not, I was downloading this paper on the
history of Ethiopian pottery in 4000BC »).

SSLapps, SSLeay, argus, crack5, cracklib, MD5, SHA, l6, satan, ssh, stunnel,
syn, tcp_wrappers, more coming.

http://cryptography.org/cgi-bin/crypto.cgi/libraries/crypto30.zip

http://cryptography.org/cgi-bin/crypto.cgi/libraries/crypto23.zip

Packet Storm is now owned by Kroll-O’Gara, an international security corporation,
thanks to the cowardice of Harvard University and LEA-tool AntiOnline Ahole.
The archive is to be activated in September 1999 (stripped of offensive stuff;
too bad, RIP Infamous Original Packet Storm):
http://www.securify.com/packetstorm/

Tattooman has blessed this
« re-education, » but beware of being snooped at the new site. Tattooman has
zipped-lip since what smells like a forced confession.

ACE demod – Software demodulator for Advanced Composition Explorer
spacecraft telemetry

psn-patch – Linux kernel patch to disable Pentium III CPU serial number


cpuid – x86 CPU identification utility

FEC – Forward error correction with Reed-Solomon, Viterbi and Fano
algorithms updated 5/99

httproute – Web router, ad blocker, cache & cookie cutter

dupmerge – Merge duplicate files in a filesystem

KA9Q NOS – Self-contained TCP/IP stack for DOS

firs.s – Finite impulse response filter for x86

DES – Fast implementation of DES/3DES in x86 asm

We’ve been asked what to mirror if it is not possible to mirror large archives
(200 MB and up), or you can’t easily decide which programs are most
important.

John Gilmore recommends:

The top things I’d suggest for a mirror site are (see sources at sites above):

PGP source code (various versions)

Matching PGP binaries (for easy downloading and use)

SSH source code and matching binaries

SSLEAY – Eric Young’s crypto library from Australia

Kerberos source code (various versions)

IPSEC source code (various versions for BSD and Linux)

Crypto-Mozilla source code (web browser with good crypto)

DNS Security source code (domain name with good crypto)

My criterion for these things is:  what building blocks will people
be able to use every day for to improve their privacy?  And then, what
pieces of infrastructure will permit people to build secure networks that
protect their users?

At first, the archives will be « rough and ready », but as people worldwide
start writing documentation, e.g. « How to secure your MS-Windows system using
this archive », « How to secure your Linux system », etc, it will become easier
for the end users.

Jim Gillogly recommends:

One way to determine which programs are the best for this purpose would be
to study what various governments have taken some action on.  Some obvious
ones (See US 5):

PGP (various versions, high level of
government interest)

Snuffle (extended US litigation
against Daniel Bernstein)

All the AES
candidates (strictly-controlled dissemination from NIST)

SecureOffice (Charles Booher’s program
— US government has taken action)

Applied Cryptography disk (US export
license denied Phil Karn)

It would also be nice to have an infrastructural component, such as (when
ready for mass distribution) the
Linux/FreeSWAN
IPSec release; this doesn’t have quite the cachet of programs on which
the government has already weighed in, though.

Jim Choate recommends that cryptography documentation be mirrored
to encourage understanding and creation of strong encryption — the best
assurance that it will grow and spread.

Mirror whatever you can until better advice for selections comes along. Prime
need: many mirrors of the strongest cryptography, especially anything allowing
the use of key lengths above 40-bits, that is, anything that requires a US
export license for general public use (the US standard appears to be the
model for latest Wassenaar
restrictions). Next, mirror any program that appears to be a target
for latest Wassenaar restrictions as they may be implemented in your country.

For complaints about the restrictions on privacy to be implemented due to
US pressure, contact your government’s cryptography control ministry:
http://www.wassenaar.org/docs/contacts.htm

Note 3: For information on cryptography export
issues see:

Global Internet Liberty Campaign
(GILC)

EFF « Privacy – Crypto
– ITAR Export Restrictions » Archive

John Gilmore’s Cryptography
Export Control Archives

Note 4: More mirror sites are needed in countries
which are not members of the Wassenaar Arrangment so that when the doors
are slammed shut by new WA laws there will still be free sources of strong
encryption. For list of WA members see:
http://www.wassenaar.org/docs/contacts.htm.

Note 5:

From: Richard Stallman <[email protected]>
Subject: Encryption software volunteers needed in countries without
         export control
We need to find volunteers in countries which are not signatories to
Wassenaar to take over development and distribution of encryption
software such as the GNU Privacy Guard and PSST.  We are looking for
(1) an ftp site from which to distribute the software, and (2) people
to carry on the development work.
If you have contacts in any non-signatory country, please circulate
this message as widely as possible in your country, looking for people
who might want to volunteer for GNU software development.
Non-signatory countries that come to mind as possible places where
free encryption software can be developed include Mexico, India,
Croatia, China, South Africa, and perhaps Israel.  However, any
country is ok if its laws do not prevent the work.