Hi all!

I just uploaded OmniMix 0.9.9.5.

It corrects some minor bugs and allows to vary the time interval the
hint window is displayed. Signatures of incoming nym / WME messages
are now interpreted with the result being added to the message header.

Then I addressed a security flaw concerning PGP keys and encrypted nym
/ WME messages (signatures for WME messages are scheduled to be
implemented next). Both carry UTC timestamps related to the moment of
creation resp. signing. So if you encrypt (and by that sign) a nym
message and instantly send it, which is what OmniMix does, an
adversary at the concerning nym server gets knowledge of the exact
shipping time, which makes it a lot easier for him to compromise the
author.

Therefore I now added an option to alter the system time for periods
when PGP is getting involved with such sensitive action. This strategy
is anything but a perfect solution, as an incorrect system time
entails a lot of potential side effects not even limited to OmniMix
itself, which is why it's deactivated by default. However, the PGP
library currently leaves no choice to eliminate this data leakage. It
solely offers to specifiy the key creation time, which in this context
is totally worthless as long as there's no way to influence the
timestamps of signatures, which are part of any key, as well. Any
suggestions that lead to a smarter solution are highly welcome.

You'll find the new version at
http://www.danner-net.de/om/omnimix099.zip.

Kind regards

Christian
--
OmniMix .. protect your privacy
http://www.danner-net.de/om.htm

[ Post a follow-up to this message ]

On 5 Jan 2007 18:14:38 -0000
Christian Danner <---@---.---> wrote:

> Hi all!
>
> I just uploaded OmniMix 0.9.9.5.
>

Doesn't work here with Windows XP sp2, whereas ver 0.9.6 did.
Event Viewer lists:

"Faulting application omnimix.exe, version 0.9.9.5, faulting module
kernel32.dll, version 5.1.2600.2687, fault address 0x00012a23."

Generates a Window's error as soon as the .exe is double clicked, doesn't
install or create any .ini files etc. All .dlls are up to date. Have PGP, JB
N2
and Mixmaster on the system elsewhere, all of which work.

Something I'm doing wrong? Why did it work okay with 0.9.6? 0.99pre is
similarly XXXXed.

[ Post a follow-up to this message ]

Hi!
 
>
>Doesn't work here with Windows XP sp2, whereas ver 0.9.6 did.
>Event Viewer lists:
>
>"Faulting application omnimix.exe, version 0.9.9.5, faulting module
>kernel32.dll, version 5.1.2600.2687, fault address 0x00012a23."
>
>Generates a Window's error as soon as the .exe is double clicked, doesn't
>install or create any .ini files etc. All .dlls are up to date. Have PGP, J
BN2
>and Mixmaster on the system elsewhere, all of which work.
>
>Something I'm doing wrong? Why did it work okay with 0.9.6? 0.99pre is
>similarly XXXXed.

Many thanks for your report.

The major difference between 0.9.6 and 0.9.9 is the nym related PGP
integration. I'm not aware of crashes in connection with specific XP
versions. SP1 and SP2 work well here. But maybe you've a newer PGP
version installed on your system, which is incompatible with the 6.x
PGP DLLs OmniMix requires. With PGP 9 we were trying hard to get
around this problem. AFAIR with patched PGP DLLs at best we got a
complaint at the start of OmniMix with no further problems.

So it would help to know which PGP version you were using outside of
OmniMix and the version of the DLLs that you deployed in the OmniMix
folder.

Kind regards

Christian
--
OmniMix .. protect your privacy
http://www.danner-net.de/om.htm

[ Post a follow-up to this message ]

On 6 Jan 2007 11:19:37 -0000
Christian Danner <---@---.---> wrote:
>
> The major difference between 0.9.6 and 0.9.9 is the nym related PGP
> integration. I'm not aware of crashes in connection with specific XP
> versions. SP1 and SP2 work well here. But maybe you've a newer PGP
> version installed on your system, which is incompatible with the 6.x
> PGP DLLs OmniMix requires. With PGP 9 we were trying hard to get
> around this problem. AFAIR with patched PGP DLLs at best we got a
> complaint at the start of OmniMix with no further problems.
>
> So it would help to know which PGP version you were using outside of
> OmniMix and the version of the DLLs that you deployed in the OmniMix
> folder.
>
Hi Christian

I use PGP ckt 6.5.8 and copied the DLLs fom there (they show version 1.7.8.0
)

Does that help?

[ Post a follow-up to this message ]

Christian Danner wrote:
> Hi all!
>
> I just uploaded OmniMix 0.9.9.5.
>
> It corrects some minor bugs and allows to vary the time interval the
> hint window is displayed. Signatures of incoming nym / WME messages
> are now interpreted with the result being added to the message header.
>
> Then I addressed a security flaw concerning PGP keys and encrypted nym
> / WME messages (signatures for WME messages are scheduled to be
> implemented next). Both carry UTC timestamps related to the moment of
> creation resp. signing. So if you encrypt (and by that sign) a nym
> message and instantly send it, which is what OmniMix does, an
> adversary at the concerning nym server gets knowledge of the exact
> shipping time, which makes it a lot easier for him to compromise the
> author.
>
> Therefore I now added an option to alter the system time for periods
> when PGP is getting involved with such sensitive action. This strategy
> is anything but a perfect solution, as an incorrect system time
> entails a lot of potential side effects not even limited to OmniMix
> itself, which is why it's deactivated by default. However, the PGP
> library currently leaves no choice to eliminate this data leakage. It
> solely offers to specifiy the key creation time, which in this context
> is totally worthless as long as there's no way to influence the
> timestamps of signatures, which are part of any key, as well. Any
> suggestions that lead to a smarter solution are highly welcome.

Can't you change the TZ ? Too bad that only works with whole hours though...

Thomas
--
Falling in love is like being buried alive.
Fun at first but after that it sucks

[ Post a follow-up to this message ]

Hi Thomas!

Thomas J. Boschloo wrote:

>Christian Danner wrote:
[vbcol=seagreen] 
>
>Can't you change the TZ ? Too bad that only works with whole hours though...[/vbcol
]

PGP always stores UTC timestamps. Time zone information isn't passed
on. Window's system time works the same way. The local time changes
according to the selected time zone leaving the UTC system time
unchanged. That's why you have to alter the time itself in order to
disguise the real parameters.

IMHO only a 'PGPOSignatureDate' option would get us out of this
misery.

Kind regards

Christian
--
OmniMix .. protect your privacy
http://www.danner-net.de/om.htm

[ Post a follow-up to this message ]

Hi!

Anonymous <nobody@mixmin.net> wrote:

>I use PGP ckt 6.5.8 and copied the DLLs fom there (they show version 1.7.8.
0)
>
>Does that help?

That's exactly what works here without any problem on a dual-boot
system with

- XP SP1 (kernel.dll 5.1.2600.1106 - xpsp1.020828-1920) and
- XP SP2 (kernel.dll 5.1.2600.2180 - xpsp_sp2_rtm.040803-2158),

the first-mentioned with GnuPG, the latter with PGP 6.5.8 ckt
installed. OmniMix uses PGP 6.5.8ckt build 08 DLLs with

hashcash.dll (version n/a):
 5CE7AEB4AD07D6556B42B96C9094AC00063AE4EB
2737D3D407CDF13733C1EC4D
libeay32.dll v0.9.8.4:
 6CD380112FCC9970D1A3A93957AD63280DF2C346
46086C1DE5B8D29BE06AF084
ssleay32.dll v0.9.8.4:
 A6738AEC9249114DF395246AB0660466E3513A8D
F5BEAD70BCA952D97AF687CF
PGP_SDK.dll v1.7.8.0:
 8D1BFA9D6E3CEC804B6401B67E0FE44A6312F70B
057B774551B5BCCE84C5B60C
PGPsdkNL.dll v1.7.8.0:
 AEEDD4771D38FE0E1429799FDB70A10822D7894F
0F5BA511ECD9173A696B345A
PGPsdkUI.dll v1.7.8.0:
 53E9E1CA947989AC98706F360F01E4B977E602B8
CCD96F73120CE9CBA25955F3
mix\mix.exe (version n/a):
 CCC67548B37FC0E2C73334EFDBDCC05DF01A0847
30094D07CE0872E25E5D9D7A
mix\mixlib.dll (version n/a):
 5CAAC23351E14C74FD4B3F15801A948643C1D13B
ACFC43A45A57F6142924AE16
mix\libeay32.dll (version n/a):
 50593BBF017B95C5307ADE277BC9EC77EAA0E1F9
C3A1042DAB1F2D84894E7D20

and runs flawlessly from both OS. So I think it's something else, but
unfortunately have no idea where to start. Maybe another user also
experienced the behaviour you described and can help to find
similarities in your configurations. I'm sorry.

Kind regards

Christian
--
OmniMix .. protect your privacy
http://www.danner-net.de/om.htm

[ Post a follow-up to this message ]

>(signatures for WME messages are scheduled to be implemented next).

Done.

Christian
--
OmniMix .. protect your privacy
http://www.danner-net.de/om.htm

[ Post a follow-up to this message ]

>>(signatures for WME messages are scheduled to be implemented next).
>
>Done.

WME capability added to the 'anonymous mail' branch as well.

As a result within a circle of friends mails can now be exchanged
end-to-end whole-message-encrypted without allowing an observer to
assign the originator to the recipient. Replies are done the normal
way (also optionally with WME / OR) provided that the decrypted
message contains the originator's true 'From' / 'Reply-To' address.

Be aware that the WME features aren't well tested yet! I urge you to
observe the 'Raw Data' output and request to report any odd result.
It's still better to deactivate WME (WME > Control > Mode: Disabled)
if you already have added keys and participants to the WME lists but
don't intend to use it any longer.

Regards

Christian
--
OmniMix .. protect your privacy
http://www.danner-net.de/om.htm

[ Post a follow-up to this message ]

On 5 Jan 2007 18:14:38 -0000, Christian Danner wrote:

> Hi all!
>
> I just uploaded OmniMix 0.9.9.5.
>
>
> You'll find the new version at
> http://www.danner-net.de/om/omnimix099.zip.
>
> Kind regards
>
> Christian

I could not send newsgroup messages with previous versions and I still
can't, and for the same reason.

14:58:28.218 0 Message converted
14:58:28.234 0 Processing message with Mixmaster ...
14:58:28.531 0 Waiting for Mixmaster access permission ...
14:58:28.546 0 Calling Mixmaster (parameters: ' -m -c 6 -l deuxpi,*,*,dingo
om\0.mxt') ...
14:58:29.421 0 Mixmaster encryption completed
14:58:29.421 0 Try to retrieve files from the pool 'D:\Program
Files\Omnimix\mix\pool'
14:58:29.421 0 Got 0 chunks for 6 copies
14:58:29.421 0 -------> Mixmaster encryption failed
14:58:29.578 > NNTP State: Disconnecting.
14:58:29.578 > NNTP State: Disconnected.

For some reason Mixmaster doesn't mix with Omnimix for me.

One positive thing I can say about this version is the easy install.

[ Post a follow-up to this message ]