April 1993 - cypherpunks-legacy

RE: Tough Choices: PGP vs. RSA Data Security
by Pat Farrell 29 Apr '93

29 Apr '93

Tim may is starting to sound like a Suit. :-) I agree strongly that we need RSA on our side, not against us. I don't know the history of the animosity between Jim B and Phil Z, but I think it is time to say that water is over the dam. Several folks have suggested here, and in the usual feeds, that it wouldn't appear to be all that hard to take RSAREF and use it as the key exchange engine for a US-legal PGP. Or even to take the PGP source and use it as an enhanced RSAREF. I haven't looked at either source, but I have to believe that someone on the list has. Is there a technical reason why this can't be done? Is there some hidden political reason that it can't be done? The readers of this list are hardcore and facile with techninology. To get the widespread support we need kill the wiretap chip, we need to get "easy to use" strong cryptography into the mass market. I'm writing a Windows-based POP client designed for folks that can't spell SLIP. It should have strong encryption invisibly and automatically. It won't until there is a legal encryption engine with at least the key management of PGP. Pat Pat Farrell Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

1 0

Re: HELP! Some nut is threatening to sue!
by fig＠eff.org 29 Apr '93

29 Apr '93

At 9:31 PM 4/28/93 -0600, Stanton McCandlish wrote: If it is the Real Shit, It looks like the Real Shit to me, Stanton. I don't know anyone who has stonewalled Bidzos, so I don't know if he has actually taken legal action against a PGP distributor. But that's the guy (assuming it's not forged mail). <<*>><<*>><<*>><<*>><<*>><<*>><<*>><<*>> Cliff Figallo fig(a)eff.org EFF Online (617)576-4506 (voice)

1 0

A link encryption protocol to crytique ;-)
by Nickey MacDonald 29 Apr '93

29 Apr '93

Okay folx, tear this apart... I running on little sleep, but after thinking about this for a couple of hours (mostly while trying to document it...) I can't see any obvious holes... If no one points out any significant deterrants, I will code this up in C and release the code to the public domain (I'll get it put on soda...) I should comment, that this is not meant to be the best link encryption protocol available... the NSA (or others of their TLA friends) can monitor my sessions if they really want to... but this should at least provide a minor stumbling block... Also, I'm not a math major, so my version of a "technical" description of how to do this may upset the mathematicians among us... I did it the way it is cause it seem straight forward that way... I hope it actually makes sense to someone besides me... I hope it is general enuff (while writing this I had fixed values in mind, like 256 byte packets, so I may have let some of the constants creep in without noticing... I hope not, please point out these things)... Anyway, here it is, for whatever its worth... Oh, for irony's sake, I must admit that it was all the "clipper" discussion that got me thinking, and the use of I1 & I2 reflect this... hehehehe! --- Cut here --- Protocol proposal for a peer to peer encrypted link --------------------------------------------------- The goal of this algorithm was to be fast and not easily subject to a known plaintext attack, as the data bytes in B[] will be highly structured. x^y=the result of x exclusive ORed with y v[x..y]=a vector with positions indexed from x up to y (inclusive) v[i]=index into an an vector v for position i v[]=the list of all values in vector v CRC(v[])=caculate a CRC checksum on the data bytes in vector v N=number of user data bytes per packet D=N+sizeof(CRC(B[])) (for ease in generating I, should be a power of 2) S=D+sizeof(I)*2 B[0..N-1]=the N user data bytes C[0..D-1]=a work buffer filled from B[], CRC(B[]) P[0..S-1]=the outgoing packet K1 & K2=two random "session" keys of length P I=packet rearrange index (range of 0 up to D-1) I1 & I2=the two generators of I (range of 0 up to D-1) T[0..(2^sizeof(I))-1]=array of vectors of size D L=number of times to iterate the shuffle function total size of data D=N + sizeof(CRC(B[])) total size of each packet S=sizeof(I)*2 + N + sizeof(CRC(B[])) Exchanged in advance of any packets being sent (by a public key mechanism for example) are N, sizeof(I), sizeof(CRC(B[])), K1, K2, T. K1 and K2 are generated randomly, but checked to insure that K1[i] does not equal K2[i]. T[i] is generated by a pseudo random process, similar to shuffling a deck of cards. For each i, fill the vector with the values 0 to D-1. Then two random indexes (j & k) are chosen (to be different) and the two values at T[i,j] and T[i,k] are swapped. This can be iterated an arbitraty number of times (L) to ensure a good "shuffle" of the values. To encrypt each packet P: - Generate a random index (I) by generating two random values for I1 and I2 and exclusive OR'ing them together. I is not transmitted as part of the packet - Copy the values in B[i] to C[T[I,i]] for all values of i=0 up to N-1. - Copy the individual bytes from CRC(B[]) into C by indexing T[I,x] for x=N up to D-1. - Form the packet: P[0..D-1]=C[], P[D..D+sizeof(I)-1]=I1, P[D+sizeof(I)..S-1]=I2 - Replace each value of P[i] with P[i]^K1[i]^K2[i] for all values of i=0..S-1. - Transmit P[i] for all values i=S-1 down to 0. Explanatory comments: - Exclusive OR was chosen beacuse it executes so quickly on most machines. - The asumption was that just using a single key K1 would not be strong enough, so thus there are two. - Sending I as I1 and I2 gives more appranent choices of values, without requiring T to be extremely large. This is in hopes of further hindering any known plaintext attacks. - P is transmitted backwards merely so that I1 & I2 arrive first, to aide the decryption process. (Quite honestly this was done to make the above description of the assemblage of P a little easier to write, as putting I1 & I2 in first would have meant more calculation to yield the offsets of the sub parts of P eg. "P[0..D-1]=C[] would have become "P[sizeof(I)..sizeof(I)+D-1]=C[]" which is not as easily understood.) To decrypt each packet P: - As each byte comes in, it is stored into P[i] for values of i=S-1 down to 0. - Replace each value of P[i] with P[i]^K1[i]^K2[i] for all values of i=0..S-1. - I1=P[D..D+sizeof(I)-1]=I1, I2=P[D+sizeof(I)..S-1]. - I=I1^I2. - C[]=P[0..D-1]=C[]. - Copy the values in C[T[I,i]] to B[i] for all values of i=0 up to N-1. - Verify that CRC(B[]) equals C indexed T[I,x] for x=N up to D-1. - If the CRC verifies, the the data values have been transmitted and reside in B[] to be used. --- Cut here --- { God I hope I don't look like too much of a fool... ;-) } --- Nick MacDonald | NMD on IRC i6t4(a)jupiter.sun.csd.unb.ca | PGP 2.1 Public key available via finger

1 0

Some ideas, thats all...
by crunch＠netcom.com 29 Apr '93

29 Apr '93

Who wants to collaborativly work on an information packet containing a collection of the previous reports on the wiretap chip, such as the initial white house statement, CPSR's and EFF's responses, list of questions that were hashed at the last Cypherpunks meeting, etc, etc. A smaller and easier to read infomation packet should be prepared to hand out at raves. These should be fairly simple, easy to read and comprehend while on LSD, and other drugs, and also easy to fold up and tuck in your jacket pockets for later reading. Included might be a diskette containing PGP and a "Bone head" starter "readme" file, with references to additional places where more robust information can be had. I volunteer to check out the rave scene, and do an analysis on how the ravers will respond. :-). I'll also try out various other ways to reach ravers and fill them in. It's most important to point out ways for them to become involved in both spreading the info to others, and if they have computers, how they can use PGP and other encryption software to protect their email and voice calls. In the not to distant future, I will be in various media interviews, and will have opportunity to mention these things, and tell people how they can get more information on what we are doing, and how they can be involved. Anyway, feel free to post this to any other system or network, where appropriate. John D.

1 0

Re: Raving on...
by geoffw＠nexsys.net 29 Apr '93

29 Apr '93

> Brian says: > > >Hmm... the problem is I don't think a majority of the people at raves are > >focused enough to concentrate on something as technical as that (I KNOW it > >isn't technical to you and me, but the average raver doesn't even > >know what the word encryption means). HOWEVER, raves ARE the ideal place > >to hand out info about what's going on, something the raver can cling onto > >to read and understand when he's not high on {vibes,music,drug,etc.}. Give > >pointers to where to get more info or where to obtain PGP, and perhaps > >most importantly, WHY THEY NEED IT. Within a certain amount of time, but > >most likely sooner than any of us anticipate, there will be more people with > >email access than without, so "taking the message to the streets" is becoming > >less and less of a fanciful idea.... Speaking as someone who has been a pretty hardcore raver for almost 2 years now my view on this is as follows: 1) Most ravers don't want to be preached to, they do want to be informed though, the best approach is an "access to tools" approach of invite and education. I think that as of right now, not many ravers even have e-mail, although there is a very organized group that does and is strongly networked already. Some of them know about PGP. We have already discussed whether our e-mail lists should be encryped and the idea was rejected by the group at large. Some of us do send encrypted messages back and forth sort of as a novelty, sort of for practice. I think the best thing to do for this organized group is to educate them and at least get them to generate keys for themselves IF THEY WANT TO. Education is important they have to realize that the key is like a bank card password , you don't tell everbody what it is. Many people are in altered states at raves, this is NOT the set or setting to have them generating keys with pass phrases that they have to remember. 2) I am on a drive to "wire-up" the rave community, in the next issue of CyberTribe-5, I have an article on PGP and why ravers should get hooked up to e-mail. The e-mail advantage is clear for many ravers... the ones who are wired always seem to know where the best parties are. Why we need encryption is not as clear. The scene is about openess, we are well aware that LE folks are most likely on our lists, we don't post the truely underground events anymore to public list. We set up phone trees and private e-mail trees for events like the Full Moon Rave. This has been sufficient to keep the authorities from having preknowledge of our events. I personally hope that most organizers learn about e-mail and at least generate keys in case there comes a time that the Scene really needs secure communication between people (I think this time is not too far off). 3) I have seen some activity by the libertarian party around the rave scene in SF. I've thought this to be curious but as I think about it, it makes sense, many ravers would most likely embrace large portions (but not all) of the libertarian ideals. Most ravers are not overtly political in the classic sense of the word. Although there is sort of a "Politics of Ecstasy" :) so to speak, we find that a lot of the problems that the left is still struggling with like, equality for women and people of color (within their own ranks!) are non-issues for us. We don't need affirmative action policies because as a social group, we are intensely homogenous, when you party with people across race,gender,sexual orientation, lines, it become easy to work with them, you naturally build a network of trust that is multi-cultural. As far as capitalism is concerned many young people in the Scene have developed their own companies from the selling of T-Shirts to "other things" that people buy at raves. They have no great love for "taxation" or interfearence by the "State" The scene is forging its own economic web and they are finding that economic co-operation is more productive then traditional competition, e-mail and encryption can help here. Raving IS a social political statement, sort of like the people in (pre) nazi germany who danced to swing,jazz,blues music which the nazis said was a "degenerate" type of music from the negro. You can go to a rave, dance to socialy unacceptable music, confront Authority with a statement but not land in prison (at least not in this country). Ultimately raving is not just another disco, it IS NOT a pick-up scene as most people going for that reason have discovered, it is not even a drug scene although there is drug use at raves (there are also some folks who have sex). The Scene IS about a persons right to CONSCIOUSNESS, knowledge and the right to think what ever thoughts s/he might want to think using whatever tools are at their disposal. The main goal of the raves that I go to are to reach that ecstatic state that some refer to as "The Vibe". This usually happens in the wee hours of the morning after 2 am when all the alcohol drinkers go home. This state is accessable via drugs but you need the beat as well, advanced ravers don't need the drugs any more to go into trance, this type of trance dancing is little understood in the west but is common throughout africa, india and parts of the middle east. 4) OK so the bottom line is I think that a SIMPLE flier informing these young people what is at stake as far as their present and future freedom of thought/speech/privacy sould be handed out. Low on rethoric, high on information. Have a lap-top available for the advanced ones who know/comprehend what PGP is and want to be able to use it. Don't blindly give out floopies, most will never be used. This message has been long but I wanted to INFORM the group who might have had preconceived ideas about the scene. I am willing to answer any questions that anybody might have, off-line. ------------------------------------------------------------------------------- NEXUS SYSTEMS/CYBERTRIBE-5 : Voice:(415)965-2384 Fax: (415)327-6416 Editor/Instigator/Catalyst : Geoff White <geoffw(a)nexsys.net> Production Crew : Universal Movement Trinity <umt(a)nexsys.net> "They might stop the party, but they can't stop the future" --PGP Public key available upon request-- AT&T:Phones with Big Brother Inside, Just say "NO" to the Clipper wiretap chip! -------------------------------------------------------------------------------

2 1

Re: Raving on...
by Paco Xander Nathan 29 Apr '93

29 Apr '93

"Sent from the cyberdeck of: Geoff White" > > >Hmm... the problem is I don't think a majority of the people at raves are > > >focused enough to concentrate on something as technical as that (I KNOW it > > >isn't technical to you and me, but the average raver doesn't even > > >know what the word encryption means). HOWEVER, raves ARE the ideal place > > >to hand out info about what's going on, something the raver can cling onto Our company, FringeWare, has been out doing brain machine demos at raves for a while.. I'm still trying to catch up on sleep from last weekend's rave construction & show :-) The raves started as socio/politial but in many places have become yet-another-club-hop-for-kids-with-time-to-kill. Even so, sentiments are in the right place, guaranteed. Especially among the *RAVE PROMOTERS* .. The promoters are already sensitive to issues in common with cypherpunks since they tend to be underground operations in the cash economy, etc. Plus, they're HEAVILY networked. As a techno/gonzo journalist, I've found it EASIER to get in with hacker cliques than with rave promoter cliques; granted the real stakes are higher so they take security more seriously :-) Also, I'm intrigued to see the overlap (at least in this area) between ravers and people at EFF-Austin mtgs.. Some of the main u/g promoters even showed up to EFF-A's CopCon a couple weeks back, so the overlap in our agendas is valid. I'd tend to go with the argument that actually signing keys or passing out pamphlets during a rave would be weird and blow the mood. Maybe you'd say "So what?" but to an entertainment promoter, mood means everything and only a few cypherphuckups would spread a terrible image for us. I'm generally the most hi-tech part of these raves, what with the sound/light brain gizmos and even that's too left-brained some ravers.. Most want to experience, not engage in discourse. With pheromones and alkaloids being some of the dominant attractions for people attending, I could agree more :-) Which is why I'd suggest we tag along with the VRrave project, based on IRC connex between concurrent raves. That'd present a hi-tech set & setting and allow for some demo/experience of secure comm. Do what you can to introduce/instruct the local promoters -- but generally they're busy people with better things to worry about, like liability and overhead not somebody else's political agenda. pxn. pacoid(a)wixer.bga.com

1 0

RE: Rave on...
by simonm＠mindvox.phantom.com 29 Apr '93

29 Apr '93

crunch(a)netcom.com (John Draper) writes: > My proposal is to set up a room with a bunch of donated PC's Macs or > whatever, and have a booth set up where people can purchase PGP diskettes While this sounds like a great idea, I'm not sure you'll find many ravers who eill actually use PGP. How many ravers exchange email, but haven't heard of PGP? It seems like only a couple, based on my talking to people about computers at raves. > [...] handout literature can be made available for anyone attending that > describes the "Clipper" proposals, and suggestions on what people can do > to resist further government control over private cryptography. This seems like a more practical tactic. Even just handing out a single or half-page flier about PGP, Clipper, and a couple of other topics would probably get a lot of people to read it. And people at raves are used to others going around handing out interesting things to read. The hard part is coming up with 300 well written words that cover everything that needs to be said, a task I leave in more capable hands. On the other hand, I wouldn't mind lugging my PowerBook 170 down to a rave... If anyone organizes such an event, drop me a line... -- Simon (simonm(a)mindvox.phantom.com)

1 0

Orig. Press Release.
by J. Michael Diehl 29 Apr '93

29 Apr '93

I'm looking for the press release for the wire-tap chip which says that communications manufactures will be "encouraged" to incorporate the "we're-tapped" chip in their products. Any hints would be appreciated. Thanx in advance. +-----------------------+-----------------------------+---------+ | J. Michael Diehl ;-) | I thought I was wrong once. | PGP KEY | | | But, I was mistaken. |available| | +-----------------------------+---------+ | mdiehl(a)triton.unm.edu | "I'm just looking for the opportunity | | mike.diehl(a)fido.org | to be Politically Incorrect! <Me> | | (505) 299-2282 | | +-----------------------+---------------------------------------+

1 0

pgp
by jim＠RSA.COM 29 Apr '93

29 Apr '93

I don't think you're aware of our position on pgp. Unfortunately, you may leave us no choice but to take legal action, which we will unless you cease promotion adn distribution of pgp. The next message will state our position. End forwarded msg---------------------------------------------------------- -- Testes saxi solidi! ********************** Podex opacus gravedinosus est! Stanton McCandlish, SysOp: Noise in the Void Data Center BBS IndraNet: 369:1/1 FidoNet: 1:301/2 Internet: anton(a)hydra.unm.edu Snail: 8020 Central SE #405, Albuquerque, New Mexico 87108 USA Data phone: +1-505-246-8515 (24hr, 1200-14400 v32bis, N-8-1) Vox phone: +1-505-247-3402 (bps rate varies, depends on if you woke me up...:)

1 0

Help find this shareware!
by William Oldacre 29 Apr '93

29 Apr '93

To: >Internet:cypherpunks@toad.com PLEASE HELP ME LOCATE THE FOLLOWING SHAREWARE AND IT'S AUTHORS. The following shareware was removed from Compuserve Information Service because a sysop feared it might be downloaded by someone outside of the United States and get him in trouble. 1 DES Documentation for DESJWW.ZIP IBMPRO/C and C++ [P] DESJWW.DOC 2 Data Encryption Standard (in MSC v5.0) IBMPRO/C and C++ [P] DESJWW.ZIP 3 Knapsack Public-Key Encryption System IBMPRO/C and C++ [P] KNAPSA.ZIP 4 Confide - encryption/decryption program (DES) IBMSYS/File Utilities [S] CONFID.ARC 5 The Private Line (tm) IBMSYS/File Utilities [S] TPL.ARC 6 The Private Line Documentation IBMSYS/File Utilities [S] TPLDOC.ARC I am trying to do a survey of ALL data encryption shareware, especially that based on the DES or RSA algorithm (I have PGP). Can you help? Please contact William Oldacre at: 76114.2307(a)Compuserve.com or William H. Oldacre 6208 N.W. 132nd St. Gainesville, FL 32606 904-332-3010

1 0