May 1993 - cypherpunks-legacy

Inside Dope on Mykotronx
by rclark＠nyx.cs.du.edu 22 May '93

22 May '93

Received from an undisclosed source, for release to all appropriate electronic media, concerning Mykotronx, Inc. The following material was publicly available, but I still am not at liberty to disclose my source: Information: Mykotronx Inc. 357 Van Ness Way (1 blk so. of Del Amo) Suite 200 Torrance CA 90501 (310) 533-8100 fax (310) 533-0527 STU III (310) 533-0738 Founded 1979 Resale # SR-AB 12-711252 Dunn & Bradstreet # 00-611-5281 Banking: Shearson Lehman Brothers Attn: Steve Scerra Acct # 509 24261 12011 21250 Hawthorne Bl Torrance, CA 90509 (310) 540-9511 Employee Names: Bob Gottfried, CEO Leonard J. Baker, President Ralph O' Connell, aka "The Father of COMSEC", NSA Lobbyist Mike Furusawa, Space COMSEC Manager Patti Linahan, Executive Secretary Kikuo Ogawa, Buyer R. Todd, W. Greenfield, KG-44B (Outrunner) Project John C. Droge, Personnel Bob Todd, Manufacturing Manager Landy Riley, Engineering Federal Express Acct # 1122-7492-8 NSA Contact Home Address: Ralph O' Connell 1401 Woodbridge Road Baltimore, MD 21228 (301) 747-6276 Principle NSA Technical Contact: National Security Agency Maryland Procurement Office Attn: N244 (CEB) (MDA904-92-G-0354/J.O. 5001) 9800 Savage Road Fort George G. Meade, MD 20755-6000 (301) 688-8086 NSA Accounting Contact: National Security Agency Maryland Procurement Office Finance and Accounting Office 9800 Savage Road Fort George G. Meade, MD 20755-6000 (301) 859-6715 KG-46 Tactical Decryptor Unit and KG-48B Outrunner Provisioning Conference participants: Robert Todd, Mykotronx Bill Greenfield, Mykotronx G. Burgio, NSA J. Gochnour, NSA J. Wimpy, Air Force Computer Systems Command S. Solis, Air Force Computer Systems Command To Be Discussed at meeting May 18 & 19, 1993 Outrunner Project Milestone Payments: 1. Preliminary Studies $268,074 2/14/92 2. Place Subcontract w/ VLSI $47,917 2/22/92 3. Complete PDR KG-44B $61,431 4/13/92 4. Complete PDR VLSI $71,090 5/19/92 5. Complete SFA Review VLSI $78,470 7/12/92 6. Complete CDR VLSI $106,638 7/17/92 7. Complete first KG-44B $166,641 8/12/92 8. Complete CDR $132,454 6/18/92 9. Complete tests 1st KG-48B $151,957 12/16/92 10. Complete fab VLSI $203,941 11/17/92 11a.Deliver 2 KG-44B to NSA $81,080 9/8/92 11b.Deliver 2 KG-44B to NSA $81,081 10/7/92 12. Complete Cryto Verif VLSI $152,223 12/16/92 13. Deliver 4 KG-44B to NSA $171,571 3/2/93 14a.Deliver 2 KG-44B to NSA $30,432 3/30/93 14b.Deliver 2 KG-44B to NSA $30,432 4/20/93 15. Deliver 4 KG-44B to NSA $60,864 4/24/93 16a.Deliver 1 KG-44B to NSA $15,216 4/28/93 16b.Deliver 3 KG-44B to NSA $45,648 5/12/93 17. Deliver 4 KG-44B to NSA $42,840 5/13/93 Total: $2,000,000 KG-44 VLSI Procurement: United Technologies Microelectronics Center 1575 Garden of the Gods Road Colorodo Springs, CO 80907 (719) 594-8000 fax (719) 594-8032 PO#5703-44ACN1 Feb 19, 1992 Invoice Date Feb 5, 1993 "Customer to pick up parts. Secret item handling. Secret Design KG-44LSI. Mykotronx P/N M20/00301XXX" Government contract # MDA904-92-C-A027 Group C Testing: $4,400 5 Parts @ $675ea $3,375 Job #BE-7281 Group C Samples PIC Number: HP67AG84WTDLC "Note: Group B samples also included with this shipment (ref Packlist #10128" "The export of this product is controlled by the US Government. The export of this product or the disclosure of related technical data to foreign nationals without the appropriate export license is prohibited by law." Test Plan for MYK-80: Statement of Work for Exatron Inc. 5/13/93 Develop test interface board for MYK-80 (176 pin TQFP) and I.M.S. tester. Interface to utilize "particle interconnect" system. Data on MYK-80 I.O. and IMS tester to be supplied by Mykotronx. Interface board to be installed in a work station which utilizes Exatron "PET" handler, tooled for the MYK-80; a vacuum pick-up device (manual, pencil type); work surfaces for JEDEC tray storage and operator support. The IMS tester will mount directly under the "PET" handler. Two "PET" handlers are to be quoted with two sets of specific nesting tools for the MYK-80. Installation in place at Mykotronx and initial operator and maintenance training to be included. Design review of the interface board layout, prior to release of the board to fabrication is to be held at Mykotronx. Manuals and Training Manuals subcontracted to: ELITE Technical Corporation Warren A. Griswold, President 1903 B Marshallfield Lane Redondo Beach, CA 90278 (310) 372-5616 CAPSTONE Financial Commitments by Mykotronx Basic VII Cap VLSI 10 $212,000 Sun 1 Yr maint hw&sw $2,700 Compass $159,400 IKOS Systems & sw $57,500 ELITE Technical Corp $8,000 IMS/Sun $119,000 Versatec Plotter $36,500 SJ (1) $71,200 SJ (2) $76,200 Exatron Test System $78,000 ROM Cell $60,000 AT&T $100,000 Surf Mgt (real estate) $13,900 Universal Shielding (Tempest) $20,600 Plotter maint $5,000 Litronics $225,000 Spyrus (1) $45,600 Spyrus (2) $44,800 Compass (2) $110,000 VLSI Tech $30,000 VLSI Tech (2) $163,000 VLSI Tech CAPSTONE TQFP $10,000 New Media NRE Design $18,700 South Coast Designers $14,600 South Coast $6,000 VLSI Tech Exponeniator Tamper Sys $163,000 Conres logic analyzer $3,200 VLSI Myk-78 tester $33,800 Here are exerpts of the general ledger of Mykotronx, the Torrance Based Big-Brother outfit that is going to make the Clinton Clipper wiretap chip: Period: 01/01/93 to 04/30/93 (first 4 months of 1993) Acct Descr Beg Bal Debits Credits ==1000 series== Shearson Lehman 286,511 2,620,096 2,670,822 Paine Webber 95,602 868 0 Dean Whitter 55,391 484 0 Petty Cash 3,000 0 0 Union bank payroll act 13,408 900,000 816,443 Accts rcvbl -customer 1,185,829 1,981,356 2,562,064 Accts rcvbl - eployees 7,125 48,450 55,575 Franchise tx rcvbl 2,165 0 0 Unbilled costs&fees 567,792 533,347 0 Raw inventory 172,252 0 76,064 Prepaid taxes 1,116 0 0 Prepaid sales tax 688 0 688 Equp/mach/furn 383,038 20,695 0 Accum depreciation 234,425 0 23,000 Deposits 9,272 0 0 ==2000 series== Accts Payable 482,895CR 1,869,477 1,684,555 Sales tax payable 147CR 176 0 Sales tax paid 0 0 0 FIT withheld 0 10,854 135,741 FICA withheld 0 0 56,622 CA state IT withh 0 0 36,163 CA state disability 0 0 8,730 SUI pybl employer 0 0 5,788 FUTA payable 0 0 2,007 FICA employer 0 0 56,621 Pd Payroll txs withh 0 290,820 0 401K withheld 0 0 42,712 Accrued payroll 25,637CR 343,682 318,045 Dental withheld 0 0 674 Dental plan pd 0 674 0 Withh 401K pd 0 42,712 0 Accrued bonuses 214,040 341,240 127,200 [Those are some nice bonuses, aren't they?] Accrued Vacation 44,252 0 0 Excess billings 139,216 154,706 55,036 Gross payroll 0 751,859 0 Gross payroll distrd 0 2,552 754,412 Lease obligations 4,911CR 0 0 ==3000 series== Common Stock 169,320 0 61,435 Capital disbursement 916,675 222,230 0 Retd Earnings, begng 2,385,020CR 0 0 ==4000 series== Sales, returns&allowc 0 6,014 2,577,323 Interest income 0 0 1,353 Int income tax free 0 0 2,490 ==5000 series== Consultants 0 47,395 47,395 Subcontracts 0 932,210 110,419 Other direct costs 0 62,265 5,454 Printing/repro costs 0 542 0 Equipment rental/leasg 0 1,537 1,537 Maint, repairs 0 1,761 0 Delivery 0 3,217 0 Postage 0 960 0 Materials/parts 0 186,252 22,423 Telephone 0 93 0 Travel 0 10,437 0 Inv Cost of Mfg Prod 0 76,064 0 Direct labor-Engnrg 0 240,341 54,172 Direct labor-Technician 0 129,839 37,459 Direct labor-Adminst 0 47,542 10,081 ==6000 series== Indirect labor 0 60,319 0 Holidays 0 32,867 27,331 Sick leave 0 3,276 0 Vacation 0 38,096 25,976 Retroactive pay 0 4,400 0 Job advertisments 0 655 0 Grp Med Ins non sharhl 0 25,522 1,818 Mykotronx pd payrl txs 0 64,417 0 Workers comp 0 9,554 1,418 Interest pd 0 0 0 Consultants 0 2,013 0 ADP Acctg 0 1,493 0 Real World Acct Suppt 0 1,485 0 Bank charges 0 155 0 Blueprints/repro 0 390 0 Proposals 0 2,817 0 Copier expense 0 514 0 Depreciation - elec eq 0 23,000 0 Dues & memberships 0 749 0 Education & Training 0 2,850 0 Employee relations 0 4,531 0 Business expense 0 7,431 0 Equip rental/lsng 0 4,458 0 Computer software 0 2,114 0 Insurance 0 9,061 1,380 Janitorial 0 20 0 Licenses & Permits 0 175 0 Maint, repairs 0 2,096 0 Delivery 0 995 13 Postage 0 942 0 Amort organiz expense 0 0 0 Taxes - franchise 0 2,763 0 Real & Pers prop tax 0 0 0 Rent 0 54,080 0 Subscriptions/books 0 325 0 Office/lab supplies 0 14,183 446 Telephone 0 7,961 36 Travel 0 10,296 1,303 Utilities 0 5,833 0 LTD Ins, non sharehld 0 2,877 594 401K Mykotronx contrib 0 17,411 0 ==7000 series== Special Bonus 0 132,200 123,200 [Special bonus? $132,000.00; I wonder which Federal Agency this money went to.] G&A Labor 0 103,4520 0 Legal Services 0 5,895 0 Board of Dir Expnse 0 1,078 0 Financial Svc 0 7,505 0 Totals 0 12,555,101 12,555,101 Other little items: Locks at Mykotronx installed and maintained by Torrance Lock and Key, 2421 Torrance Bl. Torrance, CA 90501 (310) 320-8840 For some reason, Mykotronx is over 90 days late paying a lousy $50 invoice. Mykotronx has a Mossler safe. It cost $1,693 when they bought it 11/27/90. They have never changed the combination. Outstanding VLSI purchase orders: VLSI Tech (Capstone) $212,000 AT&T (Myk-78) $71,200 Motorola (Myk-77) $76,200 AT&T (Misc) $100,000 Compass (Software) $159,400 VLSI Tech (Myk-78) $66,200 Litronics (PCMCIA Crypto) $225,000 VLSI Tech (Expoteniator) $163,000 VLSI Tech (Capstone TFQP) $10,000 VLSI Tech (Myk-78 fix) $68,500 VLSI Tech (Myk-78A proto) $11,000 VLSI Tech (Myk-78A prod.) $220,000 VLSI Tech (Myk-80 #1) $48,000 VLSI Tech (Myk-80 #2) $33,750 VLSI Tech (Myk-82) $80,000 VLSI Tech (Myk-79) $79,500 Their LAN was installed by Strategies, Inc for about $14,000. More information is forthcoming. Please forward to all appropriate electronic media, and reproduce as desired. Will someone post this to alt.privacy.clipper and sci.crypt, or is this a bad idea? ---- Robert W. Clark rclark(a)nyx.cs.du.edu PGP signature available by mail or finger

1 0

Re: false positives
by catalyst＠netcom.com 22 May '93

22 May '93

>Has anyone tried to create a strong encryption algorithm that cannot >be broken by brute force? ^^^^^^ Brute force = exhaustive search. Therefore, if there is a solution, and the search terminates, the answer will be found. Your point was, can an encryption system be designed such that an exhaustive search yields multiple equally good, different (preferably contradictory) decryptions, for any given encrypted message. In "Communications Theory of Secrecy Systems", Bell Systems Technical Journal, Vol 28, pp. 656-715, Shannon measures the efficacy of an encryption system by the average number of plaintext messages that map to an arbitrary cyphertext (via different keys). Later, Hellman (in "An Extension of the Shannon Theory Approach to Cryptography", IEEE Transactions on Information Theory, vol 23, No. 3, pp. 289-284) emphasized Shannon's point about using compression with encryption so that decryption will yield more false positives. Ross Williams discusses this in his book: "Adaptive Data Compression". Note the limited definition of meaningful in these papers as 'makes words'. Given sufficient context, a correct decryption would not be able to hide in a forest of 'meaningul' false positives. (e.g. "Hmmmm, do you think it's 'cats often enjoy', or 'be ready by tuesday'). Of course, a one time pad affords a very large space of meaningful (much more meaningful than just 'makes words') decryptions for each encryption, hence its information-theoretically perfect security. A system which provides arbitrary mappings at the message level and no derivable component context enjoys this property as well. (e.g. a code book: 1-->be ready by tuesday; 2-->expect a guest. What does the message '1' mean? It can mean any message in the world, exactly as (when using a one time pad) the 17th character might mean any character in the world.) So in answer to your question: yes, a one time pad is just such a system. -- Scott + Scott Collins + "Few people realize what + + catalyst(a)netcom.com | tremendous power there is in one | + of these things." -- Willy Wonka +

5 4

PI Compression
by Kent Hastings 21 May '93

21 May '93

PI Compression It may have been discussed here months ago, but my favorite bogus compression scheme is "pi compression". Any number like pi or SQRT(2) can be represented as an infinite sequence of non-repeating bits (there are repetitive patterns, but eventually the sequence breaks out). A finite bit string can be represented simply as the starting location and length in pi. Since all possible finite bit strings are, by definition, contained in the unending cavalcade of bits in pi, all literary works, radio programs, TV, 3D holos, feelies, etc for all sentient species from the remotest past to the distant future, in every possible alternate universe is in little old pi. PI has been in the public domain from antiquity, therefore all parts of pi are public domain, just like every chapter, paragraph, sentence, word and bit are parts of a book. Who would dare argue against these reasonable assertions? Kent - kent_hastings(a)qmail2.aero.org.

3 2

LISTBIZ: Unsub during my abscence/USA-Legal PGP
by edgar＠spectrx.Saigon.COM 21 May '93

21 May '93

-----BEGIN PGP SIGNED MESSAGE----- Distribution: Cypherpunks Request <cypherpunks-request(a)toad.com> Cypherpunks <cypherpunks(a)toad.com> Please stop sending the Cypherpunks mailing list to edgar(a)spectrx.saigon.com (Edgar W. Swank) until further notice. I anticipate rejoining the list soon after my wife and I return from travel abroad around the end of June. (Since I'm retired I guess I can't say "vacation" or "holiday", can I?) For the general list: I would greatly appreciate it if someONE would save to E-mail me after my return any postings here or to alt.security.pgp about the progress of the USA-Legal PGP project or availability, or any response by Jim Bidzos or RSA to Phil Z's letter of early this month, asking permission to use non-standard RSAREF entry points. -----BEGIN PGP SIGNATURE----- Version: 2.2.1/EWS iQCVAgUBK/yZrt4nNf3ah8DHAQEQVwP8Cx6lG7kR4GnlRyka1B+l1BJisvcxfBGt i/YioZA0WF/4nlFOnj45vMMuPwWLfAFc/BtzjLmk3Iammiw2ZlUfs29rcF9peq+w YWjjVCePIbKE08pYiCUzaSlHT5l1II5Fl0Ex9NoMgjNfYCY2RxzGzrhlObeNZCra J+WXauK0l18= =Ipsd -----END PGP SIGNATURE----- -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Cupertino, Ca

1 0

Re: cypto + compression
by smb＠research.att.com 21 May '93

21 May '93

OK well if you encrypt a compressed file, there are bound to be lots more new redundencies created in the encryption process (unless it is something like ROT-13). Why not compress this AGAIN, squeezing more space out o Actually, you've got it backwards. A decent encryption algorithm, including DES, generates something with very little redundancy, and hence which cannot be compress further. $ compress </vmunix >vmunix.Z $ des -e -k foo <vmunix.Z >vmunix.Z.des des: WARNING: using software DES algorithm $ compress <vmunix.Z.des >vmunix.Z.des.Z -rwxr-xr-x 1 root 1875490 Jan 7 16:59 /vmunix $ des -e -k foo </vmunix | compress >vmunix.des.Z des: WARNING: using software DES algorithm $ ls -l /vmunix vmunix* -rwxr-xr-x 1 root 1875490 Jan 7 16:59 /vmunix -rw-rw-r-- 1 smb 794374 May 21 17:17 vmunix.Z -rw-rw-r-- 1 smb 794376 May 21 17:18 vmunix.Z.des -rw-rw-r-- 1 smb 1066555 May 21 17:18 vmunix.Z.des.Z -rw-rw-r-- 1 smb 2538235 May 21 17:21 vmunix.des.Z As you can see, compressing after encrypting *increases* the size of the file.

1 0

Dec. of Ind. < Govt. Imposted Crypto Restrictions
by Stanton McCandlish 21 May '93

21 May '93

I'd sure lend a .signature to ratify that! -- Testes saxi solidi! ********************** Podex opacus gravedinosus est! Stanton McCandlish, SysOp: Noise in the Void Data Center BBS IndraNet: 369:1/1 FidoNet: 1:301/2 Internet: anton(a)hydra.unm.edu Snail: 8020 Central SE #405, Albuquerque, New Mexico 87108 USA Data phone: +1-505-246-8515 (24hr, 1200-14400 v32bis, N-8-1) Vox phone: +1-505-247-3402 (bps rate varies, depends on if you woke me up...:)

1 0

Re: Cryptography show for ITR?
by John (FuzzFace/Fast-Eddie) McMahon 21 May '93

21 May '93

I just forwarded your suggestion to the guys who run ITR. Hopefully, it will go somewhere :-) Cheers! Fuzz

1 0

looking for distributed systems/crypto textbook.
by sommerfeld＠apollo.hp.com 21 May '93

21 May '93

At work, we're thinking of organizing an internal self-study seminar on areas related to distributed systems security. I know of Denning's textbook in the area, but would prefer not to use it for what should be obvious reasons. I also know of and have read the "Contemporary Cryptography" book by Simmons, but it seems to be a little too heavily oriented towards crypto/math as opposed to applications. Undoubtedly many of you would have opinions in this area; let me know what they are and I'll summarize to the list. - Bill

1 0

Cryptography show for ITR?
by technopagan priest 21 May '93

21 May '93

This week's NPR "Talk of the Nation/Science Friday" was on the internet. Both telephone callers, and internet "callers" were accepted. The show included the founder of Internet Talk Radio. There was a question along the lines of "how can internet mail privacy be assured?" Unfortunately, the experts only breifly mentioned public-key cryptosystems. I was wondering if they would go into a longer discussion about electronic privacy and crypto issues. I wonder if we could get a "cypherpunk" onto Internet Talk Radio to discuss cryptography and it's privacy concerns. Any ideas? -Thomas

1 0

SIGINT and TEMPEST follies
by fergp＠sytex.com 21 May '93

21 May '93

On Thu, 20 May 93 18:33:52 EDT, Bill_Stewart <anchor.ho.att.com!wcs> wrote - > This is distinctly not the case. You can take any countermeasures > you want. The precise standards are classified (some SECRET, some > CONFIDENTIAL COMSEC), so you can't find out how good the > government's abilities to eavesdrop are, or precisely what level of > protection the government thinks is necessary to protect classified > information, or how good the NSA thinks the Russians are, but as long > as you're not using classified information as your sources, you can > do anything you want. (If you're not protecting yourself *enough*, > the FCC will get on your case, but over-protection is fine.) I beg your pardon, but this is _not_ the case. TEMPEST requirements are _not_ classified and are available for public scrutiny. (You obviously do not know where to look.) I _know_ this to be true: I working in the COMSEC arena within the US military for the better part of five years. In fact, I helped design and construct the first tactically-based, X.25 packet switched, PC based, uHF interfaced network in Europe back in the early '80's using Zenith Z-248's and KG-84's. We did everything from designing the cabling pin-out's on up. > TEMPEST isn't particularly about transients or electromagnetic pulses, > it's about overall electromagnetic emissions. You're trying to separate issues that are one and the same. With the proper equipment, I can put you and an IBM Selectric (tm) typewriter on a wooden raft in the middle of Lake Superior, monitor and realize every keystroke that you make and you'd not be the wiser. This type of monitoring is easily defeated by low yield TEMPEST requirements. I've worked in this area, Bill, and have tested these _facts_. I don't care how you care to word it, it _is_ transient electromagnetic emissions. > Electromagnetic Pulses are the big fast spikes you get from nuclear > explosions (or similar slower spikes from lightning, etc.) and the > techniques you use for protection against EMP don't solve your > TEMPEST problems, and vice versa, though both kinds of protection > are some help for the other. > In my previous incarnation as a Tool of the Military-Industrial > Complex, I never saw TEMPEST expanded as an acronym in any of the > documents I read. As I stated above (and I place myself in jeopardy of being accosted by Big Brother by admitting it), I was a COMSEC flunky during my junket with the US Army. Originally, I was a 31S(ierra) and later a 29S(ierra) when two MOS's (Military Occupational Specialties, in Army jargon) were later merged. I was also a COMSEC Custodian (alternate, actually) and I can admit that I have a deep understanding of cryptographic key systems, cryptographic theory, cryptographic hardware design and integration and "BLACK" and "RED" separation principles. This type of technology does not require a rocket scientist (trust me, I've worked with them too at NASA)(oh yeah, I forgot -- I've also done contract work for Bell Labs and AT&T Secure Systems). > In the case of the Crippler Chip, however, you knew it had a built-in > wiretap when you bought it, which changes some of the reasonable > expectations about privacy a bit. This issue is one where I must disagree with you emphatically. The majority of the American public don't even know about Clipper. Hell, most of them think those AT&T commercials (Aretha singing "Freedom") are cute. Personally, I think its pretty sick, considering how they worked in collusion with Big Brother (No Such Agency) and announce that they would be immediately using this "technology" on the same day that the NIST made its announcement that Clipper would be the "weapon of choice" in their war on drugs, would-be criminals and the American public (April 16, 1993). I know the technical specifics of TEMPEST (it is an acronym, BTW) and the reason it was developed as a SIGINT (SIGnal INTelligence) standard. Cheers. Paul Ferguson | The future is now. Network Integrator | History will tell the tale; Centreville, Virginia USA | We must endure and struggle fergp(a)sytex.com | to shape it. Stop the Wiretap (Clipper/Capstone) Chip.

1 0