July 1993 - cypherpunks-legacy

Re: steganography
by wcs＠anchor.ho.att.com 17 Jul '93

17 Jul '93

I think Kragen's definition of "Steganographically Strong" is a bit overstrong. He suggests that the cyphertext should not be recognizeable by its own program, with no checksums or program-specific delimiters, headers, etc. If checksums become widely used in other data formats (e.g. MIME or whatever), having them used in "innocent-looking-format" is ok. And having a checksum that only checks out if you have the correct key for decrypting the file is relatively ok, assuming you use strong encryption; it's really no more of a giveaway than having the correctly-decrypted plaintext have other recognizeable format, such as all-ascii or MIME or GIF. The request for a feature that corrupted files decrypt to total garbage and not just partial garbage can be implemented using some variant on doubly encrypting the file, e.g. descbc file | reverse-the-file | descbc. Most encryption systems can be used in modes that only trash the corrupted block, modes that trash the corrupted block and all following blocks, or modes that trash the corrupted block and some stuff after it, but eventually resync. The latter are useful for on-line continuous encryption systems like ethernet or T1 encryptors, where you don't want to send out guys with briefcases handcuffed to their arms any time there's a noise burst :-) One wimpy steganography approach I've thought of recently is to use uuencode. Each line starts with an indicator of how many characters are on the line, normally "M" for 64, followed by the characters; you could use variable-length lines with the length encoding your real (cyphertext) data at 6 bits/line. It'd be ugly, and probably noticeable, but you could always demonstrate that it outputs normal genuinely-innocent stuff by running it through uudecode. And it's only a factor of 10 less efficient than hiding it in a GIF! Bill Stewart

1 0

Re: Anonymity takes one on the chin
by peter honeyman 17 Jul '93

17 Jul '93

paul, my thoughts in (extremely) brief: i applaud your resolve to correct what you saw to be wrongdoing. i totally disagree with you on the merits of the case; i think the civil servant runing the bbs (i forget her name) provides a valuable service, and serves the common good. as usual, anonymity is a lightning rod here, although it is largely peripheral to the real issues. peter

1 0

Re: Relation between number theory and cryptography
by collins＠newton.apple.com 17 Jul '93

17 Jul '93

J. Michael Diehl <mdiehl(a)triton.unm.edu> writes: >if we were to add some noise [then] we have added [...] information Perhaps in 'Information Relativity'. With respect to the original system (and by definition), noise is not information. It is only data. Scott Collins | "Few people realize what tremendous power there | is in one of these things." -- Willy Wonka ......................|................................................ BUSINESS. voice:408.862.0540 fax:974.6094 collins(a)newton.apple.com Apple Computer, Inc. 1 Infinite Loop, MS 301-2C Cupertino, CA 95014 ....................................................................... PERSONAL. voice/fax:408.257.1746 catalyst(a)netcom.com ....................................................................... QUOTING. Full text of sources upon request. You may quote if you do the same *and* include this notice so your readers may quote similarly.

2 1

DCASH: Two Digital Cash Reports Available
by edgar＠spectrx.Saigon.COM 17 Jul '93

17 Jul '93

-----BEGIN PGP SIGNED MESSAGE----- I have two reports on new ideas for digital cash which I retrieved from Amsterdam. Both are in PostScript format. I have a hardcopy of the larger one kindly supplied by mail by the author, Stephen Brands. If there is any interest, I will bring both soft and hard-copies to the next Physical Meeting, which I presume will take place on the 2nd Sat of August, 8/8, noon, at Cygnus in Mtn. View. (I didn't see any announcement/agenda for the July meeting, but I understand it occurred anyway). Here are summaries of the reports: [Newsgroup sci.crypt] Post: 1070 of 1149 From: brands(a)cwi.nl (Stefan Brands) Newsgroups: sci.crypt Subject: * REPORT ON PRIVACY-PROTECTING OFF-LINE CASH AVAILABLE * Date: 19 Apr 93 14:37:17 GMT Organization: CWI, Amsterdam Lines: 60 I recently published a new privacy-protecting off-line electronic cash system as a technical report at CWI. Being a PhD-student at David Chaum's cryptography-group, our group has a long history in research in the field of privacy-protecting cash systems. The report is called CS-R9323.ps.Z, contains 77 pages, and can be retrieved from ftp.cwi.nl (192.16.184.180) from the directory pub/CWIreports/AA. The postscript-file is suitable for 300dpi laserprinters. ==================================================================== ABSTRACT (from coverpage): We present a new off-line electronic cash system based on a problem, called the representation problem, of which little use has been made in literature thus far. Our system is the first to be based entirely on discrete logarithms. Using the representation problem as a basic concept, some techniques are introduced that enable us to construct protocols for withdrawal and payment that do not use the cut and choose methodology of earlier systems. As a consequence, our cash system is much more efficient in both computation and communication complexity than any such system proposed previously. Another important aspect of our system concerns its provability. Contrary to previously proposed systems, its correctness can be mathematically proven to a very great extent. Specifically, if we make one plausible assumption concerning a single hash-function, the ability to break the system seems to imply that one can break the Diffie-Hellman problem. Our system offers a number of extensions that are hard to achieve in previously known systems. In our opinion the most interesting of these is that the entire cash system (including all the extensions) can be incorporated in a setting based on wallets with observers, which has the important advantage that double-spending can be prevented in the first place, rather than detecting the identity of a double-spender after the fact. In particular, it can be incorporated even under the most stringent requirements conceivable about the privacy of the user, which seems to be impossible to do with previously proposed systems. Another benefit of our system is that framing attempts by a bank have negligible probability of success (independent of computing power) by a simple mechanism from within the system, which is something that previous solutions lack entirely. Furthermore, the basic cash system can be extended to checks, multi-show cash and divisibility, while retaining its computational efficiency. ==================================================================== Cryptographers are challenged to try to break this system! I made a particular effort to keep the report as self-contained as possible. Nevertheless, if you have any questions, please e-mail to me and I will try to reply as good as I can. Any comments are also welcome! Stefan Brands, - -------------------------------------------------------- CWI, Kruislaan 413, 1098 SJ Amsterdam, The Netherlands Tel: +31 20 5924103, e-mail: brands(a)cwi.nl [Newsgroup alt.privacy] Post: 452 of 458 From: Niels Ferguson <Niels.Ferguson(a)cwi.nl> Newsgroups: alt.privacy,comp.society.privacy,alt.security,comp.security.announce,comp.security.misc,sci.crypt Subject: new Electronic Cash scheme: technical report available Date: 25 Jun 93 13:48:26 GMT Organization: Computer Privacy Digest Lines: 58 Approved: comp-privacy(a)pica.army.mil X-Submissions-To: comp-privacy(a)pica.army.mil X-Administrivia-To: comp-privacy-request(a)pica.army.mil X-Computer-Privacy-Digest: Volume 2, Issue 054, Message 4 of 4 New electronic cash system: report available by FTP. --------------------------------------------------- Electronic cash is the equivalent of paper cash in an electronic form. It has all the same basic properties as ordinary cash: It carries value, can be used to pay other people without contacting any central organization and is completely anonymous. Recent work at the CWI has resulted in significantly improved protocols for electronic cash. The following CWI technical report is now available by FTP: Title: Single Term Off-Line Coins Author: Niels Ferguson Report: CS-R9318 Site: ftp.cwi.nl directory:/pub/CWIreports/AA file: CS-R9318.ps.Z (compressed PostScript file) Abstract -------- We present a new construction for off-line electronic coins that is both far more efficient and much simpler than previous systems. Instead of using many terms, each for a single bit of the challenge, our system uses a single term for a large number of possible challenges. The withdrawal protocol does not use a cut-and-choose methodology as with earlier systems, but uses a direct construction. This report is slightly more extensive than the version that appeared in the pre-proceedings of EuroCrypt '93. If you are interested in this report, you might also be interested in a report by my colleague Stefan Brands entitled "An Efficient Off-line Electronic Cash System based on the Representation Problem". It can be found under the name "CS-R9323.ps.Z" in the same directory. Note: Followup set to sci.crypt Niels -------------------------------------------------#include<stddisclaimer>------ ... of shoes and ships and sealing-wax, of | Niels Ferguson cabbages and kings, and why the sea is boiling | CWI, Amsterdam, Netherlands hot, and whether pigs have wings ... | e-mail: niels(a)cwi.nl -----BEGIN PGP SIGNATURE----- Version: 2.3.2/EWS iQCVAgUBLEW2Wd4nNf3ah8DHAQFQIAP/eCwkHJzjINs+0GHpW/USH0mI/CZGbtlx wSCPZOHBfgboEOrttam/vz5SApghRHwraVcXYnCR+6cZaCkmdISkcZ8ISj6V/77w L5q992BR5SZ7vVV31lLjEgTTw8Va2n9y2ry6ubZCMF0j5nTZy44OOYIU5gLQDHhR fT0u8iwQY2s= =4CNQ -----END PGP SIGNATURE----- -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Cupertino, Ca

2 1

TEST: Ignore me
by hughes 17 Jul '93

17 Jul '93

More mailing list testing. Please ignore. Eric

1 0

ADMIN: cypherpunks mail configuration change
by hughes 17 Jul '93

17 Jul '93

Effective immediately, all cypherpunks mail will appear to originate from 'owner-cypherpunks'. Previously the name was 'cypherpunks-request'. This change only affects those of you using mail filters which are filtering on the out-of-band "From " line. This change was made so that I can more easily separate bounce messages from list requests. Eric

1 0

No Subject
by Thomas Grant Edwards 17 Jul '93

17 Jul '93

-----BEGIN PGP SIGNED MESSAGE----- Does anyone know of C source code for low speed CELP or vocoder software available on the net? I feel if we can develop even a low-speed software based answer to the secure-phone, it will probably be used and distributed to many people. I think it would have to be based around the soundblaster card though. Perhaps we can also devise an internet secure-phone standard, and clients can be written for NeXTs, Suns, PCs, and etc. I've had no luck getting our SparcStations to decompress ADPCM encoded Internet Talk Radio in real time...either the software I have is truly sad (could be), or we need to look at other compression methods such as CELP, or at worst, vocoder. - -Thomas -----BEGIN PGP SIGNATURE----- Version: 2.2 iQBVAgUBLEcE4DAI9D7h8UTJAQHGSgIAgleqJLQnpwQck4b8FQi79uL6RPGv1j01 LlLX+ICFA/yFfVheh43tWt9vsHrG0d+Vgbo3SX4FHUniDBlqAHYnfw== =QYED -----END PGP SIGNATURE-----

2 1

DCypherpunks
by fergp＠sytex.com 17 Jul '93

17 Jul '93

Washington, DC area Cypherpunks: I have accepted a consulting position in the DC area which will not require consistent travel (unlike my current job), which I will begin the first of August. This position will be designing, implementing and configuring routed Internet access data networks for one of the big three carriers (no, not AT&T). Anyway, I'd like to find out how many of the DCypherpuuks are willing to plan a physical meeting for mid-August to discuss current happenings, sign keys and the likes. E-mail me if you are interested. Cheers. Paul Ferguson | "Confidence is the feeling you get Network Integrator | just before you fully understand Centreville, Virginia USA | the problem." fergp(a)sytex.com | - Murphy's 7th Law of Computing Quis Custodiet Ipsos Custodes? being used for, what I consider, unethical, immoral and possibly illegal activities. ---- begin forwarded message ------------- AIS BBS Capture log. To: all interested parties, especially Americans who may wish to ask relevant questions of relevant people. Capture log from a BBS that claims to be run by the US Treasury Department, Bureau of the Public Debt. Notice - I have not verified that the US government is actually running this BBS, only that the BBS claims that it is. The capture was made live. I have cut out parts where the same area was visited twice, and the information is identical. Also cut out, is any information that could lead to the caller being identified, as the caller wishes to retain privacy. If indeed this is being run by the US Government, the caller would not wish to be harassed by that organisation. Also omitted are the "More" prompts for paging the display. And, after the first few displays of the main menu, some of those have also been omitted for brevity. The file 27-ASM.ZIP was downloaded, to check that there really were source codes. In fact, there were mostly recompilable disassemblies, some good, some bad. I've included, at the end of this file, the beginning of 512.ASM, a disassembly of Number of the Beast. But I've only included the header, the first couple of instructions (discover Dos version) and the end (the '666'). All the meat of the code, I've omitted for brevity, and because this capture is likely to become publicly available. [End of forwarded transcript] Immediately following the above text, was contained a list of computer viruses, virus construction tools and virus disassemblies. In the subsequent storm of debate, there have been several scathing articles written about the way the situation was brought into public knowledge, including a front-page article in the Washington Post and several rather scathing articles in Computer Underground Digest (CuD 5.51) and a rebuttal (of sorts, CuD 5.52) in which I stated my own position on the matter. It is also been brought to my attention that certain underground hackers have vowed to seek revenge in some fashion, which really worries me the least. My main concern is that this instance of valid utilization of "whistleblowing" has been overshadowed by the ravings of virus exchange enthusiasts and underground virus distribution and propagation groups who are calling "Foul!" without closely examine the implications of their own actions (a topic which I will not launch into at this time). In fact, I applaud Peter G. Neumann, moderator of RISKS Forum for allowing the anonymous post to be posted to the list in the first place. Another copy of the message was sent anonymously to VIRUS-L Digest (comp.virus list) where Ken van Wyk, the moderator, decided not to post it. (A raspberry to Ken for that one.) Perhaps the remainder of the net is not quite ready to acknowledge anonymity? As I stated above, I'd really like to hear some of your thoughts on the matter... Cheers. Paul Ferguson | "Confidence is the feeling you get Network Integrator | just before you fully understand Centreville, Virginia USA | the problem." fergp(a)sytex.com | - Murphy's 7th Law of Computing Quis Custodiet Ipsos Custodes?

1 0

steganography and cryptography
by Mike Johnson 17 Jul '93

17 Jul '93

Kragen Sittler says: > . . . > For a steganographically strong code, the cyphertext must not be recognizable > to its home program. This means, among other things, no CRC's, no MD5's, etc, > intended to assure data integrity. This means no delimiter-structured files. > (I think--I'm not absolutely sure on this one.) Every field in the file must > be either fixed-length or have a number somewhere in it > (in a format indistinguishable from the rest of the cyphertext) which tells it s > length. And every field, individually, must not be recognizable as something > unusual. (For instance, no sending of large prime numbers in the clear, as the y > are very unlikely to appear in a random file.) > > The foregoing "field" stuff has to do with things like PGP, which have a > message cyphertext, encrypted with a session key, and a session key, encrypted > with a PKC, in the same message. (Possible several cyphertexts of the session > key.) > > Oh, and it would be nice, though not essential, if a corruption in the file > made it completely, rather than partially, nonsense when decrypted. This way > you can't have a file with no use to the recipient used as evidence against > them. > > The important qualifications seem to rule out any crypto package in current > widespread use, don't they? > . . . For a steganographically strong code, it is not enough to make it unrecognizable to its home program. The ciphertext must look like something "innocent" to either a human reader or a computer program designed to look for ciphertext. For example, the message could be hidden in the least significant intensity bits of a bitmapped picture that the intended recipient has an unmodified copy of. If data that looks like random noise is innocent enough, then it is not hard to hack PGP or write another encryption program that intentionally lacks any signature information. I wrote several programs with this property. The two best examples are CRYPTE and CRYPTMPJ, both of which are available on the Rainbow Missions BBS at 303-938-9654. This makes them a little harder to use than PGP and similar programs, because the user has to know in advance when encryption and decryption are appropriate, and which algorithm to use. Allowing a signature in the file format makes it obvious which program was used to encrypt the data (thus slightly reducing security), but it makes it easier to use the program. This increase in ease of use makes it more likely that it will be used, and that increases security.

1 0

Re: WARNING: NON-CYPHERPUNK QUESTION
by anonymous＠extropia.wimsey.com 17 Jul '93

17 Jul '93

Clark Reynard asked: Are there any fast, quick, reliable methods of forestalling phone disconnection due to failure to pay the bills, and the ugly reconnection fee which ensues thereupon? I can't offer a method of *eliminating* your phone bill, but I have been practicing a method of drastically *reducing* the charge for local phone service. Simply ask Pac Bell (In California) for "Lifeline" service. The monthly bill is $1.31, after "credits" for "inside wire repair" and "Tel Equip" (for buying your own phone(s)). Clark, do you think you could afford that? This gets you a local (outgoing) call allowance of 60 calls per month (about 2 a day). Unlike regular measured service, which measures (and charges) by call *and length of call*, each of your 60 calls under lifeline can be of unlimited length. Back when I had a 2400 baud modem, I frequently had single calls of 2-4 *hours* while uploading & downloading files from various local BB's. Calls beyond your 60-call allowance are charged at $.08 per call. Of course, there's a catch. Lifeline service is only offered to "poor" people. You have to sign a statement every year certifying that your combined family income doesn't exceed their guidlines. But although they warn you that the Public Utilities Commission "may investigate" your claim; they apparently never do! Unlike the PG&E lifeline program, Pac Bell doesn't ask for *any* documentation of your income like W-2 forms or copies of your tax returns. I've been on lifeline service for *years*, I think almost since they started offering it, back when the Bell system was broken up, and local phone rates were raised sharply. During most of that time, I earned around $50,000/year. Now I'm retired & my pension is about $24,000, still well above the lifeline "guideline". One caveat, I live in an area of San Jose where many of my neighbors are working-class, a few on welfare, etc. This scam might not work from an address in Hillsboro, Los Gatos, or Saratoga; but who knows, the PUC may be so incompetent and/or lazy that it might. Considering the moral factors, if you *don't* claim lifeline eligibility, then you are *charged* a few cents a month to pay for the people who *do*! You are also charged $1.75 for "access to a long distance carrier", even if you don't call long distance. (but lifeline customers get an offsetting credit and still have long distance access). So you have to choose to be a sheep or a wolf, a victim or a victimizer, to either take unfair advantage of the system or have it take unfair advantage of you; there is no middle ground. Consider the pragmatic factors. Based on my experience, the chances of getting "caught" seem remote. If I'm ever investigated, I plan to play dumb and claim I didn't understand the lifeline forms I signed. Since I didn't provide any false documentation of a low income (they didn't *ask* for any), be pretty hard to prove intent to commit fraud. So I expect the worst that could happen is that I'd have to pay some estimate of what my correct bill might have been less what I actually paid. I suspect there's a statute of limitations, which I've already exceeded for most of the time I've been on lifeline. So this sounds like a good bet. If you win, you win big; if you lose, you break even, with chances of losing being much less than 50/50.

1 0