August 1993 - cypherpunks-legacy

Re: Cypherpunk Chip
by cme＠ellisun.sw.stratus.com 19 Aug '93

19 Aug '93

On Aug 19, 12:18pm, peter honeyman wrote: > Subject: Re: Cypherpunk Chip > how important is the prng aspect of tran? presumably des-cbc does > a good job of bit diffusion. why is it better to tran than to > "dd conv=swab" or rot13? (or even to do nothing at all, simply > des-cbc|des-cbc|des-cbc?) > > peter >-- End of excerpt from peter honeyman I did a version of tran which did 4 rounds of an FFT-style butterfly. This achieves maximal mixing. However, it's predictable -- therefore easier to cryptanalyze (not that I'd care to try it :-). DES does a fine job of bit diffusion, within its block. (for CBC, that includes the rest of the stream -- if you hide the ciphertext from the cryptanalyst, so he can't XOR it out again) tran moves bytes of DES output around so that they can expect to have new neighbors for the next round of encryption. This produces diffusion. The actual diffusion of tran is less than that of the FFT-butterfly. However, for the cryptanalyst, there are more possibilities. Any byte can go anywhere within the 8KB block. With the FFT, each byte goes to a known location and gets diffused with 7 neighbors by the next round of DES. - Carl

1 0

Re: Cypherpunk Chip
by peter honeyman 19 Aug '93

19 Aug '93

how important is the prng aspect of tran? presumably des-cbc does a good job of bit diffusion. why is it better to tran than to "dd conv=swab" or rot13? (or even to do nothing at all, simply des-cbc|des-cbc|des-cbc?) peter

1 0

Cypherpunk Chip
by MIKEINGLE＠delphi.com 19 Aug '93

19 Aug '93

I'd like to propose a Cypherpunk chip to take the place of the Clipper chip. This could go a long way toward bringing the Cypherpunk vision to life, and it could also make someone a fortune. But first, I'm going to flame a bit. Even without key escrow and secret algorithms, Clipper is no good. The Clipper chip uses a conventional single-key algorithm, so if you want to use it with public-key, you have to do the RSA operations in software. This makes it vulnerable to tampering and key stealing. Clipper is essentially a beefed-up DES with a built- in spy hole and a classified "trust us" algorithm. The NSA seems to believe that only their classified algorithms are unbreakable. This is not true. We don't need to trust the NSA to give us an unbreakable single-key cipher. What we need are two good, respected ciphers and a simple reorganization operation. Choose, for instance, IDEA and triple-DES. Both are good algorithms. They have keys which are long enough to rule out any possibility of a brute-force attack. They are resistant to known methods of cryptanalysis, including differential cryptanalysis. They have good dispersion and produce pseudo-random ciphertext. Whether the NSA could break either of these, using a classified method, is pure speculation. IDEA and triple-DES are very different algorithms. DES is based on bit manipulation and permutation tables, whereas IDEA uses 16-bit arithmetic operations. This is good, because it means that if either algorithm has a flaw, the other one is not likely to have the same flaw. Take a 64-byte section of plaintext. Encrypt it using triple-DES. Now, reorganize the ciphertext: take the first byte of each 8-byte DES block (bytes 0,8,16, and so on) and make the first 8 bytes of the reorganized section. Repeat with the second, third, etc. until the entire 64 bytes are reorganized. So: 0 0 0 0 0 0 0 0 ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@ becomes: AIQYgow4BJRZhpx5...and so on. Then, re-encrypt the section with IDEA, producing double-encrypted ciphertext. Suppose you now change one bit in the ciphertext and decrypt it. When you decrypt IDEA, you get one 8-byte block of garbage (which is indistinguishable from the rest of the still-encrypted data). When you undo the reorganization, you get one bad byte in each DES block. So when you DES decrypt, you get 64 bytes of garbage. This compound cipher is effectively a 64-byte block cipher, in that every bit in the 64 bytes depends on every other bit. This means that you would have to attack a 64-byte section i.e. you would need 64 bytes of plaintext to attempt a plaintext attack. And even if you had the 64 bytes, you probably couldn't do anything with it. If you found a weakness in either cipher that allowed you to attack it, the same weakness would not exist in the other cipher (since they are based on different methods). So you could not attack the compound cipher. For this reason, a combination of two ciphers, especially with the reorganization, should be much more secure than one cipher. If I had to choose a cryptosystem to bet my life on, I'd choose this above Skipjack any day. Of course, it would be slower than a single cipher, but there are ways to make it usable. For example, the reorganization would be performed by straight-line assembly language, with no loops. And the encryption program would use a large disk buffer. Or, better yet, use hardware. See below. The Cypherpunk Chip Why couldn't we make a chip of our own, with some venture capital? This would be a public-key encryption chip, with all the necessary hardware self-contained, which would make secure phones, faxes, computers, and everything very easy. RSA Data Security could make a fortune if they received only a small royalty on each one sold. The design of the chip would be extremely public and readily available. Any company could produce them if it was willing to pay for the use of the RSA algorithm. The chip would contain a hardware true-random-number generator; facilities for executing RSA; MD5 or another message digest; and an extremely secure conventional cipher such as the compound cipher mentioned above. It would also contain nonvolatile (flash ROM) registers to store its public key and secret key. Hardware random numbers can be generated by several methods. One is to measure the jitter in an unstable oscillator. Another is to reverse bias a diode, right on the edge of zener breakdown, causing it to produce white noise. These methods can be proven by quantum mechanics to be inherently random. The chip would be sold blank - no serial number or anything. The user would instruct it to initialize itself by generating a key pair. It would do this internally, producing and remembering a public key and secret key. This might take a while, but you only have to do it once. When this is finished, you can easily extract the public key, but there would be no way to extract the secret key from the chip. The chip would be designed to make it very difficult and expensive to extract the secret key by physical surgery, thus making key stealing hard. The secret key would be stored internally in encrypted form, using a pass phrase much like PGP does, and the chip would decrypt it before each operation. In addition to the initialization, there would be five basic operations. The chip could output its public key, encrypt, generate signatures, decrypt, and check signatures. To encrypt, you would send the chip one or more public keys for people you want to send to. It would generate a random session key, and output the session key RSA-encrypted with each of the provided public keys. It would never reveal the actual session key. Then the chip would accept plaintext, 64 bytes at a time, and output ciphertext. When the encryption of a particular message was finished, the chip would forget the session key. To sign, you would send the text to the chip, along with the pass phrase, and it would run the MD5 algorithm on it. When finished, it would output the signature, the MD5 encrypted with its secret key. To check a signature, you would send the text, signature, and public key, and the chip would output good or bad. To decrypt, you would send the ciphertext and pass phrase, and the chip would output the plaintext. This chip would do basically what PGP does, except that it would be self-contained, very difficult to steal keys from, and easy to use in any device. The chip would not need to be hard-wired into a device. It could be built into a card or other plug-in module, perhaps PCMCIA compatible. You could use this as an electronic identity, while retaining the option to remain anonymous by getting a second card and generating a new identity. The card might also contain a memory for other people's public keys. You could, for example, insert the card into a pay phone and dial your pass phrase. This would secure the call, allow you and the recipient of the call to verify each others' identities, and pay for the call with digital cash. If this chip existed, "crypto-anarchy" would be easy. Everyone would have a motive to use it. There would be no more credit card fraud, no more phone-code fraud, no more bad checks, no more hacking, no more surveillance, etc. The chip could make it happen. We cipherpunks could actually win. The chip would be introduced in a low-key way. We would let the market see its advantages and jump on it, before the bad guys recognized the threat. For example, it could be introduced as an option for computers - plug it into a PCMCIA card slot and use it to secure E-mail, your hard drive, etc. Don't advertise what it could become; just let it happen. When we get it started, it will happen by itself. < mikeingle(a)delphi.com >

2 1

World record in password checking
by gtoal＠an-teallach.com 19 Aug '93

19 Aug '93

> You can do even better if you happen to have 2000 sparcstations which > are idle for 16 hours a day. Myself, I wonder how many machines we > would need for a net parallel DES crack. > > Perry Hmmm.... shouldn't be hard to organise either - everyone adds a crackd daemon to their inetd.conf... hey - even better - we make it an extension to 'sendmail' and put it in the default distribution bwahahaha ;-) G === Personal mail to gtoal(a)gtoal.com (I read it in the evenings) Business mail to gtoal(a)an-teallach.com (Be careful with the spelling!) Faxes to An Teallach Limited: +44 31 662 4678 Voice: +44 31 668 1550 x212

1 0

mailing list <-> newsgroup ?
by gtoal＠an-teallach.com 19 Aug '93

19 Aug '93

In article <9308181850.AA10702(a)toad.com> newsham(a)wiliki.eng.hawaii.edu writes: > How many people are subscribed to this list right now? How many > people have read it before and dropped off only due to bandwidth > problems? This list easily generates more traffic than any of > the newsgroups I read. If the number of people on this list is Then use better tools! I easily cope with this list -- and another one which averages 300 letters a day. I set up separate accounts for each list and gateway them into local 'mail.*' newsgroups. Admittedly, if it comes in with your real mail it would be a pain. But I'd rather keep it as email than news just to keep that cretin Sternlight out :-) G === Personal mail to gtoal(a)gtoal.com (I read it in the evenings) Business mail to gtoal(a)an-teallach.com (Be careful with the spelling!) Faxes to An Teallach Limited: +44 31 662 4678 Voice: +44 31 668 1550 x212

1 0

network parallel decryption amateur style
by nobody＠alumni.cco.caltech.edu 19 Aug '93

19 Aug '93

Recent postings have gotten me to thinking: If we wrote a easily portable UNIX program to decrypt DES in parallel across our many machines, how fast could we go? Perhaps we could make use of the anonymous remailers to hide our cooperation. How many computers do we have? I have account on somewhere between 10 and 20 Sparcstation IIPX's which are very lightly loaded at night...someone else said they have 1500... PC gurus might want to also make versions for high-speed PC's on the net. It wouldn't even need to be very difficult, just maybe having one complex server which assigns keyranges to every person who mails in a request, and gets mailed back the range to check. It doesn't really have to be automatic, although that would be nice. What do y'all think? -(signature removed, because, this is a dangerous idea. That's why I like it ;)

2 1

APS-0.3 - anonymous posting software for the masses
by khijol!erc＠apple.com 19 Aug '93

19 Aug '93

FYI - I have released the source code for APS-0.3 out to alt.sources. If anyone wants the sources but doesn't have access to alt.sources, they can email me and I'll be glad to email them the software (it's fairly small). -- Ed Carp, N7EKG erc(a)apple.com 510/659-9560 anon-admin(a)khijol.uucp If you want magic, let go of your armor. Magic is so much stronger than steel! -- Richard Bach, "The Bridge Across Forever"

1 0

Anon: remailer list
by M..Stirner＠f28.n125.z1.FIDONET.ORG 19 Aug '93

19 Aug '93

* Reply to msg originally in CYPHERPUNKS Uu> Q1: What cypherpunk remailers exist? Uu> 1: nowhere(a)bsu-cs.bsu.edu Uu> 2: hh(a)cicada.berkeley.edu Uu> 3: hh(a)pmantis.berkeley.edu Uu> 4: hh(a)soda.berkeley.edu Uu> 5: 00x(a)uclink.berkeley.edu Uu> 6: hal(a)alumni.caltech.edu Uu> 7: ebrandt(a)jarthur.claremont.edu Uu> 8: remailer(a)rebma.mn.org Uu> 9: elee7h5(a)rosebud.ee.uh.edu Uu> 10: hfinney(a)shell.portal.com Uu> 11: remail(a)tamsun.tamu.edu Uu> 12: remail(a)tamaix.tamu.edu Uu> 13: remailer(a)utter.dis.org Uu> 14: remailer(a)entropy.linet.org Uu> 15: remail(a)extropia.wimsey.com OK. It seems that remail(a)extropia.wimsey.com (#15) is down. This is a shame, as it was the _only_ remailer that would function as an anonymous remailer for me. It worked beautifully while it was up. Its apparent demise has been reported by other users as well, . Several of the remailers listed (2,3,4,5) have _never_ worked using standard cypherpunks syntax: :: Request-Remailing-To: . All other cypherpunks remailers, reliable or not, retain the footer addresses automagically inserted by the host box here & are therefore not in any way anonymous for my purposes. There was a discussion of a "cut line" syntax before I temporarily lost access to cypherpunks, but as far as I know there was never any agreement or implementation (I shall be pleased to be corrected if this is not the case). . Penet.fi will no longer work for me since the forced-password implementation due to an apparent header conflict with the X-Anon-Password: line & local host/gate software. . Why am I depressed? . ~ . M. ********************************************************************* * <m..stirner(a)f28.n125.z1.fidonet.org> - PGP Key D30909 via servers * * > What country can preserve its liberties if its rulers are not <* * > warned from time to time that their people preserve the spirit <* * > of resistance? Let them take arms!" - Thomas Jefferson, 1787 <* ********************************************************************* ... Organization: Concerned Norwegians Against Lutefisk, S.F., CA ___ Blue Wave/QWK v2.12 -- M. Stirner - via FidoNet node 1:125/1 UUCP: ...!uunet!kumr!shelter!28!M..Stirner INTERNET: M..Stirner(a)f28.n125.z1.FIDONET.ORG

2 1

no subject (file transmission)
by Timothy Newsham 19 Aug '93

19 Aug '93

>From nowhere(a)bsu-cs.bsu.edu Tue Aug 17 15:28:39 1993 Return-Path: <nowhere(a)bsu-cs.bsu.edu> Received: from bsu-cs.bsu.edu ([147.226.112.101]) by hemp-imi.hep.anl.gov.noname (4.1/SMI-4.1) id AA01228; Tue, 17 Aug 93 15:28:35 CDT Received: by bsu-cs.bsu.edu (5.57/Ultrix3.0-C) id AA07310; Tue, 17 Aug 93 15:32:24 -0500 Date: Tue, 17 Aug 93 15:32:24 -0500 Message-Id: <9308172032.AA07310(a)bsu-cs.bsu.edu> From: Anonymous <nowhere(a)bsu-cs.bsu.edu> To: EDITED X-Remailed-By: Anonymous <nowhere(a)bsu-cs.bsu.edu> X-Ttl: 0 X-Notice: This message was forwarded by a software- automated anonymous remailing service. Status: R Introduction to BlackNet Your name has come to our attention. We have reason to believe you may be interested in the products and services our new organization, BlackNet, has to offer. BlackNet is in the business of buying, selling, trading, and otherwise dealing with *information* in all its many forms. We buy and sell information using public key cryptosystems with essentially perfect security for our customers. Unless you tell us who you are (please don't!) or inadvertently reveal information which provides clues, we have no way of identifying you, nor you us. Our location in physical space is unimportant. Our location in cyberspace is all that matters. Our primary address is the PGP key location: "BlackNet<nowhere(a)cyberspace.nil>" and we can be contacted (preferably through a chain of anonymous remailers) by encrypting a message to our public key (contained below) and depositing this message in one of the several locations in cyberspace we monitor. Currently, we monitor the following locations: alt.extropians, alt.fan.david-sternlight, and the "Cypherpunks" mailing list. BlackNet is nominally nondideological, but considers nation-states, export laws, patent laws, national security considerations and the like to be relics of the pre-cyberspace era. Export and patent laws are often used to explicity project national power and imperialist, colonialist state fascism. BlackNet believes it is solely the responsibility of a secret holder to keep that secret--not the responsibilty of the State, or of us, or of anyone else who may come into possession of that secret. If a secret's worth having, it's worth protecting. BlackNet is currently building its information inventory. We are interested in information in the following areas, though any other juicy stuff is always welcome. "If you think it's valuable, offer it to us first." - trade secrets, processes, production methods (esp. in semiconductors) - nanotechnology and related techniques (esp. the Merkle sleeve bearing) - chemical manufacturing and rational drug design (esp. fullerines and protein folding) - new product plans, from children's toys to cruise missiles (anything on "3DO"?) - business intelligence, mergers, buyouts, rumors BlackNet can make anonymous deposits to the bank account of your choice, where local banking laws permit, can mail cash directly (you assume the risk of theft or seizure), or can credit you in "CryptoCredits," the internal currency of BlackNet (which you then might use to buy _other_ information and have it encrypted to your special public key and posted in public place). If you are interested, do NOT attempt to contact us directly (you'll be wasting your time), and do NOT post anything that contains your name, your e-mail address, etc. Rather, compose your message, encrypt it with the public key of BlackNet (included below), and use an anonymous remailer chain of one or more links to post this encrypted, anonymized message in one of the locations listed (more will be added later). Be sure to describe what you are selling, what value you think it has, your payment terms, and, of course, a special public key (NOT the one you use in your ordinary business, of course!) that we can use to get back in touch with you. Then watch the same public spaces for a reply. (With these remailers, local PGP encryption within the remailers, the use of special public keys, and the public postings of the encrypted messages, a secure, two-way, untraceable, and fully anonymous channel has been opened between the customer and BlackNet. This is the key to BlackNet.) A more complete tutorial on using BlackNet will soon appear, in plaintext form, in certain locations in cyberspace. Join us in this revolutionary--and profitable--venture. BlackNet<nowhere(a)cyberspace.nil> -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3 mQCPAixusCEAAAEEAJ4/hpAPevOuFDXWJ0joh/y6zAwklEPige7N9WQMYSaWrmbi XJ0/MQXCABNXOj9sR3GOlSF8JLOPInKWbo4iHunNnUczU7pQUKnmuVpkY014M5Cl DPnzkKPk2mlSDOqRanJZCkyBe2jjHXQMhasUngReGxNDMjW1IBzuUFqioZRpABEB AAG0IEJsYWNrTmV0PG5vd2hlcmVAY3liZXJzcGFjZS5uaWw+ =Vmmy -----END PGP PUBLIC KEY BLOCK-----

3 2

Physical to digital cash, and back again
by hfinney＠shell.portal.com 19 Aug '93

19 Aug '93

Anonymous points out problems with managing and using digital cash: > (1) customer reads ad about cool net.service > (a) they contact directly (but this ruins privacy) > (b) they contact independent distributor of > PGP key and anon-remail address generating software. > (but how does customer trust _them_?) > (2) vendor sends key & address generators (via e-mail or floppy), > and physical-mail-security instructions > (3) customer sends in money order (from mail drop or without > return address!) along with chosen anon e-mail address and public > key. > (4) vendor sets up account and e-mails the d-cash. > (5) we still need a physical mail drop or bearer bank > account for withdrawals, refunds, etc. of physical cash. It's true that this is a lot of steps. This is one reason why we should push to make anonymous mail easy to use. If you start with an infra- structure where you can communicate securely and anonymously across the net, with return messages that don't reveal your true identity, you have a good start on steps 1 and 2 above. Another simplification would be to split the users of the digital cash into customers and vendors, along the lines of the triangle diagram Tim suggested. In my experience, I make many withdrawals from my bank, but often only two deposits a month as my paycheck comes in. Applying this to the digital bank model, customers would mostly make digital cash with- drawals to buy things on the net, with occasional physical cash deposits to keep their balance up. Customers would thus primarily turn real cash into digital cash which they send to vendors; the vendors then turn the digital cash back into real cash. Customers can remain anonymous even without physical mail drops, while vendors have less anonymity. In this model, a customer sees some new software being sold on the net. He normally keeps enough digital cash on hand for such spending, so he sends the cash to the seller, including one of his standard anonymous return addresses for the return software. If this lowered his stock of digicash below the amount he likes to keep around, he sends another check to the bank and gets another batch of digicash. (This would be analogous to carrying cash in your wallet, and when it gets low you stop by the ATM and withdraw more. How often do you find yourself depositing cash back into the ATM? I suspect customers of the digital cash bank would similarly not need to turn their digicash back into real dollars very often.) With an infrastructure like this, using digital cash does not have to be complicated. > Also, the issue of which parts of these schemes are *legal* > is critical, but being completely overlooked. I once posted some excerpts from the Code of Federal Regulations involving the tax requirements of barter agencies. These are organizations in which their members exchange their labor without the use of regular cash. Often they use some scrip as a substitute for cash, or they may just keep records in an accounting system. It appeared to me that virtually any form of digital cash would fall under this definition. Barter agencies are not illegal, but there are many rules about reporting transactions and members. It would definately not be possible under the current tax code for a barter agency to have anonymous members. Therefore it looks like anonymous digital cash would not be legal in the U.S. at this time. I don't know about Duncan's suggestion to use an offshore bank. Paul Robichaux wrote, regarding the NetCash proposal: > Collusion between the service provider & the currency house can > produce a record of exactly what I bought, but I don't know that > blinding can do much better. Actually, blinding can do better. Collusion between the bank and the vendor can not break customer anonymity in a cash system using Chaum's blinding protocols. This is one of the things I found so surprising about the NetCash proposal. I am surprised they dare to call their idea an implementation of digital cash when it does not even provide this bare minimum of customer anonymity. This anonymity is why we call it "cash", as distinguished from other forms of money. The NetCash proposal is more like cashier's checks. Bill Stewart writes: > If you're sending non-accountable-by-sender cash, you need some way to get > a receipt. If you're mailing a check or digicash, you have a way to > repudiate the transaction or at least make a claim against them, > or if you can go in to the bank in person for the transactions with cash. This is a good point, and is another reason why blinding is so important. If you don't mind it being known in general terms that you are a customer of the bank, you can send a check with instructions to turn it into digital cash to be sent to your email address. There will still be no way that the bank can figure out when or where you spend that digital cash. And they are no more likely to just cash your check and pocket the money than any other mail order business would be. Hal Finney hfinney(a)shell.portal.com

1 0