September 1993 - cypherpunks-legacy

Mailer hooks for PGP
by Graham Toal 10 Sep '93

10 Sep '93

In article <9308271722.AA11690(a)ah.com> hughes(a)ah.com writes: > >check your public ring and automatically sign/encode outgoing mail to > >eligible users > > As a general rule, mere presence of a key on a keyring should not > indicate that this person wishes to receive encrypted mail. There > should be a separate installation for that, either by an enhanced > alias file or similar. There are many for whom reading encrypted mail > is not always desirable, because the effort required to download it > and decrypt it is more time than the content is worth. I myself fall > into this category, unfortunately. This is very true. I hacked my mailer to encrypt when possible, and it drove Phil Zimmerman batty every time I mailed him and forgot to override it. G -- Personal mail to gtoal(a)gtoal.com (I read it in the evenings) Business mail to gtoal(a)an-teallach.com (Be careful with the spelling!) Faxes to An Teallach Limited: +44 31 662 4678 Voice: +44 31 668 1550 x212

1 0

No Subject
by koontzd＠lrcs.loral.com 10 Sep '93

10 Sep '93

>From: "David LANDGREN, PUB " <David.D.L.LANDGREN(a)pub.oecd.fr> >To: cypherpunks(a)toad.com >Subject: ... long live DES (sic) >Importance: Normal >Status: R > >>>>This chip takes a single plaintext/ciphertext pair and quickly tries >>>>DES keys until it finds one that produces the given ciphertext from the >>>>given plaintext. > >It's all very well to be able to crack DES in 3.5 hours, but I don't know >of too many people who obligingly send out the plaintext and cyphertext of >a message together, or in some other way combinable. If U can get the >plaintext of a DES-encrypted msg then U don't need to dick around with DES >anyway. No-one ever said it was bulletproof; a direct consequence is that DES users change their keys awful frequently. The way to get plaintext is through what is known as revealed-plaintext, where you can with a high degree of accuracy 'guess' part of the plaintext of a message, such as "From: Col. Dimwitt" in a message format, or the title of a paper or document, which is usally unclassified and knowable from another source. Fearing such, our illustrious 3 letter governmental organization implemented with the advent of electronic crypto gear (set your way back machine, sherman) something called traffic flow security, where on a radio net or dedicated line a cryptographic stream continously runs. The idea is to make it hard to distinguish boundaries of messages, and thus revealed-plaintext. This also allows the use of the caveat - EFTO (Encrypted For Transmission Only) seen on unclassified messages, hey the line was otherwise idle, waiting for classified traffic, right? Modern communications are swinging toward the use of packets, which beside allowing traffic analysis unless the transmission medium is denied (Such as using link encryption as a super encryption, or dedicated lines, etc.). The way to offset to offset the vulnerability to revealed-plaintext attacks is to use filling where some random data followed by a sync or start of message symbol preceeds the the actual message. All message traffic should be encrypted in general, making it hard to separate the wheat from the chaff. Ideally the only unencrypted data should be that required for operating the communications protocol, including denial of packet ordering if possible. There's a paper found on the NIST anonymous ftp site entitled 'Security in ISDN' by William E. Burr that can be informative. Its available in PostScript and is around 70 pages long.

1 0

Re: ... long live DES (sic)
by smb＠research.att.com 10 Sep '93

10 Sep '93

It's all very well to be able to crack DES in 3.5 hours, but I don't know of too many people who obligingly send out the plaintext and cyphertext of a message together, or in some other way combinable. If U can get the plaintext of a DES-encrypted msg then U don't need to dick around with DES anyway. No-one ever said it was bulletproof; a direct consequence is that DES users change their keys awful frequently. It's not that simple; Wiener's design is indeed a major breakthrough (for the open literature, of course). First of all, one can often guess probable plaintext for some of the message. Here's the first line of your note as it (apparently) left your machine: Date: 10 Sep 93 10:30:12 GMT If I've ever received mail from you, and hence know that format, I know at least the first 6 bytes, and the format of the next two. If I know the date of the intercept, I have even more. Poof -- a crib. I can do even better. Look at the $10,000,000 machine -- the one with a 21-minute solution. I can afford to try several guesses for where the string `Date: ' occurs. It doesn't take that much more complex a chip to look for obvious variants, such as that string occuring shifted over one or two bytes in either direction. You may get some false positives, but a second-order search machine can then apply more complex heuristics to possible keys returned by Wiener's design. And historically, enemies have been able to get probable plaintext -- or even some chosen plaintext -- for at least a few messages. Read ``The Codebreakers'' or ``Seizing the Enigma'' for many such examples. There's one more step here, described in detail in Garon and Outerbridge's ``DES Watch'' paper. If the DES session key is transmitted encrypted by DES using a 56-bit master key, you're dead meat. I can crunch for weeks to recover one session key, using many possibilities for the plaintext and its location in the ciphertext. But once I recover that long-gone session key, I can use it as the known plaintext to recover your master key. And after that, the jig is up. No, there should be no mistake about it. Single DES is *dead*, for any application where recovery of a single session key is bad. If you want to stick with single DES, you need to change session keys very often (every few seconds against an enemy who can build a $10M machine), and you need to distribute session keys by some other mechanism (i.e., RSA, Diffie-Hellman, triple DES). --Steve Bellovin

1 0

Cracking DES - A practical implimentation?
by ferguson＠fiber.sprintlink.net 10 Sep '93

10 Sep '93

On Thu, 09 Sep 93 16:14:56 -0700, <gnu(a)toad.com> John Gilmore wrote - > Be the first on your block! No kidding. I just ftp'd the des_key_search.ps file from ftp.eff.org and browsed through the first few pages (hats off to Michael for a fine piece of work). This is indeed an important milestone and will have an impact on the cryptographic implementations used by banks, etc. in the very near future. It should be interesting to see what the future holds .... > The paper was written as a warning to DES users (bankers) and their > customers (depositors). DES is used to protect electronic money > transfers among banks all over the world. Several billion dollars per > day are moved in this way. Within a day of finishing the machine, a > criminal could easily pay back the $1.5M in capital. In the second > day, they'd have the capital required to build a second machine, and > in the third day a positive cash flow would begin. Banks can do > nothing to stop this -- if they shut down their comm links, they go > out of business; if they keep moving money over them, intruders suck > money out at will. I recommend not keeping your money in banks... ...and in another communique - > Oho! I now suspect why RC2 and RC4 must remain trade-secret...NSA > doesn't want people to know what particular internal algorithm > features their brute-force chips are capable of handling! I recall > the discussion of how RC2/4 were invented; NSA told the designer > (since identified as Ron Rivest): "No, this is too big; weaken this > over here; do fewer rounds here; etc..." What resulted was suitable > for NSA brute-force using chips they had readily available. It's > possible that simple changes to the algorithm would render it much > less penetrable by NSA's current hardware. Ron even knows *which* > changes, and I encourage him to tell us. That would be an interesting revelation, wouldn't it? ,-) _____________________________________________________________________________ Paul Ferguson Mindbank Consulting Group fergp(a)sytex.com Fairfax, Virginia USA ferguson(a)icp.net

1 0

Re: "Code Warriors" Article in "Metro" Newspaper
by doug＠netcom5.netcom.com 10 Sep '93

10 Sep '93

tcmay(a)netcom.com (Timothy C. May) said: >Julian Dibbell's excellent article that appeared in the "Village >Voice" (August 3rd, cover story) is the *cover story* as well in the >latest "Metro" newspaper, the free San Jose area paper (but we get it >down here in Santa Cruz as well). Over lunch yesterday I was telling a friend (who had previously exhorted me to find folks on the net more appropriate than sci.crypt to discuss crypto schemes with) about discovering cypherpunks, and on our way out he noticed this Metro issue, commenting "Zeitgeist." Quite. :-) It quotes Tim, btw: You can get further away in cyberspace than you could in going to Alpha Centauri", says Tim May, and he should know. Before he retired seven years agao, a wealthy man at age 34, May was a reasonably illustrious corporate physicist. Now he's a Cypherpunk, part of a loose-knit band of scrappy, libertarian-leaning computer jockeys who have dedicated themselves to perfecting and promoting the art of disappearing into the virtual hinterlands. Concentrated in Silicon Valley but spread out across the country and as far away as Finland, the Cypherpunks maintain daily e-mail contact, collaboratively creating and distributing practical software answers to modern cryptography's central question: How to wrap a piece of digital information in mathematical complexity so dense that only literally astronomical expenditures of computer time can breach it? "Some of these things sound like just a bunch of fucking numbers," May explains. "But what they really are is they're things which in computability space take more energy to get to than to drive a car to Andromeda. I'm not kidding. I mean, you can work the math out yourself." Well, no, you probably can't, but even those unversed in rocket science can appreciate the social value of such calculations... And Eric: "Cryptography is a greater equalizer than the Colt .45," says Eric Hughes, the long-haired, cowboy-hatted and not entirely lapsed Mormon who, along with May, conceived the Cypherpunks just seven months before the Clipper hit the fan. "These are power-leveling techniques," he adds, pointing out that the hermetically sealed voice-and-data channels that could arm every citizen against state wire-surveillance are just the simplest of the crypto toys the Cypherpunks are playing with. Nicely provocative article. Doug -- Doug Merritt doug(a)netcom.com Professional Wild-eyed Visionary Member, Crusaders for a Better Tomorrow Unicode Novis Cypherpunks Gutenberg Wavelets Conlang Logli Alife HC_III Computational linguistics Fundamental physics Cogsci SF GA VR CASE TLAs

1 0

Re: Crack DES in 3.5 hours for only $1,500,000!
by smb＠research.att.com 10 Sep '93

10 Sep '93

Oho! I now suspect why RC2 and RC4 must remain trade-secret...NSA doesn't want people to know what particular internal algorithm features their brute-force chips are capable of handling! I recall the discussion of how RC2/4 were invented; NSA told the designer (since identified as Ron Rivest): "No, this is too big; weaken this over here; do fewer rounds here; etc..." What resulted was suitable for NSA brute-force using chips they had readily available. It's possible that simple changes to the algorithm would render it much less penetrable by NSA's current hardware. Ron even knows *which* changes, and I encourage him to tell us. I'll let Rivest speak for himself about NSA's influence -- but I've spoken to cryptographers who've seen the algorithm (under non-disclosure agreements), and they say that RC2 and RC4 are quite strong *if* you use a long enough key. They're algorithms with variable-length keys, and their strength -- and not just their resistance to exhaustive search -- is related to the key size used. The gotcha is that only the 40-bit version is exportable. But we don't need stories about weakened algorithms to know that NSA can crack 40-bit RC2/4; they'd never have granted a license otherwise. (And what does that tell us about 512-bit RSA?) One more point -- it's been claimed that RC2 and RC4 have an inherently- slow key setup mechanism. That can slow down brute-force attacks tremendously, since it then takes a long time to try each case. But it's fine for point-to-point encryptions, where you can amortize that overhead over many messages. --Steve Bellovin

1 0

... long live DES (sic)
by David LANDGREN, PUB 10 Sep '93

10 Sep '93

>>>This chip takes a single plaintext/ciphertext pair and quickly tries >>>DES keys until it finds one that produces the given ciphertext from the >>>given plaintext. It's all very well to be able to crack DES in 3.5 hours, but I don't know of too many people who obligingly send out the plaintext and cyphertext of a message together, or in some other way combinable. If U can get the plaintext of a DES-encrypted msg then U don't need to dick around with DES anyway. No-one ever said it was bulletproof; a direct consequence is that DES users change their keys awful frequently. David Landgren <david.landgren(a)oecd.fr> <dlandgren(a)bix.com> [standard disclaimer: this is my personal point of view] A B O L I S H F E A R -- E S T A B L I S H T R U S T

1 0

Crack DES in 3.5 hours for only $1,500,000!
by gnu 10 Sep '93

10 Sep '93

Be the first on your block! Michael Wiener <weiner(a)bnr.ca> produced a complete design for a DES key search machine, which he presented in the "rump session" at Crypto '93 last month. He designed a single custom chip which can do 50 million test encryptions per second, and the boards and racks and frames into which it fits. The full design has about 60,000 copies of the chip, solves DES in 3.5 hours, and is fully described in the paper. Here is an excerpt from his conclusions: It is possible to build a $1 million machine that can attack DES and recover a key in an average time of 3.5 hours. The machine uses a known plaintext to exhaustively search through the DES key space and could be developed for $500000 in about 10 months. Because a great deal of detail has gone into the design of the key search machine, we can have high confidence in the assessment of its cost and speed. The key search design presented here is one to two orders of magnitude faster than other recently proposed designs. Even cryptosystems with 64-bit keys may be vulnerable. If DES were modified to use 64-bit keys, there would be 2**8 times as many keys to search through, and a $10 million machine would take an average of 3.7 days to find a key. It is possible to build a key search machine that can support a range of modes of DES with little penalty in run-time. A $1 million machine would take 8 hours on average to find a key used in 1-bit CFB mode and 4 hours on average for any of ECB, CBC, 64-bit OFB, 64-bit CFB, or 8-bit CFB mode. This work shows that exhaustive DES key search is alarmingly economical. If it ever was true that attacking DES was only within the reach of large governments, it is clearly no longer true. A fairly painless way to improve security dramatically is to switch to triple-DES. The paper was written as a warning to DES users (bankers) and their customers (depositors). DES is used to protect electronic money transfers among banks all over the world. Several billion dollars per day are moved in this way. Within a day of finishing the machine, a criminal could easily pay back the $1.5M in capital. In the second day, they'd have the capital required to build a second machine, and in the third day a positive cash flow would begin. Banks can do nothing to stop this -- if they shut down their comm links, they go out of business; if they keep moving money over them, intruders suck money out at will. I recommend not keeping your money in banks... Most organizations who would build such a machine (national governments and other forms of organized crime) have probably already constructed many similar machines. This paper will not help them. It is intended to help people who thought that DES was secure. The full paper is available in PostScript via ftp from: ftp.eff.org:/pub/crypto/des_key_search.ps cpsr.org:/cpsr/crypto/des/des_key_search.ps cpsr.org also makes it available via their Gopher service. CPSR.org is on a slow link; use the ftp.eff.org archive if possible. (The file will appear there shortly; apologies for any delay.) John Gilmore Electronic Frontier Foundation Feel free to hack this up and send me back revised copy... John

1 1

Re: WACO: commentary, addresses to write
by remail＠tamsun.tamu.edu 10 Sep '93

10 Sep '93

Is there any ethical person inside Treasury with a digitizer and net access (or a freind with net access)? A great opportunity for use of alt.whistleblowers.

1 0

WACO: commentary, addresses to write
by L. Detweiler 10 Sep '93

10 Sep '93

wow, I guess this has been known in cyberspace since last friday. just goes to show you I don't read all the conspiracy newsgroups, eh? :) ===cut=here=== Newsgroups: talk.politics.guns,talk.politics.misc,alt.individualism,alt.activism,misc.legal From: lvc(a)cbnews.cb.att.com (Larry Cipriani) Subject: BATF GOES FOR COVER-UP OF WACO FIASCO, Organization: Ideology Busters, Inc. Date: Fri, 3 Sep 1993 17:35:28 GMT BATF GOES FOR COVER-UP OF WACO FIASCO, WRITE TO TREASURY NOW TO PROTEST!!! The people who launched the disastrous raid on the Branch Dividian compound in Waco, Texas, have now mounted an attack on the American people's right to know facts behind the tragedy. The Tresury Department is seeking to deny public access to invesitgative reports probing the government's actions leading to the Waco conflagration You have until September 15 to protest against this cover-up. Comments (preferably in triplicate) should be sent to the Dept. of the Tresaury, Office of Enforcemnet, Room 4312, 1500 Pennslyvania Ave., N.W., Washington, D.C. 20220. WRITE NOW! It has been reported that the Treasury wants to lockup many of the findings of the Waco investigation to "protect investigative techniques and procedures." What they are really doing is hiding the truth from the American people and preventing the people from making an accurate judgment on the BATF actions in Waco. This action is being taken at teh same time critizism of the raid is mounting. The affidavit used to justify the search warrant used in Waco has come under intense criticism, with stories in a number of major papers, the Washington Times the latest (Sept. 2). Experts who have researched the warrant have stated that it never should have been granted because the affidavit did not meet legal requirements. Specifically cited were: a quote attributed to Koresh regarding the LA riots, said to have been spoken three weeks before the riots happened; no probable cause based on information included in the warrant; inaccurate description of the firearms in possession of Koresh; and only technical, if any, violations of firearms laws. As a result of this intense pressure, there has been speculation in the press that Stephen Higgins, BATF Director and other top BATF officials may be forced out. However, to counter the growing outcry, the Treasury is now taking steps to seal away information from the investigation of the tragedy. That is, they are trying to cover it all up. Below is the text of a proposed rule change that would lock up the files of the "Waco Administrative Review Group Investigation", the panel assigned to investigate the assault on the Branch Davidian Compound. This means that Freedom of Information Act requests for information will be denied, and the public will not have access to this information. This is a blatant effort to cover-up the blunders in Waco. It can only be stopped if people cry-out in protest. DEPARTMENT OF THE TREASURY Departmental Offices (DEPO) 31 CFR Part 1 Proposed rule: Privacy Act of 1974, as Amended; Exemption of System of Records From Certain Provisions Contact: Nichole L. Jenkins, 202-622-0450 Comment Date: 09/15/93 (FEDREGISTER 58 FR 43312 08/16/93; 538 lines.) *Proposed Rules* --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- DEPARTMENT OF THE TREASURY Departmental Offices 31 CFR Part 1 Privacy Act of 1974, as Amended; Exemption of System of Records From Certain Provisions AGENCY: Departmental Offices, Department of the Treasury. ACTION: Proposed rule. SUMMARY: In accordance with the requirements of the Privacy Act of 1974, as amended, Departmental Offices, Office of Enforcement is proposing to exempt a system of records, the Waco Administrative Review Group Investigation (DO/.207) from certain provisions of the Privacy Act. The exemptions are intended to increase the value of the system of records for law enforcement and investigative purposes, to comply with legal prohibitions against the disclosure of certain kinds of information, and to protect the privacy of individuals identified in the system of records. The exemptions are intended to increase the value of the system of records for the factfinding investigation and administrative review performed by the Waco Administrative Review Group so as not to reveal local, state or Federal law enforcement techniques, sources and methods or affect the ability of law enforcement agencies to prosecute people for criminal wrongdoing. DATES: Comments must be received no later than September 15, 1993. ADDRESSES: Comments (preferably in triplicate) must be submitted to the Department of the Treasury, Office of Enforcement, room 4312, 1500 Pennsylvania Ave., NW., Washington, DC 20220. FOR FURTHER INFORMATION CONTACT: Nichole L. Jenkins, Attorney, Office of the Assistant General Counsel (Administrative & General Law), (202) 622- 0450, room 1410, 1500 Pennsylvania Ave., NW., Washington, DC 20220. Downloaded from GUN-TALK (703-719-6406) A service of the National Rifle Association Institute for Legislative Action Washington, DC 20036 -- Larry Cipriani -- l.v.cipriani(a)att.com or attmail!lcipriani

1 0