December 2000 - cypherpunks-legacy

IBM Cries Crypto Wolf, Experts Say
by No User 01 Dec '00

01 Dec '00

Big Blue says it can make encryption twice as fast. But the company hyped a similar advancement years ago; experts say that idea didn't amount to much, and this one won't either. By Elinor Abreu IBM is announcing a new algorithm on Thursday that it says will double the speed at which online communications are encrypted. But several crypto experts say that IBM is fixing something that isn't broken and that Big Blue has a history of tooting its horn needlessly. IBM's new as-yet-unnamed security algorithm simultaneously encrypts and authenticates messages. It works with symmetric cryptography in which the same secret key, or mathematical code, is used to encrypt and decrypt, as opposed to public key cryptography, in which two different keys are used. The new algorithm has been submitted to the U.S. Patent Office and proposed to the National Institute of Standards. The improvement in speed won't be noticed when sending small items, such as an e-mail, but it will make a difference with things like a long Microsoft Word document, an entire Web page and bulk data, according to Charles Palmer, manager of IBM's Network Security and Cryptography division. The algorithm will be especially useful with parallel processors, spreading the work among multiple processors for even greater speed improvement, so that "pointing [a handheld device] at a Coke machine actually makes the transaction happen as soon as you touch the button," said Palmer. However, several crypto experts questioned the need for the technology and said it can't be taken seriously until it's been widely analyzed and tested. "There is no market demand for this algorithm," said Bruce Schneier, author of several cryptography and security books and chief technology officer of Counterpane Internet Security, a network monitoring outsourcer. "Sure, RSA (crypto) can be slow, but other aspects of network protocols are much slower. Rarely is the cryptography the bottleneck in any communications." Performance is already addressed by Moore's Law, which dictates that processing speed increases twofold every 18 months, Schneier pointed out. He also suggested that IBM's method is counterproductive P that most security protocols prefer separating encryption and authentication because they often have different key management and implementation requirements. "Combining the two makes engineering harder, not easier," he said. "I predict that if you go back in one year, zero applications will be using it." Tim Dierks, CTO of Certicom, concurred with Schneier and added that there are already other means, including hardware accelerators, to improve crypto performance. "I don't have reason to believe the market is hung up on this sort of solution. It's a question of whether there is market demand for it," he said. IBM's Palmer acknowledged that the new technology isn't going to have any drastic impact in the near term. "We can do it all right today, but this is just going to get worse as we get cable modems and DSL," he said. "[Schneier's] right; we may not have a blinding need for this right now." The criticism wouldn't be so harsh if IBM hadn't done this before. Two years ago, IBM announced what it called the "Cramer-Shoup cryptosystem" that it cited as "provably secure" and hyped as a replacement for SSL (Secure Sockets Layer), a protocol that is ubiquitous in e-commerce transactions. That IBM technology, which was designed to prevent against an obscure type of crypto attack, has not yet been deployed, noted Schneier. "IBM's got a track record of coming out with these major crypto announcements around early stage results" that haven't been evaluated and tested, said Dierks of Certicom. "They're seen as self promoting." An IBM algorithm dubbed the "Atjai-Dwork cryptosystem" was announced in 1997 and broken the following year, he said. Burt Kaliski, chief scientist and director of RSA's Labs, came to IBM's defense. The new IBM algorithm "is an interesting line of research; a nice application of theory to achieve some significant results," he said. "While we could debate whether there's a problem to be solved, it's a nice technology they've come up with. "Here, they seem to be on more solid ground in terms of the technology they're proposing," Kaliski added. "It still needs some more analysis by the crypto community."

4 3

Re: Re: Sunders point on copyright infringement & HTML
by Bill Stewart 01 Dec '00

01 Dec '00

(Tim and "Riad S. Wahby" <rsw(a)mit.edu> have been discussing mail formats for PGP.) Riad's latest message worked fine - it's the first time in a while I've seen Mutt sending PGP-signed messages that were actually readable with Eudora (in other words, they're Just Text, not some kind of broken MIME attachment.) Looks like you're using Mutt 1.2.5i. What settings did you use for other parameters? On my system, by the way, the previous message didn't launch MSWord; it asked me what application to use to read the message (and I told it Notepad, since I expected it to be text.) Tim probably picked one the Evil Empire tool sometime in the past, though perhaps it's a Mac-specific thing. At 11:41 AM 11/30/00 -0500, Riad S. Wahby wrote: > >*** PGP Signature Status: unknown >*** Signer: Unknown, Key ID = 0x1931C6A6 >*** Signed: 11/30/2000 8:41:06 AM >*** Verified: 12/01/2000 7:36:23 AM >*** BEGIN PGP VERIFIED MESSAGE *** > >Tim May <tcmay(a)got.net> wrote: >> No, it _doesn't_ work. Clicking on your "mutt-positron" icon >> presented to me in Eudora caused Microsoft Word to launch on my >> system. Which gave me this message: > >Oh, how embarrassing. I forgot to make the Content-disposition: field >inline instead of attachment. This was the source of the problem for >Eudora. > >I believe that is fixed now, and I've tested it with the copy of >Eudora Pro I have sitting on my Windows box. > >-- >Riad Wahby >rsw(a)mit.edu >MIT VI-2/A 2002 > >5105 > >*** END PGP VERIFIED MESSAGE *** > > > > Thanks! Bill Bill Stewart, bill.stewart(a)pobox.com PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639

2 1

Net News as Cover Traffic
by Ray Dillinger 01 Dec '00

01 Dec '00

I think that what we really need is some kind of NNTP-like system that distributes encrypted packets instead of cleartext ones. If you want to baffle traffic analysis, just create a system where they can't tell the difference between your emails and tons and tons of news traffic. It's not like you could really escape regulation here; if people can't read it, it isn't news. But you could provide a bunch of encrypted traffic on the same port as any encrypted- mail distribution or encrypted-web system (a la freedom) during the news distribution - and you could read news without any news hosts anywhere knowing which news you were reading. Hell, you could even gateway some usenet groups through it if you wanted to give it a kick-start. And you could have your own groups available only on the crypto grapevine. They would serve as message mixes, in some cases. You wouldn't want to follow the classic hierarchical distribution model that usenet uses; that makes any differently-routed traffic stand out. But NNTP is actually pretty flexible about how messages get passed, and could be deployed in a fractal way as easily as a hierarchical way, at the cost of distribution being a bit slower. With straight NNTP, the overhead of organizational messages would be raised; but it could be made more efficient again using hashes on multiple messages so that different hosts could quickly check for identical lists of posts and quickly discover any that were missing in either direction. Bear

1 0

Antigen found W32/Hybris@m virus
by ANTIGEN_EXCHANGE 01 Dec '00

01 Dec '00

Antigen for Exchange found sexy virgin.scr infected with W32/Hybris@m virus. The file is currently Deleted. The message, " Snowhite and the Seven Dwarfs - The REAL story!", was sent from Hahaha and was discovered in IMC Queues\Inbound located at ITC/Corporate/EXCHANGE.

1 0

Antigen found W32/Hybris-B virus
by ANTIGEN_BAMBI 01 Dec '00

01 Dec '00

Antigen for Exchange found sexy virgin.scr infected with W32/Hybris-B virus. The file is currently Deleted. The message, "CDR: Snowhite and the Seven Dwarfs - The REAL story!", was sent from Hahaha and was discovered in IMC Queues\Inbound located at Cognex/Natick/BAMBI.

1 0

Snowhite and the Seven Dwarfs - The REAL story!
by Hahaha 01 Dec '00

01 Dec '00

Today, Snowhite was turning 18. The 7 Dwarfs always where very educated and polite with Snowhite. When they go out work at mornign, they promissed a *huge* surprise. Snowhite was anxious. Suddlently, the door open, and the Seven Dwarfs enter...

1 0

RE: Arthur Anderson black-bagged, NIPC now spooking
by Carskadden, Rush 01 Dec '00

01 Dec '00

And you are bragging about this? Jeez. Have you MET the guy yet? So tell us, what was discussed, and where can we find it? -----Original Message----- X-Loop: openpgp.net From: Declan McCullagh [mailto:declan@well.com] Sent: Wednesday, November 29, 2000 9:50 PM To: Multiple recipients of list Subject: Re: Arthur Anderson black-bagged, NIPC now spooking On Wed, Nov 29, 2000 at 04:52:49PM -0500, Tim May wrote: > I don't know what "NIPC" means, but I thought at first you meant that > NIPC was in Lithuania. Perhaps not. FBI's National Infrastructure Protection Center. I'm on an ABA panel tomorrow with Michael Vatis, the head. Should be cybercast; I'll find details. -Declan

2 1

New Internet Casino page. $10 free on signup!!
by info2161105＠blackthumbnail.net 01 Dec '00

01 Dec '00

1 0

IBM E-Business Solution in a box
by Gladys Frankloden 01 Dec '00

01 Dec '00

IBM Small Business Web-Connections (Complete e-solution in One Box) Total Business Computing 'Internet in a Box' Low Low Price! " The InterJet II includes everything you need to access the Internet using IBM's Webconnection system and to build a fully functional enterprise online ....easy thanks to an almost overly simple setup " It is like owning your own web hosting company. You have total control. Internet access for up to 100 user Business class e-mail for everyone Fully Functional Internet Server Your Company domain name File Sharing capabilities Firewall Security 24X7 telephone Support Award winning InterJet Web appliance Analog, DSL, or ISDN Optional Secure Remote Network access Website Creation and hosting E-commerce capabilities For More Information Call Toll Free I-877- 775-4781 Or Visit the website below for picture and more details http://www.forchuteckconsulting.com/ibm_e-solution.htm For inquiries call the number or send e-mail to Sales(a)forchuteckconsulting.com ------------------------------------------------------------------- This mail is never sent unsolicited. This message is sent in compliance of the e-mail bill: SECTION 301. Per Section 305, Paragraph (c)(2)(D) of S. 1618, You subscribed to receive this email from one of our partners To unsubscribe simply reply message with remove?youremail in subject line. -------------------------------------------------------------------

1 0

re: Imagine
by Anonymous 01 Dec '00

01 Dec '00

Bill Stewart wrote: > The "bunch of elementary school kids had no trouble" press release > is fun, but bogus. If the teacher had told the kids > "Vote for Gore and Lieberman" instead of "Vote for Gore", > they'd have been much more likely to make a mistake. More likely, maybe, but not "much more likely." Now if the kids had been told "Vote for the Miscreant," or "Vote for the Statist," that's a different matter. Too bad they weren't told to "Vote for Who Needs Killing."

1 0