October 2003 - cypherpunks-legacy

Q: Has a change taken place in factoring RSA keys?
by Jim Choate 29 Oct '03

29 Oct '03

Hi, One of the local Linux user groups had a talk at their meeting as well as some extended discussion on the mailing list regarding RSA keys and factoring. In particular a claim was made that recent technology has come to light that allows factoring of 1024 bit RSA keys at $1B (US)/day. The basic gist was that they were claiming that 1024 keys were no longer reasonable outside of a life time of approx. a year. That 2048 keys were by extension weaker, and that larger keys should be the norm. There was some discussion about hacking GPG to generate 8k keys. I'm wondering if anyone might comment on this with regard to sources of info or other efforts? In particular I'm interested in any leads regarding this supposed hardware breakthrough. I spent about an hour googling around and didn't really come up with anything substantial. Thanks. -- -- Open Forge, LLC 24/365 Onsite Support for PCs, Networks, & Game Consoles 512-695-4126 (Austin, Tx.) help(a)open-forge.com irc.open-forge.com Hangar 18 Open Source Distributed Computing Using Plan 9 & Linux 512-451-7087 http://open-forge.org/hangar18 irc.open-forge.org James Choate 512-451-7087 ravage(a)ssz.com jchoate(a)open-forge.com

3 2

Re: Certicom? [...] [Fwd: NSA Turns To Commercial Software For Encryption] (fwd from harley@argote.ch)
by Eugen Leitl 29 Oct '03

29 Oct '03

----- Forwarded message from "Dr. Robert J. Harley" <harley(a)argote.ch> -----

1 0

Re: "If you DON'T use encryption, you help the terrorists win"
by Harmon Seaver 29 Oct '03

29 Oct '03

On Wed, Oct 29, 2003 at 01:50:37PM -0500, Sunder wrote: > The push to do that should be aimed at the MTA authors and package > organizers. If you can get it turned on by default, you're half way > there. Last time I tried to fuck with this on qmail, I had to patch qmail > to support it. Not something I'd like to do again - hopefully it's > changed a bit. > > >From 1st hand experience - it is indeed a pain in the ass. > > But if you can get the big projects to turn it on by default for all/most > of the MTA's, then you can push the bigger fish to do so as well. I'd It's not setting up tls itself that's the problem, really, it's the cert generation that got me bogged down and so everytime I've tried it, first with sendmail and then with postfix, I've ended up with "okay, when I've got more time I'll finish this". Of course, ipsec is the same way. Setting up ipsec on a cisco router is sure a lot easier. -- Harmon Seaver CyberShamanix http://www.cybershamanix.com

1 0

Re: "If you DON'T use encryption, you help the terrorists win"
by Tyler Durden 29 Oct '03

29 Oct '03

Tim May wrote... "But silliness about "if everybody used encryption, then..." is just that, silliness." You seem to miss my point here (and in general), and since this is probably the closest area in which we agree, I'd suggest it's worthwhile examining this. Let's first of all agree that the proliferation of crypto is a good thing. If crypto is rarely used, then MY usage of it is actually almost worse (depending on context) than using it. More than that, increased use of crypto implies increased cost of monitoring. The $$$ nature of the assymmetry is mirrored precisely by the calculational assymetry. Ideally, it seems to me that this should be exploited. "If only everyone" is I agree largely pointless in and of itself. However, when coupled to some fairly easy and obvious applications of "greed", the potential results are interesting. Want an example? We now see file trading, messaging, and possibly even IP telephony occuring in P2P networks. Some of the P2Ps will be/are encrypted...a primitive form of "blacknet" you might say. Couple this app with popular notions of "protecting us from the terrorists" and you may have wildfire. That's the goal: wildfire. You're problem is that you don't realize that crypto is no longer a technological issue now. It's now a social and marketing one. The fact that "Tyler Durden" actually has little of major insight to say completely misses the point. Ideally, "Tyler Durden" is a generic, popular figure that embodies virulent, 'stoopid' popularity. Tyler Durden is not an intellectual: He's basically a dumb punk and a rabblerouser. Ideally, he's every man. He's everything you've always been afraid of, but he is precisely the one who can set you free. -TD >From: Tim May <timcmay(a)got.net> >To: cypherpunks(a)lne.com >Subject: Re: "If you DON'T use encryption, you help the terrorists win" >Date: Mon, 27 Oct 2003 18:40:51 -0800 > >On Monday, October 27, 2003, at 08:50 AM, Tyler Durden wrote: > >>"Basically they say things like "If you think the government can't break >>all >>the encryption schemes that we have, you're nuts." This guy was a math >>major >>too, so he understands the principles of crypto." >> >>Basically, the answer was hinted at by another poster. >> >>For anyone who doesn't trust the government, the point to make is that >>crypto use is currently a red flag. Last year I went through great pains >>on this list to point out that right now the gubmint probably doesn't even >>need to break most encrypted messages in order to know something's up. >>This is only possible because outside of a coporate context few >>individuals use encryption. >> >>If everybody uses encryption, then it matters MUCH less if the government >>can break any one message. What costs us pennies to encrypt may cost them >>thousands to break. That's the assymmetry we asyms can exploit. That's >>where we need to depart from a Tim May lone wolf approach to your >>friendly, smiling America-loving flag-waving cypherpunks: "If you don't >>use encryption then you help the terrorists win". > >I have no patience with "If _EVERYBODY_ did foo, then...." arguments. > >Contrary to what many of the newcomers (last 5 years) here have argued, >crypto anarchy was never about converting the world to one true political >system--it was, and is, about those motivated to do so to find ways to drop >out of the system and find ways to sabotage the various politicians and >socialists and minorities using government to steal from them. > >Finding ways to destroy large nests of socialists and minority welfare >mutants is of course consistent with this individualist approach. > >But silliness about "if everybody used encryption, then..." is just that, >silliness. > >"First we convert the world to our viewpoint" is an empty philosophy. > >"Tyler Durden," you have never shown a trace of sophistication or >cleverness in the several months you have been on this list. > > >--Tim May _________________________________________________________________ Concerned that messages may bounce because your Hotmail account has exceeded its 2MB storage limit? Get Hotmail Extra Storage! http://join.msn.com/?PAGE=features/es

3 2

Re: [s-t] privacy and caution digest #2
by Steve Lamont 29 Oct '03

29 Oct '03

> My only contribution is the mantra: "Take comfort in your own > unimportance." That is to say, paranoia has more than a smidgen of > self-aggrandisement to it, and though everyday worrying is not > paranoia, it's important to remember the allure inherent in thinking > yourself a certain target. Most of us, perhaps all of us on this > list, aren't worth it; whatever we do which might displease the > government or a real or fictive person with power is almost certainly > being done at the same time by a lot of other people. > > Fear of being watched is part of the plan of anyone maliciously watching. Except, of course, that while you as an individual may be unimportant, information about you is. Your email address is important to spammers, who seem to go to extraordinary lengths to get it and to break through any barriers you might attempt to erect to prevent them from filling your email file[*] with crap. Mass marketers want your physical mail address, to which they direct entire old growth forests worth of paper to entice you to refinance, change your phone carrier, or reshingle your house, usually with some deceptive come-on to dupe the slow-witted. Telemarketers. . . well, you get the idea. In the future, your shopping cart will spy on you as you cruise the aisles of your local megamart, phoning home whenever you slow down in front of the Oreos display, buy cheese, or condoms. Your TiVo already reports what programs you record, what commercials you skip and which ones you rewind and watch again. Your CD or MP3 player will probably be soon uploading your music preferences back to the RIAA. And if you wish to live anything resembling a comfortable life, you will have no option but to submit. Your every move will be watched, not just by TIA and the CIA but Nielson, Safeway, Wal*Mart, Fox, and Nike. The government only cares about your politics. The real Big Brother cares about your wallet and is thus much, much, more motivated. spl -- [*] I hate the "mail box" metaphor. It's not a box. It's a file. Or a directory. Whatever it is, it ain't a box. But that's another rant for another day. ----------------------------------------------------------- ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 0.97c removed an attachment of type application/pgp-signature]

1 0

Re: [s-t] privacy and caution digest #2
by Steve Lamont 29 Oct '03

29 Oct '03

> My only contribution is the mantra: "Take comfort in your own > unimportance." That is to say, paranoia has more than a smidgen of > self-aggrandisement to it, and though everyday worrying is not > paranoia, it's important to remember the allure inherent in thinking > yourself a certain target. Most of us, perhaps all of us on this > list, aren't worth it; whatever we do which might displease the > government or a real or fictive person with power is almost certainly > being done at the same time by a lot of other people. > > Fear of being watched is part of the plan of anyone maliciously watching. Except, of course, that while you as an individual may be unimportant, information about you is. Your email address is important to spammers, who seem to go to extraordinary lengths to get it and to break through any barriers you might attempt to erect to prevent them from filling your email file[*] with crap. Mass marketers want your physical mail address, to which they direct entire old growth forests worth of paper to entice you to refinance, change your phone carrier, or reshingle your house, usually with some deceptive come-on to dupe the slow-witted. Telemarketers. . . well, you get the idea. In the future, your shopping cart will spy on you as you cruise the aisles of your local megamart, phoning home whenever you slow down in front of the Oreos display, buy cheese, or condoms. Your TiVo already reports what programs you record, what commercials you skip and which ones you rewind and watch again. Your CD or MP3 player will probably be soon uploading your music preferences back to the RIAA. And if you wish to live anything resembling a comfortable life, you will have no option but to submit. Your every move will be watched, not just by TIA and the CIA but Nielson, Safeway, Wal*Mart, Fox, and Nike. The government only cares about your politics. The real Big Brother cares about your wallet and is thus much, much, more motivated. spl -- [*] I hate the "mail box" metaphor. It's not a box. It's a file. Or a directory. Whatever it is, it ain't a box. But that's another rant for another day. ----------------------------------------------------------- ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 0.97c removed an attachment of type application/pgp-signature]

1 0

Re: NSA Turns To Commercial Software For Encryption (fwd from brian-slashdotnews@hyperreal.org)
by pgut001＠cs.auckland.ac.nz 29 Oct '03

29 Oct '03

"Dave Howe" <DaveHowe(a)gmx.co.uk> writes: >I was under the impression they had just licenced their *patent* Yup, and that's all they did. I've seen some downright bizarre interpretations of this particular portent on the web (<cough> slashdot</cough>), but the simple fact is that the NSA, in its role as the agency responsible for overseeing crypto use by the USG, got a blanket Certicom patent license for cases where ECC (of the Certicom-patented variety) is used, just as they got a blanket DSA license for DSA, and would have had to get a blanket RSA license before that if it hadn't been USG-funded work and a blanket DES license if IBM hadn't made the patent freely usable. Certicom's PR folks, seeing an opportunity, put out a press release saying that the NSA had licensed their patent(s). This does not mean that the NSA is about the drop their own crypto for ECC (definitely the silliest interpretation of Certicom's press release I've seen), nor is it a sign that they believe RSA is dead or that the end of the world is nigh, etc etc etc. Peter.

1 0

The Register - SCO says GPL unenforcable, unconstitutional and void (fwd)
by Jim Choate 28 Oct '03

28 Oct '03

http://www.theregister.co.uk/content/4/33619.html -- -- Lo! Men have become the tools of their tools - H.D. Thoreau ravage(a)ssz.com jchoate(a)open-forge.com www.ssz.com www.open-forge.com

1 0

Re: "If you use encryption, you help the terrorists win"
by Tyler Durden 27 Oct '03

27 Oct '03

Tim May wrote... "I predict we'll soon be seeing a new thought control campaign with this theme, that "if you use encryption, you help the terrorists win."" Well, I'm dubious. Right now I'm thinking their strategy has been to pull encryption down off of the social radar, and that's worked better than any frontol assault. Also watch carefully for hole-pokers...I'd bet their's also been disinfo campaigns to get the public to think that no crypto is secure (every ask anyone if they believed there was such a thing as effectively 'unbreakable' encryption? Reglar folks always believe SOMEBODY'S got the technology to break what scheme you use, so "why bother"). Let's also remember that 'terrorists' are only terrorists when their guns are small. Once they start winning a few battles they're no longer "terrorists" (eg: Mao and that whole gang). So let's beat them to the punch: "Use strong crypto in order to keep America free from the terrorists." -TD >From: Tim May <timcmay(a)got.net> >To: cypherpunks(a)lne.com >Subject: "If you use encryption, you help the terrorists win" >Date: Fri, 24 Oct 2003 14:52:02 -0700 > >I predict we'll soon be seeing a new thought control campaign with this >theme, that "if you use encryption, you help the terrorists win." > >Similar to the heavy advertising (paid for by Big Brother, and hence by >money stolen from taxpayers) with the theme that lighting up a doobie helps >Osama, that taking an Oxycontin (sorry, Rush!) is equivalent to flying a >plane into the World Trade Center. > >Why encryption? Why now? > >Perhaps Eric B. can comment on the status of encrypted cellphones, of >whichever flavor, but it occurs to me that some people in Iraq desperately >need them. I refer of course to those trying to expell the American >soldiers occupying their cities and, as Anne Coulter put it and as senior >Army officials agree, "occupy their country, take their oil, and convert >them all to Christianity." > >You see, the landlines and central offices were largely wiped out in the >War for Oil. So what is now going in is what makes sense for nearly all >developing--or flattened--countries: cellphones. The U.S. had plans for the >contracts to deploy cellphones to go to American companies, but the local >puppets must have had no fear of the Americans, as they went with a better >bribe: mostly Arabic cellphone providers will deploy the initial system. > >And of course this is why there are a lot of subcontractors with ties to >the NSA, DIA, ASA, etc. now in Iraq monitoring communications. (Partly to >track down Saddam's whereabouts, as he may use a cellphone, if he's >careless. Recall the tale of Pablo Escobar.) > >So, what would happen if even 5% of the cellphones were encrypted with a >sufficiently-strong system (Eric's 3DES would presumably be enough)? > >And if not encrypted cellphones, encryption of the usual sort, over >networks. > >I wonder what would happen to someone found carrying copies of PGP into >Iraq? > >(Which is not to say copies are not already widely circulating, or readily >downloadable, etc.) > >It seems clear to me that the puppet state of Iraq (maybe we could dub it >"The Puppet Republic of Iraq"?) will not allow significant use of encrypted >cellphones, or perhaps even encryption over networks. If the daily attacks >on the crusaders continue to rise, and there appears to be some kind of >coordination, the intelligence agencies will be called to task on why they >are not intercepting (or jamming) the coordination channels. > >If the expected attacks in Saudi Arabia and other soft targets happen on >schedule in the next few weeks, we might even see reintroduction of crypto >ban proposals inside the U.S. > >We should not assume the war for crypto is won. > > >--Tim May >"A democracy cannot exist as a permanent form of government. It can only >exist until the voters discover that they can vote themselves money from >the Public Treasury. From that moment on, the majority always votes for the >candidate promising the most benefits from the Public Treasury with the >result that a democracy always collapses over loose fiscal policy always >followed by dictatorship." --Alexander Fraser Tyler _________________________________________________________________ Fretting that your Hotmail account may expire because you forgot to sign in enough? Get Hotmail Extra Storage today! http://join.msn.com/?PAGE=features/es

3 2

"If you DON'T use encryption, you help the terrorists win"
by Tyler Durden 27 Oct '03

27 Oct '03

"Basically they say things like "If you think the government can't break all the encryption schemes that we have, you're nuts." This guy was a math major too, so he understands the principles of crypto." Basically, the answer was hinted at by another poster. For anyone who doesn't trust the government, the point to make is that crypto use is currently a red flag. Last year I went through great pains on this list to point out that right now the gubmint probably doesn't even need to break most encrypted messages in order to know something's up. This is only possible because outside of a coporate context few individuals use encryption. If everybody uses encryption, then it matters MUCH less if the government can break any one message. What costs us pennies to encrypt may cost them thousands to break. That's the assymmetry we asyms can exploit. That's where we need to depart from a Tim May lone wolf approach to your friendly, smiling America-loving flag-waving cypherpunks: "If you don't use encryption then you help the terrorists win". This statement has the added irony of being objectively true, according to more international definitions of 'terrorism'. -TD >From: Burning Cows with Strauss <steve(a)njord.org>(by way of Burning Cows >with Strauss <steve(a)njord.org>) >To: cypherpunks(a)lne.com >Subject: Re: "If you use encryption, you help the terrorists win" >Date: Sun, 26 Oct 2003 20:37:47 -0600 > >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > >On Saturday 25 October 2003 04:27 pm, Tyler Durden wrote: > > Tim May wrote... > > > > secure (every ask anyone if they believed there was such a thing as > > effectively 'unbreakable' encryption? Reglar folks always believe > > SOMEBODY'S got the technology to break what scheme you use, so "why > > bother"). > >I have a few friends like this....anyone have suggestions for ways to >change >their minds? > >Basically they say things like "If you think the government can't break all >the encryption schemes that we have, you're nuts." This guy was a math >major >too, so he understands the principles of crypto. > >I feel pretty confident that 2048 bit encryption is reasonably safe for >now, >but how can I convince others, and how safe should I really feel in that >opinion anyway? > >Steve > >- -- >Steve Wollkind 810 C San Pedro >steve(a)njord.org College Station, TX 77845 >http://njord.org/~steve 979.575.2948 >- -- >All these worlds are belong to us, except Europa. Take off no zigs there. >-----BEGIN PGP SIGNATURE----- >Version: GnuPG v1.2.3 (GNU/Linux) > >iD8DBQE/mwqO0uexoyuzySARApnNAKCUxOrLDh2gk1Ls5piL1zsnXzhHuwCfUW5l >AYtOw2wfT0EqlvhWxo5rup4= >=12ec >-----END PGP SIGNATURE----- _________________________________________________________________ Concerned that messages may bounce because your Hotmail account has exceeded its 2MB storage limit? Get Hotmail Extra Storage! http://join.msn.com/?PAGE=features/es

2 1