December 2003 - cypherpunks-legacy

Re: Only accepting e-mail from known parties
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

How about one-time electronic stamps. I generate a large-ish number of long-ish random numbers. I store these into a data base on my system. I send one e-stamp to all of the people I want to communicate with and vice versa. Each person uses the e-stamp in the header or some other area of their message to me easily accessible to my mail bot. My bot reads the e-stamp and then checks the data base to see if the stamp is valid. If not, then /dev/null. If so, then: a) send the message to me; b) delete the used e-stamp from the data base; c) send a confirmation of received message with a new e-stamp in it. Thoughts? (I see one problem with this but it should be able to be worked out once the basic method is agreed to). --tallpaul

4 4

Re: bashing (fwd)
by Daniel Miskell 17 Dec '03

17 Dec '03

Allan, shut the hell up. This thread is truely unnecessary, can we just let it die? Munster --- _________________________________ *!Cheese Doctrine:!* Though cultured over time, and aged to perfection, one must not yield to produce mold. One must also not belittle themselves by conforming to the "whiz", but melt over the unprocessed ideas of Ghuda. _________________________________

1 0

Re: Only accepting e-mail from known parties
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Dec 25, 1995 14:53:19, 'Adam Shostack <adam(a)lighthouse.homeport.org>' wrote: > The basic problem is that (personal) spam is a social, not a >technical problem. If someone wants to annoy you via the internet, >they can do so. You can raise the cost of their annoying you, but you >need to be careful not to make it difficult to talk to you. > I agree in many ways. On a personal level, I am far more interested in the *social* are of this form of privacy. It is more a problem of the data-hermit than privacy. And in a society increasingly generating narcissistists, I see the problem getting worse. Negroponte of the MIT Media Lab can sing the praises of the personal e-newspaper with personal filters to cut out everything uninteresting while culling the world new feeds for desired information. I see this feeding into the narcissitism problem. E.G. Imagine two people who "feel" that members of the other gender are "only interested in one thing." Each wakes up in the morning and looks at their personal e-paper. She reads nothing of particularly nasty rapes, serial rapists at large, rapists who have been convicted, and rapists who an uncaring pro-male system has let out to rape again (i.e. been found not guilty). He reads nothing of particularly nasty robberies of men by women, serial robberies by prostitutes, female robbers who have been convicted, and robbers who an uncaring pro-female system has let out to rob again. Both believe that their custom filtered feeds are the *real* events going on in the world and are far more accurate than any non-customized news feed. I hope nobody takes this as a generic attack on the privacy issues that the list is devoted to. I am a great supporter of privacy and pro-privacy tek. But I see myself as a realist on privacy issues, not as a privacy-utopian or a privacy-dystopian. We live in a post-Faustian world. It is divided into two groups of people. First are those who understand the post-Faustian character and devote themselves to getting used to it and even having fun with the new opportunities while understanding that the new world also generates new problems (like furthering data-narcicism). Second are those classic-reactionary forces (from all parts of the political spectrum) who whine about how the post-Faustian world is personally unfair to them and how everybody in the world has a personal obligation to them to move the world back to its pre-Faustian origins. --tallpaul PS to Tim May: I understand your posts on material that is off-topic. I usually agree with your posts. But I see the issues I discussed above as far more on topic (even if highly mediated) than, say, the ongoing discourse on the differences between an Army Captain and a Navy Captain.

1 0

Encryption Discrimination from Sun
by mpd＠netcom.com 17 Dec '03

17 Dec '03

I was just browsing through the rules for the million dollar contest just announced by Sun Microsystems to encourage the writing of killer applets in Java, Sun's new architecture- independent program format. The URL is http://javacontest.sun.com/rules/index.html in case anyone is interested. While reading the contest rules, I found the following one particularly interesting... "No entries may include encryption as a feature or part of an applet." This was made even more curious by the later revelation that one of the criteria for judging entries was... "The applet should be able to transfer information from one point to another, with no possibility of interception or other interference during the process." Doubtless the reason Sun nixed encryption is because this is an international contest, and they did not want to deal with legal hassles involving international borders and different laws in every country. Nonetheless, they seem to have missed an excellent opportunity to encourage the migration of privacy software into the new realm they are creating. -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

2 1

Bidzos on C-Span 2
by John Young 17 Dec '03

17 Dec '03

If you care, Jim is smoothly hawking a beautiful world of easy-going crypto on C-Span 2, at least in NYC at 5:35 PM. At a session in San Francisco, probably a recording. Jingle jangle.

1 0

Bidzos Coda
by John Young 17 Dec '03

17 Dec '03

The Bidzos show was recorded 12/8/95 at the Commonwealth Club in SF. It finished here at about 5:45 PM. Only caught a piece. Jim was answering written questions about a range of crypto and Internet security issues from the audience. Among other things, he says they're working on an encryption program "closely tied to the OS of portables, to protect the data if the machine is lost or stolen." He also said, "don't throw tomatoes," but they're doing something with "private key escrow" for those who want to provide access to their encrypted material in case of death or other emergency. Maybe some other idle sinner saw more, or was at the realtime tomato-chucker.

1 0

(cpx) Re: Bidzos on C-Span 2
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 5:41 PM 12/25/95, John Young wrote: >If you care, Jim is smoothly hawking a beautiful world of >easy-going crypto on C-Span 2, at least in NYC at 5:35 PM. Actually, he did a pretty good job of towing the er, party line. Lots of good opportunities for analogical heavy lifting in arguments with statists. "Suppose you had a very strong door which protected your whole house and made it inviolate. Suppose then the government then wanted to have copy of your door keys on the off-chance you turn into a crack dealer someday...", etc. Except for the fact that he wants Uncle to protect his patents, that is... ;-). This was done on December 8 at the Commonwealth Club in SFO. Were there c'punks there? The questions sounded like it... He also said something about some kind of magic badge with biometric/PK software which would allow you to work anywhere there was a network connection. Reminiscent of our discussions about Xerox PARC's ubiquitous computing stuff, Gerry O'Neil's 2081, etc. I feel a rant coming on about this "information toaster" stuff, Metcalfe's fight with Alsop in Infoworld, etc. Guess I'll start it tomorrow. Take cover everybody... Merry Christmas! Cheers, Bob -------------------------------------------------- The e$ lists are brought to you by: Making Commerce Convenient (tm) - Oki Advanced Products - Marlboro, MA Value-Checker(tm) smart card reader= http://www.oki.com/products/vc.html Where people, networks and money come together: Consult Hyperion http://www.hyperion.co.uk info(a)hyperion.co.uk See your name here! Be a charter sponsor for e$pam, e$, and Ne$ws! e-mail rah(a)shipwright.com for details... -------------------------------------------------

1 0

Re: (cpx) Re: Bidzos on C-Span 2
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Oops. You can shoot me now... Sorry, folks! e$pam first and let god sort 'em out. Fixing that little problem this week, as a matter of fact. Cheers, Bob ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The NEW(!) e$ Home Page: http://thumper.vmeng.com/pub/rah/ >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: New Release of CFS
by dxm＠alpha.c2.org 17 Dec '03

17 Dec '03

Matt Blaze writes: > [Perhaps this isn't the best time for me to post this here; apologies > in advance if this sparks another flame fest. -matt] > > Source code for the latest version (release 1.3.2) of CFS, the Cryptographic > File System, is now available upon request for research and experimental > use in the US and Canada. Dear Mr. Blaze: As you seem to have noticed, a few subscribers to cypherpunks are more interested in exploring their own personal psychopathologies than in the creation and spread of strong cryptography. Please do not feel that you need to apologize for their actions, and especially please do not restrict your actions and/or posts because of them. To correct merely one of the many mis-statements made by these people desperate to draw attention to themselves, the Linux community is NOT interested in 'out-of-the-box'. If we were interested in 'out-of-the- box', we would be running OSs that COME in a box. What we ARE interested in is source (or, if source isn't available, at least 128 bit keys). If you provide source, we'll port it. It's that simple. While support is nice, and appreciated, it is NOT NEEDED. We can take care of ourselves. So, on behalf of the Linux community and those of us running CFS, thank you very much for your contribution. And please don't let a couple of idiots like these lower your opinion of the over 1 million Linux users who appreciate your efforts and support. -- Deus Ex Machina dxm(a)alpha.c2.org

1 0

Assault presses with cop killer computers.
by James A. Donald 17 Dec '03

17 Dec '03

While channel surfing around 6PM today on Christmas day, I saw President Clinton announce the grave international threat posed by terrorists, drug dealers and money launderers wielding computers (Only three horsemen -- he left out child pornographers.) He was immediately followed by an Expert In Television Expertise, who told us that computers were getting more and more powerful, and doing more and more things, and that Something Must Be Done. The Expert did not actually use the phrase "The first Amendment was never intended to protect modern assault presses using cop killer computers", but that was the message. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

HRB Systems Data Storage Encryptor
by nobody＠flame.alias.net 17 Dec '03

17 Dec '03

Check out http://www.hrb.com/encryption/ssp.html, your exclusive source of the Ultron Crypto-Engine (tm)

1 0

Re: New release (v.1.3.2) of CFS Unix encrypting file system available
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

>Source code for the latest version (release 1.3.2) of CFS, the Cryptographic >File System, is now available upon request for research and experimental >use in the US and Canada. Does anyone know if this code has made it across the pond yet? If so please post the ftp location to sci.crypt or comp.os.linux.misc. I don't read this list. Thanx.

1 0

Re: Assault presses with cop killer computers.
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Dec 25, 1995 23:36:00, 'Kevin L Prigge <Kevin.L.Prigge-2(a)cis.umn.edu>' wrote: >According to rumor, James A. Donald said: >> >> While channel surfing around 6PM today on Christmas day, I saw >> President Clinton announce the grave international threat >> posed by terrorists, drug dealers and money launderers wielding >> computers (Only three horsemen -- he left out child pornographers.) > >Probably because child pornographers have been dealt with in >the recent bill signed by Bill, which mandates 24-30 months >for transmitting child porn, double if a computer is used. > see Reuters, "Clinton acts to tougher penalties" 23 Dec 95 08:40 clari.news.crime.sex Message-ID: <Rclinton-pornographyURN-1_5DN(a)clari.net> see AP, "Clinton signs porn bill," 23 Dec 95 09:40 clari.news.crime.sex Message-ID: <Aclinton-pornoURCBj_5DN(a)clari.net> What is most interesting is how far the four horsemen have rampaged and the destruction they have already done. The internet is not the *least* regulated as those pushing for "tougher penalties" claim. One can argue, using the new federal doubling of prison terms when computers are used, that it is the *most* regulated. One can also see how far the combination of sexual hysteria and fear of new technology has fed into and been used by politicians from throughout the political spectrum. It also shows how much of the government threat to privacy is a social, not a technological, issue. While people argue about heat-death-of-the-universe encryption algos, a different form of hot air is producing the heat death of civil liberties. While cyber-libertarians talk about how strong crypto algos are needed to protect property and how "the statists in Washington" are trying to take away their crypto, right-wing pro-capitalist politicians have already taken away civil liberties. While crypto-radicals talk about how strong crypto algos are needed to lead the revolution and how "the nazis in Washington" are trying to take away their crypto, sexual hysterics calling themselves "radical feminists" have already helped take away many civil liberties. I support strong crypto. I support powerful and secure algos. I see it as a wonderful development of technology to protect individual privacy. But privacy is only one right of the citizen; it is only one of the many civil liberties under attack. I am also disturbed by the number of discussions on the list that may be on topic but avoid *these* social issues, E.G. Army vs. Navy Captain? how cheap is AT&T? Bizdos: confused executive vs. conspiratorial swine? Are CFS programmers being treated nicely? Fred Cohen: nice guy victim or swine? Why Alice should use PGP. Ever heard of bit fiddlin' while Rome burns? --tallpaul

1 0

Re: Only accepting e-mail from known parties
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 14:33 12/25/95, tallpaul wrote: >Thoughts? (I see one problem with this but it should be able to be worked >out once the basic method is agreed to). I assume that the "Problem" is that by only giving each corespondent ONE E-Stamp, you are single streaming your connections with them (ie: Are talking Half-Duplex). Not only are they restricted to one message "in-flight" but they can not start another message until they have done a capture run to acquire your ACK and get the new key.

1 0

Austin CPunk Video Update
by combee＠techwood.org 17 Dec '03

17 Dec '03

First, a lot of thanks to all of you who sent me ideas for the Cypherpunk video we are working on here in Austin. I'm sorry I haven't individually acknowledged all of you, but it was been a busy couple of months. Here is our status: We have agreed on the meeting infrastructure, with a video working group meeting twice a month of planning/strategy meetings and at other times for filming, editing, and so on. We have decided to do a 30 minute video with segments dealing with crypto history, basic theory, popular applications, and possible futures. We may go one to produce further videos which look at these topics in more detail. We have a outline of the segments of the video. The outline was originally conceived for a 60 minute program, so some items might have to be cut. This outline should be available online sometime soon off my web page at http://www.yak.net/combee/crypto/ (URL not yet active). This program will initially air on Austin's public access stations, but we have nebulous plans to distribute it once that requirement is met. Questions? Just write to me or to all the Austin CPunks at austin-cpunks(a)einstein.ssz.com. -- eebmoC .L nimajneB | Benjamin L. Combee (REVERSE) gro.doowhcet@eebmoc | combee(a)techwood.org (ENGINEERING) \eebmoc\ten.kay.www\\:ptth | http://www.yak.net/combee/ (RESERVE)

1 0

Re: a new idea: stocks == currency
by Mark Hittinger 17 Dec '03

17 Dec '03

> I've not seen promoted by any single author yet (although I have seen > some prominent cpunks argue the opposite). There was a book written some time ago called "SuperMoney" that basically argues this point (that stocks were not only money, they were *better* than money). One example would be a deposit at a bank. How can you tell if there is a potential solvency problem at the bank? One quick and easy check is to look at the value of the stock of the bank! You see this behavior in currencies when you are exchanging a stronger one for a weaker one or vice versa :-) PS: I read Prechter's "turn of the tidal wave" book over the holidays, and although it is mostly dry, it is an interesting read. Regards, Mark Hittinger Netcom/Dallas bugs(a)freebsd.netcom.com bugs(a)ritz.mordor.com

1 0

Re: HRB Systems Data Storage Encryptor
by James A. Donald 17 Dec '03

17 Dec '03

At 09:45 AM 12/26/95 +0100, Anonymous wrote: >Check out http://www.hrb.com/encryption/ssp.html, your >exclusive source of the Ultron Crypto-Engine (tm) The web page proudly announces: "is the only NSA-approved Type I data encryptor available today." There are probably some people ignorant enough to regard that as a recommendation. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Employer Probing Precedents?
by "Jason D. Livingood/WSC"＠hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To Whom It May Concern: I was curious as to where I might find some electronic freedom legal precedents. If, for example, an employer was planning to probe file systems on PCs in the off-hours and employees began encrypting their hard drives, what legal precedents would support the employees or would support the employer in blocking the encryption? Thanks for any info you can give me!! Jason Livingood jlivingood(a)hammer.net - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMOG/6ioZzwIn1bdtAQHQ2QF/cOq8vE9o+V/yGuk5KLbYv5E6xWJjV2cB pSHFhr4O0HtiTgOtTxMhylVmXFZpuosm =fIWG -----END PGP SIGNATURE-----

5 6

Re: FH radios
by jim bell 17 Dec '03

17 Dec '03

At 05:06 PM 12/25/95 -0500, you wrote: > There is certainly little additional cost to building a >trully secure digital cordless phone given the dense ASIC technology >that is standard in this kind of product - but someone has to >persuade the manufacturers that there is a real need and find a way >to allow them to export the product. > > Dave Emery N1PRE Is there actually a restriction on the export of really-fast frequency-hopping radios, even those (like cordless phones) which have no clear military value?

2 1

Re: [Rant] Flame threads and factual accuracy
by jim bell 17 Dec '03

17 Dec '03

At 07:30 AM 12/25/95 -0500, you (Fred Cohen) wrote: >With rights come responsibilities. If you want the right of free speech, you >have to use it responsibly - otherwise, you will lose the right - and quite >possible lose it for me as well. This commentary is pure bullshit. If it were possible to quantify it throughout history, I strongly suspect that the vast majority of instances where "free speech" was LOST (or was never had in the first place) occurred NOT because of some objectively agreed-upon ABUSE (irresponsible use) of that free speech, but in fact merely because those in power WANTED there to be no free speech. In short, "losing the right" had NOTHING to to with abuse. (Though admittedly, that might be a common excuse given...in lieu of the truth!) Fred, you richly deserve your bad reputation.

1 0

Mix Ported to DOS Yet?
by kdf＠gigo.com 17 Dec '03

17 Dec '03

[Please respond netmail, as I have but periodic contact w/list.] Subject says it all: Has anyone ported Mixmaster to DOS yet? It has been impending for about a year, it seems, but no one had actually done it last time I asked. Thanks for any new info... JE -- : Fidonet: John Erland 1:203/8055.12 .. speaking for only myself. : Internet: kdf(a)gigo.com

1 0

Re: FH radios
by andr0id＠midwest.net 17 Dec '03

17 Dec '03

Dave Emery writes: > There is also a newer technology called direct digital synthesis >or DDS that works by accumulating phase (adding to the previous value) We use DDS in some of our Microwave equipment between sites. > > There is certainly little additional cost to building a >trully secure digital cordless phone given the dense ASIC technology >that is standard in this kind of product - but someone has to >persuade the manufacturers that there is a real need and find a way >to allow them to export the product. > I agree; but, if the information you are passing is truly that important just use a landline phone. Eliminate the possable "leak". I'm not claiming that a landline phone is secure, but your cordless is connected to it, so no matter how good your security is on the phone its no longer secure once it leaves the base station and enters the landline. Further encryption can be implemented but this requires equipment on both ends. Really aren't we trying to create the most secure methods of information exchange with the least amount of cost? I'm budget restricted so PGP and the internet are more secure and cheaper for me than most other means of comunication, so far. :) Dr0id (andr0id(a)midwest.net callsign: N9XLM) ( Computer Consulting & Management ) (P.O. Box 421 Cambria, IL 62915-0421) -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQENAzCsIi4AAAEH/1hb5+tO/n99Nbppf0ImLJ6AaVZ3NlZP0ZHwRQor00uA129i d4zWixNXxc8t2auaqN+asV99LpIip3/nQzBnjydiumeBdGLF2PR9+6X8X/RrqKa1 dVIukxM5Agg2eM6ih+0J38hgKJ3qzKXSz6sjYmpaxvbXZoHHOLUk/ZtHUKvvEyPw hnJEYnut8NUnIeK56lqeqRw86yoeRKymbfCdjdpgeY2aRwK2FJts8sbb7Fs10s4y jgxWIxIipBznbGUTh1hb2XrLGPENwk3E/qqXQJEsrySbtwdl6VgTVQjhDDEJMitL DYeiQ3W5EgxfcdbM1j2FwYu3P/dM6Y0I8xLMYT0ABRG0NmFuZHIwaWRAb2ljdTgx Mi5jb20gKG9pY3U4MTIuY29tIHN5c3RlbSBhZG1pbmlzdHJhdG9yKYkBFQMFEDCs LO90C7R/GkJcSQEB01cH/0KC3sd+u4OxMku5378SJktoN6QIQYLJ7uVbuV4S51yK NAotCGf4Wl6wwjynzZvXKU0H87oDuMiq7FybgMNL2n+4bQIZi0iz0lIuzwoMDu63 NrHUW9Kz42pOnhrEhrdkHhHL9O5GgD1yc40fJ3qw5h7LQEjDxgypyw0IFILFc34u LeRLliNibxKp8JwAxXNHWSgxu28TQvmnkHi0AHP6tJ/uZYe+4dqJtrMMsYFjzZaz DPmxD+dzbTwlQKtJaP1ZkDI0Sr072wrZDv+G86GyGBMX2lpSafpRitnxuUttjU9o wsQ9Qo5xiH1nZRCs/bDzJe/gng+GHzevixDIITurtNA= =SgPT -----END PGP PUBLIC KEY BLOCK-----

2 1

COMMUNITY CONNEXION ANNOUNCES APACHE-SSL COMMERCE
by sameer 17 Dec '03

17 Dec '03

For Immediate Release Contact: Sameer Parekh 510-601-9777 COMMUNITY CONNEXION ANNOUNCES APACHE-SSL COMMERCE Community ConneXion today announced Apache-SSL Commerce, a commercial version of the Apache webserver with support for Netscape Communication Corporation's Secure Sockets Layer, a standard for encrypted communications over the Internet. Community ConneXion's Apache-SSL package includes Apache v1.0.0, extensions to Apache which enable the SSL protocol, additional customizations to the webserver, and tools to aid in server and SSL maintainence. The server supports virtual hosts and an extensible API to allow for easy modifications to the behavior of the server. Apache is currently the fastest growing HTTP server, looking set to become the most used web server on the net in 1996. Sameer Parekh, President of Community ConneXion, commented on their release of the encrypting webserver, "We're very happy to make available an affordable SSL server to the Internet community. For security to work, it must be ubiquitous, which requires that encrypting servers be affordable and widely deployed." Apache-SSL is available for free to non-commercial users, and the commercial use package, Apache-SSL Commerce, is available for $495.00. Customers who own versions of other commercial encrypting webservers can upgrade to Apache-SSL Commerce for $295.00. In addition to the right to use the server in commercial applications, the commercial package includes support and free lifetime upgrades from Community ConneXion. Apache-SSL Commerce is not available outside the United States, but Apache-SSL is available for free, both commercially and non-commercially, outside the United States from Ben Laurie, of A. L. Digital, Ltd. The Apache-SSL Commerce webserver is the only commercial encrypting webserver with source available. Ian Goldberg, graduate student at U.C. Berkeley, well-known for his work on SSL security, commented on the importance of available source, "The public release of source, especially for security-critical sections of code, is vital for a product in which the public must put its trust. It's far better for me to be able to check the software that's used, say, for accessing my bank account via the Web, for security problems, than for me to be forced to trust whatever company put out the product. Companies will soon find that releasing more information about the internals of their products will lead not only to better products, but better reputations, as well." Portions developed by the Apache Group, taken with permission from the Apache Server http://www.apache.org/. This product includes software developed by Ben Laurie for use in the Apache-SSL HTTP server project. This product includes software developed by Eric Young (eay(a)mincom.oz.au) Information on Apache-SSL is available at http://www.c2.org/apachessl/. Questions and inquiries regarding the server should be sent to apachessl(a)c2.org. Community ConneXion, founded in June of 1994, is the leading provider of privacy on the Internet. They provide anonymous and pseudonymous internet access and web pages in addition to powerful web service, virtual hosts, and web design consultation. Information is available from their web pages at http://www.c2.org/.

1 0

Cybercash security
by David Klur 17 Dec '03

17 Dec '03

What are the major security risks of the Cybercash system? I can't really find any, other than someone cracking the consumer's Cybercash client s/w password and using the victim's account to order something, or someone cracking RSA!. The following features seem to mitigate other risks... - The merchant never sees the credit card number - The Cybercash server does not store any credit card numbers (only temporarily while it is waiting for an authorizatino for a specific card purchase) - The consumer's credit card number is stored on his hard disk encrypted w/DES - The consumer sends his credit card number across the Internet encrypted w/DES and signed w/ 768-bit RSA

1 0

Fwd: Re: Fwd: Re: FH radios [Dave Emery] [Vaughan Pratt]
by stig＠hackvan.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I forwarded a cypherpunks message to technomads, where it got a killer response, so I'll bounce it back to Cypherpunks... Stig - ------- start of forwarded message (RFC 934 encapsulation) ------- From: Vaughan Pratt <pratt(a)cs.stanford.edu> To: technomads(a)UCSD.EDU Subject: Re: Fwd: Re: FH radios [Dave Emery] Sender: pratt(a)cs.stanford.edu Date: Tue, 26 Dec 1995 12:00:43 -0800 Message-Id: <199512262000.MAA23334(a)Coraki.Stanford.EDU> In-reply-to: Your message of "Tue, 26 Dec 1995 07:07:00 PST." <m0tUayp-0006F0C(a)hackvan.com> >>> Thus in a frequency-hopping radio you can push the retuning (read RF >>> phase-locked loop) technology to its limit and build transmitters and >>> receivers around them. These typically hop in the order of 100 times a >>> second. The adversary has to find the uncorrelated signal very quickly >>> indeed *and* have PLL technology at least as good as yours to recover >>> anything from it. Finding the signal generally means listening to all >>> frequencies at once, requiring huge amounts of hardware parallelism and/or >>> realtime computing power. Once you throw ten or so radios onto the same >>> band, it's no longer any use looking for the strongest signal, making that >>> approach useless. >> >> This is nowhere near the limit of the technology. 15 years ago, I was >> working on PLLs that would stabilize within a couple degrees of final >> phase within 3.5 microseconds. That permits you to do useful work at >> 100,000 hops per second. >> > There is also a newer technology called direct digital synthesis >or DDS that works by accumulating phase (adding to the previous value) >each tick of a high frequency clock in a register at a rate determined >by the contents of another register (the value here sets the frequency) >with the upper bits of the accumulated phase being used to address a >sine/cosine lookup table rom which in turn feeds digital output values >into a D/A converter. The output of the D/A converter is a sampled >approximation of a sine or cosine wave at a frequency set by the >increment register. The sample rate is set by the high frequency clock >rate. This is all wishful thinking. A 26-MHz wide channel such as 902-928MHz has a channel capacity of 2*26 Mbs or 6.5 megabytes/sec. So if someone can tell *that* you are transmitting somewhere within that channel then they simply record *everything* at that data rate in the entire channel, your transmission and everyone else's, for the necessary time. A $600 3.5Gb Sequel drive can record a ten-minute transmission; then the eavesdropper can use one Pentium or two dozen, budget permitting, to extract your message from that data. If all you are doing is frequency hopping or spread spectrum, reconstruction is a very undemanding algorithmic task, and one Pentium should be able to reconstruct your signal the same day, two dozen the same hour. >But to get back to the original point of this thread - while >such techniques are possible (as is full hard encryption), it is my >understanding that actual conusmer 900 mhz digital cordless phones >that use frequency hopping use a very limited set of frequencies >and a small set of fixed hopping patterns and don't hop very fast. Hopping speed is almost completely irrelevant to the computational complexity of this problem. >When the brand of cordless phones that most emphasizes security >from eavesdropping in its point of sale advertising display is the one that >uses open FM with simple speech inversion you know there is something >wrong, particularly when the company that makes it is a pioneer in >really secure digital speech over handheld radios (and a big governmeent >contractor). To put it mildly. You can never overestimate the cost of decryption. What looks expensive enough today to decrypt can plummet by orders of magnitude on alarmingly short notice. We used to think TCP was mildly secure until easily installed sniffers became freely available on the internet that would reconstruct a telnet connection and print out the first 100 characters, making it child's play to extract passwords. If you think that you are secure because the effort of an attack seems on the high side, bear in mind that the tasks in a systematic attack can by definition of "systematic" be programmed, greatly easing the attacker's task. And once programmed, the program can be distributed to all and sundry on the internet. If a given level of cryptographic strength seems adequate for a message, add several orders of magnitude and maybe you'll be lucky. I know of only two really satisfactory places to hide information worth hiding: combinatorial search space (read: real encryption such as DES or RSA, with a hefty key), and the real world, which as a search space is approximately the size corresponding to a combinatorial space encrypted with a 256-bit key (i.e. the world seems bigger than 128 bits and smaller than 512). The latter is distributed in space-time and frequency (momentum-energy); if you consider only space-time or only frequency the universe looks like only a 128-bit hiding place in either case. Both together give you 256 bits (very approximately, that's a very round binary number). Vaughan Pratt - ------- end ------- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by Mailcrypt 3.3, an Emacs/PGP interface iQCVAwUBMOCS5khaKuRiAqcVAQEJEAP/WNqKrjrGk5LpYt5fw70BtFYZEIMqkBzu TQscTmoK2sSOeI9yjxmOp8aQhArLpOdN0ZQgfwkuelfV+/n73ms3hMV+JIDOvuFx hirE1iBvZDMgEPX1BdyP94Me13a1f8mBKTTG1cPLIYKLSTZ1tmQ/MVI0EYN9H16U AETV7FJilvM= =l+fI -----END PGP SIGNATURE-----

4 3