December 2003 - cypherpunks-legacy

Re: Netscape
by jim bell 17 Dec '03

17 Dec '03

At 09:52 AM 7/23/96 -0700, David Sternlight wrote: >At 5:09 PM -0700 7/22/96, Ted Anderson wrote: >> >>I must agree with Lucky. I am quite sure that even if Netscape was not >>begin distributed over the net, copies would still be uploaded to >>international sites by folks practicing Civil disobedience. > >To call simple lawbreaking by cowards working in secret "civil >disobedience" is to defame the name of Gandhi, King, and all the legitimate >protesters of modern history. Civil disobedience must be seen publicly, and >must be done by observable individuals. Masked men throwing stink bombs is >not civil disobedience--it's hooliganism. As usual, while you have at least the hint of a truth there, you manage to warp it just enough to be difficult to recognize. Historically, the the government has had nominal control of the media. The only civil disobedience that was _seen_ to be successful were the examples that made the news. And the "only" examples which made the news were the ones the government wanted to publicize. And the "only" examples the government wanted to publicize were the ones in which government "successfully" made examples of those doing it. And the "only" examples where the government achieved this were the ones where the perpetrator allowed himself to be caught. (my usages of the word, "only," are somewhat hyperbolic, of course. In practice, they are strong probabilities.) Your usage of the word, "legitimate" is quite slick (in the worst sense of the word, "slick"): The only ones you're going to want to acknowledge were "legitimate" are the ones that either are already successful, or the few you approve of and are still waiting to be successful. So, in a certain odd sense, it has been correct to say that the only "successful" (and thus, by your standards, "legitimate") civil disobedience has been that in which the perpetrator did it openly. And not surprisingly, anyone who does anything in such a way that he's not caught (and therefore, is also not subject to government-sponsored publicity) is a "coward" by your standards. How convenient! A rather sophisticated self-fulfilling prophecy. No wonder you've got some people fooled into believing you're a good debator. Fast-forward to 1996. Today, the traditional news media is beginning to be seriously bypassed by the computer networks, and this process is accelerating. No longer can the government keep enough control of the news media in order to help ensure that civil disobedience stays covered up unless they catch the protestor. Since everything else seems to be changing, it's no surprise that civil disobedience is, too. Today, civil disobedience still needs publicity, but to achieve that it now DOESN'T need the cooperation of the mainstream media, or implicitly the government. So a person doesn't need to be "caught" in order to win. The _results_ must be publicized, the person or people who did it doesn't. This represents a rather enormous change in the whole issue of civil disobedience, a change which is extraordinarily unwelcome among governments and statists alike. Jim Bell jimbell(a)pacifier.com

1 0

Re: Intel, Microsoft doing Internet Phone Software
by jim bell 17 Dec '03

17 Dec '03

At 10:47 AM 7/23/96 -0400, W Lee Nussbaum wrote: > > >On Mon, 22 Jul 1996, jim bell wrote: > >> If these people REALLY wanted to promote the use of Internet telephoning, >> what they'd do is implement a system where an Internet ISP could be "called" >> over the Internet by a person wanting to place an LD telephone call to that >> area, and (presumably using A/D and D/A techniques) rather than generating >> and receiving modem tones, woudl generate and transmit the audio over the >> telephone line. That way, the target of the call would simply need to pick >> up the telephone and talk, as he would ordinarily do: He wouldn't even need >> a computer. He might not even know the call was going over the Internet. > >...see IDT's Net2Phone product, at http://www.net2phone.com/; it does >what you describe. Two notes: (1) I haven't used it yet; (2: disclosure) >I'm now employed by IDT, though in a different area. Excellent! It seems that the one remaining piece in the puzzle is financial motivation. Many ISP's might hesitate to install a "feature" on their systems which has the prospect of tying up some of their lines, with no payback. As much as it pains me to face it, at this point what is needed is some system to pay the ISP's for maintaining and even upgrading their systems to make this whole thing practical. Currently, Sprint is proud to announce that they charge 10 cents a minute for off-peak calls. Could an ISP make money charging, say, 2 cents a minute for a similar service? The main marginal cost is that of an extra phone line, which is probably about $30 per month or $1 per day. Assuming the line is occupied 8 hours per day, that's 480 minutes, which means that the phone line costs 0.2 cents per minute. Even if other costs increase this by a factor of 5 or so, there should be nothing to prevent an ISP from making money off a 2 cent per minute charge or even less. Jim Bell jimbell(a)pacifier.com

1 0

Re: Flaws of Thinkers (Jefferson, Rand, Nietzsche, Voltaire, etc.)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:40 AM 7/23/96, bryce(a)digicash.com wrote: >I know a lot about Rand, and about her deep flaws as an >individual, especially in terms of treatment of her supporters, >but this is the first I've heard of this one. Perhaps Tim is >thinking of a play by Murray Rothbard called "Mozart Was a Red" >in which the Ayn Rand caricature insists that her followers >smoke. > >As for smoking being "proof" of man's dominance over nature, >Rand _did_ believe that in the sense of "demonstration" or >"symbol" but she did not believe that in the rigorous sense of >"proof". This was well-known to a bunch of us in the early 70s who were interested in Rand (and her extreme followers, known widely as "Randroids"). I think some of her essays in her Objectivist Newsletter had explained why smoking was essentially de rigeur. (By the way, at the time Rand was writing this stuff, doctors were recommending smoking as a digestive and health aid, and nearly everyone smoked. I don't condemn Rand for smoking, or for falling into the all-too-common practice of using "logic" to justify one's beliefs and practices.) Rothbard was a source for the smoking example, but not in a play (although he may have also used his knowledge in a play...I wouldn't know). Rothbard wrote an article for "Liberty," circa 1986-8, which is where I read the details. Also, I believe Barbara Branden's biography of Rand dealth with this, but I haven't read it in many a year. And there is this comment, from an admittedly off-beat source (http://www.zonpower.com/zonpower/book/chapters/chapter29.html) "Whatever the root of his irrationality, Dr. Peikoff's persona shrinks with his advocating force-backed intolerance as he expressed during his 1995 Ford Hall Forum lecture. Recall how Ayn Rand's life wastragically diminished by her irrational, deadly, "dot-of-light" glamorization of smoking. Her emotional, irrational denials of the narcotically addictive, physically destructive nature of tobacco smoking led her and some of her "caped" followers to the grave." --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: Digital Watermarks (long, getting off-topic)
by Alex F 17 Dec '03

17 Dec '03

> Easy enough. > > - Unless somebody reversed-engineered it, filtered it, and re-stamped it. Never said that it would be fool proof :) > - The entertainment industry has a reputation of being paranoid Sometimes with good reason, just like software producers are paraniod about piracy. Though, the Ent. Ind. does tend to overreact. IMO the copyright laws that are currently in place are enough to protect against the forms of piracy that they are trying to protect themselves against. I really don't think that there is need for new legislation or potentially privacy invading practices at this point. The forgers of the copyright laws (at least as they relate to music) had incredible foresight. Basically, from the laws that were originally drafted (30's maybe? Then revised in the early '70's at least as far as public domain goes) both videos and CDs are protected. These were written when there were no CDs or videos. > Some of you may recall > the flap over DAT, which significantly reduced the consumer market > penetration (the industry itself uses them all over the place). The Ent. Ind. got what they wanted though. There are taxes, etc. (some sort of import restrictions anyway) that keep DAT player/recorder devices at around $700 per unit. By this time normally the prices *should* be down to like $200 (using the CD industry as a guide) DATs are used all over the industry because they are cheap (see below), and because going from analog tape to DAT for CD mastering is a million times easier then sending off reels of analog tape, even if the tape is a properly mixed down duplicate of the master. There are still track times, numbers, etc., etc. A HUGE pain in the ass for CD manufacturers, but easy to do on a one-off basis in the studio where the producer & artist can sit there and help mix, fix tracks, select times, indexes, etc., etc. It can all be done to a single DAT )(which would then be copied for safety) and set along with a time code sheet. > (you still > have the even-less-effective argument of the associated cover art not > being included or being scanned and duplicated with reduced signal > quality, unless the distribution is all on-line). Cover art is pretty easy to duplicate if you have access to a color laser printer. Just scan the original in at 300dpi, and print it out at the same resolution/size and you have it. Just don't scan it in as a .GIF :) (too few colors) > Probably not done that way. My guess is that the disk ID is assigned > to the disk at the time of manufacturing. At the point of purchase > the customer is forced to give name, address, ID, whatever. This is > then stored in a database > > - Would YOU want to be responsible for maintaining that database? It's > like maintaining a hardware store trying to maintain an ID on every > single screw and nail in inventory. You would run into the same problems if it were done by CC. Hopefully the industry will do some sort of a cost-analysis (an accurate one) and realize that they would spend more on this than they lose (esp. since they still wouldn't eliminate piracy, just make it a little more difficult). > - Nobody's going to try and do a higher-frequency encoding (I HOPE). While > the human ear cannot hear those frequencies directly, we have found out > that those higher-frequencies interact in such a way to influence the > sound waves that influence what the user can hear. Yes, that's true. Anyone ever hear of HAARP? :) Certain frequencies can affect the brain in certain ways (a guy by the name of Robert A Monroe, while maybe a little eccentric, has been using this method since the 50's to do things like keep people awake when they are sleepy, vice versa, etc.). Also the body. Your body parts resonate a certain frequencies. For example, there is a very low note (I believe that it is a B) that vibrates at the same frequency as your bowels. Play that note, and you loose control... :) (If anyone knows this frequency, PLEASE let me know. I'm serious :) ). This is the reason > there's still a debate between digital and analog recordings, and is > still a big reason a lot of artists still record on analog equipment > (in musical "fuzzy" terms, it's equated with the warmth of the sound, > sort of like the tube-amp vs. solid-state amp debate among some guitar > players, etc.) If somebody deliberately played with such frequencies, > the journalistic media would probably have a field day. Yes, there are > audio cancelling and other tricks that could be deployed, but no matter > what, you're still deliberately introducing signal noise I touched on that in my other posting. The real difference between analog vs. digital is actually 2 things; static and musical "overtones" (used to produce various distortion effects and feedback, for example. ANyone who has listened to Robin Trower, Hendrix, Van Halen, etc. knows). People *are* playing with these frequencies. It's known as COSM or Composite Object Sound Modeling, and apparently is fuzzier (as in fuzzy logic, not fuzzy sound) than cold sampling is. Companies like Roland and Line6 are playing with such things. Roland is really doing some amazing things with this technology. > If I remember correctly, there is plenty of room in the design of the > audio CD protocal to embed such information, just like you can embed > the timing and track number information. Yeah, that's something else too. I'm not sure exactly how that works, but I *think* it's like a 1Khz or 1 hz signal that signals this. At least it is for the start of the first track on a cd. In the manufacturing process, at least > - Well, the MASS market piraters are exactly the point. Well, let's face > it, if the industry controllers got their way, there would be no > second-hand market like garage sales - there IS money involved here > (witness the bizarre dealings with CD-rental stores that have shown up The thing is, there is no money lost, really. Think about it. In order for one CD to be bought at a garage sale, someone else had to buy it at a retail store. If the record companies were in the used CD business then there may be money lost, but otherwise. The place where real money is lost is sale of promo CDs (many say "Promotional copy. Not for sale" on them). Here the record company loses nothing. The artist loses big time. With the exception of Sony records, most record companies will only pay artists royalties on 85% of records sold. The other 15% is said to be "promotional material" which is a huge scam run by the recording industry to take advantage of the artists. These 15% are still paid for (manufacturing, etc.) by the artist, and are given away to radio stations, etc. There is where the real money is lost. The rest is lieing with numbers. Getting off topic, Alex F =-=-=-=-=-=-=-=-=-=-=-=-=- Alex F alexf(a)iss.net Marketing Specialist Internet Security Systems =-=-=-=-=-=-=-=-=-=-=-=-=-

2 1

Re: DES Optimization (Brute Force DES)
by Peter Trei 17 Dec '03

17 Dec '03

> "Peter Trei" writes: > > The fastest general purpose, freely available des implementation I'm > > aware of is libdes. by Eric Young. With this, I can do a set_key in > > 15.8 us, and an ecb_encrypt in 95 us/block. That adds up to > > about 9,000 keytests/sec (this is on a 90 MHz P5, running NT). > > I'll point out that like most DES implementations, Eric's tries to > spend a lot of time in key setup to save time later on in > encryption/decryption. This tradeoff would probably be very different > if you didn't plan on trying more than one or two blocks of decryption > after getting a key. > > Perry Yep - with good optimization, the keygen and the des rounds get very close to each other in processing cost. Let's look at the steps involved (I'm refering to the DES description in Schneier, 2nd ed, p 270-278). I've not yet coded these optimizations, so this may be subject to revision. I'm assuming a known plaintext attack on a single 64 bit block, ECB mode. What we want to obtain is the key (which was presumably also used to encode interesting data which we can't read) First of all, we can move the initial and final permutes (tables 12.1 and 12.8) completely out of the testing loop. These have to done only once per run, and thus are effectively zero cost. Similarly, we can eliminate the key permutation (table 12.2), and iterate the permuted 56 bit key. If we get at hit, we invert the key permutation and add back the parity bits to get the original key. In the DES round The S-box and P-box steps can be combined into a single 48->32 bit permutation. So, per round (there are 16), we now have: 1. copy 32 bit sub-block to use as 'other' half in next round. 2. expansion permutation (32 -> 48) 3. xor with appropriate subkey. 4. perform the s-p permutation. (48->32) 5. xor with 'other' half from previous round. The key scheduling can be done in parallel with the rounds, since we're only planning on using each key once. However, on the Pentium it may be more efficient to do it before the des rounds, due to register starvation. Generating the subkeys is actually quite painful. You have to rotate the 56 bit key as two 28 bit halves, by one or two bits depending on the round, and then do a 56-> 48 bit permutation to generate the subkey. This step needs to be done 16 times. In a regular DES implementation, you generate the key schedules once at the start, and reuse them for each block, so there is little to be gained by optimzing this step. In a keysearch situation it's a different matter. Optimizing the permutations: DES was originally designed for hardware implementation, where permutation is a simple matter of braiding the wires between the input and output. It's a lot harder in software. I'm aware of two basic approaches: 1. Algorithmic: Analyse the permutation table to find bits which get shifted in the same direction, by the same number of bits, and arrange a series of SHIFTs, ANDs, and ORs to generate the desired permutation. This is essentially a geometry problem. 2. Lookup: Create tables for the permutation. While a permutation with n bits of input requires 2^n entries (each the size of the output data) if done as a single table, it's possible to break the permutation into several smaller tables, at increased processing time. This is a classic speed vs space tradeoff, with a big step if your tables are too large to fit into cache (and even bigger if they go to virtual memory) Example: A straight 32 -> 32 bit permutation: If done as one table, it would have 2^32 entries, and take about 16 Gbytes. If broken up into 4 tables, each of which dealt with 8 bits of the input, it would take 4096 bytes total. However, the calculation would require extracting the four eight bit subkeys from the input, doing four lookups, and ORing the four results together to get the final output. A 32 bit perm could also be done with two tables, but they would occupy half a Mb. The S-P step and the compression step of the key schedule are probably faster by lookup than by algorithm. I'm not sure about the expansion permutation, which is very regular. The size and number of tables used is going to depend a lot on cache size and available memory - for example, the rotates in the key scheduling can be eliminated if I'm willing to maintain 16 key compression tables (one for each round). I strongly expect that the whole key testing loop can fit into the 8k L1 code cache. The lookup tables *may* fit into the L2 cache. If anyone has any other optimizations, I'd like to hear about them. Peter Trei trei(a)process.ocm Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

1 0

Kids and Computer Privacy Was Re: No more stupid gun thread ...
by Scott Schryvers 17 Dec '03

17 Dec '03

At 06:24 PM 7/22/96 -0700, you wrote: >Ok. This thread has gone on long enough and covered just about every >point except the one which I originally made in my first response, >which is that I abhor the idea that kids should carry weapons (of any >sort) to school as standard equipment. In fact, I abhor the idea >that kids should carry weapons at school for any reason. > >Enough said. > >I do not care to discuss: > >1. Should kids have any weapons at any time? > >2. Should kids have guns (specifically guns)? > >3. Should kids know how to operate weapons of any sort? > >If any of you really really have to discuss this issue, let's spare >the rest of the list and send me E-Mail directly. > >Thanks! > >Ern > Should kids have crypto? [weapons] Should parents teach their kids crypto at an early age? Should kids have a right to privacy? If yes, should there be a limit to the privacy they hold? Under Itar crypto is a weapon. If a kid were to bring a disk containing pgp to school could they be expelled for carrying a weapon? Should children's legal rights be taught at school at an early age?

1 0

emscrypt 0.01 ALPHA
by Matt Carpenter 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I finally managed to find some time to do a little testing of emscrypt and make some of the changes that were suggested here earlier. It is still rather ugly and I haven't added many of the features/capabilities I hope to eventually implement. But I'm making it available so that people can play with it if they want. It looks like I'm going to be very busy for at least the next month trying to finish up the work for my master's degree, so I probably won't be making any major changes for a while. emscrypt's purpose is to automatically run PGP signed scripts received by e-mail and return the results to the submitter. emscrypt is a heavily mutated version of morepgp, originally by Jason Steiner and modified by Greg Spencer. Please realize that this program has NOT undergone extensive testing, so you may encounter strange behaviour. Make sure you read the documentation that exists. Using this program may make your system insecure, especially if you don't follow the installation procedure carefully. Use at your own risk. You should be able to find emscrypt and some documentation at: http://www.bmen.tulane.edu/~carpente Look under the "Other random projects or possibly useful stuff" heading. In order to try out emscrypt you need the following: * Perl -- emscrypt is written in Perl. * PGP 2.6.2 -- Other versions may work, but I haven't tested them and emscrypt relies strongly on knowing the format of the PGP output messages. * Procmail -- For passing incoming mail to emscrypt. This can be accomplished in other ways, but at this point I haven't tried any of them. If you don't have procmail you can still play with emscrypt by piping messages to it manually. I strongly suggest you do this anyway, to make sure you trust emscrypt to answer incoming mail. Here are the major things that have changed with emscrypt since I described it here a while ago: There are now two required headers which must be included in the body of the signed message: 'Reply-To:' and 'PGP-Key-Fingerprint:'. Both must appear before the beginning of the script. The beginning of the script is considered to be anything other than the above headers, blank lines, or lines that begin with '::' but that are otherwise empty. Duplicate headers will generate an error and prevent the script from executing. Case within the headers is not important. (You are free to use eLiTE d00dz capitalization techniques, just don't try to use kRe8yv sP3lliNg5.) 'Reply-To:' must be followed by a valid e-mail address, otherwise you won't get your results. (emscrypt will also recognize a 'Request-Remailing-To:' header in place of 'Reply-To:'. I added this so that emscrypt could be treated as a "remailer". The idea is that you could use software such as premail to automate the generation of messages going to emscrypt, so that you don't have to do the signing/encrypting manually. Then you could just send a script to yourself, "chaining" it through your emscrypt "remailer". But I don't think this will work without slight modifications to the remailer message generating programs, since emscrypt requires the 'Request-Remailing-To:' header within the signed body of a message (it would also be nice if the 'PGP-Key-Fingerprint' header could be automagically included)). The 'PGP-Key-Fingerprint:' header gives the fingerprint of the key used to sign the message and which will also be used to encrypt the results. It must also be included within the signed body of the message. Most of the other changes involved minor debugging and general clean-up (not that I consider it clean now). I also improved the error handling a little, but it needs more work, too. Right now emscrypt generally tries to generate, encrypt, and mail an error report if things go wrong. If that doesn't work, then it saves an error message to a log file. If you find any problems, please let me know. Comments, suggestions, etc. are also welcome. Thanks, - --Matt - -- mcarpent(a)mailhost.tcs.tulane.edu -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMfXlaijtJAMyBnp9AQHAdAf+MQ/ZroKoLeYyQDYabVrIq1eLSQB6vpr+ 2tXu63wDbcUeFoeSFNx6Sar7DNtAJyJUlwVcVKlb5SOuYR/8aFDvAnIYuQLPfdXd xXjC4iv+Hh3hNx4ibeyAB4xbFmDYAMB19zEf6nhmJdxR03oFXP+Qfx2m/aN/LDKZ zVSjtOs/ujTa6ltP6r/9x1vdiqmSNuSCNLvL/f4YulfdzR8frF0uLyLmiDH6mUpm etKxSpIg4ZI+iy1YvvSd+FtA0F3XSziaLEepx4X8gYjZKP0YXPTEMGhTeWj1o6bP yl06KUIRTL5k56P0xnW2MezGN5c0Cz2W9TEa9NBbHxY1DgSTDWa3sg== =DTpY -----END PGP SIGNATURE-----

1 0

Re: DES brute force? (was: Re: Borders *are* transparent)
by Dan Bailey 17 Dec '03

17 Dec '03

If we choose a plaintext/ciphertext pair carefully, we can easily save ourselves some work (50%) while still making the attack a credible demonstration. The idea is to use each trial encryption twice. In _Differential Cryptanalysis of the Data Encryption Standard_, Biham and Shamir note the following, known as the complementation property of DES: if T = DES(P, K) where T is ciphertext, P plaintext, and k key, then: T' = DES(P', K') where T', P', and K' are the bitwise complement of the above. Now the interesting part. If two pairs (P1,T1) and (P2,T2) are available with P1 = P2' or T1 = T2', then an attacker can restrict his search to only the keys with LSB = 0. The attacker runs through the remaining 2^55 keys (with LSB = 0) and tests the results against both T1 and T2'. Since testing for equality is much faster than performing the actual encryption, time savings is on the order of 50%. Just a thought on how to save some cycles. Dan

1 0

Re: Digital Watermarks (long, getting off-topic)
by tcmay＠got.net 17 Dec '03

17 Dec '03

(My comments are really minor quibbles, based on my longtime use of DAT machines, which I now have three of.) At 2:19 PM 7/23/96, Alex F wrote: >The Ent. Ind. got what they wanted though. There are taxes, etc. >(some sort of import restrictions anyway) that keep DAT player/recorder >devices at around $700 per unit. By this time normally the prices >*should* be down to like $200 (using the CD industry as a guide) As I said, I have three DAT machines. They are complicated machines, having lots of moving parts and precise tolerances. (And they are prone to break!) CD players are vastly simpler. I'm not at all surprised that prices have remained at about the $400 level for DAT decks, and about the same for DAT portables. After all, camcorders, which use much the same technology, have also remained at about the same price. And I don't think the SCMS code had too much to do with mass-acceptance. Most comsumers, according to available figures, *buy* C-90 cassette tapes, and do not make their own. (That _you_, the CP list reader, may use your cassette deck to make tapes has little to do with the vast numbers of cassette users out there do...most don't know how to record with their cassette decks.) Pre-recorded DAT tapes were available for a while...they did not sell. I believe this was because DAT machine purchasers were sophisticated and new how to make CD-to-DAT copies, with or without SCMS. Thus, the failure of DAT as a consumer medium (not to mention the much-hyped MD and DCC formats) probably is due to other reasons, including the mechanical issues, the lack of a real need for consumer DAT, and the confusion over new emerging formats. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: A Snake-Oil FAQ
by David E. Smith 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com Date: Wed Jul 24 00:10:54 1996 > Honestly, this boycott campaign looks out of place on Cypherpunks, at > least to me. I mean, we are for freedom of speech, aren't we? > Sternlight is talking about on-topic things. How come that renowned > defenders of freedom of speech resorted to name calling and attempts to > push their opponent out of the public forum? > (cheer) I don't agree with David Sternlight; frankly, I doubt very many of us agree with David Sternlight. But if we're going to start plonking just on the basis of a periodic rant, after he goes Perry goes, and Tim goes, and before long there's no list. Now to keep things interesting, somebody wanna subscribe Dorothy Denning to the list? Might be fun :) dave - ---- David E. Smith POB 324 Cape Girardeau MO USA 63702 dsmith(a)prairienet.org http://www.prairienet.org/~dsmith send mail of 'send pgp-key' subject for my PGP public key "I'm only a social smoker, just a few packs a day really" -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Automagically signed with Pronto Secure for Windows. iQEVAwUBMfWwaTVTwUKWHSsJAQHmAwf/XkwZZtAbymiSni4L8N6D6qW75W2B/Hgv yuPX0uCoXnBmvUXzq6RS7zNN0A1vtgXhCgzgyYY+1/1PRAAoQAd8q7evX1K+rTVe 1MmlOfJWFHJG9q0tHc45LONagW1m0eAp9Z9fkO4NRhGpybfWDCZKwtClbaLiAdoA 86lJnNRacjEHf1dAAHc/1dibJz+6617nfgLkea0OVbLICIsSpkc3PJLkFE9jjK2a g+5CXJ8oXg4bKlEw7QoefagXYsM9o6PF+MHIDVT/pZnfoVmGoI9+3BYHkByXh/vQ 8M+w6hZu4X50zzxCx/6lDvzfd1zccmHvJAsx6GXf4VGUp6lIw+lfCg== =KXCp -----END PGP SIGNATURE-----

1 0

Re: Bare fibers
by Bill Stewart 17 Dec '03

17 Dec '03

h > > Doesn't that make it vulnerable (detectable) to Tempest attacks? h > > Harka rw> No. rw> Transmitting light via fiber doesn't emit EM. Light is electromagnetic :-) rw> Anyway, the original post, as I recall, was about keeping sensitive data rw> on a second hard drive, connected via (very thin, therefore harder to rw> notice) fiber. Tempest monitoring was not a factor. rw> -r.w. I assume that if you've got a fiber hanging from your PC, and thugs come in to steal/confiscate/forfeitize your PC, that they're bright enough to notice it and maybe to follow it. Thugs who want your information will follow it to find information; thugs who just want to resell your hardware will follow it to find more hardware. I had initially assumed that the mention of fiber optics was in the context of "Infrared transmitter on the PC, fiber optic sticking out of the wall to receive the IR and transmit it to a hidden detector." or something silly like that. If you want to hide a small PC in your attic/wall/etc and use the newer faster IR stuff for clandestine backups, and have a Real Operating System so you can run it in the background (since your disk drive is presumably much faster than IR), I suppose you could do that. The main use of TEMPEST here is to detect backup systems hidden in the attic that they hadn't noticed. Hiding it in your stereo system doesn't protect it from honest thieves, who might also want to resell your stereo, and info thieves have been known to seize anything even resembling computer equipment, such as Mozart CDs. You could also hide the computer in your kitchen cabinets like one Famous Cypherpunk, but you'd have to use a thinner bundle of cables than he does to connect the monitors and keyboards :-) # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Confuse Authority!

1 0

RE: Distributed DES crack
by koontz＠netapp.com 17 Dec '03

17 Dec '03

>I'd like to see a very general hardware processing power equivalence table. >For example, 1 MasPar equals how many Pentiums. One MasPar MP2 (4K processors) could run 300,000 crypt(3) crack attempts per second (a password checker). That should give you 6 or 7 million brute force key attempts per second. Unfortunately the only way to show an equivalance for a particular problem is to have both machines work on the same problem. (Perhaps we could manage to break a DES key in the course of executing a new benchmark?)

1 0

the VTW---FBI Connection (fwd)
by Sharma 17 Dec '03

17 Dec '03

I am asking for some verification that you (cypherpunks) have something to do with this before I forward it anywhere. I looked at the vertexgroup and so-oregon webpages, and there is no investigative journalism there that I was able to find. Please get back to me soon. Thanks, sharma sharma(a)aa.net >X-URL: <URL:http://www.vertexgroup.com> >X-URL: <URL:http://www.program.com> >X-URL: <URL:http://www.so-oregon.com> > >>Date: Sun, 21 Jul 1996 20:51:23 -0600 >>To: cypherpunks(a)toad.com >>From: nobody(a)zifi.genetics.utah.edu (Anonymous) >> >>We have received information that VTW is run and supported by the FBI, >>which we have suspected for reasons listed here. >> >>I) They appear to have no financial support or funding source. They >>do not accept donations. They have no corporate funds. And yet they >>appear to be a thriving business. >> >>II) They are secretive about their location, and do not seem to have >>a headquarters. The address listed in the NIC is a vacant lot in of >>all places Brooklyn, NY. They do not have a listed telephone. >> >>III) On a tip from a "friend" we learned that the power leader behind VTW >>is a cleancut man with the unusual name "Shabbir M. Safdar." Not exactly >>a common name. Several people say they've met him. Our "friend" says >>that Mr. Safdar is in reality an agent of the FBI. >> >>IIII) We didn't believe this without external verification. So we called >>the Brooklyn office of the FBI and asked for Agent Safdar. No such person. >>I called the Washington office. No such person. Checked if there is >>any agent named Safdar. They don't give out this info. Then we tried to find >>ANY public records on a Safdar, with no luck. No driver's license in NY, >DC, NJ, >>etc. No phone, etc. Odd that such a person does not exist and yet runs a >>"human rights" organization? Then Alice called the NY FBI office. Asked for >>Agent Safdar. Guess what? "He's not in. Can I take a message". No message, >>thanks. He'll get the message all right. >> >>Now the big question: What is the FBI trying to do getting all these >>names? What else has "VTW" been doing? And what other organizations like >>them are there? Who else is in on it? What does this say about EPIC, CDT, EFF? >>Are Blaze and Schneier dupes, or willing participants? What about their >>ISP? I think we are all owed an explanation. This is serious. Maybe FOIA or >>a lawsuit before they burn the files. >> >>What do you want to bet "VTW" quietly fades away after a few prefunctory >>denials, and gets replaced by another organization in due course? >> >>Faithfully, >> >>Net reporter team Alice and Bob >>

2 1

RE: Distributed DES crack
by Bill Stewart 17 Dec '03

17 Dec '03

At 03:40 PM 7/23/96 PDT, koontz(a)netapp.com (Dave Koontz) wrote: > > I'd like to see a very general hardware processing power equivalence table. > > For example, 1 MasPar equals how many Pentiums. > >One MasPar MP2 (4K processors) could run 300,000 crypt(3) crack attempts >per second (a password checker). That should give you 6 or 7 million >brute force key attempts per second. Interesting - thanks for the result. Do you know how tightly tuned the crack implementation was (e.g. straight C with MasPar optimizer, hand-tuned assembler, etc.)? Since the MasPar has a large number of very small processors, I'd expect it to be better at bit-twiddling than conventional processors. # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Confuse Authority!

1 0

Re: DES-Busting Screen Savers?
by Steve Reid 17 Dec '03

17 Dec '03

On the subject of choosing keys randomly, rather than dividing up the keyspace... This seems like a very good idea to me. One potential problem is actually choosing the random keys. Have to be able to get entropy at a fast rate, and/or use a good PRNG. Both of these things would take time away from the actuall cracking (more time than just incrementing the key). And if a weak PRNG is used in order to save time, it's possible that it might favour certain keys and thus interfere with the attempt. Any ideas for a fast and good PRNG? ===================================================================== | Steve Reid - SysAdmin & Pres, EDM Web (http://www.edmweb.com/) | | Email: steve(a)edmweb.com Home Page: http://www.edmweb.com/steve/ | | PGP (2048/9F317269) Fingerprint: 11C89D1CD67287E68C09EC52443F8830 | | -- Disclaimer: JMHO, YMMV, TANSTAAFL, IANAL. -- | ===================================================================:)

1 1

Exporting cryptosystems in pieces: Re: Question [NOISE, mostly]
by Bill Stewart 17 Dec '03

17 Dec '03

Cc: vice.president(a)whitehouse.gov, The cypherpunks list has been discussing ITAR again. :-) >> If it is illegal (by our governments standards...) to export programs >>like PGP, etc., and you can send the whole source code in a message >>because that is also considered illegal, then could you send the code, >>broken up into many pieces, and send THAT in Email, would that be >>illegal? Exporting components of military hardware, including cryptosystems, is also specifically banned by ITAR. How big a piece is enough to get you prosecuted is a question for the nastiest of the N prosecutors out there, and whether you can be convicted is a question for the best of the 12 jurors you'll have.... Vince Cate's arms exporter page lets you export a highly-useful fully working cryptosystem in three lines with one mouse click (developed by Adam Back and an international cast of dozens.) Adam Back's export-three-lines-of-PGP-at-once is a more blatant test of this; go see his web pages. Here's my two bits worth - the following bits are components of PGP, Netscape 3.0b5, and also of RSAREF. 0 1 # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Confuse Authority!

2 1

Re: Digital Watermarks for copy protection in recent Billbo
by Alex F 17 Dec '03

17 Dec '03

> > People buying CDs at a garage sale & getting arrested for > >piracy. Wonderful. > > Arrests like this are uncommon. Even buying "cheap bikes" and other "cheap" > (= probably stolen and fenced) merchandise almost never subjects the > purchaser to criminal sanctions. Yes, but concievably if (whoever would be incharge, FBI?) *could*, under law do this, even if they are wrong. It is a lot harder to prove that they intentionally harrassed *you* than it is for them to say that they were following leads and show evidence. Yes, this may never happen, but the mere fact that it *could* is uncomforting. Kinda like the CDA an Clinton saying "we will not enforce this...." Fine, but there is still a law on the books that allows them to if they decide to change their mind. Even if you can't be found guilty, you could still be ruined by legal fees, job loss, etc. > ("Alice's Restaurant" not to the contrary; the confession to Officer Obie > cinched his fate.) Don't wanna end up on that "Group-W" bench! :) > > It would be trivial to add a digital ID signal at, > >say 30,000 or 15 or something like that. This could then be decoded, > > Doubtful. The existing CD standard tops out at a Nyquist limit of about > 20KHz, with the actual sampling at 44 KHz--but there is simply "nothing" at > above 20-22KHz. Putting a signal in at "30 KHz" is simply not possible, > given the Nyquist Theorem and the CD sampling rate. Cds are often sampled at 48 these days. Mine was, and we had to reduce it to 44.1 for mass producing (much to our surprise, since many CD manufacturers love getting stuff at 48 over 44.1) Not familiar with the Nyquist limit w/ regards to sampling rate vs frequency :( Alex F =-=-=-=-=-=-=-=-=-=-=-=-=- Alex F alexf(a)iss.net Marketing Specialist Internet Security Systems =-=-=-=-=-=-=-=-=-=-=-=-=-

1 0

Wiesenthal Center (Canada) and the Ostrich Syndrome (fwd)
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- For Skippy. - ---------- Forwarded message ---------- Date: 23 Jul 1996 08:26:15 -0700 From: Ken McVay OBC <kmcvay(a)nizkor.almanac.bc.ca> Newsgroups: alt.revisionism, can.general, alt.censorship, comp.org.eff.talk, misc.legal, ont.general, bc.general, talk.politics.misc Subject: Wiesenthal Center (Canada) and the Ostrich Syndrome The July 19 article in the Vancouver Sun, "B.C. Internet provider is the largest Canadian site for racist material" is alarming. (See URL http://ftp.nizkor.org/ftp.cgi?orgs/american/wiesenthal.center/press for a copy of the article.) It is not the material found on the websites mentioned, nor the fact that the host server is Canadian - nor indeed that the server is physically located in BC - which give cause for alarm. It is alarming because - either by deliberate design or by abject ignorance - - Sol Littman (and the Simon Wiesenthal Center [SWC] whom he represents in Canada) is fostering and promoting the spread of the "Ostrich Syndrome." Their actions represent a counter-productive denial of reality - akin to the Ostrich burying its head in the sand. Littman is quoted as saying: "We found the longer you leave these groups unexposed, the longer they fester and the more they infect others and the only way to deal with them honestly and forcefully is to expose them to the light of truth." Yet the article concludes, "Littman said he wants to see if Klatt will remove the groups from Fairview voluntarily before the centre takes any other action." The only truth that seems to emerge from such a veiled threat is that Littman has no understanding of the Internet. One is at a loss to determine how removal of the "groups" from one Internet Provider's server would in any way "expose them to the light of truth." If Littman had any knowledge of the Internet, he would know that the Nizkor Project [http://www.nizkor.org/] is an award winning website that is accessed daily by hundreds. In addition to being a source for those who seek information about the facts of the Holocaust, it is used as an electronic resource for those who wish to "deal with [these groups] honestly and forcefully" thereby exposing Lemire and many others - of whom Littman may not even be aware. Nizkor is arguably the "host" to more hate literature than any other website. Since we also include a link to the Zundelsite amongst others, will Littman next be targetting Nizkor and demanding that we remove such links? Or that we hide from public view the mountains of archived material which meticulously documents and uses the "arguments" put forward by these groups as instruments of their refutation and exposure? If Littman and the SWC prefer to bury their heads in the sand while engaging in this futile exercise in darkness, let them do so. But the martyrdom they hand on a platter to Lemire and others whom they find offensive stands in marked contrast to their failure to use the Internet on their own website. Conspicuously absent on the SWC website are links to the increasingly growing number of useful resources for those who truly do wish to participate in the battle to expose racist and anti-semitic groups on the Internet. The Ostrich syndrome is far more dangerous to society than any white supremacist group on the Internet. Such groups will fester in darkness, but wither in light. Kenneth McVay, OBC The Nizkor Project - -- Nizkor Canada | http://www.nizkor.org - -----------------------| Prince Myshkin's Troll Bait Sold Here |-------------------------------------- http://www.nizkor.org/hweb/people/g/giwer-matt/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMfVcLJNcNyVVy0jxAQENJQIAwGhMdP82l3S0Ac3uSaYaUcj1TowW6J9F K+l+wRmWwpQBuxq+INEPghNcY54thnc6iQIqGfR5KVoUsFNLAk9lcg== =12JK -----END PGP SIGNATURE-----

1 0

Re: Netscape
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 1:23 7/23/96, Jeff Weinstein wrote: > If you know that the recipient can read a message encrypted with >3DES, IDEA, or RC2-128, then you can send the message using one of >these strong algorithms. Given that you need someones public key >to send them a message, there are several obvious ways to transmit >information about what algorithms they accept along with it. Granted. What about the signature bug? Will Netscape encrypt the outside signature? -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

2 1

Re: Bare fibers
by jim bell 17 Dec '03

17 Dec '03

At 03:20 AM 7/23/96 -0400, Rabid Wombat wrote: > >> >> Doesn't that make it vulnerable (detectable) to Tempest attacks? >No. >Transmitting light via fiber doesn't emit EM. >Anyway, the original post, as I recall, was about keeping sensitive data >on a second hard drive, connected via (very thin, therefore harder to >notice) fiber. Tempest monitoring was not a factor. It occurs to me that a bare fiber could actually be (randomly) hung across treetops, roofs, power lines, and various other structures, over a many-block distance in suburban areas. Such a fiber wouldn't be protected very well, but it would probably last a few months. It would also be exceedingly hard to find its terminations, and tracing it would be a real pain. (It probably wouldn't be visible against a bright sky more than a meter or two away.) Jim Bell jimbell(a)pacifier.com

4 3

RE: Brute Force DES
by Matt Thomlinson 17 Dec '03

17 Dec '03

well, first of all, I wasn't computing 2^40, I was computing something like 2^(56*0.667) * 8bytes/each or somesuch, I don't recall exactly as I don't have the paper in front of me. In any case, it was the tradeoff between time and space -- 2^40 in time was something like 2^38th in space. But don't trust my numbers, get the paper and rattle them off yourself. It just seems like if we're going to browse all of the way through the DES keyspace, we _ought_ to take notes along the way -- that means building a table. I don't care how big the table is; if it is only 2^30 entries (about 1G entries, each 8 bytes = 8Gig) we reduce our next DES crack by a factor of 8. If we keep 2^31 entries (16Gig) we can cut it down to 2^50, or a factor of 16. If we have 4 - 9 Gig drives (or perhaps three drives and some wiggling, described below) we can save about 2^32 entries and the search becomes a measly 2^48. :) To whittle this down to a 40-bit workload, we'd have to save 2^36 entries* 2^8 bytes/entry = 2^39 Bytes = 512 Gig. Yes, admittedly large. What's the cheapest form of storage, magtape? How much can you store on magtape? The entries can be sorted so that lookup doesn't take long even when you have to mount tapes. Wiggling: We may be able to save less than 2^8 bytes/entry because we know the quality that made the point interesting enough to save (say we only keep points where the top 32 bits were zeros -- no need to save these zero prefixes) but I suppose we'd only be able to cut this storage factor down by a factor of two at most. If you don't have Hellman's paper handy, the apropos formulas are: Total time=T, memory=M, search space=N Time/space tradeoff: M=mt , T=t^2, m*t^2=N In our case, N=2^56; M, T variable. mattt >---------- >From: Ray Arachelian[SMTP:sunder@dorsai.dorsai.org] >Sent: Tuesday, July 23, 1996 3:16 PM >To: Matt Thomlinson >Cc: 'trei(a)process.com'; 'cypherpunks(a)toad.com' >Subject: RE: Brute Force DES > >On Tue, 23 Jul 1996, Matt Thomlinson wrote: > >> why not put together (a LOT of) disk space and we can build a table >> (read: "a cryptanalytic time-memory tradeoff") for cracking DES? Using >> the table, we could brute-search the DES keyspace in less time than it >> would take to do an exhaustive search of a 38 bit keyspace, according to >> the paper. 4 gigs is what, a couple of hundred nowadays? >> >> Making DES equivalent to a 40-bit crack would take approx. 500Gig, but >> publishing the table would push DES out usefulness. Certainly we could >> scale back (make DES equivalent to a 45-bit crack?) if we don't have >> enough disk... > >IMHO it's more expensive to go this route than to build a machine with >dedicate DES cracking chips. 2^40 = 1,099,511,627,776 or about 1 terabyte >worth of space, not 500G. 2^39 would be 500Gb. A 4Gb drive these days is >$800, hardly a couple of hundred dollars. :) > >Even so, that's a ton of hard drives. Further you need machines to hook >these drives up to. Infact, you need a farm of machines. Why? You can >only put 7 on a chain, and maybe if you're lucky four chains in a machine >using four controllers. > >A better idea might be to make small cheap computers, say based on 8086's >or 68000's that replace the drive's controller card, or if that drive >controller card is intelligent enough to be a CPU or contain one, burn >EEPROMs. Have the EEPROMs be able to generate DES (or any other >cypher's) keyspace given a range, and then have them able to search the >whole drive for a match. > >Even so, if you build these drive boxes, all you've accomplished is to >create a nice huge big searchable array. You still will need some sort >of logic to figgure out when it finds the right key, and you still can't >do 3DES or recusively encrypted files, nor know when you've found the key >for data you can't recognize - or rather have these drives recognize. > >However: Reading a 4Gb drive end to end takes less than 2 hours. I know >this because I have a RAID array of them, and it takes 2 hours to >rebuild, so since rebuilding an array requires reading from two drives >and writing to one drive, reading a whole 4Gb drive at full speed would >be something like maybe 1 to 1.5 hours(???) > >You might be better off with 9.0Gb drives if you can afford them because >you then have less controller logic cards to build. > >The drives alone will cost $204,800. $800*(2^40/(4*1024*1024*1024)). >You could get a nice big discount if you buy that many, but this will >also mean however much it will cost you to build the cpu cards for >multiplied by 256 drives, plust the R&D cost, plus the network connection >between all the CPU boards. > >At that point you also run into the MTBF of the drives which means that >your drives will fail quite often. > >If you want to go dirt cheap on the CPU's while using this huge space >method, you could just buy something like 37 Mac IIsi's, hook each up to 7 >of the drives (you'll have to partition the drives as they won't support >volumes that huge.) and network the machines using localtalk. You won't >need a faster connection because all you need for networking is keyspace >distribution and success reporting. But then IIsi's are sloooow machines >and your searches will suffer a hit from the lack of the machine's speed, >plus all the overhead of having an operating system and using the SCSI >chain to talk to the drives. > >IIsi's go for $350-$500 nicely loaded... $14800 for 37 at $400 a pop, >add the drives to that, plus the cost of writing the program and hooking >all of this crap together and that'll be $219,600. Ya got that kinda >dough to spare? > >========================================================================== > + ^ + | Ray Arachelian |FL| KAOS KERAUNOS KYBERNETOS |==/|\== > \|/ |sunder(a)dorsai.org|UL|__Nothing_is_true,_all_is_permitted!_|=/\|/\= ><--+-->| --------------- |CG|What part of 'Congress shall make no |=\/|\/= > /|\ | Just Say "No" to|KA|law abridging the freedom of speech' |==\|/== > + v + | Janet Reno & GAK|AK| do you not understand? |======= >===================http://www.dorsai.org/~sunder/========================= > Key Escrow Laws are the mating calls of those who'd abuse your privacy! >

1 0

Re: DES-Busting Screen Savers?
by Bill Stewart 17 Dec '03

17 Dec '03

Tim and others have discussed the effectiveness of random search vs. centralized servers, problems of cheating, scaling, etc. My take is that, if you can ignore scaling, the best approach is probably to have a central server that doles out keyspace and wraps around when it reaches 100%, and doesn't worry too much about collecting results - even if there are cheaters, machine failures, etc., and people don't finish their keyspace, it'll be more likely to cover the whole space than randoms. (Make it a web page, and use cut&paste to transfer to the search programs so they don't need to be network-equipped.) To support scaling, make it easy for people to run subset servers; grab a chunk of keyspace from the main server and dole it out to people who ask you for it. If you want to get fancy, hack a DNS server to allow people to register their machines as NNN.descrack.org, 0<=NNN<1000, so that people can find subsets without having to ask the main server. >>> a brute force "screen saver" for >-- By the time the total amount of computons expended has equalled the >amount that would have been expended in a "no duplications" allocated >search, the Poisson probability distribution says that 1/e = 36.8% of the >keyspace will not have been searched; the rest of the probabilty lies in >keyspace searched once, twice, three times, etc. # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Confuse Authority!

2 1

re:SHI_fty
by Alan Olsen 17 Dec '03

17 Dec '03

At 08:13 PM 7/22/96 -0800, Vinnie Moscaritolo wrote: >Uh I think apple had that for a while, it's called cyberdog >http://cyberdog.apple.com screw this ole fud. Unfortunatly, this is only available for Macs at this time. Hopefully we will see Windows and/or Unix versions sometime soon. (Of course if you expect Microsoft PR to resemble *ANYTHING* vaguely like reality...) --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon "Microsoft -- Nothing but NT promises."

1 0

RE: Distributed DES crack
by pjn＠nworks.com 17 Dec '03

17 Dec '03

> I've a few machines around that could be dedicated almost full time to the > task. What are the bandwidth requirements? Specifically, could the > keycracker be run over a 28.8 (with a 486 running linux)? If so, how many > 486's could I get over a single 28.8 (i.e. 28.8 -> multiple 486's daisy > chained with ppp over direct serial connection)? > It's not a factor of the bandwidth, you search offline and send in > your results to a central server. > But first, a little reality check is in order. According to libdes, > the 200Mhz Pentium Pro on my desk will do 1,827,997 ECB bytes/sec, or > 228,499 ECB blocks. A DES crack would have to try, on average, 2^55 > blocks. That would take my machine 43,798,875 hours, or 1,824,953 > days. > OK, so let's be reasonable and say that a week would be a good time to > come up with a DES key. We would need 260,707 200Mhz Pentium Pro's to > achieve this. > Looking at that, 30 days seems not such an unreasonable target. We > would need 60,831 200Mhz Pentium Pro's to achieve this. > It seems obvious to me that DES is still *way* out of reach of > anything other than special purpose hardware. In> - Andy (hoping he got his sums right) (I think you did :) One small thing... You are assuming that we will not get the right equasion/code/whatever untill the very end. There is a good chance that it will only take half that time...and a slim chance that we will get it with the first try... P.J. pjn(a)nworks.com (BTW, I have a 486 DX/4 100MhZ That I will put to the effort...) ... As easy as 3.14159265358979323846264338327950288419716 ___ Blue Wave/QWK v2.20 [NR]

1 0

Re: Responding to Pre-dawn Unannounced Ninja Raids
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 3:38 PM 7/23/96 -0400, hallam(a)Etna.ai.mit.edu wrote: >>I don't understand this conclusion. One book people aside, it is generally >>believed that humans evolved in an evolutionary context and they certainly >>frequently use cooperative strategies. Cooperation usually also involves >>the ability to sanction misbehavior. Unilateral disarmament is throwing >>away your sanction. > >That depends on the circumstances. If you are arguing the case for >unilateral disarmament or unilateral reduction. In many cases there was a >deliberated attempt to confuse one with the other. Unilateral >reduction can be the right move to make. No argument. I said disarmament. >In the case of a minor nuclear power such as the UK unilateral >disarmament may be the right move... But still, the UK has available other sanctions. That's why they are still called the Falklands. >... Burglars are not rational actors, and >are more likely to have their behavior determined by drugs or >alcohol than analytical game theory. Burglars are among the most rational of thieves. They try to maximize gain and minimize risk by acting when no one can oppose them. Even muggers, a much less rational activity, try to pick on people smaller than them. >The facts are very clear, if you have a handgun in the house it is >far more likely to kill a member of the familly than stop an >intruder. The NRA know this which is why they have lobbied for the >CDC to stop research in this area - they do not like the facts. Christmas trees make your house far more likely to catch fire. However many people have them because they provide other, hard to quantify, values. (BTW, my mother's retirement home does not allow them in individual units.) Guns have value besides home defense. Just one off-the-wall example: I learned to hold a camera steady by competitive target shooting. Home defense is not the only reason to have a gun. (Besides, I would rather have a shotgun with a short barrel for close-up defense than a handgun. As the California police forces discovered when they (briefly) changed from pump shotguns to "automatics", the sound of chambering a round with a pump shotgun makes people focus very clearly on their situation. Frequently it avoids violence.) IMHO handguns are much more useful when you need a portable defense. Examples: 1. The USGS will allow field geologists to carry handguns in bear country after a rigorous training program. 2. I have a friend who defended himself from a pack of feral dogs after they attacked him and forced him to retreat to the roof of his car. (He killed three of the four. The local rancher treated him to dinner for ridding the neighborhood of a dangerous nuisance.) ------------------------------------------------------------------------- Bill Frantz | Cave ab homine unius lebri | Periwinkle -- Consulting (408)356-8506 | [Beware the man of one | 16345 Englewood Ave. frantz(a)netcom.com | book] - Anonymous Latin | Los Gatos, CA 95032, USA

1 0