December 2003 - cypherpunks-legacy

Re: Brute Force DES
by jim bell 17 Dec '03

17 Dec '03

At 04:55 PM 7/22/96 -6, Peter Trei wrote: >Single DES has the security of 56 bits of key - there are 64 bits in the >keys, but 8 of them are parity bits which add nothing to security. >2^56 = 7.205e16 keys (which is a whopping big number) >Let's guess that we can recruit the equivalent of full-time on 1000 >machines. >7.205e13 keys/machine. >Let's guess that we have about a month before people start to lose >interest - so we want to be more than 1/2 done by then. Lets say >we want to sweep the whole space in 40 days. > >1.8e12 keys/machine/day > >~21,000,000 keys/machine/second > >The fastest general purpose, freely available des implementation I'm >aware of is libdes. by Eric Young. With this, I can do a set_key in >15.8 us, and an ecb_encrypt in 95 us/block. That adds up to >about 9,000 keytests/sec (this is on a 90 MHz P5, running NT). For grins, I decided to look at some old Intel data books; I had recalled that they build a DES encrypt/decrypt chip. It was the 8294A, which could do 400,000 bytes per second, or 50,000 blocks per second. That's fairly good for 1983 technology. Since the clock rate of the typical microprocessor of the day was a 6-MHz 80286, and today's rate pushes 200 MHz, I think it's fair to conclude that a similarly state-of-the-art DES chip should be similarly improved, about a factor of 30, or about 1.5 million blocks per second. That's somewhat less than 2000 system-years of operation. (In practice, a cracker might be even more improved: The 8294A used an 8-bit I/O bus, which probably limited the rate at which encrypts could be done: 400,000 bytes per second means 400,000 writes, and 400,000 reads per second, or 1.25 microseconds per I/O byte throughput. This is sufficiently close to state-of-the-art for 1983 that I speculate the internal encryption rate might be substantially faster. And remember that a dedicated cracker doesn't need to I/O very much: Comparing with a previously-stored template requires no I/O, unless the compare is good, and that will rarely happen.) Not that I think that such a dedicated chip necessarily exists; chances are good that there isn't all that much demand for a 12-megabyte/second encryptor. However, appropriately-fast DSP chips tend to be at the cutting edge for wide-word operations, so I'll guess that the best way to implement DES today (absent a dedicated chip) would be on a DSP. It would also be the cheapest, because DSP's are built in huge numbers for other applications. What this shows you is that there is a vast difference between doing a task on a fairly optized platform, and a general-purpose computer. This _also_ shows you why the government is being highly dishonest by quoting the difficulty in cracking ciphers on scalar machines, rather than more-dedicated vector units. Jim Bell jimbell(a)pacifier.com

1 0

DES-Busting Screen Savers?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:28 PM 7/22/96, aba(a)atlas.ex.ac.uk wrote: >Hmm, 56 bits is a lot of bits... > >Here's some calcuations of my own for your criticism... >So ideally for a break you would like the whole thing to be completed >in say 2 weeks wall clock time, which gives rise to the need for >~100,000 machines of similar throughput, full-time for two weeks. Or several times that number of machines or time for machines with less crunch. Say, 100K Pentium-type machines for a month or two. How might this be gotten? A while back I proposed one approach: a brute force "screen saver" for Windows machines. Other platforms, maybe, but the most cost-effective thing to do is to go after the Windows market only. Instead of bouncing balls around the screen, or whatever screen savers like "After Dark" are doing these days, it could flash messages about "Working on a crack of ...." and perhaps show bar graphs, etc. Maybe some flashy graphics, some Cypherpunkish slogans, etc. That is, an attractive enough screen saver module in its own right that people would be perhaps inclined to leave it running. (I know that "After Dark" publishes the specs on its program and encourages third-party drop-in modules...some have been successful enough to be marketed by the vendor. I presume this is still the case, and with Windows, too.) Acquiring chunks of keyspace remains an issue, but I think we resolved a while back that a probabalistic method works OK: people just pick chunks at random, and the decreased efficiency as compared to perfect scheduling is something like a factor of a couple (I have the numbers I calculated somewhere, and I recall Hal Finney made the same estimate). Some means of communicating results--especially wins!--is still needed. This is where Perry's idea of a Java program is a good one. >As far as cash prizes go how much could cypherpunks and friends >generate for such a purpose? I'd guess individuals could come up with >a fair bit of money... 1000+ list members x 10$ = 10k (or whatever). More realistically, 1000+ list members x 10% who make plans to contribute x half of these who actually follow through x $10 = $500. (If that....) Prizes have their place, but are hard to set up properly. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Decrypt Unix Password File
by Jerome Tan 17 Dec '03

17 Dec '03

How can I decrypt Unix password file?

5 4

RE: Boobytraps and the American Legal System [France Legal System]
by Jean-Paul Kroepfli 17 Dec '03

17 Dec '03

TCM wrote: (...) >Still, I remember vividly in college when the court case was decided >involving a guy in Florida who was tired of being burglarized and the cops >doing nothing about it: he rigged a shotgun to go off when someone broke a >window and entered. A perp did, was shot, survived, and the case went to >trial. > >The boobytrapper was found guilty of some serious crime--I don't recall the >details (this was circa 1972). > (...) > >As Vinnie said, "only in Amerika." Not only, in France too. Circa twenty years ago a man booby-trapped his secondary house (a radio set with explosive) and was successfully sued by the burglar for damages. I think it is also the point of view of the central european society. Jean-Paul ~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~- Jean-Paul et Micheline Kroepfli (our son: Nicolas and daughter: Celine) eMail: JeanPaul.Kroepfli(a)utopia.fnet.fr Also Compuserve and MSNetwork Phone: +33 81 55 52 59 (F) PostMail: F-25640 Breconchaux (France) or: +41 21 843 27 36 (CH) or: CP 138, CH-1337 Vallorbe Fax: +33 81 55 52 62 (Switzerland) Zephyr(r) : InterNet Communication and Commerce, Security and Cryptography consulting PGP Fingerprint : 19 FB 67 EA 20 70 53 89 AF B2 5C 7F 02 1F CA 8F "The InterNet is the most open standard since air for breathing"

2 1

Code of Password File
by Jerome Tan 17 Dec '03

17 Dec '03

What is the code of password file of Unix? I have them but don't know how read them. Any file converter or viewer for that?

1 0

Re: Netscape download req
by pjn＠nworks.com 17 Dec '03

17 Dec '03

-=> Quoting Int:dlv@bwalk.dm.com to pjn(a)nworks.com <=- In> of Archimedes Plutonium, Dr. Jozeph Goebbels, and Janet Reno combined. Ewwww... (Two is fine, but Reno pushed it over the edge :) P.J. pjn(a)nworks.com ... Hey Bill Clinton: I'll give you something to censor.... ___ Blue Wave/QWK v2.20 [NR]

1 0

Re: Responding to Pre-daw
by pjn＠nworks.com 17 Dec '03

17 Dec '03

>> ichudov(a)algebra.com (Igor Chudov @ home) writes: >> David Sternlight wrote: >> <spam spam spam spam spam spam spam spam spam spam spam spam spam> > >> It is not surprising that after the society decided to label >> natural economic activities (drug dealing) as crimes, it has >> to resort to unnatural methods of enforcing the unnatural >> legislation. >> ... > Please do not respond to anything "Dr." David Sternlight posts to this > mailing list, no matter what nonsense he says. The asshole is starved > for attension. He's just trolling for flames. Please ignore him. Thank > you. > -!- Get real... I dont like him or his posts, but he has the right to do so, and you have no right to censor him or anyone else. If you dont want to read his posts, then dont...Its that simple... For a mailing list that has so many people complaining about the government censoring people... P.J. pjn(a)nworks.com ... (A)bort (R)etry (S)mack the friggin' thing ___ Blue Wave/QWK v2.20 [NR]

2 1

Anonymous web servers
by Hal 17 Dec '03

17 Dec '03

[This is somewhat of a follow-up to Black Unicorn's idea about private web pages a few weeks ago, also motivated by thinking about Ross Anderson's Eternity service, about which I just posted.] Right now you can get anonymous web pages at various places. But these are basically just regular web pages where you haven't told the service provider what your name is. If somebody doesn't like what you have posted there they may be able to get your pages shut down just as easily as if you were non-anonymous. I was thinking about ways to allow more truly anonymous web pages. The goal would be to allow them to operate even if someone powerful didn't like them. I'm not sure the idea I have really works but I thought I'd lay out some possibilities. The web is basically a client-server environment. The server sits there all the time ready to accept connections from users running clients (browsers). The client connects briefly to a web page and downloads the data for the page. It disconnects and displays the data. Some of the newer technologies have extended this model but it is the original concept. The idea I have is to provide a meeting place for anonymous servers and clients. There would be a sort of "meta-server" which runs software which just pairs up interested parties. The idea is that both servers and clients would be relatively transient. Two people would arrange in advance to interact via web protocols, and agree on a transient URL which they would share. The client and server both connect to the "meeting place" host, specifying the magic name they have agreed on. The meeting place software would then pair up connections which shared the same name and allow them to interact via conventional protocols. URL's for the meeting place server would be interpreted in this context rather than simply as file names. In some ways the role of the "meeting place" software is similar to an IRC server. In fact, this concept could be thought of as HTTP over IRC. The big question mark is whether the meeting place would be blamed for the possibly illicit transactions it facilitates. It can argue that it didn't know what people are doing (it might require people to use SSL for their transactions so it doesn't see them). But in practice it may be easy for attackers to prove that illegal transactions are going on (they just arrange to connect to an illicit server and download incriminating evidence). It does seem though that IRC, despite having a reputation as a place where a lot of illegal transactions occur, manages to keep running, without the servers taking the blame. Maybe it is just a matter of having a low enough profile? You'd also have a problem if a server, protected by anonymity, decided that being transient was stupid and arranged to always be ready to respond to one of the anonymous URL's. Then there seems effectively no difference between the "meeting place" with an anonymous server URL, and an ordinary host with an objectionable file available via URL. In each case clients connect and get the same illegal data. One thing we haven't seen (AFAIK) is anonymous posters offering to supply illegal data to anyone who asks for it. Something like "just post your email address and I'll mail you (anonymously) some Holocaust revisionism" (or Christian literature, or whatever else may be banned in your particular jurisdiction). This is the kind of application where it would seem that the anonymous web pages would be effective. Maybe there is not much demand for it, after all. Hal

2 1

RE: Distributed DES crack
by Andy Brown 17 Dec '03

17 Dec '03

On 22 July 1996 22:48, Ben Holiday[SMTP:ncognito@gate.net] wrote: > I've a few machines around that could be dedicated almost full time to the > task. What are the bandwidth requirements? Specifically, could the > keycracker be run over a 28.8 (with a 486 running linux)? If so, how many > 486's could I get over a single 28.8 (i.e. 28.8 -> multiple 486's daisy > chained with ppp over direct serial connection)? It's not a factor of the bandwidth, you search offline and send in your results to a central server. But first, a little reality check is in order. According to libdes, the 200Mhz Pentium Pro on my desk will do 1,827,997 ECB bytes/sec, or 228,499 ECB blocks. A DES crack would have to try, on average, 2^55 blocks. That would take my machine 43,798,875 hours, or 1,824,953 days. OK, so let's be reasonable and say that a week would be a good time to come up with a DES key. We would need 260,707 200Mhz Pentium Pro's to achieve this. Looking at that, 30 days seems not such an unreasonable target. We would need 60,831 200Mhz Pentium Pro's to achieve this. It seems obvious to me that DES is still *way* out of reach of anything other than special purpose hardware. Regards, - Andy (hoping he got his sums right) PS. For those more acquainted with Sun hardware, an Ultra-1 will do 1,683,647 ECB bytes/sec (gcc 2.7.2).

1 0

Returned mail.No such addressee
by Remo Pini 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com Date: Tue Jul 23 13:53:56 1996 To: cypherpunks Date: Tue Jul 23 13:53:09 1996 Check out Pronto Secure (I think there's a mac version around!?) http://www.commtouch.com/ - --------< fate favors the prepared mind >-------- Remo Pini rp(a)rpini.com PGP: http://www.rpini.com/remopini/rpcrypto.html - ------< words are what reality is made of >------ -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBMfS9VRFhy5sz+bTpAQHYFQgA1BzJQY9dM29KYpuzdhW9GRG/Ng0M9x5o d2obC6MWa3th3vCjr3qSb1yC4IKLXLACFvTa4/jHky8P3//3UOUVNZ0IffPSlY9/ a3dKSKFyMUaKtyzi7rzCV24NlBFT1eJVVNZjYsH8pbCGbxteH5+dRAvvbkmSPukX GGa1oY6u/XK7Ti8IaOifWFDvYi76W37UlLs9aSGAfpTWKlM88bnkUL3iPxHf8qs6 DE0PQZOE8M4JyQTc/H7E5oNkEhE9RxIOgJNpZGPSOazwh3MVjTBLIZZOpmsV3srv EH6aNobS5shKOs8t/t7aCXIzhvNRDEqB652bfPP79Q13ICOT7BBYyA== =4iqW -----END PGP SIGNATURE-----

1 0

DNA printing at birth
by William "Bud" Kennedy 17 Dec '03

17 Dec '03

[IMAGE] UK News Electronic Telegraph Monday July 22 1996 [IMAGE] Issue 432 See text menu at bottom of page [IMAGE] Labour plans DNA tests for everyone from birth By Rachel Sylvester, Political Staff _________________________________________________________________ External Links [IMAGE] Identity cards - A solution looking for a problem [IMAGE] Conservative Way Forward - Danger of compulsory ID cards [IMAGE] Centre for Computing and Social Responsibility - response to Green Paper on ID cards _________________________________________________________________ RADICAL plans to take the genetic fingerprints of everyone in Britain and put them on a compulsory ID card are being considered by Labour. A database of DNA identities would be used to solve crimes and cut benefit fraud. Frank Field, tipped as a possible Social Security Secretary in a Labour government, has drafted proposals to produce a genetic database of the nation. Blood samples would taken from babies and from people applying to live in Britain. The samples would be used to extract DNA. Only identical twins have the same DNA, making it a more accurate fingerprint. Chris Smith, shadow social security secretary, confirmed that the party was examining the plans. "We are not ruling them out. We are determined to cleanse the national insurance system of fraud." John Wadham, director of the pressure group Liberty, said it was incredible that a senior Labour politician could suggest such a "draconian" measure which breaches European law. "There is no evidence that such a massive invasion of our privacy would do anything very much towards stopping crime." Mr Field, chairman of the Commons Social Security Select Committee, also advocates taking compulsory fingerprints from every citizen as a fall back to confirming a person's identity. The combination of genetic and physical fingerprints would be used to "rebuild the national insurance system", Mr Field said yesterday. Each person would be given a number at birth, combining national insurance and health numbers, which would tally with their genetic code. The information would go on a computerised identity card. It would also contain an individual's address, medical history or criminal record. It would be impossible to claim benefit without the card. Mr Field believes that Mr Blair is "sympathetic" to the proposals and that any opponents would be "Old Labour". Mr Blair will express his determination to reduce fraud in a speech tomorrow. Mr Field, MP for Birkenhead and described as one of Blair's "gurus", believes that the scheme would eradicate the use of multiple identities by benefit fraudsters and wipe off a large part of the annual £2.5 billion cost of social security fraud. There are millions of bogus national insurance numbers in circulation. It would also allow police to solve more crimes because traces of semen, hair or skin found at a burglary or rape would lead to the culprit. Ann Widdecombe, the Home Office Minister, said: "There are huge practical and resource implications. Think what it would cost to test every person in the country." Mr Wadham said there was no guarantee that the benefits would follow. "Not all fraud is to do with bogus national insurance numbers. I do not understand why, even if you have an identity card, you would need a genetic database." Mr Field advocates setting up a commission to regulate the use of the information. It is unlikely that any policy would be announced before the general election. Mr Blair, who is known to be looking for radical ideas on social security, has told shadow ministers to "think the unthinkable" and remind the public that "with rights come responsibilities".

1 0

Re: Borders *are* transparent
by Remo Pini 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com Date: Tue Jul 23 13:52:55 1996 > What about the possibility of using DSP's? Is there any brand of 28.8 K > modem which uses a "standard" DSP and EPROM firmware? Such a beast > might be > the easiest way to get a large amount of CPU horsepower operating > independently of the host computer. DSP's are optimized to execute a > large > number of instructions with little I/O needs. > > Jim Bell Zyxel modems (ISDN and V34) have a Motorola 56000 DSP and a Motorola 68000. - --------< fate favors the prepared mind >-------- Remo Pini rp(a)rpini.com PGP: http://www.rpini.com/remopini/rpcrypto.html - ------< words are what reality is made of >------ -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBMfS9GBFhy5sz+bTpAQFQbggAp7H0bJyZYUzD87QQorzRQ8PTaTkkB1r3 tsEj6JWmq4PlppRd0lvjP2mN4LmfR700A8O7qdr6d9IfKrNmQzItDEPjq2zv+Lbf P9e2mi7Jz1xl1faZv3YiBAbdhv/jlnI0m4o3x6AwZNkAy1pe3xkj61H9n8tQ3cqf eAwDqZlOCCsjuN/hdJAiIHuiuqC2W0i59bZR59u6ek8iXE+8LnXXxeMxuUOZVIgI 2efgoJk6ev5/7IOoDaMlgffkHcWTTnjEClBI3JnGcIOnauacYG8t8UuPa5R8Td0t ZL/O8/gEDKGpos8j92DSyDgjb6XrRWq3CWZbfoXDhfRbnTKU/ZqXUg== =2afe -----END PGP SIGNATURE-----

1 0

Re: Digital Watermarks for copy protection in recent Billbo
by Deranged Mutant 17 Dec '03

17 Dec '03

On 22 Jul 96 at 11:19, Alex F wrote: [..] > > Other issues: what if an eavesdropper steals the music or video? It's > > If they steal it, well, who cares? If there is something worked out > so that they could trace STOLEN (not traded or sold) CDs then fine, > arrest them. Do you really think though that anyone would waste so > much time over $8? Sniffers aren't much effort, and if I sniff your tagged purchases and put them out over the net anonymously, they are traced to you. > > If it uses a credit-card number as (part of) an ID, that's pretty > > bad. Someone can sniff for CC numbers if they know how it's stored. > > Probably not done that way. My guess is that the disk ID is assigned [..] Probably, but the Billboard article discussed using CC numbers as an ID in the online watermarked transactions. Doesn't mean they were correct, of course. > > The system will have to rely on proprietary tech and security through > > obscurity. Even know how watermarks are stored without understanding > > the math, one must be able to somehow garble the sound without > > distorting it, but which renders the watermark useless. > > Actually, this would be quite easy. The "watermark" would be a > signal that plays inband, but out of our hearing range during the > entire CD. The human ear can only hear in the 20-20,000 (Hz, KHZ?, > whatever) range. It would be trivial to add a digital ID signal at, > say 30,000 or 15 or something like that. This could then be decoded, > if need be. This seems the easiest and most efficient way. This > could also be defeated with a lot of $$ (and/or a LOT of HD space). > If the frequecy is known (it can be found out) it can easily be run > through recording studio eqipment that can very effectively isolate > the frequency and cut it out. If you have a LOT of HDD space > (digital audio at 2 stereo tracks, not sure of the sampling rate or > bit resolution, takes about 20MB of HDD space per minute (2 tracks, > good sampling and bit rate) ) you could probably find the freq. > fairly easily by isolation and just edit it out, and write the new > stuff to a CD-R. If the signal is purely digital, I would imagine > that it might be even easier that if it were an analog signal (?). > Someone w/ good equipment (Digital Labs' stuff, or SAW (Software > Audio Workshop) would be able to do this w/o much problem. The > question is is the price/effort worth it? In quantity maybe. On an > individual basis, only if you already happen to have the erquipment. For someone in the misuc counterfit business, the equipment is probably not that expensive. It's innocuous enough (recording and editing equipment) that it wouldn't draw suspicion. AFAIK, most "bootlegging" is of unreleased concerts or out-takes. Digital watermarks would be of little use. > I have a suspiscion that this type of thing will not really come to > any kind of fruition due to not only the ability to defeat this, but > mainly due to things like buying at a garage sale, etc. If it did, I think it's intended for tagging online transactions. You connect to a company's site and download the latest album or single by some band, presumably with the rights to transfer that to a tape for personal use. If this becomes a predominant way of buying music or movies in an eventual future (when most people on the planet are wired) and anonymous purchases disappear (I doubt it) as well as radio broadcasts (another loophole) die out (quite doubtful as well). Of course you have to be foolish to pirate under such a system using your own name. Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: Borders *are* transparent
by Remo Pini 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com Date: Tue Jul 23 13:52:47 1996 At 10:32 AM 7/22/96 -0006, Peter Trei wrote: >Any one up for a distributed brute force attack on single DES? My >back-of-the-envelope calculations and guesstimates put this on the >hairy edge of doability (the critical factor is how many machines can >be recruited - a non-trivial cash prize would help). I'm in with: 2x Pentium75 1x 486DX50 (all machines Win NT 4.0, it would have to be an Intel runnable algorithm) - --------< fate favors the prepared mind >-------- Remo Pini rp(a)rpini.com PGP: http://www.rpini.com/remopini/rpcrypto.html - ------< words are what reality is made of >------ -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBMfS9FBFhy5sz+bTpAQFV6gf/ZkarvomYeMqyHSGz5yAtLPey6ucFx1AJ 1PfqZV/UJp92d9tX9DmfESHTqZcyCRDHq9+ziDh5vRr5PHovVVOkg9TClssYYk3l M75EZ20bNohI3ISTH28yUN9H/JdxvlPrDQp7Gwa0LU9QFhBsmpzaLbyL+aas1DA7 sUD6Yc8wBTg95OswYkOqc49DzyEdH6obfL0NhN2QuaSvJDIV/8vfdr08ZhW2ZGfF TmbGf8z3lWpuZpzhIDRypb74xrg0PJHuvL0OMsEe3HV0euUCpvCwK18YlAaJLoW9 R9Pep6Cq5u+13MDlYM20OZ+RVpUPvKrCY0t0//W8OArgiVCiaC7tVw== =tUpt -----END PGP SIGNATURE-----

1 0

RE: Responding to Pre-dawn Unannounced Ninja Raids
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

perry(a)piermont.com writes: >Jefferson could have been a mass murderer for all I care. His words >may be evaluated fully independently of his actions. They are not >interdependent. Many of our current politicians would be heartened by your sentiment: Do as I say, not as I do. Personally, I incline more towards the other cliche: Actions speak louder than words. It is possible to evaluate a persons words independent of their actions, but, given that environment has some effect on behaviour, it is not at all clear that you can treat them as independent. Nor, more importantly, would you want to. It could prove to be a good breeding ground for cynicism. Or is it sarcasm... ;-) James

2 1

Re: Another fascist
by Alex de Joode 17 Dec '03

17 Dec '03

In article <v03007807ae1a03b2bb71(a)[192.187.162.15]> you wrote: : One of the great friends of free speech on this list sent a forged cancel : message to the listbot to try to cancel my subscription. : The listbot, being reasonably well designed, ignored him and told me about : it, though I have no doubt less of a dunce could bring it off. : What a piece of slime! What do others think of this practice? : David Why, David, did you decide to subscribe to cypherpunks ? bEST Regards, -- -AJ-

2 1

Re: Brute Force DES
by Peter Trei 17 Dec '03

17 Dec '03

> Peter wrote: > >Any one up for a distributed brute force attack on single DES? My > >back-of-the-envelope calculations and guesstimates put this on the > >hairy edge of doability (the critical factor is how many machines can > >be recruited - a non-trivial cash prize would help). Duncan wrote: > I volunteer my 120 MHZ Pentium. A lot more Pentiums are out there now than > a year ago. That makes it more feasible. A lot more people with full net > connections. Like most Americans, I have a flat rate net connection and a > flat rate local phone connection so could run a cracking session permanently > (as long as no one tells my ISP). We need a full test of the Winsock > cracking client in any case. It wasn't working very well last time. > > DCF <back-of-envelope> In my terminology, 'hairy edge of doability" means we have a shot at success, but I wouldn't bet the farm on it. I thought that I might bet a couple hundred bucks, though. Sadly, after further calculation, I'm not so sure if it's doable just yet. What I'm looking at is a known plaintext attack on single ECB DES, using a brute-force test to cycle through the key space. People would get chunks of keyspace to test from a central server or servers, and would be motivated to take part by a cash prize for the lucky person who finds the key. Lets do the numbers: Single DES has the security of 56 bits of key - there are 64 bits in the keys, but 8 of them are parity bits which add nothing to security. 2^56 = 7.205e16 keys (which is a whopping big number) Let's guess that we can recruit the equivalent of full-time on 1000 machines. 7.205e13 keys/machine. Let's guess that we have about a month before people start to lose interest - so we want to be more than 1/2 done by then. Lets say we want to sweep the whole space in 40 days. 1.8e12 keys/machine/day ~21,000,000 keys/machine/second The fastest general purpose, freely available des implementation I'm aware of is libdes. by Eric Young. With this, I can do a set_key in 15.8 us, and an ecb_encrypt in 95 us/block. That adds up to about 9,000 keytests/sec (this is on a 90 MHz P5, running NT). I'm looking at ideas to speed up DES - if I'm willing to use honking great lookup tables, the permutation steps can be done more quickly than libdes. I'm also looking at implementing the algolrithm in hand-optimized P5 assembler. (It's been years since I've done a major assembler project - the P5 has some truely weird features to be considered, but also has (some) internal 64 bit registers to play with). Let's guess that I can speed up a key-test up by a factor of 10. (This is not a slur on Eric's code - it's extremely clever, but not optimized for any particular processor, or for key-testing. Note that the keytest described above takes about 10,000 cycles/test.) That gets my workstation up to about 90,000 keys a second, which is still almost a factor of 250 too slow. I'm going ahead with my work on a faster DES keytester, but unless optimizing gives an astounding win, I now think a distributed bruting effort is a bit pre-mature. What will make this brute doable, if not now, then in the near future? 1. Faster Processors - Moore's Law is still holding. A year ago, my 90 MHz Pentium was one of the faster machines taking part in the 40-bit RC4 crack. Now, it's passe. 2. More processors. The number of people on the internet continues to grow rapidly. 3. More interest - Crypto awareness has greatly increased in the last year, and a real cash prize (say, over $500) will generate both publicity and interest. These factors all multiply together. The number of cycles that could probably be recruited is increasing at a fast rate. A major part of the work will be a keyspace distribution mechanism which can handle the load (this was a major stumbling block last year). </back-of-envelope> Peter Trei trei(a)process.com Disclaimer: This has nothing to do with my employer.

8 9

RE: Distributed DES crack
by Joel McNamara 17 Dec '03

17 Dec '03

I'd like to see a very general hardware processing power equivalence table. For example, 1 MasPar equals how many Pentiums. This would be extremely useful in figuring out a range of the types of boxes required to do this. Joel At 09:51 AM 7/23/96 +0100, Andy Brown wrote: >But first, a little reality check is in order. According to libdes, >the 200Mhz Pentium Pro on my desk will do 1,827,997 ECB bytes/sec, or >228,499 ECB blocks. A DES crack would have to try, on average, 2^55 >blocks. That would take my machine 43,798,875 hours, or 1,824,953 days. > >OK, so let's be reasonable and say that a week would be a good time to >come up with a DES key. We would need 260,707 200Mhz Pentium Pro's to >achieve this.

1 0

No Subject
by owner-visualprog＠scribe.cerf.net 17 Dec '03

17 Dec '03

VISUAL PROGRAMMING++ The biweekly newsletter featuring reviews for Windows development products and Internet/Intranet tools. VP++ is free to Visual Basic Programmer's Journal subscribers and premier club members of FTP's Development Exchange web site: http://www.windx.com. Vol. 1 No. 1 July 12, 1996 Welcome to the premiere issue of Visual Programming++, an e-mail newsletter providing timely reviews of Windows components, utilities, add-on products and Internet/Intranet development tools. This premiere issue is being sent to every registered member of The Development Exchange Web site (DevX). All future issues will be sent as a service only to paid subscribers of either Visual Basic Programmer's Journal or DevX's new Premier Club. To subscribe or unsubscribe, follow the instructions at the end of this document. Every issue will be posted under "Reviews" on DevX. VP++ is a part of the totally re-designed DevX Web site. Explore DevX and you'll see complete archives of articles and code from Visual Basic Programmer's Journal and Microsoft Interactive Development, plus a database of more than 5,000 Windows development tools updated daily. You'll also see an event calendar that covers all major trade shows for developers, including details on our VBITS:Interactive, coming to San Francisco in October. The VP++ charter includes reviewing products for VB, VB Script, Access/Jet, VC++, Delphi, PowerBuilder, the Microsoft Internet Explorer, Netscape's Navigator and other tools. Every two weeks subscribers receive detailed reviews automatically delivered by e-mail. Utilities form a theme for this issue. All products are shipping--no beta software was reviewed. We'll maintain a product review archive on our web site as we add new editions of VP++. You can search for product information using key words. For Premiere Club members, we have a bulletin board in the Reviews section of the Developer's Exchange. You can discuss these reviews or products there. Not only are venders offering demos on web sites, but some reviewers have posted sample code on web sites as well. I hope you find these reviews useful. Send questions or comments to editor Frank_Moncrief(a)MSN.com or 70443.1434(a)CompuServe.com. 8 PRODUCTS REVIEWED CONTENTS * VBNet 2.01: Automatically converts VB code and forms to VB Script. * CodeBank: VB routines you can plug into your own code or share across teams. * PowerDoc: Automated documentation generator. * IDSMail: OLE server for building email into applications. * Total Access Agent: Repair, backup and compacting utility for Access and VB/Jet databases. * DynamiCube 1.31: 32-bit data-bound ActiveX custom control for On-Line Analytical Processing. * VB Compress Pro 4.03: Automatically deletes unused or un-referenced code. * Visual SQL 4.0: Code generator and class library that turns Microsoft Visual C++ into a client/server development environment. *Subscribe/Unsubscribe ------------------------------------------------------------------------ VBNet 2.01 TVObjects Corporation Tel: 609 514-1444 Fax: 609 514-1004 http://www.tvobjects.com Price: $197 Runtime: not applicable Quick Facts: VBNet 2.01 is a VB4 add-in that uses a wizard to convert VB4 forms into HTML pages with embedded VB Script code. By John Clark Craig VBNet is a Visual Basic 4.0 add-in that turns VB4 into an environment for developing HTML pages with embedded VB Script code. The add-in provides a wizard that walks you through the automatic steps of converting each of the Visual Basic forms in your VB 4.0 project into a set of equivalent HTML pages containing embedded VB Script code that is executed directly by Microsoft's Internet Explorer 3.0. You can even convert ODBC-compliant client/server database applications this way. VB Script code is developed right in HTML pages-there isn't any Integrated Development Environment (IDE) for VBS. Hence, you can create your app using VB's rich IDE during development (where you can use the debugger, for example), then you just do the conversion to VB Script using VBNet. You can do this tedious conversion chore by hand, but believe me, VBNet simplifies this task quite a bit. While reviewing VBNet, I created a few simple VB 4.0 applications using the new, restricted VB Script syntax and let VBNet do its thing to them. I learned a lot about the way VB Script works by studying the resulting HTML pages created by VBNet, and I realized that even though VB Script follows a simplified Visual Basic 4.0 syntax, the details of reworking applications into embedded VB Script code for web pages is more complicated and exacting than I expected. VBNet handles these details with ease. Here's how it works. You start by developing a working Visual Basic 4.0 application that runs successfully in the Visual Basic development environment, purposely using the restricted syntax of VB Script. As just one example of this new syntax, the only variable type allowed in VB Script is the Variant, so you'll need to edit out the dollar signs from the end of string variable names, and you'll need to be more explicit in the use of type conversion functions. To convert existing VB programs, you need to edit variables to conform to VB Script conventions. (Some helpful documents that cover all the new VB Script syntax exist on Microsoft's web pages-http://www.microsoft.com/VBScript is the main VB Script page. There are links to complete documentation, an online tutorial, FAQ documents, sample VB Script pages, and more). MAKING THE CONVERSION When you're ready to convert your application to HTML pages, you start the VBNet wizard from VB's Add-In menu. VBNet automatically creates a folder hierarchy based on your application's name, and populates these folders with the all the files required for rebuilding the application in the user's browser. VBNet converts standard buttons, check boxes, text boxes, and many other controls. To test VBNet for converting third-party controls, I added a Sheridan Software Tabbed Dialog and it worked. Any controls should be registered on the user's system. Microsoft provides a set of free downloadable ActiveX controls that are designed specifically for use with VB Script within IE3. These controls duplicate the command button, text box, check box, and a few other standard VB4 controls. The set also includes IE Stock Ticker, IE Chart, IE Animated Button and others. As the conversion proceeds, VBNet generates a report you can view or print. This report describes any parts of your Visual Basic application that fail to translate to VB Script, and provides other useful information about the conversion process. I created an example VB Script application using VBNet that you can browse at http://home.sprynet.com/sprynet/jccraig using IE3. Be sure to right-click and select View Source so you can study the actual lines of code that VBNet created as it converted this simple random-password-generation application from VB 4.0 to VB Script. Also, TVObjects offers example VB Script enhanced pages, product information and the latest downloadable updates at its home pages: http://www.tvobjects.com. You can build powerful ODBC-compliant client/server database applications for use over the Internet using VBNet and the RemoteData control, available in the Enterprise edition of VB 4.0. Hence, users can interact with data on your company's Intranet, for example. You simply add controls to your form that can be bound to your RemoteData control, get them working in the Visual Basic 4.0 environment, and convert it all using VBNet to enable deployment over the net. Also, VBNet can generate JavaScript code for database compliant access with Netscape 2.0. For security reasons, VB Script doesn't allow normal file I/O, but the remote data capability more than makes up for this limitation. VBNet is a great product. I just wish VBNet had a little tighter integration with the Visual Basic 4.0 development environment. The syntax checking for proper VB Script syntax works great, but only during the wizard's conversion processing. What I'd like to see is immediate feedback as I enter each line to let me know right away if I'm using a feature of Visual Basic 4.0 that's not allowed in VB Script. John Clark Craig is the author of more than a dozen books on computer programming, including The Microsoft Visual Basic 4.0 Developer's Workshop (Microsoft Press, 1996). Craig lives with his family in Castle Rock, Colorado. Email: jccraig(a)sprynet.com; Web: http://home.sprynet.com/sprynet/jccraig ------------------------------------------------------------------------ CodeBank Visual Components, Inc. Tel: 913 599-6500 Fax: 913 599-6597 http://www.visualcomp.com/ Sales(a)visualcomp.com Price: $99.00 Runtime: not applicable Quick Facts: CodeBank makes it easy to store, update and manage Visual Basic 4.0 procedures for individual or multi-programmer development teams. By David McCarter CodeBank is a system for storing re-usable code or for sharing routines with other developers in your group. Sure, you can create massive, generic modules that can be attached to every project, but this would waste space in your EXE and bloat memory requirements. Using CodeBank, you can choose only the subs and functions your project needs and add them to specific modules. While I think there are a few kinks that need to be ironed out in this first version, it's off to a great start. CodeBank includes 163 subs and functions (procedures) ready for use in your projects. The program displays a list of available procedures organized in categories in an expandable tree box. Categories include graphic effects, text effects, status bar control and others. Some of the 163 procedures include rotate text, gradient background and elastic forms. Simply click on a category and browse the procedures in it. You can also view procedures by procedure name, type (sub or function) or author. Clicking on a procedure will show a sample of how the procedure works in a different window. Double clicking on a routine will bring up the editing window. By default, you can't edit the canned routines in order to protect the archive. However, you can make copies of routines (maintaining all dependencies), then edit them and save them with a different names. A tabbed form contains all the information for the procedures, including category name, whether it's a sub or function, description, instructions, code, sample calls, revision history, and links to API calls or other procedures and forms need for the procedure. I must warn you that the majority of the stock 163 procedures are graphically oriented. While this is great for those of you looking for ways of doing really cool graphic tricks in VB without using a VBX or OCX, I would like more general-use procedures in CodeBank. However, you can purchase CodeBank to share code among your development team instead of for the canned procedures. As you find procedures needed in your program, click on an Include button to add them to a new or existing module file created with CodeBank. These procedures are listed in a window under the module file name. Of course, you can also remove these procedures. Consider this window your shopping basket. When you are done selecting procedures, all you have to do is click on the Make Module button and the module is created in just a few seconds. Impressively, CodeBank automatically adds any required API calls and procedures. This beats the copy and paste method hands down! Also, a message box informs you of any forms you need to add to your project. CodeBank offers an Update All Basic Modules feature for efficient updating. CodeBank keeps a record of all procedures and API calls added to a module. So if these procedures are modified at a later date, simply use this feature to update your modules. It's a snap! IRONING OUT THE KINKS In my experience, CodeBank has a few kinks that need to be ironed out to make it a more productive, useful tool. I tested 15 of the procedures that came with the program, including graphic, form, toolbar and file dialog procedures. I found one routine that didn't work correctly: UnloadAllForms. It crashed VB because it did not take into account that it can't be called from a form that is already being unloaded. Also, most of the procedures are poorly documented. The beginning of the procedures need better commenting on how to use them and which parameters to choose. And commenting is displayed on one long line, so I had to scroll to read the entire comment. This is not a standard commenting practice. The code itself could use better commenting. There were a few other things that bothered me. I could not maximize the main program window to view more categories and procedures simultaneously. Also, code is stored in an Access database. I'm not sure of the reason for this because it's used as a flat database. Access has a reputation for high memory overhead (the database of 163 procedures is 622K), and for corrupting in my experience. I think it'd be better to store routines in a flat ASCII file system. Also, there seems to be no compression, backup or error checking features in CodeBank for the Access database. CodeBank comes in both 16- and 32-bit versions. It only creates VB4 modules (though you could translate some of the code to VB 3.0). It can also import other CodeBank files or a specially tagged ASCII file (I did not have any samples to test this feature). The program comes with sample projects that show off a majority of the included routines. David McCarter is editor and publisher of the electronic newsletter Visual Basic Tips & Tricks. He works at an interactive television and wagering company, and has his own software publishing/consulting firm. Contact him at 74777.447(a)compuserve.com. ------------------------------------------------------------------------ PowerDOC for Visual Basic Catapult Systems Tel: 800 581-7354 Tel: 512 328-8181 Fax: 512 328-0854 (fax) http://www.launch.com PowerDoc(a)Launch.COM Price $79.00 Runtime: not applicable Quick Facts: Powerdoc automatically creates VB documentation using Microsoft Word. A demo version is available on the web site, which can be upgraded to full version via registration. By Craig M. Bobchin If you are a typical developer you probably dread the thought of writing documentation. And if you have to work on a system written by anyone else, you may be cursing the lack of documentation. If these scenarios sound familiar, you may want to check out PowerDOC. PowerDOC works with Microsoft Word 6.0c or 7 to automatically create technical documentation for VB3 or VB4 apps. It handles third-party custom controls by default. I tested PowerDOC with Sheridan, Crescent, and Apex and Farpoint custom controls with no problems. You can set options to document a few types of controls, such as text boxes and labels, or you can document all properties of every control in your app. Also, PowerDOC creates screen captures of forms in black and white, 16- or 256-colors. PowerDoc offers an easy installation with plenty of user control as to where the program installs, including drive, directory, and program group. However, you must have VB3 or VB4 on your system before PowerDOC will install. The utility is easy to use. Select the project you want to document, determine the level of detail by selecting which controls, properties, events, and modules you want to document, set a few other options, such as where you want the resulting file to be stored and if you want a table of contents and index, and PowerDOC does the rest. SELECTING OPTIONS PowerDOC offers a 3-tabbed interface that leads you through the steps for documenting your application. The first tab, Select Application, lets you select the VB project you want to document. After selecting the project in the normal Open File dialog, PowerDOC presents a list of forms and modules to be documented. You can select as many or as few as you want to document. You can then sort the items by name or type, or keep them in the order they are in the project. The next tab, Select Output, lets you choose projects, forms, classes, and modules. Each selection gives you several check boxes showing which portions of the objects you can document. Pressing the Advanced button on this tab lets you select which control types and properties you want to document, as well as how you want any screen captures stored. I documented an entire application with 14 forms and 3 modules. The app had approximately 100 controls and about 5,000 lines of code. I documented all controls and objects, and the resulting Word document was 374 pages. You can customize the scope and size of your documentation by either not documenting the entire system, or by selecting which pages you want to print. The last tab, Customize Word, lets you customize Word options and settings, such as generating a table of contents and index, and determining their style. MINOR ANNOYANCES When you press the Document button, PowerDOC launches VB with your application loaded. Documenting a VB4 app works fine. However if you try to document a VB3 project using VB4, a message states that you must first save the project in VB4 format before you can run PowerDOC. If you have both VB3 and VB4, you can specify which version of VB you want to use. The second minor glitch shows up if you already have Word open. In this case you get a message asking you to close Word and try documenting again. Performance is adequate: it took about 20 minutes on my P90 with 24 MB of RAM to document my test application. Your time will vary based on the size of your application, the level of detail you want and the power of your machine. PowerDOC comes with a 30 page manual that assumes you have the knowledge to install the product. The manual does a good job of explaining the program and how to use it. The manual covers topics ranging from a step-by-step tutorial to a trouble shooting guide of frequently asked questions (FAQ). The help file is similar to the manual in scope and content. Overall, I like PowerDOC. It does what it is supposed to with a minimum amount of fuss. I expect that most developers can live with the minor annoyances I described. I say get this program if you need to document your Visual Basic applications. Craig Bobchin is president and founder of CMB Systems Design, a microcomputer consulting firm specializing in application development and training. He has written more than 150 articles and Powerpoint 4.0 for Windows QuickStart (Que). Cbobchin(a)aol.com or 102142,3336(a)CompuServe.com. ------------------------------------------------------------------------ IDSMail 2.1 Intuitive Data Solutions Tel: 408 778-1376 Fax: 408 776-1267 http://www.kudonet.com/~ids ids(a)kudonet.com Price: Standard Edition: $295 (send mail only), Professional Edition: $495 (send and receive mail) Size: 460K (total for all DLLs for all mail systems) Runtime: licensing required only when distributing more than 100 copies external to your company. Quick Facts: An OLE Server that supports major E-mail protocols and provides e-mail services under any version of Windows for any tool that supports OLE automation. Download sample code: http://www.kudonet.com/~ids/idsmprog.htm. By Peter Vogel Electronic mail is becoming a necessity rather than an option. IDSMail lets your apps send and receive mail using any version of Windows across four mail systems: MAPI, VIM, MHS, and Vines. You can even download a VB program from the company's website showing how IDSMail makes your mail system accessible from the Internet (though the package does not support the Internet mail protocols: POP3 and SMTP). If VB's MAPI control satisfies your email requirements, you don't need IDSMail. However, if you must support multiple types of systems (MAPI, VIM, MHS and Vines), or you want to extend the mail capabilities of Excel and Access under Windows 3.1, then I recommend IDSMAIL. IDSMail comes as a 16-bit OLE server, hence it works with any tool that supports OLE Automation under Windows 3.1 or Windows 95. I had no problems installing IDSMail on either version of Windows. Ten minutes after starting up VB4 and copying some code from the help file, I had a mail application running. The brief Windows help file is the only documentation provided; it seems complete and I found only a few minor inaccuracies (some VB3 code labeled as VB4, for instance). The help file and additional sample code can be downloaded from the IDS website. IDSMail used only 2% to 3% of my system's resources when running, but while the documentation doesn't indicate it, I found I didn't get all of those resources back unless I set my program's reference for IDSMail to Nothing after use. Performance was acceptable even on a 33mz 486 with 16MB of RAM with Excel 5.0 using the server and Access 2.0 or Word 6.0 loaded. WEIGHING THE PROS & CONS The product has some neat extensions to MAPI: you can specify how many messages you want to retrieve, prevent attachments from being copied to your disk, build an array of message headers or text for search purposes, and read messages without flagging them as having been read. On the other hand, compared to VB's MAPI controls, you give up some things. These include single methods for forwarding, copying, and replying to messages, the ability to customize the address book dialog, and message types. While I found some activities (notably logging in) simpler, some activities (like reviewing the recipients list) were more awkward. Obviously, in providing a universal mail server, IDS had to decide which features they were willing to support across all protocols. Even so, not all of IDSMail's functionality is available for all mail systems. There are dozens of properties and methods supported by IDS across different systems, and sorting through which functions are supported on which systems is beyond the scope and length of this review. If portability matters to you, you'll want to review the help file's Implementing Truly Universal Email topic. Most of the recommendations are made to ensure consistency as you move from one mail system to another. For instance, IDS suggests that you always use IDSMail's Mail Send dialog, though this means losing the functionality of the native dialogs provided with VIM and MAPI. IDS also recommends not using folders because they are not supported under MAPI, and using PeekOnly is discouraged because it isn't supported by MHS. While these are all useful tips, their recommendation to not use the NameResolution property is not a good idea if you might be working with a MAPI compliant system. If you follow the advice to leave NameResolution set to false, you'll encounter a problem with users whose display names are similar under MAPI. MAPI considers Jane Smith to be an ambiguous name compared to Jane Smith-Jones, and it won't send mail to the display name Jane Smith. You can use the ResolveName action to retrieve Jane Smith's unique mail address to solve this problem with the MAPI VBX. Unfortunately, IDSMail's ResolveName method just returns the still ambiguous display name. Setting IDSMail's NameResolution property to True, however, solves the problem. Because theNameResolution property is ignored under the other systems IDSMail supports, there seems to be no reason not to leave it set to True, contrary to IDS's recommendation. Another solution would be to use each user's unique mail address, but there isn't any way to get those with IDSMail. I called the company's technical department with a question just before 5:00PM IDS time and left a message. I also sent in a request for support using the IDSMail server on the company's website. I got a response to my mail request in a few hours and heard back about my phone request the next business day. Each IDSMail server has a unique license file that provides the objectkey your program must pass to the server before use. You'll want to make sure that you have only one license file in circulation no matter how many development licenses you buy. There's definitely a niche for ISDMail, even if you are only using a MAPI compliant mail system. If you want to receive mail from within Access 2.0 or Excel 5.0, or if you want to send a non-Access attachment from within Access 2.0, you should consider IDSMail-the alternative is having to code the MAPI calls yourself. If you don't use a MAPI compliant system and you want any mail functions at all, IDSMail will let you mail-enable your applications. Finally, if you may be changing mail systems, IDSMail will save you from rewriting your code as part of the changeover. While not everyone will need IDSMail, those who do will be glad to have it. Peter Vogel is the applications supervisor at Champion Road Machinery and a Microsoft Certified Solution Developer. Reach him at peter.vogel(a)odyssey.on.ca ------------------------------------------------------------------------ Total Access Agent 1.02 FMS, Inc. Tel: 703 356-4700 Fax: 703 448-3861 http://www.fmsinc.com Price: single copy: $199; five-pack: $599 Size: 1.7MB Runtime: not applicable QuickFacts: Total Access Agent is a maintenance scheduling utility for Microsoft Access/Jet databases. It performs routine tasks such as compacting and repairing databases, gathering statistics, and archiving tables or whole databases in both 16- and 32-bit versions. By Don Kiely Total Access Agent automates the drudgery of maintaining and archiving Jet databases. It works with all versions of Jet .MDB database files, so you can use it with VB and all Access releases. The product is a program scheduler tailored for easy maintenance of Access databases. It includes several standard, pre-configured actions: archive a database, archive table data, compact and/or repair a database, gather statistics about database objects and execute named macros. It also includes a custom command option that lets you run any command line. Archiving table data is a nice touch, because macros, forms, reports, and code can take up a lot of disk space but rarely change, so why back them up hourly? Total Access Agent consist of three components: the Manager, Monitor, and Engine. You use the Manager to maintain actions, such as to add and remove databases, schedule events, and specify network passwords. The Monitor runs continuously and launches the action at the scheduled time. Finally, the Engine is the backend that runs everything-it has an OLE interface so you can launch events programmatically. Total Access Agent can schedule hourly, daily, weekly, and monthly events. The hourly and daily intervals had all the flexibility I needed, but I would like to see more options for the weekly and monthly intervals. For example, you can select the particular days of the week to run an event, but you can only run monthly events on a particular day of the month, such as the 15th. It would be useful to run something on the third Thursday of the month or every other week without creating multiple, duplicate actions. The utility has some slick scheduling features. I was impressed with how it manages database files. Once you add a particular file to an event, it is added to a master database list, no matter how many actions use it. That means that if you change a single database file that is used in 15 Total Access Agent actions, you only have to change one setting in one place. This is just one benefit of a well-defined and consistent user interface that belies the work that went into planning the product. DOING THE TESTING I set up the program on Windows NT 3.51 and 95 machines connected on an NT Server network to put Total Access Agent through its paces. I used two large Access databases for testing and performed just about every available event as frequently as possible. Once I got everything set up properly, the program performed flawlessly, repeatedly backing up the databases and gathering statistics. Some impressive features include automatically emailing a message when an error occurs, copying whole groups of events so you don't have to recreate them by hand, and suspending an event so that you don't have to delete and then recreate it. It even includes a Test button so you can immediately test any scheduled action to make sure that you've set it up correctly. FMS did a nice job with these extra touches. The 73-page manual is well-written, concise, clear, and indexed. It has almost too much detail, but this is a testimony to the quality of product design rather than a flaw in the manual. The Windows help file contains the same material as the manual--another nice touch. The documentation is careful to point out the program's limitations, such as to caution you that Total Access Agent uses the Jet engine's database repair capabilities, so don't expect miracles if Access itself can't fix a file. Total Access Agent includes both 16- and 32-bit versions, so it runs under Windows 3.x, 95, and NT using all Jet database versions. WINDOWS NT GOTCHA I did encounter a minor problem with Total Access Agent on my Windows NT 3.51 SP4 development machine. Total Access Agent Manager ran fine, as did Monitor, but I got an OLE error any time the Engine tried to perform an action. Technical Support via email and phone was helpful and responsive, and we ultimately solved the problem: the server wasn't registering properly--a typical NT problem. The product worked great on Windows 95. Besides this small problem with the Windows NT installation, there are a few minor improvements I'd like to see. There isn't always a list presented to the user when it would make sense, such as when you enter the name of an existing macro in the database you want to schedule. It would be easy enough to get a list of macros; the utility does present a list of tables to archive. If you change the scheduled events in Manager, you have to remember to either restart Monitor or click the Refresh Event Schedule button for the changes to take effect. I'd prefer having an option for the schedule to refresh itself at a specified interval, because this could easily be overlooked. My first impression on learning about Total Access Agent was, why bother? Access itself can do all the maintenance chores that Total Access Agent handles, and a simple program scheduler will run them. But it would take you a long time to match Total Access Agent's ease of use and elegance. So if you have Access databases to maintain, I'd definitely suggest you consider Total Access Agent. Don Kiely is Development Manager for the Arctic Development Council on the North Slope of Alaska. He programs in VB and writes about it when he isn't chasing polar bears. He's written several books about VB and VC++, including Visual Basic 4 Database How-To (co-author) from Waite Group Press and the Ultimate VB 4 Controls Sourcebook from Coriolis Group Books. Reach him at donkiely(a)polarnet.com or 72657.475(a)CompuServe.com. ------------------------------------------------------------------------ DynamiCube 1.31 Data Dynamics, Ltd. Tel: 614 895-3142 Fax: 614 899-2943 72672.550(a)compuserve.com http://www.datadynamics.com ferhat(a)coil.com Size: 1.2 MB Runtime: not applicable Price: $499 Quick Facts: DynamiCube is a 32-bit data-bound ActiveX custom control for On-Line Analytical Processing (OLAP). Supports VB4 32-bit Professional and Enterprise Editions, or other 32-bit ActiveX compatible development tools. Downloadable demo. Requires Windows 95 or Windows NT compatible PC, 3 MB HD, 8 MB RAM (16 recommended). By Jeff Borgoff With corporate America embracing On-Line Analytical Processing (OLAP), Data Dynamics, Ltd. has thrown its hat in the ring with DynamiCube, an ActiveX custom control that allows VB4 developers to build OLAP capability into executive information systems (EIS) and decision support systems (DSS). DynamiCube delivers custom n!-multidimensional data analysis capability, where the dimensions are limited only by system resources. To give you a better idea of the concept of dimensions, consider this: you want to see your company's total sales by product, category, country, region, quarter and year. The quarter, category and product constitute your columns, the region, country and year make up the rows, and the sum of sales is presented as your data. The result is six dimensions of data--or 6! A market saturation of first tier OLAP tools with OLE Automation support may make it difficult for Data Dynamics to position DynamiCube as a enterprise solution for OLAP. I'm familiar with other OLAP tools, but they're all larger and more expensive than DynamiCube. I see DynamiCube best suited for small-business, departmentalized or small commercial-product development where the fat competitive products aren't suitable due to size and cost. DynamiCube's claim to fame is its small foot-print (less than a megabyte for distribution), fast processing (assisted by Win32), impressive built-in print engine with print preview, OLE Automation support and slick presentation of data with drill-down capability. The product does its number-crunching on the client-side using the Microsoft Jet engine (DAO and RDO) and ODBC data sources. This works well enough if your clients have powerful machines, but this could be a problem with the client-side processing of massive amounts of data that would be processed faster on a server. DynamiCube also binds to the Visual Basic Data Control, Remote Data Control or directly to a data source without the Data Control. As long as clients have adequate resources, DynamiCube retrieves, crunches and displays huge amounts of data. The vendor recommends a Pentium 100+ MHz processor with 24 to 32 MB RAM for the power user of heavy DynamiCube applications. Data Dynamics provided me with a formula for virtual memory consumption of a Cube in action: ((Number of Dimensions * 4 bytes) + ( Number of Data Items * 8 bytes)) * (The Summarized Number of Records) For example: ((6 * 4) + ( 2 * 8)) * (10,000) = 3,840,000 bytes consumed. TESTING PROPERTIES DynamiCube's interface is developer friendly. The grid-layout properties page is robust, with an ample amount of customization ability comparable to capabilities offered by third-party grid controls. The properties page uses drag-and-drop to setup the data views. Notable property features include the dcConnect, dcConnectType, dcDatabaseName, dcOptions, dcQueryTimeout and dcRecordSource. These built-in DynamiCube replacement properties for the VB Data Control allow direct support for DAO, RDO and ODBC. I tested DynamiCube's connection to a Visual Basic Data Control compared with a direct connection using DynamiCube's built-in connection properties, and found performance about the same for each approach. However, there are a couple of benefits for using the built-in connection properties for DAO, RDO and ODBC. First, you don't have to deliver the Visual Basic Data Control with your application; secondly, you don't have to write any code using DynamiCube's built-in connection properties. DynamiCube's obvious weaknesses are its lack of support for Windows 3.1 (no 16-bit ActiveX version) and no integrated charting. Data Dynamics obviously chose to go with a 32-bit version because of the added power for processing large amounts of data, but if your users are running 16-bit systems, you're out of luck. The single sample project that comes with DynamiCube demonstrates a charting method using Visual Basic's anemic charting control--not exactly EIS presentation quality. However, you can export data to Excel using OLE Automation. The good news is DynamiCube has a few runtime properties that make it fairly simple to populate any chart control on the market. The sample application demonstrates all of DynamiCube's features (if you work through everything). I couldn't find some features in the manual or help file (e.g. the "PerformanceDlg" method), however PerformanceDlg was demonstrated in the sample app. I would prefer to have Data Dynamics spell out everything in the documentation. I encountered some problems using DynamiCube's on-line help file, such as properties missing from the properties list, and keywords not found during a context-sensitive search. I had to reference the 90 page manual more than I usually do for a custom control. Also, the manual has a two-page guided tour with some documentation errors that prompted me to call the vendor. They noted the errors and will hopefully make corrections for subsequent releases. If you want to see a cool example of how Data Dynamics' ActiveX DynamiCube works on the web, download Microsoft Internet Explorer 3 (beta as of early July) and go to http://www.datadynamics.com. You'll find an excellent demo. In spite of the documentation shortcomings, if you're looking to add OLAP capability to departmental or small-business EIS or DSS applications using client-side processing, DynamiCube is worth a look. Jeff Borghoff is the founder and President of Avalon Logic, Inc. He is a Microsoft Certified Professional and Visual Basic Product Specialist. His New Jersey based firm specializes in the design and development of Microsoft Windows based client/server systems. Reach him at AVALON_LOGIC(a)msn.com. ------------------------------------------------------------------------ VB Compress Pro 4.03 WhippleWare Tel: 617 242-2511 Fax: 617 241-8496 BBS: 617 241-9284 Price: $100 Runtime: not applicable Quick Facts: VB Compress Pro 4.03 automatically deletes unused or un-referenced code. It generates reports, regenerated code, or both. Supports VB2, VB3, VB4-16 and VB4-32. By Bill Shadish Many VB projects accumulate unused code over time. For example, code is orphaned when you delete a control on a form and forget to delete any corresponding event code for that control. VB Compress ferrets out any un-referenced code and deletes it. I must admit, VB Compress is one of the tools I hoped would make the treacherous journey from VB3 to VB4 with me. And it has, with release 4.03 offering significant improvements. VB CompressPro 4.03 (VBC4) searches your projects' source files for un-referenced API calls (declarations), unused variables and constants, unused subs, functions or property procedures and un-referenced controls or other external references. Selecting appropriate options configures the utility to automatically delete unwanted code. This latest release offers improvements over version 3, including: * Server mode checks that allow you to compress automation server code. * Intelligent checking of public references so that dynamically loaded routines are preserved. * Long file name support for use on Win95. * The ability to place C++-like assertions in your VB code to perform actions in case of unexpected errors. * Speed improvement of 30-40%. This new release requires less puttering around with options than VBC3 demanded. You can rewrite project code after reviewing a brief informational screen. Moving between options and reports lets you control the level of detail to code changes. Also, many options are provided to control which of these unwanted impurities are actually removed from the final rewritten code. GENERATING REPORTS I ran VBC4 against a 5070 line, 12 file, OLE Server project. VBC4 quickly produced an informational analysis, showing referenced and un-referenced controls, and references to outside DLLs and EXEs. Also included were missing external references that show up as unresolved. The utility also produced a list of file facts, including the oldest file, largest file, file sizes, byte counts and other types of files. I received a file-by-file analysis featuring the number of comments, blanks, executable code, variable declarations, form definitions and in-line counts that make up each file. I analyzed the code, generated a report and produced source code. Analyzing the 5070 line server took 1 minute, 39 seconds on a 486-33 with 16MB of RAM (the slowest machine that I could find). The Analysis Report step told me which constants, variables, and routines (sub, function and property) are un-referenced (that means unused) in my program. I also received an analysis of external objects I had left un-referenced. The analysis even included unused labels, such as unused error handlers. Armed with this information, I analyzed my code manually to see why variables or routines were un-referenced. This is a great tool for double-checking your code to see if something was forgotten or unfinished. I let VBC4 automatically produce an updated version of my code, dropping the un-referenced items. The VBC4 report also shows any unused API declarations so they can be deleted as well. API calls take up a fair amount of space within VB, because the string itself must be allocated, along with enough space to hold and resolve the parameters passed through the API call. Removing unused declarations can save quite a bit of memory if you have a large number of un-referenced API calls--possibly duplicated across several modules. The report is generated as a text file. VBC4 provides a viewer (VBC Viewer) that formats this file for viewing. You can drill down into further detail in some areas marked "click-here" to see more information about the items marked. And you can change report options to produce more or less of a breakdown. For example, you can select options to show all control events that have had code written behind them--a rather handy reference guide. You can print the report from the VBC Viewer, but WhippleWare left out the ability to copy, cut and paste the information directly from the on-screen report. Hence, you can't easily export the statistics into other tools, such as Excel. CODE GENERATION VBC4 offers quite a bit of control for handling code generation. For example, you can change options to have unused files deleted when the code is regenerated. You can also remove unused control objects from your project (which means I don't have to remember to remove control objects prior to creating install disks!). You have the ability to comment out, remove, ignore, mark or interactively decide how to handle the un-referenced local, private or public items. These items include constants, variables, type declarations, declarations or procedures. Lastly, VBC4 loads VB.EXE under its control and runs the VB design environment. You are able to interrupt the code generation process using a VBC4 toolbar that appears within VB. Using this same toolbar, you can generate a new .EXE and decide whether to update the VB source files or not. The one glitch I found working with VBC4 was running out of memory while producing updated code (for code procedures or declaration sections approaching 64K). This type of problem is often due to limitations within VB's editor itself. In case you couldn't tell by now, I like this product. Bill Shadish is a principal of Fundamental Objects, Inc., where he works with ActiveX controls and OLE server technology. He teaches VB programming, and writes regularly for VBTech and Visual Basic Developer. He co-authored the book Using OLE In Visual Basic 4, (Pinnacle Publishing, Inc.). Reach him at bills(a)fo.com or at http://www.fo.com. ------------------------------------------------------------------------ Visual SQL 4.0 Blue Sky Software Corporation Tel: 619 459-6365 Fax: 619 551-2486 http://www.blue-sky.com/ Price: $1899 QuickFacts: Visual SQL 4.0 is a code generator and class library that turns Microsoft Visual C++ into a client/server development environment. Supports 32-bit VC++ 4.0, Windows 95 and Windows NT. By Steve Jackson Visual SQL is a code generator and class library that creates 32-bit client/server database applications using Visual C++ 4.0 and the Microsoft Foundation Classes. It requires Windows 95 or Windows NT, and comes bundled with Sybase SQL Anywhere. The main benefit of Visual SQL is that it saves the time otherwise necessary coding screens and creating code to move data to and from the edit controls. The developer starts up the Visual SQL application generator wizard, selects the ODBC data source, tables, and columns needed for the application, and Visual SQL generates all the Visual C++ code needed for a fully functioning MFC database application. You can use any database with a 32-bit ODBC database driver. Visual SQL and the code it creates are fully integrated into the Visual C++ Developer Studio IDE. No runtime DLL is needed other than the standard ODBC DLLs. The product includes some useful utility programs and a repository that can be used optionally to store queries. The repository can be used in a team environment to share queries among multiple developers. I put the Visual SQL application wizard to the test by creating a customer order-entry database update program. Creating update screens was easy--I chose the table and columns, and they appeared on the form. The wizard created the update screens automatically, with edit controls for each field and the field name placed as a label above each edit control. I was then able to visually modify the form by dragging fields around and clicking on labels to change text. The wizard gives you some choices for how to do database retrieval and how the screens appear. Database retrieval can be done for an entire table, for SQL statements you create, or using a query stored in the Visual SQL Repository. Screens can appear as a data sheet with multiple records per screen like a spreadsheet, or as a data screen with one record showing at a time. Menu choices and toolbar buttons are automatically generated with navigation commands (first, next, and last record) and update commands. The code generated by the wizard compiled and ran cleanly the first time without any errors or warnings. SEAMLESS INTEGRATION I found the code generated with Visual SQL to be well written and well integrated with the MFC document/view architecture. I have seen other code generators that require the programmer to stay within the code generator IDE for all compiles, with limited ability to modify the program code. I was quite pleased to discover that Visual SQL creates an entire MFC project that can be compiled and modified with the Visual C++ IDE. I easily set debug breakpoints and ran the code from the Visual C++ debugger, and was able to modify the code using Visual C++ class wizards. Using the MFC Class Wizard, I added code to the undo menu items to cancel database changes made to a record. Oddly, the Visual SQL wizard generated menu selections for this, but failed to generate any code behind the menu choices. Looking under the hood, I found that the database operations were carried out in a Visual SQL class library. This library consists of classes that are wrappers around standard MFC data access objects (DAO) using dynasets and snapshots. Because the MFC DAO classes are built on top of the ODBC API, a developer can add calls directly to the ODBC API if needed. The product comes with a suite of useful utility programs. The Database Explorer allows the developer to view database table structures, analyze ODBC connections, and view repository entries. The ODBC Data Source tester and Configuration tester can be distributed with applications generated by Visual SQL. These testers verify that ODBC data sources are installed correctly, and that a user has the right versions of all the required DLLs; this information is highly useful for debugging an application, and for remote telephone support. The Visual Query builder presents a graphical interface for creating database queries and SQL statements, saving the developer time spent looking up column names and SQL syntax. Installation went smoothly, and the setup program automatically configured an ODBC data source for the tutorial programs. The documentation is well written and complete. For example, the documentation includes a detailed description of all the generated code modules, what each routine does, and how the modules are named. A few potential improvements I'd like to see in future releases include: the ability to automatically generate undo code to allow a user to cancel updates on a data screen, transaction commit point processing, a report generator and the ability to store labels in the repository instead of using field names when creating data screens. Blue Sky maintains a web site at http://www.blue-sky.com. Be sure to include the dash in blue-sky in the web address--if you leave it out you will find the web site for another company also called Blue Sky! Steve Jackson develops network-based applications using VB, C, SQL Server, Oracle and other tools at Loral Aeronutronic in Southern California. Steve is a Visual Basic Programmer's Journal author and CompuServe section leader: 72040.1640(a)compuserve.com. ------------------------------------------------------------------------ To subscribe to Visual Programming++, send an e-mail to visualprog-request(a)scribe.cerf.net. Include the word "subscribe", space, your e-mail address in the body of the message. For example, subscribe yourname(a)youraddress.com. To cancel your subscription, include the word "unsubscribe", space, yourmailaddress and send the same request. VP++ is separate from Hot Links, a brief e-mail sent to registered users of DevX alerting them to interesting new items on the site, and industry news. ABOUT FAWCETTE TECHNICAL PUBLICATIONS Visual Programming++ is Published by Fawcette Technical Publications. Copyright (c) 1996 Visual Programming++. All rights reserved. FTP also publishes or produces: Visual Basic Programmer's Journal, Avatar: http://www.avatarmag.com, Microsoft Interactive Developer, VBITS conferences, The VBCD, The VBPJ Guide to VB4, VBPJ CompuServe forum (GO VBPJ). Fawcette Technical Publications Publisher/President: Jim Fawcette 209 Hamilton Avenue Palo Alto, CA 94301-2500 USA Editorial Offices. Tel: 415-833-7100 Editorial Offices. Fax: 415-853-0230 Customer service and subscriptions: 303-541-0610 Orders: 800-848-5523 or 415-833-7100

1 0

DAM_lin
by jya＠pipeline.com 17 Dec '03

17 Dec '03

7-23-96, WaPo: "The Cryptography Wars." Op-Ed By Kenneth W. Dam and Herbert S. Lin In a June 10 editorial The Post disagreed with the NRC report, suggesting that law enforcement and national security interests require that current restrictions on cryptography be maintained. The Post asserted that it is "too soon" to accept that encryption can help law enforcement and national security. But arguing that it is premature to believe some uses of encryption do benefit law enforcement and national security simply denies reality. We emphatically reject The Post's implication that we "sacrificed" law enforcement and national security considerations in favor of economic interests. Indeed, only a fully open and inclusive public discussion can lead to the national consensus upon which any successful cryptography policy will depend. ----- http://jya.com/damlin.txt (6 kb) DAM_lin

1 0

Latest Schwartau Banned From Export
by winn＠Infowar.Com 17 Dec '03

17 Dec '03

For Immediate Release: Contact: Robert Newman (508) 478-0900 Jacqueline Jeng (212) 780-6133 (New York, NY): The Internet had been called the world's largest Enterprise Zone -- a place where small business people and entrepreneurs can compete with corporate giants. But to make it work, a business must master the ways of the Net -- how to target on-line customers, how to present products and services with style, and how to keep sites and transactions secure. That's why Winn Schwartau and Chris Goggans, internet experts with first hand knowledge of both the potential and dangers of the Internet, have created The Complete Internet Business Toolkit ($34.95, Van Nostrand Reinhold, ISBN 0-42-02222-0) -- the first comprehensive manual for setting up, operating and defending a business in Cyberspace. In The Complete Internet Business Toolkit, two of the digital age's savviest cybernauts offer all the information and tools needed to establish, maintain, expand and protect Net enterprises. This complete resources includes information on common pitfalls, security measures, and payment methods needed to open up shop on the Internet. >From the basics of how to get on line to the mechanisms needed to protect credit card transactions and use Cybercash, Schwartau and Goggans provide businesses with a step by step approach to creating a secure, functional and user-friendly on-line business. The Complete Internet Toolkit will: * Outline how a business can easily expand by taking advantage of the Internet and its myriad resources. * Demonstrate how to design a web page that will capture the attention of cyber-customers. * Review all of the current major security software for conducting financial transactions on the Internet. The Complete Internet Toolkit also includes a bonus CD-ROM with more than 5,000 files. In a matter of minutes, it can download Web browsers, SLIP/PPP drivers, digital cash and encryption programs, graphics and animation viewers, compression utilities, and other key programs for navigating the Internet. THE BOOK CONTAINS CRYPTOGRAPHY TOOLS BANNED OUTSIDE THE U.S. Far from another dry, reference book, The Complete Internet BusinessToolkit is written in clear and entertaining style and is designed for the small business owner or the individual poised to overcome any challenge in order to stake out their claim in Cyberspace. See reverse side for Table of Contents and About the Authors ABOUT THE AUTHORS One of the world's leading experts on information security and electronic privacy, Winn Schwartau is President of Interpact, Inc., an international security consulting firm for industry and government and is the author of Information Warfare: Chaos on the Electronic Superhighway and Terminal Compromise, as well as more than 500 articles. Chris Goggans owns Computer Security Technologies, a consulting firm based in Austin, TX. A founding member of the legendary hacking group, the "Legion of Doom," Goggans has helped Federal authorities crack some of their most notorious computer and telecommunications frauds such as the "Masters of Deception" case. Goggans is the editor of the on-line publication, Phrack Magazine. TABLE OF CONTENTS A Brief History of Cyberspace Getting Wired Electronic Mail Usenet NewsGroups Telnet and FTP The World Wide Web HTML So You Want to Get Paid Other Useful Applications Defending Yourself on the Internet Your Future on the Internet Appendix A - What's on the CD-ROM If you are interested in scheduling an interview or in receiving more information about the book, please call Bob Newman at (508) 478-0900. The Complete Internet Business Toolkit is available in better bookstores or by calling 1-800-842-3636. Peace Winn Winn Schwartau - Interpact, Inc. Information Warfare and InfoSec V: 813.393.6600 / F: 813.393.6361 Winn(a)InfoWar.Com

1 0

Re: DES brute force? (was: Re: Borders *are* transparent)
by Mixmaster 17 Dec '03

17 Dec '03

>What DES modes are used in typical banking situations? (I am >presuming a challenge involving a widely used banking funds transfer >protocol would be a suitably juicy targets, based on a criteria of >demonstrating the greatest financial risk). The problem with banking applications is that cracking a real key causes lots of real damage. I don't think it is illegal (as long as you don't withdraw somebody else's money), but publishing e.g. one of the DES keys used for the "EC Card" PIN verification would bring the European ATM system close to collapse. Finding a self- generated key, on the other hand, is not very impressive.

1 0

RE: Brute Force DES
by Matt Thomlinson 17 Dec '03

17 Dec '03

why not put together (a LOT of) disk space and we can build a table (read: "a cryptanalytic time-memory tradeoff") for cracking DES? Using the table, we could brute-search the DES keyspace in less time than it would take to do an exhaustive search of a 38 bit keyspace, according to the paper. 4 gigs is what, a couple of hundred nowadays? Making DES equivalent to a 40-bit crack would take approx. 500Gig, but publishing the table would push DES out usefulness. Certainly we could scale back (make DES equivalent to a 45-bit crack?) if we don't have enough disk... mattt >---------- >From: Peter Trei[SMTP:trei@process.com] >Sent: Monday, July 22, 1996 9:55 AM >To: frissell(a)panix.com; cypherpunks(a)toad.com; trei(a)process.com >Subject: Re: Brute Force DES > >> Peter wrote: >> >Any one up for a distributed brute force attack on single DES? My >> >back-of-the-envelope calculations and guesstimates put this on the >> >hairy edge of doability (the critical factor is how many machines can >> >be recruited - a non-trivial cash prize would help). > >Duncan wrote: >> I volunteer my 120 MHZ Pentium. A lot more Pentiums are out there now than >> a year ago. That makes it more feasible. A lot more people with full net >> connections. Like most Americans, I have a flat rate net connection and a >> flat rate local phone connection so could run a cracking session >>permanently >> (as long as no one tells my ISP). We need a full test of the Winsock >> cracking client in any case. It wasn't working very well last time. >> >> DCF > ><back-of-envelope> > >In my terminology, 'hairy edge of doability" means we have a shot >at success, but I wouldn't bet the farm on it. > >I thought that I might bet a couple hundred bucks, though. > >Sadly, after further calculation, I'm not so sure if it's doable just yet. > >What I'm looking at is a known plaintext attack on single ECB DES, >using a brute-force test to cycle through the key space. People >would get chunks of keyspace to test from a central server or >servers, and would be motivated to take part by a cash prize for >the lucky person who finds the key. > >Lets do the numbers: > >Single DES has the security of 56 bits of key - there are 64 bits in the >keys, but 8 of them are parity bits which add nothing to security. > >2^56 = 7.205e16 keys (which is a whopping big number) > >Let's guess that we can recruit the equivalent of full-time on 1000 >machines. > >7.205e13 keys/machine. > >Let's guess that we have about a month before people start to lose >interest - so we want to be more than 1/2 done by then. Lets say >we want to sweep the whole space in 40 days. > >1.8e12 keys/machine/day > >~21,000,000 keys/machine/second > >The fastest general purpose, freely available des implementation I'm >aware of is libdes. by Eric Young. With this, I can do a set_key in >15.8 us, and an ecb_encrypt in 95 us/block. That adds up to >about 9,000 keytests/sec (this is on a 90 MHz P5, running NT). > >I'm looking at ideas to speed up DES - if I'm willing to use >honking great lookup tables, the permutation steps can be done >more quickly than libdes. I'm also looking at implementing the >algolrithm in hand-optimized P5 assembler. (It's been years since >I've done a major assembler project - the P5 has some truely weird >features to be considered, but also has (some) internal 64 bit >registers to play with). > >Let's guess that I can speed up a key-test up by a factor of 10. (This is >not a slur on Eric's code - it's extremely clever, but not optimized >for any particular processor, or for key-testing. Note that the keytest >described above takes about 10,000 cycles/test.) > >That gets my workstation up to about 90,000 keys a second, which is >still almost a factor of 250 too slow. > >I'm going ahead with my work on a faster DES keytester, but unless >optimizing gives an astounding win, I now think a distributed bruting >effort is a bit pre-mature. > >What will make this brute doable, if not now, then in the near future? > >1. Faster Processors - Moore's Law is still holding. A year ago, my >90 MHz Pentium was one of the faster machines taking part in the >40-bit RC4 crack. Now, it's passe. > >2. More processors. The number of people on the internet continues >to grow rapidly. > >3. More interest - Crypto awareness has greatly increased in the >last year, and a real cash prize (say, over $500) will generate both >publicity and interest. > >These factors all multiply together. The number of cycles that could >probably be recruited is increasing at a fast rate. A major part of the >work will be a keyspace distribution mechanism which can handle >the load (this was a major stumbling block last year). > ></back-of-envelope> > >Peter Trei >trei(a)process.com > >Disclaimer: This has nothing to do with my employer. >

2 1

Re: DES-Busting Screen Savers?
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 15:53 7/23/96, Timothy C. May wrote: >Or several times that number of machines or time for machines with less >crunch. Say, 100K Pentium-type machines for a month or two. How might this >be gotten? > >A while back I proposed one approach: a brute force "screen saver" for >Windows machines. Other platforms, maybe, but the most cost-effective thing >to do is to go after the Windows market only. A friend of mine actually wrote an RC4-40 cracking screen saver during the initial RC4 crack. We finished the brute force so quickly that he never released the software. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

1 0

Re: E-Cash promotion idea
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 23:19 7/22/96, Anonymous wrote: >How about getting the CyberCafes to accept ecash? Just pull out your >Newton/HP48/PDA and point the IR beam at the cash register. Now that's >an ecash application I'd like to see!! So would I. And one day we will. Though not not on the HP48. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

2 1