December 2003 - cypherpunks-legacy

Re: cycle market
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 11:14 AM 6/4/96 -0400, SINCLAIR DOUGLAS N wrote: >Graphical rendering is one place where I might like a cycle >market. Finite element simulation is another. Sinclair mentions some of my favorites. Others are: (1) Attacking RSA-nnn challanges. (2) Brute forcing 56 bit keys to demonstrate that 1DES is obsolete. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Paper about electronic cash and common currencies available
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: e$(a)thumper.vmeng.com Reply-To: Wolfgang Roeckelein <wolfgang.roeckelein(a)wiwi.uni-regensburg.de> Mime-Version: 1.0 (NeXT Mail 3.3 v118.2) Precedence: Bulk Date: Tue, 4 Jun 96 11:14:41 +0200 From: Wolfgang Roeckelein <wolfgang.roeckelein(a)wiwi.uni-regensburg.de> To: Multiple recipients of <e$(a)thumper.vmeng.com> Subject: Paper about electronic cash and common currencies available Hello everybody, our paper titled "A Common Currency System for Spontaneous Transactions on Public Networks" is available online under http://www.whu-koblenz.de/~wolfgang/CommonCurrency/ Perhaps somebody might be interested. Thank you for your attention, Wolfgang Roeckelein --- Dipl.-Wirtsch.Inf. Voice: +49 941 943 2998 Wolfgang Roeckelein Fax: +49 941 943 4986 Uni Regensburg E-Mail: roeckelein(a)wi.whu-koblenz.de Universitaetsstr. 31 Wolfgang.Roeckelein(a)wiwi.uni-regensburg.de D-93053 Regensburg (MIME and NeXTmail ok) Germany WWW: http://www.whu-koblenz.de/~wolfgang/ GCM/B d-- s: a- C++ US+++$ UX+++ P+ L E? W++ N++ w-- O-(++) M+ !V PS++ PE Y+ PGP(++) t+ 5? X? R+ tv b++ DI D++ G e+++>++++ h+ r++>% y? (Geek Code V3.x) --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "If they could 'just pass a few more laws', we would all be criminals." --Vinnie Moscaritolo The e$ Home Page: http://www.vmeng.com/rah/

1 0

Re: Class III InfoWar: TST Article
by jya＠pipeline.com 17 Dec '03

17 Dec '03

On Jun 04, 1996 12:29:02, 'Dan Haskovec <dhaskove(a)ucsd.edu>' wrote: >Here's the reply I got from a friend that I forwarded it to.... > > >and the verdict is... NetMYTH! I checked the cite in the article on >cyberterrorism... no such article ran on 6/2/96 in the Times >(London)... nor, in fact, in any newspaper available on Nexis... >just thought I would let you know... Gosh, Dan, your friend may want to double-check. After reading Winn Schwartau's post, I bought a copy of The Sunday Times here in NYC late Sunday in which the article led at the top of the Front Page. Be glad to fax anyone a copy who may want such, ahem, verification. E-mail me a number. However, I acknowledge that there is a chance that the TLAs, or Net security/info war consultants (like Schwartau, et al) planted the article, a fake to generate scare-funding and boost conference attendance. Or maybe it's a classic Brit joke, a spoof -- or a sting by the Intergalactic Net Police. Strange terrorist ripoffs happen -- incredible IPOs, vaporware millionaires, and such.

1 0

cycle market
by bryce＠digicash.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I was trying to think what I would use a cycle market for. The only thing that I wait for more than a minute on currently is compiling. It might be quicker to ship my source code to a remote compilation service with big pipes and big engines. Considering that I've got a Pentium 120 on my desktop, though, those would have be pretty big engines to make up for the time lost in transmission of source and compiler output (both compiler messages and object files.) Just musing out loud. Regards, Bryce -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.1b2 iQB1AwUBMbQ/d0jbHy8sKZitAQHRFgL/Ydkbb4ieFryq1ZRwAVPR0/gksKdVMJ88 rWXGmqpHh810mi1vqgEjWL3XSJL1ogoN6GXuvpZQufvN0ldShOr+fDiodYX6g53K gK+6Z5WTUzTS6Wn1I/IGuSQ86Om4+JOg =MQ0q -----END PGP SIGNATURE-----

2 1

Re: (VTW) BillWatch #48
by Carl Ellison 17 Dec '03

17 Dec '03

The NRC gets points for putting out a report that will become useful in the months to come. The White House gets an 'F' for their handling of encryption policy. Even in the face of two expert studies on their policy, they continue to stick to a failed, unpopular policy. <<<< I was at the EPIC conference yesterday (6/3) -- where Whit Diffie, BTW, presented the same argument Steven Cherry gave in this BillWatch -- but at the end of the EPIC conference we had Scott Charney of DoJ on a panel about what the OECD is doing (pushing Clipper internationally) and we kept going round with him on the administration's pushing of Clipper (N). [One attendee described this as "forum shopping" -- looking for a friendly place to push Clipper.] There were people battling him over his alleged representation of the USA at the OECD -- claiming he was misrepresenting the country by pushing Clipper. His response was that the Executive is empowered to do all international meetings/negotiations/.... After the meeting ended it hit me what the problem is and I mentioned it to PRZ. We're complaining that the Executive has gone rogue -- is disobeying the will of the people. PRZ likened it to Nixon's war in Cambodia. So, maybe it's nothing new -- just a new playing field for the same old game. - Carl +------------------------------------------------------------------------+ |Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2| | "Officer, officer, arrest that man! He's whistling a dirty song." | +-------------------------------------------- Jean Ellison (aka Mother) -+

1 0

Asendmail v0.5beta
by Ben Holiday 17 Dec '03

17 Dec '03

Okay, so i'm an idiot. :) I ran out the door in such a hurry on friday that I didn't bother to make the asendmail package globally readable. Apologies to everyone who tried to get a copy and got a permission denied. It is now really and truely available from: http://www.infonex.com/~ncognito/asendmail.tar.gz Sorry for the hassles.

1 0

Electronic Signature Act Of 1996
by Ben Holiday 17 Dec '03

17 Dec '03

(Condensed from AP article) Florida now recognizes electronic signatures as legal and binding. In other words - its okay to sign it by modem. The electronic Signature Act of 1996 passed the Legislature unanimously and became law Friday. The law does not specify how an electronic document must be signed, but it probably will mean coding the text and typed signature so they cannot be changed by anyone other than the writer. California and Utah are the only other states that have laws recognizing electronic signatures.

2 1

Where are the cryptographers going to come from?
by nelson＠crynwr.com 17 Dec '03

17 Dec '03

> >----- Forwarded Cyberia-L message (DAVID POST <postd(a)EROLS.COM>) -----< > Someone else pointed to a recent story in the Economist, which > listed the leading encryption software/services companies > worldwide, each of which is Israeli. > > Bidzos made the claim, and many others echoed, that the export > controls are in the process of doing nothing more than ceding a > potentially lucrative market to others, a market in which the US > might otherwise be expected to be the dominant player. It may > even, in the eyes of some, be too late to undo this damage. Not only that, but where are the cryptographers of the future going to come from for the NSA to recruit? Israel?? Oh right, foreign nationals privy to our own highest secrets, give me a break. Do they intend to train them themselves? If so, that's identical in principle to universities granting tenure to their own graduates. You get inbred that way, so universities don't do that. The principle behind crypto secrecy presumes that other people don't have the secret. Once they do, you only hurt yourself by trying to keep a double-edged sword in the closet. The NSA believes that they can and should discard any amount of benefits of crypto in exchange for avoiding any harm of crypto. They are wrong. -russ <nelson(a)crynwr.com> http://www.crynwr.com/~nelson Crynwr Software | Crynwr Software sells packet driver support | PGP ok 11 Grant St. | +1 315 268 1925 voice | It's no mistake to err on Potsdam, NY 13676 | +1 315 268 9201 FAX | the side of freedom.

1 0

Re: Java
by Clay Olbon II 17 Dec '03

17 Dec '03

Bill Frantz <frantz(a)netcom.com> wrote: >In the long run, I hope to use Java to sell cycles. Java has the advantage >in a cycle market that it is machine independent, and the Just In Time >compilers should make the performance reasonable. > Has anyone written a Java app to implement the Chinese Lottery? Seems like a natural way to do it. A small cash prize might entice lots of folks to let it run in the background... Clay --------------------------------------------------------------------------- Clay Olbon II | Clay.Olbon(a)dynetics.com Systems Engineer | ph: (810) 589-9930 fax 9934 Dynetics, Inc., Ste 302 | http://www.msen.com/~olbon/olbon.html 550 Stephenson Hwy | PGP262 public key: on web page Troy, MI 48083-1109 | pgp print: B97397AD50233C77523FD058BD1BB7C0 TANSTAAFL ---------------------------------------------------------------------------

1 0

(Fwd) Crypto conference
by jya＠pipeline.com 17 Dec '03

17 Dec '03

>----- Forwarded Cyberia-L message (DAVID POST <postd(a)EROLS.COM>) -----< I was at EPIC's annual crypto conference yesterday, and just thought I'd pass along my impressions. It was, as always, extremely interesting; EPIC does a terrific job at these things of getting a very diverse and thoughtful collection of people with interests in crypto policy into the room together, everyone from Whit Diffie and Phil Zimmermann and Eric Hughes to Scott Charney of DOJ and Bruce McConnell of the White House, people from the OECD and the hardware/software community, etc. There were panels on key escrow, digital cash, international developments, and the Karn/Bernstein cases and other domestic policy developments. To me, the most striking feature of the event was what I felt was a new bite to the complaints about export controls. People have been complaining, needless to say, about these for a while -- but the *economic* case for lifting controls is now in the forefront of the discussion in a way that was not the case before, imho. Indeed, there wasn't an enormous amount of talk about the *privacy* implications of encryption this time at all. Jim Bidzos of RSA gave a very powerful talk at lunch, at which he unveiled two chips that are now being mass produced by Nippon Telephone, one incorporating the Triple-DES algorithm, and one with the RSA public key algorithm. Someone else pointed to a recent story in the Economist, which listed the leading encryption software/services companies worldwide, each of which is Israeli. Bidzos made the claim, and many others echoed, that the export controls are in the process of doing nothing more than ceding a potentially lucrative market to others, a market in which the US might otherwise be expected to be the dominant player. It may even, in the eyes of some, be too late to undo this damage. Now, some of this may be exaggerated, special interest whining. But there's an interesting hook here. Many have talked about the importance of control over "standards " in network industries, the importance of obtaining an early dominant position in the market that can appropriate all of the network externalities waiting to be plucked out there. [Mark Lemley has an interesting discussion of this in a piece on antitrust on the Net -- Mark, is that out anywhere yet?] Acting quickly to penetrate the market becomes critical, not just because markets change on "Internet Time," but also because the early entrants have a chance of establishing themselves as de facto standards and thereby extending their dominance over time. This, one can plausibly argue, is what is happening -- has happened? -- in this market. It is more credible in these kinds of markets to argue, as Bidzos was arguing, that if government policymakers wait until there's actual evidence of damage, of "lost market share," to US companies, that it will at that point already be too late to do anything about the damage. ---------- [Second Cyberia-L message by David Post] One other interesting issue generated heated discussion -- as in yelling and screaming between audience and panel -- at the EPIC conference. Scott Charney of DOJ, who heads the US delegation to the OECD crypto guidelines conference, was subjected to pretty heated questioning about the possibility that the US is trying to use the international forum as a way to move a particular policy agenda that is *not* being successfully peddled at home, and then to use the international support as a means of moving the domestic policy debate in that direction. Jamie Boyle of AU was particularly eloquent about this concern (I raised it too, less eloquently) -- I think it fair to say that both of us had the copyright experience in the back of our minds, where, many of us believe, the US has been pushing the "Lehman agenda" in international discussions as a way of presenting Congress with a kind of fait accompli. Charney vigorously denied that this was going on -- he strongly argued that since the OECD guidelines are non-binding (unlike, say, the treaty obligations being discussed in the copyright context), there's simply nothing wrong with discussing these clearly global issues with our international partners. It was, as they say in the press, a spirited exchange. David ********************************* David G. Post, Georgetown University Law Center Postd(a)erols.com 202-364-5010 Cyberspace Law Institute home page http://www.cli.org ********************************* David ********************************* David G. Post, Georgetown University Law Center Postd(a)erols.com 202-364-5010 Cyberspace Law Institute home page http://www.cli.org *********************************

1 0

Cost of brute force decryption
by Bruce M. 17 Dec '03

17 Dec '03

Windows NT Magazine ran an article in their May 1996 issue titled "Secure Enterprise Email - How Safe is Your Mail System" that goes into matters of keeping company email private. PGP and other means of encryption are mentioned along with the following: "If you can ensure secrecy either until no one cares about the information or so that cracking the code costs more than the information is worth, it's 'secure enough.' "For example a 40-bit key takes about $10,000 worth of supercomputer time and two weeks to crack. Although this key may be adequate to protect my checking account, it's probably not large enough for the accounts of a major corporation. "A slightly longer key of 56 bits requres millions of dollars to crack and should protect the information for years to come. A 56-bit encryption key has 2^56-or 72 quadrillion-possible keys. With 1,000 computers, each trying 1,000,000 keys per second, trying them all would take 833 days. On average, you find the key halfway through your search. I was curious as to what type of formula was used to determine these figures since it wasn't mentioned in the article. Obviously, the speed of the computers, method of cracking and other such factors would be important to know. Could anyone shed some additional light on this for me? Thanks. Bruce M. * brucem(a)feist.com ~---------------------------------------------------~ "Knowledge enormous makes a god of me." -- John Keats

1 0

Asendmail yet again
by Ben Holiday 17 Dec '03

17 Dec '03

Ok so it isnt really and truely available. The right URL should have been: http://www.cyberpass.net/~ncognito If that still isn't right then im gonna assume that god is giving me a hint and go shoot myself in the head. Adios.

1 0

How to explain crypto?
by declan＠well.com 17 Dec '03

17 Dec '03

Brock, the crypto-challenged, humbly apologizes for his gaffe. He was looking for a way to draw an understandable comparison of how much harder a 1024-bit implementation of RSA is to break than what current export controls allow. He's asking for suggestions on how in future articles he could word this so a layman could understand it... Preferably something that could be said in a few sentences. (Brock cops to the fact that it does an incredible disservice to a complex topic. Remember, tho, he writes for a broad audience with a way diverse range of understanding -- or misunderstanding, as the case may be!) For example, someone sent me this explanation: "The 1024 bit key is likely an RSA key, and is not comperable to a 40 bit symetric key. From memory, 1024 bit RSA is about as hard to crack as 90 bit symetric." Is this a reasonable comparison? -Declan

3 2

Re: Java Crypto API questions
by jim bell 17 Dec '03

17 Dec '03

At 11:52 PM 6/3/96 -0700, Lucky Green wrote: >At 16:22 6/3/96, jim bell wrote: > >>A signature is just that: A signature. It doesn't encrypt or decrypt. It >>doesn't even ALLOW the system it's in to encrypt or decrypt, because there >>are numerous encryption programs written that have no need for such a >>signature. If no program existed which _used_ that signature, nobody would >>think twice about exporting it. >> >>The fact is, it is LEGAL to import encryption code into the US. It is LEGAL >>to generate an hash of that code, and it is LEGAL to export that hash. To >>believe otherwise is to broadly expand the scope of export laws far beyond >>what they were intended to mean. > >First, the ITAR are not laws, but regulations. Second, there are many that >believe that applying ITAR to crypto software is already expanding the >scope of the regulations far beyond what they were intended to mean. I agree. Which is why I think any acquiescence by Microsoft on the subject of exportability of signatures is wrong. Let the government press its case, if it wants to try. Don't assist it, even rhetorically. Jim Bell jimbell(a)pacifier.com

1 0

Re: NYT on NTT/RSA Chips
by jim bell 17 Dec '03

17 Dec '03

At 10:54 AM 6/4/96 GMT, John Young wrote: >Connecting Declan's three dots [...]: > The New York Times, June 4, 1996, pp. D1, D4. > Japanese Chips May Scramble U.S. Export Ban > By John Markoff > Washington, June 3 -- The Nippon Telegraph and Telephone > Corporation has quietly begun selling a powerful data- > scrambling chip set that is likely to undermine the Clinton > Administration's efforts to restrict the export of the > fundamental technology for protecting secrets and commerce > in the information age. > An executive at NTT America said that although there were > no restrictions on the export of cryptographic hardware or > software from Japan, his company was still anxious to > obtain software from RSA Data to use in its chips. That > software is still controlled by United States export law, > he said. Maybe it's just me, but the solution to NTT's problem is obvious. Even assuming that the export of this software would be against the law, why doesn't somebody simply violate that law? RSA would publish that software, possibly encrypted with NTT's public key, on a public system protected against direct export. "Somebody" would download it, write it to a floppy (taking care not to leave any fingerprints, and wetting both the stamp and the envelope with tap water, rather than licking them) and mail that floppy off to NTT in Japan. (Naturally, you don't put a return address on that envelope. The truly paranoid would first take that floppy to some store's PC section, and cross-load the data onto a floppy written by some other floppy drive.) NTT finds that envelope in their mail, opens it, reads the floppy, decrypts the data, and say, "Wow! It's the data we wanted to get!" It verifies that the data is valid by emailing a copy back to RSA in America, who say, "Amazing! Somebody has illegally exported our software!" As far as I know, there is nothing wrong with NTT using this software even if it is assumed to have been exported illegally. Obviously, NTT won't _ask_ for somebody to do this, because then the government will claim it was all a conspiracy, but that doesn't prevent NTT from being the beneficiary of somebody else's activities. Jim Bell jimbell(a)pacifier.com

2 1

Export what's imported
by jim bell 17 Dec '03

17 Dec '03

Recently, Senator Burns introduced that bill, S.1726, "ProCode." Part of it had to do with changes in the export laws to allow export of things that are currently not allowed. It occurs to me that this bill should be amended to say, explicitly, that any object or software which has ever been imported into the US can be legally exported. (Including multiple copies of software.) It is particularly important that we do this now that the NTT encryption chip set has been announced. Why? Well, first, we CAN easily justify this. The claim for export controls is that they restrict the access of encryption to various of the horsemen, out there. But by definition anything which has ever been imported is already available outside the US, so it'll look rather silly if they try to control somebody from export that came from out of the country. What are the benefits? Maybe it'll destroy the entire crypto-export-regulation system. Domestic software companies can simply set up a practice of buying all their crypto expertise from overseas. If this happened over the long term this would be bad, but it won't because within a couple of years good crypto will be exported by American manufacturers based on foreign designs. Pretty soon the export bans will become meaningless (even more so than they are today) and the pressure to remove the last restrictions will be enormous. Jim Bell jimbell(a)pacifier.com

1 0

Re: (VTW) BillWatch #48
by jim bell 17 Dec '03

17 Dec '03

At 10:17 AM 6/4/96 -0400, Carl Ellison wrote: >I was at the EPIC conference yesterday (6/3) -- where Whit Diffie, BTW, presented the same argument Steven Cherry gave in this BillWatch -- but at the end of the EPIC conference we had Scott Charney of DoJ on a panel about what the OECD is doing (pushing Clipper internationally) and we kept going round with him on the administration's pushing of Clipper (N). [One attendee described this as "forum shopping" -- looking for a friendly place to push Clipper.] > >There were people battling him over his alleged representation of the USA at the OECD -- claiming he was misrepresenting the country by pushing Clipper. His response was that the Executive is empowered to do all international meetings/negotiations/.... > >After the meeting ended it hit me what the problem is and I mentioned it to PRZ. We're complaining that the Executive has gone rogue -- is disobeying the will of the people. PRZ likened it to Nixon's war in Cambodia. I have a solution to that problem. Jim Bell jimbell(a)pacifier.com

1 0

Re: FOR WHOM THE BELL TOLLS
by jim bell 17 Dec '03

17 Dec '03

At 12:30 PM 6/4/96 -0700, Sandy Sandfort wrote: > Carl Ellison wrote: >>After the meeting ended it hit me what the problem is and I >>mentioned it to PRZ. We're complaining that the Executive >>has gone rogue -- is disobeying the will of the people. >>PRZ likened it to Nixon's war in Cambodia. > > Jim Bell replied: > >>I have a solution to that problem. > >My question for member of this list is: When Bell finally >goes too far and they arrest or shoot him, how can we best >capitalize on his martyrdom? Or in a more negative light, >what damage control will we need to do in that case? >Now I know that barking dogs rarely bite, but Jim may just >fool us and find his cajones. In any event, the sort of >yapping he is doing could itself be considered a crime that >could attract the sort of negative attention he apparently >craves. If there is any doubt that we _need_ a system to rid us of these sleazy politicians: I just saw tonight's PBS McNeil news hour, and they had two politicians on, one of which was promoting a re-emergence of the "Star Wars" missile defense system, which even under optimistic scenarios would cost hundreds of billions of dollars. My solution is simpler and far less expensive: Target any political or military person at any level who is directly or indirectly in control of any offensive missile system (nuclear or otherwise), killing off as many as it takes until they cry "uncle" and destroy all of that hardware. Probable cost of this persuasian? A few hundred million dollars, at most. Who is committing the crime, here? Maybe, someday, you'll start really LISTENING to what I have to say. ObCrypto? Your motivations are quite opaque. Maybe we can turn them into a cryptosystem? Jim Bell jimbell(a)pacifier.com

1 0

Info on DES crypto program
by vinnie moscaritolo 17 Dec '03

17 Dec '03

Hey all; Does anyone have experience or comments about a product called Code Cryptor from New Mexico Software. I belive it is yet another DES based product. tey have a web page at: http://www.swcp.com/cryptor/ "Rah's Samoan Attorney" Vinnie Moscaritolo ------------------ "friends come and friends go..but enemies accumulate." http://www.vmeng.com/vinnie/ Fingerprint: 4FA3298150E404F2782501876EA2146A

2 1

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

1 0

FOR WHOM THE BELL TOLLS
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ C'punks, In a recent exchange, Carl Ellison wrote: >After the meeting ended it hit me what the problem is and I >mentioned it to PRZ. We're complaining that the Executive >has gone rogue -- is disobeying the will of the people. >PRZ likened it to Nixon's war in Cambodia. To which Jim Bell replied: >I have a solution to that problem. My question for member of this list is: When Bell finally goes too far and they arrest or shoot him, how can we best capitalize on his martyrdom? Or in a more negative light, what damage control will we need to do in that case? Now I know that barking dogs rarely bite, but Jim may just fool us and find his cajones. In any event, the sort of yapping he is doing could itself be considered a crime that could attract the sort of negative attention he apparently craves. Any suggestions? S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

4 3

MELP: 2400 baud speech coding
by John Gilmore 17 Dec '03

17 Dec '03

Mixed-Excitation Linear Predictive encoding gives better speech quality than CELP at half the data rate. Encoding and decoding together burn up more than 100% of a TMS320C3x digital signal processor at 33MHz -- 64% to encode and 53% to decode. I don't know how it does on a Pentium or an Alpha. If you have the MIPS at both ends, this enables very robust encrypted speech across modem links to the Internet. John Walker's free SpeakFreely software (http://www.fourmilab.ch/speakfree/windows/speak_freely.html; or follow the link from there to the Unix version) is already doing packet replication for high reliability, using the earlier LPC-10 algorithm. (It doesn't implement MELP, though those on fast CPUs could add it.) I noticed an ad in EE Times that said, "MELP: The new Federal Standard for 2400 bps Speech Coding", so I did a web search for it. It reportedly comes from Georgia Tech research. Atlanta Signal Processors has the exclusive license. See http://www.ti.com/sc/docs/dsps/softcoop/voc-13-1.htm. John Gilmore

1 0

biometric id
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

info on a biometric id utilizing crypto techniques. ------- Forwarded Message Date: Fri, 31 May 1996 16:34:40 -0700 (PDT) From: Phil Agre <pagre(a)weber.ucsd.edu> To: rre(a)weber.ucsd.edu Subject: biometric encryption [A Canadian company called Mytec is marketing a biometric encryption system that, as far as anybody can tell, is an important step forward for privacy protection. It is based on fingerprint recognition, but it does not produce a representation of the fingerprint or recover the identity of the fingerprint's owner. Instead, it uses an optically transformed version of the fingerprint to decrypt a text string that could be, for example, the private key for a public-key cryptographic system such as RSA. Provided that one trusts the Mytec box, this would be a way to overcome many of the pragmatic hassles that would otherwise accompany the privacy-enhancing technologies that David Chaum and others have described. For example, they have built their device into a computer mouse, so that the computer will only generate your digital signature, or permit your mail to be read, if you are holding the mouse (or, I suppose, if you have been holding it very recently). In this message, the president of Mytec responds to some common concerns about his company's technology that arose in response to a query that I sent to the Computer Privacy Digest. He provides the company's web URL for those who wish to know more.] =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Fri, 31 May 96 11:06:44 EST From: Computer Privacy Digest Moderator <comp-privacy(a)uwm.edu> To: Comp-privacy(a)uwm.edu Subject: Computer Privacy Digest V8#044 Computer Privacy Digest Fri, 31 May 96 Volume 8 : Issue: 044 - - ---------------------------------------------------------------------- Date: 29 May 1996 09:42:54 -0400 (EDT) From: gtomko(a)noc.tor.hookup.net (George Tomko) Subject: Re: Biometric Encryption Dear Mr. Levine: Subject: Biometric Encryption I have noticed a number of communications in your news group regarding Biometric Encryption, especially some concerns about its use. As one of the developers of this technology, I would appreciate if the attached response could be posted in the news group to provide people with some answers and also to obtain feedback and discussion. Kind regards. George J. Tomko, Ph.D. Several people commented on four concerns in using a finger pattern for biometric encryption, namely: 1. It's easy to get someone's fingerprints since they are left on a vast number of everyday objects, such as drink cans and door handles; 2. Muggers would start cutting off people's fingers when stealing their cards; 3. The crooks would forcibly hold down an individual's finger against the biometric encryption authentication device to extract the string coded by the individual's Bioscrypt; and 4. If the finger used to code the Bioscrypt is damaged or destroyed, then an individual will not have access to the files associated with the Bioscrypt. I will try to answer these concerns in order. But, first, let me define a Bioscrypt. A Bioscrypt is a two-dimensional image of a string or set of characters which can represent a PIN, encryption key or pointer and which has been coded (encrypted) by the two-dimensional information in a fingerprint pattern. It has the following properties: - - - it has no resemblance to the original fingerprint. - - - it cannot be reconverted to the original fingerprint. - - - if an optical image of the correct live fingerprint is transmitted through the Bioscrypt, then the output light beam uniquely represents the coded number. By successfully decoding their Bioscrypt, the person also confirms who they claim to be. For purposes of the discussion below, it is important to note that the optical authentication device is a coherent system and uses the phase information in a finger pattern (complex domain) as a discriminating parameter. 1. "Picking up latent prints from door handles, etc." To perpetrate a masquerade using a latent fingerprint of a legitimate user is very difficult for the following reasons: * The system requires a three-dimensional reconstruction of the legitimate user's fingerprint because the height of the various fingerprint ridges can modify the two-dimensional complex optical image which is the input to the authentication device. There is little information in a two-dimensional latent print about the depth and the height of grooves and ridges of the actual fingerprint. * The three-dimensional reconstruction of the legitimate user's fingerprint from a latent print would also need to duplicate the approximate oil and moisture content of the skin, since this is one of the factors which affects (modulates) the two-dimensional image read by the system. Quantifying this information from a latent print is very difficult. Even if it were, the three-dimensional reconstruction would have to be made from a synthetic material which had the same oil and moisture properties as the legitimate user's skin. To use an oil/water based solution to place on the input scanning window would be useless since this would frustrate all of the light bouncing off the window and would convey little or no useful information to the optical system. * The reconstructed fingerprint would also need to be made from a material with approximately the same elastic properties as the legitimate user's finger skin. During enrollment, and subsequently on authentication attempts, the user slides a finger over the input scanning window. This action warps the skin and the corresponding fingerprint pattern based on the elastic properties of the skin. Within the population, warping can vary significantly based on age, dryness of skin, etc. and is thus another unique aspect of the individual's finger pattern. 2. "Severing the finger to obtain access." As already mentioned in some of the previous communications in this newsgroup, measuring the temperature, humidity, pulse rate and even heart rate to verify a live finger can be accomplished. One of the key factors, though, is after the finger is severed the elastic properties of the skin change rapidly and thereby would not warp in the same manner as a live finger pattern. This would make a cadaverous finger useless after a period of time. (Can't find subjects to do a double blind study though). 3. "Crooks would forcibly hold down the finger." By forcibly sliding an individual's finger against the biometric encryption authentication device (reading device), the string coded by the Bioscrypt can be extracted. The string coded by the individual's finger pattern Bioscrypt could then be used for a one-time access for whatever purposes the string was intended. However, assuming that the individual is freed, he can then use his finger pattern to code a completely different string to prevent repetitive access. The system is robust in that it is very easy to change PINs, encryption keys or computer pointers. It was suggested in some of the messages that a pass phrase be used in conjunction but, again, if an individual is holding your finger down forcibly, to extend that to pointing a gun to your head to divulge the pass phrase is not an extreme assumption. There is no perfect security system out there and I doubt one will ever be designed since it has to work with real human beings. I suggest that the goal is to provide privacy-enhancing technology that handles the majority of the infringement cases and that, for exceptional circumstances where extreme privacy and security must be guaranteed, we combine the biometrics (something you are) with the pass phrase (something you know) and a token (something you have). If the combination of those three doesn't do it, then at this stage of technological evolution, nothing will cut it. 4. "Losing or damaging a finger with the result of not being able to access the Bioscrypt and related files." One of the properties of optical processing is that composite patterns can be made and thereby used to make the Bioscrypt. Accordingly, more than one finger could be used or a finger and a proprietary pattern (which one keeps hidden away somewhere). Of course, there is a penalty. The more patterns one uses, the smaller the signal to noise ratio of the system. The system is currently designed to give signal to noise ratios in the order of 10 to 12 dB and thereby significant degradation can still occur which would allow comfortably two to three patterns to be superimposed in the same Bioscrypt. If you are interested, more information can be gained by accessing Mytec's web page at http://www.mytec.com. - - -- George J Tomko Mytec Technologies Inc. Toronto, Ontario - - ------------------------------ End of Computer Privacy Digest V8 #044 ****************************** - ------- End of Forwarded Message ------- End of Forwarded Message

1 0

Re: CWD: "Jacking in from the "One that Got Away" Port (fwd)
by Carl Ellison 17 Dec '03

17 Dec '03

>(By Brock Meeks / brock(a)well.com / Archived at http://www.cyberwerks.com/) > > > CyberWire Dispatch // Copyright (c) 1996 // > > Jacking in from the "One that Got Away" Port: > > Washington, DC -- President Clinton call your spooks, get FBI Director > Louis Freeh on the phone. Tell them to order in pizza. Bill, it's > going to be a long night. All your plans to hold the U.S. crypto > market hostage have just been fucked... and you didn't even get kissed. > > A virtual tactical nuke was hurled into the arcane subculture of > encryption technology Monday when RSA President Jim Bizdos revealed > that his company's Japanese subsidiary had developed a monster chipset > capable of scrambling voice and data real time with a so-called "key > length" of up to 1024 bits. Brock, you have probably heard by now -- this is wrong. The chip set was developed by a subsidiary of NTT called NEL. That's much worse, of course, than if it had been an RSA subsidiary. - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)cybercash.com http://www.clark.net/pub/cme | |CyberCash, Inc. http://www.cybercash.com/ | |207 Grindall Street PGP 2.6.2: 61E2DE7FCB9D7984E9C8048BA63221A2 | |Baltimore MD 21230-4103 T:(410) 727-4288 F:(410)727-4293 | +--------------------------------------------------------------------------+

1 0

Re: Where are the cryptographers going to come from?
by jim bell 17 Dec '03

17 Dec '03

At 03:22 PM 6/4/96 -0000, nelson(a)crynwr.com wrote: > The NSA believes that they >can and should discard any amount of benefits of crypto in exchange >for avoiding any harm of crypto. They are wrong. I think the truth is even more revealing. We can hypothesize that allowing widespread use of good crypto has many advantages and just a few disadvantages. However, those disadvantages may almost all accrue to government and its employees, and very few to ordinary citizens. This means that talking up the disadvantages of good encryption is doubly fraudulent, because the audience they should be trying to convince (ordinary folks) doesn't realize that the disadvantages generally don't apply to them. And of those few crimes against ordinary citizens where crypto might play a role, that role will almost always be to PREVENT the crime rather than allow it. Jim Bell jimbell(a)pacifier.com

1 0