December 2003 - cypherpunks-legacy

Thoughts on the NSA's correction to SHA
by schneier＠chinet.chinet.com 17 Dec '03

17 Dec '03

This is the fix to the Secure Hash Standard, NIST FIPS PUB 180: In Section 7 of FIPS 180 (page 9), the line which reads "b) For t=16 to 79 let Wt = Wt-3 XOR Wt-8 XOR Wt-14 XOR Wt-16." is to be replaced by "b) For t=16 to 79 let Wt = S1(Wt-3 XOR Wt-8 XOR Wt-14 XOR Wt-16)." where S1 is a left circular shift by one bit as defined in Section 3 of FIPS 180 (page 6): S1(X) = (X<<1) OR (X>>31). This is exactly one additional line in assembly language. The very fact that this correction had to made offers some insights into the National Security Agency. I believe that releasing DES to the public was the biggest cryptography mistake that NSA ever made. Consider the state of research in cryptology before DES. It was simplistic. It was haphazard. There was little interest. If any results of value were ever discovered, the NSA could squash them with a secrecy order. No one cared. Then, in the late 1970s, came DES. Suddenly there was a an algorithm to argue about, dissect, study, and learn from. A whole generation of cryptographers learned their craft from DES. Even today, we're still learning from DES. We're learning new techniques of cryptography and cryptanalysis. DES has transformed academic cryptology in ways the NSA never envisioned. The NSA will not make this mistake again. They will not release Skipjack or any other algorithm to the public, because that could galvanize another fifteen years of research in algorithm design and analysis. (Even so, I believe that Skipjack is similar in design to DES; the NSA realizes that Clipper chips will be reverse-engineered eventually.) When it came time to propose an algorithm for the SHS, the NSA chose not to use an algorithm from its own arsenal. Instead it chose to take an algorithm from academia, Ronald Rivest's MD4, and modify it to produce a 160-bit hash. While this approach did not compromise any of NSA's work, it also short circuited NSA's lengthy internal algorithm design and review process. The SHA was announced only two years after MD4. By contrast, NSA claims to have spent five years designing and analyzing their Skipjack algorithm, based on an additional seven years of design. There is no substitute for years of intense cryptanalysis, and the flaw in SHA illustrates that. >From owner-cypherpunks Tue Jun 21 20:47:03 1994

1 0

C Programmer Wanted for Cryptography Programming
by schneier＠chinet.chinet.com 17 Dec '03

17 Dec '03

I am looking for a good C programmer who is interested in doing some contract programming for me. Anyone interested? Bruce ************************************************************************** * Bruce Schneier * Counterpane Systems For a good prime, call 391581 * 2^216193 - 1 * schneier(a)chinet.com **************************************************************************

2 1

Unofficial Release
by dcosenza＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm pleased to announce the release of an unofficial version of PGP v2.6ui that allows for key generation up to 8176 bits, thanks are due to Tom Rollins for his diligence compiling the code and also to Mathew at Mantis Consultants in the UK for bringing us all up to 2.6ui. Said material, including source codes and an associated signature, can be found on ftp.netcom.com look in /pub/dcosenza for the following: pgp26ui.zip --> DOS release pgp26uisrc.zip --> source codes pgp26uisrc.sig --> sigfile for pgp26uisrc.zip tom.asc --> Tom's public key, you'll need this to check the sig This patch level is not endorsed or supported in any way shape or form by MIT, so usage of this program might put you in violation. A couple of notes: keys that are larger than 1264 bits will not be readable by previous versions of the software, so users who are interested in larger key lengths are encouraged to move up. Also, considering the enormous amount of time it takes to generate a 4096 bit key on a 486 (10 1/2 hours), an upper limit of 2048 or thereabouts is strongly recommended. Enjoy everybody and Ever forward, David - -- - --------------------------------------------------------------------------- David Cosenza dcosenza(a)netcom.com PGP 2.3a Public Key available by finger _or_ ftp.netcom.com:/pub/dcosenza PGP 2.3a Key fingerprint = BF 6C AA 44 C6 CA 13 3F 4A EC 0A 90 AE F3 74 6D "When encryption is outlawed, only outlaws will have encryption." -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCzAgUBLgevPSjdpAfJZzihAQFipATwk1jlksS571wBq3p2KySjjpj0PHOY8QJy yc5/S2BYn5ynY4XSp98skAUgWTblU0cT1uFu2JrukpdCqec5pCzCFVuErN2fn9zY MWUhqZKG74v1nTfNrlA+JjfiXd9LWjJJO8bBRfEyZ5ZBMsxALvU/N1j1rCV+KovI OjxtLDdbe5znloT/2GVwlPo2TQUi//cpfT9XNbVDUVCLG934nlw= =BQtC -----END PGP SIGNATURE-----

5 4

Re: something I've always wondered
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

> Does DES (or name your favorite encryption algorithm) produce as output > all possible cyphertexts of length L, given all possible conbinations of > keys and plaintexts of length L? Choose any cyphertext and a random key and decrypt the cyphertext with that key. Now you have a key and a plaintext which produce this cyphertext. Hadmut

1 0

sorry...
by Mikolaj Habryn 17 Dec '03

17 Dec '03

apologies for last message...

1 0

Re: Unofficial Release
by trollins＠debbie.telos.com 17 Dec '03

17 Dec '03

Perry says; >Yup, you have it on me. I guess it is important to lower the >possibility of someone cracking your key by brute force from lower >than the odds that all the oxygen atoms in the room you are in will >spontaneously end up on the wrong side of the room to lower than the >odds that all the oxygen atoms in the world will end up on the wrong >side of the planet. After all, we are fooling with lives. Perry, I don't know the probability of oxygen atoms moving to Japan or anywhere else. (who said Japan was the wrong side of the planet) And, I don't think that anyone will attack my keys by brute force. I do think that someone will be trying to crack messages on a random basis. That is by trying IDEA keys with otherwise idle cpu time on a large base of message trafic. (not my one little pathetic message). Given estimates that the IDEA algorithem is equivlent to a 3000-bit rsa key. I am bringing the rsa part of PGP up to par with the IDEA part of PGP. (just hitting on the weakest link first) So, call me paranoid or joe, I will strive to reach MY crypto comfort level. And that seems to be a higher level of crypto than you have. Who cares ! Use whatever crypto you want. tom

2 1

Re: HOW TO MUTATE AND TAKE OVER THE WORLD
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

> Date: Tue, 21 Jun 1994 12:57:11 -0700 > From: Judith Milhon <stjude(a)well.sf.ca.us> > > I, Judith Milhon, am not a fink. I was at the first meating of this > weird coalescence. I even thought up the name "cypherpunk." I write I wasn't at the first meeting. I wasn't the one who coined the term "cypherpunk". I heard that Andy Hawks did. Cat Shoe

1 0

PGP Comments and Questions.
by trollins＠debbie.telos.com 17 Dec '03

17 Dec '03

Hey, Got some comments about the future of PGP. I would like to compair PGP with DOS. It has gotten a large following and that is good. It has it's limitations and that is bad. Like DOS, expanding it's functions seems to be trouble. Trouble from the tech side and from government. I believe that we should lay a framework so that people around the world can modify and enhance various parts of PGP and not get in each others way. After all, how much can 1 or 2 or 3 or 4 people do vs thousands on the net. Also if the code is modular, people in the US can work on sections that do not contain the crypto engines. Bulk crypto engines could be replaced and not get in the way of the Public key stuff. So, now for some questions.... As I understand the Gnu CopyLeft. People can make changes and pass them on with the source code and NOT step on anyone's toes. Why then should there be an official release by a small group of people that still have bugs in the code after N years. An official framework which will allow for expansion and change is in order. Is Mathew in the UK a named remailer for Phil Z? (just kidding) How fine do you have to divide the crypto code before it is not considered crypto code anylonger. (for US ITAR regs) How do the French get around the anti crypto laws? I want to know before those laws get enacted here in the US.

1 0

Re: Archives?
by ghio＠cmu.edu 17 Dec '03

17 Dec '03

Roger Bryner <bryner(a)atlas.chem.utah.edu> wrote: > Hello, > Are there archives for this mailing list? ftp cs.cmu.edu /afs/andrew.cmu.edu/usr12/mg5n/public/cypherpunks It's a symlink to CMU's internal news directory. You will need to get the file cypherpunks.index to figure out the filenames. The file also contains some binary data for the local news software here, you will have to just ignore that. Not exactly the easiest way to look things up, but it works. Messages are kept one month.

2 1

Re: Need advice on starting to make PGP library
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

Too late! It's been done, by Pr0duct Cypher... G (Some of us are even using it...)

1 0

INFORMATION WARFARE
by Brian D Williams 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- For those who asked: INFORMATION WARFARE Chaos on the electronic Superhighway Winn Schwartau Thunder's Mouth Press ISBN 1-56025-080-1 I should add that at least one member of this list wrote and doesn't share my opinion of it. Let the buyer beware! I am still enjoying it immensely! Brian Williams Extropian Cypherpatriot "Cryptocosmology: Sufficently advanced communication is indistinguishable from noise." --Steve Witham "Have you ever had your phones tapped by the government? YOU WILL and the company that'll bring it to you.... AT&T" --James Speth -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLghCANCcBnAsu2t1AQHkpQP+KQ7lnUMJJNQsdW9pYZYTLVNLXHQDq9L5 ruX+zearfvplpwtke/0YE+8X6dwuPCtHalzmBfo921euX9mN/eaSOGhfmagQ80wY U6G/AT2ox1s5XbvtRHoqA9/glAiMZrRH+hXNNmEMXMu0GJSdDIMWDKXTglyiXlEt Uc20JPC+Cng= =BbYI -----END PGP SIGNATURE-----

1 0

Re: Unofficial Release
by trollins＠debbie.telos.com 17 Dec '03

17 Dec '03

Perry @ insi.com says: >Way overkill. Remember that 2000 is not just twice as hard as 1000 -- >even breakthroughs that improved factoring speed by factors of >thousands couldn't break 2000 bit keys any century soon, if ever. I'd >worry more about my key management -- before putting in even the >effort to crack a 1500 bit key they are likely to just listen in on >the emmissions from your keyboard and monitor. Ahhhh, It is nice to know that people won't even TRY to crack big keys. Cracking, you know, is a lot like the lotto. You MIGHT guess the correct key on the first TRY. But, if you don't TRY, then you won't crack the key. "Gotta play to win" -tom

3 2

Groups Hail New Bill For
by Duncan Frissell 17 Dec '03

17 Dec '03

To: cypherpunks(a)toad.com C >This is a press release put out by People for the American Way and C >the Media Access Project last week. C > C >Senate Communications Subcommittee Chairman Inouye's bill guarantees C >access on the "superhighway" for non-commercial and governmental C >uses. "Without this protection, we may not get anything besides home C >shopping and movies on demand," said Leslie Harris, Director of Public C >Policy for the People For the American Way Action Fund (PFAWAF). C >"We hope -- and expect -- that some day the new technologies C >will provide so much capacity at such low prices that there will be C >no >need to reserve space for public use. The bill directs the Federal C >Communications Commission to phase out the `public right of way' if C >and when that happens." But, he added, "It is critical that local C >government and non-profit groups have access to the new technologies C >right away. What complete and utter garbage. With monthly access costs in the $20 range and an incredibly diverse marketplace under construction without "public interest" power-mad fascists involved in it, such whining shows nothing more than their view of the gullibility of the public. All networking proposals involve two-way networks and private voice and data systems that anyone who cares to can use to communicate with anyone who cares to. Any "public interest group" that cares to (and many have) can put aside its tin cup and get online. If 12-year-olds can do it... DCF "Whether or not the residents of that fetid swamp between Virginia and Maryland try to help us or hinder us, we'll build Market Earth on the nets. And there's not a damned thing on God's good green earth that they can do about it." --- WinQwk 2.0b#1165

1 0

Re: e$: Geodesic Securities Markets
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Perry Metzger says, >Its fairly easy to envision a system that directly >matches orders for shares in IBM. Trying to match up buyers and >sellers of swaps might not be that easy. Agreed. I do want to talk my buddy about derivatives, however, because he seems to think that there are ways that e$ protocols could help. Of course, he didn't tell me in any way I could understand... I think it had to do with the authentication of e$ instruments, proving you are who you say you are and you have what you say you have. A WAG: Maybe zero-knowlege stuff has something to do with this? However, like you say it's easy to see how IBM could issue its own shares directly into a geodesic market; maybe even a company could do it's own IPO, with the right rules... When you think about it that way, an investment banker could "sign" an issue (for a fee...), to vouch for it. After all, using that kind of "protocol" on large well established companies is what kept Morgan partners in wood walls and leather wing-back chairs from the time of Glass-Stegall all the way up until the early 70's. In the IPO markets, that's what Hambrecht & Quist does (did? ;-)). The technology changes, but the practice would be the same in a geodesic market. I mean, there's the risk of underwriting the security, but that's pretty much nonexistant these days anyway, and with some modification of the shelf registration idea, a company could "underwrite" it's own offering. Of course when you're underwriting yourself, the term "underwriting" ceases to have meaning, really. >In the foreign exchange market, for instance, most trading >is done on blocks of millions to hundreds of millions of dollars worth >of currency. In the current scheme of things people will only deal >with entities that they know because fails are devistating. It is >possible for third parties to guarantee credit to open up markets, but >they will expect to be paid for this. You can't get rid of the banks >-- someone has to guarantee that you have the money on hand. It seems to me that the issue of capital concentration could be taken care of by the mutual fund analog I used before, the portfolio manager in Marblehead with an e-cash / fund "certificate" exchanger. The restriction of transaction size in the markets is still there, though it might be that the economies of scale would diminish a bit, reducing that required transaction size... The whole idea of avoiding trusted entities is what the DigiCash algorithm is about, right? e$ itself in proper form is proof it is what it says it is. Just like it's possible to spot counterfeit money. It's a pointer to some other stuff, but it can be moved around much better than the stuff it's denominated in, or the market wouldn't create that particular form of e$. >...no matter what you hold, be it dollars, >shares of IBM, or futures contracts for dried silkworm cocoons (a >perfectly real commodity, by the way) you need a bank to hold the >account and guarantee the existance of the thing being held, be it a >figment of the computer's memory or a thing backed by a bar of gold. >The banks will expect to be paid for this service. Try imagining a >digital cash algorithm that DOESN'T involve a bank, and you will >swiftly see that there is a small problem involved... I'm not entirely sure we disagree, Perry. e$ protocols are just pointers (with teeth) to the actual stuff being traded. e$ (cash, mutual fund shares, cocoon futures) has to be issued by somebody and it has to be convertable into something else to be of any use at all. To take one business model that we've pretty much killed, it's easy to see how someone could plug the ATM network into one end of a DigiCash server, and pay out DigiCash to customers on the internet, using encrypted card swipes and PIN numbers for authorization. Banks are necessary in that scenario, because the money the digicash was issued for has to be held in a bank by the issuer, whoever that may be ;-)... Or maybe the issuer buys t-bills (safely) and keeps the interest. Maybe the issuer charges a nominal transaction fee for the conversion from one side of the gateway to another. The money doesn't just disappear or get created. Only governments (or lending institutions) get to do that (both ways, in the case of Uncle Sam). > >This is not to say that transaction costs can't be radically reduced, >and the role of intermediation in fully fungible goods reduced. >However, transaction costs will not go to zero, and banks will not >disappear. Yes. There will still be a need for *some* demand deposits. There will be a need for *some* brokerage accounts. The timescale is certainly nebulous here. But I think that like most successful new technology a superset of the old capital market structure gets created. We still walk, but we fly too. Cheers, Bob ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

Re: Thoughts on the NSA's correction to SHA
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

>The very fact that this correction had to made offers some >insights into the National Security Agency. > >I believe that releasing DES to the public was the biggest >cryptography mistake that NSA ever made. Consider the state of >research in cryptology before DES. It was simplistic. It was >haphazard. There was little interest. If any results of value >were ever discovered, the NSA could squash them with a secrecy >order. No one cared. > There is one problem with this analysis: IBM created DES. Not the NSA. Sure the NSA could have asked them to keep it hidden, but the NSA was also going to IBM and warning them about Russians evesdropping on IBMs networks. Everyone realized it was time for public cryptography. Especially IBM. It is not clear that a secrecy order would have worked. This is not to say that your analysis is wrong. They classified the design procedures which was their attempt at a compromise. IBM couldn't publish the details of how to make a good algorithm, but they could release the details of the standard.

1 0

Re: something I've always wondered
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> Jim Miller says: > > Does DES (or name your favorite encryption algorithm) produce as output > > all possible cyphertexts of length L, given all possible conbinations of > > keys and plaintexts of length L? As Perry points out, for any key, cycling through the 2**64 inputs will produce all 2**64 outputs. On the other hand, there are (2**64)! mappings of the set of inputs to the set of outputs, and DES only uses 2**56 of those mappings, so there are probably values of P and C for which there is no key K such that C = DES(P,K).

1 0

Re: Tracking Mobile Nodes
by kentborg＠world.std.com 17 Dec '03

17 Dec '03

Triangulation works great for tracking any transmitter--but it is expensive. Cellular systems, by their nature, know which cell you are in. Given that they already know, the service provider could log all movement pretty easily. A simple matter of programming--programming which is possibly already done, judging from the Simpson case. -kb -- Kent Borg +1 (617) 776-6899 kentborg(a)world.std.com kentborg(a)aol.com Proud to claim 28:15 hours of TV viewing so far in 1994! ^ note, number that did not increment after the Big Chase.

1 0

Re: e$: Geodesic Securities Markets
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Forgive me for *ever* doubting you... Perry Metzger says, >Actually, even in the case of securities largely settled by book >entry, DTC still holds physical certificates. That is not, however, >the point. I know It's Not the Point, but I got curious anyway ;-). After all, I haven't been near a brokerage cage in 10 years (NIDS was big stuff back then), and I thought maybe it's time to learn how the world really works these days... So I called DTC, the Depository Trust Corporation, on Water St. in Manhattan, the Mother of all Securities Clearinghouses. After about five transfers, I talked to a very nice lady in underwriting. She said they really *do* have bales of securities in a vault, and that they have a program called FAST, where securities are stored in banks also. However, she said that a growing number of securities are issued book entry only. Issues of up to $150 million can be issued on a *single* certificate. That certificate is held just like the other securities issues, in a vault. She said that like par value, physical delivery is becoming more and more obsolete. That makes sense. Once a certificate is put into the vault at DTC, it usually never leaves. It might as well not be there at all. Changes in ownership are reflected by offseting book entries. Ah, the wonders of double-entry bookeeping. Oddly enough, an e$ certification scheme reverses that paradigm. The book entries disapear, the certificates proliferate, and the clearinghouse becomes a referee, "blessing" the trade. Cheers, Bob ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

3 2

Paging Eric Hughes
by Eric_Weaver＠avtc.sel.sony.com 17 Dec '03

17 Dec '03

[apologies to all others; couldn't reach him at any addresses I have seen] Mr. H., Please write me. Thanks.

1 0

Re: e$: Geodesic Securities Markets
by Perry E. Metzger 17 Dec '03

17 Dec '03

Robert Hettinga says: > Perry Metzger says, > > After about five transfers, I talked to a very nice lady in underwriting. > She said they really *do* have bales of securities in a vault, and that > they have a program called FAST, where securities are stored in banks also. > However, she said that a growing number of securities are issued book > entry only. Issues of up to $150 million can be issued on a *single* > certificate. That certificate is held just like the other securities > issues, in a vault. Yup. The certificate is held in street name -- the name such certificates are held in is "Ceed & Co." for obscure reasons I've never been able to fathom. > She said that like par value, physical delivery is becoming more and more > obsolete. That is largely the case for institutional transactions. Lots of equities are still physically delivered, and in fact all equities are still physically deliverable. (Many holders still request physical delivery, and there are many instances in which physical delivery is still in fact necessary -- for instance, when you purchase unregistered securities in a private placement. I still have bad memories about trying to get the incompetant 144 department at my broker to deal with some previously unregistered certificates.) There are no US govvies that are physically deliverable any more, although of course the older ones still are. > That makes sense. Once a certificate is put into the vault at > DTC, it usually never leaves. It might as well not be there at all. However, it is still there, fulfilling technical legal requirements, and the vaults on Long Island are heavily guarded in spite of the fact that the certificates are non transferable. > Oddly enough, an e$ certification scheme reverses that paradigm. The book > entries disapear, the certificates proliferate, and the clearinghouse > becomes a referee, "blessing" the trade. Its not really practical to do this with things that aren't bearer instruments. You need to know the beneficial owner of virtually all securities issued in the U.S., and even if we had a completely free market we would still likely not have bearer certificates for most corporate stocks, since such certificates are hard to track and one wants to be able to find stockholders for corporate governance reasons -- when stockholder meetings are called for example. Perry

1 0

Thanks!
by dwomack＠runner.utsa.edu 17 Dec '03

17 Dec '03

First, thanks to everyone for some *_super_* guidance on decrypting weak cyphers...I have some (enjoyable) homework to do now! Secondly, I seem to have come across a minor bug in the majordomo software; and I thought others might be having a similar problem... I subscribed...'domo accepted...then I got duplicate mailings. I did a 'who', and found I was listed under 2 slightly different, equally valid, addressess. I canceled one, and it required manual approval, which came (apparently) quickly...and BOTH addresses got taken off! Anyway, after fiddling with it a bit, I'm getting the one copy of each posting I wanted...but, I wonder if somehow the duplicate address problem might be related to the crash problem? Regards, Dave

2 1

Re: Unofficial Release
by trollins＠debbie.telos.com 17 Dec '03

17 Dec '03

Perry(a)imsi.com says: >Tom Rollins says: >> Ahhhh, It is nice to know that people won't even TRY to crack >> big keys. Cracking, you know, is a lot like the lotto. You >> MIGHT guess the correct key on the first TRY. But, if you >> don't TRY, then you won't crack the key. >> >> "Gotta play to win" > >It is all a question of economics. Its one thing if your idle try has >one in 10^6 chance of working, but if its one in 10^70 or something >like that the attempt is pretty much pointless -- you are more likely >to have a giant sack of gold hit you on the head. Even spending a >penny on cracking something that way is uneconomical. Our govenment has NEVER been very economical! >They could spend a lot less effort simply >getting your key via "practical cryptanalysis". True, a good hose or pretty woman in the sack would loosen me up. Except for my old key that hangs out on the pgp-key-servers. Too bad, Lost that secret key... >There is therefore no point in using a cryptosystem which would cost >the enemy hundreds of billions of dollars to try to attack and then >type in your key on a machine who's keystrokes can be monitored using >$3000 in equipment. Which way would YOU try to get the keys, eh? Say, that sounds like a good deal ! Where could I buy that. Wow, hang out at Charles Schwab, or Meryll Lynch and get account info... >Unless you are already doing all your encryption in a Faraday cage, >I'd say that there is no conceivable point in using anything over a >2000 bit key -- indeed, there is probably no point in using such a key >even if you are doing all your encryption in a Faraday cage. Well, I work for C3-Telos and we make several lines of ruggedized portable tempest capable equipment (like the one I am typing on). >The benefit is minimal, and the cost, in terms of dramatically slowed >performance, is very high. Using an 8000 bit key is like claiming you >are stronger than the enemy because whereas he only has enough nuclear >weapons to vaporize your city 15 times over you have enough to >vaporize his 90 times over. I don't need an 8000 bit key, but, I don't want the pgp-key-server barfing on a 4096 bit key that I feel I need. How can you put a price on someones life. You don't know there situation. (think about OJ and fooling around with his wife) Tim May says: >If this was tongue in cheek, I missed it. Nobody in their right mind >will try a brute force attack on a 1024-bit key, let alone a 1200- or >2000-bit key. Unless there are flaws in PGP and/or RSA we haven't >heard about. So you or I won't try the crack. But then there are all those people who are being paid from tax dollars to do nothing else but crack. And all those high priced computers paid for with tax dollars to do the cracking with. Do you think they will just close up shop and sell off the equipment? Yes, there are flaws. (some call them design compromises) Why known text in the Idea data area? Why CFB mode vs CBC mode? Peter Gutman's SFS documentation makes reference to a class of weak IDEA keys. What are they? And what do they do? >As for lotto, simple calculations tell anyone that the best way to win >is not to play. The return _at best_ is 30 or 40 cents on the >dollar, with the rest going to all the various programs the lotto is >supposed to support. The more you play, the more you lose. I don't advocate that you play the lotto. I am pointing out a fact that the lotto people use/say/claim to get people to play their game and thus give them money. >(I think gambling is a perfectly fine "tax on stupidity," collecting >money from the gullible. However, banning gambling by private citizens >while having the government run their own casinos and lotteries is >crummy. It's government at its worst.) I agree almost 100%

4 6

Re: MAIL: Using "nobody"
by Vincent.Cate＠FURMINT.NECTAR.CS.CMU.EDU 17 Dec '03

17 Dec '03

Karl Lui Barrus: >Using "nobody" as a remailer is pretty interesting ;) the only problem >being you have to be root or be allowed to choose your own username. Yes, you need to be root. >I don't understand: why can't the somebody do a telnet to port 25 and >"vrfy nobody" to see if it points to /dev/null? Or find out if mail >is piped to a script? When I do this to different machines where "nobody" is aliased to different things, I always get "Nice address". But even if there was some way to tell by accessing something on my machine, I can make my machine lie. Really. Do I need to get my machine to lie for me? Can anyone detect any difference between the "nobody"s on cs.cmu.edu, furmint.nectar.cs.cmu.edu, and alex.sp.cs.cmu.edu? >> So it would be nice if sites with remailers would set the "nobody" >> alias to point to their remailer to start this convention. Assuming > >Again, a pretty good suggestion, but I don't think most remailer >operators can do this even if they wanted to. I know I couldn't have >with remailers I've run in the past. It does not need to be all of them to work. Even if only a few places do this, it is still good cover. If there is some mail going to "nobody" on my machine, maybe I have some "black-net" operation running off of my machine, or maybe mail is all getting dropped in the bit bucket like "nobody" on standard machines. From outside you can not be sure. It could just be L. D. trying to make it look like I am up to something. If there was a witch hunt for encryption use, someone might send lots of encrypted mail to someplace like nobody(a)att.att.com, and the fierce witch hunters might try to burn someone who was not a true witch. -- Vince

1 0

RSA Key Size & QP
by catalyst-remailer＠netcom.com 17 Dec '03

17 Dec '03

A wild card here is the recent work in quantum computing, done at AT&T and reported in a recent post by Pal Vitanyi. With a specialized quantum computer (not clear yet whether one could economically built it, but it's theoretically possible) one can factor in polynomial time (computational class "QP", or something like that). If cycles on such a computer would be, say, 1,000 times more expensive than on your PC, then cracking the key would be 1,000*O(keysize^c) more expensive than generating it, not 1,000*O(c^keysize). Having a keysize of, say, 8 kbits instead of 1 kbit in this circumstance is not at all overkill; it makes a practical economic difference. Of course if your info is _very_ valuable and the polynomial is of small degree, even a large key size won't help much. If such a device was built, we'd want to switch to a cryptosystem whose inverse is not in QP; but some of our current communications would be compromised. If a QP machine is with even small probability feasible within the next few decades (or whatever your timeline of concern is), it makes sense to use larger key sizes.

5 6

Re: e$: Geodesic Securities Markets
by rah＠shipwright.com 17 Dec '03

17 Dec '03

>That is largely the case for institutional transactions. Lots of >equities are still physically delivered, and in fact all equities are >still physically deliverable. ^^^^^^^^^^^^ Except those equities designated "Book entry only" issues, of course ;-). >> That makes sense. Once a certificate is put into the vault at >> DTC, it usually never leaves. It might as well not be there at all. > >However, it is still there, and the vaults on Long Island are heavily >guarded in spite of the fact that the certificates are non >transferable. I'm just wondering why not make them e$ certificates someday... > >> Oddly enough, an e$ certification scheme reverses that paradigm. The book >> entries disapear, the certificates proliferate, and the clearinghouse >> becomes a referee, "blessing" the trade. > >Its not really practical to do this with things that aren't bearer >instruments. Ain't it a bitch...:-) >You need to know the beneficial owner of virtually all >securities issued in the U.S., and even if we had a completely free >market we would still likely not have bearer certificates for most >corporate stocks, since such certificates are hard to track and one >wants to be able to find stockholders for corporate governance >reasons -- when stockholder meetings are called for example. I'm *really* *not* making this up as I go along, but... If a clearinghouse is "blessing" the trade they could still perform their function(??) of notifying the corporation / issuer of a change in it's ownership. The "pointers" to the security just get swapped around... Uncle Sam still gets to know who owns what. However, it's possible under this scheme to have anonymous ownership, too. If it were legal, of course... While this thread is starting to look more like crypto-enabled and less like actual crypto, I'm still thrashing this stuff around on my own. My crew figures there's some business in here somewhere. If anyone wants to yak about it with me off-line, let me know.... *I'm* having fun... Cheers, Bob ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

2 1