December 2003 - cypherpunks-legacy

Re: www for cypherpunks' collection
by Vincent.Cate＠FURMINT.NECTAR.CS.CMU.EDU 17 Dec '03

17 Dec '03

I exchanged email with Eric Johnson about his database a few days ago. He has had some sort of problem and does not have the time to fix it, so his database is down till further notice. This is too bad, as it was a fantastic resource. Sometime back someone mentioned that they now had their own workstation on the net and were willing to do something, like make it available for the Cyperpunk Electronic Book idea. I think it would be really good to have a permanent archive site to make all of the cypherpunk mail available via FTP. If they, or someone else, have the disk space to do this, it would be a very good thing. Along with making the mail directly available, a permanent archive would let mosaic pages reference any mail. -- Vince ftp://furmint.nectar.cs.cmu.edu/security/README.html

1 0

TEMPEST
by Sandy Sandfort 17 Dec '03

17 Dec '03

C'punks, I seem to recall a thread on the origin of the term "tempest" with regard to electromagnetic emissions. Several people thought it was an acronym and various phrases were offered. I found a story I don't think was mentioned. It's in an article from /Full Disclosure/, #26. The article, "Hi-Tech Fraud," is by James E. Carter of Bank Security. The relevant part says: ... Is there a real danger because of EME? Well, I have known about EME for over thirty years and back then our government was so concerned the subject was classified. Our government gave EME the name "Tempest." When this issue was brought up before a congressional committee, the statement was made, "it sounds like a tempest in a teapot." So thereafter the name Tempest was adopted, so the story goes. Sounds plausible. S a n d y

1 0

Re: Traceless Calling
by frissell＠panix.com 17 Dec '03

17 Dec '03

At 01:49 PM 7/16/94 -0800, kevin(a)beach.com wrote: >For anyone interested in private communications: > >Access codes are available in blocks of 100 minutes for $75. Volume discounts >are available. FYI, another company is providing this same service at 90 >minutes for $99. > Or you can walk up to any newsstand or drug store and buy a phone card from someone else for cash for 30-60 cents/minute. DCF

1 0

Re: Card Playing Protocol
by kentborg＠world.std.com 17 Dec '03

17 Dec '03

tcmay(a)netcom.com writes of why projects (like my proposal) never get finished. His item #3: >No group of co-workers to chat with, to reignite interest, to exert >peer pressure to finish. I'm counting on Cypherpunks to play that role! -kb, the Kent who is pretty excited about Shoemaker-Levy 9 too. -- Kent Borg +1 (617) 776-6899 kentborg(a)world.std.com kentborg(a)aol.com Proud to claim 35:00 hours of TV viewing so far in 1994!

2 1

Re: Card Playing Protocol?
by kentborg＠world.std.com 17 Dec '03

17 Dec '03

hughes(a)ah.com wrote some interesting stuff: >Duplicate games won't work Damn! People are paying attention. It was an off-hand remark. Any bells and whistles along those lines are certainly banned from any early version. >There is a non-crypto issue of how one finds playing partners without >a central server. My mind wandered to that very point this very morning. The simplist way to find players is the same we currently find email addresses: the hard way. Type in the addresses of the other players. (Assuming the software is already running on those nodes, those players would not have to retype the other addresses, accepting the invitation to play would be more like a single "click".) I think anything more elaborate along these lines is a candidate for banning from 1.0. (One problem is that the "I'm looking for a game."-problem is at least as big and interesting as building a deck of cards.) >I would strongly suggest the separation of the communications, user >presentation, and decision parts of the client software. And that is one of the wonderful sort of engineering problems I love: keeping the different parts clear of each other's private parts yet still considerate of their desires and needs. >client software My instinct is for a peer-to-peer design. Yes, they will serve each other cards, etc., but I would like to avoid the user confusion of having two different sorts of software needed. (At a comms protocol level there might always be a single server per game--I don't know yet--but I would like to hide that sort of stuff from users.) -kb, the Kent who will be driving to Pasadena early in the morning, but not to watch soccer. -- Kent Borg +1 (617) 776-6899 kentborg(a)world.std.com kentborg(a)aol.com Proud to claim 35:00 hours of TV viewing so far in 1994!

3 2

Re: Card Playing Protocol
by kentborg＠world.std.com 17 Dec '03

17 Dec '03

hughes(a)ah.com >Time to read crypto. HEY! I've read Schneier (if that is what you meant). Eric also went into various details of how to reveal cards to individuals (my hand) and all players (the current trick), etc.--details I am not prepared to comment on yet. I have some reading to do first! I also need to review (learn) a collection of card games to appreciate their requirements, whether there is a tractable common set of operations. (Ironic to have a virtual non-card player consider this choice of project.) Crypto is not the only thing I need to read. -kb -- Kent Borg +1 (617) 776-6899 kentborg(a)world.std.com kentborg(a)aol.com Proud to claim 35:00 hours of TV viewing so far in 1994!

3 2

Re: Hashed hash
by kentborg＠world.std.com 17 Dec '03

17 Dec '03

Ben.Goren(a)asu.edu foolishly says: >I'm planning on implementing the "cryptographic protection of databases" And wonders about the hash being too fast to compute, that a brute-force traversal of the database would be too easy. The idea is then to hash a bunch of times to burn CPU cycles, but what if the hash is a group, extra hashing could be reversed quickly. (Did I get that right?) Well, as the LOUD proponent of making secret keys s-l-o-w-e-r to decrypt, I have thought about this a bit, and have a suggestion: Hash once, then do a zillion encryptions of the hash with a non-group cypher like DES. Another idea (something I have thought less about): send every legit user of the database a custom version with the parts encrypted with that user's public key--and do the trick mailing list companies use, scatter some dummy info in the list. When a dummy (not just me) gets a junk mailing, go beat up on the user who's copy had to have supplied the junk. Not perfect: combinations of dummies are needed in case the junk mailer cracks multiple copies (multiple work) and then trys to sift unique dummies that way. Another problem: it is expensive to monitor the dummies. (1990's biz opportunity?, the monitoring of data that no one is supposed to have.) -kb, the Kent who doesn't want to be thought of as only a card player -- Kent Borg +1 (617) 776-6899 kentborg(a)world.std.com kentborg(a)aol.com Proud to claim 35:00 hours of TV viewing so far in 1994!

2 1

No Subject
by Anonymous 17 Dec '03

17 Dec '03

Well, keeping in the spirit of the original message, I will reply to it anonymously. Besides, what I am going to say probably won't be popular. >i'm glad ghio caught that message in his mailbox through careful screening >so that it wouldn't go out to the newsgroups. I always thought the >remailers were automated, but I guess in most case the operators are >screening all the stuff. this is good, because we don't need any more >Detweiller junk out there (amazing how peaceful things are without him!!!) >too bad if the message was forged, because it would be LOTS of fun to >EXPOSE THE BASTARD!!! (insert evil smirk here) Did anyone else shudder when they read this? All I can say is that I am *glad* this person does not run a remailer (although, if I were really paranoid, I might speculate that he does!). As Tim May and Carl Kadie have pointed out on numerous occasions, by systematically filtering mail the operator tends to lose the protection of the legal status of "common carrier". I don't know if a remailer operator would be classified as such but others have proposed that idea. But just from a philosophical view, I think any remailer operators hunting for Detweiler-grams in all their incoming mail are employing a procedure that is antithetical to their entire commitment. Isn't it just a *teensy* bit hypocritical? Is this how you are going to build cyberspatial-wide confidence in the use of your remailers for their dependability and secrecy? Isn't it just a *teensy* bit hypocritical to yell to the world that ANONYMITY IS THE RIGHT OF MAN and have a little whisper in small print, "unless you are an official enemy of the cypherpunks"? Is it just me, or is this Detweiler thing blown *way* out of proportion? He seems like a harmless crackpot occupying himself by banging on a keyboard. In fact, being consistently at the tmp(a)netcom.com even helps to filter him. Cypherpunks, we believe in the philosophy that we are being oppressed by numerous forces that seek to deprive us of our privacy-- big business, the government, police, etc. But how can we claim to uphold the philosophy of freedom of speech and privacy looking at our relationship with Detweiler? Sometimes I think he was sent by God to test us. What is it in the human psyche, rooted deep in our subconscious, that pushes us to *vengeance* against those who offend us? That pushes us to want to *expose* them (as the person said above, "EXPOSE THE BASTARD!!!"). Do we have any consistent beliefs? How is that we, who are dedicated to privacy, broadcast to everyone listening in a clear voice, that "freedom of speech does not belong to people who offend us"? There is a saying, "who will guard the guardians themselves"? Who will ensure that those who advocate anonymity actually follow through, if they don't? I personally advocate that the Detweiler-Detritus be allowed through the remailers unaltered as a blaring advertisement to the entire world of cyberspace that yes, we believe that anonymity is *sacred*, even more so than we believe that Detweiler is the AntiChrist of the Cypherpunks. "I detest what you say, but I will defend to my death your right to say it." --Voltaire "Freedom of speech does not end at the point that it offends; to the contrary, that is where it begins" --Supreme Court justice (paraphrase) That's all I have to say.

5 4

New Money design announced
by nym＠netcom.com 17 Dec '03

17 Dec '03

I think this came from a Fidonet channel. an interesting topic: how will this affect the value of US cash? i.e. will it affect the value of the dollar worldwide? often when countries are facing economic trouble they change their currency. **** Conf. : 0008 - FINANCIAL WASHINGTON (AP) -- Move over Ben Franklin, tell Andrew Jackson the news: The portraits on the nation's paper money likely will be enlarged and moved off-center as part of the first major makeover in 65 years. ``Our plan ... is a pre-emptive step to protect U.S. currency from high-tech counterfeiting,'' Treasury Secretary Lloyd Bentsen said in announcing the redesign Wednesday. His department plans to have a final design ready sometime in 1995 and begin circulating new bills about a year later, starting with the most popular target for counterfeiters, $100 notes. Nothing has been decided for certain, but Treasury officials gave the House Banking Committee a rundown Wednesday of what was likely. The enlarged portraits -- Franklin on the $100, Ulysses Grant on the $50, Jackson on the $20, Alexander Hamilton on the $10, Abraham Lincoln on the $5 and George Washington on the $1 -- will allow for more detailed engraving of what is the most recognizable feature on a bill. The $2 bill, with Thomas Jefferson, is not being redesigned. And, moving the portraits will make room for a watermark in the form of a smaller version of the portrait, visible only when a bill is held to the light. Other likely changes include: -- Color-shifting ink that may, for instance, appear green when viewed straight on and gold from an angle. -- Computer-designed ``interactive'' patterns that turn wavy when illicitly copied. -- Iridescent planchettes in bills' paper. These are colored discs only a few millimeters wide that reflect light. -- Micro-printing and machine-detectable threads or fibers in the paper. The last major change in U.S. currency came in 1929, when bills were reduced in size and given a uniform look. Congress added the words ``In God We Trust'' in 1957. In 1990, several small changes made it more difficult to counterfeit with modern color photocopiers. They included adding a microscopic line of type and a polyester thread visible only when a bill is held to a light. Most lawmakers applauded the latest modifications, saying they were long overdue. ``We must protect the dollar's standing as the world's foremost currency. Our financial future depends upon it,'' said the committee chairman, Rep. Henry B. Gonzalez, D-Texas. But others warned against too radical a redesign, saying it would send a message of instability at a time when the value of the dollar is being battered on world currency markets. Peter H. Daly, director of the Bureau of Engraving and Printing, said the bills' traditional look will be maintained as much as possible. The paper will feel the same and the size of notes won't change. And the same engraving style will be used for portraits, borders, numbers and the historic scenes on bills' back. Bentsen stressed that old money will continue as legal tender. ``The redesigned currency will be introduced over a period of years and no U.S. currency will be demonetized, devalued or recalled,'' he said. And U.S. Treasurer Mary Ellen Withrow promised a worldwide educational campaign to encourage public acceptance of the new design. About $357 billion of U.S. paper currency is in circulation, more than 60 percent of it abroad. In fact, in some countries with troubled economies it serves as the principal medium of exchange. According to the Secret Service, counterfeiting abroad now far outweighs domestic counterfeiting. Last year, $120 million in phony bills were seized overseas, compared with $44 million domestically, said Secret Service Deputy Director Guy P. Caputo. Republican Reps. Jim Leach of Iowa and Bill McCollum of Florida suggested the administration may be minimizing the severity of the problem. Leach said a Middle Eastern country, which he did not name, reportedly has developed the capacity to counterfeit large quantities of $100 notes. He was apparently referring to trade press reports that Iran was distributing counterfeit bills through Lebanon. But Bentsen stressed that the changes were being made in anticipation of future problems and not in response to any current counterfeiting crisis.

2 1

Re: Leaving the Country
by frissell＠panix.com 17 Dec '03

17 Dec '03

At 06:27 PM 7/17/94 -0400, Perry E. Metzger wrote: >The same Karl Hess (sadly departed on the same day as Tricky Dick >Nixon) who wrote for Goldwater: "Extremism in the defense of liberty >is no vice, moderation no virtue" (or something like that; I can't >remember the exact words). Hess was an anarchist, and open about it. "Extremism in the defense of liberty is no vice. Moderation in the search for justice is no virtue." Delivered at the '64 Republican National Convention at the Cow Palace in San Francisco (actually Daly City), California. It was ascribed to Karl but he said he didn't actually write it. Au H2O DCF "Ted, I'm pregnant." "Don't worry Mary Jo. We'll cross that bridge when we come to it. -Still the best Chappaquiddick joke. July 18, 1969

1 0

Re: Hashed hash (and Kent's games)
by Ben.Goren＠asu.edu 17 Dec '03

17 Dec '03

At 12:19 AM 7/17/94, Kent Borg wrote: >Ben.Goren(a)asu.edu foolishly says: >>I'm planning on implementing the "cryptographic protection of databases" > >And wonders about the hash being too fast to compute, that a >brute-force traversal of the database would be too easy. The idea is >then to hash a bunch of times to burn CPU cycles, but what if the hash >is a group, extra hashing could be reversed quickly. (Did I get that >right?) On the nose. >Well, as the LOUD proponent of making secret keys s-l-o-w-e-r to >decrypt, I have thought about this a bit, and have a suggestion: > >Hash once, then do a zillion encryptions of the hash with a non-group >cypher like DES. I'll probably do just that. First thought, subject to revision: hash the name, feed it to DES with the output of a deterministic RNG (need not be secure, but the slower the better--BBS? (not that BBS is incesure)) as the key; repeat as needed. Hmmm...perhaps I'll adapt an earlier idea of mine: split the hash into two parts, a and b, and compute (a^(1/b))-1, and use some or all bits after the leading zeros. >Another idea (something I have thought less about): send every legit >user of the database a custom version with the parts encrypted with >that user's public key--and do the trick mailing list companies use, >scatter some dummy info in the list. When a dummy (not just me) gets >a junk mailing, go beat up on the user who's copy had to have supplied >the junk [. . . .] Nice idea, but there's neither the available resources to do that, nor, I think, the desire to beat up on careless users. Berzerk suggests a 0.1 S/N ratio (and in an earlier note a couple useable algorithms for the multiple encryption process); that would not be practical for any decent sized database, and I might have 100K or so people to deal with. But I almost certainly will mix in at least some random padding. I imagine that the database will always be the same length, even as people are added and/or removed with time. And the records, of course, will be premuted randomly. >-kb, the Kent who doesn't want to be thought of as only a card player Then here's a suggestion for you: develop some other primitives, like rolling dice, and you could implement just about any other game you like. Monopoly would need (aside from licensing issues) the dice, two decks of special cards, and some ecash. (Surely MM used as Monopoly Money isn't subversive? After all, it's teaching our young 'uns to be good capitalists.) Scrabble would need a deck of cards, each of which contains only a letter, with many duplicates. Trivial Pursiut is just a huge deck of cards; they'd probably be index positions to the database of questions, so special editions are just a file switch away. These are among the most popular games in the US, and probalby abroad. Build your primitives right, and these games are as simple as specifing paramaters (how many sides to the dice, what info the cards contain, etc.). And maybe you could license the stuff, each and every independent game, to the current owners of the games that aren't PD. So how about becomming "kb, the Kent who digitized the American family evening"? Go for it! And drop me a line when you want beta testers (sometime Thursday?). >Kent Borg +1 (617) 776-6899 b& -- Ben.Goren(a)asu.edu, Arizona State University School of Music net.proselytizing (write for info): Protect your privacy; oppose Clipper. Voice concern over proposed Internet pricing schemes. Stamp out spamming. Finger ben(a)tux.music.asu.edu for PGP 2.3a public key.

2 2

PGP bug *NOT* yet fixed
by Ben.Goren＠asu.edu 17 Dec '03

17 Dec '03

Y'all remember that bug that Colin Plumb told us about in the true random number generation part of PGP? It's still there, in the version from net-dist.mit.edu, as of late yesterday evening. There is *no* mention of the bug anywhere, in any readme files, in the documentation, anything. This strikes me as irresponsible. I would expect PGP 2.6a to have been released the day of the announcement, with the bug fixed. If there's some reason why that couldn't be done, then at least there should be some sort of prominent notice detailing the change, and probably a diff file--or even a simple shell script--to apply the (very simple!) fix. The signature on the following file checks as follows: >File has signature. Public key is required to check signature. . >Good signature from user "Colin Plumb <colin(a)nyx.cs.du.edu>". >Signature made 1994/06/01 14:04 GMT That's a month and a half ago. The *only* copies of PGP 2.6 out there that are free of the bug are those that have been fixed by hand. That's probably not all that many of them. I'm going to bite the bullet and paste in the original message here. Feel free to flame me if this is unnecessary re/cross-posting, but I'm not aware of any place to get this aside from digging through archives, and.... b& -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.5 mQCNAi3L864AAAEEAKRe8j9QUqL4PDQSsliTKQ0yTkdLL8BFBm7c03RC9Ol5PP9K j/RtnsdxFMTtW7wkMwTpY1jF23HR+x54LrOpi8ig6HEmiXVVWuNByRjSMgz8jvrn MM0/tIOCPAgNMxiANUWqretPEWCZE9sLbylkJrrOd54ZKyXBTw/D7AL7u4qxAAUR tCFDb2xpbiBQbHVtYiA8Y29saW5Abnl4LmNzLmR1LmVkdT6JAJUCBRAtyxCUZXmE uMepZt0BAeiyA/4tNXz6loqEwyMv65TMGtqxTlT5ocGNzyE8mkZXvbmoS0m7sdsd aVBvHfK8lrkQz/anrzAHJMBOaZ0V6T7aCLAK6GnjHoeanP8ZyhaXpc2e7EVut4Zi hCpmq45uiA/1diwLXhC8OoHwKqZDT+uNnJLLdlAzrJiOaELAzXXeOvtMXokAYAIF EC3L/BnKPaH9hlqn8wEBXWgCWMgIh8Lsww5pFHRFbAe2HehjGIiOmQ+ZcnL3pOhw tLdoGm6lqWZ4njDSTULxDpKUtbe4pWNv6Go13t9p+1GmTh+RrnGoq6rs3Mlg+IkA lQIFEC3L+zgPw+wC+7uKsQEBDZkEAJYkHK5n02GXLwEEgFKpxQvWLqI2xz33rPDa 0eT6+RYMDcr/1vzTqX7CwNpCuTaFTVNRbRznvwNTDcQXVsnyPg5yGdRIIMPnWuGf gSEP7vjm8zzvfdh5te4ag6jobCN1PVyqIIxIV5S8iPv632gm4vQboJiQ+4+53qoS WJ6BNDq9 =Wjfi -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNED MESSAGE----- I have the unpleasant task of reporting a significant bug in PGP's random number generation (for making primes), and that it's my fault. It *is* a significant problem, although it is *not* end-of-the-world severity. That is, the code is not doing performing as intended, and the results aren't as random as intended. On the other hand, this does not appear to make any generated keys easier to break. Because it has to do with random-number generation, there are no interoperability issues raised. Please read on for details. Thanks to the many people who have submitted other bug reports and porting patches. A new release from MIT is forthcoming with more cleanups. * The Bug In pgp 2.6 (and 2.5), there is a file named "randpool.c", which accumulates entropy from keyboard timings. These random numbers are used in generating session keys, although the primary random number generator for session keys, based on IDEA, is unaffected. The main use of these random numbers is the much more sensitive task of generating RSA secret keys. In that file, a tiny helper function is xorbytes: static void xorbytes(byte *dest, byte const *src, unsigned len) { while (len--) *dest++ = *src++; } A character is missing. '^', to be precise. That "=" should be "^=". I wrote it, and I knew when I was writing it that it was critical code. Since you can't test a random-number generator (except for the most trivial of flaws), you have to walk through the code very carefully. I did, or thought I did, yet still managed to miss this. Oops is too mild. That code is not supposed to have ANY bugs. In other words, I screwed up. There's a lesson in there somewhere. I'll try to learn it. * The Effect The randpool.c code works by maintaining a pool (buffer) of random bits and adding in new "noise" from the environment each time a key is pressed. This "adding" is done by exclusive-oring it with successive bytes from the existing pool. When the pool is "full", a cryptographic stirring operation is performed to mix all the information in the pool together and get ready for new noise. The bytes in the pool at the end are intended to be uncorrelated with the noise bytes that will be added, so the XOR adding does not cause any sort of "cancellation" of information. This stirring is done with a key, which is taken from the pool at the end of each pass. With the bug in place, the noise bytes *replace* the bytes in the pool rather than being added to them. So the information that was in the pool is obliterated. The only trace that remains is what's stored in the key. This is at most the size of the key, 512 bits, rather than the size of the whole pool, 3072 bits. PGP tries to ensure that generated RSA keys are completely unpredictable by accumulating enough Shannon information to make the whole key. Thus, infinite computational power would not let you predict a generated secret RSA key. This bug subverts that. * Security Analysis What effect does this have on someone's chances of breaking an RSA secret key generated with PGP 2.6? Not much, as far as I can tell. But it requires more careful thought and that eats into the comfort margin that should be there. Just for comparison, the RSAREF library's random number generation routines are also based on MD5, but use 16 bytes of seed. Successive random bytes are taken by computing the MD5 hash of the 16-byte seed, using those 16 bytes, incrementing the seed by 1 (taken as a 128-bit number), and repeating. Taking the MD5 of a 16-byte value involves one pass of the MD5Transform function, with 16 of the 64 key bytes unknown, 48 bytes are known (fixed, in fact), and the input hash is known (fixed, in fact). Compared to this, PGP 2.6, even with the bug, is excellent. All 64 bytes of key to MD5Transform are dependent on all of the seed, the input hash varies widely, and the output is XORed with some difficult-to-predict data. The reason that you can get away with less than perfect random numbers (less Shannon information than the size of the generated key) is that you only have to make sure that the weakness does not make any attack easier than the best known attack without the weakness. As long as guessing is only useful to a brute-force attack, it remains far easier to factor. Paul Leyland estimated that the work to try all possible 128-bit IDEA keys is equivalent to factoring a 3100-bit RSA key. Now, recent work by Arjen Lenstra on the number field sieve (Paul Leyland was assuming the MPQS used in RSA-129) has raised this RSA key length somewhat. Thus, an argument can be made in favour of RSAREF's use of a 128-bit random number seed, since that's all that is necessary. PGP prefers to be a little bit more paranoid. Still, once you have 512 bits of uncertainty, trying all possibilities is more work than trying to break a 1024-bit RSA key by trial division. So let's see just how much entropy is in there. Each keystroke, the following data is added to the random pool: - - The cahracter typed, an int (2 or 4 bytes) - - the time_t result of time() (4 bytes) - - the clock_t result of clock() (4 bytes) - - On MS-DOS, 2 bytes of hardware timer 0 - - On Unix, 8 bytes of gettimeofday() and 20 bytes of times() results - - On VMS, 8 bytes of high-resolution timer. The total is 12 bytes on MS-DOS, 32 bytes on Unix (this may vary, but that's very common), and 20 bytes on VMS. The information content of the bytes is taken at a maximum of 8 bits, although it's actually closer to 15 bits on MS-DOS, and less (maybe as low as 1 or 2) on a Unix system with a fast typist and a slow (60 Hz) clock. VMS is in between. This means that the entropy density in the added bytes varies from 1/12 (or better) in MS-DOS to 1/256 on Unix. Thus, the content of a pool's worth (3072 bits) is 256 bits (or more) under MS-DOS and may be as low as 12 bits on some flavours of Unix. The random number accumulation operation adds bytes to the pool until it is either full or the desired number of bits have been accumulated. Then it stors the pool. For a maximum-sized key (1024 bits), it will take many passes through the pool to accumulate the entropy, but owing to the bug, each time the pool is overwritten with the most recently collected data. The only entropy that remains from the previous pass is in the 512-bit key buffer. This applies to every stirring pass until the last, after the last noise data has been added and new data is about to be withdrawn from the pool. This last pass is very likely to be incomplete; some of the data at the tail of the pool is probably not overwritten. This can carry over extra entropy from the previous pass. No more than is there (the 12 to 256 bit range observed before), and then you have to add an unknown fraction of that for data that has been added in the current pass, but the total will vary from 12 bits (an average of 18) to 256 bits (an average of 384). Plus the entropy preserved in the key buffer. So there is from just over 512 to an average of 896 bits of entropy in the pool. 1016 random bits are used to make the starting values for the two primes in a 1024-bit key. This is clearly not the perfect Shannon entropy PGP aims for. As long as the stirring operation is still considered cryptographically strong, this reduction in the possible range of generated keys is not useful to a factoring algorithm, so it doesn't make a factoring attack any easier, yet a factoring attack is still far easier than a guessing attack, so the easiest attack is no easier. So I don't think anything is more attackable. Still, it's NOT what was intended, and that's always bad. My apologies to users of PGP. - -- -Colin -----BEGIN PGP SIGNATURE----- Version: 2.5 iQCVAgUBLeyVSw/D7AL7u4qxAQEjCQP/YlzY5DWT4FrSErQ8W0TP9ibRqpck4gKL YOkUgiMQnvCE2XHEvP1VTfUANgU9O/P7lClJ1oaOXIEbt5GW45DAVPgSZk5PoJ10 TZ5Ly4wqDzMa8YLDu4I2l2Use5wwIIYl5IbGEdZiRlYdox7eWaGRLfOiA8CPVb9p yZ7PgFZU10Y= =Bj83 -----END PGP SIGNATURE----- -- Ben.Goren(a)asu.edu, Arizona State University School of Music net.proselytizing (write for info): Protect your privacy; oppose Clipper. Voice concern over proposed Internet pricing schemes. Stamp out spamming. Finger ben(a)tux.music.asu.edu for PGP 2.3a public key.

1 0

uh... excuse me
by nym＠netcom.com 17 Dec '03

17 Dec '03

Pardon me, but I think people are mistaking me for someone else. I read about this group from talk.politics.crypto (which I found poking around for info on Clipper). Are people objecting to the article I posted? I thought the interest in "digital cash" might warrant my posting that article about the U.S. currency changes. I guess I better just shut up and listen awhile longer on this list to find out what people are really interested in. I like to play an active role in posting contributions to every mailing list I subscribe to but I guess I was out of line here. Or maybe I should leave. You guys seem a little too paranoid for my tastes. (It's too bad, because I had some speculation I was hoping to share with you from some fascinating books I've been reading. You see, I'm a bit of a "new ager" and have been reading about prophecies that predict a new Hitler will arise partly via seizing the worldwide electronic infrastructure, and was curious what you would think.) Anyway, my apologies if my post was out of line. I'll be glad to leave if this list is not open to the general public or something. --nym(a)netcom.com

1 0

Remailer Detweiler filtering
by Hal 17 Dec '03

17 Dec '03

Nobody wrote: > But just from a philosophical view, I think any remailer operators > hunting for Detweiler-grams in all their incoming mail are employing > a procedure that is antithetical to their entire commitment. Isn't > it just a *teensy* bit hypocritical? Is this how you are going to build > cyberspatial-wide confidence in the use of your remailers for their > dependability and secrecy? Isn't it just a *teensy* bit hypocritical > to yell to the world that ANONYMITY IS THE RIGHT OF MAN and have a little > whisper in small print, "unless you are an official enemy of the > cypherpunks"? The issue is not a desire to deprive Detweiler of the benefits of anonymity; it is that he appears to do things which are designed to bring down the remailer network. By intentionally mass-posting to inappropriate news- groups, and injecting exponentially-growing messages into the remailer chain, he seems to be trying his best to deprive the benefits of the remailer net- work to others. This is, of course, in accordance with his well-known position against anonymity. If Detweiler succeeds, Nobody won't get to post anonymously (so to speak) anymore. I know that it is unfortunate that the remailer network is so fragile that a lone crackpot is a significant threat, but presently that is essentially what the situation is. > Cypherpunks, we believe in the philosophy that we are being oppressed > by numerous forces that seek to deprive us of our privacy-- big business, > the government, police, etc. But how can we claim to uphold the philosophy > of freedom of speech and privacy looking at our relationship with Detweiler? > Sometimes I think he was sent by God to test us. Pragmatically, I think that filtering Detweiler is more likely to provide privacy than not doing so. I understand the charges of inconsistency but IMO the particular facts of a case are a better guide to the proper action than abstract arguments. > What is it in the human psyche, rooted deep in our subconscious, that > pushes us to *vengeance* against those who offend us? That pushes us to > want to *expose* them (as the person said above, "EXPOSE THE BASTARD!!!"). > Do we have any consistent beliefs? How is that we, who are dedicated > to privacy, broadcast to everyone listening in a clear voice, that > "freedom of speech does not belong to people who offend us"? There is > a saying, "who will guard the guardians themselves"? Who will ensure > that those who advocate anonymity actually follow through, if they don't? If chained, encrypted remailing techniques are used, it is not a question of "exposing" anyone. Detweiler may be blocked from the network (if everyone agrees to do so) but it won't be possible to find out just what he is being blocked from doing. Had he been sufficiently careful in the first place there would not necessarily be any way of knowing who exactly was producing the offensive messages. In that case I believe most of the remailers would no longer exist. > I personally advocate that the Detweiler-Detritus be allowed through > the remailers unaltered as a blaring advertisement to the entire world > of cyberspace that yes, we believe that anonymity is *sacred*, even more > so than we believe that Detweiler is the AntiChrist of the Cypherpunks. I suggest, then, that you run a remailer (it only costs $20 a month on the system I use), and publicize the fact that Detweiler can use yours with impunity. Set up a mail-to-news gateway that other remailer operators can use so that they don't have to worry about the consequences of abuse. It's easy to talk about sacred ideas, but perhaps not so easy to keep an unpopular and misunderstood remailing infrastructure in place. "Xenon" also accused us of hypocrisy, started up a remailer, and stopped it in just a couple of days faced with these kinds of problems. > "I detest what you say, but I will defend to my death your right to > say it." --Voltaire > > "Freedom of speech does not end at the point that it offends; to the > contrary, that is where it begins" --Supreme Court justice (paraphrase) Detweiler is free to send any messages he likes; his service providers are free to continue or terminate his accounts as they see fit; and remailer operators are free to establish whatever policies they like for message handling. What better implementation of free speech could you want? Hal Finney hfinney(a)shell.portal.com

1 0

Re: Key length security (calculations!)
by Hal 17 Dec '03

17 Dec '03

solman(a)mit.edu writes (quoting someone else initially): >> You mention Shamir, etc. However I would point out that even if any of the >> original RSA mathematicians found a better factoring algorithm, they'd be >more >> than likely to keep it under lock and key. The obvious reason is that their >> money supply depends on such an algorithm being suppressed. >What about Shamir's triple pass key exchange protocol (explained briefly >below). Its the perfect key exchange algorithm. It obsoletes Public key >systems entirely as long as you only need to exchange keys and not >authenticate. I'd say that is pretty decent evidence that he does still >do things to help the field when it might hurt RSADSI. (although I wouldn't >say the same thing about all of them) I suspect this protocol is covered by the Diffie-Hellman patent, which is quite broad, covering many sorts of key exchanges. Diffie-Hellman is now owned by PKP, the sister company to RSA. If so, Shamir has not undercut his own financial interests by this work. (Also, this does not obsolete PK since it requires several exchanges before communication can occur, making it inappropriate for high-latency communications, such as for most email.) Hal

2 2

request for subscription
by SNMC62A＠prodigy.com 17 Dec '03

17 Dec '03

request for subscription

1 0

Clipper Costing / NSA ATM Crypto Venture
by NetSurfer 17 Dec '03

17 Dec '03

CP's, here's a couple of tidbits to get the juices flowing. They are from Infosecurity News July/August 1994 issue, page 10. The ATM part is particularly interesting... "Clipper Debate Rages Onnnn..." by Charlotte Adams Controversy continues to escalate over the government's Clipper escrowed-key proposal. Attacks include an analysis of just how much taxpayers would have to pay for it, and a Freedom-of-Information-Act request to hand over Clipper's escrowed keys. Meanwhile, the federal government continues to backpedal, saying that Clipper will not be mandatory, even for government users. What cost Clipper? To gauge Clipper's economic impact on taxpayers, Steve Walker, president of Trusted Information Systems Inc., offers the following analysis. Approximately 5,000 legally authorized wiretaps take place each year, based on a reported total of 800. He increased this reported figure to 1,000, for argument's sake, and multiplied by five to account for multiphone wiretaps.) There are approximately 500 million phones in the U.S., so the ratio of taps to the total number of phones is about O.001 percent. If the government taps 0.001 percent of AT&T's estimated market of 250,000 Clipper-equipped telephones, that works out to 2.5 key-escrow taps per year. Since the cost to run the country's two planned key-escrow centers is estimated at about $6 million per year, Clipper taps could cost taxpayers $2.4 million apiece (beyond the $250 million to buy the Clipper-equipped phones at $1,000 apiece in the first place). But if the number of Clip per phones sold is 100-fold greater than AT&T estimates--25 million devices--there would still be only 250 escrow taps per year and one call to key-escrow centers every 1.5 days, Walker figures. Each approved Clipper tap, under these cir- cumstances, would cost $24,000. Now, add to these escrowed-tap approval costs the estimated $50,000 to $60,000 that would be required to actually set up each wiretap. More than 1,000 Clipper crypto devices have been sold commercially since the products became available late last year, Department of Justice officials said. So far, the government has purchased another 9,000. Stalling tactics. A response to the Freedom-of-Information- Act (FOIA) request for Clipper's keys filed by Electronic Frontier Foundation cofounder, John Gilmore, is slow in coming. According to Gilmore's lawyer, Lee Tien, the FOIA applications--to the Department of the Treasury and Department of Commerce --have only generated requests for more time. The agencies, however, "seem to be making an effort to respond," Tien adds. Now, it's voluntary. Government witnesses testifying before back-to-back congressional hearings in May stressed the voluntary nature of key-escrow technology for both government and commercial use. But others demanded more than executive-branch reassurances. Raymond Kammer, deputy director of the National Institute of Standards and Technology, told a House Science, Space and Technology panel that he hopes government use will drive prices down far enough to make Clipper phones attractive to the public. Citizens may also wish to buy Clipper-equipped phones for communicating with government agencies, he added. Among Clipper critics, David Farber, professor of telecommunication systems at the University of Pennsylvania, told the House subcommittee that Congress needs to "weld into law" guarantees that Clipper will not be mandatory. And Trusted Information Systems' Walker told an earlier hearing before the SenateJudiciary Subcommittee on Technology and the Law that the administration should not "proceed on its own without separation of powers." He suggested putting key-es- crow centers under the judiciary branch, so that the executive branch "can't twist arms." --------------------------------------------------------------- NSA Launches ATM Encryption. Trying to stay in step with rapidly evolving telecommuncations technology, the National Security Agency has kicked off an Asynchronous Transfer Mode (ATM) encryption program to provide end-to-end encoding across synchronous optical network (SONET) systems. Called Fastlane, the ATM project specifies optical- channel (OC) rates, with OC12 desired. The work will parallel a SONET encryptor development program awarded to Motorola earlier this year. --------------------------------------------------------------- Disclaimer: these articles were scanned, not forwarded <hehehe> -NetSurfer #include standard.disclaimer >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> == = = |James D. Wilson |V.PGP 2.4: 512/E12FCD 1994/03/17 > " " " |P. O. Box 15432 | finger for full PGP key > " " /\ " |Honolulu, HI 96830 |====================================> \" "/ \" |Serendipitous Solutions| Also NetSurfer(a)sersol.com > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

1 0

Re: Sue D. Nym, and Netcom records
by merriman＠metronet.com 17 Dec '03

17 Dec '03

> >I'm not disturbed by this, actually. The only way to stop it would be >for Netcom to demand to see people's national ID papers before giving >them an account. Do any of us want that sort of world? Oh, sure, give us an easy choice... Detweiler or National ID card..... Dave M Wherever you go in Life - there you are!

1 0

Sue D. Nym
by merriman＠metronet.com 17 Dec '03

17 Dec '03

I trust that everyone got the joke: Sue D. Nym = pseudonym Dave Merriman Wherever you go in Life - there you are!

1 0

RE: uh... excuse me
by Blanc Weber 17 Dec '03

17 Dec '03

From: Sue D. Nym "....maybe I should leave. You guys seem a little too paranoid for my tastes." ......................................................... It's not paranoia, it's just that LD is always trying to induce the list members into self-incrimination: he intends to evoke crowd-gathering behavior wherein they will all betray their true nature, true motives, true attitudes. He doesn't believe that they deserve as much credit as they seem to give themselves and wants to reveal to them, by their actual responses, what they would deny in public. He doesn't think that they have all that much respect for privacy, but are only opportunists bent on only their own advantage, rather than supporting the principle of privacy per se (even for their enemies, who could as well use the available methods against them). Everyone always knows what his true aims are, though, and no one ever gives him any slack. Blanc

1 0

Re: Nixon, Johnson, and the Dollar
by Blanc Weber 17 Dec '03

17 Dec '03

From: Sandy Sandfort "When the government makes any announcement (ESPECIALLY a denial), you should figure out what the government is trying to get you to do. . . . . . " ...................................... I think this is what is called "providing incentive" or in corporate-speak, "incentivization" (when they make an announcement and you take the kind of action which they intended you should). Blanc

2 1

Re: PGP bug *NOT* yet fixed
by jis＠MIT.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Chill out friend. We are working on a bugfix release to PGP which will fix several important bugs. The bug you mention is fixed in our development sources and will be fixed in the next release. Read Colin's note carefully. If you do you will realize that this problem is not a disaster. The reason that you need good random numbers for cryptographic purposes is to make an exhaustive search through all possible values of a key too hard to do. There is more then enough randomness in the random pool even with this bug to prevent someone from being able to search all possible values. -Jeff -----BEGIN PGP SIGNATURE----- Version: 2.6x iQBVAgUBLinTiVUFZvpNDE7hAQGm2QH/S7uvlJMUGeYNTncQ9rvr0Dkowjto2GG7 Pi+f0cLlUGTfDNTtAlSdao0HxwT5uv2PUwXMAd6Cns3uo3ordRiP1Q== =9BZ3 -----END PGP SIGNATURE-----

1 0

RE: ACAPULCO H.E.A.T.
by Blanc Weber 17 Dec '03

17 Dec '03

Thinking about card games & privacy/technology issues (eliminating el Fabuloso for a minute): It would be interesting to see TV shows with real-life crypto scenarios, demonstrating the advantages of using it and how it prevents the bad guys ("them") from intruding upon the free movement, the private property, etc. of the hero-winners. "It's just me and my code (and my public key. . . . and my pc....and my laser gun) against the world, winning against the odds....." But it probably wouldn't be as interesting as an exotic melange of Iran/Iraquis, renegade biologists, casinos, blackjack, etc. (not to mention bikinis). Blanc

1 0

New FLA
by j.hastings6＠genie.geis.com 17 Dec '03

17 Dec '03

The computer-designed replicant, Kent Borg, writes: >We need another TLA? >I propose: TPD: Terrorists, Pedophiles, and Drug-dealers. No, we need another FLA: TPMD: Terrorists, Pedophiles, Money-Launderers, and Drug-dealers. The Treasury's IRS and Customs collectors are really concerned that the rich will evade their fair share of taxes. We'll accomplish something if we can discredit tax collection. Billions of unregulated dollars will destabilize foreign democracies. Corrupt regimes may enact strict bank secrecy laws. These new evil dictators may not cooperate with income tax investigations. Send the Marines and the ATF now!!! Yes, a horde of Islamic fundamentalist, child molesting, dope smoking, welfare chiseling tax cheaters may soon cross our borders. There is only one way to repel this invasion. We must give up our infantile obsession with Liberty. The President's responsible leadership with the Clipper chip and Digital Telephony will protect us from certain doom. Let's unite under Uncle Sam's infobahn jackboot, install Big Brother's interactive video cameras in our homes, and embrace the new national socialist health I.D. internal passports without complaint. Then we can be happy. The one true Kent - j.hastings6(a)genie.geis.com Proud to have watched 1,743.21 hours of Beavis and Butt-head this week

1 0

Re: Sue D. Nym, and Netcom records
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> Oh, sure, give us an easy choice... > > Detweiler or National ID card..... That's real easy - I'd take Detweiler in a minute. Sure, it takes work to filter out each incarnation of Sue D. Spoof, and there are N-1 more like him out there, but it's a lot less work than explaining to people why you don't have any intention of using the Nationalist ID Card Number in your databases, or carrying it on your person, or presenting it when you open bank accounts, or getting it printed on your armonce they make tattoo removal the monopoly of the National Health Care System or whatever the paranoids will thinnk of next. (And *please* don't say too much of this around politicians; they tend to miss the smileys and think this sort of thing is a good idea....) Bill

1 0