December 2003 - cypherpunks-legacy

Full strength Email Clients.
by Steven Herod 17 Dec '03

17 Dec '03

Hello, I'm in search of an *EASY TO USE* Internet Email client software that uses full strength (outside US export restriction) RSA encryption. It would be used for end to end encryption of Patient Pathology results, hence the need for "full strength". Any pointers to sites of interest? Best Regards Steven Herod Computer Systems Officer Med-E-Serv Connect, a division of CITEC

1 0

Re: FCPUNX:ecure Phones
by Lucky Green 17 Dec '03

17 Dec '03

At 09:41 PM 2/3/97 -0700, C. Kuethe wrote: >As we were both saying (meaning to say) there's a lot of holes in there... and >you're rich if you'd trust $1e4 to this box.... I'd put maybe $100 on it. Not >that I have a problem with wealth. My point there is that I don't think this >device is secure enough to be placing a lot of trust in... For 1E3, you can get the CS8191 from Communication Security Corporation. http://www.comsec.com/ It uses 3DES. No silly "voice inversion". Sigh. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

1 0

Re: Embarrass a Marylander, Go to Jail
by tmcghan＠mail.bcpl.lib.md.us 17 Dec '03

17 Dec '03

in a message allegedly from: Robert Hettinga <rah(a)shipwright.com> this appeared... > A Maryland bill that would make it illegal to send "annoying" or > "embarrassing" e-mail was introduced this week by Democratic General > Assembly member Samuel Rosenberg. {snip} > "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle As a marylander, in particular, a baltimoron, I am both embarrassed and annoyed that these legislative bozos have the unmitigated gall to expend time and energy on pursuits such as these. Perhaps they feel that our state attorney general needs to earn his excessive salary by attempting to defend this constitutionally indefensible mental excrement. Did the defeat of CDA not resonate?

1 0

Re: More Hacking of the Mykotronx Site!
by John Young 17 Dec '03

17 Dec '03

While this report may be true, I wonder if it's not a spoof or even official disinformation to mislead about the details of Aaron's mission as well as what Rainbow and others are really peddling to rabble-fearing paranoids. This last sentence seems a bit too melodramatic even for a suck-up crippled-chip manufacturer: >The MYK-82, developed by Mykotronx and fabricated by VLSI Technology, >Inc., is the first of a series of security products to be developed as >part of an alliance with the NSA, targeting both Government and >commercial citizen monitoring markets. Granted that defense to LEA-market conversionists like to pornograph the godawful carnage their technology can wreak on disobedient civilians to arouse ex-military-to-LEA converted glands -- do they actually write SOF drool like this?

1 0

No Subject
by owner-cypherpunks 17 Dec '03

17 Dec '03

1 0

Re: Secure Phones
by Peter Gutmann 17 Dec '03

17 Dec '03

>My guess on the CESCOMM device is that they (would like us to belive that >they) use pure RSA with optional hybrid links... this seems a bit obvious >because of: > >"Guessing the unique Keys is out of the question. Acquiring the keys through >wiretapping is impossible, since they are never transmitted." <--RSA? This thing is snake oil. What it does is move the data through an FIR filter with the taps being controlled by a secret key. The data itself isn't encrypted, but is spread out over a wide spectrum in a (they hope) difficult-to-analyse manner. However with only 1K possible taps and (presumably) something as high-security as an LFSR driving it, I think the strength of the system has been overestimated somewhat. It wasn't designed for security at all, it was designed by an ex-Canterbury uni engineer to provide add-on noise-immunity to fax machines, and they only decided to market it as an encryption device later on - the designer apparently knows very little about encryption. I've got a photo of it, it's in a box the size of a small modem and consists of a circuit board with an ASIC on it and a bit of interface circuitry. The company has a patent on it, but a search for the patent has so far been unsuccessful (mind you I didn't search very hard). If anyone wants to check it themselves, the patent will probably be assigned to Ken Stokes of Cardinal Encryption Services - they claim to have worldwide coverage. >I emailed the German team about the LC-1... don't know if I'll hear back from >them, but if I do, I'll pass on everything I get. This is rather cool, it was designed by a couple of students at the University of Saarbruecken. It uses the Lintel RSA chips which are fast enough to do real-time RSA voice encryption, either singly for 512 bits or chained for 1033 bits. I've got a brochure somewhere which shows one of the inventors using it, it's a small motherboard containing the RSA chip, some other unidentifiable circuitry (presumably a modem chipset), an EPROM, etc etc. It was done as a research project by students who are unlikely to have put backdoors in it. The BSI (German NSA) were not at all happy about it. It's a pretty neat product, but unfortunately due to its origins it's having difficulty getting any market penetration. In addition the Lintel chips are f-ing expensive and there are many other components that go in on top of that, I doubt the whole thing sells for less than DM 1000-1500. Peter.

1 0

Re: PCS Encryption?
by Phil Karn 17 Dec '03

17 Dec '03

>Phil Karn is, of course, the expert on this -- I hope he'll chime in soon >-- Phil, you out there?? Yup, I'm out here. Just buried under a pile of email. >Working from my not-so-great memory, CDMA uses a fixed spreading code that >is determined by a pretty simple "cipher-like" process. I believe the >details are covered by an NDA, sorry. At any rate, it isn't "encryption" >by any means -- and tapping it requires little more than building a new >base station (again, given $ and the fact that you're going to have to >follow the bloody thing around as it moves). No, it's not covered by NDA. It is, however, all heavily covered by Qualcomm patents. It's all specified in complete detail in TIA IS-95A. The actual spec is copyrighted TIA (even though we did almost all the work) but you can find an early version, plus a much more readable overview paper, through my web page. The air interface is essentially the same as you'll find on the air. <http://www.qualcomm.com/people/pkarn/cdma.html> There is essentially no "encryption" in the usual sense of the word in CDMA. It is true that the complexity (and until recently, the obscurity) of the modulation method provides some modest protection against casual eavesdropping (e.g., someone with a Radio Shack scanner). But phones containing the necessary ASICs are now being shipped by the hundreds of thousands per month, and as I said earlier the complete air interface spec has been public for some time. I do note that the forward (base to mobile) and reverse (mobile to base) modulation methods are totally different, because the jobs they have to do are different. Only the reverse link is truly CDMA, as there you have many transmitters sending to a single receiver. Both links are spread to 1.25 MHz bandwidths, but that's about where the similarities end. The phone ASIC contains only a forward link demodulator function and a reverse link modulator function. The base station ASICs are not yet generally available. Also, an echo canceller in the base station effectively blocks any reverse link audio from coming back out on the forward link. Consider also the very low and tightly controlled transmitter powers typically used on the reverse link. One can now make certain conclusions about the relative ease of intercepting the forward link as compared to the reverse link. The closest thing to "encryption" in CDMA is the "private long key" mechanism. The private long key is the starting state of a 42-stage linear feedback shift register (LFSR) that is used to spread (reverse link) or scramble (forward link) the vocoder data. (The IS-95 signal path is too complex to describe fully here -- see the documents on my web page for the details, including the difference between scrambling and spreading). As anyone with even a rudimentary knowledge of cryptanalysis knows, LFSRs are not at all cryptographically secure. The Massey-Berlekamp algorithm can easily determine the state of the long code shift register with a short (42-chip) sample of its output. Furthermore, the long key sequence has other specified uses on the reverse link; in particular it is used as a pseudorandom sequence generator to control the puncturing (on-off transmitter gating pattern) when the phone is transmitting at a low data rate between talk spurts. This obviously suggests other ways to determine the LFSR state without demodulating individual CDMA chips. Nevertheless, NSA has repeatedly objected to the export of the "private long code" feature, and I'm not even sure it's implemented on the domestic models currently being deployed. Phil

1 0

Re: Trigger-Words...Trigger-Fingers
by Larry Johnson 17 Dec '03

17 Dec '03

Dale Thorn wrote: > > Larry Johnson wrote: > > Cynthia H. Brown wrote: > [snippo] > > Theres not many girls on this list, is there? > [mo' snippo] > > Anyway, my uncle prints out the girl-cypherpunks stuff for the girls > > on my list and they think its real cool and they all want to marry > > technicians so that they can make them work on the computers for them, > > kind of like making them do the computer dishes, you know. > [yet mo' snippo] > > I want to get married. Lots of times. Are the girls cute? > I don't do hardware, tho, I'm a software guy. Yeah their real cute, most of them anyway. Their all nice though. Some of them would like you cause they dont like regular guys, cause their troublemakers too. I know your a troublemaker (I think thats a good thing) because Ive read your stuff and myu uncle keeps you in his NotADork/MyAssholes dir. Thats where he keeps the troublemakers but its not an insult because he likes what Kevin (hes a Bodston Celtic said--"Danny Ange is an asshole, but hes _our_ asshole." He taght me how to read by using the Froggie manual since I could boot it myself when he was out of the rooom when I was two year old. Now he teachs me how to read with the cypherpunk messages and stuff from his govbernment friends. (Their good government guys though, they like you guys. Their really secret guys not lamer regualar secret guys. They laugh at those regular secret guys who screw with you guys cause they leave their pecker tracks all over the place.) Some people thik Im a lamer cause Im not good with grammer (not on the kids lists thogh) bu tmy uncle says Ill learn how to do that but Im better to learn how tho think first. Ive got dsylexia too so I use a spell checkerif I want to look smart but emailers dont have it. You guyhs should keep being troublemakers. Really. My uncle says that if you guys get too polite then you better watcvh your backs when you curtsy, cause you never know whos sneaking up behind you. He told me that if I watch you rmodernation that I wont have to have sex educaton laterer cause I'll already know how to get f*)&%ed. (Hes funny. His governmnt friends call him the fool becaise hes dumb like a fox.) Excuse my spelling but I spell things good once I see them in a dir cause myu uncle make s me look stuff up before I put it in a dir or he erases myu dir to make me learn. I think the girls would like you cause yuou are a computer guy. Ill show them your letter. Theeir smart, too. They dont like lamer guys. When their school computer guy messes up ecveyones stuff then they fix it but they dont tell him cause it makes him mad. Im not real good at 4reading code and stuff but the secret computer guys let me drink Scotch with them evcen in the bar at the Holiday In in Santafe cause Im smarter than them abou t som e stuff even if they are really good. (I go tm y uncles password on his secret machine by putting my video camera on the frige with a dead battery and pluging it into his power supply) (Now when he boots up he will getr Duke Nukem3D and when he leacves it he will get a message telling him hes a _lamer_.) He had to go to Lost Alamo again because of you guys and hell gibve me sh*&)( when he gets back but not too much cause he said I could do anything I want on his secret machine if I got on it. Im getting to play with Unix cause he has a Spark Card on it that has Unix on it. (Dos is for lamers but Bill Gates owns ecerything so its cheaper for kids) Some lamer said on cypherpunks today that it takes him an hour to get the pecker messages off his computer. My uncle has me to do it for him sometimes and it only take me like maybve two minutes. If the guy is such a lmaer that it take s hinm an hour then maybe he should just read only the pecker messages cause they have pictures and then when he mobes his lips to read then he coul d put them on the peckers. (Thats a joke) I like that Tim May is bacvk, if only even for a little while. When you guys fight at least you say stuff that isnt kissing ass for other guys money. Im going to make a message to cypherpunsk that says if anyone wants me to be their moderator then they should not write any messages to the cypherpunks. Then the 2000 people who dont post will be voting for me to be their moderator and I will be their boss. If Im the moderator then I will givbe everyone free pizz a and lots and lots of Scotch. (<--Dewars) I hope you guys stay together. My uncle says sometimes you learn by looking and sometimes you leran by seeing whos looking back. But he tells the secret gobvernmetn guys not to look back cause their might be a cypherpunk gaining on them. (Thats a joke) Ive got to go to bed so I can pretned to get up again. Im sick so I can do what I want bu t Im not supposed to stya up all night either. I wont let the door hit me in the ass on my wayout. Bye, Human Gus-Peter p.s. - dont write me after Thursday cause my dad will be back and Ill get in trouble. My uncle will help me clean u p my mess cause hes not a squealer.

1 0

Moderation, Tim, Sandy, me, etc. * Strong crypto == DES?!
by John Gilmore 17 Dec '03

17 Dec '03

I'm glad we're talking about some of the real issues here. Tim May said: > I don't want Sandy Sandfort sitting in judgment on my > posts, deciding what the Cypherpunks--a group I co-founded for God's > sake!!!!--are to be allowed to read and what they may not. Tim, the Cypherpunks have chosen to follow Sandy's lead for this month. I'll admit I made it easy for them, but the results are conclusive. There are 1311 addresses in the cypherpunks list today; 42 in the unedited list; and 19 in the flames list. Forty people cared enough to read every posting; the other thousand either wanted to try the experiment -- or didn't care enough to send an email message. Which, as we all know, is a very low threshold. If I was a social scientist I might want to run the experiment both ways, or six different ways. Name it this, or name it that. I'm not; all I want is something that works. The cypherpunks list was unusable for this kind of discussion, only a month ago. It's usable now. I'm definitely bugged by the community's attitude toward my "censorship". Rather than being glad that someone, anyone, was doing something about the major problem on the list, 99% of the reaction was to create even more ill-considered, emotional flamage. *I* didn't make the signal/noise get worse at that point -- *you-all* did. Perhaps at that point I should have shut down the list, as Lucky is now suggesting. "Asking the list what to do" was clearly not a useful option. Sandy cared enough about the community to make some concrete suggestions to me about how to get the list back on track. They involved a lot more work than the previous setup. I told him if he was willing to do the work, we could try it. As Dale suggests, I wasn't about to waste my time reading the whole list in real time and passing judgement on the postings. Sandy was, for a month. The element I find most lacking from the whole discussion, until recently, has been responsibility. In an anarchy, *everyone* is responsible; nothing is "somebody else's job". Sandy felt responsible, so he proposed something. I felt responsible, so I helped. But a large part of the community sat on the sidelines and criticized, without making attempts to make things better; indeed the volume and tone of the criticisms themselves made things worse. Unpaid labor for a peanut gallery of spoiled children isn't very gratifying. You-all remind me of a passage from Booker T. Washington's book _Up From Slavery_, describing what happened on the night that news of the Emancipation Proclamation reached the South: The wild rejoicing on the part of the emancipated coloured people lasted but for a brief period, for I noticed that by the time they returned to their cabins there was a change in their feelings. The great responsibility of being free, of having charge of themselves, of having to think and plan for themselves and their children, seemed to take possesion of them. It was very much like suddenly turning a youth of ten or twelve years out into the world to provide for himself. In a few hours the great questions with which the Anglo-Saxon race had been grappling for centuries had been thrown upon these people to be solved. These were the questions of a home, a living, the rearing of children, education, citizenship, and the establishment and support of churches. Was it any wonder that within a few hours the wild rejoicing ceased and a feeling of deep gloom seemed to pervade the slave quarters? To some it seemed that, now that they were in actual possession of it, freedom was a more serious thing than they had expected to find it. Most of the people on the list haven't bothered to face that freedom. Your de-facto "leaders" have faced it for you. It is a more serious thing than than you expect. All it takes it hard work and judgement. Be responsible for setting your society's privacy policy -- without knowing whether you are right. Face the uncertainty and build anyway. Shall I post you an Emancipation Proclamation -- as if you needed one? Start a mailing list on another site! Move this list to somewhere! Create and nurture an alt group! Make an independent moderated list drawn from the unedited list! Hold meetings! Establish for it a home, a funding, the rearing of newbies, education, citizenship, and the establishment and support of philosophies. Dead simple for people as capable as us. Just takes work. Who's volunteering? Just do it! The experiment will be over in a few weeks. Who's going to take over deciding how to run the list, and running it? If you want to help organize what I'll call the `progressive crypto community', for lack of a better term, then please do. Otherwise, in the immortal words of Lazarus Long, "PIPE DOWN!". John PS: Can we talk about crypto too? It's clear from the last few days of press releases that the pro-GAK forces are again working to confuse novices into thinking that two very different things are the same thing. Last time it was "public key infrastructure" and "key recovery". This time it's "strong crypto" and "56-bit DES". What should we do about this? Educate the public?

5 4

Re: PCS Encryption?
by Phil Karn 17 Dec '03

17 Dec '03

>While awaiting Phil's response, there's an informative description of >Qualcomm's CONDOR device at: > http://www.nsa.gov:8080/programs/missi/condor.html Condor is, of course, a Fortezza (clipper) application, which makes it less than useful to those outside the government. In fact, from what I've heard even the potential government users are much more interested in STU III support. I wonder why... Phil

1 0

Re: My Departure, Moderation, and "Ownership of the List"
by ISP_Ratings 17 Dec '03

17 Dec '03

Dr.Dimitri Vulis KOTM wrote: > > ichudov(a)algebra.com (Igor Chudov @ home) writes: > >> Adam Back wrote: >> > >> > Perhaps it is time to reconsider the benefits of alt.cypherpunks. (As >> > an aside, it is ironic that John Gilmore was the guy who started the >> > alt.* USENET hierarchy, specifically to facilitate freedom of speech). >> > >> >> An interesting idea. > >John Gilmore of EFF is a liar and a hypocrite who likes to claim credit for >other people's accomplishments. Well EFF itself is a lie--the were very well exposed by Wired Mag. a while back as being nothing more than a corporate whore. They represent the interests of owners not consumers--the ACLU has been very open in their critisism of the EFF in this regard. A large corporation waves some money in front of their noses and tells them to bend over you can be sure they'll bend over. Respectable free speech advocates do not associate with EFF. >He had nothing whatsoever to do with the creation of the alt.* Usenet >hierarchy. Gilmore is a liar and a censor. > Is Mr. Gilmore making this claim? >On the other hand, creating an alt.cypherpunks sounds like a more robust >idea than yet another mailing list. And you could merely post this mailing list publically in the alt group of your choice--I find it interesting at times but not worth responding to in general since freedom of expressiion is not a given. Steve

1 0

Re: Information Warfare
by tmcghan＠mail.bcpl.lib.md.us 17 Dec '03

17 Dec '03

in a message allegedly from: Peter Hendrickson <pdh(a)best.com> > The cypherpunks list has been under "attack" for some time. {snip} > Some people have dismissed the idea that rogue governmental elements > are behind some of our problems. {snip} > We know that "Information Warfare" is the big thing in the defense > establishment right now. Information Warfare Conference sponsored by DPMA/AITP Washington, DC, March 13-14, 1997 Crystal City Marriott 1999 Jefferson Davis Highway Arlington, VA 22202 Presentations by: Major General Michael V. Hayden, Commander, Air Intelligence Agency Dr. C. Kenneth Allard, Competitive Strategies Col. H. Stevens, Land Information Warfare Activity - current service visions and planned program initiatives - operational concepts for 'third-wave' warfare - information warfare drivers for 21st century C4I architectures - emerging technologies and systems for information warfare superiority: opportunities on the horizon 'information warfare targets and vulnerabilities', Maxim I. Kovel, TASC systems management group 'information warfare for deterrence', William H.J. Manthorpe, Jr. Applied Physics Laboratory, Johns Hopkins 'adaptive techniques for counter-deception', James Llinas, technical advisor, DOD JDL, Data Fusion group 'emerging threats come in all sizes and flavors', Eugene Schultz, SRI consulting "Information has been termed the 'fifth dimension' in the conduct of 'third-wave' warfare, and promises to dramatically enhance the role of C4I as a force multiplier. Joint and individual service doctrine is emerging for IW, ans is affecting the needs and requirements for diverse systems: from space-based surveillance and communications systems to terrestrial image processing, visualization, and information fusion systems." "This conference will provide a valuable forum where military and industry staff can interact with key decision-makers to achieve the most current possible understanding of Information Warfare concepts, initiatives, technologies and potential opportunities. The Critical Questions to be addressed include: - how is IW changing operational concepts? - how can we defend the weak links in the planned information-intensive reconnaissance, strike, targeting architecture? - what developments in enabling technologies are needed to support current Information Operations, Battlefield Visualization, and Information Exploitation initiatives? -what can be done to develop defensive information technology capabilities? and last, but _c_e_r_t_a_i_n_l_y_ not least: - how will we move forward to develop a true offensive IW capability ==============================================

2 1

Re: Moderation, Tim, Sandy, me, etc. * Strong crypto == DES?!
by Dale Thorn 17 Dec '03

17 Dec '03

John Gilmore wrote: > I'm glad we're talking about some of the real issues here. > I'm definitely bugged by the community's attitude toward my "censorship". I'll bet you are. > Perhaps at that point I should have shut down the list, as Lucky is > now suggesting. He'd really like to, but... > You-all remind me of a passage from Booker T. > Washington's book _Up From Slavery_, describing what happened on the > night that news of the Emancipation Proclamation reached the South: What we most remind him of are slaves. > Most of the people on the list haven't bothered to face that freedom. Which freedom is that? > If you want to help organize what I'll call the `progressive crypto > community', for lack of a better term, then please do. Otherwise, in > the immortal words of Lazarus Long, "PIPE DOWN!". i.e., stop saying what I don't want to hear and start saying what I do want to hear, after all, it's *my* list.

1 0

Re: GAK/KR spin
by Peter Trei 17 Dec '03

17 Dec '03

> Date: Mon, 3 Feb 1997 14:34:49 -0800 > From: Steve Schear <azur(a)netcom.com> > To: cypherpunks(a)toad.com > Subject: GAK/KR spin > Several months back there were discussions on the list regarding renaming > the government's key escrow/recovery proposals (KRAP comes to mind). I > think we need something that's catchy and simple (perhaps already familiar) > to understand for the semi-litterate citizen units. I propose we encourage > use of the terms "crippleware" or "crypto crippleware" when refering to the > products limited to their weak crypto and/or key escrow/recovery. > > --Steve For some time, I have been using the term 'espionage-enabled software' to describe GAK'd products. Also, 'compromised software' - I want to make the point that 'key escrow/recovery' == insecure.' Peter Trei trei(a)process.com PS: I have SW for working on the $10,000 DES challenge available.

1 0

RE: My Departure, Moderation, and "Ownership of the List"
by Jason Vagner 17 Dec '03

17 Dec '03

>(And if Sandy wants comity and good cheer, let him either form >his own list or establish a filtered list just the way Blossom >and Arachelian did. Hijacking the list to reform it in his own >image is dirty pool.) Just something from another perspective: I've been on the list for quite a long time, though I've never posted. I've been online for over ten years, ran my share of mailing lists, and understand majordomo quite well. As far as I can tell, nobody has ever advertised or posted instructions for joining Blossom's or Arachelian's lists. At one time I gave a little bit of an effort to find them, to no avail. They don't seem readily available on the search engines (again, as of about 6 months ago). I never did flat out post a request for the information, as it was not that important for *me* to find it. I imagine that these individuals might have limited resources for a list-too-large, but is there really a reason this is request-only info? --- Jason Vagner <jlv(a)sig.bsh.com> Resist KRAP and GAK. Police States Are Bad. "All that one can give is what is going to happen, which may have little to do with a present that you can grasp." - Avital Ronell.

1 0

Re: New X-Ray Imager
by Adam Shostack 17 Dec '03

17 Dec '03

| A poll last week by the Los Angeles Times found that a majority of people -- | 58 percent -- said they would curtail some civil liberties if it would help | thwart terrorism. Thirteen percent said it would depend on what rights were | at stake. The poll didn't ask people to single out any rights. Its worth noting the 'if it would help thwart terrorism.' The 'best,' most expensive anti-terrorism measures ever used in the US were at the Summer Olympics. The White House point man on encryption admitted at last years CFP that Clipper and its derivatives would not have prevented the Oklahoma city bombing. A question worth asking is do we want to apply evolutionary pressure to terrorists? I prefer hijacking to bombings wrt aircraft, but the FAA disagrees. I prefer having my car stolen without me in it as well. (I think John Gilmore asked that question, but I could be wrong.) Adam -- Pet peeve of the day: Security companies whose protocols dare not speak their name, because they don't have one. Guilty company of the day is now V-One.

1 0

IBM's SecureWay Key Recovery technology
by Marshall Clow 17 Dec '03

17 Dec '03

>From <http://www.ibm.com/Security/html/prkeyrec.html>: >At the RSA Conference, IBM announced the details of its highly >anticipated SecureWay key recovery technology. IBM is developing this >technology in response to market demands for exportable strong >encryption required to advance the growth of global e-business. >[ yada yada yada snipped ] I attended this presentation. Basically, what they do is to add two packets to the "channel setup process", one that depends only on the coorespondents, the other that contains the information about this particular session. A problem with this, as I pointed out to the presenters, is that the first packet can be trivially used for traffic analysis. The eavesdropper may not be able to determine who is cooresponding, but they can tell if it is the same people as in a previous conversation. >From <http://www.ibm.com/security/html/wp_keyrec2.html> >In order to minimize the preparation overhead, the recovery information >is prepared in two phases: one phase is independent of the particular >session/archive key being prepared; the second phase is dependent on the >particular key and session parameters. The first phase, which uses >public-key encryption, can be shared across multiple invocations of key >recovery preparation, thus reducing overhead. The public-key encryptions >can be stored for repeated use. > As you can see, IBM suggests cacheing the contents of the first packet, so that you don't have to recalculate it each time. Imagine how easy traffic analysis would be if the identification packets were identical instead of just related. -- Marshall Marshall Clow Aladdin Systems <mailto:mclow@mailhost2.csusm.edu> Warning: Objects in calendar are closer than they appear.

1 0

AltaVista Tunnel
by Rick Osborne 17 Dec '03

17 Dec '03

The Digital / Microsoft "Driving Force" tour is in our parking lot today and I got the opportunity to have a look around. One of the 'stations' inside the truck is on intranets. They were showing off a product called "AltaVista Tunnel" which I assume is their PPTP product. I say "I assume" because the guy showing it off had absolutely no clue what he was talking about. He triumphantly exclaimed that the encryption was 128-bit, but when I said "128-bit what?" he cowered and muttered that he didn't know and went on with his little speech. The rest of my crypto-specific questions met with equal dark stares. And these are the people setting industry standards... _________ o s b o r n e @ g a t e w a y . g r u m m a n . c o m _________ Real programmers programs never work right the first time. But if you throw them on the machine they can be patched into working in only a few 30-hours debugging sessions.

1 0

DES keyspace
by Joel McNamara 17 Dec '03

17 Dec '03

Is anyone coordinating (formally or informally) which chunks of the keyspace has been searched for the DES challenge? Yes, I know all the arguments about potential fraud and verification, but it would be nice to have a Web site that informally listed what had been scanned so far (verified or not). Did I perhaps miss something and this is already out there? URLs appreciated if so. If it doesn't exist, I'd be willing to host a site and play coordinator... Joel

1 0

Re: Embarrass a Marylander, go to jail
by Scottauge＠aol.com 17 Dec '03

17 Dec '03

Think they are trying to expand the harrassment laws to directly effect the E world, but I would think the laws on harrassment would apply anyhow (provided your in their domain, but then again thats true for all governments...) --- How has the government interfered in your life today?

1 0

DES keyspace
by Joel McNamara 17 Dec '03

17 Dec '03

Is anyone coordinating (formally or informally) which chunks of the keyspace has been searched for the DES challenge? Yes, I know all the arguments about potential fraud and verification, but it would be nice to have a Web site that informally listed what had been scanned so far (verified or not). Did I perhaps miss something and this is already out there? URLs appreciated if so. If it doesn't exist, I'd be willing to host a site and play coordinator... Joel

1 0

IBM's SecureWay Key Recovery technology
by Marshall Clow 17 Dec '03

17 Dec '03

>From <http://www.ibm.com/Security/html/prkeyrec.html>: >At the RSA Conference, IBM announced the details of its highly >anticipated SecureWay key recovery technology. IBM is developing this >technology in response to market demands for exportable strong >encryption required to advance the growth of global e-business. >[ yada yada yada snipped ] I attended this presentation. Basically, what they do is to add two packets to the "channel setup process", one that depends only on the coorespondents, the other that contains the information about this particular session. A problem with this, as I pointed out to the presenters, is that the first packet can be trivially used for traffic analysis. The eavesdropper may not be able to determine who is cooresponding, but they can tell if it is the same people as in a previous conversation. >From <http://www.ibm.com/security/html/wp_keyrec2.html> >In order to minimize the preparation overhead, the recovery information >is prepared in two phases: one phase is independent of the particular >session/archive key being prepared; the second phase is dependent on the >particular key and session parameters. The first phase, which uses >public-key encryption, can be shared across multiple invocations of key >recovery preparation, thus reducing overhead. The public-key encryptions >can be stored for repeated use. > As you can see, IBM suggests cacheing the contents of the first packet, so that you don't have to recalculate it each time. Imagine how easy traffic analysis would be if the identification packets were identical instead of just related. -- Marshall Marshall Clow Aladdin Systems <mailto:mclow@mailhost2.csusm.edu> Warning: Objects in calendar are closer than they appear.

1 0

AltaVista Tunnel
by Rick Osborne 17 Dec '03

17 Dec '03

The Digital / Microsoft "Driving Force" tour is in our parking lot today and I got the opportunity to have a look around. One of the 'stations' inside the truck is on intranets. They were showing off a product called "AltaVista Tunnel" which I assume is their PPTP product. I say "I assume" because the guy showing it off had absolutely no clue what he was talking about. He triumphantly exclaimed that the encryption was 128-bit, but when I said "128-bit what?" he cowered and muttered that he didn't know and went on with his little speech. The rest of my crypto-specific questions met with equal dark stares. And these are the people setting industry standards... _________ o s b o r n e @ g a t e w a y . g r u m m a n . c o m _________ Real programmers programs never work right the first time. But if you throw them on the machine they can be patched into working in only a few 30-hours debugging sessions.

1 0

Re: Embarrass a Marylander, go to jail
by Scottauge＠aol.com 17 Dec '03

17 Dec '03

Think they are trying to expand the harrassment laws to directly effect the E world, but I would think the laws on harrassment would apply anyhow (provided your in their domain, but then again thats true for all governments...) --- How has the government interfered in your life today?

1 0

Re: Dissolving Choke Points
by Lucky Green 17 Dec '03

17 Dec '03

At 11:36 PM 2/3/97 -0800, Peter Hendrickson wrote: >What I have seen is a pretty complete elimination of the signal that >was there. Some might argue that this is "just" because Tim stopped >posting. But so what? The result of moderation was the elimination >of signal. Nonsense. The signal had left long before the moderation began. The steepest drop in signal (not S/N ratio) was between shortly before Perry left and Vulis had completed his takeover. Signal is cause by signal generators. Most top signal generators, other than Tim, had left because of pollution caused by the likes of Vulis, aga, and his homophonic boyfriends. Moderation has nothing to do with the loss of signal other than that signal from Tim was lost. And while I appreciated Tim's essays, they were never the sole source of signal on the list. Tim did not even provide the majority of signal. "Best individual contributor", sure. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

1 0