December 2003 - cypherpunks-legacy

Security is TWO Rubber Stamps
by fnerd＠smds.com 17 Dec '03

17 Dec '03

Ludwig R. Vogel's letter to New York Newsday makes the point, "...Government intercept procedures involving Clipper technology offer users no more protection from wrongful government surveillance than plain text." FBI guys say they only want to keep the abilities they already have. Vogel turns it around: they want to make sure we have no more protection against them than we already have...except for key escrow... America's Bulwark Against Corruption! Every citizen has the right to the protection of Two Rubber Stamps!* So wear your rubber stamps today, America! +----------------------+ | APPROVED FOR WIRETAP++---------------------+ | U.S. Treasury |+APPROVED FOR WIRETAP | +---------------------++ N.I.S.T. | +----------------------+ *Offer void under certain circumstances that cannot be discussed. -fnerd did i get the two agencies right? quote me - - - - - - - - - - - - - - - We shall have to evolve Problem solvers galore As each problem they solve Creates ten problems more. --Piet Hein -----BEGIN PGP SIGNATURE----- Version: 2.3a aKxB8nktcBAeQHabQP/d7yhWgpGZBIoIqII8cY9nG55HYHgvt3niQCVAgUBLMs3K ui6XaCZmKH68fOWYYySKAzPkXyfYKnOlzsIjp2tPEot1Q5A3/n54PBKrUDN9tHVz 3Ch466q9EKUuDulTU6OLsilzmRvQJn0EJhzd4pht6hSnC1R3seYNhUYhoJViCcCG sRjLQs4iVVM= =9wqs -----END PGP SIGNATURE-----

1 0

On encrypted Logins
by Matthew J Miszewski 17 Dec '03

17 Dec '03

Does anyone have information on the actual overhead of encrypted logins. What besides telnetd need be modified, specifically? Jef makes an interesting idea for cost containment. Jef, what exactly would y --Matt ______________________________________________________________________________ In defense of liberty, encrypt for all purposes, civil and professional. In defense of privacy, encrypt all correspondence, personal and professional. In defense of sanity, do not encrypt your dry cleaning invoice! ++++++++--------mjmiski(a)macc.wisc.edu (c)1993

1 0

welp.
by Matthew J Miszewski 17 Dec '03

17 Dec '03

Well now, that message got crunched. I meant to say Jef, what exactly would need to be modified using your monodirictional approach? --Matt ______________________________________________________________________________ In defense of liberty, encrypt for all purposes, civil and professional. In defense of privacy, encrypt all correspondence, personal and professional. In defense of sanity, do not encrypt your dry cleaning invoice! ++++++++--------mjmiski(a)macc.wisc.edu (c)1993

1 0

Insecurity of public key crypto #1 (reply to Mandl)
by hughes＠ah.com 17 Dec '03

17 Dec '03

>Only "sensitive" information is worth encrypting and if you want to >stay out of trouble you don't go giving sensitive information to >someone you don't know. If part of your communications are encrypted and part are not you have sent the message about what information is sensitive and what is not. This difference in encoding is a fir-class message in it's own right. Therefore _all_ communications should be encrypted at all time. It is no argument against the principle that this is difficult to do at the current time. Eric

1 0

Re: low-overhead encrypted telnet
by Jef Poskanzer 17 Dec '03

17 Dec '03

>1) Kerberos *does* work between corporate entities. In practice, no, it doesn't. This is not a technical problem, but it's nevertheless quite real. You will never see inter-realm Kerberos set up at places line netcom, because netcom's sysadmins have better things to do than manage secret keys for every organization that wants to connect. Only a system with completely automated configuration and operation has a chance. >2) Using your example, a user on host A telnets to host B, and from >host B they telnet to host C, if the A<->B link is encrypted, then so >long as the user trusts host B, then A<->C is secure as well (assuming >B<->C is encrypted). Yes, of course, if the A<->B link is encrypted then subsequent logins are secure. The point is to find a way to secure those logins *without* full encryption of the A<->B link. >3) Just encrypting from client->server will not necessarily reduce the >load on the server. In practice, almost all of the time, it will. >Also, doing something like DES is really not a >very high CPU operation, IMHO. Personally I agree with this. Most sysadmins will not. >4) Charon, which is based upon Kerberos, was developed exactly for >this type of problem: you want to authenticate securely over links >which may not otherwise be secure, but you trust the CPU in front of >you! The paper describing Charon is available via anonymous ftp: > ftp://toxicwaste.mit.edu/pub/charon/thesis.ps.Z I'll check this out, but if it's based on Kerberos it's probably useless for the reasons mentioned above. --- Jef

2 1

Re: stego
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Jim Choate's comments on steganography having problems with images that are too complex or too simple were interesting. Obviously, cartoon-like GIFs aren't a good target, though scanned real stuff may be fine. Weather maps cna be good - back when I worked with the things, I found you could really see about5-6 bits worth of depth, and after that it didn't usually look much different - we stole one or two values from the color-map to draw lines on the satellite images to add state boundaries, various data values, etc., but could have stolen the LSB and maybe 7th bit without major loss on cloud-image pictures. (Radar pictures, on the other hand, were almost all black, with one or two other pixel values, compressed to 2% of original size, and would have been useless for hiding anything in.) Bill

2 1

Re: DES Question
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Matthew Ghio writes: > When using DES to encrypt email addresses, the total amount of data to > be encrypted would be only 3 or 4 eight-byte DES blocks. My question > is: Would CBC or CFB really be effective for such a small amount of data Assuming you're using a random initialization vector rather than zeros, yes, CBC or CFB should be quite effective - the first real block is essentially XORed with random junk, though of course if they guess the right key they can check that the block comes out reasonably. But it does prevent a brute-force attack where they decrypt and see if they get ASCII, since they first block is random junk - they're forced to decrypt at least two blocks of data, which is somewhat annoying for brute-force-search machines. Bill

1 0

Re: ditz in office
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

(I voted Libertarian, of course; back in '84 I had wasted my vote on (yuk) Mondale because he was the closest to a credible threat to Reagan, and it only encouraged them to get another useless Democrat the next time. If there hadn't been a Lib running, I would have probably voted for Perot just for the chaos factor, though I didn't particularly trust him.) I had, however, hoped that Clinton, as a tax&spend Democrat, would at least bring in some of the Liberal virtues along with the Liberal vices, which would be better than a George Bush who had the vices of the conservatives with none of the virtues. Unfortunately, I've been disappointed, in spite of how low my expectations already were :-) Somebody who favors national ID cards, concentration camps for non-violent political offendors, allowing the Federal cops to burn down the homes of uncooperative religious groups if they won't surrender, restrictions on free speech to keep the cops happy, wiretaps for everyone, and stuff like that is *clearly* no liberal. Some columnist, probably George Will, described him as a "passionate hypocrite", which seems to fit reasonably well. I'd hoped for someone genuinely passionate about something, and I don't see that in him. (Nobody could describe George Bush that way, of course, since the man's clearly not passionate about anything....) Bill Stewart, ranting about politics again....

1 0

Applied Crypto
by fhalper＠pilot.njin.net 17 Dec '03

17 Dec '03

Does anyone know if Project Guttenberg(or anyone else) has electronic books such as applied cryptography? Thanks, Reuben Halper

3 2

Re: Dorothy Denning
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

I objected to Anthony Ortenzi's article on Dorothy Denning. Much of the attacks seemed appropriate for a politician like Clinton (:-)), but aren't appropriate for an academic who's doing politics about technical areas, where there so much more *useful* ways to flame her ideas, rather than her character. > Number 1, if someone is an encryption expert [...], why would they endorse > anyone but the recipient being able to decode the message? You're confusing technical tactics with political/social goals. She's an expert in what you can do with encryption, she just has different values about who should be able to benefit from it and how. > Number 2. [Newsday...] > The argument was just very, well, flimsy is the word I guess. I thought so too. Part of it was from writing for a non-technical audience, but some of her arguments have been appallingly weak. El Rukn was a particularly bad example :-), and as you say, it would be nice if she'd just come out and say the government should spy on all of us to keep us from doing Bad Things; it's an argument people can relate to and discuss (though it'll get a lot of negative reaction, which is not her objective.) > Anyone know: > A) Is she an expert in cryptography? Yes - her book from the early 1980s was *the* standard text on crypto for quite a few years, and she's published some other reasonable papers. Dr. Denning is department head of CS or EE or something at Georgetown. > C) Was she dropped on her head a lot as a baby? Probably got scared by a Commie Terrorist Drug Dealer, and comforted by some friendly federal police officer... or else was educated in government-run schools. :-) > Also, I've gotten a message through to Ross Perot about our fight > against Clipper, and how to reach me, so if I get a response, I'll let Clipper sounds like just the kind of thing Perot would enjoy. Bill

5 4

Re: The answer.
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> I think I have found the way to end all our problems: ESP. No good - the KGB has top psychics working for them, and the CIA has been working for years to keep up. I read it in the newspaper in the supermarket, so it must be true! Bill

2 1

Re: Insecurity of public key crypto #1 (reply to Mandl)
by Eric Johnson 17 Dec '03

17 Dec '03

: >Only "sensitive" information is worth encrypting and if you want to : >stay out of trouble you don't go giving sensitive information to : >someone you don't know. : : If part of your communications are encrypted and part are not you have : sent the message about what information is sensitive and what is not. : This difference in encoding is a fir-class message in it's own right. : : Therefore _all_ communications should be encrypted at all time. It is : no argument against the principle that this is difficult to do at the : current time. : : Eric : Would it not make sense, therefore, to publish a public cypherpunks mailing list key, which is returned with subscription requests? All incoming message cleartext to the mailing list server would then be encrypted in the server's key; not for security, but precisely for the reason you state above. That _would_ create quite a volume of encrypted communications to each receipient of the list. --Eric

3 3

Re: I have FOIA'd the Clipper Key Escrow databases
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Eric Hughes writes: > Should John's FOIA request for the clipper key database work, it > creates a wonderful hole in the entire key custody system. > It would require a legislative act to plug the hole. Not necessarily - they may be able to claim there's a criminal investigation in progress (one of the standard FOIA loopholes) or they may lose the first round if there isn't one in progress so they'd have to go start investigating somebody (for corruption in government, or spies in the CIA, if nothing else is available :-) Since they don't know who the spy is, or who has which phone, everybody's key must obviously be relevant evidence... But it's clearly a fun opportunity. > Now, how many legislators do you know that are going to make a public > record by voting in favor of Big Brother? If the President supports it, why not a bunch of his fellow politicians? Bill

1 0

Large Block DES Newsletter
by ritter＠cactus.org 17 Dec '03

17 Dec '03

Large Block DES Newsletter Vol. I, No. 1 Feb. 28, 1994 Terry Ritter, Ed. Current Standings for the Large-Block DES Proposals: I. NxM DES: A B v v k1 -> DES1 k2 -> DES2 v v C D Exchange Right 4 Bytes E F v v k3 -> DES3 k4 -> DES4 v v G H Falls to meet-in-the-middle like double-DES. Falls to a practical attack by Biham, now called "fix-in-the-middle." II. NxM DES Found Weak Announcement of above. III. Isolated Double-DES 2x construct found weak in original article. The 1x construct: A v k1 -> DES1 v B v km -> XOR v C v k2 -> DES2 v D was found weak by Chris Dodd <dodd(a)csl.sri.com> who pointed out that two different blocks of known-plaintext (A,D) and (A',D') will allow matching (B XOR B') and (C xor X'). (This is similar to Biham's "fix-in-the-middle.") Good going Chris! Also found by Stefan Lucks <lucks(a)namu01.gwdg.de>. IV. Ladder-DES A B | k1 | v v | XOR <- DES1-----| | | | k2 | | v v |---- DES2 -> XOR | | | k3 | v v | XOR <- DES3 ----| | | | k4 | | v v |---- DES4 -> XOR | | v v C D Joseph C. Konczal <jkonczal(a)nist.gov> points out that the construct is indeed vulnerable to meet-in-the-middle. I agree, but note that this seems to imply a 112-bit search. Since we don't need more than 112 or 120 bits of strength, I don't see it as a problem. (Indeed, if we could get more strength, we might want to trade it for speed anyway.) 112 bits (or so) is the design goal, which should be enough for a couple of decades. In a normal cipher design, I would expect each key bit to contribute toward strength, but these are hardly normal cipher designs. Especially when we try to expand block size, extra keys may simply provide another small block with the same strength as a previous small block. Keys will be delivered electronically, so the relatively rare delivery of 2x or 4x or even 8x the expected key material should not pose a serious problem. However, Biham reports: "ladder DES is not more secure than 2**88 steps and 2**64 chosen plaintexts." Now, 2^88 cipherings is 2^32 times as strong as the 2^56 currently in DES (and larger than Skipjack), but hardly the 2^112 intended. For the current design the current options are: 1) live with the 2^88 strength (so far!), 2) design the rest of the system to prevent chosen plaintexts, or 3) prevent more than, say, 2^32 block cipherings under a single key. Actually, we need to know exactly what the problem is, and the limits of it, before we can propose a fix, or decide whether the ladder-DES scheme is unfixable. Summary Three substantially different constructs proposed; of these, two fall, and one is wounded. To review, the intent is to find some relatively-simple construct which builds on the assumed strength of DES to deliver wide blocks and something like 112 bits of strength, with less processing than triple-DES. (I see no need for super-strength, unless it is free.) We still do not know whether or not this is possible.

1 0

Fax / Modem question
by fnerd＠smds.com 17 Dec '03

17 Dec '03

(Please respond to this question by private email.) Is it possible to set up most fax/data modems to be ready to receive calls from either fax machines or data modems? If so, in this mode, does it make the beep that sets a calling fax machine going, or does the caller have to push a button to initiate the connection from his or her side? Ditto for data. Doesn't the answer side usually put out the first beep? -fnerd please reply to: fnerd(a)smds.com - - - - - - - - - - - - - - - blue mass, Pharm. a preparation of metallic mercury with other ingredients, used for making blue pills. -----BEGIN PGP SIGNATURE----- Version: 2.3a aKxB8nktcBAeQHabQP/d7yhWgpGZBIoIqII8cY9nG55HYHgvt3niQCVAgUBLMs3K ui6XaCZmKH68fOWYYySKAzPkXyfYKnOlzsIjp2tPEot1Q5A3/n54PBKrUDN9tHVz 3Ch466q9EKUuDulTU6OLsilzmRvQJn0EJhzd4pht6hSnC1R3seYNhUYhoJViCcCG sRjLQs4iVVM= =9wqs -----END PGP SIGNATURE-----

1 0

Re: Dorothy Denning
by fischer＠charybdis.prl.ufl.edu 17 Dec '03

17 Dec '03

> I recall a profile of the Dr's Denning in one of the > popular cracker/phreax exposes, (maybe in Markov/Hafner?) > > Andy I believe you are referring to Bruce Sterling's "The Hacker Crackdown", interesting book because Sterling sympathetically presents many sides: paranoid telco's, testosterone-poisoned adolescent hackers, hand-wringing cops (Dr. Denning is presented in this milieu) and (my personal favorite) the "information wants to be free" libertarians. Randy Fischer

1 0

PGP on the HP 100
by smb＠research.att.com 17 Dec '03

17 Dec '03

Has anyone tried putting ViaCrypt PGP on the HP-100? Is anyone but me crazy enough to contemplate it? How abysmal is the performance? --Steve Bellovin

2 1

Cryptography Articles in April 94 Dr Dobbs Journal
by schneier＠chinet.com 17 Dec '03

17 Dec '03

Check out the April 94 issue of Dr. Dobbs Journal. There are four articles on cryptography, and a cryptanalysis contest. The first article is by myself, about the Cambridge Algorithms Workshop last November. The topic of the workshop was high-speed encryption, and ten complete algorithms were presented. The article discusses the workshop, briefly mentions the algorithms, and talks a little about designing secure algorithms. The second article, by Peter Smith, talks more about the LUC cipher. If you remember his article in the Jan 93 DDJ, LUC is an RSA variant that uses Lucas functions instead of exponentiation. Even though Smith claims to have invented this scheme, it has been around since the early 1980s (see p. 318 of my book). In any case, it's a good article. William Stalling's article is about SHA. It explains how the algorithm works very nicely. (If this is any indication of how his new book will look, I am looking forward to it.) And finally, I have an article describing a new secret-key algorithm: Blowfish. I presented Blowfish at the Cambridge Workshop. The article includes a description of the algorithm and source code (that hopefully will compile on any machine--call me if you have problems). DDJ is sponsoring a cracking context for Blowfish. You don't have to break the entire algorithm, just finding a weakness is sufficient. The best attack received by 1 April 1995 wins. Awards are $750 for first place, $250 for second, and $100 for third. Subscribers should expect to receive their copy of the magazine in a week or so, and newsstand copies will be available by mid- March. Bruce ************************************************************************** * Bruce Schneier * Counterpane Systems For a good prime, call 391581 * 2^216193 - 1 * schneier(a)chinet.chi.il.us ************************************************************************** >From owner-cypherpunks Tue Mar 1 13:49:25 1994

3 2

Colorado Cypherpunks meeting
by nates＠netcom.com 17 Dec '03

17 Dec '03

2 1

Applied Crypto
by m＠BlueRose.com 17 Dec '03

17 Dec '03

Project Guttenberg has only books that are in the public domain e.g. very old books. I suspect that Bruce Schneier (and the publisher) would like people to buy Applied Cryptography. I found it to be worth the price. M Carling Begin forwarded message: Date: Tue, 1 Mar 94 18:45:49 EST From: fhalper(a)pilot.njin.net (Frederic Halper) To: cypherpunks(a)toad.com Subject: Applied Crypto Sender: owner-cypherpunks(a)toad.com Precedence: bulk Does anyone know if Project Guttenberg(or anyone else) has electronic books such as applied cryptography? Thanks, Reuben Halper

1 0

Re: Colorado Cypherpunks meeting
by russw＠netcom.com 17 Dec '03

17 Dec '03

At 13:30 3/1/94 -0800, Nate Sammons wrote: >This saturday, the 5th of March, at 7:00pm in the Penny Lane >coffee shop, there will be a Colorado Cypherpunks meeting to >discuss the recent Clipper/Skipjack/FBI DTB problems. > >Please tell anyone in the area (Colorado) who is interested to >please show up. It's on the South-west corner of 18th street >and Perl. > Nate, I know people in Colorado who would be interested in going... if you told them what city it might be in. Denver? Russell Russell Earl Whitaker russw(a)netcom.com Director, Extropy Institute 408-366-5435 ================================================================

1 0

the nsa
by nobody＠soda.berkeley.edu 17 Dec '03

17 Dec '03

we of the cypherpunks mailing list certainly admire the nsa, perhaps more than any other agency anywhere in the world. because of this admiration, i would like to have a large, color jpeg of the director of the nsa. i will uuencode this and mail it to many many people. could someone post such a jpeg to cypherpunks, or perhaps point me to where i might find one, or point me to a book or magazine that would have one, so i can scan it in? it's ok if the image is a bit noisy. thanks, nobody

1 0

Standards for Steganography
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

There are basically three classes of things you can hide 1) Plaintext easily-recognized payloads 2) Encrypted payloads with easily-recognized forms, e.g. PGP 3) Encrypted payloads that looks like random noise unless you have the key. (e.g. stealth-PGP or other cryptosystems that don't self-identify.) The definition of "easily-recognized" is obviously context-dependent, depending on your threat model. The proposed stego programs are mainly A) Programs that simply insert the payload, no frills except padding the ends B) Programs that insert the payload with length-markers and checksums C) Programs that encrypt the payload while inserting it D) Mimic functions that adapt the real bits to a given set of statistics Type A stego is fine for Type 3 data, as long as the statistics of the file you're hiding data in make random bits believable. It's obviously not much use for Type 1 data, and only some use for Type 2 data, if you're worried about the Bad Guys knowing that you're sending secret messages (and you probably are, else why bother with stego?) So if you're using Type A stego, make sure you use Type 3 random-looking payloads. Type B stego is a dead giveaway, like Type 2 payloads, if the Bad Guys are looking for it. If you're using encryption programs that do some kind of verification (at least if you have the right key), then you don't need these functions. Sure, the Bad Guys have to do the checksum themselves, which takes some work, but they now have a 256:1 or 64K:1 or whatever certainty there's stuff there. Type C stego programs are ok, if they're sufficiently high-quality, but they have to provide most of the functions of a good encryption program. It makes much more sense to use a software tools approach and separate the encryption from the steganography - if the encryption function doesn't advertise itself blatantly. If you just use a wimpy encryption function (e.g. XOR all the data with 10101010 or a PRNG), it stops wimpy Bad Guys at the cost of annoying the rich competent Bad Guys. The main usefulness of this is for Type 2 payloads, e.g. current PGP, but it's probably better to use Stealth-PGP instead. Type D stego can be useful for cases where the host material doesn't look right if you throw in random bits, and you seriously need to hide something. It's probably most effective with random- looking data (Type 3 payloads); with Type 1 or Type 2 the steganized message will tend to start the same way each time, which is bad, and if you need the quality of data hiding that mimic functions give you, you need a high-quality encryption program as well. All this stuff is essentially saying that you should use simple stego programs and stealthy encryption programs. Among other advantages, it means that you *can* standardize on stego programs without risking the attention of the Bad Guys, and it's much easier to agree on a standard with almost no options than to waste time on the infinite choice of details that you can haggle about with Type B stego - especially since those systems really tend to need good stealthy encryption as much as Type A stego does. Bill

1 0

Colorado cypherpunks meeting -- city
by Jonathan Corbet 17 Dec '03

17 Dec '03

> This saturday, the 5th of March, at 7:00pm in the Penny Lane > coffee shop, there will be a Colorado Cypherpunks meeting to > discuss the recent Clipper/Skipjack/FBI DTB problems. > > Please tell anyone in the area (Colorado) who is interested to > please show up. It's on the South-west corner of 18th street > and Perl. For all of you who haven't heard of Penny Lane...it's in Boulder, on *Pearl* street (frueidan slip there, Nate?). This is about your last chance to check out this place -- it's being booted so that we can have another Starbuck's or some such. Such is life in Boulder these days. (Insert sanctimonious old-timer's sigh here). If I can explain to my wife that one night I'm staying late thrashing up the systems, the next I'm brewing beer with a friend, and the following I'm going to a cypherpunks meeting I'll be there. Jonathan Corbet National Center for Atmospheric Research, Atmospheric Technology Division corbet(a)stout.atd.ucar.edu http://www.atd.ucar.edu/rdp/jmc.html

1 0

Insecurity of public key crypto #2 (reply to May)
by nobody＠soda.berkeley.edu 17 Dec '03

17 Dec '03

## As many of you know, I believe such a protocol exists. :-) and as many of us believe, you're full of it... and what about the STS protocol that's been presented on the list before?? unless you publish, no one has any good reason to believe you...

1 0