December 2003 - cypherpunks-legacy

Re: Digital Watermarks for copy protection in recent Billbo
by Alex F 17 Dec '03

17 Dec '03

> Sniffers aren't much effort, and if I sniff your tagged purchases and > put them out over the net anonymously, they are traced to you. Actually I was thinking more along the lines of physically stealing, but if someone sniffed an electronic transfer of a record then the laws would become even more useless as far as enforcement goes. > Probably, but the Billboard article discussed using CC numbers as an > ID in the online watermarked transactions. Doesn't mean they were > correct, of course. Considering that their sources are probably more reliable (even though less knowledgable), and considering the idiocy of such an idea, I would risk saying that they are right :) > AFAIK, most "bootlegging" is of unreleased concerts or out-takes. > Digital watermarks would be of little use. There are solutions to this that work. 1) The Greatful Dead approach - let everyone bootleg live shows. Who cares? 2) The Frank Zappa Approach - take the bootlegged copies, use better equipment, and possibly your own soundboard recordings of the same show, and put them out yourself. Since you are capable of putting out a better product sonically, then beat them at their own game ("Beat the Boots") Alex F =-=-=-=-=-=-=-=-=-=-=-=-=- Alex F alexf(a)iss.net Marketing Specialist Internet Security Systems =-=-=-=-=-=-=-=-=-=-=-=-=-

1 0

Re: Netscape
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 16:07 7/23/96, Tom Weinstein wrote: >The Deviant wrote: >> >>> You should only break rules of style if you can | Tom Weinstein >>> coherently explain what you gain by so doing. | tomw(a)netscape.com >> >> Style is standing up for what you beleive in. Netscape obviously has >> none, or they would be activly fighting the ITAR. > >Anyone who believes that Netscape is not actively fighting ITAR is a >fool. Amen. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

1 0

Cracking DES or building a DES cracking machine?
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Hm, If we are talking about convincing 100,000 people to donate a lot of their CPU time, would not it be possible to convince the same 100,000 people to donate $10 each and build a $1,000,000 DES cracking machine? Then we can crack DES keys for a certain sum per key, without asking any unnecessary questions. Profits can be donated to purchasing AK-47's for poor preschool children or some similar charitable project. - Igor.

3 2

Schelling Points, Rights, and Game Theory--Part I
by tcmay＠got.net 17 Dec '03

17 Dec '03

Part I I thought I'd write a brief piece on a very interesting angle on "rights," especially given the discussion recently about rights of privacy, children's rights, parent's rights, the role of schools, gun rights, and so on. This also shows the role of game theory, imperfect as it is. (I mention "imperfect" because some have mentioned that game theory does not explain things perfectly...of course not.) Here's a simple example of what a Schelling point is: Alice and Bob decide to meet on Friday in the Washington, D.C. area. They forget to say when and where. Is it hopeless? Can they find each other? Given the millions of places they could be, and the hundreds or more of time-slices to consider, e.g. "10:23 a.m., 345 Crestwood Drive, Arlington," how could they ever meet? Well, there are certain "mutually more probable" times and locations. Absent any time specification, "noon" is what each will expect the other to also think of. (Followed perhaps by 6 p.m., and other on-the-hour times.) And absent any location specification, there's a short list of likely places: NSA headquarters (after all, Alice and Bob are well-known there), in front of the White House, at the base of the Washington Monument, at the entrance to the Air and Space Museum, on the steps of the Supreme Court, etc. I'd say they have about a 10% chance of finding each other, absent any prearrangement. (In smaller cities, the probabilities are even higher, as the central plaza is a major Schelling point for such encounters.) The game theorist Richard Schelling developed this notion, circa about 1960. There are analyses based on "algorithmic information theory," a la Chaitin and Kolmogorov, which I find appealing, to wit: a Schelling point has a shorter "description" in terms of mutually-known building blocks than non-Schelling points. Thus, "noon in front of the White House" has a shorter description, or is more "compressible," than is "10:23 a.m., 345 Crestwood Drive, Arlington." (Don't think in terms of just ASCII characters, but in terms of readily recallable building blocks.) How does this relate to rights? This is more controversial, and less-developed. David Friedman gave me a paper he's done on this..."Schelling points" are a Schelling point between us, as it were. Part II will get into this briefly. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Brute-forcing DES
by pjn＠nworks.com 17 Dec '03

17 Dec '03

> Any one up for a distributed brute force attack on single DES? My > back-of-the-envelope calculations and guesstimates put this on the > hairy edge of doability (the critical factor is how many machines can > be recruited - a non-trivial cash prize would help). >> Count me in. I've got a couple of net-connected Pentiums that are >> mostly idle. Although I dont have a pentium, I would be glad to put forth some computer power to help. >> Might be able to bring some money in by selling "I Helped Crack DES >> And All I Got Was This Lousy T-shirt" T-shirts. Id buy one! :) P.J. pjn(a)nworks.com ... I helped crack DES and all I got was this lousy Tagline. ___ Blue Wave/QWK v2.20 [NR]

3 2

Question
by pjn＠nworks.com 17 Dec '03

17 Dec '03

OK...A question for you all: If it is illegal (by our governments standards...) to export programs like PGP, etc., and you can send the whole source code in a message because that is also considered illegal, then could you send the code, broken up into many pieces, and send THAT in Email, would that be illegal? (Wow...All in one sentence... :) P.J. pjn(a)nworks.com ... I am Jesus of Borg. Blessed are they who are assimilated. ___ Blue Wave/QWK v2.20 [NR]

2 1

M$NBC covers "Fear of a Hack Planet" and "Hate Goes Online"
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At the risk of giving M$NBC more attention than it deserves... BillG's latest misadventure editorializes on free/hate speech tonight at 7 and 10pm. Current and past fluffage at http://www.thesite.com/cgi/worl.cgi There's also a blank message area for "Would you bank through your computer? Do you think the technology is secure enough?" but no story. Maybe that's tomorrow. - -rich http://www.c2.org/~rich/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMfUvjpNcNyVVy0jxAQF9pgH/cYKc2FlkNt9xD1MFXHnMg9tshZsVqKjW O7ZYEyDOxutgBTgNoDkW2VA1FqkKioqxDGjurvUJmuvRGBu3E2GOfA== =bFqb -----END PGP SIGNATURE-----

1 0

Re: Netscape
by nobody＠vegas.gateway.com 17 Dec '03

17 Dec '03

david(a)sternlight.com wrote: >At 5:09 PM -0700 7/22/96, Ted Anderson wrote: >>shamrock(a)netcom.com (Lucky Green) writes: >>> At 15:27 7/20/96, Tom Weinstein wrote: >>> >Why not consider what the consequences will be? Do you seriously >>> >believe that this will make the government stop enforcing ITAR? Do you >>> >believe it will make them change the law? No. What it will do is make >>> >them remove our permission to distribute this stuff. >>> >>> I doubt that. PGP has been distributed for years with less safeguards >>> than Netscape. It is available on more free-world sites than Netscape >>> US. This did not prompt the powers that be to force MIT to take down >>> their site. >>> ... >> >>I must agree with Lucky. I am quite sure that even if Netscape was not >>begin distributed over the net, copies would still be uploaded to >>international sites by folks practicing Civil disobedience. > >To call simple lawbreaking by cowards working in secret "civil >disobedience" is to defame the name of Gandhi, King, and all the legitimate >protesters of modern history. Civil disobedience must be seen publicly, and >must be done by observable individuals. Masked men throwing stink bombs is >not civil disobedience--it's hooliganism. As I have said before, European & other foreign users, who get the strong- crypto version should pay Netscape what they owe Netscape, to keep the ITAR as the issue, and not piracy. These are two separate issues, and if necessary the foreign users can mail anonymous cash [the paper kind] to assuage their consciences. Not all will do this, of course, but that's another example of ITAR losing US companies $ again. Lucky is, as usual right. There is a double standard for PGPdistribution vs other strong crypto distribution, and Tim is also right that this GAK-loving info-disclosure requirement sets a *really* lousy precedent for later software distributions. Pelease deal with issues separately. me

3 2

No Subject
by Bill Stewart 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks From: Bill Stewart Date: 7/23/96 Tim wrote: >| More realistically, 1000+ list members x 10% who make plans to >| contribute x half of these who actually follow through x $10 = $500. >| (If that....) >| Prizes have their place, but are hard to set up properly. All right, $100 to the winner, by the end of 1996, for a reasonably-convincingly-non-rigged public crack of DES, whether it's from a net-run or screen-saver effort, a DES cracker using fancy special equipment, supercomputers, microcomputers, DES chips, or Gate Array chips. $100 extra bonus if the winner is from the NSA or FBI (Black-bag jobs, rubber-hose cryptanalysis, and subpoenas all count as rigged - sorry :-) At 08:46 AM 7/23/96 -0500, Adam Shostack <adam(a)homeport.org> wrote: > A better way to set up a prize is to find a few big companies >willing to sponsor such a demonstration. AT&T, Nortel, RSA, Netscape, >Microsoft, Qualcomm, and many other companies have an interest in >seeing stronger than DES crypto exportable. Perhaps one of them could >set up a prize, similar to netscape's Bugs Bounty, or the RSA-129 >challenge. Perhaps cracking 56-bit DES would count as a new bug for Netscape's existing Bugs Bounty? Bill Stewart -----BEGIN PGP SIGNATURE----- Version: 2.7.1 Comment: PGP available outside U.S.A. at ftp.ox.ac.uk iQBVAwUBMfWVOPthU5e7emAFAQG99QIAlKIBWs8ynr00uincnNBCymdz2E8CrlL3 MhCndNxOgpFIkjvJSdHNT+4alt2hsgU3fMlK8xWOK56R8WxdkTZvMw== =GesG -----END PGP SIGNATURE-----

1 0

RE: [Noise] was Re: Giving 6 year old kids Uzi's
by Bill Olson (EDP) 17 Dec '03

17 Dec '03

Perry E. Metzger writes: > > >"Bill Olson (EDP)" writes: >> I don't care if it takes my son 6 years to get through 2 grade levels, >> anyone who allows there kid to pack a gun (or a rifle?) should get their >> head examined > >Why? What, objectively, is wrong with allowing, say, a twelve year old >to go plinking with a .22? Lets not hear vitriol -- lets just hear >cold hard reasons not to allow it. > >Myself, I'd say that it appears that there is no good objective >reason. > >Perry I find nothing wrong with plinking. Hell, I'm from Montana--we used to go shooting all the time. But when the shooting was done, the guns were put away. What I find disturbing is that a child is taking it to school, or just carrying it around. I say that any parent who thinks their child is mature enough to carry a gun for non-recreational reasons is less mature than the child. In fact, I'd go so far as to say they are a danger to their own children. I guess I don't really have to worry too much, though. It is illegal for children to possess such items publicly, and any parent who condones it is simply breaking the law. I don't blame the child, I blame the moronic parent who let's it happen.

1 0

Re: Bare fibers
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:56 PM 7/23/96, Bill Frantz wrote: >At 12:30 AM 7/23/96 -0500, Douglas R. Floyd wrote: >>Not really sure how. I have had heard of ways to tap a fibre optic link >>noninvasively, but its not related to Van Eck or anything like that. > >You could break the fiber and add a repeater (if you know enough about the >light protocol). Plastic fiber can be cut with a pocket knife, glass >requires a machine which will make a square cut and polish the end. Those >machines are not yet cheap. Fibers can be tapped noninvasively, and without cutting them, by placing detectors in direct proximity to the fiber. That is, touching the glass or plastic. For fibers relying on total internal reflection at the fiber boundary, the waves actually partly exist beyond the boundary (with an imaginary component). Another fiber or a detector placed near this boundary can make this imaginary component become "real," and hence detect the wave. This is "tunneling," of course. (A simple demonstration is done with a glass prism reflector, a reflector relying on total internal reflection. If a symmetrical prism is placed up against the first prism, the "total reflector" ceases to be.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

DES-busting Javanese pagers and TVs
by Deranged Mutant 17 Dec '03

17 Dec '03

On 23 Jul 96 at 15:53, Timothy C. May wrote: [..] > A while back I proposed one approach: a brute force "screen saver" for > Windows machines. Other platforms, maybe, but the most cost-effective thing > to do is to go after the Windows market only. How about applets for java-aware pagers or tv-sets that will supposedly show up in the near future? When a crack is found, you can call a toll-free number, give them the code, and win a prize (ala Chinese-lottery). Would it be better to have them all try random keys rather than use assigned keyspaces? Can't keysearches be shorted by half (not that it's that significant, 2^55 rather than 2^56) using complement keys? First thing one should check are the weak and semi-weak keys (a good implementation will avoid them, but that doesn't mean one shouldn't check for them). [..] > Acquiring chunks of keyspace remains an issue, but I think we resolved a > while back that a probabalistic method works OK: people just pick chunks at > random, and the decreased efficiency as compared to perfect scheduling is > something like a factor of a couple (I have the numbers I calculated > somewhere, and I recall Hal Finney made the same estimate). > > Some means of communicating results--especially wins!--is still needed. > This is where Perry's idea of a Java program is a good one. Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

2 1

new bbs
by SOMSER BBS 17 Dec '03

17 Dec '03

You are going to receive a week to all our areas for free. You will have access to all the files of our BBS (Except Adult) for one hour each day. Your week will expire on 30-7-96 ID 25324 PASSWORD 19062 Le hemos obsequiado con una semana gratuita a nuestro bbs Podra acceder a todas las areas excepto a las de adultos La semana gratis termina el 30-7-96 NOMBRE 25324 CLAVE 19062 WEB (SOMSER BBS) This BBS is being operated in Spain and its address is http://www.somser.hnet.es (194.177.1.171) We are now in a test period and operational every day from 20:00 to 05:00 GMT and from 10:00 to 13:00 GMT. 20.000 files. 10 GB on disk. No CDROM 50 news files per day plus 200 areas. Welcome! Be our guest! ====================== We would be thankful if you send your opinion and your comments to the sysop in order so the BBS can be improved. If you desire a utility or program that you don't find leave a message to the sysop and we will attempt to get it. Hundreds of stages for DOOM, HERETIC, DESCENT, SIMCITY, SIMTOWER, WARCARFT, etc. WEB (SOMSER BBS) Nuevo BBS que es un BBS, el primero que existe en España La dirección es: http://www.somser.hnet.es (194.177.1.171) Estamos en periodo de pruebas y está en funcionamiento desde las 22:00 a las 8:00 y desde las 12:00 a las 15.00 GMT Tenemos más de 20.000 en disco. 10GB sin CDROM 50 ficheros nuevos cada día. Más de 200 areas diferentes. Estais invitados, esperamos vuestra conexion. Agradeceria que dejaran su opinion y sus comentarios al sysop para poderlo mejorar. Si desea una utilidad o programa que no encuentra deje un mensaje al sysop e intentaremos conseguirla Cientos de escenarios para los juegos del DOOM, HERETIC, DESCENT, WARCARFT, SIMCITY, ETC. HERETIC, DESCENT, WARCARFT, SIMCITY, ETC.

1 0

Re: passphrase and Diceware [was Re: Length of passphrase beneficial?]
by reinhold＠world.std.com 17 Dec '03

17 Dec '03

>The author of the Diceware system is Arnold G. Reinhold and can be contacted to reinhold(a)world.std.com >He has three pages: The Diceware Passphrase home page (html), The Diceware >WordList (ascii) and a text with the technical rationales behind the list >(ascii) >I don't remember the URL, sorry >Greeting, >Jean-Paul > >~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~- >Jean-Paul et Micheline Kroepfli >eMail: JeanPaul.Kroepfli(a)utopia.fnet.fr The Diceware Passphrase home page: http://world.std.com/~reinhold/diceware.page.html The Diceware WordList: http://world.std.com/~reinhold/diceware.wordlist.asc Technical rationales behind the list: http://world.std.com/~reinhold/diceware.txt Other stuff that may be of interest, including a survey on PGP passphrase usage and a rant on why p=?np has nothing to do with crypto: http://world.std.com/~reinhold/papers.html Regards, Arnold G. Reinhold reinhold(a)world.std.com

1 0

RE: [Noise] was Re: Giving 6 year old kids Uzi's
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:54 PM 7/23/96, Bill Olson (EDP) wrote: >I find nothing wrong with plinking. Hell, I'm from Montana--we used to >go shooting all the time. But when the shooting was done, the guns were >put away. What I find disturbing is that a child is taking it to school, >or just carrying it around. I say that any parent who thinks their child >is mature enough to carry a gun for non-recreational reasons is less >mature than the child. In fact, I'd go so far as to say they are a >danger to their own children. > >I guess I don't really have to worry too much, though. It is illegal for >children to possess such items publicly, and any parent who condones it >is simply breaking the law. I don't blame the child, I blame the moronic >parent who let's it happen. I'm _still_ missing the reference here? Just who *seriously* is proposing that 6-year-old children carry guns to school? (I emphasize "seriously* because there is a big difference between seriously proposing this and obviously making a joke, a la "I say we issue them guns after a basic safety class in Kindergarten." And I think someone's (maybe Brad Dolan's, if I remember correctly) point that his daughter carries a gun at school was followed immediately by mention that she is home-schooled, i.e., at his home.) I can imagine certain circumstances in which children could be armed--attacking terrorists on a ranch, Indians, etc.--but no public school in the United States, and probably not any private schools (K-12), allow loaded guns to be carried to schools. I'd love to see this "stupid gun thread" (to use Ernest Hua's term) die, but it keeps living on because some here are mischaracterizing the claims of others. Look, handing out guns to kids playing cops and robbers at age 6 or 8 or even 10 is probably a bad idea, but training kids at even a very young age to respect guns and to understand their dangers and limitations--and their advantages--is proably a good idea. In any case, the hoplophobia of some parents is not adequate reason to stop other parents from training their children under carefully controlled conditions. Getting a carry permit is not easy in any state in the U.S., so the fears that 6-year-olds are openly carrying guns to public schools is unfounded. (Young kids carrying guns to schools _secretly_ is of course a problem. Many of them carry crude guns out of fear that other kids are carrying guns. The proper solution for a kid committing a serious crime with a gun is to severely punish the child--I see no reason why a 14-year-old who murders someone should not get the brand of justice I favor, namely, a fair trial, no appeal except on substantive grounds, and a quick execution if determined to be guilty of first degree murder.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: Decrypt Unix Password File
by Bill Stewart 17 Dec '03

17 Dec '03

At 06:46 PM 7/23/96 +0800, Jerome wrote: >How can I decrypt Unix password file? Get the source for a a Unix-compatible password encryptor, reverse it to make it a decryption program, take the line for a user from the password file, decode it from printable-ASCII format to the binary value, and enter the user's password. If you've written your programs correctly, you'll get the original secret value*. If this secret value is less than exciting to you (:-), try lots of things that might be the user's password, and one of them will work. Exercises for the reader: 0) What's a "shadow password file"? Does it affect the methods described above? 1) Since you know the secret value, you could try using your existing Unix password software and seeing if you get the correct encrypted value when you put in the correct password. 1A) Does this suggest some more useable algorithms? 1B) What does the Unix manual page for crypt(3) say about it? 1C) Can you implement a program that does this successfully? 1D) How many tries do you think it will take? 1E) Does anybody on your system use wimpy passwords? 2) Are there any books or papers describing how the Unix Password System works that would help you understand? 2A) Where would you look for them? 2B) Are they on the Web? How would you find out? 2C) Which of the following famous authors of Unix wrote important papers about the topic: Dennis Ritchie? Ken Thompson? Brian Kernighan? Rob Pike? Fred Grampp? Bob Morris Sr.? Jr.? The Brahms Gang? Bill Joy? Matt Crawford? How would you find out? Did they write anything else interesting? 3) Has anyone else implemented any Unix password cracking programs? What countries with very cold weather would have them on popular ftp sites? Are they more effective than your implementation in 1C)? Why? 4) If you're trying to crack passwords on a System V Unix system, why should you always try to crack root's password? [* hex 0000000000000000, I think. ] In a later message, Jerome Tan also wrote: > What is the code of password file of Unix? I have them but don't > know how read them. Any file converter or viewer for that? A) The code is "RTFM" B) The code is "Ask the user" # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Confuse Authority!

1 0

RE: SHI_fty
by Bill Olson (EDP) 17 Dec '03

17 Dec '03

Vinnie Moscaritolo writes: <snip> >>>Uh I think apple had that for a while, it's called cyberdog >>>http://cyberdog.apple.com screw this ole fud. >> >>Very true. But once again, it is not the technology that molds the >>world, but the exploitation thereof. Welcome to capitalism. >>> > >so shit floats...whats your point? Let me spell it out for you: M-O-N-E-Y. Shit floats. Apple doesn't... don't kill the messenger.

1 0

Public briefing on NRC Cryptography Policy Report in...
by CRYPTO 17 Dec '03

17 Dec '03

Subject: Public briefing on NRC Cryptography Policy Report in Boston, August 7 Please post widely.... Cryptography's Role in Securing the Information Society A Public Briefing in Boston, Massachusetts Wednesday, August 7, 1996, 10:00 am to noon There will be a public briefing Boston, Massachusetts by the National Research Council on the report. The briefing will be held at the Gardener Auditorium in the State House in Boston on Wednesday, August 7, from 10:00 AM to 12:00 noon. Check http://www.tiac.net/biz/bcslegal for current information. Authoring committee member Elliot M. Stone will be among the presenters at the Boston briefing. Dr. Herbert Lin, study director and senior staff officer of CSTB, will be present. The Boston Computer Society Legal Group, the Boston Bar Association and the Information Technology Division of the Commonwealth of Massachusetts are co-hosts for this event. Questions from the audience will be entertained, and a limited number of pre-publication copies of the report will be available at that time. For further information, please contact Dan Greenwood at (617) 973-0071 or DGreenwood @ state.ma.us. The event is open to the press and the public. If you have suggestions about other places that the committee should offer a public briefing, please send e-mail to crypto(a)nas.edu.

1 0

RE: No more stupid gun thread ...
by Bill Olson (EDP) 17 Dec '03

17 Dec '03

Ernest Hua writes: > >Ok. This thread has gone on long enough and covered just about every >point except the one which I originally made in my first response, >which is that I abhor the idea that kids should carry weapons (of any >sort) to school as standard equipment. In fact, I abhor the idea >that kids should carry weapons at school for any reason. > >Enough said. > >I do not care to discuss: > >1. Should kids have any weapons at any time? > >2. Should kids have guns (specifically guns)? > >3. Should kids know how to operate weapons of any sort? > >If any of you really really have to discuss this issue, let's spare >the rest of the list and send me E-Mail directly. > >Thanks! > >Ern Who died and left you in charge?

1 0

Re: Digital Watermarks for copy protection in recent Billbo
by jim bell 17 Dec '03

17 Dec '03

At 05:03 AM 7/24/96 -0700, Timothy C. May wrote: >>Not familiar with the Nyquist limit w/ regards to sampling rate vs >>frequency :( > >Check any textbook, or even a good dictionary. Basically, it says that one >must sample at more than twice the frequency of the highest frequency to be >reconstructed. Thus, a 20 KHz top frequency needs at least 40 K samples per >second. The exact number is, I think, about 2.2x the freqency, which is why >CDs were standardized at 44 K samples per second per channel. No, Tim, the minimum Nyquist sample frequency _is_ precisely 2.000 times the highest frequency to be recovered. However, what is somewhat less well-known is the fact that in order to keep higher frequencies from being "aliased" (reflected to lower frequencies by heterodyne processes) it is necessary to remove (by filtering) any frequency content above that maximum, before sampling is done. Real-world filters (at least, _economical_ ones) do not have instantaneous cutoffs, so it is necessary to provide a little margin, in this case about 10%. Fortunately, a play-only CD only needs output filters, and the input data (the CD disk itself) has already been limited to about 20 kilohertz, so its requirements are not so stringent. The reason so-called "oversampling" started to be done on CD players is that interpolating digitally between samples results in a far higher aliased noise frequencies, allowing either better performance with the same-quality of filters, or equal quality with lower-cost filters, or a combination of them both. Jim Bell jimbell(a)pacifier.com

2 1

Re: [Noise] Hettinga Sees Colors...
by Duncan Frissell 17 Dec '03

17 Dec '03

At 01:20 PM 7/22/96 -0400, Robert Hettinga wrote: >Anyway, I was standing there at the monument to the British war dead ;-), >and said to the kids (ages 15, 13, and 11), "Guys, right here, on this >spot," (they looked down) " is were America [sic] started. If you could >imagine the ground here painted red, white and blue, and then the colors >radiating out from here in all directions", (they looked around) "from the >Atlantic to the Pacific, to Alaska and Hawaii, and bunch of islands in both >oceans. Oh, yeah. Even the Moon." Then they looked up. By the rude bridge that arched the flood, Their flag to April's breeze unfurled, Here once the embattled farmer's stood, And fired the shot heard round the world. See also: http://www.inc.net/~fhs/littour/bridge.html Relevant to cypherpunks because to steal from Nelson Thall of some Marshall McLuhan Institute in the latest Wired: "Ultimately, the power of the Internet is that it makes you think like a North American. It allows the entire world to think and write like North Americans. This is the agenda of the Internet. It goes along with NAFTA." An *why* is it vital that the world become like 'North Americans' (or, as we non-Canadians would say 'Americans')? See my follow-up message. DCF

1 0

A Global Village; an open letter to Bill & Hill and also Mr. & Mrs. Dole, from Asim at Molecule One. Cypherpunks, please excuse this note.
by molecul1＠molecule1.com 17 Dec '03

17 Dec '03

Honourable wishes, I write about Mrs. Clinton's concept of Global Village and wholeheartedly, pledge my support to such an important concept. The world is everchanging and Mrs. Clinton is correct in that the industrialized countries have lost, most, of their extended families. This makes children vulnerable to danger. If in need of help, such children are commonly abused due to their vulnerability. I want to take this moment to express some understandings. Firstly, it was never in my plan to locate where I have been over the last while. Probably, if it hadn't been for many malicious encounters, I probably would of gone to a remote island, as I hold so dear to my heart. A close friend was severly violated and I had to witness a war being fought against civillians. When an insurance policy becomes more valuable than the human life, something must be wrong with social ethics. To live through many of the experiences I had to, while living here, made me realize high technology is dangerous in many peoples lives. To manipulate peoples decisions using brute force seemed terribly wrong to me. Many of the people controlling the situations are also stressed out. Abuse results from stress. Concerning the old man. I knew of this man since childhood. I always considered him one of the greatest neuroscientists on the planet earth. Even his friends hold him with a greatest respect. What he accomplished, very few could match his accomplishments. I send much thanks to Point Communications for allowing me a long interview about my social concerns. I wanted to personally thank all the K12 students that partook in my interview. I was never able to attend the requests of some of those students, that asked me to review some of their essays, as my time was occupied with endless other obstacles. I want those students to understand that I just couldn't. I want to thank all those cool students that let me participate at their, private, dance parties. They know I attended endless dance parties, researching technological requirements, so they are happy and socially satisfied. I also got to know what kind of social threats they are faced with, both, underground and official. Stress does tend to corrupt some people. I want you to understand that I came up with Molecule One as a means to address the needs of a culture. Even though many plots were directed at me for proposing this project, I always knew I spoke the truth and my intentions were pure. Neurosciences has always been a lifelong inspiration to me. Standards, to improve the quality of life in society, seemed a noble goal. I want the students to know that Molecule One was created for their benefit first. They are the future. When a child remains innocent, that innocence should be protected. Far too often, children loose their innocence to hardend people, who's primary motive is malicious intent. Naivete and innocence is purity and lack of ethical standard is rampent. I knew that acceptance of truth is difficult for some people, especially those ignorant and those conditioned to believe otherwise. I always chose positive as an outcome for motive. I want to thank all of you, Republican, Democrat, and families, friends and which other political inspiration. I respect all life and those standards that can increase the health standard of all people. There are many important factors that must be considered to insure a safe and healthy society, of the future. To work together, to attain this standard, is important for all people, irregardless of color. Care and courtesy, toward our fellow people, is another social characteristic that is becoming lost, with the loss of the extended family. I also want to thank all those cool computer folk that let me play upon the info highway, as it was being developed. I want to thank all those cyberfolk that recognised the import of all topics covered. Understand well, visions of tropical islands have floated through my mind, probably, everyday I've been here. It was my concern for the youth and for the elderly that made me stay and attempt to create a project that could bring happiness and harmony, to the society, for a long time to come. It is a challenge. Thanks for the cyber inspiration, acknowledgement and being allowed the opportunity to create a work of art that can benefit so many. To the 1'st family & 2 Mr.& Mrs. Dole, all friends and families. Peace and best wishes, Sincerely, Asim molecul1(a)molecule1.com

1 0

Re: Another fascist
by Remo Pini 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com Date: Tue Jul 23 14:13:43 1996 It's kind of childish... (And clumsily done, or else David would never have known) - --------< fate favors the prepared mind >-------- Remo Pini rp(a)rpini.com PGP: http://www.rpini.com/remopini/rpcrypto.html - ------< words are what reality is made of >------ -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBMfTB+BFhy5sz+bTpAQGCGAgAvbFSYoLn1aogjB4fIu8RRrCiSVo8zAl+ 9ilpfYQ7jaKnzO8kJsz40NWu4jPTYbgqw7wYbw4e37XYGCLdBAqUT/0SSwCF/id2 nyVLU09vGiAtjZUsLTQRjTd2qF89CwcxcEWtEu3LjTKI8z5QD5L+O8yeh444dXbH Jhu42Cho0gGfAqK8SvzZzX7LDh4N0tQox2s9lc4XqisioBRRI0f4MOEqrOfGz+2/ MWOxaySADXJJ2Xp+yRLhFuH2n92VIenH4lzU2r8dmnGD4/PYoZsE+GSeO5dyohdl cn4gmB57S5aBsu235eCatqMEtk3auqAJfDCaIInX2rlaZS/47TpTQg== =iyK1 -----END PGP SIGNATURE-----

1 0

Re: Another fascist
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:26 PM 7/22/96 -0700, David Sternlight <david(a)sternlight.com> wrote: >One of the great friends of free speech on this list sent a forged cancel >message to the listbot to try to cancel my subscription. >The listbot, being reasonably well designed, ignored him and told me about >it, though I have no doubt less of a dunce could bring it off. >What a piece of slime! What do others think of this practice? Yeah, it's slimy. If somebody wanted to be rude to you personally, they could have sent you flames telling you to go away; if they wanted to be rude to you publicly, they could have imitated many others (:-), and if they simply wanted you to not exist they could have installed procmail or used a killfile-capable mailer like Pegasus or Commercial Eudora and defined you out of existence. If the listbot sends you their name, you could always, umm, escrow them or something..... (In a killfile, no one can hear you flame...) (I have tried to remove people from the list, if they've sent it mail asking to "Unsuscrive" or whatever, but at least for the last long while that's failed; you at least need a half-way attempt at forgery.) # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Confuse Authority!

1 0

Re: Question
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:25 PM 7/23/96, pjn(a)nworks.com wrote: >OK...A question for you all: > > If it is illegal (by our governments standards...) to export programs >like PGP, etc., and you can send the whole source code in a message >because that is also considered illegal, then could you send the code, >broken up into many pieces, and send THAT in Email, would that be >illegal? I don't think this has been spelled-out clearly in the ITARs, much less tested in court, but the intent is clearly to subvert the ITARS. Isomorphic to shipping out a piece of military hardware in pieces, wouldn't you say? And don't forget the "structuring" laws regarding the reporting of cash transactions over $10K. I don't think this has much promise. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Brute-forcing DES
by koontz＠netapp.com 17 Dec '03

17 Dec '03

>>At 3:06 AM 7/23/96, Steve Reid wrote: >>Did you consider the possibility of DES chips in your back-of-the-envelope >>calculations? They are hundreds of times faster than PCs. I don't know >>where to get them or how much they cost, though. I would expect they >>wouldn't be too expensive. The cash might be better spent on DES chips >>than on a prize. >Specialized DES-cracker chips have of course been considered. Actually hardware DES can be thousands of times faster than PCs. The problem with using commercially available DES chips is that you need to load keys, do encrypts and XOR the output with the ciphertext looking for all 0's or all 1's, in a serial fashion. Commercial DES chips don't have the facilities for doing comparisons or loading a new key while encrypting with the previous, not to mention the ability to increment the key value. >The advantage of the cracks done last year, the French and Australian >cracks, and the MIT cracks, were that the "entry costs" for joining the >project were low. >--Tim May The lowest cost entry for hardware crackers would probably be FPGA based (lower NRE). I could design one that would do say 2 - 4 million DES ops per second and cost less than 60 dollars (a PCI interface and cheap card). Anyway, hardware cracking can be done on a smaller scale than Wieners 30 Million DES ops/second, and it could still prove valuable. The good news is that software and hardware efforts are no more incompatible than using different performing machines. If someone steps forward with 1728 Giga DES ops machine, they can have as much of the key space as they can handle. I could probably manage a 100 M DES ops hardware machine before my wife wondered what I was spending the money for the new driveway on (and I would use reprogrammable FPGAs). I would also be inclined to run software on a couple of workstations at home, and an incidental PC or Alpha at work.

1 0

Re: Netscape
by jim bell 17 Dec '03

17 Dec '03

At 09:52 AM 7/23/96 -0700, David Sternlight wrote: >At 5:09 PM -0700 7/22/96, Ted Anderson wrote: >> >>I must agree with Lucky. I am quite sure that even if Netscape was not >>begin distributed over the net, copies would still be uploaded to >>international sites by folks practicing Civil disobedience. > >To call simple lawbreaking by cowards working in secret "civil >disobedience" is to defame the name of Gandhi, King, and all the legitimate >protesters of modern history. Civil disobedience must be seen publicly, and >must be done by observable individuals. Masked men throwing stink bombs is >not civil disobedience--it's hooliganism. As usual, while you have at least the hint of a truth there, you manage to warp it just enough to be difficult to recognize. Historically, the the government has had nominal control of the media. The only civil disobedience that was _seen_ to be successful were the examples that made the news. And the "only" examples which made the news were the ones the government wanted to publicize. And the "only" examples the government wanted to publicize were the ones in which government "successfully" made examples of those doing it. And the "only" examples where the government achieved this were the ones where the perpetrator allowed himself to be caught. (my usages of the word, "only," are somewhat hyperbolic, of course. In practice, they are strong probabilities.) Your usage of the word, "legitimate" is quite slick (in the worst sense of the word, "slick"): The only ones you're going to want to acknowledge were "legitimate" are the ones that either are already successful, or the few you approve of and are still waiting to be successful. So, in a certain odd sense, it has been correct to say that the only "successful" (and thus, by your standards, "legitimate") civil disobedience has been that in which the perpetrator did it openly. And not surprisingly, anyone who does anything in such a way that he's not caught (and therefore, is also not subject to government-sponsored publicity) is a "coward" by your standards. How convenient! A rather sophisticated self-fulfilling prophecy. No wonder you've got some people fooled into believing you're a good debator. Fast-forward to 1996. Today, the traditional news media is beginning to be seriously bypassed by the computer networks, and this process is accelerating. No longer can the government keep enough control of the news media in order to help ensure that civil disobedience stays covered up unless they catch the protestor. Since everything else seems to be changing, it's no surprise that civil disobedience is, too. Today, civil disobedience still needs publicity, but to achieve that it now DOESN'T need the cooperation of the mainstream media, or implicitly the government. So a person doesn't need to be "caught" in order to win. The _results_ must be publicized, the person or people who did it doesn't. This represents a rather enormous change in the whole issue of civil disobedience, a change which is extraordinarily unwelcome among governments and statists alike. Jim Bell jimbell(a)pacifier.com

1 0

Re: Intel, Microsoft doing Internet Phone Software
by jim bell 17 Dec '03

17 Dec '03

At 10:47 AM 7/23/96 -0400, W Lee Nussbaum wrote: > > >On Mon, 22 Jul 1996, jim bell wrote: > >> If these people REALLY wanted to promote the use of Internet telephoning, >> what they'd do is implement a system where an Internet ISP could be "called" >> over the Internet by a person wanting to place an LD telephone call to that >> area, and (presumably using A/D and D/A techniques) rather than generating >> and receiving modem tones, woudl generate and transmit the audio over the >> telephone line. That way, the target of the call would simply need to pick >> up the telephone and talk, as he would ordinarily do: He wouldn't even need >> a computer. He might not even know the call was going over the Internet. > >...see IDT's Net2Phone product, at http://www.net2phone.com/; it does >what you describe. Two notes: (1) I haven't used it yet; (2: disclosure) >I'm now employed by IDT, though in a different area. Excellent! It seems that the one remaining piece in the puzzle is financial motivation. Many ISP's might hesitate to install a "feature" on their systems which has the prospect of tying up some of their lines, with no payback. As much as it pains me to face it, at this point what is needed is some system to pay the ISP's for maintaining and even upgrading their systems to make this whole thing practical. Currently, Sprint is proud to announce that they charge 10 cents a minute for off-peak calls. Could an ISP make money charging, say, 2 cents a minute for a similar service? The main marginal cost is that of an extra phone line, which is probably about $30 per month or $1 per day. Assuming the line is occupied 8 hours per day, that's 480 minutes, which means that the phone line costs 0.2 cents per minute. Even if other costs increase this by a factor of 5 or so, there should be nothing to prevent an ISP from making money off a 2 cent per minute charge or even less. Jim Bell jimbell(a)pacifier.com

1 0

Re: Flaws of Thinkers (Jefferson, Rand, Nietzsche, Voltaire, etc.)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:40 AM 7/23/96, bryce(a)digicash.com wrote: >I know a lot about Rand, and about her deep flaws as an >individual, especially in terms of treatment of her supporters, >but this is the first I've heard of this one. Perhaps Tim is >thinking of a play by Murray Rothbard called "Mozart Was a Red" >in which the Ayn Rand caricature insists that her followers >smoke. > >As for smoking being "proof" of man's dominance over nature, >Rand _did_ believe that in the sense of "demonstration" or >"symbol" but she did not believe that in the rigorous sense of >"proof". This was well-known to a bunch of us in the early 70s who were interested in Rand (and her extreme followers, known widely as "Randroids"). I think some of her essays in her Objectivist Newsletter had explained why smoking was essentially de rigeur. (By the way, at the time Rand was writing this stuff, doctors were recommending smoking as a digestive and health aid, and nearly everyone smoked. I don't condemn Rand for smoking, or for falling into the all-too-common practice of using "logic" to justify one's beliefs and practices.) Rothbard was a source for the smoking example, but not in a play (although he may have also used his knowledge in a play...I wouldn't know). Rothbard wrote an article for "Liberty," circa 1986-8, which is where I read the details. Also, I believe Barbara Branden's biography of Rand dealth with this, but I haven't read it in many a year. And there is this comment, from an admittedly off-beat source (http://www.zonpower.com/zonpower/book/chapters/chapter29.html) "Whatever the root of his irrationality, Dr. Peikoff's persona shrinks with his advocating force-backed intolerance as he expressed during his 1995 Ford Hall Forum lecture. Recall how Ayn Rand's life wastragically diminished by her irrational, deadly, "dot-of-light" glamorization of smoking. Her emotional, irrational denials of the narcotically addictive, physically destructive nature of tobacco smoking led her and some of her "caped" followers to the grave." --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: Digital Watermarks (long, getting off-topic)
by Alex F 17 Dec '03

17 Dec '03

> Easy enough. > > - Unless somebody reversed-engineered it, filtered it, and re-stamped it. Never said that it would be fool proof :) > - The entertainment industry has a reputation of being paranoid Sometimes with good reason, just like software producers are paraniod about piracy. Though, the Ent. Ind. does tend to overreact. IMO the copyright laws that are currently in place are enough to protect against the forms of piracy that they are trying to protect themselves against. I really don't think that there is need for new legislation or potentially privacy invading practices at this point. The forgers of the copyright laws (at least as they relate to music) had incredible foresight. Basically, from the laws that were originally drafted (30's maybe? Then revised in the early '70's at least as far as public domain goes) both videos and CDs are protected. These were written when there were no CDs or videos. > Some of you may recall > the flap over DAT, which significantly reduced the consumer market > penetration (the industry itself uses them all over the place). The Ent. Ind. got what they wanted though. There are taxes, etc. (some sort of import restrictions anyway) that keep DAT player/recorder devices at around $700 per unit. By this time normally the prices *should* be down to like $200 (using the CD industry as a guide) DATs are used all over the industry because they are cheap (see below), and because going from analog tape to DAT for CD mastering is a million times easier then sending off reels of analog tape, even if the tape is a properly mixed down duplicate of the master. There are still track times, numbers, etc., etc. A HUGE pain in the ass for CD manufacturers, but easy to do on a one-off basis in the studio where the producer & artist can sit there and help mix, fix tracks, select times, indexes, etc., etc. It can all be done to a single DAT )(which would then be copied for safety) and set along with a time code sheet. > (you still > have the even-less-effective argument of the associated cover art not > being included or being scanned and duplicated with reduced signal > quality, unless the distribution is all on-line). Cover art is pretty easy to duplicate if you have access to a color laser printer. Just scan the original in at 300dpi, and print it out at the same resolution/size and you have it. Just don't scan it in as a .GIF :) (too few colors) > Probably not done that way. My guess is that the disk ID is assigned > to the disk at the time of manufacturing. At the point of purchase > the customer is forced to give name, address, ID, whatever. This is > then stored in a database > > - Would YOU want to be responsible for maintaining that database? It's > like maintaining a hardware store trying to maintain an ID on every > single screw and nail in inventory. You would run into the same problems if it were done by CC. Hopefully the industry will do some sort of a cost-analysis (an accurate one) and realize that they would spend more on this than they lose (esp. since they still wouldn't eliminate piracy, just make it a little more difficult). > - Nobody's going to try and do a higher-frequency encoding (I HOPE). While > the human ear cannot hear those frequencies directly, we have found out > that those higher-frequencies interact in such a way to influence the > sound waves that influence what the user can hear. Yes, that's true. Anyone ever hear of HAARP? :) Certain frequencies can affect the brain in certain ways (a guy by the name of Robert A Monroe, while maybe a little eccentric, has been using this method since the 50's to do things like keep people awake when they are sleepy, vice versa, etc.). Also the body. Your body parts resonate a certain frequencies. For example, there is a very low note (I believe that it is a B) that vibrates at the same frequency as your bowels. Play that note, and you loose control... :) (If anyone knows this frequency, PLEASE let me know. I'm serious :) ). This is the reason > there's still a debate between digital and analog recordings, and is > still a big reason a lot of artists still record on analog equipment > (in musical "fuzzy" terms, it's equated with the warmth of the sound, > sort of like the tube-amp vs. solid-state amp debate among some guitar > players, etc.) If somebody deliberately played with such frequencies, > the journalistic media would probably have a field day. Yes, there are > audio cancelling and other tricks that could be deployed, but no matter > what, you're still deliberately introducing signal noise I touched on that in my other posting. The real difference between analog vs. digital is actually 2 things; static and musical "overtones" (used to produce various distortion effects and feedback, for example. ANyone who has listened to Robin Trower, Hendrix, Van Halen, etc. knows). People *are* playing with these frequencies. It's known as COSM or Composite Object Sound Modeling, and apparently is fuzzier (as in fuzzy logic, not fuzzy sound) than cold sampling is. Companies like Roland and Line6 are playing with such things. Roland is really doing some amazing things with this technology. > If I remember correctly, there is plenty of room in the design of the > audio CD protocal to embed such information, just like you can embed > the timing and track number information. Yeah, that's something else too. I'm not sure exactly how that works, but I *think* it's like a 1Khz or 1 hz signal that signals this. At least it is for the start of the first track on a cd. In the manufacturing process, at least > - Well, the MASS market piraters are exactly the point. Well, let's face > it, if the industry controllers got their way, there would be no > second-hand market like garage sales - there IS money involved here > (witness the bizarre dealings with CD-rental stores that have shown up The thing is, there is no money lost, really. Think about it. In order for one CD to be bought at a garage sale, someone else had to buy it at a retail store. If the record companies were in the used CD business then there may be money lost, but otherwise. The place where real money is lost is sale of promo CDs (many say "Promotional copy. Not for sale" on them). Here the record company loses nothing. The artist loses big time. With the exception of Sony records, most record companies will only pay artists royalties on 85% of records sold. The other 15% is said to be "promotional material" which is a huge scam run by the recording industry to take advantage of the artists. These 15% are still paid for (manufacturing, etc.) by the artist, and are given away to radio stations, etc. There is where the real money is lost. The rest is lieing with numbers. Getting off topic, Alex F =-=-=-=-=-=-=-=-=-=-=-=-=- Alex F alexf(a)iss.net Marketing Specialist Internet Security Systems =-=-=-=-=-=-=-=-=-=-=-=-=-

2 1

Re: DES Optimization (Brute Force DES)
by Peter Trei 17 Dec '03

17 Dec '03

> "Peter Trei" writes: > > The fastest general purpose, freely available des implementation I'm > > aware of is libdes. by Eric Young. With this, I can do a set_key in > > 15.8 us, and an ecb_encrypt in 95 us/block. That adds up to > > about 9,000 keytests/sec (this is on a 90 MHz P5, running NT). > > I'll point out that like most DES implementations, Eric's tries to > spend a lot of time in key setup to save time later on in > encryption/decryption. This tradeoff would probably be very different > if you didn't plan on trying more than one or two blocks of decryption > after getting a key. > > Perry Yep - with good optimization, the keygen and the des rounds get very close to each other in processing cost. Let's look at the steps involved (I'm refering to the DES description in Schneier, 2nd ed, p 270-278). I've not yet coded these optimizations, so this may be subject to revision. I'm assuming a known plaintext attack on a single 64 bit block, ECB mode. What we want to obtain is the key (which was presumably also used to encode interesting data which we can't read) First of all, we can move the initial and final permutes (tables 12.1 and 12.8) completely out of the testing loop. These have to done only once per run, and thus are effectively zero cost. Similarly, we can eliminate the key permutation (table 12.2), and iterate the permuted 56 bit key. If we get at hit, we invert the key permutation and add back the parity bits to get the original key. In the DES round The S-box and P-box steps can be combined into a single 48->32 bit permutation. So, per round (there are 16), we now have: 1. copy 32 bit sub-block to use as 'other' half in next round. 2. expansion permutation (32 -> 48) 3. xor with appropriate subkey. 4. perform the s-p permutation. (48->32) 5. xor with 'other' half from previous round. The key scheduling can be done in parallel with the rounds, since we're only planning on using each key once. However, on the Pentium it may be more efficient to do it before the des rounds, due to register starvation. Generating the subkeys is actually quite painful. You have to rotate the 56 bit key as two 28 bit halves, by one or two bits depending on the round, and then do a 56-> 48 bit permutation to generate the subkey. This step needs to be done 16 times. In a regular DES implementation, you generate the key schedules once at the start, and reuse them for each block, so there is little to be gained by optimzing this step. In a keysearch situation it's a different matter. Optimizing the permutations: DES was originally designed for hardware implementation, where permutation is a simple matter of braiding the wires between the input and output. It's a lot harder in software. I'm aware of two basic approaches: 1. Algorithmic: Analyse the permutation table to find bits which get shifted in the same direction, by the same number of bits, and arrange a series of SHIFTs, ANDs, and ORs to generate the desired permutation. This is essentially a geometry problem. 2. Lookup: Create tables for the permutation. While a permutation with n bits of input requires 2^n entries (each the size of the output data) if done as a single table, it's possible to break the permutation into several smaller tables, at increased processing time. This is a classic speed vs space tradeoff, with a big step if your tables are too large to fit into cache (and even bigger if they go to virtual memory) Example: A straight 32 -> 32 bit permutation: If done as one table, it would have 2^32 entries, and take about 16 Gbytes. If broken up into 4 tables, each of which dealt with 8 bits of the input, it would take 4096 bytes total. However, the calculation would require extracting the four eight bit subkeys from the input, doing four lookups, and ORing the four results together to get the final output. A 32 bit perm could also be done with two tables, but they would occupy half a Mb. The S-P step and the compression step of the key schedule are probably faster by lookup than by algorithm. I'm not sure about the expansion permutation, which is very regular. The size and number of tables used is going to depend a lot on cache size and available memory - for example, the rotates in the key scheduling can be eliminated if I'm willing to maintain 16 key compression tables (one for each round). I strongly expect that the whole key testing loop can fit into the 8k L1 code cache. The lookup tables *may* fit into the L2 cache. If anyone has any other optimizations, I'd like to hear about them. Peter Trei trei(a)process.ocm Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

1 0

Kids and Computer Privacy Was Re: No more stupid gun thread ...
by Scott Schryvers 17 Dec '03

17 Dec '03

At 06:24 PM 7/22/96 -0700, you wrote: >Ok. This thread has gone on long enough and covered just about every >point except the one which I originally made in my first response, >which is that I abhor the idea that kids should carry weapons (of any >sort) to school as standard equipment. In fact, I abhor the idea >that kids should carry weapons at school for any reason. > >Enough said. > >I do not care to discuss: > >1. Should kids have any weapons at any time? > >2. Should kids have guns (specifically guns)? > >3. Should kids know how to operate weapons of any sort? > >If any of you really really have to discuss this issue, let's spare >the rest of the list and send me E-Mail directly. > >Thanks! > >Ern > Should kids have crypto? [weapons] Should parents teach their kids crypto at an early age? Should kids have a right to privacy? If yes, should there be a limit to the privacy they hold? Under Itar crypto is a weapon. If a kid were to bring a disk containing pgp to school could they be expelled for carrying a weapon? Should children's legal rights be taught at school at an early age?

1 0

emscrypt 0.01 ALPHA
by Matt Carpenter 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I finally managed to find some time to do a little testing of emscrypt and make some of the changes that were suggested here earlier. It is still rather ugly and I haven't added many of the features/capabilities I hope to eventually implement. But I'm making it available so that people can play with it if they want. It looks like I'm going to be very busy for at least the next month trying to finish up the work for my master's degree, so I probably won't be making any major changes for a while. emscrypt's purpose is to automatically run PGP signed scripts received by e-mail and return the results to the submitter. emscrypt is a heavily mutated version of morepgp, originally by Jason Steiner and modified by Greg Spencer. Please realize that this program has NOT undergone extensive testing, so you may encounter strange behaviour. Make sure you read the documentation that exists. Using this program may make your system insecure, especially if you don't follow the installation procedure carefully. Use at your own risk. You should be able to find emscrypt and some documentation at: http://www.bmen.tulane.edu/~carpente Look under the "Other random projects or possibly useful stuff" heading. In order to try out emscrypt you need the following: * Perl -- emscrypt is written in Perl. * PGP 2.6.2 -- Other versions may work, but I haven't tested them and emscrypt relies strongly on knowing the format of the PGP output messages. * Procmail -- For passing incoming mail to emscrypt. This can be accomplished in other ways, but at this point I haven't tried any of them. If you don't have procmail you can still play with emscrypt by piping messages to it manually. I strongly suggest you do this anyway, to make sure you trust emscrypt to answer incoming mail. Here are the major things that have changed with emscrypt since I described it here a while ago: There are now two required headers which must be included in the body of the signed message: 'Reply-To:' and 'PGP-Key-Fingerprint:'. Both must appear before the beginning of the script. The beginning of the script is considered to be anything other than the above headers, blank lines, or lines that begin with '::' but that are otherwise empty. Duplicate headers will generate an error and prevent the script from executing. Case within the headers is not important. (You are free to use eLiTE d00dz capitalization techniques, just don't try to use kRe8yv sP3lliNg5.) 'Reply-To:' must be followed by a valid e-mail address, otherwise you won't get your results. (emscrypt will also recognize a 'Request-Remailing-To:' header in place of 'Reply-To:'. I added this so that emscrypt could be treated as a "remailer". The idea is that you could use software such as premail to automate the generation of messages going to emscrypt, so that you don't have to do the signing/encrypting manually. Then you could just send a script to yourself, "chaining" it through your emscrypt "remailer". But I don't think this will work without slight modifications to the remailer message generating programs, since emscrypt requires the 'Request-Remailing-To:' header within the signed body of a message (it would also be nice if the 'PGP-Key-Fingerprint' header could be automagically included)). The 'PGP-Key-Fingerprint:' header gives the fingerprint of the key used to sign the message and which will also be used to encrypt the results. It must also be included within the signed body of the message. Most of the other changes involved minor debugging and general clean-up (not that I consider it clean now). I also improved the error handling a little, but it needs more work, too. Right now emscrypt generally tries to generate, encrypt, and mail an error report if things go wrong. If that doesn't work, then it saves an error message to a log file. If you find any problems, please let me know. Comments, suggestions, etc. are also welcome. Thanks, - --Matt - -- mcarpent(a)mailhost.tcs.tulane.edu -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMfXlaijtJAMyBnp9AQHAdAf+MQ/ZroKoLeYyQDYabVrIq1eLSQB6vpr+ 2tXu63wDbcUeFoeSFNx6Sar7DNtAJyJUlwVcVKlb5SOuYR/8aFDvAnIYuQLPfdXd xXjC4iv+Hh3hNx4ibeyAB4xbFmDYAMB19zEf6nhmJdxR03oFXP+Qfx2m/aN/LDKZ zVSjtOs/ujTa6ltP6r/9x1vdiqmSNuSCNLvL/f4YulfdzR8frF0uLyLmiDH6mUpm etKxSpIg4ZI+iy1YvvSd+FtA0F3XSziaLEepx4X8gYjZKP0YXPTEMGhTeWj1o6bP yl06KUIRTL5k56P0xnW2MezGN5c0Cz2W9TEa9NBbHxY1DgSTDWa3sg== =DTpY -----END PGP SIGNATURE-----

1 0

Re: DES brute force? (was: Re: Borders *are* transparent)
by Dan Bailey 17 Dec '03

17 Dec '03

If we choose a plaintext/ciphertext pair carefully, we can easily save ourselves some work (50%) while still making the attack a credible demonstration. The idea is to use each trial encryption twice. In _Differential Cryptanalysis of the Data Encryption Standard_, Biham and Shamir note the following, known as the complementation property of DES: if T = DES(P, K) where T is ciphertext, P plaintext, and k key, then: T' = DES(P', K') where T', P', and K' are the bitwise complement of the above. Now the interesting part. If two pairs (P1,T1) and (P2,T2) are available with P1 = P2' or T1 = T2', then an attacker can restrict his search to only the keys with LSB = 0. The attacker runs through the remaining 2^55 keys (with LSB = 0) and tests the results against both T1 and T2'. Since testing for equality is much faster than performing the actual encryption, time savings is on the order of 50%. Just a thought on how to save some cycles. Dan

1 0

Re: Digital Watermarks (long, getting off-topic)
by tcmay＠got.net 17 Dec '03

17 Dec '03

(My comments are really minor quibbles, based on my longtime use of DAT machines, which I now have three of.) At 2:19 PM 7/23/96, Alex F wrote: >The Ent. Ind. got what they wanted though. There are taxes, etc. >(some sort of import restrictions anyway) that keep DAT player/recorder >devices at around $700 per unit. By this time normally the prices >*should* be down to like $200 (using the CD industry as a guide) As I said, I have three DAT machines. They are complicated machines, having lots of moving parts and precise tolerances. (And they are prone to break!) CD players are vastly simpler. I'm not at all surprised that prices have remained at about the $400 level for DAT decks, and about the same for DAT portables. After all, camcorders, which use much the same technology, have also remained at about the same price. And I don't think the SCMS code had too much to do with mass-acceptance. Most comsumers, according to available figures, *buy* C-90 cassette tapes, and do not make their own. (That _you_, the CP list reader, may use your cassette deck to make tapes has little to do with the vast numbers of cassette users out there do...most don't know how to record with their cassette decks.) Pre-recorded DAT tapes were available for a while...they did not sell. I believe this was because DAT machine purchasers were sophisticated and new how to make CD-to-DAT copies, with or without SCMS. Thus, the failure of DAT as a consumer medium (not to mention the much-hyped MD and DCC formats) probably is due to other reasons, including the mechanical issues, the lack of a real need for consumer DAT, and the confusion over new emerging formats. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: A Snake-Oil FAQ
by David E. Smith 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com Date: Wed Jul 24 00:10:54 1996 > Honestly, this boycott campaign looks out of place on Cypherpunks, at > least to me. I mean, we are for freedom of speech, aren't we? > Sternlight is talking about on-topic things. How come that renowned > defenders of freedom of speech resorted to name calling and attempts to > push their opponent out of the public forum? > (cheer) I don't agree with David Sternlight; frankly, I doubt very many of us agree with David Sternlight. But if we're going to start plonking just on the basis of a periodic rant, after he goes Perry goes, and Tim goes, and before long there's no list. Now to keep things interesting, somebody wanna subscribe Dorothy Denning to the list? Might be fun :) dave - ---- David E. Smith POB 324 Cape Girardeau MO USA 63702 dsmith(a)prairienet.org http://www.prairienet.org/~dsmith send mail of 'send pgp-key' subject for my PGP public key "I'm only a social smoker, just a few packs a day really" -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Automagically signed with Pronto Secure for Windows. iQEVAwUBMfWwaTVTwUKWHSsJAQHmAwf/XkwZZtAbymiSni4L8N6D6qW75W2B/Hgv yuPX0uCoXnBmvUXzq6RS7zNN0A1vtgXhCgzgyYY+1/1PRAAoQAd8q7evX1K+rTVe 1MmlOfJWFHJG9q0tHc45LONagW1m0eAp9Z9fkO4NRhGpybfWDCZKwtClbaLiAdoA 86lJnNRacjEHf1dAAHc/1dibJz+6617nfgLkea0OVbLICIsSpkc3PJLkFE9jjK2a g+5CXJ8oXg4bKlEw7QoefagXYsM9o6PF+MHIDVT/pZnfoVmGoI9+3BYHkByXh/vQ 8M+w6hZu4X50zzxCx/6lDvzfd1zccmHvJAsx6GXf4VGUp6lIw+lfCg== =KXCp -----END PGP SIGNATURE-----

1 0

Re: Bare fibers
by Bill Stewart 17 Dec '03

17 Dec '03

h > > Doesn't that make it vulnerable (detectable) to Tempest attacks? h > > Harka rw> No. rw> Transmitting light via fiber doesn't emit EM. Light is electromagnetic :-) rw> Anyway, the original post, as I recall, was about keeping sensitive data rw> on a second hard drive, connected via (very thin, therefore harder to rw> notice) fiber. Tempest monitoring was not a factor. rw> -r.w. I assume that if you've got a fiber hanging from your PC, and thugs come in to steal/confiscate/forfeitize your PC, that they're bright enough to notice it and maybe to follow it. Thugs who want your information will follow it to find information; thugs who just want to resell your hardware will follow it to find more hardware. I had initially assumed that the mention of fiber optics was in the context of "Infrared transmitter on the PC, fiber optic sticking out of the wall to receive the IR and transmit it to a hidden detector." or something silly like that. If you want to hide a small PC in your attic/wall/etc and use the newer faster IR stuff for clandestine backups, and have a Real Operating System so you can run it in the background (since your disk drive is presumably much faster than IR), I suppose you could do that. The main use of TEMPEST here is to detect backup systems hidden in the attic that they hadn't noticed. Hiding it in your stereo system doesn't protect it from honest thieves, who might also want to resell your stereo, and info thieves have been known to seize anything even resembling computer equipment, such as Mozart CDs. You could also hide the computer in your kitchen cabinets like one Famous Cypherpunk, but you'd have to use a thinner bundle of cables than he does to connect the monitors and keyboards :-) # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Confuse Authority!

1 0

RE: Distributed DES crack
by koontz＠netapp.com 17 Dec '03

17 Dec '03

>I'd like to see a very general hardware processing power equivalence table. >For example, 1 MasPar equals how many Pentiums. One MasPar MP2 (4K processors) could run 300,000 crypt(3) crack attempts per second (a password checker). That should give you 6 or 7 million brute force key attempts per second. Unfortunately the only way to show an equivalance for a particular problem is to have both machines work on the same problem. (Perhaps we could manage to break a DES key in the course of executing a new benchmark?)

1 0

the VTW---FBI Connection (fwd)
by Sharma 17 Dec '03

17 Dec '03

I am asking for some verification that you (cypherpunks) have something to do with this before I forward it anywhere. I looked at the vertexgroup and so-oregon webpages, and there is no investigative journalism there that I was able to find. Please get back to me soon. Thanks, sharma sharma(a)aa.net >X-URL: <URL:http://www.vertexgroup.com> >X-URL: <URL:http://www.program.com> >X-URL: <URL:http://www.so-oregon.com> > >>Date: Sun, 21 Jul 1996 20:51:23 -0600 >>To: cypherpunks(a)toad.com >>From: nobody(a)zifi.genetics.utah.edu (Anonymous) >> >>We have received information that VTW is run and supported by the FBI, >>which we have suspected for reasons listed here. >> >>I) They appear to have no financial support or funding source. They >>do not accept donations. They have no corporate funds. And yet they >>appear to be a thriving business. >> >>II) They are secretive about their location, and do not seem to have >>a headquarters. The address listed in the NIC is a vacant lot in of >>all places Brooklyn, NY. They do not have a listed telephone. >> >>III) On a tip from a "friend" we learned that the power leader behind VTW >>is a cleancut man with the unusual name "Shabbir M. Safdar." Not exactly >>a common name. Several people say they've met him. Our "friend" says >>that Mr. Safdar is in reality an agent of the FBI. >> >>IIII) We didn't believe this without external verification. So we called >>the Brooklyn office of the FBI and asked for Agent Safdar. No such person. >>I called the Washington office. No such person. Checked if there is >>any agent named Safdar. They don't give out this info. Then we tried to find >>ANY public records on a Safdar, with no luck. No driver's license in NY, >DC, NJ, >>etc. No phone, etc. Odd that such a person does not exist and yet runs a >>"human rights" organization? Then Alice called the NY FBI office. Asked for >>Agent Safdar. Guess what? "He's not in. Can I take a message". No message, >>thanks. He'll get the message all right. >> >>Now the big question: What is the FBI trying to do getting all these >>names? What else has "VTW" been doing? And what other organizations like >>them are there? Who else is in on it? What does this say about EPIC, CDT, EFF? >>Are Blaze and Schneier dupes, or willing participants? What about their >>ISP? I think we are all owed an explanation. This is serious. Maybe FOIA or >>a lawsuit before they burn the files. >> >>What do you want to bet "VTW" quietly fades away after a few prefunctory >>denials, and gets replaced by another organization in due course? >> >>Faithfully, >> >>Net reporter team Alice and Bob >>

2 1

RE: Distributed DES crack
by Bill Stewart 17 Dec '03

17 Dec '03

At 03:40 PM 7/23/96 PDT, koontz(a)netapp.com (Dave Koontz) wrote: > > I'd like to see a very general hardware processing power equivalence table. > > For example, 1 MasPar equals how many Pentiums. > >One MasPar MP2 (4K processors) could run 300,000 crypt(3) crack attempts >per second (a password checker). That should give you 6 or 7 million >brute force key attempts per second. Interesting - thanks for the result. Do you know how tightly tuned the crack implementation was (e.g. straight C with MasPar optimizer, hand-tuned assembler, etc.)? Since the MasPar has a large number of very small processors, I'd expect it to be better at bit-twiddling than conventional processors. # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Confuse Authority!

1 0

Re: DES-Busting Screen Savers?
by Steve Reid 17 Dec '03

17 Dec '03

On the subject of choosing keys randomly, rather than dividing up the keyspace... This seems like a very good idea to me. One potential problem is actually choosing the random keys. Have to be able to get entropy at a fast rate, and/or use a good PRNG. Both of these things would take time away from the actuall cracking (more time than just incrementing the key). And if a weak PRNG is used in order to save time, it's possible that it might favour certain keys and thus interfere with the attempt. Any ideas for a fast and good PRNG? ===================================================================== | Steve Reid - SysAdmin & Pres, EDM Web (http://www.edmweb.com/) | | Email: steve(a)edmweb.com Home Page: http://www.edmweb.com/steve/ | | PGP (2048/9F317269) Fingerprint: 11C89D1CD67287E68C09EC52443F8830 | | -- Disclaimer: JMHO, YMMV, TANSTAAFL, IANAL. -- | ===================================================================:)

1 1

Exporting cryptosystems in pieces: Re: Question [NOISE, mostly]
by Bill Stewart 17 Dec '03

17 Dec '03

Cc: vice.president(a)whitehouse.gov, The cypherpunks list has been discussing ITAR again. :-) >> If it is illegal (by our governments standards...) to export programs >>like PGP, etc., and you can send the whole source code in a message >>because that is also considered illegal, then could you send the code, >>broken up into many pieces, and send THAT in Email, would that be >>illegal? Exporting components of military hardware, including cryptosystems, is also specifically banned by ITAR. How big a piece is enough to get you prosecuted is a question for the nastiest of the N prosecutors out there, and whether you can be convicted is a question for the best of the 12 jurors you'll have.... Vince Cate's arms exporter page lets you export a highly-useful fully working cryptosystem in three lines with one mouse click (developed by Adam Back and an international cast of dozens.) Adam Back's export-three-lines-of-PGP-at-once is a more blatant test of this; go see his web pages. Here's my two bits worth - the following bits are components of PGP, Netscape 3.0b5, and also of RSAREF. 0 1 # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Confuse Authority!

2 1

Re: Digital Watermarks for copy protection in recent Billbo
by Alex F 17 Dec '03

17 Dec '03

> > People buying CDs at a garage sale & getting arrested for > >piracy. Wonderful. > > Arrests like this are uncommon. Even buying "cheap bikes" and other "cheap" > (= probably stolen and fenced) merchandise almost never subjects the > purchaser to criminal sanctions. Yes, but concievably if (whoever would be incharge, FBI?) *could*, under law do this, even if they are wrong. It is a lot harder to prove that they intentionally harrassed *you* than it is for them to say that they were following leads and show evidence. Yes, this may never happen, but the mere fact that it *could* is uncomforting. Kinda like the CDA an Clinton saying "we will not enforce this...." Fine, but there is still a law on the books that allows them to if they decide to change their mind. Even if you can't be found guilty, you could still be ruined by legal fees, job loss, etc. > ("Alice's Restaurant" not to the contrary; the confession to Officer Obie > cinched his fate.) Don't wanna end up on that "Group-W" bench! :) > > It would be trivial to add a digital ID signal at, > >say 30,000 or 15 or something like that. This could then be decoded, > > Doubtful. The existing CD standard tops out at a Nyquist limit of about > 20KHz, with the actual sampling at 44 KHz--but there is simply "nothing" at > above 20-22KHz. Putting a signal in at "30 KHz" is simply not possible, > given the Nyquist Theorem and the CD sampling rate. Cds are often sampled at 48 these days. Mine was, and we had to reduce it to 44.1 for mass producing (much to our surprise, since many CD manufacturers love getting stuff at 48 over 44.1) Not familiar with the Nyquist limit w/ regards to sampling rate vs frequency :( Alex F =-=-=-=-=-=-=-=-=-=-=-=-=- Alex F alexf(a)iss.net Marketing Specialist Internet Security Systems =-=-=-=-=-=-=-=-=-=-=-=-=-

1 0

Wiesenthal Center (Canada) and the Ostrich Syndrome (fwd)
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- For Skippy. - ---------- Forwarded message ---------- Date: 23 Jul 1996 08:26:15 -0700 From: Ken McVay OBC <kmcvay(a)nizkor.almanac.bc.ca> Newsgroups: alt.revisionism, can.general, alt.censorship, comp.org.eff.talk, misc.legal, ont.general, bc.general, talk.politics.misc Subject: Wiesenthal Center (Canada) and the Ostrich Syndrome The July 19 article in the Vancouver Sun, "B.C. Internet provider is the largest Canadian site for racist material" is alarming. (See URL http://ftp.nizkor.org/ftp.cgi?orgs/american/wiesenthal.center/press for a copy of the article.) It is not the material found on the websites mentioned, nor the fact that the host server is Canadian - nor indeed that the server is physically located in BC - which give cause for alarm. It is alarming because - either by deliberate design or by abject ignorance - - Sol Littman (and the Simon Wiesenthal Center [SWC] whom he represents in Canada) is fostering and promoting the spread of the "Ostrich Syndrome." Their actions represent a counter-productive denial of reality - akin to the Ostrich burying its head in the sand. Littman is quoted as saying: "We found the longer you leave these groups unexposed, the longer they fester and the more they infect others and the only way to deal with them honestly and forcefully is to expose them to the light of truth." Yet the article concludes, "Littman said he wants to see if Klatt will remove the groups from Fairview voluntarily before the centre takes any other action." The only truth that seems to emerge from such a veiled threat is that Littman has no understanding of the Internet. One is at a loss to determine how removal of the "groups" from one Internet Provider's server would in any way "expose them to the light of truth." If Littman had any knowledge of the Internet, he would know that the Nizkor Project [http://www.nizkor.org/] is an award winning website that is accessed daily by hundreds. In addition to being a source for those who seek information about the facts of the Holocaust, it is used as an electronic resource for those who wish to "deal with [these groups] honestly and forcefully" thereby exposing Lemire and many others - of whom Littman may not even be aware. Nizkor is arguably the "host" to more hate literature than any other website. Since we also include a link to the Zundelsite amongst others, will Littman next be targetting Nizkor and demanding that we remove such links? Or that we hide from public view the mountains of archived material which meticulously documents and uses the "arguments" put forward by these groups as instruments of their refutation and exposure? If Littman and the SWC prefer to bury their heads in the sand while engaging in this futile exercise in darkness, let them do so. But the martyrdom they hand on a platter to Lemire and others whom they find offensive stands in marked contrast to their failure to use the Internet on their own website. Conspicuously absent on the SWC website are links to the increasingly growing number of useful resources for those who truly do wish to participate in the battle to expose racist and anti-semitic groups on the Internet. The Ostrich syndrome is far more dangerous to society than any white supremacist group on the Internet. Such groups will fester in darkness, but wither in light. Kenneth McVay, OBC The Nizkor Project - -- Nizkor Canada | http://www.nizkor.org - -----------------------| Prince Myshkin's Troll Bait Sold Here |-------------------------------------- http://www.nizkor.org/hweb/people/g/giwer-matt/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMfVcLJNcNyVVy0jxAQENJQIAwGhMdP82l3S0Ac3uSaYaUcj1TowW6J9F K+l+wRmWwpQBuxq+INEPghNcY54thnc6iQIqGfR5KVoUsFNLAk9lcg== =12JK -----END PGP SIGNATURE-----

1 0

Re: Netscape
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 1:23 7/23/96, Jeff Weinstein wrote: > If you know that the recipient can read a message encrypted with >3DES, IDEA, or RC2-128, then you can send the message using one of >these strong algorithms. Given that you need someones public key >to send them a message, there are several obvious ways to transmit >information about what algorithms they accept along with it. Granted. What about the signature bug? Will Netscape encrypt the outside signature? -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

2 1

Re: Bare fibers
by jim bell 17 Dec '03

17 Dec '03

At 03:20 AM 7/23/96 -0400, Rabid Wombat wrote: > >> >> Doesn't that make it vulnerable (detectable) to Tempest attacks? >No. >Transmitting light via fiber doesn't emit EM. >Anyway, the original post, as I recall, was about keeping sensitive data >on a second hard drive, connected via (very thin, therefore harder to >notice) fiber. Tempest monitoring was not a factor. It occurs to me that a bare fiber could actually be (randomly) hung across treetops, roofs, power lines, and various other structures, over a many-block distance in suburban areas. Such a fiber wouldn't be protected very well, but it would probably last a few months. It would also be exceedingly hard to find its terminations, and tracing it would be a real pain. (It probably wouldn't be visible against a bright sky more than a meter or two away.) Jim Bell jimbell(a)pacifier.com

4 3

RE: Brute Force DES
by Matt Thomlinson 17 Dec '03

17 Dec '03

well, first of all, I wasn't computing 2^40, I was computing something like 2^(56*0.667) * 8bytes/each or somesuch, I don't recall exactly as I don't have the paper in front of me. In any case, it was the tradeoff between time and space -- 2^40 in time was something like 2^38th in space. But don't trust my numbers, get the paper and rattle them off yourself. It just seems like if we're going to browse all of the way through the DES keyspace, we _ought_ to take notes along the way -- that means building a table. I don't care how big the table is; if it is only 2^30 entries (about 1G entries, each 8 bytes = 8Gig) we reduce our next DES crack by a factor of 8. If we keep 2^31 entries (16Gig) we can cut it down to 2^50, or a factor of 16. If we have 4 - 9 Gig drives (or perhaps three drives and some wiggling, described below) we can save about 2^32 entries and the search becomes a measly 2^48. :) To whittle this down to a 40-bit workload, we'd have to save 2^36 entries* 2^8 bytes/entry = 2^39 Bytes = 512 Gig. Yes, admittedly large. What's the cheapest form of storage, magtape? How much can you store on magtape? The entries can be sorted so that lookup doesn't take long even when you have to mount tapes. Wiggling: We may be able to save less than 2^8 bytes/entry because we know the quality that made the point interesting enough to save (say we only keep points where the top 32 bits were zeros -- no need to save these zero prefixes) but I suppose we'd only be able to cut this storage factor down by a factor of two at most. If you don't have Hellman's paper handy, the apropos formulas are: Total time=T, memory=M, search space=N Time/space tradeoff: M=mt , T=t^2, m*t^2=N In our case, N=2^56; M, T variable. mattt >---------- >From: Ray Arachelian[SMTP:sunder@dorsai.dorsai.org] >Sent: Tuesday, July 23, 1996 3:16 PM >To: Matt Thomlinson >Cc: 'trei(a)process.com'; 'cypherpunks(a)toad.com' >Subject: RE: Brute Force DES > >On Tue, 23 Jul 1996, Matt Thomlinson wrote: > >> why not put together (a LOT of) disk space and we can build a table >> (read: "a cryptanalytic time-memory tradeoff") for cracking DES? Using >> the table, we could brute-search the DES keyspace in less time than it >> would take to do an exhaustive search of a 38 bit keyspace, according to >> the paper. 4 gigs is what, a couple of hundred nowadays? >> >> Making DES equivalent to a 40-bit crack would take approx. 500Gig, but >> publishing the table would push DES out usefulness. Certainly we could >> scale back (make DES equivalent to a 45-bit crack?) if we don't have >> enough disk... > >IMHO it's more expensive to go this route than to build a machine with >dedicate DES cracking chips. 2^40 = 1,099,511,627,776 or about 1 terabyte >worth of space, not 500G. 2^39 would be 500Gb. A 4Gb drive these days is >$800, hardly a couple of hundred dollars. :) > >Even so, that's a ton of hard drives. Further you need machines to hook >these drives up to. Infact, you need a farm of machines. Why? You can >only put 7 on a chain, and maybe if you're lucky four chains in a machine >using four controllers. > >A better idea might be to make small cheap computers, say based on 8086's >or 68000's that replace the drive's controller card, or if that drive >controller card is intelligent enough to be a CPU or contain one, burn >EEPROMs. Have the EEPROMs be able to generate DES (or any other >cypher's) keyspace given a range, and then have them able to search the >whole drive for a match. > >Even so, if you build these drive boxes, all you've accomplished is to >create a nice huge big searchable array. You still will need some sort >of logic to figgure out when it finds the right key, and you still can't >do 3DES or recusively encrypted files, nor know when you've found the key >for data you can't recognize - or rather have these drives recognize. > >However: Reading a 4Gb drive end to end takes less than 2 hours. I know >this because I have a RAID array of them, and it takes 2 hours to >rebuild, so since rebuilding an array requires reading from two drives >and writing to one drive, reading a whole 4Gb drive at full speed would >be something like maybe 1 to 1.5 hours(???) > >You might be better off with 9.0Gb drives if you can afford them because >you then have less controller logic cards to build. > >The drives alone will cost $204,800. $800*(2^40/(4*1024*1024*1024)). >You could get a nice big discount if you buy that many, but this will >also mean however much it will cost you to build the cpu cards for >multiplied by 256 drives, plust the R&D cost, plus the network connection >between all the CPU boards. > >At that point you also run into the MTBF of the drives which means that >your drives will fail quite often. > >If you want to go dirt cheap on the CPU's while using this huge space >method, you could just buy something like 37 Mac IIsi's, hook each up to 7 >of the drives (you'll have to partition the drives as they won't support >volumes that huge.) and network the machines using localtalk. You won't >need a faster connection because all you need for networking is keyspace >distribution and success reporting. But then IIsi's are sloooow machines >and your searches will suffer a hit from the lack of the machine's speed, >plus all the overhead of having an operating system and using the SCSI >chain to talk to the drives. > >IIsi's go for $350-$500 nicely loaded... $14800 for 37 at $400 a pop, >add the drives to that, plus the cost of writing the program and hooking >all of this crap together and that'll be $219,600. Ya got that kinda >dough to spare? > >========================================================================== > + ^ + | Ray Arachelian |FL| KAOS KERAUNOS KYBERNETOS |==/|\== > \|/ |sunder(a)dorsai.org|UL|__Nothing_is_true,_all_is_permitted!_|=/\|/\= ><--+-->| --------------- |CG|What part of 'Congress shall make no |=\/|\/= > /|\ | Just Say "No" to|KA|law abridging the freedom of speech' |==\|/== > + v + | Janet Reno & GAK|AK| do you not understand? |======= >===================http://www.dorsai.org/~sunder/========================= > Key Escrow Laws are the mating calls of those who'd abuse your privacy! >

1 0

Re: DES-Busting Screen Savers?
by Bill Stewart 17 Dec '03

17 Dec '03

Tim and others have discussed the effectiveness of random search vs. centralized servers, problems of cheating, scaling, etc. My take is that, if you can ignore scaling, the best approach is probably to have a central server that doles out keyspace and wraps around when it reaches 100%, and doesn't worry too much about collecting results - even if there are cheaters, machine failures, etc., and people don't finish their keyspace, it'll be more likely to cover the whole space than randoms. (Make it a web page, and use cut&paste to transfer to the search programs so they don't need to be network-equipped.) To support scaling, make it easy for people to run subset servers; grab a chunk of keyspace from the main server and dole it out to people who ask you for it. If you want to get fancy, hack a DNS server to allow people to register their machines as NNN.descrack.org, 0<=NNN<1000, so that people can find subsets without having to ask the main server. >>> a brute force "screen saver" for >-- By the time the total amount of computons expended has equalled the >amount that would have been expended in a "no duplications" allocated >search, the Poisson probability distribution says that 1/e = 36.8% of the >keyspace will not have been searched; the rest of the probabilty lies in >keyspace searched once, twice, three times, etc. # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Confuse Authority!

2 1

re:SHI_fty
by Alan Olsen 17 Dec '03

17 Dec '03

At 08:13 PM 7/22/96 -0800, Vinnie Moscaritolo wrote: >Uh I think apple had that for a while, it's called cyberdog >http://cyberdog.apple.com screw this ole fud. Unfortunatly, this is only available for Macs at this time. Hopefully we will see Windows and/or Unix versions sometime soon. (Of course if you expect Microsoft PR to resemble *ANYTHING* vaguely like reality...) --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon "Microsoft -- Nothing but NT promises."

1 0

RE: Distributed DES crack
by pjn＠nworks.com 17 Dec '03

17 Dec '03

> I've a few machines around that could be dedicated almost full time to the > task. What are the bandwidth requirements? Specifically, could the > keycracker be run over a 28.8 (with a 486 running linux)? If so, how many > 486's could I get over a single 28.8 (i.e. 28.8 -> multiple 486's daisy > chained with ppp over direct serial connection)? > It's not a factor of the bandwidth, you search offline and send in > your results to a central server. > But first, a little reality check is in order. According to libdes, > the 200Mhz Pentium Pro on my desk will do 1,827,997 ECB bytes/sec, or > 228,499 ECB blocks. A DES crack would have to try, on average, 2^55 > blocks. That would take my machine 43,798,875 hours, or 1,824,953 > days. > OK, so let's be reasonable and say that a week would be a good time to > come up with a DES key. We would need 260,707 200Mhz Pentium Pro's to > achieve this. > Looking at that, 30 days seems not such an unreasonable target. We > would need 60,831 200Mhz Pentium Pro's to achieve this. > It seems obvious to me that DES is still *way* out of reach of > anything other than special purpose hardware. In> - Andy (hoping he got his sums right) (I think you did :) One small thing... You are assuming that we will not get the right equasion/code/whatever untill the very end. There is a good chance that it will only take half that time...and a slim chance that we will get it with the first try... P.J. pjn(a)nworks.com (BTW, I have a 486 DX/4 100MhZ That I will put to the effort...) ... As easy as 3.14159265358979323846264338327950288419716 ___ Blue Wave/QWK v2.20 [NR]

1 0