December 2003 - cypherpunks-legacy

DESCHALL v0.214 now available -- US/Canada only
by Rocke Verser 17 Dec '03

17 Dec '03

Greetings! DESCHALL Version 0.214 is now available in the US and Canada. DESCHALL is a client-server based approach to cracking the RSA DES Challenge. Information about DESCHALL is available at the following Web site: http://www.frii.com/~rcv/deschall.htm As indicated in the above Web page, Michael Paul Johnson has graciously agreed to distribute DESCHALL from his export-controlled North American Crypto Site. [Thanks, MPJ!] At the present time, the server is running at about 2% of capacity. The server can handle a *whole lot* more clients. Clients are available for Linux, FreeBSD, OS/2, Windows 95/NT, and Sparc. [Offers for guest accounts to compile other clients gladly accepted!] Pentium 120MHz clients can test about 600,000 keys per second. Good luck! -- Rocke Verser, rcv(a)dopey.verser.frii.com

2 1

Re: [ADMINISTRATIVIUM] ElGamal
by nobody＠hidden.net 17 Dec '03

17 Dec '03

The only `culture' Timmy C[ocksucker] May possesses is that cultivated from his foreskin scrapings. O O Timmy C[ocksucker] May | \___/ \_/

3 2

Re: Anonymous Nymserver: anon.nymserver.com
by Peter Trei 17 Dec '03

17 Dec '03

Someone mistitling itself "Truthmonger" writes: > Now that you seem to have actually read what I have written, perhaps > you might consider reading what you, yourself, have written. > I stated my case for contending that PGP=>2.5 has been compromised, > and got back wild-eyed demands for proof of that which I did not > claim, mainly, that PGP had been 'broken.' > To reiterate my original observations: > 1. The development of RSA was funded and controlled by the spooks. > i.e. - The National Science Foundation and the Navy. > 2. The campaign of persecution against Phil Zimmerman ground to a > halt once he agreed to PGP using the spook-developed RSAREF subroutines > to implement the RSA functions, instead of PGP's original subroutines. > If people with guns came to me and told me that software I had > written now had to use their subroutines, instead of my own, then > I would consider my software 'compromised', regardless of whether > or not I could immediately discern any anomalies in it. > It is far, far easier to 'build' a back-door, than to 'find' one. "TM" (I can't bring myself to use it's full name, since it is so totally inappropriate) has made the following claims: 1. "PGP => 2.5 has been compromised." 2. "It is far, far easier to 'build' a back-door, than to 'find' one." His main arguement rests on the fact that the later versions of PGP use RSAREF, rather than Phil's own code. As support of the first claim, he claims: > 1. The development of RSA was funded and controlled by the spooks. > i.e. - The National Science Foundation and the Navy. I'm not sure what you're referring to with "RSA" here - is it the algorithm or the company? If it's the algorithm, you may or may not have the intellectual capacity to verify it yourself - if you don't you have no business telling us it's compromised, and if you do, either publish the problem (and claim your 15 minutes of fame), or admit there is no hole you are aware of. There are plenty of people on this list who can follow the math, even if you can't. If it's the company, then you are either ignorant or lying. RSA has *not* had a good relationship with the USG, as those who have been following the matter over the years know well. Most recently, you will notice that it has licensed some of it's patents to a Japanese chip maker in an effort to avoid problems with US export restrictions. Is this the action of a USG patsy? > 2. The campaign > of persecution against Phil Zimmerman ground to a halt once he > agreed to PGP using the spook-developed RSAREF subroutines to > implement the RSA functions, instead of PGP's original subroutines. PGP 2.5 was released in March 1994, about a year after Phil was indicted. It took until January 1996 for the indictment to be dropped; nearly another two years. If a deal was struck, why did it take so long? The dismissal of Phil's persecution was almost certainly due to (a) the approach of the statute of limitations, and (b), the very high probability that he would be found innocent. if they took him to trial. The government simply ran out of legal pretexts under which to harass him. Now that your supporting assertions have been shown to be flawed, let's return to the original claims. 1. "PGP => 2.5 has been compromised." 2. "It is far, far easier to 'build' a back-door, than to 'find' one." The problem, TM, is that we have full source code, and anyone with the intelligence and knowledge required can check it independently. PGP and RSAREF are both distributed as source. There is not one byte of instructions or data that have to be accepted on faith - no precompiled libraries, no mysterious DLLs or ActiveX controls. If there is a backdoor, show it to us. Your second claim, that it is easier to build a backdoor than to find one, is true but not pertinant. Let's try an analogy. 1. You buy a house from a builder. You, being paranoid, wonder if the builder has included a secret door to enable him to enter the house without your permission. You investigate what you can, but in the end are left with some doubts. 2. You buy a set of blueprints from the builder, and examine them carefully for weaknesses. You then buy a plot of land of your choice, hire the workers you want, get materials from any supplier you wish. You supervise the construction yourself down to the last detail. Others who have purchased the same blue prints include trusted independent architects and construction engineers, who concur with you thatno hidden back doors can be found in the design. At this point, how worried are you that the builder has left himself an unauthorized entry? The situation with PGP >=2.5 is like the second scenario, not the first. What it comes down to "TM" is: Put up or shut up. You can't spread FUD in a situation where there is no unknown to Fear, no Uncertainty to deal with, and no Doubt that we have all the knowledge we need. Respond in a substantive manner. So far, you've avoided doing so. Peter Trei trei(a)process.com

5 6

Fred Cohen and dhp.com
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

For a good laugh, check out www.dhp.com where they posted their e-mail correspondence with Dr. Fred Cohen. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

VSA2048 Cryptography Module Source Code
by DataETRsch＠aol.com 17 Dec '03

17 Dec '03

Anyone interested in receiving the source code of VSACM should e-mail DataETRsch(a)aol.com with VSACM V2.0 Source Code Request in the subject line. (BTW, about that "if they come in pretty disks" line, very funny.) Jeremy Yu-Ramos DataET Research

3 2

FW: Rules for The Great DES Replacement Contest
by Mullen 17 Dec '03

17 Dec '03

>---------- Forwarded message ---------- >Date: Wed, 19 Feb 1997 09:24:38 -0500 (EST) >From: Christof Paar <christof(a)ece.WPI.EDU> >To: christof(a)ece.WPI.EDU >Subject: (fwd) Rules for The Great DES Replacement Contest >Newsgroups: sci.crypt > > >Rules for The Great DES Replacement Contest > >On 1997 Jan 02, the National Institute of Standards and Technology >of The Department of Commerce announced the start of a process to >approve an "Advanced Encryption Standard." (See the Federal >Register Vol. 62, No. 1, pp. 93-94; for example, by going to > > http://www.lib.auburn.edu/gpo/index.html > >and searching the Federal Register for "Advanced Encryption >Standard.") > > >The first part of the process seems to be requesting comments >on the cipher requirements and submission guidelines as follows: > >"Proposed Draft Minimum Acceptability Requirements and Evaluation >Criteria > > "The draft minimum acceptability requirements and evaluation >criteria are: > A.1 AES shall be publicly defined. > A.2 AES shall be a symmetric block cipher. > A.3 AES shall be designed so that the key length may be increased >as needed. > A.4 AES shall be implementable in both hardware and software. > A.5 AES shall either be (a) freely available or (b) available >under terms consistent with the American National Standards Institute >(ANSI) patent policy. > A.6 Algorithms which meet the above requirements will be judged >based on the following factors: > (a) Security (i.e., the effort required to cryptanalyze), > (b) Computational efficiency, > (c) Memory requirements, > (d) Hardware and software suitability, > (e) Simplicity, > (f) Flexibility, and > (g) Licensing requirements." > > >"Proposed Draft Submission Requirements" > > "In order to provide for an orderly, fair, and timely evaluation of >candidate algorithm proposals, submission requirements will specify the >procedures and supporting documentation necessary to submit a candidate >algorithm. > > B.1 A complete written specification of the algorithm including >all necessary mathematical equations, tables, and parameters needed to >implement the algorithm. > B.2 Software implementation and source code, in ANSI C code, which >will compile on a personal computer. This code will be used to compare >software performance and memory requirements with respect to other >algorithms. > B.3 Statement of estimated computational efficiency in hardware >and software. > B.4 Encryption example mapping a specified plaintext value into >ciphertext. > B.5 Statement of licensing requirements and patents which may be >infringed by implementations of this algorithm. > B.6 An analysis of the algorithm with respect to known attacks. > B.7 Statement of advantages and limitations of the submitted >algorithm." > >

1 0

Re: Anyone have the complete info on CP list alternatives?
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> However, I'm very confused on just what to do at this > point, my news server doesn't see alt.cypherpunks > yet and if it did would probably lose about 75% of > the posts if past performance is to be any indicator. > (Or more accurately, would never get them, we seem > to be a bottom feeder here in South Florida as far > as the newsgroups go.) try pubnews.demon.co.uk, its a public server open to everyone and his dog, recognises all newsgroups, doesn`t accept rmgroups and is quite fast (quickest line between UK and USA, 100mbit/sec as I remember). Alternatively there is always dejanews.com Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

No Subject
by Shark 17 Dec '03

17 Dec '03

Trial

2 1

OECD on Dirty Money
by John Young 17 Dec '03

17 Dec '03

Last week's FT-reported OECD money laundering paper, "FATF-VIII Money Laundering Typologies Exercise Public Report," 5 February 1997 is at: http://jya.com/fatf8.htm (Text 94K; 4 images 78K)

1 0

Re: Belated thank you's
by Thomas M. McGhan 17 Dec '03

17 Dec '03

in a message apparently-from: jbugden(a)smtplink.alis.ca these words appeared: >The loss of John's involvement is a real loss. {snip} I would expect that "John's involvement" will not be lost just because the primary mass storage for the data comprising these messages is not on a disk drive in toad hall. >...how John will feel about the cypherpunks list as it moves beyond him. {snip} Unless the openness of this list, which was such a cause celebre, is compromised, I do not envision any mechanisms being put in place to exclude his contributions, if he chooses to make any. I also expect that the outcome of the in-progress election for ISOC board of trustees may have a certain effect on his time-and-energy resource allocation algorithm for the next few years. ======= tmcghan(a)mail.bcpl.lib.md.us http://www.gill-simpson.com voice: (410) 467-3335 fax: (410) 235-6961 pagenet: (410) 716-1342 cellular: (410) 241-9113 ICBM: 39.395N 76.469W

1 0