December 2003 - cypherpunks-legacy

Reno at FCBA
by John Young 18 Dec '03

18 Dec '03

Communications Daily, October 19, 1996 U.S. Attorney Gen. Janet Reno offered to "set the record straight" at FCBA lunch Thurs... U.S. Attorney Gen. Janet Reno offered to "set the record straight" at FCBA lunch Thurs. on why controversial issues of encryption and digital wiretapping "deserve support" of communications industry. She said law enforcement community agrees that encryption is "critical" to citizens who want to protect sensitive data but "our ability to protect life and property is threatened" if people use encryption that can't be accessed by law enforcement officials: "The only solution is encryption that allows data recovery." She said it's "important to understand" that digital wiretapping "doesn't expand the government's ability to conduct electronic surveillance." ----- If any citizen has access to a full transcript of the AG's talk, please post here or send it to us by fax to 212-799-4003.

3 2

Re: Prof Shamir arrested
by Jim Byrd 18 Dec '03

18 Dec '03

At 02:56 PM 10/21/96 +0100, Tom Womack <thomas.womack(a)merton.oxford.ac.uk> wrote: > >A few column inches in the British Independent had Prof Avi Shamir (who I >guess is the S in RSA) arrested in Israel, on (I believe) suspicion of >involvement in a substantial fraud. The S in RSA is Adi Shamir. Do you know if this is the same person? Do you have any more details?

3 2

Chinese internal internet
by E. Allen Smith 18 Dec '03

18 Dec '03

I seem to recall someone predicting that China and other such countries would set up an internal net with strict controls. Good prediction... I wouldn't be surprised to see Cuba recruited to it, for instance, although North Korea doesn't appear likely (too insular). -Allen > ______________________________________________________________________ > Centura > ______________________________________________________________________ > China's Xinhua launches business computer network > __________________________________________________________________________ > Copyright © 1996 Nando.net > Copyright © 1996 Reuter Information Service > BEIJING (Oct 21, 1996 10:25 a.m. EDT) - A China-wide computer network > launched by a subsidiary of the official news agency Xinhua on Monday > will take Chinese businesses online and supply them with news and > economic information, company officials said. > The China Wide Web (CWW) created by China Internet Corp would provide > Chinese customers with online services in their own language and would > give overseas subscribers a window on to the Chinese business world, > company chairman Ma Yunsheng said. I've about concluded that we'll see a Web dominated by two languages - English and Japanese. It's very hard for native speakers of Indo-European languages to learn Japanese, it's very hard for native speakers of Japanese to learn English, and no other such language has a prosperous-enough home country to work. Such internal nets may alter this, however... [...] > In January, Xinhua was appointed the government regulator for foreign > suppliers of economic information in China, a role that some analysts > say clashes with its involvement in enterprises that supply financial > and business data. [...] > Unlike the open-access Internet, CWW was modelled on internal company > networks or "intranets," Edelson said. > "There will be a lot of real-time information available," he said. "I > think there's going to be very fast growth from a zero start." > China Internet would enjoy free use of Xinhua's communications network > and already had access agreements with the powerful Minstry of Posts > and Telecommunications, he said. > Ma said domestic economic information would also be available through > Xinhua news services and databases. He declined to say how many > clients were expected to subscribe. Heavily edited domestic economic information... > The Internet is viewed by some Chinese officials as a haven for > pornography and political dissent but CWW would likely be a > politically correct alternative. > "CWW should reflect Chinese culture," technology officer Wong said, > without giving details. Ah, yes, the old claim of cultural difference to try to justify censorship. So Nazi Germany was due to a cultural difference? ****** MESSAGE DAMAGED IN TRANSIT ******

3 2

Re: Paper on Network Security
by Ryan Russell/SYBASE 18 Dec '03

18 Dec '03

See! And you all said us Mormons had no crypto relevence :) I missed the pointer to the article/paper...I wanna see what my church's involvement is.. Anyone got it handy? Ryan ---------- Previous Message ---------- To: jya cc: cypherpunks From: declan @ eff.org (Declan McCullagh) @ smtp Date: 10/21/96 06:44:56 AM Subject: Re: Paper on Network Security On Sun, 20 Oct 1996, John Young wrote: > We posted news* a few days ago of a white paper by the > OURS organization on network security. We have put it at: Thanks, John. The members are interesting. -Declan *** MEMBER ORGANIZATIONS Bellcore Cedars-Sinai Health Systems Chase Manhattan Bank Church of Jesus Christ of Latter-Day Saints Compaq Computer Corporation CoreStates Financial Corporation Data Securities International, Inc. Digital Equipment Corporation EDS Corporation Educational Testing Service EXXON Company USA IBM Corporation IDX Corporation Intel Corporation Learning Tree International Levi Strauss & Co. Massachusetts Institute of Technology Merrill Lynch, Inc. Microsoft Corporation Motorola, Inc. New York Life Insurance Company Novell, Inc. Oracle Corporation Pacific Gas and Electric Company Phillips Petroleum Princeton University Security Dynamics, Inc. Societe Generale Software AG of N.A., Inc. SunTrust Service Corporation Sybase, Inc. Synopsys, Inc. Texaco, Inc. The Open Group Washington National Insurance Co. Ziff-Davis Publishing Company Information Protection Task Force Participants American Express Bellcore Chase Manhattan Bank Data Securities International, Inc. Digital Equipment Corporation IBM Corporation ICL, Inc. Levi Strauss & Co. Mergent International, Inc. Merrill Lynch, Inc. Motorola, Inc. Novell, Inc. Pacific Gas and Electric Company Phillips Petroleum Security Dynamics, Inc. SunTrust Service Corporation Trusted Info Union Camp Corporation

1 0

improving cpunk S/N via grouplens/filtering
by Vladimir Z. Nuri 18 Dec '03

18 Dec '03

an interesting new field called "collaborative filtering" seems to have strong potential in helping separate signal-to-noise, and might be of interest to some cpunks here as a pet project. Brad Miller is working on his PhD. in this area and put together a nice system inside many news readers that allows people to read/ratings articles and track their ratings. the system uses the heuristic that people who agree or disagree consistently on ratings on particular messages in the past will tend to do so in the future, and it uses this to extrapolate ratings on messages a person has not yet rated. essentially he has all the technical stuff down and mostly just needs trial users. it wouldn't be hard to plug it all into the cpunk list to see how well it works. its the most promising route I know of at the moment, for solving an extremely difficult problem that pervades cyberspace. however, B.M. has been working on the project for a long time and at least from my perspective it doesn't seem to have reached "critical mass" yet, which surprises me. anyway, the URL http://www.cs.umn.edu/Research/GroupLens/grouplens.html is anyone here familiar with this project? what do you think about how effective it is?

2 1

Re: Prof Shamir arrested
by John Young 18 Dec '03

18 Dec '03

At 03:00 PM 10/21/96 -0400, Jim Byrd wrote: >At 02:56 PM 10/21/96 +0100, Tom Womack <thomas.womack(a)merton.oxford.ac.uk> >wrote: >> >>A few column inches in the British Independent had Prof Avi Shamir (who I >>guess is the S in RSA) arrested in Israel, on (I believe) suspicion of >>involvement in a substantial fraud. > >The S in RSA is Adi Shamir. Do you know if this is the same person? Do you >have any more details? Since we posted the item below to c'punks this morning, I see that WSJ and Financial Times have stories on the News Datacom tax fraud raid. Perhaps Shamir has not been actually arrested, maybe only implicated. Anyone in Jerusalem know more? ---------- In a coincidence with the Biham/Shamir smart card attack, AP reports October 20 on an Israeli raid of News Datacom Research for $150 million tax fraud, allegedly because locally developed crypto products were smuggled out of the country. News Datacom develops and markets encryption systems for pay-TV based on Shamir's work, and he is a part-owner. Recall that Markoff's story on DFA cited Bahim's experience with pirate-TV and smart-card tampering. Financial Times ran stories last May about the company's financial derring-do, which we've placed with the AP report at: http://jya.com/keylok.txt We've also put the Biham/Shamir DFA post and NYT article at: http://jya.com/dfa.htm

1 0

Re: Prof Shamir arrested
by jim bell 18 Dec '03

18 Dec '03

At 02:56 PM 10/21/96 +0100, Tom Womack wrote: > >A few column inches in the British Independent had Prof Avi Shamir (who I >guess is the S in RSA) arrested in Israel, on (I believe) suspicion of >involvement in a substantial fraud. We should carefully note the use of the word "fraud" in this message, and presumably it's how the news story will describe the situation. Notice that the authors of the idea, "Binding Cryptography," repeatedly like to use the term "fraud" to describe sending bits with other than the prescribed pattern which shows that the key has been appropriately GAK'd. Further recall that the so-called "Bit Tax" idea, the one most recently proposed by that Belgian (?) Luc Soete, would apparently require that any data transmitter keep account of any data it sends, in order to collect some sort of tax, and thus any mistake in the count (either as a result of misinterpretation of the rules, or a disk crash, or a power surge, etc) would presumably turn a minor error into "tax fraud," or maybe they'll call it "bit fraud." My opinion was and is that one of the worst aspects of that bit tax idea was that it would automatically result in essentially everybody becoming unavoidably guilty of this "bit fraud", which from the name would presumably be criminalized. Further, unlike taxing the profits of the ISP or a gross tax on revenue which was analogous to a sales tax (neither of which had anything to do with the actual data being transmitted) a "bit fraud" situation would presumably be used to justify wiretapping, ostensibly just to count bits, but in reality would allow content monitoring as well. And since the ISP would be under the gun for such a charge, presumably the government could extort cooperation from him, particularly encouraging him to violate the terms of the agreement he may have previously signed with his customers and divulge information without a warrant. Isn't it interesting, however, that the term "fraud" can be misused to make what was previously not a crime into a crime? Don't you wonder why the authors of that "Binding Cryptography" idea don't explain why a person would agree to some kind of GAK'd encryption standard which would (given the repeated use of the word "fraud") leave him open to what could become criminal charges some day? After all, the term fraud implies that somebody is being misled, and seriously misled at that. However, most owners of equipment which is used to carry data on the Internet have only limited and marginal interest in the content of that data, and certainly would have no reason (absent some arm-twisting by government) to monitor and check the keys of the data it transmits. If I owned equipment which transmitted Internet data, I wouldn't consider myself "defrauded" if some data went over that circuit which didn't have the correct-GAK data included. Against whom, then, is this "fraud" against? There's an old saying: "When the only tool you have is a hammer, you treat all problems as though they are nails." Well, governments and its apologists and minions seem to think that the main tool they have is being able to declare something to be "fraud" and punish it accordingly, and naturally they're anxious to convert all problems to "fraud" problems. That's why Luc Soete wants a bit tax, and I think that's why our Dutch friends keep talking about fraud in their government-friendly GAK system. And I won't be surprised if Avi Shamir is yet another victim of the "fraudification" of cryptography. I wonder if Professor Shamir will now be receptive to a cryptographic solution to a political/governmental problem? Jim Bell jimbell(a)pacifier.com

1 0

Tim May is a fine person.
by anonymous＠miron.vip.best.com 18 Dec '03

18 Dec '03

Tim May's early support of the cypherpunk concept has helped advance the culture of humanity! A true scholar, Tim analyzes the various ideas presented to the cypherpunks list, and gives his honest opinion, even when that opinion is not popular. In doing so, Tim displays truly noble courage. Unlike some others on this list, Tim has not sought to make purely personal attacks of the other inhabitants of the list and has shown impeccable restraint in doing so.

7 10

Selections from RISKS DIGEST 18.54
by Alan Olsen 18 Dec '03

18 Dec '03

The latest issue of RISKS has some info of Crypto interest. The second one may have been posted to the list, but the first is well worth reading. (Shamir Adi on new methods of breaking sealed module cryptosystems. Maybe this is why they hauled him away...) >Date: Fri, 18 Oct 1996 16:58:50 +0200 >From: Shamir Adi <shamir(a)wisdom.weizmann.ac.il> >Subject: A new attack on DES > >You have recently referred in RISKS [18.50, 18.52] to the ingenious new >attack against public key cryptosystems developed at Bellcore. All the >published information on the subject (including Bellcore's press release) >stress that the attack is not applicable to secret key cryptosystems. Well, >Eli Biham and I have just released a research announcement in which we show >that an extension of the attack can, under the same realistic fault model, >break almost any secret-key algorithm, including DES, multiple DES, IDEA, >etc. The attack on DES was actually implemented on a PC, and it found the >key by analysing fewer than 200 ciphertexts generated from unknown >cleartexts. > >Adi Shamir > >= = = = = = > >Research announcement: A new cryptanalytic attack on DES > >Eli Biham Adi Shamir >Computer Science Dept. Applied Math Dept. >The Technion The Weizmann Institute >Israel Israel > > 18 October 1996 > (DRAFT) > >In September 96, Boneh Demillo and Lipton from Bellcore announced an >ingenious new type of cryptanalytic attack which received widespread >attention (see, e.g., John Markoff's 9/26/96 article in the New York Times). >Their full paper had not been published so far, but Bellcore's press release >and the authors' FAQ (available at >http://www.bellcore.com/PRESS/ADVSRY96/medadv.html) specifically state that >the attack is applicable only to public key cryptosystems such as RSA, and >not to secret key algorithms such as the Data Encryption Standard (DES). >According to Boneh, "The algorithm that we apply to the device's faulty >computations works against the algebraic structure used in public key >cryptography, and another algorithm will have to be devised to work against >the nonalgebraic operations that are used in secret key techniques." In >particular, the original Bellcore attack is based on specific algebraic >properties of modular arithmetic, and cannot handle the complex bit >manipulations which underly most secret key algorithms. > >In this research announcement, we describe a related attack (which we call >Differential Fault Analysis, or DFA), and show that it is applicable to >almost any secret key cryptosystem proposed so far in the open literature. >In particular, we have actually implemented DFA in the case of DES, and >demonstrated that under the same hardware fault model used by the Bellcore >researchers, we can extract the full DES key from a sealed tamperproof DES >encryptor by analysing fewer than 200 ciphertexts generated from unknown >cleartexts. The power of Differential Fault Analysis is demonstrated by the >fact that even if DES is replaced by triple DES (whose 168 bits of key were >assumed to make it practically invulnerable), essentially the same attack >can break it with essentially the same number of given ciphertexts. > >We would like to greatfully acknowledge the pioneering contribution of Boneh >Demillo and Lipton, whose ideas were the starting point of our new attack. > >In the rest of this research announcement, we provide a short technical >summary of our practical implementation of Differential Fault Analysis of >DES. Similar attacks against a large number of other secret key cryptosystems >will be described in the full version of our paper. > >TECHNICAL DETAILS OF THE ATTACK > >The attack follows the Bellcore fundamental assumption that by exposing a >sealed tamperproof device such as a smart card to certain physical effects >(e.g., ionizing or microwave radiation), one can induce with reasonable >probability a fault at a random bit location in one of the registers at some >random intermediate stage in the cryptographic computation. Both the bit >location and the round number are unknown to the attacker. > >We further assume that the attacker is in physical possession of the >tamperproof device, so that he can repeat the experiment with the same >cleartext and key but without applying the external physical effects. As a >result, he obtains two ciphertexts derived from the same (unknown) cleartext >and key, where one of the ciphertexts is correct and the other is the result >of a computation corrupted by a single bit error during the computation. For >the sake of simplicity, we assume that one bit of the right half of the data >in one of the 16 rounds of DES is flipped from 0 to 1 or vice versa, and >that both the bit position and the round number are uniformly distributed. > >In the first step of the attack we identify the round in which the fault >occurred. This identification is very simple and effective: If the fault >occurred in the right half of round 16, then only one bit in the right half >of the ciphertext (before the final permutation) differs between the two >ciphertexts. The left half of the ciphertext can differ only in output bits >of the S box (or two S boxes) to which this single bit enters, and the >difference must be related to non-zero entries in the difference >distribution tables of these S boxes. In such a case, we can guess the six >key bit of each such S box in the last round, and discard any value which >disagree with the expected differences of these S boxes (e.g., differential >cryptanalysis). On average, about four possible 6-bit values of the key >remain for each active S box. > >If the faults occur in round 15, we can gain information on the key bits >entering more than two S boxes in the last round: the difference of the >right half of the ciphertext equals the output difference of the F function >of round 15. We guess the single bit fault in round 15, and verify whether >it can cause the expected output difference, and also verify whether the >difference of the right half of the ciphertext can cause the expected >difference in the output of the F function in the last round (e.g., the >difference of the left half of the ciphertext XOR the fault). If >successful, we can discard possible key values in the last round, according >to the expected differences. We can also analyse the faults in the 14'th >round in a similar way. We use counting methods in order to find the key. >In this case, we count for each S box separately, and increase the counter >by one for any pair which suggest the six-bit key value by at least one of >its possible faults in either the 14'th, 15'th, or 16'th round. > >We have implemented this attack on a personal computer. Our analysis >program found the whole last subkey given less than 200 ciphertexts, >with random single-faults in all the rounds. > >This attack finds the last subkey. Once this subkey is known, we can >proceed in two ways: We can use the fact that this subkey contains 48 out of >the 56 key bits in order to guess the missing 8 bits in all the possible >2^8=256 ways. Alternatively, we can use our knowledge of the last subkey to >peel up the last round (and remove faults that we already identified), and >analyse the preceding rounds with the same data using the same attack. This >latter approach makes it possible to attack triple DES (with 168 bit keys), >or DES with independent subkeys (with 768 bit keys). > >This attack still works even with more general assumptions on the fault >locations, such as faults inside the function F, or even faults in the key >scheduling algorithm. We also expect that faults in round 13 (or even prior >to round 13) might be useful for the analysis, thus reducing the number of >required ciphertext for the full analysis. > >OTHER VULNERABLE CIPHERS > >Differential Fault Analysis can break many additional secret key >cryptosystems, including IDEA, RC5 and Feal. Some ciphers, such as Khufu, >Khafre and Blowfish compute their S boxes from the key material. In such >ciphers, it may be even possible to extract the S boxes themselves, and the >keys, using the techniques of Differential Fault Analysis. Differential >Fault Analysis can also be applied against stream ciphers, but the >implementation might differ by some technical details from the >implementation described above. > >------------------------------ > >Date: Fri, 18 Oct 1996 09:21:58 -0400 (EDT) >From: Edupage Editors <educom(a)elanor.oit.unc.edu> >Subject: "Key Recovery" Replaces "Key Escrow" in Encryption Plan (Edupage) > >The latest government proposal for encryption software controls touts a new >approach called "key recovery." This provision would allow law enforcement >officials to rebuild, or "recover" the mathematical key to encoded messages >with the help of third-party code-breakers. The new policy reflects >suggestions made in a National Research Council report released earlier this >year. Under the Clinton plan, encryption keys would be expanded from 40 >bits to 56 bits in products to be exported, provided the company agrees to >the key recovery process. In addition, authority to issue licenses for >overseas sales of such products would move from the State Department, where >they're handled as "munitions," over to the Commerce Department. The >Business Software Alliance, however, is still not completely happy with the >compromise. "We expect to go back to Congress," says a BSA spokeswoman. >"Although the announcement was clearly a step in the right direction, it's >not at all what the industry was looking for in its entirety." (*Investor's >Business Daily* 17 Oct 1996 A4; Edupage 17 October 1996)

1 0

Re: Question: OTP
by jim bell 18 Dec '03

18 Dec '03

At 03:06 PM 10/21/96 +0000, paul(a)fatmans.demon.co.uk wrote: > >> This whole thing seems crazier each time I think about it. >> basically my question is: given that he picks his key securly does he have >> an OTP if the plaintext is shorter than the key? >> Bob > >Yes, if he were just to modular add the key to the plaintext (or XOR >them) he would have an OTP if AND ONLY IF the key were real random, >however, he doesn`t do this, he uses the key to seed an array or >linear congruential generators, which have been cryptanalysed to hell >and back. I think that there may be at least one potential application for a sorta-OTP system to be overlaid on a reasonably-secure public-key system: I think there might be an use for a system that allows the recipient of a message to prove to his own satisfaction that the sender of the message is who he says he is, but does NOT allow him to prove this to anyone else's satisfaction. The goal would be to prevent one party to the commucation from being strongarmed into not only revealing the data, but also providing trustworthy evidence against the other person. I haven't thought about this in enough detail to know if this is practical. Jim Bell jimbell(a)pacifier.com

1 0