December 2003 - cypherpunks-legacy

I'M BACK
by Sandy Sandfort 17 Dec '03

17 Dec '03

C'punks, I have completed my journey across the continent and am now ensconsed in the Greater Gotham Metropolitan Area. I can still be reached at all my old e-mail addresses (ain't technology great?). Last night, Duncan, his wife, Lois, and I enjoyed a fine dinner in "the Village" with Heroes of the Revolution, Matt Blaze and Eric Hughes. The food was good; the waitress was cute; maybe this East Coast thing will work out. Duncan and I will commence the Privacy Seminar sometime next week, or as soon as I overcome truck lag. (Hey, you try driving 3,000 miles {5,000 kilometers for our non-US list members} sometime. It's exhausting.) S a n d y

2 1

Utlimate spying machine
by John Young 17 Dec '03

17 Dec '03

Pointers: John Markoff writes in today's NYT about NSA's contract with Cray Computer Corporation for development of "ultimate spying machine", p. D3. May be related to full-page coverage today on threat of uncontrolled Russian nuclear material and another article about Energy Department's denial that the issue is being pumped for funding reasons.

1 0

Re: CIA Using Remailer System?
by jdd＠aiki.demon.co.uk 17 Dec '03

17 Dec '03

In message <199408181058.AA15812(a)xs4all.hacktic.nl> nobody(a)vox.hacktic.nl writes: > Wouldn't it be funny, if the CIA (or other agency) used the remailer system > (alon with PGP) for regular communication with operatives overseas. When the CIA wanted to deliver some packages during the Viet Nam war, they set up their own air line, Air America. If they wanted to send encrypted traffic through a 'civilian' system, I would suppose that they would do the same sort of thing. Did you know that Sprint has set up a Global SprintLink service, with offices opening up in London, Paris, and Tokyo, and that Sprint already handles a large chunk of the traffic to the former Soviet Union? They have a direct link from Falls Church (you know, next to Langley) VA to Moscow. ;-) -- Jim Dixon

3 2

Re: Are "they" really the enemy?
by jdd＠aiki.demon.co.uk 17 Dec '03

17 Dec '03

In message <9408160310.AA13160(a)phoenix.aps.muohio.edu> Shalder Flow writes: > > What I said was : "to work with a system, you need to understand it > > objectively". [snip snip] > > I've been watching this for a bit (I lurk here a lot) and this discussion > is really interesting. I have some questions. How are we going to > understand the system objectively? By objectively do you mean logically, > mechanistically, magically? To understand something you must become somewhat dispassionate about it. Otherwise your observations are warped and you simply do not see what does not agree with your preconceptions. > Its clear you can't seperate yourself from > "the system," even the "government system" as a member of this country. Well, in some sense this is true, and the universe is one, and so on and so forth. But actually all of us observe systems in operation every day. For example, the police force in your city is a distinct little system. If you do not believe this, go out and buy yourself a uniform, a gun, etc, and walk around the town for a while. You will find that the police will disagree with your simplistic theory and will arrest you. > Sure, you can not vote, not participate, and try to observe it, but we're > all part of those average americans that you point out make up the > government. (a) It is not necessary to withdraw from participation in order to observe; it is only necessary to be dispassionate, specifically in regard to your explanations or theories about things. In fact, participation will probably make you a better observer. (b) My comments about average Americans are somewhat more guarded than what you say I say. My point was that in trying to understand the government it is best to start from the elementary observation that it is staffed by a more or less random selection of Americans, not devils incarnate. If you look more closely, you will find that certain types tend to concentrate in certain departments, and then again experience causes some to become alienated from the population at large. > > > In _Systemantics_, John Gall conducts a very interesting examination of > > > man-made systems and their behavior. He notes that all man-made systems > > > exhibit certain traits, among them growth, encroachment and promulgation > > > of intra-system goals. Your observation on the people employed by > > > government may be right on target, but it doesn't take into account the > > > entity of government itself. This entity cannot be touched, > > > communicated with or coerced. The last sentence has a certain noble silliness about it. A mob is a man-made system. It often grows, encroaches, and promulgates its own goals. Yes. But all of us know that it can touch and be touched, it can be communicated with (ask any demagogue), and coerced (read Napoleon's remarks on the utility of grapeshot in coercing mobs). > I'll have to check out this book-- it sounds very interesting. I'm > bothered by the statement "all man-made systems." I find it hard to > believe that such generalizations can be made. Is it all man made > systems of a certain size? Of Western philosophical culture? Does my > family exhibit these traits? My circle of friends? I must read this > book myself to fully understand you point. > > > I more or less agree. Now apply your arguments to this list as a > > man-made system. > > OK, I should have read along a bit farther. > > > > Put another way, even though every person within the system may be a > > > "good man", the system itself isn't necessarily good. > > > > I agree. But recall that I never spoke of goodness; I just said that > > the people who work for the government are pretty much a random > > assortment of Americans. On the other hand, there have been several > > heated statements to the effect that 'all lawyers are X' and 'all > > government employees are Y'. It is this that I disagree with the most. > > Makes sense... you dislike generalizations based on occupation. Not really. What really bothers me is generalizations that are based on nothing and/or generalizations that the generalizer is unwilling to defend. I _like_ generalizations, whether based on occupation or anything else, that are accurate. And I was trained in the scientific method, which means first you take a good look at the real world, then you make up theories, then everyone has a good time poking holes in them, then you do it all over again. > So what do we do? It seems we've pretty much agreed that governments are > beasts beyond anyone's control, but so is _society_. So is the entire > human population. Personally, I find these statements very disturbing, because they are so empty. The 'beast beyond control' is your image in the mirror. The government that you are so concerned about controlling is staffed by people like you and me. They look in _their_ mirrors and they feel threatened too and they want to control what they see too. > Where do we start? If, or based on the words of many > on this list, we tear down the government, will we understand the > resultant human-made system any better? You won't tear down the government without replacing it. And I would argue that the more violent the means used to tear down the government, the more repressive its successor. Governments exist in part because we are such dangerous animals. -- Jim Dixon

2 1

Re: Are "they" really the enemy?
by bshantz＠spry.com 17 Dec '03

17 Dec '03

>> Where do we start? If, or based on the words of many >> on this list, we tear down the government, will we understand the >> resultant human-made system any better? >You won't tear down the government without replacing it. And I would >argue that the more violent the means used to tear down the government, >the more repressive its successor. Governments exist in part because >we are such dangerous animals. Well said, Jim. However, I question the "more repressive its successor" part. (Note: I have nothing to back up that statement, except that it didn't hit me as being entirely true.) Brad >>>>>>>>>>>>>>>>INTERNETWORKING THE DESKTOP<<<<<<<<<<<<<<<< Brad Shantz bshantz(a)spry.com Software Engineer Main #: (206)-447-0300 SPRY Inc. Direct #: (206)-442-8251 316 Occidental Ave, 2nd Floor FAX #: (206)-442-9008 Seattle, WA 98104 WWW URL: http://WWW.SPRY.COM ----------------------------------------------------------- >>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

1 0

Re: Are \"they\" really the enemy? (Systems commentary)
by jdd＠aiki.demon.co.uk 17 Dec '03

17 Dec '03

In message <199408180713.AAA28521(a)deepthought.pylon.com> the impostor "Jim.Dixon": @pylon.com:; writes: > System-makers typically expect automatic processes to determine > the character of the whole, and the operations themselves > become the purpose for which the system exists. [etc] This whole discussion, I think, begins with a misconception: the original writer was talking about the idea that a group has an existence separate from that of its members; you are talking about systems that people have designed, or think that they have designed. > When a system is designed to organize human behavior (as in > "governing" it) it has the inherent mistake of being based on > the presumption of complete knowledge of human nature (yet who > agrees on what that comprises). Only a philosopher could make such a statement. A family is such a system, but it is based on no such presumption. Families begin in what is usually a completely mindless activity. And any honest parent of teenage children will admit that he or she is almost totally ignorant of human nature. If the parent doesn't admit it, the child will let the parent know. Most of us just bumble along. We have little theories. We recognize that we do not have complete knowledge of anything. > Anyone who is circumscribed by > the system created is held within its confines, is judged by > its borders and by its limits upon their decisions. If someone > wants to try out an idea or method which does not fall within > the allowances set up within it, they must first go outside of > the system to have the freedom to act according to the new > idea. Or they must be willing to raise hell. Once again, look at any family with children. The parents set limits. The children throw themselves into challenging those limits with great abandon. Some kids leave when they see that the system cannot challenge them any more. They go to look for stronger limits. > ... > > No one is going to be agreeable to participating in a venture > in which they do not have some confidence about the reward; in Look at real systems. Look at the family. No one is asked to join: they just get born. That's how most of us become Americans (or whatever) too. The great systems that control most of our lives are simply _there_. > a ready-made system if someone has become dependent upon the > security it provides, they are going to be even less willing to > give up the comfort of pre-determined decisions and predictable > outcomes. Then there will be seen less of reason and more of > unimaginative automaticity. Ah, there is so much to disagree with. In the Middle Ages, people like Thomas Aquinas lived in societies and institutions which controlled thought and behaviour to a high degree. But Aquinas devoted his life to reason and he was no unimaginative automaton. Poetry is the result of forcing speech into predictable patterns. Reason depends upon the existence of accepted principles. > In a non-political system or manner of existence (not designed > to rule over human nature per se), individuals have to rely > upon their own abilities, upon the development of their own > judgement, rather than upon the "governance" of their behavior > by strangers. I think that you mean to propose this as an ideal, yes? But you fail to see that many situations are zero-sum games or even negative-sum gains, where someone must lose. And often it is in no one's particular interest to do that which is for the common good of all. One of the functions of politics and government is to limit the freedom of individuals where the exercise of that freedom can lead to harm to others. It is in everyone's interest that there be white lines down the middle of roads and that cars be forced to drive on one side or the other. > This doesn't mean that there could be no systems > in existence at all; there are still business enterprises which > call upon the coordination of efforts towards a specific goal. > But this does not obligate that they take on the quality of a > "perpetual picnic". The more that individuals look at systems > as relative to the accomplishment of particular, specific > goals, the less they will look to them as the means to > accomplish the re-shaping of mankind (i.e. the morality of the > neighbors). Such systems actually could accomplish a > "re-shaping" of some individuals, but as an accessory > contingent event, simply from the fact of those involved having > discovered a means of achieving some personal command over > "Nature". We have no choice about systems. Without the system called the English language, you and I would not be communicating. Without schools, you would have no education. And so forth. It is of course true that we can design small systems for specific purposes. But you cannot look only at the overt, rational, explicit, acceptable purposes of the group. > Trying to understand the system (whose system?) is really > putting the cart before the horse (first you need a problem, to > which the system is the solution). No. Systems exist and they have attributes which are independent of those who created them and those who staff them. You walk around the corner and there is a mob. The mob is a little system, like a dust devil. What it is a solution to is irrelevant. It is there, and it has an effect on you. You need to understand it to some degree if you want that effect not to be harm. The people in the mob may be carried away by what they see as noble motives and they may not even notice the harm that they do to things and passers-by. Motives are far less important than effects. > Trying to understand all of > human nature is a Major Enterprise. It's much more managable > to set up small systems based upon the control of those who > have cause to set one up, who are interested & willing to > participate, than trying to set up an all-encompassing system > which includes even unrully, ungrateful beasts with an attitude. The author of the original comments might say that when you set up your little system, call it the overt one, you will at the same time set up another, call it the covert one. The covert one arises in part out of private, unconfessed motives. It is just as real and often far more effective than the overt one. I knew this guy in Calcutta, in India. He was a Salvation Army major. He ran a group that distributed food to the very poor. Every day they went out in a jeep and fed thousands of people from a big pot in the back. This is the overt system. A selfless relief worker, a group of kindly saints bringing food to the starving. The number of starving people around Calcutta was always a good approximation to infinity, so the Sally Ann used a system of ID cards. These ensured that only deserving people got free food and that each person got only one meal. To many of the Bengalis, the major was the devil incarnate. They actually had no food and their families would starve without the daily visit from the Sally Ann. The major had many arbitrary rules which they could not understand. He also had a bad temper. So as they saw it, every so often, the soup god would blow up and yank someone's ID card for no reason. They were extremely careful when he was around. He terrified them. They propitiated their dark god daily. This was the covert system. -- Jim Dixon (the real one)

2 1

Public Key Encryption/RSA/Information Security
by Daniel Houser 17 Dec '03

17 Dec '03

I understand that you run some sort of service (a "zine"?) relating to RSA and cryptography. I'm very interested in this kind of thing, and am currently doing some work on information security topics. Any information you could provide me with would be relished! Thanx Dan Houser, CSP ddhouser(a)freenet.columbus.oh.us

1 0

Re: Zimmermann on PGP 2.6 myths
by alano＠teleport.com 17 Dec '03

17 Dec '03

> >-----BEGIN PGP SIGNED MESSAGE----- > >To: All Users of PGP >From: Philip Zimmermann, creator of PGP >Re: Misconceptions about PGP 2.6 from MIT >Date: 18 Aug 94 > >I'd like to clear up some widely held misconceptions about PGP >version 2.6 from MIT. I get a lot of email and phone calls from >people who report a lot of misinformation on many Internet newsgroups >about this MIT version of PGP. > [Stuff Deleted] >- --------------------------------------------------------------------- >Myth #2: PGP 2.6 is weaker than previous versions, with a back door. >- --------------------------------------------------------------------- > >This is not true. I would not allow MIT or anyone else to weaken PGP >or put a back door in. Anyone who knows me will tell you that. > >This is not to say that PGP doesn't have any bugs. All versions have >had bugs. But PGP 2.6 has no known bugs that have any net effect on >security. And MIT should be releasing a bug-fixed version of PGP 2.6 >Real Soon Now. In my opinion what helped to contribute to this assumption was the downreving of RSAREF from 2.0 in PGP 2.5 to 1.0 in PGP 2.6. (That with the "expiration date" seemed to make things look pretty evil.) What is the difference between RSAREF 2.0 and 1.0 and should I be concerned? /========================================================================\ |"I would call him a Beastialic Sadomasochistic | alano(a)teleport.com | |Necrophile but that would be beating a dead | Disclaimer: | |horse." -- Teriyaki (What's up Tiger Lily?) | As if anyone cares! | \========================================================================/

1 0

NSA Spy Machine and DES
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

It is a fun game to contemplate the powers of the machine that Cray Research is creating for the NSA. Early reports note that it will have 512,000 SIMD processors. The proceedings of Crypto 92 contains a paper I wrote describing a slightly strange design for a DES cracking machine that used "off-the-shelf" associative memory chips built by Coherent Research Inc in Syracuse, NY. (Incidentally, the chips still aren't "on-the-shelf" yet.) Each line in the chip had 42 bits and a really, really dumb processor. That meant you could get 1024 processors on a chip. They weren't packed very densely and I'm sure it would be possible to get 16k or maybe even 64k processors on the chip today. The processors are really dumb. They take 57126 cycles to encrypt one 64 bit block of data with a 56 bit key using standard DES. At 50 Mhz, it took 1 million chips to search the entire DES keyspace in one day. That was 1 billion processors running at once. I calculated at the time that this would cost $30 million in the 92 paper. I've revised this and I think it is eminently possible to get it for about $2 million if you bargain with the fabrication plants. This is, though, just a guess. It was also possible to estimate how long it would take to crack UNIX passwords. A 2 million processor machine could knock off all 7 character passwords composed of alphanumeric characters (A-Z, a-z, 0-9) in one day. Given that the processors I used are probably as dumb as could ever be invented, I think it is fair to say that 7 character passwords could be cracked by this new Cray in four days. Also, DES could be cracked in 2000 days using this machine and a very brute force approach. But let's give the NSA/SRC some credit. These new SIMD processors are probably smarter. Let's say that they're 64 bit wide RISC machines which can only access their own local on chip memory. If they can run 2 times faster (100 MHz) and do DES encryption in 1000 cycles, then this means that the brute force attack on DES could be done in 4 days. Bam. Is it fair to do DES in 1000 cycles? There are 16 rounds and each round consists of passing a value through an S Box and adding it in with a key and part of the result. The most time consuming part is computing the sbox result. There are 8 sboxes in play that operate on 4 bits at a time. Lets assume that they compute the sboxes by looking them up in a table. If it takes 4 cycles to go to memory and an extra cycle to add in the result, then that is 40 cycles to compute the sbox. The key computation involves several shifts and some more adds. Let's say 10 cycles. Use the other 14 cycles for book keeping and that leaves 64 cycles per round or 1024 cycles to do the encryption. That translates into 4 days per DES attack. Could it go faster? On chip memory access could be done in one cycle. You might be able to push things down to 24 cycles per round. That would get you near 1 day per attack. I don't see going any faster. Is it fair to assume that you can build 512,000 low-grade 64 bit processors for a price? The newspaper stated that the contract was worth $4.5 million. Let's allocate $512,000 for the SIMD chips. That $1 a processor. Let's say you can get 800,000 transistors for $10 in bulk quantities today. That's 80,000 transistors per processor. It seems reasonable to me that you can get a pretty okay 64 bit processor with some local memory for that amount if you strip away all of the cache management, floating point and multiplication. But this really isn't my area of expertise. I would welcome more informed analysis. The best data point, though, would be some papers about the Processor-In- Memory project run by the Supercomputing Research Center in Bowie, MD. This is a semi-public project and there have been some pre-prints circulating. They built some early machines that added a few processors to each memory chip. You could write to these chips like normal memory until you flipped a logic line. Then all writes would be routed to the processors which would treated the write as an instruction. There were something like 8 or 16 processors on a chip. I can't seem to find my copies of them. They would give great insight into the past work of the NSA. Given this, I conclude that this new machine is the first public acknowledgement that the NSA will have the ability to use a brute-force attack on DES in about 4 days. It also implies that 7 character alphanumeric UNIX passwords can be knocked off in no time of consequence. These are all back of the envelope computations about people pushing the technological envelope. I would enjoy hearing about any arguments or suggestions that people have about the details. The RISKS? Passwords _REALLY_ need to be longer. DES needs to be replaced by triple-DES or something similar.

4 3

NSA Spy Machine and DES
by John Young 17 Dec '03

17 Dec '03

Responding to msg by pcw(a)access.digex.net (Peter Wayner) on Thu, 18 Aug 4:41 PM Peter, Thanks for posting your thoughts on this. A small note: The NY Times article today said that NSA will contribute $4.2 million toward *development*, along with $400,000 in software-consulting services, while Cray will invest another $4.8 million. Thus the overall cost, after full development, may be more than you assumed in your calculations and thus the power may be more. But, as the story said, Cray will need more than this initial contract to survive, so the machine may never be completed. John

1 0