December 2003 - cypherpunks-legacy

Public Key Encryption/RSA/Information Security
by Daniel Houser 17 Dec '03

17 Dec '03

I understand that you run some sort of service (a "zine"?) relating to RSA and cryptography. I'm very interested in this kind of thing, and am currently doing some work on information security topics. Any information you could provide me with would be relished! Thanx Dan Houser, CSP ddhouser(a)freenet.columbus.oh.us

1 0

Re: Zimmermann on PGP 2.6 myths
by alano＠teleport.com 17 Dec '03

17 Dec '03

> >-----BEGIN PGP SIGNED MESSAGE----- > >To: All Users of PGP >From: Philip Zimmermann, creator of PGP >Re: Misconceptions about PGP 2.6 from MIT >Date: 18 Aug 94 > >I'd like to clear up some widely held misconceptions about PGP >version 2.6 from MIT. I get a lot of email and phone calls from >people who report a lot of misinformation on many Internet newsgroups >about this MIT version of PGP. > [Stuff Deleted] >- --------------------------------------------------------------------- >Myth #2: PGP 2.6 is weaker than previous versions, with a back door. >- --------------------------------------------------------------------- > >This is not true. I would not allow MIT or anyone else to weaken PGP >or put a back door in. Anyone who knows me will tell you that. > >This is not to say that PGP doesn't have any bugs. All versions have >had bugs. But PGP 2.6 has no known bugs that have any net effect on >security. And MIT should be releasing a bug-fixed version of PGP 2.6 >Real Soon Now. In my opinion what helped to contribute to this assumption was the downreving of RSAREF from 2.0 in PGP 2.5 to 1.0 in PGP 2.6. (That with the "expiration date" seemed to make things look pretty evil.) What is the difference between RSAREF 2.0 and 1.0 and should I be concerned? /========================================================================\ |"I would call him a Beastialic Sadomasochistic | alano(a)teleport.com | |Necrophile but that would be beating a dead | Disclaimer: | |horse." -- Teriyaki (What's up Tiger Lily?) | As if anyone cares! | \========================================================================/

1 0

NSA Spy Machine and DES
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

It is a fun game to contemplate the powers of the machine that Cray Research is creating for the NSA. Early reports note that it will have 512,000 SIMD processors. The proceedings of Crypto 92 contains a paper I wrote describing a slightly strange design for a DES cracking machine that used "off-the-shelf" associative memory chips built by Coherent Research Inc in Syracuse, NY. (Incidentally, the chips still aren't "on-the-shelf" yet.) Each line in the chip had 42 bits and a really, really dumb processor. That meant you could get 1024 processors on a chip. They weren't packed very densely and I'm sure it would be possible to get 16k or maybe even 64k processors on the chip today. The processors are really dumb. They take 57126 cycles to encrypt one 64 bit block of data with a 56 bit key using standard DES. At 50 Mhz, it took 1 million chips to search the entire DES keyspace in one day. That was 1 billion processors running at once. I calculated at the time that this would cost $30 million in the 92 paper. I've revised this and I think it is eminently possible to get it for about $2 million if you bargain with the fabrication plants. This is, though, just a guess. It was also possible to estimate how long it would take to crack UNIX passwords. A 2 million processor machine could knock off all 7 character passwords composed of alphanumeric characters (A-Z, a-z, 0-9) in one day. Given that the processors I used are probably as dumb as could ever be invented, I think it is fair to say that 7 character passwords could be cracked by this new Cray in four days. Also, DES could be cracked in 2000 days using this machine and a very brute force approach. But let's give the NSA/SRC some credit. These new SIMD processors are probably smarter. Let's say that they're 64 bit wide RISC machines which can only access their own local on chip memory. If they can run 2 times faster (100 MHz) and do DES encryption in 1000 cycles, then this means that the brute force attack on DES could be done in 4 days. Bam. Is it fair to do DES in 1000 cycles? There are 16 rounds and each round consists of passing a value through an S Box and adding it in with a key and part of the result. The most time consuming part is computing the sbox result. There are 8 sboxes in play that operate on 4 bits at a time. Lets assume that they compute the sboxes by looking them up in a table. If it takes 4 cycles to go to memory and an extra cycle to add in the result, then that is 40 cycles to compute the sbox. The key computation involves several shifts and some more adds. Let's say 10 cycles. Use the other 14 cycles for book keeping and that leaves 64 cycles per round or 1024 cycles to do the encryption. That translates into 4 days per DES attack. Could it go faster? On chip memory access could be done in one cycle. You might be able to push things down to 24 cycles per round. That would get you near 1 day per attack. I don't see going any faster. Is it fair to assume that you can build 512,000 low-grade 64 bit processors for a price? The newspaper stated that the contract was worth $4.5 million. Let's allocate $512,000 for the SIMD chips. That $1 a processor. Let's say you can get 800,000 transistors for $10 in bulk quantities today. That's 80,000 transistors per processor. It seems reasonable to me that you can get a pretty okay 64 bit processor with some local memory for that amount if you strip away all of the cache management, floating point and multiplication. But this really isn't my area of expertise. I would welcome more informed analysis. The best data point, though, would be some papers about the Processor-In- Memory project run by the Supercomputing Research Center in Bowie, MD. This is a semi-public project and there have been some pre-prints circulating. They built some early machines that added a few processors to each memory chip. You could write to these chips like normal memory until you flipped a logic line. Then all writes would be routed to the processors which would treated the write as an instruction. There were something like 8 or 16 processors on a chip. I can't seem to find my copies of them. They would give great insight into the past work of the NSA. Given this, I conclude that this new machine is the first public acknowledgement that the NSA will have the ability to use a brute-force attack on DES in about 4 days. It also implies that 7 character alphanumeric UNIX passwords can be knocked off in no time of consequence. These are all back of the envelope computations about people pushing the technological envelope. I would enjoy hearing about any arguments or suggestions that people have about the details. The RISKS? Passwords _REALLY_ need to be longer. DES needs to be replaced by triple-DES or something similar.

4 3

NSA Spy Machine and DES
by John Young 17 Dec '03

17 Dec '03

Responding to msg by pcw(a)access.digex.net (Peter Wayner) on Thu, 18 Aug 4:41 PM Peter, Thanks for posting your thoughts on this. A small note: The NY Times article today said that NSA will contribute $4.2 million toward *development*, along with $400,000 in software-consulting services, while Cray will invest another $4.8 million. Thus the overall cost, after full development, may be more than you assumed in your calculations and thus the power may be more. But, as the story said, Cray will need more than this initial contract to survive, so the machine may never be completed. John

1 0

Re: CIA Using Remailer System?
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 1:46 PM 8/18/94 -0500, Paul Ferguson wrote: >That's patently false -- we're located in Herndon, Virginia, right >across the street from Dulles Airport and a hop, skip & jump down >the street from the new NRO office. ,-) Hi. I interested in talking to a marketing person at Sprint. I want "secure" ;-) high bandwidth internet access for an internet access service a client wants to start up. Can you just forward this to someone you know? Thanks! Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

Re: Are \"they\" really the enemy?
by John Young 17 Dec '03

17 Dec '03

Responding to msg by jdd(a)aiki.demon.co.uk (Jim Dixon) on Thu, 18 Aug 4:46 PM Jim (and other respondents), These discussions are pretty invigorating and I look forward to reading them. Just want to say to Jim that the following remarks of yours made about someone's earnest thoughts: >Personally, I find these statements very disturbing, >because they are so empty. Might be applied to your own later comments: >You won't tear down the government without replacing >it. And I would argue that the more violent the means >used to tear down the government, the more repressive >its successor. Governments exist in part because we >are such dangerous animals. This rhetorical ploy comes across as an apology for the status quo and seems to offer counter-revolutionary cant instead of your best arguments for making rational, evolutional improvements to our inheritance. My preference is for hard-wrought and hard-fought prickly specifics to easy, dreamy generalizations. Even though both enrich the brew. If this topic does not get blown off this list I would like to offer some specifics responses to your good stuff. What say, c'punks, is this topic okay here? Tim? Anybody? TLAs? John

2 1

PGP26A is out
by dave.hodgins＠canrem.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- A file has appeared here called PGP26A.ZIP. The readme file claims this version "fixes all known bugs" in the 2.6 version. I'm very suspicious. The file does not contain any viruses that I can detect, or have any obvious functionality problems. The pgp.exe file is signed by the key "Rebellious Guerrilla <rebel(a)f26.n374.z1.fidonet.org>". Source files are not included. The rebel key is not signed by any other keys. Does anyone here have any info on this "release"? Thanks, Dave Hodgins. -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLlPetJbACHtihSGlAQHRMgP/Z5NMbx9nqJZAQoHKw36HuXgNvGluQnAF RnswlM2d4tJmSJocCFb/9b3FAjGX+eFCP+M0pLmbuJjTHclhoYtn2kgQ7YdZML7P QV+k7qOyTcvpOyuiQwB+iY4srvFlMGiVghZxQua7kuqgHxgxXqNsuBy6U6ARDPQL FLSnz438H6s= =LHY5 -----END PGP SIGNATURE----- **EZ-PGP v1.07 cc: ALL in 5207 on CRS ALL in 1139 on CRS --- * RM 1.3 00820 * Internet:Dave.Hodgins@Canrem.com Rime->118 Fido(1:229/15)

1 0

Re: EFF on why they did it.
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

David Lesher writes: > > Paid for "by the government"?!! And just where does the EFF think the > > government gets its money? > > One difference -- the Hill must allocate money for "paid for by the > government" as compared to "just rape the switch designer" financing. > > No money, not wiretaps. That may {or may not} limit the effect of FBI > Wiretap, depending on how [much/little] the Hill loosens the > pursestrings. It's certainly a good start, but the government *does* have other money. For instance, when Clipper was first announced, they said they wouldn't need Congressional permission, because they were paying for it out of the DoJ Super Forfeiture Fund, which had about $2B in money stolen from users of politically incorrect substances. I realize that doesn't go very far when you're talking about restructuring the Global Information Infrastructure. But it's a lever to get stuff started, then they can go demanding tax money because you *can't* shut down the Phone Companies! Bill

2 1

Re: cfs & remailers
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Bill O'Hanlon writes: > I half-expect Eric or Tim to jump in here to point out that this is one > of those situations where you have to define who your enemy is, and to make > sure that your efforts apply to the situation. Well, if they won't, I will :-) You have to define your threats, or at least think about them a bit. > I run a remailer on a home Unix machine via a phone line UUCP feed. [...] > block the following foes: my service provider and any node upstream of it, > thieves/misguided law enforcement types, and phone taps. Encrypting something > that I receive in the clear over an insecure line isn't useful. It's still useful - it lets you protect yourself against attackers who seize your machine but aren't actively wiretapping. For instance, the thugs who raided Steve Jackson Games, etc. Wiretapping is a lot of work, and takes a better argument to a fancier judge than simple search warrants. Even if you are wiretapped, it lets you protect messages that got there before the wiretap started - it's not surprising to have messages stick around for a week in a uucp environment, and there are all your UUCP databases. There's also a legal problem to be addressed, since nobody's established whether remailer operators are common carriers or co-conspirators or RICO-racketeer (probably depends on the quality of lawyers you can afford.) Encrypting your disks makes it *much* harder for them to examine your system until you've had time to get a lawyer and do things in front of the judge instead of on their own in some back room. Bill Stewart

1 0

Re: Are \"they\" really the enemy?
by jamiel＠sybase.com 17 Dec '03

17 Dec '03

At 6:52 PM 08/18/94 -0400, John Young wrote: >If this topic does not get blown off this list I would like to >offer some specifics responses to your good stuff. > >What say, c'punks, is this topic okay here? Tim? Anybody? >TLAs? Go for it! These are the specifics of theory that so often get ignored here. And considering a recent thread having to do with children, I would say you are close to charter, relatively speaking... >John --Jamie "Nope, not Tim or or any other three letters" Lawrence

1 0