December 2003 - cypherpunks-legacy

limitations of fed power (was CLT&G Update: 29 Dec 98 (fwd)) (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Wed, 30 Dec 1998 11:46:39 -0700 (MST) > From: Jim Burnes - Denver <jim.burnes(a)ssds.com> > Subject: limitations of fed power (was CLT&G Update: 29 Dec 98 (fwd)) > > > >The entire point of a consitutional democracy is to avoid >centralization. > > > > > > That would be a valid point if we were living in that arrangement. I > like to be a little more specifc. We are living in a democratically elected > reprentative constitutional republic. A representative democracy is still a democracy. The ONLY guarantee of limits in ANY democracy is whether it is constitutional or not. That is the defining issue because that is what limits and defines the governmental structures. The defining issue is not whether it is representative or direct but rather that it has a constitution. A constitution and a bill of rights are in no way a requirement for a democracy (representative or direct). That constitution is what prevents mob-rule. > The point of that constitution is to shackle the tendancy of > a bureaucracy from assuming authority over matters never > assigned to it and using its enforcement powers to assure it. Which is the point under discussion after all. > Eventually the people, wallowing in ignorance, forget the > infraction and the bureacracy assumes de facto control. That is a function of human psychology and not democracy. Blaiming democracy for a function of human behaviour is more than a little misleading. People are social animals. It's gotten us this far and there is no reason to expect a radical shift in human population dynamics in the near term. Really a moot point. It is also the reason the constitution splits authorities, per the 9th and 10th, as it does. The fundamental aspect of a working democracy is conflict, not cooperation as much of todays spin doctor press would have you believe. And by conflict I don't mean spilled blood in the streets. What is really amazing about it is that we have the intelligence to recognize and deal with the trait at all. ____________________________________________________________________ What raises the standard of living may well diminish the quality of life. The Club of Rome The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

[ISN] Academic Attacks on SAFER+ (fwd)
by Max Inux 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Subject: [ISN] Academic Attacks on SAFER+ Forwarded From: "Jay D. Dyson" <jdyson(a)techreports.jpl.nasa.gov> Originally From: John Kelsey <kelsey(a)plnet.net> I believe I have found two attacks on the SAFER+ version with 256-bit keys. While these attacks aren't practical, they demonstrate a weakness in the SAFER+ key schedule design, and may lead to more practical attacks in the future. The first attack is a modified meet-in-the-middle attack, requiring 2 known plaintexts and their corresponding ciphertexts, 2^{37} bytes of memory, and work equivalent to about 2^{241} SAFER+ encryptions. I have discussed this attack with Massey, and am fairly confident it really works. The second attack is a related-key attack, requiring 256 chosen plaintexts and their corresponding plaintexts encrypted under two related keys, and work equivalent to about 2^{216} SAFER+ encryptions. This is a much newer attack (about two days old), and I am less certain of it, but I believe it works. I will be writing these attacks up for publication fairly soon, but I wanted to announce them here to get the word out, and to see if anyone can either improve on them or find problems with them. Both attacks exploit two useful properties of SAFER+. First, I will describe the two useful properties, then I will describe the two attacks very briefly. The rest of this note assumes familiarity with SAFER+. 1.0. The Two Useful Properties of SAFER+ Consider SAFER+ with a 256-bit key. The key schedule is quite simple: We extend the key by a parity byte, getting a 33 byte extended key. We then use the 33 byte extended key to generate the entire sequence of subkeys. Each subkey byte is determined by only one key byte. If you know a given key byte, you know all the subkey bytes it determines; if you know a subkey byte, you know the key byte from which it was derived. SAFER+ rounds use 32 bytes of subkey each, in two blocks of 16 bytes. If the key bytes are k[0..32], then we have First Round: k[0..15] k[1..16] Second Round: k[2..17] k[3..18] Third Round: k[4..19] k[5..20] etc. This means that it takes quite a while in the encryption process for the last couple key bytes to affect the encryption. SAFER+ with a 256 bit key has 16 rounds and an output transformation. The output transformation uses only sixteen key bytes. Now, consider how many key bytes have affected the encryption at all after each round: After the first round (round 0), 17 key bytes have been used. After the second round, 19 key bytes have been used. After the third, 21. Continuing, we can see that it takes 9 (out of 16) rounds before SAFER+ has used all 32 key bytes. This allows both of my attacks. 0 17 1 19 2 21 3 23 4 25 5 27 6 29 7 31 8 all The other useful property is that we don't have to know all the key bytes to be able to recognize an output from a round of SAFER+ as being correct. Consider the situation where we know all but the last byte of the key of some round, and we know its input block. Each SAFER+ round consists of the keyed byte substitution layer, and the mixing layer. If we know k[0..14], but not k[15..16], then we end up knowing all but two bytes of the input into the mixing layer. The result is that we end up knowing *none* of the bytes of the output. However, we still know relationships between the bytes of the output. The matrix that describes the mixing layer makes it easy to see how to combine the output bytes into values that are not dependent on the unknown bytes of input. Now, consider a situation where we know all but the last two key bytes for round 0, and all but the first two key bytes for round 1. We can go backward through the mixing layer of round 1 (it's unkeyed), and then go back through the keyed byte substitution layer, learning all but two bytes of the output from round 0. We then make use of the trick described above. We will know relationships between the remaining known bytes of output from round 0, regardless of the unknown key bytes. 2.0. The Meet-in-the-Middle Attack The real insight that makes the low-memory attack work is that we can do meet-in-the-middle with two rounds whose key material we don't know all of. That is, we guess the keys for rounds 1-7 (numbering from one), which gives us all but two of the bytes for round 8. That's 29 key bytes guessed. We then compute some expressions in the output bytes of round 8 that don't rely on knowing the two unknown bytes of key, and that don't rely on knowing the two bytes of round 8's output that will depend on the two unknown key bytes when doing the guess on the other side. We guess the keys for the output transformation (16 bytes), plus the keys for rounds 10-16. That means 30 bytes of key guessed, and it also gives us enough information to get knowledge of all but two bytes of the output of round 8. We then compute those same expressions in those bytes. The result is that we can do the meet-in-the-middle at the output from round 8, despite not knowing all the key bytes used in round 8 or 9. Round | Key Bytes Guessed 1 17 2 19 3 21 4 23 5 25 6 27 7 29 8 29 (two unknown key bytes) - - -------------- (this is where the meet-in-the-middle happens) 9 30 (two unknown key bytes) 10 30 11 28 12 26 13 24 14 22 15 20 16 18 OX 16 That is, we can compute a set of bytes that are dependent only on the 29 bytes of key guessed from the top, or the 30 guessed from the bottom. Now, this would seem to take up a lot of memory to do this meet-in-the-middle attack. Fortunately, however, most of the key bytes guessed from the top are also guessed from the bottom. We thus mount the attack by first guessing all key values in common from the top and the bottom. We then do the meet-in-the-middle by trying all possible 2^{24} values from one side, and all possible 2^{32} values from the other. We compute this intermediate value that doesn't need any other key material from both sides, store our results in a sorted list, and look for duplicates from the top and bottom. With two plaintexts, it's easy to get more than 32 bytes of intermediate values, meaning that we don't expect to see any matches from incorrect guesses. 3.0. The Related-Key Attack The related-key attack works on a similar principle. My current attack is very simple: We choose a pair of keys, K,K^*, such that the keys differ only in the first two bytes; in these two bytes, we have a difference of 0x80. Under K we encrypt 256 plaintexts, P[i], each identical except with a different leftmost byte. Under K^* we encrypt 256 plaintexts, P[i]^*, with some fixed difference D<>0x80 from P[i] in the leftmost byte, and with fixed difference 0x80 in the next byte over. With probability about 1/2, we get at least one pair of plaintexts P[i],P[i]^*, whose values after two rounds are identical under the different keys. When this happens, their values are also identical after nine rounds. Now, we do our trick from the meet-in-the-middle attack, again, and guess the last 26 bytes of relevant key material. This lets us peel off the output transformation and the last five rounds, leaving us with access to the output from the eleventh round. We can peel off the PHT layer, since we know it and its inverse. We can then learn all but two of the bytes input to the eleventh round. We now know all but two bytes of the output from the tenth round, and we know a pair of texts for which only the last two bytes of the input to the tenth tound had changed. We can check to see if the values we've computed as being the outputs from the tenth round are consistent with this situation, and thus are consistent with this being a right pair. We expect to have to check 256 different pairs of texts in this way, each with work equivalent to 2^{208} SAFER+ encryptions. This leaves us with work equivalent to about 2^{216} encryptions, total, to learn 208/256 of the SAFER+ key bits. The remaining 48 bits can be brute-forced after these are known. We thus break SAFER+ with a differential related-key attack, using 2 related keys, 512 plaintexts encrypted under each key, and 2^{216} work. Comments? - - --John Kelsey, kelsey(a)counterpane.com / kelsey(a)plnet.net NEW PGP print = 5D91 6F57 2646 83F9 6D7F 9C87 886D 88AF -o- Subscribe: mail majordomo(a)repsec.com with "subscribe isn". Today's ISN Sponsor: Internet Security Institute [www.isi-sec.com]

1 0

'Tis the day after Christmas And something's not right
by qiy68＠leica.com.au 17 Dec '03

17 Dec '03

'Tis the day after Christmas And something's not right Were painfully aware That our clothes are too tight. We ate lots of gravy And pumpkin pie too Oh, no, not a diet... But what shall we do? Now you can lose weight without suffering. Call Tides of Life at 1-888-817-7443 for information on safe, natural, and effective weight loss products. Our premier product, Cheat & Eat, contains 1000 mg of chitosan per tablet along with herbs. This binds to fats and sugars in the intestinal tract, blocking absorption and passing them out of the body before you can absorb the calories! Also stops sugar cravings. Clinical studies show an average weight loss of 4 pounds per week with no drugs, side effects or starvation diets! We are offering a great introductory price of $29.50 plus $2.50 shipping for a 6 week supply. You can buy much weaker chitosan products for $70/bottle but we have located the best product for you at the best price. Call 1-888-817-7443 for more information on Cheat & Eat and other natural weight loss products. Tides of Life has specialized in natural hormonal products and related health supplements since 1993. Free price list upon request. *-*-*-*-*-*-*-* Removal from lists, please go to http://209.216.69.189/remove/ #2167659jdfv94894hde nqr is <qiy68@leica

1 0

LEA VPN's in the South [CNN]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > X-within-URL: http://www.cnn.com/TECH/computing/9812/30/vpncops.idg/ > A HIGH-TECH WAR ON DRUGS > > Mobile VPNs are key to law enforcement alliance in Southern states > > > > December 30, 1998 > Web posted at: 3:05 PM EST > > by L. Scott Tillett From... > Civic.com > > (IDG) -- Counternarcotics units in four Southern states soon will > begin piloting a new technology that allows law enforcement officials > to work securely on mobile computers -- palmtops and laptops -- to > create virtual private networks (VPNs) over the Internet. > > As many as 3,000 law enforcement officials in Alabama, Georgia, > Louisiana and Mississippi will use a new software application product > called Viatores to build a secure VPN for sharing information while > investigating drug-related crimes. A small start-up company in > Northern Virginia, Ecutel LLC, pioneered the application. [text deleted] ____________________________________________________________________ What raises the standard of living may well diminish the quality of life. The Club of Rome The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Your ad to 1 Million...$50
by lay8＠helium.dcs.kcl.ac.uk 17 Dec '03

17 Dec '03

EMAIL YOUR MESSAGE TO ONE MILLION ADDRESSES FOR LOW INTRODUCTORY PRICE OF US$50.00 ! This is a Co-Op mailing service! I'll email your 5-line message to 1 million potential buyers for the low Special of US$50. Promote your products and services at a low cost! Very limited Space. Order your slot today! First come, first served! 1000+ SEARCH ENGINE SUBMISSION FOR ONLY US$15.00 I'll submit your web site info to 1000+ search engines, directories, free links for all for only US$15.00. Best price on the internet! SUBMIT AN AD TO 150 TOP CLASSIFIEDS: US$15.00 I'll submit your ad to top 150 internet and global sites for only US$15.00. An expensive way to promote your products/services! SUBMIT AN ELECTRONIC TRADE OPPORTUNITY: $15.00 I'll promote your product or service worldwide through the Electronic Trade Opportunities System that goes to millions of traders all over the globe! SEARCH FOR BUYERS & IMPORTERS WORLDWIDE: $15.00 Locate buyers and importers in 100 countries! I'll submit your request to 100 chambers of commerce in 100 countries. Ask them to advertise your request for local buyers, agents, importers, etc. in their country! REACH 20,000 U.S. IMPORTERS & EXPORTERS BY FAX! Ideal for non-US companies trying to enter the US market and find agents, buyers, dealers, etc.! Imagine the cost if you were to send your own fax to 20,000, let alone the DAYS you will spend doing that! With 7 other non- competing offers, we shall fax your 5 line message for only US$395.00! --------------------------------------------------------------------- ORDER FORM: __Co-Op 1 million emailing of my message for US$50 $_____ __1000+ search engine & directory, submission $15 $_____ __150 Classifieds ads submission service for only $15 $_____ __Submit electronic trade opportunity worldwide $15 $_____ __Submit search request to 100 chamber of comm.$15. $_____ __Co-op fax service to 20,000 US firms for only $395 $_____ TOTAL FOR THE ORDER:.......................US $_________ I enclose payment by __Cash __Check __Money Order __Visa __M/Card. Charge my credit card with the amount of US$______ Card#____________________ Expiry:______ Signature:_________________ Name:_________________________________ Address_______________________________ ______________________________________ City:____________________State:_________ Zip:_____________Country:______________ E-Mail(Required. Please write/type clearly): ______________________________________ Mail/fax above to: Al Jebaly, 3668 161st Terrace N., Loxahatchee, Fl. 33470. Fax (561) 792-6175. Once I receive your order, by mail or fax, I shall email you the proper Form to fill the needed information for the service ordered! Once you return this Form, I shall perform the service without delay! +-+-+-+-+-+-+-+-+ List Removals go to http://www.globalremove.com thank you very much w

1 0

GoLive CyberStudio 30-day Activation Key
by sales＠golive.com 17 Dec '03

17 Dec '03

Dear Fritzie, Thank you for downloading the GoLive CyberStudio Tryout software. Your official 30-day activation key is: TRIA1MT23NFJD8MXGGJ85UDA You'll need to enter this key when you first start-up the software. Included with the GoLive CyberStudio installation are the latest Release Notes and New Product Features for GoLive CyberStudio. NOTE: If you are using Stuffit Expander 4.5.x to decode and decompress PDF documents, please make sure the cross platform preference and the option "Convert Text Files to Macintosh Format" is set to "Never". If you have questions about how to use the Tryout software, GoLive's knowledgeable Technical Support staff is available to assist you. We suggest you first check the Technical Support section of our Web site www.golive.com. If you don't find your answers there, please send us an email at support(a)golive.com or call 1-800-554-6638. When you are ready to purchase GoLive CyberStudio or if you want to know more about why GoLive CyberStudio is the best product for Web site design, please return to our Web site or contact me at 1-800-554-6638 or 1-650-463-1580. Sincerely, Dan Fernandez Director US Sales GoLive Systems Sales(a)Golive.com

1 0

We promised!
by bill payne 17 Dec '03

17 Dec '03

John Young We made it. http://jya.com/whpfiles.htm With some help of nmol, I got wsftp working this afternoon. I failed to click on a filename. Good stuff at webmasters.nmol.com. This site is under construction. New employee Randy is putting his software at this site. In particular, look for hypersnap which captures screen shots. This WILL NOT BE OUR WORKING SITE. Only testing so see if I sort-of understand html. Without your advice and ALOPress's html compiler putting-up a web site in one day wouldn't have been possible for me. We plan to post other people's pro se and other lawsuit progress at our site. And try to get some CROOKED JUDGES and clerks removed from the federal court system. Let's hope McKinney and Grassley can help get this settled before IT GETS EVEN WORSE! bill Title: Main(Page 1) Pro se [for yourself] Pro Se Litigation with the US Federal Government Purpose of The Real World is to help Movers, Shakers, and Do-ers

1 0

Star Trek and Microsoft (fwd)
by Max Inux 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Wed, 30 Dec 1998 20:35:34 -0500 X-Loop: openpgp.net From: Christopher Baker <chrisbaker(a)iname.com> Reply-To: isp-linux(a)isp-linux.com To: isp-linux(a)isp-linux.com Subject: Star Trek and Microsoft Star Trek and Microsoft... <Picard> "Mr. LaForge, have you had any success with your attempts at finding a weakness in the Borg? And Mr. Data, have you been able to access their command pathways?" <Geordi> "Yes, Captain. In fact, we found the answer by searching through our archives on late Twentieth-century computing technology." <Geordi presses a key, and a logo appears on the computer screen.> <Riker looks puzzled.> "What the hell is 'Microsoft'?" <Data turns to answer.> "Allow me to explain. We will send this program, for some reason called 'Windows', through the Borg command pathways. Once inside their root command unit, it will begin consuming system resources at an unstoppable rate." <Picard> "But the Borg have the ability to adapt. Won't they alter their processing systems to increase their storage capacity?" <Data> "Yes, Captain. But when 'Windows' detects this, it creates a new version of itself known as an 'upgrade'. The use of resources increases exponentially with each iteration. The Borg will not be able to adapt quickly enough. Eventually all of their processing ability will be taken over, and none will be available for their normal operational functions." <Picard> "Excellent work. This is even better than that 'unsolvable geometric shape' idea." .. . . 15 Minutes Later . . . <Data> "Captain, We have successfully installed the 'Windows' in the command unit and as expected it immediately consumed 85% of all resources. We however have not received any confirmation of the expected 'upgrade'" <Geordi> "Our scanners have picked up an increase in Borg storage and CPU capacity to compensate, but we still have no indication of an 'upgrade' to compensate for their increase." <Picard> "Data, scan the history banks again and determine if their is something we have missed." <Data> "Sir, I believe their is a reason for the failure in the ' upgrade'. Apparently the Borg have circumvented that part of the plan by not sending in their registration cards. <Riker> "Captain we have no choice. Requesting permission to begin emergency escape sequence 3F . . ." <Geordi, excited> "Wait, Captain I just detected their CPU capacity has suddenly dropped to 0%!" <Picard> "Data, what does your scanners show?" <Data> "Apparently the Borg have found the internal 'Windows' module named 'Solitaire' and it has used up all the CPU capacity." <Picard> "Lets wait and see how long this 'solitaire' can reduce their functionality." .. . . Two Hours Pass . . . <Riker> "Geordi what's the status on the Borg?" <Geordi> "As expected the Borg are attempting to re-engineer to compensate for increased CPU and storage demands, but each time they successfully increase resources I have setup our closest deep space monitor beacon to transmit more 'windows' modules from something called the 'Microsoft fun-pack'. <Picard> "How much time will that buy us ?" <Data> "Current Borg solution rates allow me to predicate an interest time span of 6 more hours." <Geordi> "Captain, another vessel has entered our sector." <Picard> "Identify." <Data> "It appears to have markings very similar to the 'Microsoft' logo." <Over the speakers> "THIS IS ADMIRAL BILL GATES OF THE MICROSOFT FLAGSHIP MONOPOLY. WE HAVE POSITIVE CONFIRMATION OF UNREGISTERED SOFTWARE IN THIS SECTOR. SURRENDER ALL ASSETS, AND WE CAN AVOID ANY TROUBLE. YOU HAVE 10 SECONDS." <Data> "The alien ship has just opened its forward hatches and released thousands of humanoid shaped objects." <Picard> "Magnify forward viewer on the alien craft." <Riker> "Good Grief, captain! Those are humans floating straight toward the Borg ship with no life support suits! How can they survive the tortures of deep space?!" <Data> "I don't believe that those are humans sir, if you will look closer I believe you will see that they are carrying something recognized by twenty-first century man as doe skin leather briefcases, and wearing Armani suits." <Riker and Picard together horrified> "Lawyers!!" <Geordi> "It can't be. All the Lawyers were rounded up and sent hurtling into the sun in 2017 during the Great Awakening." <Data> "True, but apparently some must have survived." <Riker> "They have surrounded the Borg ship and are covering it with all types of papers." <Data> "I believe that is known in ancient vernacular as 'red tape' it often proves fatal." <Riker> "They're tearing the Borg to pieces!" <Picard> "Turn off the monitors. I can't stand to watch, not even the Borg deserve that." ~~~~~ ------------------------------------------------------------------------------------------ "Ultimately, education is about our place in the universe, our place in it. The bigger that connection, the bigger our lives and dreams. Through what we take to know and understand, we can be as immense as the milky way--glorious indeed." --Grace Llewellyn, _Teenage Liberation Handbook_ ------------------------------------------------------------------------------------------ Chris Baker -- chrisbaker(a)iname.com, chrisbaker(a)nls.net "If you keep looking back, you'll lose your momentum." _______ The http://ISP-Linux.com/ EMAIL DISCUSSION LIST ______ To Remove, Send An Email To: mailto:remove-isp-linux@isp-linux.com To Join, Send An Email To: mailto:join-isp-linux@isp-linux.com

1 0

Stinger strike stagesetting
by Frederick Burroughs 17 Dec '03

17 Dec '03

There's a story in the Dec. 30, 1998 Washington Post about how US intelligence acquires foreign weapons technology. Specific mention is made about trading US Stinger missile know-how to China for whatever. My guess is the government's trying to set the stage to shift blame away from CIA for leaking antiaircraft missile technology, 1000 Stingers in the hands of Afghan rebels notwithstanding, and the aircraft disasters to come. Story at: http://www.washingtonpost.com/wp-srv/politics/special/campfin/stories/vecto… And, of course the esteemed Mr. Young is always on top of things: http://jya.com/vector.htm

2 1

True Random Numbers
by Kevlar 17 Dec '03

17 Dec '03

Several months ago, someone was talking about "True random numbers" and how to obtain them, and I (rather ignorantly) suggested they run a recorded sound through a program to record a 1 for every peak of volume over a certian threshold , and a 0 for every thing quieter.(I think i suggested a russeling tree, or a waterfall) Just adjust the threshold according to the volume of your sampling. (it was clear in my mind, even if I can't explain it here) Little did I know... Read phrack 54.5. -Kevlar <Webmaster(a)max-web.com> Does God know Peano Algebra? Or does she not care if strong atheists couldnt reason their way out of a trap made of Boolean presumptions? A little bit of knowledge is a dangerous thing, but zero knowlege is absolutely subversive. Overspecialization breeds in weakness. It's a slow death. Beat your algorithms into swords, your dumb terminals into shields, and turn virtual machines into battlefields... Let the weak say, "I am strong" and question authority.

1 0