December 2003 - cypherpunks-legacy

Re: Can we kill single DES?
by jim bell 17 Dec '03

17 Dec '03

At 04:27 PM 10/1/96 -6, Peter Trei wrote: >Unlike many cypherpunks, I actually write code (:-). I took Phil >Karn's DES386 as a starting point, and modified it to run effiiciently >on the Pentium. The code I've written will run 14 round DES (all >that is required for a key test app) at 254,000 crypts/sec on a >90 MHz Pentium. > >Allow about 10% overhead for key scheduling (there are some tricks to >speed this up), and we're still at about 250,000 keys/sec on a 100MHz >Pentium (I'm using a nominal 100 MHz Pentium as my 'unit' of >cpu power). [snip] >On this type of processor, it would still take 9133 years to exhaust >a 56 bit key space. On the other hand, on 20,000 processors of this >power it would take less than 6 months. If the target is encrypted >in a chaining mode with an unknown 8 byte IV, the time more than >doubles. [snip] >Questions for general discussion: > >1. Is this a good idea? What will happen if DES becomes perceived > as insecure? Reluctantly, I'd have to say that I don't think this is a good idea. If anything, what this would inadvertently demonstrate is how difficult (at least, with non-dedicated hardware) it is to crack DES. The resulting number will be misleading if it doesn't represent the real danger to encryption users. I contend that a misleading estimate is actually worse than none at all, because it is a number which can be misused. They can say, "Hey, these guys had to apply $10-20 million dollars worth of computer equipment for a full year just to get the contents of a SINGLE MESSAGE!" The real danger is, indeed, a dedicated system, because it would presumably be the way a "real opponent" would do it. First, my assumptions: I assume that it would be generally straighforward to build a cracking chip that tries 10 million keys per second, with a great deal of internal parallelism and pipelining. This is a factor of 40 higher than the number you quoted above for a 100 MHz Pentium. Further, I assume that at least 10 of these chips could be installed on a single card in a PC, monitored by a program running on that PC. Thus, it would take 9133 years/400, or 23 years, for a single one of these modules to try all keys. With "only" 100 of these units, a crack would take about 3 months max, 1.5 months on the average. Now, THAT sounds like a real threat! It would be a far more effective demonstration of the weakness of DES. Compared to this, the alternative, say an average of a crack in a year with 4500 machines, is practically meaningless. An even more ominous configuration would involve perhaps 50 chips per full-length board, seven boards installed in a stripped-down PC, which would produce a crack in 4 months average with one system alone. So how would all this be done? First, write a serious proposal for the project and circulate it among companies with fab capacity. How about finding a custom, semi-custom, or other semiconductor manufacturer who would be willing to do the fab in exchange for the publicity, or a deep discount. It might be particularly "relevant" if that company had an interest in seeing DES discredited, possibly because it was going to be building an encryption chip with greater security. (NTT? and their new encryption chip?) Likewise, find a politically-sympathetic designer with access to IC layout software, etc. The way I see it, there has to be a huge amount of unused 0.5-0.7 micron IC capacity around the world. Remember, we're only talking about a few hundred wafers. And for example, as I recall, I've seen a number of ads over the years for a company called "Orbit Semiconductor," which builds small-volume IC's by putting a number of different designs on a single wafer. The number of die per wafer is, more or less, based on the volume needed for that particular chip. They do a new fab run fairly regularly, to accomodate designs with fast turnaround. Presumably, they occasionally would like to do a run quickly without waiting for the wafer to "fill up" with new designs. Anyway, the way I see it, you're probably going to burn up over a million dollars worth of ELECTRICITY alone on a single crack with Pentiums. Why not get whoever is doing these cracks to donate 1/10th of this value to finance the portion of this project which cannot be "finagled"? Maybe Microsoft would be willing to help? After all, it is THEY who are going to be limited to DES-strength exports if things continue as they've been going. How about Intel? Jim Bell jimbell(a)pacifier.com

2 1

Re: Weaknesses in Smart Cards? (Re: FLA_wed)
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 2:21 AM 9/26/96, Timothy C. May wrote: ... >Strip-back of the outer packaging is possible, of course. I'd need to know >a lot more about the packaging used by VISA and other smartcard makers to >know how economical this would be. (Breaking any single card is not >necessarily a financial windfall, if the card has a limit, for example. >This puts a limit on how much $$$ can be spent on cracking a chip.) As best I can figure, extracting the secret from a Mondex card gives you not merely the money from the card, but the "digital plates" with which to mint arbitrarily much more money. I only say this because the only protocol the I can think of that fits what we do know of Mondex has this problem. This fault does not plague Chaum cash. I don't know how to code the card application so that a transient errors won't just occasionally cause the secret to be exported. Then again that may be possible to code it for "fail safe". If it were my money backing the Mondex cards, I would want to know how it worked.

2 1

Re: White House crypto proposal -- too little, too late
by jim bell 17 Dec '03

17 Dec '03

At 02:57 PM 10/1/96 -0700, Declan McCullagh wrote: > > >---------- Forwarded message ---------- >Date: Tue, 1 Oct 1996 14:56:21 -0700 (PDT) >From: Declan McCullagh <declan(a)well.com> >To: fight-censorship(a)vorlon.mit.edu >Subject: White House crypto proposal -- too little, too late [snip] >What's even more disturbing is what the administration might do >next. After the roundtable broke up, I chatted with Michael Vadis, one >of the assistant deputy attorneys general who oversees national >security issues. He said an international consensus is forming that >terrorists can use crypto; therefore crypto must be controlled. The >U.S. is certainly pushing this line at the OECD talks. > >"But it just takes one country to decide to export strong crypto," I said. >"You're missing something," said Vadis. >"What?" I asked. "Unless you're talking about import restrictions." >"Exactly," he said. >-Declan An import restriction would be even less effective than the current export restrictions. With an import restriction, a person need merely receive a given piece of software in the mail from an "unknown" benefactor, software that (surprise!) would have been illegal to import. (the software doesn't even have to be mailed from outside the US, merely trucked in by a wetback and anonymously mailed by tossing it into the ubiquitous USnail PO Box.) Redistribution of this software would have to be legal, if for no other reason than nobody could prove it was imported illegally. Nobody outside the US would have any standing to sue for copyright violation, because they couldn't import it and sell it without restrictions. Jim Bell jimbell(a)pacifier.com

5 4

Re: active practice in America [RANT]
by Dale Thorn 17 Dec '03

17 Dec '03

Marc J. Wohler wrote: > At 11:19 PM 9/30/96 -0700, you wrote: > >I'm glad you asked. I wouldn't pretend to have *the* answer, but rather > >than screw around with basic Constitutional enumerations, I think the > >"authorities" should have had the guts to challenge those cases (at > >least the most obvious ones at first, to get the ball rolling), by > >investigating and declaring mistrials based on some kind of jury > >manipulation which showed bad faith on the part of the locals. > Theory sounds great, but what if, as often was the case, the > "authorities" were the major part of the problem. I presume heirarchical authority. That's what we had in the U.S., even in the 1960's. The specific authorities running bogus juries were generally county-level. One could argue that the states, and by extension the feds, looked the other way as long as they could, and indeed they did. Once they could no longer look the other way, those higher-level authorities should have proceeded against the local governments as I specified, rather than undermining the Constitutional enumerations. If there should happen to be a good argument that the feds and states couldn't proceed against the locals because these higher-level authorities were somehow compromised (other than general scumbagness), I'd like to know how.

1 0

Re: Clipper III on the table
by jim bell 17 Dec '03

17 Dec '03

At 06:31 PM 10/1/96 -0700, Lucky Green wrote: > > > >On Tue, 1 Oct 1996, Robert Hettinga wrote: >[as to why HP and others support GAK in exchange for DES export] > >> I agree with Lucky's earlier hypothesis that HP's doing this to curry >favor >> for government contracts in lieu of an actual marketing strategy, and I >> leave TIS's motives up to the list as an exercise. ;-). > >This not a hypothesis. A policy person from HP told me that > >1. HP as well as TIS and other companies sell single DES products that >they would like to be able to export. >2. He was directed by HP's marketing department to find a way to make >that happen. >3. He therefore supports a GAK for export "compromise". HP, then, might be a good company to approach as a potential donor on a DES-cracker. While they want to be able to portray their products as reasonably secure, at the same time they want to be able to de-fuse any export limits. Showing that, say, $25,000 of hardware could crack DES in a year (and thus, presumably, $25 million could crack DES in 1/3 of a day, a budget available to the NSA et al.) would demonstrate that there's no strong reason to keep it restricted in any way. Jim Bell jimbell(a)pacifier.com

1 0

Re: Can we kill single DES?
by mpd＠netcom.com 17 Dec '03

17 Dec '03

Peter Trei writes: > Since it looks like the US government will be allowing the export of > 56 bit espionage-enabled software, it's time to kill single DES. Yes. It's an obsolete cipher with a woefully small key. Only a catastrophic failure will cause the ABA to undergo religious enlightenment. > As some of you will recall, a while back I wondered aloud about the > feasibility of brute-forcing DES on general purpose machines, ala the > RC4-40 crack last year. I'm a firm believer in "work smart, not hard." It might be interesting to run a wiring diagram of DES through a superoptimizer and see how many algebraic identities fall out. An analytical crack that could be published on the Net would be far more impressive than harnassing gigacycles on every available machine, which might very well awe the gullible into thinking DES was difficult to break. > On this type of processor, it would still take 9133 years to exhaust > a 56 bit key space. On the other hand, on 20,000 processors of this > power it would take less than 6 months. If the target is encrypted > in a chaining mode with an unknown 8 byte IV, the time more than > doubles. I can see the headlines now. "Cypherpunks show DES can withstand up to 9,000 Pentium-years of torture and keep on ticking." Remember the Law of Unintended Consequences. -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

1 0

Re: Clipper III on the table
by Omegaman 17 Dec '03

17 Dec '03

> Allow me to say here that I do not belive that Netscape will be amongst > those fooled so easily. But IBM, HP, TIS, and others have already been > fooled. The USG does not need to get every software company to agree with > their proposal. Divide and conquer. Seems that the USG has done a > marvelous job of D&C so far. > If anything, it would not be in their best _marketing_ interests to support GAK. Rejecting GAK in favor of promoting strong crypto will make them look like "good guys". This is also true of Micro$oft. And contrary to an earlier opinion, I think Bill & Co. have been soured by their experiences with DoJ. While their are far larger motivations involve, I certainly don't think Micro$oft will skip at the chance to thumb their noses at the government if it's to their advantage. Both of these companies may be willing to support a DES-crack effort me -------------------------------------------------------------- Omegaman <mailto:omega@bigeasy.com> PGP Key fingerprint = 6D 31 C3 00 77 8C D1 C2 59 0A 01 E3 AF 81 94 63 Send a message with the text "get key" in the "Subject:" field to get a copy of my public key. --------------------------------------------------------------

1 0

Re: How might new GAK be enforced?
by jim bell 17 Dec '03

17 Dec '03

At 09:39 AM 10/1/96 -0800, Timothy C. May wrote: > >Now that the shoe is dropping on "Clipper III" (or "Clipper IV"), the >"voluntary, for export, key escrow system," how might it be enforced? > >Some possibilities: [snip] >(Else what's to stop Giant Corporation from using Non-GAKked software >within the U.S., which is perfectly legal (under the "voluntary" system), >but then "happening" to have their foreign branches and customers obtain >"bootleg" versions at their end? All it takes is a single copy to get out, >and be duplicated a zillion times. Voila, interoperability, with the only >"crime" being the first export...which is essentially impossible to stop, >for so many reasons we mention so often. Conclusion: Government must make >this very mode illegal, perhaps by making it a conspiracy to thwart the >export laws....) If this solution were really practical, it would have been tried already. One of the biggest problems with enforcing anti-export laws is that there is no guarantee that anybody currently within the jurisdiction of the country involved (for concreteness, the US) is actually responsible for a given export. Let alone KNOWN to be responsible. And it's even less likely that it be "provable" within the standards of court cases. Worse, doing the prosecution does nothing about returning the copies of the program to the country of origin, making the whole exercise pretty damn futile! >Any other ideas on how the government plans to enforce GAK, to make GAK the >overwhelmingly-preferred solution? Clipper I was, I think, their best hope for promoting GAK. It would have engineered distorted-market pressure by making it artificially easy to use GAK, hard to use non-GAK. Subsequent proposals have all been weaker, less effective, less practical, and less encompassing. And the "worst" part, from the point of view of the USG, is that it's now 3.5 years after the announcement of Clipper I, and they're no closer to foisting this turkey onto us. Nobody in Congress is under the illusion that the public likes this stuff, unlike 1993 where they could at least imagine that there were no emotions running high on the subject. In 1993, they were under the impression that they could implement their fondest desires with legislation; now the only likely legislation is either anti-GAK or non-GAK. Jim Bell jimbell(a)pacifier.com

2 1

FUCK!!!!!!;-)
by Robert Hettinga 17 Dec '03

17 Dec '03

It seems to be worse than we thought? Apple and *Sun*? Doesn't *Whit Diffie* work for Sun? Curioser and curioser... Cheers, Bob Hettinga --- begin forwarded text From: sombody... Date: Wed, 2 Oct 1996 15:41:38 -0400 To: rah(a)shipwright.com Subject: FUCK!!!!!!;-) NEW YORK AND PARIS--(BUSINESS WIRE)--Oct. 2, 1996--Eleven major information technology vendors and user organizations today announced the formation of an alliance to develop an exportable, worldwide approach to strong encryption. The goal of the alliance is to enable companies to conduct secure international electronic commerce. The alliance was formed in response to demand from customers who are conducting more and more of their business processes electronically. Internationally available strong encryption would enable these firms to send sensitive information securely over the Internet and other international networks. The companies forming the alliance will achieve this by developing modern, high-level cryptographic "key-recovery" solutions that meet the requirements of business and could allow easing of restrictions of cryptographic import/export around the world. Members of the alliance are Apple Computer, Inc., Atalla, Digital Equipment Corporation, Groupe Bull, Hewlett-Packard Company, IBM, NCR Corp., RSA, Sun Microsystems, Inc., Trusted Information Systems and UPS. The alliance is also open to other companies with an interest in key recovery. "Keys" are strings of computer code that lock and unlock data. Key recovery is an approach that permits the recovery of lost or damaged keys without the need to store or "escrow" them with a third party. This approach could also meet the needs of law enforcement to act under the authority of a court order without risking the confidentiality of business data. Modern, high-level cryptography works to ensure four critical elements of security -- Confidentiality: prevents against unauthorized parties from seeing information; Integrity: determines that information has not been changed during transit; Authentication: verifies the identity of the user and the user's eligibility to access and use information; Non-Repudiation: provides evidence that a transaction took place, for example, that a customer actually placed an order. "Apple recognizes and supports the need for key recovery, and we are pleased to be a part of the alliance," said Ellen Hancock, chief technology officer and executive vice president of R&D for Apple Computer, Inc. "We believe that this alliance will help industry lead in developing solutions for secure transactions while prompting the evolution of the Internet as a business environment." "Securing commerce over the Internet using strong encryption technologies will require a common set of standards and approaches to fundamental security issues such as key recovery and key management," said Robert Gargus, Atalla president and general manager. "Once these standards are accepted and globally deployed, public networks such as the Internet will provide a secure, multi-national commercial trading environment for worldwide electronic commerce." "The alliance has struck a balance between government and business needs," said CommerceNet Chairman Marty Tenenbaum. "Allowing encryption to this degree opens the door to the proliferation of electronic commerce." "Strong encryption is a necessary element in delivering secure network business solutions to our customers worldwide. Key recovery is a mechanism that addresses government policy concerns about the export of strong encryption while at the same time meeting growing commercial needs," said Sam Fuller, vice president and chief scientist for Digital Equipment Corporation. "Digital sees this alliance as an effective means to develop open and interoperable key recovery standards." "Electronic Commerce is planned to be $1T by the year 2010 according to experts. The capability to have secured transactions is a prerequisite for the market," said Alain Couder, senior executive vice president of Groupe Bull. "Groupe Bull had been actively involved in the search for a solution to provide a balance between the legitimate need for users to have privacy, for corporations to protect their trade secrets and relationships and for governments to maintain national security. Bull has the ambition to be a leading provider of this capability with key encryption technology, smart cards and its Internet products and services." "HP is pleased to be a founding member of the alliance," said Richard W. Sevcik, HP vice-president and general manager of the Systems Technology Group. "Exportable strong encryption is a key enabler for international electronic commerce and provides businesses with the ability to perform secure transactions and other communications regardless of geography. Key recovery is one of several technologies that will be important." "Key recovery will truly open the Internet for serious business," said Irving Wladawsky-Berger, general manager, IBM Internet Division. "Once businesses are confident that their electronic transactions are safe and they control the recovery of keys, a flood of new market opportunities will open. The Internet is rapidly shifting from a place to browse for information to an environment for conducting real business." "Export controls are a fact of life," said Jim Bidzos, president of RSA Data Security. "The key recovery alliance's approach will allow companies to use cryptography with differing levels of security in an interoperable way. When the alliance implements this technology it will give the user a new level of flexibility that did not exist before. In an imperfect world this technique will at least allow you to take advantage of what governments around the world will allow." "We're delighted to be part of the alliance because we believe the adoption of a worldwide standard for key recovery is essential to solving current network security problems," said Stephen T. Walker, president and CEO of TIS. "User-controlled key recovery systems including our own products have already demonstrated that user privacy concerns and exportability requirements can be successfully addressed. But there must be worldwide interoperability. And it is our hope that the alliance will be able to accomplish that." "The work of the alliance could have a profound impact on conducting international business over the Internet," said Joe Pyne, UPS vice president of marketing. "UPS is committed to improving the movement of both information and packages in secure and time sensitive manners. The alliance allows us to combine our expertise, energies and financial strength to quickly develop standards that will open the door for rapid development of products and services." CONTACT: Apple Computer, Inc. Maureen O'Connell 408-862-6689 or Atalla Gary Lefkowitz 408-435-5715 or Digital Equipment Corp. Patrick Ward 508-493-9441 or Groupe Bull Jean-Jacques Roulmann 33-1-39-66-3970 or Hewlett-Packard Kimberly Daniel 408-447-4587 or IBM Mike Corrado 914-766-1162 or NCR Bob Farkus 513-445-2078 or RSA Data Communications Ginny Kirkley 415-595-8782 or Sun Microsystems Inc. Ray Nasser 415-786-4395 or Trusted Information Systems Homayoon Tajalli 301-854-6889 or UPS Pat Stephen 201-828-6103 KEYWORD: NEW YORK INDUSTRY KEYWORD: COMPUTERS/ELECTRONICS COMED BW0153 OCT 02,1996 --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "'Bart Bucks' are not legal tender." -- Punishment, 100 times on a chalkboard, for Bart Simpson The e$ Home Page: http://www.vmeng.com/rah/

2 2

[SPAM] Timmy May's tentacle thinks I'm Timmy May's tentacle?
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Timmy May lies, rants, posts off-topic, and pollutes the cypherpunks mailing list with his kinky sexual phantasies. Why is this cocksucking limey faggot dying from the combination of AIDS and the mad cow disease accusing me of being Timmy's tentacle? How could Timmy create a tentacle that knows something about crypto when Timmy doesn't? >Comments: Authenticated sender is <paul(a)fatmans.demon.co.uk> >From: paul(a)fatmans.demon.co.uk >To: "Dr.Dimitri Vulis KOTM" <dlv(a)bwalk.dm.com> >Date: Mon, 30 Sep 1996 17:40:49 +0000 >Mime-Version: 1.0 >Content-Type: text/plain; charset=US-ASCII >Content-Transfer-Encoding: 7BIT >Subject: Re: [AP] Afghanistan >Priority: normal >X-Mailer: Pegasus Mail for Windows (v2.31) >Message-Id: <844193561.12763.0(a)fatmans.demon.co.uk> > > >> > And this would accomplish???? And this has what to do with cryptography?? >> >> Nothing, of course - neither do Timmy May's stupid rants, lies, and personal >> attacks. >> >> By the way, your abuse of your native language suggests that you're probably >> a product of U.S. public education. > >Then it would appear that you are ranting here, your post is off >topic, you are lying, and in addition you have posted a personal >attack.. Haha! - I`ve found Tim`s secret pseudonym!!!! > > > > Datacomms Technologies web authoring and data security > Paul Bradley, Paul(a)fatmans.demon.co.uk > Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org > Http://www.cryptography.home.ml.org/ > Email for PGP public key, ID: 5BBFAEB1 > "Don`t forget to mount a scratch monkey"

1 0