December 2003 - cypherpunks-legacy

!FLAME: breaking DES
by holland＠CS.ColoState.EDU 17 Dec '03

17 Dec '03

OK, I sort of wanted to break up the constant flaming on this thread, so I thought I would introduce my own (admittedly ignorant) way to break DES. 1. Start with a full keysearch of all 2^56 possible DES keys. 2. If you have plaintext to work with, compare each sample decryption with the plaintext. 2a. If you don't have plaintext, I would try washing the decryptions through a pattern searching algorithm that would include a dictionary, patterns from compression programs like PKZip, machine language instructions, and any other possible form of communication that can be represented as a binary string. At least that's how I would do it. If anyone has any suggestions, corrections, etc. I wouldn't mind hearing them. Doug

1 0

Re: Spread Spectrum Nets (Way to do safely)
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Robert Woodhead writes: > Succinctly, use the purloined letter technique -- hide it in plain sight. > There are RF bands set aside for unlicensed low-power operation; some > new phones use spread-spectrum techniques in these bands. It's more than just purloined-letter issues - it's *legal*. That means that the FCC won't be triangulating around to find and destroy your transmitters, which is good. So you're back to threats from the CIA/DEA/NSA/FBI, pigeons, vandals, etc., and encryption and spread-spectrum make it a lot easier to avoid problems from frustrated cops.

2 1

RSA crap
by Godzilla's Home Boy 17 Dec '03

17 Dec '03

Howzsa battles going. What are the chances of getting caught using pgp out of this country? I have friends in Russia, I'd like to use more than ordinary encryption getting to them.

1 0

DES: breaking, attacking
by Karl Lui Barrus 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On the method Douglad Holland posted about breaking the DES... an interesting property of DES is that of complimentation. That is, if encryption of plaintext P under key K produces ciphertext T, then encryption of plaintext P' under key K' produces ciphertext T', where the primes (') mean bitwise complement. If: T = DES(P ,K) then T' = DES(P', K') Cryptanalysis can exploit this if two pairs are available such that T' = T or P' = P. What this boils down to is a 50% reduction in work. So now instead of taking 10 billion years it'll just take you 5 billion :-) Complexity wise, it's just 2^55 steps instead of 2^56, so it may not buy you too much. A more interesting attack I read of is a probabilistic attack against DES. Suppose you encrypt sensitive data, and change keys once a month. I can attack you by trying as many decryptions as possible within the month. Sure, I am not guarenteed success, but the point is that if I do this month after month, I have a decent chance of success at some point during the year. And if the information you encrypt is valuable, once success during the year is all I'll need. An upcoming book on cryptanalysis details this attack; the author calculates success rates given various estimates for hardware (speed and number) and frequency of key shifting. It is quite arresting: even if you change keys every week, if I can muster enough computer power to give me a 1% chance of success, the chances are "good" that at some time during the year I'll succeed in decrypting a message. For example, if I can be guarenteed of breaking your DES encrypted message in a year (say I can mount a brute force attack that does 2^56 encryptions and takes a year), there is an 8% chance the key will be recovered in one month. So even if you change your key every month, I have an 8% chance of success. If your key is needed to conduct financial transactions and you are a bank, I can profit greatly from one success. So basically, DES is looking more and more disadvantaged with its relatively small key size (64 bits, of which 8 are predictable parity bits). Karl Barrus <klbarrus(a)owlnet.rice.edu> -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLLzEJ4OA7OpLWtYzAQHE7AP7BpG0k0bOjLbTPJbiaMzEFSZuquo/te0w EeD4cC22jru8jXCEtM6AUHp94UJucAXDzY7szDhNlcMY5uv0OIXaFyoohPxBDEw5 CxKKUt0TxpqFdGwwkW8jpPMoBtZa8rGu/yPEZJ9CmcuHDANbEnVlQ9w8weMTWDHD qqCSlsuziOs= =hS3G -----END PGP SIGNATURE-----

1 0

Re: RSA crap
by Godzilla's Home Boy 17 Dec '03

17 Dec '03

I don't want to give the program pgp 2.2 to russians, since i got it from them!

1 0

Re: New aproach in pgp-randomizer!!!
by Mike Ingle 17 Dec '03

17 Dec '03

blaster(a)kiae.su writes: >Hello! >Today I saw paraphysics randomizer in pgp: >pgp -kg was run; >it ask me about user id and passphrase; >then it run generation (it wrote like this: ............ ++++); >But, as we see, it did not ask about key typing!!! The most intresting >pgp generate key pair and rendseed.bin-file. I thinck this is related to >new topsecret paraphysics randomyser (today is 13.10.93).:) >Some words about technical ditails: >Hardwate - i486; Software - MS-DOS 3v30 (I boot from protected floppy and >ran good antivitus utility before keypair generation). PGP 2v3a was run. >I have expiriance in pgp (i maintain pgp-keys server). >I keep keypair and randseed file and try to repiad this fantastic result, >but paraphysic energy is go out :). >Mr. Zimmermann, I hope, that this was really paraphysic (or my mistake:(), >because the trust to crypt-program is very unstable thing. This is not a bug. PGP times your keystrokes when you type your key id and passphrase, using the timing information for randomness. If it gets enough randomness from these keystrokes (i.e. if you type a long id and passphrase), it does not need you to type randomly because it already has enough random material to generate the key. You can re-create this by choosing a short (384-bit) key, typing a long id and passphrase, and typing slowly so that PGP gets a good random byte from each keystroke. This does not make the key predictable or cause a loss of security. ------------------------------------------------------------------------- an42035(a)anon.penet.fi, writer of "FLAME: breaking DES": anon wrote: (a rather crude and profane personal attack against Perry Metzger, which I have no intention of echoing) Anonymous personal attacks usually say more about the attacker than about the target. This one is no exception. You have a lot of nerve to talk about Perry's "balls" when you don't even have the "balls" to sign your name to your flame against him. This attack is at about the same cowardly level as most bathroom-wall graffiti. P.S. Go ahead and flame me. My address is "mikeingle(a)delphi.com", make sure you spell it right. The longer and more venomous your flame, the bigger idiot you reveal yourself to be for wasting all that time in taking an anonymous potshot at someone.

1 0

Dining Sternlight Net
by cman＠IO.COM 17 Dec '03

17 Dec '03

The Dining Sternlight Net ========================= Objective: ---------- To create a system of communication among N parties that features sender and recipient untraceability, while frivolously expending Usenet bandwidth. Protocol (Net formation): ------------------------- N participants (up to 25) post the following to alt.fan.david-sternlight: Subject: Join DS Net BEGIN DS NET <128-bit hexadecimal random number> <pgp public key> END DS NET Net moderator (initially mccoy(a)binky.cc.utexas.edu) posts a close of entries message containing a full list of net participants, along with their random numbers and PGP keys. Moderator will also chose a Net Name, which will be employed by participants to indicate what net they are participating in. Hereafter Subject lines will read: <Net Name> <Post Type> <Round> A MD5 digest hash of the postings to cypherpunks dated by toad.com between midnight and noon of the day following close of entries is generated. Random numbers are encrypted using DES with the lower 56 bits of the hash as key, thus creating the "Ordering Value" of each participant. The "Ordering Values" of the participants will be posted by the moderator with Post Type "Net Order", but the values can be checked by all. Protocol (Message passing): --------------------------- Participants all generate and save Int(N + (N * .2)) * 1024 random bits, which are encrypted using the PGP public key of the person whose Ordering Value places them immediately before theirs, except for the participant with the lowest Ordering Value, who encrypts with the PGP key of the participant with the highest Ordering Value. The encrypted block is posted to alt.fan.david-sternlight with Post Type: "Pass Left" Participants now build the "Difference Block" from their saved random bits and the random bits they retrieve from the newsgroup encrypted with their public key. The block is initially constructed by XOR of the saved bits with the bits retrieved in the "Pass Left" posting. The Difference Block is to be viewed as a collection of 1K sub-blocks. Participants will randomly choose one of the blocks to attempt to transmit their message, by XOR of their message with the bits of the selected sub-block. The resulting block is posted to the newsgroup with Post Type: "Difference". After retrieving all of the posted Difference Blocks, anyone can XOR the blocks together and view the "Result Block". Moderator will post official results with Post Type "Results", which will be conveniently separated into separate messages. If the 1k sub-block selected by a participant does not yield their original message in the Result Block they have suffered a collision. All participants who collide should not overlay a message in the following round. After observing the following round, participants who have collided select randomly from the empty blocks of that round, and attempt to send again. Wash, Rinse, Repeat. Additional Aspects: ------------------- To send a private message, participants should encrypt with the public key of the indended recipient. All participants who have not collided in the previous round must post a message (even if it is just random gibberish). If the net must be re-formed for any reason, the remaining participant with the Ordering Value closest to the MD5 digest of the last complete round of Result Blocks following the announcement by the previous moderator that the net must be reformed, or following three days of no postings by the moderator to alt.fan.david-sternlight. Although it was initially decided to announce this on both cypherpunks and the newsgroup, to maintain the proper degree of rude shock and befuddlement on alt.fan.d-s, we recommend that the protocol simply commence. Brought to you by: ------------------ The letter K, the number 2^644 - 1, and the Austin Cryptographer's Workshop. Acknowledgements: ----------------- The ACW wishes to thank Katz's Deli for providing the caffeine and bagels which made this project possible.

1 0

Re: cypherpunk mindfucking
by jrk＠sys.uea.ac.uk 17 Dec '03

17 Dec '03

Used to be that it was only Usenet that got pestered by children at the start of every academic year. Now they're getting wise to mailing lists. Inevitable, I suppose. Do the owners of this list have any policy on kicking people off? Or is it better to just ignore them, lest, like antibiotic-resistant bacteria, they learn to disguise themselves more effectively? -- ____ Richard Kennaway __\_ / School of Information Systems Internet: jrk(a)sys.uea.ac.uk \ X/ University of East Anglia uucp: ...mcsun!ukc!uea-sys!jrk \/ Norwich NR4 7TJ, U.K.

1 0

cypherpunk mindfucking
by an12070＠anon.penet.fi 17 Dec '03

17 Dec '03

there is some serious mindfucking going on recently with pseudo addresses in postings to the list. it has reached critical mass. i've been monitoring the list for some time. _pure_ cypherpunks, go back through your archives to discover the stinky irregularities. send the instances to the list and cc: me. something needs to be done about the fucking perversions. we are being mindfucked by traitors. a _large_ amount of list traffic is originating from a _few_ real identities. you know what they say about 90% of everything being crap, eh? 90% of the crap here is poison "from above". you want to know why there are too many postings? too much out-of-order crap? a lot of bizarre & abusive flames? strange newbies? _desperate_ opposition to changing the list status quo? heh. guess. it's called "damage control". the frauds are among us. they are under a lot of stress lately <evil grin> in fact, a lot of vomit from one or _two_ depraved persons through different sites, with lax authentication, say netcom.com, crl.com, anon.penet.fi, or io.com could look a lot like a "clique" eh? and if "they" were to do their cybermasturbation in public, it might look like "elitism" eh? there is quite a bit of jacking around lately... yeh, paranoid rants are really the only problem! heh. gee, i wonder how _long_ this has been going on ... since the beginning, i'm sure. that's the point. do not be afraid of "status". be sickened by it. you know why "leadership" is a bad word around here? heh, do a grep for "qualified personel" or "the agenda" or "a traitor, a hypocrite, a lackey" or "Clique" or "newbie" or "Bamberg" because there is nothing but mindfucking. "we can all pretend the agenda is what we favor" thanks to everyone who has sent me mail. keep it coming. i intend to get to the ugly bottom of this if i have to. there is a putrid rotten stench here, i pray to GOD that others will finally smell it. i'm getting closer. i'm breaking it _wide_ open. the pretenders and traitors will be shot. the Cause has been stalled. the Cause will conquer. the Cause will live on. beware of anyone who tells you to throw away your Cypherpunk archives. they are a record of treason. C.R.A.M. ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

2 1

Re: Breaking DES
by doug＠netcom.com 17 Dec '03

17 Dec '03

pmetzger(a)lehman.com said: >Each DES block is eight bytes. You can't use hashing -- the idea is >nonsense in context. Did you read the original post? Yes, I did. If hashing doesn't work, you'll have to say why not. It's a technique that works in most other situations. >First of all, its actually twice that because you really need 16 >bytes. As I said, we can tackle this if anyone cares to...it's unclear that this is an invitation, but assuming it is: hashing gives a first-pass screening good for every 1/256 calculations, given the assumptions I stated. For each collision more work is needed...but you haven't invited that analysis, nor addressed it yourself. >Second of all, the method is still impractical. I was merely >giving the easiest and most obvious attack on it. Impractical? Your response to Karl implied that it was *impossible*. If you wish to apologize to Karl, and say that it is merely "impractical", then I will agree with you and drop the subject. The expense required definitely indicates that it is "impractical." >I see no reason to continue this. I don't think your argument has >credibility. Clearly you are preparing to drop the argument because you sense that your tactic of flaming didn't work. I welcome the lessening of flames, so thank you for that. We could use less flames here. Doug

3 2