December 2003 - cypherpunks-legacy

Dr. Dobb's Editorial
by anonymous＠extropia.wimsey.com 17 Dec '03

17 Dec '03

As mentioned, the December, 1993 issue of Dr. Dobb's Journal has an excellent editorial about the government investigation of PGP export and the general crackdown on cryptography. This issue also includes an article by Bruce Schneier describing the IDEA encryption algorithm. As usual with DDJ, source code is included: IDEA.C, apparently based on PGP source. Dr. Dobb's has published encryption source before. A few months ago there was an article by Burt Kaliski of RSADSI on using Montgomery multiplication to speed up an RSA implementation. Earlier there was an article on the (patented) Lucas public-key system. Both articles had source. No doubt there have been others as well. Here is the text of the editorial: Cryptography is like one of those West Virginia subterranean fires that smolder along coal seams for months before flaring up above ground. The current flame along the encryption firing line involves a pair of Federal grand jury subpoenas handed out to distributors of Phil Zimmermann's PGP ("Pretty Good Privacy") message signature and privacy software. Earlier this fall, the Austin Code Works (a Texas software distributor) and ViaCrypt (a Phoenix cryptography-tool developer) were slapped with demands to produce contracts, payments, correspondence, and related information concerning their international distribution of PGP and RSA cryptography source code. Neither company was told why they must turn over this information, nor were they given any indication of when or what the next shoe to drop might be. For the past year Code Works has been selling Grady Ward's Moby Crypto, a collection of crypto software that includes PGP, RSA, MD4, DES, and the like. Although not mentioned in the subpoena, Code Works has also been separately selling a DES encryption and decryption software package. For the time being, both have been removed from Code Works' shelves. ViaCrypt, on the other hand, licensed PGP from Zimmermann, combined it with ViaCrypt's DigiSig+ cryptographic engine, and released a toolkit called "ViaCrypt PGP," the first commercial PGP-based package. Interestingly, ViaCrypt is also a sublicensee of RSA public-key encryption from Public Key Partners, holder of the RSA patent and a big-time competitor and long-time critic of PGP. Ostensibly, the subpoenas are part of a U.S. Customs investigation into the export of PGP. (A letter the State Department's Enforcement Branch fired off to the Code Works begins with, "It has come to the attention of this office that your company is making cryptographic source code... available for commercial export....") State Department regulations lump cryptographic software with munitions and weapons, making it subject to export licenses as per International Traffic in Arms Regulation guidelines. However, Code Works' current advertisements clearly state that both Moby Crypto and DES Encryption are "not for export," and ViaCrypt says sales are made "export regulations permitting." In short, there's no indication that either company has exported crypto software, leading you to believe that the investigation is really nothing more than a fishing expedition. The timing is curious, considering that the Clinton administration views many high-tech export rules as antiquated Cold War laws that hinder U.S. trade. Consequently, the administration is rethinking export laws so that U.S. manufacturers can more easily export communications and other high-tech equipment - what's protected today may be fair game in a few months. Of course, the government also wants to make it harder to sell high-tech military equipment to renegade countries. Unfortunately, cryptography has a foot in both military and civilian communications camps. Neither the Code Works nor ViaCrypt had anything to do with developing PGP. You could even argue that Zimmermann really isn't the "author" of the software. True, he did write Version 1.0, but subsequent editions (2.3 is the current release) are the contributed efforts of U.S. and non-U.S. programmers who've created what's been described as the strongest, easiest-to-use encryption utility available to the public in source form. There's no question that PGP was exported, but neither is there a hint that Zimmermann shipped it overseas. He assiduously avoided the chance of _his_ exporting PGP, to the point of having other people upload the software to the nets. The bottom line is that PGP was legally on the net and anyone with a PC and a modem could have moved it across international borders - just as with DES, which has been on the nets and authorized by the government for more than a decade. Still, you have to wonder why the government is taking action now. PGP has been around for a couple of years. Maybe the Feds are upset that Zimmermann's encryption scheme is good - PGP is thought to be stronger than DES, the NSA and FBI reportedly can't crack it, and the thought of publicly available cryptography scares the dickens out of them. Or maybe the announcement of a commercial PGP-based application finally hitting the shelves prompted PGP's competitors to lean on the government. We just don't know, and the Feds aren't talking. The government is struggling to cope with a changing world, one in which technology has altered many of the old rules. Regulations, written for a paper-based society, aren't adapting well to digital reality. International electronic networks make it hard to control software distribution and information dissemination. Like wildfire, bank transfers and e-mail are circling the globe unfettered - and encryption is keeping secret the contents of these communications. But the means by which Washington is attempting to maintain control over cryptography is, in the long run, injurious to us all. From a business perspective, these tactics hobble U.S. companies from competing internationally. More importantly, the First Amendment guarantees us the right to speak in an encrypted way and insidious attempts to douse public access to cryptography, cloaked under the guise of software-export investigations, appear to stifle those rights. Jonathan Erickson editor-in-chief

1 0

random dot stereo benefactor
by Carl Ellison 17 Dec '03

17 Dec '03

For those who are interested, my source for the random dot stereo code was Tony Marotto: marotto(a)camb.com (Sorry, I still haven't tested it.)

1 0

Re: Key Sharing Protocols
by an7822＠anon.penet.fi 17 Dec '03

17 Dec '03

> > I'm working on an internal protocol for securing company records > and I'd like to solicit some net.wisdom. > (...) > > To allow for loss of a passphrase, for whatever reason, use a > secret sharing protocol to split the secret key of the user into > several pieces, held by designated security officers. > Reconstruction of the key will require cooperation by "n" > security officers. I have some problems with this. > Sorry, I should have done some more reading before I posted. What I'm after is a "Fair Cryptosystem". I'm not happy with the whole idea of escrowed keys, but in this case, it's the best solution which will be accepted by this organization. Micali describes how the user can generate their own key and create verifiable pieces for the escrow agents. Does anyone know of code which implements this scheme? ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

REMAIL: Cypherpunks Anonymous Remailer Installation
by Sameer 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Finally, after a few months of slacking off, I've finally gotten this remailer installation thing cleaned up to release it. I'll be throwing this in /pub/cypherpunks/incoming on soda.berkeley.edu. The Cypherpunks Anonymous Remailer Installation Version 1.0 Installer: Sameer Parekh Remailer: Eric Hughes & Hal Finney, with minor modifications by Sameer Parekh - ----------------------------------------------------------------------------- This is the Cypherpunks Anonymous Remailer Installation Suite Version 1.0. By simply running the script "install_remail" included in the archive, you can very easily install a cypherpunks anonymous remailer service in almost any UNIX account. The anonymous remailer uses the .forward file to pipe all mail to the remailer system. If mail to the remailer account is not acted upon by the remailer software, it lands in the standard mailbox of the account. First on the TODO list is to make it so that non-remailer mail is acted upon in a fashion which allows an alternate .forward file operation. To install: gunzip and untar the archive: % gunzip RemailInstall.tar.gz % tar xfv RemailInstall.tar execute the remail_install program: % remail_install answer all the questions. The program automatically self-tests, and mails me a notice saying that the remailer is in operation. I plan on writing a system which will wait one week after receiving the notice, after which your remailer will be pinged. If the ping is received, your remailer will be added to my list of active remailers, updated and posted weekly to the cypherpunks list. (Not yet operable, but the installation script still sends a notice.) Remember that running a remailer is a sensitive issue on the net. If you choose to run a remailer, keep in mind that some powerful net-personalities object to anonymous remailers, endangering your access to the internet. Stay free, Sameer sameer(a)uclink.berkeley.edu -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLOSxbXi7eNFdXppdAQFGgwP/SlSe8zKTH2QDY47cjdjbfHaR7NPBTtYv BYQ5nmHauYVwhoZxLVPUrdYUc2Gfv/5zIbgjb3df5ZWIaY6qo4dcsUtFHIR1CIvx SYJkBrLw22Jqfal2g2Wqzg+PsiQcsjjxREEVzyHaN3uNaQwYShXtwAhQ4Rfb3Bu2 AN6ytzyqg1A= =UFzz -----END PGP SIGNATURE-----

1 0

The Contortions of Cypherpunks
by L. Detweiler 17 Dec '03

17 Dec '03

N.Szabo <szabo(a)netcom.com> in RISKS >I'd like to assure the readers of RISKS that I am in fact a unique person, >distinct from the other names L. Detweiler listed. Of the people on his list >I know from personal contact, all are distinct people in Real Life(tm). Give specific evidence to support your claim or retract it. Who do you know from personal contact? What do you mean that you are `distinct from other names'? >Well >before his post to RISKS, L. Detweiler was provided means of personally >verifying that many of the names he listed are distinct True Names (eg phone >numbers he can call), but it doesn't seem to help. You appear to be referring to my private mail among many different people. Please elaborate on your claim, or retract it.

7 7

Re: fractal crypto
by Matthew J Ghio 17 Dec '03

17 Dec '03

> give a hint about the chaotic function you used... like what it > was x(1-x) or something else > > that would just leave the "key" to be determined... a reasonable test! hehe... I did something involving the trigonometric tangent function. The actual "key" isn't too complex actually...

1 0

RAMPANT CONSPIRACIES and MASSIVE COVERUP
by an12070＠anon.penet.fi 17 Dec '03

17 Dec '03

As David Letterman says, I don't have a joke here, I just like saying ... <g> ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Re:Bandwidth limitations, DNA binary coding
by VACCINIA＠UNCVX1.OIT.UNC.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Perry writes: >15 symbols, HALF a byte (actually a touch less.) One nybble can express 16 >possible symbols (or one Hex digit, or whatever.) Oops, I stand corrected, 15 symbols half a byte. What I was trying to convey is that GenBank (the repository for genomic sequence data) has a specific format for binary representation of DNA sequence data. Most genomic analysis programs use GenBank sequence format now (some use EMBL which is similar) and probably will in the future. Thus, the half byte per GATC symbol is defined as convention, not by the fewest binary digits neccesary for encoding them. It may waste bandwidth but that's no problem for fiber optics. Which is how this thread started. >plus, of course, the genome is highly compressable -- lots of repeated >sequences, especially in interons. This brings up an interesting topic. There are four classes of DNA: Foldback DNA, highly repetitive DNA, middle-repetitive DNA and single-copy DNA. Foldback DNA consists of palindromic sequences which form hairpin like structures. Highly repetitive DNA is made up of short sequences from several to hundreds of bases long (repeated around 5 x 10^5 times). Middle repetitive DNA consists of longer sequences, hundreds or thousands of bases long (these appear hundreds of times in the genome). Single-copy DNA sequences are usually genes themselves, of which (in humans) it is estimated that there are around 1 x 10^5. Since the genome is highly redundant (in mammals up to 60% of the genome is repetitive sequence), you could probably compress alot of it just by designating symbols for specific repetitive elements. Most of the repetitive nature of the genome is found as highly repetitive sequence localized as tandem arrays (not in introns). However, a second class of element known as SINEs and LINEs are found in introns, gene flanking regions and intergenic regions. The most widely characterized SINE is the Alu sequence, which is approximately 300 bases long and scattered throughout the genome over 5 x 10^5 times. This constitutes 5-6% of the genome! That's a lot of compressability. I often wonder if the redundancy is a way to encrypt a species genome, thus keeping different species from genetic communication. The "key" being millions of random base pairings which allow like species to decrypt their own genetic code and successfully have progeny. Pairings between species that are too dissimilar would be a refractory event because the key is not homologous. By the way, genes are made up of exons and introns. Scott G. Morham ! The First, Vaccinia(a)uncvx1.oit.unc.edu ! Second PGP Public Key by Request ! and Third Levels ! of Information Storage and Retrieval ! DNA, ! Biological Neural Nets, ! Cyberspace -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLOR1gj2paOMjHHAhAQFNZwP+Lv7Xv4bityeHd2L53fgY4seWKZX/Mkrw YmHv5hPpusiXx6jt2tVGPnPyH0TVtdFb5Cy1YVnvLydgU4FPblJAO7chWuc5EPXn 7/SQ29AuGrDnWu9gEGaQiqEUgn40idPgvDVVQPikAX8tn5OmWo8vygMwIYgicQUh Po8BHvPSLfg= =ek9F -----END PGP SIGNATURE-----

1 0

REMAIL: installer script not working
by Sameer 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I jumped the gun, and posted before I was ready. Oops. The installation script isn't working perfectly yet. Hopefully I won't wait two months before fixing these problems like I did last time. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLOUdEni7eNFdXppdAQG6AwQAkJAoiz3KE7nYhS2JPmtP6u0VokIaJ1Dl TfgYEgNxqQhb3M1VBvM0vIaxtGk6K956+ji3W7WhpkJk65IBvmyVMm/O3b6ZFG1h kGQ9wjmUTOGageXag3fXCOGo3NFXi2WIhLyzix1u02Q+iw7Bwf2pSTztp60Mw32g ePTbENC128E= =8jWg -----END PGP SIGNATURE-----

1 0

REMAIL: scan, folders scripts
by Karl Lui Barrus 17 Dec '03

17 Dec '03

Well, I put two PERL scripts I wrote at the ftp site (named misc.elm.scripts.tar.gz); here is the README file: scan is the script which prints out signature information of pgp signed messages (instead of where the message came from). Thus, if pgp signed mail is sent through an anonymous remailer, you see who signed the message instead of where it came from. The inner loop is ugly and needs major reworking; I've noted this below and in a comment in the code :-) It would be easy to include this in the mh 'folder' command, but I don't have mh anymore here on owlnet :( Integration into elm itself would be great. -----BEGIN PGP SIGNED MESSAGE----- These are two experimental PERL scripts I wrote which report information about elm mail folders. folders prints a summary of mail in your ~/Mail directory. It prints out how many letters are in each folders, and how many files are in each directory. ~> folders Folder austin : 4 messages Folder cypher : 20 messages Folder educom : 1 message Folder inc : 17 messages Directory misc : 12 messages Folder store : 26 messages Folder ysn : 0 messages - -------------------- scan prints out a more detailed summary of a folder in the ~/Mail directory. It prints message number, who the message is from, and the subject. ~>scan cypher 1 hfinney(a)shell.portal.com Chaum's credentials (technical question) 2 hughes(a)ah.com Chaum's credentials (technical question) 3 hfinney(a)shell.portal.com Signing keys for nyms 4 hfinney(a)shell.portal.com message depots, packet routing? 5 hughes(a)ah.com Signing keys for nyms 6 szabo(a)netcom.com Commerce models scan also takes an optional argument: -p this will make scan look for pgp signed messages, and attempt to verify them. An asterisk is printed at each signed message, and the signer's address is printed instead. ~>scan -p cypher 1* Hal Finney <74076.1041@com Chaum's credentials (technical question) 2 hughes(a)ah.com Chaum's credentials (technical question) 3* Hal Finney <74076.1041@com Signing keys for nyms 4* Hal Finney <74076.1041@com message depots, packet routing? 5 hughes(a)ah.com Signing keys for nyms 6 szabo(a)netcom.com Commerce models Here, we see three messages are signed, and the signer's address is printed instead. This distinction is important if a message is sent via and anonymous remailer, for example. In this case, instead of printing the anonymous remailer as who sent the message, you will see who signed the message (which may in turn be a pseudonym, etc.) BUGS: folders counts the number of message by looking for 'From' at the beginning of a line. This causes problems if the text of a message contains 'From' at the left, or if a message contains a forwarded message, or somehow pastes in another message's header. In these cases, the message count will be off. scan probably also makes this mistake. In fact, you will find the inner loop of scan to be pretty ugly. I will clean it up eventually. scan winds up piping message to PGP to check signatures. This degrades performance. scan is not able to deal with pathological files: pgp messages that don't have an end delimiter, etc. One of these days I will read RFC-822 and other relevant documents and make the message count accurate. Comments, bug fixes, enhancements :-) are all welcome at klbarrus(a)owlnet.rice.edu -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLOUhEoOA7OpLWtYzAQG4PAP/eTw/EWw0wlQ4QVpHfUP6OI3sWdKOltwN 3pgB41JxK1sY/GCnP8rCP9HDEkY/OePTBZDsu9CGJG1fneTsZIlCXrXpKSGzQpvC 94819bdF/+OFe5DcMUcaTcsG/KN3asw3TO0ed4KyOXqTE/SrAIyHsChgKRtHO70u 3uuLWrp0nR8= =vVg8 -----END PGP SIGNATURE-----

1 0