December 2003 - cypherpunks-legacy

Comments Requested for preso outline
by jdblair＠nextsrv.cas.muohio.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Fellow c*punks, I plan on creating several informational sessions on net legal issues here at Miami University. Use of E-mail has risen considerably in just the last year. Most users of this e-mail have no idea how the words move from their screen to the screen of the addressee, much less government attempts to regulate cryptography. I want to create an overview of no more than an hour (hopefully shorter) that will cover many of the important issues involved. The meetings will be followed by PGP distribution and key generation on Mac and MS-DOS platforms. The following outline is "version 0.1" of what I would like to explain. Unfortunately, I believe the outline needs to be considerably edited. The main problems are 1) Keeping interest, and 2) Making concepts of cryptography understandable for people who are not mathematicians or programmers. I would appreciate any input, criticisms, suggestions any of you have. Mainly, I'm looking for ideas about the best way to teach a basic, conceptual understanding of public key cryptography and digital signatures. I don't expect every person who shows up to start encrypting their communications. What I aim to do is increase awareness, mainly about the activities of their government, and to distribute PGP. These will be people interested in the future of the net as end users, not as code- writers or hackers. I want to educate them about the policies, being formed now, that will affect the net for decades. - -john. - --------------------------------cut here------------------------------- 1) Basic overview of the net. o There is, currently, no "Internet Inc." o The Internet started as a cold war problem: How do you communicate after a nuclear attack? Electronic Mail: How do the words go from your screen to your friend's screen? o broken up into ASCII packets and sent towards the destination this ASCII could be intercepted and read by numerous people along the way Why should you be worried about your privacy? o low cost of information archiving o low cost of key-word scanners o ease of implementation, at least along backbones (in our area, OARnet) o the backbones are often funded, or operated by government agencies o you use envelopes in reality, why not in Cyberspace? 2) How do you keep communications private?: Overview of encryption o encryption is hiding data in plain site o plaintext -> key -> ciphertext relationship o symmetric ciphers > requires a secure channel for key transmission > limited to governments, corporations > ex: DES, used by banks for wire transactions o public key ciphers > does not require a secure channel for key transmission > relationship of public/private keys > overview of a transmission > conceptual description of Alice and Bob communicating (diagrams) o signing methods > what is a digital signature? > what can they be used for? > verifying the integrity of a message o What makes an algorithm secure? > peer-reviewed, public algorithm > security in vast key-space, not in secret algorithm o Software you can use > PGP > demonstrate key generation, data encoding/decoding > various other schemes, probably Curve Encrypt (IDEA) 3) Legal Issues o government regulation > What is the NSA? > Export Laws > Clipper/Skipjack o What is Clipper? > government designed hardware encryption for voice and data > secret algorithm > government backdoor > created to allow tapping of communications by drug dealers, terrorists, etc. o what does it mean for you? o why won't it work? > smart criminals won't use it > government checks on key use probably inadequate o what can you do? > distribution of letter to the president, congress, representatives > encourage algorithm distribution > EFF info 4) Software distribution, Key generation o Mac and MS-DOS PGP o Curve Encrypt -----BEGIN PGP SIGNATURE----- Version: 2.3 iQBVAgUBLU2L+hD3efpluabZAQHzEwH8DPrdnDfG2zVXAD/MV+21+m6iinT7DN1+ PshKBLAE/UfZCjlplGgZGaHBY+8O9gQ/XsCUp5HDJRLKSxzVvCGKEg== =53C1 -----END PGP SIGNATURE-----

1 0

please unsubscribe
by Mack Knopf 17 Dec '03

17 Dec '03

Unfortunately, I just can't handle all the mail and mailing the automatic server didn't work. So, please unsub! Thanks.

2 1

Re: An interesting tidbit in Information Week Magazine
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> The government's information superhighway team is finally > coming together. Commerce Secretary Ron Brown last week named > the National Information Infrastructure Advisory Council. > Members include Craig Fields, chairman of MCC; Mitch Kapor, > chairman of the *Electronic_Frontier_Foundation* and > co-creator of Lotus 1-2-3; nathan Myhrvold, senior VP for > advanced technology at Microsoft; Bert Roberts, chairman of > MCI; and John Sculley, former chairman of Apple. Interesting stuff, though it really belongs on comp.eff.org.talk or other netnews groups rather than in cypherpunks; we've talked about it a bit, but the major cypherpunk issues are encryption policy and how much we'll be able to engage in free speech if the state-capitalists manage to steal the nets from the emerging free market. (Oh, wait, that's flame bait, isn't it? Sorry :-) Followup-To: comp.org.eff.talk -- Thanks; Bill # Bill Stewart AT&T Global Information Systems, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

1 0

Re: Matsui-san Attack
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> ]> of a new attack by Mitsuru Matsui of Mitsubishi that requires 2^43 > ]> *known* plaintexts, not chosen ones. The note I received says that it > ]> ``breaks the scheme in 50 days on 12 HP9735 workstations''. This was > ]> presented last week at the Japanese Conference on Cryptography and > ]> Information Security. Fortunately, attacks requiring large quantities of known or chosen plaintext aren't very relevant to secure email, since typically each message has a different randomly-selected key used only for that message; even if you discover the key, it isn't used in previous or future messages so the compromise is limited. A 1GB message gives about 2^27 8-byte texts, and if you have that much known plaintext, you probably don't need to decrypt the rest :-) On the other hand, if someone had a known-or-chosen plaintext attack on a public-key algorithm, that would be interesting, since you can generate as much chosen plaintext as you want. > 50 days on 12 HP9735 = 600 days on a single HP9735 > The 735 has a pretty fast Mflop rating (compared to Sun, IBM, SGI, PC, and > Macs). Using a comparable breaker on the average machine, it is going > to take two years to "break the scheme". > That leaves two years to create stronger/tighter strategies. Crypto usually cares more about integer MIPS than MFLOPS. I'm not up on current HP models, but 12 HP machines should cost between $100K and $1M, which makes this attack close to the second-best attacks on DES, which will break a key in a day for ~$30-50M - Peter Wayner's design used Content Addressable Memory, and somebody from DEC designed and I think built a Gallium Arsenide DES chip. The best is Michael Wiener's design using CMOS gate arrays, which should be able to break a key in about 3-4 hours for $1M. Doing this well with general-purpose hardware is impressive. But, yes, this means your PC will still take a while to crack DES; on the other hand, the NSA has probably been building massively parallel DES-crackers for a few years, and is more likely to try to break secure email than most amateurs. :-) Bill # Bill Stewart AT&T Global Information Systems, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

1 0

Re: 2-way anonymous via SASE
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Hal Finney writes: > From: "Jon 'Iain' Boone" <boone(a)psc.edu> > > So, you use a chain of anonymous-id's to set up your return-path? > > Unfortunately, return-paths are not exactly the strong point of the > current cypherpunks remailers :-). That is what much of the discussion > in this thread has discussed: how to best allow for convenient but secure > return paths. Yeah; the only solutions I've seen so far either give you some persistence, like anon.penet.fi, or no replies, or have generally been pretty ugly, requiring rapidly-increasing numbers of messages to set up chains of anonymous IDs, or use broadcast, like the Blacknet "post to Usenet" or DCnets. AIR-MAIL may be a start. It seems to need something that supports a small but >1 number of replies to make a non-ugly system, which means either some kind of Time-To-Live or destruct messages from one or both ends need to be supported. Bill

1 0

PGP keyid collisions?
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

I had discussed the benefit of putting PGP keyID or fingerprint in signatures to reduce spoofing for people who distribute by finger or unreliable keyservers, though obviously signatures are what gives you the confidence that a key is valid. Hal points out that brute-forcing a 24-bit Key-ID isn't all that hard; the usual formulas tell you what fraction of numbers are prime in the desired range, though without looking them up I'd expect it would take around 2**30 - 2**35 tries to find a specific one; I suppose this means the NSA has already done it :-) > I understand there is already at least one 24-bit collision on the > public key servers, not unexpected given a few thousand keys. I assume PGP does the right thing, except in cases of pilot error (e.g. doing key lookup by KeyID) ? Even if it does, this has some design impact on systems using random public-private key generation for meet-me remailer cutouts. Bill # Bill Stewart AT&T Global Information Systems, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

1 0

BlackNet - what is it?
by Roy Franz 17 Dec '03

17 Dec '03

Hi, I have seen BlackNet referred to several times. Could someone say a few words about it? Thanks, Roy ----------------------------------------------------------- Roy B. Franz rbfranz(a)ucdavis.edu Software Engineer Viewgraphics, Inc

1 0

Re: BlackNet - what is it?
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Blacknet wasn't real; it was a posting Tim May anonymously posted advertising network support for various illegal services, including where to send your digicash blackmail or ransom payments and the like. Basically to try to get us to think about the implications of the technologies we're developing and potential for abuse and paranoia. On the other hand, maybe it wasn't *really* Tim May anonymously posting it, and the Tentacles of Detweiler will be posting GIFs of you and your friends talking to notorious politicians to alt.your.mother and releasing that new virus with your name on the banner page unless you help Eric start a digibank to deposit some ransom money in. :-) Bill,or someone like him

1 0

Re: 4th ammendment and Cryptography
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

I'll second Phil Karn's recommendation of Caroline Kennedy's book, though I do remember it having somewhat of a liberal "Government is Good" bias. Unless I'm mixing it up with another book I read around the same time, it's also the one place where I've seen a recent 3rd Amendment case. The case was interesting largely because 3rd Amendment cases are very rare; the U.S. government hasn't quartered troops in people's homes except during the War Between The States, when it was ignoring the Constitution and Bill of Rights anyway. The issue was a prison guard strike, in which the National Guard was brought in to replace striking guards until the contract dispute was settled. Guards at the prison had rooms there for sleeping and off-duty use, and the National Guard, which is part of the military, used them during the strike. The guards contended that this was quartering troops in their homes. I think the government won the case rather than the prison guards, since it was really stretching the point. Phil's concerns about not freaking people out by emphasizing that the Second Amendment is designed to make overthrowing governments possible are well-placed (notwithstanding the fact that it's true.) It may be good rhetoric to use at a pro-gun meeting, though a lot of the NRA people I've met tend to get upset by the word "anarchy", but the general public just barely tolerates duck hunting and really has no desire for violent revolution, and frankly, neither do I. We're trying to go for their hearts and minds here, and issues like privacy, freedom of speech, and Big Brother tapping your phone are a lot more attractive to most people. Even the ideas that private communications can make government obsolete and that obsolete institutions can fail are pretty scary to people who've been educated in government schools, and associating crypto-privacy with the more extreme radically-correct side of the Gun Nuts will lose them - especially when there *are* legitimate concerns about use of anonymity and digicash for blackmail, ransom, and funding of real terrorists, plus the government's favorite drug dealer scare. Besides, walking around making unattributed quotations from the writings of the Founding Fathers tends to get you treated like David Koresh or at the very least Michael Milken.... Bill # Bill Stewart AT&T Global Information Solutions, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

1 0

Re: PGPkeys (ftp access)
by Doodeck 17 Dec '03

17 Dec '03

> Subject: PGPTools > From: m(a)BlueRose.com (M Carling) > I don't have ftp access here. Could some kind person please email it > to me? I don't have ftp (or Internet) access either. Try using one of BITFTP (BITnet FTP I think) services. Automated info response will be send to you upon sending mail with message body containing word "help" (without quotes) to one of the following addresses: bitftp(a)pucc.princeton.edu or bitftp(a)pucc.bitnet (located in USA) bitftp(a)plearn.edu.pl or bitftp(a)plearn.bitnet (located in Central Europe) Just before onset of twenty first century such ftp 'access' may seem ridiculous but it really works as I have transferred megabytes of data this way. Good Luck ! Doodeck.

1 0