December 2003 - cypherpunks-legacy

DH Exchange Code / Magic Money comments
by remailer＠merde.dis.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- DH Exchange announcement follows these comments on mpd's message. Pr0duct Cypher mpd(a)netcom.com wrote: >Earlier this morning I grabbed the latest version of Magic Money >from csn.org and compiled it under the Borland C++ 3.1 IDE. Since >the Borland C compiler is one of the more paranoid ones around, I >thought I would briefly list the things I had to do in order to >get zero warnings and zero errors. >The sources I started with were MGMNY10E.ZIP and PGPTL10C.ZIP. >After #defining MSDOS you will find that it is a good idea to >#include <stdlib.h> in almost every module. This prototypes >quite a few of the commonly used functions which would otherwise >cause the compiler to complain. A few modules will require ><mem.h>, <string.h>, and <time.h> since they call functions in >these modules which are not in <stdio.h> or <stdlib.h>. Have they changed the .h files? My compiler isn't missing any functions when I compile it. >The C library function "randomize" is defined in <stdlib.h>. This >conflicts with the Magic Money function of the same name which >initializes the MD5 based RNG used to generate coin ids. I >changed the name of the Magic Money one to "random_init". Blaaah. I didn't have stdlib compiled into that module, so I didn't notice this one. >There is no prototype for pgp_randombyte. Since this function >returns "byte", not "int", this could be painful on any compiler >which treats these types of function returns differently. There is a prototype for it in pgptools.h >Complete prototypes for (*output) and (*lookup) need to be >provided in the function header of pgp_check_sigs and also for a >different function pointer (*output) used in PGPKGEN. Is this bad? I thought a function pointer didn't really care, as long as you called it correctly. >The Borland compiler always warns on "if (a=b)" because it >assumes the user mistyped "if (a==b)". To get rid of the >warning, you have to say "if (0!=(a=b)) which is optomized out by >the compiler. This occurs in a number of places, including the >macro for multiplication mod 65537 in idea.c. I know, mine complains about that too, but it's a common programming technique and there is nothing wrong with it. I've been ignoring that particular warning. >There is a reference to an undefined pgp_pubkey in fifo.c which >goes away if you #include "pgptools.h". You then also have to >toss in "mpilib.h" and "md5.h" to make "pgptools.h" happy. Yes, when fifo.c includes pgpmem.h, it notices that in one of the prototypes in that function. But the only function fifo calls within pgpmem is safemalloc, so it doesn't matter. I didn't want every file to include every other file, although it has been hard to avoid. >It appears that mpilib.c has been persuaded to compile the UPTON >modmult instead of the SMITH modmult. Unfortunately, there are a >few modules which fail to #include the definition of UPTON and >still call stage_smith_modulus and smith_modmult. Sticking in a >#define to UPTON at the top of "mpilib.h" fixes this. MPILIB has not been altered. It is the same as in PGP. PLATFORM appears to set the appropriate modmult, but I usually define UPTON because SMITH has given me some problems in the past. >The conditional code which allows prior definition of external >versions of mp_setp, mp_addc, mp_subb, mp_smul, and mp_rotl >written in assembly language for some strange reason causes the >compiler to generate externals to _P_SETP, _P_ADDC, _P_SUBB, >_P_SMUL, and _P_ROTL instead of _mp_setp, _mp_addc, _mp_subb, >_mp_smul, and _mp_rotl in modules which reference these routines. >It does not seem to have this effect in mpilib.c where these >routines are defined. Deleting the corresponding #ifdefs cures >this. This I hadn't noticed. You have to define NO_ASM or compile in 8086.asm. Also define MSDOS and SMALL_MEM and DYN_ALLOC for an MSDOS machine. Take a look at the PGP 2.3a project file. >The compiler correctly points out that pgp_extract_rsa never uses >the variable "pk" passed to it. At the cost of a few machine >cycles, you can silence the compiler by putting "pk=pk" as the >first executable statement in this function. True. I noticed this after writing the prototype. The public key might be useful in the future if the modexp is changed, so I left it in. >The function pgp_randombyte hashes a variable "time" without >first initializing its value. It might be nice to change "time" >to "timestamp" and do a "time(&timestamp) unless it was the >authors intention to utilize uninitialized memory. I screwed up here. I meant to include the time in the hash and forgot to put in the call to time. I just sent an update to csn.org to fix this one, because it could reduce the entropy of the randomizer. Time was already factored into the initialize, so it wasn't a killer, but it badly needed fixing. Thanks for finding it. >If the server is executed more than one time within a second, it >can generate indentical random values. This could be a problem when >batch-processing mail. Including a fast timer register in the MD5 >hash in addition to the time of day in seconds would likely >eliminate this risk. What are you running, a Cray? My machine takes quite a few seconds to run the server. How do you include this fast timer register? Not all machines have it, so doing so would be very machine dependent. You could put in ifdefs for the PC. I think PGP has this. >The program uses "safemalloc" and "mm_safeopen" to access memory >and files, but does a very large number of "fread" and "fwrite" >calls without checking to see if they completed successfully. A >"safefread" and "safefwrite" might be a good idea so the server >does not continue happily on as the hash file fills up the disk. Yeah, I know, and so does fifo.c in PGP Tools. I hate error checking. If I put in safe read and write calls, what do I do if they fail? You could do this easily with some defines, if you have the error recovery code in mind. Thanks for pointing out that bug, and especially for setting up a Magic Money server. - ----------------------------------------------------------------------- Diffie-Hellman Exchange addition to PGP Tools Should appear on csn.org as dhex10a.zip There has been quite a bit of interest in online crypto applications, such as secure phones, BBSes, and TELNET connections. For these applications, Diffie-Hellman exchange has a major advantage over RSA: there is no private key to steal. If RSA is used for key exchange, an attacker could record the encrypted sessions, and then acquire your private key after the fact and decrypt them. With Diffie-Hellman, the secret information is gone as soon as the session is over. Using DH is equivalent to using a disposable one-time RSA key for each session, but much faster. This is a DH add-on for PGP Tools. There is a new PGPKGEN which exports the prime-finding functions, the main files DHEX.C and DHEX.H, and a demo. To use DH, we need a modulus n and a generator g. Unlike an RSA modulus, which is a product of two primes, a DH modulus must be prime. (n-1)/2 must also be prime. This makes the moduli slightly painful to find, but they can be reused indefinitely. DHEX tests a modulus by first testing both n and (n-1)/2 with fastsieve. Only if both pass is slowtest used. It still took me a whole day to find the 1024-bit modulus in the demo. There is also a 512-bit modulus there. To find the generator, we need the factors of n-1. They are 2 and (n-1)/2. For each factor f, we compute ((g^((n-1)/f)) mod n). If this is 1 for either factor, the number is NOT a generator. Generators are easy to find, usually in one to three tries. The modulus and generator can be saved and reused. Now Alice and Bob each call precomp. This generates a private piece x and computes X=g^x mod n. Big-X is the public piece. Alice and Bob exchange public pieces, then each compute k=Y^x mod n where Y is the other person's public piece and x is your own private piece. K will be the shared secret. We take the MD5 of this number to get an IDEA key, which will be the same on both sides. No eavesdropper can get this number. The public and private pieces are disposed of - they are only used once. This is vulnerable to a man-in-the-middle attack, where an attacker carries out a separate DH exchange with each party and then sits in the middle, decrypting with one session key and encrypting with the other. A digital signature will prevent this, if Alice and Bob have each others' public keys. One approach is for both parties to sign their public pieces before exchanging them. Another is to do the DH, go secure, and then each party signs the session key and sends the signature to the other. If there is a man in the middle, the session keys will be different. I prefer the second method because a passive eavesdropper does not find out who is communicating with whom. You can do this with the pgp signature functions in PGP Tools. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLW7drcGoFIWXVYodAQHKRwQAj4zOGBqNeT6w6VeHRn6QMk5sAmYAep9M MpiVYTEdcSTzW7C2TP9RF/f1cqIpPy4pBK5ATRmGCnaDe12FxM4iIZVMVcprS7Ao XaL52RR/0d0Tctt6YhQBMaODaosPm0Nbd+R3ztRRpugCU37lAFTWLHTuDAVlNqzl yX/8iTSbyGo= =gZ8U -----END PGP SIGNATURE-----

2 1

Re: Infomercial
by norm＠netcom.com 17 Dec '03

17 Dec '03

>Most people couldn't care less. They don't encrypt data, and will >never use a clipperphone. The FBI can *already* listen to all their >phone calls and see all their medical records. Why should people >do anything to protect something they don't have anyway? I don't encrypt my stuff but I gain much peace of mind when I know that I could. This suggests that I should encrypt in order to maintain that right.

1 0

Clipper and the EU
by Dave Banisar 17 Dec '03

17 Dec '03

Clipper and the EU The Independent (UK) February 25, 1994 Page 16 Super-spooks seek to extend domain to data networks; US agency wants ability to spy on new superhighways. by Leonard Doyle In Roman times conquered peoples and slaves were forced to carry tesserae or identity chits and any Gaul or slave who refused to accept one was branded or maimed instead. Soon all users of computer networks may be singled out for the tessera treatment if the National Security Agency, America's super secret military intelligence agency, has its way. The NSA, with a budget of $ 30bn ( pounds 20.5bn) a year, is responsible for intercepting foreign government communications and breaking the codes that protect such transmissions. America's most exclusive spooks are worried that advances in encryption technology are about to rob them of their ability to conduct surveillance on a global scale. After nearly 50 years of electronic eavesdropping, the NSA is finding that some widely available codes are impossible to crack. The worry is that hostile governments, drug barons, terrorists and money launderers will have a field day using networks or information highways built and maintained by the US or, for that matter, the European Union. But here is the rub. Anyone who wants to use government-funded information highways in future may be forced to use the lacklustre encryption technology provided by the intelligence agencies, complete with a backdoor access for official eavesdropping. Simon Davies, of Privacy International, a consultancy, has no doubt this will happen. ''A Wild West frontier - self-regulated by ethics and culture - has evolved in the computer communications business and now that the stakes are getting higher, government is trying to muscle in.'' It is widely predicted that by the end of the century about 50 per cent of world trade will be in services and that much of this will be carried out via computer- linked databases communicating across continents at the speed of light. It is this lucrative trade which the NSA intends to protect and oversee. The Internet system has already been identified by the Clinton Administration as the basis of a new information superhighway. If that should happen, organisations such as Computer Professionals for Social Responsibility and the Electronic Freedom Foundation fear that future access to the networks could be restricted to users of an encryption product developed by the NSA - which ironically enough is called Tessera. The fear is that the freewheeling, anonymous access that hundreds of thousands of individual network users enjoy at the electronic frontier may end. To the outrage of users in the US and elsewhere, the Administration recently backed the NSA's plans to ensure that the agency will always be able to intercept and decode messages sent over computer and telephone lines. The privacy concerns are by no means confined to US computer users. Anyone who has every logged onto a bulletin board or computer service like Compuserve or Internet could be affected. The Administration has played up the law and order side of the debate, arguing that advanced encryption will be used by criminals and terrorists. Al Gore, the Vice- president, announcing the new policy at the beginning of February, said: ''Our policy is designed to provide better encryption to individuals and businesses, while ensuring that the needs of law enforcement and national security are met.'' However many leading experts in cryptography, computer security and privacy in the US do not agree and said so in a letter to President Clinton last month asking him to withdraw the NSA's proposal. That appeal failed to avert the decision to back the Tessera and since then a petition organised by Computer Professionals for Social Responsibility has been signed by more than 1 million people who have sent their complaints by electronic mail to the President. There is no parallel debate taking place in the European Union, but the intelligence agencies here are just as busy trying to ensure that the information highways of the future can be monitored. Jacques Delors, president of the EU Commission, sees data highways as being key to future competitivity and job creation. Before long individuals will be able to hook up to the highway for all sorts of transactions, from renting a movie to view at home to swiping a smartcard through a reader at the doctor's surgery to bring up an entire medical history. The real business will of course be conducted by service companies, from banks to insurers to market traders. For these companies privacy and security are of growing concern, to which the NSA has responded with its relatively cheap encryption devices. But Tessera, which fits into the back of a computer, will also identify the user and has a special built-in ''trapdoor'' that will allow the NSA to eavesdrop on E-mail and other messages. Another cryptographic device known as the Clipper Chip can be used to scramble telephone and fax communications while giving the security services the same ability to eavesdrop with the help of a special electronic key, held in ''escrow'' by the government agencies. Government agents will be able to obtain the ''keys'' upon presentation of what has been vaguely as ''legal authorisation''. These ''keys'' will be held by two ''escrow agents'' and would enable the government to access the private voice transmissions. A similar device known as Capstone would be used for data sent via computer modem. The Administration hopes its encryption devices will at some stage have to be universally used by US industry. However, the outpouring of vehement objections from the computer industry, telephone companies and privacy groups in the US may have shaken the Administration and some computer professionals say that the NSA's encryption technology has no chance of being accepted in the market place. Sharron Webb of the National Computer Security Organisation is one of those leading the fight against the spy agency's encroachment into the world of computer communications. ''If the US government has a hand in setting up the information superhighways here, they may require users to use Tessera to participate, it is then only a matter of time before foreign users are brought on board as well.'' Already the signs are that big business will knuckle under in the face of fierce pressure from the US Administration. The largest American telephone company, AT&T, has agreed to buy the NSA's technology and to include it in scrambling devices which sell for about $ 1,000 ( pounds 680) each. Other companies are expected to follow suit, especially if they wish to maintain their lucrative contracts with the federal government. What remains unclear is how the EU and individual European governments intend to react to the US moves. So far the US is looking only to American companies and their overseas subsidiaries to use the new encryption technology. But sooner or later decisions will have to be made that affect European users. The smart money is on the EU adopting the Tessara philosophy, but with different electronic keys for each country's eavesdropping agencies.

1 0

DES VS SKIPJACK
by radatti＠cyber.com 17 Dec '03

17 Dec '03

I found part of a paper on DES VS Skipjack using gopher but could not find the remainder. Does anyone know where I can ftp this document from or have any other information about this subject. PS: Skipjack in the form of Clipper is expected to become a FIPS. DES was given a 5 year extention of it's FIPS status then it dies leaving only.... Pete Radatti radatti(a)cyber.com

1 0

Clipper and Amendment 4
by Robert A. Hayden 17 Dec '03

17 Dec '03

IV The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized. ------- Is it just me, or is the government ignoring the word 'secure' in the above statement? ____ Robert A. Hayden <=> hayden(a)krypton.mankato.msus.edu \ /__ -=-=-=-=- <=> -=-=-=-=- \/ / Finger for Geek Code Info <=> In the United States, they \/ Finger for PGP 2.3a Public Key <=> first came for us in Colorado... -=-=-=-=-=-=-=- (GEEK CODE 1.0.1) GAT d- -p+(---) c++(++++) l++ u++ e+/* m++(*)@ s-/++ n-(---) h+(*) f+ g+ w++ t++ r++ y+(*)

1 0

I have FOIA`d the Clipper
by Duncan Frissell 17 Dec '03

17 Dec '03

G >There appears to be no FOIA exemption that would justify withholding G >the key escrow databases which Treasury and NIST are building. (The G >keys are not tied to any individual, so individual privacy isn't a G >valid exemption. The database isn't classified. Etc.) I have asked G >for a copy of each database, in toto. What a great move. And I always considered FOIA requests a waste of time. This will at least *really* amuse the recipients. This raises a further thought though. Since it is easier to FOIA federal records that pertain to oneself, couldn't anyone who acquires a piece of "Clipped" telecoms equipment file a request for his *own* keys. I guess you can capture the LEEF/LEAF in encrypted form and submit a printout of it with your letter. Maybe we could set up a server to help encourage people to generate FOIA requests. DCF --- WinQwk 2.0b#1165

1 0

Civil Rights
by Jim choate 17 Dec '03

17 Dec '03

Seems to me that a 'right' as is being discussed should be 'Civil Right'. When used in this context I believe a suitable definition would be the following: Civil Right A characteristic granted to a citizen of a country which is beyond the normal law making ability of that countries governing body. In effect it grants a citizen the ability to make decisions and act on them without regulation or permission being required by the government. It in effect says that there are certain facets of an individual which are outside the normal operations of a government and can not be regulated or otherwise controlled through legistlative means.

1 0

FOIA's and you...
by Jim choate 17 Dec '03

17 Dec '03

One facet of using the FOIA legislation is that such requests will GUARANTEE that a file is started on you even if one did not previously exist. If yo you make FOIA requests then it behooves you to include in them at some point (I suggest at least annualy) to make a FOIA of your own records. The reason is that if there is a security question you will at least get a form letter refusing to release the information which should act as a warning bell. Just thought I would mention it since nobody else has made reference to it.

1 0

RoboFest 5
by Jim choate 17 Dec '03

17 Dec '03

I am including this notice to cpunks since my group (ssz.com) will be there and among other things we will be doing crypto related presentations. We are also looking at getting some form of virtual-community going w/ 2600 and Ripco. If any of the cpunk related sites would like to get involved then please contact me or the Robot Group. RoboFest 5 March 26, 27 1994 Austin City Coliseum Austin, TX Robot Group: voice: 512-794-9105 email: robot-group(a)cs.utexas.edu ssz.com: voice: 512-458-5818 512-832-4849 modem: 512-458-6084 fax: 512-832-4848 email: ravage(a)bga.com Note: my email address will soon also include ravage(a)ssz.com as well. Note: ask for 'Jim' if you contact ssz.com or CyberTects. We will have a T1 link available and you should also be able to use the T1 that is Ripco's feed as well. If all goes well you should also be able to use my modem number assuming bga.com gets my SLIP feeds straightened out (not there fault, GE is dragging and Ma Bell is ladding insalling the new lines). If you don't have any interest in this event or feel it is irrelevant please don't waste bandwidth, your time, or my time by replying. Please ignore it and don't respond in any manner.

1 0

Re: RoboFest 5
by jim＠Tadpole.COM 17 Dec '03

17 Dec '03

The T1 line isn't absolutely 'there' .. yet. We're fighting SW Bell.

1 0