December 2003 - cypherpunks-legacy

Table of Key Lengths and Brute Force Cracking Times
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Here are some numbers from Bruce Schneier's article in the April 1994 "Dr. Dobb's." The article is a review of the "Cambridge Algorithms Workshop," where Bruce also presented a paper on Blowfish. These estimates are in a slightly different form than what "Applied Cryptography" has (on pp. 130-135), and incorporate (apparently) the Michael Wiener DES-busting estimates from last summer. First, some typical key lengths for block ciphers, as reported by Schneier: Algorithm Key Block Problems/Comments DES 56 64 key too small Triple DES (3DES) 112 64 slow Khufu (Merkle/Xerox) 64 64 patented, key too small FEAL 32 64 64 patented, key too small LOKI-91 64 64 weaknesses, key too small REDOC II 160 80 patented REDOC III variab. 64 patented IDEA (Europe) 128 64 patented RC2 (RSADSI) variab. 64 proprietary Skipjack (NIST/NSA) 80 64 secret algorithm GOST (FSU, Russia) 256 64 not completely specified MMB 128 128 insecure The "problems" reported are exactly as reported by Schneier. No mention of RC4, which may in "exportable" versions may be as short as 40-45 bits. Second, some estimates of brute-force cracking time: Key Length Time for a $1M Time for a $1B ($1000M) Machine to Break Machine to Break 40 0.2 second 0.0002 sec 56 3.5 hours (Wiener) 13 sec 64 37 days 54 minutes 80 2000 years 6.7 years (2 years?) 100 7 billion years 7 million years 128 10^18 10^15 years 192 10^37 years 10^34 years 256 10^56 years 10^53 years Note that a billion dollar cipher-busting machine is not out of the question. Norm Hardy once described to us the $100M "Harvest" machine (also described by Bamford). NSA has its won on-site wafer fab facility (built by National Semiconductor several years back). A single Space Shuttle launch costs around a billion dollars (NASA says $0.6B, GAO says $1.5B), and many of the launches are just put up reconnaisance and SIGINT satellites, so spending $500M to $1B on special computers to crunch the data seems plausible. (However, it's hard for NSA to make plans for what key length they'll have to target. It's also not clear that enough non-financial users have been using DES to make it "necessary" for such large expenditures....a single machine that can crack a DES-encrypted message in, say, 1-10 hours may be enough for their current needs. All of this is just speculation.) For logistical and other reasons, I would expect they may have _several_ smaller machines. Just as effective, of course, cumulatively. Obviously a billion dollars worth of hardware will not be dedicated for a couple of years to crack a single 80-bit cipher. Anyway, you all can fool with these numbers and draw your own conclusions. Ron Rivest did some similar calculations for RSA modulus sizes and came to similar conclusions (e.g., 1200-bit modulus will withstand even attacks by billion-dollar machines for several more decades). --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

2 1

Dolphin Encryption Tutorial
by Anonymous 17 Dec '03

17 Dec '03

I just received this encryption "tutorial", which is really a thinly disguised sales pitch for Dolphin Encryption software. The sales pitch seems aimed toward less knowledgable users of PGP. >Some have claimed that PGP is the most secure encryption program >available for PCs, a claim that does not withstand critical >examination. What PGP is built on (IDEA, MD5, RSA) are all available for public inspection. Same for RIPEM. Available for free. Are you somehow implying the Dolphin Encrypt withstands critical examination? Be real. >Generally public key systems, such as PGP, are much slower than >secret key systems, and so ?? PGP uses MD5 to hash the passphrase to create a session key. It uses the session key to encrypt data, and uses RSA to encrypt the session key. It does not perform full blown RSA encryption on the data. What follows is a wondrous statistical analysis designed to frighten. A "weak" system is used to encrypt 2048 bytes, showing statiscal skewing. Fortunately, Dolphin Encrypt produces a flat distrubution when encrypting a 60201 byte file. Dolphin encrypt versus a 60201 byte file is superior to another system versus a 2048 file. Thank god. I just wonder what kind of data these two files are: 2048 bytes of ascii text versus 60201 bytes of a jpeg, zip archive, random noise? The comparison, fairly useless as it is, is even more useless without this further information.

2 1

Cypherpunks Quick Code
by Bill Garland 17 Dec '03

17 Dec '03

Cypherpunks Quick Code V 1.00 ====================== 1. Cypherpunks, QUICK! CODE! 2. Cypherpunks write code. 3. Cypherpunks, WRITE CODE! 4. Cypherpunks, right. Code? 5. Cryptography is all Economics. 6. There is no cypherpunks agenda. 7. According to something tossed around over on the Extropians list, .... 8. i am NOT Detweiller. 9. As long as you use the MD5 hash of the 3DES session keys in the remailer header and PGP in the digital postage stamps, the NSA can't de-cripple your whiffie, er, de-clipple your Hell, man, - the money will still be safe with aunt bessie. 10. DISSEMINATION of this IMPORTANT INFORMATION in UnAltered Format is .... 11. ag588 is rejecting mail from you. Wendell Noseworthy =========== Just so as not to generate any more wasted bandwidth here, or is that waste more generated bandwidth, whatever, I will forward any suggested changes to the Cypherpunks Quick Code to Wendell Noseworthy for insertion into the next offically cypherpunk-agenda-approved release of the Cypherpunks Quick Code. Send them to me... Bill Garland, whose .sig does channeling for a small fee

1 0

RE: Laundering money through commodity futures
by Pat Farrell 17 Dec '03

17 Dec '03

hughes(a)ah.com (Eric Hughes) posts to C'punks: >> This zero sum nature is the key to laundering the money. Person A and >> Person B get together and guess that the price for a commodity is going >> to go up. > > Guess. Read that word again; it's important. > >[stuff elided] > The example is ludicrous, but the conclusion is valid. More > transactions means more interactions between them and more possibility > to hide something inside the ever-increasing flux. On the OP-Ed page of the WSJ a week ago thursday (page A14) is an article that describes a way to make a $100,000 bribe look like extrodinary luck in the cattle futures market. The trick that both the initial poster and Eric missed is that you don't guess. You need a shady broker who makes a saddle - both side of the trade - and doesn't register either. Once the market has moved, one will post a gain, and the other a loss. So you could, hypothetically of course, post the loser to a huge poultry conglmerate, and the winner to a successful laywer's account. The Poultry firm would write it off as a normal market loss that was protecting their operations. The laywer would claim that she read the WSJ and was lucky. But untracable electronic markets will have lots of transactions, so there will be lots of ways to play these games. This is what drives the taxman crazy. Pat Pat Farrell Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

1 0

Warrantless searches -- A sign of things to come?
by paul＠hawksbill.sprintmrn.com 17 Dec '03

17 Dec '03

A Page 1 story in The Washington Post Sunday (94.04.17) reads, "Clinton Lets Police Raid Projects," "Warrantless Searches Said to Be Needed For Tenants Safety." For those who haven't been following this ludicrous story, the USG has now decided that Chicago Housing Authority-sponsored, and warrantless, searches of dwellings within the CHA, is "A Good Thing" (tm) and specifically geared towards uncovering weapons of criminals (or would-be criminals) for the safety of law-abiding Housing tenants. Personally, I find this mentality alarming and indicative of a growing trend within the government. "Big Brother knows best." Vile and Nauseating. This is another absurdity in the "War on Drugs" and "War on Crime." More government-sponsored "wars" are undoubtedly on the horizon, perhaps even a war on non-escrowed crypto. I suppose things will get worse before they get better. _______________________________________________________________________________ Paul Ferguson US Sprint Enterprise Internet Engineering tel: 703.904.2437 Herndon, Virginia USA internet: paul(a)hawk.sprintmrn.com

3 2

If however Dolphin Encrypt was extremely strong ...
by wet!naga 17 Dec '03

17 Dec '03

>Date: Sat, 16 Apr 94 21:26:24 -0700 >From: hughes(a)ah.com (Eric Hughes) >Message-Id: <9404170426.AA28904(a)ah.com> >To: cypherpunks(a)toad.com >In-Reply-To: Anonymous's message of Fri, 15 Apr 1994 12:53:16 -0400 <Added.shfgNum00UdZ0OvU4M(a)andrew.cmu.edu> >Subject: Dolphin Encryption Tutorial >Precedence: bulk >Status: R Eric Hughes quotes "Anonymous": >>Are you somehow implying the Dolphin Encrypt withstands critical >>examination? Be real. Real? "Anonymous" here reveals that he has not been keeping up with the literature. DE was examined critically by Prof. Cipher Deavours in the October 1993 issue of Cryptologia, who (after studying the C source code for the encryption algorithm) wrote: "The diffusion process employed in the ciphering of data is fairly complex for an inexpensive system such as this one." Eric then allows as how: >Last time Dolphin Encrypt reared its insecure head in this forum, >these same issues came up. The cipher that DE uses is not public and >was not designed by a person of known cryptographicc competence. It >should therefore be considered extremely weak. However, in Peter Meyer's article we read: >The >encryption algorithm used in Dolphin Encrypt is defined by the C source >code for the encryption and decryption functions, and this source code is >part of a publicly available C function library (the Dolphin Encryption >Library). The method is not secret and its full details are available for >examination to anyone who purchases the library. Perhaps the DE cipher is not "public" in the sense that it is widely available on unix sites, but it is "publicly available". Perhaps the source code is not posted on sites such as soda because the publisher does not wish to expose himself to the the charge of making a strong crypto system available for export. Eric again quotes "Anonymous": >>The comparison, fairly useless as it is, is even more useless without >>this further information. > >Agreed. For all we know Eric himself posted that "anonymous" message, so he could quote him out of context. As I recall, Anonymous seemed to have (deliberately?) misunderstood the part about the statistical test (and Eric agrees with him). >I repeat my recommendation of before: Do not use Dolphin Encrypt if >you want secrecy. If you want something on the scale of a secret >decoder ring, fine. > >Eric By his own admission Eric is ignorant of the DE cipher and is ignorant of the cryptographic competence of the author (or authors) of DE. Yet, rather than withholding judgment until more information is available, he makes a strong negative recommendation (and adds an insult). I would imagine that, in the opinion of most people, recommendations based upon ignorance such as this are worthless. Eric seems to have a burr up his ass regarding either DE or its author(s). His misrepresentation (e.g. that the DE cipher is not public) and lack of logic (e.g. we don't know that X is true therefore X is false) suggest that there is an emotional basis to his "recommendation". Apparently as regards DE Eric is not capable of anything except smear tactics. The astute readers of this list are not likely to be fooled by this.

2 1

New Remailer
by Istvan Oszaraz von Keszi 17 Dec '03

17 Dec '03

Could someone give me some quick direction on installing and running a new remailer. Due to system constraints, I've had to rewrite some of the mailer software, I've tested it, and it seems to operate fine. My question is what is necessary, to create an address for the remailer? I'd like it addressed as something other than my personal account. Do I contact my sysadmins for a new address, or is this something which is user configurable. Thanks BTW: Do I open up the remailer to the public or do I ask some of the users of remailers to help me test it prior to a world release.

4 3

Re: 'Nother MIT talk on crypto...
by Hal 17 Dec '03

17 Dec '03

From: hughes(a)ah.com (Eric Hughes) > Micali's "fair" cryptosystem is a much better key surrender system > than Clipper, but it still allows non-intended recipients for a > message. > > For this reason, I don't like it either. > > Fight _all_ intrusions. > > Eric Right - here are some quotes from Micali's paper in the Crypto 92 proceedings. "Abstract. We show how to construct public-key cryptosystems that are _fair_, that is, strike a good balance, in a democratic country, between the needs of the Government and those of the Citizens. [...] "In this paper we show how cryptographic protocols can be successfully and efficiently used to build cryptosystems that are fairer, that is, that strike a better balance, in a democratic country, between the needs of society and those of the individual." Micali's system is basically a key escrow system that would be quite appealing to those who love Clipper. At least he has the honesty to make it clear that such a system makes more sense if competing systems are made illegal: "Of course, if using any other type of public-key cryptosystem were to be made _illegal_, Fair PKC's would be most effective in guaranteeing both private communication to law-obeying citizens and law enforcement. (In fact, if a criminal uses a phone utilizing a Fair PKC to plan a crime, he can still be secured to justice by court-authorized line tapping. If he, instead, illegally uses another cryptosystem, the content of his conversations will never be revealed even after a court authorization for tapping his lines, but, at least, he will be convicted for something else: his use of an unlawful cryptosystem.) Nonetheless, as we shall discuss in section 4, Fair PKC's are quite useful even without such a law." When I first heard of this so-called "Fair" (one of the most misused words in political debate) system, my reaction was to snort in derision. But since Clipper it starts to look like the lesser of two evils. That just shows how the terms of the debate can shift. Eric is right that the best thing to do is to remain firmly committed to free access to cryptographic technology for everyone. Hal

2 1

Re: Key Eater Needed
by Matthew J Ghio 17 Dec '03

17 Dec '03

Mike Ingle <MIKEINGLE(a)delphi.com> wrote: > There is no way to know now when a key was sent to a server, so it is hard > to know when to delete it. One way would be to keep track of when new > keys are sent or updated, and delete any key which has not been updated > within a certain time, such as one year. All existing keys could be given > six months to live. Those who wanted to keep their present keys could > send them again, and others could create new ones. > > The web of trust model does not lend itself easily to key expirations, > because this requires you to frequently get people to re-sign your key, > and to re-sign the keys of others. This creates the opportunity for the > "here's my new key, and I haven't got it resigned yet" attack. There > would have to be a fairly long overlap period between new and old keys, > during which time the old key signed the new key. Expirations would > complicate the system considerably. How about people just keep their keys, and the signatures, but they re-sign their own keys every six months or so? In order to keep their keys on the keyserver, they must submit a PGP signed message to prove that they still have that key. If they don't, the key is assumed to be lost, and it is deleted.

1 0

Re: Laundering money through commodity futures
by tim werner 17 Dec '03

17 Dec '03

>Date: Mon, 18 Apr 1994 10:01:52 -0400 >From: "Perry E. Metzger" <perry(a)snark.imsi.com> >tim werner says: >> A man went to the casino with several suitcases full of money and proceeded >> to play roulette using the progressive betting strategy. Eventually he >> broke the bank. That's when casinos started imposing house limits on the >> tables. I don't think this story is apocryphal. > >In that case, please provide the time, place, and location -- also >provide references to original sources so that we can look it up >ourselves. I took a probability class in the early '70s. The prof explained the progressive betting system and told us the Monte Carlo story. As I recall, it took place in the late 1700s. That's all I can remember, except that he made it clear the system was not guaranteed to work even with no house limit unless you have unlimited funds. Just that someone actually did break the bank at Monte Carlo. I have used the system twice and won both times. The second time I almost got burned when red came up 6 times in a row. On the 7th time I had $320 riding on black and it came up black. My profit on the 7 spins: $5. I was only 1 spin away from the house limit. If it had come up red, I could have bet $640 on black one more time, but that would have been the end. The limit was $1250. I almost switched the $320 to red. After that experience I decided to do some analysis of the system, and finally managed to convince myself of something that I should have known all along: the house limits are set so that you will lose the same amount of money in the long run if you bet progressively as you will if you just bet $5 on black each time. Next time I get to a library I will see if I can find out anything else about it, if you are really interested. >> I don't think the commodity exchanges have the same sort of limits set up. > >You don't know anything about the commodities market, then. That's not entirely true. I do know that the commodities market is another place where you can lose a lot of money real quick. :) Actually, when I said 'the same sort of limits', what I meant was limits that are specifically designed to ensure that you will lose eventually, like they have at casinos. For instance, the house limit at a casino is generally such that you can only double your bet 7 times (e.g., $1250 limit on a $5 table, or $500 limit at a $2 table). Is the same sort of low limit placed on commodities trades? tw

2 1