December 2003 - cypherpunks-legacy

AABBS Conviction relation to child porn?
by ED KELLY 17 Dec '03

17 Dec '03

There is hoopla over the convictions of those who ran the Amateur Action BBS. The actual charges involve stuff that sounded like it was intended to be distributed as child pornography. The indictment described the offensive material being destributed as follows in each count: COUNT 1: CONSPIRACY TO VIOLATE FEDERAL OBSCENITY LAWS BY DISTRIBUTING OBSCENE MATERIALS (see following) -------------------------- COUNT 2: "AA-8589.GIF" described as "SHE SUCKS HER SON'S COCK! FATHER IS FUCKING HIS DAUGHTER !" -------------------------- COUNT 3: "AA-8278.GIF" described as "FULL SCREEN VIEW! A HAIRLESS PUSSY NAILED TO A TABLE!", "AA-7153.GIF" described as "MOTHER IS WATCHING HER DAUGHTER FUCK BIG COCK! NO TITS!", "AA-8682.GIF" described as "HE MAKES HIS DAUGHTER SUCK COCK! SHE IS FISTING HER SISTER!", and "AA-11935.GIF" described as "HE FUCKS HIS DAUGHTERS HAIRLESS CUNT!" SHE FISTS HER MOTHER!" -------------------------- COUNT 4: "AA-15198.GIF" described as "BLONDE LOLITA HAS NO TITS! SUCKS HUGE COCK AND DRINKS SPERM!" ------------------------- COUNT 5: "AA-13216.GIF" described as "PUSSY PENETRATION! HORNY BRUNETTE GETS FUCKED BY A HORSE!" ------------------------- COUNT 6: "AA-13517.GIF" described as "HORNY BLONDE JACKS OFF HORSE! HORSE CUM ON HER HANDS!"', "'AA-13521.GIF" described as "CLOSE-UP! BIG HORSE COCK IN HER CUNT! HORSE CUM ON HER LEG", and "AA-16587.GIF" described as "'SHE SUCKS THICK DOG COCK! DOG SPERM ON HER LIPS AND CHIN." -------------------------- COUNT 7: "AA-17623.GIF" described as "YOUNG ASIAN HAS A THICK CLIT! DRINKS PISS FROM AN UNCUT COCK!" -------------------------- COUNT 8: . . . used an express company and common carrier, United Parcel Service (UPS), for carriage in interstate commerce from California to Tennessee an obscene video cassette tape -------------------------- COUNT 9: . . . used an express company and common carrier, United Parcel Service (UPS), for carriage in interstate commerce from California to Tennessee obscene video cassette tapes -------------------------- COUNT 10: . . . used an express company and common carrier, United Parcel Service (UPS), for carriage in interstate commerce from California to Tennessee obscene video cassette tapes -------------------------- COUNT 11: . . . shipped in interstate commerce by means of the United States Mail, visual depictions, the production of which involved the use of a minor engaging in sexually explicit conduct, . . . involving (three (3) magazines, bearing titles of "Little Girls Fuck Too!", "Lolita Colour Special 6" and "Lolita Color Special 18" -------------------------- COUNT 12: FORFEITURE ALLEGATIONS involving any instrumentalities of committing crimes. The Grand Jury voted to charge the defendants with all of the above crimes. The trial jury, did not convict the defendant of the one count charging child pornography -- perhaps because it was never proved that the defendants opened it (see Count 11). Although the convictions of the defendants in the Amateur Action BBS case were not technically for violation of federal child pornography laws, if the defendant's own descriptions of their wares is correct, I think the jury might have convicted them because of the apparant inclusion of children in their materials. People do not need to feel bad about convictions of those who peddle depictions showing children in sex acts. Reasonable people may disagree about important issues. But, I do not feel protected speech or electronic communication was endangered by the defendants' shipment and sale of their described materials. ED KELLY

3 2

fixed code
by Adam Shostack 17 Dec '03

17 Dec '03

The procmail stuff I sent yesterday was slightly broken. It seems that keyservers respond well to 'mget 36E61FB1', but not 'get 36E61FB1' To auto retrieve keys, use these two procmail recipies: # auto key retreival :0BW * -----BEGIN PGP KEYID=|/usr3/adam/bin/sender_unknown # I have an elm alias, pgp, points to a keyserver :0ac |elm -s"mget $KEYID" pgp sender_unknown #!/bin/sh # sender_unknown returns a keyid, exits 1 if the key is known OUTPUT=`pgp -f +VERBOSE=0 +batchmode -o /dev/null` echo $OUTPUT | egrep -s 'not found in file' EV=$? if [ $EV -eq 0 ]; then echo $OUTPUT | awk '{print $6}' fi exit $EV

2 1

Re: NYT on Insecure Phones
by cactus＠hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199412040246.VAA25360(a)pipe3.pipeline.com>, John Young <jya(a)pipeline.com> wrote: > Cellular One of Washington-Baltimore, owned by SBC > Communications Inc., has sent its customers letters > notifying them that it would block the service beginning on > Thursday because it had compiled a huge backlog of phone > numbers used in New York that appeared to be fraudulent. It's worse than that! They will allow customers to use their service in NYC, I'm told by a customer of their's visiting this weekend, if they pay for the call with a credit card (IE, VISA, MC, etc) that they must *give* *an* *operator* *over* *the* *cellphone*. So to avoid their own exposure to fraud, they're requiring their customers to give credit card info over the cellphone. Thanks, guys. No pro-34s 'round here, nope. - -- Todd Masco | "Roam home to a dome, Where Georgian and Gothic once stood cactus(a)hks.net | Now chemical bonds alone guard our blond(e)s, cactus(a)bb.com | And even the plumbing looks good." - B Fuller - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuFGUioZzwIn1bdtAQF98wGAiBKy9nk/SzN7Nb/8v/noLEZDJgRCZy71 pjyDqlAtjnnQ0KelgzqDPLr8LIXAo8Eq =+JzJ -----END PGP SIGNATURE-----

3 2

Remailers and "##"
by Jonathan Rochkind 17 Dec '03

17 Dec '03

I know there's some kind of a syntax you can use involving "##", with some of the remailers, and the remailer will insert a header line into the message. But I'm having trouble figuring out what syntax this is. Can anyone help me out?

3 2

backing ecash
by Alex Strasheim 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [Standard disclaimer: all of this may be based on some misunderstanding of the underlying situation on my part.] I've been thinking about what Eric and others have written about the apparent problems Digicash is having hooking up with financial partners. I agree that it would be encouraging if some large banks or a credit card company were on board, but I'm not sure their absence is as big of a problem for a digital currency system like Digicash as it would be for other types of systems. If a transaction system uses credit card numbers to process purchases, then you need to have either a credit card company that's willing to participate, or someone with a merchant account to submit purchases to the system. Obviously, if the credit card company doesn't want to allow the online system, they can prevent people with merchant accounts from participating, so it's important to have them onboard. But digital currency is a commodity, or at least an incredibly lifelike simulation of one. If someone's willing to make a market for it, it will have value, assuming the system's secure and the mint behaves responsibly. Suppose Digicash opened up a digital currency exchange in Amsterdam. They agree to make a market in edollars. Specifically, they agree to sell edollars for $1US, and they agree to buy edollars for $0.99. This prices are good for all time, for all comers. The promise to sell is easy to keep, because they can mint as many edollars as they want. The promise to buy is backed up by cash reserves, which they create with revenues from sales. Let's suppose, just for the sake of argument, that the currency exchange doesn't even conduct business over the net. You have to walk into a storefront in Amsterdam with a floppy disk to buy or sell edollars. Edollars would still have value here in Lincoln, NE USA. I could find a partner and set up a local currency exchange here in Lincoln; my partner would set up shop in Amsterdam. We'd offer to sell edollars for $1.01 and buy them for $0.98. We'd keep reserves of both edollars and US dollars on hand, from which we'd do our trading. If we started to run low on edollars, my partner would go to the storefront and buy some more. If we started to accumulate too many, he'd sell. The prices are set up so that we'd always make a profit, assuming our volume was high enough to cover expenses. Now suppose that Bob, who runs a local business here in town, wants to sell widgets over the net. He decides to use digicash software. Alice lives in Hoboken, and she wants to buy a widget. She goes to a digital currency exchange in Hoboken and buys some edollars, and then she uses her digicash client to transfer the funds to Bob at Widgets 'R Us. Every day, Bob goes to the bank and deposits the day's checks at the drive through window. Once he started selling online, he stops at my drive through window every day on the way to the bank. He gives me the edollars, and I give him a check. Then he deposits my check along with all the others at the bank. If my check is good, the bank can't say much about things one way or another. You don't need Visa or Citibank or anyone else onboard. They're not part of the loop. You just (just?) need the government to agree to stay out of the way. Now obviously, things would work a lot more smoothly if you didn't need me or my digital currency exchange. It would be nice if Bob and Alice could buy and sell edollars from their banks online. But it's not essential. I could extend credit to Alice so that she could buy edollars from me online, without having to go out and physically buy them. If Bob and I have been doing business for a while, maybe he'll trust that I'll mail him a check after he transfers edollars to me online. I suspect that if I started to make money, banks would decide to put people like me out of the business by moving into it themselves. It seems to me that one of the main strenghts of the digicash system is that it can take off slowly as more and more people decide to use it. It doesn't need to be embraced by anyone except the regulators. If it's cheaper and provides a better service, it will win. == Alex Strasheim | finger astrashe(a)nyx.cs.du.edu alex(a)omaha.com | for my PGP 2.6.1. public key -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLuKXVBEpP7+baaPtAQEaLwP+K0MU9agIOaLb9SI9Bwv9732P5ltsdeJ5 45z2IUPzOPRJn/o+ivXJv7sjP1hIlTXMKjA2Q0Lpy2gplDIa8/cqz9WmqSku837o nJc13tdsJevfNjtEUztC1kfrTsrZjwxW2L+hg0uL9GJSxFhU6G+eKqsXYH5nlEFZ b1w2wFbzf5c= =4/Jz -----END PGP SIGNATURE-----

3 2

Moto Secure Clear digital?
by Wes Felter 17 Dec '03

17 Dec '03

I just got a second phone line, and decided that if I was going to get a 2-line phone it might as well be a good one, so I am considering a Motorola Secure Clear cordless 2-line phone with speakerphone. This will be quite an investment,so I was wondering whether the Secure Clear phones are digitally encrypted or merely scrambled using some analog method. Anybody know about this? How secure are these phones really? --Wes Wesley Felter wesf(a)unicycle.cs.tulane.edu I speak for no one. Trust no one. Cryptography is outlawed and only the outlaws care. When thinking is outlawed, maybe then somebody will care. When thinking is outlawed, only outlaws will be able to care. <sigh, depressing .sig>

3 2

Callback phones
by Ben 17 Dec '03

17 Dec '03

I picked this up on the alt.2600 newsgroup. Seems like it could be used for things like privacy enhancement if it was coupled with a credit card/cashier's check that wasn't in your name along with perhaps a call back loop. Ben. Begin Forwarded Article: __________

1 0

Big Brother database
by Brad Dolan 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm watching a congressional hearing on C-SPAN about the "Computer Criminal Tracking System." Jim Martin of the National Consortium for Justice Information and Statistics is testifying, describing an FBI database under development. As an example of its intended use, he gave the following example: A hitchhiker could be stopped by police and required to submit fingerprints. These fingerprints could transmitted digitally to obtain instant identification and "criminal history" information about the hitchhiker. Criminal history information would include information from federal, state, and local authorities. Mr. Martin also observed that, while existing Justice Information databases are now used only for law-enforcement, firearms licensing, and "national security purposes," he envisions that the new database could be expanded in its uses to include "non-criminal justice" applications. Why should I have to provide fingerprint identification on demand to cops? What are the "national security" applications of existing databases? Imagine all the potential "non-criminal justice" applications for the new database. What happens when this database gets linked up to the "citizen tracking and employment eligibility" database under construction? Do we then have a de facto (cardless) national ID? I think so. -----BEGIN PGP SIGNATURE----- Version: 2.9.i iAMtyPingInAfakeKeYBecaUSeSomePeoPleOnACErtaINMailiNGLIStarereQU IRinGtheUseoFDiGiTaLSiGNAturES.DoESTHIsMaKEaNYSenSEtoyOU?ItDoESN 'TTOMEsOIAMdoINgTHisInsTEAdblAHBLahbLAHbLahBlAHBlahBlahbLAHBlahb blAHBlahbLAh blAHb -----END PGP SIGNATURE-----

1 0

Re: Big Brother database
by merriman＠metronet.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The above line is a recycled pgp signature header. Save those bits! > >Mr. Martin also observed that, while existing Justice Information >databases are now used only for law-enforcement, firearms licensing, >and "national security purposes," he envisions that the new >database could be expanded in its uses to include "non-criminal justice" >applications. Oh, hot diggety. >Why should I have to provide fingerprint identification on demand to >cops? 'cause they'll shoot you or toss you in jail if you don't? > >What are the "national security" applications of existing databases? Finding out which spys in the CIA have been deducting payments on their new Jaguars. > >Imagine all the potential "non-criminal justice" applications for the >new database. Child support, vagrancy, alimony, using cash instead of plastic, parking tickets, income taxes, state taxes, municipal taxes, tax taxes, environmental terrorism (remember that tree in your yard you cut down?), jaywalking, having a hole in your sneakers, picking your nose, Un-American activities (ie, disagreeing with the Kongress), Tax Fraud (ie, trying not to give any more your money than you have to to the Tax Gestapo), reading books on the Prohibited Publications List, Violation of National Health Policy (ie, eating junk food, or otherwise placing an 'undue burden' on the National Health Kare System), and any other kind of mopery and dopery they can think up. If you can think of it or do it, they'll make it illegal, immoral, or Socially Irresponsible. > >What happens when this database gets linked up to the "citizen >tracking and employment eligibility" database under construction? grab your ankles. >Do we then have a de facto (cardless) national ID? I think so. You got it, Bunky. -----BEGIN PGP SIGNATURE----- Version: 3.141592654 ThIsIsAfAkEsIgNaTuReBlOcKsOtHaTtHeSiLlYcYpHeRpUnKsReMaIlErAtToAd DoEsNoTtHrOwUp,IfYoUCaNrEaDtHiS,ThEnYoUnEeDtOgOoUtAnDbUyYoUrSeLf SoMeViSiNeToMaKeYoUrEyEsFeElBeTtEr-PlEaSeAcCePtMyApOlOgIeSfOrThE rIdIcUlOuSnAtUrEoFtHiSuSeLeSsBiToFcRyPtO- FlUfF -----END PGP SIGNATURE----- - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)fohnix.metronet.com for PGP public key and fingerprint. PGP encrypted Email welcome, encouraged, and preferred. "Those who make peaceful revolution impossible will make violent revolution inevitable." John F. Kennedy

2 1

The Sapphire Stream Cipher
by Michael Paul Johnson 17 Dec '03

17 Dec '03

THE SAPPHIRE STREAM CIPHER The Sapphire Stream Cipher is designed to have the following properties: * Be useful for generation of cryptographic check values as well as protecting message privacy. * Accept a variable length key. * Strong enough to justify _at least_ a 64 bit key for balanced security. * Small enough to be built into other applications with several keys active at once. * Key setup fast enough to support frequent key change operations but slow enough to discourage brute force attack on the key. * Fast enough to not significantly impact file read & write operations on most current platforms. * Portable among common computers and efficient in C, C++, and Pascal. * Byte oriented. * Include both ciphertext and plain text feedback (for both optimal data hiding and value in creation of cryptographic check values). * Acceptable performance as a pure pseudorandom number generator without providing a data stream for encryption or decryption. * Design in a little extra strength where there is doubt about what attacks might be a threat. HISTORY AND RELATED CIPHERS The Sapphire Stream Cipher is very similar to a cipher I started work on in November 1993. It is also similar in some respects to the alledged RC-4 that was posted to sci.crypt recently. Both operate on the principle of a mutating permutation vector. Alledged RC-4 doesn't include any feedback of ciphertext or plain text, however. This makes it more vulnerable to a known plain text attack, and useless for creation of cryptographic check values. On the other hand, alledged RC-4 is faster. The Sapphire Stream Cipher is used in the shareware product Quicrypt, which is available at ftp://ftp.csn.net/mpj/qcrypt10.zip and on the Colorado Catacombs BBS (303-772-1062). There are two versions of Quicrypt: the exportable version (with a session key limited to 32 bits but with strong user keys allowed) and the commercial North American version (with a session key of 128 bits). A variant of the Sapphire Stream Cipher is also used in the shareware program Atbash, which has no weakened exportable version. I don't recall ever reading anything about using a stream cipher like this for the generation of cryptographic check values, but it seems like it should be a fast technique compared to some existing hash functions. OVERVIEW The Sapphire Stream Cipher is based on a state machine. The state consists of 5 index values and a permutation vector. The permutation vector is simply an array containing a permutation of the numbers from 0 through 255. Five of the bytes in the permutation vector are moved to new locations (which may be the same as the old location) for every byte output. The output byte is a nonlinear function of all 5 of the index values and 7 of the bytes in the permutation vector, thus frustrating attempts to solve for the state variables based on past output. On initialization, the index variables are set (somewhat arbitrarily) to 1, 3, 5, 7, and 11. The permutation vector (called the cards array in the source code below) is shuffled based on the user key. This shuffling is done in a way that is designed to minimize the bias in the destinations of the bytes in the array. The biggest advantage in this method is not in the elimination of the bias, per se, but in slowing down the process slightly to make brute force attack more expensive. Eliminating the bias (relative to that exhibited by RC-4) is nice, but this advantage is probably of minimal cryptographic value. KEY SETUP Key setup (illustrated by the function initialize(), below) consists of three parts: 1. Initialize the index variables. 2. Set the permutation vector to a known state (a simple counting sequence). 3. Starting at the end of the vector, swap each element of the permutation vector with an element indexed somewhere from 0 to the current index (chosen by the function keyrand()). The keyrand() function returns a value between 0 and some maximum number based on the user's key, the current state of the permutation vector, and an index running sum called rsum. Note that the length of the key is used in keyrand(), too, so that a key like "abcd" will not result in the same permutation as a key like "abcdabcd". ENCRYPTION Each encryption involves updating the index values, moving (up to) 5 bytes around in the permutation vector, selecting an output byte, and adding the output byte bitwise modulo-2 (exclusive-or) to the plain text byte to produce the cipher text byte. The index values are incremented by different rules. The index called rotor just increases by one (modulo 256) each time. Ratchet increases by the value in the permutation vector pointed to by rotor. Avalanche increases by the value in the permutation vector pointed to by another byte in the permutation vector pointed to by the last cipher text byte. The last plain text and the last cipher text bytes are also kept as index variables. See the function called encrypt(), below for details. PSUEDORANDOM BYTE GENERATION If you want to generate random numbers without encrypting any particular ciphertext, simply encrypt 0. There is still plenty of complexity left in the system to ensure unpredictability (if the key is not known) of the output stream when this simplification is made. DECRYPTION Decryption is the same as encryption, except for the obvious swapping of the assignments to last_plain and last_cipher and the return value. See the function decrypt(), below. C++ SOURCE CODE FRAGMENT The original implimentation of this cipher was in Object Oriented Pascal, but C++ is available for more platforms. /* sapphire.h -- Interface for the Saphire stream cipher. Dedicated to the Public Domain the author and inventor (Michael Paul Johnson). This code comes with no warranty. Use it at your own risk. Ported from the Pascal implementation of the Sapphire Stream Cipher 9 December 1994. unsigned char is assumed to be 8 bits. If it is not, the results of assignments need to be reduced to 8 bits with & 0xFF or % 0x100, whichever is faster. */ class sapphire { // These variables comprise the state of the state machine. unsigned char cards[256]; // A permutation of 0-255. unsigned char rotor, // Index that rotates smoothly ratchet, // Index that moves erratically avalanche, // Index heavily data dependent last_plain, // Last plain text byte last_cipher; // Last cipher text byte // This function is used by initialize(), which is called by the // constructor. unsigned char keyrand(int limit, unsigned char *user_key, unsigned char keysize, unsigned char *rsum, unsigned *keypos); public: sapphire(unsigned char *key = NULL, // Calls initialize if a real unsigned char keysize=0); // key is provided. If none // is provided, call initialize // before encrypt or decrypt. ~sapphire(); // Destroy cipher state information. void initialize(unsigned char *key, // User key is used to set unsigned char keysize); // up state information. unsigned char encrypt(unsigned char b = 0); // Encrypt byte // or get a random byte. unsigned char decrypt(unsigned char b); // Decrypt byte. void burn(void); // Destroy cipher state information. }; /* sapphire.cpp -- the Saphire stream cipher class. Dedicated to the Public Domain the author and inventor: (Michael Paul Johnson). This code comes with no warranty. Use it at your own risk. Ported from the Pascal implementation of the Sapphire Stream Cipher 9 December 1994. */ #include <mem.h> #include "sapphire.h" unsigned char sapphire::keyrand(int limit, unsigned char *user_key, unsigned char keysize, unsigned char *rsum, unsigned *keypos) { unsigned u, // Value from 0 to limit to return. retry_limiter, // No infinite loops allowed. mask; // Select just enough bits. retry_limiter = 0; mask = 1; // Fill mask with enough bits to cover while (mask < limit) // the desired range. mask = (mask << 1) + 1; do { *rsum = cards[*rsum] + user_key[(*keypos)++]; if (*keypos >= keysize) { *keypos = 0; // Recycle the user key. *rsum += keysize; // key "aaaa" != key "aaaaaaaa" } u = mask & *rsum; if (++retry_limiter > 11) u %= limit; // Prevent very rare long loops. } while (u > limit); return u; } void sapphire::initialize(unsigned char *key, unsigned char keysize) { // Key size may be up to 256 bytes. // Pass phrases may be used directly, with longer length // compensating for the low entropy expected in such keys. // Alternatively, shorter keys hashed from a pass phrase or // generated randomly may be used. For random keys, lengths // of from 4 to 16 bytes are recommended, depending on how // secure you want this to be. int i; unsigned char toswap, swaptemp, rsum; unsigned keypos; // Initialize the indices and data dependencies. // Indices are set to different values instead of all 0 // to reduce what is known about the state of the cards // when the first byte is emitted. rotor = 1; ratchet = 3; avalanche = 5; last_plain = 7; last_cipher = 11; // Start with cards all in order, one of each. for (i=0;i<256;i++) cards[i] = i; // Swap the card at each position with some other card. toswap = 0; keypos = 0; // Start with first byte of user key. rsum = 0; for (i=255;i>=0;i--) { toswap = keyrand(i, key, keysize, &rsum, &keypos); swaptemp = cards[i]; cards[i] = cards[toswap]; cards[toswap] = swaptemp; } toswap = swaptemp = rsum = 0; keypos = 0; } sapphire::sapphire(unsigned char *key, unsigned char keysize) { if (key && keysize) initialize(key, keysize); } void sapphire::burn(void) { // Destroy the key and state information in RAM. memset(cards, 0, 256); rotor = ratchet = avalanche = last_plain = last_cipher = 0; } sapphire::~sapphire() { burn(); } unsigned char sapphire::encrypt(unsigned char b) { // Picture a single enigma rotor with 256 positions, rewired // on the fly by card-shuffling. // This cipher is a variant of one invented and written // by Michael Paul Johnson in November, 1993. unsigned char swaptemp; // Shuffle the deck a little more. ratchet += cards[rotor++]; swaptemp = cards[last_cipher]; cards[last_cipher] = cards[ratchet]; cards[ratchet] = cards[last_plain]; cards[last_plain] = cards[rotor]; cards[rotor] = swaptemp; avalanche += cards[swaptemp]; // Output one byte from the state in such a way as to make it // very hard to figure out which one you are looking at. last_cipher = b^cards[cards[(cards[ratchet] + cards[rotor] + cards[last_plain] + cards[last_cipher] + cards[avalanche])&0xFF]]; last_plain = b; return last_cipher; } unsigned char sapphire::decrypt(unsigned char b) { unsigned char swaptemp; // Shuffle the deck a little more. ratchet += cards[rotor++]; swaptemp = cards[last_cipher]; cards[last_cipher] = cards[ratchet]; cards[ratchet] = cards[last_plain]; cards[last_plain] = cards[rotor]; cards[rotor] = swaptemp; avalanche += cards[swaptemp]; // Output one byte from the state in such a way as to make it // very hard to figure out which one you are looking at. last_plain = b^cards[cards[(cards[ratchet] + cards[rotor] + cards[last_plain] + cards[last_cipher] + cards[avalanche])&0xFF]]; last_cipher = b; return last_plain; } GENERATION OF CRYPTOGRAPHIC CHECK VALUES (HASH VALUES) For a fast way to generate a cryptographic check value (also called a hash or message integrity check value) of a message of arbitrary length, simply generate a set of 20 bytes (160 bits) by encrypting zeroes. The output so generated is the cryptographic check value. To generate a cryptographic check value when message integrity is desired but encryption is not (for example, as part of a digital signature process), either use a "standard" key (like four bytes of zero) or simply bypass the "card shuffling" part of the key setup (for even more speed). The plain text is still fed to the encrypt function, but the ciphertext is discarded until the check value is generated. SECURITY ANALYSIS There are several security issues to be considered. Some are easier to analyze than others. The following includes more "hand waving" than mathematical proofs, and looks more like it was written by an engineer than a mathematician. The reader is invited to improve upon or refute the following, as appropriate. KEY LENGTH There are really two kinds of user keys to consider: (1) random binary keys, and (2) pass phrases. Analysis of random binary keys is fairly straight forward. Pass phrases tend to have much less entropy per byte, but the analysis made for random binary keys applies to the entropy in the pass phrase. The length limit of the key (255 bytes) is adequate to allow a pass phrase with enough entropy to be considered strong. To be real generous to a cryptanalyst, assume dedicated Sapphire Stream Cipher cracking hardware. The constant portion of the key scheduling can be done in one cycle. That leaves at least 256 cycles to do the swapping (probably more, because of the intricacies of keyrand(), but we'll ignore that, too, for now). Assume a machine clock of about 256 MegaHertz (fairly generous). That comes to about one key tried per microsecond. On average, you only have to try half of the keys. Also assume that trying the key to see if it works can be pipelined, so that it doesn't add time to the estimate. Based on these assumptions (reasonable for major governments), and rounding to two significant digits, the following key length versus cracking time estimates result: Key length, bits Time to crack ---------------- ------------- 32 35 minutes (exportable in qcrypt) 33 1.2 hours (not exportable in qcrypt) 40 6.4 days 56 1,100 years (kind of like DES's key) 64 290,000 years (good enough for most things) 80 19 billion years (kind of like Skipjack's key) 128 5.4E24 years (good enough for the clinically paranoid) Naturally, the above estimates can vary by several orders of magnitude based on what you assume for attacker's hardware, budget, and motivation. In the range listed above, the probability of spare keys (two keys resulting in the same initial permutation vector) is small enough to ignore. The proof is left to the reader. INTERNAL STATE SPACE For a stream cipher, internal state space should be at least as big as the number of possible keys to be considered strong. The state associated with the permutation vector alone (256!) constitutes overkill. PREDICTABILITY OF THE STATE If you have a history of stream output from initialization (or equivalently, previous known plaintext and ciphertext), then rotor, last_plain, and last_cipher are known to an attacker. The other two index values, flipper and avalanche, cannot be solved for without knowing the contents of parts of the permutation vector that change with each byte encrypted. Solving for the contents of the permutation vector by keeping track of the possible positions of the index variables and possible contents of the permutation vector at each byte position is not possible, since more variables than known values are generated at each iteration. Indeed, fewer index variables and swaps could be used to achieve security, here, if it were not for the hash requirements. CRYPTOGRAPHIC CHECK VALUE The relatively large portion of the state altered with each byte encrypted (relative to alledged RC-4) contributes to a rapid avalanche of generated check values -- probably more than is needed. A single bit change in a message causes a radical change in the check value generated (about half of the bits change). This is one good feature of a cryptographic check value. Another good property of a cryptographic check value is that it is too hard to compute a message that results in a certain check value. In this case, we assume the attacker knows the key and the contents of a message that has the desired check value, and wants to compute a bogus message having the same check value. There are two obvious ways to do this attack. One is to solve for a sequence that will restore the state of the permutation vector and indices back to what it was before the alteration. The other one is the so-called "birthday" attack that is to cryptographic hash functions what brute force is to key search. To generate a sequence that restores the state of the cipher to what it was before the alteration probably requires at least 256 bytes, since the index "rotor" marches steadily on its cycle, one by one. The values to do this cannot easily be computed, due to the nonlinearity of the feedback, so there would probably have to be lots of trial and error involve. In practical applications, this would leave a gaping block of binary garbage in the middle of a document, and would be quite obvious, so this is not a practical attack, even if you could figure out how to do it (and I haven't). If anyone has a method to solve for such a block of data, though, I would be most interested in finding out what it is. Please email me at m.p.johnson(a)ieee.org if you find one. The "birthday" attack just uses the birthday paradox to find a message that has the same check value. With a 20 byte check value, you would have to find at least 80 bits to change in the text such that they wouldn't be noticed (a plausible situation), then try the combinations until one matches. 2 to the 80th power is a big number, so this isn't practical either. If this number isn't big enough, you are free to generate a longer check value with this algorithm. Someone who likes 16 byte keys might prefer 32 byte check values for similar stringth. OTHER HOLES Are there any? Take you best shot and let me know if you see any. I offer no challenge text with this algorithm, but you are free to use it without royalties to me if it is any good. LEGAL STUFF The intention of this document is to share some research results on an informal basis. You may freely use the algorithm and code listed above as far as I'm concerned, as long as you don't sue me for anything, but there may be other restrictions that I am not aware of to your using it. The C++ code fragment above is just intended to illustrate the algorithm being discussed, and is not a complete application. I understand this document to be Constitutionally protected publication, and not a munition, but don't blame me if it explodes or has toxic side effects. ___________________________________________________________ | | |\ /| | | Michael Paul Johnson Colorado Catacombs BBS 303-772-1062 | | \/ |o| | PO Box 1151, Longmont CO 80502-1151 USA Jesus is alive! | | | | / _ | mpj(a)csn.org aka mpj(a)netcom.com m.p.johnson(a)ieee.org | | |||/ /_\ | ftp://ftp.csn.net/mpj/README.MPJ CIS: 71331,2332 | | |||\ ( | ftp://ftp.netcom.com/pub/mp/mpj/README -. --- ----- .... | | ||| \ \_/ | PGPprint=F2 5E A1 C1 A6 CF EF 71 12 1F 91 92 6A ED AE A9 | |___________________________________________________________|

1 0