December 2003 - cypherpunks-legacy

Mykotronx
by Tommy the Tourist 17 Dec '03

17 Dec '03

The latest Mykotronix dirt, pulled off of my source just last week. Scattered information, but perhaps this can be assembled with the other information to create a better profile. !(myko) ------------- TELEDYNE SYSTEMS COMPANY MYKOTRONX METROLOGY DEPT. 357 VANNESS WAY TORRANCE, CA FIELD SERVICES METROLOGY CALIBRATION SERVICE SPER PROPOSAL MET $2,000.00 $2,000.00 5/2/93 1 LOT $2,000.00 PLEASE MAKE RECALL PERIOD ONE (1) YEAR FOR EACH ITEM UNLESS ADVISED BY MYKOTRONX, INC. ATTN: DEAN BURNGART (881)886-2211/(881)717-6881 William H. Doy 1eTRWR2 20041 Space Park Redondo Beach, CA 90278 Bobby Daniels Caremella Mestriannatot Tim Hauersperger Bob Todd Rick Oberbbndorf Roger Brouwer Chris Curren Kathleen Fairley Rod Fujikawa Roger Brouwer Mike Furusawa Bill Greenfield Gerald Krause Russell Matsui Margaret McNeil Chris Curren Joe Heindl Jesse Mirilesie Landi Riley Rod Fujikawa Glenn Higuchi Scott Mobdderly Rick Oberndorf Wendy Goble Jason Moku Sam Morrissette Roy Usui Paul Smith Bob Todd Mr. Ed Martin AEROJET 1100 W Hollyvale Street Azusa, CA 91702 8403 Destruct Security Labels $106.78 4-5-93 One Hundred six dollars and 78/100*** Modern Data 4-5-93 Richard Takahashi Rob Ertgray GERALD KRAUSE JAN DOLPHIN 408-432-8180 SPY R US 2280 ZANKER ROAD, SUITE 207 SAN JOSE, CA 94135 6203 LITRONICK INDUSTRIES 2950 Redhill Ave. Costa Mesa, CA 92626 NCJ03078 FD70322040601 Myk-5 Ground Unit Serial Number s146 and l652EA $64,910 $93,820 10110111101 Acceptance Test Procedure/Test Report Report 2EA --J.Liaci AFCSC/LMJYP 4-8-93 BOB TO DDJ.LIACI210977-2356AFCSC/LMJYP Kelly AFB 250 Hall Blvd, Suite 112 San Antonio, TX 78243-7061 RJAMESLICCACIAFCSC/LMJYP Kelly AFB 250 Hall Blvd, Suite 112 San Antonio, TX MR JOHN WIMPY AFCSC/LMMLC Building 2028, Room 208 San Antonio, TX 78243-5000 NATIONAL SECURITY AGENCY Elkridge Landing Road Linthicum, MD 21090-2902 Checkfree Corporation Problem Resolution Department P.O. box 987 Columbus, OH 43216-0897 RALPH O'CONNELL 1401 Woodbridge Road Baltimore, MD 21228 3939 S. Figureora Street Los Angeles, CA 90037 Ms. Hazel M. Smith MS:W3-7534 Harris Corporation GISD P.O. Box 98000 Melbourne, FL 32902 Mr. Vito DiGigilio VLSI Technology, Inc. 634 Balboa Blvd., Suite 100 Encino, CA 91316 R. Takahashi Mykotronx, Inc. 357 VanNess Way uite 200 Torrance, CA 90501 Contract Administrator 210977-2821 HQAFIC/LECCS 306 Wakkanai St., Suite 1 San Antonio, TX 78243 Defense Investigative Service Industrial Security Field Office(S53LB) Attention: Barry W. Hash 3605 Long Beach Blvd., Suite 405 Long Beach, CA 90807-4013 R. Todd Lee George 408 629-2880 938 Foothill Drive San Francisco CA 95123 Franchise Tax Board P.0.Box 942840 Sacramento, CA 94240-000 John C. Droge 414 Sixth Street Hermosa Beach, CA 902540 Mr. Tom Black GLANTZ & BLACK 25043 Narbonne Avenue Lomita CA 90717 Maryland Procurement Office 7318 Parkway Drive South Hanover, MD 21076 ---- VLSI Technologies, Inc. 6345 Balboa Blvd. Bldg #1 Suite 100 Encino, CA 91316 Attn: Dr. Freeman PE4-18-93 PD4-12-93 $75,000.00 4-14-93 Seventy-five thousand dollars and no/100 **** Mykotronx, Inc. Payroll Account #731081567 ---- Mr. Tom Black Glantz & Black 25043 Narbonne Avenue Lomita, Ca 90717 14 April 1993 Dear Tom, Per your request attached has is a list of our sales from 1-1-93 through 3-13-93. I've marked the items as Government or Non-government. If you have any questions or need additional information, please call me on (310)533-8100. Sincerely, Patti ---- Maryland Procurement Office Attn: N22144(CEB)(MDA 904-92-G-0354/J.0.5001) 9800 Savage Road Fort George G. Meade, MD 20755-6000 Cryptographic Support Center Logistics Management Branch 250 Hall Blvd., Ste 311 San Antonio, TX 78243-0760 ------------ To respond to the sender of this message, send mail to remailer(a)soda.berkeley.edu, starting your message with the following 8 lines: :: Response-Key: ideaclipper ====Encrypted-Sender-Begin==== MI@```%AS^P;+]AB?X9TW6\8WR:*P&2&#E66'?22E^>4!79;]2Q5!'U$<<JHX M`"[QYE??E1ASFX#P?M@\HN3EX*PWZYQ!,?+42=@Y22SIOI/F+;(_!LI82<S^ #V?,2 ====Encrypted-Sender-End====

1 0

Re: PGP 2.5 available from Electronic Frontier Foundation ftp site
by Tommy the Tourist 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- From: Stanton McCandlish <mech(a)eff.org> Date: Wed, 11 May 1994 16:46:49 -0400 (EDT) Despite the patent & licensing issues being resolved, PGP is still not legally exportable from the United States (except to Canada), due to ITAR export restrictions which categorize cryptographic materials as weapons of war. Thus, EFF can only make PGP and other crypto tools and source code available to US and Canadian nationals currently residing in the US or Canada and connecting to EFF's site from a US or Canadian site. I was under the impression that NAFTA is the reason that Canada is included. Am I misinformed? If NAFTA is the reason, isn't Mexico equivalent to Canada in this context? Could someone clarify this aspect of the export situation, or perhaps point me at a document that explains the situation? Zeke -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLdJIuBVg/9j67wWxAQEebAP/flhqUugfCUJ9at1nI8kCbkXiF10NYfcE s+1+ZFNnvz16gwI/O7nEfrIHKQl6mqmqT8T4e2JCsMiw7uM7L3vYIKHJvRek45gk /6JoUE7sjVb8nyvyct9sKeExAGqKFLxAAsOZfYno88qOMAE4nc3QRxMoqLb3XDbI EbxPLyo8T/s= =RqOv -----END PGP SIGNATURE----- ------------ To respond to the sender of this message, send mail to remailer(a)soda.berkeley.edu, starting your message with the following 7 lines: :: Response-Key: ideaclipper ====Encrypted-Sender-Begin==== MI@```$YS^P;+]AB?X9TW6\8WR:>P&2'9,7.YM5[D--('+[6(0O]013@CTWLQ FKWZ$M2G9>G1>/=5O1[0U.E)J&63=DHF($P$KX#I8T]5&9!GFQ]@` ====Encrypted-Sender-End====

3 2

message brokering
by Matt Thomlinson 17 Dec '03

17 Dec '03

nobody says: Is there someone out there who would like to act as a broker (for a small fee, natch), so that I can maintain rigorous anonymity while trading? This seems like a good way to earn some ghostmarks! I'm sure *someone* will take you up on this offer. Alternatively, you could perhaps do business through the penet remailer...? mt Matt Thomlinson University of Washington, Seattle, Washington. phone: (206) 548-9804 Check my home page -- ftp://ftp.u.washington.edu/public/phantom/home.html PGP 2.2 key available via email, or finger phantom(a)hardy.u.washington.edu

2 1

Re: San Jose Mercury News Washington News in Brief Blurb
by collsc＠snowbird.aud.alcatel.com 17 Dec '03

17 Dec '03

> > Thursday May 12, 1994 > > ELECTRONIC SNOOPING TAKES SHARP UPTURN > > Wiretaps and electronic monitoring by federal agents, > primarily against suspected drug traffickers, grew by a > third during the first year of the Clinton administration, > the largest increase in a decade. > [N722] > This from the same Administration which rationalizes its attempts to emasculate cryptography by citing the need for and widespread use of such methods. Coincidence? You decide. +--------------------------------------------------------------------------+ |Scott Collins Alcatel Network Systems| |collsc(a)aud.alcatel.com Richardson, Texas| | Even if my employers agreed with this, they would never admit it. | | GCS d? -p+ c++@ l u e- m* s+/ n- h+ f? g-(+++) w+@ t-- r- y? | +--------------------------------------------------------------------------+

1 0

Postal Service and IRS mull national identity cards (fwd)
by harry＠starbase.sj.unisys.com 17 Dec '03

17 Dec '03

I know you are interested in electronic privacy issues, so I thought you would like to see the following article. Yikes! -- Harry Subject: Postal Service and IRS mull national identity cards Forwarded-by: bostic(a)vangogh.CS.Berkeley.EDU (Keith Bostic) Forwarded-by: kole(a)hydra.convex.com (John P. Kole) Forwarded-by: cavasin(a)bach.convex.com (Vince Cavasin) >From Digital Media, May 9, 1994. EVER FEEL LIKE YOU'RE BEING WATCHED? YOU WILL.... Postal Service and IRS mull national identity cards, Clinton to sign orders Digital Media has learned that the Clinton administration is debating not if, but how, to create a card that every American will need in order to interact with any federal government agency. Combined with two potential executive orders and the Postal Service's designs on putting its stamp on personal and business electronic transactions, the card could open a window on every nuance of American personal and business life. The wrangling among the administration, the U.S. Postal Service, the Internal Revenue Service and Department of Defense, emerged into the public eye at this April's CardTech/SecureTech Conference. The gathering of security experts was convened to discuss applications for smart card and PCMCIA memory card technologies in business and government. The Postal Service, at the conference presented a proposal for a "general purpose U.S. services smartcard," which individuals and companies would use to authenticate their identities when sending and receiving electronic mail, transferring funds and interacting with government agencies, such as the I.R.S., Veterans Administration and the Department of Health and Human Services. President Clinton is also considering signing two executive orders that would greatly expand the government's access to personal records, including an order that would allow the I.R.S. to monitor individual bank accounts and automatically collect taxes based on the results, said sources close to the White House. The collection service will be presented as a convenient way to avoid filling out a tax return. The White House did not respond to requests for comments about this report. The Post Office: We deliver for you. The Postal Service's U.S. Card would be designed to use either smart cards (plastic cards with an embedded microprocessor carrying a unique number that can be read by a electromagnetic scanner and linked to computerized records stored on a network) or PCMCIA cards, which can contain megabytes of personal information. (You've probably seen this type card in AT&T's "You Will" ad campaign, which shows a doctor inserting a woman's card in a reader in order to access a recording of a sonogram). The Postal Service said it is considering AT&T and other companies' smart card technologies. In a slide presentation at the conference, Postal representative Chuck Chamberlain outlined how an individual's U.S. Card would be automatically connected with the Department of Health and Human Services, the U.S. Treasury, the I.R.S., the banking system, and a central database of digital signatures for use in authenticating electronic mail and transactions. The U.S. Card is only a proposal, Chamberlain insists. Yet the Postal Service is prepared to put more than a hundred million of the cards in citizens' pockets within months of administration approval, he said. "We've been trying to convince people [in the different agencies] to do just one card, otherwise, we're going to end up with two or three cards," said Chamberlain. He said in addition to the healthcare card proposed by President Clinton last year, various government agencies are forwarding plans for a personal records card and a transactions (or "e-purse") card. Chamberlain said the I.R.S in particular is pursuing plans for an identity card for taxpayers. Don't leave home without it. Though he did not name the U.S. Card at the time, Postmaster General Marvin Runyon suggested that the Postal Service offer electronic mail certification services during testimony before the Senate Governmental Affairs Subcommittee in March. The proposal is clearly intended as a way to sustain the Postal Service's national role in the information age, since it would give the agency a role in virtually every legally-binding electronic transaction made by U.S. citizens. For instance: % When sending or receiving electronic mail, U.S. Card users would be able to check the authenticity of a digital signature to screen out impostors. % Banking transactions (notably credit card purchases) that depend on authentication of the participants identities and an audit trail, would be registered in Postal Service systems. % Veterans, or for that matter college students and welfare recipients, could check their federal benefits using the identification data on their U.S. Cards. % Visitors to an emergency room would have instant access to medical records at other hospitals, as well as their health insurance information. These examples may seem benign separately, but collectively they paint a picture of a citizen's or business's existence that could be meddlesome at best and downright totalitarian at worst. Will buying a book at a gay bookstore with a credit card that authenticates the transaction through the Postal Service open a Naval officer up to court martial? If you have lunch with a business associate on a Saturday at a family restaurant, will the IRS rule the expense non-deductible before you can even claim it? "There won't be anything you do in business that won't be collected and analyzed by the government," said William Murray, an information system security consultant to Deloitte and Touche who saw Chamberlain's presentation. "This [National Information Infrastructure] is a better surveillance mechanism than Orwell or the government could have imagined. This goddamned thing is so pervasive and the propensity to connect to it is so great that it's unstoppable." Deep Roots; Deep Pockets; Long History. Chamberlain said the Postal Service has been working for "a couple years" on the information system to back up the U.S. Card. He said the project was initiated by the Department of Defense, which wanted a civilian agency to create a national electronic communications certification authority that could be connected to its Defense Messaging System. Chamberlain said the Postal Service has also consulted with the National Security Agency, proponents of the Clipper encryption chip which hides the contents of messages from all but government agencies, like law enforcement. The National Aeronautics and Space Administration's Ames Research Laboratories in Mountain View, Calif. carried out the research and development work for Clipper. "We're designing a national framework for supporting business-quality authentication," said John Yin, the engineer heading up the U.S. Card- related research for NASA Ames' advanced networking applications group. "This is not specifically with just the Postal Service. We'll be offering services to other agencies and to third-party commercial companies that want to build other services on the card." For example, VISA or American Express could link their credit services to the U.S. Card. Yin, who works on Defense Messaging Systems applications, said his group has collaborated with "elements of Department of Defense" for the past year, but would not confirm the participation of the National Security Agency, a Department of Defense agency. The NSA is specifically prohibited from creating public encryption systems by the Computer Security Act of 1987. Yin also would not comment on the budget for the project, which other sources said was quite large and has spanned more than two years. A false sense of security? According to Yin, the cards would allow individuals or businesses to choose any encryption technology. "It's not our approach to say, 'Here's the standard, take it our leave it,'" he said. "We're not trying to create a monopoly, rather it's an infrastructure for interoperability on which a whole variety of services can be built." Yet, NASA, which is a participant in the CommerceNet electric marketplace consortium will "suggest" to its partners that they adopt the U.S. Card certification infrastructure, he said. The reality is that government agencies' buying power usually drives the market to adopt a particular technology -- not unlike the way the Texas Board of Education, the largest single purchaser of textbooks in the U.S., sets the standard for the content of American classroom curricula. Since, the administration has already mandated use of Clipper and its data-oriented sibling, the Tesserae chip, in federal systems it's fairly certain that the law enforcement-endorsed chips will find their way into most, if not all, U.S. Cards. Even in the unlikely event that one government agency should weather the pressure and pass on the Clipper chip, it's still possible to trace the source, destination, duration and time of transactions conducted between Clippered and non-Clippered devices. "Most of this shift [in privacy policy] is apparently being done by executive order at the initiative of bureaucracy, and without any Congressional oversight or Congressional concurrence, " Murray said. "They are not likely to fail. You know, Orwell said that bureaucrats, simply doing what bureaucrats do, without motivation or intent, will use technology to enslave the people." EDITOR'S NOTE: Digital Media has filed a Freedom of Information Act request for Clinton and Bush Administration, Postal Service, NSA, Department of Defense, NASA, I.R.S. and other documents related to the creation of the U.S. Card proposal. -- Mitch Ratcliffe Copyright 1994 by Mitch Ratcliffe and Seybold Publications. Digital Media: A Seybold Report 444 De Haro St., Ste. 128 San Francisco, Calif. 94107 415.575.3775 dmedia(a)netcom.com Mitch Ratcliffe Editor in Chief 415.575.3775 office 206.581.1892 home godsdog(a)netcom.com

1 0

remailer abuse
by Eli Brandt 17 Dec '03

17 Dec '03

The jarthur remailer is presently down because of a twit who blitzed much of Caltech and JPL with a car-repair ad. A Caltech postmaster has advised me that he has moved on to using rebma. Remailer admins who don't need this kind of hassle may wish to block messages with "BARKEV'S AUTO CENTER" in the body. Eli ebrandt(a)hmc.edu finger for PGP key.

1 0

Archives, FAQ, and Why Things are the Way they Are
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

(This message has two parts. First, a discussion of archives, the FAQ, etc. Second, why encryption and remailers have been such successes and why things like digicash and other more exotic protocols have not.) I received half a dozen requests for ftp posting of articles, for archive sites, etc. This was in response to my comment about "golden oldies." We are in a tower of Babel these days. Dozens of computer platforms, from mainframes to workstations to Macs to Windows to Amigas. Dozens of mail programs (hence the fragmented support for something so basic as PGP), dozens of newsreaders, dozens of etc. The point: There is no easy solution to the problem of how newcomers can come up to speed on this list. Some miscellaneous points: * Yes, a FAQ would help. I am working on one. A long one, as is my wont. I hope to have a version out soon for comments and further submissions. I expect to either put it up for ftp at my site, or at the soda/csuu(?) site, or to just mail it to folks who request to be early commenters (I don't want the early versions ricocheting through cyberspace). * However, many people are demonstrably unwilling or unable to read the sci.crypt FAQ (else why some of the questions we get?) or to acquire Schneier. ("What's Schneier?" is one of the FUQs--Frequently Unanswered Questions.) * My best articles (in my opinion) and the best articles of others are scattered in 200 folders/directories, arranged thematically. I use Eudora's sorting capabilities to sort the mail into topics I think are related (such as Crypto/Technical/One Time Pads). Then I index the articles with "On Location," which allows me to pull up each article that has key words, such as "uranium" anywhere in the message. My own personal research tool. I mention this because I have no plans to collect these articles (either mine or those of others) and put them up for ftp access. Just too much work for too little gain. * Newcomers should be patient. Read the list for a while. I notice that one newcomer has announced that he is leaving the list after 3 days (!!) because his question on analog encryption went unanswered. Oh well. * The "Cypherpunks Archives" comes up from time to time. While we all have our own personal archives (I have 40 MB of Eudora files devoted more or less to Cypherpunks), many believe a browsable archive of _all_ posts would be nice. - this has some downsides: inspection by prosecutors and the like for seditious, infringement-inducing posts, etc. (Yes, they could subscribe and see much the same things, but making a browsable site accessible to one and all seems risky, given the political climate.) Also, the 50 or 100 MB (rough estimate) of Cypherpunk mail would be unreadable except in dribbles and dabs. (The Bible is only 10 MB!) - and recall that Cypherpunks has no budget, no organized structure, and no means of accomplishing such goals as making archives available except insofar as the volunteer efforts of folks like Hugh Daniel and Eric Hughes go. And the toad.com machine is John Gilmore's personal machine, for which we should be thankful we have any access to at all. - a real archive, maintained by real people, would require time commitments and budgetary commitments I don't see materializing anytime soon. * Meanwhile, we face the "tower of Babel." Only text messages, like this one, cut across all systems, all mailers, all readers, and can be encrypted (into _other_ text blocks, which is why some interoperability exists at all). Many things that are "possible" in the malleable and Protean world of computers simply never gets done. For while many things are "possible," time and energy limits mean these things don't get done. To the Unix jocks who send me their idea of helpful messages, suggesting that I use MIME-compliant agents and HTML URLs for the FAQ (or somesuch...), or that a few pages of perl would fix these problems....thanks, but no thanks! (I get a fair number of messages suggesting that my complaints about foo would vanish if I gave up the Macintosh and adopted the One True Way, be it BSD, or XWindow, or perl, or whatever.) (I do have access to "lynx," a stunning character-based form of Mosaic, and I've been cruising around webspace with this. But I intend to distribute the FAQ as a simple text doc, not as a WWW/Mosaic/HTML/URL/lynx thingamajig. I know this will be disappointing to some fraction of you, but we can't all be pioneers with arrows in our backs. I actually have some expectation that WWW and Mosaic are the Next Big Thing, and that groups like our list will eventually migrate to webspace, with Cypherpunks being a virtual meeting place in webspace. But not in the next year or two.) AND NOW FOR SOMETHING COMPLETELY DIFFERENT,... One final word: My point about only the text block being the lingua franca of e-mail and the Internet (with a few images and sound files gaining strength) is an important clue to what works and what doesn't work in the world of crypto: * simple encryption works because everybody conceptually understands the concept of the encrypted message, which remains a text block. * remailers have worked for the same reason: everybody understands the idea of readdressing a letter, and the underlying data structure for the system remains a text block. * other protocols, like digicash, reputation servers, anonymous markets, and so on, have languished because of the tower of Babel effect--too many layers of protocol communication, negotiation, and cross-platform incompatibilities. And the "semantics" of these protocols are far from clear. (Try playing the roles of Banker, Customer, and Shop in a 3-entity digital cash protocol, with messages, signatures, blinded signatures, and "money objects" flowing back and forth. It gets confusing, even to those who've pored over the Chaum papers. Now try to _automate_ the protocol to run with little human intervention on a mix of platforms, e-mail systems, etc. This is the "protocol problem" that I happen to think needs a _lot_ more work. A big C or perl problem will not necessarily be the solution.) So, our early successes (use of encryption and remailers) is not too surprising, and that's why these successes came early on. What's next is a much harder problem. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Re: low-quality posts
by Cyber City 17 Dec '03

17 Dec '03

Derek Upham <upham(a)cs.ubc.ca> wrote: > There are two ways to filter for content: filter at the newsgroup > source via moderators, or filter at the newsgroup destinations via > killfiles. Moderating does seem to get rid of most of the cruft, but > the moderators are required to read every post that comes through, > and, worse, make judgements with some degree of impartiality (which is > not always possible). There's a simpler solution. Using the majordomo hack I posted earlier, mail from known abusers would be bounced to the moderator for his approval or rejection. This would be a small volume, which should be within the capabilities of one moderator. It's important to note that even abusive posters have their moments of lucidity. For example, one or two of Detwelier's posts were actually worth reading. So a wholesale and automatic filtering would be wrong. As for the marginal stuff, it should be passed for redistribution, and the end-users should be educated on means to do their own filtering. For example, here's a simple scheme to employ the filter distributed with ELM: .forward file: "|/path/to/filter -vo $HOME/.elm/filter-errors" .elm/filter-rules file: if (from = "lassie") then save "~/mail/nal" if (to contains "cypherpunks") then save "~/mail/Cypher" -- Alex Brock

1 0

The Wisdom of Stuart A. Baker
by perry＠imsi.com 17 Dec '03

17 Dec '03

Says Stewart A. Baker, Chief Counsel for the NSA, writes in Wired: MYTH NUMBER TWO: Unreadable encryption is the key to our future liberty. Of course there are people who aren't prepared to trust the escrow agents, or the courts that issue warrants, or the officials who oversee the system, or anybody else for that matter. Rather than rely on laws to protect us, they say, let's make wiretapping impossible; then we'll be safe no matter who gets elected. This sort of reasoning is the long-delayed revenge of people who couldn't go to Woodstock because they had too much trig homework. It reflects a wide -- and kind of endearing -- streak of romantic high-tech anarchism that crops up throughout the computer world. Don't you just love the finely tuned reasoning here? The absense of ad hominem attacks? This is obviously a rapier sharp logician we have here. I, for one, doubt I could ever produce any counterarguments. We must implement a police state, ladies and gentlemen, because its opponents were more interested in studying than in goofing off at a famous rock festival. I see no possible counterargument. Perry Metzger Who's bothered to read his history books instead of making fun of people who know how to read.

1 0

more from RISKS
by dat＠ebt.com 17 Dec '03

17 Dec '03

More from Risks... Amos Shapir's point below is well taken -- if indeed computer capacity is growing exponentially, which from all accounts it seems to be, then any code can be broken in linear time! ------------------------------ RISKS-LIST: RISKS-FORUM Digest Weds 11 May 1994 Volume 16 : Issue 05 ------------------------------ Date: Tue, 10 May 1994 15:37:05 -0400 From: pcw(a)access.digex.net (Peter Wayner) Subject: Re: Elevators, Car bumpers and Cryptography... I once talked to a major elevator company about doing just what the Schindler Elevator Corp. is accused of doing by the Toronto government. (RISKS-16.04). The company told me that they were in the habit of selling the elevators at a loss so they could make up the money in service contracts. Then they found themselves battling independent service companies who undercut their prices. They hoped to use cryptography to lock out any other service provider without the right key. Of course, this loss-lead approach is common in many businesses. Car companies often sell their cars at a low price and hope to make it up selling spare parts later. That is why I discovered that a spare bumper for my car cost over $500. The difference is that other companies are now making duplicate parts. The major automakers can try and discourage them, but they can't lock them out of the business. Cryptographic locks, though, are a different story. They probably can't be broken in a reasonable amount of time. (See also 16-04) I'm not sure of the case law on this, but I would suspect that it might fall under questionable or illegal trade practices. At least in the US. ------------------------------ Date: Tue, 10 May 94 19:33:36 PDT From: Fredrick B. Cohen <fc(a)Jupiter.SAIC.Com> Subject: Re: Bellcore cracks 129-digit RSA encryption code (RISKS-16.04) I think a lot of people are missing the real point about the RSA. On my pocket PC, I can create a code that requires 5,000 MIP years to break in a matter of seconds. If I am willing to use several more seconds, I can make a code that takes 10^25 MIPS years to break. Compare this to any other encryption scheme, and you will find that the workload amplification of the RSA is quite good. And Shannon told us in 1949 that any non-perfect information transform can be broken with enough cyphertext - and developed the concept of workload for evaluating cryptosystems. If we want perfect cryptosystems we know how to get them, but it requires secure distribution. On the other hand, the RSA provides any degree of complexity we wish to generate (finite) and a fantastic complexity amplification factor, and the advantages of a dual public key system that can be used for both encryption and authentication. The point is that the RSA has not been broken, rather it has shown just how much of a David is required to defeat a given Goliath. After all, in terms of that story, David would have been a MIP second and Goliath 5,000 MIP years in relative sizes for a break-even fight. I'll take that David any day. FC ------------------------------ Date: 11 May 1994 15:19:01 GMT From: amos(a)CS.HUJI.AC.IL (Amos Shapir) Subject: Re: Bellcore cracks 129-digit RSA encryption code (RISKS-16.04) > So where does the 40 quadrillion figure come from? It comes from this very table. 10^9 is a billion, not a trillion, in the US system, and 40 quadrillion is 4 x 10^16, which is even less than what I get by interpolating to 425 bits (can anyone who has access to the original RSA article verify this?). There seems to be an interesting risk here: most encryption methods rely on "hard" problems, i.e. problems whose "brute force" solutions require computation resources which are an exponential function of the key length. But in a world in which computing power grows exponentially, such problems can be solved in polynomial (or even linear) time! Amos Shapir, The Hebrew Univ. of Jerusalem, Dept. of Comp. Science. Givat-Ram, Jerusalem 91904, Israel +972 2 585706,586950 amos(a)cs.huji.ac.il ------------------------------

1 0