December 2003 - cypherpunks-legacy

Re: Physical storage of key is the weakest link
by Matt Thomlinson 17 Dec '03

17 Dec '03

duh. sorry, guys. wow, that doesn't happen very often. a personal msg from me to the list. won't happen again. mt (phantom(a)u.washington.edu)

2 1

Mac PGP 2.6 sig file
by lcottrell＠popmail.ucsd.edu 17 Dec '03

17 Dec '03

I have just unstuffed the Mac PGP archive I grabbed from MIT. Inside is a detached signature file. What file is a signature for? Is it for the binhex file, for the first archive, for the archive in the archive? Has anyone made this work? -------------------------------------------------- Lance Cottrell who does not speak for CASS/UCSD loki(a)nately.ucsd.edu PGP 2.3 key available by finger or server. "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche

1 0

Credit-card PCs exist
by fnerd＠smds.com 17 Dec '03

17 Dec '03

I'm looking at an ad for "CARDIO 386," a PC in a thick card a little bigger than a credit card. It has a 236-pin connector with a full AT bus, VGA interface for video or LCD, IDE interface for hard disk, 1 parallel, 2 serial, keyboard, mouse and floppy interfaces. Up to 256K Rom and 4M DRAM. I don't see built-in SRAM or battery, but they have SRAM and flash cards as well as a PCMCIA interface. The point is that it's what developers and their tools are used to. You could run regular PGP on it, for instance. (That reminds me: does anyone know whether automatic teller machines are PCs inside?) S-MOS Systems of San Jose, CA. "A Seiko Epson Affiliate." and of which i am not an affiliate, -fnerd - - - - - - - - - - - - - - - spam is in the eye of the beholder (splat) -----BEGIN PGP SIGNATURE----- Version: 2.3a aKxB8nktcBAeQHabQP/d7yhWgpGZBIoIqII8cY9nG55HYHgvt3niQCVAgUBLMs3K ui6XaCZmKH68fOWYYySKAzPkXyfYKnOlzsIjp2tPEot1Q5A3/n54PBKrUDN9tHVz 3Ch466q9EKUuDulTU6OLsilzmRvQJn0EJhzd4pht6hSnC1R3seYNhUYhoJViCcCG sRjLQs4iVVM= =9wqs -----END PGP SIGNATURE-----

3 3

Re: Password Difficulties
by smb＠research.att.com 17 Dec '03

17 Dec '03

Figure that each English character has 1.8 bits of entropy. (This is a conservative number, because it doesn't take into account case, spacing, or punctuation.) If I want a passphrase that will map into a 64-bit keyspace, I need at least a 35-chararcter phrase. Don't forget the difficulty of typing such a long phrase, with echoing turned off.

6 5

Blame me! I started the "What motivates crypto-folk" thread
by Sherry Mayo 17 Dec '03

17 Dec '03

I only joined the cypherpunks list a few days ago so 'imagine my surprise' to see that a post I sent to talk.politics.crypto had been forwarded here and was the topic of some considerable debate! I've also had stacks of replies by email, so I thought I should stick my head above the parapet and post here with a few observations. It is self evident from the emails I have received that crypto-use and cypherpunks encompass people of every political stripe. Someone used the phrase 'strange bedfellows' to describe the variety of people on cypherpunks and I couldn't agree more. The majority of people shared a simple desire for privacy, from government snooping in particular. I guess the articles I had read on WWW that lead to my original post were not very representative of crypto-users as a whole. I wasn't really intending to start a political left vs right debate with my post. As many people have pointed out to me, crypto is a neutral tool that can be used by all sorts of people for all sorts of ends. I don't expect to agree politically with all those people any more that I expect to agree with all car drivers (for example). I was just curious that there was an *apparent* trend in the politics of the crypto articles I read - How wrong I was :-) To all those who have replied to me by email, thanks for your views. Sherry Mayo PS. Someone wrote: > > Thanks for your thoughtful comments. However the message was > > not by me but by Sherry May <scmay(a)rschp2.anu.edu.au>. > > Sherry May, Tim's EVIL TWIN? (Or is it the other way 'round?) Ha ha ha this had me ROTFL!!! PPS. Its Mayo - I'm no relation!

1 0

Re: Credit-card PCs exist
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> (That reminds me: does anyone know whether automatic teller > machines are PCs inside?) I should know our cash machine line by now, but anyway... I think ours are basically PCs with OS/2 operating systems; having real multitasking is useful in a communication device, and it's a reasonably flexible environment for adding drivers for miscellaneous peripherals, like cash dispensers. A few years ago I saw a cash machine that was not working, and had a very dos-llike boot error message on the screen. Grocery store aisle signs are often driven by Amigas, and occcasionally have confused-Amiga messages on them. ObCrypto: according to someone on the net, some appallingly large fraction of teller machines don't use encryption on their comm links. (Grocery store signs do just fine without crypto :-), though some of the new radio-transmission shelf price labels might be interesting hacking for somebody with lots of time on their hands.)

1 0

Re: Password Difficulties
by kentborg＠world.std.com 17 Dec '03

17 Dec '03

joshua(a)cae.retix.com writes: >> Hey folks, passwords are hard to choose! > >? What part don't you understand? Give people the opportunity to chose "random" passwords and they choose easily guessed strings. (Well demonstrated.) Tell people to chose a *phrase* and they are going to frequently type "The quick brown fox...". (My assertion.) Your suggestion about rare steak is so long that "normal" people are not going to bother with it. Just getting people to type the 19-characters of "the quick brown fox"--just four words--is going to be hard, and there are not very many bits of information in 4 short common English words--forget that they are a chiche. Besides, your sample phrase might not have as many bits in it as you think. >Rare steak tastes good when it is cooked over a wood fire. better >chicken. better than fish. good with worcestershire sauce. 22 words, a good start. But all will appear in a short dictionary list, 4 gramatical sentences, sentences with related meaning. Not so good. Slightly non-standard capitalization--but only a few bits in that. You suggest a phrase that is going to seem annoying to people raised on 4-digit PINs, yet it still might not have, say, the 128-bits lots of people want. My 128 coin tosses can be roughly turned into 8-words, but out of a much larger word list than your phrase and with no gramatical connections--and hard to remember. Each transformation I might do to those words to help remember them chops off a few of my original bits. By the time I have something my mother is going to bother with there are few bits left. A little brute force and those bits are blown. And why should you care if my mom uses weak keys? Because it will undermine the legal weight of things like digital signatures. Because all communication you have with "normal" people will be nearly in the clear because of their poor security. If you want privacy, you need to help others have privacy. Back to a rephrasing of my original question: should programs like PGP super-duper encrypt the private key (and remove those hints poeple have mentioned recently) as a way of slowing down brute-force attacks? -kb P.S. Remember, even a good hashing algorithm should not be expected to create entropy out of thin air. Too few bits in means too few bits out. Just because I don't know how to analyze those bits does not mean you should be content. -- Kent Borg +1 (617) 776-6899 kentborg(a)world.std.com kentborg(a)aol.com Proud to claim 31:15 hours of TV viewing so far in 1994!

5 4

Cypherpunks of the world unite!
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Michael Wilson <0005514706(a)mcimail.com>: > There is a good reason why revolutionaries in very poor nations tend to > espouse socialist or communist rhetoric--those are political systems that can > raise the quality of life considerably and immediately, I see governments as representing the collective will of society, responsible for only those things that are best achieved through everyone's cooperation. It is now fashionable to talk about the Asian way -- subjugating freedom to prosperity. This is of course bunkum, freedom is an ideal and is universal. The way to get to that may differ from society to society, particularly, as Michael says, in poor nations. It isn't necessary to have a strong state to survive; India, with a similar standard of living in 1950, has been democratic with more or less regular, free and fair elections. Contrary to popular perception, India has been no more 'socialist' than many European countries such as France, with stockmarkets and large state-owned enterprises. It is naturally more difficult to control crime or rising population here than in China, where petty thieves and corrupt officials are frequently executed. Freedom is a right equally applicable everywhere, whatever the political, social or economic situation. Any technology that promotes it is important for the whole world. Cypherpunks of the world unite! You have nothing to lose but your escrowed keychains! ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

2 1

The usefulness of PGP pass phrases
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

tcmay(a)netcom.com (Timothy C. May): > > after you have entered the pass phrase, the secret key is available within > > your machine, and could be stolen, and if your OS leaves pagefiles etc > > arounnd, might even be taken after you shut down PGP. > > Or am I missing something? Thanks, Andy > > I haven't seen a formal analysis of the strength of PGP if the secret > key is known but the passphrase is still secure, but from conventional > crypto we would assume that the search space would be greatly reduced. The secret key is _encrypted_ with the passphrase. Strength of PGP with a known secret keyFILE, not key, and unknown passphrase, is the strength of the cipher used to encrypt the secret key with. In this case, the strength of IDEA. Of course, your pass phrase is as susceptible to dictionary attack as your UNIX password, and it would be easier to decrypt a message by decrypting through such attacks or brute force your keyfile, than to factor large numbers to get at your session key. > You obviously can't do with just the paIn short, these are reasons to keep your secret key secret. Your > passphrase alone may be insufficient (else why not just dispense with > the secret key and just have a passphrase?). RSA would have a tough time using a 11 char English phrase as an exponent ;-) To quote from the PGP manual: PGP also asks for a "pass phrase" to protect your secret key in case it falls into the wrong hands. Nobody can use your secret key file without this pass phrase. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ps. as Tim correctly said, Jains don't like killing living things. They are Jains, not Jainists (followers of some hypothetical Mr. Jain?); the word comes from the Sanskrit for 'to overcome'. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

IS IT POSSIBLE?
by bmorris＠netcom.com 17 Dec '03

17 Dec '03

To: cypherpunks(a)toad.com I've heard rumors through the years that CIA/NSA/whoever can aim a parabolic antenna at your window, read the electronic pulses surrounding your computer, and thusly determine what you are typing. Is there any truth to this? * RM 1.4 B0037 *

3 2