December 2003 - cypherpunks-legacy

Let us attack Clipper
by Ben.Goren＠asu.edu 17 Dec '03

17 Dec '03

No, not with words, as we're all so fond of doing. Instead, I suggest that the NSA or others provide free access to an EES system on the 'net, for any and all to attempt attacks. They could hook up a workstation or two with a couple Tessera cards, and provide anonymous login access. All functions should be permitted as they will be in a final implementation. This is an inexpensive way that EES advocates can permit access to the system for analysis. It would be only for research purposes--there'd be no way to encrypt a phone conversation, and anybody would have to be stupid to encrypt sensitive data with an NSA-owned machine, even assuming you could get the data to the computer securely in the first place. To the NSA agent who is surely subscribed: if Clipper is so great, prove it. If you won't disclose the Skipjack algorithm (but why not if it's secure?), at least provide access to test its implementation. b& -- Ben.Goren(a)asu.edu, Arizona State University School of Music net.proselytizing (write for info): Protect your privacy; oppose Clipper. Voice concern over proposed Internet pricing schemes. Stamp out spamming. Finger ben(a)tux.music.asu.edu for PGP 2.3a public key.

2 1

Another Cellular Victim
by Duncan Frissell 17 Dec '03

17 Dec '03

I'm watching (presumably) OJ being persued live on CNN. They report that he was tracked via his cellphone use. What this country needs is a good anonymous cellphone net. DCF "When entrenching tools are outlawed, only outlaws will have entrenching tools." --- WinQwk 2.0b#1165

2 1

(None)
by Jeff Gostin 17 Dec '03

17 Dec '03

"Perry E. Metzger" <perry(a)imsi.com> writes: > algorithm that factors numbers or even just breaks RSA in O(log(n)) > time or less (where n is the length of the number being factored or > the public key). I'd offer more, but it would be cruel. If you don't > know what the notation O(f(n)) means, please don't come back asking. Well, I don't know what it means. If you'd care to tell me, even in mail, I'd like to know. I've been following this thread with interest, but I don't pretend to follow this X(f(y)) notation all the time. I understand that it means we are applying function X to the result of f(y)... Anyone who's passed Trig or Elem. Functions does. I don't understand what function O(x) represents. --Jeff -- ====== ====== +----------------jgostin(a)eternal.pha.pa.us----------------+ == == | The new, improved, environmentally safe, bigger, better,| == == -= | faster, hypo-allergenic, AND politically correct .sig. | ==== ====== | Now with a new fresh lemon scent! | PGP Key Available +---------------------------------------------------------+

3 2

Re: Prime magnitude and keys...a ?
by Jim choate 17 Dec '03

17 Dec '03

> > If you can get the sign of the difference between RSA(your number) and > RSA(unknown key), then you can discover (unknown key) in log n time. > That implies, due to the nature of RSA, that you can factor in log n > time using whatever algorithm it is that makes the determination of > the sign of the difference. No, again it will allow you to find the secret key, it will not provide any information about the factors of that number. It might be used for that but as you have pointed out, it takes a long time. If I can take a cypher-text and look at the periodicity of the mod function when several false keys are provided I can narrow down the guess through a binary search. I am going up, not down (ie finding the factors which must be smaller than n). I am looking for n, not its *@$^%# factors. You are asking the wrong question. I am asking, since I can't factor the keys is there some periodicity in the mod function that I can attack.

2 1

(None)
by Jeff Gostin 17 Dec '03

17 Dec '03

Dave Otto <dave(a)marvin.jta.edd.ca.gov> writes: > ! While they are aware that software for secure encryption is > ! available from non-US, they are making a best effort to prevent > ! a standard from emerging, while hoping that some escrowed > ! encryption scheme will gain acceptance. This is a critically dangerous statement of intent. What we are seeing here the the US government running scared when they consider the fact that they won't be able to pry into our lives without asking permission (IE: for our keys) first. Now it all makes sense. If ever they've sealed their own fate, now is the most damnable time. If only they realized how zealously we will guard our encryption rights before saying something so incriminating, perhaps they would have come up with a better excuse. I don't get active in many things, but, alas, my time of complacency is over. If the pen is mightier than the sword, perhaps a Bic will level Congress. --Jeff -- ====== ====== +----------------jgostin(a)eternal.pha.pa.us----------------+ == == | The new, improved, environmentally safe, bigger, better,| == == -= | faster, hypo-allergenic, AND politically correct .sig. | ==== ====== | Now with a new fresh lemon scent! | PGP Key Available +---------------------------------------------------------+

2 1

Re: Another Cellular Victim
by Jef Poskanzer 17 Dec '03

17 Dec '03

>They report that he was tracked via his cellphone use. What this country >needs is a good anonymous cellphone net. Really. And what's more: when the Colombian drug lord was located via his cellular use, the story was that the NSA had to bring special equipment into the country to do the tracking. That doesn't wash here. It looks like at least some switches in Amerika are already equipped to read out locations for individual phones. They probably don't even have to wait for you to make a call - they can call you, or even use the phone's automatic pings. --- Jef

4 3

Re: Crypto export legislation defeated in House Intelligence Cmte.
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

: I recommend that we give up the battle and go fight the real war. We are : totally outgunned if we stick to this approach and are wasting our time. : What the entire net community should do is focus it's energies on chopping : NSA's budget, period. That's what these guys really care about after all. There was quite an interesting quotation in one of the British papers recently from Ames, the CIA spy who was caught - he said that the intelligence infrastructure in the US was a self-serving bureaucracy. I forget the exact wording, but it was the sort of thing you'd imagine the head of any big organisation like that would want to say but was never in a position to be able to - of course, now Ames can say what he likes :-) I wonder if he's available for interviews by the Cypherpunk Press ;-) G

2 1

Re: Perry vs. the Math Teacher
by Jeff Gostin 17 Dec '03

17 Dec '03

perry(a)imsi.com (Perry E. Metzger) writes: > the result applicable to factoring, I feel rather sad. Its depressing > commentary on what cypherpunks has become. Go figger. It's become a haven of learning, where the more learned teach those willing to learn, instead of the self-congratulatory elitist squad I was told it once was. That's why *I'm* here, to learn from those who know more than I do. I am VERY willing to learn what others have to teach. They know more than I do, and there's some very knowledgeable people here. I've recieved some very nice replies to my earlier question about what O(f(x)) meant, including one from you, Mike McNally, Bill O'Hanlon, and Douglas Sinclair (thanx guys!! If anyone else sent anything, I haven't recieved it yet, but you do have my thanx, in advance!). This only proves that there are people who are only too willing to teach if someone shows they are willing to listen, and learn. The moral of the story is this: Someone had to teach you at one time, didn't they Perry? One is well-advised to remember, and be humbled by, the fact that they weren't born knowing everything. Flames in e-mail, please. Constructive replies always welcome. --Jeff -- +------------------------------------+---------------------------------------+ | Jeff Gostin jgostin(a)eternal.pha.pa.us | +------------------------------------+---------------------------------------+ | "The risk... is that our vision is too small, our dreams not large enough" | | -Jim Seymour | +------------------------------------+---------------------------------------+

5 4

FYI
by dcosenza＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I spoke to Phil Zimmermann again today, and as per his request I have removed the hack of 2.6ui from ftp given that PGP is Phil's intellectual property and I respect him. In its place I have ftp'd Mathew's 2.6ui, I recommend it to all of you who want upward and downward compatibility with official versions of the software. Ever forward, David PS, I know that an 8176 bit key is absurd from a security standpoint, for that matter so might a 4096 bit key, but there are users who feel they need such a capability and for their sake I sincerely hope that a future version of PGP addresses this concern at least up to 4096 bits. :-) - -- - --------------------------------------------------------------------------- David Cosenza dcosenza(a)netcom.com PGP 2.3a Public Key available by finger _or_ ftp.netcom.com:/pub/dcosenza PGP 2.3a Key fingerprint = BF 6C AA 44 C6 CA 13 3F 4A EC 0A 90 AE F3 74 6D "When encryption is outlawed, only outlaws will have encryption." -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCzAgUBLgzbqCjdpAfJZzihAQGplwTvQhu5SdwRhzBC1PDRpv+w51Z6iJU3VPY3 qhWH3neM6nlzA3sICdkQDW2EuifoaQ5un1zLGG1UMvITSDFpmDvEraenHyY0wa1e Tz3Wlm2mAmHdA82nSv6IEN52cQahPo11XjK6a0kuRuGLK3rF87ldoToQ91fhJ+dI Ycsijo627a36OzgIiNSPeGiWVID59kqp/F0suhgq4esQNHHRyN0= =FFy4 -----END PGP SIGNATURE-----

1 0

One man's view on Clipper...
by Michael Wilson 17 Dec '03

17 Dec '03

Cypherpunks... just thought I would contribute my two cents on the recent developments, by showing you a response I wrote to a friend on the issue recently. I've been building anti-Clipper sentiment in some 'old school' businessmen friends of mine, since my belief is in free markets and money trails... === >Many thanks for the messages -- Clipper is still bothering a bunch of >people including me, and I hope the cyberworld will do something organized >about it. If I were more competant in computers than I am I would be >willing to lead the charge. The politics of Clipper are insidious. If it actually gets passed off as the standard, it will show up in pretty much any standard product that will hook into the grid. Most people, since there is already encryption built into the products they use, won't advocate the use of anything else, and more importantly, won't PAY for anything additional. I can tell you from experience, people won't buy security products, there is no security market; security is something that people expect to get built in to a system. The only reason that there is any market to speak of at all is a symptom of just how bad the current security situation is--essentially, most systems, including critical ones, are wide open, and you can certainly say that secure communications make up less than 1% of the total amount of traffic on the grid. So what happens when Clipper gets in? People once again abdicate responsibility for handling their own security and secure communications. Why pay more (money, time, effort) when it is already taken care of? The market for competing products dries up; interest dies. If there is no money, how can you expect to pursue a product or create a market? There is no perceived need to address. And so Big Brother wins; they once again become the only experts in the field, since they are the only ones with the money to continue playing the game. Direct outlawing of the technology would only make martyrs of the people trying to present it. Instead, the government is striking in a much more intelligent and, from my viewpoint, dangerous strategy. Their [govt] encryption scheme is good enough... Yes, there are holes, but only to 'hackers'... People who want to have secrets must have something to hide... Only criminals will need to protect themselves, and have additional security and cryptography.... The folks at NSA have struck a blow from a very advanced PsyOps perspective, rather than a cryptographic one. They destroy the marketplace, and also attack any popular support that could be put to good use by the opposition [cypherpunks]. Does this outlaw other cryptographic methods? Not at all; there is the fiction of choice still available (the old game of "let them hold free elections as long as we get to choose the candidates"). Cypherpunks and others who are concerned will be the 'lunatic fringe.' And their more secure traffic will stand out like a sore thumb; somebody somewhere will be making lists. So at this stage, I am increasingly convinced that the solution, actually the groundrules of the game, are not technical at all, but belong solidly in the realm of political warfare. It just so happens that I know more than a little about that game. === The rest of the communication is confidential, but I thought you folks would appreciate some additional thoughts. Michael Wilson Managing Director, The Nemesis Group An old hand at political warfare...

1 0