December 2003 - cypherpunks-legacy

Re: Kragen == LD?
by adwestro＠ouray.Denver.Colorado.EDU 17 Dec '03

17 Dec '03

> octopus? Something with tentacles? And isn't Kragen's user name, > xentrac, close to an anagram for tentacle? And isn't unm the University > of New Mexico, adjacent to Detweiler's home state of Colorado? The Alliance for Bandwidth Conservation (ABC), asked me to point out: LD> I don't have a voice without them. My Nyx account would be LD> censored immediately from your screeching complaints if I didn't LD> post through them! LD's account is anon????(a)nyx.cs.du.edu (? = hex digit). This is the first I knew of this, but it doesn't surprise me -- Nyx is a public access site at the University of Denver. And please don't all mailbomb his overworked sysadmin (who volunteers his time to run Nyx), right away. LD's been fairly mild lately, compared to last Nov-Dec. I think it suffices for him to know that this will occur if he becomes abusive -- damn surprised he mentioned Nyx, in fact! His sysadmin *can* correlate anon accounts with True Names, if necessary. btw, anyone can telnet there and read the list gated as newsgroup mail.cypherpunks. You'll have to jump through some hoops to be able to post from there, though. Sigh...awaiting the (awestrop = Detweiler?) thread, Alan Westrope <awestrop(a)nyx.cs.du.edu> __________/|-, <adwestro(a)ouray.denver.colorado.edu> (_) \|-' finger for pgp 2.6 public key PGP fingerprint: D6 89 74 03 77 C8 2D 43 7C CA 6D 57 29 25 69 23

1 0

Non-determinism forever. (was -- Re: GUT and P=NP)
by collins＠newton.apple.com 17 Dec '03

17 Dec '03

At 9:58 PM 18.7.94 -0700, Eric Hughes wrote: >Non-determinism is only another way of rephrasing the existential >quantification. I agree. Entropy, like velocity, is relative. `Non-deterministic' is the label we apply to the unknown or possibly unknowable. Non-deterministic algorithms (or thought experiments) work by `knowing more than we do'. They guess the un-guessable: the correct answers to problems we can't solve readily any other way. From their point of view, for some reason, it's not un-guessable. This very attribute makes them un-guessable to us. We simulate `guessing' correctly by exhaustive search (check out, e.g., NFA's and pattern matching). "Is P==NP?" is roughly equivalent to "For every problem that you could `guess' the answer if only you knew how---and can prove the answer correct without guessing---is there a shortcut (that meets some strong criterea)?" If P==NP is ever proven it _will_ have an impact on a large class of problems (and the effect will depend on the nature of the proof), but not all problems. Some problems are harder than NP, e.g. decrypting a message encrypted with a truly random OTP. Even if you guess the correct decryption, you can't prove it's right without guessing. Currently, lacking `THE shortcut', P != NP (in the practical sense; _not_ the theoretical). Even if it becomes the case that, demonstrably, P == NP in both the practical and theoritical sense, the world will still be an interesting place (in both the practical and theoretical sense). Scott Collins | "Invention, my dear friends, is 93% perspiration, | 6% electricity, 4% evaporation, and 2% butter- collins(a)acm.org | scotch ripple." -- Willy Wonka ..................|.................................................. Apple Computer, Inc. 5 Infinite Loop, MS 305-2D Cupertino, CA 95014 408.862.0540 fax:974.6094 R254(IL5-2N) collins(a)newton.apple.com ..................................................................... 408.257.1746 1024:669687 catalyst(a)netcom.com

1 0

Re: Why triple encryption instead of split+encrypt?
by John Douceur 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >From: <solman(a)MIT.EDU> >Date: Tuesday, July 19, 1994 2:31PM >You are then quite correct that meet-in-the-middle attacks can be >done, but the key to the first encryption (the hashing multiplex) is 112 >bits (for the split into two parts version) which would require 2^112 >stored messages, substantially more than could possibly be stored by >anybody ever (well, I guess ever is a bad word to use in this context). There are two separate operations here. One is splitting the plaintext: P0, P1 = S_KS(P) The other is generation of the splitting key. I assume independent generation of the splitting key both because it maximizes the total keyspace and because it avoids the confusion that I believe is evidenced by the above quoted paragraph. To wit: You have suggested generating the split key with a one-way hash of the DES keys: KS = hash(concat(K0,K1)) If the concatenation of the DES keys is 112 bits, then there are 2^112 possible values of the concatenation. However, the hashing of this value is not the first of the two encryptions; the splitting of the plaintext is the first encryption, and the hash is merely a mechanism for generating the splitting key. The domain of KS is the determinant of the size of the intermediate memory in a brute-force meet-in-the-middle attack. Furthermore, even for an independently generated splitting key, if the size of the domain of KS is greater than the size of the domain of K0 or K1, then the DES-decrypted values can be stored as the intertext, requiring no more memory than that required for decrypting double DES. >I still believe that the security >of the scheme, even when just splitting into two parts and using the hash >of the keys to multiplex the split, is much worse (by more than a couple >of factors of two) than DES. I suspect that you mean better, not worse [smiley deleted by censor]. I do not contest this claim, but I consider a more pertinent metric to be the security of this scheme relative to that of double DES. One decomposite of the split+encrypt algorithm can be viewed as: C = E_K0(S0_KS(P)) And an analogous double DES encryption is: C = E_K0(E_K1(first_half(P))) For the sake of argument, I'll assume that the domains of KS and K1 are equal in size. Thus, a brute-force meet-in-the-middle attack will require the same number of encryptions and the same amount of memory in both cases, although the amount of computational power required will be somewhat less in the case of split+encrypt because the splitting is less computationally intensive than DES. However, the splitting algorithm is relatively simple, far more so than DES. It is unlikely that a brute-force approach is necessary to cryptanalyze the splitter. For example, consider the following splitting algorithm: p0[i] = (p[i+1] & ~key) | (p[i] & key); p1[i] = (p[i+1] & key) | (p[i] & ~key); This is particularly simple, and I chose it to be so for simplicity of discussion. Imagine that our cryptanalytic algorithm begins as follows: Decrypt first block of ciphertext with each possible DES key; check to see if the resulting intertext could possibly have come from first block of known plaintext; if so, store the key; continue. Without looping through all possible split keys, we can determine whether the intertext could have come from the plaintext: precompute: bits_in_common = ~(p[0] ^ p[1]); // ^ = XOR must_be_1 = bits_in_common & p[0]; must_be_0 = bits_in_common & ~p[0]; inside loop: if (test_block & must_be_0 | ~test_block & must_be_1) test_block could not be from plaintext This greatly shortens the amount of memory required for the search, making the algorithm much less secure than double DES. You may respond by suggesting improvements to the splitting algorithm, such as multiple-bit dependency; but there are doubtless other weaknesses that could be exploited. I did not spend a lot of time on the above technique; persons more qualified than I am, devoting serious time to the problem, will certainly develop better cryptanylitic attacks. I think you will be very hard pressed to develop an algorithm anywhere near as secure as DES. JD -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLixRSUGHwsdH+oN9AQE4QgP8CMTmnk0It9Y4qWK08j9jLWCEYn2gLrEr +b17avqtVE/ArvLh3g6wHLQ4bMU0UOuLyNI0abk19FM7agqYT3WLo+U36DvU4qDJ 9lsyyUfqHgYrXOMGAPG/Kzg4ixqo+9IiCvnFxMbsniPnlCT5l5UuEOBLlAPqyrNQ ggvcxZ4a4rU= =gPdN -----END PGP SIGNATURE-----

2 1

Re: the Cypherpunk and the Shadow
by sidney＠taurus.apple.com 17 Dec '03

17 Dec '03

I said: >If someone tried to generate a million different identities >and public keys, that could be dealt with by imposing a time delay for >registration Whoops. Of course that wouldn't work. If a delay was imposed after any registration before processing any next one, then there's an obvious denial of service attack by simply sending in lots of registrations. And if there isn't, someone can simply register a zillion different e-mail addresses and public keys and send each copy of a mail bomb from a different one. Someone who wants to build up a reputation can already do it anonymously (like Pr0duct Cypher), while someone who wants to make trouble doesn't need to build up a reputation. Oh well. -- sidney <sidney(a)apple.com>

1 0

Come On
by John Young 17 Dec '03

17 Dec '03

Responding to msg by SADLER_C(a)HOSP.STANFORD.EDU ("Connie Sadler (415)725-7703") on 19 Jul 1994 <I find lines like the above very offensive/non-professional. I >won't let it stop me from continuing on, but what's the >point? I really don't get it. > >CS - Glad you posted. I don't get it either. John

2 1

RE: Reputation
by Pat Farrell 17 Dec '03

17 Dec '03

In message Tue, 19 Jul 94 14:31 EDT, nelson(a)crynwr.com (Russell Nelson) writes: > This leads me to wonder how encryption helps make portable > reputations? Can it even? Chaum did some work on credentials without identity. Pretty interesting stuff. But I haven't seen any of the c'punks pursuing it. Anybody interested in doing some real work on this? Pat Pat Farrell Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

1 0

Re:
by lefty＠apple.com 17 Dec '03

17 Dec '03

>On Tue, 19 Jul 1994 nobody(a)shell.portal.com wrote: >> Isn't a "Kragen" a fictional sea beast, something like a giant squid or >What does this have to do with crypto? Yawn. What did _that_ have to do with crypto. Here, I'll save you some time: what does _this_ have to do with crypto? Not much, I guess, but I always _did_ wonder where Superman's dog got that stupid cape. Do you suppose the _dog_ had a "secret identity", too? -- Lefty (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

1 0

\"But this is not really related to crypto, so....\"
by John Young 17 Dec '03

17 Dec '03

Responding to msg by tcmay(a)netcom.com (Timothy C. May) on Tue, 19 Jul 12:7 PM >the house of Cypherpunks has many rooms. Best thing about it, exceeded only by the fact that construction continues without architect.

1 0

The Infamous 'Sue D. Nym' Spam
by Random H0Z3R 17 Dec '03

17 Dec '03

nym(a)netcom.com (Sue D. Nym) wrote: > I think you must have something against women. In fact, I think > the whole list is pretty unbalanced. I haven't seen any other > women except Sandy post. If you are trying to create an > atmostphere of fear and intimidation, let me say that you have > succeeded! Gawd! What should the quota for FemiNazis be? Scared away the women just to make room for female impersonators like you? Did you enjoy wearing mommy's clothes when you were "growing up"? Or DID you ever grow up? > This is a nasty message, but you are being nasty to me for no reason. Oh really? As if we couldn't have figured that out for ourselves? > If you believe in reincarnation (as I do) you will understand > that the earthly realm is a place where souls are being recycled. Here we go ... another religious spammer on the net. Why don't you go hang out with Ralph (the Mouth) Stokes and Clarence (the World is Coming to an End RSN) Thomas IV, and blather each other to death. Take your Shirley MacLaine bullshit elsewhere. > There are a lot of neat parallels between reincarnation and email > addresses. Are you what Detweiler died and became reincarnated as? If so, Karma dealt him poetic justice, I'd say. > I hope you can get over your obvious intolerance, Perry. Probably as soon as you get back on your broom and fly away.

2 1

I take it the list is down?
by Michael V. Caprio Jr. 17 Dec '03

17 Dec '03

If so, please resubscribe me. I find it unusual to not have the typical 20 or so messages waiting for me since my last login... If not, apologies for the letter. Mike

2 1