December 2003 - cypherpunks-legacy

Black eyes heal
by baum＠newton.apple.com 17 Dec '03

17 Dec '03

Its important to realize what was really gained by this revelation- - some PR value - several months before fixed Clipper/Tessara chips become available I have no doubts that the problem that was revealed will be corrected. I'm not sure it was a good idea to reveal the weakness. Imagine how much worse it would be (in terms of PR) if lots of phones had been deployed before the flaw was found? On the other hand, it's possible the weakness was known and would have been (is being) corrected quietly. So, there is a small window in which to take advantage of the PR, and the delay in revised chip availablility. Unless there are some major defections in Congressional support because of this, I don't think much will change; Clipper will become a reality. A competing product could devastate it- yes, government subsidies & requirements might form the nucleus of support, but having to deal with NSA restrictions and sole sourcing of the chip makes it a real, expensive pain to turn it into a product. I don't think the revision will be completely trivial, either. The way these chips are built means a much more extensive verification process must be used- not just reburning a PROM. A standard micro and a standard encryption chip on the side (don't have the references here, but at HotChips there will be a paper on a 100kbit/sec Single Chip Modular Exponentiation Processor from Holger Orup of Aarhus Univ. Denmark) could make a viable, competing product. Note that I'm not volunteering or suggesting that one of you should go out and implement my great idea- just making predictions. ************************************************** * Allen J. Baum tel. (408)974-3385 * * Apple Computer, MS/305-3B * * 1 Infinite Loop * * Cupertino, CA 95014 baum(a)apple.com * **************************************************

3 2

Re: Alt.Gvmt.Immorality
by blancw＠pylon.com 17 Dec '03

17 Dec '03

Responding to msg by Stephen D. Williams: >There are some theories that various 'power' segments >of society actively cultivate a particular working >model for their own benefit. Foremost, of course, are >Clergy, lawyers, and gov. Well, reading books like the one from which I took that quote would alert one's attention to the fact that there are many working models of human nature possible, and that one should not merely take the one given out in school or at church or by whomever. I think that when one realizes that these models are all the product of our own human reasoning, then the idea of liberty & freedom becomes more meaningful, as one realizes that there are choices beyond the views created by one's elders or leaders. >I've always thought and recently espoused that there >should be classes from the beginning of highschool on >philosophy and sociology. I suppose the problem would >be which philosophy and whose spin on things the >schools would encourage. I think this would start a big fight in the public schools as to which philosophy or sociological works to use in the classroom. However, in classrooms per se if there were a general presentation of the concepts and discussions on the human ability to develop comprehensive views of the world, then everyone was turned loose in the library, each person could begin their study of any of them and proceed at their own pace & interest. At the very least they could become aware of the source of the images of human nature which surround us and could better evaluate what it means to live & act within any particular system of operations. >I just think that too many people don't think of >themselves on the 'meta' level. (Thinking about what >they think and do and why.) The opportunities for this kind of thinking are greatly limited to what the church and politics provide as a frame of reference (not that the libraries aren't open and available for budding curiosities). It was from browsing through picture books of other peoples & reading about how other cultures arrange their existence, that I developed the comprehension that there are different methods of doing things in the world, that there is such a thing as choice, and that not only cultures but individuals can arrange their affairs according to their own ideas of success. Blanc

1 0

HR 3627? Success or failure?
by Michael Handler 17 Dec '03

17 Dec '03

So? Did the good guys win this time, or were we just tilting at windmills again? -- Michael Brandt Handler <grendel(a)netaxs.com> Philadelphia, PA PGP v2.6 public key on request

1 0

Rep. Brooks speaks out against export controls -- DO NOT DIST
by Stanton McCandlish 17 Dec '03

17 Dec '03

Rep. Brooks submitted the following statment on encryption export controls today. You may with to send a "thanks" or "great statement" note of kudos to Rep. Brooks (Chair of the House Judiciary Cmte., and longtime detractor of Clipper. He's involved in these issues on several fronts.) NOTE: Even after today, keep faxing, calling, writing. It DOES make a difference. If the bill is butchered, express your opinion on that. It won't get changed otherwise. If it passes the Intell. Cmte. with flying colors, send notes of thanks and approval. GET INVOLVED, otherwise politics control the people instead of vice versa. ***************************************************************************** Floor Statement of Congressman Jack Brooks U.S. House of Representatives re: Encryption Export Controls June 15, 1994 ENCRYPTION POLICY ENDANGERS U.S. COMPETITIVENESS IN GLOBAL MARKETPLACE For some time now, a debate has been raging in the media and in the halls of Congress over the Administration's intention to require U.S. corporations to use and market the Clipper Chip, an encryption device developed in secret by the National Security Agency. The Clipper Chip will provide industry and others with the ability to encode telephone and computer communications. The use of the Clipper Chip as the U.S. encryption standard is a concept promoted by both the intelligence and law enforcement communities because it is designed with a back door to make it relatively easy for these agencies to listen in on these communications. The law enforcement and intelligence communities have a legitimate concern that advances in technology will make their jobs more difficult. But the issue here is whether attempts to restrict the development, use and export of encryption amounts to closing the barn door after the horse has already escaped. The notion that we can limit encryption is just plain fanciful. Encryption technology is available worldwide -- and will become more available as time goes on. First, generally available software with encryption capabilities is sold within the U.S. at thousands of retail outlets, by mail, even over the phone. These programs may be transferred abroad in minutes by anyone using a public telephone line and a computer modem. Second, it is estimated that over 200 programs from some 22 countries -- including Great Britain, France, Germany, Russia, Japan, India, and South Africa -- use some form of encryption that the government currently prohibits U.S. companies from exporting. And this is just the beginning. According to the May 16, 1994 issue of _Fortune_ , not only are U.S. companies willing to purchase foreign encryption devices, American produces of encrypted software are also moving production overseas to escape the current U.S. export controls. Third, encryption techniques and technology are well understood throughout the world. Encryption is routinely taught in computer science programs. Text books explain the underlying encryption technology. International organizations have published protocols for implementing high level encryption. Actual implementations of encryption -- programs ready to use by even computer novices -- are on the Internet. The only result of continued U.S. export controls is to threaten the continued preeminence of America's computer software and hardware companies in the world markets. These restrictive policies jeopardize the health of American companies, and the jobs and revenues they generate. I support, therefore, the immediate revision of current export controls over encryption devices to comport with the reality of worldwide encryption availability. I believe law enforcement and the intelligence community would be better served by finding real, and targeted ways to deal with international terrorists and criminals rather than promoting scattershot policies, which restrict American industries' ability to design, produce, and market technology. Now -- more than ever -- we cannot afford to harm our economic competitiveness and justify it in the name of National Security. ***************************************************************************** -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist F O R M O R E I N F O, E - M A I L T O: I N F O @ E F F . O R G O P E N P L A T F O R M O N L I N E R I G H T S V I R T U A L C U L T U R E C R Y P T O

1 1

Re: DES w/ variable S-boxes
by Matthew Ghio 17 Dec '03

17 Dec '03

Ben.Goren(a)asu.edu wrote: | However, as Bruce Schneier points out (p. 242), *variable* S-boxes make | | differential cryptanalysis impossilbe, as such an adaptive plaintext attack | | relies on knowledge of the composition of the S-boxes. If the boxes and | | their contents change with both keys used and plaintext--probably with the | | help of a strong RNG--then the only way such an attack could work would be | | by first figuring out what causes the changes in the S-boxes; in that case, | | the attack is probably already finished, by other means. Perhaps, even, the | | S-boxes could change with so many chunks of text--again, variable, of | | course. | You should take a look at Michael Paul Johnson's Diamond Encryption Algorithm. It uses variable S-boxes as you describe. Source code and documentation is availiable on ftp csn.org. /pub/mpj/...

1 0

You know you're getting old when...
by Bill Garland 17 Dec '03

17 Dec '03

When a cypherpunk posts this: >> It does my heart good to hear someone use the term 'grok' -- I don't >> hear many folks use that term very much anymore. ,-) >> >> - paul >What does it mean? Then I guess redundancy takes on a new meaning. Bill Garland, whose .sig is whose .sig is

1 0

C'punks mail database
by sglass＠netcom.com 17 Dec '03

17 Dec '03

Operating System: SunOS 4.1.3 Site: netcom X-Mailer: ELM [version 2.4 PL23] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Content-Length: 798 -----BEGIN PGP SIGNED MESSAGE----- C'punks, I've used lynx to connect to PMIP to see the c'punx list like: lynx http://pmip.maricopa.edu/crypt/cypherpunks I connect okay, but get the message that the requested URL isn't on the server if I want to see anything but the Parent Directory selection. Maybe this is an "under construction" effect? Sheldon - -- sheldon glass | Plauger's Dogma sglass(a)netcom.com | No program may leave its sanity #include <std.disclaimer> | at the mercy of its input. finger for PGP -----BEGIN PGP SIGNATURE----- Version: 2.3a iQBVAgUBLf+PA7GlKhzDiFoxAQHhyQH/bKgtyhhfWHKjXiJNpcY+9KSBnKooQsYf t3vlKY+UdaaWzducsorPp2tTTQ0Eum/OxHDnXejGC3phHNur1oN9Zw== =G/Th -----END PGP SIGNATURE-----

1 0

Encrypted databases
by Ben.Goren＠asu.edu 17 Dec '03

17 Dec '03

In _Applied Cryptography,_ Bruce Schneier describes a method of encrypting a database in such a way that it's easy to get individual entries but "impossible" to get the whole database. Basically, the first field is a hash of the individual's last name, the second is encrypted (symmentrical algorithm) w/ that name and contains the rest of the info. Are there any readily available implementations of this or anything equivalent? I've a use for such, but I'm not likely to have the time to start writing anything like that for a month or two. Thanks, b& -- Ben.Goren(a)asu.edu, Arizona State University School of Music net.proselytizing (write for info): Protect your privacy; oppose Clipper. Voice concern over proposed Internet pricing schemes. Stamp out spamming. Finger ben(a)tux.music.asu.edu for PGP 2.3a public key.

1 0

Jus Curious
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

Pardon me-- So ViaCrypt sells PGP for $98.00 big ones huh, how much of that does Philip get??

1 0

Re: Cypherpunks' mail database does exist (fwd)
by Ben.Goren＠asu.edu 17 Dec '03

17 Dec '03

Actually, this has nothing to do with the mail database or RAH. Just wanted to let you know that your .sig made me smile. b& -- Ben.Goren(a)asu.edu, Arizona State University School of Music net.proselytizing (write for info): Protect your privacy; oppose Clipper. Voice concern over proposed Internet pricing schemes. Stamp out spamming. Finger ben(a)tux.music.asu.edu for PGP 2.3a public key.

1 0