December 2003 - cypherpunks-legacy

Hey, you're back?
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

Hi, Strick, I see you're back on the list - how was Europe? Are you back out west, or just dialing in from somewhere? Bill #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- # Export PGP three lines a time --> http://dcs.ex.ac.uk/~aba/export/ M0V]N9W)E<W,@<VAA;&P@;6%K92!N;R!L87<@+BXN(&%B<FED9VEN9R!T:&4@ M9G)E961O;2!O9B!S<&5E8V@L(&]R(&]F('1H92!P<F5S<SL-"F]R('1H92!R M:6=H="!O9B!T:&4@<&5O<&QE('!E86-E86)L>2!T;R!A<W-E;6)L92P@( T*

1 0

Challenge-response passwords (Was: big word listing)
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 06:59 PM 7/25/95 +0100, Andrew Spring wrote: >Free-after-1997 example: > g is a generator of a prime p. > password is X (0<X<p); > password file has g^X mod p. > login server generates Y, issues challenge g^Y. > expected response is g^XY mod p > login client has X, generates (g^Y)^X = g^XY mod p. > J. Random SuperHacker can get g^X, and g^Y, but not g^XY. It's _not_ free after 1997! I thought of it last fall, was surprised I couldn't find it anywhere in the literature, given that it's pretty obvious, but eventually found that a guy from Siemens had patented it in Germany and then gotten a US patent in ~1994. Unfortunately, he phrased it in terms of "commutative hash functions", with g^X mod p as an example, so it's more general. He also extended it to do two-way authentication (obviously the process can be symmetrical if the user has a stored g^W from the server and can send a challenge, but he found a way to save a step or two.) I developed it because I was looking for a way to do authentication-only public key stuff so the code would be exportable - this approach doesn't generate a shared secret (since the otherwise-secret g^XT is exposed as the response to the challenge.) However, it's possible to extend it to preserve the shared secret - instead of sending response g^XY mod p, send Hash(g^XY mod p) and have the login server validate that. One advantage is that the hash can be much shorter than the whole g^XY mod p, e.g. 32-64 bits instead of 512-1024. And you can now use (g^XY mod p) as a session key (for encrypted sessions) or an authenticator (e.g. send Hash(Data,sequence#,sessionkey) as a MAC for each packet. #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- # Export PGP three lines a time --> http://dcs.ex.ac.uk/~aba/export/ M0V]N9W)E<W,@<VAA;&P@;6%K92!N;R!L87<@+BXN(&%B<FED9VEN9R!T:&4@ M9G)E961O;2!O9B!S<&5E8V@L(&]R(&]F('1H92!P<F5S<SL-"F]R('1H92!R M:6=H="!O9B!T:&4@<&5O<&QE('!E86-E86)L>2!T;R!A<W-E;6)L92P@( T*

3 2

WIL_mil
by John Young 17 Dec '03

17 Dec '03

Garry Wills, the historian, writes a thought-provoking essay in The New York Review of Books, August 10, 1995, on "The New Revolutionaries," about the militants and the political and social grievances that undergird their movement -- many of which are shared, Will states, by a wide spectrum of the populace discontented with the government: The suspicion that government has become the enemy of freedom, not its protector, crosses ideological lines. Liberals point to FBI plots against American citizens like Dr. King, to CIA experiments with LSD on American citizens, to the Defense Department's use of Americans as guinea pigs in nuclear testing. The right sees assaults on liberty from the Bureau of Alcohol, Tobacco and Firearms, the Department of the Interior, the Occupational Safety and Health Administration. Many people resent the fact that government has become a dictator of the terms of societal conduct -- in welfare programs, in affirmative action and other preferential attitudes toward citizens' rights, in schools that seem to have a "multicultural" or antireligious agenda, in confiscatory taxation, in the keeping of elaborate files on citizens' activities, in various agencies' surveillance techniques and bribing of informers. Wills goes on to review these grievances: Taxation. The jury system. Regulations. Police power. Schools. Family. Religion. Citizen militias. Constitutionalism. Corruption. Guns -- discussed at length. And, he summarizes in closing: With the end of the cold war, the justification for government activism has been taken away. If the government is only good for fighting Communists, and it no longer fights Communists, then what good is it? No convincing answer comes from above -- which lends the answer from the depths its new plausibility: It is good for nothing, and citizens must take their own lives in hand again, vindicating their own liberties. Right or wrong, the armed patriots at least have arguments they can believe in wholeheartedly. They take the mood of post-cold war drift, of Perotista resentment, of disillusionment and economic shakiness, of fin de siecle fear, and change it into a plan for doing something about one's gripes. The militias and their supporters are not the most central social symptom of our time, but they are among the more dramatic symptoms of a general crisis of legitimacy. The authority of government can no longer be assumed. It has to be justified from the ground up. Many people who are not militants or conspiratorialists can agree with parts of this analysis. Libertarians wonder why people who keep to themselves should be bothered. It is no longer so "extreme" to believe that our government is the greatest enemy to freedom. We see this in a new hatred of government agents (who fear for their lives in western states). Or in the unprecedented vilification of the head of our government. The fierce contempt for Hillary Rodham Clinton, for the Attorney General (called "Butch" Reno on bumper stickers), for "Condom Queen" Joycelyn Elders, reflects misogyny rebelling against feminism's gains; but it is also a sign that the office of the presidency itself may now incur a contempt as routine as the respect it once commanded. The heaping of filth on the personnel and symbols of government has a delegitimating effect in itself; and the assault is joined to the disillusion, anger, and disorientation that have marked recent electoral behavior. Where the heated deny legitimacy and the cool are doubtful of it, a crisis is in the making. WIL_mil (about 50K, in 3 parts)

1 0

Re: NSA, Random Number Generation, Soviet Codes, Prohibition of
by Ulf.Moeller＠hamburg.netsurf.de 17 Dec '03

17 Dec '03

In the book I mentioned there is a quotation of D. Kahn, The Codebreakers, from 1967: "Interestingly, some pads seem to be produced by typists and not by machines. They show strike-overs and erasures - neither likely to be made by machines. More significant are analsyses of the digits. One such pad, for example, has seven times as many groups in which digits in the 1-to-5 group alternate with digits in the 6-to-0 group, like 18293, as a purely random arrangement would have. This suggests that the typist is striking alternately with her left hand (which would type the 1-to-5 group on a Continental machine) and her right hand (which would type the 6-to-0 group). Again, instead of just half the groups beginning with a low number, which would be expected in a random selection, three quarters of them do, possibly because the typist is spacing with her right hand, then starting a new group with her left. Fewer doubles and triples appear than chance expects. Possible the girls, ordered to type at random, sensed that some doublets and triplets would occur in a random text but, misled by their conspiciousness, minimized them. Despite these anomalies, however, the digits still show far too little pattern to make cryptanalysis possible." -- Ulf Möller * um(a)ulf.mali.sub.org * 3umoelle(a)informatik.uni-hamburg.de PGP key fingerprint: B6 4F 97 28 8F C0 54 C3 A6 10 02 2F B9 31 78 14 "When cryptography is outlawed, bayl bhgynjf jvyy unir cevinpl!"

1 0

Re: Three strikes you're out! for politicians... yeah we wish!
by hal9001＠panix.com 17 Dec '03

17 Dec '03

At 10:27 7/26/95, Scott Brickner wrote: >In message <2751(a)umlaw.demon.co.uk> Michael Froomkin writes: >>> Therefore, the only organization which can hold a >>> senator/representative liable for passing a bad law is the one which >>> passed the law. :( > >>and the voters > >Not in the sense of being able to punish him. The voters may only >withold their support in the next election. Not nearly enough to >deter morons like Exon. Who, unless I'm confusing him with someone-else, is not going to stand for reelection and thus can run amuck with no possible fall-out from the voters.

1 0

Canadian Export Controls
by Richard Martin 17 Dec '03

17 Dec '03

This is a notification of the first creation of a few pages describing Canadian Export Controls. Any one who has read the printed document [Canada's Export Controls] will realise that it's almot word-for-word, but there's some use for that. In any case, they currently live at http://www.io.org/~samwise/crypto/ It may be that they'll move, but http://www.io.org/~samwise/interesting.html#privacy should always have a pointer to them. comments, bugs, spelling errors, contributions to rmartin(a)alias.com The pages were written this evening. Tomorrow morning I'll look at them, scream, wonder what I was thinking, and rewrite them. This is so that there'll be a few more screams. :) frodo =)

1 0

Re: Exporting from Canada (was Re: Let's try breaking an SSL RC4 key)
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <m0saTpk-0005BTC(a)nrk.com>, wb8foz(a)nrk.com (David Lesher) wrote: >marc: >> However, goods of U.S. origin are export restricted, unless said >> goods are further processed outside the U.S. so as to result in a >> substantial change in value, so some of the PGP development would >> need to be done in Canada. > >How about compiling it? THAT is "further processing"...... I am not sure that would hold. After all, the disk with the source code to "Applied Cryptography" was denied an export license, because the source code could be compiled into libraries. <What kind of drugs are these people on anyway? They really ought to quit.> - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMBR5PCoZzwIn1bdtAQGSygGAs0JN64qoFfzC0OEL+yV5p/iWecnTtBeJ Fm8a7jsIqtV+FsQg7ATQRcpSxtDOnbS2 =He6y -----END PGP SIGNATURE-----

3 2

Strategic Invest. on Bad Boys, Blk Net, & Remailers
by gjeffers＠socketis.net 17 Dec '03

17 Dec '03

from: Strategic Investment 824 East Baltimore Street Baltimore, MD 21202 July 25, 1995 ------------------------------------------------------------ ---------- BEHIND THE LINES BY Jack Wheeler BAD GUYS Let's suppose, "just suppose," that the president has placed you in charge of a super-secret spy agency conducting electronic intelligence, the National Security Agency; and suppose that he ordered you to trace the activities of those who have replaced the Communists as official "Bad Guys," "Enemies of the State:" tax evaders, money launderers, and drug traffickers. So you decide to pull one of the great intelligence coups of modern times, by having the NSA become a major provider of banking software. Working through a cutout company skilled in managing money in support of U.S. covert operations, and using a modified version of sophisticated tracking software provided by the Justice Department's intelligence service (OSI, Office of Special Investigations), you sell your product to financial institutions around the globe - not telling them, of course, that what they're buying has an electronic "backdoor" giving the NSA computerized access to the intimate details of their customers' financial transactions. In less than a decade, your client list includes many of the world's leading banks. The banks behind the Visa smart card for the Atlanta Olympics, and those soon to offer Internet banking are your clients too. Yes, now you'll do your patriotic duty and get the Bad Guys - and anyone else you decide is an Enemy of the State. We're just suppposing, you understand. THE BLACK NET A worldwide communications system, accessible to anyone on the Inter- net, of completely anonymous and unbreakable encrypted messages and transactions: That's the vision of the Black Net being created by "crypto-anarchist" computer programmers. Using programs like "MixMaster" and anonymous re-mailer computer servers that nest encryted messages in encrypted envelopes, the Black Net will defeat the NSA's ability to trace communications to their source via traffic analysis or any other method. Black Net banks could offer totally untraceable and anonymous transact- tions with the identity of the account holder unknown even to the bank- - rendering any attempts, such as those imagined above, to get the Bad Guys useless. As economist Richard Rahn puts it: "The information tech- nology of the 80s (cheap faxes & photocopiers, satellite radio, etc.) doomed an government's attempt to have a monopoly on the supply of money." ------------------------------------------------------------ ----------- Beat State!

1 0

Decoded Version of KODMAIL.MSG
by johnl＠radix.net 17 Dec '03

17 Dec '03

The American Bankers Association is attempting to address the privacy and security needs of banks and bank customers by ensuring that each have access to appropriate cryptographic tools. The ABA Cryptographic Policy will be posted on this list later today. ************************************************ CONTACT: Sonia Barbara FOR IMMEDIATE RELEASE (202) 663-5469 (1995) ABA REAFFIRMS SUPPORT FOR PRIVATE-SECTOR CONTROL OF CRYPTOGRAPHY Association Recommends a 10-year Extension for the Data Encryption Standard WASHINGTON, July 21 -- The Data Encryption Standard (DES) should be recertified for at least 10 more years to allow interested financial institutions adequate time to convert to any new cryptography standard, the American Bankers Association said in a policy statement issued today. Encryption is the process whereby sensitive data communications, such as wire transfers, credit card and automated teller machine transactions, are protected by secret codes to protect their confidentiality. DES, released in 1977, is the primary method used by financial institutions to encrypt information. Critics say that the longer DES is used, the more likely its code could be broken. While realizing this could limit its life span as a government certified standard, ABA warned that requiring banks to convert to a new standard by 1998 (the year DES's certification expires) could be prohibitively costly due to the high level of electronic funds transfers secured by DES. ABA therefore encouraged the National Institute for Standards and Technology (NIST) to continue to endorse DES as a Federal Information Processing Standard (FIPS) for use by the financial community. There has been an ongoing debate regarding who should control the development and support of private-sector computer security standards: the government or the private sector. ABA strongly recommends that the U.S. government work with the private sector and Congress in an open forum to develop a comprehensive policy on the commercial use of cryptography. In its newly-revised policy statement on cryptography, ABA proposed alternatives to DES and outlined other criteria that must be met before changes in cryptographic standards can be accepted by the banking industry. These criteria -- which will be (more) ABA CRYPTOGRAPHY POLICY/P2 presented next week to representatives of the White House, U.S. Department of Commerce, National Security Agency (NSA) and federal banking agencies -- were developed following a two-day meeting held in June of bankers, vendors and crypto experts concerned about the federal government's direction regarding private-sector information security. Specifically, ABA recommended: a The financial services industry be allowed to continue to use DES based on risk assessment (e.g. value of the transaction) and the business application involved. a A security framework encompassing a family of commercially available algorithms, including DES, be developed. This framework should include a process for negotiated algorithm selection based on the level of risk and other business requirements. a Opposition to government mandated key management systems for financial applications where keys would have to be stored outside the financial institution (e.g. key registration/surrender or the mandatory escrow of cryptographic keys). Instead, banks should continue to be responsible for key management and continue to cooperate with government for law enforcement purposes, as required by law. a Export of cryptography for financial applications must not be restricted. a Full participation of Congress and the private sector before establishing a U.S. policy for the commercial use of cryptography, instead of being carried out solely by Executive Order. [Note: These recommendations were summarized. For the full statement, please call Sonia Barbara at 202/663-5469.] The American Bankers Association is the only national trade and professional association serving the entire banking community, from small community banks to large bank holding companies. ABA members represent approximately 90 percent of the commercial banking industry's total assets, and about 94 percent of ABA members are community banks with assets less than $500 million. ### -- John A. Limpert johnl(a)Radix.Net

1 0

Re: Utah Digital Signatures Act
by E.J.Koops＠kub.nl 17 Dec '03

17 Dec '03

> From: "greg pitz" <pitz(a)onetouch.com> > Would someone be so kind as to describe the Utah initiative? I > wasn't able to find a further description in my percursory search of > Mr Froomkin's otherwise very informative home page > > http://www-swiss.ai.mit.edu/6095/articles/froomkin-metaphor/text.html You can find the text at (save typing errors :-)): gopher://gopher.utah.edu:70/77/Off%20Campus%20Information/State%20of% 20Utah/Utah%20Legislative%20Bills/1995/Bills/Senate/SB0082 Bert-Jaap ---------------------------------------------------------------------- Bert-Jaap Koops tel +31 13 66 8101 Centre for Law and Informatization facs +31 13 66 8102 Tilburg University e-mail E.J.Koops(a)kub.nl -------------------------------------- Postbus 90153 | "We forgot the crackers!" | 5000 LE Tilburg | | The Netherlands | Wallace and Gromit | --------------------------------------------------------------------- http://www.kub.nl:2080/FRW/CRI/people/bertjaap.htm ---------------------------------------------------------------------

1 0