December 2003 - cypherpunks-legacy

Re: Status of Cypherpunks list sites?
by John Young 17 Dec '03

17 Dec '03

Okay, mace me, I'm still posting to toad, and receiving from it, along with dupes from cyberpass, and TAing the latency. Toad's stuff comes right through, fast, while it's +/- all over the chart from cyberpass -- up to eight hours delay at times, even a day later, with answers to vital controversies coming before the issue is shown to be misunderstood squat. Excuse cyberpass dis for disarray, but toad's speed is handy when you've nothing to say and want to instantly scream it very clearly to yourself and the empty void rather than face the horror of fixing insyntax. And, praise elvis, not all vaporings that come from toad makes it past molassel cyberpass, although most eventually oozes in. Null stench especially pops up from world-sucking toad, the kind that makes one's own East Coast voidance smell not so bad. Until the West Coast wakes up and sez jesus cork that, we're fetal lunged here. Still, if Tim's right to call for toad discon, its reliable speedy drip drip drip of 24-hour addictive invective will be sorely missed when it presents a last time middle web and hops off into the swamp leaving only one's own dig-itch digit to sniff and howl how awful.

2 1

Cyphernomicon for ftp
by Jeff Simmons 17 Dec '03

17 Dec '03

I remember the trouble I had finding a text copy of the Cyphernomicon ... So until someone posts it on a site with higher bandwidth, it's available at: ftp.goblin.punk.net/pub/docs/cypherpunk.faq.gz or cypherfq.zip We're talking 400K+ over a 28.8 modem, so don't expect much in the way of speed ... -- Jeff Simmons jsimmons(a)goblin.punk.net

1 0

Crypto '95 report
by Hal 17 Dec '03

17 Dec '03

This was the first year I attended a Crypto conference (although for the last two years I have "crashed" the evening rump session, where less formal 5-10 minute presentations are given). A number of list members were present and it was good to meet a lot of new people. I was a bit disappointed that few of the technical sessions were in areas that I am interested in or that seem to have bearing on CP issues. I have read many of the Crypto proceedings and this year the pickings seemed to be unusually slim. Richard Schroeppel gave a very clear presentation on an implementation of elliptic curve cryptography for a diffie-hellman-like key exchange. This is a two-dimensional variation from the regular integers that are used in most of the number theory based crypto, and has some advantages. This new implementation is actually faster than regular DH for apparently the same security level. It looks like elliptic curve crypto is on the threshold of coming into widespread use. I believe the patent situation is one of the main reasons. There were several papers on secret sharing, something we have discussed here as an alternative to escrow for handling lost keys. Amir Herzberg et al had a method for "resharing" a shared secret periodically and securely, so that if an adversary was stealthily sneaking in and learning shares occasionally, he would be put back to square one when the secret resharing phase occured. Only the trustees are involved, not the original secret holder, and the secret does not have to be reconstructed during the resharing. Bruce Dodson presented some results on using the Number Field Sieve factoring algorithm. Their implementation looks to be the fastest available now, considerably better than the Quadratic Sieve that was used for RSA-129. I belive they estimated 1000 MIPS years would have been enough for NFS to do RSA-129 compared to the 6000 MIPS years for QS. They are now going to try another challenge number, RSA-130. (RSA has challenge numbers every 10 digits in size (or maybe it was 5): RSA-140, RSA-150, etc.) There was one paper on electronic cash, by Okamoto. His technology is distinguished by allowing divisibility - you can take a $10 and divide it into 2 $5's without going back to the bank. However he has always had a problem that your various pieces of cash are linkable, although not traceable to the user who withdrew them. His new method uses smaller amounts of data. I was encouraged to see some progress on the linkability issue: for the first time (that I have seen) he admits it as a problem; he now has it so that theoretically the linkability is only within a single divided piece of cash (so that if you didn't divide you wouldn't have linkability). Actually the overheads are too large for this to by quite true, but it is a step in the right direction. He also included elimination of linkability as a future goal. Unfortunately his oral presentation was extremely shallow, mostly describing what electronic cash was. There was also a paper on "fingerprinting", the encoding of hidden information into a document so that if the doc is leaked it can be traced to the leaker. The talk wasn't very clear but I was able to glean enough that I now believe that this is possible whereas I didn't before. I was discouraged to see a whole session on key escrow. One presenter described key escrow as a whole new area of cryptography, analogous to the discovery of public key crypto when all that was known previously was conventional key. Now there are three areas. The academic crypto community seems to be greeting key escrow enthusiastically as a new technical challenge. The rump session had some good stuff, I thought. Matt Blaze et al had a paper on "Master Key" cryptosystems, a variation on escrow where the government can read all the messages using a certain cryptosystem. They pointed out the similarity to the trap door concept used in public key cryptography and concluded that an efficient master key system would be an efficient public key system. If you believe that the latter can't exist then it follows that the master key versions can't exist either. Bruce Schneier gave a talk summarizing the sketchy information known about Skipjack (the cipher in Clipper), including some FOIA'd docs. These included some comments from design reviews by Mycotronix on earlier versions, which included references to F and G boxes or tables. This is the first I had heard of this and helps explain why people thought S-1 was Skipjack or a hoax, since it had F and G tables. (I hadn't felt that the number of rounds and key/block sizes were sufficient coincidence to preclude independent invention.) A new crypto library was announced from AT&T. It is written in C and has a bignum lib (arbitrary size) and the usual crypto suspects, although I think not RSA presuambly due to patent issues. On a reasonably modern PC it could do an RSA 1024 bit signature in 900 milliseconds. Email to lacy(a)research.att.com with subject CRYPTOLIB to be informed on when it will be released and how to get it. Dhem and Quisquiter described CASCADE, a smart card system with voice recognition for ID rather than the PIN usually used. http://www.dice.ucl.ac.be/~dhem/cascade/. This talk was hard to understand due to the language differences. Eric Hughes, co-founder of the cypherpunks, announced the formation of Cypherpunk Laboratories, a California non-profit corporation. It is intended to be a common resource for people motivated by freely available strong cryptography tools. Among other things it will offer scholarships and prizes to students who create relevant work and papers, consider establishing an online journal focusing on implementations of crypto, and work on software development. One project Eric mentioned was to create a replacement for PGP. Ron Rivest proposed probabilisitic key escrow, which he described as "translucent" crypto. The idea is that with every message you send there is a Law Enforcement Access Field, but there is only some probability p that it is readable, and you can't tell if it will be readable or not. This way you don't lose as much privacy but criminals can't take the risk that maybe they'll be unlucky and this particular message will be readable. Shamir had an interesting paper on preventing "flooding" attacks. A server may check for signatures on incoming messages to reject bogus ones (only certain sigs are valid) but just doing a signature check may take too long if it is really being flooded. Shamir came up with a kind of signature which can be quickly probabilistically checked, based on a variation on the Rabin cryptosystem. You can do almost all the work using single precision and it should be very fast. I will write this up if anyone is interested. Our own Wei Dai, at 19 the youngest author, has spent his summer vacation developing with Josh Benaloh at Microsoft an improved modular reduction algorithm, which unfortunately will be patented (or at least they will try). BTW a number of people from Microsoft were in attendance at Crypto, including other list members. Obviously this crypto stuff is considered very important at MS. One of the more interesting talks I thought was from cypherpunk Doug Barnes, on "identity agnostic" electronic cash. This is basically an idea for creating a Magic-Money-type electronic cash server without violating Chaum's cash patent. What you do is to run the server and publish a spec it will follow. All the server does is do an RSA signature on the raw data it receives and decrement the user's account accordingly. The user has a choice of doing blinding or not on the signature. Chaum's patent covers the blinding, so if the user wants to do that he should be sure to license the patent or live somewhere it doesn't apply (or ignore it if he figures he's too small potatoes for them to care about). But the server isn't responsible for checking all this. It just does RSA sigs, which is prior art as far as Chaum's patent goes. Users can blind or not, it doesn't care. It is "identity agnostic" as Doug says. The implication is that with an RSA license you could run this kind of bank (online cash) and ignore Chaum's patents, while a horde of end users violate the patents but take safety in numbers and get anonymity. Lawyers like to go after big targets but the servers aren't violating anything. The other things I enjoyed in the conference were the non technical talks by Bob Morris (senior), retired NSA, and later Adi Shamir. Morris said, with what I thought was peculiar emphasis, "never underestimate the amount of time, money, and effort your opponent will put into breaking your encryption." He was supposedly speaking in the context of the German (and Allied) mistakes during WWII, but I got the impression he was talking about today, and in fact warning of NSA efforts to spy on people. He went on to describe the many ways mikes and antennas can be planted or used - he looks at a telephone and sees a microphone, and the hand cord is an antenna. All in all a rather chilling talk from someone who obviously can't say as much as he would like to. Shamir had some interesting anecdotes about the invention of RSA. He emphasized what amateurs the three of them were, claiming this was probably an advantage. Some of the other talks I enjoyed without following all the details were the cryptanalysis ones. A lot of systems were broken or weaknesses found. Most were not ones I was familiar with but it just emphasizes how hard it is to really come up with something strong. All those bozos on sci.crypt with their "break this" challenges would benefit from seeing some of these results. All in all there were several interesting results even if the percentage seemed smaller than usual. Hal Finney

1 0

INFOTECH WEEKLY - August 18, 1997
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Authentication-Warning: nickkean.ihug.co.nz: p46-chch2.chch.ihug.co.nz [207.214.13.46] didn't use HELO protocol Date: Wed, 20 Aug 1997 13:02:50 -0400 From: Blair Anderson <"Blair Anderson"@nickkean.ihug.co.nz> Organization: Techno Junk and Grey Matter [http://www.isdn.now.co.nz] MIME-Version: 1.0 To: dcsb(a)ai.mit.edu Subject: INFOTECH WEEKLY - August 18, 1997 Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: Blair Anderson <"Blair Anderson"@nickkean.ihug.co.nz> Summary Report on New Zealand encryption export restrictions under Wassanar/COCOM international agreements... http://www.infotech.co.nz/spreports/asaint.html -- Blair Anderson mailto:blair@technologist.com "get a piece of the click" Electronic Commerce, Encryption and Electronic Rights Management Techno Junk and Grey Matter mailto:Benefit@isdn.now.co.nz Corporate Technology Consultants 50 Wainoni Road, Christchurch, New Zealand phone ++ 64 3 3894065 fax ++ 64 3 3894065 Web Page(s): http://www.isdn.now.co.nz/INDEX.HTM -------- Caught in the Net for 25 years ----------- For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)ai.mit.edu" with one line of text: "help". --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

Nautilus 1.0 under OS/2 Warp?
by Mixmaster 17 Dec '03

17 Dec '03

Has anyone run the Nautilus 1.0 secure telecom software in a DOS box under OS/2? When I've tried it, it starts up, audio saying "welcome to Nautilus" comes out of my speakers, and I'm prompted for a passphrase. The problem comes when it tries to connect to the modem. It comes back and says "Remote failed to connect" followed by "Resetting modem...". Then the software exits. It never even takes the phone line off the hook. Other DOS comm software works just fine in a DOS box, so why not Nautilus?

1 0

Re: anyone know what this "top secret" code does? Re: anyone know what this "top secret" code does?
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

hallam(a)zorch.w3.org (Phillip M. Hallam-Baker) wrote: > The code looks more than a casual hoax. Its not Skipjack, but that > does not mean its not NSA originated. Its probable that many of the > people who designed skipjack don't know its skipjack. If you read > the code carefully it is obvious why its not skipjack, an S2 > algorithm is referenced explicitly. [...] > Regardless about whether or not it is skipjack it challenges one of > the basic assumptions of many cipher designers, namely that the > amount of diffussion should be maximized at each round. I am now > very much less than convinced that this is in fact an issue. The S1 > design with its narrow diffussion provides very strong guarantees > that one round cannot undo the work of the previous one. > S1 must therefore be considered to be a significant contribution to > the cryptographic community. It has challenged a fundamental tenet of > faith which has so far been accepted without argument. It is thus > paradigmatic in that it may lead to a new method of cipher design. Does anyone remember the scenario someone suggested awhile back that hypothesized a scheme by the NSA or other TLAs to encourage the use of WEAK crypto? It involved spreading a lot of F.U.D. about PGP and other strong crypto methods, followed by the discovery/leak of a supposedly "strong" crypto algorithm to replace it. This may not be it. It may just be a trial balloon to gauge the reaction of the crypto community to an anonymous, "gift from heaven" crypto algorithm. But at least be aware of what COULD happen. One tactic that might be tried is an intentional "leak", followed by a flurry of legal actions designed to make it look like the "leak" was going to cause some real damage to their cryptanalysis efforts, due to it being "unbreakable", or whatever. Of course, anything "leaked" would be crippled in some undetectable manner so as to provide a back door...

1 0

VoicePGP Query
by Deranged Mutant 17 Dec '03

17 Dec '03

Due to some acct. problems I lost most of the mail snet to me betw. May and September. I saw a post in a newsgroup about VoicePGP betas being available, though only for Mac and WIn'95... is this true? And if so, will there be a Win 3.11 or OS/2 or DOS version out eventually? I don't intend to get Win '95 for as long as I can avoid it (and this is NOT the start of an OS flame war...) Also, what's the status of PGP 3.0? Thanks, Rob

1 0

Re: Anonymous Remailers
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Robert A. Costner wrote: > > In Georgia, while we have won a temporary injunction and assume we will see the law fully struck down, EFGA is still involved in lawsuit against the state over internet anonymity. I actually don't contemplate another affidavit in this case, but it may happen. If I need to write another affidavit in support of the remailer, I will only have about two weeks to get it done. Don't write an affidavit, write an indictment. Say, perhaps, an indictment of our founding fathers for their use of anonymity, as well as tacking a "use of crypto in commission of a crime" charge on to the indictment. You can site Paul Revere's use of cryptography ("one if by land, two if by sea) to implicate the whole bunch in a drug dealing child pornography ring. Perhaps you might even want to trace the founding fathers' use of anonymity and strong-lantern encryption to the moral corruption existing today. LanternMonger "The founding father of drug dealing child pornography rings."

1 0

Re: MIT distributing PGPfone -Reply
by terrell＠sam.neosoft.com 17 Dec '03

17 Dec '03

>PGPfone was out of the U.S. less than 3 hours after first appearing >publically at the MIT site. > >As I noted in a previous message, MIT takes various steps to ostensibly >protect against export, but there is clearly no practical means of stopping >export once the software has been received by someone. > >I got my copy of PGPfone 16 hours after its public release, via an >anonymous person who posted it on the Cypherpunks list through an anonymous >remailer. Of course that list is distributed to more than 20 foreign >countries, so "export" happened that way, as well as by other means. > >--Tim May > As tim May's .sig should say: "National borders are not even speed bumps on the information highway." Buford C. Terrell 1303 San Jacinto Street Professor of Law Houston, TX 77002 South Texas College of Law voice (713)646-1857 terrell(a)sam.neosoft.com fax (713)646-1766

1 0

Re: PGPfone over Appletalk
by Hal 17 Dec '03

17 Dec '03

From: "Rev. Mark Grant" <mark(a)unicorn.com> > Can someone tell me how to run PGPfone over Appletalk ? The > documentation says that support has been added for this release, and > there's a preferences box to check to use it, but there's no information > I can find in the documentation on how to initiate a call over > Appletalk.. it just says to enter a telephone number to dial. If I > press 'Connect' without entering anything it hangs up the Mac. > > How do I tell it which machine I want to connect to ? I changed the preferences box setting, but then I exited and restarted the program so that it came up in "appletalk" mode. This is probably the step you are missing. I did this on two different machines, and then when I clicked connect it no longer tried to open the modem, instead it put up a dialog box allowing me to click on the machine running the other PGPfone. I did that and it connected OK. There is a nice audio simulation of an old-fashioned telephone bell ringing. Unfortunately my appletalk "network" consists solely of my power mac and an old 68030 mac laptop, the latter apparently being underpowered for PGPfone. The voice quality changed occasionally as the software adaptively tried different coders, and the powermac instance of the program finally printed a message saying that the list of coders had been exhausted. Hal

1 0