December 2003 - cypherpunks-legacy

Re: key for Alice as promised (not)
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

>On Tue, 28 Nov 1995, Adam Hupp wrote: > >> >Can you imagine?? I'm simply not willing to fool myself into thinking >> >that I ahve security by posting a key and using PGP. >> >> Unless you can post some proof that PGP is insecure, stop insisting it is. > >Hold on a minute. Alice is, here, 100% correct. no, he isn't. He isn't even using a minimal effort to prevent spoofing, and he's blaming this on the fact that some particular piece of software (for example, PGP) isn't absolutely foolproof. >If I use PGP to read messages and there's a videocamera trained on the >keyboard, and other people have access to the machine, PGP is not >secure. Similarly, if PGP is on a computer which other people may use >without my supervision, they can monitor keystrokes, etc. and PGP is not >secure. True but irrelevant. This is especially true since the only purpose to signing messages to a public area is to prevent spoofing. If somebody does, indeed, figure out how to break (say) a 1024-bit PGP key and "Alice" gets spoofed, HE WILL KNOW because he will see a message with his signature that HE KNOWS he didn't send. At that point, he will at least be able to reduce the number of spoofed messages to 1 before he alerts us that there is a problem. We won't necessarily know who to believe, of course, but we will know that one of a number of this is probably true: 1 "Alice" is lying to us. (by far the most likely.) 2. Somebody actually has physical access to "Alice's" machine and is actively using it to spoof messages. 3. Somebody found out how to break 1024-bit PGP keys easily. (Very unlikely, of course.) >A chain is only as strong as its weakest link; Alice recognizes this, and >makes no claim that PGP itself is the weak link. But "Alice" resists using ANY chain at all!

2 1

Response to ping re: CJR
by Raph Levien 17 Dec '03

17 Dec '03

I just got a message on my answering machine from Sam Capino. He said they are working on answer to my CJR. They had hoped to get it out by now, but were set back by "the furlough." I had called him about a week ago to check up on the status, but at the time only got his answering machine. Of course, the original 15 days have passed, but I'm perfectly willing to let that slide since I'm not completely sure that the CJR was submitted using exactly the right process. Just thought you'd like to know. Raph

1 0

"Proprietary" internetworking protocols (was RE: The future will be easy to use )
by Pete Loshin 17 Dec '03

17 Dec '03

Perry E. Metzger writes: >attila writes: >>figures. I'll give ipsec and ipsec-dev a look. However, SUN does have >>the power to make something happen on the high-power workstations, and the >>fact they are making a portable package available in source code is >>farther than anyone else has gone. > >Unfortunately, an internetworking protocol used by only one vendor >gets nowhere. much other discussion ommitted... I hate to quibble, but past experience may demonstrate this to be inaccurate. In particular, and most relevantly: NFS (Sun) SSL (Netscape) Another internetworking protocol (IPX) gave Novell a good run. The point is that a working implementation goes a long way for people who want/need _something_ that works, NOW. Consider the relative merits/success of S-HTTP and SSL. ObCrypto: the POTP people are the Boston Internet Expo today and tomorrow, and they have their "technical guy" who is supposed to be answering questions. The nontechnical guy said they generate random numbers using randomness taken from the text of the messages being encrypted. -pl _Electronic Commerce_ (Charles River Media, available now) pete(a)loshin.com

4 3

Question on modular exponents
by Usuario Acceso2 17 Dec '03

17 Dec '03

Hi CP's: I'd be pleased if someone explained me this ASAP: How could I demonstrate that _ (g^a)^b (mod p) = g^{(a*b) mod q} mod p _ when g's order in Zp is q? The same question remains for adition. I have the feeling the demonstration must be similar. Best. Jaime

1 0

Re: GOST for sale
by JMKELSEY＠delphi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >Date: Fri, 24 Nov 1995 03:43:25 +0100 (MET) >From: Mats Bergstrom <asgaard(a)sos.sll.se> >Subject: GOST for sale >According to a short article in a Swedish newspaper (DN) >with the title 'Spy Code of KGB can make computers safe', >JETICO INC., located in Finland (Tammerfors), introduced >a new crypto system on the world market last week. It's >based on GOST, the Russian federal standard algorithm. >This product, called BestCrypt, is implemented at least >partly in hardware. Alledgedly it uses 'GOST 28147-89', >whatever that stands for. Hmmm. >GOST is probably very secure - a huge keyspace (256 bits) and >KGB would not have left a trapdoor for NSA to take advantage >of, would they? If this is the cipher I've seen, it's not overwhelmingly impressive, though it may be OK. I haven't ever made any serious attempt to attack it, and I don't know anyone else who has. Anyone have a reference? Basically, GOST is a balanced Feistel network (like DES), but its F-function is much simpler. Basically, F(X,K) = Rotate_Left(S(X+K),11), where S(t) denotes parallel application of eight 4:4 S-boxes. Depending on the implementation, these S-boxes' contents could be key-dependent and pseudorandom, or fixed. Unfortunately small random S-boxes are likely to have some weaknesses W.R.T. differential cryptanalysis. This can be true even when the S-boxes are secret and key-derived--see Biham and Birkyov's paper in Auscrypt '94 on a DES variant with variable S-boxes, for a quick discussion of this. And the security of this scheme is very much going to depend upon the S-boxes used. If the S-boxes are generated at (pseudo)random from the key, I'd expect there to be some pretty nasty weak key conditions that could occasionally come up. On the other hand, GOST is defined with 32 rounds, so it may be hard to find any useful differential or linear characteristics, even for relatively bad S-box choices, that have high enough probability to get through 29-31 rounds. And it has a 256-bit key, so even if someone determines some attack which recovers 160 bits of the key, there are still 96 bits of key left to provide security. The GOST key schedule is really simple, though it avoids the most obvious kind of related key attack. I wouldn't be surprised to see some interesting related key attacks be possible. This is interesting because there is also a hash function based on GOST--I'd be pretty reluctant to use this without a lot of analysis. >The newspaper article ends: > >'The Finnish entrepreneurs asseverate that their >Russian colleagues have never had anything to do >with the KGB.' I may be mistaken, but wasn't there some other internal organization in the USSR that did cryptography? >Mats Note: Please respond via e-mail as well as or instead of posting, as I get CP-LITE instead of the whole list. --John Kelsey, jmkelsey(a)delphi.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMLv0kkHx57Ag8goBAQFH3AP+JR1sEQCH0ANmNSDFhzpCZb4jn4uqq23v PjZfFOrYc9SrD1xn+3azqfHFpiHIubfWzZ8u1aNEf4erAErbQLPAUOLPv17zhn// 6UEVKX4GhPqoLfou+wO38rF2DwWdeCjuQm2GgxuFpw5b0D4M3V1mv5ocLOoOMq2N twdfxiMtO6Y= =BOER -----END PGP SIGNATURE-----

1 0

Re: The future will be easy to use
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"perry(a)piermont.com" 28-NOV-1995 13:34:33.55 Jonathan Zamick writes: > I can't agree. The model of a successful enterprise includes feedback from > different levels of participants. This isn't an enterprise. The government is not a participant except by their own desire to interfere. --------- One reason to incorporate a probable opponent into something is to see what methods the opponent will likely use. For instance, their debating points would be nice to know in advance (to the degree they aren't already); while cyberpunks don't have much access to the mass media, that on the Net (where a lot of the initial potential users are likely to be) is another matter. Getting clues to their likely legal strategy may also be valuable. On the other hand, letting them know too much may be a problem... of course, I'm _certain_ the NSA, etcetera get copies of this list. -Allen

1 0

Re: Directed Hamiltonian Path Problem
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"tcmay(a)got.net" 28-NOV-1995 20:15:30.64 The reason we speak in terms of physical volumes of "Adleman computers" is to make concrete the way things scale. If the amount of Adleman computers needed to factor, say, a 2000-digit modulus (or some reasonably equivalent Hamiltonian cycle problem, such as the TSP) is "ten Pacific oceans full of them running for 100 years," then one has a pretty clear feel for just how futile it is to ask about "But what about if we apply MASSIVE PARALLELISM?!?!" ------------ Ah. My objection is probably from being too much of a purist in my own area of science. I do tend to try to be quite careful in whatever I write to use the correct terms (then explain them for those who've heard the incorrect ones). ------------- I don't worry much about factoring breakthroughs. And I don't mean minor improvements, which keep occurring: I mean major breakthroughs which would make factoring a 2000-decimal-digit number "easy." Practically speaking, snarfing private keys is a helluva lot easier, for many reasons. -------------- Umm... it's easier for each one. But the effort in question adds up. Ultimately, for an agency (NSA, CIA, etcetera) wanting to do a lot of such unencryptings, coming up with a factoring method is the most efficient way to go. Fortunately, science doesn't work very well with security classifications (unlike engineering, which is what most military classified "science" is from what I know). -Allen

1 0

Re: Netscape gives in to key escrow
by James A. Donald 17 Dec '03

17 Dec '03

At 12:55 AM 11/30/95 -0800, Jeff Weinstein wrote: > All press accounts I've read so far > have lots of stuff attributed to Jim, but very little of it is actual > quotes. Then we would like to hear Jim "clarify" his position. Absent such clarification, we must assume he considers the press reports of what he said to be reasonably accurate. > I don't want to go down in history as a facilitator of the totalitarian > state, and I don't think anyone else here does either. Most of the major players have taken a position overtly opposed to GAK (whilst leaving themselves some wriggle room, should the heat get too severe). What is netscape's position? --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: cypherpunks at ietf
by James A. Donald 17 Dec '03

17 Dec '03

> OUR CURRENT PROBLEM IS THAT THE AVERAGE CONSUMER CAN NOT COMPLETE AN ACCURATE > SEARCH ON THE WEB. > > [...] > > AT THIS POINT SO MANY CYBERPUNKS HAVE EMBEDDED SO MUCH GARBAGE ON THE WEB, > THAT YOU CAN NOT COMPLETE AN ACCURATE SEARCH. Gee: Someone who has not learnt to use the caps key on his computer cannot do accurate searches, so will everyone else please get off the net. > > [...] > > BUT MORE IMPORTANT, WE NEED TO CLEANUP THE TRASH THAT THE CYBER-PUNKS ARE > PLACING ON THE WEB. Pleasant comic relief. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: The future will be easy to use
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 15:30 11/28/95 -0500, Carl Ellison wrote: >BTW -- PGP currently lacks a way for me to note, when I sign a key, how it >is that I trust that key (by personal meeting, by attribution, by message >association, ...). A signed attribute record would let me record that >information for myself as well as for others. There is more to this problem than how it is that I trust the key. There is also what I trust it for. I just added a key to my key ring that I will use for sending confidental data to a client site. I trust that no one can access the secret key who is not also inside their firewall. However, the key is on a multi-user system, so I do not trust that it is accessable to only one person. Since the data I intend to send will be publicly available inside the firewall, I don't have to trust more than the firewall. It is hard to see how to record the information about how much I trust the receipent's systems security. Bill ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

2 1