December 2003 - cypherpunks-legacy

MD4-derived hash functions
by JMKELSEY＠delphi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >Date: Tue, 24 Oct 1995 13:14:41 -0400 >From: hallam(a)w3.org >Subject: Re: MD5 weakness >Ron has not mentioned such an event to me and if that were the case I would >seriously doubt that he would not have been told about it. The only comment he >generally makes is that he wrote MD5 because "MD4 was making me nervous". In the MD5 RFC, I seem to recall the statement that MD4 was trading off too much strength for additional speed. However, sometime around that time, it came out that there were attacks on two-round variants of MD4, which is the stated reason for the development of RIPE-MD. Does anyone know whether Rivest was motivated to design MD5 by the partial attacks on MD4, or whether those came later? (This is totally idle curiousity.) >NIST and the NSA trusted MD4 sufficiently to base SHA upon it. SHA is preferable >in many ways to MD5, it has a different approach to extending the scheduling and >resist differential cryptanalysis. There is a problem with the compressor >function of MD5 which I dislike. All of the well-known software hash functions seem to be based on MD4 these days, but that doesn't mean much about the security of MD4--3DES with three independent keys looks pretty strong, as does 3DES with two independent keys, but that doesn't mean that single DES is a strong enough cipher for modern applications. One issue that exists with MD5, but not with SHA or the longer hash versions of Haval, is that MD5 has only a 128 bit hash function output, which corresponds loosely to having a 64-bit key. This implies that a wealthy enough opponent could determine a pair of MD5 inputs that collide, and conceivably use this in an attack. I think we should stick to 160 bit or longer hashes for future designs. (See P. van Oorschot and M. Weiner, "Parallel Collision Search with Application to Hash Functions and Discrete Logarithms," in the proceedings of the 1994 Fairfax Conference, for example). As an aside, what hash functions are there out there that look reasonably strong, have hash outputs of at least 160 bits, and aren't based on MD4? Some of the Snefru variants with many passes (eight?) come to mind, and the GOST hash function fits all the criteria, except I have a hard time convincing myself it's as strong as it claims to be. Is there a generic construction for arbitrary-length hash functions from good block or stream ciphers? > Phill --John Kelsey, jmkelsey(a)delphi.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMI+Mc0Hx57Ag8goBAQFJ9gP/VMvNefSm77prSY/NMbJfGO1EVmQrUAHn kEQEse+cXiaoJTe7njxUqycuDX0PN09C4XhNVOQJ6IBpCPZOKQMiXsI9FwAfjGWb mibwSfzyiXwxny1kYgfDCffS8KwdlWiVjxj1+MhvqhGQnxPsVA6UVrSCyAyHPZVJ UTXUWBJlJho= =2Pti -----END PGP SIGNATURE-----

7 6

Re: Let's Not Merge Mailing Lists, OK?
by rah＠shipwright.com 17 Dec '03

17 Dec '03

I'm cc:-ing this to both lists just this once, because this message is more or less administrative. I'm not trying to merge www-buyinfo with cypherpunks. tcmay(a)got.net (Timothy C. May) said: >There is great danger in constantly "casting the net wider," in trying to >reach more and more people. I understand the temptation for some on both >lists to cross-post some messages. I urge that they do this, as Bob H. has >done on occasion, by personally forwarding the message, with only _one_ of >the lists getting it. (This because the real danger is as above, where >multiple lists are in the recipient or cc: fields, and followups semi-spam >multiple lists.) I agree with Tim. I've been doing one-way forwards from cypherpunks to www-buyinfo for most of a year now. Most of the people on www-buyinfo are business people who understand that digital commerce *is* financial cryptography, but they don't have time to read all of cypherpunks to find the e$ juicy-bits. When I do this, I put a "(cpx)" in the subject line so that the sizable community of cypherpunks on www-buyinfo can filter them out and won't have to see double. I've gotten a lot of fan-mail for this, even though it's not really in keeping with the original charter for www-buyinfo, which seems to have been subsumed by other groups, like the e-payments list and others. Recently Dave Kristol has said that he's going to retool www-buyinfo, and when he does, I'm hoping to have set up my own structure of 3 hypermail archived e$ lists (a netwide e$ digest, a discussion list, and a newsletter). I'm talking to about 3 or 4 different people about it, and I should have the details worked out within a few days, with an announcement next week, if I'm lucky. Anyway, I've sent a few messages in the opposite direction on occasion (from www-buy to c'punx), but I do try to hold it down, mostly because whatever the topic is, we've usually talked about it on cypherpunks before. I should note, however, that there's a good-sized discussion, for www-buy, anyway, going on over on over there about anonymity, which has heated up over the past few days. I forwarded a message here from Nick Szabo as an example of it yesterday. The cross-posting Tim's talking about is a result of that discussion. There's a whole lot of "what do we need anonymity for, anyway?" opinion in the business community, and it should be addressed with as much reason as possible, and not by shouting them down with moral arguments to the contrary, no matter how right those moral arguments are. Fortunately, I believe there's a great business case for anonymity, and frankly, there had better be, because, in a cryptoanarchic geodesic economy like the one we're fixing to have, nothing is going to survive without a market. Anyway, like I said, I agree with Tim. If you want to post to cypherpunks, you should subscribe to cypherpunks, and suffer the firehose like the rest of us have to do. However, those of us who are on both lists, especially those of us longer-term cypherpunks like Hal, and Nick, and Adam Shostack, should be the ones to forward messages, if any, to cypherpunks, because they are the ones who know whether cypherpunks has seen this before. For instance, the posting of Nick Szabo's that I sent to cypherpunks was more of a rah-rah exercise (no pun intended) than anything else. It was so well thought out that I thought it bore passing around a bit. However, as an actual contribution to the information content on cypherpunks, what Nick said has been said on cypherpunks before, if not typically with such eloquence. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

New release of CFS Unix encrypting file system available
by Matt Blaze 17 Dec '03

17 Dec '03

Source code for the latest version (release 1.3.1) of CFS, the Cryptographic File System, is now available upon request for research and experimental use in the US and Canada. CFS pushes encryption services into the Unix(tm) file system. It supports secure storage at the system level through a standard Unix file system interface to encrypted files. Users associate a cryptographic key with the directories they wish to protect. Files in these directories (as well as their pathname components) are transparently encrypted and decrypted with the specified key without further user intervention; cleartext is never stored on a disk or sent to a remote file server. CFS employs a novel combination of DES stream and codebook cipher modes to provide high security with good performance on a modern workstation. CFS can use any available file system for its underlying storage without modification, including remote file servers such as NFS. System management functions, such as file backup, work in a normal manner and without knowledge of the key. CFS runs under SunOS and several other BSD-derived systems with NFS. It is implemented entirely at user level, as a local NFS server running on the client machine's "loopback" interface. It consists of about 5000 lines of code and supporting documentation. You must have "root" access to install CFS. CFS was first mentioned at the work-in-progress session at the Winter '93 USENIX Conference and was more fully detailed in: Matt Blaze. "A Cryptographic File System for Unix", Proc. 1st ACM Conference on Computer and Communications Security, Fairfax, VA, November 1993. (PostScript available by anonymous ftp from research.att.com in the file dist/mab/cfs.ps.) and in Matt Blaze. "Key Management in an Encrypting File System", Proc. Summer '94 USENIX Tech. Conference, Boston, MA, June 1994. (PostScript available by anonymous ftp from research.att.com in the file dist/mab/cfskey.ps.) Version 1.3 of CFS also includes ESM, the Encrypting Session Manager. ESM provides shell-to-shell encrypted sessions across insecure links and requires no OS or network support. It is useful for typing cfs passphrases when logged in over the network. ESM needs RSAREF 2.0 to compile and is tested only on SunOS and BSDI. ESM is the first released part of a suite of session encryption tools that are described in Matt Blaze and Steve Bellovin. "Session-layer Encryption." Proc. 1995 USENIX Security Workshop, Salt Lake City, June 1995. (PostScript is available from ftp://research.att.com/dist/mab/sesscrypt.ps) The new version of CFS differs from the version described in the papers in a few ways: * The DES-based encryption scheme has been strengthened, and now provides greater security but with the online latency of only single-DES. * Support for the smartcard-based key management system is not included and a few of the tools are not included. * An impoved key management scheme now allows chaning the passphrase associated with a directory. * The performance has been improved. * The security of the system against certain non-cryptanalytic attacks has been improved somewhat. * User-contributed ports to a number of additional platforms. * Hooks for adding new ciphers. * 3-DES, MacGuffin, and SAFER-SK128 encryption options. * Timeout options allow automatic detach of encrypted directories after a set time or period of inactivity. CFS is distributed as a research prototype; it is COMPLETELY UNSUPPORTED software. No warranty of any kind is provided. We will not be responsible if the system deletes all your files and emails the cleartext directly to the NSA or your mother. Also, we do not have the resources to port the software to other platforms, although you are welcome to do this yourself. The software was developed under SunOS and BSDI, and there are also unsupported user-contributed ports available for AIX, HP/UX, Irix, Linux, Solaris and Ultrix. We really can't promise to provide any technical support at all, beyond the source code itself. We also maintain a mailing list for CFS users and developers; subscription information is included with the source code. Because of export restrictions on cryptographic software, we are only able to make the software available within the US and Canada to US and Canadian citizens and permanent residents. Unfortunately, we cannot make it available for general anonymous ftp or other uncontrolled access, nor can we allow others to do so. Sorry. Legal stuff from the README file: * Copyright (c) 1992, 1993, 1994, 1995 by AT&T. * Permission to use, copy, and modify this software without fee * is hereby granted, provided that this entire notice is included in * all copies of any software which is or includes a copy or * modification of this software and in all copies of the supporting * documentation for such software. * * This software is subject to United States export controls. You may * not export it, in whole or in part, or cause or allow such export, * through act or omission, without prior authorization from the United * States government and written permission from AT&T. In particular, * you may not make any part of this software available for general or * unrestricted distribution to others, nor may you disclose this software * to persons other than citizens and permanent residents of the United * States and Canada. * * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR IMPLIED * WARRANTY. IN PARTICULAR, NEITHER THE AUTHORS NOR AT&T MAKE ANY * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE MERCHANTABILITY * OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR PURPOSE. If you would like a copy of the CFS source code, please read to the end of this message and then send email to: cfs(a)research.att.com DO NOT REPLY DIRECTLY TO THIS MESSAGE. You must include a statement that you are in the US or Canada, are a citizen or legal permanent resident of the US or Canada, and have read and understand the license conditions stated above. Be sure to include an email address in a US- or Canada-registered domain. The code will be sent to you via email in a "shar" shell archive (a little over 300K bytes long).

6 5

Re: Anonymity: A Modest Proposal
by loki＠obscura.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 3:35 PM 10/23/95, Futplex wrote: >Lance Cottrell writes: >> I think one solution to this problem is to encourage (require) the use of >> pseudonym servers. Having a server like alpha as the entity on the from >> line has several advantages. >> >> 1) Less Spam since it takes some effort to set up the nym and it will be >> taken away as soon as the spam starts. > >I fear this will be a short-lived gain. User-friendly scripts for >establishing pseudonymous accounts are pretty easy to write. They may be >beyond the average Fast Money Maker, but I expect myself and others will be >putting them out on the Net for general consumption. One need not automate the process of setting up anonymous accounts. One might also require some sort of exchange before activating the nym to verify that the return address is working. <SNIP> >Semi-permanent account status confers privileges to the user, IMHO. I >believe a pseudonymous account ideally should be treated the same as a >regular account on an ISP. For example, an admin will not unilaterally close >an account upon receiving a single complaint about the account user. >Certainly I don't know of an ISP that routinely blocks its users' accounts >from sending mail to selected other accounts. Lest I seem too presumptuous, >let me say that I realize all immediately foreseeable pseudonymizers are >free services. Clearly these service providers can set whatever policies they >wish, and are not directly competing with the fee-charging ISPs. Perhaps >future fee-charging pseudonymizers will consider these criteria in offering >enhanced services. > >-Futplex <futplex(a)pseudonym.com> I agree. With both free and for-fee nym servers must clearly spell out what actions will result in the termination of the nym. Perhaps 1 spam, 1 systematic harassment, or more than 5 serious complaints per month. Obvious this would need to be tuned to preserve free speech while allowing abusers to be quickly squelched. I would imagine an ecology of these servers would develop with some short lived permissive servers mixed with long lived more restrictive ones. -Lance -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMI8kEfPzr81BVjMVAQF3QAgAh+Q03VU3b69uQqylri/S2EJvfS5MqQ4V JRTZRu8ZQTjb7Ic6KowQXogXG0yAv/GUa6jEWup+fO1omR2t/s7AtXjcFC6du1hh iwSeRw1QVtyspDu6FHAJNL98uG3b0taSHJxfAueA4CA8lZm00vP1exM1A0ndPjXN 6/oM/O5xdUET2tanlpcW2WDdVOZDDGQGvMORlrG8WmJKWebmcg9GnrE5gyZLs3Wr ijze7CccyPLnET4dZiry9Qd/NRx2hgdfkDopTNiTbvmGCXulzqBpqSZ689KDITAK MNgSagZKgOsy7pRGCFSK9EPljZ2IwPtCrE/s9YX0kkJtDhq84SU3EQ== =UBy5 -----END PGP SIGNATURE----- ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

Re: [Noise] Paranoia in the Comics
by Duncan Frissell 17 Dec '03

17 Dec '03

At 11:27 PM 10/25/95 -0700, you wrote: >This has no real crypto relevance, but some anarchistic relevance. > >Sometimes you find anti-government paranoia in the strangest of places... >In the Ziggy strip for 10/25/95, Ziggy is in a Psychiatrist's office. The >shrink is stating "You're afraid of the government, are you? I'm required >to report that sort of thing you know." Ziggy has long been a libertarian/right winger. Note a Sunday strip of a few years ago. Ziggy bends over and looks closely at some red ants who are carrying picket signs reading "Down with Communism", "Freedom Now", etc. Ziggy observes "It had to happen sometime." Since we are being semi-irrelevant here, yesterday's Broom Hilda strip was good for the net "Universal Access" wars. Broom Hilda sits down at a computer to take a ride on the Information Superhighway. The computer says "Sorry, the information superhighway is a toll road." "What's the toll"? "Brains." So Broom Hilda gives up and sets off on a tour of the back roads of America. Note the proof that competition provides better service than government-monopoly Universal Service. After years of being one of the few Local Telcos that charged residential customers metered rates for local calls, NYNEX (New York Telephone) has announced some flat rate pricing plans. Nothing like a little local loop competition. DCF "School Bus Safety - Are your children safe? - Story at 11:00" -- They're safer on the bus than they are when they arrive at their local institution for the mentally/morally defective.

1 0

Re: your mail about Dr. Dobbs CD-ROM. (fwd)
by Cypherpunks Maintenance Account 17 Dec '03

17 Dec '03

----- Forwarded message from Unicorn ----- >From cpunks Fri Sep 12 07:14:53 1997 Message-ID: <19970912124749.42396(a)sequent.com> Date: Fri, 12 Sep 1997 12:47:49 +0200 From: Unicorn <hvdl(a)sequent.com> To: coderpunks(a)toad.com Subject: Re: your mail about Dr. Dobbs CD-ROM. References: <c=US%a=_%p=EDS%l=AUADMEDS001-970911232759Z-1185(a)sg-energy-nt01.sg.eds.com> X-Mailer: Mutt 0.81 In-Reply-To: <c=US%a=_%p=EDS%l=AUADMEDS001-970911232759Z-1185(a)sg-energy-nt01.sg.eds.com>; from Garrard, David on Fri, Sep 12, 1997 at 08:27:59AM +0800 X-Files: The Truth Is Out There! X-Disclaimer: Comments contained do not necessarily represent thoseof my current employer. X-Copyright: Portions of this message may be subject to copyright.(c) 1994-1997 Hans "Unicorn" Van de Looy. Sender: owner-cypherpunks(a)toad.com Precedence: bulk --- On Sep 12, Garrard, David apparently wrote -------------------------------- > Has anyone gotten a copy of the Dr Dobb's Cryptography CDROM outside the > US yet ? Nope. But where did you hear that it was available inside the US already? > David Garrard --- and thus sprach: "Garrard, David" <David.Garrard(a)EXCH.EDS.com> ------------ Ciao, Unicorn. -- ======= _ __,;;;/ TimeWaster ================================================ ,;( )_, )~\| A Truly Wise Man Never Plays PGP: 64 07 5D 4C 3F 81 22 73 ;; // `--; Leapfrog With a Unicorn... 52 9D 87 08 51 AA 35 F0 ==='= ;\ = | ==== Youth is not a time in life, it's a State of Mind! ======== ----- End of forwarded message from Unicorn -----

1 0

Re: Welcome to cypherpunks
by stevenw＠best.com 17 Dec '03

17 Dec '03

>> Why am I getting this when I am already subscribed to the >>list?????? > >Because someone signed the list up to the list...probably inadvertently. >They probably sent something to majordomo with a line like: > >subscribe cypherpunks cypherpunks(a)toad.com > >thinking it actually made sense for some reason...then again they might >have done it on purpose. Well, the Welcome message says this: ->If you ever want to remove yourself from this mailing list, ->you can send mail to "Majordomo(a)toad.com" with the following command ->in the body of your email message: -> -> unsubscribe cypherpunks cypherpunks(a)toad.com So it is but a small leap of logic to remove the 'un' in order to subscribe, since to my knowlege the Welcome message does not tell you how to subscribe. A human interface problem? ------------------------------------------------------------------------- Steven Weller | "The Internet, of course, is more +1 415 390 9732 | than just a place to find pictures | of people having sex with dogs." stevenw(a)best.com | -- Time Magazine, 3 July 1995

1 0

Re: Court proceedings under new SAFE act
by John Young 17 Dec '03

17 Dec '03

Lucky Green asked about judges of the FISA court, and Declan named Joyce Green. The Chief Judge of FISA is Royce Lambert, who gave talk on C-SPAN about the operation of the court at an ABA conference in D.C. a few months ago. He made the point that few applications for electronic surveillance are turned down by the court (of 8,000 applications 12 were denied) because the judges coach the applicants until they get a request right. And that the DoJ teams are quite adept at complying with the court's requirements, because all pass muster first of a special office set up for that purpose. Judge Lambert said the job is "a lot of fun" because its deals with supremely critical events of national urgency, and that all the judges involved really do like it, especially the secrecy and prestige of being part of one of the most exclusive groups in Washington. This is not a joke. Indeed, the Chief joked that the court's role "may be constitutional." And then said that he'll probably get in trouble for the statement. For how the snoop system is supposed to work see the Foreign Intelligence Suveillance Act: http://jya.com/fis.htm (107K)

1 0

Re: CJR returned to sender
by Richard.Johnson＠Colorado.EDU 17 Dec '03

17 Dec '03

Michael Froomkin wrote: >I agree strongly with Tim May that this (fun) little joke has gone far >enough. I enjoyed it while it lasted, but the CJR was clearly frivolous, >the T-Shirt was clearly not a munition, IMHO, and that's that. Write up >the experience, post it on the web somewhere (I'll provide a space if you >need it), and call it a day. The CJR for the t-shirts was not frivolous. Not in the least. Letting the NSA/Dept. of State off the hook on this one leaves them with wiggle room. The goal of filing these CJRs is to find out just where the NSA/Dept. of State draw their lines, and to _force_ them to draw lines where they'd rather retain flexibility. At the very least, we can point out the rather strange ideas they have about what constitutes speech, for the PR value, during the splashes of media attention silly CJR rulings generate. Even more useful: other things remaining equal, a rigid agency is safer to deal with than one that retains the flexibility to selectively harrass. Richard

1 0

Re: Fred, Fred, Fred: Enough already!
by James A. Donald 17 Dec '03

17 Dec '03

At 11:58 AM 10/24/95 -0400, Robert Hettinga wrote: > Can we please talk to Dr. Fred, the Poster Child of the Informal Fallacy, > if we *really* have to, off line? Yes, please, will everyone please killfile Dr Fred. I am tired of seeing things that are glaringly obvious explained in painful detail to someone who is reluctant to understand them. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0