December 2003 - cypherpunks-legacy

Article requests
by Tim Philp 17 Dec '03

17 Dec '03

I have received many requests for the articles that I wrote on Cryptography so I will post them to the list with the subject "ARTICLES" Regards, Tim Philp =================================== For PGP Public Key, Send E-mail to: pgp-public-keys(a)swissnet.ai.mit.edu In Subject line type: GET PHILP ===================================

1 0

MD4 collision
by norm＠netcom.com 17 Dec '03

17 Dec '03

Hans Dobbertin in Germany has found two messages to which MD4 assigns the same hash.

1 0

ARTICLES
by Tim Philp 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Copyright (C) 1995 Tim Philp Brantford, Ontario Canada Article appeared in The Expositor, Brantford, Ont., Canada June 10th, 1995 - COMPUTER CRYPTOGRAPHY - - PROTECTING YOUR PRIVACY - by Tim Philp Last week I discussed ways that the computer has made our lives less private. Today we take up that thread and talk about the stuff of spy novels.Cryptography, in the context that we are discussing it, is a means of preventing unauthorized people from reading our files or correspondence. Cryptography is not new. It has been used throughout history and has played its part in shaping events. Mary Queen of Scots was beheaded because the cipher that she used to arrange a rebellion against Elizabeth I was decoded by the government. Julius Caesar used a primitive cipher, now known as a Caesar Cipher, to disguise his messages to Rome during his military campaigns. Every letter in his messages was replaced by the letter three letters farther in the alphabet. Thus A would become D, B would become E, until you reached the end of the alphabet. You would then wrap around to make X equal to A, Y equal to B and Z equal to C. In this way the word CAESAR would become FDHVDU. Simple substitution ciphers like this one are easily broken and today are used in puzzle books to provide a few moments diversion to puzzle fanciers. The role of computers in cryptography goes back to the early days of computers. One of the first computers was used to help decode enemy messages in England during the second world war. The 'boffins of Bletchley' were the true progenitors of the computer, not IBM. Cryptography has progressed far beyond the simple Caesar Cipher. Indeed, today's methods of encoding messages have progressed to the point where the ciphers are unbreakable within any reasonable amount of effort. It does no good to break a cipher if it takes 1500 years of computer time to do it! Of interest to computer users is the development of a type of cryptography called Public Key Cryptography. With this method you have two keys, a public key and a private key. Simply speaking, a key is a very long number that is used by your program to encode and decode messages. Each person that you want to communicate with has a public key that is published and is known by everyone. To send a message to your friend you would use his public key to encode the message. Your friend receives the message and uses his private key to decode the message. The beauty of this technique, is an eavesdropper can intercept the encoded message and the public key of the recipient, but he cannot use this information to decode the message without the secret key of the recipient. In older systems you had to transmit the secret key to the recipient. The secret key could be intercepted and used to decode the messages. Public key systems require that only the public key be transmitted to the recipient. The message cannot be decoded using only the public key and the message. The availability to the general public of secure, military grade cryptographic methods has generated considerable controversy. The US government has placed this software under export control and has suggested the use of their own system called Clipper. Clipper has a 'backdoor' that will allow the government to decode secret messages. They claim that they need this power to combat drugs and crime. Civil libertarians claim that the government has no business intercepting private communications. Cryptography can be used to protect E-Mail messages and computer files. The software to do this is freely available on the Internet (search for PGP). The US government, it seems, is locking the barn door after the horses have escaped. This file may not be reproduced by any means without the permission of the author -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBMHM8unseeMISF+fVAQFesQP/YxFgW3BAjnvDCMU4SfksgpKLEGMDMv9M YQpn/0BqUZSUnO3yye1bIN5KsDofePaCd6PcE6RcnvZJTBVu9PiZvxiBkr/a76wf 5Ft+F4p2tH0gxPunXZyjDqEnfHDcXY+X0FM7JgmeMyjDxzbq6GIqEX7gLoPAszwp Ayu4jIl2smg= =76yF -----END PGP SIGNATURE----- =================================== For PGP Public Key, Send E-mail to: pgp-public-keys(a)swissnet.ai.mit.edu In Subject line type: GET PHILP ===================================

1 0

ARTICLES
by Tim Philp 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Copyright (C) 1995 Tim Philp Brantford, Ontario Canada Article appeared in The Expositor, Brantford, Ont., Canada Sept 9th, 1995 - THE CODEBREAKERS - by Tim Philp A couple of weeks ago an extraordinary event took place that has implications for all users of the Internet. A group on the Internet, who call themselves CYPHERpunks, ran a test of a code system that was considered uncrackable in any reasonable amount of time. This in itself was not the extraordinary event. This code was broken by the cypherpunks in only 31.5 HOURS! That's right, hours. This code, called SSL used a 40 bit encypherment key with 1,099,511,627,776 possible combinations. To give you an example of just how incredible this feat was, let's examine the security of this code. If you were to try 1 key per second it would take you just over 34,841 years to try them all. That is almost five times longer than all of recorded history. How was this done and what does this mean to users of the Internet? The how part is simple to explain, the meaning will be more difficult to divine. The security of a code must rely only upon the key used to encipher the plaintext. It is assumed that the method of encryption is well known, as indeed it would be if it were used in a commercial product. Someone would disassemble the code and figure out the method. It is for this reason that security cannot reside in a secret means of encypherment. SSL is one such code. This group, the Cypherpunks, wrote a program that would try keys in sequence and then they distributed it to the Internet community. They then set up a central computer that people all over the world could call into and get assigned a group of keys to try. These people would then feed these keys into the code cracking program and report the results to the central computer. With hundreds of users taking part, using computers that were sitting idle at nights running screen savers, they cracked the code in 31.5 hours. One of the greatest arguments against people trying this kind of brute force attack on codes, is that the computer time and power required would cost the earth. In actual fact, this successful attack cost nothing at all as the computers used were sitting idle. Everything from little 286 PCs to mini-computer workstations were pressed into service labouring long over the weekend tirelessly trying one possible key after another until they cracked the code. Because this was an academic excersise, there was no harm done. The purpose was to prove how quickly a 40 bit code could be cracked. I confess to be astounded at just how fast this was accomplished. This points out two remarkable possibilities for the new communications technology that we are only now beginning to use. If that code were protecting sensitive information, such as a bank funds transfer, this group could be very rich. It does also point out a new way of using the Internet to solve problems that have long eluded solution because of the shear computational size of the problem. If the problem were to be divided up into small chunks and given to hundreds of computers worldwide, solution may become possible. We are just beginning to understand the possibilities. This file may not be reproduced by any means without the permission of the author -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBMHM8znseeMISF+fVAQEGzgP+L+JQfTSZ1un83/oh2g/5Nthw3tiHVtb9 eDiOtuzvuQiLxMO/SUPnjM5cXlSYhTNCN8wF49IXEO5Istg58oIA8wf4MPr8aDML dsK8h34rBQqVXjaxC9staKtKnTGLfZFLmKGwRShLJECgs6Bzqu25TptSYIa8RRGk ncYhNj6Lalc= =RE7O -----END PGP SIGNATURE----- =================================== For PGP Public Key, Send E-mail to: pgp-public-keys(a)swissnet.ai.mit.edu In Subject line type: GET PHILP ===================================

1 0

The Evolution of Cooperation (Towards a mathematical theory of reputation?)
by norm＠netcom.com 17 Dec '03

17 Dec '03

I highly recommend Axelrod's short book, The Evolution of Cooperation, for those (like me) who find it hard to think clearly about trust issues. You have probably heard about prisoner's dilemma, tit-for-tat etc. Axelrod is a very early worker in this field. He set up a tournament of programmed bugs that competed with each other in an artificial environment. They could survive only by cooperation with other bugs. The could also cheat. Axelrod does not use the term "reputation" but it what one bug gains or looses as it interacts with other bugs in iterated encounters. I read the book about two years ago. Only last night did I realize that those ideas helped me think about the MITM threat.

2 1

Comments on STT Spec Implementation Details
by Rick Johnson 17 Dec '03

17 Dec '03

Hi All - Last week our team published jointly with Visa the STT specification. Since then, we've received some comments that the wire formats and protocols section for STT have not been complete enough for developers to implement. We're very interested in feedback and specifics on this. We worked to keep _only_ the detail we felt required to implement STT -- the language is intentionally terse. However, it is in everyone's best interest that the STT spec is completely understood and implementable. We want your participation in this. We've set up an alias direct to our team to respond to your comments: stt(a)microsoft.com Non-technical flames direct to: Rick - aka - Rick Johnson rickj(a)microsoft.com

2 1

Re: Netscape finally issuing md5sums/pgp signed binaries ? (was Re: NetScape's dependence upon RSA down for the count!)
by Rich Salz 17 Dec '03

17 Dec '03

You might want to look at BETSI which was created to do this kind of thing, too. Check out http://info.bellcore.com/BETSI/betsi.html

1 0

Re: NYT: WWW Usage Monitoring for Marketing
by Eamon Daly 17 Dec '03

17 Dec '03

On Tue, 03 Oct 1995, futplex(a)pseudonym.com (Futplex) wrote: [snip] >In his regular Advertising column, Stuart Elliott discusses the presentation >of a report on the problem of "assuring accurate and comprehensive measurement >of consumer exposure to advertisements that appear in interactive media like >World Wide Web sites and on-line services." [snip] Could someone please scan this article and post it to the list, or email it to me? Thanks. Eamon Daly eamon(a)cosc.canterbury.ac.nz

1 0

New Windoze PGP Shell (freeware) worth checking out
by Adam Philipp 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- AEgis Research (who I know nothing about) has come out with a very pleasant windows fron end for PGP. It is bone-head compliant, and even works well in Win95. I'm only plugging because I was so impressed. Until Eudora has PGP hooks, this is my shell of choice. Adam Philipp -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMHJgjm/ZTaRmpgTFAQGp+wf7BO36FpbAdLdDieORKldIe3MvPa8wUDpR Rax38rxSP+aeR0toqtuldmWpfV5I+p40d+6pgWVfOKegS38Qt3k6rEt3r7C++Efi PQZLOE3b4RHT5ZeS4klEZtwu1A8nTWMVZFkwcxTb6s+C3KYv9JxdXFHnrOPlnkcL 5AJhUDvznMnA1WhKmknNjXhGJH9FKtvNuTO/k1fmD6YwclqAbKBiuGwQduWqZfwI 0zGZlpSfbuZ6sCsbHFnw1wJIOONyAEr1dB5qhyV3rX00hm6KfSNsuGqwvlDhaOM9 lODlFwBVt+PJIRHVocCcCdp7/5ffE/hTIXoRNYYF0kcZTotJP05SXg== =fvcQ -----END PGP SIGNATURE----- --=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\ |PGP key available on my home page|Unauthorized interception violates | | http://www.rosa.com/~adam |federal law (18 USC Section 2700 et| |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-|seq.). In any case, PGP encrypted | |SUB ROSA: Confidential, |communications are preferred for | |secret, not for publication. |sensitive materials. | \-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-/

3 2

Re: More forged cancels
by A.Back＠exeter.ac.uk 17 Dec '03

17 Dec '03

[someone crossposting to a ton of alt groups about spam, the headers: Newsgroups: news.admin.net-abuse.misc, soc.culture.german, soc.culture.jewish, rec.radio.shortwave, alt.2600, mail.cypherpunks, ^^^^^^^^^^^^^^^^^ alt.privacy.anon-server, alt.stop.spamming, alt.stop-spamming] It's started already. This is because of "mail.cypherpunks" in the huge newsgroup line? A news to mail gateway pointing at cypherpunks(a)toad.com? Any chances of disabling this before it gets out of hand? Who runs the gateway(s)? Make it read only please! Or change the gateway so it doesn't forward if there are other groups on the newsgroup line or something. Adam

1 0