December 2003 - cypherpunks-legacy

Re: /dev/random for FreeBSD [was: Re: /dev/random for Linux]
by tomw＠orac.engr.sgi.com 17 Dec '03

17 Dec '03

In article <DHEtE6.FB6(a)sgi.sgi.com>, Mark Murray <mark(a)grondar.za> writes: >> ? "Gut feel" suggests to me that large ammounts of "predicted" input might >> be worse than the normal sort of system noise you have been using. >> >> But keep in mind that what we're doing is XOR'ing the input data into >> the pool. (Actually, it's a bit more complicated than that. The input >> is XOR'ed in with a CRC-like function, generated by taking an >> irreducible polynomial in GF(2**128). But for the purposes of this >> argument, you can think of it as XOR.) So since you don't know what the >> input state of the pool is, you won't know what the output state of the >> pool. > I chatted with a colleague at work, and he helped bend my mind right. > I had the mistaken notion that adding lots of data would "overflow" > and "dilute" the entropy to an attackable state. I think the problem is not merely flooding the device with non-random input data. If you coordinate sucking out entropy with feeding in non-random data you can suck the real entropy in the system down to zero while making the driver think it has plenty of randomness. While it's not clear to me how this would lead to an attack, it would be worrisome. -- Sure we spend a lot of money, but that doesn't mean | Tom Weinstein we *do* anything. -- Washington DC motto | tomw(a)engr.sgi.com

2 1

Re: FBI seeks huge wiretapping system
by Jay Campbell 17 Dec '03

17 Dec '03

>I was being facetious. The point is that the government has no >inherent right to tap our phones -- indeed, it didn't do so for nearly >the first 200 years of our existance, and we did just fine -- better, >in fact. It is a well-known fact that it was common practice for NSA operatives to masquerade as Injuns in the 1800's and waylay Pony Express riders in order to intercept communications between targeted parties. This practice lost popularity towards the end of the century with the advent of boxed cereal, and with it the Lone Ranger Decoder Ring, since the operatives were too underfunded to afford anything more than oatmeal. [ducks] -- Jay Campbell edge(a)got.net - Operations Manager -=-=-=-=-=-=- Sense Networking, Santa Cruz Node Jay(a)Campbell.net got.net? PGP MIT KeyID 0xACAE1A89 "On the Information Superhighway, I'm the guy behind you in this morning's traffic jam leaning on his horn."

1 0

Re: Radiation Detectors from Aware Electronics
by usura＠berserk.com 17 Dec '03

17 Dec '03

sharborth(a)hai-net.com writes in an followup to perry(a)piermont.com: .... :: There have been several requests for information on the company that :: makes the radiation detectors with RS232 interfaces that I mentioned. [..] :: Perry : : So what does this have to do with this mailing list?? : Skip The cypherpunks mailing list has a lot to do with cryptography, an important element of cryptography is randomness one way that seems to be a superior source for obtaining random data is radioactive decay, radiation detectors wich have an RS232 interface can be hooked up to an computer and thus act as a source of randomness. -AJ- -- kill -9 hkk(a)netcom.com .. process killed .. lawyer terminated successfully

1 0

Risks of ``foreign persons'' under the ITAR
by Peter D. Junger 17 Dec '03

17 Dec '03

It is usually assumed that a foreign person outside the United States runs no risks if he posts cryptographic software to the net or otherwise discloses it to other foreign persons, although technically that is a violation of the United States International Traffic in Arms Regulations. I note, however, that in an article entitled ``Export Controls on Encryption Software'' by Ira S. Rubenstein, dated October 17, 1994 (which apparently was distributed at some legal conference) the following passage appears in Section 4(3): ---------------- Finally, foreign employees of those companies or any foreign person who runs afoul of export controls on technology transfers may face severe immigration consequencs.[83] Under the Immigration and Nationality Act,[84] as revised by the immigration act of 1990,[85] an alien who seeks entry to the U.S. to engage in activities that violate or evade export control laws is excludable.[86] Similarly, an alien who has engaged, is engaged, or at any time after entry engages in such activities is deportable.[87] [Notes] [83] For a detailed discussion see generally Rubinstein, ``Export Controls and Immigration Law,'' 93-3 Immigration Briefings (Mar. 1993). [84] Immigration and Nationality Act of 1952, Pub. L. No. 82-414, 66 Stat. 163 (codified as amended at 8 USC \S\S 1101-1524) (hereinafter INA). [85] Immigration Act of 1990, Pub. L. No. 101-649, 104 Stat. 4978 (hereinafter IMMACT 90). [86] INA \S 212(a)(3)(A)(i)(II), 8 USC \S 1182(a)(3)(A)(i)(II). [87] OMA \S 21(a)(4)(A)(i), \S 1251(a)(4)(A)(i). -- Peter D. Junger--Case Western Reserve University Law School--Cleveland, OH Internet: junger(a)pdj2-ra.f-remote.cwru.edu junger(a)samsara.law.cwru.edu

1 0

Re: What!!!
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:25 PM 11/2/95, tony266(a)vabeach.email.net wrote: >Can someone tell me this cypherpunks is all about??? Grammar not best subject his. List sense make after read for time. --Klaus! More seriously, when you subscribed you undoubtedly got a "Welcome" message. I suggest you read it. Reading topics that interest you on the list is the best way to learn what it "is all about." The Cypherpunks list archives and Cyphernomicon are also useful. They are in various places, including these Web sites: http://www.hks.net/cpunks/index.html http://www.oberlin.edu/~brchkind/cyphernomicon/ --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

RE: Info needed on observers
by ljo＠ausys.se 17 Dec '03

17 Dec '03

>I am currently preparing a paper on payment systems for the Internet >and related issues. I recently found out that so-called observers could >be placed on smart cards (in order to prevent double spending, or even to >prevent people from cheating on taxes...). > >To be honest that's about all I know about observers and I am very eager >to find out more. I am, however, having a hard time finding interesting >references on this subject. > >Hence, all suggestions to get me started would be extremely welcome. >Questions of particular interest are: possible functions (and limits), >how 'real' are they already?, what about privacy?, ... > >Many thanks in advance. Leo, The concept 'Wallet (Databases) with Observers' was introduced by David Chaum and Torben Pryds Pedersen at Crypto '92. See the proceedings of that conference. Put shortly, it is a method of preventing double spending of digital cash, stored on a smart card, and still provide full payer anonymity. Since then, others have worked on improving the original protocol, e.g. Ronald Cramer, Niels Ferguson and Stefan Brands. In particular the system by Stefan Brands have drawn much attention since it was said to offer "provable security". It is his protocol that is used in the european project CAFE. In CAFE, each user is thought to have a PDA (Personal Digital Assistant) which stores the digital cash. The observer is a smart card that has to be inserted into the PDA in order to spend that cash. I don't know how far this project has come, implementation wise but I think another project, called SWAP was about to test these electronic wallets in practise. Regards, /Lars Johansson ljo(a)ausys.se

1 0

Re: Radiation Detectors from Aware Electronics
by sharborth＠hai-net.com 17 Dec '03

17 Dec '03

So what does this have to do with this mailing list?? Skip ______________________________ Reply Separator _________________________________ Subject: Radiation Detectors from Aware Electronics Author: perry(a)piermont.com at internet Date: 02-11-95 23:45 There have been several requests for information on the company that makes the radiation detectors with RS232 interfaces that I mentioned. Here is how to reach them: Aware Electronics P.O. Box 4299 Wilmington, DE 19807 Phone (800) 729-5397 (302) 655-3800 Perry

3 3

Re[2]: Radiation Detectors from Aware Electronics
by sharborth＠hai-net.com 17 Dec '03

17 Dec '03

Perry - Sorry for the rude question. I have been following this thread closely but must have missed the original message regarding using radiation detectors to produce random numbers. Skip ______________________________ Reply Separator _________________________________ Subject: Re: Radiation Detectors from Aware Electronics Author: perry(a)piermont.com at internet Date: 03-11-95 09:23 sharborth(a)hai-net.com writes: > So what does this have to do with this mailing list?? Generating good random numbers is key to operating a solid cryptographic system. I've argued that computer interfaced radiation detectors are the optimal way of generating such numbers because they are hard to screw up -- biased diode noise and other sources are too easy to misdesign or misuse. Aware is a source of such detectors. Perry > There have been several requests for information on the company that > makes the radiation detectors with RS232 interfaces that I mentioned. > > Here is how to reach them: > > Aware Electronics > P.O. Box 4299 > Wilmington, DE 19807 > Phone (800) 729-5397 > (302) 655-3800 > > > Perry > >

1 0

Bruce Schneier's Applied Cryptography, 2nd Edition
by norm＠mediacity.com 17 Dec '03

17 Dec '03

Stanford University Book Store (om compus) has a bunch at about $49.

3 2

Kallstrom Calls All Calls Tappable
by John Young 17 Dec '03

17 Dec '03

11-3-95. Wash Post: "Privacy Groups Assail FBI's Wiretapping Plan" [Excerpt] James Kallstrom, assistant FBI director in charge of the New York field division, argues that the proposal would in fact reduce the FBI's surveillance authority. "Today ... we could tap all the phones in the United States," he said, referring to older, pre-digital technology. Under the plan, the FBI's surveillance ability would shrink to a maximum of 1 percent of simultaneous telephone calls from any one telephone switch, he said. Kallstrom said a typical central switching office in New York that serves 50,000 telephone lines has a capacity to carry only 5,000 calls simultaneously. It is the latter number, not the former, he said, on which the FBI bases its calculations. So the highest level of simultaneous surveillance in that area, he said, would be 50 lines. "We've never done that many" taps at one time, he said. But in a "worst-case scenario," such as a major act of terrorism, the agency might need such ability, he said. "I think it's a reasonable, minimal, conservative number."

3 2