December 2003 - cypherpunks-legacy

Re: NIST GAK meeting writeup, LONG part 3 of 3
by Andrew Loewenstern 17 Dec '03

17 Dec '03

Pat Farrell writes in his report on thi NIST GAK meeting: >>Geoff said that they may want legislation support for >>protecting against illegal release of keys, failure to release, etc. Jim Bell Responds: > Pardon me, but since this "key escrow" system was always claimed > to be "voluntary," then how can there be any kind of legal penalties > associated with "failure to release" those keys? well, since the subject at hand is Escrow Agent Criteria, "Geoff" is probably talking about the failure of an escrow agent to release a key upon production of "lawful authorization" .... andrew

1 0

DES Cryptanalysis
by Kevin L Prigge 17 Dec '03

17 Dec '03

I'm looking for pointers, or perhaps an explanation of the statement I found in Applied Cryptography (section 9.6) where it implies that if the IV is not unique in CFB mode, the cryptanalyst can recover the plaintext. The reason that this interests me is that I have a file, encrypted with DES in CFB mode. I believe I know the first 8 bytes of plaintext and I also know the IV used. While it'd be nice to decrypt this file, I don't know that it'd be worth brute forcing the key, even if the spare cycles to do it were available. Any pointers to any pertinant information would be appreciated. Thanks. -- Kevin L. Prigge |"A computer lets you make more mistakes faster UofM Central Computing | than any invention in human history--with the email: klp(a)umn.edu | possible exceptions of handguns and tequila." 01001001110101100110001| - Mitch Ratcliffe

2 1

Re: NIST GAK meeting writeup, LONG part 3 of 3
by jim bell 17 Dec '03

17 Dec '03

At 11:04 AM 12/10/95 -0800, you wrote: > >NIST Key Export meeting, December 5, 1995 Long version >Part 3 of 3. > >This covers the notes on agent criteria, and the >industry presentations. > [stuff deleted] > >Geoff said that they may want legislation support for >protecting against illegal release of keys, failure to release, etc. Pardon me, but since this "key escrow" system was always claimed to be "voluntary," then how can there be any kind of legal penalties associated with "failure to release" those keys? Which raises another question: Let's suppose I owned a product based on CKE, and I went to the escrow agent and said, "This escrow is voluntary, right? If so, erase my key in your possession." Not that I'd trust them to do so, but how "voluntary" can a system be if people can't volunteer out of it?

1 0

Re: GAK and self-incrimination?
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:57 AM 12/10/95 -0800, you wrote: >The Fifth protects you against *compelled* self-incrimination - in >particular, the right to be free from the "cruel trilemma" of > > o conviction of a substantive crime, based on your > (true) testimony > o conviction of perjury, for lying when asked to incriminate > yourself > o contempt of court sanctions, for refusing to answer Testimony was often compelled by more direct means than threatened contempt citations. Piling rocks on people until they talked was still in use in the 1600s, unless I've got my dates wrong. It may have gone out of fashion slightly after witch-burning, but was still in recent cultural memory of the Constitution's authors. #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

2 1

The origin of some heavy legal terms
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:10 PM 12/11/95, Black Unicorn wrote: >The term 'pressing a defendant for a plea' came from the practice of >piling heavy weights on a defendant and 'pressing' him into the very >floor of the court. (As defendants who did not admit a plea would save >their family from being held accountable to judgment, the incentive to >remain silent was high). Often weight was piled atop the hapless >defendant until he or she expired, having refused to enter a plea. Modern courts have replaced the rocks used in earlier days with law books, of course. The need for heavy law books to press the accused is one of the main reasons electronic versions are not being adopted. This practice also gave us the term "the full weight of the law" as well as the symbol of the law as being a blind woman carrying a scale filled with rocks to place upon the guilty to convince them to confess. (This was originally done in the court's torture chamber, from which we get the term "judge's chamber.") Sometimes the "scales of justice" can be "tipped," which derives from the practice of tipping the judge to get favorable rulings. --Tim "Not a Lawyer" May

1 0

Re: [NOISE] GAK and self-incrimination?
by Ed Carp (ecarp＠netcom.com) 17 Dec '03

17 Dec '03

> Date: Mon, 11 Dec 1995 09:01:40 -0500 > To: Bill Stewart <stewarts(a)ix.netcom.com> > Subject: Re: [NOISE] GAK and self-incrimination? > From: tallpaul(a)pipeline.com (tallpaul) > Cc: cypherpunks(a)toad.com > If I'm not guilty why do I want strong crypto? Sometimes for the same > reason I want a shredder. And why do I want a shredder? Sometimes just to > keep the local gossip from going through my papers after I throw them out. Another, not-so-obvious reason to encrypt stuff, especially stuff that goes out over the net, is that folks can suck your email off the net and gather all sorts of useful information. This has all kinds of annoying implications, especially for people who gather demographics and other data for constructing email lists for sale. -- short ed

1 0

Re: Time-based cryptanalysis: How to defeat it?
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:56 PM 12/10/95 -0800, anonymous-remailer wrote: >Assuming Alice is decrypting a secret message sent to her >by Bob (on her very slow C64 ;), and Mallet is watching >with a stopwatch in hand, hoping to determine Alice's secret >key... The modern equivalent of that very slow C64 is the smartcard/ electronic wallet. Sounds like we'll have to implement them very carefully.... >It would be good to place inside the decryption routines >a timer (WELL PLACED!) that waits a random-number of cycles >(based on key-strokes, mouse position, etc.) to defeat this >type of cryptanalysis? The most interesting detail in the paper, to me, was: PK> Computing optional Ri+1 calculations regardless of whether the exponent PK> bit is set does not work and can actually make the attack easier; PK> the computations still diverge but attackers no longer have to identify PK> the lack of a correlation for adjacent zero exponent bits. My immediate reaction to the description of the timing attack on Diffie-Hellman had, of course, been to do precisely that :-) #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

2 1

Third generation privacy
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Dec 11, 1995 13:07:22, '"Ed Carp (ecarp(a)netcom.com)" <khijol!netcom.com!ecarp>' wrote: > >Another, not-so-obvious reason to encrypt stuff, especially stuff >that goes out over the net, is that folks can suck your email off the >net and gather all sorts of useful information. This has all kinds >of annoying implications, especially for people who gather >demographics and other data for constructing email lists for sale. > >-- short ed > Another related issue is what I'll call "third generation" privacy. This exists when I want privacy not for myself or even the person with whom I'm communicating but to protect the privacy of innocent third parties. E.g.: Grandpa is getting senile and I'm communicating with a second family member on how we should handle the problem; My friend Jane was just raped and I'm communicating with a mutual friend about how we can help her. The anti-freedom forces have tried to define the parameters of the debate inside the boundaries of the "four horsemen." We need to understand that we do not have to remain within those false boundaries and, in fact, it is very good not to. --tallpaul

1 0

Re: NIST GAK meeting writeup, part 3 of 3
by Pat Farrell 17 Dec '03

17 Dec '03

I appologise to the list for the character mangling in the original posting. I wrote it in Word so I could spellcheck it, and I couldn't turn OFF the idiotic smartquotes. I've placed a cleaned up, fewer typo, and hyperlinked version out on my NIST page, http://www.isse.gmu.edu/~pfarrell/nist/pdf.nist2.html jim bell <jimbell(a)pacifier.com> writes: >> Geoff said that they may want legislation support for >> protecting against illegal release of keys, failure to release, etc. > Pardon me, but since this "key escrow" system was always claimed to be > "voluntary," then how can there be any kind of legal penalties associated > with "failure to release" those keys? It was Geoff G. talking, not Mike Nelson or Ed Appel. The difference is critical. Mike and Ed have some political savvy. My best friend Geoff does not. I believe that Geoff has never bought into "voluntary" as a concept. EPIC successfully FOIA'd papers from the FBI saying that they will change their tune when/if there isn't sufficient compliance. Mike and Ed are political enough to know that they can't sell this if they push too hard. Geoff isn't. The podium had a light that showed green/yellow/red lights. These let the speakers know how much time was left. For the morning, since only NIST/NSA/FBI/... folks talked, they didn't bother to reset the light. It was red all the time, altho it blinked occasionally. Ed took the mike, and asked "what is the red light for? Does it glow red whenever someone from the Government is lying?" It got a good chuckle. It was probably also close to being true. Ed and Mike understand the audience, Geoff never will. > Which raises another question: Let's suppose I owned a product based on > CKE, and I went to the escrow agent and said, "This escrow is voluntary, > right? If so, erase my key in your possession." > > Not that I'd trust them to do so, but how "voluntary" can a system be if > people can't volunteer out of it? It isn't voluntary for export approved software. The word voluntary is not in the criteria. It is only voluntary if domestic users foolishly choose to buy GAK'd products. So don't! Criteria #2 says "...cryptographic functions shall be inoperable until the key(s) is escrowed in accordance with #3." Worse, IMHO, is criteria #9, which states " ... cryptographic functions shall interoperate only with key escrow cryptographic functions in products that meet these criteria..." The interoperability issues stayed muddy. The government didn't spend much effort making it clearer. The karma seemed to be that if you had two products, say Webscape 128 and Webscape 64/Gak, selling 128 domestically and 64/GAK exported, that you can't make Webscape128 interoperate with 64/GAK unless the Webscape128 keys are GAKed. Part of this is burried in agent criteria #6, "6. Escrow agent entities that are certified by the U.S. government shall work with developers of key escrow encryption products to develop and support a feature that allows the product to verify to one another that the product's keys have been escrowed with a U.S.-certified agent." Looks to me like the software has to chase up the chain of certification authorities (or escrow authorities if you prefer) before it can work. Pat Pat Farrell Grad Student http://www.isse.gmu.edu/students/pfarrell Info. Systems & Software Engineering, George Mason University, Fairfax, VA PGP key available on homepage #include <standard.disclaimer>

1 0

Re: Re[2]: Timing Cryptanalysis Attack
by David E. Smith 17 Dec '03

17 Dec '03

At 10:30 PM 12/11/95 CST, Martin Diehl wrote: > OTOH, maybe we _should_ try for constant computation time and then try > for *random* delay time. Remember that _we_ will spend a lot of real > time arguing whether the *random* delay is really _random_ Does it necessarily matter whether the random delay time is true-random? The idea is to obfuscate the time of the whole computation. As long as you don't base your random numbers on the system clock, it should serve its purpose. (I omit the system clock because timing seems to be the nexus of the whole attack, so we can safely assume that the clock's data, and thus its source of "randomness," can be predicted. ----- David E. Smith, c/o Southeast Missouri State University 1210 Towers South, Cape Girardeau MO USA 63701-4745, +1(573)339-3814 PGP ID 0x92732139, homepage http://www.midwest.net/scribers/dsmith/ Quote: "And if we change, well, I'll love you anyway" - Alice In Chains Dec15-Jan15: (618)244-3340/2209 Perkins, Mt Vernon IL 62864

1 0