December 2003 - cypherpunks-legacy

IDEA encryption
by Ben Holiday 17 Dec '03

17 Dec '03

The copy of the source for idea (unix) that I have specify's a user key length of 8 bytes, but allows this to be increased to something larger. Will increasing the user keylength improve the overall security? Also, is it worth hashing the user key first, then using the hashed key as the key for encryption and decryption? Or am I wasting my time? Last thing -- how secure is unix "rm"? If something is rm'd, is it really really gone? Thnks..

3 3

Re: What ever happened to... Cray Comp/NSA co-development
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 10:32 PM 12/17/95, Anonymous wrote: >What caught my attention was the architecture. > >A "hybrid design linking two supercomputer processors with an >array of HALF A MILLION inexpensive processors" that were >designed by the U.S. government laboratory affiliated with the >NSA. The same chip house that brought us Clipper. First, half a million chips is not that big a deal...the Connection Machine had up to 64,000. Very few cryptographic problems of interest to us will be affected by a mere factor of a million or so. Second, there was work on a "processor-in-memory" architecture, in conjunction with a Bowie, Maryland spook-connected company. Perhaps this is what you are thinking of? Third, all avenues of continued funding having fallen through, Cray Computer (not Cray Research, of course) was shut down and assets liquidated. I haven't heard what's become of Seymour, though. (He is undoubtedly an asset, buy I doubt the Agency would have him liquidated.) >I've not kept up with the "ultimate" demise that eventually >befell Cray Computer Company, but the October 16 FBI filing >on capacity for Digital Telephony got me thinking back to this >article. 1% seems like a rather huge need for horsepower. And >what if GAK doesn't fly? And the widespread use of hard crypto >just keeps increasing? The tightly-coupled supercomputers are hardly needed for these sorts of problems. >This kind of machine could, in theory: > >1) Implement ALL Clipper(II) based Key Escrow functionality in > silicon (the easy part) AND allow for simultaneous decrypt and > surveil of 'who knows how many' Clipper based data streams. Huh? First, what evidence do you have for this claim? Second, who cares? Implementing Clipper in a Cray Computer machine--why bother? As to the claim that a million-processor machine could do this, you need to work out the math. (If a backdoor exists, or the LEAF has been gotten, a supercomputer is not needed....) >2) Implement general RSA based Prime Factoring functionality in > silicon (the not so easy part) AND allow massively parallel > decrypt and surveil of 'who knows how many' RSA/etc. based > data streams. Prime Factoring? Primes are easy to factor, of course. (Hint: Every prime has two factors.) If you mean using supercomputers to brute force the general factoring of an RSA modulus, this is nonsense. While there may be math shortcuts we don't yet publically know about which make factoring easier than we currently think it is, a mere million or even a billion processors will not make a dent in the factoring of, say, a 700-digit modulus. See the tables in Schneier and elsewhere for some estimates of factoring efforts needed. >3) Implement it all, AND 'on-line' transaction based surveillance > via the FBI's 1% capacity infrastructure. Let's see some numbers. (On second thought, let's not.) >Chilling... Who needs key escrow (or RSA private keys) when >you've got a massively parallel prime factoring machine. What if >GAK was to become a 'non-issue'? How fast do you think a machine >such as this could factor RSA 129? Well, do the math. The MIPS-years for the RSA-129 crack were publicized, so the computation for a million SPARC-equivalent (or even UltraSPARC-equivalent) can be done. When you've done this, and concluded that RSA-129 could be done in, say, X minutes, then move on to RSA-384 (the BlackNet key cracked by the MIT group), and on to the 1024- and 2048-bit keys. Tell us how many years or centuries it will take. (Hint: Rivest and Schneier have done these calculations....) --Tim May, who fears that he's just been trolled by Derek Atkins Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

6 5

2 websites
by prf＠teleport.com 17 Dec '03

17 Dec '03

Interested in Term Limits? See http://www.termlimits.org Grass Roots Research's "Portrait of America" at http://www.grr.com Paul R. Farago, Portland OR

1 0

redirect of newsgroups
by David Klur 17 Dec '03

17 Dec '03

For those of us sitting behind a firewall that blocks out all of the alt, rec, etc.. newsgroups...is there another way to access these groups? For example, redirecting the contents of alt.2600 to, say, comp.2600 (because this firewall allows the comp.xxx groups through). Or any other hacks around this inconvenience? -----BEGIN PBP SIGNATURE----- Version: 1.0.0, Copyright 1995, Pretty Bad Privacy David Klur dklur(a)dttus.com I am who I am because I say so. So there. -----END PBP SIGNATURE-------

4 3

Re: PAY-OFF TIME FOR BUG-BUSTERS, NETSCAPE PLEDGES "DOGFIGHT"
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Fri, 15 Dec 1995 anonymous-remailer(a)shell.portal.com wrote: > On Fri, 15 Dec 1995, Alice de 'nonymous wrote: > > > Can anyone tell me whether Ian Goldberg and David Wagner got their $25,000 > > from Netscape for finding the HUGE security flaws in Netscape's existing > > product line?? > > > > Alice de 'nonymous ... <an455120(a)anon.penet.fi> > ^^^^^^^^^^^^^^^^^^^^^^^^ > > Heh, hey Alice, you know this discussion a short time ago where you > claimed that you wouldn't use PGP for signing because it wasn't secure > or something, what's with the use of the penet address? Uhhm, actually, I said that I don't have a secure machine to run PGP on, and that I didn't feel that I should have to travel across town to use a secure machine to ask whether or not Ian Goldberg and or David Wagner got any moola from Netscape or AT&T for helping to make these companies a fortune. Did they get their $25,000, or a scholarship, or a Christmas week or two at the Halekulani in Honolulu?? They helped out these companies, and here it is, less than ten days to Christmas, and what have these companies done?? Nothing ... nothing at all ... but freeload ... > Surely a penet address offers even less protection for your id? > > Or have you done something nifty like create the penet address with a > nymserver address? Yep, something like that ... you must be paying attention, my friendly "spoofing" shadow. The Penet address is simply to prevent huge email from being mailed to me. I don't want AT&T or Netscape to mailbomb me for simply writing the truth about them. Penet gives me some protection. I'm not looking to Penet to protect my "identity". All I want Penet to do is provide a way for people to write to me if they want to. Alice de 'nonymous ... <an455120(a)anon.penet.fi> ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

Securing the end-points
by GLEN_MCBRIDE＠BayNetworks.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Greetings! I was wondering if in addition to all the work and discussion regarding crypto which generally centres around the transmission path information takes traveling from end-point to end-point, there is any work being done to secure the end-points themselves (I.e. files on your PC etc.) In my view the end-points present the most vulnerability in the overall message path from person to person. It is at these points that the message/information exists as cleartext even if for a short period of time. While of course it is possible to PGP encode your files is this a practical way to go about securing your system? I am aware or RSA secure but is that all there is out there? Thanks in advance Glen McBride Bay Networks ASIA-PAC customer service Australia Views are my own and do not represent those of my employer ===== CURRENT PGP KEY FOLLOWS ===== - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQERAzDFDk4AAAEIAJvkPKWMS8TR5eNNQZw5FjUg8roSe/wFdw3d8vCEfb2lX3G+ qBAQKuTSUAhO8marZvNWF9VPuyqkOGEOrwzdont8jSHAdF9dguh1sP56eGXzyn8n mDN1Fw8vQiNrttvCEYUjvLEML8tFlLc7QlQRkAMEGrkH29D4ck3wOkJLEaSZrTcO RIZAzOBVVvrJORVKsREnGG4IrItJCiREw7Gp/LXIHMSEBCdu2+uaNc9nHQxKcYZc yx9UiiZ0XP6TzzUtkD00ZDtO8OdZCAhXdj0zbCUKVrzuY37EgnFVFQ7SlZZAQn/U Jx26k0eZvZhXjhSVd3QyElbJYNFVLrdyU+h+Gt0AIwQAAAABtCpHbGVuIE1jQnJp ZGU8R0xFTl9NQ0JSSURFQGJheW5ldHdvcmtzLmNvbT4= =N/lg - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMNS1vy63clPofhrdAQHn1wgAjHV2vKXIEY4qZ/Rm2rq4hnJsUJDt+zd5 BbYo/BZBruwX+gqylYlbOemkPvZ7ktAMdu9jUFfaJQ7Cb3jT4kgfp2dqqle6yaq1 0nxU9m7BMiVnSqevtK5Fy+thR/yVZWdHi1LFMy48yp8FCaqvMkEruscOsG0ydUNM lyf3OCNGdN7LQcxQkRE9UzKPwEpacDD/afU5W5aZhhchkpAH9t/kqKzvgXxia1VF 4hfOEcCMN21JO6QGqdnHASVNoIdV44O6BlUPhv5omAqofgU58tnbJ9G3/24zjecM QhxTMGBv+aDB1DtQ+k9wDJTdPBLwhqyWUZWImN3RPVnQb1Ec1CVM8A== =yLIB -----END PGP SIGNATURE-----

2 1

What ever happened to... Cray Comp/NSA co-development
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- O.K. I'm new... however... I remember reading an article about this news release in mid '94 (I believe it was the NY Times), about the time that Cray Computer Company (Seymour's unsuccessful spinoff company) was actively seeking bank financing. Anyone remember? The article was about an NSA contract award to Cray Computer. In some background: The Supercomputer industry had been struggling for a while with reductions in purchases from the U.S. government due to cutbacks on research spending and the 'end of the cold war'. The situation at MasPar had gotten to the point of court reorginization or worse. In June (of '94) Cray was in such a cash squeeze that it took out a $17.5 million secured loan to fend collapse. During July, Cray announced that it was seeking a "partner" to make an investment in exchange for technology access. Guess who shows up with plans to build "the ultimate spying machine"? Now, Seymour's a nice guy, but money is tight, so he buys in on the hopes for more a lucrative future relationship. The plot thickens. The contract calls for Cray to put up $4.6 million to cover the initial development (didn't they just take out a loan?) of which about $400,000 will go to the NSA for so called "software consulting services". It makes one wonder what the "real" contract was worth (such as producing this surveillance system in quantity)? There was some speculation in the article about what this system could be used for, such as DEA operations outside U.S. borders (Columbia perhaps) or foreign military communication or enhancement processing of spy satellite photos. What caught my attention was the architecture. A "hybrid design linking two supercomputer processors with an array of HALF A MILLION inexpensive processors" that were designed by the U.S. government laboratory affiliated with the NSA. The same chip house that brought us Clipper. I've not kept up with the "ultimate" demise that eventually befell Cray Computer Company, but the October 16 FBI filing on capacity for Digital Telephony got me thinking back to this article. 1% seems like a rather huge need for horsepower. And what if GAK doesn't fly? And the widespread use of hard crypto just keeps increasing? This kind of machine could, in theory: 1) Implement ALL Clipper(II) based Key Escrow functionality in silicon (the easy part) AND allow for simultaneous decrypt and surveil of 'who knows how many' Clipper based data streams. 2) Implement general RSA based Prime Factoring functionality in silicon (the not so easy part) AND allow massively parallel decrypt and surveil of 'who knows how many' RSA/etc. based data streams. 3) Implement it all, AND 'on-line' transaction based surveillance via the FBI's 1% capacity infrastructure. Chilling... Who needs key escrow (or RSA private keys) when you've got a massively parallel prime factoring machine. What if GAK was to become a 'non-issue'? How fast do you think a machine such as this could factor RSA 129? Makes you wonder if 2048 bits will be enough (my guess.. it won't). But then, I'm sure that when Cray Computer finally folded (has/hasn't?) all that tech just got sold for scrap eh? Anitro - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMNSadioZzwIn1bdtAQEgYwF+Nf5Azpeore6OPMNU94CpCawxPcPg8g7T kLQDY9I5Upk7vCe1dCpHm14g8jRYdSDx =vjJA -----END PGP SIGNATURE-----

1 0

Re: Campaign Finance Reform
by jim bell 17 Dec '03

17 Dec '03

At 10:41 AM 12/18/95 -0500, you wrote: >On Mon, 18 Dec 1995, Jon Lasser wrote: > >> On Sun, 17 Dec 1995, jim bell wrote: >... >> > It is absolutely true that you couldn't stop a person from communicating >> > claims of a donation to a politician. But what you COULD do is to ensure >> > that the donor couldn't PROVE that he made such a donation. In other words, >> > _I_ could claim that I gave $1K to Senator Sludgepump (a lie) and the good >> > senator would have no idea that I wasn't telling the truth. The people who >> > REALLY made such donations would be helpless. >> >> A tricky way around this, if it's done ALMOST properly, is to donate in >> odd amounts... ie "Senator Sludgepump, I am going to donate $469.23 to >> your campaign..." >> >> All this means is that the donations would have to be lumped in some way >> so that Senator Sludgepump can't find out the exact amounts donated by >> any individual. > >Cancelled checks. > >Or, hand check in addressed, stamped envelope to Senator Sludgepump and >ask him if he would mind sealing it and dropping it in a mailbox. > All of which raises numerous opportunities for sting operations against politicians, done by individuals by procedures provided for under law. Escrow (Okay, I know that's a dirty word around here, but...) an encrypted statement of how you intend to run the sting, to be opened by the escrow agent at some point in the future, explaining who you're going after and how. Make the contribution, keep evidence, and if you're successfull the congressman goes to jail for a few years.

2 1

Re: Oklahoma University: Is this legal?...
by sethf＠MIT.EDU 17 Dec '03

17 Dec '03

Going on my past experiences with this sort of situation, I think the problem is a) Oklahoma University is public (seems true from http://www.uoknor.edu/) b) The state of Oklahoma has an "open public records" law so c) someone decided that everything stored on the University's computer system was therefore a "public record" (since the computer is "owned" by the public), and thus had to be accessible by law. This seems to be approximately what's going on: "Drafted by Associate Chief Counsel Kurt Ockershauser a year ago, the policy will make a legal statement that e-mail is running on state property, Colaw said. He said the policy is not an invasion of privacy." http://www.uoknor.edu/okdaily/issues/fall1995/dec-7/1-email.processed.html Someone needs to explain to him that what he is doing is not legally required, and perhaps violates the ECPA. ================ Seth Finkelstein sethf(a)mit.edu

1 0

Re: Political Cleanup program [NOISE]
by Bill Stewart 17 Dec '03

17 Dec '03

I was going to refrain from ranting on this one (for once:-) but a couple points with cypherpunks relevance have come up. One is that PACs are, in some sense, a donation-remailer. The purpose is to get the money to its destination while obfuscating the link between the donor and the candidate, while allowing the PACs to take the political heat for it, but giving them the out that "it's just being done on behalf of our fine upstanding donors." At 11:20 AM 12/18/95 -0500, Phill Hallam wrote (order rearranged somewhat): >The starting point for campaign reform has to be to cap the amount that can be >spent on a campaign. Most countries have such laws to prevent the political >process from being owned by the rich. Unfortunately this has happened in the US >with the effect that both parties are much further to the right than in any >other Western democracy. I happen to believe in freedom of speech, especially political speech, and if you're not allowed to spend money broadcasting your speech or printing your messages, you don't have much freedom of press or speech. In this case, technology is giving us the ability to not only support freedom of speech, but give it as little or as much visible linkage as desired, allow the money to be passed around privately, and also to coordinate publicity efforts of different groups in ways other than simply giving cash to a candidate's bagman to be spent on publicity. It's also significantly changing the costs, speed, and targetability of speech, allowing more people to get involved, and allowing low-cost efforts to have more impact by reaching the right people. And as far as "prevent the political process from being owned by the rich" goes, there have been brief exceptions over the last 5000 years in which the less-rich have overthrown the rich, but campaign finance laws have almost never kept the rich or the politicians from helping each other out. >The main problem with anonymous political donations is that it is easy enough to >create linkage if the recipient and the donor conspire together. That's a given; not much point in giving someone a bribe if they don't know what they're being bribed to do or who they're doing it for :-) >There are many other things that campaign laws are intended to achieve beyond >avoiding bribery. For example foreign nationals cannot make donations to US >parties. It would be a good thing if there were similar laws in the UK since at >the last election a foreign national with links to organised crime alledghedly >made a multi million donation to the Conservative party. I also don't believe freedom of speech should be limited by national boundaries. >Of course in the absence of full disclosure of details of party records > nobody can be sure. We are as voters entitled to consider the worst however. You can always agree not to vote for any candidate or party that doesn't provide full disclosure, though it's a little harder to deal with political publicity supporting a candidate provided directly by non-candidates. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # .... Heading back to The Big Phone Company

3 2