December 2003 - cypherpunks-legacy

Re: DES_ono
by Frank Willoughby 17 Dec '03

17 Dec '03

Two brief questions about DES, if I may. I have heard of a couple of rumours that DES is considered to be fairly weak. Specifically, the rumors mentioned that there were some questions about the design of the S-boxes and the possibility that there was a trap door which would permit the NSA or other gov't agency to quickly obtain the cleartext. Another rumour was that the French & Israeli intelligence agencies downgraded the classification of DES to one of the lowest strengths of encryption algorithms. I have been wondering about these issues off & on for a while & have tried to do some research on them, but have come up with nothing which would amount to more than hearsay. It's tough to tell if the rumours stem from urban legends or are based on fact. If it isn't too much trouble, I'd appreciate an expert opinion of the two rumours mentioned above. Assuming the rumours of the weakness of DES are true, which symmetric encryption algorithms would you recommend which are substantially more secure than DES (and which are obtainable from Internet or commercial sources)? (It doesn't haver to be exportable). Thanks in advance for your help. Best Regards, Frank <standard disclaimer> The opinions expressed above are of the author and may not necessarily be representative of Fortified Networks Inc. Fortified Networks Inc. - Management & Information Security Consulting Phone: (317) 573-0800 - http://www.fortified.com/fortified Home of the Free Internet Firewall Evaluation Checklist

5 4

Risks of a style anonymizer?
by Deranged Mutant 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- One risk of "style anonymizers", though: if the style becomes too generic it's just another levelling of readability. Usenet and mailing lists can become that much more boring, if not stupidified with too many spelling erros and grammatical abuses. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMSZfQyoZzwIn1bdtAQF47QGAkP5+ti0j6KyJg8KY1ei1dF9Yz8FAnz4b EjB4r6nMXDW2wBG7ZnpFkX1YO6Aezmte =vrAk -----END PGP SIGNATURE-----

2 1

True random numbers
by maruishi＠netcom.com 17 Dec '03

17 Dec '03

I was trying to think of a way to come up with true random numbers... And knowing a bit of UNIX socket TCP/IP programming I made a small little program that generates random numbers by measuring the mili-second timing ies a TCP packet to bounce back, from another network. My program simply send some data to port 7 (echo port) of a network on an internal list. Then timing it, randomly picks a different network to send to. I was wondering if this would be helpful to anyone for generating random key or whatever. If you want the source code please post a request or e-mail me. If you think for some reason that using this method is a bad idea, I would like to know. maruishi(a)netco.com

3 3

Re: PING packets illegal?
by Bill Stewart 17 Dec '03

17 Dec '03

At 03:20 PM 2/14/96 -0500, markm@gak [cute machine name :-] wrote: >-----BEGIN PGP SIGNED MESSAGE----- >> Concerning the ITAR ...... what would happen if some Evil Hacker Dude in, >> say, England, decided to ICMP-ping a host in America? Nothing wrong with >> that ...... but if those ping packets contained little pieces of something >> like PGP ...... would the host being pinged be breaking the law? Would >> all the hosts in the route between that host and the host in England that >> was doing the ping also be breaking the law? > >Exporting encryption to the U.S. from another country is not illegal, only >exporting from the U.S. is. The method of transmissioni is irrelevant. It >does not matter if TCP packets or ICMP-ping packets are used to transmit the >data. You missed the fun part of his post - it's that ping packets return the data they were pinged with, so the US-end host is re-exporting components of PGP. >From a legal perspective, it's tough to assert that the US user had scienter, given that it pings scarcely reach the machine's consciousness, much less the human users', since they're handled by ICMP rather than by a user-space TCP or UDP socket. (Obviously, if there's a sniffer around this is slightly different.) Is it possible to send out forged ping packets, pinging machine B with a From address of C (fake) instead of A (real), so that Alice can talk to China via Bob? If so, it might be an interesting method for traversing some firewalls, and also (if you write a ping-collector program) for back-channel communications. If you want to really abuse the protocols, 53 bytes probably fits into the 64 you can send in a ping, so you could implement ATM-over-ICMP :-) #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281 ! Frank Zappa for President !

3 2

Re: NSA net trolling
by Eric Murray 17 Dec '03

17 Dec '03

Here's a copy of your message back to you as you requested: lmccarth(a)cs.umass.edu writes: > > Wayne Madsen wrote somewhere: > > A knowledgeable government source claims that > > the NSA has concluded agreements with [...] Netscape to > > permit the introduction of the means to prevent the anonymity of > > Internet electronic mail, [...] > > I suspect this may actually mean that they're pushing Netscape to > incorporate cryptographic authentication into browser email, which I think is > a useful development. (Hey, I read that Netscape employees get fined $1 for > referring to Navigator as a "browser".) > > At any rate, it's an excuse for me to ask some questions: > > (0) > I'm not aware of any class library objects or methods in stand-alone Java > for calling the local mail transport agent. Is there any class library > support in Java+{Navigator, HotJava, Mosaic, NetCruiser, the AOL web tool, > etc.} for calls to the local mail agent configured in the browser ? > > I would prefer not to reinvent SMTP using the Socket class in my own applets. > Ideally I'd like to have an applet that presents a form with some entry boxes > and check boxes, quantizes and encrypts the input according to the check box > settings, and spews the resulting byte streams to the MTA. > > (1) > As I recall, I used to be able to set (as an Option) the path and name of the > local MTA (e.g. /usr/lib/sendmail) in an earlier version of Netscape. That > seems to have disappeared in Navigator 2.0. Is there indeed no longer a way > to set that ? > > It occurs to me that we could have achieved partial integration of > remailing into Navigator quite cheaply with that option. > > Comments from Sun and/or Netscape and/or anyone else would be welcome. > Thanks :) > > -Lewis "You're always disappointed, nothing seems to keep you high -- drive > your bargains, push your papers, win your medals, fuck your strangers; > don't it leave you on the empty side ?" (Joni Mitchell, 1972) > > -- Eric Murray ericm(a)lne.com ericm(a)motorcycle.com http://www.lne.com/ericm PGP keyid:E03F65E5 fingerprint:50 B0 A2 4C 7D 86 FC 03 92 E8 AC E6 7E 27 29 AF

1 0

IBM Breakthrough?
by John Young 17 Dec '03

17 Dec '03

IBM has an ad in the Feb 26 New Yorker where a joker e- mails a recipe-swapping friend in Osaka that "I'll teleport you some goulash." The text then states: Margit is a little premature, but we are working on it. An IBM scientist and his colleagues have discovered a way to make an object disintegrate in one place and reappear intact in another. It sounds like magic. But their breakthrough could affect everything from the future of computers to our knowledge of the cosmos. What is this breakthrough or is it just a chump tease?

3 2

mixmaster info?
by David K. Merriman 17 Dec '03

17 Dec '03

I hate to bring up the topic of privacy/crypto (yech! :-), but could someone point me at the 'specs' for Mixmaster remailers? I'm after how messages are sliced, diced, repackaged, and shipped, etc. Dave Merriman ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> For privacy tools: http://www.geocities.com/capitolhill/1148

2 1

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 18:46 2/20/96, IPG Sales wrote: >Hedging, hedging, hedging - why? I did not noitice this in my first >reply - in addition to giving you the company if you can break the >system, we will give you the company if you can establish, through our >employees or any other method, that we retain any Ocopies of the TPs, >any! - for very large systems, we maintain a temporary copy to insure >safe arrival, by excuting the check system menu item - >it is immediate destroyed upon system notification. Anyone that wants to >audit us cazn do so, unannounced at any time - subject to payment ofd >expenses! We do not keep copies, we would not be in business 30 days if >we did. It is irrelevant if you keep copies of the OTPs or not. The point is that you might. There is no way to prove to me or anyone else that you don't keep copies. [why this is true is left as an exercise to the reader]. I would not trust anyone outside my company to create keys for us. I would urge any others interested in keeping their data inaccessible to outsiders to exercise the same fundamental caution. There is no further need to look at IPG's source code or algorithms. As I said, end of story. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by dan＠milliways.org 17 Dec '03

17 Dec '03

Perhaps you should apply for an export license for your software. I'm sure that the ability to use your system across national borders fits nicely within your marketing strategy. To do so, you simply submit your product to the U.S. National Security Agency, and submit a Commodity Jurisdiction application to the State Department. After the NSA evaluates its security, you'll be able to sell your product overseas. Please see pages 610-618 of Applied Cryptography, Second Edition for general information on the process. By the way, you might note that Cypherpunks is only a mailing list, there is no way to get the signed consent of everyone on the list to agree to anything, much less formal rules of a contest. My suggestion is to post the OTP-expansion algorithm to sci.crypt. It's really in all of our best interests to have the greatest number of people examining your product. Think of the publicity it will generate. Your work will remain protected with whatever patents or copyrights you have applied for. This approach is nothing new, RC2 and RC4 were both posted to sci.crypt. Both are in wider use today because of it. Both algorithms stood up to many people's tight scrutiny. I think your algorithm should be given the chance to do the same. Dan ************************************************************************** Support your local info-calypse dan(a)milliways.org "The Internet cannot be regulated. It's not that laws aren't relevant, it's that the nation state is not relevant." Nicholas Negroponte, 1996 The Cypherpunks: Civil liberties through complex mathematics. **************************************************************************

4 5

CoFR Report Site
by John Young 17 Dec '03

17 Dec '03

Thanks to KLP, the Council on Foreign Relations report on the future of US intelligence: http://www.tc.umn.edu/~klp/CoFR.txt (text) and http://www.tc.umn.edu/~klp/CoFR.gz

1 0