December 2003 - cypherpunks-legacy

Re: Truly Random Numbers
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:26 PM 3/2/96, Adam Shostack wrote: > My expectation would be that your numbers are not random in a >cryptographic sense, and that this route of attack is much less >efficient than others that would be used. > > I'll note that PGP does NOT take your data entered and convert >it to numbers, but takes timings to choose a hard to predict starting >point for its prime searching. Yes, which is why I said this in my post: "...With a reasonable amount of entropy, such as picking the next digit from several keyboard timings, I expect the 150-decimal-digit number to be *very* random!" > I'd expect this use of timings is better than using the large >random number you entered, but in a theory sense only. Both are >pretty difficult; thats why we like large numbers. :) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: M A F_i o s
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:27 PM 3/1/96 -0500, John Young <jya(a)pipeline.com> wrote: > 3-1-96. TWP: > "Expert Panel Wants Intelligence Director to Hold More Power." > The commission finds that the patchwork of 14 separate > intelligence agencies is functioning well in its current > form. To meet tbe growing threat of worldwide criminal > activity the panel suggested creation of a high-level > policy group run out of the White House, called tbe > Global Crime Committee. But they've already _got_ the Pentagon! The title does remind me somewhat of "Buckaroo Banzai against the World Crime League".... #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281

1 0

Re: Is there any work on entropy-lowering schemes?
by Mark Grant, M.A. (Oxon) 17 Dec '03

17 Dec '03

On Fri, 1 Mar 1996, Mutant Rob wrote: >So it seems possible to create a scheme that given a key will take a >block of n bits and expand it to 1.5n or 2n bits, recoding it in such >a way that determining the key is difficult even if one suspects such >a scheme has been used... but that using the scheme will make the data >look more like the MSBs of graphical data rather than encrypted data. Stealth 1.3 (or is it 1.2?) does that, but it only makes the data look more like the MSBs, and not *exactly* like the MSBs. I think it's available from Adam Back's WWW site (http://dcs.ex.ac.uk/~aba/stealth/) Mark

1 0

Random keys ?
by A. Padgett Peterson P.E. Information Security 17 Dec '03

17 Dec '03

> This does not demonstrate that the RSA keys are as well >distributed, but it does generate some confidence that the key >generation methods of PGP are not very broken. Testing for RSA >generation would be more difficult, since there are some practical >difficulties in getting a large sample of RSA private keys. True but do not need private keys, just public ones (one to one relation), should be able to get a large sample (20,000 in one place did I hear ?) of those. Warmly, Padgett

1 0

Anonymous Web Browsers
by A. Padgett Peterson P.E. Information Security 17 Dec '03

17 Dec '03

>I took the JavaScript stuff that was posted and put it in one of my web >pages (http://students.cs.byu.edu/~don/mail2news.html) I had to pick a new >address because support(a)netscape.com is reportedly now just an autoresponder. >I've disabled java, I've changed the mail server to null (from the default >localhost) and none of it stops the JavaScript from sending mail. You did this to the *server* or the *client* ? (the latter is what I was talking about). If the client, then is Netscape/Java acting as its own mail server ? Guess I am going to have to did out a sniffer and see just what is going on... Warmly, Padgett

1 0

Re: Web of Trust vs other models
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:48 AM 3/1/96 -0500, you wrote: >There are a pool of 1 million keys. Each of those keys is signed by between > two and 5 other randomly chosen keys in the pool. > Each signature implies a trust relation between the key and the signer. >Given that, determine mean, min, and max path lengths for purposes of > "certification". >Has anyone done this experiment? Probably been done, though not necessarily in a PGP context. The problem is equivalent to analyzing a randomly selected directed graph, and some Operations Research or CS grad student has probably done it. Meanwhile, Don Kitchen at one point collected all the data off the MIT keyserver for analysis, which is a much different problem than random signatures. I found that the chain from some middle point, such as Phil Zimmermann's or Derek Atkins's key was about 12-14 levels deep, averaging about 6, which compares interestingly with the default PGP depth limit of4. From my key, it was pretty deep, especially since my certification from Phil Karn was from one of his older keys, which is why I asked Derek to sign my key... #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281

1 0

Win a free Apache-SSL-US Commercial license
by sameer＠atropos.c2.org 17 Dec '03

17 Dec '03

See http://apachessl.c2.org/ for more details. Thanks, -- Sameer Parekh Voice: 510-601-9777x3 Community ConneXion, Inc. FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org/ (or login as "guest") sameer(a)c2.org

2 1

Truelly Random Numbers
by A. Padgett Peterson P.E. Information Security 17 Dec '03

17 Dec '03

>The number of randomly selected 768 bit primes that you would need for a >reasonable chance of a birthday collision is 1.708E104 True however the current mechanism of generating PGP keys which consists primarily of pseudo-randomly pounding on a keyboard is hardly "truely random. Have no idea of the true number but expect it to be significantly less than that quoted above, even for a 1024 bit key like mine. Warmly, Padgett

3 2

Re: A brief comparison of email encryption protocols
by cme＠cybercash.com 17 Dec '03

17 Dec '03

At 12:01 2/29/96, Laurence Lundblade wrote: > >Isn't using a hash as the identifier replicating the key distribution >problem that PGP has or are you including some other data that can be used >to look up the cert? I think a problem occurs when you have 20 billion of >these certs (two for every person in the year 2010 or such). A simple hash >into a table isn't going to cut it because you a single database (with >replication?) isn't going to be possible. Some hierarchical lookup like >DNS is going to be needed. The look ups are needed to check for revocation. Our current straw-man http://www.clark.net/pub/cme/html/cert.html uses the following to identify a key within a certificate: KEY_ID ::= <hash of public key> [<nickname chosen by the owner>] [<URL of the full key>] It is assumed that the key is in a cache at the verifier. The verifier can add it to his cache by having it sent to him directly, by fetching it via the URL (if present), or through some other means. One of my co-workers [Donald Eastlake] is proposing distribution of keys via the DNS and that sounds fine, too. We weren't tying the distribution problem to the certificate problem. They really are separate. Revocation is a separate problem. My personal preference [quite seriously] is not to allow for revocation -- rather to issue certificates with a validity only long enough to get the job done but not so long that you'd be seriously damaged by having an invalid cert honored. There's no way to get 100%, immediate validation [by non-existence on a revocation list]. For more words on this subject, see cert.html. If one really needs CRL checking, I'd recommend including a URL for the Issuer's own revocation list as a field in the cert. - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)cybercash.com http://www.clark.net/pub/cme | |CyberCash, Inc., Suite 430 http://www.cybercash.com/ | |2100 Reston Parkway PGP 2.6.2: 61E2DE7FCB9D7984E9C8048BA63221A2 | |Reston, VA 22091 Tel: (703) 620-4200 | +--------------------------------------------------------------------------+

3 2

Re: Problems with certificates.
by Bill Stewart 17 Dec '03

17 Dec '03

At 08:35 AM 3/1/96 -0500, "A. Padgett Peterson P.E. Information Security" <PADGETT(a)hobbes.orl.mmc.com> wrote: >Today, each person generates their own PGP key. While it is unlikely that >any two will match, it is likely that at some point some two will match >(see matching birthdays in a bar - number is less than you would think). PGP KeyIDs are 8 hexes long (formerly 6), and there have been some natural collisions and it's easy to manufacture them. On the other hand, the MD5 hash used for key fingerprints is 128 bits long, and cryptographically strong. So birthday-problem collisions occur when you have ~ 2**64 keys around, which is not a problem, and you can't generate collisions on purpose either. A 64-bit hash would be more interesting; you get collisions if you have around 2**32 keys, which could actually happen. >Next rage might well be "vanity" PGP keys. While at the moment it is not known >how to create a specific match key to a sequence, if you generate enough >keys, there will be some interesting sequences found. Possibly some PGP >signatures will even be in violation of the CDA (now that should start a rush 8*). :-) The main problem is the limitations of hex; keyids like 0xdeadbeef are available, but it's tough to really trigger Exonization that way. Using 32 bits as ASCII instead is a bit more flexible. >For some time I have been concerned about the scalability of PGP. It works >well in small groups but after trying once to create a 6,000 member keyring >(took over three days on a 386 & was several meg when done) Yeah - lots of people have been concerned about this. Keyservers simplify the problem a lot, since you no longer need to carry a large number of keys around yourself, but the keyring handling mechanism of PGP wasn't designed to scale. Wouldn't be too hard to redesign, once PGP 3.0 comes out and we've got tools to do it - you could use a database or decently structured ASCII file or files. And DNS or similar distributed keyserver can make it easier to find, for people who are on-line. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281

2 1