December 2003 - cypherpunks-legacy

RE: Brute Force DES
by Matt Thomlinson 17 Dec '03

17 Dec '03

well, first of all, I wasn't computing 2^40, I was computing something like 2^(56*0.667) * 8bytes/each or somesuch, I don't recall exactly as I don't have the paper in front of me. In any case, it was the tradeoff between time and space -- 2^40 in time was something like 2^38th in space. But don't trust my numbers, get the paper and rattle them off yourself. It just seems like if we're going to browse all of the way through the DES keyspace, we _ought_ to take notes along the way -- that means building a table. I don't care how big the table is; if it is only 2^30 entries (about 1G entries, each 8 bytes = 8Gig) we reduce our next DES crack by a factor of 8. If we keep 2^31 entries (16Gig) we can cut it down to 2^50, or a factor of 16. If we have 4 - 9 Gig drives (or perhaps three drives and some wiggling, described below) we can save about 2^32 entries and the search becomes a measly 2^48. :) To whittle this down to a 40-bit workload, we'd have to save 2^36 entries* 2^8 bytes/entry = 2^39 Bytes = 512 Gig. Yes, admittedly large. What's the cheapest form of storage, magtape? How much can you store on magtape? The entries can be sorted so that lookup doesn't take long even when you have to mount tapes. Wiggling: We may be able to save less than 2^8 bytes/entry because we know the quality that made the point interesting enough to save (say we only keep points where the top 32 bits were zeros -- no need to save these zero prefixes) but I suppose we'd only be able to cut this storage factor down by a factor of two at most. If you don't have Hellman's paper handy, the apropos formulas are: Total time=T, memory=M, search space=N Time/space tradeoff: M=mt , T=t^2, m*t^2=N In our case, N=2^56; M, T variable. mattt >---------- >From: Ray Arachelian[SMTP:sunder@dorsai.dorsai.org] >Sent: Tuesday, July 23, 1996 3:16 PM >To: Matt Thomlinson >Cc: 'trei(a)process.com'; 'cypherpunks(a)toad.com' >Subject: RE: Brute Force DES > >On Tue, 23 Jul 1996, Matt Thomlinson wrote: > >> why not put together (a LOT of) disk space and we can build a table >> (read: "a cryptanalytic time-memory tradeoff") for cracking DES? Using >> the table, we could brute-search the DES keyspace in less time than it >> would take to do an exhaustive search of a 38 bit keyspace, according to >> the paper. 4 gigs is what, a couple of hundred nowadays? >> >> Making DES equivalent to a 40-bit crack would take approx. 500Gig, but >> publishing the table would push DES out usefulness. Certainly we could >> scale back (make DES equivalent to a 45-bit crack?) if we don't have >> enough disk... > >IMHO it's more expensive to go this route than to build a machine with >dedicate DES cracking chips. 2^40 = 1,099,511,627,776 or about 1 terabyte >worth of space, not 500G. 2^39 would be 500Gb. A 4Gb drive these days is >$800, hardly a couple of hundred dollars. :) > >Even so, that's a ton of hard drives. Further you need machines to hook >these drives up to. Infact, you need a farm of machines. Why? You can >only put 7 on a chain, and maybe if you're lucky four chains in a machine >using four controllers. > >A better idea might be to make small cheap computers, say based on 8086's >or 68000's that replace the drive's controller card, or if that drive >controller card is intelligent enough to be a CPU or contain one, burn >EEPROMs. Have the EEPROMs be able to generate DES (or any other >cypher's) keyspace given a range, and then have them able to search the >whole drive for a match. > >Even so, if you build these drive boxes, all you've accomplished is to >create a nice huge big searchable array. You still will need some sort >of logic to figgure out when it finds the right key, and you still can't >do 3DES or recusively encrypted files, nor know when you've found the key >for data you can't recognize - or rather have these drives recognize. > >However: Reading a 4Gb drive end to end takes less than 2 hours. I know >this because I have a RAID array of them, and it takes 2 hours to >rebuild, so since rebuilding an array requires reading from two drives >and writing to one drive, reading a whole 4Gb drive at full speed would >be something like maybe 1 to 1.5 hours(???) > >You might be better off with 9.0Gb drives if you can afford them because >you then have less controller logic cards to build. > >The drives alone will cost $204,800. $800*(2^40/(4*1024*1024*1024)). >You could get a nice big discount if you buy that many, but this will >also mean however much it will cost you to build the cpu cards for >multiplied by 256 drives, plust the R&D cost, plus the network connection >between all the CPU boards. > >At that point you also run into the MTBF of the drives which means that >your drives will fail quite often. > >If you want to go dirt cheap on the CPU's while using this huge space >method, you could just buy something like 37 Mac IIsi's, hook each up to 7 >of the drives (you'll have to partition the drives as they won't support >volumes that huge.) and network the machines using localtalk. You won't >need a faster connection because all you need for networking is keyspace >distribution and success reporting. But then IIsi's are sloooow machines >and your searches will suffer a hit from the lack of the machine's speed, >plus all the overhead of having an operating system and using the SCSI >chain to talk to the drives. > >IIsi's go for $350-$500 nicely loaded... $14800 for 37 at $400 a pop, >add the drives to that, plus the cost of writing the program and hooking >all of this crap together and that'll be $219,600. Ya got that kinda >dough to spare? > >========================================================================== > + ^ + | Ray Arachelian |FL| KAOS KERAUNOS KYBERNETOS |==/|\== > \|/ |sunder(a)dorsai.org|UL|__Nothing_is_true,_all_is_permitted!_|=/\|/\= ><--+-->| --------------- |CG|What part of 'Congress shall make no |=\/|\/= > /|\ | Just Say "No" to|KA|law abridging the freedom of speech' |==\|/== > + v + | Janet Reno & GAK|AK| do you not understand? |======= >===================http://www.dorsai.org/~sunder/========================= > Key Escrow Laws are the mating calls of those who'd abuse your privacy! >

1 0

re:SHI_fty
by Alan Olsen 17 Dec '03

17 Dec '03

At 08:13 PM 7/22/96 -0800, Vinnie Moscaritolo wrote: >Uh I think apple had that for a while, it's called cyberdog >http://cyberdog.apple.com screw this ole fud. Unfortunatly, this is only available for Macs at this time. Hopefully we will see Windows and/or Unix versions sometime soon. (Of course if you expect Microsoft PR to resemble *ANYTHING* vaguely like reality...) --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon "Microsoft -- Nothing but NT promises."

1 0

RE: Distributed DES crack
by pjn＠nworks.com 17 Dec '03

17 Dec '03

> I've a few machines around that could be dedicated almost full time to the > task. What are the bandwidth requirements? Specifically, could the > keycracker be run over a 28.8 (with a 486 running linux)? If so, how many > 486's could I get over a single 28.8 (i.e. 28.8 -> multiple 486's daisy > chained with ppp over direct serial connection)? > It's not a factor of the bandwidth, you search offline and send in > your results to a central server. > But first, a little reality check is in order. According to libdes, > the 200Mhz Pentium Pro on my desk will do 1,827,997 ECB bytes/sec, or > 228,499 ECB blocks. A DES crack would have to try, on average, 2^55 > blocks. That would take my machine 43,798,875 hours, or 1,824,953 > days. > OK, so let's be reasonable and say that a week would be a good time to > come up with a DES key. We would need 260,707 200Mhz Pentium Pro's to > achieve this. > Looking at that, 30 days seems not such an unreasonable target. We > would need 60,831 200Mhz Pentium Pro's to achieve this. > It seems obvious to me that DES is still *way* out of reach of > anything other than special purpose hardware. In> - Andy (hoping he got his sums right) (I think you did :) One small thing... You are assuming that we will not get the right equasion/code/whatever untill the very end. There is a good chance that it will only take half that time...and a slim chance that we will get it with the first try... P.J. pjn(a)nworks.com (BTW, I have a 486 DX/4 100MhZ That I will put to the effort...) ... As easy as 3.14159265358979323846264338327950288419716 ___ Blue Wave/QWK v2.20 [NR]

1 0

Re: Responding to Pre-dawn Unannounced Ninja Raids
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 3:38 PM 7/23/96 -0400, hallam(a)Etna.ai.mit.edu wrote: >>I don't understand this conclusion. One book people aside, it is generally >>believed that humans evolved in an evolutionary context and they certainly >>frequently use cooperative strategies. Cooperation usually also involves >>the ability to sanction misbehavior. Unilateral disarmament is throwing >>away your sanction. > >That depends on the circumstances. If you are arguing the case for >unilateral disarmament or unilateral reduction. In many cases there was a >deliberated attempt to confuse one with the other. Unilateral >reduction can be the right move to make. No argument. I said disarmament. >In the case of a minor nuclear power such as the UK unilateral >disarmament may be the right move... But still, the UK has available other sanctions. That's why they are still called the Falklands. >... Burglars are not rational actors, and >are more likely to have their behavior determined by drugs or >alcohol than analytical game theory. Burglars are among the most rational of thieves. They try to maximize gain and minimize risk by acting when no one can oppose them. Even muggers, a much less rational activity, try to pick on people smaller than them. >The facts are very clear, if you have a handgun in the house it is >far more likely to kill a member of the familly than stop an >intruder. The NRA know this which is why they have lobbied for the >CDC to stop research in this area - they do not like the facts. Christmas trees make your house far more likely to catch fire. However many people have them because they provide other, hard to quantify, values. (BTW, my mother's retirement home does not allow them in individual units.) Guns have value besides home defense. Just one off-the-wall example: I learned to hold a camera steady by competitive target shooting. Home defense is not the only reason to have a gun. (Besides, I would rather have a shotgun with a short barrel for close-up defense than a handgun. As the California police forces discovered when they (briefly) changed from pump shotguns to "automatics", the sound of chambering a round with a pump shotgun makes people focus very clearly on their situation. Frequently it avoids violence.) IMHO handguns are much more useful when you need a portable defense. Examples: 1. The USGS will allow field geologists to carry handguns in bear country after a rigorous training program. 2. I have a friend who defended himself from a pack of feral dogs after they attacked him and forced him to retreat to the roof of his car. (He killed three of the four. The local rancher treated him to dinner for ridding the neighborhood of a dangerous nuisance.) ------------------------------------------------------------------------- Bill Frantz | Cave ab homine unius lebri | Periwinkle -- Consulting (408)356-8506 | [Beware the man of one | 16345 Englewood Ave. frantz(a)netcom.com | book] - Anonymous Latin | Los Gatos, CA 95032, USA

1 0

When books are outlawed
by sparks＠bah.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Only outlaws will have books... Just watching the news here in Fl. and they are trying to hold a publisher responsible for a murder because they published a fictional account of a hitman and a guy says he used the book to kill some people. Would you give your 6 year old a book ? This is really getting out of hand.. Anyone have any property for sale in Idaho ? -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCXAwUBMfTGneJ+JZd/Y4yVAQHLuQQMDQglhj5/SWlstlnGTnky47xkqIrm5gUK umCeV7tdlKlYjy/KprUx/UChy2GQ/fHd6rh14CIrnqIzV8I1WUOIbcLWYsOZxTmU sOa2vwISXuLvV7wDy50GgLq3kjGUh+BvhvAfxD/vrbyjOWYMCJB9KNRqE2TMpSn5 O6J/Pb0OYkQB6A== =A8SX -----END PGP SIGNATURE----- Charles E. Sparks http://www.clark.net/pub/charley/index.htm In God we trust, All Others we encrypt Public Key at: http://www.clark.net/pub/charley/cp_1.htm

1 0

WinSock Remailer Going On-Line Tonight
by Joey Grasty 17 Dec '03

17 Dec '03

Y'all: I'm pleased to announce that the WinSock Remailer is going into operation tonight at 11:00 PM. Please feel free to test it. You can get the key by sending a message to winsock(a)c2.org with the "Subject: remailer-key". After about a week of further testing, I will be releasing the executables to everyone who sent me a note asking to participate in the alpha test. If you want to be included, please send me a note. Here's the info for the remailer-list: $remailer{"winsock"} = "<winsock(a)c2.org> cpunk pgp hash cut ksub reord"; I'll be adding "post" to this list after I get a more thorough testing of the NNTP code that I added for authentication. "latent" is also pending. The remailer will run every 60 seconds from 12:00 AM to 8:00 AM every day and whenever I am online. c2.org automatically spools the messages when I am not connected. Note: alt.religion.scientology and alt.clearing.technology are blocked. I'm not interested in run-ins with either supporters or detractors of the Church of Scientology. Binary and picture groups are also blocked, but only because I don't have the bandwidth to support them. Anyone who has blocking lists that they want to share, please send them to me. Regards, -- Joey Grasty jgrasty(a)gate.net [home -- encryption, privacy, RKBA and other hopeless causes] jgrasty(a)pts.mot.com [work -- designing pagers] "Anyone who considers arithmetical methods of producing random digits is, of course, in a state of sin." -- John Von Neumann PGP = A7 CC 31 E4 7E A3 36 13 93 F4 C9 06 89 51 F5 A7

1 0

Re: Another fascist
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"david(a)sternlight.com" "David Sternlight" 23-JUL-1996 08:30:51.02 >One of the great friends of free speech on this list sent a forged cancel >message to the listbot to try to cancel my subscription. >The listbot, being reasonably well designed, ignored him and told me about >it, though I have no doubt less of a dunce could bring it off. >What a piece of slime! What do others think of this practice? You have my sympathies. Either I got logged off the list accidentally a bit back, or someone did this successfully to me. I didn't notice due to being gone for a bit, but I finally did and got back onto the list. I'd meant to email the list maintainer (Eric Hughes, as I recall), but haven't gotten around to it - lack of time. Any signs of who did it from the message? I would guess not. -Allen

1 0

Re: Distributed DES crack
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"mab(a)crypto.com" "Matt Blaze" 23-JUL-1996 09:38:21.11 >Personally, I'd rather someone finish up the Wiener ASIC to the point where >it could go out to fab, get some prototype chips made, design a board around >it, and publish the design, from board layout on down. This would be a >great Master's project, and some of us (maybe me, but I'll have to check) >might even be able to scrape up enough funds to buy enough chips/boards/etc >to build a modest size machine (say, that could exhaust a DES key in 1-6 >months). Initial engineering costs aside, the marginal cost of each >such machine could be well within the budgets of, say, a medium size crypto >research lab, and would make a scary enough demo to convince even the >most trusting management types of the risks of 56 bit keys. How about generalized FPGA boards? Some applications in computational biology (searching for similar genes or proteins using FASTA, etcetera) use those quite a bit - and they're available for only about 20,000 or so for quite a few high-level FPGA chips on a board. We've been looking into getting one such and renting its use out on the Web, but the initial investment costs are beyond what available grants will cover; maybe later. Given that at Rutgers is one of the people doing whole bunches of stuff on Web security - namely Simon Cooper - it should't be too difficult. But that will be at least a year or so. -Allen > - matt >(Please cc me on replies, as I'm not reading the list except when someone >alerts me to an interesting topic. Thanks.)

1 0

Re: Special Agent Safdar
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Perry Metzger writes: > Anonymous writes: > > FBI Special Agent Safdar is upset enough by the revelation > > of his true identity to issue a quick denial (on a sunday night, to get > > more OT no doubt), but he doesn't even bother to try to refute the > > central truth that his cover has been blown by a careless operator at > > his home office who verified his employment and offered to take a message > > for him. > > You really are on drugs. The question is, which ones? It could only be Ritalin, the Official Non-Stimulant of the Cypherpunks list.

1 0

[forwarded message]: IAB/IESG statement on cryptography (fwd)
by Jeff Barber 17 Dec '03

17 Dec '03

Subject: IAB/IESG statement on cryptography To: ietf(a)ietf.org Date: Wed, 24 Jul 1996 08:21:59 +0200 (MET DST) From: Brian Carpenter CERN-CN <brian(a)dxcoms.cern.ch> IETF, FYI, the IAB and IESG have just requested the Internet Society to release the attached statement to the press on our behalf. (The copyright tag at the end is purely to protect the text against misuse.) We intend to publish this as an informational RFC for the record. Brian Carpenter - --- IAB and IESG statement on cryptographic technology and the Internet - ------------------------------------------------------------------- July 24, 1996 The Internet Architecture Board (IAB) and the Internet Engineering Steering Group (IESG), the bodies which oversee architecture and standards for the Internet, are concerned by the need for increased protection of international commercial transactions on the Internet, and by the need to offer all Internet users an adequate degree of privacy. Security mechanisms being developed in the Internet Engineering Task Force to meet these needs require and depend on the international use of adequate cryptographic technology. Ready access to such technology is therefore a key factor in the future growth of the Internet as a motor for international commerce and communication. The IAB and IESG are therefore disturbed to note that various governments have actual or proposed policies on access to cryptographic technology that either: (a) impose restrictions by implementing export controls; and/or (b) restrict commercial and private users to weak and inadequate mechanisms such as short cryptographic keys; and/or (c) mandate that private decryption keys should be in the hands of the government or of some other third party; and/or (d) prohibit the use of cryptology entirely, or permit it only to specially authorized organizations. We believe that such policies are against the interests of consumers and the business community, are largely irrelevant to issues of military security, and provide only a marginal or illusory benefit to law enforcement agencies, as discussed below. The IAB and IESG would like to encourage policies that allow ready access to uniform strong cryptographic technology for all Internet users in all countries. The IAB and IESG claim: The Internet is becoming the predominant vehicle for electronic commerce and information exchange. It is essential that the support structure for these activities can be trusted. Encryption is not a secret technology monopolized by any one country, such that export controls can hope to contain its deployment. Any hobbyist can program a PC to do powerful encryption. Many algorithms are well documented, some with source code available in textbooks. Export controls on encryption place companies in that country at a competitive disadvantage. Their competitors from countries without export restrictions can sell systems whose only design constraint is being secure, and easy to use. Usage controls on encryption will also place companies in that country at a competitive disadvantage because these companies cannot securely and easily engage in electronic commerce. Escrow mechanisms inevitably weaken the security of the overall cryptographic system, by creating new points of vulnerability that can and will be attacked. Export controls and usage controls are slowing the deployment of security at the same time as the Internet is exponentially increasing in size and attackers are increasing in sophistication. This puts users in a dangerous position as they are forced to rely on insecure electronic communication. TECHNICAL ANALYSIS - -------------------------- KEY SIZE It is not acceptable to restrict the use or export of cryptosystems based on their key size. Systems that are breakable by one country will be breakable by others, possibly unfriendly ones. Large corporations and even criminal enterprises have the resources to break many cryptosystems. Furthermore, conversations often need to be protected for years to come; as computers increase in speed, key sizes that were once out of reach of cryptanalysis will become insecure. PUBLIC KEY INFRASTRUCTURE Use of public key cryptography often requires the existence of a "certification authority". That is, some third party must sign a string containing the user's identity and public key. In turn, the third party's key is often signed by a higher-level certification authority. Such a structure is legitimate and necessary. Indeed, many governments will and should run their own CAs, if only to protect citizens' transactions with their governments. But certification authorities should not be confused with escrow centers. Escrow centers are repositories for private keys, while certification authorities deal with public keys. Indeed, sound cryptographic practice dictates that users never reveal their private keys to anyone, even the certification authority. KEYS SHOULD NOT BE REVEALABLE The security of a modern cryptosystem rests entirely on the secrecy of the keys. Accordingly, it is a major principle of system design that to the extent possible, secret keys should never leave their user's secure environment. Key escrow implies that keys must be disclosed in some fashion, a flat-out contradiction of this principle. Any such disclosure weakens the total security of the system. DATA RECOVERY Sometimes escrow systems are touted as being good for the customer because they allow data recovery in the case of lost keys. However, it should be up to the customer to decide whether they would prefer the more secure system in which lost keys mean lost data, or one in which keys are escrowed to be recovered when necessary. Similarly, keys used only for conversations (as opposed to file storage) need never be escrowed. And a system in which the secret key is stored by a government and not by the data owner is certainly not practical for data recovery. SIGNATURE KEYS Keys used for signatures and authentication must never be escrowed. Any third party with access to such keys could impersonate the legitimate owner, creating new opportunities for fraud and deceit. Indeed, a user who wished to repudiate a transaction could claim that his or her escrowed key was used, putting the onus on that party. If a government escrowed the keys, a defendant could claim that the evidence had been forged by the government, thereby making prosecution much more difficult. For electronic commerce, non-repudiation is one of the most important uses for cryptography; and non-repudiation depends on the assumption that only the user has access to the private key. PROTECTION OF THE EXISTING INFRASTRUCTURE In some cases, it is technically feasible to use cryptographic operations that do not involve secrecy. While this may suffice in some cases, much of the existing technical and commercial infrastructure cannot be protected in this way. For example, conventional passwords, credit card numbers, and the like must be protected by strong encryption, even though some day more sophisticated techniques may replace them. Encryption can be added on quite easily; wholesale changes to diverse systems cannot. CONFLICTING INTERNATIONAL POLICIES Conflicting restrictions on encryption often force an international company to use a weak encryption system, in order to satisfy legal requirements in two or more different countries. Ironically, in such cases either nation might consider the other an adversary against whom commercial enterprises should use strong cryptography. Clearly, key escrow is not a suitable compromise, since neither country would want to disclose keys to the other. MULTIPLE ENCRYPTION Even if escrowed encryption schemes are used, there is nothing to prevent someone from using another encryption scheme first. Certainly, any serious malefactors would do this; the outer encryption layer, which would use an escrowed scheme, would be used to divert suspicion. ESCROW OF PRIVATE KEYS WON'T NECESSARILY ALLOW DATA DECRYPTION A major threat to users of cryptographic systems is the theft of long-term keys (perhaps by a hacker), either before or after a sensitive conversation. To counter this threat, schemes with "perfect forward secrecy" are often employed. If PFS is used, the attacker must be in control of the machine during the actual conversation. But PFS is generally incompatible with schemes involving escrow of private keys. (This is an oversimplification, but a full analysis would be too lengthy for this document.) CONCLUSIONS - -------------------------- As more and more companies connect to the Internet, and as more and more commerce takes place there, security is becoming more and more critical. Cryptography is the most powerful single tool that users can use to secure the Internet. Knowingly making that tool weaker threatens their ability to do so, and has no proven benefit. - ---- The Internet Architecture Board is described at http://www.iab.org/iab The Internet Engineering Task Force and the Internet Engineering Steering Group are described at http://www.ietf.org - ---- (C) Internet Society 1996. Reproduction or translation of the complete document, but not of extracts, including this notice, is freely permitted. (ends)

1 0