December 2003 - cypherpunks-legacy

More Balto Sun on the NSA: Infowar
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

The last part of the Baltimore Sun's series of articles on the NSA arrived today. It concentrated upon the prospect for a bloodless "Infowar." The article began with a hypothetical attack beginning on January 17, 2001, the tenth anniversary of the US bombing of Baghdad. In the attack, bad, computer related things happen like stock markets crash and all of the money is drained from the accounts of the sailors in the US Navy. The article then uses this as a beginning for a long contemplation of the NSA's future. Many of the details are well-known to cypherpunks. The NSA is poking around with drug interdiction, economic intelligence and computer security. The Russian linguists are being retrained. Etc. The article ends with a story told by Senator Rudman of NH. He says that 100 years ago, the houses were wood and we needed fire stations on every corner. Now, they're made of brick and concrete and come with sprinkler systems. The Fire Union might argue that you still need a fire station on every corner, he told the reporter, but that's not necessarily true. So, perhaps Clipper is a form of job insurance? True perfect security would not only hurt SIGINT, but it would remove the need for crypto firemen. If you want to have a system that gives some people access and not other people, then you need a lot of folks to stand around, sign forms and generally make sure that everything is running smoothly. Strong cryptography is automation. GAK requires a large bureaucracy to administer it. The article also has some anecdotes about how the agency protected US firms abroad. One company was alerted that its European competitor was bribing the Latin American officials who were choosing the winning bid. Also, when the Peso collapsed, the US negotiators had access to some information that the Mexican government wasn't being as forthcoming as they should have been about the country's assets. They used this information in negotiations. --Peter Wayner You can purchase the complete articles from the Baltimore Sun by dialing 410-332 6962. The price is $3.95. (See my second post for more info on an earlier article about Crypto AG).

2 1

Re: .PWL Spin
by Jeff A. Gehlbach 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 02:01 PM 12/15/95 -0600, you wrote: >According to rumor, anonymous-remailer(a)shell.portal.com said: >> On Sat, 9 Dec 1995, Joel McNamara wrote: <SNIP> >> What would make a University less secure than a corporation?? > >1) Usually more net connected hosts. >2) Lack of adequate sysadmin attention/knowlege. >3) Vague and poorly enforced site security policies. IMHO Microsoft has no concern about the security of any university; educational institutions will standardize on whatever OS the majority of their students are familiar with (=Windows whatever). No, the big priority in Redmond is winning (and keeping) corporate customers. A corporation can standardize around whatever the management likes. A large Virginia-based metals corporation recently standardized on the M$ Office suite with little regard to the hundreds of users who had already effectively entrenched with WordPerfect. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMNIxEY8AYvAI/GnhAQEveQQAtyPwljkPyBCyeD0fv5Bb83TQ4UX6P+g4 tqgQSH+7LpYORHxJvMmWVTocUHWdo+rkx8AngFPvhF9fTl6DB1Qyd8RzeL0Od0f9 WJOcbi5BtS/sqbmU82XWypohk5FCE3fMKCvkCMpNy6ptuvbwLBHmastJxt0FJ8kO wwWQENHp6sg= =O/P9 -----END PGP SIGNATURE-----

1 0

The Elevator Problem & Groucho's Duck
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Dec 14, 1995 04:44:12, 'futplex(a)pseudonym.com (Futplex)' was kind enough to respond to my post on the elevator problem. I thought his response was insightful and appropriate but that the description of the problem had changed a bit since the problem was first posed. Thus this post. I've been thinking of the old game show hosted by Groucho Marx. You would "say the secret word and win $100." Getting the $100 was easy. The duck would drop down on a string with the money in its beak and you'd just pluck it out. Saying the secret word was also an easy problem to hack. You could just read the dictionary. Of course this hack didn't work in real time because the show only lasted 30 minutes, Groucho did most of the talking, and you had to say the secret word in normal conversation. All of this rather "limited the bandwidth." The elevator problem remains somewhat undefined as a problem. Several parameters are boundaries within which the basic problem must be solved. Two parameters are the length of time Alice and Bob will spend coupled against the desired level of security. Highly specific solutions are effectively impossible until these parameters are defined (or at least approximated). However ... My original solution involved a variation of Merkle's non-patented puzzles. Futplex stated, correctly, that this took a goodly amount of time to generate and transmit the puzzles and the security was "not so hot." My mind still returns to Merkle and the idea of solving the original elevator problem that could be geometric for Alice and Bob while being exponential for the other people on the elevator. The more I tried to focus on this aspect of the problem the more I just repeated the problem in my own mind. I felt that I was trapped in a "maze of twisty little passages, all the same." At this point, this holiday season, I had an image of Merkle sitting by the tree putting an infinite number of prime numbers in an infinite number of boxes. (In the real world I've been fighting with my landlord and suddenly thought of Cantor's first description of the landlord's dilema where a landlord has an infinite number of rooms, all full, when another guest shows up and wants a room.) At this point, I suddenly had an image of Cantor sitting on the floor next to Merkle. Merkle would pack an infinite number of boxes and hand each box to Cantor who would proceed to wrap each box in an infinite number of sheets of wrapping paper. Suddenly, I saw that my first suggested solution put all of the major work on Alice. She had to generate 10^6 prime pairs and send them all to Bob then brute force an average of (10^6)/2 attempts to discover the one pair Bob picked ot factor. This process *might* be speeded up if Bob would, Cantor-like, help out. In other words, have Alice generate and transmit 10^3 prime pairs and have Bob do the same. This cuts transmission time by 5*(10^5), a considerable savings. Then Alice and Bob each have to brute force an average of 5*(10^2) attempts to discover each others primes, for a similar savings. However, you still need a nonpatented algorythm that lets them use the four primes to encypher their message(s) while forcing the others on the elevator to factor an average of (10^3^2)/2 products instead of 2*((10^3)/2). This is still very far from a solution to the elevator problem as re-posed by Futplex but creates at least one way of *potetentially* shortening the prime generation and transmission time issue he was kind enough to point out. I now feel that I am only "trapped in a maze of twisty little passages, all different." Comment, Futplex? --tallpaul

2 1

Re: kocher's timing attack
by Hal 17 Dec '03

17 Dec '03

From: dreschs(a)austnsc.tandem.com (Sten Drescher) > On Firewalls, "Jonathan M. Bresler" <jmb(a)FreeBSD.ORG> said: > JMB> After > JMB> several large key signing parties hundreds of known ciphertexts > JMB> could have been generated using Alice's key--each one a public key > JMB> of someone else. over several years it piles up. the known > JMB> ciphertexts can be tested/analyzed to yield Alice's secret key. > JMB> ouch. ;/ > > Are you sure about this? It would seem that the same principle > would then apply to signed messages as well, and I find it a bit hard to > believe that signing messages would make ones key pair vulnerable. As Kocher's paper implies, the known ciphertext attack is a TIMING attack. Simply accumulating known text/signature pairs as you would have after a "key signing party" does not help. You must know exactly how much time each signature took. Hal

2 1

taking electronic privacy into our own hands
by Eric Anderson 17 Dec '03

17 Dec '03

Would it be possible to write a program ( i.e. a worm or Trojan) to ferret out personal information that is stored in databases and encrypt it? I was just wondering what such an undertaking would entail. Eric

1 0

Is ths legal?...
by Jay Holovacs 17 Dec '03

17 Dec '03

I was told today that students at Oklahoma University have their computer accounts subject to administrative inspection and that encryption (even email) without escrow is prohibited. Maybe the story is not quite straight but federal law supposedly protects personal electronic communication and I somehow don't think OU can overide this simply because it passes thru their computers. Sounds like another job for PGP. Jay Holovacs <holovacs(a)ios.com> PGP Key fingerprint = AC 29 C8 7A E4 2D 07 27 AE CA 99 4A F6 59 87 90 (KEY id 1024/80E4AA05) email for key

1 0

Encrypted telnet...
by droelke＠rdxsunhost.aud.alcatel.com 17 Dec '03

17 Dec '03

I am looking for an encrypted telnet (or rlogin/etc) package that supports a Windoze client. It looks like all the normal ones that I can find (SSH, SRA telnet, SSLtelnet, etc) are just under Unixoids. Don't get me wrong - I would prefer to use Unix, but I am headed off to locations, where I know all I'll have access to is Windows, with a PPP stack to some ISP. I'ld write it myself, - pasteing different packages together, but I need it working in a day or two. Can anyone help me here? Thanks, Dan ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX

3 2

(fwd) Showdown over e-cash
by rah＠shipwright.com 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: dmk(a)zp.tempo.att.com Mime-Version: 1.0 Date: Sat, 16 Dec 1995 20:27:29 -0500 To: www-buyinfo(a)allegra.att.com From: allegra!dmk(a)uunet.uu.net (Dave Kristol) Subject: Showdown over e-cash Take a look at the article by that title at http://www.upside.com/resource/print/9601/ecash.html It's a provocative and rather breathless account of the forthcoming demise of banks as we know them, brought on by electronic transactions. Dave Kristol --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The NEW(!) e$ Home Page: http://thumper.vmeng.com/pub/rah/ >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: Secured RM ? (source)
by jps＠monad.semcor.com 17 Dec '03

17 Dec '03

I don't think this will work. When you > if ( (Pfp = fopen(Pfilename, "wb") ) == NULL) the file will be truncated. Subsequent writes could be anywhere on the platter; you're building a new file. I think you can work this way if you open the file for read/write access, although I'd be more inclined to take the file name into the directory and then walk the inodes. jps -- Jack P. Starrantino (215) 674-0200 (voice) SEMCOR, Inc. (215) 443-0474 (fax) 65 West Street Road jps(a)semcor.com Suite C-100 Warminster, PA 18974

3 2

Re: Motorola Secure Phone
by David E. Smith 17 Dec '03

17 Dec '03

At 04:34 PM 12/15/95 -0800, you wrote: > My AT&T 900 (or is it 9000?) MHz digital cordless phone says >the same thing. I figure it uses a weak cryptosystem. There is >something about key setup when you return the handset to the base. > (The phone was $200, FWIW) That just refers to the fact that it is no longer legal to sell scanners that can listen in to that range. The same is true of the 800 MHz band (used for a lot of cellular phone traffic). Ah, I love my really old scanner that isn't bound by such limitations... (BTW, a couple of years ago Nuts & Volts ran an article with information on a program and some toys that let a laptop computer, properly wired into a cell phone, act as a cell scanner. Never did wire it up, but it looked like fun ;) ObCrypto: um, if you can find it, let me know :) ----- David E. Smith, c/o Southeast Missouri State University 1210 Towers South, Cape Girardeau MO USA 63701-4745, +1(573)339-3814 PGP ID 0x92732139, homepage http://www.midwest.net/scribers/dsmith/ Dec15-Jan15: (618)244-3340/2209 Perkins, Mt Vernon IL 62864Quote: "If I wanted thrills and danger and lots of rampant violence, I coulda been a postal worker!" -- Ben, "Sensational Spider-Man"

1 0