December 2003 - cypherpunks-legacy

Re: Mondex
by nobody＠replay.com 17 Dec '03

17 Dec '03

Jim Ray was right, Vulis. Eat your lithium.

1 0

FWD: Binding crypto
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

FORWARDED MESSAGE =++=++=++=++=++=++=++=++=++=++=++=++=++=++=++=++=++=++=++=++=++=++=+= In this message, we introduce binding cryptography, a new proposal for establishing an information security infrastructure that does not hamper law enforcement. We present an alternative that can give law-enforcement agencies access to session keys, without users having to deposit private keys. Unilateral fraud in this scheme is easily detectible. We outline the proposal below, and announce two articles which will describe the proposal in more detail and which will provide the legal and the technical context. The text is also available at http://cwis.kub.nl/~frw/people/koops/binding.htm. 9 October 1996 Eric Verheul, everheul(a)ngi.nl Bert-Jaap Koops, koops(a)kub.nl Henk van Tilborg, henkvt(a)win.tue.nl ------------------------------------------- (c) 1996 Eric Verheul, Bert-Jaap Koops, Henk van Tilborg This message may only be redistributed in its entirety and with inclusion of the copyright notice. Credit if quoting. _Binding Cryptography, a fraud-detectible alternative to key-escrow proposals_ _1. Introduction_ Information security, and so cryptography, is essential in today's information society. A robust (information) security infrastructure must be set up, including a Key Management Infrastructure. However, the unconditional use of encryption by criminals poses a threat to law enforcement, a problem that is hard to solve. Consequently, governments have two tasks. The first is stimulating the establishment of a security structure that protects their citizens, but which does not aid criminals. The second task is coping with the use of encryption by criminals outside of this framework. We think that encryption outside of the framework (e.g., PGP) should not be outlawed - but it need not be mainstream either. It is crucial that any such established security structure is widely accepted and trusted, as this will lower the demand for encryption outside of this framework, and so will make the second goal easier to achieve (or, at least, not more difficult). The establishment of such a widely accepted and trusted security structure is now the challenge that (US) IT businesses face if they want to participate in the recent CLIPPER IV initiative. _2. Binding cryptography_ In a series of two articles, we address the establishment of an information security infrastructure. Several proposals have been made by governments and others to establish such an infrastructure, but a satisfactory overall solution remains yet to be found. In the non-technical article [VKT], we review several technical proposals and a few government initiatives, focusing on key-escrow proposals. We present a series of criteria that acceptable solutions should meet, and note that all proposals so far fail to meet many of these criteria. We argued that the establishment of a worldwide security infrastructure can not be achieved without strong cooperation of governments. In fact, governments themselves should take up the challenge of establishing a security infrastructure, based on public-key encryption, which does not hamper law enforcement. We offer a new solution to achieve this: "binding data", which also improves upon current proposals. It has the advantage that it helps the establishment of a strong security infrastructure which discourages abuse for criminal or subversive purposes by making unilateral abuse easily detectible. It allows a straightforward monitoring of compliance with law-enforcement regulations, without users having to deposit ("escrow") keys beforehand. Thus, an information security infrastructure can be established, which does not worsen the crypto problem for law enforcement. Metaphorically speaking, our solution consists of equipping public-key encryption systems used for confidentiality with a (car) governor (a speed-limiting device). The specifications of this governor are rather general, and so many systems can probably be equipped with them. It is inspired by the proposal of Bellare and Rivest [BR], in which users' encrypted messages consist of three components: 1. the (actual) message encrypted with any symmetric system, using a random session key; 2. the session key encrypted with the public key(s) of the addressee(s); 3. the session key encrypted with the public key of a Trusted Retrieval Party (TRP). In effect, the TRP is treated as a virtual addressee, although the message is not sent to it. When a law-enforcement agency is conducting a lawful intercept and strikes upon an enciphered message, they take the third information component to the TRP. If shown an appropriate warrant, the TRP decrypts the information component and hands over the session key, so that the law-enforcement agency has access to the message. Observe that users are not obliged to escrow their (master) keys, they only give access to the (temporary) session keys used in the communication. The concept of "virtual escrow" has been the base of several escrow products (AT&T Crypto, RSA Secure, TIS Commercial Key Escrow). The main drawback of this concept is that it offers no possibility, at least for others than the TRP, to check whether the third component actually contains the (right) session key; moreover, the TRP will only discover fraud after a lawful wiretap. This renders the solution almost entirely unenforceable. Therefore, we propose a binding alternative, which adds a fourth component to the encrypted message: 4. binding data. The idea is that any third party, e.g., a network or service provider, who has access to components 2, 3 and 4 (but not to any additional secret information) can: a. check whether the session keys in components 2 and 3 coincide; b. not determine any information on the actual session key. In this way, fraud is easily detectible: a sender that attempts to virtually address a session key to the TRP (component 3) that is different from the real one he uses on the message (or just nonsense) will be discovered by anyone checking the binding data. If such checking happens regularly, fraud can be properly discouraged and punished. The binding concept supports the virtual addressing of session keys to several TRPs (or none for that matter), for instance, one to a TRP in the country of the sender and one in the country of the addressee. The solution therefore offers the same advantage for worldwide usability as the Royal Holloway [Holl] concept. We also remark that the concept supports the use of controllable key splitting in the sense of Micali [Mica] as well: a sender can split the session key and virtually address all the shares separately to the addressee and various TRPs using the binding concept. Moreover, the number of shares and the TRPs can - in principle - be chosen freely by each user. Finally we remark that the time-boundedness conditon (the enforceability of the timelimits of a warrant) can be fulfilled by additionally demanding that encrypted information (or all components) be timestamped and signed by the sender; a condition that can be publicly verified by any third party (e.g., monitor) as well. A PKI that incorporates binding data hence has the following four players: - Users, i.e., governments, businesses, and citizens, - TTPs offering trusted services (e.g., time-stamping and certification of public keys), - TRPs aiding law-enforcement agencies with decrypting legally intercepted messages, - Monitors, monitoring communications encrypted via the PKI on compliance with binding regulations. For instance, these could be network operators or (Internet) service providers. In [VKT], we explain how we envision the framework in which the binding concept could present a security tool in the information society. We think the concept is flexible enough (e.g., in the choice of TRPs) to be incorporated into almost any national crypto policy, on both the domestic and foreign use of cryptography. In a mathematical paper [VT], Verheul and Van Tilborg propose a technical construction for binding data for an important public-key encryption system: ElGamal. This construction is compatible with Desmedt's [DESM] traceable variant of ElGamal. The construction is based on the techniques used in zero knowledge proofs. We expect that these constructions can be improved and that various other public-key encryption systems can be equipped with binding data. We present this as a challenge to the cryptographic research community. An outline of the mathematical construction of binding ElGamal can be found at http://cwis.kub.nl/~frw/people/koops/bindtech.htm. _3. References_ [BR] M. Bellare, R.L. Rivest, "Translucent Cryptography. An Alternative to Key Escrow, and its Implementation via Fractional Oblivious Transfer", see http://theory.lcs.mit.edu/~rivest [Desm] Y. Desmedt, "Securing Traceability of Ciphertexts - Towards a Secure Key Escrow System", Advances in Cryptology - EUROCRYPT'95 Proceedings, Springer-Verlag, 1995, pp.147-157. [Holl] N. Jefferies, C. Mitchell, M. Walker, "A Proposed Architecture for Trusted Third Party Services", Royal Holloway, University of London, see http://platon.cs.rhbnc.ac.uk [Mica] S. Micali, "Fair Public-key Cryptosystems'", Advances in Cryptology - CRYPTO '92 Proceedings, Springer-Verlag, 1993, pp. 113-138. [VKT] E. Verheul, B.J. Koops, H.C.A. van Tilborg, "Binding Cryptography. A fraud-detectible alternative to key-escrow solutions", Computer Law and Security Report, January-February 1997, to appear. [*] [VT] E. Verheul, H.C.A. van Tilborg, "Binding ElGamal. A fraud-detectible alternative to key-escrow solutions", will be submitted to Eurocrypt97. [*] For the Computer Law and Security Report, send subscription enquiries, orders and payments to: Pam Purvey The Oxford Fulfilment Centre PO Box 800, Kidlington Oxford 0X5 1DX UK Tel: +44 1865 843373 Fax: +44 1865 843940 For the United States: Elsevier Advanced Technology Fulfilment (enquiries) 660 White Plains Road, Tarrytown New York, NY 10591-5153 USA Tel: 914 333 2458 --------------------------------------------------------------------- Bert-Jaap Koops tel +31 13 466 8101 Center for Law, Administration and facs +31 13 466 8149 Informatization, Tilburg University e-mail E.J.Koops(a)kub.nl -------------------------------------------------- Postbus 90153 | This world's just mad enough to have been made | 5000 LE Tilburg | by the Being his beings into being prayed. | The Netherlands | (Howard Nemerov) | --------------------------------------------------------------------- http://cwis.kub.nl/~frw/people/koops/bertjaap.htm --------------------------------------------------------------------- -- " The way to combat noxious ideas is with other ideas. The way to combat falsehoods is with truth. " -- Justice William O. Douglas, 1958

2 1

Re: RSA 1024bit Key for Export
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:26 AM 10/19/96 +0700, you wrote: >Just a short question : >What is the exportable maximum key length of RSA if >use for encrypting session keys? My local Cylink VAR >in Malaysia says it is 1024bit for encrypting the >Omega algo. There isn't one well-defined limit that applies to everything. You still need to ask for permission, and they still have arbitrary power to grant or not grant it, though they have some guidelines about what they will usually approve and what they usually won't.* I've seen 512-bits as the usual number, but the session key has to be for a weak symmetric-key cypher like RC4/40. They probably wouldn't approve 512-bit keys for encrypting session keys to be used with triple-DES or IDEA or RC4/256. Cylink may have permission to use 1024 bits in some specific export-approved product (I'm guessing that's what Omega is?), but that isn't something you can get approved for general use, unless the NSA has relaxed a bit under pressure. Padgett's response on coderpunks wasn't really relevant - the section he was quoting was for authorization-protecting systems only (e.g. protecting PINs), explicitly saying that it wasn't for encrypting files or text, which would affect session keys used to encrypt files or text. (*They also have guidelines about how fast they will usually approve or reject things, but they still haven't approved or rejected Raph's application for exporting the RSA T-shirts after a year, and the shirts are now semi-obsolete because the RSA implementations are shorted now :-) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

1 0

[NOISE] Re: Q.E.D. reply to petty MESSger
by Jim Ray 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Sat Oct 19 21:13:00 1996 Don Wood writes: ... > ... I headed the OTP group at NSA, ... ... For those of you also on fight-censorship, I hereby rest my case regarding deficiencies in the NSA's hiring practices. :) JMR One of the "legitimate concerns of law enforcement" seems to be that I was born innocent until proven guilty and not the other way around. -- me Defeat the Duopoly! Vote Harry & Jo http://www.HarryBrowne96.org/ ___________________________________________________________________ PGP id.E9BD6D35 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 I will generate a new (and bigger) PGP key-pair on election night. <mailto:jmr@shopmiami.com> http://www.shopmiami.com/prs/jimray ___________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMml8oW1lp8bpvW01AQFP3AQArzx/eUWKl4Pc9l3YWk4CUIqtWlPQoo6v vi+F6KXi+VUTKgkSJAW8GZWgFrk3cJxrJVJnESCC0WPwzaEiMmDvW0y2bRhxSxX5 XYuIBMmMDM2j+eYddwI0ip8uiBUSTvPu23m5hBKmEsBv5+8CsJ13xhwXD+g+2Rtm sAEO3P5xtfo= =fWFy -----END PGP SIGNATURE-----

1 0

Re: NSA/GCSB spying shown on NZ television [RANT]
by azur＠netcom.com 17 Dec '03

17 Dec '03

>clint barnett wrote: [snip] >If you think that you >can resist the NSA and win, more power to you, and I'll help if I can, but >I don't think you can.However, I strongly believe that you have the power >to limit the information they steal from you, and thereby limit the >control they have over you. If you can keep your wits about you, act fast >when you have to, and run away to fight another day, then you can maybe >do some good, but don't make a martyr of yourself or anyone else, because >martyrs can't write code, they can't attack or defend a system, they can >only lay there and rot in jail or in the ground. > To paraphrase Gen. George S. Patton, "No dumb bastard ever won by dying for his cause, he won by making the other poor dumb bastard die for his." PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Snoop Daty Data | Internet: azur(a)netcom.com Grinder | Sacred Cow Meat Co. | --------------------------------------------------------------------- Counter-cultural technology development our specialty. Vote Libertarian. Just say NO to prescription DRUGS. "Of all tyrannies, a tyranny sincerely exercised for the good of its victims may be the most oppressive." -- C.S. Lewis "Surveillence is ultimately just another form of media, and thus, potential entertainment." -- G. Beato

1 0

Re: is there no end to Murder Politics & Creative Wiretap
by Jean-Francois Avon 17 Dec '03

17 Dec '03

On 19 Oct 96 at 15:08, jim bell wrote: > >At 02:14 PM 10/19/96 -0400, hallam(a)ai.mit.edu wrote: > >>Murder Politics (lets give your psychopathic scheme an acurate name) to assasinate = to commit murder : the previous term was accurate... Why nitpick? > >>will never be functional. If anonymous cash implied muder politics then > >>society would be right to reject anonymous cash. The thing is, *how* exactly are you gonna prevent the advent of e-cash? The same mechanisms that will make a group try to prevent it's apparition will work for groups that try to promote it. Prostitution was virtually always repressed. But was it ever eradicated? Only, the odds are immensely stacked in favour of AP as long as *any* kind of e-$ exists. Doesn't even have to be denominated in dollar, donations could very well be made in ounces of gold... > >>It is easily done > >>since money only has value so long as it is convertable. > >> > >>Not only are rights dependent on a social infrastructure that > >>guarantees that they will be respected but currency is as well. > >>Without the social and political infrastructure of the US > >>government a dollar bill has only the value of the paper its > >>printed on. An electronic balance has zero value. Well, let's get into that passionnate topic... Many peoples pretend that theses pieces of paper are worth nothing *right now*. But what about gold e-bonds? You don't like gold? OK, what about a composite of precious metals, patented antibiotics, some choosen chemicals, some choosen stock, etc, all of them *privately owned* by the issuing bank? :-) ROTFL! > >>If you want to live in a society where the political system has been > >>"reformed" through murder of inconvenient politicians then go and > >>live in Columbia. Its the nearest thing you will find on the planet > >>to libertopia. > > > >No, not nearly enough politicians have been killed in Columbia to result in a > >society that could best be described as an "anarchy." While some peoples want anarchy, I jsut want peaceful living... The example of Columbia is completely out of context. Some dictators were replaced by other dictators, both being different sides of the same coin. In Columbia, any member of the gang of drug cartels could be identified and get targeted by peaceful citizens the same way they would target politicians. AP would thus stop street terror. AP is not against govt per se, it is something acting against any opressing "leadership", whomever it might be. Jim Bell's conviction being that the human animal is basically a reasonnable animal that enjoys life, AP, IHHO, will bring a world in which the golden rule will be "live and let live (or die).... or get killed". Here, "live and let live (or die)" is opposed to "live and make die (or live)" The operative is *let* versus what we currently have now: "make" Jim Bell, as it is evident by his writings, believe that the word "freedom" means "to be free from other men". In that sense, an I think that I am quoting him, he claims that anarchy is not "the lack of order" but rather the "lack of orders". jfa Jean-Francois Avon, Pierrefonds (Montreal) QC Canada DePompadour, Societe d'Importation Ltee Finest Limoges porcelain and crystal JFA Technologies, R&D consultants physicists and engineers, LabView programing PGP keys at: http://w3.citenet.net/users/jf_avon ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 ID# 5B51964D : 152ACCBCD4A481B0 254011193237822C

1 0

Re: IP: - Biham/Shamir Differential Fault Analysis of DES, etc
by azur＠netcom.com 17 Dec '03

17 Dec '03

>Note that this attack requires physical access to the DES chip, to >stress it so it will fail. It works great against "tamper-proof" >devices such as smart cards. It doesn't work against encryption >happening at any distance from the attacker (e.g. across the network). >It doesn't work against stored information like PGP-encrypted >email messages either. > >However, it might be possible to use the attack by beaming disruptive >energies (heat, electrons, microwaves, etc) at a computer which is >doing a lot of encryption, while simultaneously monitoring that >computer's activity across a network. > > John Although using physical/electrical attacks to cause circuit disruptions to ICs (like smartcard) may be feasible, it appears to be much more difficult to mount this sort of attack on specially hardened crypto modules, which can more effectively isolate themselves from invasive sources or detect them and take action (i.e., key clearance) before an attacker can pry out their secrets.

1 0

Re: Writing A Remailer
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:06 AM 10/20/96 -0700, William Davidheiser <wgd(a)netcom.com> wrote: >Hi all. I want to try to write a re-mailer that will run on my ISP's UNIX >shell account. I am familiar with Windows socket programming (C/C++) but >have never done anything in the UNIX environment. > >Any pointers on where I should start? I'd start by looking at the existing remailers, and thinking about the problems they're trying to solve and the service objectives they have. Mixmaster code is easy to find, and I've got my own modified ghio2 somewhere under my web page (idiom.com/~wcs/remailer, probably). Freedom remailer is another Type 1. Nymservers are trying to solve a different, and harder, problem. Writing a remailer that solves a slightly different problem than the others is a good thing to do. For instance, a remailer that's useful at work, such as one that decrypts PGP mail and forwards it inside the domain, or one that only sends mail to the suggestion box account, could gain acceptance and help add respectability for remailers. I don't remember if code for the Winsock remailer is available, but it works by fetching mail from a POP3 server and remailing it out SMTP servers. Also, you could benefit from feedback from people who used to run remailers and have switched to other code or quit. The usual problem is abuse, whether it's spam posted to the net, mailbombing victims, or forging mail/postings from victims to lists/newsgroups that will generate flames in response. Any blocking code you can write is good - you definitely need to be able to block by source, destination, and Subject:, and grepping message bodies may help. Limiting source and destination to pre-approved lists is also a good feature. Good code for auto-detecting attacks would help, e.g. shutting down or blocking if you get more than N messages for a given source or destination in a given time period, with a tolerable user interface for the administrator. You also need to integrate with encryption - PGP is the obvious choice (it'll be _so_ much easier when PGP 3.0 comes out, as we've been saying for the last couple of years :-) but S/MIME or SSL may also be good. I'd recommend having the default behaviour be to refuse non-encrypted mail - otherwise, any eavesdropper can compromise your system. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

1 0

Don't ask why, thank you.
by red 17 Dec '03

17 Dec '03

Why? Date: 20th October 1996. The purpose of life,... is not to be found. I have been pursuing this thought and question to many of the people I have met in the past few weeks. Sad enough to report that I have found no answers or clues that if anyone ever know what it is or could be. One thing for sure is material and physical objects are close to replacing the purpose, the real purpose if there is one. I am still quizzed on how there is a purpose in which we all strive to attain. There must an objective somewhere which clearly states,"You, whatname whatage, will have to do this, do that." Somehow, in the pursuit for the answer I have strained my physical and emotional self. I have realised what I am doing and that I am actually directionless, like all the people I know. Doing things for the sake of doing. Clearly, I think television or rather, the mass media in general has caused the gradual eradication of purpose in life for many people. What do you want? What do I want? Sure enough, we do not ask ourselves that question once too often, but spending more time pondering about it, it really makes no sense in what we do having corellation to what we want. What is it actually that we seek in life? Which brings us back to the time when we thought we had a purpose. Could you recall the times when you really wanted something? Or someone? Why? Simply because we didn't have it. It's a mass media driven, pointless race to own something, which actually doesn't make much sense. I am not sure why all of us are acting the way we are. In trying to understand it, I began to question why I would want to know. Why do I want to know? So that I could talk about it? Write a book? Be famous and rich? Be respected? Now, take a minute off and think of what you just read. It's from the media to the people. The people made the media. People are driving people nuts. Is this what we want? Once you shrink the big picture, you realise that nothing makes any sense anyway. And what is "making sense"? What do we gain from realising all this which makes us act and live the way we are? We get to past our time. Since we were born, we had nothing except time. Shitloads of it, excuse me. So we start doing things. Things that actually do not mean much to us but, "heck, I've got all the time in my life" So, it starts to generate a sort of hype, "hey, he's doing something, maybe I should too." Then another fella comes in, "Well I've got nothing to do, maybe I should tell others what these two guys are doing" So the snowball gets rolling. The moment it stops, if it ever stops, I guess we go crazy. Now what is crazy? Understanding why we actually have no reason of being here? I'm not going to start on religion, if you're getting my rift here. So here we are, pretending that we love this and like doing that. Okay, I admit somethings are fun but 90% of the time you realise, "gee, what is it that I want?" If everyone were to ask the same question at the same time, then we'd all be crazy or something, whatever. The problem is, there's five billion people and each one not voicing what they think would hold themselves back by saying "Now, if I say that, these guys would think I'm nuts, and my..." Some do get to express, and once they express it, they are lost in the world of understanding, they realise that we all have no reasons, logical or whatsoever, to be where we are doing what we think we need to do. Now these guys are labeled "nuts" and grouped together. See how happy they are in "Cuckoo's Nest". Okay, so the interns are a little pain in the ass. But look at yourself! We are basically doing things of no relevance. Question what you do with "So?" You are bound to realise what you have probably tried to hide all your life. That we are all alone. That we are all meaningless. That we are all trying to hide from each other what we fear. No, this is not a scam. And sorry, I don't have the solution. I guess we are the same. In the dark we are alone, in the bright we skin and hide. rednax(a)tm.net.my http://www.asiapac.net/~rednax "I have seen little angels turn bad But that's just because they have grown Likewise the problems I currently access They are small matters full blown"

3 2

Mondex -Reply
by Raymond Mereniuk 17 Dec '03

17 Dec '03

>>> Anonymous <nobody(a)replay.com> 10/19/96, 12:00am >>> Timothy C. May must have been sharing needles with a rabid hedgehog. To Anonymous Just as a matter of interest, my own personal interest, what type of society do you come from? The insults are not the type normally originating from a person of the American type culture as these insults would mean nothing to the average American. I have been to places where people give serious concern to such statements but I doubt many people in those places read this list and I doubt anyone on this list does anything but delete your messages. But, please give me a hint where you developed this classy style of insulting the character of Mr T. C. May. Normally Lurkin Raymond

1 0