December 2003 - cypherpunks-legacy

Cypherpunk Mailboxes?
by William H. Geiger III 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi, I have a thought for addressing the anon. problem. We could create a network of anonymous remailers with mailboxes. All messages in the mailboxes are stored encrypted. No information about the users are keep. Users would be be given x K of mailbox space. We could use PGP keys for encrypting the messages. Each user would have his own key pair for his anonymous mailbox. Any plain text messages received to the server would be encrypted on recept. Let the government's subpoena away. :) "Sorry we don't have user addresses, no I can't decrypt those messages Senator." <BEG> What do you think? - -- - ----------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting WebExplorer & Java Enhanced!!! Merlin Beta Test Site - WarpServer SMP Test Site Author of PGPMR2 - PGP Front End for MR/2 Ice Look for MR/2 Tips & Rexx Scripts Get Work Place Shell for Windows!! PGP & MR/2 the only way for secure e-mail. Finger whgiii(a)amaranth.com for PGP Key and other info - ----------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMisGh49Co1n+aLhhAQHvAgP/aLktPSyoj3Ps7OnJ2LXlSIJJQq+B3GiA TlGFJ/DZVF9Ai9rKMzjgmTiukLY/+Hf58vrw7QjJA7wp/fcGOZoYNnMt0mW09wsp biUtXnMkX86sW2abtazy6U3f+DR15lGi9S2F0dvZERmFCdUX5Yi5geoa31Zezght Sj/0sFT+AUk= =7tw/ -----END PGP SIGNATURE-----

3 3

Re: The Esther Dyson Flap
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:59 AM 9/3/96, Chuck Thompson wrote: >I don't quite understand the position taken by Mr. Assange and Mr. Unicorn >regarding recent statements attributed to Ms. Dyson. I would appreciate >some additional insight. > >It appears as though they are both critical of statements (taken out of >context according to Dyson) because of her position with the EFF. It >appears that they both believe that she has no right to her opinion if it is >contradictory to the policy of the EFF. Certainly no one is suggesting she should have her right of free speech taken away from her, as a citizen. Rather, these are precarious times for the future of the Net, with actions in many countries, including the U.S. to restrict the Net in various ways. Esther Dyson is in an influential postition, not just because of her new role as Chairman of the EFF. Anytime a person of her influence is seen to be supporting limitations on what private citizens can communicate to others or to the public at large, this is cause for worry. (As both John Gilmore and Stanton McCandlish have noted, anonymity has a long history in the United States. From the Federalist Papers, to anonymous leafletting (upheld by the Supreme Court), to anonymous letters to the editor, to the basic architecture of the Postal System and the phone system, anonymity has been with us for a long time. Esther Dyson says that anonymity on the Net can do more damage than anonymity in other forums, and thus may need to be regulated and restricted in various ways. I disagree, as "the Net of a Million Lies" (to use Vinge's term) has grown up with anonymity, and few people take the anonymous (or not) rants and charges made in the millions per day with the same degree of certainty they take print comments. Put another way, there is no clear and present danger. And the Net makes for effective counterspeech. As free speech advocates note, the proper remedy for bad speech is more speech. (The links between "free speech" and "anonymity" are fairly obvious, and curtailing one curtails the other. "Congress shall make no law restricting speech" says nothing about anonymous speech being subject to regulation.) Further, the computerized nature of Net speech makes other remedies available as well. For example, reputation-ratings services. And digital signatures (to preclude forged comments). Speech on the Net closely resembles idiots, scholars, dweebs, and scoundrels ranting in public parks. Sometimes they accuse the mayor of adultery, sometimes they rant about UFOs, sometimes they merely utter obscenities. All are potentially dangerous, potentially ignorable, potentially humorous. And yet in none of these cases is there a demand that identification be produced, that one's papers be in order, that a "free speech license" be produced upon demand by the authorities. (Some might say that the physical personna of the speaker means that a means of last resort--apprehending the person--exists to track down a speaker of illegal thoughts, and that this is the kind of last resort that is currently lacking for Net speech. Perhaps. But this very same lack is evidenced with anonymous pamphlets, with anonymous pieces written for newsletters (where even an editor may not know the author), and with phone calls, say, to radio call-in programs. Clearly someone calling "The Howard Stern Show" and making a preposterous, or even illegal, claim is reaching many more people than is some anonymous message to a Usenet newsgroup. Again, where is the clear and present danger with anonymous Net speech that would justify (putatively) greater restrictions on Net speech than other speech channels have?) >Pouncing on someone, without knowing all the facts, who is vulnerable >because of their position smacks of dirty politics - it is distasteful. Why >not ask for the facts from the source? Then state your opinions or make >your threats about not contributing financially. Well, many of us did not pounce. Speaking for myself, I strongly suspected that the newspaper article had summarized a more-nuanced point and had effectively taken just a convenient sound bite. (Also, I'd heard Dyson speak on anonymity issues before, and knew her to have some doubts about full-blown crypto anarchy.) Now that she has somewhat clarified what it was she actually said, more issues have been raised. I believe she does not understand the problems implicit in trying to provide "accountability" for online speech. What if, for example, I offer to forward things I receive to various online forums? Am I then violating a law by "anonymizing" a message? Am I supposed to check identities? (How?) Are remailers to be declared illegal? If not, all other "accountability" laws go out the window. This is the "knife edge," or "fork in the road," I've long talked about. If anonymity is outlawed, it will take draconian measures to enforce it--citizen-unit ID cards, officially issued encryption keys, escrow, monitoring of communications, massive penalties to deter illegal use of encryption, and other police state measures. On the other hand, if enough degrees of freedom are left untouched, the result is a growing, expanding crypto anarchy. Government will find itself powerless to control commerce (handled via encrypted channels), will find it doesn't know the True Names of various Net entities, and will end up being chased into an enclave of things it _can_ control. My strong hunch is that no stable solutions lie between these two extremes. This is one of those "decision points" for modern society, with attractors pulling the solution to one side or another. We know which side we stand on. It's possible that Esther Dyson is finding herself on the other side, alongside Dorothy Denning, Louis Freeh, Donn Parker, and the other advocates of "responsible freedom." (Anytime you hear someone speaking of "responsible freedom," look out.) I don't call her our enemy. Perhaps she just hasn't thought things through as deeply as many of us have. Given that I think EFF has pretty much lost any role it may have once had, for a variety of reasons we're probably all tired of hearing about, I'm not too worried about what the EFF says or does on this issue. I'm more worried, to be honest, that a person as influential _for other reasons_ as Esther Dyson is talking about responsible freedom and the need to limit certain forms of speech. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

LInteger Version 0.1: A C++ MPILIB
by janke＠unixg.ubc.ca 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- LInteger is a C++ library designed to allow programmers to create and perform arithmetic on objects representing nearly arbitrary precision integers. Thanks to C++'s support for operator overloading, the use of the large integers in this library should be nearly as easy as the use of regular int's. In fact, much code which performs arithmetic on regular int's can be converted to code to perform the same arithmetic on arbitrary precision integers merely by substituting "LInteger" for "int". This library is free for both commercial and non-commercial use. (See the COPYRIGHT notice included in the source distribution for exact details.) The current version of this library is only implemented for i386+ processors, and will, probably, only compile unhacked under gcc. Additionally, it has only been tested on the Linux operating system, though I am fairly confident that it will compile, unhacked, under the OS/2 and Windows versions of gcc. (Please let me know if you get it to work!) The basic multiprecision methods are implemented in i386+ assembly language for high speed. Multiplication is performed recursively resulting in O(lg 3) performance. Modular multiplication can be performed via Montgomery representations for a noticeable performance gain when a large number of these modular multiplications are performed. HTML documentaion for all public methods is included. There is currently no pseudo-random or probable prime number generation included. These are my highest priorities for the next release which will, hopefully, come out shortly after I read Rabin-Miller. :) A link to the latest version of this library can be found at http://www.interchg.ubc.ca/janke/linteger/index.html Once you have the file linteger-v0.1.tar.gz, uncompress and untar it with tar -zxvf linteger-v0.1.tar.gz. Next, cd to the newly created directory linteger-v0.1 and read the file README for details on how to proceed. The message digests for linteger-v0.1.tar.gz are MD5: B518B338D59A8376095B9CAD74EA2E16 SHA: 445D8D1555DC18AB0DF47B9B0381F0B07D4CB644 HAVAL: 53774BA2BF60116DF9F0F476913252188DFD9D3828D19B6795BC14C19EFA7FEE -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: noconv iQCVAwUBMitSJR6H/su8/YEZAQH3lwQAsBpNY0rEW1U5vq5hkxdnqxgk1ZZtSV3K 5gTlYu7Z3OAqsqC62Qi7LlkI2dzhrNWYr/G+OXdFfCaHfBcNlePgHsj6xF4oCy3U iGy9yiCxP7Xs4xb8CjHYkW7S/HfVwyiY2AMxGJ/YfFzvi1MJTIT2A8z4Par5qwWe XuG7XztGzAI= =wq2q -----END PGP SIGNATURE-----

1 0

Re: Los Angeles Times article on Helsingius and anon.penet.fi
by jim bell 17 Dec '03

17 Dec '03

At 02:06 PM 9/2/96 -0700, Stanton McCandlish wrote: >You have to have an anonymizing system that crosses a dozen or so >national boundaries to make such an attack infeasible for most large >organizations. You'd need a system that crossed 50 or more widely >disparate jurisdictions to make it infeasible to large intelligence or >law enforcement agencies, and even then you'd have to NOT have broad >international agreements, such as you'd called for or it would be trivial >to force all the remailers in the chain to cough up personally >identifiable information. > >> My assumption is that there will be a wide variety of Net communities with >> different rules/regulations/attitudes towards anonymity that would apply ex > >This is already true. > >> some kind of international sanctions; I think that's appropriate. > >That's what bugs me - if there are some kind of sanctions coming from a >governmental body (I may be misinterpreting you here), that's probably >enough to kill private and well as public anonymity on the Net. > >Incidentally, if something does happen from a governmental direction to >kill online anonymity, it will probably be readily broadenable to all >other media. At the risk of sounding like a broken record (a phrase that will get ever more obscure now that we're in the CD era...) that's why I pushing AP (Assassination Politics.) While anonymous remailers and chains are great for security, there ought to be some final bulwark against violations of our security and anonymity that doesn't depend on legal arguments, or even technical refinements of encryption. When organizations such as CoS can seek Penet data with impunity, and when courts in Finland can let them, we're not safe. Remember the saying, "The best defense is a good offense." Playing as we do now, it's like saying, "We'll try our best to maintain our security, but if it fails too bad." I propose changing it to, "We'll try our best to maintain our security, but if you manage to violate it anyway you're dead." As rude as it may sound, one of the best advantages is that this defense is free while it's not needed, and is pretty cheap when called upon. In case anybody has any residual doubts as to whether we should enforce our rights in this way, consider this: if we've decided that we have the right to anonymity and security (through remailers and encryption) EVEN IF some people might misuse those tools to cause crime and potentially even death (which, of course, would be an exceedingly rare outcome) then I suggest we've already accepted the principle that our rights to use these tools daily are more important than the possibility of a rare negative outcome. (in the same sense that occasional fatal car accidents don't justify taking away all cars.) And if that's the case, we should also be willing to DELIVER a rare negative outcome to anyone who acts to take these rights away, particularly if such a person is adequately forewarned of our intentions. Jim Bell jimbell(a)pacifier.com

1 0

POT_hot
by jya＠pipeline.com 17 Dec '03

17 Dec '03

Foreign Affairs, Sep/Oct, Lead Essay: "Postmodern Terrorism. The terrorism of the future may be far more destructive than terrorism as we have known it." An informative survey and pot-heat by Walter Laqueur. Terrorism's prospects, often overrated by the media, the public, and some politicians, are improving as its destructive potential increases. Terrorism has replaced wars between nations of the 1800s and 1900s. In the future, terrorists will be individuals or like-minded people working in very small groups. An individual may possess the technical competence to steal, buy, or manufacture the weapons he or she needs for a terrorist purpose. The ideologies such individuals and minigroups espouse are likely to be even more aberrant than those of larger groups. And terrorists working alone or in very small groups will be more difficult to detect unless they make a major mistake or are discovered by accident. Society has also become vulnerable to a new kind of terrorism, in which the destructive power of both the individual terrorist and terrorism as a tactic are infinitely greater. The advanced societies of today are more dependent every day on electronic information. That exposes enormous vital areas of national life to mischief or sabotage by any computer hacker, and concerted sabotage could render a country unable to function. Why assassinate a politician or indiscriminately kill people when an attack on electronic switching will produce far more dramatic and lasting results? If the new terrorism directs its energies toward information warfare, its destructive power will be exponentially greater than any it wielded in the past -- greater even than it would be with biological and chemical weapons. The single successful one could claim many more victims, do more material damage, and unleash far greater panic than anything the world has yet experienced. ----- http://jya.com/pothot.txt (30 kb) POT_hot (in 2 parts)

1 0

Re: DON'T Nuke Singapore Back into the Stone Age
by Hallam-Baker 17 Dec '03

17 Dec '03

One of the things that you are probably not aware of is that your government tracks every phone call you make and has a complete list of everyone who you comunicate with. This information is then used to identify potential dissidents who can be "monitored" - just like in the old USSR. I know that this is a fact because I know people in the business. They also tell me that they prefer to dissuade people from entertaining guests at home. The assumption being that the more private conversations take place the more opportunities to criticise the government there are. >Now, what makes you think that citizen of Country A has the power or >rights to tell politicians of Country B what to do and what they cannot >do? What makes you think that the concept "country" has any legitimacy whatsoever? The Web is not politically neutral. I intended the Web to be an agent of social change. The corruption of the present social order should be apparent from the fact that we destroy food while people starve, the majority of the worlds population have no political rights and political participation is only available to a tiny minority. The Web will have an effect whenever there is an internal inconsistency within a social order. The interaction of opposed cultures via the Web will reveal these inconsistencies in a manner that requires them to be resolved. The people of Singapore are not going to change their government because the US people convince them of the superiority of US culture. While it is patriotic for a US citizen to believe a-priori in US superiority it is unpatriotic for anyone else. What will change the government of Singapore is revealing the internal inconsistencies of the governments claims. Phill

1 0

Re: SCO giving free licenses to UNIX OpenServer
by David E. Smith 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: hallam(a)ai.mit.edu, cypherpunks(a)toad.com Date: Mon Sep 02 23:01:35 1996 > > > > I doubt it. People don't use Microsoft products because > > of their quality or functionality. > > Errmm.. hate to disappoint but SCO UNIX started life as Xenix which > was written by Microsoft in the dark ages. > Concur. Microsoft products are used not necessarily because of quality or functionality (which are often dubious, but very occasionally present), but because of user interface and/or market share. > Today Linux probably represents the future of the UNIX familly, it > allows people who want to hack at the OS level access to the sources > of a fully functioning OS. This allows people to add in new kernel > features, schedulers and other exotica without having to write a > whole new O/S. I still like FreeBSD. Similar functionality, similar availability- of-source, but very slightly easier to install/run/manage/play with. Similarly free. (FreeBSD was able to find my modem, something I couldn't get Linux to do after most of an hour. Of course I'm a *nix novice for the most part.) > Just don't confuse it with "home computing", this is geek computing > and you better have a lot of interest in computing to use it. Home > computing is the market for users who need a system thats simpler > than a VCR or they can't use it. At one time that meant Apple, today > it means Microsoft, it will never mean Linux - not unless someone > can make Linux much much simpler than it is at present and provide > decent WISIWIG tools such as editors etc. designed for use by aunt > Ethel. I'm not sure about that... X-Windows seems to have a decent interface, runs on Linux, hell, most any *nix you care to name, and has some decent editors available. (Or, there's always emacs, but aunt Ethel might not grok emacs too well. I don't :) - ----- David E. Smith, P O Box 324, Cape Girardeau MO USA 63702 dsmith(a)prairienet.org http://www.prairienet.org/~dsmith send mail with subject of "send pgp-key" for my PGP public key "Ask not what you can do for your country; ask what your country did to you" -- KMFDM, "Dogma" -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMiutozVTwUKWHSsJAQEdCgf+OM8tpEbJh/FonjORnFwe9lo2t+my8eD7 +oM7Gv/WMPekDhvxxolzqGSvgUAJL1sgbwKdray5fHFCwOtK1ogQJrN4qrXKQH5e IXlC+G91i5BUq98MmzsEngZ3Akz2YciY/U4zyEJSXUNigAFgGcuXhZ1Bw+HT3hLt x27h45wWxHWfUJR8EUgOiUDG41rTW3eSLN0Pf/cSyvMTE3c+ub+59SMYJzCO+DnK MjNfhKvFLVNPUGJYNfLGt3OzwJFaCLnuDKLI78R0W+MsCqSA02o4Mq8GRul78Dfi jgBNJEsP8JdZnQTheRCwR4cgwIHc/Csmu+Ab5UN8h5L7VV1u2YFfkA== =PgX+ -----END PGP SIGNATURE-----

1 0

Kill all "libertarians"
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

>From nobody(a)REPLAY.COM Mon Sep 2 12:26:36 1996 Received: by bwalk.dm.com (1.65/waf) via UUCP; Mon, 02 Sep 96 15:42:57 EDT for dlv Received: from basement.replay.com by uu.psi.com (5.65b/4.0.061193-PSI/PSINet) via SMTP; id AA18013 for dlv(a)bwalk.dm.com; Mon, 2 Sep 96 12:26:36 -0400 Received: (from replay@localhost) by basement.replay.com (8.7.5/8.7.3) id SAA11752 for dlv(a)bwalk.dm.com; Mon, 2 Sep 1996 18:26:28 +0200 (MET DST) Date: Mon, 2 Sep 1996 18:26:28 +0200 (MET DST) Message-Id: <199609021626.SAA11752(a)basement.replay.com> To: dlv(a)bwalk.dm.com From: nobody(a)REPLAY.COM (Anonymous) Organization: Replay and Company UnLimited Xcomm: Replay may or may not approve of the content of this posting Xcomm: Report misuse of this automated service to <abuse(a)REPLAY.COM> Subject: All russians are scum. No exceptions. Return-Path: <cypherpunks-errors(a)toad.com> To: cypherpunks(a)toad.com Subject: Re: Sen. Leahy's "impeccable cyberspace credentials" From: dlv(a)bwalk.dm.com (Dr.Dimitri Vulis KOTM) Comments: Dole/Kemp '96! Date: Mon, 02 Sep 96 01:19:37 EDT Organization: Brighton Beach Boardwalk BBS, Forest Hills, N.Y. Sender: owner-cypherpunks(a)toad.com jonathon <grafolog(a)netcom.com> writes: > On Sun, 1 Sep 1996, James A. Donald wrote: > > > > I agree with what you are saying but not all polititions are that bad. > > > You make it sound as if their are no politisions are for freedom of the > > > net. > > So who is the exception? > > Harry Browne Libertarian Party Candidate. Harry Browne is a fucking statist. All politicians are scum. No exceptions. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: SCO giving free licenses to UNIX OpenServer
by Hallam-Baker 17 Dec '03

17 Dec '03

Eric Murray wrote: > > Scottauge(a)aol.com writes: > > Read, Understand, and Delight... Microsoft maybe in trouble at last. > > I doubt it. People don't use Microsoft products because > of their quality or functionality. Errmm.. hate to disappoint but SCO UNIX started life as Xenix which was written by Microsoft in the dark ages. > > This is for single user home based UNIX systems. > > Single-user UNIX isn't all that useful. Multi-user ain't much better. Listen to the guys who built it. UNIX is a program development environment. In the early years it was interesting because there was source available, that ceased to be the case years ago. Today Linux probably represents the future of the UNIX familly, it allows people who want to hack at the OS level access to the sources of a fully functioning OS. This allows people to add in new kernel features, schedulers and other exotica without having to write a whole new O/S. Just don't confuse it with "home computing", this is geek computing and you better have a lot of interest in computing to use it. Home computing is the market for users who need a system thats simpler than a VCR or they can't use it. At one time that meant Apple, today it means Microsoft, it will never mean Linux - not unless someone can make Linux much much simpler than it is at present and provide decent WISIWIG tools such as editors etc. designed for use by aunt Ethel. Phill

2 1

Pseudocrypto detector is going wild (was: Re: ALPHACIPHER - An unbreakable encryption program.)
by C Matthew Curtin 17 Dec '03

17 Dec '03

The following message is a courtesy copy of an article that has been posted as well. -----BEGIN PGP SIGNED MESSAGE----- "Alex Walker" <survival(a)aa.net> writes: > The strongest encryption system available to the public will be available > soon at: > http://www.aa.net/cyber-survival-hq > > ALPHACIPHER has been in the making for the past ten years, and has come > into its own > with the proliferation of Internet communications. > > A demo of this program along with a FAQ can be downloaded from > cyber-survival-hq 1SEP. This is an unbreakable program... Here we go again. I just got done surfing the site above. Assuming that all statements regarding the unbreakability of the cipher, the lack of applicability of the question regarding its key size, etc., are at least based on some degree of truth, "alphacipher" is a one-time pad. Given that anything else is not really "unbreakable," if it's not a one-time pad, the claims about its security are bogus. But let's assume that it is. In exchange for the great security of one-time pads, users of such must be willing to tolerate their drawbacks, and there are some significant ones. 1 The unbreakability of the one-time pad is completely thrown out the window if the key is not _truly_ random. A software based pseudorandom number generator simply won't cut it; even the best PRNGs will have some degree of predicability. It is possible that these random keys are truly random (given point 2, below), but I find this to be unlikely, since the overview boasts that the keys are generated by a "proprietary random key set generator." Now, we're getting into *another* issue, and that is of the wisdom (or, more correctly, lack thereof) in using proprietary algorithms. Not only does this fail to ensure any higher level of security when compared to that of a well-known algorithm, but actually increases the liklihood that an error has gone undiscovered, since fewer experts have had the opportunity scrutinize it. 2 The pool (or "pad") of random bits from which the keys are generated must be distributed ahead of time. Given this requirement, the "random bit pad" must be distributed with the program itself. In fact, the two "comm key disks" seem to be just this. A third "vault key" disk, used for local online storage, seems to be another random bit pad. 3 Keys must stay perfectly in sync. A single bit-shift either way, and you're hosed. Given that there is a finite number of bits in the pad (as there must be, since they need to be precalculated and distributed with the program), that they all must stay perfectly in sync, and that the program appears to be marketed for widespread (albeit low-bandwidth) use, there must be some mechanism by which the encrypting program can tell the decrypting program how far along in the bit pad to advance before using them for the key. Otherwise, if I send a message to Alice, then I send one to Bob, Bob is going to use a different starting point in the pad for the key assembly than I did to create the message, unless he also received a copy of what I sent Alice, and every person before that. Giving an indication of the byte offset to use for decryption seems the only workable solution to this problem. 4 The keysize must be exactly equal to the size of the plaintext to be encrypted. 5 Bits from the pad that are used for key generation must never be used again. Ever. Since there are only two "comm key" disks, which must be the same for every distribution, you can get probably get somewhere between two and 10 million "random" bits on the disks, depending on whether you're using compression, and if so, what compression algorithm you're using. Let's assume that you've got 10 million bits on there. Since the encryption of one bit exhausts one bit from the pad, I can exhaust the entire supply by sending someone a 10MB mail message. Or two five MB mail messages, or 10 one MB messages. In any case, it doesn't take long. And as soon as I'm out, if I start over again at the beginning, I'm blowing the security, since I'm reusing keys. 6 Anyone with access to the key pad can decrypt a message sent to anyone else, as long as they know the proper bit offset. Because of what I've described in item 3, it seems likely that I'll know that ahead of time. Hence, the security of the "alphacipher" encrypted messages decreases with each additional user that "alphacipher" gains. So, it seems to me that I can break *any* message that anyone encrypts with "alphacipher" by getting a copy of the comm key disks, figure out how "alphacipher" calculates where in the pad to begin generating the key, and apply the appropriate key to the encrypted message. Perhaps a bit of additional obfuscation is occuring somewhere in there, but the basic premise is that because of what it's trying to do, this has to be a very poor implementation of a one-time pad, and therefore completely vulnerable to passive attack. (This is using the "comm key"; the "vault key" has much more potential, since it can be unique for every user, but it can still be exhausted very quickly, and therefore have a successful cryptanalysis made of that data, using other means: a larger amount of data will be necessary to reconstruct the bit pad before any messages can be broken, but once again, after it's constructed, anything encrypted using that bit pad can be broken. And, since it seems unlikely that we're dealing with REAL random numbers here, this probably isn't nearly as tough as it ought to be.) I have absolutely no knowledge of "alphacipher" beyond what is contained in the original posting I saw on alt.security which pointed me to the web page (http://www.aa.net/cyber-survival-hq/Alpha1.htm) but it seems that I've made a decent (albeit trivial) analysis of its weakness, and at least given serious raise to your ability to make such claims about its security. If I'm wrong, please show me how so. If not, please do us all a favor and quit with the advertising claims. (All I need now is someone to threaten to sue me, and I'll maintain my record of having lawsuit threats made against me every time I criticize something that claims to be "strong crypto.") - -- C Matthew Curtin MEGASOFT, INC Chief Scientist I speak only for myself. Don't whine to anyone but me about anything I say. Hacker Security Firewall Crypto PGP Privacy Unix Perl Java Internet Intranet cmcurtin(a)research.megasoft.com http://research.megasoft.com/people/cmcurtin/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Have you encrypted your data today? iQEVAwUBMisu2X6R34u/f3zNAQFKSgf/T/cB0X33sDGHoiqVfbXZcW9VEFBcbtVA bTjFLEKrh89pEeZ8VR7FsZRkbC5C7ceuy1aoTAK+RLdaOBZN8AkOTWXvo139gVW/ 9P+gv8eitZlhWzSnXfpURp45m737wjRfgsP7drgWZr3AdGCu3XOipIyy3tcJrcGY fPBpBZXvAfdmxX5B3CiRgLFOdhVxzhyO7Cv019ybRTCYjZncPEyyXIYMzrCJkyBi QbZzcsvgwTq+vD0Cw9/REVqxH6Av3tzJacLLgo33hO1cvti9910FcTSCIdnmR+E+ Pse2Gm0nx8Ochcfw2ZmEVtJI7hXkLbOXMq7i/i++jtMSeMVrIsfXUg== =ZbJf -----END PGP SIGNATURE-----

2 1