December 2003 - cypherpunks-legacy

NYT Nix GAK
by jya＠pipeline.com 17 Dec '03

17 Dec '03

The New York Times, October 4, 1996, p. A32. A Flawed Encryption Policy [Editorial] The new White House proposal to keep high-powered encryption software out of the hands of foreign terrorists and criminals is needlessly restrictive and probably unworkable. Though the new plan is better than previous Administration proposals, it risks doing more harm than good. The Administration is rightly worried that foreign terrorists or criminals will get hold of encryption software that will make it impossible for the Government to eavesdrop on their telephone and computer messages. The technology is legal in this country, but the Administration wants to keep the powerful new software out of foreign hands. However, the Administration downplays the fact that encryption is also a good way for honest citizens to prevent crime. At a time when banks and other private companies send vast amounts of confidential information over the electronic highway, it would seem sensible to make high-quality encryption widely available so that the private sector can protect itself from criminal or malicious eavesdropping. For that reason, the Government ought to promote wide-scale dissemination of encryption, both here and abroad. Trying to block dissemination is probably useless and almost certainly harmful to American exports. Powerful encryption systems made by foreign companies are already available in Europe and Asia, and American exporters will need to sell state-of-the-art software to keep competitive. The Clinton Administration previously proposed that the computer industry adopt a single type of encryption, known as key-escrow, which would scramble messages with mathematical passwords. Under the plan, private companies and individuals would turn over these passwords to the Government, which, with court authorization, could use them to unscramble the phone and computer traffic. The purpose of key-escrow, then, would be to preserve the Government's existing ability to tap phone calls. But that Clinton plan was firmly rejected by industry and privacy-rights advocates who feared that a government that held passwords would abuse First Amendment prohibitions against listening in on private communications. The latest White House plan addresses many of these concerns. It would impose restrictions only on the software that exporters sell abroad. Privacy advocates have less to fear from the latest plan because it would allow individuals to deposit their passwords with private organizations, rather than the Government. Yet the Administration has not explained why foreigners would buy American software that would allow the F.B.I. to eavesdrop when they could buy equally powerful software from non-American manufacturers that omits any such trap door. Critics assume that foreign governments -- few of which pay attention to American constitutional protections against invasion of privacy -- would demand access to passwords, making such software unattractive for anyone to use. There is room to improve the plan. A panel of the National Research Council recently concluded that there is no good reason to restrict exports of currently available encryption because foreigners already have access to equally powerful software. There is time to work out restrictions, in cooperation with the industry and privacy advocates, for the next generation of encryption software. In the meantime the Administration might push forward on the panel's other sensible recommendations -- such as developing better encryption expertise within the F.B.I. and helping the private sector develop the encryption software it needs to stop illegal eavesdropping. [End] The National Research Council report is available at: http://pwp.usa.pipeline.com/~jya/nrcindex.htm

3 3

Re: Key recovery/RSA/Bidzos/WTF?!?
by Rich Burroughs 17 Dec '03

17 Dec '03

At 08:38 PM 10/3/96 -0700, Declan wrote: >PC World (at www.pcworld.com) has a radio interview with Bidzos, I'm >told, probably in the same story for which they interviewed me. RSA's "position statement" is at: http://www.rsa.com/PRESSBOX/releases/keyrecov.htm ______________________________________________________________________ Rich Burroughs richieb(a)teleport.com http://www.teleport.com/~richieb See my Blue Ribbon Page at http://www.teleport.com/~richieb/blueribbon U.S. State Censorship Page at - http://www.teleport.com/~richieb/state New EF zine "cause for alarm" - http://www.teleport.com/~richieb/cause

1 0

RE: DESCrack keyspace partitioning
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

"geeman(a)best.com" <geeman(a)best.com> wrote: >(P)RNG's just aren't that likely to produce a key of 010101010..... nor 001100110011... etc etc and I have been thinking about how one might formalize and exploit this randomness property to increase the probability of finding the key sooner. ... >Any thoughts here? Suppose we have a function f() that randomly chooses an integer between 1 and 100 such that each integer in the range is equally likely to be selected on each call. If we call f() 6 times, each time noting whether the result is even or odd, which of the following sequences is more likely? Even Even Even Even Even Even Even Odd Odd Even Even Odd If you picked the second sequence as more likely, you are like most people who responded to similar questions in a classic study of cognitive biases [1]. The two sequences actually have an identical probability of occuring, and, in fact, all sequences of six outcome are EQUALLY probable. This example illustrates the representativeness bias, in which we mistakenly suspect the global characteristics of a process to be represented locally in a specific sequence[2]. Ciao, James 1. Kahnman, D., and Tversky, A. Subjective probability: A judgement or representativeness. Cognit. Psych. 3 (1972) 430-454 2. Stacy, Webb and MacMillian, Jean, Cognitive Bias in Software Development. Communications of the ACM June 1995, 57-63

1 0

RE: DESCrack keyspace partitioning
by geeman＠best.com 17 Dec '03

17 Dec '03

Sorry, but you are ASSUMING that which I dispute. The point I am making is that keys in the real world are not uniformly distributed. Some results forthcoming. Suppose we have a function f() that randomly chooses an integer between 1 and 100 such that each integer in the range is equally likely to be selected on each call. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ If we call f() 6 times, each time noting whether the result is even or odd, which of the following sequences is more likely?

1 0

RE: DESCrack keyspace partitioning
by geeman＠best.com 17 Dec '03

17 Dec '03

Re: DESCrack keyspace partitioning geeman(a)best.com wrote: > > What about the heuristics of partitioning the keyspace? > > Seems to me that a _subset_ of all possible keys is much more likely > to appear than a random selection from an equidistributed population 0..2^56. > > (P)RNG's just aren't that likely to produce a key of 010101010..... > nor 001100110011... Why? They seem just as likely as any other sequence. I left out a piece: again heuristically speaking, most DES keys are derived from pasword hash, or similar technique. In such a case the statistics of the generated keys are (it looks like) _highly_ skewed. etc etc and I have been thinking about how one might formalize > and exploit this randomness property to increase the probability of finding the key sooner. Again, which randomness property? The property that essentially _no_ predictability is found in a hash-derived key. Gary -- "Of course the US Constitution isn't perfect; but it's a lot better than what we have now." -- Unknown. pub 1024/C001D00D 1996/01/22 Gary Howland <gary(a)systemics.com> Key fingerprint = 0C FB 60 61 4D 3B 24 7D 1C 89 1D BE 1F EE 09 06

1 0

[IMPORTANT] GAK
by dustman＠athensnet.com 17 Dec '03

17 Dec '03

Timmy May is a convicted child molester.

1 1

Re: boycott GAKkers (was Re: NYT on IBM GAK)
by Scott J. Schryvers 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 08:39 PM 10/3/96 -0400, you wrote: GAKked DES! Talk about redundant. >-----BEGIN PGP SIGNED MESSAGE----- > >On Thu, 3 Oct 1996, Adam Back wrote: > >> (I've seen HP, Sun, RSADSI, TIS, Apple, Atalla, DEC, Groupe Bull, IBM, >> NCR Corp., and UPS mentioned). Any confirmations? Denials? > >IBM and TIS are definitely pro-GAK. TIS is selling a firewall that uses >GAKked DES. IBM has been working on developing the "key recovery" technology. >The article posted here a while ago that told of IBM's plans to support GAK >also said that they were planning to license the technology to Sun and >Netscape. I don't know about the accuracy of that last statement. > >Mark >- -- >PGP encrypted mail prefered. >Key fingerprint = d61734f2800486ae6f79bfeb70f95348 >http://www.voicenet.com/~markm/ > >-----BEGIN PGP SIGNATURE----- >Version: 2.6.3 >Charset: noconv > >iQEVAwUBMlRcsCzIPc7jvyFpAQEiIwf/btvAiIVHF3alGh+Vivr3MoHnSSciFjGX >qhqdS+SEsM4cTxE+y8vvfpHFs/faQPmWLgT70lyf1pJ+Avei7brieb/qWoC5q9MJ >gBlSa1f2yVMY7ax+KPTwU+Yk63A7oi964d+ebCp51BLOtzKammRlIw/nBFuDMq/5 >ss2a4w4PuOEOP35WQIy0i8NBoJxEi5gHx5J/+gGzWK9iw/yZa0xyoT25ci6uh7mJ >sPgNmedr/Pq+D5gk5GduGgGni/jrDeADH0K7R0M8Jqlh0Xc82NPkau8xwZAXDMJV >947PF56souwrx3BHmj7fXPXIVBJEjWy/Ymv2N8LBm+BHS09CN0ns5Q== >=URZJ >-----END PGP SIGNATURE----- > > -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMlUoaf+hzPlzwZAdAQGopQgAvlREZb8S6SPQs/WQvZzkoR9ETJy1byEK xGO/ymOpkivpGCZBXGcdOLnnDJbH26x8eh7iHi+Mzv6iVrbt11YkbZ9h7z7UTkdq jtUMVN9MvOaKPxcLqTvcYgTOyKgLPYpIa27xKlP5Y7NqovacTHHA6TgSz5HjC8fQ Jg+xCPDYsJTLEDmmdJVykJx/SU4ovIFP2o/8eF+LMIW7M3L7w5bHUO14HYkuMrUy hpNp4NCycGbwia1GYkwfOYnx5YuQFSjBeubIm8sqC2Zs3A7B9OoTyOmec12JyvGz G4kJe5vKhF+q8MktOSzazqMvdJ8PgQX0ecrhrurLVdVnwu1H1QB1ZQ== =HViK -----END PGP SIGNATURE-----

1 0

Secret Swedish GAK and ITAR
by Asgaard 17 Dec '03

17 Dec '03

Gunnar Klein, a Swedish MD, is chairing a EU committee dealing with standardization of security measures in medical information systems. Recently, in a full-page anti-GAK debating article in a national Swedish evening newspaper (Aftonbladet 9/25/96), he chose to reveal some secret information he's gotten hold of: Sweden's representatives in the OECD GAK proceedings have declared that Sweden is willing to sign bilateral or multilateral GAK treaties, if other countries so demand. This declaration, along with the OECD records per se, has been classified. He also discloses that Sweden in late 1994, effectively in total secrecy, issued a completely new law against export of 'stretegic products', principally including all cryptography, without permission from the 'Inspection for Strategic Products'. In theory this law would cover export of a crypto program on a notebook. Gunnar Klein suspects US strong-arming behind all this. Obviously, Denmark has taken a different, anti-GAK, position in the OECD proceedings. Denmark is less susceptible to US blackmail than Sweden - they don't build fighter-planes with lots of US high tech parts inside (like the JAS/Gripen). Asgaard

1 0

RE: DESCrack keyspace partitioning
by geeman＠best.com 17 Dec '03

17 Dec '03

Another thinking step: most real-world DES keys are derived from hashes. Not (P)RNGs. The distributions are **not** uniform. I am talking about FAMILIES of predictable bit patterns in keys, not any specific pattern. I'm doing the stats. The goal is to search the most likely keys first, and not all keys are created equally. Your reasoning is thin. ---------- From: Mike McNally[SMTP:m5@tivoli.com] Sent: Friday, October 04, 1996 6:10 AM To: geeman(a)best.com Cc: 'cypherpunks(a)toad.com' Subject: Re: DESCrack keyspace partitioning geeman(a)best.com wrote: > > (P)RNG's just aren't that likely to produce a key of 010101010..... > nor 001100110011... etc etc Right. A good CSPRNG is ulikely to produce the pattern 010101010101. It's also unlikely to produce the pattern 0011001100110011. Oh, and it's also unlikely to produce 01100100101001011. In fact, a good 32-bit CSPRNG has only a 1/2^32 chance of producing any particular bit pattern. Of course, another way of saying that is that it's just as likely to get an "obvious" bit pattern as it is to get any other one. You can't just throw away part of the keyspace based on such bogus reasoning. (There may be other reasons to throw away part of the keyspace, of course.) ______c_________________________________________________________________ Mike M Nally * IBM % Tivoli * Austin TX * How quickly we forget that mailto:m5@tivoli.com mailto:m101@io.com * "deer processing" and "data http://www.io.com/~m101/ * processing" are different!

1 0

The attitude of US peoples toward govt WAS: [AP stuff] (fwd)
by snow 17 Dec '03

17 Dec '03

Jean-Francois Avon asked me to forward this to the list. It is part of a conversation that He and I had last week. The Crypto Relevance if any is in the attitudes we are discussing, and in the the last couple paragraphs of Mr. Avon's writing. Forwarded message: > From jf_avon(a)citenet.net Fri Sep 27 23:59:05 1996 > Message-Id: <9609280545.AB01676(a)cti02.citenet.net> > Comments: Authenticated sender is <jf_avon(a)pop.citenet.net> > From: "Jean-Francois Avon" <jf_avon(a)citenet.net> > Organization: JFA Technologies, Montreal, QC, Canada > To: snow <snow(a)smoke.suba.com> > Date: Sat, 28 Sep 1996 01:45:30 -0500 > Subject: The attitude of US peoples toward govt WAS: [AP stuff] > Priority: normal > X-Mailer: Pegasus Mail for Windows (v2.32) > > On 27 Sep 96 at 20:01, snow wrote: > > When I talked about driving for 48 hours straight, I was trying to > > impart an idea that many midwestern people are rasied with, the > > total VASTNESS of the world. We (midwesterners, and some of the > > westerners, and a lot of older people (in their 60's & 70's) > > honestly believe deep down inside that this country is too vast to > > effectively control that the government simply CAN'T do it. They > > can't enforce any control they wish to have with the army, because > > WE have guns, and a lot of us are ex-army (a little older, a > > little slower, a HELL of a lot more devious and a lot less > > impetuious<sp>). We simply don't accept the fact that any one CAN > > control us. > > This might be why I liked NM, and AZ and TX. I can understand the > feeling you describe as you can barely escape it while visiting the > place. I suppose our canadian politicians also understood that: c.f. > Bill C-68 :( > > > Anyway, [the person's] point was that [some type of software] took > > control and decesions out of peoples hands, and that is why it was > > a market sucess. This I see as a European disease, the looking to > > government & the church for the solutions to every day problems. > > That is the feudalist attitude and philosophy. Absolutely > disgusting. Although we have, here in Quebec, french roots and > civil laws based on the Napoleon Code (Common Law everywhere in > Canada except in QC), the population have a very american way of > seeing life. Every time I have political discussion with French from > France, the feudal mentality always surfaces up and I always have > problems with them. They have a hierarchy-worshiping attitude, > coupled with an abdication of the power of their own reason (at the > individual level). In short, they are brought-up to become yes-men. > It litterally gives me an uncomfortable feeling in my guts. > Disgusting. > > > The original Colonists didn't have that attitude (well, they did to > > some degree, but not the people on the edges) In fact the attitude > > really didn't develop fully in this country until the 1920's, and > > still hasn't caught on everywhere. > > Roosevelt and his New Deal... I got the chance to find a magazine > who explained how the Federal Reserve was created. Politicians > sneaking into trains as "duck hunters", grand political socialistic > schemes sprung on peoples in secret, etc. The magazine did not say > that but I am leaning on the Objectivist side and I tend to read > what *is* written... > > > politicians started paying for votes with government largess > > As a 70 years old englishmen, ex-company managing president & very > friend of mine once said: Everyday, they buy us with our own money... > > > These two attitudes are pretty diametrically opposed, but coupled > > it with a school system that doesn't encourage extra-curriculer > > thought, and you have some pretty incosistent people. > > Unfortunately, you are absolutely right. > > > [slight topic drift...] I was wondering lately... Words have a lot > of power. They are the building blocks we use to materialize > concepts. Think about the word "Government". You would think of it > as a body that governs. But the american peoples think the > government ought to be a body that acts under a mandate to > administrate and oversee certain things. > > The very word "govt" seems to (conceptually) almost "justify" the > actions of present govts, while any other word (like, for example, > "overseers", "Mandated", etc) would stress out that they are under > *our* orders (and nowadays, exceeding their mandate). > > Maybe we should start using a new word to describe *exactly" what it > is that they ought to be doing. Doing so would also stress out > *exactly* what they are pulling on us... > > Comments? > > jfa > > Please e-mail me directly since I am not on cypherpunks anymore. > Thanks. > Jean-Francois Avon, Pierrefonds (Montreal) QC Canada > DePompadour, Societe d'Importation Ltee > Finest Limoges porcelain and crystal > JFA Technologies, R&D consultants > physicists and engineers, LabView programing > PGP keys at: http://w3.citenet.net/users/jf_avon > ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 > ID# 5B51964D : 152ACCBCD4A481B0 254011193237822C Petro, Christopher C. petro(a)suba.com <prefered for any non-list stuff> snow(a)smoke.suba.com

1 0