December 2003 - cypherpunks-legacy

revised FC97 program
by R.Hirschfeld＠cwi.nl 17 Dec '03

17 Dec '03

Financial Cryptography '97 February 24-28 1997, Anguilla, BWI PRELIMINARY PROGRAM (Revised 6 February 1997) General Information: Financial Cryptography '97 (FC97) is a new conference on the security of digital financial transactions. The first meeting will be held on the island of Anguilla in the British West Indies on February 24-28, 1997. FC97 aims to bring together persons involved in both the financial and data security fields to foster cooperation and exchange of ideas. Original papers were solicited on all aspects of financial data security and digital commerce in general. Program Committee: Matthew Franklin, AT&T Laboratories--Research, Murray Hill, NJ, USA Michael Froomkin, U. Miami School of Law, Coral Gables, FL, USA Rafael Hirschfeld (Program Chair), CWI, Amsterdam, The Netherlands Arjen Lenstra, Citibank, New York, NY, USA Mark Manasse, Digital Equipment Corporation, Palo Alto, CA, USA Kevin McCurley, Sandia Laboratories, Albuquerque, NM, USA Charles Merrill, McCarter & English, Newark, NJ, USA Clifford Neuman, Information Sciences Institute, Marina del Rey, CA, USA Sholom Rosen, Citibank, New York, NY, USA Israel Sendrovic, Federal Reserve Bank of New York, New York, NY, USA Preliminary Conference Program for FC97: Monday 24 February 1997 800 -- 820 Breakfast 820 -- 830 Welcome 830 -- 905 Anonymity Control in E-Cash Systems George Davida (University of Wisconsin, Milwaukee, WI, USA), Yair Frankel (Sandia National Laboratories, Albuquerque, NM, USA), Yiannis Tsiounis (Northeastern University, Boston, MA, USA), Moti Yung (CertCo, New York, NY, USA) 905 -- 940 How to Make Personalized Web Browsing Simple, Secure, and Anonymous Eran Gabber, Phil Gibbons, Yossi Matias, Alain Mayer (Bell Laboratories, Lucent Technologies) 940 -- 1015 Anonymous Networking and Virtual Intranets: Tools for Anonymous Corporations Jim McCoy (Electric Communities, Cupertino, CA, USA) 1015 -- 1045 Coffee Break 1045 -- 1120 Unlinkable Serial Transactions Paul F. Syverson (Naval Research Laboratory, Washington, DC, USA), Stuart G. Stubblebine (AT&T Labs--Research, Murray Hill, NJ, USA), David M. Goldschlag (Naval Research Laboratory, Washington, DC, USA) 1120 -- 1155 Efficient Electronic Cash with Restricted Privacy Cristian Radu, Rene Govaerts, Joos Vandewalle (Katholieke Universiteit Leuven, Leuven, Belgium) 1155 -- 1230 The SPEED Cipher Yuliang Zheng (Monash University, Melbourne, Australia) 1230 -- 1330 Lunch 1800 -- 1930 Cocktail Reception (at Mariners Hotel) Tuesday 25 February 1997 800 -- 830 Breakfast 830 -- 930 Invited Speaker Evaluating the security of electronic money; the view of a European central bank Simon L. Lelieveldt (De Nederlandsche Bank, Amsterdam, Netherlands) 930 -- 1005 Smart Cards and Superhighways The technology-driven denationalisation of money David G.W. Birch, Neil A. McEvoy (Hyperion, Surrey, England) 1005 -- 1045 Coffee Break 1045 -- 1120 Fault Induction Attacks, Tamper Resistance, and Hostile Reverse Engineering in Perspective David P. Maher (AT&T Labs--Research, Murray Hill, NJ, USA) 1120 -- 1155 Some Critical Remarks on "Dynamic Data Authentication" as specified in EMV '96 Louis C. Guillou (CCETT, Cesson-Sevigne, France) 1155 -- 1230 Single-chip implementation of a cryptosystem for financial applications Nikolaus Lange (SICAN Braunschweig GmbH, Braunschweig, Germany) 1230 -- 1330 Lunch Wednesday 26 February 1997 800 -- 830 Breakfast 830 -- 930 Invited Speaker Ronald Rivest (MIT Lab for Computer Science, Cambridge, MA, USA) 930 -- 1005 Auditable Metering with Lightweight Security Matthew K. Franklin, Dahlia Malkhi (AT&T Labs--Research, Murray Hill, NJ, USA) 1005 -- 1045 Coffee Break 1045 -- 1120 SVP: a Flexible Micropayment Scheme Jacques Stern, Serge Vaudenay (Ecole Normale Superieure, Paris, France) 1120 -- 1155 An efficient micropayment system based on probabilistic polling Stanislaw Jarecki (MIT Lab for Computer Science, Cambridge, MA, USA), Andrew Odlyzko (AT&T Labs--Research, Murray Hill, NJ, USA) 1155 -- 1230 On the continuum between on-line and off-line e-cash systems - I Yacov Yacobi (Microsoft, Redmond, WA, USA) 1230 -- 1330 Lunch Thursday 27 February 1997 800 -- 830 Breakfast 830 -- 905 Towards Multiple-payment Schemes for Digital Money H. Pagnia, R. Jansen (University of Darmstadt, Darmstadt, Germany) 905 -- 940 Applying Anti-Trust Policies to Increase Trust in a Versatile E-Money System Markus Jakobsson (UCSD, La Jolla, CA, USA), Moti Yung (BTEC/CertCo, New York, NY, USA) 940 -- 1015 Cyberbanking and Privacy: The Contracts Model Peter P. Swire (Ohio State University, Columbus, OH, USA) 1015 -- 1045 Coffee Break 1045 -- 1120 Legal Issues in Cryptography Edward J. Radlo (Fenwick & West LLP, Palo Alto, CA, USA) 1120 -- 1230 Panel Discussion Legal Issues of Digital Signatures Michael Froomkin (U. of Miami School of Law, Coral Gables, FL, USA), Charles Merrill (McCarter & English, Newark, NJ, USA), Benjamin Wright (Dallas, TX, USA) 1230 -- 1330 Lunch 1930 -- 2015 Invited Speaker Money Laundering: Yesterday, Today and Tomorrow Peter Wayner (Baltimore, MD, USA) 2015 -- 2200 Rump Session Friday 28 February 1997 800 -- 830 Breakfast 830 -- 905 The Strategic Role of Government in Electronic Commerce Paul Lampru (Verifone, Atlanta, GA, USA) 905 -- 940 Using Markets to Achieve Efficient Task Distribution Ian Grigg, Christopher C. Petro (Systemics, Amsterdam, Netherlands) 940 -- 1015 The Gateway Security Model in the Java Electronic Commerce Framework Theodore Goldstein (Sun Microsystems Laboratories/Javasoft) 1015 -- 1045 Coffee Break 1045 -- 1120 Highly Scalable On-line Payments Via Task Decoupling David William Kravitz (CertCo LLC, Albuquerque, NM, USA) 1120 -- 1155 GUMP; Grand Unified Meta-Protocols Recipes for Simple, Standards-based Financial Cryptography Barbara Fox, Brian Beckman (Microsoft, Redmond, WA, USA) 1155 -- 1230 Secure Network Communications and Secure Store&Forward Mechanisms with SAP R/3 Bernhard Esslinger (SAP AG, Walldorf, Germany) 1230 -- 1330 Lunch Updates of the conference schedule will be available at the URL http://www.cwi.nl/conferences/FC97/. The conference will run from 8:30 AM to 12:30 PM for five days, February 24-28 1997. Breakfast and lunch are provided at the conference. The conference organizers have left the afternoons and evenings open for corporate sponsored events, for networking, and for recreational activities on the resort island of Anguilla. Participants are encouraged to bring their families. Workshop: A 40-hour workshop, intended for anyone with commercial software development experience who wants hands-on familiarity with the issues and technology of financial cryptography, is planned in conjunction with FC97, to be held during the week preceding the conference. For more information on the workshop, please see the URL http://www.cs.berkeley.edu/~iang/fc97/workshop.html. For workshop registration, see the URL http://www.offshore.com.ai/fc97/. Venue: The InterIsland Hotel is a small 14-room guest house and a large, comfortable 150 seat conference facility with additional space for a small 10-booth exhibition. The Inter-Island is on Road Bay, near Sandy Ground Village, in the South Hill section of Anguilla. The conference, workshop, and exhibition will have TCP/IP internet access. The rooms at the InterIsland itself have sold out, but there are many other hotels and guest houses on Anguilla, and shuttle service to the conference will be available. Air Transportation and Hotels: Air travel to Anguilla is typically done through either San Juan or St. Thomas for US flights, or St. Maarten/Martin for flights from Europe and the US. Anguillan import duties are not imposed on hardware or software which will leave the island again. There are no other taxes--or cryptography import/export restrictions--on Anguilla. Hotels range from spartan to luxurious, and more information about hotels on Anguilla can be obtained from your travel agent, or at the URL http://www.offshore.com.ai/fc97/. General Chairs: Robert Hettinga, Shipwright/e$, Boston, MA, USA; rah(a)shipwright.com Vincent Cate, Offshore Information Services, Anguilla, BWI; vince(a)offshore.com.ai Conference, Exhibits, and Sponsorship Manager: Julie Rackliffe, Boston, MA, USA; rackliffe(a)tcm.org Workshop Leader: Ian Goldberg, Berkeley, CA, USA; iang(a)cs.berkeley.edu Registration: You can register and pay for conference admission via the World Wide Web at the URL http://www.offshore.com.ai/fc97/. The cost of the FC97 Conference is US$1,000. Booths for the exhibition start at US$5,000 and include two conference tickets. For more information about exhibit space, contact Julie Rackliffe, rackliffe(a)tcm.org. Sponsorship opportunities for FC97 are still available. The cost of the workshop is US$5000, and includes meals but not lodging. You can register for the workshop, which runs the week prior to the conference, at the URL http://www.offshore.com.ai/fc97. Financial Cryptography '97 is held in cooperation with the International Association for Cryptologic Research. It is sponsored by: The Journal for Internet Banking and Commerce <http://www.arraydev.com/commerce/JIBC/> Offshore Information Services <http://www.offshore.com.ai/> e$ <http://www.shipwright.com/rah/> C2NET <http://www.c2.net/> See Your Name Here <mailto: rackliffe(a)tcm.org>

1 0

Re: Moderation, Tim, Sandy, me, etc. * Strong crypto == DES?!
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> Tim, the Cypherpunks have chosen to follow Sandy's lead for this > month. I'll admit I made it easy for them, but the results are > conclusive. There are 1311 addresses in the cypherpunks list today; > 42 in the unedited list; and 19 in the flames list. Forty people > cared enough to read every posting; the other thousand either wanted > to try the experiment -- or didn't care enough to send an email > message. Which, as we all know, is a very low threshold. As I, and a number of other list members, have said: Why did you not rename the lists so that cypherpunks(a)toad.com was uncensored??? You and I know perfectly well that probably 1250 of those addresses are people who don`t know the censorship is taking place, don`t read the list (defunct accounts), don`t know how to change their subscription, are too lazy to care either way etc... I would guess there are less than 100 that have considered the issues and decided to subscribe to the censored list. > If I was a social scientist I might want to run the experiment both > ways, or six different ways. Name it this, or name it that. I'm not; > all I want is something that works. The cypherpunks list was unusable > for this kind of discussion, only a month ago. It's usable now. No, it was usable to those with time and patience or the rather rudimentary knowledge necessary to set up filters. Now all we are doing is relegating a list that was once subscribed to by intelligent and well educated people into a playground for the inept. I`m not being elitist but if we can`t expect a member of this list who actually uses it for discussion to know how to set up filters then he might as well unsubscribe. > Perhaps at that point I should have shut down the list, as Lucky is > now suggesting. "Asking the list what to do" was clearly not a useful > option. Sandy cared enough about the community to make some concrete > suggestions to me about how to get the list back on track. They > involved a lot more work than the previous setup. I told him if he > was willing to do the work, we could try it. As Dale suggests, I > wasn't about to waste my time reading the whole list in real time and > passing judgement on the postings. Sandy was, for a month. You should indeed have shut down the list. The problem being not that you choose to run a censored list but that you have associated the name cypherpunks with it and in doing so you have destroyed the reputation that the name cypherpunks once had. > Unpaid labor for a peanut gallery of spoiled children isn't very > gratifying. Paternalism is the root of all statism. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

testing
by Rodney Thayer 17 Dec '03

17 Dec '03

Rodney Thayer <rodney(a)sabletech.com> +1 617 332 7292 Sable Technology Corp, 246 Walnut St., Newton MA 02160 USA Fax: +1 617 332 7970 http://www.shore.net/~sable "Developers of communications software"

1 0

FinCEN hates cybercash, who 'da thunk it...
by Derrick Storren 17 Dec '03

17 Dec '03

Big brother, Morris, at FinCEN sees a criminal behind every cyber dollar. The sky is falling, the sky is falling, it's raining cyber cash! Artilce follows :) ****************** =09=09_G7 groups frets over electronic money laundering_ Copyright =A9 1997 Nando.net Copyright =A9 1997 Agence France-Presse=20 PARIS (Feb 6, 1997 11:30 a.m. EST) - Money-laundering fighters from key industrial countries and leading Asian financial centers are looking into ways of countering use of the Internet and "smart cards" to clear proceeds from criminal activities, officials said Thursday. The Financial Action Task Force (FATF), set up following a Group of Seven initiative at their l989 summit, called in a lengthy report for closer cooperation and coordinated efforts to fight money laundering, especially in regard to new electronic payments technologies. The report noted that these technologies were still "in their infancy" and said it was "premature to consider prescriptive solutions to theoretical problems." But Stanley Morris of the United States Treasury, who chaired a FAFT working group which drafted the report, told a news conference that law enforcement agencies would face 'very major new challenges' if new technology moves the world "to a cashless society, beyond banks, cash and borders." He said the group's meeting, held in Paris last November, was the first time an international organization has examined "the implications of e-money - electronic money - or cyber payments." The group had for the first time examined "not only criminal activity as we see it" at present, but "what kind of crominal activites might occur as we approach the new payments technologies relying on the revolution in microchips and .. changes in payments services generally." Morris, who heads the U.S. Treasury's Financial Crimes Enforcement Network (FinCEN), said cash had become "a significant problem" for criminal groups, which find it increasingly difficult to channel their criminal proceeds into the banking system, at least in FATF countries. "We find a clear move away from direct dealing with banks to non-bank institutions, including bureaux de change money order sellers, and even professional services like lawyers and accountants," he said. The group had also seen "the realities of economic globalization," he said, adding that financial activities are "poorly controlled by the nation states." Morris said the working group had therefore invited representatives of the high technology industry now working on the new payments technology which was still "in the prototype stage" without any clear indication as to the direction they might take. "We wanted to sit down with the industry as experts on money laundering enforcement.... to let them know now what kinds of systems would cause us problems and give the bad guys new opportunities," he said. The purpose was to seek to encourage development of these technologies "in ways that do not provide a new forum for money laundering," he said. The FATF was essentially a preventive business, Morris added. "We do not measure our success simply on arrests and (money) seizures." FATF chairman Fernando Carpentieri, the Director General of the Italian Treasury, said drug trafficking remained a key source of criminal proceeds which crime groups were seeking to "legalize." He said the Task Force, consisting mainly of OECD member countries, as well as Hongkong, Singapore, the Gulf Cooperation Council and the European Commission, was not at present considering admitting further members to preserve its efficiency. But it was working with the authorities of countries throughout the world to secure the broadest possible implementation of the anti-money laundering measures it has recommended.> G7 groups frets over electronic money laundering

2 1

Re: Moderation, Tim, Sandy, me, etc. * Strong crypto == DES?!
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> Tim, the Cypherpunks have chosen to follow Sandy's lead for this > month. I'll admit I made it easy for them, but the results are > conclusive. There are 1311 addresses in the cypherpunks list today; > 42 in the unedited list; and 19 in the flames list. Forty people > cared enough to read every posting; the other thousand either wanted > to try the experiment -- or didn't care enough to send an email > message. Which, as we all know, is a very low threshold. As I, and a number of other list members, have said: Why did you not rename the lists so that cypherpunks(a)toad.com was uncensored??? You and I know perfectly well that probably 1250 of those addresses are people who don`t know the censorship is taking place, don`t read the list (defunct accounts), don`t know how to change their subscription, are too lazy to care either way etc... I would guess there are less than 100 that have considered the issues and decided to subscribe to the censored list. > If I was a social scientist I might want to run the experiment both > ways, or six different ways. Name it this, or name it that. I'm not; > all I want is something that works. The cypherpunks list was unusable > for this kind of discussion, only a month ago. It's usable now. No, it was usable to those with time and patience or the rather rudimentary knowledge necessary to set up filters. Now all we are doing is relegating a list that was once subscribed to by intelligent and well educated people into a playground for the inept. I`m not being elitist but if we can`t expect a member of this list who actually uses it for discussion to know how to set up filters then he might as well unsubscribe. > Perhaps at that point I should have shut down the list, as Lucky is > now suggesting. "Asking the list what to do" was clearly not a useful > option. Sandy cared enough about the community to make some concrete > suggestions to me about how to get the list back on track. They > involved a lot more work than the previous setup. I told him if he > was willing to do the work, we could try it. As Dale suggests, I > wasn't about to waste my time reading the whole list in real time and > passing judgement on the postings. Sandy was, for a month. You should indeed have shut down the list. The problem being not that you choose to run a censored list but that you have associated the name cypherpunks with it and in doing so you have destroyed the reputation that the name cypherpunks once had. > Unpaid labor for a peanut gallery of spoiled children isn't very > gratifying. Paternalism is the root of all statism. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

EXTRA CHARGE FOR INTERNET SERVICE !
by Brian Adrian 17 Dec '03

17 Dec '03

Just received this from another mailing list. PLEASE FORWARD TO ALL INTERESTED PARTIES I am writing you this to inform you of a very important matter currently under review by the FCC. Your local telephone company has filed a proposal with the FCC to impose per minute charges for your internet service. They contend that your usage has or will hinder the operation of the telephone network. It is my belief that internet usage will diminish if users were required to pay additional per minute charges. The FCC has created an email box for your comments, responses must be received by February 13, 1997. Send your comments to isp(a)fcc.gov and tell them what you think. Every phone company is in on this one, and they are trying to sneak it in just under the wire for litigation. Let everyone you know here this one. Get the e-mail address to everyone you can think of. isp(a)fcc.gov Please forward this email to all your friends on the internet so all our voices may be heard! It's time to let them know just who is paying their salaries. Don't sit back and be quite on this one, SPEAK YOUR MIND, LET THEM KNOW THIS IS BULLSHIT !!!!!!!!!! Just passing it along... Brian Adrian e-mail: chow(a)niven.imsweb.net Web page: http://home.imsweb.net/~chow/

1 0

Re: "Why am I being completely censored"?
by John Gilmore 17 Dec '03

17 Dec '03

> I'd just appreciate it if someone would explain to me just why > I'm being completely censored from the cypherpunks list. ... > Absolutely none of my recent postings are even going to > cypherpunks-unedited, I've received no response to my mail to > gnu(a)toad.com asking why, and I've received absolutely no bounces > indicating that there are delivery problems. I haven't investigated your story because you didn't provide enough details and because I have been busy with other things. There is no infrastructure here for blocking postings from going through cypherpunks-unedited. It really is unedited. Perhaps there is a mailer problem (at your end or at mine). If you cc'd yourself on your messages to cypherpunks, please send me a verbatim copy of such a message that did not appear in cypherpunks-unedited, including all the header lines. I can trace whether it was ever seen on the toad.com end and what happened if it was. Hmm. Your message that I just received, about this problem, was cc'd to cypherpunks. It did not make it into the cypherpunks-unedited list. In examining the message header itself, there is an "Approved: yes" line. My guess is that your attempt to be too tricky has screwed you. Majordomo is probably zapping postings that claim to be, but aren't actually, moderator-approved. This is just a guess. Please try making a posting to cypherpunks without such a line, and see if it goes through into the unedited list. Let me know. John

2 1

Re: Cypherpunks FOIA request
by Lucky Green 17 Dec '03

17 Dec '03

At 12:40 AM 2/5/97 -0800, Greg Broiles wrote: >I'm not sure what I think about the response from the SF FBI branch - it >seems unlikely that they'd never have paid any attention to the list, given >the media coverage in Wired and other places. My attorney used to fly planes with nuclear cargo. Another friend of mine has been visited several times by the FBI. In either case, the FBI claimed upon receiving an FOIA request that they have no record on either person. Does anybody here believe that the USAF would let pilots take off with nukes on board without ever conducting a background investigation (which are handled by the FBI)? I didn't think so. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

2 1

Re: Deloitte-Touche, e$pam plug, Moderation, Cypherpunks as a cresote bush
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 09:09 PM 2/5/97 -0500, Robert Hettinga wrote: >In the meantime, if you're interested in e$, or financial crypto, or other >stuff I'm interested ("it don't say e$pam until Bob says it says e$pam" >:-)), you might want to check it. I think that Bob's e$ list should be considered a viable alternative to the other two filtered cpunks lists; I recommend it to people looking for a moderated alternative to the list. (I get e$, but use Eudora and procmail to suck out the duplicates where messages are copied from lists I already get.) He also finds a lot of the stuff that used to show up on cpunks but doesn't any more because people have wandered away. I've been meaning to write up a long message explaining why I think I'm about to drop off of the list. It's peculiar to spend a lot of time discussing things with a group of people over the course of several years and then disappear without saying why. But I'm having trouble coming up with anything more profound than "it's not interesting any more." Philosophically, I agree with Lucky - it looks to me like it's time to kill the list and move on to other things. But that's not my choice to make, and perhaps other people can still extract something useful from this. More power to them if they can. I'm starting to think that cpunks may be similar to college, in that it's a good thing for a few years, but if you stick around too long you just get bitter and cranky and frustrated because the new people keep talking about the same old problems. Don't they know we've already talked about that? -----BEGIN PGP SIGNATURE----- Version: 4.5 iQEVAgUBMvmSHP37pMWUJFlhAQGu3Qf/WTpImfcNb4883V2h/JHKsZh1hWR+hrSH e7hgtUAujphktzteZi6NqC47QEQHRIbgT/SRHelDB4lJLPv3TtIN09ZUwK6GWb/F QfmoyPXBVfM5Pt/FqPqtPpXnehC7r71SO0jQ2qKqTrhcuSDYNmOjtCrjK/BIEJ7l mMYcxY7JKBq0H8u1BNzZaMfCkEvDytUejgsevusWGGfkwodUSTon81Kbxmy7Yg2w 3vOmESgMz2Vm2av2bHTYBy3CSy3JzB8m2OPQo+Wang6WJDfvJaDaALGuHgem8PH8 0jCjBww2vEOJ0xj62oQ/mD2heEe+TZZnDZ5ZRynID1wOOm7SOOOeAg== =+SRl -----END PGP SIGNATURE----- -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

2 1

40-bit RC5 crack meaningless??
by Vin McLellan 17 Dec '03

17 Dec '03

(A gem off sci.crypt. Schwartau's mailing list is turning into the most amazing source of misinformation or disinformation about cryptography on the Net. And he's probably got the most influential audience in Washington re crypto policy. Go figure;-) ---------------- Subject: 40-bit RC5 crack meaningless?? Date: 6 Feb 1997 11:43:58 -0500 From: nobody(a)REPLAY.COM (Anonymous) Organization: Replay and Company UnLimited Newsgroups: sci.crypt Strassmann, the author of this denunciation of RSADS and Ian Goldberg, is the former Director of Defense Information (i.e., CIO,) of the Bush DoD and an often-insightful commentator on business culture and computing. Strange is the logic that channels the mind of the American Defense Intellectual... or, maybe he just doesn't know squat about cryptography??? (Reposted from Infowar Digest, Winn Schwartau's moderated mailing list <mail to: infowar(a)infowar.com> without permission.) >Date: Thu, 30 Jan 1997 20:10:36 -0500 >To: "Wright Larry" <Wright_Larry(a)bah.com> >From: "Paul A. Strassmann" <paul(a)strassmann.com> >Subject: Further to Goldberg's Cracking Accomplishments >Gentlemen: > >As I suspected (see earlier private comment), the >highly promoted RSA cracking contest offered >a number of clues that ordinarly would not be >volunteered by info-terrorists or info-criminals to >IW Defense teams. > >These clues made the cracking significantly easier, >because it made it possible to eliminate an enormous >range of possible searches. > >The following was extracted verbatim from the ><The RSA Data Security Secret-Key Challenge> >posted on <http://www.rsa.com/rsalabs/97challenge/>: > >Clue #1: > > " ...all the RC5 contests posted as part of the RSA Secret-Key Challenge >will use 12-round RC5 with a 32-bit word size. " > >Clue #2: > > " ...The first RC5 contest will consist of some unknown plaintext >encrypted using a 40-bit key;." > >Clue #3: (a giveway!) > > " ... For each contest, the unknown plaintext message is preceded by three > known blocks of text that contain the 24-character phrase "The > unknown message is: .....". > >In summary: The claim of exportable cryptography being totally >insecure, because it can be cracked in 3.5 hours is not >realistic. The three clues announced in the contest >would not apply under infowar conditions. > >What other clues may have been provided to Goldberg >to support private agendas and gain shrill headlines >is also a matter of speculation, but I rest my case. > >I certainly cannot assert that a 40 bit key cannot be decyphered. >However, I do not think that the RSA unqualified claims >offer full and appropriate disclosure. > >Paul > >At 10:21 AM -0500 1/30/97, Wright Larry wrote: >>Following provided for your information. >> >> >>EXPORTABLE CRYPTOGRAPHY TOTALLY INSECURE: CHALLENGE >>CIPHER BROKEN IMMEDIATELY >> >>January 28, 1997 - Ian Goldberg, a UC Berkeley graduate >>student, announced today that he had successfully >>cracked RSA Data Security Inc.'s 40-bit challenge cipher >>in just under 3.5 hours. >> >>RSA challenged scientists to break their encryption >>technology, offering a $1000 award for breaking the >>weakest version of the code. Their offering was >>designed to stimulate research and practical experience >>with the security of today's codes. >> >>The number of bits in a cipher is an indication of the >>maximum level of security the cipher can provide. Each >>additional bit doubles the potential security level of >>the cipher. A recent panel of experts recommended >>using 90-bit ciphers, and 128-bit ciphers are commonly >>used throughout the world, but US government regulations >>restrict exportable US products to a mere 40 bits. >> >>Goldberg's announcement, which came just three and a >>half hours after RSA started their contest, provides >>very strong evidence that 40-bit ciphers are totally >>unsuitable for practical security. "This is the >>final proof of what we've known for years: 40-bit >>encryption technology is obsolete," Goldberg said. <...Rest of the nnouncement from UC Berkeley snipped> >Paul A. Strassmann >55 Talmadge Hill Road, New Canaan, CT. 06840 >Telephone: 203-966-5505; Fax: 203-966-5506 >INTERNET: paul(a)strassmann.com >WorldwideWeb: http://www.strassmann.com >~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >

2 1