December 2003 - cypherpunks-legacy

40-bit RC5 crack meaningless??
by Vin McLellan 17 Dec '03

17 Dec '03

(A gem off sci.crypt. Schwartau's mailing list is turning into the most amazing source of misinformation or disinformation about cryptography on the Net. And he's probably got the most influential audience in Washington re crypto policy. Go figure;-) ---------------- Subject: 40-bit RC5 crack meaningless?? Date: 6 Feb 1997 11:43:58 -0500 From: nobody(a)REPLAY.COM (Anonymous) Organization: Replay and Company UnLimited Newsgroups: sci.crypt Strassmann, the author of this denunciation of RSADS and Ian Goldberg, is the former Director of Defense Information (i.e., CIO,) of the Bush DoD and an often-insightful commentator on business culture and computing. Strange is the logic that channels the mind of the American Defense Intellectual... or, maybe he just doesn't know squat about cryptography??? (Reposted from Infowar Digest, Winn Schwartau's moderated mailing list <mail to: infowar(a)infowar.com> without permission.) >Date: Thu, 30 Jan 1997 20:10:36 -0500 >To: "Wright Larry" <Wright_Larry(a)bah.com> >From: "Paul A. Strassmann" <paul(a)strassmann.com> >Subject: Further to Goldberg's Cracking Accomplishments >Gentlemen: > >As I suspected (see earlier private comment), the >highly promoted RSA cracking contest offered >a number of clues that ordinarly would not be >volunteered by info-terrorists or info-criminals to >IW Defense teams. > >These clues made the cracking significantly easier, >because it made it possible to eliminate an enormous >range of possible searches. > >The following was extracted verbatim from the ><The RSA Data Security Secret-Key Challenge> >posted on <http://www.rsa.com/rsalabs/97challenge/>: > >Clue #1: > > " ...all the RC5 contests posted as part of the RSA Secret-Key Challenge >will use 12-round RC5 with a 32-bit word size. " > >Clue #2: > > " ...The first RC5 contest will consist of some unknown plaintext >encrypted using a 40-bit key;." > >Clue #3: (a giveway!) > > " ... For each contest, the unknown plaintext message is preceded by three > known blocks of text that contain the 24-character phrase "The > unknown message is: .....". > >In summary: The claim of exportable cryptography being totally >insecure, because it can be cracked in 3.5 hours is not >realistic. The three clues announced in the contest >would not apply under infowar conditions. > >What other clues may have been provided to Goldberg >to support private agendas and gain shrill headlines >is also a matter of speculation, but I rest my case. > >I certainly cannot assert that a 40 bit key cannot be decyphered. >However, I do not think that the RSA unqualified claims >offer full and appropriate disclosure. > >Paul > >At 10:21 AM -0500 1/30/97, Wright Larry wrote: >>Following provided for your information. >> >> >>EXPORTABLE CRYPTOGRAPHY TOTALLY INSECURE: CHALLENGE >>CIPHER BROKEN IMMEDIATELY >> >>January 28, 1997 - Ian Goldberg, a UC Berkeley graduate >>student, announced today that he had successfully >>cracked RSA Data Security Inc.'s 40-bit challenge cipher >>in just under 3.5 hours. >> >>RSA challenged scientists to break their encryption >>technology, offering a $1000 award for breaking the >>weakest version of the code. Their offering was >>designed to stimulate research and practical experience >>with the security of today's codes. >> >>The number of bits in a cipher is an indication of the >>maximum level of security the cipher can provide. Each >>additional bit doubles the potential security level of >>the cipher. A recent panel of experts recommended >>using 90-bit ciphers, and 128-bit ciphers are commonly >>used throughout the world, but US government regulations >>restrict exportable US products to a mere 40 bits. >> >>Goldberg's announcement, which came just three and a >>half hours after RSA started their contest, provides >>very strong evidence that 40-bit ciphers are totally >>unsuitable for practical security. "This is the >>final proof of what we've known for years: 40-bit >>encryption technology is obsolete," Goldberg said. <...Rest of the nnouncement from UC Berkeley snipped> >Paul A. Strassmann >55 Talmadge Hill Road, New Canaan, CT. 06840 >Telephone: 203-966-5505; Fax: 203-966-5506 >INTERNET: paul(a)strassmann.com >WorldwideWeb: http://www.strassmann.com >~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >

2 1

True story, Fly the Obsfucted Skies (fwd)
by Ray Arachelian 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Thu, 6 Feb 1997 00:18:18 -0500 From: Salvatore Denaro <sal(a)panix.com> To: 'Ray Arachelian' <ray(a)earthweb.com> Subject: True story, Fly the Obsfucted Skies I was at the airport, checking in at the gate. An airport employee asked me (and I quote) "Has anyone put anything in your baggage without your knowledge?" I thought about it. I scratched my goatee. I said: "If it was without *my* knowledge... how would *I* know about it?" He smiled. He nodded his head, knowingly. He then gave me this cryptic reply, "That's why we ask." -- Salvatore Denaro "The only difference between me and a madman sal(a)panix.com is that I am not mad." -- Salvador Dali

2 1

Re: ITAR and Paper ROM
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:26 AM 2/5/97 -0800, Steve Schear wrote: >I'm not sure if what I did in the 80s, trying to create what I called >'paper ROM, is applicable. [....] >to replace diskettes for inexpensive mass data distribution. > Although a technical success, I abandoned the effort >when I discovered someone had patented (4,488,679) something similar a >few years earlier. Yeah, our patent office is so helpful - granting a patent for "Storage of Information By Making Marks On Paper" :-) You'd think they'd recognize a few thousand years of prior art..... Xerox also has a similar patent; their method uses little diagonals to encode data in. ///\\\/// It really _isn't_ called "cuneform". More practically, sort of, there was the Cauzin Softstrip Reader, which cost about $200 and held enough data to distribute programs back when computers and programs were much smaller; a few PC magazines tried distributing programs by printing them in the back that way. Cute, but not cute enough to stick around very long. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

2 1

Re: Deloitte-Touche?
by Adam Back 17 Dec '03

17 Dec '03

Mark <mark(a)infolawalert.com> writes: > I'm almost certain that Murray is a consultant rather than > or in addition to an accountant. He's been saying these things William Murray used to post frequently to sci.crypt, alt.security.pgp, etc when I read those forums. He also I think wrote the forword for one of the books on using PGP. Adam -- print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

2 1

Re: mail-to-news fun
by Scott V. McGuire 17 Dec '03

17 Dec '03

On Wed, 5 Feb 1997 stewarts(a)ix.netcom.com wrote: ...snip... > If I were going to restart a remailer, and to offer news posting, > I'd probably limit it to posting to moderated newsgroups only, > so a human can trash things that look like SPAM or abuse; > the abuse that caused me to kill my remailer wasn't something > a simple filter would catch. (I'd also prefix each posting with a > header about this message having been received from an anonymous source, > not verified, not guaranteed to be worth the electrons it's printed on, > probably not written by anybody whose name's at the bottom, etc.... > People don't read mail headers or disclaimers at the bottom, > and putting disclaimers like that into message text for > email exposes the message to traffic analysis.) How does putting it in the message expose it to traffic analysis but not putting it in a header? > ...snip... > > # Thanks; Bill > # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com > # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp > # (If this is a mailing list, please Cc: me on replies. Thanks.) > -------------------- Scott V. McGuire <svmcguir(a)syr.edu> PGP key available at http://web.syr.edu/~svmcguir Key fingerprint = 86 B1 10 3F 4E 48 75 0E 96 9B 1E 52 8B B1 26 05

3 2

anonymous remailers
by c.musselman＠internetmci.com 17 Dec '03

17 Dec '03

C'punks -- When I told a friend about the alt.drugs.pot cultivation newsgroup and suggested that he use an anonymous remailer to post to the group, he laughed and said, "Who do you suppose runs the remailers? ATF, FBI, DEA, that's who!" Gee, it makes sense to this paranoid. Does anyone know the answer? Specifically, how can we choose a trusted remailer? Cheers (?), Charley

3 2

Re: 40-bit RC5 crack meaningless??
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:37 AM 2/7/97 -0500, Vin McLellan wrote: > Now, an international institution which buys and bets the bank upon >US-exportable (40-bit) cryptography probably deserves what it has bought: > [...] even 56-bit keys -- whatever the algorithm! -- offer only "minimal" security. >(What Goldberg did in hours, many could do in a days or weeks with much >less equipment. You don't bet the bank on 40-bit crypto, unless you're, ummm, accepting credit cards over wimp-configured sessions of SSL. (You, as merchant, may not lose if there's a forgery, and your customer's loss may be limited to $50, but the bank's loss isn't limited except by how fast they can block thieves.) While banks get Extra Slack on crypto exports, and can use 56-bit DES, they've got more serious adversaries - building a $1M machine to win a $1000 contest is a bit expensive for the average grad student, but it's a perfectly reasonable investment if you're planning to rob banks of millions of dollars with it, especially if you think you can either siphon the money off slowly while hitting a lot of banks or else make a really big haul all at once. Banks aren't the only kind of company with big money floating around; stockbrokers, commodities traders, purchasing departments of big companies that might not notice that they're buying a few percent more parts, and all sorts of other large companies are targets for crypto-cracking thieves. Because well-funded thieves can do this kind of financial damage, we have a legitimate-sounding spin on "Federal law enforcement's job includes preventing large-scale theft, and they're letting their political agenda get in the way of doing their job. Sure, 56-bit keys are harder to crack than 40, but well-funded crackers could use the same techniques Ian did." Either method of theft requires being non-stupid enough not to get caught afterwards (like the $(24?)M computerized bank job last year), and having your "partners" not rip you off; a big heist also risks detection by tracking chip purchases, and provoking the Feds into banning "ASIC Laundering" and criminalizing illegal possesion of field-programmable gate arrays and such paranoid silliness. ..>> the same Strassmann Yeah, him :-) > (It was a usefully overheated hook for some article on compsec, but >I don't think I ever used it. Reminded me too much of warnings that >someone was bound to someday taint the city water reservoir with LSD;-) But we _were_ planning to enhance the water that way, back in the 60s! :-) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

What else do I need for an Internet Server
by Otto Matic 17 Dec '03

17 Dec '03

What else do I need for an internet server? HP Vectra Towers 2 each 486 cyrex chips 50 meg processor Need high speed hard drives. These are the Tall Towers that have multiple drives, these are server towers. I think I have a router Hub. And a couple LAN cards. That's all I have. But I just got them, and I want to use them. I assume I will be using some kind of UNIX software. Thanks: otto =-=-=-=-=- Otto Matic "Fuckin' A, Miller!" Bud, Repo Man --------------------------------------------------------- Get Your *Web-Based* Free Email at http://www.hotmail.com ---------------------------------------------------------

1 0

Re: Metzger, Denninger square off
by Roy M. Silvernail 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In list.cypherpunks, ericm(a)lne.com writes: > Damaged Justice writes: >> administration about this." Barring that, Denninger will lobby >> Internet service providers around the country, asking them not to >> recognize the new GTLDs. "There is no reason to support it. We will do >> everything in our power to convince ISPs not to go along," he says. > If I didn't already think that Karl was an idiot, I'd sure think so after > reading this. Concur. When I went after my domain name last year, I was effectively forced into taking a .com, which was the _last_ TLD I wanted. (first choice was .net, but that's supposedly now only given to ISPs) I'd happily accept scytale.nom, especially since it's doubly cryptic. - -- Roy M. Silvernail [ ] roy(a)scytale.com DNRC Minister Plenipotentiary of All Things Confusing, Software Division PGP Public Key fingerprint = 31 86 EC B9 DB 76 A7 54 13 0B 6A 6B CC 09 18 B6 Key available from pubkey(a)scytale.com, which works now -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMvvDqBvikii9febJAQE23AQAle+xfNgFCof8CjIDD1VxKv62TbHz5itj 7z2aAPaOD9IT812heFSKn+wYteETpWKWy6iGI/cKyR4siEtqJq2IiqaEs6bjSkIL 2C2ErK0FaKmnW14rUNX2XdSGHlqBGfh3rkjKM5UrHd+PBakNQKIIByPvTxn/Stsl /XzWZBZyAG0= =qAs2 -----END PGP SIGNATURE-----

1 0

Congressional cell phone security hearing
by Dan Veeneman 17 Dec '03

17 Dec '03

Hyperbole flew hot and heavy during a February 5 hearing on cellular telephone privacy chaired by Louisiana Republican Billy Tauzin. The House Commerce Subcommittee on Telecommunications, Trade, and Consumer Protection held a hearing titled "Is anybody listening? You betcha." Subcommittee members were shocked, just shocked to learn that, according to a hyper-animated Thomas Wheeler (president of the Cellular Telephone Industry Association), Americans are engaged in "electronic stalking" of cellular telephone users. Further details of CSPAN pandering and Ed Markey's (D-MA) Humpty Dumpty imitation ("words mean whatever I want them to mean") elided. Some notable moments: Representative Cliff Stearns (R-FL), during a discussion about encryption, called PGP "a darn good program." Jay Kitchen, head of the Personal Communications Industry Association, related an (apocryphal?) story about MI5 requiring 2 Crays to run for 3 days to break a single GSM. Jim Kallstrom, Assistant Director FBI and head of the New York field office, woodenly delivered his (IMHO unfocused) testimony and reported that on the first day of the TWA Flight 800 crash investigation he determined that the news media knew more than they should, so he confiscated the cell phones of the FBI agents and locked them away, under the (reasonable) presumption that reporters were listening to FBI cell phone calls. Jimmy also reiterated the FBI line that their new wiretap requirements were reasonable and necessary to protect American citizens from terrorists. Dan dan(a)decode.com -- cypherp(a)decode.com (Dan Veeneman) Cryptography, Security, Privacy BBS +1 410 730 6734 Data/FAX

1 0