December 2003 - cypherpunks-legacy

Correction in Bay Area meeting announcement
by hughes＠ah.com 17 Dec '03

17 Dec '03

CORRECTION ========== The meeting is Saturday the 9th, not Sunday the 10th. Sorry for the typo. The Bay Area meetings are always on Saturdays. Eric

1 0

Weak RSA keys?
by Karl Lui Barrus 17 Dec '03

17 Dec '03

I don't mean to flame you, but before you rush off and publish your results somewhere you may want to step back and check over your premise and the steps it involves a few times. > The "spare" is 7. The "spare" runs faster, too. Go ahead, try it. > The myth is that "ED = 1 mod (m)". > The truth is as follows: > G = gcd( p-1 , q-1) in this example G=2 > F = m/G in this example F=20 > ED = 1 mod (F) Now how exactly do you calculate this "F"? Does it involve, say, knowing phi(n), information ONLY available to you if you happen to know the factorization of n? In which case the whole thing collapses anyway? How can you use this information to decrypt a message? If I were to give you the 200 digit product of two primes, could you find the "spare" key? If I get some time I'd like to look over your method to see if it's really there or an artifact of the numbers you chose. There is a "weakness" easily shown in RSA in that for some keys, up to 9 messages encrypt to themselves! That is, M^e = M mod n. Now, if you pick large primes, these 9 messages will get lost in the 100 trillion numbers every atom in the universe can have allocated, so it really isn't a problem. -- Karl L. Barrus: klbarrus(a)owlnet.rice.edu keyID: 5AD633 hash: D1 59 9D 48 72 E9 19 D5 3D F3 93 7E 81 B5 CC 32 "One man's mnemonic is another man's cryptography" - my compilers prof discussing file naming in public directories

1 0

Fiberpunks? (Was - Really Cheap Crypto)
by djw＠eff.org 17 Dec '03

17 Dec '03

>>>From today's New York Times: >> >>"- - - General Aidid was brazenly speaking out on his own clandestine radio >>station this week, assailing United Nations colonialism. Today, Pentagon >>officials said they believed the Somali clan-leader had foiled their >>efforts to locate him in part by communicating with his forces on simple >>walkie-talkies difficult to monitor with high-technology American >>listening gear". >> >>Now, is the time for Dorothy D. to suggest, as she did with Clipper, that >>all dissident Somalis be required by law to use high-tech comm gear. Let's >>hope that the criminal element against which the escrowed key crap is >>oriented doesn't hear about the Somali answer to communications intercept. >>In the off chance that they might, I'm going to buy stock in oatmeal boxes >>and wax string. String is, indeed, an critical privacy-protecting technology, but alas, a threat to national security as well. Perhaps someone will have to start a fiberpunks movement. ................................................................... Daniel J. Weitzner, Senior Staff Counsel <djw(a)eff.org> Electronic Frontier Foundation 1001 G St, NW Suite 950 East Washington, DC 20001 202-347-5400 (v) 202-393-5509 (f)

1 0

Re: Weak RSA keys, 2nd post
by Karl Lui Barrus 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- (sorry for posting this twice, but as I sent the previous message, line noise or something overtook me) It does appear that there can be multiple decryption keys, but with good choices of p and q, there will be only two. Whether or not "ed = 1 mod phi(n)" is a myth or not... depends. Look at "Cryptography: an Intoduction to Computer Security" by Seberry and Pieprzyk. On page 92, equation 3.9 gives the relation between encryption and decryption keys as "ed = 1 mod gamma(n)" where gamma(n) = lcm(p-1,q-1). Which is what the "F" function described before is. With proper choices of p and q, the d calulcated by the first forumla and the d calculated by the second will be the same. Of course, since you must know how to factor n to calculate the "spare" key, it isn't clear to me how it will help you decrypt a message. With large enough properly chosen primes, it won't matter. Solution: pick good primes. An example with better choices for p and q: p = 107; q = 167; n = pq = 17869 phi(n) = (p-1)(q-1) = 17596 e = 43 Method 1: d = 43^-1 mod 17596 = 7775 Method 2: lcm(p-1, q-1) = 8798 d = 43^-1 mod 8798 = 7775 Either method: message M = 71 encrypted M' = 71^43 mod 17869 = 10073 decrypt = 10073^7775 mod 17869 = 71 The "spare" key is 7775 + 8798 = 16573, which does indeed work. But again, I don't see how an attacker can use info about the existence of a second key. Karl L. Barrus <klbarrus(a)owlnet.rice.edu> -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLLR5CYOA7OpLWtYzAQH/FQP/a+/uxGaKIYKuWCNcP5e0aBGMjhVPnwlU cJxrDMSBQYcPHzMPafqXIdfIlNE/g7aB/0Fnnh2cB4MtwvsGiCOe/XGNUgrR+R+e X2LWBlQmQ4YBPRnGgXAejX8LkWTScexIrfcXLsps6REyJHVoJB/5gpLNflBnjW5C h8xTNoqknf4= =8y9+ -----END PGP SIGNATURE-----

1 0

Re: Standard Headers for Anonymous Remailers
by owen＠autodesk.com 17 Dec '03

17 Dec '03

> From: pierre(a)shell.portal.com (Pierre Uszynski) > > From: Karl Lui Barrus <klbarrus(a)owlnet.rice.edu> > > The attitude expressed by the individual on io.com shows a problem we > > will have in educating others - "anonymous posts CAN destroy a civil > > conversation". Yes, maybe so, but in my experience on mailing lists, > > bbses, etc. I've noticed that "flame wars" and "anonymous posts" have > > NO correlation, and are quite independent of one another. > > Since I've seen "flame wars" on systems with absolutely no anonymous > > posting facilities (or none that were used), I conclude that civil > > conversation is destroyed by strongly held differences in opinions (or > > some other factor I can't pin down). > I'll second that. The main menaces against "civil conversations" have been, > on Netnews, flame wars and wars between two individuals. There is another level of *menace* which I suppose many of you are unaware. The queer newsgroups of usenet, have been experiencing waves of net-terrorism for the last couple of years. I don't mean the usual mean-spirited or dogma-driven type of uninformed posting that echoes the stereotypical stuff we are used to dealing with in daily life. Nor do I mean the occasional *ALL FAGS SHOULD DIE POSTED IN ALL CAPS FROM SOMEONES ACCT THAT THEY LEFT LOGGED IN ON A PUBLIC TERMINAL AT AN INSTITUTION OF -ahem- HIGHER LEARNING* I mean people who exploit insecure sites and networking skill to forge mail and articles as part of a concerted and ongoing campaign of harrasement. Stuff that has resulted in very serious consequences. Theres no need to go into detail here about the array of tactics and the widening scope of the phenomenon, but I think it needs to be looked at as an example of how and why systems are abused. If anti-social immaturity can easily find shelter for puerile behavior, then any socipathic agenda or ruthless competitor can do likewise. > the flamers and the opponents are clearly > identified. They are usually proudly posting under their usual Name (as > they are all fighting for their Reputation, and for establishing their > opponent's Incompetence) (... do we recognize anybody yet :-? ) I actually > can't remember such a war involving an anonymous poster (as in "using > penet or similar"). soc.motss and other newsgroups have seen a long list of pseudo-persons posting from non existent sites, and yes.. penet has been used to this effect. > What destroys discussions (and forces people to leave them...) is the > tendency of threads to start genuine, and to end as flame wars. > Certainly, for-money systems would tend to shorten flame wars.. I think that there is no shortage of contributing factors to the shortcomings of network distributed ascii based communication. Bottom line is that when we have our full range of auditory clues, and visual context, we use all of that and more in order to convey meaning, and in network distributed ascii communication the clues and context are missing unless we *spell it out*. Most of us aren't that diligent or patient. I think it is interesting to also note that people will engage in levels of flaming that tehy would never do to another person face to face. That is also a form of non-acountability by being unreachable when your content might otherwise earn you a fist in your face. Personally, I believe that some levels and forms of anonymity are highly desireable. Reality is that some levels and forms of anonymity are too easily subverted by sociopaths who don't care about the consequences of their acts, or the restrictions that may come about due to their abuse. Not to get too far past the scope of mailers and netnews, but these issues have importance to the growth of Networked commerce in general. I think that the design of privacy systems needs to take these dark-side issues seriously and do their best to minimise the potential for abuse. If for no other reason, where there is money, there is abuse and criminally sociopathic predators who will do anything in their power to gain advantage over their competition. Perhaps a *zoning* concept is needed, in such that transactions would have qualifying conditions - or in such that *zones* exist as data-space with authentication qualifications for *entry* or transaction. LUX ./. owen

2 1

Good editorial in the Merc
by doug＠netcom.com 17 Dec '03

17 Dec '03

The Thursday Oct 7 San Jose Mercury News lead editorial contains a note acknowledging a sane point of view about cryptographic exports. (It's titled "Unshackled Tech -- Looser export rules will boost Silicon Valley Sales", and it discusses Clinton's decision last week to boost the speed limit for exportable computers.) The *good* part, though, is: " * Congress should update the Export Administration Act. A 1990 version would have lifted export controls on telecommunications and software with encryption codes, which give the software users a better way to keep data secret. President Bush vetoed it. His administration wanted to deprive the Chinese and Russians of the latest, hard-to-bug telecommunications equipment, and the latest encrypted software. Well, the Chinese already know how to make the new telecommunications equipment. The encryption software is in the hands of anyone who can find a pirated copy." Awareness is beginning to grow out there. Doug

1 0

Weak RSA keys?
by Karl Lui Barrus 17 Dec '03

17 Dec '03

>He probably believes, along with most people, that for each >encryption exponent there is ONLY ONE decription exponent. >In fact there are AT LEAST TWO. Yes, you have a "spare key". Yes, it does look like there are two possible decryption exponents, but one is derived from the other and information only known to the person who can factor n, so it isn't clear to me how this is a big weakness. If you pick good factors of n and the primes are large, the problem is just as infeasible as it was before, and you get ONLY two decryption exponents. In fact, if you look on page 92 of "Cryptography; An Introduction to Data Security" by Seberry and Pieprzyk, you will see that they make it more explicit than some other texts: they give this as the formula relating then encryption and decryption exponents: e d = 1 mod gamma(n) where gamma(n) = lcm (p-1, q-1) So they use the least common multiple of p-1 and q-1. With good choices of p and q, there will be 2 decryption exponents: d and (d + phi(n)/gamma(n)). If you have more than 2 decryption exponents, you have made poor choices of primes. Again, to calculate the "spare" key you nee need to know how n factors, which makes the whole thing moot. Example with better choices for p and q: p = 107; q = 167; n = 17869 phi(n) = 106 * 166 = 17596 e = 43 d = 43^-1 mod 17596 = 7775 71^43 mod 17869 = 10073 (the encrypted message) to decrypt: 10073^7775 mod 17869 = 71. If you use e d = 1 mod gamma(n) you get d = 43^-1 mod 8798 = 7775, which is the same d you got above. Thus, the spare key is 7775 + 8798 = 16573, which does work as a decryption exponent. -- Karl L. Barrus: klbarrus(a)owlnet.rice.edu keyID: 5AD633 hash: D1 59 9D 48 72 E9 19 D5 3D F3 93 7E 81 B5 CC 32 "One man's mnemonic is another man's cryptography" - my compilers prof discussing file naming in public directories

2 1

Re: Standard Headers for Anonymous Remailers
by peb＠PROCASE.COM 17 Dec '03

17 Dec '03

>From: pierre(a)shell.portal.com >Who qualifies whom, based on what info, and to eliminate whom? As the Internet becomes more diverse and less the domain of programmers and scientists, it is natural that other means of selection are needed for membership in a group. The traditional academic atmosphere of mailing lists will evolve away from total openenss. Here are some possibilities: 1. By invitation only--members sponsor new members. 2. By trial period--new members are lurkers on the main list and a subset of the members can see their postings or they must first be moderated. 3. Qualifications--could range widely. 4. Tests. 5. All of the above. >From: owen(a)autodesk.com >with authentication qualifications for *entry* or transaction The Extropians list already does this--not totally secure, to be sure, but you must let the list administrators know all your posting nodes. Paul E. Baclace peb(a)procase.com

1 0

Re: Standard Headers for Anonymous Remailers
by pierre＠shell.portal.com 17 Dec '03

17 Dec '03

> From: owen(a)autodesk.com (D. Owen Rowley) > > There is another level of *menace* which I suppose many of you are unaware. [...] > I mean people who exploit insecure sites and networking skill to forge > mail and articles as part of a concerted and ongoing campaign of ????????????????????? > harrasement. > Stuff that has resulted in very serious consequences. ????????????????????????? > > Theres no need to go into detail here about the array of tactics and > the widening scope of the phenomenon, but I think it needs to be looked > at as an example of how and why systems are abused. On the contrary, let's hear the details. If what we are considering here is how to fight abuse while encouraging (what we think is) positive use of anonymous systems, then we need to know the details. If you are not comfortable posting that here, I'd welcome a private email (as well as the people at io.com would, I expect). Still, I don't think cypherpunks is anywhere close to the stage where we should withold that kind of detail (except for OS bugs that go to CERT first)... > soc.motss and other newsgroups have seen a long list of pseudo-persons > posting from non existent sites, and yes.. penet has been used to this > effect. ok, and anonymous remailers don't change that possibility one way or the other. I'll go hang out there for a while anyway... > I think that the design of privacy systems needs to take these > dark-side issues seriously and do their best to minimise the potential > for abuse. Sure, but consider that extremist systems will exist nonetheless. > Perhaps a *zoning* concept is needed, in such that transactions would > have qualifying conditions - or in such that *zones* exist as data-space > with authentication qualifications for *entry* or transaction. Who qualifies whom, based on what info, and to eliminate whom? Pierre pierre(a)shell.portal.com

2 1

Weak Keys? explained
by charliemerritt＠BIX.com 17 Dec '03

17 Dec '03

No, I did not mean I can find the spares of a well constructed key. And yes, the best key has at least one spare. What I meant was, if I were the NSA and wrote the keygen for a crypto system I could guarantee that each key would have a huge number of spares. Enough, that if I were the NSA I could find them. How to generate a weak RSA key: Start with a prime R S=R*2 L1 If S+1 is prime then P=S+1 If S+1 Not prime S=S* next_odd_number (3,5,7,9,11...) Loop to L1 else L2 If S+1 is prime then Q=S+1 If S+1 Not prime S=S* next_odd_number Loop to L2 else N=P*Q #spare keys => 2*R In the example I gave R was 101 p=1+(101*2*3) q=1+(101*2*2*3) spare keys=606 There are many BETTER ways to make a keygen that will produce keys the author can break. RSA has no government trap door, but I, and certainly the NSA can write a keygen that makes trap-doored keys. Ones YOU can't break, but I can, knowing my secret. My example was a put-down of Denning's assurance that skipjack is good. RSA is good, skipjack MAY be good. Look out for booby trapped keys.

1 0