December 2003 - cypherpunks-legacy

[Question EFF yielding of crypto authority to NIST]
by Doug Humphrey 17 Dec '03

17 Dec '03

[stuff deleted] >Actually, they have issued such legal guarantees. They're in the form of the >administration's vow to uphold the US Constitution. That document's 9th and >10th amendments preclude US Government denial or disparagement of the people's >right to use cryptography (and a whole lot of others). The fact that these >legal guarantees are being ignored simply illustrates that their tyranny is >unbridled. When I first scanned this, I saw "... illustrates that their tyranny is unbundled" And I thought, what a concept! Doug

1 0

MPJ Encryption Algorithm
by Mike Johnson 17 Dec '03

17 Dec '03

Bill Stewart writes: > Sounds interesting; do you have any comparisons between it and IDEA > about either encryption strength, speed, or design philosophy? The full design philosophy for MPJ is in my thesis. Since then, I learned about differential cryptanalysis and was relieved to see that MPJ is fairly resistant to that. Here is a short summary: Algorithm Key size Block size Rounds Strength* SW Speed HW Speed DES 56 bits 64 bits 16/2 22-55 slow fast 3DES 112 bits 64 bits (16*3)/2 24-58 slower fast IDEA 128 bits 128 bits 16 65-110 fast fast Skipjack 80 bits 128 bits 32 79 ? ? MPJ 128 bits 128 bits 10 70-120 medium very fast MPJ2 >=64 bits 128 bits >=10 50-128 <=medium <=very fast *Strength is a GUESS at log base 2 of the complexity of breaking it. Algorithm Legal status Back door? Origin DES Public Domain No IBM/NBS->NIST/NSA 3DES Public Domain No IBM IDEA Patented No Switzerland Skipjack Classified LEAF NSA MPJ Public Domain No USA - University of Colorado at Colorado Springs (UCCS) MPJ2 Not yet released No USA DES Design philosophy: (1) Fit in small chip (2) Use involution for reversibility (only half of block changes with each round) (3) Use polyalphabetic nonlinear s-boxes of limited size (requires great care to avoid differential cryptanalysis) (4) Some design criteria still classified. 3DES Design philosophy: (1) Cascade existing known algorithm (2) Avoid weak key situations (3) Try not to require too much more key than the strength of the algorithm justifies (i.e. just 2 instead of 3 keys are used). (4) Apply a bandaid. Making one compound block cipher would have been more secure, but not all the s-box design criteria are known. IDEA Design philosophy: (1) Use unrelated arithmetic operations on different fields. (2) Use only 32 bit arithmetic operations for speed on a computer. (3) Arrange the structure of the algorithm to do proper confusion/diffusion. (4) Very small code and memory space used in computer. Skipjack design philosophy (guessed): (1) Similar to DES, but with a block size of 128 bytes. (2) No attack known to the NSA will be more than a bit or two better than exhaustive key search. (3) Learn from the mistakes of DES (i.e. avoid weak keys and complementation symmetries DES suffers from). (4) Restrict knowledge of the algorithm as much as possible. MPJ Design philosopy: (1) Relax some of the size limits of DES & IDEA to gain security, but make sure it fits on a PC. (2) Avoid fragile fixed s-box & subkey design of DES, but copy its product cipher structure. (3) Change the whole block with each round instead of just half (i.e. 10 MPJ rounds is as effective as 20 DES-type rounds). (4) Make every output bit a strong function of every bit of the input and every bit of the key within 3 rounds. (5) Use such simple operations in a complex and nonlinear fashion that mathematical breakthroughs are not a threat (as with RSA). (6) Make the substitution steps reversible through a very clever construction of reversible substitution arrays directly from the key. (7) Make key scheduling slow (to discourage exhaustive search for keys), but make the algorithm very fast, especially in dedicated hardware. (8) Make creative use of nonlinearity, bit twiddling, and rounds to thwart an analytical attack using massive quantities of known or chosen plain text. MPJ2 Design philosophy: (1) Generalize the key scheduling to accommodate variable length keys. (2) Generalize to n rounds. (3) Attempt to do key scheduling on the fly in cases where the memory required for precomputed internal keys take up too much RAM. Common elements: All of these block cipher algorithms use repeating rounds of "confusion and diffusion" or "substitution and permutation" weaker ciphers to form a stronger product cipher. All of them are secure, even if the cipher becomes known. Skipjack is classified more to prevent knowledge of design criteria and cryptanalysis secrets, and to allow the forced insertion of a back door (LEAF) than for the security of the algorithm (just ask Dr. Denning). DES and 3DES can raise the price of unauthorized disclosure of secrets above the average individual's means. The others have the potential of raising the price of eavesdropping by breaking crypto algorithms to above the budgets of organized crime, hostile governments, and terrorists. None of them prevent other technological solutions to spying, such as placing bugs closer to the target individual, office, or computer system. General rules of the game in CRYPTOGRAPHY and CRYPTANALYSIS: 1. There is always a way to crack any practical cryptosystem. 2. Your opponent will not tell you if she has broken your cryptosystem and is reading your mail. 3. The longer any one cryptosystem is in use, and the more widely it is used, the more likely it is that someone has broken it, or at least discovered a weakness in it and not told anyone about it. 4. The more widely used a cryptosystem is, the more profitable it is to try to break it (for either noble or ignoble purposes). 5. Exclusive control of the ability to communicate securely is a powerful force that can easily be corrupted. 6. Putting all your eggs in one basket is unwise. Use more than one cryptosystem, and change keys regularly -- even if you don't suspect compromise. 7. Insecure cryptosystems often appear on the surface to be secure. They are often sold for good money. DISCLAIMERS: DISCUSSIONS ABOVE ARE FROM MEMORY AND MAY NOT BE ACCURATE. ALL DATA CLAIMING TO BE GUESSWORK IS. PROVING ANY CRYPTOSYSTEM SECURE IS USUALLY IMPOSSIBLE. INVENTERS OF CRYPTO ALGORITHMS ARE NOT QUALIFIED TO JUDGE THEM. Mike Johson mpj(a)csn.org This message contains writings protected under the First Amendment of the Constitution of the United States of America. Censorship is forbidden.

1 0

Re: TRAVELLER'S ADVISORY
by an36440＠anon.penet.fi 17 Dec '03

17 Dec '03

>Unfortunately, >I don't have any bullet-proof solutions. Suggestions? Yes. Seek professional help. And try Xanax. ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

secretive API
by doug＠netcom.com 17 Dec '03

17 Dec '03

I don't know if this is old hat, but I was amused to see a moment ago on another mailing list the following quote from the Windows NT API: ERROR_TOO_MANY_SECRETS -The maximum number of secrets has been exceeded. -Win32 (NT) API. Doug

1 0

Re: TRAVELLER'S ADVISORY
by doug＠netcom.com 17 Dec '03

17 Dec '03

an36440(a)anon.penet.fi said: >> [ Sandy said: ] >>Unfortunately, >>I don't have any bullet-proof solutions. Suggestions? > >Yes. Seek professional help. And try Xanax. Now, now. Sandy's got a point, John could in fact get zapped by overly zealous authorities. It may be mildly paranoid to think that they'd plant evidence on him...the suits only do that if they're *REALLY* pissed at someone, and even then only sometimes...they're risking their jobs every time they do that, after all. Actual conspiracies are comparatively rare, if only because they take a lot of high level carefully planning and support to execute well. It's not like John is a key figure in South American politics or something. :-) But nonetheless, there's still the chance that they'd get a fixation on the notion that he was carrying something illicit out of the country and interfere with his travel in a very unpleasant way. It wouldn't be the first time such a thing happened purely out of misplaced zealousness. As for solutions, the age-old approach is to be a high profile philanthropic and campaign contributor and elbow-rubber, so that one has a lot of community support if one gets leaned on. This would be a private matter for John, though, and not up to us to discuss. I mention it simply because it *is* a well known partial solution. I actually don't exactly recommend it, for complicated reasons. Considering certain recent posts (and considering the Internet at large, for that matter), I'll still give you points for showing signs that you paid attention to everything Sandy said and responded to what he actually said. I wish everyone would do that. ;-) Doug

1 0

troglodyte MIND RAPIST flames, take II
by an12070＠anon.penet.fi 17 Dec '03

17 Dec '03

anon.penet.fi cut my message. now I know how Infocalypse feels. send this EVERYWHERE in cyberspace it might make a difference. === Subject: STOP THE TROGLODYTE FIDONET MIND-RAPISTS *NOW*! does routine FIDOnet email INVASION by operators VIOLATE the U.S. Electronic Communications Privacy Act? EFF's lawyer M. Godwin speaks with FIDOnet operator Al Billings <mimir(a)u.washington.edu> on the cypherpunks mailing list. Resident list crank Perry Metzger offers his own whitehot flame. this forward brought to you by cypherpunks Cyberspatial Reality Advancement Movement (CRAM) Information Liberation Front (ILF) Blacknet === From: Mike Godwin <mnemonic(a)eff.org> Subject: Re: FIDOnet encryption (or lack thereof) To: cypherpunks(a)toad.com Date: Fri, 1 Oct 1993 16:40:09 -0400 (EDT) Al Billings writes: > On Thu, 30 Sep 1993, Mike Godwin wrote: > > > > My question is this: how does he know that the mail is encrypted if he's > > not examining the mail that passes through his system? If he *is* > > examining the mail that passes through his system, it seems likely that he > > is violating the Electronic Communications Privacy Act. > > Only if he has stated that he allows private mail. Most sysops have > specifically worded policy statements for their systems that say that the > sysop can read any and all messages on the system and may do so at any > time. That's all very nice, but it doesn't enable a FIDO sysop to intercept messages from people who are not users of his or her particular system. Those people did not waive their rights to privacy under the ECPA. > Bulletin boards do not normally offer truely private mail because of > some of the legal implications. This is a common myth. First of all, there are many BBSs that do offer truly private mail, or whose sysops, as a matter of policy, do not read others' private mail. Secondly, there's no legal liability associated with allowing e-mail privacy. Third, federal law (the ECPA) bars sysops from examining mail except under some very precisely defined circumstances. I suggest that you inform sysops who tell you otherwise that they can contact me at the Legal Services Department of EFF. You've got my e-mail address already--my phone number is 202-347-5400. -Mike From: Mike Godwin <mnemonic(a)eff.org> Subject: Re: FIDOnet encrypted mail issues Date: Fri, 1 Oct 1993 17:16:48 -0400 (EDT) To: cypherpunks(a)toad.com anonymous(a)extropia.wimsey.com writes: > Now, the point most internet people forget is that FIDOnet hosts are > hobbyists with 100% privately-owned machines and generally pay for the > entire participation of their userbase out of their own pockets, > excepting a few who get some dollars here and there from their generous > callers. I have never forgotten this. But their commitment and efforts do not amount to an amendment to federal law. > As a completely justified consequence, they can decide if they > allow encrypted traffic _on their individual BBSs_. Under what legal theory do they get an ECPA exemption as a "completely justified consequence"? > In that there is > considerable fear of the consequences of illegal activity being > conducted on their BBSs via encrypted mail, many sysops (such as the one > you mention, leaving aside, for now, that he apparently confused a PGP > key with an encrypted message) do not wish to take the risk and forbid > encrypted traffic. What they don't realize is that, rather than reducing the risk of legal liability, they are increasing it. > They also monitor e-mail, if only incidentally > during the course of routine system maintenance, and notices to this > effect are generally contained in log-on screens and new-user info > files. Any monitoring that results *directly* as a function of system maintenance is okay--it's sanctioned by ECPA. > In that these sysops are extremely, _personally_ vulnerable, they are > generally more cautious than those internet folks who can hide behind > institutions and businesses. If they were really cautious, they'd talk to a lawyer before setting policy based on some guess as to what their legal liabilities may be. ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Apple's PowerTalk: *breakthrough* in crypto export?
by L. Detweiler 17 Dec '03

17 Dec '03

>From the TidBITS Mac newsletter: (I'd be more specific but don't have it from my source -- perhaps someone can post the info on how to retrieve the whole article.) >PowerTalk Arrives >----------------- > by Wolfgang Naegeli -- wnn(a)ornl.gov Powertalk is Apple's new `Collaborative Environment' client software, supposedly to be released next week. Its a sort of groupware-email package with some significant security & cryptography mechanisms. Sounds like its very intuitive and a very highly refined user interface. I suspect this whole platform could have a *major* effect in bringing seamless, invisible, secure cryptography to the masses -- at least, reading all the promotional hype, the *potential* is there. > Apple claims that PowerTalk is more secure than most other off- > the-shelf software solutions since those use less secure > algorithms to avoid export restrictions. Apple is the first > company to receive an export license for a DES-based product. 1st? *WOW* Cypherpunks we need more intelligence on this ASAP! Does this represent a fundamental *breakthrough* in export policy? Why are they the first? Is it real live DES and not some strange crippled bit length version? What does this *mean*?! red warning flag: >RSA always is at the > root of the issuing process and signatures expire after two years. Not sure if this means what it seems to say -- that RSA is *generating* the private keys and passing them on? We just had that big discussion about this issue with some other software from Apple, didn't we? Here's some more from the article of interest to cypherpunks. ===cut=here=== Digital signatures, based on RSA Public Key Encryption, provide a secure way of ensuring data has not been altered and was signed by a particular person. The mechanism is similar to Kerberos [a security system developed at MIT -Adam], which was not mature enough at the critical point in PowerTalk development. Apple anticipates supporting Kerberos in a future PowerTalk release. To sign a document, simply drops it on a Signer icon. A prompt for the personal signer code then appears on the screen. If the content of the signed document later changes in any way, the signature becomes invalid. While being signed, a file automatically is locked to avoid inadvertent invalidation. The Get Info window of a signed file is used to uncheck the file lock, and it contains a Verify button with which the recipient can assert the integrity of the file and authenticity of its signature. Large companies can become trusted signature issuing agents for their employees by obtaining a titanium blackbox with key interlocks from RSA. The box contains a certain number oFrom owner-cypherpunks Sat Oct 2 03:18:43 1993 Received: by toad.com id AA25713; Sat, 2 Oct 93 03:14:17 PDT Received: by toad.com id AA25695; Sat, 2 Oct 93 03:13:54 PDT Return-Path: <sameer(a)soda.berkeley.edu> Received: from soda.berkeley.edu ([128.32.149.19]) by toad.com id AA25690; Sat, 2 Oct 93 03:13:51 PDT Received: by soda.berkeley.edu (5.65/KAOS-1) id AA09739; Sat, 2 Oct 93 03:13:44 -0700 Date: Sat, 2 Oct 93 03:13:44 -0700 Message-Id: <9310021013.AA09739(a)soda.berkeley.edu> To: cypherpunks(a)toad.com From: nobody(a)soda.berkeley.edu Subject: Sternlight's Key Remailed-By: Sameer Parekh <sameer(a)netcom.com> As an official Key Escrow Agent of the United States Gubberment, I have decided that David Sternlight, being a controversial public figure, needs cryptographic protection for his private communications. Accordingly, a key has been created for him. He has been provided with his public and secret keys via e-mail. A copy of the secret key will be held in escrow. In the event that Mr. Sternlight is ever served with a subpoena, the key will be released to appropriate authorities. Since Mr. Sternlight has been a vocal advocate of key escrow, I'm sure he will have no problems with his key being created by an unknown person. In the absence of a subpoena, Mr. Sternlight, your key is safe. Trust me. I'm from the gubberment and I'm here to help you. pub 1024/5C4E59 1993/10/02 David Sternlight <strnlght(a)netcom.com> Available from a keyserver near you.

1 0

Re: POISON PILL
by George A. Gleason 17 Dec '03

17 Dec '03

Remote control via pagers is subject to false-positives, i.e. you'd need a passcode to activate it or otherwise the first wrong number which dialed your pager would wipe you out... and also, you're not in any position to dial your pager if some hypothetical robber was holding you hostage while trying to get at your data.

1 0

Re: POISON PILL :-)
by hiscdcj＠lux.latrobe.edu.au 17 Dec '03

17 Dec '03

In <9310011727.AA01395(a)netcom.netcom.com> msattler(a)netcom.com (Michael Sattler) writes: >> >>I have Australian Defence Security Clearance stickers on my computer, >>they are so cool, these little yellow and red stickers that authorise >>the computer for secure use (and something else I can't remember). >Any chance of getting a few sent to me in San Francisco? And perhaps me in Melbourne? :-) Dwayne

1 0

No Subject
by hughes＠ah.com 17 Dec '03

17 Dec '03

>I have personally reconstructed many shredded >documents done with commercial-grade shredders. It's extremely easy and >I wonder why the "security conscious" even bother with the waste of >time. Cost. It's much more expensive to read a shredded document than an integral one. As always, though, if the expense to reconstruct is smaller than the value of the documents, one should use a better method. Eric

1 0