December 2003 - cypherpunks-legacy

Strong PRNGs
by cme＠ellisun.sw.stratus.com 17 Dec '03

17 Dec '03

I can think of two: 1. a long-period PRNG (like subtract-with-carry) feeding a cryptographically strong hash function (perhaps triple-DES in ECB mode with both key nad input taken from the PRNG and output becoming the new PRNG output; 2. Russell Imagliazzo's (sp?) PRNG as strong as subset-sum. Reference: R. Imagliazzo, M. Naor, ``Efficient Cryptographic Schemes Provably as Secure as Subset Sum.'' FOCS89. For example: (if I remember correctly) Algorithm: Take an array of 512 numbers, each 521 bits long. Fill those with true random bits (coin flips, etc.). fill a 512 bit register with random bits. associate each bit of the register with one entry in the array. loop: for each bit in the 512-bit register, if the bit is a 1, add the corresponding array entry into a 521-bit accumulator (init'd to 0 at the start of this pass), modulo a 521-bit prime. at the end of the pass over all 512 bits, take the low order 8 bits of the accumulator as your output byte (a pseudo random value) and the next 512 bits as the new register for the next round. Toss the top bit. goto loop

2 1

Re: Need Suggestions for Random Numbers
by cme＠ellisun.sw.stratus.com 17 Dec '03

17 Dec '03

>Message-Id: <9310060445.AA16280(a)toad.com> >From: peter honeyman <honey(a)citi.umich.edu> >Date: Wed, 06 Oct 1993 00:44:29 -0400 >Subject: Re: Need Suggestions for Random Numbers > >... recommended that i check >out marsaglia's paper in annals of applied probability v1n3 1991. I have this algorithm coded in C -- and will send it to anyone who wants it. It's not strong -- just long period. It's also part of the new "tran", as posted on sci.crypt and available for FTP on ripem.msu.edu - Carl

1 0

Crypto Toolkit Suggestions
by Mike Ingle 17 Dec '03

17 Dec '03

I'm writing a toolkit to allow crypto programs to be written using pipes and shell/perl scripts. There will be several small programs, most of which will act as filters, to give direct access to rsa, idea, md5, keyrings, etc. This should allow quick and easy coding of digicash, zero-knowledge servers, and other interesting things. So far I've got the MD5 and IDEA functions. MD5 is just a filter - it takes whatever you feed it and outputs the MD5 hash in hex. IDEA takes e or d for encrypt or decrypt, a key, and (if encrypting) an initialization block. Then it acts as a filter. The output is ten bytes longer than the input - init block and two key check bytes - just like the idea_file function in PGP's crypto.c file. MD5 links with md5.c and md5.h, and IDEA links with idea.c and idea.h from pgp23a. For example, you could do: key=`md5` passphrase^D init=(16 random hex digits - another MD5 is okay, it will ignore excess) export key init idea e key init < infile > outfile idea d key < outfile > decrypted Questions: what is the best way to pass a key? The command line is definitely out, because ps shows it. Right now, IDEA takes the name of an exported environment variable containing the hex key. Can you securely wipe an environment variable? Is there a better way? (A temporary file could be dangerous; a key could be left lying around.) What else should I write? Ideas: direct access to rsa with hex numbers, direct access to modmult, etc, for dh and stuff, a filter for armor/dearmor and zip/unzip. A program to pull key material out of a keyring in hex, so you could use PGP keys with the rsa routines. What would really be nice is a filter that could generate pgp-compatible packets, so you could make up any "pgp object" using a pipe. You could also use the hex output directly. --- MikeIngle(a)delphi.com The enemy is not just the federal government. The enemy is centralized power, wherever it may exist.

2 1

Enough already!
by nobody＠pmantis.berkeley.edu 17 Dec '03

17 Dec '03

Has everyone on this list lost their minds? Can't someone give a well-intentioned piece of advice without getting bogged down in a ten-day flame war? I don't think anyone here questions the integrity of the EFF. They were trying to help by giving the names of those outlaw GIFs. What's the big deal? If there's someone smoking a cigarette on the subway platform and I see a cop coming, I'll tip the person off. Common courtesy. (I'm not saying this is the exact same thing that the EFF is doing, just making an analogy.) Why blow this all out of proportion? Please do your part to save bandwidth and keep S/N as high as possible. If you're going to harangue people, do it via private email. Probably 40% of cypherpunk posts in the last few weeks have been stupid bickering that never should have started and probably persuaded quite a few people to unsubscribe besides. There's no need to let everyone on the list know about every tiny disagreement you have with someone's opinion. Especially when that person clearly has the best of intentions. Maybe we SHOULD make people pay to post the list. -Mr. Funn

3 2

Re: POISON PILL
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> Furthermore, pipe bombs throw shrapnel, and as such are anti-personnel > devices. The goal was to destroy data, not FBI agents. Booby traps that > take lives are considered in court as 1st degree murder. > There are more elegant approaches. Thermite, for instance :-) Actually, that could get you nicked for arson of Federal property, which carries substantial jail terms (a couple of anarchists who burned a government-owned flag a few years ago got 10+ years for it.) Releasing viruses can also get heavy penalties; keeping the malfunction (excuse me, "different data storage parameters") within your own machine is more likely to be safe, though destroying data on "Federal interest computers" (which manages to include banks and a few other things as well as government-owned systems) is also illegal, and your machine becomes a Federal interest machine if they steal it. You could do something really hostile, like have it boot OS/2 if someone gives the wrong password :-) Bill

1 0

Living in a state of sin
by Tom Libert 17 Dec '03

17 Dec '03

Don't use PRNGs for one time pads. To quote Don Knuth, anyone using software methods to generate random numbers "is living in a state of sin." Knuth quoted John von Neumann: "Anyone who considers arithmetical methods of producing random digits is, of course, in a state of sin." (1951)

1 0

Re: Strong PRNGs
by cme＠ellisun.sw.stratus.com 17 Dec '03

17 Dec '03

>Message-Id: <9310061432.AA16969(a)snark.lehman.com> >Subject: Re: Strong PRNGs >Date: Wed, 06 Oct 1993 10:32:26 -0400 >From: "Perry E. Metzger" <pmetzger(a)lehman.com> >Carl Ellison says: >> I can think of two: >> >> 1. a long-period PRNG (like subtract-with-carry) feeding a >> cryptographically strong hash function (perhaps triple-DES >> in ECB mode with both key nad input taken from the PRNG >> and output becoming the new PRNG output); > >What would the point of using this for a one time pad be, though? Why >not just use triple-DES and be done with the bulk and complexity? I'm not advocating it as a replacement for triple-DES. I was answering a question. I have many uses for random numbers and none of them is XOR encryption. However, I can even see a point for using this for XOR encryption [I prefer not to call anything using a PRNG One-Time-Pad]. I can see two points, even: 1. You might have traffic which operates in very high speed bursts (faster than your triple-DES can go) but for which the average throughput is well within the speed of your triple-DES. So, you keep your PRNG/DES grinding and building a buffer of bytes to be used, then you use them at high speed during the burst. 2. Knuth's Algorithm M (from someone else) mixes two PRNG streams and the result is stronger than either of the two sources. I haven't read the paper he references, so I don't know how much stronger, but if there's any strength to be gained, someone might want to use it. - Carl

2 1

Re: Standard Headers for Anonymous Remailers
by Stanton McCandlish 17 Dec '03

17 Dec '03

> It seems to me that his suggestion would work to make it easier for > readers to do that. There are people who don't want to read anonymous posts. It > seems only fair to give them a reasonable opportunity to kill them as a group > _from their own newsreaders_. This job is very difficult in the present, and it > requires that the person know the email addresses of every anonymous remailer > in the world, so he/she can killfile all of them. On the other hand, a single > word added to a special header would enable them to identify anonymous posts as > a group, saving everyone a lot of hassle. Which will result in newgroups banning anon mail wholesale. There are other filtration methods besides using the full address of the remailer. Simply filtering out all mail from userIDs "anonymous" and "nobody" will kill most anon mail as it is. > This isn't necessarily related to the banning of anonymous posts from a > whole newsgroup. This is about an individual choice by individual readers. But of course it is related to banning anon postings in whole groups. > What it suggests is a matter of opinion, and I'm sure that you will > give yours (as will I) to anyone who tries to ban anoymous posting in "normal" > groups. On the other hand, the academic and hard-science conferences you > addressed would be served by this feature. They can already filter out this stuff without that much of a hassle as can anyone. Really, the idea of standardizing the anon remailers is not that big a deal, I just see it as a step in the wrong direction, at least until anon mail is more accepted. It will just make it slightly more easy to filter out anon mail, and at a time when lots of admins and moderators are frowning up anon mail, is this such a good idea? > It is a bad idea to try to stop a technical development just because > some people might misuse it. Yes, the anon-marker heeader may be misused. PGP > has been and will continue to be misused, as will the remailers. That doesn't > mean we should get rid of them. It only means that we should behave > intelligently and make our own choices about who to believe and what to > support. Hahahah, I'm not trying to stop a [useful] technological development, just slowdown a potentially worse-than-useless one until anon mail is more accepted, at which point standardizing would be a good idea. Your last sentence above...when do I ever advocate otherwise? :) > Usenet is hardly an autocratic medium. If a normal Usenet group > suddenly banned anon traffic entirely, there would be ample opportunities for > you and I and all the other cypherpunks (both in membership and in spirit) to > raise objections. And it's not only cypherpunks who would object. The traffic > in the normally conservative news.admin.policy showed the disapproval of > oppressive top-down regulations during the ARMM/UDP incidents. > I just think that the creation of a special anon header is not a real > problem, since it would do no real damage, and might improve the image of > remailers considerably. This argument I really don't follow. I don't see how standardizing this mailing software to produce a specific header line will change anyone's opinion or remailers or anonymity on the net. Well over a year ago, some Fido-tech software authors came up with a similar idea for marking encrypted mail (specifically they created the ^enc PID kluge line, which is pretty much analogous to a type of mail header). The result was that no one's opinion of crypto in FidoNet appears to have changed, and the debate rages on just as before. > >Fido: <tba> IndraNet: 369:111/1 > Oh, a Fido member? What's your opinion on the recent squabble over > encryption/mail censorship there? Well I'm temp. out of Fido, for a week or so, due to the move, but if you mean the CP argument, I'm still sorting through it (again, due to moving, I have a major backlog, like 600+ emails). If you mean the general idea of le crypto en Phydeaux, well that's been raging for a year or 2 or 4. Quite a few of us decided 'heck with it', and started a secondary hub backbone system called the SecureMail system, which WILL carry encrypted mail. Just search the nodelist for the UNSMH and URSMH flags (that's Net SecureMail Hub, and Region SM Hub.) The EFF-BBS that's coming soon will likely been one such hub. -- DISCLAIMER: This message represents only my OWN opinion, not that of EFF. Stanton McCandlish Electronic Frontier Foundation Online Activist mech(a)eff.org NitV-DataCenter BBS SysOp Fido: <tba> IndraNet: 369:111/1

1 0

OTP random number sources
by cme＠ellisun.sw.stratus.com 17 Dec '03

17 Dec '03

>Message-Id: <9310061539.AA09997(a)dink.foretune.co.jp> >Subject: Re: Enough already! >Date: Thu, 07 Oct 93 00:39:42 JST >From: "Robert J. Woodhead" <trebor(a)foretune.co.jp> >On a totally different topic, has anyone investigated using the >LSbit of CD sound tracks as the source of a 1-time pad? This was discussed, some, in the internet draft on random numbers. The one which just expired was draft-ietf-security-randomness-00.txt. A new one has been submitted to replace it. I'd recommend it to those interested in the topic.

1 0

Re: Strong PRNGs
by cme＠ellisun.sw.stratus.com 17 Dec '03

17 Dec '03

Someone wrote: > for each bit in the 512-bit register, if the bit is a 1, add the > corresponding array entry into a 521-bit accumulator (init'd to 0 > at the start of this pass), modulo a 521-bit prime. > ^^^ > is this correct? > Yup. 512 + 8 + 1 = 521 512: for the seed for next time 8: for the output byte 1: slop, since numbers mod a 521 bit prime won't give a uniform distribution of the top bit - Carl

1 0