December 2003 - cypherpunks-legacy

Phil Zimmerman on 'The Death of DES'
by Christian Void 17 Dec '03

17 Dec '03

I found the following on Usenet, and was curious as to the validity of the statements made. If anyone has any other information regarding this, please post or mail it private. I don't know if any of it already floated through here, but thought you might be interested in it. --- Seen on the PRIVACY FORUM mailing list: ----------------------- Date: Wed, 8 Sep 93 13:13:12 -0400 From: "Alan (Gesture Man) Wexelblat" <wex(a)media.mit.edu> Subject: DES is a dead dog... From: Philip Zimmermann <prz(a)columbine.cgd.ucar.EDU> Subject: Re: DES Key Search Paper (fwd) Michael Weiner presented a paper at Crypto93 that describes a fast DES key search engine that uses a special inside-out DES chip that he designed. This chip takes a single plaintext/ciphertext pair and quickly tries DES keys until it finds one that produces the given ciphertext from the given plaintext. Weiner can get these chips made for $10.50 each in quantity, and can build a special machine with 57000 of these chips for $1 million. This machine can exhaust the DES key space in 7 hours, finding a key in 3.5 hours on the average. He works for Bell Northern Research in Ottawa, and says they have not actually built this machine, but he has the chip fully designed and ready for fabrication. This is a stunning breakthrough in the realization of practical DES cracking. BTW-- note that PEM uses straight 56-bit DES. --- Christian Void /T71 | "I don't like it, and I'm sorry I | VMResearch, Inc. cvoid(a)netcom.COM | ever had anything to do with it." | P.O. Box 170213 Tel. 1+415-807-5491 | -Erwin Schrodinger (1887-1961) | SF, CA 94117 * PGP v2.3a Public Key Available Via Finger *

1 0

Easy cracking
by technopagan priest 17 Dec '03

17 Dec '03

If you found out you could easily crack a commercial "protection" method, what do you do? First, you stay anonymous, because otherwise they will try to get you, no matter what your intentions are. I think it is best to send the information, anonymously, with a working example to the company. But chances are that they will sit on it due to fear of loosing market share or being sued by users. So the question is, is it more ethical to allow the userbase to have their information cracked by "bad guys," possibly without their knowledge, or publish the information so that the userbase is aware of the security breach, and can do something about it? It depends on the situation, of course. But no one will believe you if you say "I can crack xyz programs 'protected' data" without showing how it works. When it comes right down to it, individuals have to be responsible about the cryptosystems they use. And you are much better off knowing that your data is possibly crackable rather than not knowing it, and having hackers crack it without your knowledge. Hopefully this whole incident will get software companies thinking more seriously about using scholarly-tested secure cryptosystems. -Thomas

2 1

Denning article - sites for retrieval
by L. Detweiler 17 Dec '03

17 Dec '03

The article has been placed in Privacy Forum archives: ===cut=here=== Date: Fri, 24 Sep 1993 16:49:45 -0400 (EDT) From: denning(a)cs.georgetown.edu (Dorothy Denning) Subject: Wiretap Article The following article on wiretap laws and procedures was written in response to the many questions and misunderstandings that have arisen about wiretaps in the context of escrowed encryption as well as Digital Telephony. This article may be distributed. Dorothy Denning denning(a)cs.georgetown.edu [ I have included the introductory portion of the paper below. The entire text (~33K bytes) has been placed into the PRIVACY Forum archives. To access: Via Anon FTP: From site "ftp.vortex.com": /privacy/wiretap.laws.Z or: /privacy/wiretap.laws Via e-mail: Send mail to "listserv(a)vortex.com" with the line: get privacy wiretap.laws as the first text in the BODY of your message. Via gopher: From the gopher server on site "gopher.vortex.com" in the "*** PRIVACY Forum ***" area under "wiretap.laws". -- MODERATOR ]

1 0

idiotic government regulations: DO SOMETHING!
by L. Detweiler 17 Dec '03

17 Dec '03

Here's everyone's chance to do something *constructive* about idiotic government regulations. Imagine this -- an email address to report them! ------- Forwarded Message Date: Sun, 26 Sep 93 23:14:39 EDT From: "Paul Jones" <pjones(a)sunsite.unc.edu> Subject: REGO needs your suggestions - soon The following announcement comes from the Office of the National Performance Review- they are looking for anecdotes regarding useless government regulations, and reccomendations for eliminating needless bureaucracy. This is the Net's chance to have a say in fixing what's wrong with the US government. - ------ Vice President Gore's task force on reinventing government (REGO) called for many changes in the federal government. Now that the report has been issued, we have shifted to implementation of those recommendations. Successful implementation of those changes will require the collective efforts of many people across government. To provide support and to help implement the recommendations, a "network of networks" is being established. The network, dubbed "NetResults" will link together government workers at the federal, state, and local levels, and will provide ways for people in the private and non-profit sectors to participate as well. This message is an initial effort by NetResults to get information and support for these recommendations. On September 11, 1993, President Clinton signed an executive order calling for the elimination of one-half of executive branch internal regulations within three years. We'd like your assistance in helping us find the best examples of obsolete, redundant, or dysfunctional federal regulations. This is your opportunity to let senior federal policy managers know about federal regulations or internal administration policies and procedures that prevent effective service to the taxpayer. We plan to forward this information to the Federal Quality Institute for its use in helping agencies eliminate or reduce regulations. Any replies should give a brief description of the regulation or internal administrative procedures and a specific citation where this regulation is found. Please send us this information either through electronic mail to: sillyreg(a)sunsite.unc.edu or fax it to REGO at: (202) 632-0390. For immediate impact, send your responses by electronic mail before September 28, 1993. If you are interested in more information on "NetResults", please send an electronic mail message to Steve Butterfield at steveb(a)sunsite.unc.edu, Dennis Egan at dennise(a)tmn.com, or Andy Campbell at andy(a)tmn.com. We appreciate your interest and will look forward to your replies. ------- End of Forwarded Message

2 1

Re: saturation tactics?
by George A. Gleason 17 Dec '03

17 Dec '03

yeah, here's a cheaper version. Write to the arms excport license people and pester them with questions: I'm a BBS operator, what should I do?; I'm a businessperson travelling overseas and need my crypto to comm with the home office what should I do?; all this kind of thing. Swamp them with letters. Every person and every circumstance which even remotely fits. An alternative version which would require more guts and perhaps a serious conscientious decision about whether it's worth making this an act of civil disobedience, is to write to them and say, "I'm a BBS operator, not an arms merchant, and on the strength of my 1st-A rights I'm not going to censor my board or get a license..." or "I'm a businessperson who travels & takes my cryupto out of the country on my laptop to comm with the home office; I'm not an arms dealer either and I don't intend to get a license..." And again, there is strength in numbers here. And of course, a good steganographic program or two would be a very nice development indeed, Just In Case. -gg

2 1

Ringing Dingaling Rebuttal
by L. Detweiler 17 Dec '03

17 Dec '03

Here's a cypherpunkesque rebuttal of the recent article. ===cut=here=== Date: Mon, 27 Sep 93 08:39:11 -0400 From: shap(a)viper.cis.upenn.edu (Jonathan Shapiro) To: denning(a)cs.cosc.georgetown.edu Subject: Re: Wiretap Article Dorothy: Recently you sent out a piece of mail providing information on wiretap laws in connection with the Clipper chip. I wish to draw to your attention that the laws concerning wiretapping are largely irrelevant to the issue at hand, and why. Let us assume that the wiretap laws as they stand are sound (I do not believe this, but it doesn't matter). Let us ignore the fact that the new Attorney General was recently asked to sign a large pile of blank warrants in the interests of "National Security," and rightly went through the roof. Let us further imagine that the system is Good, and that the likes likes of McCarthy, J. Edgar Hoover, Richard M. Nixon, G. Gordon Liddy, and Ollie North are gone forever. In fact, let's go so far as to ignore that as the Federal Government grows and grows it is a _necessary_ consequence that we will encounter more such people. Let us ignore the abridgements of the First Amendment rights of encryption technologists during the '60s and '70s by the NSA, and discount their bleatings as the reactions of alarmists. Finally, let us imagine that the timing of the munitions investigation into Pretty Good Privacy is entirely accidental, and that this does not amount to an attempt to make the only viable alternative encryption technology illegal de facto. As a personal matter, I'm inclined to grant this point because the agencies involved are too disorganized to have successfully coordinated. Government is _not_ intrinsically evil. It _is_ intrinsically amoral. The propriety of a government is only as sound as its weakest member in a position of relevant power. We can sometimes catch the offenders and subject them to due process, but doing so does not compensate their victims for their abuses. To be sure, this term's politicos are swearing themselves stupid promising that other encryption technologies will not be outlawed. By them. Of course, the policies change from term to term, and the guarantees of this group of people are therefore irrelevant to the long term. The question, you see, is not _whether_ the Clipper technology will be abused, but _how_soon_. The lessons of history, Ms. Denning, are best not forgotten. Jonathan S. Shapiro Synergistic Computing Associates

1 0

minor humor: telco's vs cable companies
by Brian D Williams 17 Dec '03

17 Dec '03

We at TPC like to put it to people quite simply, " Do you want your cable service to be like your phone service, or do you want your phone service to be like your cable service?" Brian Williams Extropian Cypherpatriot "Cryptocosmology: Sufficently advanced communication is indistinguishable from noise." --Steve Witham "Have you ever had your phones tapped by the government? YOU WILL and the company that'll bring it to you.... AT&T" --James Speth

1 0

Steve Jackson opposes Clipper FIPS
by L. Detweiler 17 Dec '03

17 Dec '03

===cut=here=== Date: Sun, 26 Sep 93 21:15:13 GMT From: sj(a)indial1.io.com (Steve Jackson) Subject: Comments on Clipper/Skipjack proposal Steve Jackson, President Sept. 26, 1993 Steve Jackson Games / Illuminati Online PO Box 18957, Austin, TX 78760 512-447-7866 sj(a)io.com National Institute for Standards and Technology (NIST) ATTN: Proposed FIPS for Escrowed Encryption Standard Technology Building, Room B-154 National Institute of Standards and Technology Gaithersburg, MD 20899 Sirs: I am writing in opposition to the Proposed Federal Information Processing Standard (FIPS) for an Escrowed Encryption Standard, docket # 930659-3159. As a publisher of both printed and online materials, I am deeply concerned by the potential effect of the proposed standard, which appears to me to have been produced in haste and to be lacking many significant elements required for informed citizen comment. I am in strong agreement with the points raised by the EFF and CPSR in their comments opposing the proposed standard. Private access to strong encryption is simply vital to protect the privacy of individuals in today's online environment. Legitimate business requirements for confidentiality also mandate free access to good encryption technology. The manner in which this proposal has been put forward is improper and incomplete. An algorithm intended for private and commercial purposes should not be classified as a "national security matter." And it is wholly improper to ask for meaningful "citizen input" while the algo- rithm itself is secret, the identities of the escrow agents are not firmly established, complete operating procedures are not available, and no legal recourse is yet proposed for the improper release of keys. In particular, the proposal fails to define what "legal authorization," other than a court order, might be available to compel the escrow agents to release a key. This omission is unacceptable. If keys are to be released to any authority except a United States court, the details must be made public immediately. Finally, a strong guarantee is needed that the Clipper/Skipjack system will never become mandatory, and that other forms of encryption will remain freely and legally available to all Americans. The proposal should be withdrawn until all these issues can be addressed. Only then can a legitimate period of citizen comment begin. Respectfully submitted - Steve Jackson ------- End of Forwarded Message

1 0

Re: PGP Business Week article
by George A. Gleason 17 Dec '03

17 Dec '03

Re. Representative Sam Gejdenson (pronounced as if spelled "gaydenson", accent on first syllable): I went to one of his campaign appearances when he first ran for office (this was Middletown Connecticut, 1980), and was very much impressed by his positions on various issues, and in particular, his background knowledge in a number of areas including engineering and policy areas related to the environment.... he is definitely someone who has a good ability to digest and utilise technical information in detail, and I'd say he could be a very very key person on our side of these issues. He definitely deserves 100% support and all the solid detailed information we can provide. -gg

1 0

Re: Verilog encryption broken
by George A. Gleason 17 Dec '03

17 Dec '03

Re Mark's question about the ethics of revealing that a proprietary system is crackable: I believe there is every right and duty to make the vulnerability publicly known. However, this can be done without disclosing enough of the content of the badly-protected information as to come in for heat. For example, one might post little snippets of a source code file which by themselves aren't usable but which the original owners will instangly recognise. This would be akin to the "fair use" of quotations from literature and poetry in critical reviews. And I also believe it would stand up in court, because the material which was revealed in the quotations could not be used in and of itself to devalue the content of the original complete work. -gg

1 0