December 2003 - cypherpunks-legacy

Crypto Idea; Multi-Part Sigs
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

Some parts of what Christian asks about can be done; some can't. You can't have it that each of three individuals can decrypt messages sent to a key, while they all have to cooperate to sign messages. Generally speaking, decryption and signing are identical in the RSA cryptosystem. Having enough information to do one implies teh a the ability to do the other. However, you can divide a key so that people must cooperate to sign OR decrypt. Normally, in RSA, you choose a public exponent e, and find d, the secret exponent, such that e*d = 1 mod (p-1)(q-1), where p and q are the primes. Instead, you can choose d1..d3 such that e*d1*d2*d3 = 1. Choose d1 and d2 at random, choose e, and find d3 as in regular RSA. Give d1, d2, and d3 to each of the three people. Now they must apply their exponents to the RSA block in order to sign or decrypt. Hal Finney hfinney(a)shell.portal.com

2 1

Re: Crypto Idea; Multi-Part Sigs
by cme＠ellisun.sw.stratus.com 17 Dec '03

17 Dec '03

Yes, it's possible to have a variant of RSA in which multiple people are needed to sign anything. I don't know a way to use the same key for privacy and allow any of the people to decrypt, using RSA, since for RSA signatures and decryption are the same operation. - Carl

1 0

Re: Need Suggestions for Random Numbers
by Mike Johnson 17 Dec '03

17 Dec '03

>I have seen here and elsewhere descriptions of hardware random >number generators (Geiger counters measuring random nuclear >decay, microphones picking up background hiss etc.), but I need >something that can be implemented entirely in software. There is no such thing as real random numbers implemented purely in software. The best you can do in pure software is a cryptographically strong pseudorandom number sequence, started at a random point -- like continually feeding the output of DES back to its input. >Also, can anyone recommend a statistical test for randomness, or >for detecting repeating patterns in a "random" file? Try compressing the file with PKZIP & see if it gets smaller. If it does, it flunks. If it doesn't, it may still have some patterns to it. >What would be a good source of random meaningless sound? (an >quiet room, ocean surf, repeats of Gilligan's Island, old >presidential speeches (pick your favorite president). :-) Not bad, but be sure to compress the output to remove the regular patterns of the surf, etc, then use the compressed output -- after stripping off any headers applied by the encryption program.

1 0

Re: Chaum on the wrong foot?
by peter honeyman 17 Dec '03

17 Dec '03

yes, i am replying to a message that is six weeks old. hal, chaum may be barking up the wrong tree, but that doesn't mean that his students are. i read a couple of digital cash papers last night and was struck by this statement in one of them: Techniques have been developed that ... allow the construction of off-line electronic cash systems that are secure for the bank, yet at the same time honest users of the system are guaranteed to remain completely anonymous. This holds in a very strong sense: the security of banks is not compromised even if all users and shops collaborate in such an attempt, and the privacy of honest users cannot be violated in any cryptanalytic way even under adversarial behavior of the bank in coalition with all the shops. Stefan Brands, CWI this is very encouraging: digital cash technology is very far advanced, and offers almost everything you might want. (i think the jury is still out on the question of k-spendability.) but then there is the bad news: the mathematics and the protocols underlying the technology are still too complex to be practical. but there is also good news: much of the current work intends to simplify the protocols and to lessen the computational requirements of digital cash systems. peter

3 2

Re: Need Suggestions for Random Numbers
by freeman＠MasPar.COM 17 Dec '03

17 Dec '03

> Also, can anyone recommend a statistical test for randomness, or > for detecting repeating patterns in a "random" file? Try using consecutive calls to your random-number generator to generate two-dimensional coordinate pairs, and plot them. That is, you do something like: for( i = 0; i < LOTS; ++i ) { x[i] = rand(); y[i] = rand(); } for( i = 0; i < LOTS; ++i ) { plot_point( x[i], y[i] ); } It's surprising how fast this will demolish many psuedorandom generators (and how good the eye is at pulling patterns out of plots). And as far as nominal sources of "white" noise, be careful to avoid contamination from 60-cycle power-line noise and its harmonics. Do a Fourier transform and look for peaks, for sure. I'm sure that the pros know lots of tricks like this. -- Jay "not a pro" Freeman

1 0

Re: Chaum on the good foot?
by peter honeyman 17 Dec '03

17 Dec '03

> This could refer to observer based protocols. I don't see anything in the > above paragraph to indicate that they have invented a digital coin. I don't > see how offline non-observer based cash could possibly work. (e.g. > I send a copy of my cash to someone in Europe and we "spend" them > simultaneously) well, actually, it's very neat how this works. here, i'll quote from n. ferguson's paper "single term off-line coins." The most difficult fraud to counter in electronic cash systems is the double-spending. A user can always spend the same coin in two different shops. This fraud cannot be detected at the time of spending as the payments are off-line. The solution that all electronic cash systems use is to detect the double-spending after the fact. At each payment the user is required to release some information in response to a challenge from the shop. One such release of information provides no clue to the user's identity, but two such releases are sufficient to identify the user uniquely. this is based on shamir's "how to share a secret" cacm v22n11 1979. in the stefan brands quote ("the privacy of honest users cannot be violated in any cryptanalytic way") the emphasis is on honest users. dishonest users are traceable. after reading these two papers, i really think off-line cash works -- it offers divisibility, multi-party security, privacy, and untraceability. the major impediments seem to be the complexity of the protocols and the large computational price to be paid. peter

1 0

Waa waa waa waa waah.
by Kent Hastings 17 Dec '03

17 Dec '03

Waa waa waa waa waah. I want to go to Krustyland! Anyway, if this escapes, be advised that hastings(a)courier8.aero.org is dead. Like you gave a rat's ankle in the first place. The Martians have shut down my X400 access. They probably couldn't take any more of this foolishness. As the most Homeric of philosophers would say: "Dhoh!" Looks like I'm forced to get Netcom now, but until then - "UNSUBSCRIBE." Thanks. I'll be back. Kent - <kent_hastings(a)qmail2.aero.org> for who knows how long.

1 0

Re: Waa waa waa waa waah.
by plmoses＠unix.cc.emory.edu 17 Dec '03

17 Dec '03

UNSUBSCRIBE ME from this list. I know this is the "wrong" place to send it, but I have just spent the past 2 days sorting out 700+ cypherpunks messages that piled up while i was out of email range. _ I HAD some sympathy for the ideals of this project when I signed up, but now I am finding all the bickering and phoney legalese to be too much. The extensive post from EFF was the last straw. For God's sake, what purpose could it serve? Why not just type in all House debates on Clipper. Better yet, get an optical character reader and scan them in. Believe me, I have no interest in being told "how" I may communicate by the government. Thanks for the info and best of luck. Goodbye. - Paul

1 0

Re: Chaum on the wrong foot?
by peter honeyman 17 Dec '03

17 Dec '03

> Can you post the references for these papers? sure. i got them from ftp.cwi.nl in directory /pub/CWIreports/AA/. CS-R9318.ps.Z is N. Ferguson "Single Term Off-Line Coins." it is 13 pp. CS-R9323.ps.Z is Stefan Brands "An Efficient Off-line Electronic Cash System Based On The Representation Problem." it is 77 pp. does anyone else have any digital cash papers on-line? peter

1 0

I'm outta here
by abajian＠esca.com 17 Dec '03

17 Dec '03

Ditto Paul's post. I thought this would be interesting. Instead, it's eating disk with pointless noise. How about using my cypherpunks mailings as a random number generator? No, too many repeating patterns. I'll hang out on the notice list just in case the sky falls. Yeesh.

1 0