December 2003 - cypherpunks-legacy

Re: Spread-spectrum net (vulnerability of)
by doug＠netcom.com 17 Dec '03

17 Dec '03

jkreznar(a)ininx.com (John E. Kreznar) said: >Not even the antenna should be visible. Remember, for spread spectrum radio >detectable only by the intended receivers (which use the correct spread- >spectrum code for coherent detection), the power density should be hardly >distinguishable from the ambient noise. This is true only for casual observers. If the FCC were after you, they could most definitely triangulate on unusual noise sources as well as they could a coherent signal. Power signals are a giveaway. >One way to arrange this is to put the antenna inside of a physically >secure perimeter, outside of which the power density is too low for >noncoherent detection. The perimeter can be optically opaque (e.g. a >building), as long as it leaks enough r.f. in the direction of the >receiver(s) for coherent detection. Preventing noncoherent detection >may often require _attenuation_ of an otherwise too-powerful signal, >and the building may serve part of this function. Good enough as far as it goes. But this implies a large drop in efficiency of the transmitted signal. That's not a stopper...*if* you've got power to spare. But that implies enough power for bad guys to triangulate your noise source...ouch. If they pin you down to within a building, you've lost. There are other approaches...phase-sweeping...phase-conjugation... Doug

1 0

Re: Breaking DES
by doug＠netcom.com 17 Dec '03

17 Dec '03

Thank you, Perry, for some good comments that were flame-free. I personally appreciate that, especially considering that your comments are both apropos and good food for thought. Doug >pmetzger(a)lehman.com said: >Karl Lui Barrus says: >> So maybe it's only of theoretical interest, sort of like differential >> cryptanalysis against the DES - which requires 10^47 chosen >> plaintexts. >> >> Why don't you mail Biham and Shamir that their method sucks. It's >> fairly infeasible as well. > >It *IS* infeasable, and they realize it. The breakthrough was >differential cryptanalysis itself, and the discovery that DES was >fairly resistant to it. The fact that they made ANY crack in it was >kind of neat, by the way. > >A huge number of chosen plaintexts is of course pretty much not >possible in practice, especially since you might not get any chosen >plaintexts at all!

1 0

Re: Breaking DES
by doug＠netcom.com 17 Dec '03

17 Dec '03

pmetzger(a)lehman.com said: >Each DES block is eight bytes. You can't use hashing -- the idea is >nonsense in context. Did you read the original post? Yes, I did. If hashing doesn't work, you'll have to say why not. It's a technique that works in most other situations. >First of all, its actually twice that because you really need 16 >bytes. As I said, we can tackle this if anyone cares to...it's unclear that this is an invitation, but assuming it is: hashing gives a first-pass screening good for every 1/256 calculations, given the assumptions I stated. For each collision more work is needed...but you haven't invited that analysis, nor addressed it yourself. >Second of all, the method is still impractical. I was merely >giving the easiest and most obvious attack on it. Impractical? Your response to Karl implied that it was *impossible*. If you wish to apologize to Karl, and say that it is merely "impractical", then I will agree with you and drop the subject. The expense required definitely indicates that it is "impractical." >I see no reason to continue this. I don't think your argument has >credibility. Clearly you are preparing to drop the argument because you sense that your tactic of flaming didn't work. I welcome the lessening of flames, so thank you for that. We could use less flames here. Doug

3 2

Re: Native American Encryption?!
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Median writes: > I may be in trouble for not knowing basic literature, but if so so be > it. Would a code you created yourself be secure? If you create your > own language from scratch, and the 'enemy' never gets something to act > as Rosetta Stone, is it still not secure? Or is the "aliens figure out > our language with lots of computers" cliche bogus? > I want to avoid casually dismissing Median's question without writing a mini-essay on code-breaking. Especially when so many fine and accessible (easy to read) books on code-breaking are available. (To find them, cruise your local library. I recall the Herbert S. Zim book as being a very fine introduction. Basic, and nonmathematical. But a good start. I read it in junior high school, many years ago. I was reminded of it recently, when I think Whit Diffie cited it as an influence on him as well--he obviously was more influenced by it than I was, as he went into crypto and I went into physics, a much less interesting field.) Basically, word-frequency analysis kill simple codes. Replace the word "the" with the string "globflq" and it's still going to be fairly obvious that "globflq" means "the." And so on. And, as Median mentioned, a few words may become known, in all the usual ways, and thus a Rosetta Stone has been found. The issue of communication with extraterrrestrials--some day perhaps--is an interesting one. I have no idea what work has been done on "breaking the code" when almost no clues exist. Some SF writers have explored this idea. But in summary, codes are a poor approach. The entropy of coded messages gives clues about the underlying plaintext and eventually the code falls. Usually fairly quickly. Ciphers (or cyphers) are superior, as the entropy of the ciphertext can be very high (roughly, "maximally random," though I don't want to get into what randomness means here). Kahn's "The Codebreakers" remains the definitive book. All Cypherpunks should at least read the paperback abridgment of the original massive book. "Kahn on Codes" is also pretty good. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. Note: I put time and money into writing this posting. I hope you enjoy it.

1 0

pornography & the ``cypherpunk cause''
by L. Detweiler 17 Dec '03

17 Dec '03

First of all, a clarification. I raised this issue with EFF because I'm utmostly concerned about upholding their sterling image, not because I am trying to start a flame war or engage in a sniper attack. If I had sent email to a few key people there I would have gotten nowhere (as my email actually proves). Here we have a *small personal forum* to discuss this in *unemotional* terms. I raised it in that spirit and am very disillusioned to see it all dragged through the gutter by many respondents. People are reacting like I've said, There Is No Cypherpunk Cause or Eric Hughes and T.C. May Are Traitors. So, I'm quite relieved that D. Frissell has posted some cool comments on case law and others who have focused on the issue of *operator knowledge* related to the law, which was one of my chief concerns from the beginning. * * * S. Steele <ssteele(a)eff.org> >My warning to sysops simply said that these files were listed >on a federal indictment, so the "lack of knowledge of the age of the >depicted people" defense remains The bulletin strongly suggests that the files constitute illegal child pornography. therefore, that would imply to a sensible operator that the age of the people pictured is not above that allowed for legal pornography. The point of *requiring knowledge of age*, in my view, seems to be a subset of a more important idea of *knowing the pictures violate the law*. Knowing the age of the participants is *one* way that one might know that the pictures violate the law. But one may come to that conclusion otherwise. For example, learning that they are the target of a federal investigation into child pornography would imply to a high degree of probability they are `illegal'. Of course, I don't claim to be a lawyer, and this is just one interpretation. perhaps it is mistaken. feel free to correct and insult me at the same time (what fun is it without both?). * * * I would like to say the following. My analogy to the CERT warning that appeared here seems to have completely escaped many, or perhaps everyone is intentionally evading it. The metaphor is extremely compelling. Both are sent to operators in order to bring something to their attention they `might' need to fix by an outside party generally interested in the operators own best interests. While I'm not sure that what CERT did was apropos, that warning was so *delicately worded*. In contrast the EFF announcement SHOUTS IN YOUR EAR. the CERT announcement was extremely diplomatic. the EFF announcement was SCREECHING. Do `we' have *any* consistency, sophistication, or coherence as a group? Recent messages have DISMAYED me. is `our' philosophy nothing but Beavis&Butthead style ``Gubberment and the Fedz and Pigs are THINGS THAT SUCK and EFF is a THING THATS COOL.'' Or do `we' have no philosophy at all? Are `we' just blind, crosseyed, and elitist `codeheads' that char newbies for cruel sport? Is it better to just ignore the `politics of cryptography' which coincidentally involves things like what has been called the `Tim May .sig Agenda' because some people might have strong opinions? If `we' don't have our own house in order, `we' are nothing but LOUD HYPOCRITES. If you don't clean your dirty laundry, IT STINKS. Excuse me, but I think the press adores the Cypherpunk cause, and `we' got press exposure such as the NYT and Wired article, because there appears to be LEADERS and a DEFINITE POLITICAL AGENDA. It appears, reading from those, that perhaps we even view the whole matter of free cryptography use as a MORAL ISSUE, which of course would seem to imply we possess some MORALITY to so claim. Oh yes, what was that hand-wringing a few months ago on the list about the ``MOVEMENT STALLING''? I wonder why! who posted that, anyway? I forget. p.s. I dare someone to post that old CERT announcement sent to E.H. that was posted here and caused such a noxious stink here. Look at how gentle it really is. In fact, I would recommend that future announcements of this sort look to it as a model. It clearly has been finetuned past many revisions. As much as I hate to admit it, CERT has a lot of expertise in dealing with this kind of thing. If anyone wants to emulate them, don't reinvent the wheel. p.p.s. go ahead, flame me into oblivion. ah, anonymously is even better! from people we've never *heard* of before on the list! yes, let everone up to the top tell me what a jerk I am for caring. please be as *emotional* as possible. defend the silly announcement or the Cypherpunk Status Quo as if I had accused *you* of being a child pornographer or traitor. Even better, banish me from the list for my thoughtcrimes! Yes, cyberspatial hemlock is what I need right now.

4 3

Re: Breaking DES
by wmo＠rebma.rebma.mn.org 17 Dec '03

17 Dec '03

Whenever Perry Metzger defends an opinion of his well, somebody whines. Whenever Perry Metzger disagrees with someone's arguments, someone else crys "unfair! He's using his WITS on me!" Whenever Perry Metzger has to stop and demonstrate something as simple as arithmetic to end an argument, someone cries "foul! sarcasm! Hey, he's not playing nice!" Y'all need to develop slightly thicker skins. Perry's efforts could serve to raise the thought level of other posters to this list, if they'd stop reacting to each prod with an irritated swipe back at the prodder. I like the strife on this list. Happy people getting along famously are dull. (Someone could consider adding to the cypherpunk philosophy: Cypherpunks write code, and cypherpunks are irritable.) -Bill

1 0

MEETING?: Albuquerque cypherpunks
by Kragen J Sittler 17 Dec '03

17 Dec '03

Sorry to waste yet more list bandwidth... but I have seen many meeting announcements posted on cypherpunks. I would love to attend a cypherpunks meeting, but unfortunately, I have seen none within a thousand miles. So, Albuquerque cypherpunks, such as Mike Diehl, the Mystic Homeboy, and any others whom I don't know, please email me at this address. I don't know if there are enough of us to have an actual meeting, but it would be nice to get together and talk even if not. Kragen p.s. I am subscribed at to1sittler(a)apsicc.aps.edu. Please do NOT email me there. Use only xentrac(a)phobos.unm.edu. (Kragen Sittler)

1 0

New aproach in pgp-randomizer!!!
by blaster＠kiae.su 17 Dec '03

17 Dec '03

Hello! Today I saw paraphysics randomizer in pgp: pgp -kg was run; it ask me about user id and passphrase; then it run generation (it wrote like this: ............ ++++); But, as we see, it did not ask about key typing!!! The most intresting pgp generate key pair and rendseed.bin-file. I thinck this is related to new topsecret paraphysics randomyser (today is 13.10.93).:) Some words about technical ditails: Hardwate - i486; Software - MS-DOS 3v30 (I boot from protected floppy and ran good antivitus utility before keypair generation). PGP 2v3a was run. I have expiriance in pgp (i maintain pgp-keys server). I keep keypair and randseed file and try to repiad this fantastic result, but paraphysic energy is go out :). Mr. Zimmermann, I hope, that this was really paraphysic (or my mistake:(), because the trust to crypt-program is very unstable thing.

2 1

Re: Spread-spectrum net (vulnerability of)
by George A. Gleason 17 Dec '03

17 Dec '03

RE your item, "a sort of virtual-space map, which would reveal nothing about actual phyical location of the sites or the person you are contacting." I'm not so sure... in cellular systems, cells must know where the handsets are located in order to send incoming calls. Your transmitter has a physical location which could presumably be tracked in the normal manner, and I would expect the overall routing information in a net to be susceptible to traffic analysis in any case. An individual who is using the system to communicate wouldn't be able to find the physical address of another user, but e.g. an intelligence agency which was looking at the entire network would. Even assuming spread-spectrum and various link encryption techniques on top of whatever end-user encryption is supplied; with enough traffic and enough time, it should be possible to do TA. Or have I missed something....? -gg

3 2

Spread Spectrum Nets (Way to do safely)
by Robert J Woodhead 17 Dec '03

17 Dec '03

Succinctly, use the purloined letter technique -- hide it in plain sight. There are RF bands set aside for unlicensed low-power operation; some new phones use spread-spectrum techniques in these bands. Build and sell wireless ethernet nodes that talk using these techniques. Customers will demand strong encryption to prevent their data leaking out and outsiders sneaking in, so you have a good reason for adding this to the product. Develop a robust set of protocols that automatically manage the net, which is logically dynamic (movement of nodes and episodes of interference are logically equivalent to dynamic modification of the topology of the net. You can consider each node to be on N ethernets, where N is the number of nodes it is currently able to talk to, each ethernet having only two members.) Now the kicker; the nodes can be programmed to only talk to other nodes known to them (ie: the office work-group, building, etc), or to freely accept and route messages from "alien" nodes. Given a population of "liberal" message passing nodes, one can then add a new layer of routing protocols that do regional networking, with dynamic re-routing as needed. Purchasers of the wireless nodes should be encouraged to enable the "pass-through" option, and the protocols should guarantee that assisting in the passing on of messages does not affect local net performance. If you do it this way, you'll succeed much faster because people will be paying you to do it. You'll have more money for R&D, and you'll have a lot more people bitching if someone tries to take your toys away. The protocol design is, as they say, left as an exercise to the reader. It isn't all that difficult.

1 0