December 2003 - cypherpunks-legacy

ANON: revealing penet id
by Karl Lui Barrus 17 Dec '03

17 Dec '03

Hm... this topic seems to come up every few months - just today I was reading the newest Risks digest and an32153 (or something like that) was announcing the "risk" of using penet. I mailed off a submission describing how to avoid this. I think people don't know about this because it isn't published anywhere. Or is it? Maybe somebody could help Julf out and offer to write a new help file that specifically mentions the an/na trick. Last time I looked at the penet help file, this wasn't mentioned. It only takes a bit of work to avoid blowing your id - you just can't hit 'r' and reply to the addressee; instead you must type in the address manually (and be sure to type na#### instead of an####). Last week I responded to some email from a penet user. I was careful to respond to na####, or penet would have allocated me an id for klbarrus(a)owlnet.rice.edu (since I don't have one for this account) and thus someone would have been able to correlate my penet id and this account. As a matter of fact, I think that I revealed the penet id for an old account of mine (elee9sf(a)menudo.uh.edu) this exact way, although this was before the an/na functionality. -- Karl L. Barrus: klbarrus(a)owlnet.rice.edu keyID: 5AD633 hash: D1 59 9D 48 72 E9 19 D5 3D F3 93 7E 81 B5 CC 32 "One man's mnemonic is another man's cryptography" - my compilers prof discussing file naming in public directories

1 0

Re: Subliminal Channels (jsteg)
by plaz＠netcom.com 17 Dec '03

17 Dec '03

replying to: Karl Lui Barrus <klbarrus(a)owlnet.rice.edu> >Someone did write a program which embeds information in a JPEG, but I >don't have any other info (like where to get it, who wrote it, etc. >:-) I saw jsteg on soda.berkeley.edu from the cypherpunks area (/pub/cypherpunks/applications/jsteg). I haven't actually tried it, mind you, but that's where I saw it. It's actually in the form of jpeg source and a diff file to turn it into jsteg. Forward, upward, outward, onward, and every which way but loose! _______________________________________________________________________ Geoff Dale -- insert standard disclaimers here -- plaz(a)netcom.com "We are the shock troops of reality." - Voice of the Friends (Wild Palms)

1 0

Re: crypto technique
by hughes＠ah.com 17 Dec '03

17 Dec '03

I've looked at Matthew Ghio's encryption technique and have some comments. First let me summarize the system. private key: a sequence of polynomial functions f_1, f_2 ... f_n of the form a_i x (x+1)/2 + b_i, where a_i is odd. public key: the composition of these functions f(x) = f_1 ( f_2 ( ... f_n(x))) and a modulus P = 2^k plaintext: a value 't' ciphertext: the value u = f(t) decryption: finding t such that f(t)=u, by using of the f_i Matthew has repeatedly claimed that it can't be broken. Now one of the first rules of cipher design is don't claim that unless you have some good reason to believe that it can't be broken. Merely saying "I can't figure out how" is NOT sufficient. No flame intended, Matthew, this is probably the single most common failing of people interested in crypto. In particular, Matthew has made the claim that one must find the coefficients of the f_i in order to decrypt and claims that finding such coefficients is difficult. He calls this operation factoring; properly speaking this is a 'decomposition', since the operation used to make f(x) is not multiplication by composition (called iteration when all the functions are the same). As I suspected and Karl has demonstrated, these decompositions are not unique. Since the plaintext, ciphertext pair does not depend on the representation of the function, only upon the coefficients of the polynomial function which is the public key, any such decomposition will suffice for decryption. In other words, you don't have to find how the function was created in order to decode. All you need is some way of inverting the polynomial function f(x). Note that I am using the phrase polynomial function here, and not just the word polynomial. There is a big difference. Polynomial functions are real functions with a domain and range. Polynomials are elements of a ring created by adjoining an indeterminate 'x' to some ring. Polynomials can be 'evaluated' as polynomial functions under some circumstances, but not always. A side note. The function Matthew picks, 1/2 x(x+1) is not, properly speaking, a function with coefficients in Z/2^k (integers mod 2^k). It is, however, a coefficient in Z/2^{k+1} There's one significant difference for the purposes of this proposed cipher: polynomials have arbitrarily large degree, but every polynomial function over a finite ring (such as integers mod N) is equal to some polynomial function of finite degree. One can see this easily be recalling Fermat's little theorem a^N == a (mod N). Thus x^N == x (mod N) for polynomial functions, which limits the degree. Matthew has proposed that arbitrarily many compositions will give a function which can't be inverted. This is certainly not the case if N = 2^k as he proposes. The following relation holds for all integers n > 0 and for all integers t: 2^{2^n - 1} | \Product_{i=0}^{2^n - 1} ( t + i ) What this means is that as the 2^k grows larger, the maximum degree of the polynomial functions grows as 'k', not as 2^k. In other words, the degree grows as the logarithm of the modulus, or linearly in the number of bits in the modulus, if you prefer. This is certainly not a good sign. Recommendation: don't use N=2^k. It's a general rule of cryptosystems that if you use 2^k moduli to speed your encryption, you will also speed the attack, and not just from increased speed, but from algebraic properties of these moduli. There have been some spectacular failures in this regard, notably a chip which was built to do modular exponention for a particular 2^k which was later found to be totally insecure. Another property which decreases the security of the scheme is that polynomials over Z/2^k don't have unique factorization. Therefore the polynomial functions don't have unique representations. For example (x+1)(x+3) = (x+5)(x+7) (mod 8) (x+2)(x+4) = x (x+6) (mod 8) x (x+1)(x+2)(x+3) = 0 (mod 8) (from the expression above) This makes it all the easier to invert the polynomial. The reason that you don't have unique factorization is that Z/2^k has zero divisors: 2 x 4 = 0 (mod 8), so two divides zero. The presence of zero divisors means that you don't get unique factorization. There is, however, a twist. If you don't even see the zero-divisors, you can pretend they aren't there. This is exactly what RSA does, since if you find a multiple of one of the factors of the modulus, you've broken the system. But if you use a modulus of the form pq, you're basically using RSA! RSA picks a particularly easy polynomial function to invert, namely f(x) = x^e. Other polynomials would work as well, and, in fact, appear in the patent application, albeit without examples. Now if you pick a prime modulus, you don't have a public key system anymore. This is the Hellman-Pohlig patent, which uses x^e (mod p) as its encryption. In this scheme 'p' is kept secret, since otherwise the exponentiation could be reversed. In short, I don't think Matthew's scheme can be made to work. There is an open question about how the base field increases with each composition because of the presence of the 1/2, but I don't think currently that this makes it work. For a specific reference, see the collection _Cryptology and Computational Number Theory_ which contains an essay by Kevin McCurley "Odds and Ends from Computational Number Theory." Section 3 of this essay discusses the breaking of some similar schemes by some non-obvious means. I quote: "Moreover, it holds a valuable lesson for those who tend to believe that a computational problem is difficult just because the only apparent solution is difficult." Eric

1 0

random dot stereo
by cme＠ellisun.sw.stratus.com 17 Dec '03

17 Dec '03

My friend's code is still around. I don't have permission to post it but if there's interest I'll ask. Each picture generated requires up to 2^17 random bits to seed the process. - Carl

1 0

Conon redux
by XXCLARK＠indst.indstate.edu 17 Dec '03

17 Dec '03

<trebor(a)fortune.co.jp> wrote: >Most likely by modulating the Least Significant Bit of the color Thank you. Never would have thunk it. Attempted an off-list reply, but can't find the damn gateway. ec

1 0

No Subject
by anonymous＠extropia.wimsey.com 17 Dec '03

17 Dec '03

> Maybe somebody could help Julf out and offer to write a new help file > that specifically mentions the an/na trick. Last time I looked at the > penet help file, this wasn't mentioned. Yes, and while he's at it, how about instructions for changing passwords and nicknames?

1 0

FYI - NSA going public (fwd)
by judic＠netcom.com 17 Dec '03

17 Dec '03

> >Date: Fri, 22 Oct 93 11:34:51 -0700 > >Subject: NSA call for proposals > > > >NSA is offering to support unclassified research in certain security- > >related areas. > >A description of the program is with Joyce. > >There is a deadline of Nov. 8 for a letter of interest > >(email to dld(a)tycho.ncsc.mil is apparently sufficient) > > > >They will send you an RFP in December if you reply by 11/8. > > ---jdu > > Thought you'd be interested. -- judi <judic(a)netcom.com>

1 0

Applied Steganography
by Mike Ingle 17 Dec '03

17 Dec '03

Here is an interesting application of steganography from Eric Isaacson's A86 assembler. This method would be low-bandwidth but hard to detect. 6. A86 takes advantage of situations in which more than one set of opcodes can be generated for the same instruction. (For example, MOV AX,BX can be generated using either an 89 or 8B opcode, by reversing fields in the following ModRM byte. Both forms are absolutely identical in functionality and execution speed.) A86 adopts an unusual mix of choices in such situations. This creates a code-generation "footprint" that occupies no space in your program file, but will enable me to tell, and to demonstrate in a court of law, if a non-trivial object file has been produced by A86. The specification for this "footprint" is sufficiently obscure and complicated that it would be impossible to duplicate by accident. I claim exclusive rights to the particular "footprint" I have chosen, and prohibit anyone from duplicating it. This has at least two specific implications: a. Any assembler that duplicates the "footprint" is mine. If it is not identified as mine and issued under these terms, then those who sell or distribute the assembler will be subject to prosecution. b. Any program marked with the "footprint" has been produced by my assembler. It is subject to condition 5 above.

1 0

mailing
by damiano＠wyvern.wyvern.com 17 Dec '03

17 Dec '03

Would you please add me to your mailing list...thanks -- Damiano <damiano(a)wyvern.wyvern.com>

1 0

Re: Bidzos (RSA) on "Primetime Live" (was: cellular)
by swc＠uc1.ucsu.edu 17 Dec '03

17 Dec '03

Voice registry is far easier than you imagine. I am in defense contracting and have seen demos here at Rome Laboratory. I will NEVER feel secure on the phone again. They can easily identify speakers, languages, keywords and gists of conversations. Now they are working on dialiects. ------------------------------------------------------------------------ Stuart W. Card, Consultant, Card & Associates -- Research & Development Box 153 RR 1 Newport Rd Utica NY 13502 315-735-1717 / FAX -8469 swc(a)uc1.ucsu.edu or cards(a)top.cis.syr.edu "Who is John Galt?"

1 0