December 2003 - cypherpunks-legacy

New aproach in pgp-randomizer!!!
by blaster＠kiae.su 17 Dec '03

17 Dec '03

Hello! Today I saw paraphysics randomizer in pgp: pgp -kg was run; it ask me about user id and passphrase; then it run generation (it wrote like this: ............ ++++); But, as we see, it did not ask about key typing!!! The most intresting pgp generate key pair and rendseed.bin-file. I thinck this is related to new topsecret paraphysics randomyser (today is 13.10.93).:) Some words about technical ditails: Hardwate - i486; Software - MS-DOS 3v30 (I boot from protected floppy and ran good antivitus utility before keypair generation). PGP 2v3a was run. I have expiriance in pgp (i maintain pgp-keys server). I keep keypair and randseed file and try to repiad this fantastic result, but paraphysic energy is go out :). Mr. Zimmermann, I hope, that this was really paraphysic (or my mistake:(), because the trust to crypt-program is very unstable thing.

2 1

Re: Spread-spectrum net (vulnerability of)
by George A. Gleason 17 Dec '03

17 Dec '03

RE your item, "a sort of virtual-space map, which would reveal nothing about actual phyical location of the sites or the person you are contacting." I'm not so sure... in cellular systems, cells must know where the handsets are located in order to send incoming calls. Your transmitter has a physical location which could presumably be tracked in the normal manner, and I would expect the overall routing information in a net to be susceptible to traffic analysis in any case. An individual who is using the system to communicate wouldn't be able to find the physical address of another user, but e.g. an intelligence agency which was looking at the entire network would. Even assuming spread-spectrum and various link encryption techniques on top of whatever end-user encryption is supplied; with enough traffic and enough time, it should be possible to do TA. Or have I missed something....? -gg

3 2

Spread Spectrum Nets (Way to do safely)
by Robert J Woodhead 17 Dec '03

17 Dec '03

Succinctly, use the purloined letter technique -- hide it in plain sight. There are RF bands set aside for unlicensed low-power operation; some new phones use spread-spectrum techniques in these bands. Build and sell wireless ethernet nodes that talk using these techniques. Customers will demand strong encryption to prevent their data leaking out and outsiders sneaking in, so you have a good reason for adding this to the product. Develop a robust set of protocols that automatically manage the net, which is logically dynamic (movement of nodes and episodes of interference are logically equivalent to dynamic modification of the topology of the net. You can consider each node to be on N ethernets, where N is the number of nodes it is currently able to talk to, each ethernet having only two members.) Now the kicker; the nodes can be programmed to only talk to other nodes known to them (ie: the office work-group, building, etc), or to freely accept and route messages from "alien" nodes. Given a population of "liberal" message passing nodes, one can then add a new layer of routing protocols that do regional networking, with dynamic re-routing as needed. Purchasers of the wireless nodes should be encouraged to enable the "pass-through" option, and the protocols should guarantee that assisting in the passing on of messages does not affect local net performance. If you do it this way, you'll succeed much faster because people will be paying you to do it. You'll have more money for R&D, and you'll have a lot more people bitching if someone tries to take your toys away. The protocol design is, as they say, left as an exercise to the reader. It isn't all that difficult.

1 0

Too Many Messages? Not!
by Arthur Chandler 17 Dec '03

17 Dec '03

As the culprit who started the "Native American Encryption" thread, I'd like to speak out in thanks and in favor of many answers to a question. It's true that lots of folks correctly identified Navajo as the source pf the language used. But lots of other details came in, one post at a time, that clarified the picture, and made it both more accurate and more interesting to folks interested in this fascinating chapter in the history of coding. The fact that Navajo was originally all-oral, but is now written; that the talkers used a compound of Navajo and on-the-fly slang; that real-language systems are immeasurably harder to crack than encrypted messages if you don't know they are real-life languages; etc. etc. -- I for one got a great deal out of the thread, including some references to follow up on. And all this has made me wonder if real-life languages, as opposed to algorthymic encryption schemes,.... Well, that's another thread.

1 0

DES
by Jamie Jamison 17 Dec '03

17 Dec '03

Two questions about DES. 1) If the current, 56 bit, DES system is so easy to break why don't people switch over to a DES system that uses a larger key space, say 128 bits? People obviously aren't, so what's the barrier to this? 2) How much longer would it take to break triple DES versus standard DES using one of the key-breaking machines described? As an aside I'll point out that I go by the Yakima Research Station once a month when I'm out with my National Guard unit, this is the radio dish that's on the cover of _The Puzzle Palace_. It's not a very large installation. Jamie Jamison niteowl(a)u.washington.edu

3 2

Notes from House Hearing on Cryptography Export Controls
by djw＠eff.org 17 Dec '03

17 Dec '03

October 12, 1993 House Foreign Affairs Committee Subcommittee on Economic Policy, Trade, and the Enviornment Hearing on mass market cryptography and export controls Rep. Sam Gejdenson (D-Conn.), Chair [A hopefully informative and probably biased account of the hearing by EFF] Committee Members present: Gejdenson, Cantwell (D-Wash.), Fingerhut (D-Ohio), Rohrbacher (R-Calif.) Manzullo (R-Ill.) Witnesses: PANEL 1 (Open) J. Hendren, Arkansas Systems (A data security firm that does a lot of international banking work) Ray Ozzie, IRIS Associates for Business Software Alliance (Lotus Notes developer) Stephen Walker, Trusted Information Systems for Software Publishers Association Philip Zimmermann, PGP developer Don Harbert, Digital Eqiupment Corp. PANEL 2 (Secret Session) NSA representative Opening Statement of Gejdenson: "This hearing is about the well intentioned attempts of the National Security Agency to try to control the uncontrollable.... The NSA itself acknowledges that if you have a long distance telephone line and a modem, you can send this software anywhere in the world. If you have a computer and a modem you can take this software off of the Internet anywhere in the world.... I do not question the value of the information sought by the National Security Agency. But once it is determined that the dispersion of this software cannot be controlled, then however much we might want to protect our ability to obtain information, it is beyond our means to do so. Just as in the case of telecommunications, the National Security Agency is attempting to put the genie back in the bottle. It won't happen; and a vibrant and productive sector of American indsutry may be sacrificed in the process." The main points raised by witnesses were these: 1. DES and other strong encryption which is barred by ITAR is in the public domain and available on the global market from foreign software manufacturers: -Ray Ozzie used his laptop and a modem to show how to get a DES implementation from ftp.germany.eu.net. The committee loved it and most of them seemed to understand what was going on on the screen, even though they had never heard of ftp. -Stephen Walker described the results of an SPA study which uncovered over 250 cryptography packages which offer DES-based or stronger algorithms. -Phil Zimmermann testified that he designed PGP from publicly available information. 2. Foreign DES implementations are just as good as US versions. Surprisingly enough, this is a contentious issue. Some members of the committee seemed to have been told by someone or another that foreign versions of DES may not be as strong as those that are made in the USA. If this were true, then export controls might still be justified despite the numerous foreign versions of DES on the market. In my view, this is a pretty desperate argument. -Steve Walker demonstrated that all DES works the same way by encrypting a passage from Mozart's Eine Kleine Nachtmusik with several different foreign DES packages, and then decrypting them. Surprise! They all sounded just the same. 3. Lots of money is being lost by US software/hardware vendors: -Don Harbert from DEC told of loses of over $70 Million in just the last few months. -BSA estimates that export controls exclude access to a global market the is $6-9 Billion. 4. People want their privacy -Phil Zimmermann told the committee about his experience with PGP users and how badly people need and want to protect their privacy in electronic environments Committee Responses: Overall, the committee was quite sympathetic to the witnesses. Chairman Gejdenson seemed very supportive of changing export controls. Rep. Dana Rohrbacher, no flaming liberal, said, "the cold war is over. I sympathize with everything that has been said here." ................................................................... Daniel J. Weitzner, Senior Staff Counsel <djw(a)eff.org> Electronic Frontier Foundation 1001 G St, NW Suite 950 East Washington, DC 20001 202-347-5400 (v) 202-393-5509 (f)

2 1

bad news from Georgia (the Republic of)
by Stanton McCandlish 17 Dec '03

17 Dec '03

This might be interesting, though international, to many of you. Seems a certain Internet node is perceived as vital to the Georgians in their struggles. Forwarded message:

2 1

Re: Native American Encryption?!
by koontzd＠lrcs.loral.com 17 Dec '03

17 Dec '03

Navajo (Navaho) Indians. Referred to as Code Talkers. I believe you'll find something in David Kahns "The Code Breakers". They were used in tactical situations. To break an otherwise unknown language would require context, such as good traffic flow analysis and otherwise good intelligence. I beleive there was a program on A&E (TV) on the Navajo code talkers in the Pacific (WWII). Navajo code talkers used lots of colloquilisms and all new each other more or less. You could have ended up attacking language code in sets between two code talkers.

1 0

from a source who said "NOT FOR ATTRIBUTION" re: National Performance Review (fwd)
by Stanton McCandlish 17 Dec '03

17 Dec '03

A "National Privacy Protection Board" ?! Forwarded message: > Posted-Date: Wed, 13 Oct 1993 08:35:15 -0400 > Message-Id: <9310131235.AA08993(a)linc.cis.upenn.edu> > X-Sender: farber(a)linc.cis.upenn.edu > Mime-Version: 1.0 > Content-Type: text/plain; charset="us-ascii" > Date: Wed, 13 Oct 1993 08:35:15 -0400 > From: farber(a)central.cis.upenn.edu (David Farber) > Subject: from a source who said "NOT FOR ATTRIBUTION" re: National Performance Review > Precedence: list > > > "The Vice President's recent report "From Red Tape to Results: Creating a > Government that Works Better and Costs Less (National Performance Review) > is peppered with recommendations about how to use information technology to > "reinvent government." They would put in place an administrative > infrastructure that empowers agencies and tracks progress, and undoing much > of the entrenched bureaucracy that evolved and got ossified in the single > vendor-mainframe era. > > The meat behind the recommendations, teased together with much help from > industry and information technology experts, is in a yet unreleased > technical report, and it appears that it may never be vetted in public. The > reason seems to be fears within the VP's public relations hirearchy, that > the background report may generate controversy. This one should- among the > ossified. Early and inaccurate drafts have begun circulating, raising risks > that many of the good ideas will be stillborn as bureaucratic barriers that > threaten the status quo are errected. > > The recommendations include no-brainers (placing all agencies on the > Internet and spreading e-mail through all agencies), huge $ savers > (generating agency agreements for integrating tactical law enforcemnt > network technology) and actual innovations (replacing the infamous "GSA > Schedule" (which slows federal procurement of IT and raises costs) with a > real time electronic marketplace. Some short acronym agencies appear > sensitive to a proposal for a National Privacy Protection Board. > > Curious? Take a look at the report on the UNC Sunsite Gopher. Want to know > more contact the VP and tell him!" > > > -- -=> mech(a)eff.org <=- Stanton McCandlish Electronic Frontier Foundation Online Activist & SysOp NitV-DC BBS 202-232-2715, Fido 1:109/? IndraNet 369:111/1, 14.4V32b 16.8ZyX

1 0

Re: Native American Encryption?!
by an41418＠anon.penet.fi 17 Dec '03

17 Dec '03

If nothing else, adding encryption on top of the Navajo language makes known-plaintext much more difficult. Wonderer ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0