December 2003 - cypherpunks-legacy

Re: Sharing a secret
by koontzd＠lrcs.loral.com 17 Dec '03

17 Dec '03

>I know that there is a way to have a key, K, divided into >n parts such that any i of them are needed to recunstruct >K. The property holds that no i-1 parts are sufficient, >and ANY i parts will do. How does this work exactly? Is >it really the case that no i-1 parts give information? >Is there a way to cheat? With a key K of size j (goddamn fortran anyway), i parties can share the secret with a threshold of i (requiring all i parties key part) by generating i parts P such that K = Pi XOR Pi-1 XOR ... P1. All the parts P are the same size as K, which keeps the effort of guessing a missing part equal to j, or the size of the key k itself. Such a scheme is not ideal for keys K that have a deterministic characteristic.

1 0

Clipper chip stuff (fwd)
by Stanton McCandlish 17 Dec '03

17 Dec '03

Forwarded message: > Could you forward this to cypherpunks for me? Walter is a technoid and > happened to be one of the plaintiffs in Steve Jackson Games (e-mail user on > Illuminati). I'm hoping one of the 'punks might be able to comment to him > on his theory -- it sounds interesting to me, but I'm not technical enough > to know if its got any merit. Thanks. > > >Date: Thu, 21 Oct 93 18:05 EDT > >From: Walter Milliken <milliken(a)BBN.COM> > >Subject: Clipper chip stuff > >To: ssteele(a)eff.org > > > >Hi Shari -- it's been a while.... > > > >I know you're probably not the right person to talk to about Clipper > >chip stuff, but I figured you could forward this and tell me who is. > > > >Basically, I think I see NSA's backdoor in the whole scheme. Probably > >other people have noticed this too, but in case they haven't (and I > >haven't seen any comment on these lines on comp.org.eff.talk), I figured > >I'd point it out. > > > >The trick isn't necessarily in the algorithm (which I don't know, of > >course). I think it's in the key generation process. I read Dorothy > >Denning's description as posted to comp.org.eff.talk the other day, and > >decided it sounded fishy. Why are the secret per-chip keys generated > >from the chip serial number (which is observable by anyone with the > >law-enforcement key)? To escrow keys, all you need is to 1) associate a chip > >serial number with a secret key and 2) split the secret key into two, > >unusuable parts for the escrow agents. I can't see any reason why the > >secret key isn't just a random number (or rather the XOR of two random > >numbers, one for each escrow agent). > > > >Instead, we've got this complex algorithm for converting the chip serial > >number into the chip secret key. Thus, if you know the chip serial > >number, the key generating algorithm, and the initialization states for > >the key generator (provided by the two escrow agents) *you can compute > >the chip secret key*! (Or so it appears on a very superficial reading.) > > > >I suspect you could dispense with knowing the initialization states, if > >you were NSA and could obtain any chip from the same batch -- you open > >the chip up (I'm sure *they* know how to do that), extract its secret > >key, and reverse-engineer the initialization data. (This last step is > >non-trivial, but I'd be surprised if NSA couldn't do it -- it's a > >variant of known-plaintext attack.) It's also possible that NSA may > >*supply* the initialization states, or an algorithm for generating them, > >or at least advice on how to pick them. After all, it's their game, > >they get to make the rules.... > > > >In any case, I can see no way that using the *observable* chip serial > >number to help generate the chip secret key can in *any* way improve the > >security of the system. You'd be much better off just sticking any old > >random number into the chip as a secret key, and just noting it down > >with the associated chip serial number in the escrow files. Personally, > >I think I'd use a non-algorithmic mechanism for generating random keys > >-- perhaps a truly random number source, such as atomic decay processes. > >There's only one of these things -- it can afford to get fancy. > > > > > >Disclaimer: I'm not a cryptography expert, so it's possible I'm missing > >something here. Possibly factoring in the chip serial number makes it > >harder to crack secret keys if you somehow manage to obtain a few chips > >from the same batch and open them. But it certainly seems suspicious to > >me.... > > > >---Walter -- -=> mech(a)eff.org <=- Stanton McCandlish Electronic Frontier Foundation Online Activist & SysOp "A nation that is afraid to let its people judge the truth and falsehood of ideas in an open market is a nation that is afraid of its people." -JFK NitV-DC BBS 202-232-2715, Fido 1:109/? IndraNet 369:111/1, 14.4V32b 16.8ZyX

1 0

700 club
by Mike Johnson 17 Dec '03

17 Dec '03

> The right to encryption and the "right" to abortion don't have the same > basis - encryption kills no one. Amen! But encryption IS regulated as a munition. In military applications, weak crypto could (and has) cost some people their lives. Strong crypto reduces the power of governments or other entities to oppress people of differing views. Strong crypto is a powerful influence to resist oppression of one group by another, just as Freedom of the Press, Freedom of Speech, and the Right to Bear Arms do. I don't see strong crypto as a threat to Christians. Strong crypto is a major threat to totalitarian governments, spies, and criminals. Strong crypto is a minor inconvenience for certain law enforcement agencies in some circumstances. Three out of four isn't ideal, but life just isn't that simple. By the way, if you think 700 Club support for strong crypto without key escrow is strange -- call my BBS for some amusement. You will find Bible search software, church management tools, and two file areas devoted to cryptography. Not everyone on this list is an athiest, anarchist, or whatever. Mike Johnson mpj(a)csn.org BBS 303-938-9654

1 0

Re: Subliminal Channels
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

Steganography, the art of hiding a secret message inside of an openly readable one, can be thought of as a subliminal channel. In the prisoner example, the prisoners could have pre-arranged that, say, every 10th character in the typed messages they exchange would be used to spell out a secret message. Or perhaps word or sentence lengths or spacings could send a message. In general, in any system where there is ambiguity, more than one way of expressing a valid message, there is a subliminal channel. Since DSS signatures are apparently not unique for a given message (unlike, say, RSA signatures as specified in the PKCS standards), they have such a channel. Hal

1 0

Re: Canon copiers
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

The thing that makes me skeptical about this copier story is this: the money could have any orientation and position on the page. It would take a large amount of computing power to look at an image and deteri\\ determine whether there is a certain bitmap anywhere on it. Look at how poorly optical-character-reader technology does now, and that is when it knows how the letters are oriented. Adding random orientations would make the problem far worse. And, will it look at the whole dollar bill, or just pieces of it? It has to respond to all the different denominations, too. Plus, if it makes a mistake and permanently locks up the customer's machine, the manufacturer is going to have a big problem. In short, I'm pretty sure that there is a lot of disinformation going around designed to scare people away from trying it. However, there is another possibility, which is to look at hte color of the bills. This does not take so much processing power, although bills may vary somewhat in color. Years ago, I'd read that these machines would not accurately reproduce the color of money. Perhaps today they will turn that color to black. Hal

3 2

Sharing a secret
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

I will give a simple example of Shamir secret sharing. Suppose you have some data D which you want to split up into n pieces such that any 2 of them are sufficient to reconstruct D. Shamir solves the problem for any k of them being sufficient, but the case k=2 is especially simple. Pick a random number m which will be the slope of a line. Take the equation y = mx + D, and substitute x = 1, x = 2, ... x = n. Pass out the y's for each value of x as the secret shares. For example, if D=12, pick random m = 4, and pass out (1,16), (2,20), (3,24), (4,28), and so on. Now, suppose an enemy gets hold of one of these - say (2,20). What does this tell him about the value of D? Nothing! D could be anything, depending on the value of m. But suppose we have two of these values - say (1,16) and (2,20). From these it is easy to calculate m=4, and from that it is easy to see that D=12. Two points determine a line. In the actual Shamir scheme, integers mod a prime p are used, where p>D. The math is basically the same. For k=3, a parabola is used instead of a line, so that 3 points are needed; for k=4, a third-degree polynomial is used, and for general k, a (k-1)-degree polynomial is used. In each case, knowing k-1 points tells you nothing, because there will be a (k-1)-degree polynomial that would pass through any possible value of D. Hal

2 1

cellular
by abootch＠sfsuvax1.sfsu.edu 17 Dec '03

17 Dec '03

Hey Cypherites, While taking a *study* break last night I caught the last couple of minutes of a report on the cellular phone hacking on Prime Time Live - KABC(?) west coast. Someone, presumably, from one of the cellular phone co's came up with a security scheme that would stop people from hacking into other people's accounts - using digital signatures! When asked how long this *technology*'s been around he answered its been out for awhile, only it has been implemented yet because no one was willing to pay for it. I wonder.... Also, they mentioned something about 400 people being caught by the S.S. so far this year(?) on cellular hacking charges. Is this correct? I didn't catch the whole show and am not sure if I ingested what was being said properly (I was too tired to chew) so if anyone caught the whole piece or knows more please post. Thanks.

2 1

Message to Extropians...others ignore!
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

(Sorry to send a message this way, but you'll see why.) The Extropians list has been down for several days as a result of the security incident involving Panix, the systems off of which the Extropians list is run. (The security incident is being discussed in several of the *.security groups.) Perry Metzger mentioned this a few days ago here, but I am still getting several messages a day asking what happened to the List, hence this message to you all. By the way, a conclusion I draw from this is that an alternative way to signal list members should exist, even if it's just a very long list to send mail to from an unaffected system. Sort of an "Emergency Broadcast System." Harry Shapiro says Panix is back up and the Extropians list should be restored sometime today, probably. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. Note: I put time and money into writing this posting. I hope you enjoy it.

2 1

Re: Paper Shredders
by norm＠netcom.com 17 Dec '03

17 Dec '03

The garbage disposal in a kitchen sink is very effective.

1 0

Clipper Chip report on 700 Club today (Wednesday)
by James K. Huggins 17 Dec '03

17 Dec '03

Phil Karn (karn(a)qualcomm.com) writes: > If I hadn't seen the show with my own eyes, I never would have > believed it. The Religious Right, so ready to mind everyone else's > personal business and to reshape the government in its own image, > opposes something that would make it easier for the government to > control the private lives of its citizens. Let's be honest, though ... the "Non-Religious Left" is interested in the same thing (though in different ways). Just about everybody in politics wants to change something or other. > Of course, the Religious Right is at odds with the current government, > what with talk of using the federal racketeering laws against > anti-abortion demonstrators. So perhaps they can be forgiven for > their current anti-government stance. It ain't just governments that oppose the religious right. There are a lot of moves on college campuses lately to kick conservative religious groups off campus because they aren't PC. I can easily see a time when having cryptography might be very useful to me if the administration at my university starts grepping my e-mail to see if my group meets the latest PC test. Sure, the US government tends to like Christian folks right now. But there are lots of governments around that don't -- ask people who live in Muslim countries where being a Christian is illegal, punishable by death as heresy. Any applications for cryptography there? > And there's supreme irony in the right to encryption and the right to > abortion both being founded in the same basic concept: personal > privacy. It all depends on whose ox is being gored, I guess. The problem ain't with privacy ... it's with what do you with privacy. Should we all have microphones installed in our homes because the privacy of my house out in the country means that I can beat my wife and no-one will hear her scream? The problem isn't that my house is private ... the problem is that I'm a jerk. So make being a jerk illegal and forget the microphones. Disclaimer: I don't have a house or a wife, and 4 out of 5 officemates don't think I'm a jerk ... Jim Huggins (huggins(a)eecs.umich.edu)

1 0