December 2003 - cypherpunks-legacy

Re: Detweiler
by fnerd＠smds.com 17 Dec '03

17 Dec '03

> > Who is Detweiler? > Reuben > Sounds like a good bumper sticker, T-shirt or grafito-- along the lines of "Who is John Galt?" -fnerd don't quote me - - - - - - - - - - - - - - - Gradually, I become aware of a presence. Between me and sustenance stands a woman in a suit. --Michael Swaine -----BEGIN PGP SIGNATURE----- Version: 2.3a aKxB8nktcBAeQHabQP/d7yhWgpGZBIoIqII8cY9nG55HYHgvt3niQCVAgUBLMs3K ui6XaCZmKH68fOWYYySKAzPkXyfYKnOlzsIjp2tPEot1Q5A3/n54PBKrUDN9tHVz 3Ch466q9EKUuDulTU6OLsilzmRvQJn0EJhzd4pht6hSnC1R3seYNhUYhoJViCcCG sRjLQs4iVVM= =9wqs -----END PGP SIGNATURE-----

1 0

Paranoia
by koontzd＠lrcs.loral.com 17 Dec '03

17 Dec '03

I heard last night the the 3rd Battalion of the 12th Special Forces is at Moffett, and that they wanted to modify a building to allow repelling practice. I personally can't think of any reason for an elite fighting force to be stationed in an area of urban sprawl. Has anyone noticed any other elite forces being located in high population areas?

4 3

stop mailing to remail@infinity, please
by Eli Brandt 17 Dec '03

17 Dec '03

Somebody has been repeatedly (probably by a script) trying to remail through me to "remail(a)infinity.hip.berkeley.edu", which bounces back to me (unknown user). If it's somebody on this list, could you stop? Otherwise I'll have to have something grep for it so I can source- block the sender, and I don't really want to get into looking at incoming traffic. Eli ebrandt(a)hmc.edu

1 0

Weak IDEA keys...
by jpp＠markv.com 17 Dec '03

17 Dec '03

Well, I re-read the article, and here is the real dope. In Crypto '93 Joan Daemen, Rene' Govaerts, and Joos Vandewalle write: Abstract. Large classes of weak keys have been found for the block cipher algorithm IDEA, previously known as IPES [2]. IDEA has a 128-bit key and encrypts blocks of 64 bits. For a class of 2^23 keys IDEA exhibits a linear factor. For certain class of 2^35 keys the cipher has a global characteristic with probability 1. For another class of 2^51 keys only two encryptions and solving a set of 16 nonlinear boolean equations with 12 variables is sufficient to test if the used key belongs to this class. If it does, its particular value can be calculated efficiently. It is shown that the problem of weak keys can be eliminated by slightly modifying the key schedual of IDEA. [Typo's are probably mine :)] So, it isn't as bad as I thought. Chances are about 2^51/2^128 == 1/2^77 that you will get a bad key if you choose keys at random with even distribution from the IDEA key space. PGP tries to do exactly this. Once again, though, let me ask: has any one done anything about implementing the _very_simple_ patch the authors describe? PGP 2.5, or 2.6 anyone? I am not _really_ paranoid, but I would hate it if a critical message about the March 15th assassination plot were to fall into the wrong hands because of a bad choice of IDEA keys. A related technical question: are there other easy to compute 2^n x 2^n -> 2^n 'invertable' functions than the three used in IDEA? (namely (1) xor, (2) sum mod 2^n and (3) product mod (2^n)+1 with 0 taken to represent 2^n.) j'

1 0

Re: stop mailing to remail@infinity, please
by nobody＠jarthur.cs.hmc.edu 17 Dec '03

17 Dec '03

Eli Brandt <ebrandt(a)jarthur.cs.hmc.edu> wrote: > Otherwise I'll have to have something grep for it so I can > source-block the sender, and I don't really want to get into > looking at incoming traffic. Yeah, aside from the privacy problems here, there are other reasons for not looking at mail going through your remailer. I run a remailer, and one night a few weeks ago, we had a power failure here during the night, so the system got hosed. When I was setting it back up in the morning, I saw the incoming mail which hadn't gone into the filter. Well, there were some messages in there which ... well, let me just say that someone was using my remailer for a purpose which I would have rather not known about. Sometimes ignorance is bliss.

1 0

PROGRAMMING: Assessment wanted.
by schirado＠lab.cc.wmich.edu 17 Dec '03

17 Dec '03

I'm not a programmer, so this is all over my head. I'm just throwing this out as a public service. I will forward mail to the original author. *** If a subscriber has the time and interest, I can supply them with sources to build a new public key cryptography system based on unpatented and UNPATENTABLE (because they are already published) cryptographic systems which have an entire level of better security than that RSA rubbish. So far, it appears that keys in the neighborhood of 100-200 bits are equivalent to the "600" bits for RSA and the "military grade" claims of 1024 bits (PGP) should be easily doable in around 300-400 bits. Requirements: You need to either have a good grasp on finite mathematics (fields, rings, and such..just a basic understanding is all that is necessary) or willing to spend the time to learn it (about a week if you are already math-inclined). You need programming skill too (of course). I would also recommend that you use a different compression system from that LZ-based stuff that half the world is using in favor of higher order Markov tree things (I will supply complete references for this too). I am doing this because I have the necessary information but lack the time to develop this project further. [...] Okay, for a good overview paper of doing it in hardware (the software solution is also possible..just that you can't do it quite the same..online that is), see _An Implementation of Elliptic Curve Cryptosystems Over F-2-155_ , IEEE Journal on Selected Areas in Communications, Vol. 11, #5, June 1993 (page 804). Essentially, nonsupersingular elliptic curves over the finite group of characteristic 2 become reducible to the discrete logarithm problem. Watch when you are looking for papers and doing the research for stuff by Neal Koblitz..he really knows his stuff and wrote a very good introductory book to finite arithmetic and cryptology, although the elliptic curve system in the book was written before the hole in the supersingular case was known. Elliptic curve cryptosystems appear to be the strongest known public key cryptosystem on a per-bit basis in existence. The algorithm is still horrendously slow (just like RSA-based stuff) so don't expect to be doing the encryption/decryption in real time unless you're building it in hardware. The paper mentioned above has all the references you'll need. Use a good solid block cypher for actual encryption and just encrypt a seed using the public key stuff. Do us all a favor and publish it in library as well as full-blown software package form and allow for plug-in encryption modules as well as key management systems so the software doesn't have to be done all over again each time. Same with any compression software you put in it. As far as compression (lossless) goes, you'll have to search for the papers on that because my copy appears to have been borrowed and not returned. Look for "Prediction by Partial Matching" or "PPM". This is a multiple-order Markov solution which does better than the LZ-based things.

1 0

Re: Gee...
by snyderra＠dunx1.ocs.drexel.edu 17 Dec '03

17 Dec '03

At 12:21 PM 4/27/94 -0700, Sandy Sandfort wrote: >Wrong on both counts. Getting it out legally would be nice--it's a great >*fallback* position--but that's not the object of the game. The idea is >to get it out and make it widely available. Period. Maybe of your game. My game is to get cryptography available to all, without violating the law. This mean fighting Clipper, fighting idiotic export restraints, getting the government to change it's stance on cryptography, through arguements and letter pointing out the problems (I love Phil Karn's CJ request, because it points out some of the idiocy behind some of the regulations). This means writing or promoting strong cryptography. By violating the law, you give them the chance to brand you "criminal," and ignore/encourage others to ignore what you have to say. >The Constitution and other laws are not magic talismans. It is fantasy >thinking that technical compliance with the government's laws renders >them "completely powerless." A Smith & Wesson beats four-of-a-kind. I'm not sure I understand what you are saying here. Them being the laws or the government? Bob -- Bob Snyder N2KGO MIME, RIPEM mail accepted snyderra(a)dunx1.ocs.drexel.edu finger for RIPEM public key When cryptography is outlawed, bayl bhgynjf jvyy unir cevinpl.

3 2

spooks on cypherpunks
by nobody＠jarthur.cs.hmc.edu 17 Dec '03

17 Dec '03

NetSurfer <jdwilson(a)gold.chem.hawaii.edu> Robert Mathews <mathews(a)gold.chem.hawaii.edu> be aware

6 9

Re: spooks on cypherpunks
by Jeff Davis 17 Dec '03

17 Dec '03

Thanks for the hot fucking tip, Sparky. What was your first clue? I suggest you not only learn to live with it, you learn to compete at their level. You can ftp my Psychological Warfare Primer for Online Activists at ftp.eff.org /pub/EFF/Issues/Activism/psychwar.primer You have the right to free speech, and you have the right to dissent. Use it or loose it slick. Imagine some spook taking a shit in a public restroom. They're human. And they fuck up regular as well. -- PGP PUBLIC KEY via finger! JAFEFFM Speaking & Thinking For Myself! * eagle(a)deeptht.armory.com email info(a)eff.org * *** O U T L A W S On The E L E C T R O N I C F R O N T I E R **** ***** Committed to Free Public Internet Access for World Peace *****

2 1

Digital_Auction
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

> X-From: Sameer <sameer(a)soda.berkeley.edu> >> In that case one of us (who owns a machine directly plugged into the net) >> should set up an anon server that doesn't check for user/host names, or > Well starting sometime this summer I'm going to start selling shell > accounts, and I don't plan on spending much time verifying that there is a > TrueName associated with any given account. All I will care is that I get > my money and that the account isn't used to violate any security. What is the smallest unit of access? We should use that for digital cash. Let's say I purchase 100 units of access on your system. You issue a certificate that I have this access on demand. Then when we have an IRC digital auction for the blueprints of Megacorp's new xray laser, I can display my certificate and make a bid. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCVAi2/ZzEAAAEEOQGMwT6H90aJMTmkf3bLdMVyJ3hyBDoh8ruQfa2x/8tTEPhs 0dyOMroWwMMFQHY5Gdc7etULE6G3W8Q8CGotwFIEUMCXEc9UBeePv3WaU3ovZ/Dz bdvnTeH8KYpQhV68bi1jvX3ahM2tk5jRwK8zP9+YHv5ZpbQlubVI6pRIYxGNuGfP zntP48UABRG0CG5lb24gPEA+ =CTOG -----END PGP PUBLIC KEY BLOCK-----

1 0