December 2003 - cypherpunks-legacy

Re: OJ`S CELL PHONE
by peter honeyman 17 Dec '03

17 Dec '03

a cellular phone that is turned on is in periodic contact with the local antenna. certainly the cellular provider knows what cell a mobile phone is in; that's how calls are directed. in fact, anyone can monitor the paging channel to make a primitive tracking device. (some folks on this list know much more about this ... perhaps they'll speak up.) peter

1 0

Re: MAIL: anon mailing list
by Jonathan Rochkind 17 Dec '03

17 Dec '03

> Say somebody wants to run a mailing list as you propose. I think they > should just run the list at the same address unless the remailers can > suitably pad, delay, and randomize incoming messages and redirect them > to the true list site (but then delay and randomization may lead to > loss of coherency on the list ;). If not, surely external observation >of the contact point will show where all the messages are headed. Hmm. I'd think that if the list address were an encrypted remailer path with several hops, it would be non-trivial to find the contact point by external observation. Would it even be possible? Regretably, probably so. An additional layer of security could be having the list address underneath all of the encrypted remailer stuff be an anon address at the server in Finland. Although it's probably quite easy to to determine your true address by external observation of anon.penet.fi, unfortunately. Still, the combination of chained encrypted remailer paths, and the finnish anon server would definitely make it dificult to determine the contact point. But I guess not as dificult as I had hoped. > The resources needed would be higher than a normal list since each > incoming message would need to be checked for a digital signature (or > the list could become victim to an anonymous mail bomber, and you Yeah, quite true. It would be impractical for a very large list. At least, if you wanted a list with more then maybe 70 members, you'd need to dedicate some machine to it, probably. Although maybe not; I don't want to concede that until it's actually tried to see how much proccesing power is required in practice. :) And yeah, it would take users who were actually committed to doing it, as most users of _this_ list (including me), don't even sign their messages, as you point out. If we won't even sign our messages, then I don't know who is going to be willing to sign, encrypt, append remailer path, to it. Although I guess if the list required it, as it would, then people might join the list and do the stuff, just for the principle of it. And automated shell scripts certainly help. You could have an automated shell script particularly for the mailing list that took cleartext, encrypted it to the list, signed it, appended the remailer stuff to the front, and sent it off to the proper remailer.

1 0

PC RND generator based on physical random
by jp＠jep.pld.ttu.ee 17 Dec '03

17 Dec '03

What you need is natural source of random. I have used clocking higher speed quarz generator with lower speed (10 x is ok ) unstable frequency oscillator and then taken parity of the result (4-5 bits is enough for most situations, depends of cource on distribution of LF generator values) . Variable Freq. oscillator is RC and higher quarz. Now as we are not willing to give up card slot (and PCB board area ands so on ) for just RND generator maybe it is good to find existing source of random in PC itself. So - do we have RC generator in PC? YES. We have 4 of them, to be exact. Most of us do not make much use of these ports, because most games do not support them correctly. But anyhow, joystick ports are there. IO card costs 10$ if you have not already got one. So I propose scheme for PC RND generator: 1. Make LF generator using Joystick ports 2. Use HF oscilltor of PC clock ( Program Execution, if any interrupts occur, it is no problem). 3. Find out the distribution of LF oscillator and calculate the needed Parity filter size. ( By parity filter I concider parity values of N last bits) 4. Use it

1 0

Hardware RNGs
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

pfarrell(a)cs.gmu.edu: > up IRQs, port addresses, etc. Does this suggest that a > Plug-n-play board would be more attractive? Just build it, on any platform. The key is the RNG, not the interface, which can be easily adapted to market demands. I take it that you don't plan to invest millions of dollars to start up, so _which_ interface you use first is not crucial ;-) There have been too many "let's do this" suggestions that degenerate into a discussion of the smallest details and disappear all together... ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

Neural nets crack RSA? AAARRGHH!
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Jim choate <ravage(a)bga.com>: > As far as I am concerned if it could be done w/ a neural network, or Ouch. Neural networks are _deterministic_ (except, possibly, analog VLSI ones such as Mead's). Digital neural networks can't do _anything_ that cannot be done by algorithms; they run on Turing machines too. Why neural networks are 'magical' as Perry says, in certain classes of problems, is that they provide a way to perform complex algorithmic funtions through a relatively simple interface to humans. In any case, how "fuzzy" do you allow your relative magnitude function to be? Even if a function exists that compares keys with a magnitude difference of the order of 100 bits, it's useless. For your binary search method to work, this comparator function would have to be accurate when the difference is on the order of just 1 bit. Yeah, quantum computers ;-) ----------------From owner-cypherpunks Mon Jun 20 10:33:41 1994 Return-Path: <owner-cypherpunks> Received: by toad.com id AA20571; Mon, 20 Jun 94 10:33:41 PDT Received: from src.honeywell.com (moon.src.honeywell.com) by toad.com id AA20548; Mon, 20 Jun 94 10:33:24 PDT Received: from tbird.src.honeywell.com by src.honeywell.com (4.1/smail2.6.3/SRCv0.25); Mon, 20 Jun 94 12:33:26 CDT id AA02136 for cypherpunks(a)toad.com at toad.com Posted-Date: Mon, 20 Jun 94 12:33:15 CDT Received: by tbird.src.honeywell.com (4.1/SMI-3.2) id AA29883; Mon, 20 Jun 94 12:33:15 CDT Date: Mon, 20 Jun 94 12:33:15 CDT From: bergstro(a)src.honeywell.com (Pete Bergstrom) Message-Id: <9406201733.AA29883(a)tbird.src.honeywell.com> To: cypherpunks(a)toad.com Subject: re: MAIL: secure mail Sender: owner-cypherpunks(a)toad.com Precedence: bulk >>>>> On Sat, 18 Jun 1994 21:05:04 -0500 (CDT), Karl Lui Barrus <klbarrus(a)owlnet.rice.edu> said: > What I've tried is to do a "|pgp -feat ecarp|rmail erc%khijol(a)apple.com", > but pgp just produces empty files! If I execute it by hand, it works. > Anyone know either (1) why it isn't working wnd how to fix it, or (2) > suggect a better alternative? > The problem may be this: pgp needs a path. > Try "| PGPPATH=/whatever pgp -feat ecarp | rmail erc%khijol(a)apple.com" > This is what I needed to do when I tried something similar with mh > and slocal. Keep in mind that if you have a site that follows CERT advisories, there are usually restrictions on which programs may be used to filter mail. My site requires a sysadmin to put an entry in a config file to allow any filter programs to work at all. One standard filtering program that works well is procmail. This will typically be "approved" by default and should keep your (Ed's) admin from having to be involved in your incoming mail. Pete

1 0

Stealth Crypto (Was: Re: Andy Grove on Clipper)
by jamiel＠sybase.com 17 Dec '03

17 Dec '03

At 2:28 AM 06/20/94 -0400, Ed Carp [Sysadmin] wrote: >I've read about (with interest) the so-called "stealth viruses", and how they >adapt to their environment - might crypto do the same thing? There is no way to to translate the idea that I can see. Stealth viruses work by patching the interrupts that AV programs watch- (on a PC- Macs and other platforms are conceptually different) INT 21h, etc. and the file attributes repoting mechanisms in DOS, and lie. It is hardware specific, and I don't see anyway to translate the concept to a networked environment in order to fool 'traffic cops.' I wonder about the mutation engine concept, though... -j

1 0

Hardware RNG's
by John A. Thomas 17 Dec '03

17 Dec '03

Pat Farrell and others have been discussing hardware random-number generators. Since I've built such devices, I thought I'd put in my opinions. I used a reverse-biased transistor junction for the noise source. The noise is amplified by a three-stage op-amp circuit with about 60 dB of voltage gain in the passband and a 3-dB bandwith of 10 Hz - 3 KHz. A spectrum analyzer shows the noise is random, with no frequencies standing out more than others. The analog noise feeds an op-amp comparator wired as a zero-crossing detector. The output is a logic level which switches randomly, but on average, on and off about 50% of the time, respectively. This logic level gates a 5 MHz TTL oscillator, producing bursts of pulses of random length. These pulses are counted by an 8-bit counter, producing random 8-bit numbers. The outputs of the counter are latched and read through a PC bi-directional parallel port. Allowing the slowest changing bit to turn over 10 times between samples suggests a maximum sampling rate of 1000 bytes/sec. The chi-square test and the runs tests on these samples show very good statistical properties. For large samples (> 100,000 bytes), there seems to be a slight predominance of "one" bits (e.g. 0.6% difference). This is probably due to some factor in the sampling process which I haven't figured out yet. Anyway, exclusively-or'ing successive samples together removes this bias. I'd appreciate any ideas about this. I don't know what practical use this device has, except for those who need one-time pads, but it was fun to hack up and test. John A. Thomas b858jt(a)utarlvm1.uta.edu 75236.3536(a)compuserve.com PGP key available on request

2 1

Re: Crypto export legislation defeated in House Intelligence Cmte.
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

> Brief update: The report is expected tomorrow. Initial > news from Intelligence Committee staffers is that the > crypto provisions of H.R. 3937 were axed with an > unbelievable 13-0 unanimous vote... > Has the official report been placed online, and if so, where? Thanks, Jim_Miller(a)suite.com

1 0

Re: Re:
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

>>The cypherpunks mailing list has once again been mysteriously purged. > >I've been receiving mail from cypherpunks all morning. > >-- >Lefty (lefty(a)apple.com) >C:.M:.C:., D:.O:.D:. I've received nothing. Nada. Zero

1 0

Re: Andy Grove on Clipper
by Stuart Smith 17 Dec '03

17 Dec '03

> > Not if you use Stealth for PGP which I released a few months ago after > > persuading "Henry Hastur" to write it. They can't *tell* it' non-compliant > > crypto. Sophisticated steganography is now needed however, since most noise in > > the digital domain is not white noise, like a Stealth PGP message would be (or > > at least different than normal digital noise). But even more so is needed nice > > Mac and Windows interfaces for the system that you can send to a friend, on a > > floppy. I suggest a voice mail utility. Then a critical mass is not even > > needed (security through obscurity). Remember, "Encryption always wins." They > > can't outlaw noise. > > True, but I think that the <insert name of your favorite spook agency here> > would have it's hands on any method almost as soon as it hits the streets. > I'd be interested in getting a copy to play with, but I'm curious - the methods > to validate that you have a proper message have to be there, anyway, and that > would seem to be your undoing. If you have to validate it, it can be scanned > for -- that's how they find viruses these days, too. Does your method take > that into consideration? I could imagine a future where, like viruses, crypto > used "adaptive crypto" or "adaptive signatures" to hide itself from detection... Well, I've played with stealth briefly, along with a few other interesting utilities, and it does look good. i.e. there is no way to validate proper messages. If you feed noise/junk/whatever into stealth, it will give you a pgp encoded message back. Every picture posted to alt.binaries.pictures.* could be run through stealth and a pgp file would result. Find which ones *really* were pgp files to begin with.. good luck.. What we have to worry about is making sure there is no way to identify the data that pgp puts out itself. That is, the encrypted data and the encrypted IDEA key. If I gave you random samples of noise and told you that one of them was an IDEA key encrypted by an RSA key, you shouldn't be able to pick it out. -- Baba baby mama shaggy papa baba bro baba rock a shaggy baba sister shag saggy hey doc baba baby shaggy hey baba can you dig it baba baba E7 E3 90 7E 16 2E F3 45 * 28 24 2E C6 03 02 37 5C Stuart Smith <stu(a)nemesis.wimsey.com>

1 0