December 2003 - cypherpunks-legacy

A technical question re crypto technologies: DES and RSA
by Herb Lin 17 Dec '03

17 Dec '03

Folks -- can I get your input on the following technical questions? When implemented with "ordinary" hardware and software, I understand that RSA is very slow compared to DES for "equivalent" levels of protection. Question 1: How much slower? I've heard the possibility exists of designing special purpose hardware that would greatly speed up RSA. Question 2: Please comment on the feasibility of this scheme. thanks herb

1 0

Clipper et al.
by wallace＠cs.widener.edu 17 Dec '03

17 Dec '03

I think that the Clipper system has it's heart in the right place, but that it still has quite a few problems in implimentation. The keys to the system are kept separate, but NEVER is anything competely safe or foolproof. The keys, once used, have been exposed to about 10-15 different officials who, at their own leisure, may make a copy of the key and use it. Every time a key is used, more people have the opportunity to get it. After 800 wiretaps, the system is virtually useless. Through the use of Clipper and other various technologies, the US government is trying to hedge its way into control of the Net. This is not neccesarily a good thing. I think that the Net should have its own system of governemt: common sense. There would be no "President". There would only be a "Congress" of the people, which would include everyone. It could be set up as a newsgroup, or something. The use of keyed signatures would come in handy so that people would not be able to "stuff" the "votes", etc. I think it would be an interesting experiment. The "net.gov" would have its own electronic embassy, and the indivdual world governments would not be able to "force" their will upon everyone. The problem with a government making laws against certain on-line actions is that not all people are actually located in that country. The whole thing gets messier from there. A net.gov would solve a lot of problems. Any ideas? (I admit, it's not too appropriate, but I decided to get the discussion going. :) ) - DW - wallace(a)cs.widener.edu -- Sig of the Day -- Dennis.S.Wallace(a)cyber.widener.edu "Who the hell is Cthulu?" - Mark Schroy

2 1

Clipper is voluntary? Hah!
by Sam Shipman 17 Dec '03

17 Dec '03

I was just mulling over the assertion that Clipper would be a "voluntary" standard, and I thought of an analogy. At best (i.e., assuming the Government's not lying, which is sort of like assuming smoking doesn't cause lung cancer), Clipper would be a voluntary standard in much the same sense that VHS videocassettes are now a voluntary standard. If you don't like it, you can always get Beta. Of course, good luck renting videos, exchanging tapes with your friends, buying blank tapes, etc. Note: I haven't read everything about this controversy that's come across this list, so if it turns out that I've independently reinvented this, then sorry for wasting your time. Sam Shipman speaking only for myself, as usual (nobody else will)

1 0

Re: quetion about Multi-user systems
by Eric Johnson 17 Dec '03

17 Dec '03

: From owner-cypherpunks(a)toad.com Wed Feb 23 15:13:16 1994 : Subject: quetion about Multi-user systems : To: cypherpunks(a)toad.com : Mime-Version: 1.0 : Content-Type: TEXT/PLAIN; charset=US-ASCII : Sender: owner-cypherpunks(a)toad.com : : : : I myself have a Linux system at home, all set up with PGP and : rather secure from outside thrats since it is unconnected from the net : except for when I dial-up. I was wondering what strategies some people : use in order to make it easier to write and respond to mail. I dont feel : like writing a message at home, encrypting it and then U/Ling it to my : acount and mailing it. Is there another wya to use PGP on my mail account : wihtout severely reducng mysecurity? I know the Sysop can read my secring : etc.. at any time and can also intercept my passkey for my secring, BUT I : would still like to perhaps use a low security key from my Unix account : and then have a high security key on my home system that is very safe. : The problem is, figuring out which message goes to where and all. Could : someone with extnsive knowledge of PGP use on a Unix system help me out : here>? : : : You're eqipped with a hundred billion nueron brain, that's : wired and fired, and it's a reality generating device, but : you've got too do it. Free youself ----Tim Leary---- Why not use UUCP? --Eric

3 3

Clipper questions...
by Darren Reed 17 Dec '03

17 Dec '03

Umm, with Clipper, will it be illegal to use other encryption in addition to clipper ? ie text -> des -> clipper -> des -> text Or is that (other encryption being illegal) likely to be a result of followup legislation ? And also, how will anyone know if you are without several court orders ? :-) At least, now for the NSA, they don't have to worry about legalities when it comes to decrypting DES (assuming they can) so why would they push for Clipper if it restricted them more ? (Sorry, I don't read much of the flame wars on this after the first few responses, if this has already been brought up)

1 0

RE: "Surveillance is Security," says Winston May
by Blanc Weber 17 Dec '03

17 Dec '03

From: Timothy C. May Please understand that these proposals have a few rought edges in implementation that need to be worked out, but their "hearts are in the right places." Under Big Bro's boot, that is. War is Peace, Freedom is Slavery, Surveillance is Security! ................................. You Have Been Assimilated, We are All One! Defection into Self Reliance is a Crime!

1 0

Re: STEALTH OCEANS
by Sergey Goldgaber 17 Dec '03

17 Dec '03

This is my first post to this list, so please don't flame me if I make some trivial mistake. %-> IDEA Re: making random noise files "undetectable"... ~~~~~~~ On many machines the file system allows users to "delete" files without actually deleting them. This is usually accomplished by simply marking the disk blocks that make up the file as free. Thus it should be possible to write an encrypted (noise) file on to disk, pad the rest of the disk with more noise and "delete" the whole thing, making the disk look blank to all casual observers. PROBLEM: If the above idea is implemented, one could not write on to the ~~~~~~~ the disk for fear of accidentaly overwriting the "free" disk blocks. SOLUTION: Knowing the _exact_ location and size of the file, one could write ~~~~~~~~ directly to those block which are _really_ free. 2nd PROBLEM: In order to decrypt the file, one needs to know it's ~~~~~~~~~~~ _exact_ location and size (or use some undelete util)... Which brings me to the... 3rd PROBLEM: An undelete utility could make recovering the encrypted ~~~~~~~~~~~ file trivial for _anyone_. SOLUTION: Make the file undetectable to udelete utilitys by modifying ~~~~~~~~ the FAT table, or equivalent. One would, of course, have to keep track of the file in some other, non-standard, way. FINAL(?) PROBLEM: Implementing the above idea is trivial for the average ~~~~~~~~~~~~~~~~ user. Making and recovering truely undetectable files may not be. All feedback welcome, Sergey ------------------------------------------------------------------ * * * This is a repost of a message I posted on this list on Feb. 18 * * I am reposting in hope of further feedback fromm other readers * * * ------------------------------------------------------------------

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

This question has come up a couple of times lately, and nobody seems to be talking. Does anyone know the budget size and sources for CERT? Is CERT 'officially' part of the government or do they operate independently? And could a FOIA request yield results, do you think? *waves to the CERT guys reading this letter. They are monitoring this group, I have proof!*

2 1

Re: quetion about Multi-user systems
by mch＠sqwest.wimsey.bc.ca 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Subject: Re: quetion about Multi-user systems > sOn Wed, 23 Feb 1994, Eric Johnson wrote: > > > : would still like to perhaps use a low security key from my Unix account > > : here>? > > > > Why not use UUCP? > > > > --Eric > > > I was just advised to do that. the problem is I would > need to write something to allow me to do it without the > sysadmins knowledge here. He doesnt take kindly to The simplest solution is to get UUCP service from a commercial provider. (The cost should be somewhere around $20/month) Mark -----BEGIN PGP SIGNATURE----- Version: 2.4 iQCVAgUBLWvwreULSAGiySfVAQGa3wP5AVIiNtKJx95YHzXm54xVRlEMEUhJ8CCV gkVXF/GoqZolBA0kZJ7nLIXnocV9n676LFqyN8/wRHqLGJKr8hIM2o/ipEg4dOgr qWpkWm+uLQlZOLxclvFSptOygwMS2AMz4OVID2kAVCPJGmCrO8rxnUXT8j4dY4gK ME7l/naYYPY= =Oul+ -----END PGP SIGNATURE-----

1 0

Re: STEALTH OCEANS
by Sergey Goldgaber 17 Dec '03

17 Dec '03

This is my first post to this list, so please don't flame me if I make some trivial mistake. %-> IDEA Re: making random noise files "undetectable"... ~~~~~~~ On many machines the file system allows users to "delete" files without actually deleting them. This is usually accomplished by simply marking the disk blocks that make up the file as free. Thus it should be possible to write an encrypted (noise) file on to disk, pad the rest of the disk with more noise and "delete" the whole thing, making the disk look blank to all casual observers. PROBLEM: If the above idea is implemented, one could not write on to the ~~~~~~~ the disk for fear of accidentaly overwriting the "free" disk blocks. SOLUTION: Knowing the _exact_ location and size of the file, one could write ~~~~~~~~ directly to those block which are _really_ free. 2nd PROBLEM: In order to decrypt the file, one needs to know it's ~~~~~~~~~~~ _exact_ location and size (or use some undelete util)... Which brings me to the... 3rd PROBLEM: An undelete utility could make recovering the encrypted ~~~~~~~~~~~ file trivial for _anyone_. SOLUTION: Make the file undetectable to udelete utilitys by modifying ~~~~~~~~ the FAT table, or equivalent. One would, of course, have to keep track of the file in some other, non-standard, way. FINAL(?) PROBLEM: Implementing the above idea is trivial for the average ~~~~~~~~~~~~~~~~ user. Making and recovering truely undetectable files may not be. All feedback welcome, Sergey PS: I originally posted this message on Feb. 18, '94 I am now reposting in hope of recieving more feedback from other readers. PPS: Please forgive me for my previous repost. I just realized it is illegible to anyone without MIME.

1 0