December 2003 - cypherpunks-legacy

Crypto and new computing strategies
by Jim choate 17 Dec '03

17 Dec '03

In the latest issue of Scientific American there is an article on quantum computing and how the first working machine is to be built in the immediate future. This raises dark portents in my mind when one considers the rate and the size constraints on such devices. We may be looking at a technology birth which will allow brute force computation of RSA style algorithms and their cracking. As an aside in a Physics mailing list I subscribe to Rajashi Roy from Georgian Tech supposedly has managed to synchronize two chaotic lasers which would provide a basis for a optical one-time pad system.

2 1

please ignore this test message
by Sam Walters 17 Dec '03

17 Dec '03

this is a test message. asdf;ljkasdfkl;asdfj asjdkl;flasdl;jkasdl; as;dlfsa;lasdfl; --

1 0

Anderson's RSA Trapdoor Can Be Broken
by Matt Thomlinson 17 Dec '03

17 Dec '03

The name of the article I cited earlier is in the subject line. Written by Burton S. Kaliski Jr, of RSA Labs, on **March 19, 1994**. An abstract: ------------- A recent letter by Ross Anderson proposes a ``trapdoor'' in the RSA public-key cryptosystem whereby ahardware device generates RSA primes p and p' in such a way that the hardware manufacturer can easily factor the RSA modulus n = pp'. Factoring the modulus hopefully remains difficult for all other parties. The proposed trapdoor is based on a secret value A known only to the manufacturer. For 256-bit RSA primes, the secret value A is 200 bits long. The device generates primes p of the form p = rA + q = r(q,A)A + q. (1) where q is at most about 100 bits long, and is 56 bits long and a function of A and q. To factor the RSA modulus n = pp', the manufacturer reduces the modulus modulo A to recover the product qq', following the relationship n = pp' = rr'A^2 + (rq' + r'q)A + qq'. (2) The 200-bit product qq' is easily factored and the manufacturer recovers the primes p and p' accordingly. While the trapdoor is indeed practical, it can be broken: Factoring such ``trapped'' moduli is easy. [...goes into easy-to-tex, hard-to-ascii derivation...] ...Such inequalities are called ``simultaneous Diophantine approximations,'' ... [and these will be solvable for these parameter lengths when (number of keys) >= 13] [...] One way to overcome this attack is to assign a different secret value to each device [...] The user does not need 14 moduli to find A, however. Two prime factors p and p' suffice, since the fraction r'/r is such a good approximation to the fraction p'/p that it is guaranteed to be a convergent in the continued fraction expansion of p'/p. The user can therefore detect a trapdoor even if the device generates each modulus with a different secret value. The manufacturer's only recourse, at least as far as the proposed trapdoor is concerned, is for the device to generate each modulus with a different secret value and to keep the prime factors secret. In such a sitiation, the manufacturer may as well preload the device with the primes and escrow copies--a practical ``trapdoor'' to which all cryptosystems, not just RSA, are vulnerable. burt(a)rsa.com -------------------------- check out rsa.com for the real copy: I left out about 3 equations relating to the diophantine approximations, but the text is pretty much copied in its entirety. Matt Thomlinson Say no to the Wiretap Chip! University of Washington, Seattle, Washington. Internet: phantom(a)u.washington.edu phone: (206) 548-9804 PGP 2.2 key available via email or finger phantom(a)hardy.u.washington.edu

1 0

Re: cfp '94 transcript
by Jack King 17 Dec '03

17 Dec '03

Also note that the Fifth Circuit recently discarded the "exculpatory no" defense to Sec. 1001. See _United States v. Rodriguez-Rios_, No. 92- 8257 (5th Cir. 2/11/94) (Smith, J.). Reported at 54 CrimLRptr 1528. Now, in the Fifth Circuit, you can't even say "No, I never did/say/thought that" without committing a crime!

2 1

Citizen-Unit May fulfils Duty
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

> Personally, I expect personal crypto dongles and/or similar gadgets to > be self-contained, in a wearable form. Maybe pendants, maybe rings > (real decoder rings!), maybe wristwatches. Communication will be by > inductive coupling or similarly robust links. (Inductive, > noncontacting transfer would allow implantation of the unit. IR > transfer through the skin is also possible.) We grant Citizen-Unit May Approved Thought Pattern credits for suggesting new ideas for our Unit Identifying Project. We note with some sadness that he was unable to carry his Approved Thoughts to their completion, whereby the Citizen-Identifying Trade Units broadcast all trade transactions of their attached Citizen-Unit to all Clipper-Units in the vicinity, for the benefit of surveillance and efficiency of society. --Approver-Unit Rishab Aiyer Ghosh -------------------------------------------------------------------------------- Rishab Aiyer Ghosh "What is civilisation rishab(a)doe.ernet.in, rishab(a)dxm.ernet.in but a ribonucleic Voicemail +91 11 3760335; Vox/Fax/Data 6853410 hangover?" H-34C Saket New Delhi 110017 INDIA --------------------------------------------------------------------------------

1 0

Re: Shirt project
by Jim Gillogly 17 Dec '03

17 Dec '03

> jdblair(a)nextsrv.cas.muohio.EDU writes: > > 1 9 8 4 > > > > "We're behind schedule." > > National Security Agency > > were interested in the design. I thought that on the back I might make a > list of government policies which are eroding civil rights. Sounds a bit busy -- what about the WiReD Clipper logo: the fist clutching the airwaves? I assume they'd give permission if asked nicely... Jim Gillogly Highday, 7 Astron S.R. 1994, 01:43

2 1

Re: personal manifesto (comments appreciated)
by W. Kinney 17 Dec '03

17 Dec '03

T.C. May writes: >And part of preventing totalitarianism means not interfering with >economic transactions made by folks. Say, Public Key Partners, for instance? ;-) -- Will

1 0

Shirt project
by hughes＠ah.com 17 Dec '03

17 Dec '03

>The "1984" T-shirt was suggested by one of the NSA reps at the CFP >conference. The fellow involved was indeed from the the NSA, but he was by no means representing it. I understand from him that he did a bit of bureaucratic hacking just to attend. He also kindly offered to post from dockmaster that he had seen me and some other tentacles in the same place and at the same time at a privacy conference, but alas, there were no tentacles to be found. Eric

1 0

Re: cfp '94 transcript
by Peter Wayner 17 Dec '03

17 Dec '03

>> ObNit: As has been said before by others, there's more to >> Clipper/EES than just the Skipjack algorithm. I think simply asking >> if "the [Skipjack] algorithm contains a deliberately encoded >> weakness" leaves too much room for a "truthful" No answer. >I'm not sure what the NSA policy is on this. However, at that >same conference Jim Settle from the FBI told us plainly that >he is allowed to lie, and that the courts have confirmed this >right. I doubt Baker would have confessed to a back door even >if one existed and the question was complete. And, then they get bummed out when the public doesn't _believe_ them.

1 0

Re: Ames/clipper compromised?
by Peter Wayner 17 Dec '03

17 Dec '03

>A useful exercise for this group might be to compile a list of questions >that they *should* answer if they're playing it straight. These could >be forwarded to the review committee, too. If we come up with a good >list, I'm willing to submit it to them. For that matter, I'll submit >it to one of the gentleman from NSA who gave the Clipper presentation >at Bell Labs. (But I won't bother sending in ``when did you stop beating >your spousal equivalent unit'' questions; there's no point to doing that >in this venue.) I've sent this exact question to Dorothy Denning back when they were working on the first report. I think it got lost in the noise. You might want to send it to her directly. They're open to suggestions. The first report contained cycling tests suggested, by I believe, Martin Hellman. -Peter Wayner

1 0