December 2003 - cypherpunks-legacy

No Subject
by John Young 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Dave Otto wrote: I think the issue, at this point, is not so much whether the NSA goons actually threatened his life, but that they have consistently attempted to suppress crypto anyway they can. That the NSA has tried to intimidate Bidzos is no secret. That the NSA considers PGP a threat to their domain is also well known. CPSR and EFF are doing an admirable job of taking the fight to the beltway; but outside the net, the grass roots support just isn't there. As has been pointed out by PRZ et al., the primary reason to avoided hacks to PGP is that doing so fragments what standards we have now. The release of the MIT PGP was the first step in legitimizing cryptography. The next step is to install interoperable crypto on EVERY box out there. While I don't advocate bypassing your local sysadmin, try to get PGP installed on each machine you touch. Use 2.6 (MIT in U.S., _ui_ elsewhere). Publish your key. Tell your friends. Annoy your family. Irrate your boss ;-). My wife suggested that my activities would have gotten me "black-listed" 40 years ago. I suggest that the NSA would like to do exactly that to individuals like Bidzos and PRZ, but it is too late (and the net would make it virtually impossible anyway). Besides, some things are worth fighting for. Dave rightly suggests that "black-listing" and other stigmatizing and threatening inhibit the rights of citizens. Such attacks also intimidate others who learn of the assault on organizations and persons and who fear they may become targets. To oppose this it seems also right that any attack we learn about should be posted in this forum, at the least. Please post who else NSA -- and its like -- has threatened besides Bidzos and PRZ. John -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLhBhiyC2hhsUMyZpAQH/JAP/fjhJrxoe76Dbo2+wHD9EcFl2PObKgqEa vjNaRomGIYgb/BKe/M4DejgtNgEGi+DyGoFspf14u18q2ZzFV8iQFJjaP7y5GFFI /5ztKpAH/ERCpNmF6L9jOYqIy6p3FZTsMVsxQwSW9IsM+XD7jxW7g0QU/NkvcTIn Vz7Bt0hjY9s= =AlBx -----END PGP SIGNATURE-----

1 0

RE: BLACK UNICORN
by Blanc Weber 17 Dec '03

17 Dec '03

Well, I just sent mail to you, Sandy at crl.com, but it came back to you saying that you were "554 Unbalanced '>' ". I guess it's in reference to the software :>) I was just inquiring, since you yourself are lately leaving the US & going off to Hong Kong, whether you would be there long enough to be part of the events in the changing of the guard to the Commie Chinese? Blanc

1 0

Re: NSA and competence
by Blanc Weber 17 Dec '03

17 Dec '03

From: "Perry E. Metzger" ...They have plenty of money, and EXTREMELY smart people. ........ That, and the concrete evidence that they are probably twenty years ahead of us, leads me to believe that it is stupid to underestimate them. .............................................. They sure make some BIG mistakes, though, don't they? And they didn't cover up the Clipper mistakes very well at all. And they're not seeing the economical relationships regarding exports very well. Do you suppose that maybe this is intentional? Blanc

2 1

Re: NSA and competence
by Jonathan Rochkind 17 Dec '03

17 Dec '03

> They sure make some BIG mistakes, though, don't they? > And they didn't cover up the Clipper mistakes very well at all. > And they're not seeing the economical relationships regarding exports > very well. > Do you suppose that maybe this is intentional? What big mistakes? The Clipper error is a relatively small mistake. Sure, there's a loophole that allows someone with the neccesary will and knowledge to clipper-encrypt things in such a way that the government can't decrypt them. But I believe the NSA when they say they knew about this, but didn't care. Because it makes sense. The NSA knows that anyone with the neccesary knowledge to exercise this loophole _surely_ knows about other non-clipper encryption methods too. Any terrorist who knows enough about encryption to know how to exercise the loophole (which will be any terrorist at all pretty soon) will surely know enough to encrypt with PGP underneath clipper anyway. So what difference does it make to the NSA? Sure, clipper might be a bit harder for the NSA to crack then RSA/IDEA, but appearantly not enough to justify NSA-concern. This just re-emphasizes that the NSA isn't _really_ worried about terrorists and drug dealers and such. I mean, they're worried, but that's not the worry that motivates clipper. Because clipper wont' be any good against terrorists and drug dealers as long as alternate encryption is legal. They are worried about non-escrowed encryption becoming a _standard_, for the Average Joe. The Average Joe, while he might use PGP in a clipper-free world, proably isnt' going to use it if his mail is protected by clipper already. And he sure isn't going to exercise the clipper loophole. IMHO, the NSA obviously spends enough effort spying on the Average Joe to justify clipper for these reasons. Because they can't be blind enough to think that Clipper is going to be any use at all against those who care. The fact that they are unconcerned about this loophole seems to justify that. As for "not seeing the economic relationships", they just don't care. The export restrictions have one purpose only: to hinder cryptology R&D in America. Yeah, anyone who thinks about it realizes that this means hurting american software companies ability to compete, but the NSA doesn't care about ability to compete. They care about National Security. And they think that National Security will be compromised if American firms engage in lots of crypto-R&D. So they are doing anything in their power to prevent that. Export-restrictions are really the only thing they have the power to do in this regard, but they should work perfectly sufficiently for their purposes. They dont' seem to be making too many mistakes to me.

1 0

Pipe>>OTTO5.ASC<<Pipe
by John Young 17 Dec '03

17 Dec '03

begin 644 /tmp/baaa006Cn end

1 0

Bidzos and RSA
by John Young 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Dave Otto posted today: < I think the issue, at this point, is not so much whether the NSA goons <actually threatened his life, but that they have consistently attempted to <suppress crypto anyway they can. That the NSA has tried to intimidate <Bidzos is no secret. That the NSA considers PGP a threat to their domain <is also well known. < Given that the purpose of the ITAR restrictions appear to be to prevent <an international standard from forming, I think we need to refocus on the <issue of presenting strong crypto as "a right", inevitable, and ubiquitous. < CPSR and EFF are doing an admirable job of taking the fight to the beltway; <but outside the net, the grass roots support just isn't there. As has been <pointed out by PRZ et al., the primary reason to avoided hacks to PGP is <that doing so fragments what standards we have now. The release of the <MIT PGP was the first step in legitimizing cryptography. The next step is <to install interoperable crypto on EVERY box out there. While I don't <advocate bypassing your local sysadmin, try to get PGP installed on each <machine you touch. Use 2.6 (MIT in U.S., _ui_ elsewhere). Publish your <key. Tell your friends. Annoy your family. Irrate your boss ;-). < My wife suggested that my activities would have gotten me "black-listed" <40 years ago. I suggest that the NSA would like to do exactly that to <individuals like Bidzos and PRZ, but it is too late (and the net would make <it virtually impossible anyway). Besides, some things are worth fighting for. Dave rightly suggests that black-listing and other such stigmatizing and threatening offenses inhibit the rights of citizens. These attacks also intimidate others who learn of the aggression on organizations and persons and who fear they may become targets themselves. To oppose these offenses it seems also right that any attack we learn about should be posted in this forum, at the least. Please post who else NSA -- and its like -- has threatened besides Bidzos and PRZ. John -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLhCBFyC2hhsUMyZpAQGUnwQAqFgV+nYmG+yaDMfEp7jc3KIsU3dFddvO 8pRKo9049PZMMhScksExpgmQmTQAeXRuShKiRNFzaiO8RGCPOSX/iU8QaGPI/d8o DMvoNYSDrK7IUEjTinaAGtCdHXvRE0JwtEXA/dgvj5X/s4eEzRFu4ZK3nvxsi2ey YtcH8dQ2SnI= =PdKJ -----END PGP SIGNATURE-----

1 0

Bidzos in the NYT
by Duncan Frissell 17 Dec '03

17 Dec '03

Markoff has a profile of Jim Bidzos on the front page of today's NYT business section. "Profit and Ego in Data Security." No death threats mentioned other than: "The government would like him not to exist," said Jeffrey I. Schiller, a computer manager at the Massachusetts Institute of Technology, who has negotiated a licensing deal with Mr. Bidzos. DCF --- WinQwk 2.0b#1165

1 0

(fwd) Re: Real random numbers
by Jim choate 17 Dec '03

17 Dec '03

Path: bga.com!news.sprintlink.net!hookup!yeshua.marcam.com!zip.eecs.umich.edu!newsxfer.itd.umich.edu!gumby!wupost!spool.mu.edu!torn!nott!cunews!freenet.carleton.ca!freenet3.scri.fsu.edu!mailer.acns.fsu.edu!not-for-mail From: jac(a)ds8.scri.fsu.edu (Jim Carr) Newsgroups: sci.physics Subject: Re: Real random numbers Date: 24 Jun 1994 15:56:03 -0400 Organization: Supercomputer Computations Research Institute Lines: 39 Message-ID: <2ufdoj$h69(a)ds8.scri.fsu.edu> References: <2u69cp$46q(a)asterix.uni-muenster.de> NNTP-Posting-Host: ds8.scri.fsu.edu Keywords: real random numbers , Monte Carlo simulation In article <2u69cp$46q(a)asterix.uni-muenster.de> hoppep(a)asterix.uni-muenster.de (Peter Hoppe) writes: > >4-bit random numbers (0,1,...,15) have been produced from >thermal noise by a complicated method. >Since the production is not due to a determining algorithm >(of a pseudo random generator) these numbers are 'real random numbers'. >So a priori there could not be any periodicity in the number series. >The equipartition has been checked by the "chi-square-test" and the >correlations by the "serial-test" [1]. Both equipartition and >correlations fulfill the theoretical expectations very good. >[1] D. Knuth, The Art of Computer Programming, Vol. II, > Addison-Wesley, 1969 There are much tougher tests for random numbers than these, particularly if they are to be used for Monte Carlo where the numbers are used as m-tuples. The tests you really need to make are the ones George Marsaglia calls the 'monkey test' and the 'birthday test', as well as the m-tuples test. The first two are generalizations of the well known statistics problem of the monkey typing Shakespeare and of coincident birthdays in a group of people. They are tough to pass. The problem as I see it is that 4-bit numbers do not generate much variability, so you will really need m-tuples of 4-tuples of these. This increases the chance that long range correlations will catch up to you when you least want them. I am sure George would be interested in this, however, since they have been looking at ways to incorporate physical noise that is truly random into the very sophisticated generators like the combination of lagged fibonacci with congruential. The problem is that noise is seldom random enough, according to talks he has given. -- James A. Carr <jac(a)scri.fsu.edu> | "It's never confusing though, http://www.scri.fsu.edu | because ultimately it all fits Supercomputer Computations Res. Inst. | -- it's just cockeyed and fits Florida State, Tallahassee FL 32306 | and is fire." - Norman Maclean

1 0

A question about encryption methods.
by nobody＠vox.hacktic.nl 17 Dec '03

17 Dec '03

I would like to encrypt data for a CD-Rom. Anyone's data can get on the CD-Rom by way of the encryption box. Likewise anyone could read the cypher data back from the CD-Rom. Given that every 2k block of data will be encrypted with the same key. Given that there are weak keys with the IDEA cypher. And given that someone could mount an adaptive chosen plaintext attack. Which of the following would be a good bet for a secure data CD-Rom? 1 - IDEA cypher using Cypher Feed Back for the 2k data block. Insuring that the Weak Keys are not used. 2 - A combination cypher consisting of... IDEA -> T -> IDEA -> T -> IDEA where each IDEA cypher is in Cypher Feed Back mode with it's own key. where each T mixes the bytes around in the 2K block based on a modulo sum of the 2k bytes. Would method two be too time consuming? Would I need to exclude the weak keys from the IDEA cyphers in the second method?

1 0

NOT JUST CYPHERPUNKS
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, There's a pretty good article about the privacy debate in the July/August issue of BEYOND COMPUTING. The article, "Technology and Government: The Battle Heats Up," is by Dr. H. Jefferson Smith. It appears in the "ethics" section. Mostly it was a once-over-lightly, but at least it never mentioned kiddie porn, narcotraffickers, pedophiles nor terrorists. It was fairly even handed in its presentation. The article ended with these paragraphs: . . . On one level, discussions of an individual's rights--such as the right to conduct private conversa- tions without a threat of government intrusion--are pitted against the worthy goal of an efficient and safe society. On a deeper level, a potentially more perplexing dilemma is at play: Should our government interject itself into technological advances to achieve some socially desir- able outcome? And, if so, who should determine which outcome should be sought? Of course, we know the Cypherpunk answers, but at least other folks are looking at the issues. Onward and upward. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0