December 2003 - cypherpunks-legacy

DES Flames
by kentborg＠world.std.com 17 Dec '03

17 Dec '03

It seems I made two mistakes. 1) I didn't word my question clearly enough. 2) I posted from my AOL account. (Note that this is sent from a Genuine Hard to Use Unix Machine as Terribly Sophisticated Proof the I am not a Complete Fool...boy, some people are naive.) I try again. Given: 1) Some people worry about the strength of DES. (Correct?) 2) DES is within striking distance of a brute-force attack, this is far-and-away its most serious weakness. (Correct?) 3) 3-DES is nowhere near soon being vulnerable to a brute-force attack. (Correct?) It follows then that: 3-DES is a trivial fix of DES' ills. (Correct?) Now, I repeat my puzzle. If there really was a Great Government Gnashing of teeth over how to replace DES, what was the problem? Is it that 3-DES is too good? (But then why the great worry over DES in the first place? 56-bits is not something easy to break off the shelf. Are we worried about the French or Japanese or somebody?) Something doesn't add up here--and it isn't the fact that one of my six or eight internet addresses is an AOL account. My tentative answer: DES is *generally* too strong for the TLA's taste, but specifically 56-bits worth of DES is too little. They were in a paradox of wanting something the US spooks could read but others can't. But then why the long delay before back-door systems like Clipper are rushed out? It still doesn't add up. Another possible answer: the threat to DES was not its weakness, rather the combination of its *strength* and the fact that regular folks would start using it, a la PGP and RIPEM. When it first came out only banks and stuff were interested, not plain old citizens. In other words, DES' fault was how strong it is. (ObStupidWarning: Yes, 56-bits is too few to really trust, but 3-DES is a trivial variation.) -kb, the Kent who no longer has Perry's permission to post -- Kent Borg +1 (617) 776-6899 kentborg(a)world.std.com kentborg(a)aol.com Proud to claim 39:30 hours of TV viewing so far in 1994!

2 1

broadcast encryption
by pstemari＠bismark.cbis.com 17 Dec '03

17 Dec '03

> The US is a signatory to the International Telecommunications Union > (ITU) treaties that allocate various parts of the radio spectrum for > different uses around the world. One of those treaties (or some part > of one; I forget which) prohibits the use of encryption to "obscure > meaning." So how is it that the satellite companies are allowed to encrypt their signals, while individuals are not? Another example where corporations have greater rights than individuals? --Paul

7 8

Re: anonymous anonymous remailers?
by Jonathan Rochkind 17 Dec '03

17 Dec '03

> > Assume we create the alt.anonremailer.net newsgroup mechanism that > > Jonathan Rochkind recently suggested (and it worked). > > Could we > then not use the newsgroup, in combination with a net of > > well-known remailers, to give us the capability to have some remailers > at > unknown locations by having some remailers post encrypted reply > blocks as > their "addresses"? > > This is just painfully non-scalable. Sure it will work for now, but > its not something that will last once large numbers of people begin > using it. Why? Which part, the whole idea of a remailer control newsgroup, or just the idea of remailers with unknown locations? I'm not sure how reliable remailers with unknown locatoins would be (one remailer in the chain goes down, your unknown remailer can't be contacted, and there's no easy way to verify whether the chain is still intact any more), but I'm not sure I actually see anything non-scalable about it. Nor about the "alt.anonremailer" concept. If you've got 500 remailers posting once a day, your still not the largest newsgroup out there. And when combined with a realtime verification system (you get the address of the remailer from the newsgroup, and _then_ you connect to a certain port and get an acknowledgement message, to make sure the remailer is up), you could lower traffic yet further. Maybe you only need to post once every ten days with the "my remailer is here" message. This could then accomodate some 3000 remailers and still not be as high traffic as comp.sys.mac.hardware. And I think by the time there are 3000 remailers to be accomodated, the net will be easily handling full motion video, and people will be exchanging 20 minute long quicktime movies in the newsgroups, and we wont' have a bandwith problem at all. But maybe I'm missing something obvious. Enlighten me.

2 1

Re: broadcast encryption
by Ben.Goren＠asu.edu 17 Dec '03

17 Dec '03

At 11:06 AM 8/3/94, Matthew D. Finlayson wrote: >On Wed, 3 Aug 1994, Paul J. Ste. Marie wrote: >>>The US is a signatory to the International Telecommunications Union >>>(ITU) treaties that allocate various parts of the radio spectrum for >>>different uses around the world. One of those treaties (or some part >>>of one; I forget which) prohibits the use of encryption to "obscure >>>meaning." >> >>So how is it that the satellite companies are allowed to encrypt their >>signals, while individuals are not? Another example where >>corporations have greater rights than individuals? >> >> --Paul > >Who are these satellite companies? > >I work for a major international record carrier and I have no encryption on >any of the earth stations in my inventory. > > --Matt You mean that pay-per-view satellite TV is *not* encrypted? b& -- Ben.Goren(a)asu.edu, Arizona State University School of Music net.proselytizing (write for info): We won! Clipper is dead! BUT! Just say no to key escrow. And stamp out spamming, too. Finger ben(a)tux.music.asu.edu for PGP 2.3a (soon 2.6) public key.

1 0

Re: encryption and Ham Radio
by jdd＠aiki.demon.co.uk 17 Dec '03

17 Dec '03

In message <199408031613.MAA14343(a)cs.oberlin.edu> Jonathan Rochkind writes: > A while ago I thought about getting a Ham Radio license for doing TCP/IP over the airwaves. I never got around to learning the details, but I know that it is > possible, and that many Hams in big cities have detailed digital nets running > over the airwaves, using TCP/IP, or other protocols. There are even some > gateways onto the internet. > For those interested in wireless Internet communications, this might be of interest: In message <Pine.3.07.9407180637.B7378-d100000@tech> James Horton <horton(a)cftnet.com> writes: < The next gereration of RF devices will make wireless, point to < point links, of 5-20 miles, very inexpensive. Small businesses < and individuals can build their own AS and negotiate with < national operators to get inter-connectivity! Options are increasing < daily, I just hope the RF chipsets can be purchased in the USA < and WE will not have to go overseas! < < CFTnet, the ISP of which I'm part of, is currently prototyping < an inexpensive board that combines, modems, ethernet, a unix OS, < ISDN ports, T1 or 56K ports, and network security features, into a < single system. I'm certain other designers are being creative < concurrently. < < The marketing strategy with this board is to offer, FLAT RATE < access, in every city in America. The board operates on 48VDC, < for telco co-location, or 115vac. Hopefully, the board will be in < production in 3-5 months. It seems that several of the < 'behind the technology innovation curve' telcos are interested in < jumping into the flat rate party. < Names withheld > < < Communication systems will continue to get less expensive, as < technology progresses and RF spectrum gets re-allocated to < non-licensed uses. Append to this argument: the 'HDSL, High Data-rate < Subscriber Line chipsets that convert ordinary POTS into T1 lines and dark < fiber companies and you get an enormous increase in bandwidth, at reduced < prices. [much stuff snipped] < Packet filtering may just give the internet hacker/cracker < community a new target. I've heard that now the Ci--- routers have < been comprimised and that 'source routing and virtual interfaces' < are the latest tool of the DARK side of the NET? ... < ******************************************************************* < * Creative Friendly Technologies 813 980 1317 * < * James Horton, CFTnet Operations horton(a)cftnet.com * < ******************************************************************* It is interesting that if in fact the FCC does forbid encryption of wireless Internet traffic, it opens the way for hacking on a massive scale. -- Jim Dixon

1 0

Re: broadcast encryption
by sidney＠taurus.apple.com 17 Dec '03

17 Dec '03

The idea behind allocating frequencies for amateur use is that hams could engage in a hobby with no commercial use which provides an infrastructure for emergency public service communications. To prevent any commercial use of those frequencies, to facilitate enforcement of the rules, and to facilitate the participation by anyone who obtains the proper knowledge and equipment, it is illegal to transmit in a way that "obscures the meaning" of the transmission to people who would want to listen in. So, for example, morse code and ASCII are the only exceptable digital codes, and various modulation techniques are standardized as the technologies are developed. In any case, the amateur frequencies are specifically reserved for non-private communications and are subject to restrictions that have nothing to do with the terms under which other commercial frequencies are licensed. Those frequencies may be licensed for uses that include private communications of some sort. And, since the regulations are based on the principal that broadcast spectrum is a fixed, limited resource, none of this applies to communications carriers who do not operate by broadcasting over the air. -- sidney <sidney(a)apple.com>

2 1

Remailer traffic analysis foiling
by cjl 17 Dec '03

17 Dec '03

Remailer hackers, I've been thinking about the problem of traffic analysis of anonymous remailers and I have a question to pose to those of you whose thoughts on this topic are "more frequent or fully-formed". Would there be any advantage to giving remailers a MIRV capability? The idea goes like this: The message arrives, the PGP wrapper is removed, the message is scanned for some specific token imbedded in the text (ala Matt Ghio's Cutmarks function). That token is a divider between two outbound messages. These messages are sent along their respective ways. The result is something like a 10K message coming in, and a 7K and a 3K message leaving. If one of these goes to the bit bucket, it is like having added padding stripped off. Alternately they each could be part of the real message, previously split and then sent via different paths to reduce chances of complete message interception. I guess the issues involved are: 1) How difficult would this be to code? [Yeah, yeah "Cypherpunks write code"(TM), but some of us write genetic code, not computer code :-)] 2) What is the credible threat of traffic analysis? a) Does multiplication of messages and their routing schemes create problems of scale for these alleged eavesdropers? b) Do you assume that if it's not a compromised server, that what goes on inside the machine is hidden? Now before the Zippos start flicking, I've followed the the latency vs. reordering argument, and accept that latency *may* acheive reordering, but not necessarily. In this system though, different latencies after the split would seem to acheive something because without reliable size in/out information it would be harder to correlate message in with messages out. Comments (incendiary or or otherwise) requested. C. J. Leonard ( / "DNA is groovy" \ / - Watson & Crick <cjl(a)welchlink.welch.jhu.edu> / \ <-- major groove ( \ Finger for public key \ ) Strong-arm for secret key / <-- minor groove Thumb-screws for pass-phrase / )

2 3

Re: clarification please
by L. Todd Masco 17 Dec '03

17 Dec '03

From: will(a)thinkmedia.com (thinkmedia.com) >> Events like Waco and the Persian Gulf War, in which an >> authoritarian superpower obliterates a mostly harmless and >> largely defenseless group of people, translate with relative ease >> to the cyberspacial realm. > > I remember reading a Scientific American article about two years before > Iraq invaded Kuwait, in which it was made clear Iraq had and were > developing missiles with ranges paralleling only U.S., Russia and China. I > don't think harmless and defenseless quite fits the description. Maybe > wannabe super power would be more accurate. Harmless and defensive is how I would describe the 100s of thousands of civilians masscred by the United States. The really dangerous people were safe inside their bunkers. It's an important point: regardless of the threat that the Iraqi government posed, the US government chose to destory the country rather than making a real attack against only the government. They were able to do this for two big reasons, both directly attributable to political factors (as well as the fact that there is not a large vocal Iraqi population in the US): 1) Very few US lives were lost (the "vietnam/cambodia" lesson) or at risk. 2) The US government managed to make, through direct censorship and disinformation, the US people identify the residents of Iraq with the government of Iraq. Thus, the wholesale bombing of civilian centers that posed no direct to the United States became acceptable as long as it was reported in emotionally comfortable terms. It's really not so different than the War On Some Drugs or half a dozen other power-plays... and this is the propaganda machine that we will have to face if we're unlucky enough that Clinton/Gore actual get their act together enough and get the rest of the government behind them to make a real PR effort (as opposed to the clumsy scare tactics we've soon so far). -- L. Todd Masco | Bibliobytes books on computer, on any UNIX host with e-mail cactus(a)bb.com | "Information wants to be free, but authors want to be paid."

1 0

CIA eating internet email & usenet news
by Arsen Ray Arachelian 17 Dec '03

17 Dec '03

It's started. The >CIA< (nevermind that we suspect the NSA has done this already) admitedly is starting an internet site(s) where they will monitor email and usenet feeds. Supposedly this is for "reasearch" purposes where agents would "post" questions in such a way as to not give away their real questions. See this week's Computerworld. Anyone have a scanner they can post this article up with? I'm not up to typing it... =============================================================================== | + ^ + || ' . . . . . . . Ray (Arsen) Arachelian || | \|/ || . . . ' . ' . : . . rarachel(a)photon.poly.edu || |<--+-->||. . . |' '| .' . . ... ___ sunder(a)intercom.com || | /|\ || . . \___/ . . . : .... __[R] || | + v + || . oOOo /o.O\ oOOo :. : .. |A| "And bugs to kill before I sleep"|| =========/---vvvv-------VVVV------------|I|----------------------------------/ / . : . ' : ' |D| This signature pannel is / / The Next Bug to kill(tm) --- now open. / /___________________________________________________________________/

2 2

Message pool: alt.anonymous.messages
by Rick Busdiecker 17 Dec '03

17 Dec '03

I newgrouped alt.anonymous.messages as a simple implementation of a message pool. I imagine that it will take a while to propagate, but once it's accessible from the mail-to-news gateways, it should serve as a more reasonable place than alt.security.pgp or alt.test for anonymous communication that's less subject to traffic analysis on the recipient side. Rick

1 0