December 2003 - cypherpunks-legacy

Security is TWO Rubber Stamps
by fnerd＠smds.com 17 Dec '03

17 Dec '03

Ludwig R. Vogel's letter to New York Newsday makes the point, "...Government intercept procedures involving Clipper technology offer users no more protection from wrongful government surveillance than plain text." FBI guys say they only want to keep the abilities they already have. Vogel turns it around: they want to make sure we have no more protection against them than we already have...except for key escrow... America's Bulwark Against Corruption! Every citizen has the right to the protection of Two Rubber Stamps!* So wear your rubber stamps today, America! +----------------------+ | APPROVED FOR WIRETAP++---------------------+ | U.S. Treasury |+APPROVED FOR WIRETAP | +---------------------++ N.I.S.T. | +----------------------+ *Offer void under certain circumstances that cannot be discussed. -fnerd did i get the two agencies right? quote me - - - - - - - - - - - - - - - We shall have to evolve Problem solvers galore As each problem they solve Creates ten problems more. --Piet Hein -----BEGIN PGP SIGNATURE----- Version: 2.3a aKxB8nktcBAeQHabQP/d7yhWgpGZBIoIqII8cY9nG55HYHgvt3niQCVAgUBLMs3K ui6XaCZmKH68fOWYYySKAzPkXyfYKnOlzsIjp2tPEot1Q5A3/n54PBKrUDN9tHVz 3Ch466q9EKUuDulTU6OLsilzmRvQJn0EJhzd4pht6hSnC1R3seYNhUYhoJViCcCG sRjLQs4iVVM= =9wqs -----END PGP SIGNATURE-----

1 0

On encrypted Logins
by Matthew J Miszewski 17 Dec '03

17 Dec '03

Does anyone have information on the actual overhead of encrypted logins. What besides telnetd need be modified, specifically? Jef makes an interesting idea for cost containment. Jef, what exactly would y --Matt ______________________________________________________________________________ In defense of liberty, encrypt for all purposes, civil and professional. In defense of privacy, encrypt all correspondence, personal and professional. In defense of sanity, do not encrypt your dry cleaning invoice! ++++++++--------mjmiski(a)macc.wisc.edu (c)1993

1 0

welp.
by Matthew J Miszewski 17 Dec '03

17 Dec '03

Well now, that message got crunched. I meant to say Jef, what exactly would need to be modified using your monodirictional approach? --Matt ______________________________________________________________________________ In defense of liberty, encrypt for all purposes, civil and professional. In defense of privacy, encrypt all correspondence, personal and professional. In defense of sanity, do not encrypt your dry cleaning invoice! ++++++++--------mjmiski(a)macc.wisc.edu (c)1993

1 0

Insecurity of public key crypto #1 (reply to Mandl)
by hughes＠ah.com 17 Dec '03

17 Dec '03

>Only "sensitive" information is worth encrypting and if you want to >stay out of trouble you don't go giving sensitive information to >someone you don't know. If part of your communications are encrypted and part are not you have sent the message about what information is sensitive and what is not. This difference in encoding is a fir-class message in it's own right. Therefore _all_ communications should be encrypted at all time. It is no argument against the principle that this is difficult to do at the current time. Eric

1 0

Re: low-overhead encrypted telnet
by Jef Poskanzer 17 Dec '03

17 Dec '03

>1) Kerberos *does* work between corporate entities. In practice, no, it doesn't. This is not a technical problem, but it's nevertheless quite real. You will never see inter-realm Kerberos set up at places line netcom, because netcom's sysadmins have better things to do than manage secret keys for every organization that wants to connect. Only a system with completely automated configuration and operation has a chance. >2) Using your example, a user on host A telnets to host B, and from >host B they telnet to host C, if the A<->B link is encrypted, then so >long as the user trusts host B, then A<->C is secure as well (assuming >B<->C is encrypted). Yes, of course, if the A<->B link is encrypted then subsequent logins are secure. The point is to find a way to secure those logins *without* full encryption of the A<->B link. >3) Just encrypting from client->server will not necessarily reduce the >load on the server. In practice, almost all of the time, it will. >Also, doing something like DES is really not a >very high CPU operation, IMHO. Personally I agree with this. Most sysadmins will not. >4) Charon, which is based upon Kerberos, was developed exactly for >this type of problem: you want to authenticate securely over links >which may not otherwise be secure, but you trust the CPU in front of >you! The paper describing Charon is available via anonymous ftp: > ftp://toxicwaste.mit.edu/pub/charon/thesis.ps.Z I'll check this out, but if it's based on Kerberos it's probably useless for the reasons mentioned above. --- Jef

2 1

Re: stego
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Jim Choate's comments on steganography having problems with images that are too complex or too simple were interesting. Obviously, cartoon-like GIFs aren't a good target, though scanned real stuff may be fine. Weather maps cna be good - back when I worked with the things, I found you could really see about5-6 bits worth of depth, and after that it didn't usually look much different - we stole one or two values from the color-map to draw lines on the satellite images to add state boundaries, various data values, etc., but could have stolen the LSB and maybe 7th bit without major loss on cloud-image pictures. (Radar pictures, on the other hand, were almost all black, with one or two other pixel values, compressed to 2% of original size, and would have been useless for hiding anything in.) Bill

2 1

Re: DES Question
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Matthew Ghio writes: > When using DES to encrypt email addresses, the total amount of data to > be encrypted would be only 3 or 4 eight-byte DES blocks. My question > is: Would CBC or CFB really be effective for such a small amount of data Assuming you're using a random initialization vector rather than zeros, yes, CBC or CFB should be quite effective - the first real block is essentially XORed with random junk, though of course if they guess the right key they can check that the block comes out reasonably. But it does prevent a brute-force attack where they decrypt and see if they get ASCII, since they first block is random junk - they're forced to decrypt at least two blocks of data, which is somewhat annoying for brute-force-search machines. Bill

1 0

Re: ditz in office
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

(I voted Libertarian, of course; back in '84 I had wasted my vote on (yuk) Mondale because he was the closest to a credible threat to Reagan, and it only encouraged them to get another useless Democrat the next time. If there hadn't been a Lib running, I would have probably voted for Perot just for the chaos factor, though I didn't particularly trust him.) I had, however, hoped that Clinton, as a tax&spend Democrat, would at least bring in some of the Liberal virtues along with the Liberal vices, which would be better than a George Bush who had the vices of the conservatives with none of the virtues. Unfortunately, I've been disappointed, in spite of how low my expectations already were :-) Somebody who favors national ID cards, concentration camps for non-violent political offendors, allowing the Federal cops to burn down the homes of uncooperative religious groups if they won't surrender, restrictions on free speech to keep the cops happy, wiretaps for everyone, and stuff like that is *clearly* no liberal. Some columnist, probably George Will, described him as a "passionate hypocrite", which seems to fit reasonably well. I'd hoped for someone genuinely passionate about something, and I don't see that in him. (Nobody could describe George Bush that way, of course, since the man's clearly not passionate about anything....) Bill Stewart, ranting about politics again....

1 0

Applied Crypto
by fhalper＠pilot.njin.net 17 Dec '03

17 Dec '03

Does anyone know if Project Guttenberg(or anyone else) has electronic books such as applied cryptography? Thanks, Reuben Halper

3 2

Re: Dorothy Denning
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

I objected to Anthony Ortenzi's article on Dorothy Denning. Much of the attacks seemed appropriate for a politician like Clinton (:-)), but aren't appropriate for an academic who's doing politics about technical areas, where there so much more *useful* ways to flame her ideas, rather than her character. > Number 1, if someone is an encryption expert [...], why would they endorse > anyone but the recipient being able to decode the message? You're confusing technical tactics with political/social goals. She's an expert in what you can do with encryption, she just has different values about who should be able to benefit from it and how. > Number 2. [Newsday...] > The argument was just very, well, flimsy is the word I guess. I thought so too. Part of it was from writing for a non-technical audience, but some of her arguments have been appallingly weak. El Rukn was a particularly bad example :-), and as you say, it would be nice if she'd just come out and say the government should spy on all of us to keep us from doing Bad Things; it's an argument people can relate to and discuss (though it'll get a lot of negative reaction, which is not her objective.) > Anyone know: > A) Is she an expert in cryptography? Yes - her book from the early 1980s was *the* standard text on crypto for quite a few years, and she's published some other reasonable papers. Dr. Denning is department head of CS or EE or something at Georgetown. > C) Was she dropped on her head a lot as a baby? Probably got scared by a Commie Terrorist Drug Dealer, and comforted by some friendly federal police officer... or else was educated in government-run schools. :-) > Also, I've gotten a message through to Ross Perot about our fight > against Clipper, and how to reach me, so if I get a response, I'll let Clipper sounds like just the kind of thing Perot would enjoy. Bill

5 4