December 2003 - cypherpunks-legacy

Re: The Bank of the Internet!?
by lefty＠apple.com 17 Dec '03

17 Dec '03

Harry S. Hawk writes: > >I don't, however, see how any of this could impact a simple credit >union type bank opperated over the Internet. I would be surprised to discover that running a bank "over the Internet" didn't stand a fair chance of running afoul of interstate banking laws... -- Lefty (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

2 1

Re: PGP misunderstanding
by M. Strata Rose 17 Dec '03

17 Dec '03

Derek writes: And just what is the point of an encrypted newsgroup? What key(s) would you use to encrypt the messages, and why? I would create a pair of keysets, VCNPoster and VCNReader and have both the public and private keys accessible via finger. The outbound news would be encrypted as if these two nyms were exchanging messages. It's not a security thing, it's just that people who won't bother to learn how to use the technology won't be able to read or post there. That will be enough incentive to get another class of folks using it, IMHO. _Strata M. Strata Rose Unix & Network Consultant, SysAdmin & Internet Information Virtual City (TM) Network strata(a)virtual.net | strata(a)hybrid.com | strata(a)fenchurch.mit.edu

1 0

whoops!
by jet＠netcom.com 17 Dec '03

17 Dec '03

I just sent mail saying I had 1/72 of 2^56 bytes of storage. I was wrong, it seems I dropped 'a few' zeros. In reality, there's 1/72057th or so next door. That's a bit different than 1/72. Never mind,

2 1

Re: Breaking DES
by an41418＠anon.penet.fi 17 Dec '03

17 Dec '03

I am sorry to have asked two questions in my original post. A few people have made me aware of the reason for encrypting EDE in triple DES for backward compatability and the issue of whether or not DES is a group. So, I'd like to redirect this thread to my other question: My understanding of how an exhaustive search on the key space can be used to break DES is that for every key, K, D(K,Cipher) is applied until the output matches something legible. Say that some random string, to be thrown out, is added to the beginning of the plain text, and that DES is applied in cbc mode, then how could such an attack work? My point, I don't see how DES can be broken if the initial block is a grabage block, and cipher block chaining is used. Please enlighten me (gently). Wonderer ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Re: Security through obscurity
by an38793＠anon.penet.fi 17 Dec '03

17 Dec '03

> You are not going to be able to keep your algorithm secret, period. > Those who are determined enough will be able to dig it out of any > programs or chips you use to implement your algorithm. Security through > obscurity is stupid because no matter how smart you may think you are > in hiding your method, there is always someone smarter who will dig it > out and changing technology constantly lowers the barrier of how smart > people need to be to dig information out of old locks using new tools. I agree with this 100%. The interesting fact is, a lot of commercial programs rely on security through obscurity. Often, anyone who takes the time to disassemble the interesting routines, can crack the encryption. Yes it is stupid. But, a lot of people and companies rely on "security through obscurity" to protect their applications/data. Part of this is due to export restrictions, but a large part is just due to lack of awareness. One of my favorite applications has embedded in its license agreement: "...nor shall the Licensee attempt to decrypt any Passwords that may enable the Software's functionality..." This is not a substitute for real security. ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Re: Breaking DES
by smb＠research.att.com 17 Dec '03

17 Dec '03

My understanding of how an exhaustive search on the key space can be used to break DES is that for every key, K, D(K,Cipher) is applied until the output matches something legible. Say that some random string, to be thrown out, is added to the beginning of the plain text, and that DES is applied in cbc mode, then how could such an attack work? My point, I don't see how DES can be broken if the initial block is a grabage block, and cipher block chaining is used. Please enlighten me (gently). The decryption equation for CBC mode is P[n] <- D(C[n]) ^ C[n-1] In other words, decrypt the current ciphertext block, and XOR with the previous ciphertext block. Note carefully: the previous ciphertext block. That implies that you can start at any point in the string and do your decryption. You don't have to know the plaintext of the previous block to proceed, which is what you're implying. The property of CBC mode is related to its error propagation character- istics, which are important in some environment. Suppose that ciphertext block C[n] is garbled, either by a bird sitting on a phone line or by hostile action. That will garble two blocks of output: P[n] and P[n+1]. (Derivation is left as an exercise for the reader.) But P[n+2] will be decrypted properly, since it depends on P[n+1] and P[n+2]. (N.B. I'm deliberately ignoring insertion/deletion errors. If those are a concern, use CFB mode.) In accordance with my usual habits, I'll cite an excellent reference on how to use cipher systems, and what the properties of the different encryption modes are: @book{daviesprice, author = {Donald W. Davies and Wyn L. Price}, edition = {second}, publisher = {John Wiley \& Sons}, title = {Security for Computer Networks}, year = {1989} } Bruce Schneier's excellent book ``APPLIED CRYPTOGRAPHY: PROTOCOLS, ALGORITHMS, AND SOURCE CODE IN C'' is due out next month; it covers this, too. (I'll forbear to cite my own book till it's nearer completion...)

1 0

Re: Cypherpunk Cause
by msattler＠netcom.com 17 Dec '03

17 Dec '03

At 12:10 93/10/10 -0400, Perry E. Metzger wrote: > >If you want to spew nonsense, please do so on one of the politics >newsgroups. This is for cryptography discussion. (Donning asbestos undies...) This kind of knee-jerk reaction dismays me. My response *was* about cryptography. Perhaps the following test would prevent you from (1) wasting bandwidth and (2) turning off people who are trying to put the flood of crypto info into perspective: "Does this email add any value to the discussion?" Give the rest of us a break; your usual postings are worth reading. ----------------------------------------------------------------------------- Michael S. Sattler msattler(a)netcom.com +1 (415) 358-3058 Digital Jungle Software Encrypt now; ask me how. (finger for PGP key) All that is required for evil to triumph is for {wo}men of good will to do nothing.

1 0

Re: Breaking DES
by doug＠netcom.com 17 Dec '03

17 Dec '03

pmetzger(a)lehman.com said: >Karl Lui Barrus says: >> plaintext with 2^56 keys, and decrypt the ciphertext with 2^56 keys. > >Tell you what, Karl -- when you build the device that can store 2^56 >encryptions, let us know. 2^56 bytes equals 10^7 gigabytes. At roughly $1000 per gigabyte, that equals 10^10 bucks...10 billion dollars. Or say there's a quantity discount in orders totalling a million units, and you get the whole capacity for 1 billion dollars. Well, that's a bit steep for me, but there's no question but that the NSA could afford it. Still, what do you say I wait a few years until it comes down to 10 million dollars, which I happen to have available in the year 2003 in my company budget? Ten years should do it, estimating conservatively. > Also let us know how you'll index and fetch the encryptions >in any reasonable time while you are at it, but by comparison thats a >tiny problem. That ten years also means that rather than searching 10^7 units in parallel, we will then be searching only 10^5 units in parallel. It'll still take a few hours, but that's ok. This all suggests that the NSA could do such a thing *now* if they *really* cared to, and could do so fairly trivially in 10 years. >> The work for this attack is 2^56 + 2^56 = 2^57, which suggests that >> double encryption doesn't increase the complexity of breaking your >> text very much. > >Karl, are you sure that you want people to think you believe this? I did a double take on this at first too, since naively one would expect the search to be (2^56)^2. However, this can be improved, for instance by sorting each set in N lg N time (56 * 2^56 operations), and then doing interleaved comparisons in N lg N time again, which can be mostly parallelized over those 10^5 computers that are running those 10^5 disks, so that the total time would be (since 10^16 = 2^56) 10^16 / 10^5 machines = 10^11 cycles, and given 10^3 MIP machines, this gives 10^4 seconds (20 minutes) for each phase...call it an hour total. (In other words, as a first approximation, Karl is accurate to assume linear rather than quadratic speed for this.) This neglects coordination of the networked machines, which one might expect to add a factor of 5 to 10 to those numbers. This rough analysis demonstrates that Karl's scenario is merely expensive now, and "cheap" (by NSA standards) ten years from now, rather than completely inconceivable. I guess the weakest point of the above back-of-the-envelope estimate is that each e.g. plaintext & cyphertext is assumed to be representable within one byte, but that's *not* fatal. You could use hashing to get down to one byte, and when a hit is detected, try again using two bytes. When hits are detected there, use four bytes...and so on. That approach allows the real world scheme to be reasonably close to the back of the envelope gross assumptions. Doug

2 1

CPSR Alert 2.03
by Dave Banisar 17 Dec '03

17 Dec '03

CPSR Alert 2.03 ============================================================= @@@@ @@@@ @@@ @@@@ @ @ @@@@ @@@@ @@@@@ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @@@ @ @@@ @@@@@ @ @@@ @@@ @ @ @ @ @ @ @ @ @ @ @ @ @ @@@@ @ @@@ @ @ @ @ @@@@ @@@@ @ @ @ ============================================================= Volume 2.03 October 12, 1993 ------------------------------------------------------------- Published by Computer Professionals for Social Responsibility Washington Office (Alert(a)washofc.cpsr.org) ------------------------------------------------------------- Contents [1] Administration Continues NII Initiative [2] White House Announces New FOIA Procedures [3] Health Care and Privacy [4] CPSR Panel on Medical Privacy [5] CPSR Annual Meeting - October 16-17 [6] New Documents in the CPSR Internet Library [7] Upcoming Conferences and Events ------------------------------------------------------------- [1] Administration Continues NII Initiative Following the announcement of the "The National Information Infrastructure: Agenda for Action" in mid-September, the Administration is pushing forward the NII program. An open forum was held at the Department of Commerce at the end of September with high ranking officials, private sector representatives, and public advocates exchanging views on the NII program. The National Telecommunications and Information Administration is planning a series of hearings later this year on an updated concept of "universal service," and the Information Infrastructure Task Force working group on privacy has already held several meetings to examine privacy implications of the NII program. To obtain a copy of the NII report, FTP the document from ftp.ntia.doc.gov. Log in as "anonymous" with the password "guest" and change to directory "pub." Retrieve "niiagenda.asc." (The document is also available from the CPSR FTP site). CPSR will be submitting formal comments on the NII program later this month. To send comments directly to the administration, send email to nii(a)ntia.doc.gov. ------------------------------------------------------------- [2] Clinton Issues FOIA Directive Noting that "openness in government is essential to accountability," President Clinton issued a memorandum to all federal agencies on October 4 directing them to comply with "both the letter and spirit" of the Freedom of Information Act (FOIA). Clinton noted that the FOIA "is a vital part of the participatory system of government" and stated that "I am committed to enhancing its effectiveness in my Administration." The President also urged federal agencies "to enhance public access through the use of electronic information systems." The Clinton memorandum is a marked departure from directives issued during the Reagan and Bush Administrations, when most official pronouncements on FOIA tended to discourage agency disclosures. Attorney General Janet Reno simultaneously rescinded the Justice Department's 1981 guidelines for the defense of federal agencies in FOIA litigation. Under those guidelines, issued in the early months of the Reagan administration, the Department defended agency decisions to withhold information if there was merely a "substantial legal basis" for the withholding. Under the new Reno guidelines, the Department will only defend FOIA actions in which agencies can demonstrate that disclosure would result in some specific harm. Under the new policy, "Where an item of information might technically or arguably fall within an exemption, it ought not to be withheld from a FOIA requester unless it need be." The Attorney General directed that all pending FOIA cases be reviewed to determine compliance with the new policy and also called for a government-wide review of processing "backlogs" that have resulted in substantial delays in the disclosure of requested information. CPSR has several FOIA cases pending in federal court and has long urged that the federal information disclosure process be reformed to maximize the disclosure of requested agency records. The NII initiative also provide an opportunity to improve citizen access to government information. A copy of the White House and Atty General's memos is available at the CPSR Internet Library /cpsr/foia/clinton_foia_10_93.txt. ------------------------------------------------------------- [3] Health Care Reform and Privacy The recently released President's Health Security Plan includes important new provisions on privacy protection. The plan recommends new federal legislation based on a Code of Fair Information Practices. Currently, there is no federal protection for medical records. The new proposal also includes a provision for a national medical identity card, which is described in the plan as "like ATM cards, the health security card allows access to information about health coverage through an integrated national network. The card itself contains a minimal amount of information." President Clinton was asked about the privacy implications of the medical security card at a town hall meeting in Sacramento, CA on October 4. He replied that the card will be used to ensure that in an emergency that a person could be identified and that it "will have the same sort of protections that a Social Security card would..." He recalled opposition to the past attempts to expand the use of the SSN and noted that the card was only "for the purposes of establishing that you belong to the health care system." Another important aspect of the proposal is the identifying number. The proposal calls for the establishment of "a system of universal identifiers for the health care system." The proposal notes that "The unique identifier may be the Social Security Number or a newly created number limited to the health care system...In either case, the national privacy policy explicitly forbids the linking of health care and other information through the identification number." This will be determined by the National Health Board. In April 1992 CPSR sent a letter to Hillary Clinton with the endorsement of over two dozen privacy and computer experts requesting that the SSN not be used as the identifier. The letter cited privacy, security, and fraud problems and pointed out that other countries, such as Canada, have created limited purpose identifiers for medical record information. Other Privacy Provisions o The creation of mechanisms for effective enforcement including significant penalties. o Establishing a privacy framework based on the Code of Fair Information Practices including a right to know about and approve the uses of the data, assurance of no secret data systems, right to review and correct data, assurances that the data is only collected for legitimate purposes. o Issue effective security standards and guidance for health care information o Establishing as Data Protection and Security Panel to set privacy and security standards and monitor implementation of the standards, sponsor of conduct research, studies and investigations, and developing of fair consent forms. The relevant privacy provisions of the health care plan are available at the CPSR Internet Library /medical_privacy/ clinton_health_reform_plan.txt. A copy of the letter sent to Hillary Clinton is also available as hillary_letter.txt ------------------------------------------------------------- [4] CPSR Panel on Health Care and Privacy CPSR Annual Meeting - Sunday Evening - Special Session - Free to the general public 7:30 - 9:30 Special Panel Discussion "Health Care Reform and the National Information Infrastructure: Opportunities and Risks" The White House Task Force on Health Care reform has called for the development of community-based health data-management systems. A working paper from the task force notes: "Workgroup has vision for a community health information systems (CHIS) based on a computerized medical record. The CHIS will link all key parties in the healthcare delivery systems and service all their clinical and administrative requirements." The task force has estimated that the following areas: 1. Medical Electronic Data Interchange networking 2. Community Health Information Networks 3. Outcomes Analysis and 4. Computerized Patient Records. offer the near term potential (less than 5 years) to save 100 billion dollars a year via the development of standards, administrative reform, and federal leadership in using the existing networking infrastructure to promote electronic medical commerce. However, with these opportunities for improved efficiency and cost containment come risks - specifically privacy and access. The panel will include experts in medical information systems and privacy advocates. Come and learn about this important area. Join in this national discussion. Be part of the solution. Panelists: Richard Reuben, Executive Director, Foundation for Healthcare Quality Lance Heineccius, Director of Policy, Washington Health Services Commission David Flaherty, Information and Privacy Commissioner, British Columbia Irwin Goverman, CIO, Group Health Cooperative This special event is free and open to the public. It will be held in Kane Building room 210, University of Washington ------------------------------------------------------------- [5] CPSR Annual Meeting - October 16-17 COMPUTER PROFESSIONALS FOR SOCIAL RESPONSIBILITY ANNUAL MEETING October 16 - 17, 1993 University of Washington, South Campus Center Seattle, Washington, USA Envisioning the Future: A National Forum on the National Information Infrastructure and Community Access The National Information Infrastructure (NII) is the proposed medium or "electronic highway" that will connect schools, libraries, government agencies, and citizens using state-of-the-art computer and communications technology. Media, computer, and telecommunications companies are also acutely interested in the NII as it dramatically increases their opportunity for delivery of communication, services, and entertainment. CPSR is convening this meeting for both computer professionals and the informed public to discuss the broad range of choices facing society regarding the NII. Saturday, October 16 Keynote Address - Bruce McConnell, Office of Management and Budget "Shaping National Information Infrastructure Policy" Bruce McConnell, Chief of Information Policy at the Office of Information and Regulatory Affairs in the Office of Management and Budget (OMB), will present his views on the major NII issues now facing the administration. He has been with OMB since 1985 and became head of Information Policy in 1992. He now chairs the inter-agency task force responsible for developing federal information policy for the Information Infrastructure Task Force. Other Panels: "Public Access to Internetworks" Public access to the Internet (and other major networks) is a critical issue in any discussion about an "electronic highway". Panelists representing a wide variety of perspectives, including representatives from the Pacific Northwest, will present their views. "Municipal Information Infrastructure" City and other government agencies are exploring possibilities for developing municipal networks. In this panel a city official as well as a representative from the state regulatory agency and a representative of commercial interests will offer their insights and interests. "Networking in the Community" Community networks exist and are being developed all over the U.S. Panelists from various community networks will present their perspectives on the state of community networking now and in the future. "Computers and Democracy - What's the Connection?" How might computers facilitate the democratic process? How might they pervert it? "Electronic Democracy" is currently in the public eye and aspects of it will probably be tested soon. What can be done to promote wise uses of computers in this critical area? + Presentation of the 1993 Norbert Wiener Award to The Institute for Global Communications (IGC) + Banquet Address and Interactive Event - Kit Galloway, Electronic Cafe International Kit Galloway of Electronic Cafe International in Santa Monica, California will present his innovative approach to electronic communication using phone lines, slow-scan television, and other technology. Using videotapes and a live demonstration with CPSR chapters in Los Angeles and other locations, Kit will discus how the Electronic Cafe concept has been used in a variety of settings. Electronic Cafe International has staged global events with poets, children, and communities in France, Nicaragua, Japan, as well as a variety of American cities. Sunday, October 17th The second day of the conference will feature a more interactive format including several workshops, a discussion of CPSR's NII vision, and a special - free and open to the public - panel discussion on "Privacy Implications of Health Care Reform" Sunday evening. Gender Relations in Networking Information Policy: A Framework for Action Computer Professionals and Social Action Towards Participatory Design of Community Oriented Systems and Services CPSR NII Vision Document Discussion "Health Care Reform and the National Information Infrastructure: Opportunities and Risks" For more information, contact the National Office at cpsr(a)cpsr.org, or Aki Namioka, Annual Meeting Chair, at aki(a)cpsr.org. ------------------------------------------------------------- [6] The CPSR Internet Library Nearly 40 people who submitted comments to NIST have forwarded their remarks to CPSR. These comments are now archived by last name in /crypto/clipper/call-for-comments/ Submit your comments to clipper(a)washofc.cpsr.org Dr. Dorothy Denning and several law enforcement officials have prepared a paper on the law enforcement perspective on wiretapping and procedures need to obtain permission for conducting a wiretap. /communications_privacy/wiretap/denning_wiretap_procedure.txt The CPSR Internet Library is available via FTP/WAIS/Gopher from cpsr.org /cpsr. Materials from Privacy International, the Taxpayers Assets Project and the Cypherpunks are also archived. For more information, contact: Al Whaley (al(a)sunnyside.com) ------------------------------------------------------------- [7] Upcoming Conferences and Events "Universal Service: New Challenges and New Options in Tomorrow's Network of Networks." Sponsored by the Benton Foundation & the Columbia Institute for Tele-Information. Washington, DC October 15. Contact: Andy Blau (ablau(a)cap.gwu.edu) CPSR Annual Meeting, "Envisioning the Future: The National Information Infrastructure and Local Access." Seattle, WA. October 16-17, Contact: Aki Namioka (aki(a)atc.boeing.com) "International Symposium on Technology and Society '93." Washington DC. October 22-23. Deadline for submission: February 28. Contact: m16805(a)mwvm.mitre.org. "Technology: Whose Cost?. . .Whose Benefits?" Sponsored by IEEE, George Washington University, MITRE. Washington, DC. October 22-23. Contact: wjkelly(a)mitre.org "Cyberculture Houston 93." Houston, Tx. December 10-12, Contact: cyber(a)fisher.psych.uh.edu "Computers, Freedom and Privacy 94." Chicago, Il. March 23-26. Sponsored by ACM and The John Marshall Law School. Contact: George Trubow, 312-987-1445 (CFP94(a)jmls.edu) DIAC-94 "Developing an Effective, Equitable, and Enlightened Information Infrastructure." MIT Media Lab, Cambridge, MA. April 1994 (tentative). Contact: Doug Schuler (douglas(a)grace.rt.cs.boeing.com) 5th Conference On Women Work And Computerization "Breaking Old Boundaries: Building New Forms." UMIST, Manchester, UK. July 2-5. Abstracts by 10/1/93. Contact: Andrew Clement (clement(a)vax.ox.ac.uk) (Send calendar submissions to Alert(a)washofc.cpsr.org) ============================================================== To subscribe to the Alert, send the message: "subscribe cpsr <your name>" (without quotes or brackets) to listserv(a)gwuvm.gwu.edu. Back issues of the Alert are available at the CPSR Internet Library FTP/WAIS/Gopher cpsr.org /cpsr/alert Computer Professionals for Social Responsibility is a national, non-partisan, public-interest organization dedicated to understanding and directing the impact of computers on society. Founded in 1981, CPSR has 2000 members from all over the world and 22 chapters across the country. Our National Advisory Board includes a Nobel laureate and three winners of the Turing Award, the highest honor in computer science. Membership is open to everyone. For more information, please contact: cpsr(a)cpsr.org ============================================================== CPSR MEMBERSHIP FORM Name ______________________________________________________________ Address ___________________________________________________________ ___________________________________________________________ City/State/Zip ____________________________________________________ Home phone _____________________ Work phone _____________________ Company ___________________________________________________________ Type of work ______________________________________________________ E-mail address ____________________________________________________ CPSR Chapter __ Acadiana __ Austin __ Berkeley __ Boston __ Chicago __ Denver/Boulder __ Los Angeles __ Madison __ Maine __ Milwaukee __ Minnesota __ New Haven __ New York __ Palo Alto __ Philadelphia __ Pittsburgh __ Portland __ San Diego __ Santa Cruz __ Seattle __ Washington, DC __ No chapter in my area CPSR Membership Categories __ $ 75 REGULAR MEMBER __ $ 50 Basic member __ $ 200 Supporting member __ $ 500 Sponsoring member __ $1000 Lifetime member __ $ 20 Student/low income member __ $ 50 Foreign subscriber __ $ 50 Library/institutional subscriber Additional tax-deductible contribution to support CPSR projects: __ $50 __ $75 __ $100 __ $250 __ $500 __ $1000 __ Other Total Enclosed: $ ________ Make check out to CPSR and mail to: CPSR P.O. Box 717 Palo Alto, CA 94301 ------------------------ END CPSR Alert 2.03-----------------------

1 0

Arizona state email...privacy
by Gary Jeffers 17 Dec '03

17 Dec '03

Netsurfer, "Why is State property theft?" More precisely, I should have said that govt. property is extorted rather than stolen. In a democracy, the sham that taxes are sanctioned by the people is used to justify state extortion of wealth - taxation. Right now, full taxation is approx. 45% of U.S. wealth. I don't remember giving anybody the ok to take this giant amount of money for state purposes. Even if most people would assent to 45% taxation, there would be a large minority that would not. Also, we don't agree where the money should be spent. In this giant representative democracy, policy seems to be determined by a huge number of minorities instead of a majority. Each lobbying group, minority political group, & ruling elite gets legislation & policies that favor their interests. For that reason, we are governed by huge numbers of special interests rather the "common good" as willed by a majority. For that reason, we don't even meet the criteria of majority rule. Not that I see any right that a majority has to rule us. As generally a Liberterian & specifically an Anarchist, I don't agree to be ruled. PUSH EM BACK! PUSH EM BACK! WWWAAAYYY BBBAAACCCK! BBBEEEAAATTTT STATE! Gary Jeffers

1 0