December 2003 - cypherpunks-legacy

Re: Password Difficulties
by smb＠research.att.com 17 Dec '03

17 Dec '03

Figure that each English character has 1.8 bits of entropy. (This is a conservative number, because it doesn't take into account case, spacing, or punctuation.) If I want a passphrase that will map into a 64-bit keyspace, I need at least a 35-chararcter phrase. Don't forget the difficulty of typing such a long phrase, with echoing turned off.

6 5

Blame me! I started the "What motivates crypto-folk" thread
by Sherry Mayo 17 Dec '03

17 Dec '03

I only joined the cypherpunks list a few days ago so 'imagine my surprise' to see that a post I sent to talk.politics.crypto had been forwarded here and was the topic of some considerable debate! I've also had stacks of replies by email, so I thought I should stick my head above the parapet and post here with a few observations. It is self evident from the emails I have received that crypto-use and cypherpunks encompass people of every political stripe. Someone used the phrase 'strange bedfellows' to describe the variety of people on cypherpunks and I couldn't agree more. The majority of people shared a simple desire for privacy, from government snooping in particular. I guess the articles I had read on WWW that lead to my original post were not very representative of crypto-users as a whole. I wasn't really intending to start a political left vs right debate with my post. As many people have pointed out to me, crypto is a neutral tool that can be used by all sorts of people for all sorts of ends. I don't expect to agree politically with all those people any more that I expect to agree with all car drivers (for example). I was just curious that there was an *apparent* trend in the politics of the crypto articles I read - How wrong I was :-) To all those who have replied to me by email, thanks for your views. Sherry Mayo PS. Someone wrote: > > Thanks for your thoughtful comments. However the message was > > not by me but by Sherry May <scmay(a)rschp2.anu.edu.au>. > > Sherry May, Tim's EVIL TWIN? (Or is it the other way 'round?) Ha ha ha this had me ROTFL!!! PPS. Its Mayo - I'm no relation!

1 0

Re: Credit-card PCs exist
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> (That reminds me: does anyone know whether automatic teller > machines are PCs inside?) I should know our cash machine line by now, but anyway... I think ours are basically PCs with OS/2 operating systems; having real multitasking is useful in a communication device, and it's a reasonably flexible environment for adding drivers for miscellaneous peripherals, like cash dispensers. A few years ago I saw a cash machine that was not working, and had a very dos-llike boot error message on the screen. Grocery store aisle signs are often driven by Amigas, and occcasionally have confused-Amiga messages on them. ObCrypto: according to someone on the net, some appallingly large fraction of teller machines don't use encryption on their comm links. (Grocery store signs do just fine without crypto :-), though some of the new radio-transmission shelf price labels might be interesting hacking for somebody with lots of time on their hands.)

1 0

Re: Password Difficulties
by kentborg＠world.std.com 17 Dec '03

17 Dec '03

joshua(a)cae.retix.com writes: >> Hey folks, passwords are hard to choose! > >? What part don't you understand? Give people the opportunity to chose "random" passwords and they choose easily guessed strings. (Well demonstrated.) Tell people to chose a *phrase* and they are going to frequently type "The quick brown fox...". (My assertion.) Your suggestion about rare steak is so long that "normal" people are not going to bother with it. Just getting people to type the 19-characters of "the quick brown fox"--just four words--is going to be hard, and there are not very many bits of information in 4 short common English words--forget that they are a chiche. Besides, your sample phrase might not have as many bits in it as you think. >Rare steak tastes good when it is cooked over a wood fire. better >chicken. better than fish. good with worcestershire sauce. 22 words, a good start. But all will appear in a short dictionary list, 4 gramatical sentences, sentences with related meaning. Not so good. Slightly non-standard capitalization--but only a few bits in that. You suggest a phrase that is going to seem annoying to people raised on 4-digit PINs, yet it still might not have, say, the 128-bits lots of people want. My 128 coin tosses can be roughly turned into 8-words, but out of a much larger word list than your phrase and with no gramatical connections--and hard to remember. Each transformation I might do to those words to help remember them chops off a few of my original bits. By the time I have something my mother is going to bother with there are few bits left. A little brute force and those bits are blown. And why should you care if my mom uses weak keys? Because it will undermine the legal weight of things like digital signatures. Because all communication you have with "normal" people will be nearly in the clear because of their poor security. If you want privacy, you need to help others have privacy. Back to a rephrasing of my original question: should programs like PGP super-duper encrypt the private key (and remove those hints poeple have mentioned recently) as a way of slowing down brute-force attacks? -kb P.S. Remember, even a good hashing algorithm should not be expected to create entropy out of thin air. Too few bits in means too few bits out. Just because I don't know how to analyze those bits does not mean you should be content. -- Kent Borg +1 (617) 776-6899 kentborg(a)world.std.com kentborg(a)aol.com Proud to claim 31:15 hours of TV viewing so far in 1994!

5 4

Cypherpunks of the world unite!
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Michael Wilson <0005514706(a)mcimail.com>: > There is a good reason why revolutionaries in very poor nations tend to > espouse socialist or communist rhetoric--those are political systems that can > raise the quality of life considerably and immediately, I see governments as representing the collective will of society, responsible for only those things that are best achieved through everyone's cooperation. It is now fashionable to talk about the Asian way -- subjugating freedom to prosperity. This is of course bunkum, freedom is an ideal and is universal. The way to get to that may differ from society to society, particularly, as Michael says, in poor nations. It isn't necessary to have a strong state to survive; India, with a similar standard of living in 1950, has been democratic with more or less regular, free and fair elections. Contrary to popular perception, India has been no more 'socialist' than many European countries such as France, with stockmarkets and large state-owned enterprises. It is naturally more difficult to control crime or rising population here than in China, where petty thieves and corrupt officials are frequently executed. Freedom is a right equally applicable everywhere, whatever the political, social or economic situation. Any technology that promotes it is important for the whole world. Cypherpunks of the world unite! You have nothing to lose but your escrowed keychains! ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

2 1

The usefulness of PGP pass phrases
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

tcmay(a)netcom.com (Timothy C. May): > > after you have entered the pass phrase, the secret key is available within > > your machine, and could be stolen, and if your OS leaves pagefiles etc > > arounnd, might even be taken after you shut down PGP. > > Or am I missing something? Thanks, Andy > > I haven't seen a formal analysis of the strength of PGP if the secret > key is known but the passphrase is still secure, but from conventional > crypto we would assume that the search space would be greatly reduced. The secret key is _encrypted_ with the passphrase. Strength of PGP with a known secret keyFILE, not key, and unknown passphrase, is the strength of the cipher used to encrypt the secret key with. In this case, the strength of IDEA. Of course, your pass phrase is as susceptible to dictionary attack as your UNIX password, and it would be easier to decrypt a message by decrypting through such attacks or brute force your keyfile, than to factor large numbers to get at your session key. > You obviously can't do with just the paIn short, these are reasons to keep your secret key secret. Your > passphrase alone may be insufficient (else why not just dispense with > the secret key and just have a passphrase?). RSA would have a tough time using a 11 char English phrase as an exponent ;-) To quote from the PGP manual: PGP also asks for a "pass phrase" to protect your secret key in case it falls into the wrong hands. Nobody can use your secret key file without this pass phrase. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ps. as Tim correctly said, Jains don't like killing living things. They are Jains, not Jainists (followers of some hypothetical Mr. Jain?); the word comes from the Sanskrit for 'to overcome'. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

IS IT POSSIBLE?
by bmorris＠netcom.com 17 Dec '03

17 Dec '03

To: cypherpunks(a)toad.com I've heard rumors through the years that CIA/NSA/whoever can aim a parabolic antenna at your window, read the electronic pulses surrounding your computer, and thusly determine what you are typing. Is there any truth to this? * RM 1.4 B0037 *

3 2

Re: ANI numbers
by ghio＠cmu.edu 17 Dec '03

17 Dec '03

joshua geller <joshua(a)cae.retix.com> wrote: > it doesn't work from LA and I do have AT&T long distance. It works for me and I live in LA (San Pedro, actually). It also worked when I was in Pittsburgh. The number is 1073214049889664 But if you live in the Los Angeles area, you can use PacBell's numbers 1223 or 2112345, or if you have GTE, 114

3 2

PASSWORD DIFFICULTIE
by bmorris＠netcom.com 17 Dec '03

17 Dec '03

To: cypherpunks(a)toad.com KK> 22 words, a good start. But all will appear in a short dictionary KK> list, 4 gramatical sentences, sentences with related meaning. Not so But will a dictionary attack work when the passphrase is multiple words? Because then it would have to try all the words in the dictionary grouped with other worde, and the permutations thus become huge. i.e. "spinachwalrusgazebo" is three words, and to me, would seem immune from a dictionary attack, because the attack only uses single words. Is this right? * RM 1.4 B0037 *

2 1

Clipper = Bobbitized Crypto
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

> I'm not so kind as others on this list. > I think people should live consistent with their philosophy and > what they advocate. Many times arguments are useless and only > experience serves to convince. I wouldn't try to convert another > from their faith just because it would do me good. As long as > it's possible to find alternate methods of doing the same thing > (in this case achieving privacy), I wouldn't try too hard to save > Liberals from themselves. I think they deserve to use Clipper. Consistency with one's own philosophy, huh? I dont see much of that in liberal politics, although maybe to be fair it should be applied to politics in general. Let me cite some examples: 1.) Anti-gun politicians who would regulate away the average citizen's right to self-defense with firearms, but only after they are assured of Secret Service protection, or private bodyguards for themselves. IOW, a level of personal security not affordable to their constituency. Clipper is the personal security equivalent of having to call 911 when threatened and patiently wait for the police to show up to protect you, vs. having a small army of Secret Service agents on call 24 hours a day to spring into action to defend you. 2.) Politicians who accept campaign contributions from teachers' unions, the National Education Association, etc., who vote down any legislation designed to give the average citizen a choice in their child's education, other than the entrenched public school monopoly. Yet, most of these same people put their own kids in PRIVATE schools, financed from tax dollars by the salaries that we pay them. 3.) Politicians who already employ strong crypto, unavailable to the general public, who want to limit the rest of us to "Clipper". All three points apply directly to Clinton, but not exclusively to him, of course. You know, there's just something about the name "Clipper" that conjures up pictures of Lorena Bobbitt... Maybe that's what Clipper really is ... Bobbitized crypto... <g> Anyway, back to your point, the average "liberal on the street" may indeed be stuck with Clipper. And as long as Washington DC is dominated by a single party with a liberal bent, maybe they can convince the rest of their "fellow travellers" that "Big Brother loves you and has a wonderful plan for your life", and thus to accept Clipper and its host of problems. But let liberals lose control of this country, and then watch them change their tune, when the Big Brother technology they put in place is now in the hands of "the other side". Does anyone remember 20+ years ago when the roles were reversed? It was the liberals who were protesting wiretaps, etc. by the Nixon administration? Putting a liberal in the White House somehow "blesses" these same things?

1 0