December 2003 - cypherpunks-legacy

Re: Classified Data on Unclassified machines
by Jeff Gostin 17 Dec '03

17 Dec '03

snyderra(a)dunx1.ocs.drexel.edu (Bob Snyder) writes: > In theory, anyway. I do know of classified data having been on > unclassified machines before, generally by accident. Comes from the fun > fact that unclassified datum A + unclassified datum B can = classified > data C. So true! A popular example of this is the following: Classified Fact: The Government is funding a new supersonic jet project. Unclassified Fact: Boeing was awarded a new contract from the Government. Unclassified Fact: Boeing purchased 17.34 tons of titanium alloy. Unclassified Fact: Titanium is commonly used in supersonic jets. .:, the govie awarded Boeing a Supersonic Jet contract. --jeff -- ====== ====== +----------------jgostin(a)eternal.pha.pa.us----------------+ == == | The new, improved, environmentally safe, bigger, better,| == == -= | faster, hypo-allergenic, AND politically correct .sig. | ==== ====== | Now with a new fresh lemon scent! | PGP Key Available +---------------------------------------------------------+

1 0

RE: PGP bastardization
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

> You may be correct in that Phil Zimmermann has no legal > recourse, but I counldn't say for sure. I am more concerned > with the ethical issues. What have you called your new > super-duper pgp? If you make it abundantly clear that it is > *your* hack of pgp, and not supported in any way by RSA, MIT, or > prz, I personally wouldn't have a problem with it. Isn't it ironic, though, that Phil Zimmerman was the victim of a similar accusation by PKP/RSA -- "pirating" code? IMHO, that's also who the person who released this new version really needs to worry about. If they modified PGP 2.3a code, then they're in the same boat as PRZ if they distribute it. The GPL only covers PRZ's (and Colin Plumb's) code, not the RSA routines. Also, I wonder whether the RSAREF license on 2.6 is valid for modified versions? Geeez! If it's just the name, then call this newest version "TAP" for "Totally Awesome Privacy", or something similar. Just so the "look and feel" are the same. Nothing would stop the end user from renaming it from TAP.EXE to PGP.EXE, of course... <g> I can sympathize with PRZ in wanting to protect his "baby" from the hackings of "unwashed Philistines" or whatever, but had he taken that attitude regarding the original RSA code, PGP might never have come about.

2 1

Key length security (calculations!)
by doug＠OpenMind.com 17 Dec '03

17 Dec '03

Tim Mays writes: >I refer readers to the sci.crypt FAQ, the RSA FAQ, or books such as >"Applied Cryptography." (Hint for those who don't want to: one time >pads (Vernam ciphers) and things like RSA with 1000-digit moduli.) > >("Enough effort" can be interpreted in a circular way to ensure the >answer is 'Yes," as a truism. This is meaningless, if "enough effort" >is impossible to achieve, as with OTPs, or is beyond the energy in the >universe. If "enough effort" is interpreted to mean theft or rubber >hose crytanalysis, all bets are off. But most people who ask the >question I cited don't mean these loopholes.) I have seen Tim posting statements to this effect many times, and because he is one of the more well respected and listened to voices on the list, I feel it important to examine this in some detail. While I agree that 1000 bit moduli in RSA is adequate protection *in all probability*, for even national security secrets, I think it is far from clear that this will definitely be true 10, or even 5 years from now. Instead of just waving vague generalities around, though, let's do some nitty gritty calculations: The people who cracked RSA-129 themselves have stated that they believe a 1024 bit modulus is at most 20,000 to 2,000,000 times more difficult to crack than RSA-129. For example, I recall Derek Atkins posting that he estimated a 1024 bit key to be 40,000 times harder than a 512 bit key, although I didn't save the posting. And Paul Leyland of Oxford posted: >RSA-129 is 425 bits; rather harder than 384-bit numbers. We estimate >that 512-bit keys are about 20 times harder than RSA-129, if a more >efficient but available algorithm is used. No-one knows how much >harder 1024-bit numbers are, but they will be no where near a trillion >times harder than 384-bit keys. Best estimates suggest that 1024-bit >numbers are about 10^4 to 10^5 times harder than 512-bit numbers. OK, so the people in the civilian world working on this today say it is possible that a 1024 bit key is only 20,000 times harder than RSA-129 *using known algorithms*. Now let's really get our hands dirty: cracking RSA-129 was estimated to take 5000 mips years. The NAL NWT 2/140 computer installed at the National Aerospace lab in Tokyo is estimated at 357 Cray YMP equivalents. I estimate this to be equivalent to 200 Gips for the purposes of this computation (this is possibly where I am most off). 5000 mips years = 1.58 X 10^17 instructions. This comes out to 9.13 days on the NAL NWT 2/140. If my estimates above are correct, scaling up to the 7400 Cray equivalent computer due to be installed 4Q95, from the 357 Cray equivalent above, we go down to 10.5 hours. This is all for the RSA-129, of course. Still sounds pretty safe so far... if it really takes at least 20,000 times as long to crack a 1024 bit modulus, then it would still take the 7400 C.E. (Cray Equivalent) computer 24 years to crack a 1024 bit number. BUT, the biggest worry is that no one knows how good the NSA's factoring algorithms are. I read recently that the NSA is the world's largest employer of mathematicians. The relative improvement in factoring algorithms since the introduction of the RSA-129 problem, to its factoring almost 20 years later, far exceed even the exponential increase in computer speed over that same period of time. (5 orders of magnitude? more?) We have no way of knowing how many orders of magnitude leeway we have, because as the moduli get larger, the factoring algorithm gets more and more important. Suppose the NSA has four orders of magnitude on us in the efficiency of their factoring algorithms. In that case, they might be able to crack a 1024 bit key as early as the end of 1995. (20,000 X 10.5)/10^4 hours = 21 hours required). Granted, this may not be likely, but I think we have to take the possibility seriously. At this point, 1024 bit keys cease to be secure for matters of critical national security (but still good for everything else). Now let's continue with our worst case scenario... suppose that computer speed doubles every 3.3 years over the next decade, and that further algorithmic breakthroughs continue to at least match this rate of doubling (not likely, perhaps, but *possible*). Then just one decade later, in 2005, the computer power of the NSA is 8 times greater, and the algorithms are 8 times faster, for a total speed increase of 64. At this point, they could crack a 1024 bit key in just 20 minutes (using all their resources), or 72 keys per day. At this point, I start to be uncomfortable trusting my security to a 1024 bit key length. So, it seems *possible*, even if by no means probable, that a 1024 bit key length is only good for the next decade or so. My intent is not to foster paranoia, but cypherpunks, of all people, should take as critical a view of key length security as possible. I suggest that people who state that the want 1200 bit or even 2000 bit key sizes in PGP be no longer ridiculed... the issue is subjective, as we have no way of knowing what the NSA's factoring algorithms are like. Doug ___________________________________________________________________ Doug Cutrell General Partner doug(a)OpenMind.com Open Mind, Santa Cruz ===================================================================

6 7

Re: Key length security (calculations!)
by rjc＠gnu.ai.mit.edu 17 Dec '03

17 Dec '03

James Donald writes: > Timothy C. May writes > > ... if P = NP, then fast factoring > > methods may be found (fast = polynomial in length). > > In the highly unlikely event that P = NP then we have also solved, as > an almost trivial special case, the problems of true artificial > intelligence, artificial consciousness, and artificial perception, > and the failure of one particular form of crypto will not be noticed > in the midst of such radical changes. When was AI proved NP? AFAIK, definitions of intelligence and consciousness aren't even generally agreed on. Consciousness especially. Any citations on this claim? The only place I've heard this before was your claim on the Extropians list last year that AI required solving NP problems (and that a good answer would not work), therefore classical computers couldn't do it, but quantum computers could, and therefore the mind is based on quantum mechanics and AI won't work.

2 1

Re: ID card from hell
by frissell＠panix.com 17 Dec '03

17 Dec '03

>I basically agree with Duncan's noble sentiments. I just don't think >it likely that the "What about the tourists?" argument will stop the >national ID juggernaut once it begins to move. > The grim necessity of working for a living precludes a proper answer at this time. For now though: "You can buy heroin in maximum security prisons." Controls don't always work. DCF "Eudora for Windows addict since approximately 9:05 this morning."

8 8

National I.D. Cards
by Brian D Williams 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- It would seem we are missing a point about having National I.D. cards. The rest of the world seems ready to rush in and adopt some form of "Clipper" chips to monitor their own citizens. (There doing it in the U.S.!) Do we really doubt they will adopt "The Card" as well? (don't leave home without it!) Step 2: International I.D. Cards...... Can you say "New World Order?" Sure you can....... Brian Williams Extropian Cypherpatriot "Cryptocosmology: Sufficently advanced communication is indistinguishable from noise." --Steve Witham "Have you ever had your phones tapped by the government? YOU WILL and the company that'll bring it to you.... AT&T" --James Speth -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLiWevNCcBnAsu2t1AQGhTQP/dOf1vfVoUs2wfXz70lPQ6WkwePzQCUPA prtlzzhJaJllobpM9cKUDL3x1Zx8BCV9+ebcgaZ62xDDHoGtK6K9l8RAPy/x5m5p QA+vV3Jgi0qI9UKRx4MOozaH6O2FhU6+4QgfWgE270yd4gv69cRHTEaiSB9Nfd7T KUvrt0g5b2c= =3fAd -----END PGP SIGNATURE-----

2 1

National ID Card Info Request...
by Jim choate 17 Dec '03

17 Dec '03

Hi All, Several of my more politicaly active friends are interested in starting a lobby group (if feasible) in the ctl. Texas area on this issue. I wandered all over WWW, gopher, etc. last evening trying to find the specific bill which covers this. I found *lots* of references to comprehensive plastic data-cards and smart cards. I would appreciate some kind sould e-mailing me the bill name which has this in it. Take care.

1 0

INFOBAHN PANEL SEES WORLD THROUGH [..] BLINDERS
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

I'd like to correct a misunderstanding. In the original "INFOBAHN PANEL SEES WORLD..." post I said that the ILA report was included in a fax from the Center for Strategic and International Studies (CSIS). First, I was not an original recipient of the fax. I obtained the fax (and ILA report) via a forwarded e-mail message so I can't say for sure that the original CSIS fax included the copyrighted ILA report. I originally thought the ILA report was part of the fax. I now suspect the ILA report was not sent with the CSIS fax but instead was placed in the forwarded e-mail message by one of the multiple forwarders. Just felt like clearing that up. Nobody at CSIS is demanding an apology or anything like that. Ok. Onward. The reason I posted the ILA report: I fear that the desire to minimize electronic copyright violations will give corporations an incentive to work with government to devise methods to "control" the content of the Infobahn. Now, I don't believe they could ever completely succeed at controlling the content of the Infobahn, but I do believe they sure as hell will try. Do you really think the politicians of the world will just sit back and say "Well, we really can't prevent electronic copyright violations, so we wont even try"? More likely they will try many different things. I'm hoping the ILA report will prompt a discussion of the possible approaches the government may take to control the content of the Infobahn, and the side affects of said approaches. Jim_Miller(a)suite.com

1 0

Re: ID card from hell
by kentborg＠world.std.com 17 Dec '03

17 Dec '03

frissell(a)panix.com writes: >"You can buy heroin in maximum security prisons." What a bizarre world! I have no interest in buying heroin and don't expect to go to prison anytime soon, yet this is somehow the nicest realization I have had in a long time. Thank you, Duncan. -kb, the Kent who insists upon having hope -- Kent Borg +1 (617) 776-6899 kentborg(a)world.std.com kentborg(a)aol.com Proud to claim 32:00 hours of TV viewing so far in 1994!

1 0

Re: Triple encryption...
by DAVESPARKS＠delphi.com 17 Dec '03

17 Dec '03

Carl Ellison (cme(a)tis.com) wrote: > have you considered > > des | tran | des | tran | des ? That one's sort of your "trademark", isn't it? <g> (TRAN is really clever, BTW.) One scheme that seems to make even more sense, though, is: des | tran | IDEA | tran | des You get the benefits of 112 bits worth of DES keyspace along with 128 bits of IDEA keyspace, and thus don't stake your total security on the strength of EITHER algorithm. Other than making the code bulkier by requiring the inclusion of code for TWO crypto algorithms, and 64 bits of extra key material, what other drawbacks would there be to such a scheme (in a NON-commercial setting where licensing of the patented IDEA is not an issue)? If IDEA turns out to not be as secure as we've been led to believe, at least it, sandwiched between two layers of TRAN shuffling, should at least slow down a meet-in-the-middle attack on the remaining two layers of DES. As I recall, last time we discussed this over on sci.crypt you also advocated an additional step of "PRNGXOR". Is that still the case? Have you had the opportunity to read the Eurocrypt '94 paper by Eli Biham on triple DES modes, yet? /--------------+------------------------------------\ | | Internet: davesparks(a)delphi.com | | Dave Sparks | Fidonet: Dave Sparks @ 1:207/212 | | | BBS: (909) 353-9821 - 14.4K | \--------------+------------------------------------/

4 5