December 2003 - cypherpunks-legacy

Re: Encryption Algorithm for Pagers
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> From: jgrasty(a)pts.mot.com (Joey Grasty X3697 P6611) > I am looking for a simple encryption algorithm suitable for use in pagers. [small, fast, low CPU needs, small keys] > 5. EXPORTABLE <-- yeah, I know Exportable is easy - you just need to get a *license*. Since you're at Motorola, you're a big enough company to talk to NSA and have some clue of having them approve it, as long as you give them an algorithm simple enough for them to crack, or dependent on a key you give them, or whatever. An alternative is to develop the code overseas and import it; I don't know where you're doing your pager hardware, but this does mean installing firmware overseas (not a major problem if you use flash eproms, though still annoying.) But you can use any algorithm you want, and get to complain to the COmmerce Department about how your US firm had to use overseas labor because of hostile export laws. Also, exportable doesn't mean you import it to the country you want to sell it in; Singapore may not be willing to let you import there something that the NSA let you export from here, and China may not either. As far as protocols go, you need to look at your threat model - are you worried only about random eavesdropping, or do you want something secure enough the NSA can't crack? Ron Rivests's RC2/RC4 protocols are export-licenseable, as long as you limit them to 40-bit keys, and are willing to license the code from RSADSI. It has the advantage that your data will probably be only readable by professionals for the next few years, though I don't know if it's small enough for your application; speed should be fine. On the other hand, the basic wimpy Linear Feedback Shift Register random number stuff, while not highly secure, may be adequate for your needs; use a mode like 32-bit randoms of which you use the bottom 8 bits to XOR with your data, and start it with an initialization vector you send with the message so the address message isn't always constant for a given user. I guess I really hate to suggest putting wimpy encryption in an important global system like a pager net, though it's better than the current totally non-private version. The big advantage you have for current pager applications is that most messages are short, max 80 or 256 characters with averages probably 20 characters, so there's not much known plaintext (assuming you do the important step of using a 1-character abbreviation for the pager system's own phone number, which is otherwise transmitted on a large percentage of pages...) On the other hand, you *do* have the known plaintext of the pager address in each message, which is serious risk. Actually, Blum-Blum-Shub looks like it should be a fairly small program, but I don't know how long a number you need to use to make it reasonably secure - if it's in the 128-bit range you're fine. (it's probably less likely to be exportable than DES, I suppose :-). It's slow, but you may be able to pre-compute. Also, you can gain some efficiency by splitting up the pagers into 128/256 groups, send an unencrypted group-id as the first byte, and only decode if that matches. That means you don't need to watch most of the messages that go by, and have extra slack time to decode the messages in your buffer that may be meant for you while ignoring the rest; this does imply that the transmitter would queue up messages so that messages from the same group don't go out within N messages of each other. Bill

1 0

Cryptosplit note
by rjc＠powermail.com 17 Dec '03

17 Dec '03

It uses rand() when it needs random numbers for the coefficients of the polynomial. I don't know what kind of security risk that poses, but it really should be using something better. Where can I get Blum-Blum-Shub source or documentation on the algorithm? -Ray

2 1

Re: XSPLIT now own ftp.wimsey.bc.ca
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

: XSPLIT takes a file, generates n-1 random numbers, writes those random numbers : out to each of the n-1 files, and for the nth file it takes the XOR of all N : random numbers, and XORs it with the plaintext. This way, you get to split : your file in such a way as to require all pieces of it in order to rebuild it. Where do you get your random numbers? (This could be susceptible to the usual PRNG reverse-engineering techniques...) G PS I know I should fetch it and look for myself, but I'm fighting alligators here again.

2 1

us.* heiarchy--scary
by nzook＠math.utexas.edu 17 Dec '03

17 Dec '03

The following is only tangentally c-punk. It is also long. Ctrl-C now if that is your only concern.

2 1

Proposed us.* heirarchy
by nzook＠math.utexas.edu 17 Dec '03

17 Dec '03

The following is only tangentially c-punk, and long. If, based on that, you don't want to read it, please hit ctrl-C now. Nathan

1 0

I will Kill SKE for You
by frissell＠panix.com 17 Dec '03

17 Dec '03

How to kill SKE? Open offer. For $100 I will apply for an escrowed key and get it delivered to you (without actually posessing the key material). I will also apply for a key as the representative of your corp, trust, partnership, etc. For an additional fee I will legally change my name to yours, get a key in that name and then change my name back. All transactions can be completed in cash. DCF "No racist - I support the permanent elimination of federal income taxation for African Americans to compensate them for the suffering of slavery."

1 0

DES Vulnerable, Why?
by KentBorg＠aol.com 17 Dec '03

17 Dec '03

It seems the TLAs (in a weak moment) let slip that DES was getting old and creaky and vulnerable. The story is that that is what sent the TLAs off on their search for a new encryption standard. (Unfortunately, they got their mission reversed and decided the need was to *read* plaintext not encrypt it.) My question: if triple-DES is so damn tough to break, what is wrong with DES? Triple-DES is a trivial variation on DES. Is it likely that DES's frailities are not the ones we compute with all those big numbers? Given the public portions of DES's history, what DES weaknesses make sense? -kb, the Kent who is 300+ emails behind due to a biz trip and a damp notebook. -- Kent Borg +1 (617) 776-6899 kentborg(a)world.std.com kentborg(a)aol.com Proud to claim 39:30 hours of TV viewing so far in 1994!

4 3

Oh, No, Mr. Bill!
by rah＠shipwright.com 17 Dec '03

17 Dec '03

I had a nightmare last night. I sat bolt upright in bed at about 3:45 am, and the only thing I could remember from the dream was an ad which looked like: Headline: If it's good enough for government work, it's good enough for you. [Software box in the middle] (looked like an Access or Word, or Excel box) Tagline: MS Escrow(tm): All the privacy we think you need. Apologies to those MSerfs out there. I can't control my (hyperactive) imagination sometimes... ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

RE: little brother inside
by Brian D Williams 17 Dec '03

17 Dec '03

'punksters, G. Gordon Liddy was in jail for contempt for somewhere between 18 months and two years. This has nothing to do with crypto, but alot to do with privacy. Brian Williams Extropian Cypherpatriot "Cryptocosmology: Sufficently advanced communication is indistinguishable from noise." --Steve Witham "Have you ever had your phones tapped by the government? YOU WILL and the company that'll bring it to you.... AT&T" --James Speth

1 0

Government-Controlled Trust Hierarchies
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Two recent threads have been: * Government-controlled ID systems (National ID Card, is-a-person credentials, etc.) * Software Key Escrow (SKE) These two threads are intimately connected, I claim. We would do well to consider how they relate, given the recent revelations about plans for SKE by Microsoft, the already-existing (but mostly unused?) features in Apple's AOCE/System 7 Pro/etc. system, the proposal by Stephen Walker at TIS of an SKE system, and the press for a National ID card. The "anarchic" model of the "web of trust" found in PGP is anathema to control freaks...sorry if this sounds like I'm grinding an ideological axe, but I don't feel I have to make posts to _this_ group sound like impartial, academic papers. Someone discussing key escrow here recently said that one thing he's want to see in any "voluntary" system is "proof of identity." Though many of us here dismissed his arguments as Detweileresque, in that Detweiler was always trashing pseudonymity (while being by far the most obvious user of it, ironically). But I think these arguments are common in some circles. For example, to use the Apple Open Collaboration Environment (AOCE) stuff, one gets one's key by submitting to RSA a notarized statement of one's identity. I haven't done this, and have no intentions to ever do so, but I gather than one take's one's passport, birth certificate, etc., down to a Notary Public, she confirms that the person is indeed "Sue D. Nym," signs and stamps the AOCE or RSADSI form, and this is snail-mailed to RSADSI in Redwood Shores. Some days or weeks later, one's key arrives. Sort of kills the idea of multiple keys for multiple purposes, of changing keys frequently, and of not going through such a process in the first place. Oh, and of course it costs money (the Notary for sure, and maybe RSADSI...though maybe Apple gives your a free coupon "Good for One Key Generation"). The Microsoft thing may be going down a similar track. The Microsoft paralegal who confirmed to me yesterday (via Blanc Weber, who can attest to what I'm saying) that MS is indeed pursuing SKE claimed that this is primarily to meet export laws and will not apply, he claims, to U.S. users. (I'm confused. If it's _export_ laws, and not _import_ laws into Haiti, Iraq, France, or other police state who may insist on key escrow, then won't all U.S.-sold packages of "Chicago" have to have this SKE built in? Why should U.S. export laws care about what key escrow laws other countries have? Since when do we enforce other countries' laws at our borders?) >From everything I am seeing, SKE will be incorporated into some widely-used operating systems, notably, Microsoft's upcoming release of "Chicago," the successor to Windows 3.1. (Chicago is essentially Windows 4.0) Who will write this? The SKE proposal described at the Karlsruhe workshop in international key escrow was authored by Stephen Walker and David Balenson of Trusted Information Systems. Matt Blaze's post yesterday discussed this in more detail. I suggest we look very closely for connections between TIS and Microsoft, Apple, Novell, Sun, and any other major OS providers. I believe TIS is preparing an SKE system that involves the "proof of identity" notary system Apple and RSADSI are now using, that involves mandatory selection of escrow agents (*), and that will be widely deployed in upcoming future operating systems, probably in Chicago in 1995 and maybe in Apple's System 7.5 in '95 as well. As Hal Finney notes, this will nuke the "web of trust" model, and will also make all systems in which keys need to be generated on an ad hoc, as needed basis very difficult or impossible to deploy--at least if the built-in systems of Chicago or System 7.5 are to be used. (* A note of confusion. I don't see how the schemes described by Matt Blaze, Carl Ellison, and others here, in which groups of communicants agree on a mutual escrow agent can work. For example, suppose a bunch of say, "OK, we'll play your silly game. We'll use your software, but our "escrow agents" will be "cypherpunks.nil" and "bitbucket.void," both of which consign all incoming keys to oblivion. Whutja gonna do now?" This makes the escrow agents a charade, unless of course there are laws regulating escrow agents!) In closing, it looks like the anarchic, distributed, web-of-trust stuff has been recognized as something governments need to quash. The first attack, Clipper, failed miserably, for various reasons. The second attack is much more insidious. Use various pressures on Microsoft (Gee, I wonder what _that_ could be?) to deploy a Beltway Bandit-deveoloped (TIS, with inputs from Denning, NIST/NSA) system that is, happily, "freely exportable." This satisfies Cantwell (so she drops her bill), this allows Clipper to be quietly killed, this allows Microsoft to free export Chicago, Daytona, and other such products, and this presumably keeps the national security state people happy. Well, this is my scenario. It could be wrong in some details, but clearly something is brewing out there....too many pieces are matching up. Vigilance! --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

4 3