December 2003 - cypherpunks-legacy

FW: Federal Control of Financial Transactions
by Blanc Weber 17 Dec '03

17 Dec '03

Some comments on Duncan's post: All of the arguments which he proposes against reasons why the government can't succeed are true and accurate; however, it is one of those things where "you know and I know, but *they* don't know"...... The examples which you relate of government failures from inefficiency, etc. have been proven time and again in history, but in that case why does history keep repeating itself, in slightly different variations. "......why doesn't Clinton impose wage and price controls, exchange controls, tariffs, and a full-blown industrial policy?" If he can succeed in implementing the Health Plan, and if the National ID were accepted, that would probably next on his agenda (if he were to be re-elected [2 more years]). One saving grace from all the discussions which are going on of the above projects is that they presently are just discussions, and if they could just be kept discussing these things, none of them will ever be accomplished. By the time the discussions are finished, everyone will have version 10.x of every computer app and all companies will be "virtual". Blanc

1 0

RE: Come On
by Blanc Weber 17 Dec '03

17 Dec '03

I think that because there are proportionately so very few females on the list who post, that the gentlemen sometimes forget themselves and include some "men talk". But I haven't noticed anyone follow up on it; they never carry on and on as they do about LD (a much more interesting topic), and it isn't long before they get back to random numbers, Clipper, PGP, the intricacies of money laundering, etc. Blanc

1 0

RE: the Cypherpunk and the Shadow
by Blanc Weber 17 Dec '03

17 Dec '03

It's nice to see an intelligent & honest post from you, LD, even if I do disagree with you in your attitude and your methods of dealing with what you perceive as hypocrisy from the c'punks. I would like to address the issues which you brought up, but I don't want to bother the list with my comments, as I know that many have already gone through these too often and you are not satisfied with their rebuttals. Won't you reply to me personally, so that I may present a superior argument (mine). Blanc

1 0

Schneier
by tim werner 17 Dec '03

17 Dec '03

>Date: Mon, 18 Jul 1994 23:18:40 -0400 >From: kentborg(a)world.std.com (Kent Borg) > >>No. Schneier is a start, but the source papers... Speaking of Schneier, I have an upbeat note. I ordered his book, when it first came out, from the local Borders book store. When I went to pick it up, they told me that if I decided to buy it I could not return it, since it was not a book that they would otherwise stock. Today I was there checking out the computer books, and they had a copy on the shelf, so I guess it was in enough demand that they decided to stock it. tw

1 0

Re: Card Playing Protocol
by John Young 17 Dec '03

17 Dec '03

Responding to msg by kentborg(a)world.std.com (Kent Borg) on Mon, 18 Jul 11:18 PM >>No. Schneier is a start, but the source papers... > >So I should wonder about how to find the sources >mentioned in his bibliography? kb, the Kent who is only human: Get <who cypherpunks> and assign each c'punk, alphabetically, to send you 900/#c'punks sources.

1 0

Re: the Cypherpunk and the Shadow
by sidney＠taurus.apple.com 17 Dec '03

17 Dec '03

Please point me to appropriate references if I am going over old territory. What if an anonymous remailer required that messages were digitally signed? To use such a remailer, you would have to register an e-mail address and public key with the remailer. Mail that you send through the remailer would only go through if it were properly signed with your key. The return address on the remailed message would be something that the remailer could use to get replies back to you. Chained remailing would still be possible if each remailer signed the messages that it sent out, verifying that it had been received from an address that is registered with it (which may be a user or another such remailer). This would provide a way of dealing with someone mail-bombing a remailer or through a remailer, because the messages from one person could be identified and filtered out either by the remailer or later on, as appropriate. If someone tried to generate a million different identities and public keys, that could be dealt with by imposing a time delay for registration, which would not have to be imposed under normal circumstances. The current cypherpunk remailers maintain strict anonymity by not keeping records the way the Finnish anonymous remailer does. But if you want to be able to get a reply, you still have to place an encrypted reply block in your message, which the remailer can decrypt, so you still lose anonymity in the case that someone compromises the remailer. That is no better than registering an e-mail address (which can be your anonXXXX address anyway) that the mailer stores encrypted along with your public key. For that matter, this would work if everyone had to register a public key with the remailer in order to send mail through it, but only people who wanted to be able to receive replies also registered their e-mail address. Then the only thing that would be required to prevent a mail-bomb attack would be to enforce a registration delay during such time as it became necessary. Having all messages identified, even though still anonymous, would make building of reputations possible. -- sidney markowitz <sidney(a)apple.com>

1 0

PRIVACY SEMINAR
by Sandy Sandfort 17 Dec '03

17 Dec '03

C'punks, Several of you have asked *where* my proposed privacy would be held. The answer is "cyberspace," natch. It would be "free" to you, but TANSTAAFL (There Ain't No Such Thing As A Free Lecture). Duncan and I, however, retain the right to charge you through the nose for personal consultations or services. The "when" questions will be answered as soon as Duncan and I can come up with a good plan of action. Thanks for all the positive responses. S a n d y

1 0

Re: Why triple encryption instead of split+encrypt?
by John Douceur 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >From: <solman(a)MIT.EDU> >Date: Tuesday, July 19, 1994 2:31PM >You are then quite correct that meet-in-the-middle attacks can be >done, but the key to the first encryption (the hashing multiplex) is 112 >bits (for the split into two parts version) which would require 2^112 >stored messages, substantially more than could possibly be stored by >anybody ever (well, I guess ever is a bad word to use in this context). There are two separate operations here. One is splitting the plaintext: P0, P1 = S_KS(P) The other is generation of the splitting key. I assume independent generation of the splitting key both because it maximizes the total keyspace and because it avoids the confusion that I believe is evidenced by the above quoted paragraph. To wit: You have suggested generating the split key with a one-way hash of the DES keys: KS = hash(concat(K0,K1)) If the concatenation of the DES keys is 112 bits, then there are 2^112 possible values of the concatenation. However, the hashing of this value is not the first of the two encryptions; the splitting of the plaintext is the first encryption, and the hash is merely a mechanism for generating the splitting key. The domain of KS is the determinant of the size of the intermediate memory in a brute-force meet-in-the-middle attack. Furthermore, even for an independently generated splitting key, if the size of the domain of KS is greater than the size of the domain of K0 or K1, then the DES-decrypted values can be stored as the intertext, requiring no more memory than that required for decrypting double DES. >I still believe that the security >of the scheme, even when just splitting into two parts and using the hash >of the keys to multiplex the split, is much worse (by more than a couple >of factors of two) than DES. I suspect that you mean better, not worse [smiley deleted by censor]. I do not contest this claim, but I consider a more pertinent metric to be the security of this scheme relative to that of double DES. One decomposite of the split+encrypt algorithm can be viewed as: C = E_K0(S0_KS(P)) And an analogous double DES encryption is: C = E_K0(E_K1(first_half(P))) For the sake of argument, I'll assume that the domains of KS and K1 are equal in size. Thus, a brute-force meet-in-the-middle attack will require the same number of encryptions and the same amount of memory in both cases, although the amount of computational power required will be somewhat less in the case of split+encrypt because the splitting is less computationally intensive than DES. However, the splitting algorithm is relatively simple, far more so than DES. It is unlikely that a brute-force approach is necessary to cryptanalyze the splitter. For example, consider the following splitting algorithm: p0[i] = (p[i+1] & ~key) | (p[i] & key); p1[i] = (p[i+1] & key) | (p[i] & ~key); This is particularly simple, and I chose it to be so for simplicity of discussion. Imagine that our cryptanalytic algorithm begins as follows: Decrypt first block of ciphertext with each possible DES key; check to see if the resulting intertext could possibly have come from first block of known plaintext; if so, store the key; continue. Without looping through all possible split keys, we can determine whether the intertext could have come from the plaintext: precompute: bits_in_common = ~(p[0] ^ p[1]); // ^ = XOR must_be_1 = bits_in_common & p[0]; must_be_0 = bits_in_common & ~p[0]; inside loop: if (test_block & must_be_0 | ~test_block & must_be_1) test_block could not be from plaintext This greatly shortens the amount of memory required for the search, making the algorithm much less secure than double DES. You may respond by suggesting improvements to the splitting algorithm, such as multiple-bit dependency; but there are doubtless other weaknesses that could be exploited. I did not spend a lot of time on the above technique; persons more qualified than I am, devoting serious time to the problem, will certainly develop better cryptanylitic attacks. I think you will be very hard pressed to develop an algorithm anywhere near as secure as DES. JD -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLixRSUGHwsdH+oN9AQE4QgP8CMTmnk0It9Y4qWK08j9jLWCEYn2gLrEr +b17avqtVE/ArvLh3g6wHLQ4bMU0UOuLyNI0abk19FM7agqYT3WLo+U36DvU4qDJ 9lsyyUfqHgYrXOMGAPG/Kzg4ixqo+9IiCvnFxMbsniPnlCT5l5UuEOBLlAPqyrNQ ggvcxZ4a4rU= =gPdN -----END PGP SIGNATURE-----

2 1

Re: Kragen == LD?
by adwestro＠ouray.Denver.Colorado.EDU 17 Dec '03

17 Dec '03

> octopus? Something with tentacles? And isn't Kragen's user name, > xentrac, close to an anagram for tentacle? And isn't unm the University > of New Mexico, adjacent to Detweiler's home state of Colorado? The Alliance for Bandwidth Conservation (ABC), asked me to point out: LD> I don't have a voice without them. My Nyx account would be LD> censored immediately from your screeching complaints if I didn't LD> post through them! LD's account is anon????(a)nyx.cs.du.edu (? = hex digit). This is the first I knew of this, but it doesn't surprise me -- Nyx is a public access site at the University of Denver. And please don't all mailbomb his overworked sysadmin (who volunteers his time to run Nyx), right away. LD's been fairly mild lately, compared to last Nov-Dec. I think it suffices for him to know that this will occur if he becomes abusive -- damn surprised he mentioned Nyx, in fact! His sysadmin *can* correlate anon accounts with True Names, if necessary. btw, anyone can telnet there and read the list gated as newsgroup mail.cypherpunks. You'll have to jump through some hoops to be able to post from there, though. Sigh...awaiting the (awestrop = Detweiler?) thread, Alan Westrope <awestrop(a)nyx.cs.du.edu> __________/|-, <adwestro(a)ouray.denver.colorado.edu> (_) \|-' finger for pgp 2.6 public key PGP fingerprint: D6 89 74 03 77 C8 2D 43 7C CA 6D 57 29 25 69 23

1 0

Non-determinism forever. (was -- Re: GUT and P=NP)
by collins＠newton.apple.com 17 Dec '03

17 Dec '03

At 9:58 PM 18.7.94 -0700, Eric Hughes wrote: >Non-determinism is only another way of rephrasing the existential >quantification. I agree. Entropy, like velocity, is relative. `Non-deterministic' is the label we apply to the unknown or possibly unknowable. Non-deterministic algorithms (or thought experiments) work by `knowing more than we do'. They guess the un-guessable: the correct answers to problems we can't solve readily any other way. From their point of view, for some reason, it's not un-guessable. This very attribute makes them un-guessable to us. We simulate `guessing' correctly by exhaustive search (check out, e.g., NFA's and pattern matching). "Is P==NP?" is roughly equivalent to "For every problem that you could `guess' the answer if only you knew how---and can prove the answer correct without guessing---is there a shortcut (that meets some strong criterea)?" If P==NP is ever proven it _will_ have an impact on a large class of problems (and the effect will depend on the nature of the proof), but not all problems. Some problems are harder than NP, e.g. decrypting a message encrypted with a truly random OTP. Even if you guess the correct decryption, you can't prove it's right without guessing. Currently, lacking `THE shortcut', P != NP (in the practical sense; _not_ the theoretical). Even if it becomes the case that, demonstrably, P == NP in both the practical and theoritical sense, the world will still be an interesting place (in both the practical and theoretical sense). Scott Collins | "Invention, my dear friends, is 93% perspiration, | 6% electricity, 4% evaporation, and 2% butter- collins(a)acm.org | scotch ripple." -- Willy Wonka ..................|.................................................. Apple Computer, Inc. 5 Infinite Loop, MS 305-2D Cupertino, CA 95014 408.862.0540 fax:974.6094 R254(IL5-2N) collins(a)newton.apple.com ..................................................................... 408.257.1746 1024:669687 catalyst(a)netcom.com

1 0