December 2003 - cypherpunks-legacy

Security is not free
by nelson＠crynwr.com 17 Dec '03

17 Dec '03

I think that a lot of people have forgotten that security is not free. Sometimes the cost is economic, sometimes it is mental. Even using encryption with GNU Emacs's mailcrypt package is not free, because it takes time to verify that you're using signatures and encryption and keys correctly. And, without a certain amount of paranoia, you're going to do something stupid. I think the NSA is forgetting that security is not free. They're restricting American companies from exporting encryption. Yes, this increases America's security by some amount. However, the cost of doing this means that overseas encryption is going to overseas companies, not US companies. And this amounts to several billion dollars per year. I think we need to make sure that Congress knows it is spending several billion dollars of someone else's money, in return for the very small amount of security gained by keeping American encryption products out of the worldwide market. -russ <nelson(a)crynwr.com> http://www.crynwr.com/crynwr/nelson.html Crynwr Software | Crynwr Software sells packet driver support | ask4 PGP key 11 Grant St. | +1 315 268 1925 (9201 FAX) | What art thou doing about it? Potsdam, NY 13676 | LPF member - ask me about the harm software patents do.

1 0

Re: Classified Data on Unclassified machines
by Jeff Gostin 17 Dec '03

17 Dec '03

snyderra(a)dunx1.ocs.drexel.edu (Bob Snyder) writes: > In theory, anyway. I do know of classified data having been on > unclassified machines before, generally by accident. Comes from the fun > fact that unclassified datum A + unclassified datum B can = classified > data C. So true! A popular example of this is the following: Classified Fact: The Government is funding a new supersonic jet project. Unclassified Fact: Boeing was awarded a new contract from the Government. Unclassified Fact: Boeing purchased 17.34 tons of titanium alloy. Unclassified Fact: Titanium is commonly used in supersonic jets. .:, the govie awarded Boeing a Supersonic Jet contract. --jeff -- ====== ====== +----------------jgostin(a)eternal.pha.pa.us----------------+ == == | The new, improved, environmentally safe, bigger, better,| == == -= | faster, hypo-allergenic, AND politically correct .sig. | ==== ====== | Now with a new fresh lemon scent! | PGP Key Available +---------------------------------------------------------+

1 0

Re: PGP bastardization (fwd)
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

While I sympathise 100% with prz's annoyance at this hack, I should remind him that he *did* put pgp out under the GPL and anyone is free to modify it in any way they chose as long as they too release it under the GPL. He has no legal comeback (ha, there's an interesting irony about the author of the world's leading piece of guerilla software...) and the most he can do is apply peer pressure to get the guy to back down. (Personally I'd never release anything under the GPL for precisely that reason and others...) G

4 3

Probabilistic Encryption
by solman＠MIT.EDU 17 Dec '03

17 Dec '03

How secure do you guys think Probabilistic encryption using a BBS generator is? It looks like its every bit as good for key exchanges as RSA and somewhat better because of its speed. Would I compromise the security of the algorithm if I modified it to take the maximum number of random bits from each itteration of the BBS RNG and made the corrosponding changes in the encryption algorithm this making it faster? How dangerous is it (looking at system wide security) to generate the random bits ahead of time? Is it overkill to disable swaping from the location the random bits are held in? (keeping in mind that disabling swapping is a major pain since it is system specific). Thanks, JWS

3 2

Re: ID card from hell
by frissell＠panix.com 17 Dec '03

17 Dec '03

At 06:10 PM 7/12/94 -0700, Brad Dolan wrote: >Prediction > >If Americans accept this, as I expect they will, we will >see the following: > >Cops doing card-scan roadblocks, ostensibly to find drunks and >immigrants. Mandatory carry not (yet) proposed. Also Ontario Driver's License should suffice. >A requirement to present your card and have a computer record kept >after every financial transaction over, say, $100. How to handle tourists/Canadians/etc. >A requirement to present your card to get medical care. Already in the Health Security Act. Doesn't *prevent* treatment just records it. You can claim to be an illegal alien, etc. >Adoption of these cards as drivers' licenses. Just a magnetic / >electronic data entry to indicate if you are authorized to drive. Doesn't cover driver's licenses issued by any other nations which are also legal for domestic driving (even by US citizens who are 'non-residents'). >Same thing for professional licenses. Net competition for professional services will soon end licensure in any case. >Card-scan to buy guns or ammunition - if you are allowed to buy >them at all. Perhaps true. >Card-scan to buy potentially subversive tools, chemicals, books. Books? Doubtfull. Again what about tourists. >Card-scan on entry to or exit from the U.S. Instant database >check to see if you are authorized to enter or leave the U.S. Possible although departure controls are unlikely (and may violate treaties to which the US is signatory), entry controls will dissolve over time as travel volume and economic integration swamps any control regime. The US currently has 40 million border crossings per year and has 'lost control'. 400 million will be even harder to control. >Card-scan on entry to or exit from "special" areas: an extra >little security check before you enter places the government >is taking an extra interest in. Possible. >Mandatory presentation of card to get access to an internet- >attached computer account. Not a chance. >Card-scan at your kids' school. My kids school was outside the jurisdiction. Home schools would be exempt in any case. When Purdy shot up the school in Stockton California I wondered - perversely - why parents worried about the small risk of their kids being shot at school when those same kids were guarranteed to be brain damaged at that same school. >Linked databases of parents and kids, to correlate child support >payments, vaccination histories, academic performance, truancy, >antisocial attitudes, you name it. When in doubt, deny your enemies a key field. Make sure to display multiple addresses, names, numbers. DCF "If you already comply with other's demands for personal information about you, how can you complain when they ask for more?"

2 1

Why triple encryption instead of split+encrypt?
by solman＠MIT.EDU 17 Dec '03

17 Dec '03

Why do people do tripple DES and *shudder* tripple IDEA instead of doing some form of non-redundant secret splitting and then encrypting with multiple keys. For example, instead of triple DES, why not A) divide the compressed plaintext into blocks of n*64 (where n=2 in the simple example, higher in the overkill examples) B) Split each block into n parts such that: i) The splitting can be reversed. ii) During the inverse of the splitting each bit in the plaintext is dependent on several bits from each of the parts of the splittext. iii) The total number of bits in the splittext is the same as in the plaintext. The last point will make this form of secret spliting relatively insecure, but that's OK for this application (I think, this is really what I'm asking you.) C) Now, for each n*64 bit block you have n blocks of 64 bits. Hook these together in n chains and encrypt with DES with different keys in CBC, CFB or OFB mode. D) Unencrypt on the other end. You can make the key size arbitrarily large and it takes much less time than triple DES and its immune to meet in the middle attacks. So why do we use triple DES? If I am wrong about the security of point B-iii, am I correct that by switching to a secure secret splitting algorithm and setting n=2, we still get faster performance for the same cryptanalytical hardness as triple DES? Cheers, JWS

3 4

Re: Idle question...
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 09:12 1994/07/13 +1000, Ian Farquhar wrote: ... Quoting someone else > >BTW, the algorithm leaked, it was not reverse engineered. I do not expect >SKIPJACK to leak, as it's distribution would be VERY limited, even within >the NSA and chip houses. Even A5 was reputed to be known to only 2 or 3 >people within Motorola. ... How many have access to the masks?

3 2

National ID Card Info Request...
by Jim choate 17 Dec '03

17 Dec '03

Hi All, Several of my more politicaly active friends are interested in starting a lobby group (if feasible) in the ctl. Texas area on this issue. I wandered all over WWW, gopher, etc. last evening trying to find the specific bill which covers this. I found *lots* of references to comprehensive plastic data-cards and smart cards. I would appreciate some kind sould e-mailing me the bill name which has this in it. Take care.

1 0

New version of Digital Telephony Bill?
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

In the latest Wired issue (2.08) there is a small blurb about a new version of the Digital Telephony Bill that the FBI has presented. According to the blurb, a couple of Senators has expressed a willingness to sponsor this new version. Anybody have any more info on this? Jim_Miller(a)suite.com

2 1

INFOBAHN PANEL SEES WORLD THROUGH [..] BLINDERS
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

I'd like to correct a misunderstanding. In the original "INFOBAHN PANEL SEES WORLD..." post I said that the ILA report was included in a fax from the Center for Strategic and International Studies (CSIS). First, I was not an original recipient of the fax. I obtained the fax (and ILA report) via a forwarded e-mail message so I can't say for sure that the original CSIS fax included the copyrighted ILA report. I originally thought the ILA report was part of the fax. I now suspect the ILA report was not sent with the CSIS fax but instead was placed in the forwarded e-mail message by one of the multiple forwarders. Just felt like clearing that up. Nobody at CSIS is demanding an apology or anything like that. Ok. Onward. The reason I posted the ILA report: I fear that the desire to minimize electronic copyright violations will give corporations an incentive to work with government to devise methods to "control" the content of the Infobahn. Now, I don't believe they could ever completely succeed at controlling the content of the Infobahn, but I do believe they sure as hell will try. Do you really think the politicians of the world will just sit back and say "Well, we really can't prevent electronic copyright violations, so we wont even try"? More likely they will try many different things. I'm hoping the ILA report will prompt a discussion of the possible approaches the government may take to control the content of the Infobahn, and the side affects of said approaches. Jim_Miller(a)suite.com

1 0