December 2003 - cypherpunks-legacy

if this is RC4
by Carl Ellison 17 Dec '03

17 Dec '03

Assuming for the moment that alleged-RC4 came from the keyboard of Ron Rivest, my question is whether to look at this as an amateur cipher from a famous cryptologist -- or as a carefully designed cipher from a professional. If it's the latter, we should probably look for some underlying strengths the way the community picked apart S-box design rules years ago. - Carl

6 8

DigTel: ERRATA - correct path to Berman HR testimony 09/13/94
by Stanton McCandlish 17 Dec '03

17 Dec '03

Apologies for the incorrect path given at the end of yesterday's release of our hearing summary. The correct path to the file containing EFF Policy Director Jerry Berman's testimony at the US House of Representatives hearing on Digital Telephony of two days ago is: ftp.eff.org, /pub/EFF/Policy/FBI/eff_091394_digtel_berman.testimony gopher.eff.org, 1/EFF/Policy/FBI, eff_091394_digtel_berman.testimony http://www.eff.org/pub/EFF/Policy/FBI/eff_091394_digtel_berman.testimony -- <A HREF="http://www.eff.org/~mech/mech.html"> Stanton McCandlish </A><HR><A HREF="mailto:mech@eff.org"> mech(a)eff.org </A><P><A HREF="http://www.eff.org/"> Electronic Frontier Fndtn. </A><P> Online Activist

1 0

thoughts on RC4
by perry＠imsi.com 17 Dec '03

17 Dec '03

I've been looking at the RC4 (or alleged RC4) code a bit. Unlike most ciphers, RC4 doesn't seem to have any particular word length dependancies in its principles. That is to say, a cipher like IDEA has lots of magic numbers involved, but RC4 does not, which means that one could, in principle, extend it from being byte oriented stream to being word oriented stream without causing particular harm. (It would, of course, become incompatible, but thats not a real issue.) Can anyone see any reason why one could not change RC4 to being a word oriented stream cipher, call it "ERC4"? The reason I ask is because this would speed things up by a factor of four on 32 bit machines, which would mean modest hardware could possibly break 100mbps speeds. The 64 bit extension on 64 bit RISC processors could go far, far, faster still. This is a real consideration in the protection of network traffic, where extremely fast encryption in software has been a stumbling block. Perry

7 9

RC4 Legal Issues
by hughes＠ah.com 17 Dec '03

17 Dec '03

Some general words on trade secrets. Trade secret law is eminently sensible. It grows out of common law and the merits and facts of real situations regarding information. Trade secret law does not attempt to reverse the disclosure of information, which would be contrary to the properties of information. It does not require that people forget something they have learned. Nor does trade secret law force tribute upon those who use that knowledge, as patent law does. It does not restrict the transmission of information, as copyright law does. If, however, you tell someone you're going to keep a secret, and they compensate you for that promise (i.e. consideration in a contract), then the law expects you to uphold your promise or make good the harm that you've caused. Lacking an agreement, the holder of the agreement has no recourse. In a cryptographic world, the model of trade secret law is worth considering. It concerns only information and agreements between individuals. Eric

1 0

Re: RC4 compatibility testing
by thad＠pdi.com 17 Dec '03

17 Dec '03

To: cypherpunks(a)toad.com Subject: Re: RC4 compatibility testing >> "Perry E. Metzger" <perry(a)imsi.com> writes: >> >> I'm not familiar with this term, "submarine" patent application. But >> don't they have one year from the date of first publication to apply for >> a patent? It seems that this could count as first publication, so they >> would have one year from now to get their patent application in. As I >> said before, the NSA has indicated similar plans if Clipper is ever >> reverse engineered. >> >> Hal >> >> A "submarine" patent is one that was filed long ago, but kept from being issued by various ploys. Because the patent exists for 17 years from date of being granted, there is an incentive to delay the granting of the patent. Of course, patenting the invention makes it public too, which you might want to avoid, especially if you'd like to have a world-wide market on a cryptographic product. Like RC4, for example. Once it is patented in this country, anybody from the rest of the world could copy it. Once you find somebody you'd like to go after, you can speed up the process. The patent process runs pretty slow on its own, but you can slow it down further still by delaying correspondence with the patent office, by not paying fees quickly. I think that there is one final fee that must be paid after the patent is approved, but before it is granted, that you can just hold off on for a long time. thad Thad Beier Pacific Data Images 408)745-6755 thad(a)pdi.com

1 0

privacy in Unix environment
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

Hello everyone, here is a question well suited for the c'punks. I'm looking for some kind of utility that will allow script files to be run, to spawn off processes, but will wipe out environment and "ps" info from being read. i.e. imagine that the commands being called must shield their arguments and environment from the "ps" command run on a system. the ideal program would let me run csh scripts but make all the unix commands called (sort, grep, whatever) invisible to other users on my local system. can it be done? note: I am aware of the trick of using symbolic links to hide command names. tx. bye

6 5

Re- PRIVACY REGULATIONS
by Ron Bardarson 17 Dec '03

17 Dec '03

Mail*Linkš SMTP Re: PRIVACY REGULATIONS I've upload the text files containing a sample Writ of Habeus Corpus to wimsey. They compress down to 20 K and a 60 K post seemed inappropriate. Look in /uploads for habeus.zip at ftp.wimsey.bc.ca

1 0

key signing
by Tom Allard 17 Dec '03

17 Dec '03

Hmmm... I requested my key from the MIT key-server and it came back with two unknown signatures. So I requested those two keys, only to find that they were Bill Clinton and Al Gore. I've never met either of them (although I have seen Al Gore jogging through Rock Creek Park). Those keys had signatures also, so I got the signator's key as well, only to find that it was "Hillary's" key. Type bits/keyID Date User ID pub 384/23BDC6F9 1980/01/01 William J. Clinton <president(a)whitehouse.gov> sig CC3D9213 (Unknown signator, can't be checked) sig DE09D78D (Unknown signator, can't be checked) Type bits/keyID Date User ID pub 384/DE09D78D 1980/01/01 Albert Gore <vice-president(a)whitehouse.gov> sig CC3D9213 (Unknown signator, can't be checked) sig DE09D78D Albert Gore <vice-president(a)whitehouse.gov> sig 23BDC6F9 (Unknown signator, can't be checked) Type bits/keyID Date User ID pub 1024/CC3D9213 1993/12/25 Hillary Rodham Clinton <bimbo(a)whitehouse.gov> sig CC3D9213 Hillary Rodham Clinton <bimbo(a)whitehouse.gov> rgds-- TA (tallard(a)frb.gov) +-+ I don't speak for the Federal Reserve Board, it doesn't speak for me. |X| pgp fingerprint: 10 49 F5 24 F1 D9 A7 D6 DE 14 25 C8 C0 E2 57 9D +-+

1 0

e$: Multi-Industry Coalition Framework - NII (fwd)
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Thought you folks would want to see this... >PRESS RELEASE > >FOR IMMEDIATE REALEASE CONTACT: Charles N. Brownstein >September 12, 1994 703-620-8990 > >MULTI-INDUSTRY COALITION SETS TECHNICAL FRAMEWORK >FOR THE NATIONAL INFORMATION INFRASTRUCTURE > > > >Washington, D.C. -- Today, more than forty leading communications, >computing, and services companies proposed a consensus vision of the >architecture required for tomorrow's information superhighway. In addition, >the Cross-Industry Working Team (XIWT) members detailed an example of a key >component of the National Information Infrastructure (NII) - digital cash. > >The two white papers, 1) An Architectural Framework for the NII and 2) >Digital Cash, Tokens and Payments in the NII, will be presented to the >President's NII Advisory Committee tomorrow at its meeting in New York. > >"These papers provide a technical vision and goals for the NII that cut >across a range of industries," said Robert Kahn, President of CNRI and >chair of the XIWT Executive Committee. "They provide a common foundation >for thinking about the objectives and technical requirements of the NII." > >In its Architecture paper, XIWT calls for an NII that promotes >interoperability and provides universal access, privacy, protection, >intellectual property, security, job creation and commerce in a competitive >business environment. Based on these objectives, XIWT defines the NII in >terms of a Functional Services Framework -- a model used to characterize >the NII by function and certain key characteristics. > >According to this model, the NII has three basic components: applications, >enabling services, and physical infrastructure. Together, these components >include all the NII's information and transporting machinery, the networked >software tools that facilitate manipulation and movement of digital >information, and the information processing activities of NII users. > >To meet the goals outlined for the NII, XIWT recommends that each of these >components be addressed in terms of functionality (what it does), trust >(the conditions under which it operates), and control (how it is managed). > >XIWT also provides a Reference Architecture Model for the NII -- a >description of the system in terms of the interconnection of the functional >elements of the system and the interfaces between them. XIWT identifies >four functional elements: 1) appliances: 2) networks; 3) resources; and 4) >control points. In addition, it identifies seven categories of interfaces >and protocols needed to integrate these elements and make them >interoperable. > >The Digital Cash report defines ways in which the NII will facilitate >existing and new forms of commerce. "It describes the functional >requirements and technical options for conducting everyday financial >transactions in networked electronic settings with the ease and certainty >of today's cash economy -- and with more security and control," said Dan >Schutzer of Citibank who chairs the XIWT Applications Services Working >Team. > >"The flexibility and choice implicit in the architecture we have described >will be a boon to the users of the NII and provide a challenging but >fertile business environment for savvy companies in many different >industries," said Niel Ransom of BellSouth, who chairs the XIWT >Architecture Working Team. "The members of XIWT are committed to making it >happen." > >The XIWT papers quickly received praise from the White House. "By bringing >together the views and technical recommendations of such a diverse group of >U.S. companies, the XIWT has made significant progress in moving the work >on the NII another important step forward." said Vice President Al Gore. >"We commend the work they have done so far and urge them to continue >working to define the technical aspects of the NII." > >The Cross-Industry Working Team (XIWT) was formed in 1993 to develop a >technical vision for the NII, XIWT members include over forty companies >from a range of U.S. industries. Membership list attached. > >### >PLEASE NOTE: Copies of XIWT's white papers are available in hard copy or >on-line. Please call Charles N. Brownstein at 703-620-8990, or access via >Internet from the XIWT Home Page at ><http://www.cnri.reston.va.us:3000/XIWT/public.html> > >Charles N. Brownstein >Executive Director >Cross-Industry Working Team >Corporation for National Research Initiatives >1895 Preston White Drive >Suite 100 >Reston, VA 22091 > >Tel: (703) 620-8990 >Fax: (703) 620-0913 > >Internet: cbrownst(a)cnri.reston.va.us > > > > > > ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

2 1

Re: thoughts on RC4
by m5＠vail.tivoli.com 17 Dec '03

17 Dec '03

Carl Ellison writes: > >Can anyone see any reason why one could not change RC4 to > >being a word oriented stream cipher, call it "ERC4"? > > (1) You could conceivably go to an array of 65K short values and retain the > permutation but I wouldn't try to go to an array of longs. I don't have > 32GB of RAM on my workstation. Perhaps some improvement on RISC architectures could be achieved by using four arrays, 32 bits wide by 256 entries long. The arrays would mirror the single array in the original code, except that the "interesting" byte would be at a different position in each. Then, the main encryption loop could be unwound so that you'd do four operations to each word, one from each array to hit the four bytes. (You'd do the increment/swap between each one.) This *might* be worthwhile. (On an Alpha, you'd have 8 arrays...) | GOOD TIME FOR MOVIE - GOING ||| Mike McNally <m5(a)tivoli.com> | | TAKE TWA TO CAIRO. ||| Tivoli Systems, Austin, TX: | | (actual fortune cookie) ||| "Like A Little Bit of Semi-Heaven" |

1 0