December 2003 - cypherpunks-legacy

Re: Anti-Clipper Article in "THe Computer Applications Journal"
by smb＠research.att.com 17 Dec '03

17 Dec '03

Might I suggest that this is not the right newsgroup for anti-Clipper articles? I've never seen *any* Cypherpunk defend it; what's the point? Preaching to the choir? Repeat doses of brainwashing? Citations are fine; they show what the outside world thinks. Technical aspects are fine; there's a lot to be learned about Skipjack and key escrow. But there's little point -- on this list -- to hearing yet again that Clipper is bad (unless, of course, someone starts defending it here). --Steve Bellovin

2 1

Federal Control of Financial Transactions
by frissell＠panix.com 17 Dec '03

17 Dec '03

As regular readers will be aware, Tim May and I have been sparring with each other about the risks of various control strategies that the world's governments may deploy. I thought it might be helpful to make one of his fears concrete so that we can analyze it. I trust that I am not putting words in Tim's mouth. The major concern is the same one mentioned in the Book of Revelations: "REV 13:16 And he causeth all, both small and great, rich and poor, free and bond, to receive a mark in their right hand, or in their foreheads: REV 13:17 And that no man might buy or sell, save he that had the mark, or the name of the beast, or the number of his name." So the Feds deploy a card (smart or dumb) that has to be used for most transactions and lets them track everything we do. Tourists are brought into the system through the use of temporary cards (or the machine-readable strip on their passports which already includes a space for a national ID number.) How is this most likely to come about? I consider force majeure to be unlikely. It would be rough to get Congress to impose a burden like this on businesses (who would have to completely wire themselves) in a formal vote. It is not necessary to do this in any case since they know they can't snag everyone into the system. They just want to capture most of the transaction data. If they can do it administratively without involving Congress in controversy, they will use that approach. Clipper and the Post Office agitprop on the US Card give us a possible scenario. The P.O., desperate to find a reason to exist as its core business drains away to the wires and private carriers, would like to become the primary digital signature authorizers for the U.S. It claims to be able to put millions of "US Cards" in the hands of happy shoppers within months of the go-ahead. (Assuming they use FedEx for the actual *shipments* of course). The recently attempted "Clipper maneuver" of game strategy (government preemption by standard setting rather than by direct application of force) shows us how the US Card system might be actually deployed. The government adopts the standard it likes and tries to make it the de facto standard by requiring it for most official business. An instant market is thereby created. No congressional action required. Similarly, the government might try to preempt the market for digital signature and commercial encryption technology by deciding to make anyone who wants to use a digital signature system in dealings with the government use the Post Office or some such agency as the signature authenticator. Thus bids, purchasing, benefits, and taxes could all require your "US Card" registered at your local post office. The government would then hope that commercial users who would need to use the government's system for tax filings anyway would also use it for its ordinary dealings with the public. Then if a health care bill drafting you into a "universal coverage" army is ever passed, the "US Card" also becomes the Health Security Card you will have to show to get a job in the US. Thus, all sorts of authentication transactions would pass through the powerful and efficient post office data network and the ex-countercultural/born-again control freaks Inside the Beltway could get their jollies tracking your employment and purchases. What's the big hole in this frightening scenario? Ask yourself one question. Why is the Post Office looking around for some useful work these days? Didn't they have a monopoly guaranteed by the Federal Government for more than 100 years? If they couldn't make a go of it with a pure coercive monopoly during a time of slower commercial activity, what makes them think that they can compete *without* a genuine coercive monopoly in a time of constant change. Governments have proved over and over again that they can go broke running "guaranteed" money spinners like state lotteries and such. They don't stand a chance in a marketplace that will break the hearts of the brightest people this planet has ever produced. What has recent history established? Governments are weaker. Why didn't the Amin mandate Clipper? No political ability to do so. Why are banks and telecoms being deregulated in nearly every country on earth (in spite of propaganda about "risks" and "public needs"? Why have exchange controls (a common feature of life a generation ago) become impossible almost everywhere on earth? Is it "free market ideology" that has triumphed or did the *reality* of markets rather than the *idea* of markets hit governments on the head. To those who romanticize the power of the State in the modern world I ask, why doesn't Clinton impose wage and price controls, exchange controls, tariffs, and a full-blown industrial policy? Why doesn't he nationalize the steel industry, guarantee jobs for all, confiscate all estates above $100,000, impose 95% income taxes on those making more than $40,000/year, and all of the other proposals that were popular earlier in this century? I doubt that he is restrained because of his deep commitment to human liberty. He doesn't do it because he can't. Markets wouldn't put up with it. His government would be destroyed (by capital flight.) In this connection, I invite everyone to read the excellent profile of Japan in last week's Economist. It discusses the current and growing Japanese commitment to deregulation and what is driving it. That issue is a keeper anyway because of an article on commerce on the Internet and (as has been mentioned before) the use of the word "anarcho-capitalism" in an article comparing Thailand and Singapore. Assuming that the government were to attempt to establish a Post Office mediated digital authentication system, there is no guarantee that it would work. Foreign users would presumably use foreign systems to authenticate their transactions. Some of these systems might be run by privatized foreign PTTs or by others. Note that since banks and credit agencies will still have to approve the transactions anyway (to make sure you've got the dough), they may decide to use other systems for signature authentication. It would not really cost them any more. Since information is cheap, setting up a system to use several authentication systems is almost as easy as setting up a system to use one. (Particularly since you have to do it anyway.) It is difficult to imagine the P.O. being able to compete in the cutthroat world of credit processing. Recall that even today, there are companies that pick up and deliver your mail to the P.O. to speed the process along. Similarly, expediters may interpose themselves between the customer and the P.O. to speed authentication in the even that the P.O. network is slow or inefficient (likely). Here again, Clipper gives us some hints as to how the attempted market cornering might work out in practice: The Admin is currently floating stories about perhaps withdrawing Clipper in favor of "wider discussions" with the industry. Clipper is already painfully obsolete and it isn't even shipping in quantity. Inefficient government monopolies create marvelous profit opportunities for markets to arbitrage the gap between cost and price. In a highly efficient networked world, it will be very difficult for governments to compete. DCF Why Pizza Hut should hire *me* as their spokesman: "Why does Pizza Hut oppose mandatory, employer-paid health insurance in the US even though we are forced to pay it in Japan and Germany? We support the principle of cultural diversity under which different societies experiment with different methods of social organization. Germany and Japan have chosen one road, we have chosen another. Pizza Hut would not voluntarily impose on our US customers the burden of the very high food costs that the agricultural policies of Germany and Japan impose on their citizens. Similarly, we would not choose to impose on our US employees the burden of bureaucratically designed employment contracts. Pizza Hut supports the right of our customers to enjoy the least expensive and best pizza on earth and the right of our employees to bargain with us collectively and individually concerning the conditions of their employment."

2 1

Recent references to Crypto in the media...
by Jim choate 17 Dec '03

17 Dec '03

Hi all, Just a note to alert those interested that the latest issue of PC Magazine has two articles about crypto. One is about public key and DES and the general currents. The second is in reference to WinCrypt. Both articles are very general and do not delve into technical discussion. Take care.

1 0

Nat'l ID # ?
by Carl Ellison 17 Dec '03

17 Dec '03

It strikes me as anachronistic to worry about national ID numbers for privacy reasons. With data processing of the 1950's, someone would have needed a single index number in order to gather all records about me into one place. With today's excess computing power, there's no problem doing a kind of fuzzy fill algorithm -- find all my various numbers, record links between them and therefore equate them (MC 1234 5678 8765 1982) = (AMEX 9876 123655 83002) = (SS 788 84 2345) = Carl M. Ellison 2130 Mass Ave; Cambridge 02140 = (617) 876-6644 etc. To aid those who are computationally challenged, this entity could also create its own index number and let others refer to that -- even call it a national ID number. None of this requires a national ID card.

3 2

Cypherpunks & math
by Nathan Zook 17 Dec '03

17 Dec '03

I know I'll regret this, but... I've seen a lot of comments by folks that indicates a high level of mathematical sofistication. So I'm curious. Please e-mail me as follows: SUBJECT: nomath If you've not had some Discrete Math course. SUBJECT: discrete If you've had Discrete Math. SUBJECT: algebra1 If you've had semester course on algebra. SUBJECT: algebra2 If you've had a year-long senior level course based on Fraliegh or some such. SUBJECT: grad If you've been to grad school in math. SUBJECT: firstcourse If you've had the prelim algebra course. (Hungerford or such) SUBJECT: prelim If you've passed your algebra prelim. SUBJECT: orals If you've passed your oral exam. SUBJECT: orala If your oral had a significant algebra component SUBJECT: candidate If you are a candidate in algebra. SUBJECT: phd If you have a phd in math. SUBJECT: research If you have published in number theory. I'm an "orala". Thanks!

3 2

Re: y'all gotta see True Lies
by Berzerk 17 Dec '03

17 Dec '03

On Tue, 19 Jul 1994 jdblair(a)nextsrv.cas.muohio.EDU wrote: > 2) A "blanket order" to a vague, unknown government agency to wire tap > anything they feel like. Dont forget the abuse of this to tap his own wife! I am sure that convinced everyone that there needed to be no oversite on this.(not). They also mentioned that unauthorized wiretaps were a felony, but also showed the man ignoring it. > 5) Of course, every hacker in the audience noticed that the rich > multinational zillionaire is unable to choose encryption secure enough to > fend off an attack on minutes in length using computer equipment in a van! > What was he using to hide his records? Enigma? No! an atack on enigma would take much to long, must have been [in]deskrete. > 6) Oh yeah, the women are unable to do anything except talk on the phone, > get into catfights, give men blowjobs, and kill people by accident. The I liked that part.:-) > 7) Luckily, amid all the casual death in the name of national security and > the american way, we have Arnie pointing out that "he only kills bad > people." Reminds me of the time I was at the Space and Rocket Center in The exact line was Q: "have you ever killed anyone?" a: "Ja, but they were all bad". > Huntsville, right after the Gulf War. They had a patriot missile on > display, along with the wreckage of a "busted scud." A mother pointed to > the missile, saying to her son, "Look, its the patriotic missile." I am > not making this up. Raising good little sheep for the fatherland. > I doubt it'll matter who's holding the wheel. I think the car's driving > itself. And it is not a pendulum swinging back and forth, it is a car swerving from the right lane to the left lane and heading for a cliff. > If anyone has a good monkeywrench, send it my way. Hehehhehehehehheheheheh. Berzerk, Green Libertarian ******************* Hey, those dams were paid for by stolen tax money, right? Does that mean we can blow them up?

1 0

Re: Federal Control of Financial Transactions
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 8:53 AM 7/19/94 -0400, Duncan Frissell wrote: >Inefficient government monopolies create marvelous profit opportunities for >markets to arbitrage the gap between cost and price. In a highly efficient >networked world, it will be very difficult for governments to compete. Yeah. What he said. Arachno-Capitalism, anyone? You have to be careful to use the analytic methods of the present (modern financial concepts, for instance), to make informed guesses about the future. If you don't, and your analysis is clouded with a belief in the efficacy of command economies, you start to see totalarians behind every bush. I think Eric put his finger on it before when he said something about not demonizing the NSA. They were just wrong, and they were going to lose this fight because the technology was stacked against them. "Reality is not optional", to quote Thomas Sowell. While I've been watching this discussion about manditory identity, I keep remembering a couple of things I read a while ago. The first was Gerard K. O'Neill's book "2081". Gerry was the Princeton physicist whose undergraduate physics class started the space colonization craze of the late 70's. In "2081", O'Neill had posited a world where, among other things, everyone had micro-transponders. The ultimate nightmare of free people everywhere. Yet it had it's advantages. You could pick up something and walk out of a store, and since the store's receivers knew who you were and what you took, the item would be deducted from your bank account. Phone calls would be routed to follow you wherever you went. If a crime is committed, you have an alaibi. I'm pretty sure most of you have heard about Xerox PARC's work in this regard. There was an article in Scientific American about it a couple of years ago. I even saw that Olivetti has begun manufacturing the smart badges (transponders) upon which the technology hinges. I expect that strong cryptology is the way to make this technology work so that a person's freedom and privacy is actually enhanced. The other thing I remember reading was an old Esther Dyson (Freeman Dyson's daughter...synchronicity!) quote about the necessity for some kind of law which made personal information the property of the person whose information it was. Again, I expect strong crypto and market mechanisms will evolve together to enforce that legal claim at some point. Cheers Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

2 1

Re: CBS News: National ID Card Returns
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

: From: michael(a)resonex.com (Michael Bryan) : On a related note, I was very surprised when I went to England, and : found out that their driver's licenses don't have photos on them, : supposedly because it would be an invasion of privacy. And I was also : told that they cannot keep your fingerprints on file permanently, : except for particularly severe crimes. Minor crimes might allow them : to keep records of your fingerprints for a couple of years or so, but : then the records must be destroyed. It's amazing how complacent we : are in the US by comparison. I fear that a National ID card would be : far to easy to foist upon the American public. I hope I'm wrong. The *police* aren't supposed to keep fingerprints on file if the person isn't a criminal, but who believes they're that stringent? And of course MI5 (SIS, whatever) can do what they damn well please. The USA aren't supposed to keep peoples fingerprints on file either, after they've done the background check, when you immigrate. Want to bet they do? I think when I give my fingerprints I'll ask the official to write me a *personal* guarantee that my fingerprints won't be saved, then sue his ass if they ever appear later... once they've been digitised for the system, do you believe that all copies will be deleted? I sure don't. All I believe is when they tell you the *card* will be returned they're probably telling the truth. BFD. G (Who also wonders if the blood sample for AIDS testing gets dried and filed for future genetic fingerprinting...) PS So are we going to spin off that list we talked about for this sort of stuff or not? Sameer?

1 0

RE: Big Brother comes to Campus
by Vinod Valloppillil 17 Dec '03

17 Dec '03

<stuff about Mankato State U. requiring that all students use a new PhotoID card deleted> Personally, I don't think I have any real problem with it. Unlike a government approach, you still retain some level of choice -- i.e. if you don't like Mankato's ability to track you through this card, don't go to Mankato, or perhaps more realistically, minimize usage of the card. This seems kind of similar to the arguments about a company's right to use escrowed keys. There is no reason why a company can't mandate that all use escrowed keys for employees conducting company business (email, transactions, etc.). If the company is regularly using its keys to examine your mail and it pisses you off, quit and work for a different company that treats its employees with more respect. In any case, choice is preserved. Vinod

1 0

Re: Why triple encryption instead of split+encrypt?
by John Douceur 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >From: <solman(a)MIT.EDU> >Date: Tuesday, July 19, 1994 8:37AM >> So now the meet-in-the-middle attack regains its earlier applicability: >> A known-plaintext attack would encrypt P with the splitter, decrypt >> C0 with DES, and attempt to meet in the middle to discover key K0; >> similarly, decrypting with C1 to get K1. >I don't believe this is true. You have C0 and C1, but you can not figure >out P0 and P1 without the hash of the concatenation of both keys. Without >this you can not do a meet in in the middle attack, right? Wrong. (sorry to sound so authoritative; just wanted to make my position clear.) If you knew how to perform the split, there would be no need for a meet-in-the-middle attack; you could just attack each of the DES encryptions of the split data separately. Recall that a meet-in-the-middle attack is a method for cryptanalyzing a message that has been doubly encrypted, as the following: I = E0_K0(P) C = E1_K1(I) By this nomenclature, I mean to imply that not only the keys but also the algorithms may be different between the first and second encryptions. Meet-in-the-middle works by encrypting from P towards I, decrypting from C towards I, and attempting to meet in the middle. For algorithms with large keyspaces, this attack requires so much memory for storing intertext as to be almost absurd in today's world, but it is a valuable theoretical technique for demonstrating that double encryption provides little more computational security than single encryption. I am claiming that your technique: P0, P1, P2, ... Pn = S_KS(P) C0 = E_K0(P0) C1 = E_K1(P1) C2 = E_K2(P2) . . . Cn = E_Kn(Pn) Can be decomposed into parallel double encryptions, and is therefore just as vulnerable to a meet-in-the-middle attack as double DES (or more so, if your splitting algorithm is less secure than DES). NB: When I use the term "double encryption" here, I am not referring to your use of DES multiple times after the split; I am referring to the splitting itself as the first encryption, and the DES as the second encryption. Let us define the function Sx_KS(P) as the portion of the splitting algorithm which produces Px: P0 = S0_KS(P) P1 = S1_KS(P) . . . We now have a parallel set of double encryptions as follows: P0 = S0_KS(P) C0 = E_K0(P0) P1 = S1_KS(P) C1 = E_K1(P1) . . . Each of these double encryptions is vulnerable to a known-plaintext meet-in-the-middle attack from P to Cx. >Don't concatenate the negation of the two key hash to the hash. The >point of that step was to split the cipher into two equal sized parts, >but there is no reason to require that. In fact the possibility of >different sized parts would add to the confussion. (The probability >of an extreme imbalance in the size of the ciphers is extremelly >small.) >I think that multiplexing based on the hash of the concatenated keys >is as secure as the one way hash function is, no? In my above argument, I assumed a splitting key which is completely independent of the DES keys. This will be more secure than a splitting key which is *any* function of the DES keys, since it increases the size of the keyspace. >> the security of this scheme is significantly less >> than that of triple DES. >Well I don't believe that this is the case, Perhaps you do now? >but there is one way to find out >:). I believe that for messages longer than a couple of K, my algorithm >provides substantially more security than its DES analog and is quicker. >I'll write up a version of this that splits into 4 parts and post it here >some time over the next week. I think that splitting into four parts should >be about as quick as double DES while providing substantially more security >than triple DES (which I will time it against). If you still maintain this position, then either you have not understood my argument above, or I seriously misunderstand your algorithm. If you have not yet been convinced that you have not eliminated the meet-in-the-middle attack as triple encryption does, then I welcome your algorithm in code, so that I may see if I am missing something fundamental in your approach. However, I strongly suggest that you review meet-in-the-middle attacks as described by Merkle and Hellman and judge for yourself their applicability to and effectiveness against your algorithm. >The question of the security of the split is difficult to resolve so I would >like some help with it. Is multiplexing based on the hash of the concat of >the keys as secure as the hash? The security of the generation of the splitting key from the DES keys is almost irrelevant. You can guarantee that the splitting key is completely uninferable from the DES keys by making them independent, yet the split+encrypt algorithm is still as weak as (or weaker than) double DES. JD -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLiwC4EGHwsdH+oN9AQFfIQP+MoNBMzrrZiTJYdF2eIuwLiprxTLeqBpR pxNfOrQ190Ugw+BGcjgbb7r1HZkpPtvNaXEtS/n0jBDasMalnwnPbNDM1rpl0ZkY qWsGcLXhb5MQr/sCN9E5Bud8QCRD1eF+OL3jLUxIq3fKVuECA1zk+4osE2bTw2Fv shX6vT8xZjg= =COAe -----END PGP SIGNATURE-----

2 1