December 2003 - cypherpunks-legacy

Re: PC Expo Disk Available
by markh＠wimsey.bc.ca 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Subject: Re: PC Expo Disk Available > Hey guys, I've just sent up the PC Expo disk package to ftp.wimsey.bc.ca > incase anyone is interested in it. Give it some time as Mark has to clear it > but it's in the incoming folder right now... It is available to U.S. and Canadian persons at ftp.wimsey.bc.ca /pub/crypto/software/dist/US_or_Canada_only_XXXXXXXX/pcxpo/pcxpo.zip Mark -----BEGIN PGP SIGNATURE----- Version: 2.4 iQBVAgUBLhnkIWrJdmD9QWqxAQFk2QH/VZnf1PqE0ftwQdfQLIu8Q4kaOeBh0C2R wN8mdxSEpSgWsCOzqgpN9jv195/GrQMETqAznUs2L6jA4rWyfnlbPg== =nPCR -----END PGP SIGNATURE----- -- Mark Henderson markh(a)wimsey.bc.ca - RIPEM MD5: F1F5F0C3984CBEAF3889ADAFA2437433 ViaCrypt PGP key fingerprint: 21 F6 AF 2B 6A 8A 0B E1 A1 2A 2A 06 4A D5 92 46 low security key fingerprint: EC E7 C3 A9 2C 30 25 C6 F9 E1 25 F3 F5 AF 92 E3 cryptography archive maintainer -- anon ftp to ftp.wimsey.bc.ca:/pub/crypto

1 0

RE: ACAPULCO H.E.A.T.
by Blanc Weber 17 Dec '03

17 Dec '03

From: Sandy Sandfort Gooder News: Lots of shots of Alison Armitage in swim suits. ........................................ Oh, good. I feel safer now. Blanc

1 0

(None)
by Jeff Gostin 17 Dec '03

17 Dec '03

Joseph Block <jpb(a)gate.net> writes: > 1701THQ1EBA7FLJ0SOM1THL1EDA7 > Without knowing the phrases, method, or number, what makes this insecure? > I'm not deliberately trying to be dense, I'd like to know why I shouldn't use > this sort of mnemonic method to remember the pass phrase. _Essentially_, you have a random string of text. Mind you, it's not statistically, nor cryptographically, random, but it's something that no PERSON would guess. If you are trying to get something to keep PEOPLE out, you've picked a nice one. If, OTOH, you're trying to get something to keep HACKERS/MACHINES out, you've got a somewhat time consuming one. Does that answer your question? :-) --jeff -- ====== ====== +----------------jgostin(a)eternal.pha.pa.us----------------+ == == | The new, improved, environmentally safe, bigger, better,| == == -= | faster, hypo-allergenic, AND politically correct .sig. | ==== ====== | Now with a new fresh lemon scent! | PGP Key Available +---------------------------------------------------------+

1 0

RE: FW: A third voice re: science and spirit
by Blanc Weber 17 Dec '03

17 Dec '03

From: <nobody(a)shell.portal.com> "Ingore"? Is that anything like an "AlGore"? Is that a verb to describe the state of the country, as in "we've just been INGOREd"? ........................................ Could be, if you want it to be. But it could also be part of some shocking, nonsensical AlGoreYTHM. Blanc

1 0

GOPHER: AOL, CPSR, cypherpunks
by Karl Lui Barrus 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Cypherpunks, Earlier, somebody (I beleive Carl Ellison, but I screwed up and deleted the file) asked about AOL and the gopher site. The problem may not be AOL or CPSR actually. What happened is this: Chael reorganized the gopher site, placing the Cypherpunks Gopher Archive into a subdirectory. So the archive is still at chaos.bsu.edu, but no longer immediately at the top level. Perhaps CPSR's pointer to the site is no longer valid! Or maybe the problem is that he also upgraded to a new gopher server, which is supposed to be backwards compatible ;) and one of these days I'll create some sort of index files (?) to take advantage of the new features, etc. So maybe this is the problem, a new version that AOL doesn't handle. So try gopher'ing directly to chaos.bsu.edu and then into the "Cypherpunks Gopher Archive" if going through somebody else isn't working. Hm... I'll inform CPSR about the change. Karl Barrus klbarrus(a)owlnet.rice.edu -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLhnpG8SF/V8IjI8hAQGn0gP/YjRzP3OODE9e7pXdHhOpHtY6UddH75Fj 7z1T/RA9JuL3es926zNZP2K9C1p9AlgwKyPcea2GWkgT8q79Ink4VXKGJbwEzzwV Kyh5a3Efm7ZsewxlUnrkRtppH2qc//bhNkpaTSIlM1Ccl7+yBttONyq6qHFfpzLd m88J8APnLWM= =AbvY -----END PGP SIGNATURE-----

1 0

Re: Detweiler clone at WSJ
by Blanc Weber 17 Dec '03

17 Dec '03

From: Dave Hart <list of things to do to make the life of moral innocents safer> There! That should protect us from all the creeps in the world. Of course, there will be a few anarchist crybabies who will call these measures fascist, and a few victims of the new openess...(etc) .......................................................... Don't laugh - they'll probably agree these are really good ideas. The author might even commend you for being so thorough and stringing them together to make such a complete package. Blanc

1 0

Re: Password entropy
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

"Nobody" asks whether you really get 128 bits of entropy out of MD5 if you put in fewer bits, and whether you need to put in more than 128 bits of entropy to get 128 bits of entropy out. (This is mainly relevant for the case where you iterate MD5 N times for large N.) Entropy = -sum ( p(Xi) * log2(p(Xi) ) , Xi { outcomes of a random event X } which is the sum of the amount of information each event gives you times the probability of the event occurring. In this application, the events are "the input to MD5 is" and "the output from MD5 is", and each input is one of many (presumably independent) values leading to the same output. You know that Entropy(MD5(Xi)) is <= 128, since there are only 2**128 possible outputs, and they're supposedly equiprobable given random input. If the distribution of the Xi's is known, and it has substantially lower entropy than 128 bits, then the output also has lower entropy, since the probability of MD5(Xi) appearing is the probability of Xi. There's a bit more entropy lost in the MD5 step - if MD5(Xi) = MD5(Xj), -p(Xi|Xj)*log(p(Xi|Xj) < -p(Xi)*log(p(Xi)) + -p(Xj)*log(p(Xj)). On the other hand, collisions are infrequent - the probability of a pair of numbers having the same MD5 value is presumed to be 2**-128, and the usual birthday paradox calculations apply, so you'll probably find one if you take 2**64 random samples. At this point, knowing the details of the MD5 algorithm *does* matter; you can analytically find a few pairs of inputs that have the same MD5 value - but if you're choosing random inputs it's not likely to happen. If you could analytically invert MD5 (it's presumed that you can't, even for the 128-bit-input case), or store the results in a 2**128 large lookup table (:-), you could find out exactly how much lossage there is. Don't worry about it :-) If you still *are* worried about it, however, you can scramble things a bit; since MD5 produces 128 bits of output but uses 448 bits of input+padding, you can add a different constant to the input at each step. If you're using it as a salt, put it at the beginning; if you're just doing it for multiple iterations it doesn't matter much. Bill Celebrate Independence Day the traditional way - overthrow a government!

3 2

MD5: hashing, > 1->1
by Karl Lui Barrus 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >> is based upon the fact that *finding* two messages that hash to the >> same value is as difficult as a brute-force attack, which requires >> 2^128 trials (maybe it's 2^127, but I don't think that really > This is incorrect, with a large memory, this is the birthday paradox in > action, and it takes about 2^64 tries, which puts SHS right up there at > 2^80 same as skipjack. Geez, I did it again (deleted the original message - the one Derek sent). So from memory, I beleive that in the context in which Derek was describing the "finding two messages" above, his statement about the difficulty (2^128) is correct. The birthday paradox is the situation when you are looking for *any* two messages that hash to the same value. In this case, 2^64 is the expected work. However, if you are given a particular hash and you are looking for another message which has the same hash, then the difficulty is 2^128. This is the situation which is (more) important since it corresponds to forging MD5 hashes for a signed message. Say you are given a message and you want to find another which has the same hash. 2^128 applies. The birthday paradox situation corresponds to just finding two messages with the same hash. In this case the expected work is 2^64, but then the two messages that you discover with the same hash may be random (and thus worthless). Karl Barrus klbarrus(a)owlnet.rice.edu -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLhnrj8SF/V8IjI8hAQGlmQP6AshYEwjoJGbN8cZZRiPAEdhZO9AAWG2Y P08YcQ/wUWNEAOAvi4WISPobIWxO6oRk+fBRvUMWv7wyU4eRA/7yj95nlDaui5oW rDaFrh+IBnC8Epce2hing6TqWdBxL5uKBCuq1CrKnUkDO2uESoZkN/aDpbnvueC9 05aqKfQ9P+U= =Lscb -----END PGP SIGNATURE-----

2 1

Re: BoardWatch & DigiCash.
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

: > Ziff-Davis publications. Anyone care to suggest a magazine (or other form : > of trade rag) that gives unbiased information (or at least as close as : > possible)? Z-D lost my subscription to both PC Mag and PC Computing, for : * I like "Byte." Our own Peter Wayner has written good articles on : crypto. Good articles are few and far between. Byte has gone downhill in a *big* way, from the non-PC general computing/algorithm focus is had 10 years ago - when we would have the annual Languages edition, and programs you could actually do something new and useful with. (I wrote an image processing suite based on their 'Mona Lisa' article, and their one of finding multi-word anagrams turned into my scrabble program) Anyway all the blow-in cards suck. : * "Communications of the ACM" is also good. Maybe it got better recently, but last few years I was reading it, it too had turned into a comic. I was reasonable back around 76-80 but then it turned into a joke. I admit I haven't looked at it in the 90's. G

1 0

PC Expo Disk Available
by rarachel＠prism.poly.edu 17 Dec '03

17 Dec '03

Hey guys, I've just sent up the PC Expo disk package to ftp.wimsey.bc.ca incase anyone is interested in it. Give it some time as Mark has to clear it but it's in the incoming folder right now... I'll try to send it up to some other sites, but I guess I won't send it to csua.berkeley.edu as it isn't being taken care of... (if you know otherwise let me know and I'll send it there too...)

1 0