December 2003 - cypherpunks-legacy

Re: RC4 - A response from RSA Data Security, Inc.
by Jim Gillogly 17 Dec '03

17 Dec '03

> From: jim(a)RSA.COM (Jim Bidzos) > Any person or > entity that acquires, discloses or uses this information is subject to > criminal and civil penalties including an injunction, compensatory > damages, punitive damages and payment of RSA's attorneys fees. Let's count the entities that have acquired this information. What're the most recent valid Usenet survey numbers from Brian Reid about the distribution of sci.crypt? Collecting a dollar from each of these entities would pay the salaries at RSA for a while... Jim Gillogly 26 Halimath S.R. 1994, 04:24

1 0

RC4 article in Saturday (Sept 17) New York Times
by Matt Blaze 17 Dec '03

17 Dec '03

John Markoff has a piece on the RC4 betrayal in the Business section of the Saturday NY Times (page 37), "A secret computer code is out -- Key to data security appears on internet". Not much that hasn't already been said here or on sci.crypt, but there was an interesting quote from Jim Bidzos that suggested that one of the conditions RSADSI agreed to in order to get approval of 40 bit RC4 for export in shrink-wrap software included keeping the algorithm confidential. Bidzos speculated that the NSA could revoke RC4's export status as a result of the disclosure. Also, the piece reports that "The RC4 formula was first circulated on Tuesday to a specialized computer network mailing list of computer researchers who oppose the Government's stringent controls on data encryption technology. The mailing list, which has thousands of computer users around the world, is known as Cypherpunks, and the mailings usually consist of highly technical discussions of data encryption technology." I guess Markoff gets Eric Blossom's moderated version of the list :-) -matt

3 2

PKZIP encryption broken
by khijol!erc＠apple.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - From a recent comp.risks post: Newsgroups: comp.risks Subject: RISKS DIGEST 16.39 Message-ID: <CMM.0.90.1.778901594.risks(a)chiron.csl.sri.com> Date: 7 Sep 94 01:33:14 GMT Sender: usenet Reply-To: risks(a)csl.sri.com Distribution: world Organization: The Internet Gateway Service Approved: risks(a)csl.sri.com Lines: 624 RISKS-LIST: RISKS-FORUM Digest Tuesday 6 September 1994 Volume 16 : Issue 39 FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator ***** See last item for information on RISKS (comp.risks) ***** Contents: PKZIP encryption broken (known plaintext attack) (Paul Carl Kocher) - ---------------------------------------------------------------------- Date: Sun, 4 Sep 1994 17:31:28 -0700 From: Paul Carl Kocher <kocherp(a)leland.Stanford.EDU> Subject: PKZIP encryption broken (known plaintext attack) I finally found time to take a closer look at the encryption algorithm by Roger Schlafly that is used in PKZIP and have developed a practical known plaintext attack that can find the entire 96-bit internal state. The basic encryption algorithm has four steps, two of which are based on linear shift registers, one is like a linear congruential, and the final converts the contents of an internal state register into an 8-bit value to XOR onto a plaintext byte. A complete description of the algorithm is included in the file APPNOTE.TXT, which is included with PKZIP version 1.1 (check Archie for "pkz110.exe"). Although the algorithm is substantially better than the toy ciphers used in many products, I have developed a practical known plaintext attack that finds the 96 bit internal state. Unlike the ZipCrack program I released a couple years ago, this attack finds the internal state registers directly and does not involve a brute-force attack on the password. If adequate known plaintext is available, my attack will find the state, regardless of the password's size or content. My attack is an improvement on a known plaintext attack described in a paper by Biham (unpublished work) that takes 2^38+ operations. My improvements reduce the amount of work required by approximately a factor of 1500 with 200 bytes of plaintext. With less plaintext the attack will take somewhat more time, but just 40 bytes should be enough to be practical. I've written code for all steps of the attack; a version written in C with a few optimizations in inline assembly runs in less than a day on my '486. The attack will work with versions 1.1 or 2.xx of PKZIP and other programs using the same algorithm. A more in-depth description of the attack will be made available soon, but I wanted to let people using PKZIP (and any other programs that use the same algorithm) know immediately about the weakness. Paul C. Kocher kocherp(a)leland.stanford.edu Independent data security consultant/contractor. 415-323-7634 [Disclaimers removed. PGN] - -- Ed Carp, N7EKG Ed.Carp(a)linux.org, ecarp(a)netcom.com Finger ecarp(a)netcom.com for PGP 2.5 public key an88744(a)anon.penet.fi ** PGP encrypted email preferred! ** "What's the use of distant travel if only to discover - you're homeless in your heart." --Basia, "Yearning" -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLnqUyiS9AwzY9LDxAQECcQP/cYtGpd8882KPmdPN0N1MZf4sjo4Mu8SY V9zEcRnU7VXU1WgqJiGSgyOQbYAaRxDSudtYKH5DHY+qvqLE397nkRuv1qjf5d9b PZ5Pw4YOEhAxVeq4DDSLYO5Lf2T4qs7IjVMETZjibV0feodbridG9XliEFdhrPWK vVhX3ZMWXH8= =oH6T -----END PGP SIGNATURE-----

1 0

RC4 article in Saturday (Sept 17) New York Times
by John Young 17 Dec '03

17 Dec '03

Responding to msg by mab(a)research.att.com (Matt Blaze) on Sat, 17 Sep 0:56 AM Standard offer of e-mail copies. Legal Note: NYT is electronically stalking posters of copyrighted material, according to NYT reporter Peter Lewis on list Cyberia-L. John

3 2

Acapulco H.E.A.T. Auxilliary Review
by merriman＠metronet.com 17 Dec '03

17 Dec '03

Well, here we go, sports fans - an alternative review of Acapulco H.E.A.T. In this weeks' episode, the plot was that an Iranian freighter had gone down in the waters off Acapulco - with stolen Russian U-235 aboard (enough to make Iran a Nuclear Power). The heavy (with an atrocious generic Slavic accent) was trying to recover said uranium for sale to Iran ($50M price tag - keep it in mind). Our Fearless Team was assisted by a world-famous salvage diver. Since nearly all the "action" took place underwater (duh!) at 17 fathoms (102 feet to you non-Navy/sailing types :-) the bikini count was inordinately low. Ditto on gun battles. Ditto on explosions. Ditto on crypto/computer/privacy - the closest we got was a database search of typhoon patterns. No Fabio. There *was* a brief flurry of goodguy/badguy underwater WWF action, but considering that their alleged bottom time for the dives was 25 minutes (any diver confirmation out there?), it not only didn't last long, but wasn't terribly productive. Toward the end, the H.E.A.T. team succeeded in recovering the stolen uranium; interestingly, it appeared to be contained in a single box, approximately 2' x 18" x 18" - what with shielding, etc, I don't know that there was $50M worth inside. Something to look forward to: next week, the team goes to Panama to deal with an Evil Drug Lord. From the preview clips, it looks to have a fairly high bikini count - and they appeared to be some very nice bikinis, indeed :-) Dave Merriman ----------------------------- Disclaimer: I'm not a reviewer, but I play one on the Internet. - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)metronet.com for PGP/RIPEM public keys and fingerprints. Unencrypted Email may be ignored without notice to sender. PGP preferred. Remember: It is not enough to _obey_ Big Brother; you must also learn to *love* Big Brother.

2 1

Re: Virtual assasins and lethal remailers
by doug＠OpenMind.com 17 Dec '03

17 Dec '03

Adam Shostack writes: > The anonymous nature of the funds & contract negotiation will >make finding this person more difficult, not impossible. A number of people have raised this idea in one form or another when confronted with these notions. However, the point I think needs to be stressed is that: To the extent that evidence can be found, the goals of crypto anarchy have failed. It is certainly true that police can search for a motive, can point at the usual suspects, etc. Adam claims: >The tracing of >the money from payer to assassin might be difficult, but there will >probably be a large, unaccounted for withdrawal from some back >account. To the extent that this is true, then it is also true that people are not able to keep their financial status and records completely secret, and the state can continue to enforce the collection of taxes. Strong crypto has the potential to completely remove these things... what if no one knows what secret bank accounts the suspect uses? The status of the suspect's funds and all cash transactions can be completely private, with no way to find them (even with all the court orders in the world). There are, indeed, many weaknesses to such a scheme in the real world *today*, but it is the aim of crypto anarchy to remove all such weaknesses. Doug ___________________________________________________________________ Doug Cutrell General Partner doug(a)OpenMind.com Open Mind, Santa Cruz ===================================================================

1 0

Possible [Best?] Scenario
by Anonymous User 17 Dec '03

17 Dec '03

Let's say I have a digital cellular phone. I also have Anonymous Remailers, PGP, and over 100 BBS numbers (structured for which day and which hour each would be used) so that I can contact and talk to my "Friend." Please tell me how the LEA's can find me and understand the transactions between us? If I have several encryption programs, can I 'layer' each document [I PGP the file, the I DES the PGP file, then IDEA for the final layer. Does the NSA have to crack it one layer at a time, or can they bombard it, crack the layers in whatever order the supercomputer finds? If I am missing something, please let me know what I have missed.

2 1

Re: RSADSI vs. Remailers (Meta Strong Crypto)
by doug＠OpenMind.com 17 Dec '03

17 Dec '03

[Hal forwards articles mentioning that the jpunix remailer is down after complaints were made regarding the remailing of "copy-written" material. The jpunix remailer is the visible remailer used to post the RC4 source code to cypherpunks.] (Meta Strong Crypto) This points at one of the weakest links in the crypto anarchist's toolset. To the extent that the sheep^H^H^H^H^Hpublic becomes concerned with the "implications" of the tools of crypto anarchy, there will probably be attempts to outlaw or otherwise control these tools. Take the recently much discussed notion of the risk-free placement of "contracts to kill". This relies upon almost all of the major tools in the crypto anarchist's toolkit. I count four in this case: the existence of strong public key cryptography; the existence of widely read and used public bulletin boards (such as alt.test); the existence of untraceable digital cash; and the existence of secure anonymous remailers. Of these four, strong public key cryptography is here today and would be very difficult to regulate legislatively at this point. Likewise, widely visible public bulletin boards are rock solid. Untraceable digital cash is of course not really here today, and it is possible that attempts to outlaw it could be made. However, Swiss banks have specialized in anonymous accounts and similar services for a long time, and there could be significant financial gains to be made from issuing untraceable digital cash. It seems likely that there will be banks in Switzerland or elsewhere that will be more than happy to do this. Then the only impediment can be at the level of outlawing the *use* of digital cash. However, the combination of secure public key encryption and anonymous remailing would make the use of digital cash impossible to detect. This leaves anonymous remailers as the one vulnerable link in the chain. Imagine that a country (say the USA) decides to outlaw the operation of, or use of, any anonymous remailer. I don't see how any of the other tools of strong crypto could be used to circumvent such laws. The last link in an anonymous remailer chain is always visible. The operator can be prosecuted for operating an anonymous remailer, if inside the borders of the country (or even outside, given recent USA claims to be able to kidnap foreign citizens on foreign soils for prosecution within the USA). It still might be possible to have anonymous remailers operating safely outside the borders of the country -- but it would be possible to monitor for traffic *destined* for these remailers, leaving the country. Since no anonymous remailers exist within the country, the origin of this traffic can be determined, and the sources can be prosecuted for use of an anonymous remailer. (Going Out On A Limb) One possible way around this societal control of anonymous remailers might be the existence of very large DC-nets (or related technologies). The idea here would be to effectively spread the social responsibility for the operation of an anonymous remailer out over such a large segment of the population that societal (legal) pressures could not be effectively brought to bear to suppress it. This would in effect be a type of political movement... the participating members of these vast "DC-nets" would effectively be members of a kind of political group. This membership would be intrinsically visible, since it will be used to *construct* the possibility of anonymity, and cannot rely on it. In order to be immune from suppression by the rest of society, the membership rosters would have to be comparable to that of a major political party... probably on the order of millions of members (at least hundreds of thousands). Getting there would be the tricky part... during the initial formation stage, when the membership rosters are low, the group is susceptible to be legislated out of existence. Doug

2 1

(fwd) "Will You Be a Terrorist?"
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Cypherpunks, Not all of you like posts that mention "guns" in any form, so if this the case for you, hit "D" now. I think the recently-passed Crime Act has implications for what some are calling "terrorist speech" and that Cypherpunks remailers may be construed as "PROVIDING MATERIAL SUPPORT TO TERRORISTS" in the context of being "communications equipment." Consider this "food for thought." An excerpt, and commentary by the original anonymous poster, is included below. I know that our favorite optimists, Duncan Frissell and Sandy Sandfort, are fond of saying that it's already over, that we've already won, that the state is powerless, etc., but when I read the text of the Crime Bill (available from ftp.nra.org in pub/legislation), I just can't buy that. I see a growing police force, I see U.N. blue helmets, I see many more prosecutions for a growing list of crimes, I see my gun rights being taken away, and on and on. In the section below, read carefully the sections about providing support for "terrorists." Note that belonging to a pro- or anti-abortion group in which _one_ of the members uses violence (a fistfight, a jostling of a cop, or a shooting...) makes the group a "terrorist" group, under the new language of the Crime Act. I will not be surprised to hear that the Cypherpunks group is classified as a terrorist group, for a variety of reasons (not the least of which was the "liberation" of the RC4 code, the Mykotronx-government deal info, the debates about undermining the government, the talk of assasination markets, etc.). Sorry, but I just can't "Don't worry, be happy." --Tim May Newsgroups: talk.politics.guns From: anonymous(a)extropia.wimsey.com Subject: "Will You Be a Terrorist?" Message-ID: <199409120907.AA15385@xtropia> Date: Mon, 12 Sep 1994 02:07:16 -0700 X-Mailer: mail-news 2.0.3 Remailed-By: remail(a)extropia.wimsey.com Comments: This message was anonymously remailed. Do not reply to the address in [Check it out - Cross-posted from Fidonet:] The "Crime Bill" passed by Congress recently (truename: Violent Crime Control and Law Enforcement Act of 1994) has a frightening provision that hides a boogeyman under its superficially appealing surface: *----------* *----------* *----------* SEC. 120005. PROVIDING MATERIAL SUPPORT TO TERRORISTS. (a) Offense.--Chapter 113A of title 18, United States Code, is amended by adding the following new section: ``Sec. 2339A. Providing material support to terrorists ``(a) Definition.--In this section, `material support or resources' means currency or other financial securities, financial services, lodging, training, safehouses, false documentation or identification, communications equipment, facilities, weapons, lethal substances, explosives, personnel, transportation, and other physical assets, but does not include humanitarian assistance to persons not directly involved in such violations. ``(b) Offense.--A person who, within the United States, provides material support or resources or conceals or disguises the nature, location, source, or ownership of material support or resources, knowing or intending that they are to be used in preparation for, or in carrying out, a violation of section 32, 36, 351, 844 (f) or (i), 1114, 1116, 1203, 1361, 1363, 1751, 2280, 2281, 2331, or 2339 of this title or section 46502 of title 49, or in preparation for or carrying out the concealment of an escape from the commission of any such violation, shall be fined under this title, imprisoned not more than 10 years, or both. ``(c) Investigations.-- ``(1) In general.--Within the United States, an investigation may be initiated or continued under this section only when facts reasonably indicate that-- ``(A) in the case of an individual, the individual knowingly or intentionally engages, has engaged, or is about to engage in the violation of this or any other Federal criminal law; and ``(B) in the case of a group of individuals, the group knowingly or intentionally engages, has engaged, or is about to engage in the violation of this or any other Federal criminal law. ``(2) Activities protected by the first amendment.--An investigation may not be initiated or continued under this section based on activities protected by the First Amendment to the Constitution, including expressions of support or the provision of financial support for the nonviolent political, religious, philosophical, or ideological goals or beliefs of any person or group.''. (b) Technical Amendment.--The chapter analysis for chapter 113A of title 18, United States Code, is amended by adding the following new item: ``2339A. Providing material support to terrorists.''. *----------* *----------* *----------* In the U.S. Title 18 Code, terrorism is defined as "engaging in any act or conspiring to engage in any act intended to intimidate or coerce the civilian population or the government" or close words to that effect. What does this mean? Suppose you organize a militia and some little jot or tittle is just that much off -- and the thugs at the BATF or FBI or NatPol decide that your militia is an "armed group"? They can now seize your house, your car, your bank account and anything else even remotely connected with the maintenance or support of the militia, and make *you* prove your innocence before the Federal thugs will grudgingly return your life to you. Suppose you participate in a demonstration against abortion and just one member of the peaceful demonstration gets into a fistfight with an escort. You had given a ride to this demonstrator -- is the fistfight "terrorism" and you a collaborator in this "terrorism" to be arrested and thrown in jail and your car seized until you can prove that you did not know that the other demonstrator did intend to fight with an escort? Suppose you demonstrate against national health care and you yell that Clinton should be thrown out of office and make a threatening gesture -- will the thugs treat this as an "attempt to intimidate the government" and take your car and perhaps your home if you used it to prepare materials for the demonstration? Suppose you quote Thomas Jefferson's words about a revolution being due every twenty years -- will you be thrown into jail for that? Note that the above section does not allow anything but "NON-violent" goals. This is another direct attack upon the First Amendment and deeply disturbing in its implications when considered as part of a set of other federal statutes scattered across Title 18 criminal law. ***end of quoted section*** -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. Cypherpunks list: majordomo(a)toad.com with body message of only: subscribe cypherpunks. FAQ available at ftp.netcom.com in pub/tcmay -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. Cypherpunks list: majordomo(a)toad.com with body message of only: subscribe cypherpunks. FAQ available at ftp.netcom.com in pub/tcmay

9 19

Returned mail: Host unknown
by Mail Delivery Subsystem 17 Dec '03

17 Dec '03

----- Transcript of session follows ----- 550 3toad.com (tcp)... 550 Host unknown 554 <cypherpunks(a)3toad.com>... 550 Host unknown (Authoritative answer from name server) ----- Unsent message follows ----- Received: from hummingbird.CS.Arizona.EDU by optima.CS.Arizona.EDU (5.65c/15) via SMTP id AA23319; Sat, 17 Sep 1994 11:26:06 MST Date: Sat, 17 Sep 1994 11:26:04 MST From: "Patrick G. Bridges" <bridges> Message-Id: <199409171826.AA03054(a)hummingbird.cs.arizona.edu> Received: by hummingbird.cs.arizona.edu; Sat, 17 Sep 1994 11:26:04 MST To: cypherpunks(a)3toad.com Subject: RC4 -----BEGIN PGP SIGNED MESSAGE----- >>>>> "ritter" == ritter <ritter(a)pentagon.io.com> writes: ritter> In <CwA0Br.KH0(a)chinet.chinet.com> ritter> schneier(a)chinet.chinet.com (Bruce Schneier) writes: >> I think the smartest thing RSA Data Security, Inc could do at >> this point is to patent RC4. ritter> Sorry, but they don't have that option. ritter> When a product containing an invention is sold ritter> commercially, a one- year count-down starts on the patent ritter> application. ritter> --- Terry Ritter ritter(a)io.com So, to summarize what I've heard so far: So, unless RSADSI had already filed for a patent, they're essentially screwed. The algorithm is revealed, but they can't patent it. The source posted may or may not be copyrighted, but anyone can roll their own version which would not be copyrighted and use it freely, unless Trade Secret law say otherwise, which I've heard several people say it doesn't... What has been done may or may not be criminal... If the posted code IS RSADSI source, this is clearly a breach of copyright law...If it is a reverse engineering job, then it's illegal if the reverse engineer had a no-RE agreement w/ RSADSI, which may not be the case if she just worked back from Lotus Notes, for instance... I can't say I'm upset by the fact the algorithm itself has been made public, since IMHO a new, fast algorithm will help the state of academic research in cryptography, and I think most would agree that peer review is the best way to evaluate encryption algorithms. Still, I wonder about the effects this release will have on the net as a whole... This release could make good scare tactic ammunition for the pro-clipper/DigTel folks to use w/ corporations... It may also fuel worrisome cries for regulation of the networks... - -- *** Patrick G. Bridges bridges(a)cs.arizona.edu *** *** PGP 2.6 key available via finger * Key Fingerprint: *** *** D6 09 C7 1F 4C 18 D5 18 7E 02 50 E6 B1 AB A5 2C *** *** #include <std/disclaimer.h> *** -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLns0j0oL7Aaetl5pAQFDkwP+M2cO95+jjj7cZp/6FBmplfYM7WhndGhn AcR+NsS6UNvjU+e/q7ekRXPDAHzh4idTldrGndoUAsvVhdXJpYDOvyGyBG1e0W/c HPLQbiNcURRDkDeTIVLLAtX1ECjmfEeBPC/2iiTq1GaivbEGCL1kq+2AS1dSu31m EZOOOWJQe68= =JdAM -----END PGP SIGNATURE-----

1 0