December 2003 - cypherpunks-legacy

Re: Unofficial Release
by trollins＠telos.com 17 Dec '03

17 Dec '03

Parry says: >Because it isn't cheap, first of all. If you wanted to run a >completely secure internet, for example (a problem I am currently >working on) the cost of all those RSAs really DOES show up, and fast. Parry, It looks like you have your own agenda in which large rsa keys doesn't fit your time constraints. Don't implement large keys for your secure net. And don't convince yourself that it be COMPLETELY SECURE. -tom

3 2

Hardware RNG's
by John A. Thomas 17 Dec '03

17 Dec '03

Roger, I would like some details about your hardware RNG, if you could, including how you were reading the random value. I had the impression you were taking one bit at a time. What did you mean when you said: "I just got a 3 standard deviation at a 1000000 sample..."? What statistical testing did you do? I used the chi-square test on 8-bit values (255 degrees of freedom), and also computed the probablility for the chi-square statistic. I programmed the runs-up and runs-down tests as suggested by Knuth, and computed the chi-square for those as well. Finally, I counted the numbers of 1 and 0 bits, and the number of times 1 followed 0, 0 followed 1, etc. I didn't do the autocorrelation test. If you have any code for that, I would appreciate having it. I'm not sure what you mean by "...the derevitives of the sequence..." What is that? I suppose these gadgets could be useful for those who want the absolute security of the one-time pad, and can exchange disks securely. With disks holding 1.44 meg now, it could be practical. John A. Thomas b858jt(a)utarlvm1.uta.edu 75236.3536(a)compuserve.com PGP public key available.

1 0

Get U.S. Representatives to use PGP?
by Jonathan Rochkind 17 Dec '03

17 Dec '03

I just saw a press release somewhere or other on the net which stated that a number of U.S. Representatives now have email addresses @hr.house.gov. Among other things, the release stated: > In addition, constituents who communicate with their > Representative by electronic mail should be aware that Members will > sometimes respond to their messages by way of the U.S. Postal Service. > This method of reply will help to ensure confidentiality, a concern > that is of upmost importance to the House of Representatives. What if we could get the Reps to use PGP to solve this problem? Sure, they _should_ be using clipper chip, to respect the Administration and all. But the fact is, they couldn't realistically use clipper now, even if they wanted to. No one else uses it. On the other hand, lots of people use PGP. PGP is fully legal now, so the Reps can use it if they want to. Maybe we should write up some form letter proseletyzing PGP and send it to all online Representatives? If we could get even one or two to use it, it would be major major pro-PGP publicity. It would also be a major embaressment to Clipper-supporters (ie. the Administration), but we definitely don't want to mention this in our form letter, as I doubt few Reps want to blatantly embaress the administration like that. But the fact is, PGP really _is_ a de facto standard, which is why teh Reps would use it instead of clipper, and furthermore if we can "trick" (maybe too harsh a word) a Rep or two into using it, it will just prove the standardness of PGP. What do you think? It looks like we'd have to snailmail the form letter to them all if we did it, as their email will only accept stuff from constituents who have pre-registered their email address by snailmail so as to prove their constituency.

1 0

Re: PGP is the product of the week!
by Jeff Gostin 17 Dec '03

17 Dec '03

"Claborne, Chris at SanDiegoCA" <claborne(a)microcosm.sandiegoca.NCR.COM> writes: > PGP is Product of the Week in last weeks PCMag. Good to hear it. Does this mean that PGP has become part of the Establishment? > 4. Mentioned earlier... "Attack the NSA budget". This can be a win and a > loose since a smaller budget could lower our countries defenses. It is > possible that an attack on the budget would get them to lay off without any > real action needing to be taken. This isn't truly an issue. The NSA had it's hey-day during the Cold War. Now that that's over, and the same level of effort can be attuned to fewer enemies, one would think that they don't NEED a bigger budget. --Jeff -- ====== ====== +----------------jgostin(a)eternal.pha.pa.us----------------+ == == | The new, improved, environmentally safe, bigger, better,| == == -= | faster, hypo-allergenic, AND politically correct .sig. | ==== ====== | Now with a new fresh lemon scent! | PGP Key Available +---------------------------------------------------------+

1 0

WARNING!
by dcosenza＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I spoke with Phil Zimmermann today at some length, and he has informed me that users who decide to use the jumo keys generated by the hack of 2.6ui will be running a risk of incompatibility on down the line with future releases he has planned. You have been warned! Ever forward, David - -- - --------------------------------------------------------------------------- David Cosenza dcosenza(a)netcom.com PGP 2.3a Public Key available by finger _or_ ftp.netcom.com:/pub/dcosenza PGP 2.3a Key fingerprint = BF 6C AA 44 C6 CA 13 3F 4A EC 0A 90 AE F3 74 6D "When encryption is outlawed, only outlaws will have encryption." -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCzAgUBLgoyQCjdpAfJZzihAQGXhwTuO79ehD2s5q4c877Uc/+gt5ygytj2cmDD eUGhKGwqhGco9p/SC3FmtFltSvaTRuMP8GKBbQfXPnSQ4l1i2k11qvQObioKjq7p gGsb5CwyK47sVzPm/0WvAYcPc0wv1FHmZQOWLjiQEgjR9q3JHMSD0bDnV0zeoV3Q 6G02xeigDGCuGHQMBm4zT2n5ffldDTS0b2vn4AJZxNYPGoAH5nI= =G/aQ -----END PGP SIGNATURE-----

1 0

PGP is Product of the Week
by Claborne, Chris at SanDiegoCA 17 Dec '03

17 Dec '03

PGP is Product of the Week in last weeks PCMag. I will bang my drum one more time... How to beat the three letter agencies: 1. Power of the press is just one of the weapons at our disposal. Public education and continued press on privacy alternatives is important. One of the things that would help a concerted offensive against the three letter agencies that want to remove our privacy would be to send more articles to the industry rags. Hopefully better than the one published in Byte. The more exposure the better. You there! Start writing! 2. Improve the ease-of-use factor for PGP... That is, write more front ends (windowing since most of the general public uses it). Example: ViaCryptPGP for Compuserve's WINCIM and navigator. I believe in the critical mass theory... "A product becomes a defacto standard not that it is always the best product but because of sheer number of users". In this case I am pushing PGP but I think it would go for crypto products in general. 3. Drive for an independent "renegade" standard like PGP. The term renegade here meaning "having rejected tradition". Flood the net with it and the genie is truly out of the bottle. Now that PGP is "legal" in the US, and people outside the U.S. have the product spec no-one gets left out in the cold. 4. Mentioned earlier... "Attack the NSA budget". This can be a win and a loose since a smaller budget could lower our countries defenses. It is possible that an attack on the budget would get them to lay off without any real action needing to be taken. ... __o .. -\<, chris.claborne(a)sandiegoca.ncr.com ...(*)/(*). CI$: 76340.2422 PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server.

3 2

RE: Unofficial release
by nobody＠ds1.wu-wien.ac.at 17 Dec '03

17 Dec '03

++++++++++++++++++++++++++++++++++++ > Rumor has it that certain government applications do Diffie Hellman > with 2K-bit moduli. Given the apparent connections between factoring > and discrete logarithm (the complexity formulas seem to look very much > alike), it appears that at least one user feels that keys longer than > 1K bits provide a desirable safety margin. I'm still not sure that I understand the original argument against using keys that are "too long" by someone's standards. Nor am I sure the analogy holds up. It would be the security equivalent of saying that it's "paranoid" to put strong locks on your front door because your windows are made of glass, and are thus easier to break than the door. The fact is, most burglars would rather not break a window, if possible, because it's a glaring sign of forced entry visible even while they're in the process of burgling, it's noisy, and they could get cut, leaving blood samples behind and causing themselves pain. Sure, hypothetically, it might be "easier", in a given case, to monitor RF (Tempest) leakage vs. breaking a 1K+ key. OTOH, it would also require putting monitoring equipment at every Internet user's site vs. collecting and cracking keys at a centralized location. Of course, if someone wants to leave his front door unlocked for fear of being labelled "paranoid", that's his prerogative, I suppose. Just don't ridicule others who are more security conscious! +++++++++++++++++++++

2 1

RE: WARNING!
by nobody＠ds1.wu-wien.ac.at 17 Dec '03

17 Dec '03

+++++++++++++++++++++++++++++++++ dcosenza(a)netcom.com wrote: > I spoke with Phil Zimmermann today at some length, and he has informed me > that users who decide to use the jumo keys generated by the hack of 2.6ui > will be running a risk of incompatibility on down the line with future > releases he has planned. You have been warned! > > Ever forward, Doesn't part of "ever forward" sometimes involve something "non-standard" and "running the risk of incompatibility"? Unless there's something flawed with the implementation of longer keys, why shouldn't the first to implement them become the de-facto standard? If a leter release turns out to be incompatible with an older one, but it's cryptographically superior, then it's time to switch, even if it means generating and distributing new keys. Anyone concerned enough about security to want the "latest and greatest" crypto package, with longer/stronger keys or whatever, should already be practicing good key management and generating new keys periodically, anyway. My only concern would be whether the implementation of longer keys might possibly "push the envelope" of the math routines used, and thus introduce subtle, hidden weaknesses. Two examples might be an RNG that became non-random with larger numbers, or a primality tester that failed to detect larger non-primes. If you have evidence for any of those scenarios, I'd love to hear it. Personally, I'm staying with PGP 2.3a until the dust settles a bit. I've FTPed the RSAREF 2.6 release, and it remains in its zipped archive for now. Just as an aside, can some of the PGP-aware-anon-remailer operators comment on what they plan to do with respect to the various PGP versions? ++++++++++++++++++++++

4 3

Re: PGP is Product of the
by Duncan Frissell 17 Dec '03

17 Dec '03

To: cypherpunks(a)toad.com J >A person in the group to which I refer is ``in the US'' by the J >commonly understood geographical definition of that phrase, but has as J >a matter of conscience renounced any citizenship he may have had. He J >refuses on principle to affirm that he is a national person, and J >therefore cannot use PGP 2.6 because such affirmation is supposed to be J >required in order to obtain PGP 2.6, and may therefore be implicit in J >each use of PGP 2.6. On the other hand, if he uses PGP 2.6ui, he risks J >being accused of violating RSADSI's patent rights, because they will J >take him to be "in the US", even though he has disaffiliated himself. J >What version of PGP can such a person use? Even though your friend is no longer a U.S. Citizen he is a "legal resident of the U.S." in that he could not be deported. Residence is defined at law as equal to "domicile" and is under the legal control of the individual rather than the State. "Domicile" is defined as "Actual physical presence plus intent to make the place one's home." Once domicile is gained, it persists even if you are away until one acquires a new domicile by one's own action. So he could use the MIT version of PGP. When their lawyers came up with their spastic language about users having to be U.S. Citizens or Green Card holders they weren't trying to be exhaustive. They were clearly trying to mirror the ITAR crypto regs. Since your friend, while not a citizen, is not an alien he can possess crypto technology under ITAR and thus under the MIT license. DCF "If Nicole had had a Colt Mk IV Govt. Model, she'd be alive today." --- WinQwk 2.0b#1165

1 0

Re: RE: WARNING!
by usura＠vox.hacktic.nl 17 Dec '03

17 Dec '03

nobody(a)ds1.wu-wien.ac.at writes: >Just as an aside, can some of the PGP-aware-anon-remailer operators comment >on what they plan to do with respect to the various PGP versions? The remailers at vox.hacktic.nl are running PGP 2.6 ui. Regz, -- Exit! Stage Left. Alex de Joode <usura(a)vox.hacktic.nl>

1 0