December 2003 - cypherpunks-legacy

European wilingness to pay ...
by p.v.mcmahon.rea0803＠oasis.icl.co.uk 17 Dec '03

17 Dec '03

> also, Bob Morris said in his talk, acc. to Gillogly, that Europeans > *were* willing to pay for encryption in their phones, but those in the > US weren't. please expand on that little nugget!! how did you come Presumably this is a reference to GSM. - pvm

1 0

Re: Crypto '95: Robert Morris
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> So Robert Morris worked for NSA. > Does that mean that the infamous 1988 Internet Worm > was part of a NSA-sponsored intelligence-gathering mission? > No, that was his kid! Imagine his chagrin! Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

maximizing cryptographic return
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

the question of the cost-effectiveness of phone encryption was raised by my other message. I would like to question how cheaply good encryption could be done on phones, with a poor quality microprocessor. most on this list are aware of the idea that good encryption is often used to send a low-bandwidth session key, which is then used to encrypt that session using a less sophisticated but less computationally-demanding algorithm. hence you seem to have good security at a computational price that is less than encrypting everything with the secure protocol. I was wondering how secure the following algorithm would be for phone calls: suppose that at the beginning of each session, the random key is traded using RSA or some other very secure approach. the key is a *random bit width*, say 100-6000 bits. now, my question is, I wonder if some very cheap algorithms, in terms of computation time, could be used for the "on the fly" encryption of the voice using those bit. would XOR with the pad be totally out of line? the situation is such that trivial algorithms such as XOR with *unlimited cyphertext* can be broken quite trivially. but it seems to me this dogma that "XOR is WEAK" is based on the premise that you have a huge amount of cyphertext to play with. take away this premise, that you have a session key that is guaranteed to really give you very little cyphertext, do these supposedly "weak" algorithms then become pretty secure? what I am getting at is that it seems there is this frequent assumption that "good cryptography for on-the-fly encryption means you need huge computational bandwidth". I wonder how true this really is. can you have a situation where you spend a lot of time computationally negotiating the *random one time pad*, but then have a fairly weak algorithm doing the on-the-fly encryption with the random pad? IMHO this would be the holy grail for phone hardware. as I wrote, you are already going to have something approximating the power of a low- bandwidth microprocessor in a phone. now imagine it took a long time to send the key at the beginning, but that once traded it was no big deal-- real time communication using even "weak" algorithms. what I am suggesting here is that we can get encryption for almost *no additional cost* over existing phone hardware. and I am suggesting that the main hurdles to encryption are political, not technical. again, I wonder if "weak" encryption schemes are really that weak if they are only used on short cyphertexts and if you have a good, secure OTP (one time pad). I think it may be a delusion that you must have a huge amount of computational bandwidth or have to encrypt every bit using state-of-the-art, computationally-demanding algorithms to have extremely secure on-the-fly communications. p.s. can someone give a brief summary of the Nautilus and PGP session key / code frameworks? p.p.s. a few footnotes in regard to the previous article. widespread, seamless phone encryption is the NSA's absolute worse nightmare. everything they are doing to prevent cryptography can be thought of as trying to avoid this particular reality configuration. pay special attention how they approach the issue and it will tell you what they fear the most, and what they are trying to do to prevent it. also, Bob Morris said in his talk, acc. to Gillogly, that Europeans *were* willing to pay for encryption in their phones, but those in the US weren't. please expand on that little nugget!! how did you come to that conclusion? why are americans fundamentally different than europeans in regard to the value of encryption? if humans want the same thing in most markets (as the situation of international product marketing generally seems to suggest) does it make you think that something besides the desirability of crypto is at stake here in the localities, such as *politics*? --Vlad Nuri

2 1

[Fwd: (Fwd) Microsoft - The Next Generation...]
by Arthur Unknown 17 Dec '03

17 Dec '03

1 0

rump session papers
by Carl Ellison 17 Dec '03

17 Dec '03

I ran out of copies of my rump session paper handouts. So, I put them on my ftp server... ftp://ftp.clark.net/pub/cme/ps/ cepp.ps :: a couple of symmetric modes for block ciphers which I threw out for people to attack.... k1.ps :: Key exchange algorithm K-1 -- with some very suggestive properties. Whit Diffie titled this one "If S-1 is Skipjack, then K-1 is KEA" in the rump session list. I'm not about to make that claim -- but it *does* have some interesting characteristics. Enjoy, Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme/home.html | |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | ``Officer, officer, arrest that man! He's whistling a dirty song.'' | +----------------------------------------------------------- Jean Ellison -+

1 0

Re: Wearing RSA shirt to school
by futplex＠pseudonym.com 17 Dec '03

17 Dec '03

I wrote: > With respect to possession within the U.S., there aren't any > laws stopping you from waving strong cryptography around wherever you like > (at least, not yet). ---- ...and in private email, Jim Ray pointed out that showing the shirt to a foreign national might technically violate ITAR... ---- Yeah, I suppose I overstated it a bit. It appears that if the ITAR do cover the shirt (unclear at present, AFAIK -- any news on the CJR, Raph ?), then flashing it at a furriner could constitute a violation. Thanks for the correction. The gist of my previous message remains: No local or state authority in the U.S. (of which I'm aware) classifies strong cryptography as a munition, weapon, etc. I haven't heard of any restrictions on transporting crypto across state lines, either. Unless the Feds start cracking down on high schools, or the Perl-RSA shirt somehow violates some school dress code, (gang colors ? ;) the original questioner need not fret about his son wearing the shirt to school. -Futplex, just another slimy tentacle of the List Maintainer

1 0

Re: State Charges in Weaver Case
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

A species of Monger named GovtLicensedMurderMonger wrote: > Ray Arachelian wrote: (re: "Just Following Orders" Horiuchi) > > Fine, then what shall we charge the one that gave the order with? And > > what shal be the punishment? If the one who takes the order relinquishes > > reposability, then the one giving the order must be doubly responsible. > Jeez, Ray. If you follow this twisted train of logic, you end up > expecting the President and the Legislature to take responsibility for > the State of the Union. > Are you some kind of godless Commie, or something? You'll certainly > feel foolish when the FBI lab proves that the trigger was pulled by > a drug dealer who was told to do so by a child molester. It's just a > shame that those poor federal agents had to be there to witness the > tragedy. The godless Libertarians are also spouting off the same type of ludicrous claims regarding government officials being responsible for their actions. Like the people we vote for actually had any say in how this country is run... Geez, wise up, guys. GeezMonger ~~~~~~~~~~~~~~~ THE LIBERTARIAN, By Vin Suprynowicz 'Enough money to have fed every human on earth' "August 2, 1997, marks the 60-year anniversary of the failed and devastating American public policy of drug prohibition," announced California Libertarian gubernatorial candidate Steve Kubby of Lake Tahoe in a recent -- and refreshingly outspoken -- press release. "Just how big is $400 billion?" Kubby asks. "Adjusted for 1997 dollars, $400 billion is enough money to have fed every human on Earth, each year, for the past 10 years." "As one of the chief architects of the War on Drugs, Lungren has a lot of explaining to do," Kubby said. "What has been accomplished by spending such such an incredible sum of money? We've created the biggest prison system in the history of the world, with more of our own citizens rotting behind bars than any other nation in the world -- and drugs are cheaper and more easily available than ever before, especially to kids. "It's time to hold public officials like Dan Lungren accountable for the tragic waste of money and lives that has produced nothing but more drugs, more violence, more addiction, and more misery." "It is even more puzzling as to why Mr. Lungren thinks his colossal failures in the War on Drugs qualify him for higher public office." The "Kubby for governor" web page is at http://www.alpworld.com/kubby98. Vin Suprynowicz is the assistant editorial page editor of the Las Vegas Review-Journal. Readers may contact him via e-mail at vin(a)lvrj.com. The web site for the Suprynowicz column is at http://www.nguworld.com/vindex/. The column is syndicated in the United States and Canada via Mountain Media Syndications, P.O. Box 4422, Las Vegas Nev. 89127.

1 0

Re: Socio-Economic Cults (Re: CypherPunk Cults)
by John Young 17 Dec '03

17 Dec '03

gturk wrote: >You must be referring to the Cult of Redistribution. Tis true that as these accusatory options for blaming others are displayed here, it becomes hard to tell who's potshotting from what shifting position to gain better fire lines at friend and foe and own foot. As the Bastiat quote shows, the 19th century is a fount of apologies for wizened rapacity, as are those stuck in that time warp of heyday national and indiivudal self-destruction in the cause of unshakeable rigteousness, an affliction far from cured in nations and individuals wanting to be Number One while totally whacked out on ... take your pick from the socio-politico-econo bazaar, most of which derives from the days of pre-Bastiat and now recycled by crazy-lazy-minded 20th century rip-offers of the insecurely rich. Will evolution in action ever kick in, or will the promise of it, like dreams of social justice and faith in the constitution and arms, forever cheat the maniacally despairing with so few other choices for peace of mind? Are there any reliable prefabricated alternatives from history, from today, to self-imposed sheepledom of your sole invention? Now, to move on to the day's news: Is Tim going to be kidnapped by a gang of mixed breed cops and ammo merchants, shot instantly and chained in dugout till his loved redeems his maggoty carcass by redistributing his nestegg? That's the topic of the NYT's lead business story today, the need for secret ransom insurance, so secret that it does not make you a free-for-taking target like the usual unwise display of peacockery. Hide it if you got it, hide your lush affiliations too, the poor reporters advise, or the world's scum with nothing else to do but watch and wait are gonna snag your unsmart ass when you least expect it, now as in ages past, unless, to be sure, more scum-world guardians are hired and more big-nuke prayerbooks and ransom policys are arsenaled bedside, 4X, ankle and thigh.

9 8

Oddly enough, Clipper is helpful
by Deranged Mutant 17 Dec '03

17 Dec '03

Despite a few rants about how the NSA has monkeywrenched potential standards for encryption with Clipper (market forces being what they are, even if there were no Clipper we may still have no standard by now...), I think there is oddly a good side to Clipper: the issue has thrown cryptography and security into the public debate, even if marginally. Prior to Clipper, PGP was not featured in national and international features in TV, newspapers and magazines... now a lot of people want their hands on it. People have become aware of communications security issues--very avaerage folks who one might even consider techno-illiterates or luddites are now concerned with the government's ability to listen in and watch them. Think of Clipper as an opportunity to propose something better, as an opportunity to make people more aware of the issue.

1 0

curfew laws
by Mark Hedges 17 Dec '03

17 Dec '03

In response to an earlier thread about curfew laws being unconstitutional, apparently a federal appeals court thinks so too. The San Diego curfew law was struck down on June 9, 1997. The ACLU prosecuted. For the report and a link to the decision see http://www.aclusandiego.org/curfew.html. Mark Hedges

1 0