December 2003 - cypherpunks-legacy

Flynt Daughter is pro CDA [fwd][news]
by Vipul Ved Prakash 17 Dec '03

17 Dec '03

*** Keep cyberporn from children, Flynt daughter says Anti-pornography activist Tonya Flynt-Vega said Friday she was "very disappointed" the U.S. Supreme Court struck down a law meant to keep Internet smut away from children. Flynt-Vega, 32, daughter of Hustler magazine founder Larry Flynt, said children tended to be much more computer-literate than adults and were especially prone to "unwelcome contacts" on the Internet. " ... I want there to be some laws regulating that stuff. Don't put it in my face or my child's face," she said. The Supreme Court ruled June 26 that Congress violated free-speech rights when it tried to curb smut on the Internet. For story http://www.infobeat.com/stories/cgi/story.cgi?id=5031497-28e -- Powell lingered. "How's Earth?" It was a conventional enough question and Muller gave the conventional answer, "Still spinning." -- "Reason", Asimov. ================================================================== Vipul Ved Prakash | - Electronic Security & Crypto vipul(a)best.com | - Web Objects 91 11 2233328 | - PERL Development 198 Madhuban IP Extension | - Linux & Open Systems Delhi, INDIA 110 092 | - Networked Virtual Spaces

1 0

Re: Elliptic Curve Public Key Crypto available
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

Available anywhere outside the escrowed country ?

2 1

Netscape to patch shareware version
by Weld Pond 17 Dec '03

17 Dec '03

This is from the Sept 11, 1995 Inter@ctive Week: Netscape Communications Corp.'s freely distributed browser is getting commercial-grade encryption, making it safe to use in the U.S. The change comes two weeks after Inter@ctive Week disclosed that the free version contained reletively weak encryption that had been cracked by a European user. [...] Meanwhile, in an as yet unannouced move, the company said it would place its commercial browser online for free downloading. THat move apparently comes in direct response to an Inter@ctive Week article that highlighted the fact that all shareware versions of the browser contain the so-called 40-bit key encryption software which was recently proven insecure. THe commercial version, sold only in the U.S. contains an unbreakable 128-bit encryption scheme. Netscape said it received word last week that the State Department had cleared that version for release on the Net, but only within the U.S., owing to current export laws banning the export of encryption schemes stronger than 40 bits. THe company could provide no details by press time on how it would ensure that the 128-bit version wouldn't leak beyond U.S. borders. [end excerpts] I love how Inter@ctive Week pats themselves on the back for making people aware of the problem. I guess the cypherpunk media hacking is working. Doing things behind the scenes and making the press think they are the internet users salvation looks like a good tactic. The cypherpunks forced a situation where Net users now have better encryption available to them. I'd say this is a big win. Weld Pond - weld(a)l0pht.com - http://www.l0pht.com/~weld L 0 p h t H e a v y I n d u s t r i e s Technical archives for the people - Bio/Electro/Crypto/Radio

2 1

Phil Zimmermann/Amnesty International?
by gjeffers＠socketis.net 17 Dec '03

17 Dec '03

Phil Zimmermann/Amnesty International? I was wondering if the Zimmermann case would be a proper concern of Amnesty International. Phil is obviously a political dissident. His persecution is obviously political. If Phil got support from Amnesty Int'l, then his persecution could be a big embarrassment to the Federal gov't. He has a lot of supporters and taking up his cause could be a big promotional for Amnesty International. The Feds might feel forced to drop the matter early. Any ideas? Gary Jeffers

9 12

Elliptic Curve Public Key Crypto
by Brian D Williams 17 Dec '03

17 Dec '03

Mike Rosing writes: >in the cypherpunks ftp site /pub/cypherpunks/ciphers are 2 ascii >files. One contains code and the other contains documentation: >eliptic.src and elliptic.doc. The code portion is a cat'ed block >of files: headers, C sources and a set of prime numbers. The >documentation attempts to explain the math, but it does help if >you already know number theory. It hopefully isn't necessary. Thanks Mike for all your effort!! Now could someone remind me where the Cypherpunks FTP site is? Please? Brian D Williams Cypherpatriot " Zen? Well it beats sitting around on your ass all day doing nothing! "

3 2

Re: Digital Fingerprinting
by Andrew Loewenstern 17 Dec '03

17 Dec '03

> I said I'd mention "state secrets" again. The usual example for > making subtle modifications to documents to see who leaked it is > the intelligence community, which gave us the term "barium" (because > the changes look like barium in an x-ray diagnostic). Such technology would be very useful in business, especially the high-tech industry. Think of how many non-disclosure agreements are signed every day relating to new products developed for the software industry alone. Many companies are very paranoid and already 'fingerprint' information by using unique code-names for projects, for instance. i.e. the spec sheet on their new GAK crypto product they give to Alice may be code-named 'project foobar' but the one they give to Bob may be code-named 'project burris'... Then, when the information leaks out they check which person they gave the document with that code-name and they know who to sue (or at least not give any more trade-secrets to). It's very simplistic but it has been know to work in the past. Most of the real technology for doing this is much better, of course... However, what stops you from printing out a fingerprinted document and scanning it back in, for instance? andrew

1 0

Re: Crypto and new computing strategies
by fnerd＠smds.com 17 Dec '03

17 Dec '03

> Jim Choate writes: > > > In the latest issue of Scientific American there is an article... On Seth Lloyd's grain-of-salt computer, actually. I didn't know he was going to build one. Anyway, his technique *may* be useful to make quantum computers, but it's more likely to be useful for making regular deterministic massive single-instruction-multiple-data computers out of fairly simple crystals--"maybe even a grain of salt." His technique would make every repeating unit of the 3D crystal into a computing unit. You lose a couple factors of 10 for addressing, making higher-level modules, and error-correction. Still, that's a lot of compute power. Tim May says- > No need to worry just yet. > > There is no convincing evidence that "quantum computers" can calculate > in any way differently from "ordinary" computers. Right. This is just a large power increase using deterministic stuff. It's based on electrons in the shells of atoms in crystals responding to different frequencies of photons depending on their own and neighboring atoms' shells' states. > Devices that are built on a size scale where quantum effects are > important, such as quantum-well devices, don't use QM as a > computational mechanism per se. The devices are just real small. But > not small enough to matter for large RSA moduli--the computations > required to factor a 1000-decimal-digit number swamp even a universe > _made_ of computers! Which is what a naive guess would have said about 129-digit numbers. I would love to see some sort of curve of factoring algorithm efficiencies over time. You could show the log of the difficulty for a selection of number sizes over the past hundred years, say. The experts say it's flattening out and will probably stay that way. A sudden jump in the high end of computer power would mean that we would need to use larger keys sooner than we thought. A key length requiring a little bit more work on the user's part means a lot more work on the cracker's part, but I don't know how many more bits of key compensate for a 10^9 increase in cracking power, say. -fnerd quote me - - - - - - - - - - - - - - - blue pill, Pharm. a pill of blue mass, used as an alterative... alterative, adj. tending to alter... -----BEGIN PGP SIGNATURE----- Version: 2.3a aKxB8nktcBAeQHabQP/d7yhWgpGZBIoIqII8cY9nG55HYHgvt3niQCVAgUBLMs3K ui6XaCZmKH68fOWYYySKAzPkXyfYKnOlzsIjp2tPEot1Q5A3/n54PBKrUDN9tHVz 3Ch466q9EKUuDulTU6OLsilzmRvQJn0EJhzd4pht6hSnC1R3seYNhUYhoJViCcCG sRjLQs4iVVM= =9wqs -----END PGP SIGNATURE-----

6 18

Re: Here it is; bi-directional dining cryptographers
by Andrew Roos 17 Dec '03

17 Dec '03

Phil Fraering <pgf(a)tyrell.net> observes: > If Alice and Bob are members of a reasonably non-compromised and > free of colluders dining-cryptographers network, with a protocol for > reserving blocks for the transmission of data packets, then if they > both send a data packet in the same block, they can each read what > the other is saying but to the rest of the DC-net it is garbled. > > Since what is broadcast is the XOR of Alice's and Bob's data, Alice can > read Bob's data by XOR'ing the output of the DC-net with her attempted > input; Bob can recover her data the same way. > > Comments? I haven't been following the DC thread so forgive me if I've missed something... If the objective is to keep what Alice and Bob say SECRET then we have a problem if the entropy per bit of Alice's data plus the entropy per bit of Bob's data is less than one bit, because then there is only one likely decryption of the "ciphertext", which will reveal what both Alice and Bob are saying. The system is analegous to a variation on the old Vigenere/Beaufort cipher where instead of using a single repeated keyword to generate to encryption stream, you use another "plaintext" message such as a passage from a book which is known to both correspondents. (Here the addition is done mod 26 instead of mod 2). Since the entropy of natural language is 1-1.5 bits/char, the entropy of two natural language texts added together is 2-3 bits per char, while the no of ciphertext bits is about 5 bits per char, so there remains 2-3 bits per char of redundancy in the text, which can (quite easily) be used to break the system even on a ciphertext-only basis. One way to do this is to search for "probable words" of one side of the conversation, then see what the other text would have to have been to generate the known ciphertext, and if this other text makes sense then bingo, we have an initial break, and you can usually extend this quite easily by extending one text, then seing what this gives for the other, extending that, and so on. > (At the very least, it doubles the bandwidth for the two participants...) I have to agree here, though! Andrew ___________________________________________________________________________ #!/usr/local/bin/perl -s-- -export-a-crypto-system-sig -RSA-in-3-lines-PERL ($k,$n)=(a)ARGV;$m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2% Sa2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*' ,$_)while read(STDIN,$m,($w=2*$d-1+length($n||die"$0 [-d] k n\n")&~1)/2) Andrew Roos Realtime PO Box 15170 Vlaeburg 8018 Phone: +27-21-244350 Cape Town Cape Town Fax: +27-21-221507 South Africa

2 2

Famous Zen koan: what is the sound of two shoes dropping?
by Brian A. LaMacchia 17 Dec '03

17 Dec '03

You may recall that Dorothy Denning had a pro-Clipper article in _Technology Review_ back in July. The October issue of TR contains not only some critical letters to the editor, but also a reply from Denning. How things have changed over the last 18 months... --bal ------- Start of forwarded message ------- Date: Tue, 12 Sep 95 12:23:00 -0400 Return-Path: <hal(a)martigny.ai.mit.edu> From: Hal Abelson <hal(a)martigny.ai.mit.edu> To: bal(a)martigny.ai.mit.edu Subject: Famous Zen koan: what is the sound of two shoes dropping? What is the sound of two shoes dropping? **Part 1: March 10, 1994 (From the debate between Dorothy Denning and John Perry Barlow, moderated by Philip Elmer-DeWitt) Barlow: EFF is not asking the Government to drop Clipper, though we would vastly prefer they did. We're merely asking that no steps be taken to require it either by law or practice...as, for example, would be the case if you had to use a Clipper chip to file your tax return. DeWitt: Dr. Denning, do you think this is the "first step in a process to outlaw crypto"? Denning: No I do not. ***Part 2: October 10, 1995 (From Dorothy Denning's response to letters to the editor in _Technology Review_) Denning: But critics make an important point when they argue that criminals will not use Clipper or other forms of key escrow encryption. As long as there are no laws in the United States controlling the sale and distribution of encryption products, the U.S. market will be flooded with products that have no provisions for government access. This eventual threat to public safety and social order could be avoided by establishing a licensing program for encryption products that reasonably satisfy the government's decryption requirements and do not interoperate with unlicensed systems. While the manufacture and distribution of unlicensed encryption products would be illegal, no particular system would be mandatory and any licensed product could be used without restriction. Although such a licensing program would not prevent criminals from using unlicensed products, their availability would be limited to underground channels. ------- End of forwarded message ------- P.S. Denning's TR article is available at: http://web.mit.edu/afs/athena/org/t/techreview/www/articles/july95/Denning.…

1 0

Re: GAK/weak crypto rationale?
by Andrew.Spring＠ping.be 17 Dec '03

17 Dec '03

>intercepts requested and authorized in the past year. As I recall, the >number was quite small - around 12K [?]. Someone had found this out >through an FOIA request, perhaps, (my recollection of it is poor). It was I think it's about 1200. >not a large number, anyway. I must conclude that the actual number of >intercepts is much, much larger than they are saying, and that they must >be getting what they perceive to be good intel from all this snooping. > A more cautious conclusion would be would be that the importance (to the LEA's) of the busts made with crypto is much larger than the numbers suggest. You could interpret that a lot of ways: I suspect that high-profile career-enhancing cases are highly dependent on wiretaps.

4 4