December 2003 - cypherpunks-legacy

Re: DES & RC4-48 Challenges
by dan＠milliways.org 17 Dec '03

17 Dec '03

On Mon, 21 Aug 95 23:13:06 -0400 you wrote: > >Hello all, > > Lets face it the real challenge is DES, but those 56 bits are quite a >bit harder than 40. 65536 times harder in fact. > >40 bit code a tad and set to work. It sounds as if it is comparable to the >RSA-129 prime that was cracked (OK its probably a touch harder but machines are >faster now). > > So who wants to make an RC-48 and a DES challenge? Not having my copy of The Differential Cryptanalysis of the Data Encryption Standard handy, I'd like to know about the distributability of this type of DES attack. Done right, we could significantly reduce the time complexity. The main problem, of course, would be coordinating such an effort. I seem to recall this attack requiring lots of known plaintexts. Time to review the text, I suppose.... Does the Federal Reserve still use single-key DES? Dan ****************************************************************************** "I think, therefore I am" - Descartes Dan Bailey "I don't think, therefore I'm a moustache." - Sartre dan(a)milliways.org Worcester Polytechnic Institute and The Restaurant at the End of the Universe ******************************************************************************

3 2

Netly News Fan Mail
by Mike Duvos 17 Dec '03

17 Dec '03

It appears that the CPAC/Sewer folks have read the recent Netly News article on their activities and were not pleased. This little blurb healines the "Sewer List" this morning. -----Begin Officer Paladino Rant----- July 29, 1997, I was told of an article that appeared on the Net. It appeared on a Netly News site. Of course, its good reading if you are a Boylover. Apparently the writer, like many reporters I have known, likes to keep the pot stirring with coin phrases like war, net.vigilantes and so on. To give the article credibility he interviewed CPAC, NAMBLA, ACLU. He also mention this writer but forgot to get a statement from me and 100's of other groups that feel that child porn, molesters and such have no place on the web. In the article he links to a few sites showing young boys but he forgot to link to the 1000's of sites showing young boys in the nude. Why is that I ask. Well to keep the pot stirring. He claims their is gay bashing going on, look on this site and others that link here and you'll find no gay bashing. You will see sites exposing young boys, as young as 4 years old, nude. I, for one, can't not justify nude pictures of 4yr old boys and girls. But the Boylovers insist this is their way of showing love. AND, of course, we always get back to the Freedom of Speech arguement. You know that gigantic excuse for expression. We still have Freedom of Speech in this counrty, while every other liberty is falling by the wayside. As I read the article, I could see the bias and I wonder why???? Maybe the reporter also has an agenda. If he writes another article on this subject, it would be interesting to see which Boylovers will be interviewed. Apparently he has never been to the Sewer or maybe he has? Freedom is a great thing and this is the greatest country in the world. I wonder how many soldiers that gave their lifes fighting for that freedom, had pictures of nude boys in their wallets, instead of their families. Think about that....................... -----End Officer Paladino Rant----- Will someone please buy this poor man a spell-checker? :) -- Mike Duvos $ PGP 2.6 Public Key available $ enoch(a)zipcon.com $ via Finger $ {Free Cypherpunk Political Prisoner Jim Bell}

1 0

Re: DES & RC4-48 Challenges
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:29 AM 8/22/95, hallam(a)w3.org wrote: >I think we can probably do DES within two years. > > Phill I strongly doubt it, and may be willing to bet money against it happening. (If "we" means someone or some group on this mailing list. If "we" means the Net, I still doubt it will happen.) If the "idea futures" and betting markets we've talked about here (which exist) ever take off, this may be a way to make some money for someone. For example, if someone was laying 10:1 odds that SSL would not be cracked in 1995.... And for the "do DES" bet, you need to differentiate (no pun intended) between a chosen plaintext attack and a more general attack. The differential cryptanalysis ("DC" gets another overload) method needs chose plaintext to cut the search space down to 2^47 keys. Wiener's hypothesized "million dollar DES cracker" may do the general attack, but I doubt anyone on our mailing list will do it. That is, the number of workstations and even supercomputers which would have to be lashed-together would be, ballpark, about 2^16 times greater than what was lashed-together for the SSL challenge. Maybe a factor of ten could be cut out with increased cleverness. Maybe. Call it a factor of "only" 6000 times harder than the SSL challenge. Hard to imagine this happening in the next two years. Maybe if much of the Net community was energized to run DES crackers instead of Flying Toasters, but a hard effort to organize...for fleeting reward. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Certificates/Anonymity/Policy/True Names
by Carl Ellison 17 Dec '03

17 Dec '03

>Date: Fri, 18 Aug 1995 14:47:55 -0400 (EDT) >From: Michael Froomkin <mfroomki(a)umiami.ir.miami.edu> >You have decided to allow the private CAs to issue certificates of varying >degrees of corroberation so long as the degree of verification used is >deducible from the certificate. E.g. a certificate might say "we check >the passport"; or "we check driver's license" or "we took blood, hair, >fingprint, retinal scan and first-born child". It might even say "we >checked nothing". You have also decided that a CA may issue a certificate >in the name of a pseudonym, so long as the CA retains information about >the True Name. Now the issue arises as to whether one should allow the CA >to issue certificates to pseudonyms where it has *no record* of the real >identity of the person proffering the key pair. > >Is there any reason why a person would want such a certificate? I see several reasons, but I don't see a reason for a CA in this case. The key being signed can serve in place of the CA's key. That is, the key can be self-signed. All that needs to be proved in this case is that someone owns the private key which goes with the public key. As for what good that key is -- Prior to our meeting in person this year, all you knew about me was by my postings. If I had signed all of them with the same self-signed key, then you would know that all of those postings came from one "person" (the set of people, presumably only one person, with access to the private key). The postings define the person, in your mind, and you are absolutely certain that they came from that person (defined as I did above). You don't need any further certification to attest to that fact. No economic impact, you say? My postings could have been S/W. You could have tried my S/W and liked it -- hiring me to do work for you privately. In all this process, we need never meet. If we don't meet, it doesn't matter what my blood type is or if I have a driver's license or a passport. I could even be a small, silver-skinned alien who is perpetually in hiding. No money transfer, you say? Wells Fargo bank (an innovator) could initiate public-key bank accounts. I would open the account by sending them a self-signed public key. They would use that key as my bank account number. Anyone would be allowed to deposit money into that account (e.g., using CyberCash transfers). Only I, the person holding the private key, would be permitted to transfer funds out. Again, in the Internet, nobody knows you're a dog-faced alien sea creature. - Carl

3 4

Re: FCPUNX:Prior Restraint
by James A. Donald 17 Dec '03

17 Dec '03

At 09:18 AM 7/29/97 +0200, Anonymous wrote: > Ira Stohl and Kristina Hjelsand had been charged with obscenity for > selling the controversial magazine "Answer Me!" a short-lived but > legendary > periodical that offered extremely politically incorrect articles about > rape, among other subjects. I read this magazine, and 95% of the views expressed in their infamous rape issue were tediously PC. Their thought crime was that that they embraced debate on the topic, that they presented some alternate viewpoints, some of them fairly vile, --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Partial Key Escrow
by Ted_Anderson＠transarc.com 17 Dec '03

17 Dec '03

The recent discussion of the SSL Challenge and the revival of the Software Key Escrow issue brought the following idea to mind. For the purposes of this suggestion let's just assume that the goal is to provide some kind of Government Access to Keys (GAK) for a widely deployed crypto system such as clipper phones. How about if instead of escrowing the whole key with the goverment/escrow agent you only save some of the bits of the key? I am thinking that the goverment would insist that at a minimum all key bits in excess of some N be escrowed. Where N is aournd 48. So if I was using IDEA with 128-bit keys, I'd need to escrow at least 80 bits and reveal all 128 bits only to the receiver. The export version of RC4 is similar except that 40 bits are hidden and 88 bits are "escrowed" as plaintext. I see the advantage of this is that it might just be palatable to the government. In particular, 48 bits wouldn't be any significant burden on the NSA or FBI for legally authorized wiretaps (I recall that something like 1000 were performed in some recent year). It would be a simple matter for the FBI to budget enough hardware to do brute force attacks on a few thousand keys a year with a time-to-crack of a few hours (I doubt most wiretaps are obtained with more time urgency than this). The big advantage to the user is that this provides are well defined limit on the effort required to violate their privacy. The biggest problem with the clipper-type GAK system is that everyone assumes that in the worst case keys could be obtained illegally with essentially zero cost. There are numerous scenarios where the administrative controls that protect keys break down and the public is left with no privacy at all. In this case, however, there is a significant, well-known, and quantitative (but, unfortunately, time-variable) cost in obtaining a key even if the adminstrative controls are completely compromised. While this doesn't make the privacy of any particular target much safer it seems it would significantly improve the safety of the public privacy in aggregate. Ted Anderson

3 2

e$: The Book-Entry/Certificate Distinction
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 2:30 AM 8/22/95, Timothy C. May wrote: > (An important point is that >in a cash economy, identity is almost irrelevant. It's only in non-cash, or >"account-based," economy that True Names are demanded. Lots of interesting >issues to discuss here, which I won't now.) I'd like to vamp on this for a while. I think Tim's talking about what I call the book-entry/certificate distinction. It goes right to the heart of finance, and it's why I think that the strong crypto/Moore's law combination is going to do more to free people than any political system ever could. (How's that for a wind-up to a rant?) Accounting, well, double-entry bookeeping anyway, was invented in the late middle ages so people could measure their financial progress, but most importantly, so that people could trust other people doing the measurement for them: their bookeepers. This allowed the Renaissance entrepreneur (or more orignally an Italian nobleman, who was more of a gangster than anything else) to delegate financial measurement and consequently build a much larger enterprise than he could have otherwise. Before double-entry bookeeping, the first book-entry system, everything was done on a cash, or certificate, basis, and, like the apocryphal Silicon Valley entrepreneur's bedroom shoebox, you knew you were making money when there was more in the till today than there was yesterday. The first certificates were actually the first form of writing: the original Cuneiform(sp?) of the Babylonians actually evolved from little pieces of clay formed into interesting three-dimensional polygons with a signature seal stamped on them, certificates, or abstractions of value, like "3 cows, so says I, J. Nebbuchenezzar", these were, in turn, used like money. Book-entry allowed the creation of larger and larger enterprises, and it's no surprise that a hundred years or so after the invention of double entry bookeeping, joint stock companies, and eventually limited liability, came into being. The paradox here was that this was an enherently certificate-based system. People met in front of a buttonwood tree on Wall Street, and traded ornately engraved certificates representing some fractional amount of a company's shares or debt outstanding. To trade your shares, you had to physically send them to Wall Street to have them traded for you. Eventually book-entry systems got into the trading of securities when stock exchanges were founded. Specialists or market-makers would take your order, and cross them on their books with their own inventory or with people on the other side of the trade, or, in the commodities markets where the trade volume is much higher, people stand around a pit, execute the trade with a contra party, and sign each other's orders. This was compounded enormously by the advent of faster communications, particularly telecommunications. People could trade their stock from anywhere by wire, or by physically talking to a branch office of a securities firm who was itself linked by wire to an exchange through its main office. In the early days of book-entry trading, delivery of physical certificates was done at various traders' operations departments, called "cages" for obvious reasons, to settle a trade. After a while clearing houses were instituted to do book-entry settlement of exchange-traded securities. In fact, when someone says "book-entry" these days, they usually mean book-entry securities settlement. A clearing house has all the physical certificates in a vault, and keeps books as pointers to all that paper to show who owns what. Those books match the books of the various traders, and through the miracle of double-entry bookeeping, everything balances so everyone agrees with each other. In fact, the need for all those certificates sort of goes away in this system, and when I first got on this list a year or so ago, Perry and I talked about the existence, at the Depository Trust Company -- the New York Stock Exchange's clearinghouse -- of a single certificate representing a company's entire common stock. Okay, so what does this have to do with strong crypto? A lot. Every once in a while I've compared strong crypto and privacy to flight. Flying is an inherent good for lots of people, but what makes it really economically useful is how fast you go when you fly. People buy airline tickets because they can get anywhere much quicker if they fly than if they do anything else. The same with strong cryptography. Privacy, and the strong cryptography which makes it possible, is an enherent good for most of us, especially here on *this* list. But cryptographically strong protocols become economically useful when used for the creation of certificates which abstract value: digital bearer certificates like digital cash, and eventually digital certificates representing stocks, bonds, and various derivative securities. To understand why, we need to make one further digression. Remember all those telecommunications lines going into the exchanges? The inherent geometry of a system where lines are cheaper than nodes is a hierarchy: you pick up a phone to call someone, and your central office routes you up to its central office, and further on up the hierarchy until the call can be switched back down somewhere to complete the call. The interesting correlation between this "switching" and most of our current social structure can be left for another list, but the reason for this methodology is all bound up in the economics of wires and switches: at first, wires were cheaper than switches, who, in the beginning, were people. We all know the story from there, people were first replaced with electomechanical switches, then with solid-state switches, then with microprocessing switches. When we got microprocessors, the economics of the nodes/lines problem got turned on its head. We run into Moore's Law. Moore's Law, for Moore of Intel, is an observation that the price of a given semiconductor falls by half every 12 months, though it was 18 months when Moore figured this out. From a cryptological prospective, we understand what this means to the future cost of breaking a keyspace of a certain size. Moore's Law also means just as much to the structure of the network: in collapsing the cost of a network's nodes, it converts it from a hierarchy to a geodesic. Like Bucky Fuller's geodesic domes, a geodesic network consists of nodes connected to an arbitrary number of lines, with no real directionality to the motion of traffic: there is no up or down like in a hierarchy. A message could originate at the node, or could be just passing through in any direction to any other line the node is connected to. A good example of this is a company's PBX, which allowed intra-company switching of phone calls for large organizations over long distances directly, without going up and down the telephonic heirarchy. The abolition of monopoly in the telephone system was primarily caused by the advent of the geodesic network, and the phrase "Geodesic Network" was the title of Peter Huber's analysis of the phone system for Judge Green, the judge who broke up the Bell System in the early 80's. Huber's reccommendation to Green in 1986 as was to allow competition in the Regional Bell Operating Companies' core markets: the local loop. They're just getting around to doing it almost 10 years later. Another consequence of hierarchy, right? Once again, the social consequences of geodesic information networks are interesting; ubiquitious computing, telecommuting, flattening organization structures, and lots of other phenomena can be attributed here, and even Mr. Archer's transaction-based tax proposal can. However, let's look at what it does to book-entry, particularly in the presence of strongly cryptographic certificate systems. First, like Tim says, a book-entry system is bad for privacy. The IRS knows how much money you make, the bank knows how much you spend on your credit card, another book-entry system, even your grocery store knows what kind of food your cat likes. In a certificate system, like digital cash, no one knows anything, and it's cheaper that way anyway. Who did what to whom and for how much has no economic value whatever. No one can track the origin of all the bits of cash going through the till, much less audit it's ownership trail, and cryptographic protocols allow the secure handling of the money anyway, so the existence of the money speaks for itself, without needing to know who gave it to you. Book-entry stays where it belongs, on the store's accounting system, and there's reason to believe that as processors get cheaper and cheaper, there might be a micro economy (ecology?) in the making in an enterprise's various economic units, as a result of ubiquitous computing. Transfer payments have always been a vexing problem in large businesses, because there's no way to arrive at a fair price for intra-company trades of goods and services without looking to some outside market price. In fact, it's safe to say that the current paradigm for financial analysis, the efficient market hypothesis and it's offspring, CAPM, Black-Scholes, etc., is a solution to the transfer pricing problem which evolved into something infinitely more useful. But let's take this idea of strong cryptography in a geodesic network to another financial abstraction, the securities markets. What you get then is a reversion to certificate based trading. You've gone back to the Buttonwood tree, only you're now trading digital certificates on the net. People announce their intention to trade, what they're willing to pay or accept, and, when the trade is made, people trade certificates under a strong cryptographic protocol, announce the price to the market, and walk away. People can "make markets" in securities by holding inventories and simply posting their prices bid or asked, to buy or sell their inventory of securities. Notice I said people here. What we're talking about is behavior which was originally done by *people* with *certificates*, and then by ever-larger *institutions* with *book-entry*. That is, until the advent of computers, when the pendelum swung back toward smaller entities. After all, in 1972, anyone with the money could get a Quotron or a NASDAQ Level 3 machine, and soon, at least the sell side of the market was competitive again. The stodgy old firms like Morgan Stanley and Salomon had to turn into very efficient carnivores to survive. Paradoxically, the buy side of the market, composed of banks, pensions, and mutual funds, had its development arrested by regulation and is just approaching the centralizing phase. However, we now know that the operation of both the buy and sell sides of the capital markets are going to get very interesting very soon, right? With a geodesic, certificate-based financial system, the economies of scale caused by hierarchical communications systems go out the window. There is no need to concentrating processing power to be used to used on the market's information, because the information is everywhere without having to concentrate it. What's more, the specialization of processing enabled by Moore's Law creates such a flood of information that no centralized entity can process it all, and so it collapses under its own weight. Everyone trusts their transactions because of the difficulty of forging certificates. That means that once again, a certificate has it's own inherent worth. It speaks for itself, and when it changes hands, the trade is, as Eric Hughes says, "immediately and finally" cleared and settled. The overhead of keeping books is gone, at least for the trading parties, and especially for the clearing houses, who, like exchanges, just kind of disappear, along with any way to regulate them. Somewhere, Joe Kennedy, the first Chairman of the Securities and Exchange Comission, is probably either crying his eyes out or laughing his head off, depending on your interpretation of his role in regulatory history. This brings us to the reason securities exist, anyway. A stock certificate is really a legal document, right? How can you enforce laws in a geodesic environment protected by strong cryptography. Well, in a geodesic market, cryptographic protocols, instead of laws, enforce agreements. If the cryptographic protocol isn't satisfied, the software won't work. It's easy to see how a combination of certification technology and cryptographically anonymous voting protocols allow the direct election of a company's board members without proxies -- another hierarchical device -- for instance. It's easy to see how the presentation of digital interest coupons to a company's bond trustee could result in a payment in digital cash. This seems to work for just about any kind of financial instrument you could imagine. The presence of the digital certificate is prima facie claim upon the abstracted item, votes, interest/dividends, hog bellies, you name it, and the protocol could be put into software everyone could check themselves. Obviously, we aren't talking about the end of bookeeping as we know it (BAWKI? ;-), but it does mean that days of book-entry as a means of social control are numbered. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: True Names and Webs of Trust
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:46 PM 8/22/95, Patrick J. LoPresti wrote: >-----BEGIN PGP SIGNED MESSAGE----- > > tcmay> As Bill Stewart correctly claimed is my view, the "key is the > tcmay> identity." Or, more accurately, a _persistent personna_ is > tcmay> what matters. > >These discussions are missing the entire point of the Web of Trust. > >Key signatures exist for one reason and one reason only: To thwart >man-in-the-middle attacks. Whether your "persistent persona" is a >True Name (tm) or a pseudonym is irrelevant. But this is exactly what a persistent personna is. Not a True Name, but a keyholder who has not been spoofed by some other agent or entity. End to end. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Any code for getting noise from PC & Mac sound card?
by baldwin 17 Dec '03

17 Dec '03

I am looking for an example of software that extracts unpredictable bits from the sound cards of PCs and MACs. Has anyone written software like this? Can someone send me a URL to it? Thanks, --Bob Baldwin

1 0

Re: True Names and Webs of Trust
by Rich Salz 17 Dec '03

17 Dec '03

> This has relevance to the thread Michael Froomkin raised, as well. To wit, > none of the people I've met has been "certified." And yet it doesn't bother > me. Just because you haven't been able to easily do it yet, nor found it useful, is no reason not to let new technology provide this service to you. /r$

1 0