December 2003 - cypherpunks-legacy

Re: NSA on GAK
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

I've reformatted this to make it easier to read...If you've already read it, then just delete it:) ~~~~~~~ Included reformatted stuff starts here --\/ ~~~~~~~~~~~~~~~~~~~~~~ URL: http://csrc.ncsl.nist.gov/secnews/ees_q-a.txt ---------- Note: The following answers were provided by NSA to the Senate Subcommittee on Technology and the Law in response to their follow- up questions to the May 3, 1994 hearings. --------------------------- Senate Subcommittee on Technology and the Law Hearing on the Administration's Key Escrow Encryption Standard Written Questions for Vice Admiral McConnell, NSA *Questions for Senator Pressler: Q: Admiral, as you are aware, critics of the Administration's proposal argue that as a practical matter, no criminal, foreign spy, or terrorist of any sophisticated would be foolish enough to use an encryption device designed by the NSA and approved by the FBI. How do you respond? Why do[n't you] think the people whose telecommunications the NSA and the FBI want most to decode will be the very people most unlikely to use this technology? Answer: From what we know today, the overriding requirement that spies, terrorist, and criminals have is for readily available and easy to use equipment that interoperates. Key escrow encryption is not meant to be a tool to catch criminals. It will make excellent encryption available to legitimate businesses and private citizens without allowing criminals to use the telecommunications system to plan and commit crimes with impunity. We believe it would be irresponsible for government to make excellent encryption broadly available knowing that its use by criminals would make it impossible for law enforcement agencies to conduct lawful wiretaps against them. The Department of Justice credits information gleaned through wiretaps as leading to more than 20,000 felony convictions since the early 1980s. This would not have been possible if the criminals had been using encryption systems the FBI could not break. Without government action, however, this fortunate situation will change. At present most people, and most criminals, don't use encryption. However, there is an increasing public awareness of the value of encryption for protecting private personal and business communications. Increasing demand for encryption by the public will likely lead to the widespread use of some form of standardized encryption on the public telecommunications network. This development would have great benefits for the country. Legitimate businesses an private individuals could use the telecommunications system secure in the knowledge that their private information such as business records and credit card numbers could not be intercepted by third parties. But there is a down side. Criminals, terrorists, and others could also use the system to plan crimes, launder money, and the like, completely secure in the knowledge that law enforcement agencies could not listen to those communications. Just as legitimate businesses operate much more efficiently and effectively using the telecommunications system than they could without it, so will criminal enterprises be able to operate more efficiently and effectively if they no longer have to avoid using the telecommunications system. The United States is faced with a choice. We can sit back and watch as the emerging national information infrastructure becomes a valuable tool for criminals and terrorists to use to plan and carry out their activities with complete security, or we can take steps to maintain the current ability of government to conduct lawful wiretaps so that prudent criminals will have to find other less efficient ways to operate and foolish ones may be caught. Key escrow encryption is the later option. Q: Would widespread use of the Skipjack algorithm harm U.S. exports? Do you think it is unlikely foreign businesses will purchase American encryption technology if the U.S. Government holds a set of the decoding keys? Answer: I do not believe that widespread use of key escrow encryption in the United States will harm U.S. exports. If it has any effect at all, it could increase exports somewhat. Key escrow encryption products provide another option for foreign purchasers that they have not had in the past; to the extent that foreigners doe purchase key escrow encryption products, it will mean an increase in exports. Meanwhile, U.S. exporters are free to continue to sell the products they currently sell in foreign markets and to seek license approvals for new products. It is difficult to predict the foreign market for U.S. key escrow encryption technology. Businesses that fear U.S. Government interception of their communications presumably would avoid products for which the U.S. Government hold keys. However, there are a number of reasons why foreign businesses might purchase them. One major reason would be to communicate securely with U.S. businesses that use them. In addition, the superior level of security provided by key escrow products (against all but lawful U.S. Government access) may make them attractive to foreign business that do not view U.S Government access as a major concern. While some prospective users abroad may steer clear of key escrow products because the United States will retain access, there may be many who believe they are unlikely to be targeted by U.S. intelligence in any case or for whom the superior security offered by key escrow encryption products against threats of greater concern may make key escrow products an attractive option. For example, a distributor of pay-TV programming may depend on encryption to ensure that only those viewers who pay for the service can decrypt the TV signal. Such a distributor probably would not be concerned about the threat of access by the United States Government, and might favor suitable key escrow encryption products over competing products that use weaker encryption algorithms. Q: You were present when the previous panelist, Stephen Walker, described how present U.S. laws prohibit his company from exporting encryption products. As I understand it, Senator Murray's bill S.1846, attempts to relax these export controls somewhat. Please give us your views on this legislation. Answer: I support the Administration's position, as announced by the White House on February 4, that current export controls must remain in place and that regulatory changes should be implemented to speed exports and reduce the licensing burden on exporters. The bill you reference appears to be inconsistent with the Administration position. I would be happy to provide you further information on the Administration's reasons for maintaining the current export controls in an appropriate setting. *Questions from Senator Murray: Q: In my office in the Hart building this February, I downloaded from the Internet an Austrian program that uses DES encryption. This was on a laptop computer, using a modem over a phone line. The Software Publishers' Association says there are at least 120 DES or comparable programs world wide. However, U.S. export control laws prohibit American exporters from selling comparable DES programs abroad. With at least 20 million people hooked up to the Internet, how do U.S. export controls actually prevent criminals, terrorists, or whoever from obtaining DES encryption software? Answer: Serious users of encryption do not entrust their security to software distributed via networks o bulletin boards. There is simply too much risk that viruses, Trojan Horses, programming errors, and other security flaws may exist in such software which could not be detected by the user. Serious users of encryption, those who depend on encryption to protect valuable data and cannot afford to take such chances, instead turn to other sources in which they can have greater confidence. Such serious users include not only entitles which may threaten U.S. national security interests, but also businesses and other major consumers of encryption products. Encryption software distribution via Internet, bulletin board, or modem does not undermine the effectiveness of encryption export controls. [Primary written questions for Admiral McConnell] 1. The Defense Authorization Bill for Fiscal Year 1994 has authorized $800,000 to be spent by the National Research Council of the National Academy of Sciences to conduct a study of federal encryption policy. Can we wait to implement the key escrow encryption program until we have the benefit of the NRC's study? Do you think this study is necessary? Should this study be expedited? Answer: We do not believe that we can wait until after the NRC study is completed in 1996 to begin implementation of the key escrow initiative. The information technology industry is dynamic and fast-moving, and to wait another two years or more would, we believe, jeopardize the success of the initiative. Industry demand for encryption products is growing, and the technology is available now to meet that demand with encryption products that provide an outstanding level of security to the user conduct lawful wiretaps. To wait for the completion of the NRC study to other encryption products which would defeat lawful wiretaps. We believe that such a delay would not be in the best interest of the American people. Neither do we believe that the study should be expedited. For our part, we will carefully consider the conclusions of the NRC study. We expect that it will give very careful consideration to the issues, and we would not want the pressure of an unnecessarily short deadline to limit the study group's ability to produce the best report possible. 2. The Administration has said that it is continuing to restrict export of the most sophisticated encryption devices, in part, "because of the concerns of our allies who fear that strong encryption technology would inhibit their law enforcement capabilities." Do we really need to help our allies by prohibiting the export of strong American encryption products, since those same countries can simply control the encryption bought within their borders? Answer: Exports of encryption products are subject to review primarily to protect U.S. national interests, including national security, law enforcement, foreign policy, and other important interests. The law enforcement concerns of our allies are a consideration, especially as the ability of our allies to combat terrorism, drug trafficking, and other international law enforcement problems can have direct benefits to the United States. However, foreign law enforcement concerns do not drive our export control policy. We would continue to review encryption exports to protect U.S. national interests even if foreign law enforcement concerns disappeared. 3. Do you know whether foreign governments would be interested in importing key escrow encryption products to which they hold the decoding keys? Answer: Several foreign governments have expressed interest in key escrow encryption technology due to their own law enforcement concerns. There have been some preliminary discussions, but issues such as who would hold the escrowed keys and the circumstances of government access to escrowed keys must be fully vetted. 4. The Government wants the key escrow encryption standard to become the de facto industry standard in the United States. Would the Government abandon the Clipper Chip program if it is shown to be unsuccessful beyond government use? Answer: We do not expect the program to be unsuccessful beyond government. We have developed a sound security product that we expect will find many uses in government information systems and further believe that government use will bring with it a commercial market, particularly in the defense sector. We have developed a sound security product that we expect will find many uses in government information systems regardless of its success in commercial markets. 5. Openly available devices, such as Intel-compatible microprocessors, have seen dramatic gains, but only because everyone was free to try to build a better version. Given the restrictions on who can build devices with the classified skipjack algorithm, how will key escrow chips keep up with advances in semiconductor speed, power, capacity and integration? Answer: Despite the requirements that a firm must meet to produce key escrow encryption chips, we expect that there will be a number of manufacturers competing against each other to produce the best product, and that such competition will drive them to keep up with the latest technological advances. It is worth noting that only a few companies can produce the sophisticated microprocessors you reference, yet the competition in that market has driven them to achieve remarkable advances in that technology. NSA's STU-III secure telephone program provides an example of a cryptographic product line that keeps pace with technology. The presence of a classified algorithm does not preclude keeping pace with technology. Through NSA's use of a competitive, multi-vendor approach, STU-III secure telephone products have continued to evolve in response to user requirements and technological advances despite their use of a classified encryption algorithm and the consequent need for security restrictions on the manufacturers. 6. How well does the Skipjack algorithm work on telecommunications operating at very high speeds. Is NSA working on another algorithm, called BATON, that could be used in high speeds with a key escrow system? Will Capstone be compatible with BATON? Answer: Using currently available microelectronics technology the SKIPJACK algorithm could not be used for encryption at very high speeds. BATON is the name of an algorithm developed by NSA that could be used at higher rates of speed. We have no plans to develop key escrow encryption devices using BATON, however. Instead, we are considering another algorithm for use at high speeds with a key escrow system. A high-speed key escrow device based on an algorithm other than SKIPJACK would not be "compatible with Capstone" in the sense that traffic encrypted by such a device could not be decrypted by Capstone, and vice versa. However, since such a device would be used for much higher-speed applications than those for which Capstone was designed, there would be no need for it to be compatible with Capstone in that sense. 7. Can Capstone be used to encrypt video programming? If so, have cable companies been approached by any government agency to use Capstone to scramble or encrypt cable program? Answer: Capstone could be used to encrypt any digital signal, including video programming, operating at up to about 10 million bits per second. It could be used for encrypting individual video channels but not for bulk encryption of many channels multiplexed together in a single link. NSA is not aware of any government agency approaching cable companies to urge the use of Capstone. Two manufacturers have asked us about the suitability of key escrow devices for this purpose, however. 8. Encryption software is available that can be used with Clipper to encrypt a message before after it has been encrypted with Clipper. This "double encrypting" risks bypassing the key escrow feature. If a sender first encrypts the message with software using DES, and then transmits the message "double encrypted" with Clipper, can tell you from looking at the cipher, or encrypted text, that the underlying message was encrypted? Answer: The only way to tell that a message has been "double encrypted" in this way would be to decrypt the "outer layer" of encryption, i.e. that done with Clipper. Only then would one be able to tell that the message had first been encrypted with something else. ---------- _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

2 1

Re: CYPHERPUNK considered harmful.
by Carl Ellison 17 Dec '03

17 Dec '03

>From: "Peter Trei" <trei(a)process.com> >Date: Wed, 13 Sep 1995 10:37:46 -6 >-------------------------------------------------------------- > > Towards this goal, I have written a short Q&A that could be >used as a model when discussing cryptography with non-cypherpunks. >Q: Aren't LEAs worried that strong encryption will make it more >difficult for them to catch crooks? Yes, some are -- especially at higher levels. LEAs in the field (by my informal survey) are not. They're worried instead about manpower and normal tools (e.g., computers back at the station, radios, ...). Meanwhile, there is an advantage for LEAs when criminals have, for example, encrypting phones. A phone itself gives the person using it a sense of privacy. [This is probably a side effect of the psychological cues which result from using a handset. If you pull a handset away from your ear or mouth very far, you can't converse. Someone standing in the same room as you probably can not hear the words you hear in your ear. If the handset were another person, this behavior would be called "whispering" -- something done to achieve privacy.] An encrypting phone (or e-mail for that matter) gives the impression (and, to some extent, reality) of extra privacy. When there is a perception of privacy, the people conversing are more likely to reveal things which they don't want overheard. If these people are ciminals, those things might be used as evidence against them. The advantage for LEAs comes from the fact that the person at the other end of the line might well be an LEA in disguise. This is especially true on the Internet (or on AOL, to cite a recent case), where the other person may well be someone you have never met and therefore haven't checked out to verify level of criminality. >Q: What's this 'key escrow' thing? > >A: Some government agencies have been trying to figure out methods which >simultaneously permit US citizens to use strong cryptography against >criminal eavesdroppers, while retaining the ease with which LEAs can >currently tap your calls. The schemes generally involve something >mistitled 'key escrow', in which copies of cryptographic keys would be >stored at sites accessible by LEAs. 'key escrow' is a code word for government access to the unencrypted message. It is a persistent theme, dating back to the NSA's CCEP in about 1987. 'key escrow' is also the name of a technique by which the most recent example of this access, Clipper/Capstone, achieved that government access. ( see http://www.clark.net/pub/cme/html/no-ke.html#etymology ) >Q: Why do you object to it? > >A: This is a bit as if your local police department ordered you to send >them copies of all of your house, car, and office keys, so that they >could enter whenever they felt it warranted, without your knowledge. > >Even assuming no keys will be leaked to criminals from such a valuable >archive, it's an incredible boondoggle. The inital cost is tens of >millions of dollars per year, by the most conservative government >estimates. In reality, it's likely to be hundreds of millions a year, >all to enable LEAs to investigate a type of crime which does not yet >occur, and may never occur. My preferred analogy so far (from http://www.clark.net/pub/cme/html/avss.html) is: It is one thing to permit a police officer to look in an open window, see a criminal act in progress, start an investigation or make an arrest and use what he or she saw as evidence in an eventual trial of the perpetrators. It is something entirely different to prohibit people from using curtains on the grounds that curtains might prevent a police officer from seeing a criminal act in progress. >- ------------------------------------------------------ >Cute signature quotes are needed. There was a great one last week at NIST: "Daddy ... if your data is your own property, does it become less your property after you encrypt it?" [Speaker at the NIST workshop, September 6-7, 1995] - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)tis.com http://www.clark.net/pub/cme | |Trusted Information Systems, Inc. http://www.tis.com/ | |3060 Washington Road PGP 2.6.2: 61E2DE7FCB9D7984E9C8048BA63221A2| |Glenwood MD 21738 Tel:(301)854-6889 FAX:(301)854-5363 | +--------------------------------------------------------------------------+

1 0

Re: An opportunity not to be missed
by Frank Stuart 17 Dec '03

17 Dec '03

>> Is anyone in a position to set up a cypherpunks CrimeStoppers mailbox (for >> use through the remailers)? You could set up a web-page with instructions >> and a list of crimes for which there are rewards. > >Someone already tried that. The cops got a copy of the WWW logs and >started investigating everyone who'd looked at the WWW page... So at the >least you'd need a bunch of anonymous WWW proxies as well. Yuck. Well, if this is going to be a problem, you could distribute a periodic FAQ via Usenet instead. >There's also the problem that the current ecash systems do not provide >payee anonymity, so if you pay informers with ecash they can be traced if >the bank and payer collude. That's a real problem and underscores the need for better ecash. :) Frank Stuart | (Admiral Grace) Hopper's Law: fstuart(a)vetmed.auburn.edu | It's easier to get forgiveness than permission.

1 0

No Subject
by Hroller Anonymous Remailer 17 Dec '03

17 Dec '03

/* SAFER SK-64 By James L. Massey who did not do this conversion and is not responsible for any bugs in it. This a 'C' conversion of the reference Turbo Pascal implementation Examples of Encryption with SAFER SK-64 (i.e., with the strengthened key schedule of 64 bits.) PLAINTEXT is 1 2 3 4 5 6 7 8 The KEY is 0 0 0 0 0 0 0 1 after round 1 131 177 53 27 130 249 141 121 after round 2 68 73 32 102 134 54 206 57 after round 3 248 213 217 11 23 68 0 243 after round 4 194 62 109 79 24 18 13 84 after round 5 153 156 246 172 40 72 173 39 after round 6 154 242 34 6 61 35 216 28 CRYPTOGRAM is 21 27 255 2 173 17 191 45 PLAINTEXT is 1 2 3 4 5 6 7 8 The KEY is 1 2 3 4 5 6 7 8 after round 1 223 98 177 100 46 234 13 210 after round 2 182 246 230 93 158 14 48 89 after round 3 45 234 128 149 40 101 10 134 after round 4 30 17 249 236 158 120 69 100 after round 5 1 200 182 241 0 127 152 162 after round 6 144 85 94 214 5 38 65 150 CRYPTOGRAM is 95 206 155 162 5 132 56 199 */ #include <stdio.h> /* globals */ unsigned char a1,a2,a3,a4,a5,a6,a7,a8, b1,b2,b3,b4,b5,b6,b7,b8, r; unsigned char k[21][8],k1[9]; int logtab[256],exptab[256],i,j,n; mat1(p1,p2,q1,q2) unsigned char p1,p2,*q1,*q2; { *q2=p1+p2; *q1=*q2+p1; } invmat1(p1,p2,q1,q2) unsigned char p1,p2,*q1,*q2; { *q1=p1-p2; *q2=-*q1+p2; } init_tables() { /* This portion of the program computes the powers of the primitive element 45 of the finite field GF(257) and stores these numbers in the table "exptab". The corresponding logarithms to the base 45 are stored in the table "logtab" */ logtab[1]=0; exptab[0]=1; for(i=1;i<=255;i++) { exptab[i]=(45*exptab[i-1]) % 257; logtab[exptab[i]]=i; } exptab[128]=0; logtab[0]=128; exptab[0]=1; } set_rounds() { int rounds; do { printf("Enter number of rounds (max 10): "); scanf("%d",&rounds); } while(rounds<1 || rounds>10); r=(unsigned char)rounds; } get_plaintext() { int i1,i2,i3,i4,i5,i6,i7,i8; printf("Enter plaintext as 8 bytes (0-255 separated by spaces)\n"); scanf("%d%d%d%d%d%d%d%d",&i1,&i2,&i3,&i4,&i5,&i6,&i7,&i8); a1=(unsigned char)i1; a2=(unsigned char)i2; a3=(unsigned char)i3; a4=(unsigned char)i4; a5=(unsigned char)i5; a6=(unsigned char)i6; a7=(unsigned char)i7; a8=(unsigned char)i8; } get_key() { int i1,i2,i3,i4,i5,i6,i7,i8; printf("Enter key as 8 bytes (0-255 separated by spaces)\n"); scanf("%d%d%d%d%d%d%d%d",&i1,&i2,&i3,&i4,&i5,&i6,&i7,&i8); k[0][0]=k1[0]=(unsigned char)i1; k[0][1]=k1[1]=(unsigned char)i2; k[0][2]=k1[2]=(unsigned char)i3; k[0][3]=k1[3]=(unsigned char)i4; k[0][4]=k1[4]=(unsigned char)i5; k[0][5]=k1[5]=(unsigned char)i6; k[0][6]=k1[6]=(unsigned char)i7; k[0][7]=k1[7]=(unsigned char)i8; } key_schedule() { /* append a "parity byte" to the key k1 */ k1[8]=k1[0]^k1[1]^k1[2]^k1[3]^k1[4]^k1[5]^k1[6]^k1[7]; /* derive keys k2, k3, ... k2r+1 from input key k1 */ for(n=2;n<=(2*r)+1;n++) { /* each byte of the key k1 is left rotated by 3 */ for(j=0;j<=8;j++) k1[j]=(k1[j]<<3) + (k1[j]>>5); /* the key bias is added here to the right rotated k1 */ for(j=1;j<=8;j++) k[n-1][j-1]=k1[(j+n-2) % 9]+exptab[exptab[(9*n)+j]]; } } encrypt() { for(i=1;i<=r;i++) { /* Key 2i-1 is mixed bit and byte added to the round input */ a1=a1 ^ k[2*i-2][0]; a2=a2 + k[2*i-2][1]; a3=a3 + k[2*i-2][2]; a4=a4 ^ k[2*i-2][3]; a5=a5 ^ k[2*i-2][4]; a6=a6 + k[2*i-2][5]; a7=a7 + k[2*i-2][6]; a8=a8 ^ k[2*i-2][7]; /* The result now passes through the nonlinear layer */ b1=exptab[a1]; b2=logtab[a2]; b3=logtab[a3]; b4=exptab[a4]; b5=exptab[a5]; b6=logtab[a6]; b7=logtab[a7]; b8=exptab[a8]; /* Key 2i is now mixed byte and bit added to the result */ b1=b1 + k[2*i-1][0]; b2=b2 ^ k[2*i-1][1]; b3=b3 ^ k[2*i-1][2]; b4=b4 + k[2*i-1][3]; b5=b5 + k[2*i-1][4]; b6=b6 ^ k[2*i-1][5]; b7=b7 ^ k[2*i-1][6]; b8=b8 + k[2*i-1][7]; /* The result now enters the linear layer */ mat1(b1,b2,&a1,&a2); mat1(b3,b4,&a3,&a4); mat1(b5,b6,&a5,&a6); mat1(b7,b8,&a7,&a8); mat1(a1,a3,&b1,&b2); mat1(a5,a7,&b3,&b4); mat1(a2,a4,&b5,&b6); mat1(a6,a8,&b7,&b8); mat1(b1,b3,&a1,&a2); mat1(b5,b7,&a3,&a4); mat1(b2,b4,&a5,&a6); mat1(b6,b8,&a7,&a8); /* The round is now completed! */ printf("after round %d %3d %3d %3d %3d %3d %3d %3d %3d\n", (int)i,a1,a2,a3,a4,a5,a6,a7,a8); } /* Key 2r+1 is now mixed bit and byte added to produce the final cryptogram */ a1=a1 ^ k[2*r][0]; a2=a2 + k[2*r][1]; a3=a3 + k[2*r][2]; a4=a4 ^ k[2*r][3]; a5=a5 ^ k[2*r][4]; a6=a6 + k[2*r][5]; a7=a7 + k[2*r][6]; a8=a8 ^ k[2*r][7]; } main() { init_tables(); for(;;) { set_rounds(); get_plaintext(); get_key(); printf("PLAINTEXT is %3d %3d %3d %3d %3d %3d %3d %3d\n", a1,a2,a3,a4,a5,a6,a7,a8); printf("THE KEY IS %3d %3d %3d %3d %3d %3d %3d %3d\n", k[0][0],k[0][1],k[0][2],k[0][3],k[0][4],k[0][5],k[0][6],k[0][7]); key_schedule(); encrypt(); printf("CRYPTOGRAM IS %3d %3d %3d %3d %3d %3d %3d %3d\n\n", a1,a2,a3,a4,a5,a6,a7,a8); } }

1 0

No Subject
by Hroller Anonymous Remailer 17 Dec '03

17 Dec '03

/* SAFER SK-128 designed by James L. Massey who did not do this conversion and is not responsible for any bugs in it. This a 'C' conversion of the reference Turbo Pascal implementation Examples of Encryption with SAFER SK-128 (i.e., with the strengthened key schedule of 128 bits.) PLAINTEXT is 1 2 3 4 5 6 7 8 KEY Ka is 0 0 0 0 0 0 0 1 KEY Kb is 0 0 0 0 0 0 0 1 after round 1 131 177 53 27 130 249 141 121 after round 2 68 73 32 102 134 54 206 57 after round 3 248 213 217 11 23 68 0 243 after round 4 194 62 109 79 24 18 13 84 after round 5 153 156 246 172 40 72 173 39 after round 6 154 242 34 6 61 35 216 28 after round 7 100 31 172 67 44 75 133 219 after round 8 78 226 239 135 210 83 93 72 after round 9 72 64 46 195 163 159 243 114 after round10 3 133 76 190 191 52 220 123 CRYPTOGRAM is 65 76 84 90 182 153 74 247 PLAINTEXT is 1 2 3 4 5 6 7 8 KEY Ka is 1 2 3 4 5 6 7 8 KEY Kb is 0 0 0 0 0 0 0 0 after round 1 64 214 74 216 103 222 26 54 after round 2 61 14 68 15 46 111 124 80 after round 3 197 124 96 59 255 24 2 30 after round 4 63 59 214 103 236 166 153 24 after round 5 66 254 26 45 152 223 5 122 after round 6 89 47 58 105 161 38 135 45 after round 7 19 202 174 44 57 206 52 25 after round 8 78 179 113 208 169 26 121 22 after round 9 53 17 81 215 120 37 206 246 after round10 189 177 9 0 186 82 208 253 CRYPTOGRAM is 255 120 17 228 179 167 46 113 PLAINTEXT is 1 2 3 4 5 6 7 8 KEY Ka is 0 0 0 0 0 0 0 0 KEY Kb is 1 2 3 4 5 6 7 8 after round 1 95 186 209 220 166 66 213 10 after round 2 200 65 189 120 96 135 42 166 after round 3 64 169 43 166 132 171 31 40 after round 4 199 167 76 189 145 158 241 19 after round 5 71 55 184 212 108 198 77 108 after round 6 173 197 139 11 17 48 97 59 after round 7 17 51 142 4 170 7 207 124 after round 8 62 205 253 225 167 179 228 202 after round 9 133 168 127 138 193 243 34 226 after round10 59 194 69 220 220 231 123 148 CRYPTOGRAM is 73 201 157 152 165 188 89 8 */ #include <stdio.h> /* globals */ unsigned char a1,a2,a3,a4,a5,a6,a7,a8, b1,b2,b3,b4,b5,b6,b7,b8, r; unsigned char k[25][8],ka[9],kb[9]; int logtab[256],exptab[256],i,j,n; mat1(p1,p2,q1,q2) unsigned char p1,p2,*q1,*q2; { *q2=p1+p2; *q1=*q2+p1; } invmat1(p1,p2,q1,q2) unsigned char p1,p2,*q1,*q2; { *q1=p1-p2; *q2=-*q1+p2; } init_tables() { /* This portion of the program computes the powers of the primitive element 45 of the finite field GF(257) and stores these numbers in the table "exptab". The corresponding logarithms to the base 45 are stored in the table "logtab" */ logtab[1]=0; exptab[0]=1; for(i=1;i<=255;i++) { exptab[i]=(45*exptab[i-1]) % 257; logtab[exptab[i]]=i; } exptab[128]=0; logtab[0]=128; exptab[0]=1; } set_rounds() { int rounds; do { printf("Enter number of rounds (max 12): "); scanf("%d",&rounds); } while(rounds<1 || rounds>12); r=(unsigned char)rounds; } get_plaintext() { int i1,i2,i3,i4,i5,i6,i7,i8; printf("Enter plaintext as 8 bytes (0-255 separated by spaces)\n"); scanf("%d%d%d%d%d%d%d%d",&i1,&i2,&i3,&i4,&i5,&i6,&i7,&i8); a1=(unsigned char)i1; a2=(unsigned char)i2; a3=(unsigned char)i3; a4=(unsigned char)i4; a5=(unsigned char)i5; a6=(unsigned char)i6; a7=(unsigned char)i7; a8=(unsigned char)i8; } get_key() { int i1,i2,i3,i4,i5,i6,i7,i8; printf("Enter left half of key as 8 bytes (0-255 separated by spaces)\n"); scanf("%d%d%d%d%d%d%d%d",&i1,&i2,&i3,&i4,&i5,&i6,&i7,&i8); ka[0]=(unsigned char)i1; ka[1]=(unsigned char)i2; ka[2]=(unsigned char)i3; ka[3]=(unsigned char)i4; ka[4]=(unsigned char)i5; ka[5]=(unsigned char)i6; ka[6]=(unsigned char)i7; ka[7]=(unsigned char)i8; printf("Enter right half of key as 8 bytes (0-255 separated by spaces)\n"); scanf("%d%d%d%d%d%d%d%d",&i1,&i2,&i3,&i4,&i5,&i6,&i7,&i8); kb[0]=(unsigned char)i1; kb[1]=(unsigned char)i2; kb[2]=(unsigned char)i3; kb[3]=(unsigned char)i4; kb[4]=(unsigned char)i5; kb[5]=(unsigned char)i6; kb[6]=(unsigned char)i7; kb[7]=(unsigned char)i8; } key_schedule() { /* append a "parity byte" to the key k1 */ ka[8]=ka[0]^ka[1]^ka[2]^ka[3]^ka[4]^ka[5]^ka[6]^ka[7]; kb[8]=kb[0]^kb[1]^kb[2]^kb[3]^kb[4]^kb[5]^kb[6]^kb[7]; /* derive keys k1, k2, ... k2r+1 from input key ka, kb */ for(j=0;j<8;j++) k[0][j]=kb[j]; /* each byte of the key ka is right rotated by 3 */ for(j=0;j<9;j++) ka[j]=(ka[j]>>3) + (ka[j]<<5); for(i=1;i<=r;i++) { /* each byte of the keys ka and kb is left rotated by 6 */ for(j=0;j<=8;j++) { ka[j]=(ka[j]<<6) + (ka[j]>>2); kb[j]=(kb[j]<<6) + (kb[j]>>2); } /* the key bias is added to give keys k2i-1 and k2i */ for(j=1;j<=8;j++) { k[2*i-1][j-1]=ka[(j+2*i-2) % 9]+exptab[exptab[18*i+j]]; k[2*i][j-1]=kb[(j+2*i-1) % 9]+exptab[exptab[18*i+9+j]]; } } } encrypt() { for(i=1;i<=r;i++) { /* Key 2i-1 is mixed bit and byte added to the round input */ a1=a1 ^ k[2*i-2][0]; a2=a2 + k[2*i-2][1]; a3=a3 + k[2*i-2][2]; a4=a4 ^ k[2*i-2][3]; a5=a5 ^ k[2*i-2][4]; a6=a6 + k[2*i-2][5]; a7=a7 + k[2*i-2][6]; a8=a8 ^ k[2*i-2][7]; /* The result now passes through the nonlinear layer */ b1=exptab[a1]; b2=logtab[a2]; b3=logtab[a3]; b4=exptab[a4]; b5=exptab[a5]; b6=logtab[a6]; b7=logtab[a7]; b8=exptab[a8]; /* Key 2i is now mixed byte and bit added to the result */ b1=b1 + k[2*i-1][0]; b2=b2 ^ k[2*i-1][1]; b3=b3 ^ k[2*i-1][2]; b4=b4 + k[2*i-1][3]; b5=b5 + k[2*i-1][4]; b6=b6 ^ k[2*i-1][5]; b7=b7 ^ k[2*i-1][6]; b8=b8 + k[2*i-1][7]; /* The result now enters the linear layer */ mat1(b1,b2,&a1,&a2); mat1(b3,b4,&a3,&a4); mat1(b5,b6,&a5,&a6); mat1(b7,b8,&a7,&a8); mat1(a1,a3,&b1,&b2); mat1(a5,a7,&b3,&b4); mat1(a2,a4,&b5,&b6); mat1(a6,a8,&b7,&b8); mat1(b1,b3,&a1,&a2); mat1(b5,b7,&a3,&a4); mat1(b2,b4,&a5,&a6); mat1(b6,b8,&a7,&a8); /* The round is now completed! */ printf("after round %d %3d %3d %3d %3d %3d %3d %3d %3d\n", (int)i,a1,a2,a3,a4,a5,a6,a7,a8); } /* Key 2r+1 is now mixed bit and byte added to produce the final cryptogram */ a1=a1 ^ k[2*r][0]; a2=a2 + k[2*r][1]; a3=a3 + k[2*r][2]; a4=a4 ^ k[2*r][3]; a5=a5 ^ k[2*r][4]; a6=a6 + k[2*r][5]; a7=a7 + k[2*r][6]; a8=a8 ^ k[2*r][7]; } main() { init_tables(); for(;;) { set_rounds(); get_plaintext(); get_key(); printf("PLAINTEXT is %3d %3d %3d %3d %3d %3d %3d %3d\n", a1,a2,a3,a4,a5,a6,a7,a8); printf("KEY Ka IS %3d %3d %3d %3d %3d %3d %3d %3d\n", ka[0],ka[1],ka[2],ka[3],ka[4],ka[5],ka[6],ka[7]); printf("KEY Kb IS %3d %3d %3d %3d %3d %3d %3d %3d\n", kb[0],kb[1],kb[2],kb[3],kb[4],kb[5],kb[6],kb[7]); key_schedule(); encrypt(); printf("CRYPTOGRAM IS %3d %3d %3d %3d %3d %3d %3d %3d\n\n", a1,a2,a3,a4,a5,a6,a7,a8); } }

1 0

Crimestoppers anon tip mailbox
by David C. Lambert 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >> Is anyone in a position to set up a cypherpunks CrimeStoppers mailbox (for >> use through the remailers)? You could set up a web-page with instructions >> and a list of crimes for which there are rewards. > >Someone already tried that. The cops got a copy of the WWW logs and >started investigating everyone who'd looked at the WWW page... Right - this was an abduction case in Florida, if memory serves. > So at the >least you'd need a bunch of anonymous WWW proxies as well. I don't see that as a problem. I'm about to set up at least one of these myself, and I believe that there are others around - please correct me if I'm wrong. In any case, there needn't be a web page to do the actual reporting. There can be web pages to advertise, and then a simple maildrop for the tips. You could even arrange that the maildrop send everything to a remailer for delivery to a non-advertised address for an extra layer of protection (in case someone forgot to use a remailer to send the tip in the first place, or they screwed up in a way that revealed their identity). David C. Lambert dcl(a)panix.com -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMFhV8KpplsfgM88VAQHwIgP/eO5eQIb6PgraSAGeoWJ4Jvc3F8tTkY2u ZiBfuWN3XMu8JRUQOAcW7Vs4lfgBBm7HDHe05mbmczQGsMTzhcLErQ1m1uPup+Xw LJmbI2hWjxmuTZI14zoTAnTeTJt3L2XLwl7BPpkWkB7EIrERpua2FYIfdqArFO4e AxEsD+ybA/k= =pcn4 -----END PGP SIGNATURE-----

1 0

MIME Security Issues
by Richard Potocki 17 Dec '03

17 Dec '03

Does anybody wish to express any comments regarding MIME security. I have read the RFC's and any/all doc's I could find on this issue. I understand what the security risks are, but I have been unsuccessful in my attempts to find info regarding what is being done, or has been done to correct this. If I remember correctly, I think I once saw a brief mention of filters or something. I am new to this stuff, so any assistance would greatly appreciated. Thank you, Rick

2 1

Child Porn, Morphing, and Pointers
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:40 PM 9/14/95, Rev. Ben wrote: >> The bill would expand the definition of child pornography >> to include any photograph, film, videotape or computer >> image produced by any means, including electronically by >> computer, if it depicts or appears to depict a minor >> engaging in sexually explicit conduct. > >If I'm reading this correctly, if I Photoshop a kids face onto the body >of the latest Playboy centerfold, I'm in violation of this proposed law? I believe there have already been prosecutions along these lines. For example, do you think a _comic book_ with child porn themes ("explicit" art, situations) would not be prosecuted as child porn? I strongly suspect that a _painting_ of a 7-year-old girl engaged in a sex act would result in a prosecution. Keith Henson, amongst others, has long suggested that a good test case will be the _morphing_ of legal images to make them look like child porn. This is not a legal list--for that there are several other fora/forums--but it is clear that the child porn laws are not necessarily aimed at the protection of specific minor children from "exploitation," as the laws apply to porn imported from countries where the age of consent is lower, apply to images of dead children (who can no longer be exploited by the images), and to "created" images of children (morphing, cut-and-paste, paintings, etc.) The laws are clearly aimed at both extinguishing the _market_ for child pornography and the _thoughts_ themselves, not at the protection of specific children. (Advocates will argue that by suppressing the production of child porn markets, future children may be protected....) The main Cypherpunks theme I can find here is this: anonymous remailers and Web proxies will be used to access offshore (or indeterminately located) sites. The Feds will likely come down very hard on any remailers or proxies found to be "trafficking" in such materials. I'm going to post to this list a recent post I made to the Cyberia list about whether pointers are the same as transfers. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Linking = Showing = Transferring?
by tcmay＠got.net 17 Dec '03

17 Dec '03

I posted this to the Cyberia mailing list, but think it has some implications for Cypherpunks as well. And, I'm responding to Duncan Frissell, one of our own. (I don't advise subscribing to Cyberia unless legal issues interest you and you have the time for another high-volume mailing list. Still, some bright folks there--as well as some dullards. David Friedman just joined the list. To subscribe, send a message to listserv(a)listserv.cc.wm.edu with the message body of subscribe cyberia-l YourNameHere.) > >To:cyberia-l@warthog.cc.wm.edu >From:tcmay@got.net (Timothy C. May) >Subject:Linking = Showing = Transferring? > > >As good a chance as any to extend my "showing = telling" point... > >At 9:32 AM 9/14/95, Duncan Frissell wrote: > >>And my favorite: "What if the student merely includes *links* to >>the above on his web page?" Of course racist images/messages are >>always and everywhere as legal as church on a Sunday although they >>may carry civil liability in limited cases -- not a problem for >>judgment-proof students. >... >>"Is the URL the page itself? --- Unanswered philosophical questions >>of the wired age." > >_Linking_ is effectively _showing_, given the point-and-click mechanics of >hypertext. This is a situation anticipated by authors (e.g. Ted Nelson), >but is now coming to the fore. > >Granted, providing a link is not the same as actually _including_ the >material the link points to, but it is very, very close. Arguably, the >same. > >(Example: I create a home page with links to many images that are child >pornography by U.S. standards. The images themselves may be initially >stored in URLs that are in countries with different standards for consent, >e.g., Denmark or Thailand. Have I violated the child porn laws? Arguably, >I am "making available" these materials, but all I have done is to provide >the _pointers_. The readers of my home page are the actual downloaders, >not me.) > >I can imagine rebuttals to this position, arguing that an author who >includes URLs to other places is doing nothing different than an author >who includes footnoted references to other works (and surely we all agree >that footnotes are not copyright infringements of any sort). > >However, look at how the Web is being used. Home pages that have >compilations of interesting things are effectively the works! It is as if >the original materials are being stored on those home pages themselves! > >There is _technological_ and _propertarian_ fix to this: controlled or >paid access to the URLs under question. The "gatekeeper" function shifts >to the actual material under question. > >But there are many new questions. > >And Duncan's specific point remains: > >-- is it a violation of pornography laws (perhaps campus rules) to have a >home page with links to URLs containing pornographic images? > >-- is it a violation of _child pornography_ laws to have a home page with >links to URLs containing child pornography images? (The URLs could be >offshore, perhaps in jurisdictions where the age of consent is much >different than in the U.S., e.g., Denmark or Thailand.) > >-- is it a violation of national security laws to have a home page with >links to URLs containing national defense secrets? (The URLs could be >offshore.) > >-- is it a violation of copyright/patent laws to have home pages with >pointers to protected material? (Songs, written works, images, inventions, >etc.) > >And so on.... > >--Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Annonymous Web proxies.
by hallam＠w3.org 17 Dec '03

17 Dec '03

There has been a lot of debate about setting up of annonymous Web proxies. There are many thousand already deployed. Any Web proxy which does not keep logs is effectively an annonymous Web proxy. Just download the CERN server and run it. http://www.w3.org/hypertext/WWW/Daemon/Status.html The point about monitoring such sites is an apt one. Iwork under the assumption that I am monitored because if I was a spook I would be monitoring me. Most of the discoveries of security holes arrive at my door sooner rather than later. I would have monitored the communist party for the same reason, it was one of the the most obvious place for the soviets to attempt infiltration, the other being the authoritarian establishment right. Phill

1 0