December 2003 - cypherpunks-legacy

Question on modular exponents
by Usuario Acceso2 17 Dec '03

17 Dec '03

Hi CP's: I'd be pleased if someone explained me this ASAP: How could I demonstrate that _ (g^a)^b (mod p) = g^{(a*b) mod q} mod p _ when g's order in Zp is q? The same question remains for adition. I have the feeling the demonstration must be similar. Best. Jaime

1 0

Re: GOST for sale
by JMKELSEY＠delphi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >Date: Fri, 24 Nov 1995 03:43:25 +0100 (MET) >From: Mats Bergstrom <asgaard(a)sos.sll.se> >Subject: GOST for sale >According to a short article in a Swedish newspaper (DN) >with the title 'Spy Code of KGB can make computers safe', >JETICO INC., located in Finland (Tammerfors), introduced >a new crypto system on the world market last week. It's >based on GOST, the Russian federal standard algorithm. >This product, called BestCrypt, is implemented at least >partly in hardware. Alledgedly it uses 'GOST 28147-89', >whatever that stands for. Hmmm. >GOST is probably very secure - a huge keyspace (256 bits) and >KGB would not have left a trapdoor for NSA to take advantage >of, would they? If this is the cipher I've seen, it's not overwhelmingly impressive, though it may be OK. I haven't ever made any serious attempt to attack it, and I don't know anyone else who has. Anyone have a reference? Basically, GOST is a balanced Feistel network (like DES), but its F-function is much simpler. Basically, F(X,K) = Rotate_Left(S(X+K),11), where S(t) denotes parallel application of eight 4:4 S-boxes. Depending on the implementation, these S-boxes' contents could be key-dependent and pseudorandom, or fixed. Unfortunately small random S-boxes are likely to have some weaknesses W.R.T. differential cryptanalysis. This can be true even when the S-boxes are secret and key-derived--see Biham and Birkyov's paper in Auscrypt '94 on a DES variant with variable S-boxes, for a quick discussion of this. And the security of this scheme is very much going to depend upon the S-boxes used. If the S-boxes are generated at (pseudo)random from the key, I'd expect there to be some pretty nasty weak key conditions that could occasionally come up. On the other hand, GOST is defined with 32 rounds, so it may be hard to find any useful differential or linear characteristics, even for relatively bad S-box choices, that have high enough probability to get through 29-31 rounds. And it has a 256-bit key, so even if someone determines some attack which recovers 160 bits of the key, there are still 96 bits of key left to provide security. The GOST key schedule is really simple, though it avoids the most obvious kind of related key attack. I wouldn't be surprised to see some interesting related key attacks be possible. This is interesting because there is also a hash function based on GOST--I'd be pretty reluctant to use this without a lot of analysis. >The newspaper article ends: > >'The Finnish entrepreneurs asseverate that their >Russian colleagues have never had anything to do >with the KGB.' I may be mistaken, but wasn't there some other internal organization in the USSR that did cryptography? >Mats Note: Please respond via e-mail as well as or instead of posting, as I get CP-LITE instead of the whole list. --John Kelsey, jmkelsey(a)delphi.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMLv0kkHx57Ag8goBAQFH3AP+JR1sEQCH0ANmNSDFhzpCZb4jn4uqq23v PjZfFOrYc9SrD1xn+3azqfHFpiHIubfWzZ8u1aNEf4erAErbQLPAUOLPv17zhn// 6UEVKX4GhPqoLfou+wO38rF2DwWdeCjuQm2GgxuFpw5b0D4M3V1mv5ocLOoOMq2N twdfxiMtO6Y= =BOER -----END PGP SIGNATURE-----

1 0

Re: The future will be easy to use
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"perry(a)piermont.com" 28-NOV-1995 13:34:33.55 Jonathan Zamick writes: > I can't agree. The model of a successful enterprise includes feedback from > different levels of participants. This isn't an enterprise. The government is not a participant except by their own desire to interfere. --------- One reason to incorporate a probable opponent into something is to see what methods the opponent will likely use. For instance, their debating points would be nice to know in advance (to the degree they aren't already); while cyberpunks don't have much access to the mass media, that on the Net (where a lot of the initial potential users are likely to be) is another matter. Getting clues to their likely legal strategy may also be valuable. On the other hand, letting them know too much may be a problem... of course, I'm _certain_ the NSA, etcetera get copies of this list. -Allen

1 0

Re: Directed Hamiltonian Path Problem
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"tcmay(a)got.net" 28-NOV-1995 20:15:30.64 The reason we speak in terms of physical volumes of "Adleman computers" is to make concrete the way things scale. If the amount of Adleman computers needed to factor, say, a 2000-digit modulus (or some reasonably equivalent Hamiltonian cycle problem, such as the TSP) is "ten Pacific oceans full of them running for 100 years," then one has a pretty clear feel for just how futile it is to ask about "But what about if we apply MASSIVE PARALLELISM?!?!" ------------ Ah. My objection is probably from being too much of a purist in my own area of science. I do tend to try to be quite careful in whatever I write to use the correct terms (then explain them for those who've heard the incorrect ones). ------------- I don't worry much about factoring breakthroughs. And I don't mean minor improvements, which keep occurring: I mean major breakthroughs which would make factoring a 2000-decimal-digit number "easy." Practically speaking, snarfing private keys is a helluva lot easier, for many reasons. -------------- Umm... it's easier for each one. But the effort in question adds up. Ultimately, for an agency (NSA, CIA, etcetera) wanting to do a lot of such unencryptings, coming up with a factoring method is the most efficient way to go. Fortunately, science doesn't work very well with security classifications (unlike engineering, which is what most military classified "science" is from what I know). -Allen

1 0

Re: Netscape gives in to key escrow
by James A. Donald 17 Dec '03

17 Dec '03

At 12:55 AM 11/30/95 -0800, Jeff Weinstein wrote: > All press accounts I've read so far > have lots of stuff attributed to Jim, but very little of it is actual > quotes. Then we would like to hear Jim "clarify" his position. Absent such clarification, we must assume he considers the press reports of what he said to be reasonably accurate. > I don't want to go down in history as a facilitator of the totalitarian > state, and I don't think anyone else here does either. Most of the major players have taken a position overtly opposed to GAK (whilst leaving themselves some wriggle room, should the heat get too severe). What is netscape's position? --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: cypherpunks at ietf
by James A. Donald 17 Dec '03

17 Dec '03

> OUR CURRENT PROBLEM IS THAT THE AVERAGE CONSUMER CAN NOT COMPLETE AN ACCURATE > SEARCH ON THE WEB. > > [...] > > AT THIS POINT SO MANY CYBERPUNKS HAVE EMBEDDED SO MUCH GARBAGE ON THE WEB, > THAT YOU CAN NOT COMPLETE AN ACCURATE SEARCH. Gee: Someone who has not learnt to use the caps key on his computer cannot do accurate searches, so will everyone else please get off the net. > > [...] > > BUT MORE IMPORTANT, WE NEED TO CLEANUP THE TRASH THAT THE CYBER-PUNKS ARE > PLACING ON THE WEB. Pleasant comic relief. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: The future will be easy to use
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 15:30 11/28/95 -0500, Carl Ellison wrote: >BTW -- PGP currently lacks a way for me to note, when I sign a key, how it >is that I trust that key (by personal meeting, by attribution, by message >association, ...). A signed attribute record would let me record that >information for myself as well as for others. There is more to this problem than how it is that I trust the key. There is also what I trust it for. I just added a key to my key ring that I will use for sending confidental data to a client site. I trust that no one can access the secret key who is not also inside their firewall. However, the key is on a multi-user system, so I do not trust that it is accessable to only one person. Since the data I intend to send will be publicly available inside the firewall, I don't have to trust more than the firewall. It is hard to see how to record the information about how much I trust the receipent's systems security. Bill ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

2 1

Re: key for Alice as promised (not)
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Wed, 29 Nov 1995, Adam Shostack wrote: > > PGP is really not the issue. The issue is more my security and the > > environment that I use PGP in. I don't have a trusted machine to run PGP > > on. Anyone who wants to can come up to machine and copy my secret keyring > > or they can even watch me typing my password in. > > Threat, please?? Do people often stand over your shoulder as > you type? Yes. > Enter your office, Yep, especially my night cleaning staff. > point guns at you, Not recently ... I'd co-operate fully in that situation, though. > and take a backup of your entire computer? You mean like the on-site backups that I have in the filing cabinet beside me, or the off-site backups that aren't here (in case of fire, or such) nd are completely outside my control? > Have you considered putting the secret keyring > on a floppy and locking it in your desk/safe when you're not actually > in the office? (Or home..) Yep, I've considerred it. It's still not all that helpful. Cleaning staff has plenty of time when I'm not around to deal with that. > > So, I don't fool myself, and I don't use PGP, except for things like > > exchanging a one-time pad with someone when I've already sent the message > > out across another delivery mechanism, like on a floppy delivered my > > courier. > > I don't follow. You're claiming that PGP is good enough to > transfer OTPads, but not good enough to sign pseudononymous messages? Sure. Two different situations. If I take a message or a data tape and encrypt it with a one time pad. And then I send the message out to someone via Greyhound or DHL. And once they've confirmed that they have the encrypted message safely in hand, then I'll call them and ask them to call me with their public key delivered by voice via telephone. Which I then use to encrypt the one-time-pad, using the PGP key only once. Then, I'm comfortable sending it (not the message, but the pad) over the Internet encrypted with PGP. And I think at that point, I have Pretty Good Privacy. > Adam > > -- > "It is seldom that liberty of any kind is lost all at once." Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

Re: key for Alice as promised (not) (fwd)
by Adam Shostack 17 Dec '03

17 Dec '03

>On Wed, 29 Nov 1995, Adam Shostack wrote: > >> > PGP is really not the issue. The issue is more my security and the >> > environment that I use PGP in. I don't have a trusted machine to run PGP >> Threat, please?? Do people often stand over your shoulder as >> you type? > >Yes. And you can't ask them to leave, as you send anonymous messages? Or does your whole office know your one of those who post to cypherpunks as Alice d' nonymouys? >> Have you considered putting the secret keyring >> on a floppy and locking it in your desk/safe when you're not actually >> in the office? (Or home..) > >Yep, I've considerred it. It's still not all that helpful. Cleaning >staff has plenty of time when I'm not around to deal with that. Of course, if the cleaning staff cut your safe open, you have a good indication of that in the morning. Not that you've demonstrated that the level of effort to do all of this at all equates to what is gained, namely, the ability to impersonate you. Which everyone in the world has today. >> > So, I don't fool myself, and I don't use PGP, except for things like >> > exchanging a one-time pad with someone when I've already sent the message >> > out across another delivery mechanism, like on a floppy delivered my >> > courier. >> >> I don't follow. You're claiming that PGP is good enough to >> transfer OTPads, but not good enough to sign pseudononymous messages? > >Sure. Two different situations. [...] >And once they've confirmed that they have the encrypted message safely in >hand, then I'll call them and ask them to call me with their public key >delivered by voice via telephone. >Which I then use to encrypt the one-time-pad, using the PGP key only once. > >Then, I'm comfortable sending it (not the message, but the pad) over the >Internet encrypted with PGP. And I think at that point, I have Pretty >Good Privacy. Of course, then your message only has 128 bits of security, because the Greyhound or DHL employee could be easily comprimised, as could the message in their office. So you encrypt the pad with IDEA, getting you IDEA level security, and think you're working with one time pads?? I'm flabbergasted.

1 0

Re: ecash lottery (Was: ecash casino)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:20 AM 11/30/95, Ian Goldberg wrote: >[Disclaimer: The following post is a gedanken experiment. It should not > be interpreted as condoning or encouraging anyone to break any > laws, no matter how stupid the laws are.] I, on the other hand, have no compunctions about "condoning or encouraging" various kinds of actions. When condoning and encouraging becomes criminal, I hope I'll be gone. (Wiseacres will cite hypos in which encouraging a crime, such as a rape, makes the encouragers culpable. A far cry from condoning and encouraging tax evasion, gambling, etc.) On to Ian's proposal: ... >Now: there's likely no Web-of-Trust to the various PGP keys involved, >so the lottery's Reputation will have to be built up. A good way to >do this is to have smaller prizes being won fairly often (e.g. by matching >the last digit/few bits), so that it's obvious the lottery is not just >collecting money without awarding prizes. Have to be _very_ careful here. A variety of scams can be developed which show lots of "small" winners, but which fail to show any large winners. The lottery operators can make a lot of extra bucks by simply not paying off the large winnings, in various ways. More robust protocols may be possible. In particular, I recall that Eric Hughes was working on something he called "encrypted open books." While banking was the obvious domain, it seems plausible that the same methodologies could be adapted for lotteries (some isomorphisms between accounts/balances and tickets/winnings?). I don't follow Ian's proposal in enough detail to comment on it, but thought I should point out the scams over nonpayment of winnings and the "encrypted open books" notions (from sometime in '93, as I recall). Personally, I have long had great _hopes_ for using crypto for non-sanctioned gambling, but I'm pretty skeptical that many people will do it. For one thing, anyone knowledgeable enough to be comfortable with the crytography knows that gambling when a house cut exists is a lose. (And gambling with no house cut is, at best, a wash.) --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1