December 2003 - cypherpunks-legacy

This is for YOU...
by tony266＠vabeach.email.net 17 Dec '03

17 Dec '03

Yvette... Didn't LL Cool J make a song about you..."Dear yvette"...

1 0

coding and nnet's
by Atp3000＠aol.com 17 Dec '03

17 Dec '03

cypherpunks! I just resently got interested in coding and cryptography, and I was wondering if you could suggest 3 or 4 papers that adresses the aplication of neural networks in cryptography. Thank's I really appreciate your time and consideration! Atp3000

3 2

Re: Java insecurity - long - argumentative - you are warned.
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Tue, 7 Nov 1995, Dietrich J. Kappe wrote: > >>> While all this checking appears excruciatingly detailed, by the time > >>> the byte code verifier has done its work, the Java interpreter can > >>> proceed knowing that the code will run securely. Knowing these > >>> properties makes the Java interpreter much faster, because it doesn't > >>> have to check anything. > > > >Yikes!! I'll leave this for someone else to address. This sounds to me > >like a variation on virus scanning. I think that there are far more > >reputable virus experts than I who can comment and expand on *flaws* with > >that approach. > > This "checking," as any comp-sci undergrad will tell you, amounts to solving > the halting problem for the java interpreter. While this is possible for a > finite state automata like the java interpreter (made more difficult by the > fact that it can use the "net" for additional state), it is not even > remotely feasable. OK, so by saying that it is not "even remotely feasable", you're saying that any comp-sci undergraduate will say that it can't be done? That is what "not even remotely feasable" means, doesn't it?? I mean, even if Marketing wants this problem solved, that won't be enough? > If you can write a checker that works in a reasonable amount of time, I'll > write a turing machine simulator that'll do something nasty if the input > machine halts. Then we'll split the fame and fortune for solving the 5 state > Busy Beaver problem. Deal? I'm sorry, I only work for T-shirt and mug contests. <grin> That fifteen minutes of fame thingy, just isn't my cup of tea. > Dietrich Kappe | Red Planet http://www.redweb.com > Red Planet, LLC| "Chess Space" | "MS Access Products" | PGP Public Key > 1-800-RED 0 WEB| /chess | /cobre | /goedel/key.txt > Web Publishing | Key fingerprint: 8C2983E66AB723F9 A014A0417D268B84 Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

SPAM:E-CA$H Conference SF 11/16-17
by Kawika Daguio 17 Dec '03

17 Dec '03

COMMERCIAL - SPAM ALERT - I will be speaking at a conference on Electronic Money that might interest some of you sitting on some extra rEeal Money who also suffer from the burning desire to find out what ideas and technology other folks are flogging on the talk-circuit. The brochure is too long to type in but some excerpts follow: 10 key questions to be answered at this critical industry event: 10. What are the biggest avenues to entry into the world of electronic commerce? 9. Who will be the biggest users of electronic money? 8. Who should be allowed to issue E-cash? 7. How will debit and checking fit in with the electronic money future? 6. How do you balance privacy, security, and efficiency in E-cash systems? 5. How can electronic commerce be used for a business advantage? 4. How will the government regulate E-cash? 3. How will electronic payment systems protect against fraud? 2. What infrastructure is needed to provide security on open networks? 1. What are the leading technologies that will be used for E-cash? Speakers: Ernest Brickell Bankers Trust Electronic Commerce Richard K. Crone Center for Electronic Banking, KPMG Peat Marwick ME John Doggett Bank of Boston Peter Gemmel Sandia National Laboratories Gail Grant Open Market Edward Hogan MasterCard International Randy Kahn First Interstate of California Michael Killen Killen and Associates Steve Kimmey Tandem Computers Paul Lambert Barnett Banks Ron Laurie McCutchen, Doyle, Brown and Enersen Scott Loftesness First Data Corporation Greg McKenzie Canadian Imperial Bank of Commerce B. Clifford Neuman University of Southern California Deborah Owen Arent Fox Kinter Plotkin and Kahn Daniel Schutzer Citibank Financial Services Technology Consortium Bill Washburn Mecklermedia Magdalena Yesil CyberCash Sponsor: IBC USA Conferences Date: November 16 - 17 Venue: Pan Pacific Hotel 500 Post Street San Francisco EMAIL: questions or registrations skeyles(a)ibcusa.com Phone: 508.481.6400 ext 282 (Sherry)

1 0

Re: coding and nnet's
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:17 PM 11/10/95 -0500, Atp3000(a)aol.com wrote: >I just resently got interested in coding and cryptography, and I was >wondering if you could suggest 3 or 4 papers that adresses the aplication of >neural networks in cryptography. Schneier's 2nd edition says "Neural nets aren't terribly useful for cryptography, primarily because of the shape of the solution space. Neural nets work best for problems that have a continuity of solutions, some better than others. This allows a neural net to learn, proposing better and better solutions as it does. Breaking an algorithm provides for very little in the way of learning opportunities: You either recover the key or you don't. (At least this is true if the algorithm is any good.) Neural nets work well in structured environments when there is something to learn, but not in the high-entropy, seemingly random world of cryptography." And he doesn't give any references. That's been my opinion of the issue as well; I looked into it a bit when I was doing a project with the neural net folks back at Bell Labs, partly because neural net chips typically have lots and lots of parallel bit-sized horsepower. Unfortunately, the horsepower isn't arranged in ways that are very useful for crypto; adding together a large bunch of short chunks of data (maybe using floating point addition) and thresholding the sum isn't the right thing to do with highly discontinuous functions. You could take a similar chip design and connect the pieces together differently to make a brute-force searcher, i.e. take a gate array and wire it to do crypto-like calculations, but the neural net stuff doesn't do that very efficiently. #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

1 0

Re: Lotus Notes RSA Implementation Question
by eli＠GS160.SP.CS.CMU.EDU 17 Dec '03

17 Dec '03

In article <+cmu.andrew.internet.cypherpunks+kkcsTXG00UfAE0ynIq(a)andrew.cmu.edu> Charlie Kaufman writes: >Notes V3 (the one currently deployed) uses 512 bit RSA keys in both >the USA and exportable versions. 512-bit RSA is exportable? I'm surprised. It would be interesting to CJR a known-secure binary for 512-bit RSA, attempting a little differential cryptanalysis on the NSA's practices. A fair test would require that you have the political clout of Lotus/IBM, though. -- Eli Brandt eli+(a)cs.cmu.edu

1 0

Re: Photuris Primality verification needed
by Bill Stewart 17 Dec '03

17 Dec '03

At 07:47 PM 11/8/95 -0800, you wrote: >>Including the provision for the 512 bit prime is *HARMFUL* and >>*DANGEROUS*. Export control is not really an issue here, because if >>companies in the United States cannot provide secure networking, >>there are other companies in the world that can. > >You've convinced me. I remove my proposal to include a recommended 512-bit >modulus. The smallest standard modulus will remain 1024-bits. If speed is really a concern, you could do a 640 or 768 bit modulus ("Hey, back when we wrote that, everybody assumed 640 would be enough for everybody!"), or alternatively, let people use 512-bit private modulus values - they're still short, but they're not a target if everybody's got their own (which also means that popular applications shouldn't ship with a built-in 512-bit prime; if Windows 97 did that, it'd be about the same as putting it in the spec, so really short primes should probably require user-generation, which may contradict the desire to use short numbers to save time.) One question is how to conveniently let the standard offer negotiation for the modulus length and value without adding a lot of handshake steps -> WILL MODLENGTH 512PRIV 768 1024 1024ALT 2048 <- DO MODLENGTH 512PRIV -> WILL MODULUS 8758432798573409875098347509834750983745098348584395984357908347509843750984 3750983 <- 404 HEY, THAT'S NOT A STRONG PRIME! #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

2 1

Re: "Industry Group Rebuffs U.S. on Encryption"
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

At 1:14 AM 11/9/95, Bill Stewart wrote: <deletia> | The fact that Netscape is including | secure email in their Navigator next release can be a big lever pushing the | Feds toward giving up, and perhaps deserves some publicity once the | release version is out the door. Giving up on what? On doing everything within its power to keep the world beyond itself strong-cypto-free? Not likely. In only a few decades, crypto's gone from being unheard of to the object of an increasingly high-profile PR war over "domestic and international terrorists and criminals." The govt's position, however, hasn't changed substantially: it doesn't like crypto, and it never will. There will never be a time when the cops who pull you over or drop by for a visit will say, "Ma'am, if you've encrypted that, we respect the fact that you don't want anyone to see that--so we'll just be going bow. You have a nice day, now, y'hear." And there will never be no cops. The gov't may well lose this fight eventually, but a few heads are gonna get broken before either side wins. This fight is playing itself out on the level of policy now, but it's much bigger than a policy issue. And the "revolution" of Newt and his legions of weenies (I say nothing of Clinton and his legions of weenies) is bullshit: he's an empty opportunist who's riding a fractious coalition that'll make Clinton look like a libertarian if it ever gets control of the country. And right now he's cluing in to the fact that he can score some points on encryption issues: he's got his eye on the snowballing WiReD coalition, which *no one* knew existed until a few years ago.

2 1

Online ITAR and AECA; Bibliography of export control books
by John Gilmore 17 Dec '03

17 Dec '03

> > Where can one get a copy of ITAR ? Secondly , has anyone written any > > books on the subject and if so who and what? The ITAR is a regulation, not a law. You can find it via my crypto export control page at http://www.cygnus.com/~gnu/export.html under "State Department export guidance". Or at ftp://ftp.cygnus.com/pub/export/itar.in.full. It's 380 kbytes (but ignorance of it is no excuse!). That regulation is authorized by the Arms Export Control Act (AECA), a law (22 USC Sec. 2778). The law is also available in the same places. It's only 40 Kbytes. I own and can recommend several books on export controls. Layman's books on general export controls and technology policy issues: 90-26801: Finding common ground : U.S. export controls in a changed global environment / Washington, D.C. : National Academy Press, 1991. xviii, 390 p. : ill. ; 24 cm. LC CALL NUMBER: HF1414.5 .F56 1991 87-34877: Technology transfer : a policy model / Philip A. Roberts. Washington, DC : National Defense University Press, 1988. xiii, 86 p. ; 21 cm. LC CALL NUMBER: HC110.T4 R62 1988 SERIES TITLE: A National security essay DEWEY DEC: 338.973/06 dc19 93-50697: Silencing science : national security controls and scientific communication / Harold C. Relyea. Norwood, NJ : Ablex Pub., c1994. xvii, 248 p. ; 23 cm. LC CALL NUMBER: Q223 .R45 1994. SERIES TITLE: Information management, policy, and services. DEWEY DEC: 338.97306 dc20. ISBN: 156750096X; 1567500978 (pbk.) Lawyer's Tome on export controls, with detailed case citations and such: 91-37498: Root, William A. United States export controls / 3rd ed. Englewood Cliffs, NJ : Prentice Hall Law & Business, c1991- 1 v. (loose-leaf) : ill. ; 26 cm. ISBN: 0139529381 LC CALL NUMBER: KF1987 .L54 1990. DEWEY DEC: 353.0082/76 dc20 [This one is loose-leaf and gets annual updates at $80/year. I forget how much it cost originally.] By the way, if you're trying to find general references on export controls or crypto, or anything else, I recommend `telnet://locis.loc.gov' and searching the Library of Congress card catalog or the copyright records. The user interface is IBM mainframe oriented, but the information is without peer. John Gilmore

1 0

Re: coding and nnet's
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 14:17 11/10/95 -0500, Atp3000(a)aol.com wrote: >I just resently got interested in coding and cryptography, and I was >wondering if you could suggest 3 or 4 papers that adresses the aplication of >neural networks in cryptography. Perhaps neural nets could be used in an unknown plain text, brute force attack to automatically select possible decryptions for human examination. I don't know of any papers on the subject. Bill ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

2 1