December 2003 - cypherpunks-legacy

p-NEW digital signatures
by Kent Briggs 17 Dec '03

17 Dec '03

I've been experimenting with discrete logarithm digital signatures. Schneier describes a scheme call p-NEW on page 498 of "AP" (2nd ed). It has the advantage of not requiring an inverse calculation via the extended Euclid algorithm. The signature is shown as: r=mg^(-k) mod p s=k-r'x mod q The verification equation is m=(g^s)(y^r')r mod p r'=r mod q. If p is a strong prime then q=p-1 and r'=r. The public key is y=g^x mod p. x is the private key. k is a random number less than q. m is the message being signed. I'm confused about the negative k value in the r equation. This would lead to 1/g^k which is a fractional number. It seems the equation should be: r=mg^(q-k) mod p Or, I can rearrange both equations like this: r=mg^k mod p s=-k-rx mod p To avoid using negative numbers in the mod function, I can calc s as: s=q-((k+rx) mod q) I tried this with some small integers and the numbers work out. The s calculation will be quick since there is no exponentiation. Most of the time spent in signing a message will be the r calculation. However, the the verification equation [m=(g^s)(y^r)r mod p] has two exponentiation calculations and will take more time. Since a message is only signed once but could be verified many times, I could precompute rg^s during the signing: r=mg^k mod p s=q-((k+rx) mod q) z=rg^s mod p s is discarded and the signature is r and z. The verification is: m=zy^r mod p This slows down the signing but speeds up the verification. Here's the $64K question: Does this compromise the signature's security? Kent Briggs kbriggs(a)execpc.com CIS: 72124,3234

2 1

Re: Netscape to patch shareware version
by Marshall Clow 17 Dec '03

17 Dec '03

>| Meanwhile, in an as yet unannouced move, the company said it would place >| its commercial browser online for free downloading. [..] THe commercial >| version, sold only in the U.S. contains an unbreakable 128-bit >| encryption scheme. > >Hurray! We did it! We did it! :-) Indeed. Congratulations to Damien, Adam, and all the other people who contributed cycles to the "Cypherpunks Key Breaking Ring". > >| Netscape said it received word last week that the State Department had >| cleared that version for release on the Net, but only within the U.S., >| owing to current export laws banning the export of encryption schemes >| stronger than 40 bits. THe company could provide no details by press >| time on how it would ensure that the 128-bit version wouldn't leak beyond >| U.S. borders. > I suspect Netscape will do the minimum so that they will not be held liable. >Ok, any bet on how long it will take? > Less than 3 hours. >| The cypherpunks forced a situation where Net users now have better >| encryption available to them. I'd say this is a big win. > >The power of the Net is actually quite astonishing at times. The >plotting in Ender's Game isn't all that unrealistic after all. (Oh, >well, ruler of the world is a bit of still. ;-)) > Demosthenes

1 0

fcpunx subscribe
by Wendy Fu 17 Dec '03

17 Dec '03

endWendy Fu, Network Manager St. John's University School of Law 8000 Utopia Parkway, Jamaica, NY 11439 E-Mail Address: wfu(a)sjulaw.stjohns.edu Phone: (718)990-1666

2 1

Re: GAK/weak crypto rationale?
by John Young 17 Dec '03

17 Dec '03

Responding to msg by Andrew.Spring(a)ping.be (Andrew Spring) on Tue, 12 Sep 7:3 PM >A more cautious conclusion would be would be that the >importance (to the LEA's) of the busts made with >crypto is much larger than the numbers suggest. You >could interpret that a lot of ways: I suspect that >high-profile career-enhancing cases are highly >dependent on wiretaps. In response to an audience question about wiretaps and crypto, Mr. Michael Nelson of the White House said at the NIST GAK meeting (paraphrased): We are not concerned with bad people using crypto among themselves, we can handle that. We are more concerned with their using crypto to communicate with regular folks, to make legitimate arrangements -- finance, supplies, travel, and so on -- for their nefarious deeds. It's the intermix of the bad with the good that's the problem. Maybe someone else at the meeting heard this differently and will comment, but this seems to mean that the Feds can track, and maybe crack, the crypto-intercomm of "bad people" so long as it is not buried in a torrent of public crypto use. And not commingled with lawful, ECPA- protected(?), communication. Anybody want to elaborate what Mr. Nelson was implying about wiretaps and crypto?

2 1

Edited Edupage, 29 Feb 1996
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"educom(a)elanor.oit.unc.edu" 1-MAR-1996 00:53:05.93 >***************************************************************** >Edupage, 29 February 1996. Edupage, a summary of news items on information >technology, is provided three times each week as a service by Educom, >a Washington, D.C.-based consortium of leading colleges and universities >seeking to transform education through the use of information technology. >***************************************************************** The below has some relevance for the discussion on firewalls vs encryption. It seems to give evidence for the needed solution being either firewalls and encryption (external _and_ internal) or encryption alone. >NO SAFETY ON THE NET >A recent survey of businesses found nearly one in four are staying away from >the Internet because they worry about electronic security breaches. For >instance, Merrill Lynch refuses to use the Net for any "value-bearing" >business and has doubts about allowing customers to link up via the >Internet. Meanwhile, if your company uses an Intranet, you're not immune to >security problems -- experts estimate that as much as 80% of all security >losses are committed by company insiders. The technical staff manager at >Bell Labs notes: "Our firewall keeps the bad guys out. But you can't say >there aren't bad guys inside the company." (Information Week 19 Feb 96 p34) The below is worrisome; I am willing to bet that the European governments might try to require it, and that the US might follow suit if the CDA gets tossed out (analogous to the V-chip). I'll send a further message after I've analyzed the rating system in question a bit more. >SELF-PATROLLING THE WEB >The World Wide Web Consortium is pushing the Web page rating system that it >developed in cooperation with the Platform for Internet Content Selection, a >group of 22 online firms. Operators at about 20,000 Web sites have already >coded themselves using the Internet Relay System, which is similar to the >rating system for films. To rate your Web site, go to the SafeSurf site at >< http://www.safesurf.com/ > and fill out the form that helps them come up >with a rating. PICS members plan to pitch the system to European >governments in an effort to avoid continental content restrictions. >(Investor's Business Daily 28 Feb 96 A6) >Edupage is written by John Gehl (gehl(a)educom.edu) & Suzanne Douglas >(douglas(a)educom.edu) Voice: 404-371-1853, Fax: 404-371-8057. >Technical support is provided by the Office of Information Technology, >University of North Carolina at Chapel Hill. >*************************************************************** >EDUPAGE is what you've just finished reading. To subscribe to Edupage: send >a message to: listproc(a)educom.unc.edu and in the body of the message type: >subscribe edupage Thomas Alva Edison (assuming that your name is Thomas Alva >Edison; if it's not, substitute your own name). ... To cancel, send a >message to: listproc(a)educom.unc.edu and in the body of the message type: >unsubscribe edupage. (Subscription problems? Send mail to >educom(a)educom.unc.edu.)

3 2

Re: Netscape to patch shareware version
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

>| Netscape said it received word last week that the State Department had >| cleared that version for release on the Net, but only within the U.S., >| owing to current export laws banning the export of encryption schemes >| stronger than 40 bits. THe company could provide no details by press >| time on how it would ensure that the 128-bit version wouldn't leak beyond >| U.S. borders. > >Ok, any bet on how long it will take? It's already been exported. Evidently, one of those who bought the commercial version sent it to Europe as soon as it was out. I note the site removed it, however, probably because Netscape Comm. Inc. requested that they do so. Netscape generally objects to anyone else carrying their browser (.edu sites with prior permission excepted).

1 0

Re: art-stego
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

Jonathan Rochkind wrote: > So a good steganography algorithm (which I understand > exists) merely changes the values of the noise so that it > now encodes your (random) message. So there's no way to > look for "suspicious bit patterns" > You are assuming that the noise bits have the same statistical properties as cyphertext. I would be very surprised if this were the case. It takes special effort to achieve good random bit streams. Image scanners may do this by accident, but then again, maybe they don't. This uncertainty is, in my opinion, the fatal flaw in image-based steganography. The same reasoning applies to audio-based steganography. Unless the devices were specially designed to insert cryptagraphically useful bits in the output (or, as Tim May suggested, good garbage bits are inserted later), then you should not rely on the pictures or audio files to keep your messages hidden. As an alternative to trying to hide bits, I proposed not hiding them at all, but instead creating an innocent reason for passing around files that contain, in some way or another, obvious random bit streams. The first idea that came to mind was to use the random bit streams to create pretty fractal pictures. I soon realized that any function that produces pretty pictures would do the trick as long as there was a way to recover the random bit stream given only the picture and the function. Perhaps it would be possible to use random bit streams to generate cool BioMorphs (ala "The Blind Watchmaker"). If enough people start passing around pictures generated from meaningless random bit streams, then other people could use this traffic to covertly exchange pictures generated from meaningful random bit streams. > if they can manage to get a cleartext message out of it, > plausible deniability is unlikely to get you far. > You could always claim you didn't know it was there, that you just downloaded the picture out of curiosity. It might help, depending on what country you live in. Tim May wrote: > Just bear in mind that this form of steganography is > getting further away from conventional hiding, and > into "pure plausible deniability." In fact, one need > not even make a serious attempt to hide the encrypted > bits: just call the encrypted file "art" and be done with > it! > Come to think of it, if the picture files were larger than the random bit streams, people very well might send just the random bit streams. "Hey Bob, take a look at the picture this creates when you feed it to the XYZ function (coefficient values A, B, and C)." Jim_Miller(a)suite.com P.S. In case anyone is wondering, the reason there is a large delay between a post from me and a reply from me is that I'm not actually on the mailing list. I read the messages by pointing my news reading at nntp.hks.net

4 4

VOO_doo
by Adam Philipp 17 Dec '03

17 Dec '03

1 0

Do you feel lucky, punk?
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [from Cypherpunks] Those of you who are confident that the Leahy bill won't be interpreted to punish innocent people (for example, operators of encrypted anonymous remailers) who are not directly engaged in criminal activity should read the following article, that appeared as the George Will column March 10, in my local paper. Maybe it will give you a healthy dose of REALITY (remember reality, fellows?): "Taking Property from innocents doesn't fit conservative ideals" by George F. Will. In 1827, in a case concerning the forfeiture of a Spanish ship used for piracy, the U.S. Supreme Court held that the owner could lose his ship even if he was not even aware of the use of the ship for piracy: "the thing is here primarily considered as the offender, or rather the offense is attached primarily to the thing." That, and a long line of cases in that vein, is why the court last week said Tina Bennis has no right to compensation for her half-interest in the car she co-owned with her husband John and which was forfeited after he was convicted in Detroit of engaging in sexual activity with a prostitute in the car. The court was divided 5-4 in rejecting Mrs. Bennis' contention that the forfeiture violated her 14th amendment right to due process and her Fifth Amendment right not to have property take without just conpensation. Justice John Paul Stevens, joined in dissent by David H. Souter and Stephen Breyer (anthony M. Kennedy dissented separately), condemned the "blatant unfairness" of punishing an innocent person. And Justice Clarence Thomas, although concurring separately in the opinion written by Chief Justice WIlliam H. Rehnquist and joined by Sandra Day O'Connor, Antonin Scalia, Ruth Bader Ginsburg and Thomas, said that what was done to Mrs. Bennis by Michigan law was "intensely undesireable." Because many governments are increasingly agressive in their use of forfeiture as punishment for prostitution, drug, and other offenses, this decision, although supported by the most conservative justices, should trouble conservatives: it involves conflicts between three things they value- deference to states' legislative judgments, fidelity to precedent and respect for property rights. Bennis made his mistake in 1988 in an 11-year old Pontiac he and his wife had recently purchased for $600. The trial court judge had discretion to order payment of half the sale proceeds to "the innocent co-titleholder," but commented that "there's practically nothing left" after deduction of police, prosecutorial, and court costs." Ginsburg noted that the question at issue was not whether compensating Mrs. Bennis would have been fair but whether compensation was a constitutional right. And Ginsburg's concurring opinion suggests that she would have affirmed such a right had not the car belonged as much to Mr. Bennis as to Mrs. Bennis. Although Mrs. Bennis neither consented to nor knew of the misuse of the car, Rehnquist cited the court's language in a 1926 case, that it is common "for the law to visit upon the owner of property the unpleasant consequences of the unauthorized action of one to whom he has entrusted it." That practice, the court had said five years earlier, is "too firmly fixed in the punitive and remedial jurisprudence of the country to be now displaced." Certainly the court should not casually unsettle what it has firmly fixed. Nor should the court relieve Congress of its role in correcting dubious legal practices. the chairman of the House Judiciary Committee, Rep. Henry Hyde of Illinois, has drafted the Civil Asset Forfeiture Reform Act that would, among other things, strengthen protection of innocent property owners. Still, sometimes the court has had to say, in effect, "Well, come to think about it... ." It took four years of carnage and then the 13th amendment to correct what the court did in 1857 in Dred Scott vs. Sanford. But in other cases the court has tidied up after itself. In 1896 in Plessy vs. Ferguson, the court held that "separate but equal" public facilities segregated by race were compatible with the 14th Amendment's guarantee of equal protection of the laws. Later, the court conducted a protracted retreat from that position. In 1905 in Lockner vs. New York, as in similar cases, the court held that a New York law limiting bakers to a 10-hour workday violatedd teh DUe Process clause. By 1963, Justice Hugo Black could assert that the Lochner doctrint of "substantive due process," that the court can overturn laws it considers unwise, "has long since been discarded." (Actually, it has long since been smuggled into liberal jurisprudence to support a different social policy agenda.) In his obviously uneasy confurring opinion in the court's decision about Mrs. Bennis' car, Thomas says the case "is ultimately a reminder that the Federal Constitution does not prohibit everything that is intensely undesireable." Quite so. So it is time for the political branches of state governments and the federal government to act on the clear signals from Thomas and others concerning the need to protect innocent persons who cannot reasonably be considered culpably negligent concerning the misuse of their property. [end of article] To those suckers who say that they genuinely believe that the operator of an anonymous encrypted remailer will not be subject to criminal or civil penalties for what ends up being the misuse of their system, I would like to re-state a quote from the article above: "Although Mrs. Bennis neither consented to nor knew of the misuse of the car, Rehnquist cited the court's language in a 1926 case, that it is common "for the law to visit upon the owner of property the unpleasant consequences of the unauthorized action of one to whom he has entrusted it." That practice, the court had said five years earlier, is "too firmly fixed in the punitive and remedial jurisprudence of the country to be now displaced." " Does this sound familiar? Doesn't it hit just a bit too close to home? I argue that a person who runs an anonymous encrypted remailer could be clearly claimed to be "entrusting" that "property" to someone else, under the meaning of the above paragraph. At least, that is the position the prosecutors could surely take, especially given this Supreme Court decision. In fact, I would argue that a remailer operator will actually be considered MORE responsible, legally, than Mrs. Bennis: The abuser of _her_ property, Mr. Bennis, was in fact the co-owner of that property, and it is doubtful that Mrs. Bennis COULD have denied to Mr. Bennis, practically or legally, the opportunity to abuse that property. On the other hand, the operator of an anonymous encrypted remailer is, in effect, "giving out the keys" to that remailer (giving authorization to use it) to anyone at any time, with no checking or other specific authorization, to people who have no legal ownership in that remailer. In fact, the system is (at least arguably) helping to cover up after those abuses. If those self-selected people commit crimes using it, who else is responsible? Question: If the Supreme Court is willing to take away Mrs. Bennis' interest in that car under THOSE circumstances, do you really believe that it WOULD REFUSE to allow a prosecutor to decide that the operator of an abused remailer should be prosecuted (or his property taken by government in a forfeiture action)? Frankly, I don't know how rude I must be before reality sinks in to your brains: If you people continue to insist that this Leahy bill won't be abused, you truly do need to wake up before you end up screwing the rest of us "out here." Your foolish endorsements of this Leahy bill play directly into the hands of those who want to ban the EFFECTIVE use of encryption. Go ahead, endorse the bill CONDITIONALLY on the removal of that offending section. But you should make it quite clear that keeping that section should kill the entire bill. You have been warned. Is it any coincidence that we first heard about this Leahy bill much less than a week after the decision that Mr. Will speaks of? Is it possible Leahy was waiting to see if the SC would allow him to misuse the wording of that proposed law? Having gotten the go-ahead, out pops the new bill. As if on cue. "Do you feel lucky? Well, do you, PUNK?" If there are any of you who have doubts as to the need for the "Assassination Politics" idea, I'd say this S.C. decision should clear them up but fast. Anybody out there believe that the decision would have gone this way if we'd all been able to chip in and fix the problem in a few days? Jim Bell jimbell(a)pacifier.com p.s. especially to Tim May: If the issue wasn't so serious, and their blind support of this bill so obviously misguided, I wouldn't be rhetorically "slapping them in the face" as I'm trying to do here. Klaatu Burada Nikto -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMUONFPqHVDBboB2dAQGIMQP/cQ4f7wUm3swBrXFKDgQ+QrzfrKWooDwu 0DVMIS3gRr5AOkXANjXKQmdV0U6Ug2Rf/Wtkh32S8lR+wpizvn9kg7nVhrDLHvKZ pClRAgTFolI5FDctU6J934+XxD5xt83nw15M4yenZAtPDN8OoakMft2cDKUeqEis apuLR5tzyTA= =aPdf -----END PGP SIGNATURE-----

2 1

Re: IPG - newest release of the ABC Encryption Algorithms (fwd)
by John Pettitt 17 Dec '03

17 Dec '03

>IPG Sales wrote: >> Obviously, you meet our requirements for the release of the IPG ABC >> Encryption algorithms. We need no further information from you. though we >> would appreciate your telephone num and snail mail address. > At 08:01 AM 3/19/96 -0600, Mike McNally wrote in reply: >On the other hand, the "algorithm" as presented is so hopelessly >obfuscated by the strange terminology and loose descriptions used >to present it that there's no way I (or anybody else) could seriously >evaluate it. Either publish an algorithm in some accepted format >(a real C program, or even Knuth notation) or cut back your expectations >for public analysis. > IMPORTANT: I have nothing to do with IPG and I don't endorse their stuff, I got the same mail and produced the code below to help me figure out what they are doing. John Here is my take on a C version of their code - note that a[] b[] c[] and the initial d are filled in from the 'one time pad'. The size of a,b,c is not specified it could be 8 16 or 32 bits from the text ... However the initial values of a,b & c are set using 8 bits of the 'random' key. int a[64] /* Random & 0x3500 */ int b[64] /* Randomly selected primes */ int c[64] /* randomly selected primes*/ char d; /* random start value */ int i; /* the arrays b,c are filled in from tables of smallish primes supplied by IPG using 'random' numbers supplied by IPG to select the primes (and the order of same). since all the values are > 8 bits I've assumed a,b,c = int. a[] is filled with 13568 + an 8 bit 'random' number. (13568 = 0x3500 which gets ANDed with the seed value) */ while(1) { for(i=0; i<64;i++) { a[i] = (a[i] + b[i]) % c[i]; d = (d+a[i]) & 0xFF; /* output d as next byte in stream */ /* XOR with plaintext */ } } I would not trust it without spending more time than I have right now to look at it. It arrived with the following text: >The algorithms detailed below are copyrighted 1995 and 1996 by Internet >Privacy Guaranteed, Seymour, TX. All rights are reserved. You may not >provide them to any other party, or parties, by any means or >any media, without the expressed written permission of Internet Privacy >Guaranteed. I have not agreed to this, further I strongly suggest IPG add studying trade secret and copyright law to their todo list. I do not endorse the above code or algorithm and make no comment on it's strength or otherwise.

6 5