December 2003 - cypherpunks-legacy

Cypherpunks of the world unite!
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Michael Wilson <0005514706(a)mcimail.com>: > There is a good reason why revolutionaries in very poor nations tend to > espouse socialist or communist rhetoric--those are political systems that can > raise the quality of life considerably and immediately, I see governments as representing the collective will of society, responsible for only those things that are best achieved through everyone's cooperation. It is now fashionable to talk about the Asian way -- subjugating freedom to prosperity. This is of course bunkum, freedom is an ideal and is universal. The way to get to that may differ from society to society, particularly, as Michael says, in poor nations. It isn't necessary to have a strong state to survive; India, with a similar standard of living in 1950, has been democratic with more or less regular, free and fair elections. Contrary to popular perception, India has been no more 'socialist' than many European countries such as France, with stockmarkets and large state-owned enterprises. It is naturally more difficult to control crime or rising population here than in China, where petty thieves and corrupt officials are frequently executed. Freedom is a right equally applicable everywhere, whatever the political, social or economic situation. Any technology that promotes it is important for the whole world. Cypherpunks of the world unite! You have nothing to lose but your escrowed keychains! ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

2 1

The usefulness of PGP pass phrases
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

tcmay(a)netcom.com (Timothy C. May): > > after you have entered the pass phrase, the secret key is available within > > your machine, and could be stolen, and if your OS leaves pagefiles etc > > arounnd, might even be taken after you shut down PGP. > > Or am I missing something? Thanks, Andy > > I haven't seen a formal analysis of the strength of PGP if the secret > key is known but the passphrase is still secure, but from conventional > crypto we would assume that the search space would be greatly reduced. The secret key is _encrypted_ with the passphrase. Strength of PGP with a known secret keyFILE, not key, and unknown passphrase, is the strength of the cipher used to encrypt the secret key with. In this case, the strength of IDEA. Of course, your pass phrase is as susceptible to dictionary attack as your UNIX password, and it would be easier to decrypt a message by decrypting through such attacks or brute force your keyfile, than to factor large numbers to get at your session key. > You obviously can't do with just the paIn short, these are reasons to keep your secret key secret. Your > passphrase alone may be insufficient (else why not just dispense with > the secret key and just have a passphrase?). RSA would have a tough time using a 11 char English phrase as an exponent ;-) To quote from the PGP manual: PGP also asks for a "pass phrase" to protect your secret key in case it falls into the wrong hands. Nobody can use your secret key file without this pass phrase. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ps. as Tim correctly said, Jains don't like killing living things. They are Jains, not Jainists (followers of some hypothetical Mr. Jain?); the word comes from the Sanskrit for 'to overcome'. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

IS IT POSSIBLE?
by bmorris＠netcom.com 17 Dec '03

17 Dec '03

To: cypherpunks(a)toad.com I've heard rumors through the years that CIA/NSA/whoever can aim a parabolic antenna at your window, read the electronic pulses surrounding your computer, and thusly determine what you are typing. Is there any truth to this? * RM 1.4 B0037 *

3 2

Re: ANI numbers
by ghio＠cmu.edu 17 Dec '03

17 Dec '03

joshua geller <joshua(a)cae.retix.com> wrote: > it doesn't work from LA and I do have AT&T long distance. It works for me and I live in LA (San Pedro, actually). It also worked when I was in Pittsburgh. The number is 1073214049889664 But if you live in the Los Angeles area, you can use PacBell's numbers 1223 or 2112345, or if you have GTE, 114

3 2

PASSWORD DIFFICULTIE
by bmorris＠netcom.com 17 Dec '03

17 Dec '03

To: cypherpunks(a)toad.com KK> 22 words, a good start. But all will appear in a short dictionary KK> list, 4 gramatical sentences, sentences with related meaning. Not so But will a dictionary attack work when the passphrase is multiple words? Because then it would have to try all the words in the dictionary grouped with other worde, and the permutations thus become huge. i.e. "spinachwalrusgazebo" is three words, and to me, would seem immune from a dictionary attack, because the attack only uses single words. Is this right? * RM 1.4 B0037 *

2 1

Clipper = Bobbitized Crypto
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

> I'm not so kind as others on this list. > I think people should live consistent with their philosophy and > what they advocate. Many times arguments are useless and only > experience serves to convince. I wouldn't try to convert another > from their faith just because it would do me good. As long as > it's possible to find alternate methods of doing the same thing > (in this case achieving privacy), I wouldn't try too hard to save > Liberals from themselves. I think they deserve to use Clipper. Consistency with one's own philosophy, huh? I dont see much of that in liberal politics, although maybe to be fair it should be applied to politics in general. Let me cite some examples: 1.) Anti-gun politicians who would regulate away the average citizen's right to self-defense with firearms, but only after they are assured of Secret Service protection, or private bodyguards for themselves. IOW, a level of personal security not affordable to their constituency. Clipper is the personal security equivalent of having to call 911 when threatened and patiently wait for the police to show up to protect you, vs. having a small army of Secret Service agents on call 24 hours a day to spring into action to defend you. 2.) Politicians who accept campaign contributions from teachers' unions, the National Education Association, etc., who vote down any legislation designed to give the average citizen a choice in their child's education, other than the entrenched public school monopoly. Yet, most of these same people put their own kids in PRIVATE schools, financed from tax dollars by the salaries that we pay them. 3.) Politicians who already employ strong crypto, unavailable to the general public, who want to limit the rest of us to "Clipper". All three points apply directly to Clinton, but not exclusively to him, of course. You know, there's just something about the name "Clipper" that conjures up pictures of Lorena Bobbitt... Maybe that's what Clipper really is ... Bobbitized crypto... <g> Anyway, back to your point, the average "liberal on the street" may indeed be stuck with Clipper. And as long as Washington DC is dominated by a single party with a liberal bent, maybe they can convince the rest of their "fellow travellers" that "Big Brother loves you and has a wonderful plan for your life", and thus to accept Clipper and its host of problems. But let liberals lose control of this country, and then watch them change their tune, when the Big Brother technology they put in place is now in the hands of "the other side". Does anyone remember 20+ years ago when the roles were reversed? It was the liberals who were protesting wiretaps, etc. by the Nixon administration? Putting a liberal in the White House somehow "blesses" these same things?

1 0

PGPKey for vox.hacktic.nl
by usura＠vox.hacktic.nl 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- This is a 1000 bits PGP key for the remailers at vox.hacktic.nl, it will be valid for the month July. The 512 bits PGP will remain valid for "general" use, the 1000 bits KEY will be changed every month. - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 for VoX Labz. mQCpAi4VnJsAAAED6J6slxXd/i/gckEHHykILgG9MnItD4pTnI2qDbN7JS7/RTTQ CBBzX1OBRepf8L58UuNaLSpwU1wAqgsyxdhtnvHJKTDGwDN6eRthpkPXigmIy1/H uvHTci9snnOvINjWMii44Osrc3g3SNAg481bi8PQP/8uHU6bRukx7VRlAQCAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAbQtVm9YIFJlbWFpbGluZyBTZXJ2 aWNlIDxyZW1haWxAdm94LmhhY2t0aWMubmw+tDBbS0VZIHZhbGlkIHRpbGwgMTk5 NC0zMS0wNyAyMy41OS41OSBHTVQgKyAwMjowMF0= =yb/k - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6 for VoX Labz. iQCVAgUBLhWk2lnfdBSNVpE9AQHC4AP/WdhPEsrEG9dErRyDlJy+Pfgvwf1bD9wC Iv/33qJAcydeNYxfHn7ikW9NdZYFiyFwrHXGW5Q0+tpxtbl9aiIqWF7vFqntRodP hkFyEua3+tI0bd/fgBT5YHbyFJOdol+52aRgJgy58CUjTFFA4qASS1GbdMvSzLqt iQ5O4POCd2w= =wcCa -----END PGP SIGNATURE----- -- Exit! Stage Left. Alex de Joode <usura(a)vox.hacktic.nl>

1 0

MacPGP Bug
by fhalper＠pilot.njin.net 17 Dec '03

17 Dec '03

I friend of mine has shown me a bug in MacPGP that allows someone to come along after you have decrypted a message, check "Recycle Passwords" in the options menu and proceed to decrypt any encrypted messages you have. Even if you didn't have "Recycle passwords" selected before you decrypted the message, PGP will recycle the passwords. I assume it exists in all versions. Reuben Halper P.S. I am going away so I have to unsubscribe from the list for a month or so. Please send any comments to Reuben8878(a)aol.com

1 0

Passwords, passphrases, etc.
by Michael Wilson 17 Dec '03

17 Dec '03

Cypherpunks: The evolution of the discussion here regarding passwords or passphrases is a telling indicator, and one which people here should think about, because you are reinventing the NSA. You start with a desire for privacy/secrecy, and so you create a package as a functional cryptosystem. The requirements of the cryptosystem, however, makes memorization of the cryptographic key non-trivial (and nobody here suggests offline storage, as the NSA primarily uses); this causes you to use an access control mechanism that protects the key on a local basis. This then makes you think about armoured operating systems, physical security of the site, biometric security, signals emission, coersion methods, etc. It is a capsule history of the enemy, and I hope it helps you understand what created them; the major difference was that they had an available budget and potent adversaries. Imagine the cypherpunks sitting around and attacking their own system and others (Clipper, for instance), getting paid to write code, build hardware, whatever necessary to attack/defend, and with operational support and infrastructure. Quite educational, isn't it? Another brief observation you might want to think about in regards to the implications; the data in the public domain for cryptanalysis tends to be based primarily in the English language (frequency tables, dictionary attacks, etc.). Isn't it striking that so little of similar data has leaked out for what one can assume were the real targets--Russian, Arabic, German, etc.? Seems to be quite an effort to attack English-based systems. There also seems to be an unusual silence on what one would consider to be important cryptanalysis data--if you were NSA, wouldn't you be certain to suppress data that helped your adversary? Just food for thought. Is this a true emphasis or a Potemkin village? One benefit of being multilingual; all access codes that I need to remember are obscure phrases in little known dialects. I imagine they would look like gibberish to the uninitiated. Michael Wilson Managing Director, The Nemesis Group [I hope that the record of purchases made through the Maryland Procurement group are making their way from systems such as Mead Data and into private systems for analysis; warning, access of such data is expensive.]

3 2

Re: Password Difficulties
by kentborg＠world.std.com 17 Dec '03

17 Dec '03

ben(a)Tux.Music.ASU.Edu and joshua(a)cae.retix.com both suggest ways to choose passwords/phrases--things no normal person will do. What do we do about a population which thinks a 4-digit PIN is secure? If people use their current ATM PINs--and a lot of computer users *do* when they are allowed--there will be problems: if we want privacy we had better figure out how to give everyone privacy. Part of my original post was cribbing from a paper I once read on the security of crypt on Unix machines. It talked of multiple applications of crypt to slow down brute-force password cracking. Should things like PGP use this technique in protecting the secret key? Does a million encryptions equal 10-bits added to the key? (Assuming the million encryptions cannot be composed into a single equivalent encryption.) -kb -- Kent Borg +1 (617) 776-6899 kentborg(a)world.std.com kentborg(a)aol.com Proud to claim 31:15 hours of TV viewing so far in 1994!

5 4