December 2003 - cypherpunks-legacy

Privacy Without Tears
by Bruce A. Baugh 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Since it wouldn't do me any good to write code (I've _seen_ my code, it's not pretty), I'm writing in English instead. :-) I've started work on what I currently call Privacy Without Tears, a guide to PGP and related programs pitched specifically at a novice audience. I would appreciate comments, particularly in the fact-checking line (more on this in a moment). I'd also appreciate anyone who feels like it passing the URL I'll give in a moment on to crypto newbies and seeing if they can follow the instructions and get good results. So far, I've only written an intro and a section on PGP. Now I'm working on a section on DOS and Windows front ends. I'm only discussing software I can actually use on my own system, so explaining to me about the merits of tools for other OSes won't do any good. But if you have useful information about such, I'd be happy to link to your pages. Likewise, I'm deliberately not getting in a number of technicalities up front - only in the last section, for instance, will I explain about IDEA's role in PGP keys. This is for _novices_, the people who have as much need to protect their privacy as any of us but fewer clues. One thing I could really use is a short - paragraph-length - discussion of probable times to crack keys of various lengths. The URL (for the moment): http://www.aracnet.com/~bruce/privacy/privacy.html Thanks in advance for constructive comments! Bruce Baugh bruce(a)aracnet.com http://www.aracnet.com/~bruce -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEQAwUBMR0Phn3AXR8sjiylAQGkMgfRAcH5qowi9wG/4o2cYR0qwlNXZM92TLJJ G8Klpk//5Hd3q5PAdz6QOL3ct7QYhlpjlT/UYrJ/dhjpIxWX6jmgxM0jTDdDr1q8 qXcWwzNMz5d1V0z+95NkD7hCOV7inP5ycqFRRPtAgF4LCiT4V0GrbaTLaqKbi7G+ 1YXo6ginBOjQ8WABRtpwIgGbxmJPQmTue5SqTX6zuGhTGrounCGShYZKT8ViLqtl swtD6sG6TPCAOpAgeV8TOPnJEKdbd9ASHAFdEN63DnTHNgjUWLo2bO3VcblRHVjf 1fi+UkeEF/yYXD4nryhhA8E95GUqBdIasN2E8J214Wp4Qoo= =5fO2 -----END PGP SIGNATURE-----

2 1

No Subject
by Julian Assange 17 Dec '03

17 Dec '03

>From proff Sat Feb 10 18:09:57 1996 Subject: new zip cracking code To: cypherpunks(a)toad.com Date: Sat, 10 Feb 1996 18:09:57 +1100 (EST) X-Mailer: ELM [version 2.4 PL23] Content-Type: text Content-Length: 3806 Does anyone have any pointers to cryptanalysis papers on the Zip encryption scheme (presented below)? I've seen a few MSDOS executeables which used some sort of brute force attack, which didn't seem particularly intelligent or effective for long passwords. If anyone has some pointers, or source I'd be glad to hear of it. From what I can see of Schlafly's algorithm a bute force attack could be speed up a great deal by pre-compution and expansaion of elements of the first 3 or so rounds at the very least. Ideas anyone? Decryption ---------- The encryption used in PKZIP was generously supplied by Roger Schlafly. PKWARE is grateful to Mr. Schlafly for his expert help and advice in the field of data encryption. PKZIP encrypts the compressed data stream. Encrypted files must be decrypted before they can be extracted. Each encrypted file has an extra 12 bytes stored at the start of the data area defining the encryption header for that file. The encryption header is originally set to random values, and then itself encrypted, using 3, 32-bit keys. The key values are initialized using the supplied encryption password. After each byte is encrypted, the keys are then updated using psuedo-random number generation techniques in combination with the same CRC-32 algorithm used in PKZIP and described elsewhere in this document. The following is the basic steps required to decrypt a file: 1) Initialize the three 32-bit keys with the password. 2) Read and decrypt the 12-byte encryption header, further initializing the encryption keys. 3) Read and decrypt the compressed data stream using the encryption keys. Step 1 - Initializing the encryption keys ----------------------------------------- Key(0) <- 305419896 Key(1) <- 591751049 Key(2) <- 878082192 loop for i <- 0 to length(password)-1 update_keys(password(i)) end loop Where update_keys() is defined as: update_keys(char): Key(0) <- crc32(key(0),char) Key(1) <- Key(1) + (Key(0) & 000000ffH) Key(1) <- Key(1) * 134775813 + 1 Key(2) <- crc32(key(2),key(1) >> 24) end update_keys Where crc32(old_crc,char) is a routine that given a CRC value and a character, returns an updated CRC value after applying the CRC-32 algorithm described elsewhere in this document. Step 2 - Decrypting the encryption header ----------------------------------------- The purpose of this step is to further initialize the encryption keys, based on random data, to render a plaintext attack on the data ineffective. Read the 12-byte encryption header into Buffer, in locations Buffer(0) thru Buffer(11). loop for i <- 0 to 11 C <- buffer(i) ^ decrypt_byte() update_keys(C) buffer(i) <- C end loop Where decrypt_byte() is defined as: unsigned char decrypt_byte() local unsigned short temp temp <- Key(2) | 2 decrypt_byte <- (temp * (temp ^ 1)) >> 8 end decrypt_byte After the header is decrypted, the last two bytes in Buffer should be the high-order word of the CRC for the file being decrypted, stored in Intel low-byte/high-byte order. This can be used to test if the password supplied is correct or not. Step 3 - Decrypting the compressed data stream ---------------------------------------------- The compressed data stream can be decrypted as follows: loop until done read a charcter into C Temp <- C ^ decrypt_byte() update_keys(temp) output Temp end loop -- +----------------------------------+-----------------------------------------+ |Julian Assange | "if you think the United States has | |FAX: +61-3-9819-9066 | stood still, who built the largest | |EMAIL: proff(a)suburbia.net | shopping centre in the world?" - Nixon | +----------------------------------+-----------------------------------------+

1 0

WIT_nes
by John Young 17 Dec '03

17 Dec '03

The NYT Web site does not seem to offer today's Sunday magazine article on the federal Witness Security Program, as revealed through one family's trauma of official death and rebirth: WIT_nes (38k in 2 parts)

1 0

Re: Reasons in support of crypto-anarchy WAS Re: Why am I (fwd)
by John Young 17 Dec '03

17 Dec '03

It's hard to tell the difference between "Assasination Politics" and government-sponsored provocateurism, a well-documented practice to stigmatize anarchical and anti-authoritarian ventures. However, it takes guts and thick skin to advocate overthrow of authority, knowing that reasonable people will think you're a nut seeking celebrity martyrdom. Happily for the careers of agent-and-anarchist back-stabbing back-scratchers, there is no easy way to know for sure which is which, or even if there's any difference when the media juggernauts are provocateuring both roles for melodramatic infotainment.

1 0

Re: China
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Bill Stewart <stewarts(a)ix.netcom.com> writes: > At 01:54 PM 2/10/96 EST, you wrote: > >It's not difficult to imagine that governments will seek to regulate the > >possession of modems again. Some may recall that in the U.S. it used to be > >technically illegal to connect a modem to the phone jack without a permissio > >from AT&T. > > Actually, permission from the local phone companies, who owned the system, > I assume? (Though I don't actually remember which parts of The Phone Company > were involved in the Carterphone decision.) Nope. I used modems back when the local phone company _was AT&T. :-) --- Dr. Dimitri Vulis Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: Encryption and Backups
by Deranged Mutant 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- GNU-Zip (GZip) format has encryption defined, but (AFAIK) not yet implemented. The probably won't use the vile PKZip method... and they probably will implement an unpatented method, if ever. Mark C. Henderson wrote: > GNU tar is not the commercial backup solution many folks will be > looking for, but it works, and has nice built-in hooks which are > intended to call a compression program. > > One can also use these options to call an encryption program, as long > as the encryption program takes stdin as input, stdout as output, > encrypts by default, and decrypts when given the -d option. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMR4ebyoZzwIn1bdtAQE9gwF/cDRa2Ke0i1LoezO68du4VnaR9oQmrRdS qzAQ4mM3zNsiYVRDtDrz3yqlWwtUcse3 =DQKs -----END PGP SIGNATURE-----

1 0

Re: "Rights"
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 10:15 AM 2/10/96 -0600, Ed Carp wrote: >What happens when there *is* no remedy, when there are no other sites to >go to, when there are no employers who would refrain from violating an >employee's privacy? What then? Then start your own business, as many of the people on this list have done at one time or another. And that is why, under real capitalism, unlike socialism, there will always be employers horrified by the idea of invading their employees privacy. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

cypherpunks, digital cash, and my doctoral research
by David J. Phillips 17 Dec '03

17 Dec '03

I'm a PhD student at the Annenberg School for Communication at the University of Pennsylvania. My research is on the ways that various groups influence the development of "digital cash" systems. I'd like to work with cypherpunks for part of this research. Right now, I expect this work to include reviewing the list's archives, participating in the list and in physical meetings, and interviewing some people. If you have any thoughts on this (or feelings: revulsion, intrigue, pique perhaps), please drop me a line. Thanks. djp David J. Phillips, Annenberg School, University of Pennsylvania I'm researching cultural, economic, legal, and technical aspects of the development of digital cash systems. Let me know if you're interested.

1 0

Choices
by A. Padgett Peterson P.E. Information Security 17 Dec '03

17 Dec '03

>Well there you have it. Many of the poor clearly are not buying new sets >that have closed-captioning. Meanwhile, we all pay for it when we buy new >sets and VCRs. High added cost does not follow. We (actually my wife as a Christmas present) bought the cc box because none of our sets were new enough. I suspect that the cc decode capability could be integrated into the existing video decoder chips at no additional cost (other than what is needed to turn it on and off & that is done electronically) - suspect that if you look at trade (e.g. hotel/motel) set prices before cc was added and after that you will will see little difference (any body here know ? I have not followed this. V-chip could be similarly integrated just by having the signal cause the video to lose sync. >A hidden tax, that does not benefit those in need. Depends on the quanta. I suspect that like cc, in the long run it will have little or no effect on set prices. BTW, anyone know under what juristiction the regulation requiring cc devices was issued ? ADA ? - if so would not work for V-chip. >ObCypherpunks: A truly surprising number of people on this list are on the >one hand lambasting the government for thievery, incompetence, corruption, >and violation of their rights, while on the other hand explaining why they >think some particular intrusion is justified. Think I have been consistant - am FOR things which add to my choices and AGAINST those which reduce the choices available. In general I do not mind paying a delta for increased choice so long as it is small >People need to think about the powerful implications of strong crypto, and >decide if they are _for_ access to strong crypto by citizens, or _against_ >it. All things follow from this decision. Am FOR choices. Citizens *have* access to strong crypto. Do not believe use of crypto in this country can be regulated between two citizens or on public networks. (Note, I say *public*. On *private* networks, the owner can enforce any rules he/she/it/other likes.) Gov has right to define communications with and between itself. Gov does have the right (in fact the duty) to regulate communications between citizens and non-citizens/sites in other lands (and if you do not think communications with sites such as anon.penet.fi are inside the charter of the NSA, I have this prime Florida land - we're in the dry season now 8*). Warmly, Padgett

2 1

Re: PGP & Seamless Pegasus
by Deranged Mutant 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- JNPGP also has problems when you're encrypting to an address that isn't on the keyring. It'll barf and send the plaintext message out. A really bad flaw. It'd be nice to see it or another utility incorporate support for anonymous remailers, etc. IMO, all this will be made much easier when PGP 3.0 exists as a Windows or OS/2 DLL. PGP will probably take off beautifully then. Rob. Tripp Hardy wrote: > > Let's not celebrate just yet. While it is a great improvement, it still = > causes errors if you try to encrypt an attached file and conventional = > encryption still doesn't work here. The only one that is working all = > around for me is Private Idaho. We are moving in right direction = > though. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMR4cbCoZzwIn1bdtAQGi0wF/X9JB0tJU5H0JNf141u+F7Zf1uDNSUnXx H6STdM5urkwtWvvZCxM9v0lt03D+ro7r =CSSL -----END PGP SIGNATURE-----

1 0