December 2003 - cypherpunks-legacy

The Lotus Position
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:03 AM 1/20/96, Bill Stewart wrote: >40-unknown-bit RC4 may take a week for an ICE workstation or a herd of >net-coordinated workstations, but it would be much faster to crack on >a specialized machine actually designed for RC4. I think Eric's estimate >was $25-50K for a machine that could do it in 15 minutes, built out of >programmable gate arrays. That's not $10,000/crack, or $584, but $0.25-.50. >Would they crack all the keys they wanted for a quarter each? Sure; >at that rate it's probably cheaper to crack them than read them >(though in reality they'd feed most of them to keyword scanners.) I take it as self-evidently true that NSA would spend the relatively small amount of money to build a dedicated key cracker...probably at least several for each major cipher. "In this room, where we used to have the famed acre of Crays, now we have tenth of an acre of superfast custom key crackers." (Yes, I know the Crays are used for other things besides key cracking. In fact, their main use probably is not for crypanalysis. Also, I'm not talking about cracking ciphers that are essentially uncrackable with any amount of compute power, I'm talking about cracking specific instances of ciphers with NSA-approved key lengths.) To consider just how _cheap_ such a dedicated machine is to them, consider that in the late 50s and early 60s they built the "Harvest" machine, in conjunction with IBM and based to some extent on IBM's "Stretch" machine, as I recall. (Bamford has a bunch of stuff on it, and our own Norm Hardy worked on it for IBM in the early 60s...he gave a good talk at a Cypherpunks meeting on how big it was, how much it cost, its capabilities, etc.) The Harvest machine, and its ancillary units, such as the world's largest and fastest tractor tape drive, cost something like $100 million in today's dollars, according to Norm and others. And Harvest was still running in 1975-6, when it was finally replaced by the Cray 1. NSA also funded the early efforts that later became Control Data Corporation (CDC), and NSA was a major customer of Seymour Cray's CDC 6600, and the later 7600 (and maybe even the ill-fated Star). NSA and AEC were also the early customers for the Cray-1, of course. This gives you some feel for what kind of expenditures "the Fort" is prepared to make when it sees the need. And the black budgets of other intelligence agencies, as described in Richelson's excellent books and other books (such as "Deep Black," an unauthorized history of the National Reconnaissance Organization), can only be described as "stupefyingly large." A surveillance satellite can run upwards of $1.5 billion, so spending a tiny fraction of that to decrypt what you've sniffed out of the airwaves is a gimme. The deep black budget is estimated to be something like $25 billion a year. Recall that the Wiretap Bill _alone_ provided for up to $500 million for compliance measures. Clearly the FBI somehow view their surveillance capabilities as being worth at least this much to them, and probably a lot more. Throw in the budgets for the DEA, IRS, FinCen, FBI, BATF, and all the other agencies fighting the Four Horsemen and the citizen-units who stray outside the drawn lines, and it's clear that NSA could budget several hundred million dollars *each and every year* for breaking its "approved ciphers." Like many, I take it for granted that 40-bit RC4 can be broken for "small change." Moreover, my guess is that foreign traffic is routinely cracked if it is encrypted. After all, it's the encrypted traffic that is likeliest to be interesting. (Sure, some dumbos like Pablo Escobar speak in the clear on cellphones, but the correlation is definitely in the direction of encrypted traffic being likelier than unencrypted traffic to contain interesting stuff. This will become even more the case as more people become educated and as crypto gets built into more things...this is the intelligence and law enforcement communities' worse nightmare.) A $25,000 machine. 4 cracks per hour, 100 per day, and 36,000 per year. Running for an active life of several years (before being replaced, of course, by something several times faster/cheaper), there you have the $0.25 per crack that Bill cites above. Even at 100 times this estimate, it's cheap. (Not for random vacuuming, but for anything targetted, even casually.) And think of what just a few percent of the "Harvest" budget buys you: 100 of these machines. Several million cracks per year. And from these cracks, think of the correlations, the contact lists, and the further targetting that can be done. [Sidebar: One thing that bothers me about any of these LEAF-related schemes--and I don't know if and how the Lotus scheme checks both ends for compliance, etc.--is that they are fundamentally at odds with remailers which hide the origin. If remailers are allowed to continue to exist, schemes involving LEAF fields won't work. Unless I've forgotten how these things work in the couple of years since I last looked at Clipper et. al. in depth. So, I expect a move against remailers as part of the campaign. And with no remailers, if this could ever be enforced, the ability to make contact lists based on random decryption is frightening.] Back to their 100 machines.... My guess is that they haven't even bothered to buy this many machines, that the intelligence they get from a few tens of thousands of cracks is more than enough to point to further leads, to trigger additional HUMINT, etc. But even if the estimates are off by orders of magnitude, we know that a 40-bit RC4 can be cracked in ~hours with ~hundreds of Sun-class machines. (Personally, I think it obvious the NSA has at least speeded up this work factor by at least a factor of ten.) This is also essentially a minor consideration compared to the amount of work done in ordinary wiretaps. And in a few years, 40-bit RC4 will be even more ludicrously weak. The Lotus position is untenable. --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Web site with Updated Telecom Bill Info
by Bill Stewart 17 Dec '03

17 Dec '03

At 04:05 AM 1/20/96 -0500, you wrote: >Our beloved Vice President said: "We are very gratified that the bill >contains the provisions for the V-chip that will enable families to >control the contract of television programming that comes into their homes yeaj, families like Al & Tipper Gore.... >and that it contains a provision to make advanced telecommunications >services available at low cost to schools, libraries and hospitals" #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # # "Eternal vigilance is the price of liberty" used to mean us watching # the government, not the other way around....

1 0

No Subject
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

I know this is a little off-topic, but does anyone know of a good swap file deleter? I know Real Delete is a good program, but I want something I can call in a batch file after windows to automatically do a secure wipe of the permanent swap file and then replace it. I have heard of a couple programs but I am not sure about their reliability. Any pointers to a good program would be appreciated.

1 0

Re: authenticating intrahost crypto providers
by James A. Donald 17 Dec '03

17 Dec '03

At 11:37 AM 1/18/96 EST, James Leppek wrote: > > I have been doing some research on the development of an abstract > security services API(not just a CAPI) and have hit a road block. > The problem revolves around the need to authenticate a > security service provider to an application. No such need. If the attacker can introduce his own module to supply crypto services then he must have administrator (NT equivalent of root) privileges, in which case your are stuffed regardless. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

ITAR and hash functions (Perry's question)
by Phil Karn 17 Dec '03

17 Dec '03

Perry quoted part of the joint declaration of facts in my case and asked >Would this not mean that the government is estopped from ever again >claiming that hash functions are export controlled under the ITAR? Not according to them. They have made it clear throughout their filings that they consider each CJ request on a case-by-case basis. Furthermore, they repeatedly assert that under the power delegated to them by the President, they have the absolute power to add and delete items from the Munitions List and to make inexplicable, inconsistent and arbitrary rulings whenever they damn well feel like it, and no court can overrule them. They even feel free to ignore their own rules whenever they get too inconvenient. See my attorneys' brilliant analysis of why the ITAR as written clearly permits the export of public domain crypto code under the public domain exemption. It's about halfway through http://www.qualcomm.com/people/pkarn/export/karnresp.html But State wrote the rules, so they can ignore 'em whenever they feel like it. Why gosh, National Security is at stake! And that's something we mere mortals can't possibly know anything about. Grep for the word "estoppel" in their arguments -- I know they used it at least once to discuss this exact point. So the bottom line is this: at the moment the ODTC will let you export hash functions as long as they don't encrypt data. They'll probably grant CJ requests to that effect. But they could change their minds at any time if they feel like it. Isn't it wonderful to live under a government of laws, not of men? Phil

3 2

RE: Cypherpunk Enquirer
by attila 17 Dec '03

17 Dec '03

OK, who's the 'wise guy' among us? is it the aging hippy in a hot top? is it Samuel Clemmons revenge? who cares? write on! as blanc might have said: Hee-hee-hee-haa-haa-haaaaaaa. The UpOurs CPunk News Update. ^ __________________________________________________________________________ go not unto usenet for advice, for the inhabitants thereof will say: yes, and no, and maybe, and I don't know, and fuck-off. _________________________________________________________________ attila__ To be a ruler of men, you need at least 12 inches.... ---------- Forwarded message ---------- Date: Fri, 19 Jan 1996 20:41:31 -0800 From: blanc <blancw(a)accessone.com> To: "cypherpunks(a)toad.com" <cypherpunks(a)toad.com> Subject: RE: Cypherpunk Enquirer Hee-hee-hee-haa-haa-haaaaaaa. The UpYours CPunk News Update. .. Blanc

1 0

[NOISE] FIG_newt/on CIA
by Dave Del Torto 17 Dec '03

17 Dec '03

[ This came to me from someone at Apple, through our pal Stephan Somogyi ] [ ...another "your tax dollars hard at work" story... heh. --dave ] ................................. cut here ................................. There's an easter egg in the 2.0 Newton (MessagePad 120) which was "censored" by, yes, the CIA. Back in '94, one of the Newton software types make a trek to the (very) small town of Rachel, Nevada, which is located at the edge of a secret government airbase. The base, called "Area 51," is thought by UFO-enthusiasts to be filled with alien technology which the government is in the process of reverse engineering. Meanwhile, the government denies the very existence of the base, in spite of widespread media coverage ("Larry King Live from Area 51", etc.). We figured it'd be funny to put a reference to Area 51 in the Newton -- especially given the substantial overlap between conspiracy buffs and computer nerds. So, in the "Time Zones" application, contains a world map, we put an entry for Area 51 in its correct location. Later, we added a twist -- if the user picks Area 51 from the map, the icons in the datebook application take on an alien theme. Normally, meetings are represented by an icon of two people face-to-face, events are represented by a flag, etc., etc. But when Area 51 has been chosen, the icon for a meeting is a person facing an alien, the icon for an event is a flying saucer, a to-do task is represented by a robot, an so on. Okay, cute enough. Now cut to August 1995, when the 2.0 ROM has been declared final, seed units have been in customers' hands for a little while, and the release is just about ready to go. One of the seed units, it turns out, was sent to a cryptographer working for the CIA. When he found that Area 51 was listed at the correct latitude/longitude, he complained to Apple, demanding the removal of the easter egg and threatening to have his superiors take the issue to Spindler if necessary. In the end, Newton management caved in to the demand, and decided to pull the joke out of the system. But the ROM was already done -- so the feature was hidden by a software patch ("System Update") -- but this part of the patch can itself be removed, and "Area 51" returned to its rightful glory. Here's how to get the easter egg back: 1) Open the Extras drawer. 2) Switch the folder of the Extras drawer to "Storage". 3) Tap on the icon "Time Zones" and press the "Delete" button. Warning -- any cities you've added to your Newton will be lost. 4) Switch the folder of the extras drawer back to "Unfiled icons." 5) Tap on "Time Zones." You'll find that Area 51 is on the map -- just tap near Las Vegas and choose Area 51 from the popup. Now look at the icons in Dates. (To purge the aliens from your PDA, open the back and press reset).

1 0

DC area cypherpunks physical meeting, January 27
by Pat Farrell 17 Dec '03

17 Dec '03

The next DC-area cypherpunks meeting will be Satyurday, January 27 at Digex Headquarters offices in Greenbelt MD from 3PM until 6PM. There was talk of obtaining a cypherpunk-related video to show as a social event after the meeting. More on that as details become available. For more information, agenda, directions, etc. see URL: http://www.isse.gmu.edu/~pfarrell/dccp/index.html Pat Pat Farrell Grad Student http://www.isse.gmu.edu/students/pfarrell Info. Systems & Software Engineering, George Mason University, Fairfax, VA PGP key available on homepage #include <standard.disclaimer>

1 0

DES in real life
by Michael Froomkin 17 Dec '03

17 Dec '03

Recognizing that DES is not the best thing out there, but that it is better than RC40 and life is a series of cost/benefit tradeoffs and that there is a large installed base to interoperate with, I'd like your opinions on the following: 1) Suppose you are approached by a corporate client who believes that they can get export permission for DES (but nothing stronger, i.e. no 3DES). What kind of real-world, non-banking, applications is DES just too weak for today? In answering keep in mind that most US corporate clients are not too worried about the US government reading their email. Some do worry about foreign governments and many worry about competitors. [I've limited this to "non-banking" because banks seem to be gearing up for 3DES.] 2) How long before DES becomes generally unsuitable for (A) corporate (B) personal use [please keep the threat model on which this question is based in mind -- threats *other than* the US government wiretapping you]? 3) Do you have a view as to whether DES (A) will and (B) should be recertified next time the issue arises? A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | U. Miami School of Law | froomkin(a)law.miami.edu P.O. Box 248087 | http://www.law.miami.edu/~froomkin Coral Gables, FL 33124 USA | It's warm here.

2 1

Re: Encryption and the 2nd Amendment
by Michael Froomkin 17 Dec '03

17 Dec '03

IMHO the 2nd amendment argument is bunk. [I haven't seen the Wired article BTW, so this is just a general point.] The definition of crypto as arms was accomplished as an administrative convenience by an agency of the US govt. It is not a definition of constitutional significance. To oversimplify only a little bit, agencies don't get to define terms in the constitution -- and a good thing too, or they might try to define e.g. "speech" in some funny way. The issue is whether under any fair reading of the 2nd Am. you can read "arms" to include encryption. You might try to do this by "original intent" (except that I've never seen a shred of evidence for this). Or you might try to do it by arguing that the meaning of the term "arms" should change with the times and crypto fits the purposes (defending your home?) of the amendment. But this is a very tough argument to make, and I've never seen anyone try it. I suspect it is also bound to fail; indeed any interpretive system that would stretch the constitutional use of the word "arms" so wide as to fit crypto could equally well be used to exclude anything more advanced than muskets and early rifles... which probably explains why I know of no such arguments either. I must be posting some version of this every nine months or so. Each time I get hate mail. Let's make this an exception shall we? A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | U. Miami School of Law | froomkin(a)law.miami.edu P.O. Box 248087 | http://www.law.miami.edu/~froomkin Coral Gables, FL 33124 USA | It's warm here.

1 0