December 2003 - cypherpunks-legacy

[CONSPIRACYPUNKS] RC2 Source Code - Legal Warning from RSADSI
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

It is becoming obvious to anyone with two brain cells to rub together that RC4 and now RC2 have been deliberately released by RSA Data Security. Consider that neither of these ciphers would be used in any freely available software systems if licensing fees had to be paid to RSA. Now that the algorithms are public knowledge, many developers will include them in their products if for no other reason than to tweak RSA's nose. The warning notices and claims of dire consequences from RSA are clearly designed to spread FUD among deep-pocket users of such products. Rather than risk any legal exposure, medium and large companies who wish to use products containing RC2 and RC4 will obtain licenses from RSA. RSA has traded the entirety of a small pie for a significant portion of a much larger pastry. Quite brilliant marketing when one thinks about it.

2 1

GNU_kum
by John Young 17 Dec '03

17 Dec '03

2-3-96. FinTim: "World's financial police to cast money laundering net wider." The plan needs to address issues raised by cybercash. These technologies pose a threat but answers should not be dated as soon as published. Officials want developers of new technologies to consider their criminal potential before launch, to avoid clampdown afterwards. Possible safeguards against the misuse of electronic purses may include limiting their maximum value or restricting use to closed systems. "Communist to capitalist." [Book review] China's Rise, Russia's Fall, by Peter Nolan. Nolan says China's leaders had the self-confidence to chart their own evolutionary approach, largely preserving state institutions at a central and regional level, and fostered entrepreneurship through intelligent government planning. Russia's ruling class were hoodwinked by a phalanx of mainly US and UK advisers urging a "shock therapy" of destroying existing economic and political power-bases. The result has been a deep tragedy. 2-3-96. EcoMist: "Why is the Internet so slow; what can be done about it?" At present there is no answer, only a few expedients to limit traffic on congested routes, say, with "caches". However, Web site owners object to providers caching their wares, because it robs them of valuable information about their viewers -- the sort that advertisers demand. The caches have, in effect copied these pages without their owners' permission, and are showing them to others without their owners' knowledge. But faced with an Internet meltdown copyright violation may be the least of their worries. GNU_kum (for the three)

1 0

Re: PGP "official" logo?
by David Lesher 17 Dec '03

17 Dec '03

EFF is promoting a new symbol of free speech -- the blue ribbon. Can/should a PGP logo incorporate that somehow? -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

Sometimes ya just gotta nuke em--and nuke em again
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:25 PM 2/3/96, Jordan Hayes wrote: >Sorry to inject a little scholarly research on this topic, but I >would urge those of you who are interested in how this mythology >was created and disseminated to do an AltaVista serach for Alperovitz; >he's potentially the leading scholar on this subject. I've read >his book, and Tim probably ought to as well ... I have responded privately to Jordan Hayes on this issue. Reasonable people can disagree on historical events, and historical motives, and certainly the "decision to drop the bomb" has long been a contentious one. I regret that Jordan Hayes believes a condescending tone, implying others are not as scholarly as he, is the way to make a point. (I've also received several long articles from people who seemed outraged that I was belittling the dropping of the bomb. I wasn't belittling it. Far from it. The Japs surrendered after the second bomb, so it was obviously not a trivial matter to them.) --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

free speach and the government
by Stephan Mohr 17 Dec '03

17 Dec '03

Well, I feel that I agree with the people on the right of free speech for i.e. the neo-nazi stuff or other political, ideological and/or religious ideas. But there is still something that leaves me uneasy: imagine there would be a way to easily make a powerful poison, easily applicated to your town's water-reservoir, or a very easy way to build some strong explosive device. etc. Actually, I think that stuff like this does exist already. But the idea that one day I just put 'easy made deadly poison for millions' into my webcrawler and whoop there it is on my screen or on the screen of any other fool, doesn't sound to right to me. I would like things like this to be better put aside and locked up. Well, maybe my imagination isn't strong enough to make my point. But do you fighter for free speech, in principle, think that nothing, really nothing, shouldn't be prevented of being published? And by being published, I mean published in the net, not at loompanics (who knows loompanics?). I know, of course, that by accepting that there is something that shouldn't be available on the net, we would need something to decide what and how to ban. So I wonder what would be a more 'net'-like way of handling this type of thing and how to prevent that some 'strong-armed' governments take the net over. I do not see tokay's governments being prepared for the net (at least not the German one). But I see them trying to put the 'old' laws onto the net. Not because they are mean, but because they don't know any better. So, I think it would be nice to have something to offer to them. I do not think though that they will accept the totally right of free speech (yet). There is something that is closely related to the right of free speech but not the same and that is the right of privacy. And I think there is a big danger of the issue of free (public) speech been taken over to the right of privacy. Governments may, by arguing to control the public net, start to prohibit the use of strong cryptography. It seems important to me to separate this two issues. Maybe it will be necessary to agree to some kind of (hopefully self organized) control of the public net. But it is totally unacceptable to allow whatever organization to look into someone's private life. Comments and hints to information on these topics very much welcome Stephan

4 3

[philosophy of censorship] Re: Imminent Death of Usenet Predicted
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

Jordan wrote to me today: >Hey, I tried to explain this, but you missed it: Apologies, I did miss part of your point. >I *know* that a *huge* percentage >of the population in this country does (sorry for being USA-centric, >but we have [at least for now] the largest net population, so you >can see how this will go ...). Should the absolute number of peoples 'wishing' something relevant? >Therefore, I'd like to see a way >for the default be that kids (dare I say everyone!) don't *automatically >stumble upon* it in the open network. I find the sentence a bit strong, here. >I think that if the >majority of the people in a community don't want the default behavior >to be "click here for tits!" They can subscribe to a net provider that restricts access to such newsgroups. If this restriction is circumvented by the kid, don't you think that the said kid will find ways to get whatever he/she wants no matter the laws? They also can choose the ultimate solution: not to be on the net. >then it's up to us, as technologists, >to provide easy-to-use mechanisms for those who do want to see them >to not infringe on those who don't. *THAT* is the thing I have most problems to. This sentence is boobie-trapped. Let's me state, for the book (or maybe hard drive), that I do not subscribe to this view of Man. I believe that selfishness is a virtue and that altruism is at best a psychological problem. Why is it that us, technologists, thoses who know and can, have a duty to thoses who cannot? This does not contradict good commercial practices. If there is a *demand* then, there is a market. Any producers does follow the demand very closely or he gets out of business. But govt intervention, rules, standards, etc are *all* enforced at the point of a gun (even if deeply hidden under a pile of red tape). This view implies that *because* you can produce, you have a duty to the one who cannot. It means that if you can produce, your duty is to become a cattle for the benefit of others. If you cannot produce, you have every rights. In today's political climate, the whiners, complainers and decryier are god. When is it that thoses who get sucked by the collectivists leeches will say : Enough! I am fed up to owe any drifter the best of my life! > <...> porno <...> you can rent it <...> But most people >don't want it by default to be on channel 7. >Last time: I *personally* >am not one of them, but it's important to see what the majority >thinks on this issue. I agree with you on this one: wouldn't it be wonderfull to have porno movies on channel 7 ... sigh... :-> Actually, just as I mentionned, every entities that seeked to control man used guilt to do so. And by the nature of guilt, sex and human mind, sex is *the* best thing to induce guilt. Since a large part of the population *are* controlled through the sex-guilt association, it is extremely handy to create the pseudo-justification the govt need for their actions. But as I said previously, the biggest threath to the govt is that peoples can now find each other and talk together. Previously, we had the means to talk but no means of finding each others. The Internet provides this. >Yes, if your communications >are important to you or you are a potential target of investigation, >you should know it's not private. But it's not like any significant >number of phone calls are tapped, by the government or otherwise. >And it's not likely to happen, either, because NONE CARES WHAT YOU >SAY TO YOUR FRIEND ON THE PHONE. Unless you discuss about how freedom of speech should go unbreached... > >And don't forget: if you have privacy, you don't need anonymity. > >Swiss banks provide the ultimate example. >You can get a numbered account at a Swiss bank by showing up at >the branch, introducing yourself to the branch manager, proving to >him who you are, and signing some papers. They will keep your name >out of any transactions you make, but they *know you* ... this is >not anonymity; this is merely privacy. No, for all it matters, it is anonymity. Because the swiss banks does not publish the name of accounts holders. The recent case of German police raiding homes of german citizens working in Lischtenstein(?) banks shows that, far all that matters, theses banks accounts are anonymous, i.e. there is no way for the german govt to know the name of the accounts holders. Their only way to gain knowledge is through the use or threath of physical violence. >Don't forget: the fact that "porno on the net" (for instance) is >an issue *at all* is a *failure* of technology. Sorry for my stupidity, but I *completely* fail to understand. Would you please explain what are your basis for stating so? > It would be a >non-issue if USENET wasn't essentially a technology vacuum. I find this a bit strong, but since I did not understand the previous statement, I will refrain from commenting. Regards to all CPunkers JFA Existence exists, Reality Is.

1 0

Re: Sometines ya just gotta nuke em-and nuke em again
by paralax＠alpha.c2.org 17 Dec '03

17 Dec '03

At 15:54:04 -0800 )2-03-96 Timothy C. May wrote: > I regret that Jordan Hayes believes a condescending tone, implying others > are not as scholarly as he, is the way to make a point. > (I've also received several long articles from people who seemed outraged > that I was belittling the dropping of the bomb. I wasn't belittling it. Far > from it. The Japs surrendered after the second bomb, so it was obviously > not a trivial matter to them.) Mr. Hayes MAY have used a condescending tone but you have exposed your racist roots again. First you embarass yourself with you lack of knowledge, sensitivity and understanding about all things Jewish and now you insult an entire race with the use of the word "Jap". Stick to cypher related topics - - - - - - You're elevating the Ugly American to another level altogether. A. Paralax View

1 0

Re: Noise and the Nature of Mailing Lists
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"tcmay(a)got.net" 31-JAN-1996 00:44:48.72 >However, and current subscribers will no doubt jump in and give their views, I hear that the current volume of messages is less than one per day, with--according to my sources--sometimes days between messages. (I also hear that the Extropians are devoting more of their energy to their magazine, which may also be a factor.) ------------ Actually, I'd guess that the recent problems with the mailing list software are the problem. I got signed off of there when I changed mailing addresses, and they haven't been able to put me back on. If it's that low-traffic, I may see about requesting it from them again. ------------ >And remember, it's a whole lot easier using filters and reading tools to reduce the volume of messages on an active group than it is to get an inactive group up to critical mass! ------------ One idea is to set up two lists, one of which has an automatic filter that forwards stuff to another list... I'm currently trying to set that up for another list I'm on. Something to keep in mind is that irrelevant discussion can chase people off... what's happened to the list I mentioned. -Allen

1 0

Ok Fake E.E.rnst!
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

>From: Cecelia A Clancy <cacst9+(a)pitt.edu> >Subject: Ok Fake Ernst! >In-Reply-To: ><9602031850.AA18675(a)frumious-bandersnatch.MIT.EDU> Ho -- bandersnatch is powered up again and transmitting via the pigeon-beshitten attic-lattice of MIT dome! PCB-swilling frumious, the cronkest of Hasse-heads, 23 years hacking a b.s.e.e.

1 0

RC2--Some very preliminary analysis
by JMKELSEY＠delphi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [ To: sci.crypt, cypherpunks ## Date: 02/02/96 06:21 pm ## Subject: Alleged RC2--some very preliminary analysis ] I just wanted to post some corrected comments here, regarding alleged-RC2. 1. The best differential characteristic I can think of looks like it will have a probability of 2^{-4} per round. It's a one-round iterative characteristic. In my earlier post, I miscalculated this to be 2^{-8} per round. Sorry. 2. Each round of RC2 represents four "steps." This means that RC2 has 64 "steps," the same number as MD5. (I find this interesting, since MD5 has twice as many bits to diffuse through, and the attacker can choose its key, but not its input block.) 3. I don't see how to build useful linear characteristics. Our S-box is one bit wide. There may be some very low-round confusion failures, but they don't seem particularly useful here. I'd like to hear from anyone who can see a way to do a linear attack here. It looks to me (though I haven't spent enough time to be certain) that the best differential characteristics to push through the block are going to be one-bit characteristics. (These are certainly easy to analyze.) Let's throw some terminology in here: This is one step: A = rotl(A + f(B,C,D) + sk[i], 1); A round is all four of these steps. In the step above, A is the target block (it's the one that's getting stomped by the other values) and B, C, and D are the source block. f(B,C,D) is the bitwise-select function. For each bit position i, if B_i is a one, then f_i = C_i, otherwise f_i = D_i. Now, when a one-bit difference is anywhere in the target block (the block getting all the stuff added into it) except for the high bit, its probability of not propogating to other bits in that block seems to be about 0.5. (This is just based on its chances of affecting the carry into the next bit position.) When the flipped bit is the high-order bit of the target block, it has no chance of propogating. When a one-bit difference is in the source block, if the rest of the bits are approximately random, then it has a 0.5 probability of not affecting the target block at all. If it does affect the target block, it has a 0.5 probability of only affecting one bit in that block. Note that I messed up the calculations in my earlier post on RC2 by combining these three events in each round. Let me try to fix that: We flip some bit, t, making certain that if this bit doesn't cause other bits to change, it won't ever affect the low six bits of any block during rounds 4 and 11, when it would have a radical effect on the encryption process. (In other words, we choose an input XOR delta with only bit t on.) This bit then has the following effect: a. Whenever it's in the target block, it passes through the encryption step with probability 0.5. (This means that changing this bit doesn't change the carry into the next higher bit.) This happens once per round. b. Whenever it's in the source block, it fails to affect the target block with probability 0.5. This happens three times per round. Note the reasons for this. The source block affects the target block only through this function: ((A&B)|((~A)&C)). This function looks somewhat complicated, but it's really just a bitwise IF-THEN statement: If bit A is on, then choose bit B, otherwise choose bit C. Assume that A, B, and C are random. Now, imagine flipping A. If you were choosing bit B before, now you're choosing bit C. Since they're both random, half the time, B=C, so there's no change. On the other hand, imagine flipping bit C. About half the time, bit A is a one, and so C has no effect on the output. All of this gives us a total per-round probability of 2^{-4} (NOT 2^{-8}). Getting through 14 rounds with this characteristic thus happens with probability 2^{-56}. *IF* single-bit characteristics are the best ones to use, I'm doing the calculations right, and there aren't some improvements in splitting out and dealing with several possible characteristics in the later rounds, then it looks to me like straight differential attacks aren't going to be too practical against alleged RC2, though they will be possible. The trick is going to be detecting the right pairs reliably. (This analysis is guaranteed to be worth at least what you paid me for it. :-) ) If this really is RC2, I suspect the number of rounds needed was determined by imagining flipping a bit, and then seeing what the odds were that it wouldn't flip any other bits all the way through. My guess is that a probability of 2^{-64} of this happening was deemed acceptably low. That takes care of diffusion--now how about confusion? Has anyone looked at this cipher with regard to linear attacks? In general, it seems like source-heavy UFNs can often be attacked by linear attacks. However, it's not clear to me how to build linear characteristics that will make it through more than a few rounds of alleged-RC2. Linear characteristics that are spread across many subblocks (i.e., partly in A and partly in B) seem to get messed up quickly by the rotations. However, just keeping a linear characteristic in A doesn't seem to work too well, either--if the bits in the other blocks are random, then the bits in our characteristic will quickly become random, as well, because the bit-selection function has balanced outputs. Intuitively, I think the problem here is that we're applying a three-bit to one-bit balanced S-box here, and each output from this S-box has at least one different input bit. This seems to make it really hard to find correlations between multiple S-box output bits and their corresponding input bits that span more than one or two rounds. Also, we have to deal with the carry-bits from addition, which make things significantly harder. Am I missing something? There are some other plaintext patterns that will make it through a single round, but I can't see any way to exploit them for more rounds. Anyone want to point something out to me? The other interesting area is the key schedule. Recall that phase one of the key schedule in alleged-RC2 works by filling the leftmost k bytes with the k bytes of key, and then using a byte-wide S-box to expand this out to 128 bytes. Phase two then works from the opposite direction, taking the last t bits of the expanded key buffer, and making the entire expanded key dependent only upon those bytes. As someone on cypherpunks pointed out, this seems to be meant to make it possible to use the key schedule directly on user passphrases, and then reduce the effective key length to t bits to meet export control requirements. In general, I don't think it's a good idea to use that key schedule to hash long user passphrases, because the first few subkeys wind up with some badly skewed bits. (This may or may not translate into an attack, but there isn't any good reason for allowing it.) If you had (say) a 64-byte user passphrase, this would mean that the first four rounds' subkeys were badly skewed in this way, and the next four rounds' subkeys were probably not all that well-mixed. As I said, I don't see a specific attack based on this, but it seems like a bad idea, since I might be able to plan out (for example) differential characteristics that took advantage of the skewed subkey bits. If you're using the key schedule to hash passphrases, then it's probably better that you use phase two as well, perhaps with bits = 256 or something similar. If you limit user passphrases to something reasonable, such as 64 characters, then this is probably okay. Has anyone else looked at this? (Naturally, it would make more sense to just hash the passphrase intelligently, and then use the export control hack if you had to.) Comments? Note: Please respond via e-mail as well as or instead of posting, as I get CP-LITE instead of the whole list. --John Kelsey, jmkelsey(a)delphi.com / kelsey(a)counterpane.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMRP5P0Hx57Ag8goBAQF2FQP8DCxUvPqNly99t/KyRogWKkM5X0iZWHhq MdQ5XEFWdyg26KMpwmPmFeNcgj3rpQiValSGGM3cTzAd2v35GQrKwPdRU/nmQW7B hojJrYA1D0IuMxE7c0+tyqdjw6oFXrqiWYH816NKKlTSvAUzgst8hCyoVgpbNwkm tbjAD93wsTk= =uaz+ -----END PGP SIGNATURE-----

1 0