December 2003 - cypherpunks-legacy

rhetorical trickery
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

I noticed a rhetorical trick/trap that I've seen a lot lately, in the recent article posted about Phil Zimmermann. there is an infamous case of a child pornographer or pedophile in California that is sometimes cited by law enforcement representatives as a good example of the evils of encryption: supposedly he encrypted his diary and it couldn't be unlocked by them. this was mentioned in the article. but I have a question: how did they know it was his diary? I've noticed that people tend to often make conceptual leaps like this that are wholly unjustified. it is easy to get their opposition to bite down on the trap, when they start arguing about things like "well, everyone should be free to encrypt whatever they like". the next time you run into someone using arguments with words like "criminals" in it, ask them, "how do you know they are criminals"? when you use their terminology, and argue in terms of it, you have almost already lost the argument. there is a big mindset in law enforcement to see "suspects" as "criminals". but that is mistaking means and ends. the process identifies criminals in the end, after a trial, but at no prior date. here's another example: I was watching a talk show in which the recent Israeli bombing was discussed by a bunch of very obviously frenzied commentators who were calling for Arafat's head on a stick. one of them insisted that our government had given the names of the involved terrorists to Arafat some time ago and that he did nothing. well, the question is: how do we know those names on the list are the actual terrorists? how do we know Arafat did nothing? but the other commentators were totally lost this basic rhetorical trap. they said, "well, assuming what you say is true, then... blah blah". but the obvious question is, "how do we know these names mean anything"? there is an amazing tendency in our culture in elsewhere not to question authority. when we see some law enforcement agent at a press conference, and they talk about "criminals", the press immediately latches onto the terminology and asks things like "when will they be caught"? etc. instead of, "how do you know they are culpable?" in crypto arguments as well where there is a lot of emotional rhetoric, I have noticed people have a tendency to try to debunk things that require no debunking, such as the FUD that has been sown over that infamous CA pedophile. the test is avoiding tricky rhetorical traps. there are some battles that don't need to be fought. just remember that calm, deadly retort whenever you hear someone getting excited, and ask them, "how do you know they are his diaries?"

3 2

Re: FCC & Internet phones
by Mutant Rob 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- t byfield wrote: [..] > doubt the situation for bureaucratic rule-mongering would be much > different. The WP article said that has ACTA has "asked the [FCC] to stop > this kind of communications and study how to regulate it," probably--and > not surprisingly --in that order. I noticed they complainted about IPhone "giving away our product for free" or something like that. Bad implications. Imagine MS going after the FreeDOS people, or Novel or AT&T or whoever owns Unix now going after Linux or the FSF/GNU... [..] > Q: Is it practically possible to find netphone traffic on a > generic network at any level above the source and target addresses? Good question. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMUI89CoZzwIn1bdtAQFXBAF/RSoygg/szTsrtI+Ds512YDV3KswRP43r 4HfgV+PHex3JqnhOWNbWuNga05EsFDJp =EcBe -----END PGP SIGNATURE-----

4 4

Index of Coincidence
by Marc North 17 Dec '03

17 Dec '03

I'm new to the mailing list, but I have grep'd tcmay's CP-FAQ and all related FAQs for this, but have yet to find anything. I'm looking for detailed information on a statistical tool to aid in cryptanalysis called an "index of coincidence". I would appreciate it if someone could please explain what this is, how one builds such an index against a given ciphertext, and how it is valuable in the cryptanalysis of said ciphertext. Many thanks, Marc -- .--------------------------------------------------------. | Marc North <*> mnorth(a)netcom.com <*> San Jose, CA. | `--------------------------------------------------------'

3 2

re: FCC & Internet phones
by A. Padgett Peterson P.E. Information Security 17 Dec '03

17 Dec '03

>"Long-Distance Dueling. Free Dialing Via Internet Faces a Challenge From >Small Phone Firms." You seem to forget that the Internet is just about the *only* electronic communications media not controlled/licensed by the FCC in the US. The FCC also prohibits use of cryptography by those with amateur licenses. Warmly, Padgett

5 4

Re: Cryptanalysis
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:57 PM 3/9/96, E. ALLEN SMITH wrote: >From: IN%"tcmay(a)got.net" 9-MAR-1996 12:05:04.70 > >>There are very good reasons to say little about "conventional >>cryptanalysis": it just doesn't matter much with modern ciphers, such as >>public key systems. Modern ciphers don't fall to conventional attacks based >>on word frequency, pattern analysis, etc. > > I realize that this may also be considered an out of date subject, >but what's a good reference for codes as opposed to cyphers (other than >the one reference in the Cyphernomicon which includes "codes" in its title)? The usual: Kahn, Denning, and some of the old Dover Press books on crypto. Also, Herbert Zim wrote a nice little book about 40-50 years ago on codes. Some of the standard crypto textbooks will of course have more pointers to cryptanalysis. (Not to sound harsh to Allen, but why would anyone ask here on the list for recommendations to such a standard subject when Schneier, Garfinkel, Denning, etc. all have books listed?) Again, the reason stuff like "word frequency counts" and "index of coincidence" notions are so seldom involved in modern crypto--which is what all public key systems involve--is that they are essentially of no use. There is no point in doing statistical analysis of patterns on the ciphertext in an RSA or similar encryption. (Because any "patterns" discovered are meaningless.) And there are so many interesting areas to pursue with using and furthering modern crypto, that I just can't understand how people can think that classical cryptanalysis is useful. It might be fun, as a hobby, but it has no bearing on modern systems. (Well, I'm exaggerating a bit. I suspect that classical cryptanalysts at the NSA or GCHQ might have some insights into some problems with modern systems, such as traffic analysis. So I shouldn't say there is "no use" for it. But I hope you all understand my point in general. It is unlikely in the extreme that anyone who fools around a little with classical cryptanalysis will have anything important to contribute as a result of this.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: FCC & Internet phones
by tbyfield＠panix.com 17 Dec '03

17 Dec '03

At 12:07 AM 3/10/96, Adam Shostack wrote re the Q: >| > Q: Is it practically possible to find netphone traffic on a >| > generic network at any level above the source and target addresses? >Presumably, the signal has a number of charictaristics. Some of them >have a central switchboard, where preople go to set up calls. Most >presumably use a mix of a UDP data connection and tcp for control >functions. They all consist of high volume, long duration connections >(or data flows in the case of UDP.) Many probably use a standardized >destination port. They might use the urgent pointer to force data up >the stack quickly. > > In short, yes the data streams can be easily found, if one can >tap and grep a T3 in real time. That's a big if, given the priority such a tap would likely merit. Of the Mac apps I've seen (Maven, Cu-SeeMe Talk, and Netphone), the last is by far the best. On startup it verifies registration by querying the company's site, so it'd be easy enough to shut down at, at least for now; but strangling it at that level would likely kill the company, which would effectively orphan the code--a real factor, imo. In any case, there's a crack floating around that circumvents this verification; obviously, then, it'd also circumvent that method of enforcement. As for traffic characteristics, I've never seen one of these apps work in full-duplex mode--just the allegedly fallback "push to talk" mode (i.e., hold down the button while you yak, release it to listen), which really changes the texture of a conversation--so the signal tends to be a kind of high-volume call/response "negotiation" in slow-mo, with ~10-20 secs of transmission punctuated by null periods of about the same duration. Ports are no problem, since the disassembly it'd take to rewrite the call to another port would be minimal (and it'd be easy enough to make hack a configurable port call to be arranged by mutual consent through plain old UN*X Talk). The upshot being that signal analysis would be nontrivial--and, from what I've read, the major telecom players aren't especially worried that they'll lose business to this, so they'd likely resist getting saddled with burdensome sniffing duties. And there's always PGPfone, which obviously flattens out signal characteristics... heh heh. I think ACTA will make a valiant effort to ban this stuff, and the FCC might listen--if only to safeguard its purview--but the only "effective" way to enforce such a ban would be to impose yet another policing duty on ISPs. Bandwidth aside, they've got better things to worry about. And it'd be damned hard to work the public into a frenxy over free long-distance phone calls. Basically, I think we got ourselves a winner. Ted

2 1

Re: Cryptanalysis
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"tcmay(a)got.net" 9-MAR-1996 12:05:04.70 >There are very good reasons to say little about "conventional >cryptanalysis": it just doesn't matter much with modern ciphers, such as >public key systems. Modern ciphers don't fall to conventional attacks based >on word frequency, pattern analysis, etc. I realize that this may also be considered an out of date subject, but what's a good reference for codes as opposed to cyphers (other than the one reference in the Cyphernomicon which includes "codes" in its title)? Thanks, -Allen

2 1

Re: Petty Civil Disobedience
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 10:31 AM 3/9/96 -0500, Declan B. McCullagh wrote: > Perhaps we should put up our own protest web sites with one or two > explicit sexual images as real civil disobedience? Major problem here is that ten million horny geeks are likely to bring your server to its knees, but if one only has one image, and it is moderately small, say thirty thousand bytes, perhaps the flood would taper off eventually. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

3 2

Re: Do you feel lucky, punk?
by jim bell 17 Dec '03

17 Dec '03

At 05:54 PM 3/11/96 -0500, Black Unicorn wrote: > > >[rant including some very dubious abstracts of legal opinions deleted] > >Not only is your law poor and badly reasoned, Just what George Will said about this recent Bennis SC decision. > your mastery of the jurisprudence of forfeiture law flawed, Ditto, and I notice you give no specific examples. Why is that? > and your rhetoric twisted, Again, you give no specific examples. And what is "twisted rhetoric", at least as you've used it here? >but you don't seem to know the difference between dicta and holdings. I didn't use either term. Neither did George Will. Maybe you read that item too rapidly to notice that most of it was George Will's column, not my wording. BTW, I get particularly suspicious when people "respond" to my posts and quote NOTHING that I have said. This seems to be a pattern: The person clearly disagrees with my position in general, but can't cite specifics and in fact studiously avoids them. Padgett Peterson is an expert at this, it appears you're trying to emulate him. What, then, was the point of sending me the note, as well as wasting bandwidth on CP to share your unhappiness? Jim Bell jimbell(a)pacifier.com

3 2

Key Escrow: Scholarly Treatment
by Black Unicorn 17 Dec '03

17 Dec '03

Interested cypherpunks might want to have a look at: "A puzzle even the codebreakers have trouble solving: A clash of interests over the electronic encryption standard," in the most recent issue of Law and Policy in International Business, The International Law Journal of Georgetown University Law Center. Mr. Sean M. Flynn does a fairly good job of outlining the policy issues, even if perhaps he managed to go a bit light on the NSA and miss some of his history re: the marketing of broken systems to the private sector and third world nations, and the mistrust the NSA seems to have earned as a result. I was also disturbed to see him fall into the government's "voluntary standard" trap but still, it's really nice to see a legal note with cites like: See e.g., Bruce Schneider, Applied Cryptography (1994) John Perry Barlow National Security Agency, Recruiting Brochure Unclassified Summary: Involvement of the NSA in the Development of [DES] Marc Rotenberg Whitfield Diffie Jim Bidzos mech(a)eff.org (I kid you not) Wired and A personal interview with D. Denning Worth the read, nice bit of research, if lacking in the "spirit" of things. --- My prefered and soon to be permanent e-mail address: unicorn(a)schloss.li "In fact, had Bancroft not existed, potestas scientiae in usu est Franklin might have had to invent him." in nihilum nil posse reverti 00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information

1 0