December 2003 - cypherpunks-legacy

No Subject
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- This came from Dave^H^H^H^HAnonymous in the context of that highly entertaining rec.music.white-power hullabaloo. What he was thinking cross-posting to alt.politics.white-power, I can't imagine. The References: and Reply-To: headers are hilarious. - -L. Detweiler alias Rich Graves FUCKING STATIST http://www.c2.org/~rich/ From: nobody(a)REPLAY.COM (Anonymous) Newsgroups: news.groups,alt.politics.white-power,alt.2600 Subject: L. Detweilers's Back!!! New nym: rich(a)c2.org (Rich Graves) Date: 16 Mar 1996 15:29:18 +0100 Sender: replay(a)utopia.hacktic.nl Message-ID: <4iej7u$r6(a)utopia.hacktic.nl> References: <rich(a)c2.org> lying asshole Reply-To: <rich(a)c2.org> L. Detweiler NNTP-Posting-Host: utopia.hacktic.nl Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Content-Length: 194 XComm: Replay may or may not approve of the content of this posting XComm: Report misuse of this automated service to <postmaster(a)REPLAY.COM> Xref: nntp.Stanford.EDU alt.2600:179080 news.groups:126480 Give it up, "L" We've got the glass on you -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMU3MjI3DXUbM57SdAQFBKwP9HCsustLeJGLqTzt9WCh2DM9/znj+Xl0E aaidu28dpuhxdju/6phZ0uEHHXC/fUomH/dY5AXu3IaW68N6nLAXAl1TwJvd/dAh JIjmchQpDptmH2039pFn0I/xTKO0nqqK/tMNYHC3v9HTwRxlR2nGUxh/vAUAKObf tWbITC1fNPY= =5/VC -----END PGP SIGNATURE-----

1 0

Re: Keep the pressure! Cryptographers Against Cryptography EXPOSED!
by JR＠ns.cnb.uam.es 17 Dec '03

17 Dec '03

>Some people have wondered why I am anonymous and attack me. >I am not ashamed of my views. I write this thread anonymous >as a form of protest. > >The 10 PEOPLE on the LIST OF SHAME have their shields. The whole >government will come to their aid in helping them spread their >lie and is behind them. > Have you considered visiting your GP or a psychiatrist? No, seriously, that paranoia of yours may get worst and now it may still be time to cure it. You better go now before it gets worst and you end killing a President or something similar. Or at least, use your scarce brains to think a bit (not much needed) to realize that even if these people were of such conspiratorial taste they do have the same right to express their opinions and wants as you do. >I have an acount and post regularly under my real name. I am not >ashamed of my views. I am proud of them. > Oh, I see, that's why you keep using an anonymous remailer. >I write this anonyously as a form of protest because they have >there shield and we have our remailers. I WANT TO KEEP IT THAT WAY! >THEY MUST NOT BE ALOWED TO TAKE OUR SHIELD AWAY. > ^^^ YOUR and who else? Aren't you generalizing a bit? And BTW denying others any right to express themselves? Aren't you stablishing as "me/us" vs. "THEM" where you mistify that "THEM"? Shouldn't you consider if you're not going too far and really need medical assistance? >BOYCOTT THE SELLOUTS >AND >DO WHAT YOU HAVE TO DO > Boyz, do you consider the above concerns too. Before attempting to follow advice of a possibly paranoid, ill, mental patient, consider seriously if you are not really hurting yourselves. The latest thing a cypherpunk should do is enjoin conspiratorial dementia and begin pursuing the very people that is actually supporting cryptography, developing the crypto field and fighting for crypto rights. As he says, "do what you have to": ponder seriously the problem and don't let anyone tell you what to do. Least of all "anonymous" fundamentalists. jr

1 0

No Subject
by Robb＠SpeakOut.org 17 Dec '03

17 Dec '03

Does anyone know of a Visual Basic/Quick Basic implementation of the Unix Crypt(3) function used to hash passwords. I have not found any crypto source code in VB. Your help in this search is greatly appreciated. If you would like E-Mail me direcly , Robb(a)Speakout.org. Many Thanks, Robb Hill

1 0

IPG message
by cpunk＠remail.ecafe.org 17 Dec '03

17 Dec '03

could some kind person that got IPGs' many time pad thing post it somewhere so people that never got a copy can see it???????? thanks.

1 0

Re: IPG message
by John Pettitt 17 Dec '03

17 Dec '03

At 02:58 AM 3/20/96 GMT, ECafe Anonymous Remailer wrote: >could some kind person that got IPGs' many time pad thing post it >somewhere so people that never got a copy can see it???????? > > > >thanks. > > > > > > > IPG wrote: Obviously, you meet our requirementsfor the release of the IPG ABC Encryption algorithms. We need no further information from you. though we would appreciate your telephone num and snail mail address. The algorithms detailed below are copyrighted 1995 and 1996 by Internet Privacy Guaranteed, Seymour, TX. All rights are reserved. You may not provide them to any other party, or parties, by any means or any media, without the expressed written permission of Internet Privacy Guaranteed. What is specially claimed as copyrighted and or patentable are: 1. The use of the word Ultima for the system, because it is impossible to have a either a more secure system - it is impossible to break the Ultima system, other equally difficult to break systems may exist, or may be formulated in the future, for example a true OTP, and in those cases, they may "theoretically" be more difficult to break than the IPG Ultima System, for example a true OTP. However, that would exist only in theory, because in those eventiualities, none of the systems would be breakable. Furthermore as to speed, Ultima, or simple variations, XOR, OR, or AND, instead of the Add or Subtract, is the fastest possible algorithm which will produce an unbreakable encryption system, without having a single OTP byte for each byte of plain text to be encrypted, as in an OTP. However, with the IPG system, we can obtain the same speed, or theoretically faster speeds than a pure OTP, with some very simple parrallelism - and that begs how you get humoungous OTPs to use, both in terms of generating them and getting them into a stream to be XORed against the plain text. That FACT, that the IPG algorithms are the fastest possible encryption system which will become evident when you examine the algorithms in detail. Thus it is impossible to produce a better system, in terms of either security or speed, thus we call our system Ultima, the ultimate. 2. The use of the term ABC Encryption algorithm that at once describes the basics of the system and its simplicity as will quickly become evident. 3. The use of a hardware generated OTP, which serves as a purely random seed, for the system to be described. 4. The use of a table of prime numbers, any number of which is greater than 3, from which random selections are made to be used in the algorithms to be described. The prime numbers for the system described have been selected for a specific hardware, namely the IBM PC clone, market. With other 16 bit, 32 bit, or 64 bit hardware, other prime numbers could be used to provide immediate results just as in the system to be described. The use of larger numbers, the use of larger adders, or logic gating systems, is self evident in the copyrights/patents. 5. The use of a random 8 bit seed for the dynamic vaiable that links the sets of equations into one system. This variable, D, for dynamic is the real key that distinguishes our system from any other system - excepting hardware implemented systems that use extremely large numbers, and or possible partitions, that encompass possible meaningful message lengths. Such systems, are self evident extensions of the simple IPG system. 6. The use of partitions within one OTP, pure random seed, PRNG stream - either by using parts of the random seeds, or more likely by using fixed intervals within the PRNG stream, for example, arbitrarily say every 100 gigabytes, or 100 terabytes for that matter. Using this technique, one random seed can be used for any abritrary period of time, one message, 10 messages, one day, one week, one year, one century, one millenium or whatever. The use of multiple Ds, in linear partitions, that is within one otp every terabyte fior example, is a self evident extension of the IPG system. 7. The use of a simple serial hardware implementation of the IPG system is self evident, and produces impressive speeds, mutiple megabyte per second, dependent of course on hardware speeds. 8. The use of a very simple single level of parallelism in hardware implementation, where the ABCs are computed in parrallel, and the D is passed along, is a simple self evident extension of the system and will allow a throughput of over 100 megabytes per second, on state of the sart hardware. 9. The use of a three dimensional parallel system, where the PRG stream is chopped up into several partitions, say every terabyte, and then each module proceeds as in paragraph 8, just above, is a simple extension of the basic IPG system, a would enable a system to operate at any conceivable line speed. 10. The changing of the number of equations, modules, prime number values, length of prime numbers, or length of random sample, probe values, or the other algorithmic values does not change the basic algorithm. It is the same algorithm with different values. With the previously detailed claims relating to the copyrightable and patentable features of the IPG algorithm system, IPG prersents the the Ultima Algorithms. - the ABC Encryption system. Given: 1. A 1792 BIT OTP, RANDOM SEED, generated from a hardware source. 2. A Table of 319 Prime Numbers in the range of 6,667 to 11,997, out of the 580+ available, the 384 selected for dynamic variance, the table is called BPRIMES. 3. A Table of 319 prime numbers in the range of 14,007 to 19,997, out of the 800+ available, the 384 selected for dynamic variance, the table is called CPRIMES The 1792 bits of OTP, Random Seed, are allocated as follows. 1. 512 bits for the 64 probes, for 64 C vales 2. 512 bits for the 64 probes, for 64 B values 3. 512 bits for the 64 starting A values 4. 8 bits for the initial ID value. Those 1544 bits are the actual random seed used for generating the PRNG stream, if you insist on calling it that. In addition, there are 248 bits used as follows. 5. 128 bits for the offset, partition, if applicable into the PRNG stream. Actually they are used to encrypt the actual underlying value of the partition, if any - note - in this case the mode is actually a true OTP, the first time only ot really does not help to know the offset unless you know the OTP, Random Seed. 6. 72 bits for uniquely identifying the OTP being used. 7. 48 bits as spares temporarily - can be used as different D values for partitions. If more As, Bs, Cs, are needed the random seed, OTP, can be expanded as necessary. Unlike RSA, there is no practical limit - I am actually sending you 1792 BYTE Random seeds, so that you can test other variations if you like, or use each of them, there are 32 of them in all, as 8 random seeds for the 1792 bit algorithm. 8 bit random starting A values are sufficient because we are only talking about the effect on the low order 8 bits in our PRNG stream. We actually AND these values with the constant 13,568 to give us a start that will intially have a dynamic effect on the A, B, and C values, that is the smallest possible B+13568, exceeds that largest possible C value. This selection process of course makes the A, B and C values random, 8 bits, as well as the initial ID value - the random range of each set is 2 to 32 but as you will see they are interlimked with the Dynamic variable, D. The procedure is as follows: 1. Using the 64 bytes for B selection, we select 64 Bs, B1,..,B64, as follows. B1=BPRIMES(SB1) WHERE SB1 is the first byte of the Random Number Seed, thus B1 is one of the BPRIMES, BPRIMES(0),..BPRIMES(255) then BPRIMES(SB1)=BPRIMES(256) then B2=BPRIMES(SB2) AS BEFORE EXCEPT Byte 2 of the OTP, Random Seed, is used. then BRPIMES(SB2)=BPRIMES(257) and so forth through 64 Thus you have 64 constants, B1,..,B64, each of which is an unique prime number. This of course, is the same as a lottery selection, except there is no denominator and the section pool does not shrink. Thus you have 1 in 2 to the 512 possibilities of a repeat, or guessing the selections. 2. The same procedure is used for selecting 64 C values, C1 through C64. 3. The 64 starting A byte values, from the random seed, are ANDed to 13,568 to give the 64 starting A values, random, at least 8 bit random. 4. 8 Bits are used for the starting D value Thus the B and Cs are constants - the As and D changes Then quite simply, you have 64 equation sets as follows. A1=(A1+B1) MOD C1 (Move, Add, Compare, Conditional Subtract) D=(D+A1) AND 255 (Really just use DL in assembly language) + A2=(A2+B2) MOD C2 D=(D+A2) AND 255 .............. + A63=(A63+B63) MOD C63 D=(D+A63) AND 255 + A64=(A64+B64) MOD C64 D=(D+A64) AND 255 the XOR operation against the plain text may vary. In our case, we accumulate a pair of DLs in CX, and then XOR it against a wor, two bytes of plain text. Thus we have one XOR for each set of two equations above, 32 XORs for the 64 equations. We string A1 type 8 sets of those 64 equations together, essentially duplicates of each other except for the XOR operation, which are constants, as opposed to indexed variables. Thus we do a disk sector at a time, with only the A values and D being variables. With double buffering, you can see that it cooks, to say the very least. Obviously by definition, there can be no repeat before the product of the C values, that is (C1*C2*C3,..,*C63*C64), and that does not take into account the starting A values and the starting D value. The average C value is slightly over 14 bits. Accordingly, no repeat is possible before 2 to the 864th power,minimum, or 2 to the 896th power average, 10 to the 267th power minimum, which will handle anything that can possibly occur, ever, ever, ever. If every atom in the universe was a Googol of Cray T3E's and they had been computing since the big bang, the possibilities they would have tried so far would be less than 1 part in 1 Googol. And that does not take into account the other 2 to the 1543+ possibilities. There is absolutely no way to prove that any message of any possible length is or is not possible, without trying all of the 1 to the 470th power possibilities, which of course is impossible. As John von Neumann once said to Dr. Bloome (Dottie), in my presence - it in a similar but totally unrelated case, it is not enough to say that it some theoretical message may not be theoretically possible, you must prove that at least one specific message is not possible. Of course, like JvN's case, that is not possible in the case of the IPG system. Continuing along that line, we in recognize that because we are working with a 1544 bit key, over 2 to 1543, but someewhat less than 2 to the 1544, that we only have approximately 10 to the 478th possibilities, that is 2 to the 1543+. Thus with a 125,000 byte message, we do not have 2 to 1,000,000th possible keys, but only 2 to the 1544 possible PRNG streams. Having said that, and fully recognizing that as incontrovertible, we invite you to test a long PRNG generated stream by the method, using a truly random seed of 1544 bits. You will find over both short and long sample sizes that the "effect" is indistinguishable from an OTP of the same length. To facilitate this, we are including herewith: I combined all these files listed below under BSD UNIX with the zip program so you shouldn't have any problems extracting them. If you do, please get back in touch with us and we can re-send the file under a different format, PKZIP. Note: The zipped files are considerably larger than the original because they are random unzippable data files. I promise you that with these, you can write the program to generate the PRNG streams in somewhat less than two hours. I am referring to the 64 sets of the equations set out above: This approach will also demonstrate how incredibly fast the system is and also how incredibly secure it is. Therefore, please find attached in the zipped file BINARY.ZIP consisting of: 1. BPRIMES.DAT - 384 prime numbers used for randomly selecting the B1,..,B64 values in what we are now calling the 1792 bit system - I am including 384 instead of 319 in case you want to try variations.. 2. CPRIMES.DAT - 384 prime numbers used for randomly selecting the C1,..,C64 values in the 1792 bit system - again 384 in case yopu want to try variations. 3. 32 - 1792 BYTE Hardware generated OTPs, specifically OTP.001,..,OTP.032. - any of these may be used in the 1792 BIT system, or the 5600 BIT system, or the 12288 BIT system. Further, any of the 32, can be used for other possible system configurations. The L1792 BYTE OTPs, can also be broken down into 8 - 1792 BIT OTPs. With these variables, you will not have any problem doing any kind of test that you may desire. As a prelude, consider, if you will, the 1st 64 bytes of the PRNG stream. 1. Byte 1 D is random A1=(A1+B1) MOD C1: is where A1 is random, 8 bit, and B1 and C1 are randomly selected from a table of primes and become a constant for that OTP, random seed. THE resultant A1 is some indeterminate number between 0 and C1-1. A1 MOD 256 is therefore likewise some random number between 0 and 255. There are 16,677,216 possible variations, and only 1 is the actual. ID=(ID+A1) AND 255. ID is random and A1 is pseudo random with 16,677,216 possible variations. Accordingly: by definition the new TD is random. Now therefore: if D was used for only this equation, there would only be 2 to the 32nd possible, 8 ID - 8 A1 - 8 B1 & 8 C1 possible variations and what you would have would be a system partioned into 64 didfferent subsystems. However, that is obviously not the case, D is passed from one equation set to the next, so there is no repeat possible until at the very least ID short of the entire C1*C2,..*C63*C64 cycles. 2. Byte 2, The process is the same and the resultant ID is random. The process is the same for all the other 62 bytes. Accordingly, how is it possible to determine the first 512 bits of the PRNG stream? That is 10 to the 158th power possibilities. Obviously they cannot all be tried - and any of the possible 2 to the 512th power of underlying clear text is possible. As stated, the reultant system is absolutely unbreakable - no ifs, no ands, no buts, no maybes, no anything. Also, as you can clearly demonstrate for yourself, there is no more robust system, with respect to speed, possible. It is truly Ultima, the ultimate system, as you will find out for yourself. Enough, I assume. After you have satisfied yourself that the ABC Encryption system is absolutely unbreakable and the fastest system possible. We will proceed to the demonstrate that the Key distribution is no problem and as stated, we are willing to license the process as desired by users. I invite your response, Thanks so much, Ralph, John Pettitt, jpp(a)software.net VP Engineering, CyberSource Corporation, 415 473 3065 "Technology is a way of organizing the universe so that man doesn't have to experience it." - Max Frisch PGP Key available at: http://www-swiss.ai.mit.edu/htbin/pks-extract-key.pl?op=get&search=0xB7AA37…

4 3

FTC's privacy list (was "Welcome to privacy")
by Deranged Mutant 17 Dec '03

17 Dec '03

I subscribed to the FTC (Federal Trade Comission) Privacy list. I'll lurk a bit [discipline indeed] and see who and what's there. Could be interesting. --Rob ------- Forwarded Message Follows ------- Welcome to the privacy mailing list! [..] Here's the general information for the list you've subscribed to, in case you don't already have it: ABOUT THE PRIVACY MAILING LIST Welcome to the Federal Trade Commission's Bureau of Consumer Protection Privacy Principles mailing list. The Bureau has established this list as a forum for discussing the privacy principles that should be applicable to consumers' use of the Global Information Infrastructure. The Bureau seeks commentary and resource materials from consumers, industry, privacy advocates and others who are concerned about questions such as the following: What information is routinely gathered online now, and what is industry doing with this information? How will the nature of the information gathered or the uses to which it is put change in the next few years? What control should consumers have over personal and transactional information? How should consumers be able to exercise that control? What expectations do consumers have regarding the use of information about them? What are the respective obligations of online service providers, content providers, and consumers themselves to address these privacy concerns? Should certain uses of information be off limits without the consumer's explicit consent? Under what circumstances should consumers have the ability to access and correct information about them? Additional related topics for discussion are welcome. The dialogue that takes place in response to these questions will be invaluable to the Bureau. It will facilitate the creation of a set of voluntary principles governing the use of consumer information in transactions in cyberspace. To post messages to this list, simply address your mail to: privacy(a)ftc.gov [..] Rob. --- Send a blank message with the subject "send pgp-key" (not in quotes) to <WlkngOwl(a)unix.asb.com> for a copy of my PGP key.

1 0

IPG cracked with known plaintext
by cpunk＠remail.ecafe.org 17 Dec '03

17 Dec '03

This information is preliminary and is based on an attempt to understand the IPG algorithm information. That description is not clear in some areas, however, hence this analysis is tentative at this time. First let us describe the IPG system in more conventional C: a[0] to a[63] are initialized to random 8-bit values. (The description is unclear and almost makes it sound like they are initialized to a random 8-bit value anded with 0x3500, which would of course be zero. The attack below will assume that this bizarre step is not done, but will still apply even if it is.) b[0] to b[63] are initialized to random primes selected from some pool. c[0] to c[63] are also initialized to random primes selected from a different pool. d is initialized to a random 8 bit value. The algorithm is: for ( ; ; ) { for (i=0; i<63; i++) { a[i] = (a[i] + b[i]) % c[i]; d = (d + a[i]) & 255; *data++ ^= d; /* xor with data */ } } Note first that with a known plaintext attack, the value of d can be calculated for each iteration, simply by xor'ing the plaintext and ciphertext. So we can easily recover a series of d values under this assumption. Known plaintext is a plausible cryptographic assumption in many contexts. Note second that we can assume that b[i] is less than c[i]. It appears from the description that this will be true, although it is a little unclear. If b[i] is greater than c[i] then simply do b[i] = b[i] % c[i] before beginning the loop. This will produce the same results since (a + (b mod c)) mod c is equal to (a + b) mod c. Note third that when a[i] and b[i], both less than c[i], are added mod c[i], the result will be equal to one of two things: a[i]+b[i], or a[i]+b[i]-c[i]. The reason is that the sum a[i]+b[i] must be less than 2*c[i] so the "mod" operation will be at most a single subtraction of c[i]. In general, half the time it will be necessary to subtract c[i], and half the time it will not. Now, as mentioned above, with known plaintext we can deduce the series of d values. Since each d differs from its predecessor by adding a[i], this allows us to calculate the low 8 bits of a[i] simply by taking the difference between successive d's. Every 64 bytes, i repeats. We know the low byte of a[i] from the previous iteration, and we know it for this iteration. Half of the time (on average) a[i] will change simply by adding b[i], in which case the low 8 bits will change by exactly the low 8 bits of b[i]. So if we take the difference between a[i] values spaced 64 bytes apart, half of the time these values will be a constant which is equal to the low byte of b[i]. The other half the time, the low 8 bits will change by adding b[i] and subtracting c[i]. So the low 8 bits of (b[i]-c[i]) is the other possible constant value which will be seen when you take the difference of a[i] every 64 bytes. So with a few multiples of 64 bytes of known plaintext, you will quickly find all the possible b[i] and b[i]-c[i] low bytes. By itself this should significantly narrow down the possibilities for b[i] and c[i], in many cases to a single prime. Even without this the algorithm can now be run forward or backward with only two possible known changes to a[i] at each step, and the entire message can be easily deduced. So this algorithm is easily broken with known plaintext.

1 0

Re: IPG cracked with known plaintext
by John Pettitt 17 Dec '03

17 Dec '03

At 05:32 PM 3/19/96 GMT, ECafe Anonymous Remailer wrote: >This information is preliminary and is based on an attempt to >understand the IPG algorithm information. That description is not >clear in some areas, however, hence this analysis is tentative at this >time. > >First let us describe the IPG system in more conventional C: > >a[0] to a[63] are initialized to random 8-bit values. (The >description is unclear and almost makes it sound like they are >initialized to a random 8-bit value anded with 0x3500, which would of >course be zero. The attack below will assume that this bizarre step >is not done, but will still apply even if it is.) > I think they mean ADD not AND but it's still an odd thing to do IMHO. >So this algorithm is easily broken with known plaintext. > > Agreed. Given that most PC apps generate known headers on files and that only a smallish plaintext is needed it's looks rather weak. John Pettitt, jpp(a)software.net VP Engineering, CyberSource Corporation, 415 473 3065 "Technology is a way of organizing the universe so that man doesn't have to experience it." - Max Frisch PGP Key available at: http://www-swiss.ai.mit.edu/htbin/pks-extract-key.pl?op=get&search=0xB7AA37…

2 1

Microsoft's "answer" to Java
by Alan Olsen 17 Dec '03

17 Dec '03

I recieved a copy of "Microsoft Interactive Developer" today in the mail. In it, it has a preview of Microsoft Explorer 3.0. (Flux by David Boling on page 120.) Of interest to Cypherpunks is this paragraph (in the section on OLE support in web browsers): "Since OLE controls could potentially pose a security problem, Microsoft is studying how to create an infrastructure to certify them. The idea is that, once certified, an OLE control would contain an RSA security signature indicating that it has passed muster -- the OLE eqivelent if the Good Housekeeping Seal of Approval! Users of Internet Explorer 3.0 could specify whether or not noncertified OLE controls should be loaded and executed by the browser." As a web developer, I have some problems with this scheme. Giving Microsoft access to virtually every OLE control on the Web does not make me more secure. Sounds like a way to rip off ideas from the rest of the development world. If someone has a control that might compete with a Microsoft product, it could be shelved and/or delayed for "further security testing". Java has a decentralized mechanism for security. No one group controls what is a "certified" control and what is not. You write the code and compile it and that is that. Furthermore, you are not stuck with Microsoft approved platforms. (I wonder if there will ever be a version of Explorer for the Mac.) I expect the Microsoft plan to garner a bit of resistance from the Web development community over this one... I do not expect to see many OLE crypto apps for the web with this plan. --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon

2 1

The return of the IPG Unbreakable System (fwd)
by IPG Sales 17 Dec '03

17 Dec '03

Derek and others, In view of the anonymous remailer's calim to have broken the simple system, which as you and others who have had the system for a period time know, we have had some reservations about. The effect on the 5600 bit system, and the 12288 bit system, are unkown at this time. Our tests indicate that there is not any effect at all on the 12,288 bit system. The 5600 bit system, which is indentical to the system described in our release, except that the D values, are used as an index to one, or two tables of random characters, 512 characters, or 2 - 256 characters, may be effected by a known plain text attack, we do not think so but we are running a battery of tests. The anonymous remailer may be able to confirm or deny that, since that person will presumably receive this letter. The addition is trival, that is the system is identicalin all respects to that set out, which was described accurately by the remailer, except that instead of XORing the D value, the D value is used as an index into a table(s) of random characters, that is the random seed is 5600 bits instead of 1792. That was one reason for providing large random seeds in our release. Our analysis as of 3:00pm CST 3-19-96, indicates that the D values are not recoverable, but we stand to be proven wrong. This system is only fractionally slower, for obvious reasons, than the simple one directly using the D values directly, described previously. Incidentally, for those concerned, it is as you know, the one that the IPG software in your possesion uses. Note: There was one error in the description, that is 13568 ANDed to the 8 bit random seed to get starting A values, it is not a C word AND but the assembly langauge sequnce of moving successive AL values into AX, where AH is fixed at 35, thus the effect is the same as an add, (or a byte AND of the random charcter to a zero AL) - the result is a number in the range of 13,568 to 13,823. Further, with respect to the simple system described in our release, we believe that the trimming procedure, that as some of you know, we used for another purpose - to eliminate the perceived problem of more frequent close pairs, on the average more 0,0's as opposed to 0,255's, defeats the plain text attack, though it may require the jump start as we have described - running the system through a few iterations before commencing the actual encryption. The effect of this, as has been described to some of you, is that some of the D's are not used, that portion of each C value that is not an even multiple of 256, for example 14009 MOD 256 is 185. Thus, those values where A[i] > 13824 are not used to XOR against the plain text - this is easily done in ASM by simply comparing the high order 8 bits, of A[i] with the high order 8 bits of C[i], if they are equal, then the XOR does not take place - thus the 64 interval is not applicable, it is variable depending upon the randomly selected C values. Without having the known 64 interval as a constant, I believe that the system is still solid. As those of you heretofore privy to that information know, that modification to the system system takes about 10% more time, than the system that was "cracked." Maybe, we need to do both this and use the 5600 byte system. We will appreciate any input in this regard. If we must go to the 12288 byte system, the system will be slower. However, as many of you know, it is still extremly fast but not as fast as either of the other two versions. With the 12,288 bit system. Our tests indicate that nothing but random values, can be obtained by either known plain text attack or by pattern recognition methodologies, those of which we are aware, on the 12,288 bit system. Those of you who have had all of the materials will understand the foregoing. With the information provided heretofore, you can determine the effect on the other two systems. Also, those people will know my expressed fear of a premature announcement, such as that which has now been made, would have. This was the reason, that I resisted so strongly the release of the materials to the C'punks list though a few of you recommended that I do so. Perhaps we should have released everything? Who knows. However, in any case, that is water over the dam and IPG must go on from here. It is only another of the many mistakes that we will undoubtedly make along the way. Having said that though, we must go back to our prior evaluation method, a strict confidential mode. However, I believe that we have added several very good additional people who can help to analyze the system. In view of the willful violation of our confidential release, without knowing everything involved, and putting it out on the Internet, please be advised that other than those who have heretofore been evaluating the system, we will make no further releases except on a highly selective basis. The dozens of you who have requested copies of the materials,and have not yet received them, please be patient until we can get back on track. On a selected basis, we will provide then to you, after discussing it with each of you privately. Obviously, this breech occurred from yesterdays posting since no mention was made of the 5600 bit or 12,288 bit random seed systems. Therefore, we intend to be very careful from now on. Accordingly, this will be the last letter posted to the entire cypherpunks list for the time being. If any reader posts something to the entire Cypherpunks list, do not expect any response to from IPG, there will be none. Perhaps a battle has been lost, maybe even probably? But the war is not over, not by a long shot - with minor modifications this system is absolutely secure as events will prove. However, be assured that we will not sell our product to anyone until that can be definitively established. We greatly appreciate the contribution of some of those on the cypherpunks mailing list, including the anonymous remailer, have made. We hope that someway can be found for that person to continue to cooperate with us, since we are herein obviously providing information that can be evaluated. If that person will communicate with us privately, in remailer form, including a PGP public key, we will post our response to the C'Punks list in encrypted form, or suggest an alternate approach. To many of you, you will be hearing from us tomorrow - to the remaining of you, some of whom have objected to our providing you with unsolicited information, which we mistakenly thought that you would want, you will hear from us soon, depending upon the findings made by your C'punk list associates and others. Thanks kindly, Ralph

3 5