December 2003 - cypherpunks-legacy

Numbers don't lie...
by A. Padgett Peterson P.E. Information Security 17 Dec '03

17 Dec '03

Have finally gotten around to reading the Jersey Seven paper on keylengths. Is rather amazing since if anything they are being conservative with some of their numbers - are using 30 Mhz for the FPGA where I have been using 40 & using 200 Mhz for ASICs where I would use 300 (year and a half ago I used 150mhz based on what I knew *had* been built, not what I knew X-ray lithography is capable of. In their figures, they do seem to gloss over a couple of minor points: The most compelling to me is "how do you know when you broke it ?". Bruce has always used the "known plaintext" approach, however using modern techniques for messaging, *every* message has a different session key, negotiated using assymetric keying so the only message that will be broken is one that you already have - not terribly helpful. The second point is that their scalability seems to be based on costs per chip alone, cost for which the engineering cost has been recovered and for which the yeild is significant, hardly givens when you are talking pushing the state of the art, given this 200 Mhz Pentiums would be U$10.00 also (well, maybe U$25.00). Finally, no cost is allocated to the sustem required to program/evaluate the ponderings of these 100's of ASICs. As anyone who has ever programmed a massively parallel computer (which is what they are talking about in their brute force machine, it is the boundary communications that kill you. True, each machine could operate on a specific portion of the keyspace with bits fixed as a function of its address, but each will need to be loaded with the plaintext to match and have some means to communicate success. You also have to consider that dividing the keyspace may result in some processors running slower than others due to the values used. Another minor problem in parallel processors. The cost is given of U$300,000 to build a SOA machine that could break DES in 3 hours. Using the 200 Mhz (2*10^8) figure and assuming 1 trial per clock (being nice), a single chip will test 2.2*10^12 keys in that period. 2^55 is otoa 3.6*10^16 so will require 16,680 thingies running in parallel. If they can get the chips for U$10, they will be able to allocate another whole U$10.00 per chip to the support structure and basic programming to stay inside the budget. Since this will hardly be a production process, I suspect that the cost might be a tad higher. Now often banking and EDI (as opposed to EC) does make the mistake of using the same key for more than one message. Similarly a firewall<>firewall connection might beep a single keyed channel open for multiple sessions. This would be at risk. But for individual messages. The paper does make an appropriate observation: the cost is essentially fixed per key (scaling is not perfect but can ignore that for the moment - has to do with why Crays are circular and Grace's "nanosecond"). This means that the strength of cryptography should be appropriate to the value of the information protected. If less than U$10,000, the message is individually encrypted, and has value only today, then DES is probably "good enough". Strategic information of higher value arguably needs "more" but how much ? 64 bits is 256 times stronger than DES. This would indicate effective security up to say U$2.5 million. More is better but I would not be quite so alarmist nor would I dismiss the cost of engineering. Non-trivial. Do agree that 40 bits is the same as no crypto at all (reminds me of Bob Clampett's "No Bikini Atoll" but is another hobby entirely). Still, at what point is it simply easier/cheaper to buy someone who knows the secret ? Warmly, Padgett ps calculation made with a Sharp EL-5806 "scientific" calculator that is probably older than some readers. If I dropped a digit, please let me know.

2 1

Re: Some thoughts on the Chinese Net
by Bill Stewart 17 Dec '03

17 Dec '03

At 05:38 PM 2/14/96 -0500, Perry wrote: >Jon Lasser writes: >> The more complex portion (from my perspective, at any rate) is a >> modification of the standard TCP/IP protocol, requiring that each packet >> be signed by its originating user. This would require lots of software >> modification on the Chinese end, as well as a conversion process at the >> National firewall. > >They could use no stock software, and they would grind every machine >in the country to its knees doing the signatures. RSA signatures >aren't cheap. Could you use IPv6 / IPSP authentication to do the job? You'd obviously need to create network software for the various operating systems, but for most of them it's not a big change and various well-known people are working on implementations :-) You could get by with something cheap like an RSA-signed key used for a MAC with either RC4 or MD5, reducing the problem to one RSA signature per connection plus faster algorithms. For email, that's probably still one signature per mail message, but it's a manageable load... #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281 ! Frank Zappa for President !

3 2

Re: PING packets illegal?
by Bill Stewart 17 Dec '03

17 Dec '03

At 03:20 PM 2/14/96 -0500, markm@gak [cute machine name :-] wrote: >-----BEGIN PGP SIGNED MESSAGE----- >> Concerning the ITAR ...... what would happen if some Evil Hacker Dude in, >> say, England, decided to ICMP-ping a host in America? Nothing wrong with >> that ...... but if those ping packets contained little pieces of something >> like PGP ...... would the host being pinged be breaking the law? Would >> all the hosts in the route between that host and the host in England that >> was doing the ping also be breaking the law? > >Exporting encryption to the U.S. from another country is not illegal, only >exporting from the U.S. is. The method of transmissioni is irrelevant. It >does not matter if TCP packets or ICMP-ping packets are used to transmit the >data. You missed the fun part of his post - it's that ping packets return the data they were pinged with, so the US-end host is re-exporting components of PGP. >From a legal perspective, it's tough to assert that the US user had scienter, given that it pings scarcely reach the machine's consciousness, much less the human users', since they're handled by ICMP rather than by a user-space TCP or UDP socket. (Obviously, if there's a sniffer around this is slightly different.) Is it possible to send out forged ping packets, pinging machine B with a From address of C (fake) instead of A (real), so that Alice can talk to China via Bob? If so, it might be an interesting method for traversing some firewalls, and also (if you write a ping-collector program) for back-channel communications. If you want to really abuse the protocols, 53 bytes probably fits into the 64 you can send in a ping, so you could implement ATM-over-ICMP :-) #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281 ! Frank Zappa for President !

3 2

Re: Patents suck
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

>I take some disagreement with that. > >With patents, there is a problem of large companies owning them yet >doing nothing with them except suing other companies or individuals. If you reject that possibility, you imply that the result of your work for yourself might not be your own property. It does not matter if the idea patented was originated be the patent holder of was purchased by the patent holder. Money is equivalent to personnal work. And the property rights *are* fundamentals (even if not implemented in Biiieauuuutifull Canada...). You can not have your cake and eat it too... >Patents would be better if there was a good-faith attempt on the >part of the holder to "use it or lose it". Somebody sitting on a >patent and doing nothing with it deserves to lose it after a number >of years. AFAIK, such clause already exists in Canada. But again, I am not a layer. JFA **** NEW PGP 2.6.2 KEY ********* This key is actually suspended, as of Feb, 16 1996, was never distributed, and might be subject to deletion. Sorry for the trouble my mis-management might have caused. 2048 bits Key ID:24201BA1 1996/02/13 Jean-Francois Avon <jf_avon(a)citenet.net> Key fingerprint = 23 B6 24 31 86 67 FB 35 C7 A7 AF 12 A1 61 E9 3D **** OLD KEY: DO NOT USE ANYMORE UNLESS FOR VERIFYING SIGNATURES **** 1024 bits Key ID:57214AED 1995/10/04 Jean-Francois Avon <jf_avon(a)citenet.net> Key fingerprint = 84 96 76 AE EB 7C AB 15 88 47 87 B0 18 31 74 9F

1 0

Off-topic, but pertinent...
by Ed Carp 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Sun, 18 Feb 1996 01:00:06 -0800 From: Sun Angel Innovations <webmaster(a)sun-angel.com> To: quotes(a)sun-angel.com Subject: Daily Quote for Sunday, 18 February 1996 If you resist reading what you disagree with, how will you ever acquire deeper insights into what you believe? The things most worth reading are precisely those that challenge our convictions. unknown -- Sun Angel Innovations | http://www.sun-angel.com/ | info(a)sun-angel.com

1 0

Re: A Cyberspace Independence Refutation
by Duncan Frissell 17 Dec '03

17 Dec '03

At 06:13 AM 2/16/96 -0500, lmccarth(a)cs.umass.edu wrote: >> I'm waiting. Then I'll have to call all the way to Montreal to log on. > >So much for the-net-as-I-know-it, where people don't have to call outside >the country just to log in to the net. Most of the people I want on the net >are very unlikely to do this. But what we think of as "phone calls" are likely to be digital and flat rate as well so calling distant points won't involve much of a hit. >I'd be interested to see the documentation of the number of peasants in >the U.S. (or elsewhere) who have done anything like this. Documentation of >the number of peasants who could manage the technical details would also >be interesting. Actually, it only takes a million or so out of the world population to make restrictions impossible. That will certainly be achievable. Configuration need not be difficult if the technically aware produce easy installation software and I think this is being done. In any case, once Windows 96/Windows NT is stable enough with genuine multithreading we'll be able to do a nice background TCP/IP setup with a point and click interface. If the capability to do something people want to do (communicate freely) exists, it *will* be used. Enforcement doesn't work. The Great Enemy would need to remove the capability. But they are not doing that. They are encouraging the move towards a more communications rich environment not towards a lesser one. >And of course, all peasants have plenty of disposable income to spend on >long-distance phone charges.... No more long distance. Haven't you heard. The "production cost" of a New York to London call is currently less than 2 cents a minute (most of that for billing) AT&T charges about 50-100 cents a minute. That sort of markup can't survive. >Duncan Frissell writes: >> We (some of we) don't want the housing or the school funding either. I >> certainly consider slave schools to be the most common form of child abuse >> in the world today. > >That's nice, but are you seriously claiming that the portion of the average >set of voters in a Congressional district that strongly agrees with you on >those issues matters a whit in a Congressional election ? No. But I do claim that their view doesn't mean much in an age in which politics is being replaced by markets. Look. Coercion-based systems like government depend on a power balance tipped far in their direction. They start to break down as individuals and small groups gain levels of power that are more equal to theirs. If we can overturn one of their commands with five minutes of keyboarding, that command can't stand. The stability of past systems was based on the fact that 90% of the population couldn't do anything no matter what happened. They had to stay where they were and grow food or they would starve. It's not hard to rule people in that situation. We aren't in that situation any more. We can move and communicate and buy and sell and the government can't do much about most of it. They depend on our acquiescence and the freedom of communication we have weakens their hold on that acquiescence. DCF

1 0

Re: True random numbers
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, (1) The Centre de Recherches Mathematique is hosting a year-long program in combinatorics and group theory in 1996-1997. The year will be organized around a number of workshops spread throughout the year. Among the workshops: WORKSHOP ON PSEUDORANDOM NUMBER GENERATION 06 03 / 28 96 The CRC's at the University of Montreal. Details: ACTIVITIES(a)CRM.UMontreal.CA or http://www.CRM.UMontreal.CA (2) If you'd like to read RFC 1750, "Randomness Recommendations for Security," but you're too busy to ftp, email mailserv(a)ds.internic net and in the body of the message include the command document-by-name rfc1750 In due time it will arrive in 2 parts. At the end of the 2d part: References [ASYMMETRIC] - Secure Communications and Asymmetric Cryptosystems, edited by Gustavus J. Simmons, AAAS Selected Symposium 69, Westview Press, Inc. [BBS] - A Simple Unpredictable Pseudo-Random Number Generator, SIAM Journal on Computing, v. 15, n. 2, 1986, L. Blum, M. Blum, & M. Shub. [BRILLINGER] - Time Series: Data Analysis and Theory, Holden-Day, 1981, David Brillinger. [CRC] - C.R.C. Standard Mathematical Tables, Chemical Rubber Publishing Company. [CRYPTO1] - Cryptography: A Primer, A Wiley-Interscience Publication, John Wiley & Sons, 1981, Alan G. Konheim. [CRYPTO2] - Cryptography: A New Dimension in Computer Data Security, A Wiley-Interscience Publication, John Wiley & Sons, 1982, Carl H. Meyer & Stephen M. Matyas. [CRYPTO3] - Applied Cryptography: Protocols, Algorithms, and Source Code in C, John Wiley & Sons, 1994, Bruce Schneier. [DAVIS] - Cryptographic Randomness from Air Turbulence in Disk Drives, Advances in Cryptology - Crypto '94, Springer-Verlag Lecture Notes in Computer Science #839, 1984, Don Davis, Ross Ihaka, and Philip Fenstermacher. [DES] - Data Encryption Standard, United States of America, Department of Commerce, National Institute of Standards and Technology, Federal Information Processing Standard (FIPS) 46-1. - Data Encryption Algorithm, American National Standards Institute, ANSI X3.92-1981. (See also FIPS 112, Password Usage, which includes FORTRAN code for performing DES.) [DES MODES] - DES Modes of Operation, United States of America, Department of Commerce, National Institute of Standards and Technology, Federal Information Processing Standard (FIPS) 81. - Data Encryption Algorithm - Modes of Operation, American National Standards Institute, ANSI X3.106-1983. [D-H] - New Directions in Cryptography, IEEE Transactions on Information Technology, November, 1976, Whitfield Diffie and Martin E. Hellman. [DoD] - Password Management Guideline, United States of America, Department of Defense, Computer Security Center, CSC-STD-002-85. (See also FIPS 112, Password Usage, which incorporates CSC-STD-002-85 as one of its appendices.) [GIFFORD] - Natural Random Number, MIT/LCS/TM-371, September 1988, David K. Gifford [KNUTH] - The Art of Computer Programming, Volume 2: Seminumerical Algorithms, Chapter 3: Random Numbers. Addison Wesley Publishing Company, Second Edition 1982, Donald E. Knuth. [KRAWCZYK] - How to Predict Congruential Generators, Journal of Algorithms, V. 13, N. 4, December 1992, H. Krawczyk [MD2] - The MD2 Message-Digest Algorithm, RFC1319, April 1992, B. Kaliski [MD4] - The MD4 Message-Digest Algorithm, RFC1320, April 1992, R. Rivest [MD5] - The MD5 Message-Digest Algorithm, RFC1321, April 1992, R. Rivest [PEM] - RFCs 1421 through 1424: - RFC 1424, Privacy Enhancement for Internet Electronic Mail: Part IV: Key Certification and Related Services, 02/10/1993, B. Kaliski - RFC 1423, Privacy Enhancement for Internet Electronic Mail: Part III: Algorithms, Modes, and Identifiers, 02/10/1993, D. Balenson - RFC 1422, Privacy Enhancement for Internet Electronic Mail: Part II: Certificate-Based Key Management, 02/10/1993, S. Kent - RFC 1421, Privacy Enhancement for Internet Electronic Mail: Part I: Message Encryption and Authentication Procedures, 02/10/1993, J. Linn [SHANNON] - The Mathematical Theory of Communication, University of Illinois Press, 1963, Claude E. Shannon. (originally from: Bell System Technical Journal, July and October 1948) [SHIFT1] - Shift Register Sequences, Aegean Park Press, Revised Edition 1982, Solomon W. Golomb. [SHIFT2] - Cryptanalysis of Shift-Register Generated Stream Cypher Systems, Aegean Park Press, 1984, Wayne G. Barker. [SHS] - Secure Hash Standard, United States of American, National Institute of Science and Technology, Federal Information Processing Standard (FIPS) 180, April 1993. [STERN] - Secret Linear Congruential Generators are not Cryptograhically Secure, Proceedings of IEEE STOC, 1987, J. Stern. [VON NEUMANN] - Various techniques used in connection with random digits, von Neumann's Collected Works, Vol. 5, Pergamon Press, 1963, J. von Neumann. Of course you'd get the 2d edition of Schneier's Applied Cryptography. Something a little different at the introductory level: J C G Lesurf Physics and Astronomy Department University of St Andrews Scotland Information and Measurement Institute of Physics Publishing US Editorial Office The Public Ledger Building Suite 1035 Independence Square Philadelphia PA 19106 1995 ix + 243 ISBN: 0 7503 0308 5 Cordially, Jim

2 2

Re: CDA Yes Votes; Collection
by Duncan Frissell 17 Dec '03

17 Dec '03

At 08:54 PM 2/16/96 -0800, Simon Spero wrote: >So, if the US were to end up with a President Buchanan elected by 25% of >all eligible voters, would you advocate seeking exile, or armed rebellion? Well, few rebelled or left when William Jefferson Blythe Clinton won with 23% of the eligible vote. DCF

1 0

Re: A Cyberspace Independence Refutation
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 2:56 PM 2/18/96 -0500, Duncan Frissell wrote: >At 06:13 AM 2/16/96 -0500, lmccarth(a)cs.umass.edu wrote: >>I'd be interested to see the documentation of the number of peasants in >>the U.S. (or elsewhere) who have done anything like this. Documentation of >>the number of peasants who could manage the technical details would also >>be interesting. > >Actually, it only takes a million or so out of the world population to make >restrictions impossible. That will certainly be achievable. ... My wife attended the World Women's Conference in Hai Rou, China (as staff supporting their Apple computers). She reports that the "killer application" demonstrated there was email. Women in extreemly poor countries of the world were interested in communicating with each other about solving local problems (e.g. Clean water supplies). The demand is there. These people are not stupid. They can learn. I expect to see the village email computer build on "obsolete" donated machines start to become a force in the next century, the same way the village TV and cassette player have played a role in the last decade. Regards - Bill

1 0

[NOISE] Re: CDA Yes Votes; Collection
by tbyfield＠panix.com 17 Dec '03

17 Dec '03

At 3:40 PM 2/18/96, Duncan Frissell wrote: >Well, few rebelled or left when William Jefferson Blythe Clinton won with >23% of the eligible vote. This fact seems to pique you, Duncan, as though it were somehow unjust. If you feel so strongly, maybe you should get out and organize those oceans of people who're waiting to think and vote just like you do. Or is "organizing" too gauche for your finer sensibilities? I'm no fan of the man myself, but he _did_ win. Don't like it? Change it. Ted

1 0