December 2003 - cypherpunks-legacy

Re: Known Plaintext attacks on symmertric algorithms
by Bill Stewart 17 Dec '03

17 Dec '03

At 08:09 PM 4/12/96 -0400, you wrote: >Now maybe I have this all wrong, but it is my understanding that a known >plaintext attack is when the cracker knows part of the plaintext of an >encrypted file. Then he/she uses that and runs the inverse of the >algorithm to calculate the key. Some algorithms have usable inverses, but good ones try not to; one class of known plaintext attack is working your way back through the algorithm to discover the key bits using the known parts. Another kind of attack is just to brute-force the key, assuming the algorithm or key length is short enough to do that quickly. > Whether or not I am right about what known plaintext means, isn't the >entirely possible on all of the symmetric algorithms out there? If I >grab a file that I know is, say, a standard credit card transaction >form, and I know what the first 256 bytes are because they are always >the same, shouldn I always be able to find the entire key that >corresponds with those 256 bytes? (assuming the key is 2048 bits or >less) And then with that key decrypt the whole file? Algorithms vary widely on their susceptibility. Consider a one-time-pad: even if you know the first 256 bytes of the transaction, all that does is let you recover the first 256 bytes of key, which will never be used again, even in the second half of the message. Pretty useless, usually. On the other hand, consider a simple "xor with the key, repeating as often as needed"; if the key's no longer than your known plaintext, xor again, find the key, repeat as often as needed, and you've got the whole message. Using the same technique with DES will be left as an exercise for the reader :-) # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215

1 0

Cryptography Forum - Churchill Club
by stevenw＠best.com 17 Dec '03

17 Dec '03

Seen in ba.internet. This may be of interest to people living in the San Francisco area of California. ------------------------------------->8-------------------------------------- Information Security and the 20th Anniversary of Public Key Cryptography Monday, April 29, 1996 Marriott Hotel, Burlingame, CA 5:30 PM Full Dinner 6:30 PM Program Members: $20 Non-members: $35 KEYNOTE SPEAKERS: Senator Conrad Burns (R, MT) Senator Larry Pressler (R, SD) Congressman Robert Goodlatte (R, VA) David Morris, Vice President, Cylink Corp. Jim Omura, Chief Technology Officer, Cylink Corp. James Freeman, Special Agent in Charge, FBI Phil Mellinger, Chief Engineer, Government Securities Assoc. Paul Raines, Project Manager, United State Postal Service Whitfield, Diffie, Martin, Hellman and Ralph Merkle - Pioneers and original patent holders for public key cryptography Economic espionage is costing the nation billions of dollars in lost business every year. U.S. companies are in danger of losing everything from trade secrets and proprietary financial information , to the bottom line figures on contract bills. Three bills are now in Congress to protect government, business and home computer users from outside snooping of sensitive information. These proposed new laws have been written to encourage the use of encryption and loosen export restrictions on encryption technology. Congressman Goodlatte is the author of one of these bills. April 1996 is also the 20th anniversary of the creation of Public Key Cryptography. The three principal pioneers and patent holders will also be present to share their views on the need for strong encryption. Morris of Cylink Corp. will provide an overview of what state-of-the-art security solutions are needed, and available, to truly protect business from unauthorized access. James Freeman of the FBI will discuss the recent study on industrial espionage and Paul Raines from the U.S. Postal Service will talk about electronic postmarking and certificate authority key registry bureau. TO REGISTER: Please call (408) 371-4460 or fax reservations (408) 371-4180 or email chrchllclb(a)aol.com PRESENTED BY THE CHURCHILL CLUB - A NON-PARTISAN FORUM FOR SILICON VALLEY ------------------------------------->8-------------------------------------- ------------------------------------------------------------------------- Steven Weller | Weller's three steps to Greatness: | 1. See what others cannot | 2. Think what others cannot stevenw(a)best.com | 3. Express what others cannot

1 0

Re: questions about bits and bytes
by Alan Olsen 17 Dec '03

17 Dec '03

At 11:34 AM 4/12/96 -0500, Doug Hughes wrote: > >On Apr 12 at 8:07 >jim bell wrote: >> >>Are you sure they're not referring to 8 bits of data and a parity bit? In >>any case, please give the address to the list so that it can be checked out. > >Come on, give it up already and admit you were wrong. At least 8 different >people have cited examples of machines that supported non 8bit bytes. Your >pride is getting the best of you. Jim is unwilling to admit his errors, even in things he has little or no training in. (I remember him claiming at one point that he was not a programmer or did any coding for that matter. Why he continues to persist in such things I will not speculate on...) I have worked on a couple of machines (that are still in use today) that were non-standard bit sizes. Many of the legacy machines from the old mainframe days (about 20+ years ago) had non-standard bit sizes. (Which made communication between then an interesting mess.) The old Microdata PICK machines had a weird byte size, for example. Some of the old Vax machines had the same "difficulty". >If you mean 8 bits, you should really say Octets as has always been the >form of Internet RFC's where the distinction is important. Making the assumption as to the stability of the sizes of bytes, words, and characters can get you into alot of trouble in the coding world. Characters are a good case in point. Depending on your OS and/or language, you could be talking about 5, 7, 8 or more bits. With the need to distribute applications internationally, the need to support all sorts of character schemes makes it even more variable. Unicode is 16 bytes per character. Shift JIS can be variable. (Either 8 or 16, if I remember correctly.) It just depends on the hardware, software, and compiler being used. I am sure that alot of old code is getting broken by the assumption that a character is always 8 bits. Assuming the same about bytes on old machines will do about as much good. >It may be standard today, but it was not always so.. And the standards change. I expect that at some point, some standards group will change all the terms again. (And this argument will flare up again...) --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon

1 0

Re: the cost of untracability?
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 7:42 PM 4/12/96 -0400, E. ALLEN SMITH wrote: >From: IN%"weidai(a)eskimo.com" "Wei Dai" 7-APR-1996 10:52:52.30 > >>I think you're right. There is no need for the issuer to pay explicit >>interest. The easiest way to eliminate signorage would be to steadily >>increase the value of each denomination of ecash. ... > > Another method would be for ecash to have a label on it as to when the >issuer would redeem it. Until then, if you want cash from it, find someone else >to trade to. ... And if you are using a "first to clear gets the money" system like Digicash, the holders can race to see who gets the money. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: "Contempt" charges likely to increase
by jim bell 17 Dec '03

17 Dec '03

At 07:37 PM 4/12/96 EDT, E. ALLEN SMITH wrote: >From: IN%"jimbell(a)pacifier.com" "jim bell" 7-APR-1996 03:10:38.36 >>I think that most crimes that subpoenas would normally be used for are >>probably not crimes at all, and are probably "malum prohibitum," not "malum >>in se" crimes. And in the future, they would likely be used to harass >>political enemies, as harassment was done in the 1950's and 60's. This >>means, for anybody of a libertarian bent, that it would actually be better >>if the government could be rendered incapable of enforcing them. Naturally, >>governments and courts will resist, but that will be irrelevant. > > I would guess that most instances of violations of banking secrecy, >wiretaps, et al fall into this category also. True, I think. For example, 10-20 years from now there will probably be no need anymore for laws against wiretaps, because crypto telephones will become so cheap and ubiquitous that it will be assumed that anybody saying anything "valuable" on the phone will be using good crypto. If that's the case, nobody will even bother doing wiretaps, and nobody will ever lose anything as a consequence of being tapped. There's no point in having a law against a crime that never occurs. Likewise, "banking secrecy" will become a contractural obligation: Nobody who isn't privy to this information will be able to retrieve it. Looked at in this light, laws against victimless crimes can be seen as a last, desperate attempt by government to replace the real crimes which are "lost" to technological developments with placeholders; things the cops can do when nobody needs them. I think it would be reasonable to present so-called "law enforcement" with an ultimatum: "Make yourself obsolete within 10 years or we do it for you." In other words, choose only those crimes which have real victims, and figure out technological ways to either prevent them entirely, or solve then once committed. Jim Bell jimbell(a)pacifier.com

1 0

What can the judge do to me?
by Black Unicorn 17 Dec '03

17 Dec '03

An unnamed cypherpunk asked: > I was just wondering how/if [International Union] fit[s] in with frequent >claim 'the judge can throw away the key' if he wants...... c'punks - I've been involved in a private discussion with a list reader about the extent to which courts can impose contempt fines and sanctions. I thought I would post the results to the list as many have expressed interest in the ways that courts might try to compel production of crypto keys or compel offshore e-cash institutions. The bulk of my answer follows. The key to limiting the ability of a court to summarily enter contempt sanctions has always been the classification of the sanctions. "Criminal" sanctions, may entitle the witness to a trial by jury. "For 'serious' criminal contempts involving imprisonment of more than six months, these [procedural] protections include the right to jury trial. " International Union, United Mine Workers of America, et al. v. Bagwell et al., 114 S. Ct. 2552 (1993)(hereinafter, International Union)(citing Bloom, 391 U.S., at 199; Taylor v. Hayes, 418 U.S. 488, 495, 41 L. Ed. 2d 897, 94 S. Ct. 2697 (1974)). "Civil" sanctions do not require such protections and can be imposed on the spot and without review. "...civil contempt sanctions, or those penalties designed to compel future compliance with a court order, are considered to be coercive and avoidable through obedience, and thus may be imposed in an ordinary civil proceeding upon notice and an opportunity to be heard. Neither a jury trial nor proof beyond a reasonable doubt is required." International Union, supra. The court in International Union also makes a distinction between "direct" and "indirect" contempts. "Direct contempts that occur in the court's presence may be immediately adjudged and sanctioned summarily." International Union, supra. These would certainly include refusing to reveal non-privileged information on the stand, and may include the refusal to reveal the passphrase to a crypto key while on the stand. The court also recognizes that the indefinite confinement option is available to judges. Specifically, "[t]he paradigmatic coercive, civil contempt sanction, as set forth in Gompers, involves confining a contemnor _indefinitely_ until he complies with an affirmative command such as an order "to pay alimony, or to surrender property ordered to be turned over to a receiver, or to make a conveyance." International Union, supra (emphasis added)(citing Gompers, 221 U.S., at 442). See also, McCrone v. United States, 307 U.S. 61, 64, 83 L. Ed. 1108, 59 S. Ct. 685 (1939) (failure to testify). Shillitani v. United States, 384 U.S. 364, 370, n. 6, 16 L. Ed. 2d 622, 86 S. Ct. 1531 (1966) (upholding as civil "a determinate 24 month sentence which includes a purge clause"). My favorite language from the court defining such sanctions is this: "In these circumstances, the contemnor is able to purge the contempt and obtain his release by committing an affirmative act, and thus "carries the keys of his prison in his own pocket." International Union, supra (citing Gompers, 221 U.S., at 442, quoting In re Nevitt, 117 Fed. 451 (1902)). The court goes on: "A contempt fine accordingly is considered civil and remedial if it either 'coerces the defendant into compliance with the court's order, [or] . . . compensates the complainant for losses sustained.'" International Union, supra (quoting United States v. United Mine Workers of America, 330 U.S. 258, 303-304). And, "Where a fine is not compensatory, it is civil only if the contemnor is afforded an opportunity to purge." International Union, supra, (citing Penfield Co. v. SEC, 330 U.S. 585, 590, 91 L. Ed. 1117, 67 S. Ct. 918 (1947)). And on per diem fines, "Like civil imprisonment, such fines exert a constant coercive pressure, and once the jural command is obeyed, the future, indefinite, daily fines are purged." International Union, supra. The court makes a point to justify severe sanctions where testimony is sought, or the proceedings are threatened. "The necessity justification for the contempt authority is at its pinnacle, of course, where contumacious conduct threatens a court's immediate ability to conduct its proceedings, such as where a witness refuses to testify, or a party disrupts the court... [t]hus, petty, direct contempts in the presence of the court traditionally have been subject to summary adjudication, 'to maintain order in the courtroom and the integrity of the trial process in the face of an 'actual obstruction of justice.'" International Union, supra (quoting Codispoti v. Pennsylvania, 418 U.S., at 513 and citing numerous other sources). Most interesting to the crypto crowd: "Contempts such as failure to comply with document discovery, for example, while occurring outside the court's presence, impede the court's ability to adjudicate the proceedings before it and thus touch upon the core justification for the contempt power.... Similarly, indirect contempts involving discrete, readily ascertainable acts, _such as turning over a key_ or payment of a judgment, properly may be adjudicated through civil proceedings since the need for extensive, impartial fact-finding is less pressing." International Union, supra (emphasis added). Hence, International Union preserves very broad contempt sanctions which can be imposed without much review provided they fall into a rather wide "civil" categorization, rather than a "criminal" one. I think it's clear, the court literally spells this out, that holding a witness indefinitely until he complies with court orders is within the discretion of a judge. Compelling through sanctions the production of a "key" (though I'm not sure a crypto key is directly contemplated) is likewise clearly permitted. --- My preferred and soon to be permanent e-mail address:unicorn@schloss.li "In fact, had Bancroft not existed, potestas scientiae in usu est Franklin might have had to invent him." in nihilum nil posse reverti 00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information

1 0

PGPCrack
by Mark M. 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have written a UNIX program that will brute-force crack a PGP conventionally encrypted file using a dictionary of passphrases. I am working on making it possible to break secret keys also. If you have any suggestions or bug reports, feel free to e-mail them to me. The URL is: http://www.voicenet.com/~markm/pgpcrack5b.tar.gz The MD5 hash of this file is 46aa9e37020ac2efce73d870fe1acbdc. - -- Mark =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= markm(a)voicenet.com | finger -l for PGP key 0xf9b22ba5 http://www.voicenet.com/~markm/ | bd24d08e3cbb53472054fa56002258d5 "The concept of normalcy is just a conspiracy of the majority" -me -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: noconv iQCVAwUBMW6j0LZc+sv5siulAQETGAQAnKr1n/OnWS6CpQqTQSRAJhTTCkq1zP8N l0QZYKrvO9i3EE0uXYF88EIXludrXq2mzEZCOeh4vjF0Ym8KEc82gUdRwAfxPxTU YxHylDI56PdvgLwRBAoBiGTaUZwajM+sEtvJaH1fYshPR7neTF+Aw3YL+cMQ/iQt PMFKXEM9GWQ= =fgA8 -----END PGP SIGNATURE-----

1 0

Re: Protocols at the Point of a Gun
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 11:48 4/11/96, Timothy C. May wrote: >As required by the CDA (Competency Disclosure Act) my Ignorance bit is set >to "1" for this speculation. > >At 11:03 PM 4/10/96, Lucky Green wrote: > >>If my computer creates the IP packet, what is there to prevent me from >>modifying the value of the "Minor/Adult" flag at my leisure? > >Are the "minor/adult" settings (and Christian/Atheist, Southern >Baptist/Reformed Baptist, Creationist/Evolutionist, etc. bits) even be >proposed to be set at the IP packet level? Yup. Sen. Exon and this staff demand that IP be redesigned to include such a flag. No doubt, we'll soon hear about demands to include a male/female flag, a cast flag (there go another two bits), a flag for meat eater/vegetarian, a flag indicating your HIV status, one they get going, the sky is the limit. >I'd've thought it would be at the message level, such as this message or a >posting to Usenet. (Granted, many messages are presumably the same as IP >messages. But I'd assume that the setting would be within the message, so >that any forwarder of the packet would not be likely to tamper with >internal message settings....) Sure. Access control belongs into the application layer, or somewhere nearby. The problem is that those in power wouldn't know a modem if it bit them in the ass. Expect legislation that mandates routers to support the various flags in the near future. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: No matter where you go, there they are.
by Paul_Koning/US/3Com%3COM＠smtp1.isd.3com.com 17 Dec '03

17 Dec '03

>While we may disagree with Ms. Denning on a number of political matters, >she's quite intelligent; I suspect the paper is well-founded. Yes, that was my initial reaction too, but the content just don't support that. I suspect this is a case of a person well-qualified in one area (crypto) working in very different area (GPS) where she is not qualified and does not understand what is going on. >GPS receivers are line-of-sight only; only a small portion of the earth can >see the same satellites. Well, sort of. The satellites are up at 11,000 miles, which makes for a large footprint. You'd certainly see most of the same satellites from several states away. >It might be possible to seperately record the signals from several >different satellites, delay them each just the right amount of time, and >then recombine them to simulate being at another nearby location (within >several hundred miles). Right, that's what several of us have been saying. >However, this might not be possible. Examine the >following quote from Denning's paper: > >:The location signature is virtually impossible to forge at the >:required accuracy. This is because the GPS observations at any given time >:are essentially unpredictable to high precision due to subtle satellite >:orbit perturbations, which are unknowable in real-time, and intentional >:signal instabilities (dithering) imposed by the U.S. Department of Defense >:selective availability (SA) security policy. Sure, but that is nonsense. Here's why. The time delay you need to introduce a 200 mile shift is 1 ms. The effects Denning et al. are talking about are LOW FREQUENCY effects. This is obvious for orbital perturbations, since we're talking about small motions of large heavy objects here, and it is also true for the S/A dither. Indeed it has to be that way, since any high frequency jitter would prevent the receiver from locking on the spread spectrum code that's at the core of how GPS works. In other words, at the millisecond level, none of those effects exist. Re Hal's comments: >Note however that Denning did not mention the Internet in her spiel. > >I believe her method would be workable across lower latency networks, if such >exist or eventually exist. Perhaps direct connections or leased lines would >provide low enough latency; I don't know. In any case networks are likely >to become faster in the future and her method might eventually work. >Actually the issue is not just latency but whether the latency can be >lied about, and for some kinds of networks that would be harder. What a checking system actually observes is: at time T2 it receives a message that claims to have been generated at time T1 by a system at location X. It would accept the authentication as valid if the elapsed time T2-T1 is small enough to be believable. How small this is depends on (a) the transmission latency, (b) the processing delay in X and in the checker. There are two flavors of attack on this: 1. Attacker Y uses the real-time signals from the satellites, delayed as needed. It sends those after processing, just as X would have done (except that X doesn't insert the processing delay). The elapsed time seen by the checker differs from the case of X by the sum of the processing delay and the incremental transmission latency (since Y is at a different place than X, so its connection to the checker may have either less or more latency). This fools the checker if the incremental latency is within its tolerance. Suppose that I'm using a LAN -- in that case a transmit delay on the order of 1 ms is plausible. X and Y would be about the same (of course it has hard for Y to get on the LAN unobserved...). If X is less than 20 miles away, the processing delay is under 100 microseconds, which is "in the noise". If I'm in a WAN, then the latency is likely to be greater, but even if is is 1 ms, I can be many miles away before it becomes obvious. The above of course assumes that the signal processing is done in hardware (or fast DSP) so it can indeed be done in well under 1 ms. Not a big deal... That seems to be one Denning mistake, the thinking only of replay in the sense of long delayed spoofing messages. 2. Attacker Y synchronizes to the satellites but constructs a signal locally that effectively "anticipates" what the satellite is about to send. This allows it to get the effect of a negative delay (thus avoiding the "node in the ground" problem). Since the signal is entirely predictable at the few-ms level, this is not difficult, though it requires a bit more effort than the simple delay approach. This way Y can construct a signal acceptable to the checker, even if its transmit latency to the checker is greater than it is for X. It simply anticipates by the difference plus whatever it needs to fake the position. Finally... As Hal also pointed out, if the system allows users to have partial sky view, then the attacker can avoid the need for negative delays entirely by selecting satellites closer to him than to the legitimate user. For anyone interested in an intro to GPS, Trimble (one of the leading companies in the industry) puts out some skinny paperbacks with nice clear explanations. They sometimes are a bit at the "see Spot run" level, but they do have the correct story. paul !----------------------------------------------------------------------- ! Paul Koning, NI1D, C-24183 ! 3Com Corporation, 1-3A, 118 Turnpike Road, Southborough MA 01772 USA ! phone: +1 508 229 1695, fax: +1 508 490 5873 ! email: paul_koning(a)isd.3com.com or paul_koning(a)3mail.3com.com ! Pgp: 27 81 A9 73 A6 0B B3 BE 18 A3 BF DD 1A 59 51 75 !----------------------------------------------------------------------- ! "Be wary of strong drink. It can make you shoot at tax collectors ! -- and miss!" ! -- Robert A. Heinlein, "The Notebooks of Lazarus Long" ! in "Time Enough for Love"

1 0

Re: Scientologists may subpoena
by me＠muddcs.cs.hmc.edu 17 Dec '03

17 Dec '03

Scott Binkley writes: > What if we set up a chaining remailing system in as many countries as > possible, all working in double blind > mode. You could have it randomly pick 20 or so remailers before actually > sending the message to its destination. > > That isn't a very clean method, but would sure slow down the process of > obtaining court orders in each respective country. This is true. We definitely could use more remailers outside the US. Especially since we all know that if you have enough money, you can get away with murd^H^H^H^Hanything in this country,possibly even getting access to remailer records. > I have this other idea, but it would be difficult to set up. Again, with > many many remailers, you could set it up, so that > any message you send is sent to a random FTP site of the day. Each of > the remailers randomly picks messages out > of the pool at the FTP site, and sends it on its way (all is encrypted of > course). At the end of the day, the FTP site is > erased, and a new one is set up somewhere else (all remailers would then > scan there). > > The beauty is that when a remailer pulls a message out of the FTP site, > it has no idea where the message came from, nor which > remailer (country) sent it there (providing the pooled messages have had > the return addresses removed). This would make it > very difficult to track down to the source. > > The disadvantage is that it requires cooperation between remailers, and > that a message cannot be replied to. Some of the cypherpunk remailers already sort of do this. However, the only thing it really does is make it a little harder to do traffic analysis. The main problem with your scheme is that all of the remailers would have access to the final destination of the message. The best method is still to use a randomly selected group of remailers for each anonymous message, and change your reply block on your nym often. me -- Michael Elkins <me(a)cs.hmc.edu> http://www.cs.hmc.edu/~me PGP key fingerprint = EB B1 68 32 3F B5 54 F9 6C AF 4E 94 5A EB 90 EC

1 0