December 2003 - cypherpunks-legacy

Re: Cryptanalysis
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:52 AM 3/2/96, Alan Olsen wrote: >The author has failed to call me back. I do have some serious concerns >about the code. (There is not a single XOR used, except to clear >registers!) I am starting to suspect that it is based on a mathematical >progression based on the numbers 40, 28, 36. I need to spend a bit of time ^^^^^^^^^^ Ah, note that the magic key, 42, is not included. Coincidence, or stupidity? Alan, there is not enough time in the universe to waste it on those who will not learn even the basics. The "author," who I had understood to be a friend of yours (though apparently a more distant relationship is involved), is apparently developing something John Dee would have been proud of. Fortunately for the rest of us, cryptology has moved on in the last several hundred years. I again urge you not to waste your time on this. Or our time. (Trust me, in five or six years, if your friend sticks to his current course, he will announce to the world his "discovery" of the "virtual one time pad" and will be preparing a public stock offering in Silicon Snakeoiltronics.) A few other minor points: >>* The journal "Cryptologia" is largely devoted to amateur cryptanalysis. > >The web info for back issues listed a web page from a publisher that had no >listing for them on the server. I will be sending mail to get more info... Last I checked, Tony Patti was still the editor. Not all things are on the Web in serious ways, obviously. I had no problems finding copies in my local university library (UC Santa Cruz), but it was several years ago that I last checked (conventional cryptanalysis not being very germane and all). Reed College might have copies. >>There are very good reasons to say little about "conventional >>cryptanalysis": it just doesn't matter much with modern ciphers, such as >>public key systems. Modern ciphers don't fall to conventional attacks based >>on word frequency, pattern analysis, etc. > >Still an interesting topic... Perhaps as a hobby, for those who find the NYT crosswords exciting. But of little significance for modern cryptology, except as a cautionary tale. --Tim May THE X-ON CONGRESS: INDECENT COMMENT ON AN INDECENT SUBJECT, by Steve Russell, American Reporter Correspondent....You motherfuckers in Congress have dropped over the edge of the earth this time... "the sorriest bunch of cocksuckers ever to sell out the First Amendment" or suggesting that "the only reason to run for Congress these days is to suck the lobbyists' dicks and fuck the people who sent you there," ....any more than I care for the language you shitheads have forced me to use in this essay...Let's talk about this fucking indecent language bullshit.

1 0

Re: Problems with certificates.
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

jamesd(a)echeque.com writes: >> If if we colonized every planet in the galaxy, and every planet had a >> trillion people, and every single person on every planet generated a billion >> keys a second for a billion billion years, not one pair would match, assuming >> they were generated from truly random seeds. At 03:19 AM 3/2/96 -0500, Perry E. Metzger wrote: >Well, lets see. For a 1024 bit key, a birthday match is a 1 in 2^512 >proposition, assuming that a key could be any random 1024 bit number. >Assuming 100 million planets: > >100000000*(10^12)*(10^9)*60*60*24*365*(10^9)*(10^9)= > 3153600000000000000000000000000000000000000000000000000 >2^512= > 134078079299425970995740249982058461274793658205923933777235614437217\ > 640300735469768018742981669034276900318581864860508537538828119465699\ > 46433649006084096 > >However, the density of prime numbers isn't so high as to make the >probability truly 1/2^512 -- indeed, I would guess it is much >lower. However, you may indeed be right. The number of prime numbers less than n is n/ln(n). Presumably the number of valid PGP keys is somewhat larger. Assume 768 bit PGP keys: The number of randomly selected 768 bit primes that you would need for a reasonable chance of a birthday collision is 1.708E104 Which is 170 800 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 A number substantially larger than 3 153 600 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: PGP to PC mail integration
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:18 AM 2/28/96 -0800, Mike Ingle <inglem(a)adnetsol.com> suggested setting up a VB program on localhost to proxy POP and SMTP requests for PGP, rather than hitting it from the user interface. >Once this is set up, the user burden is near zero, and it works with >any winsock-based mail program. What do you think of the idea? It'd probably be pretty convenient for incoming, though you need to build some mechanism for displaying the PGP output for signatures (since PGP gives you the contents of the signed material when you check the sig.). One interesting security problem is how to distinguish between the message your PGP bot drops in your mailbox containing the message and an indication that the signature is good from a message that someone carefully constructed that _looks_ identical but includes its _own_ indication that the (possibly bad) signature is good. For outgoing mail, you'd either have to sign everything, which may be good, or have a way to tell it the proxy whether or not to sign the mail, and you'd either need to hand it your passphrase each time or take the security risk of leaving an autosigner hanging around listening on a port, just _waiting_ for somebody to lie about where they're connecting from and get your bot to sign arbitrary things..... There are also minor issues if you use multiple keys, which most people probably should. Interfaces between VB and PGP262 are a bit crude - Private Idaho is a good example. The problem is that PGP262 is a DOS program, so you need to POP up a DOS window to run it in, and then make the window go away. PI does that just fine, but it's a bit ugly to watch; it's much cleaner with ViaCrypt's Windows-based PGP. PGP 3.0 will simplify this, since you'll be able to use PGP as a library instead of a hauling up DOS to run it in. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281

1 0

Learning about Cryptography
by eggplant＠inlink.com 17 Dec '03

17 Dec '03

I am interested in learning more about cryptography. Where could I obtain some good, recent books on cryptography for the beginner. -- "... In Germany they first came for the Communists and I didn't speak up because I wasn't a Communist. Then they came for the Jews, and I didn't speak up because I wasn't a Jew. Then they came for the trade unionists, and I didn't speak up because I wasn't a trade unionist. Then they came for up because I wasn't a trade unionist. Then they came for Catholics, and I didn't speak up because I was a Protestant. Then they came for me-and by that time no one was left to speak up..." Pastor Martin Niemoller ************************************************ * * * Matthew Murphy ------------ eggplant(a)inlink.com * * * ************************************************

2 1

Re: Percy the Python loves IPG
by geeman＠best.com 17 Dec '03

17 Dec '03

At 12:44 AM 2/29/96 -0800, you wrote: >At 10:41 PM 2/25/96 -0500, ab411(a)detroit.freenet.org (David R. Conrad) wrote: >>I think the IPG system is great! Percy, my pet python, has never been >>slicker or better lubricated! >:-) > >>IPG Sales <ipgsales(a)cyberstation.net> wrote: >>>Perhaps so, but our system does employ a true hardware generated OTP, and >>>operates similiar to what you describe - however, the important >>>differernce is that we use a small OTP to generate a larger OTP, like >>>stringing the cable across the Golden Gate narrows. > ..removed.. >So please email me the keys to your company; I'll donate 10% of the value >to David's python Percy for extra snake oil. Send me some money to me too, and I'll send you back 10,000 disks with Certified Random Data on them. Getcher One Time Pads here, folks!

1 0

Re: Chaff in the Channel (Stealth PGP work)
by Powers Glenn 17 Dec '03

17 Dec '03

- However, I suspect that the ideal would be like cryptography: - Assume the enemy knows everything about your system but the keys. - Thus, your gifs need to look like normal gifs in the lsb. Your audio - needs to have normal levels of hiss in it. Etc. the problem with many current stego programs (jsteg/stools) is that given a data stream, they will tell you if there is data steg'ed (by the same program, of course) it in. jsteg goes out of it's way to hide it's content-length header, but jsteg can still detect jsteg headers... glenn

3 2

Win a free Apache-SSL-US Commercial license
by sameer＠atropos.c2.org 17 Dec '03

17 Dec '03

See http://apachessl.c2.org/ for more details. Thanks, -- Sameer Parekh Voice: 510-601-9777x3 Community ConneXion, Inc. FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org/ (or login as "guest") sameer(a)c2.org

2 1

Is there any work on entropy-lowering schemes?
by Mutant Rob 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm wondering if anyone has done any work on schemes to lower the entropy of a given stream. Why? Save you've got message M encrypted with a good cipher, but you're worried that it can be detected because even with stego, the entropy is a lot higher than normal 'random' data flowing through a network. So it seems possible to create a scheme that given a key will take a block of n bits and expand it to 1.5n or 2n bits, recoding it in such a way that determining the key is difficult even if one suspects such a scheme has been used... but that using the scheme will make the data look more like the MSBs of graphical data rather than encrypted data. Rob - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMTeaeioZzwIn1bdtAQGNagF/cmAH45G1v1Yt1Bg+7qgZVVnIYdj9EfzV rqzPx7MRyGbVW4HtNWkYjiPxgn2iUQaH =t114 -----END PGP SIGNATURE-----

1 0

Re: PARTY PICTURES!
by stevenw＠best.com 17 Dec '03

17 Dec '03

>> http://www.c2.org/party/masquerade/ > >OK, nice pictures of some interesting-looking people. >But the only globally known participant featured is >Eric Hughes; he is also the only one presented with >a second name. For the others, it would be nice if >you wrote clarifying texts, including crypto-anarchic >relevance, in the way of: [sniperoo] > >Asgaard Maybe it wasn't made clear that all the pictures have been postprocessed with an experimental version of PGP* to optically anonymize them, thus protecting the identies of both the innocent and the guilty without bias. Software problems triggered by Eric's neckware prevented the anonymizing process from working properly in his case. Sources tell me that PRZ himself was in many of the pictures, very nicely rendered as a classic marble and rought-iron fireplace. Steve * PGP = Pretty Groovy Party ------------------------------------------------------------------------- Steven Weller | "The Internet, of course, is more | than just a place to find pictures | of people having sex with dogs." stevenw(a)best.com | -- Time Magazine, 3 July 1995

2 1

Netcom and Credit Cards
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:32 PM 3/2/96, Dr. Dimitri Vulis wrote: ... >(I'd never deal with an ISP who doesn't accept checks or money orders. >And I mean checks, not automatic withdrawals from a checking account.) For the record, Netcom has always accepted personal checks mailed in to them. The credit card debit was offered as a convenience to those who wanted it; it was and remains optional. The "credit card numbers were stolen" point, that I believe Ed Carp was referring to, had to do with the Mitnick affair, and is very old news. I no longer use Netcom as my primary account, but thought some misconceptions needed correcting. I don't plan to debate the merits of Netcom, Mitnick, etc., and will post no more on this topic. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0