December 2003 - cypherpunks-legacy

rsync and md4
by Andrew Tridgell 17 Dec '03

17 Dec '03

I've recently released a package called rsync that uses a checksum search to provide very efficient file update over a slow link. (see ftp://samba.anu.edu.au/pub/rsync if you are interested) Now I'd like to calculate some probabilities of failure of the algorithm. The fundamental thing I need to know to do the calculation is the probability of a random piece of data of length n having the same md4 checksum as another given piece of data of the same length. A first guess might be 2^-128 but I know that this sort of thing is rarely that simple. Is md4 that good? Note that I am not interested in "attacks" on md4 as such as the source of the random data is just another file provided by the same user, so it won't have been specially designed to defeat md4. If the probability is within a few orders of magnitude of 2^-128 then can I also be sure that if I only use the first b bits of a md4 checksum it will be within a few orders of magnitude of 2^-b ? There is an option in rsync to use a shorter checksum by truncating md4. This saves some bytes on the link at the risk of lowering the confidence. Why md4? I chose md4 because it seemed to be the fastest of the reputedly strong, publicly available checksum algorithms. Suggestions for alternative algorithms are welcome. Cheers, Andrew

2 1

Re: News: NEC has encrypted networks ...
by jim bell 17 Dec '03

17 Dec '03

At 10:52 PM 6/28/96 -0400, Declan B. McCullagh wrote: >Excerpts from internet.cypherpunks: 28-Jun-96 News: NEC has encrypted >net.. by Ernest Hua(a)XENON.chromat >> Japanese companies catching up and passing American companies >> should scare those Congressional critters into action: > >Realistically, there's not a chance in hell Pro-CODE will pass this >session. >-Declan Which reminds me... About that NTT chip: While I haven't been looking particularly carefully for it, I haven't noticed an announcement in any of the electronics magazines I normally read. Has anyone seen a reference to it? I think we ought to learn more about it: Does it implement an open standard, so that other manufacturers can build compatible phones? Jim Bell jimbell(a)pacifier.com

1 0

www hacking?
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

I havent seen much in lines of this being a problem yet..although I was reading through practical unix security (newest edition) and it made mention of the danger of hacking WWW. Forgive my ignorance on this.. but what dangers are there? I could see someone attacking the main server and do damage in that sense..but Im a little outdated in this as far as what is attacked. The only thing Ive ever had to worry about was unix, now theres oh-so much more. If someone could tell me the dangers of someone attacking someones site..etc..on the WWW, I would much appreciate it! Thanks Adam

2 1

unsuscribe
by ryans＠worldchat.com 17 Dec '03

17 Dec '03

unsuscribe

2 1

mocking paranoia
by nelson＠crynwr.com 17 Dec '03

17 Dec '03

Earlier, someone mocked someone else for being paranoid. Sorry, but this is a mistake. By definition, you have a non-empty threat model when you set out to encrypt; therefore you must be paranoid to use encryption. Or else they really *could* be out to get you, but sometimes it's not possible to tell, and you have to assume that they are. -russ <nelson(a)crynwr.com> http://www.crynwr.com/~nelson Crynwr Software sells packet driver support | PGP ok 521 Pleasant Valley Rd. | +1 315 268 1925 voice | Corporations persuade; Potsdam, NY 13676 | +1 315 268 9201 FAX | governments coerce.

1 0

Open letter to the NSA
by nelson＠crynwr.com 17 Dec '03

17 Dec '03

You screwed up, guys. If, instead of restricting the export of strong crypto systems, you had instead encouraged it, you would have prevented the development of foreign crypto expertise. Look at South Africa: we banned them armaments, so they created their own arms industry. Now they're a serious arms exporter. You won in the short-term and lost in the long-term. Where is the wisdom needed to admit your mistake? Missing, I'd say. -russ <nelson(a)crynwr.com> http://www.crynwr.com/~nelson Crynwr Software sells packet driver support | PGP ok 521 Pleasant Valley Rd. | +1 315 268 1925 voice | Corporations persuade; Potsdam, NY 13676 | +1 315 268 9201 FAX | governments coerce.

1 0

Re: rsync and md4
by jim bell 17 Dec '03

17 Dec '03

At 01:50 PM 6/29/96 +1000, Andrew Tridgell wrote: >Why md4? I chose md4 because it seemed to be the fastest of the >reputedly strong, publicly available checksum algorithms. Whatever you do, PLEASE stop using the term "checksum" when what you really mean is CRC, hash or something else. A "checksum" is a bad error checker, only somewhat better than none at all. If you use the term "checksum" some neophyte might actually misinterpret what you're doing and implement a real, honest-to-goodness checksum in his next program. Jim Bell jimbell(a)pacifier.com

1 0

Re: RFD: Developing Nations and crypto (based on excertp from Edupag
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 09:48 AM 6/26/96 -0700, Timothy C. May wrote: > Sadly, most developing countries (Third World, LDCs, whatever) have > repressive governments of various stripes...few are libertarian. Several > have embraced computer technology, but primarily as an instrument of social > control. This is true, but basically back to front. Certain common forms of repressive economic policy cause poverty. From time to time political convulsions change this policy for a long period. If the period is several decades, development follows. In the past, popular support for these repressive policies was vast and overwhelming, and once in place they could only be changed by fairly murderous dictatorships, for example South Korea and Chile. Popular support for these policies is still substantial, but has steadily diminished. In my opinion this diminishing support is largely the result of improved international communications. When people in poor countries discover that their social order is radically different from that in similar rich countries, they are apt to vote for institutions similar to those in the rich country -- the JR Ewing affect. In short, the third world it has become considerably easier to create liberty without the need to massacre real, suspected, and imaginary communists. >Singapore is an example of a country that jumped from former colonial >status, surrounded by relatively poor (GNP) countries, to the "Information >Age." And what is the result? What our own Sandy Sandfort dubbed >"Disneyland with a Death Penalty." No spitting, no cursing, no long hair, >no "Wall Street Journal," no pornography, no Internet free access, no >dissension. And smartcards track the movements of all Citizen-Units. Not an >encouraging example. > >As for the comment that "they aren't bogged down in older ways of doing >business, communicating, etc." Well, some of these "older ways" include: > >- concepts about the ownership of property and transfers of title > >- contracts, and the ability to make and enforce them > >- understanding of the Uniform Commercial Code (the descendent of the "Law >Merchant" which Western societies have embraced for centuries) > >- a stable middle class, solid educational facilities, and a tradition of >business and technical achievement > >(These are all things which are missing in many Third World countries, for >whatever reasons. Even in many Second World countries, such as the former >U.S.S.R., and these lacks are making the development of modern economic >systems problematic.) > >Certainly some small nations--perhaps island nations--can essentially jump >directly to an "information based economy." The Cayman Islands and several >other examples come to mind. > >I find it harder to believe that a _large_ nation is likely to make such a >transition. > >--Tim May > >Boycott "Big Brother Inside" software! >We got computers, we're tapping phone lines, we know that that ain't allowed. >---------:---------:---------:---------:---------:---------:---------:---- >Timothy C. May | Crypto Anarchy: encryption, digital money, >tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero >W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, >Licensed Ontologist | black markets, collapse of governments. >"National borders aren't even speed bumps on the information superhighway." > > > > > --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

fbi botches intel "ecspionage" case
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

"economic espionage" (ecspionage?) is in full swing as being promoted as the new bogeyman to justify spending billions of dollars to our intelligence agencies, both military and the FBI. we already have a very good example where this has backfired. I was watching Nightline on Tues night or so in which there was info about how the FBI helped get an informant into Intel in a *very* sensitive position, where he was able to film the pentium chip plans. he said he sold them, as I recall, to iraq, syria, china, etc. at the end of the show, the reporter stated that the FBI was seeking stronger laws against theft of "intellectual property" in congress that might solve the problem. there was much lamentation over the fact the criminal in question only got about 33 months of prison time or something. the FBI emerged with great egg on their face. I would say if anyone wants to ridicule them for getting into covering "ecspionage" cases, this is a prime candidate case. is this what they are aiming for? heh, heh. == somehow we have missed a good public debate about ecspionage in the country. there were a few NYT editorials, but it is clearly being used as a very major aspect of promoting the new post-cold-war spy and intelligence strategy without almost any notice by major analyists. I was thinking about all the objections I had to the FBI ecspionage treatment that were never raised on the program: 1. there was an implicit assumption that merely having the plans to the chip would allow other countries to somehow slaughter us in economic competition. but INTEL has spent billions of dollars on physical infrastructure without which the plans are virtually useless. it would take other countries years to get the kind of equipment necessary to produce the pentium, by which it might actually be yesterday's technology that no one cares about any more. 2. we have a tradition of separation of church and state in this country, and also separation of the public government and private industry. suddenly we have the FBI saying they want to infiltrate companies to deal with economic espionage. well, these companies have their own policy, and what do they gain by having a government agency working inside them? in the above case I note, it led to exactly the *opposite* of what was intended: the theft of *highly*sensitive* plans by an FBI mole. 3. hence, one wonders if the FBI could do a better job of combating ecspionage than companies are already doing, or if they are just going to botch it as has already been spectacularly proven in this case. 4. we could have companies that are run like the NSA to prevent "theft of information" (in quotes because I wonder if this will be considered a crime in future decades, just as heresy and blasphemy were once considered crimes a long time ago but no longer are today). however, we have the old "openess vs. security" catch-22. we can't have technological development without some degree of openess. 5. what is "intellectual property"? I think a very good case can be made that there isn't really any such thing, that the term itself may be thought in the future as something like an oxymoron. there is a big red flag going up here: why do we need all kinds of laws to combat this? is it really a problem? can anyone actually point to a very sinister situation in which massive amounts of cash were lost by a company due to ecspionage? as the steve jackson games incident proved, companies are liable to vastly exaggerate their losses to the point of fantasy. they have a tendency to think that "their information" is worth hundreds of thousands of dollars when it may actually be freely legally obtainable. if someone else can give more info on this case (apparently a book is coming out about it or something) including the guy's name, I'd appreciate it, I didn't take any notes so this is a bit fuzzy.

4 3

Re: mocking paranoia
by Cerridwyn Llewyellyn 17 Dec '03

17 Dec '03

At 05:58 AM 6/29/96 nelson(a)crynwr.com wrote: >Earlier, someone mocked someone else for being paranoid. Sorry, but >this is a mistake. By definition, you have a non-empty threat model >when you set out to encrypt; therefore you must be paranoid to use >encryption. Or else they really *could* be out to get you, but >sometimes it's not possible to tell, and you have to assume that they >are. heh... "just because you're paranoid doesn't mean they're not after you."

1 0