December 2003 - cypherpunks-legacy

Cost of brute force decryption
by Bruce M. 17 Dec '03

17 Dec '03

Windows NT Magazine ran an article in their May 1996 issue titled "Secure Enterprise Email - How Safe is Your Mail System" that goes into matters of keeping company email private. PGP and other means of encryption are mentioned along with the following: "If you can ensure secrecy either until no one cares about the information or so that cracking the code costs more than the information is worth, it's 'secure enough.' "For example a 40-bit key takes about $10,000 worth of supercomputer time and two weeks to crack. Although this key may be adequate to protect my checking account, it's probably not large enough for the accounts of a major corporation. "A slightly longer key of 56 bits requres millions of dollars to crack and should protect the information for years to come. A 56-bit encryption key has 2^56-or 72 quadrillion-possible keys. With 1,000 computers, each trying 1,000,000 keys per second, trying them all would take 833 days. On average, you find the key halfway through your search. I was curious as to what type of formula was used to determine these figures since it wasn't mentioned in the article. Obviously, the speed of the computers, method of cracking and other such factors would be important to know. Could anyone shed some additional light on this for me? Thanks. Bruce M. * brucem(a)feist.com ~---------------------------------------------------~ "Knowledge enormous makes a god of me." -- John Keats

1 0

Asendmail yet again
by Ben Holiday 17 Dec '03

17 Dec '03

Ok so it isnt really and truely available. The right URL should have been: http://www.cyberpass.net/~ncognito If that still isn't right then im gonna assume that god is giving me a hint and go shoot myself in the head. Adios.

1 0

How to explain crypto?
by declan＠well.com 17 Dec '03

17 Dec '03

Brock, the crypto-challenged, humbly apologizes for his gaffe. He was looking for a way to draw an understandable comparison of how much harder a 1024-bit implementation of RSA is to break than what current export controls allow. He's asking for suggestions on how in future articles he could word this so a layman could understand it... Preferably something that could be said in a few sentences. (Brock cops to the fact that it does an incredible disservice to a complex topic. Remember, tho, he writes for a broad audience with a way diverse range of understanding -- or misunderstanding, as the case may be!) For example, someone sent me this explanation: "The 1024 bit key is likely an RSA key, and is not comperable to a 40 bit symetric key. From memory, 1024 bit RSA is about as hard to crack as 90 bit symetric." Is this a reasonable comparison? -Declan

3 2

Re: Java Crypto API questions
by jim bell 17 Dec '03

17 Dec '03

At 11:52 PM 6/3/96 -0700, Lucky Green wrote: >At 16:22 6/3/96, jim bell wrote: > >>A signature is just that: A signature. It doesn't encrypt or decrypt. It >>doesn't even ALLOW the system it's in to encrypt or decrypt, because there >>are numerous encryption programs written that have no need for such a >>signature. If no program existed which _used_ that signature, nobody would >>think twice about exporting it. >> >>The fact is, it is LEGAL to import encryption code into the US. It is LEGAL >>to generate an hash of that code, and it is LEGAL to export that hash. To >>believe otherwise is to broadly expand the scope of export laws far beyond >>what they were intended to mean. > >First, the ITAR are not laws, but regulations. Second, there are many that >believe that applying ITAR to crypto software is already expanding the >scope of the regulations far beyond what they were intended to mean. I agree. Which is why I think any acquiescence by Microsoft on the subject of exportability of signatures is wrong. Let the government press its case, if it wants to try. Don't assist it, even rhetorically. Jim Bell jimbell(a)pacifier.com

1 0

Re: NYT on NTT/RSA Chips
by jim bell 17 Dec '03

17 Dec '03

At 10:54 AM 6/4/96 GMT, John Young wrote: >Connecting Declan's three dots [...]: > The New York Times, June 4, 1996, pp. D1, D4. > Japanese Chips May Scramble U.S. Export Ban > By John Markoff > Washington, June 3 -- The Nippon Telegraph and Telephone > Corporation has quietly begun selling a powerful data- > scrambling chip set that is likely to undermine the Clinton > Administration's efforts to restrict the export of the > fundamental technology for protecting secrets and commerce > in the information age. > An executive at NTT America said that although there were > no restrictions on the export of cryptographic hardware or > software from Japan, his company was still anxious to > obtain software from RSA Data to use in its chips. That > software is still controlled by United States export law, > he said. Maybe it's just me, but the solution to NTT's problem is obvious. Even assuming that the export of this software would be against the law, why doesn't somebody simply violate that law? RSA would publish that software, possibly encrypted with NTT's public key, on a public system protected against direct export. "Somebody" would download it, write it to a floppy (taking care not to leave any fingerprints, and wetting both the stamp and the envelope with tap water, rather than licking them) and mail that floppy off to NTT in Japan. (Naturally, you don't put a return address on that envelope. The truly paranoid would first take that floppy to some store's PC section, and cross-load the data onto a floppy written by some other floppy drive.) NTT finds that envelope in their mail, opens it, reads the floppy, decrypts the data, and say, "Wow! It's the data we wanted to get!" It verifies that the data is valid by emailing a copy back to RSA in America, who say, "Amazing! Somebody has illegally exported our software!" As far as I know, there is nothing wrong with NTT using this software even if it is assumed to have been exported illegally. Obviously, NTT won't _ask_ for somebody to do this, because then the government will claim it was all a conspiracy, but that doesn't prevent NTT from being the beneficiary of somebody else's activities. Jim Bell jimbell(a)pacifier.com

2 1

Export what's imported
by jim bell 17 Dec '03

17 Dec '03

Recently, Senator Burns introduced that bill, S.1726, "ProCode." Part of it had to do with changes in the export laws to allow export of things that are currently not allowed. It occurs to me that this bill should be amended to say, explicitly, that any object or software which has ever been imported into the US can be legally exported. (Including multiple copies of software.) It is particularly important that we do this now that the NTT encryption chip set has been announced. Why? Well, first, we CAN easily justify this. The claim for export controls is that they restrict the access of encryption to various of the horsemen, out there. But by definition anything which has ever been imported is already available outside the US, so it'll look rather silly if they try to control somebody from export that came from out of the country. What are the benefits? Maybe it'll destroy the entire crypto-export-regulation system. Domestic software companies can simply set up a practice of buying all their crypto expertise from overseas. If this happened over the long term this would be bad, but it won't because within a couple of years good crypto will be exported by American manufacturers based on foreign designs. Pretty soon the export bans will become meaningless (even more so than they are today) and the pressure to remove the last restrictions will be enormous. Jim Bell jimbell(a)pacifier.com

1 0

Re: (VTW) BillWatch #48
by jim bell 17 Dec '03

17 Dec '03

At 10:17 AM 6/4/96 -0400, Carl Ellison wrote: >I was at the EPIC conference yesterday (6/3) -- where Whit Diffie, BTW, presented the same argument Steven Cherry gave in this BillWatch -- but at the end of the EPIC conference we had Scott Charney of DoJ on a panel about what the OECD is doing (pushing Clipper internationally) and we kept going round with him on the administration's pushing of Clipper (N). [One attendee described this as "forum shopping" -- looking for a friendly place to push Clipper.] > >There were people battling him over his alleged representation of the USA at the OECD -- claiming he was misrepresenting the country by pushing Clipper. His response was that the Executive is empowered to do all international meetings/negotiations/.... > >After the meeting ended it hit me what the problem is and I mentioned it to PRZ. We're complaining that the Executive has gone rogue -- is disobeying the will of the people. PRZ likened it to Nixon's war in Cambodia. I have a solution to that problem. Jim Bell jimbell(a)pacifier.com

1 0

Re: FOR WHOM THE BELL TOLLS
by jim bell 17 Dec '03

17 Dec '03

At 12:30 PM 6/4/96 -0700, Sandy Sandfort wrote: > Carl Ellison wrote: >>After the meeting ended it hit me what the problem is and I >>mentioned it to PRZ. We're complaining that the Executive >>has gone rogue -- is disobeying the will of the people. >>PRZ likened it to Nixon's war in Cambodia. > > Jim Bell replied: > >>I have a solution to that problem. > >My question for member of this list is: When Bell finally >goes too far and they arrest or shoot him, how can we best >capitalize on his martyrdom? Or in a more negative light, >what damage control will we need to do in that case? >Now I know that barking dogs rarely bite, but Jim may just >fool us and find his cajones. In any event, the sort of >yapping he is doing could itself be considered a crime that >could attract the sort of negative attention he apparently >craves. If there is any doubt that we _need_ a system to rid us of these sleazy politicians: I just saw tonight's PBS McNeil news hour, and they had two politicians on, one of which was promoting a re-emergence of the "Star Wars" missile defense system, which even under optimistic scenarios would cost hundreds of billions of dollars. My solution is simpler and far less expensive: Target any political or military person at any level who is directly or indirectly in control of any offensive missile system (nuclear or otherwise), killing off as many as it takes until they cry "uncle" and destroy all of that hardware. Probable cost of this persuasian? A few hundred million dollars, at most. Who is committing the crime, here? Maybe, someday, you'll start really LISTENING to what I have to say. ObCrypto? Your motivations are quite opaque. Maybe we can turn them into a cryptosystem? Jim Bell jimbell(a)pacifier.com

1 0

Info on DES crypto program
by vinnie moscaritolo 17 Dec '03

17 Dec '03

Hey all; Does anyone have experience or comments about a product called Code Cryptor from New Mexico Software. I belive it is yet another DES based product. tey have a web page at: http://www.swcp.com/cryptor/ "Rah's Samoan Attorney" Vinnie Moscaritolo ------------------ "friends come and friends go..but enemies accumulate." http://www.vmeng.com/vinnie/ Fingerprint: 4FA3298150E404F2782501876EA2146A

2 1

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

1 0