December 2003 - cypherpunks-legacy

Re: rsync and md4
by jim bell 17 Dec '03

17 Dec '03

At 01:19 PM 6/29/96 -0400, Mark M. wrote: >> A first guess might be 2^-128 but I know that this sort of thing is >> rarely that simple. Is md4 that good? > >2^-64. >> >> Note that I am not interested in "attacks" on md4 as such as the >> source of the random data is just another file provided by the same >> user, so it won't have been specially designed to defeat md4. >> >> If the probability is within a few orders of magnitude of 2^-128 then >> can I also be sure that if I only use the first b bits of a md4 >> checksum it will be within a few orders of magnitude of 2^-b ? There >> is an option in rsync to use a shorter checksum by truncating >> md4. This saves some bytes on the link at the risk of lowering the >> confidence. > >The probability of failure is 2^-(b/2). I don't think that's correct. That would be the correct formula if I were looking for two strings that happened to have the same hash value, but that's not what he's asking for. Jim Bell jimbell(a)pacifier.com

1 0

John Grubor and you
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Lucifer Remailer Operator wrote: >Just for the record, I am NOT John Grubor and had never even heard of him >before I did an Altavista search on his name earlier today. The concept that >some net.loon like Grubor would get another account with DHP to run an >anonymous remailer for whatever reason is LAUGHABLE. From what I have read, >Grubor spams newsgroups quite often, something I have not done nor plan on >doing. I was expecting people to be posting paranoid rantings about how I >am obviously a SPOOK... Why you were expecting people to be posting paranoid rantings if you did not even know who Dr. John Grubor, undercover police agent, was?

2 1

No Subject
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

declan(a)well.com (Declan McCullagh) spake thus and so: >WASHINGTON, DC -- With no fanfare and no hype, the Justice Department >yesterday faxed a 39-word statement to Senator Exon saying they will >appeal their loss in the Philadelphia case. > >The consolidated lawsuits of ACLU v. Reno and ALA v. DoJ resulted in a >victory for the plaintiffs earlier this month after a three-judge panel >granted a preliminary injunction preventing the DoJ from enforcing the >Communications Decency Act. Sounds like a case of "political testicles in a vise." This smells like an election-year maneuver so the Clinton administration can maintain its faade. (After all, who wants to be called "soft on the protection of children"?) By the time it's finally settled, the Congresscritters will have been re-elected and can go merrily back to perverting the Constitution. So how'd we wind up having to choose between *these* two yahoos for President? :-)

1 0

PC-ness of nym.alias.net
by Rich 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Fri, 28 Jun 1996, Anonymous wrote: > I would appreciate any information members may have regarding the > security/safety of the new nym server nym.alias.net (in "alpha" state) who > posted here about 3 weeks ago. Nym.alias.net reportedly is the same > machine as anon.lcs.mit.edu. > > Specifically, is the individual running the nym _known_ to cypherpunks, or > is this an unknown about whom I should have serious doubts. I could tell you who it is, but then I'd have to kill you. So let's just stick to publicly available information. According to the root DNS servers, which as we know are controlled by a ZOG defense contractor, alias.net is an alias for alpha.jpunix.com, and anon.lcs.mit.edu is indeed the same as nym.alias.net. alias2-dom is said to get name service from Sameer and company, but that could be a trap. Obviously, they've infiltrated pretty deep, but thanks to you, we know to be careful. Then again, this could just be FUD from another Fucking Statist. Who knows? Somewhat more seriously, wouldn't it be nice if the various remailers signed each other's keys? - -rich -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMdScnJNcNyVVy0jxAQEwFQH/ZXv+9Nj5ZDjk5FpA33T+kw68H39p/SuW Ab/hRfGGkZX97PIa50C7UVu4YROYE9RYcn7kalsZgFKOsJKAq3JKIw== =1CQg -----END PGP SIGNATURE-----

2 1

rsync and md4
by Andrew Tridgell 17 Dec '03

17 Dec '03

I've recently released a package called rsync that uses a checksum search to provide very efficient file update over a slow link. (see ftp://samba.anu.edu.au/pub/rsync if you are interested) Now I'd like to calculate some probabilities of failure of the algorithm. The fundamental thing I need to know to do the calculation is the probability of a random piece of data of length n having the same md4 checksum as another given piece of data of the same length. A first guess might be 2^-128 but I know that this sort of thing is rarely that simple. Is md4 that good? Note that I am not interested in "attacks" on md4 as such as the source of the random data is just another file provided by the same user, so it won't have been specially designed to defeat md4. If the probability is within a few orders of magnitude of 2^-128 then can I also be sure that if I only use the first b bits of a md4 checksum it will be within a few orders of magnitude of 2^-b ? There is an option in rsync to use a shorter checksum by truncating md4. This saves some bytes on the link at the risk of lowering the confidence. Why md4? I chose md4 because it seemed to be the fastest of the reputedly strong, publicly available checksum algorithms. Suggestions for alternative algorithms are welcome. Cheers, Andrew

2 1

Re: News: NEC has encrypted networks ...
by jim bell 17 Dec '03

17 Dec '03

At 10:52 PM 6/28/96 -0400, Declan B. McCullagh wrote: >Excerpts from internet.cypherpunks: 28-Jun-96 News: NEC has encrypted >net.. by Ernest Hua(a)XENON.chromat >> Japanese companies catching up and passing American companies >> should scare those Congressional critters into action: > >Realistically, there's not a chance in hell Pro-CODE will pass this >session. >-Declan Which reminds me... About that NTT chip: While I haven't been looking particularly carefully for it, I haven't noticed an announcement in any of the electronics magazines I normally read. Has anyone seen a reference to it? I think we ought to learn more about it: Does it implement an open standard, so that other manufacturers can build compatible phones? Jim Bell jimbell(a)pacifier.com

1 0

www hacking?
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

I havent seen much in lines of this being a problem yet..although I was reading through practical unix security (newest edition) and it made mention of the danger of hacking WWW. Forgive my ignorance on this.. but what dangers are there? I could see someone attacking the main server and do damage in that sense..but Im a little outdated in this as far as what is attacked. The only thing Ive ever had to worry about was unix, now theres oh-so much more. If someone could tell me the dangers of someone attacking someones site..etc..on the WWW, I would much appreciate it! Thanks Adam

2 1

unsuscribe
by ryans＠worldchat.com 17 Dec '03

17 Dec '03

unsuscribe

2 1

mocking paranoia
by nelson＠crynwr.com 17 Dec '03

17 Dec '03

Earlier, someone mocked someone else for being paranoid. Sorry, but this is a mistake. By definition, you have a non-empty threat model when you set out to encrypt; therefore you must be paranoid to use encryption. Or else they really *could* be out to get you, but sometimes it's not possible to tell, and you have to assume that they are. -russ <nelson(a)crynwr.com> http://www.crynwr.com/~nelson Crynwr Software sells packet driver support | PGP ok 521 Pleasant Valley Rd. | +1 315 268 1925 voice | Corporations persuade; Potsdam, NY 13676 | +1 315 268 9201 FAX | governments coerce.

1 0

Open letter to the NSA
by nelson＠crynwr.com 17 Dec '03

17 Dec '03

You screwed up, guys. If, instead of restricting the export of strong crypto systems, you had instead encouraged it, you would have prevented the development of foreign crypto expertise. Look at South Africa: we banned them armaments, so they created their own arms industry. Now they're a serious arms exporter. You won in the short-term and lost in the long-term. Where is the wisdom needed to admit your mistake? Missing, I'd say. -russ <nelson(a)crynwr.com> http://www.crynwr.com/~nelson Crynwr Software sells packet driver support | PGP ok 521 Pleasant Valley Rd. | +1 315 268 1925 voice | Corporations persuade; Potsdam, NY 13676 | +1 315 268 9201 FAX | governments coerce.

1 0