December 2003 - cypherpunks-legacy

Re: Opiated file systems
by Chris Adams 17 Dec '03

17 Dec '03

On 18 Jul 96 18:49:04 -0800, dfloyd(a)IO.COM wrote: >The problem I ran into firsthand with archive sites is that they tend to >turn into porn or pirated software servers. One could then have the >software delete after a download. Anyway, one is always open to a denial >of service attack where someone just throws chunks of /dev/random at you. >If someone has any ideas on how to slow down attacks like this, please >E-mail me. It would be nice to have an offsite storage place, but without >the necessity of giving a bunch of personal info (as with Mcaffee's >WebStor). A) Only accept files with valid PGP signatures from accepted keys - this is one area where PGP's commandline interface is a plus - just write a batch script. Demand that a separate file be sent first, signed by a certain key. This file would contain valid filenames for the rest of the session. If a non-listed file is sent, kill the session. This could all be automated with a simple program. You could probably even use SSLs and similar to do it on a website if you could swill the PGP bit - maybe a plugin? B) bounce trash back. // Chris Adams <adamsc(a)io-online.com> - Webpages for sale! Se habla JavaScript! // Automatically receive my resume or PGPKEY by sending email with a subject // of 'send PGPKEY' or 'send resume'. Capitalization counts so be careful!

1 0

NSA response to key length report
by Matt Blaze 17 Dec '03

17 Dec '03

July 18, 1996 There is currently being circulated, to members of Congress and possibly elsewhere, a four page document entitled ``Brute-Force Cryptanalytic Attacks'' that calls into question some of the conclusions of the ``Minimum Key Lengths for Symmetric Ciphers'' white paper [1]. The document bears no author or organization attribution, but we are told that it originated from NSA. The NSA document argues that ``physical realities'' make parallel key search much more expensive and time consuming than our white paper estimated. However, the NSA document appears to have been written from the perspective of general parallel processing or cryptanalysis rather than exhaustive key search per se. It ignores several elementary principles of parallel processing that apply specifically to exhaustive key search machines of the type that our white paper considered. In particular, NSA argues that interconnections, heat dissipation, input/output bandwidth, and interprocessor communication make it difficult to ``scale up'' a key search machine by dividing the task among a large number of small components. While these factors do limit the scalability of more general purpose multiprocessor computers (such as those made by Cray), they do not apply at all to specialized exhaustive key search machines. The NSA argument ignores the most fundamental feature of brute-force key search: the processors performing the search have no need to communicate with other components of the system while they perform their share of the search, and therefore the system has no need for any of the global interconnections that limit scaling. Indeed, there is no reason that all the components of a parallel search machine must be located even within the same city, let alone the same computer housing. We note that one of our co-authors (Eric Thompson, of Access Data, Inc.) designs and builds medium-scale FPGA-based key search machines with exactly this loosely-coupled structure, and regularly uses them to recover keys for clients that include the FBI. The NSA document also calls into question our cost estimates for ASIC components, suggesting that ASIC chips of this type cost NSA approximately $1000.00 each. However, our $10.00 per chip estimate is based on an actual price quote from a commercial chip fabrication vendor for a moderate-size order for an exhaustive search ASIC designed in 1993 by Michael Wiener [2]. Perhaps NSA could reduce its own costs by changing vendors. Finally, the NSA report offers estimates of the time required to perform exhaustive search using a Cray model T3D supercomputer. This is a curious choice, for as our report notes, general-purpose supercomputers of this type make poor (and uneconomical) key search engines. However, even the artificially low performance results for this machine should give little comfort to the users of 56 bit keys. According to NSA, 56 bit keys can be searched on such a machine in less than 453 days. ``Moore's law'' predicts that it will not be long before relatively inexpensive general-purpose computers offer similar computational capability. /s/ Matt Blaze Whitfield Diffie References: [1] Blaze, M., Diffie, W., Rivest, R., Schneier, B., Shimomura, T., Thompson, E., and Wiener, M. ``Minimum Key Lengths for Symmetric Key Ciphers for Commercial Security.'' January 1996. Available from ftp://ftp.research.att.com/dist/mab/keylength.txt [2] Wiener, M. ``Exhaustive DES Key Search.'' Presented at Crypto-93, Santa Barbara, CA. August 1993. ========================================================================= [Transcription of document circulated to various members of congress and others in June, 1996, apparently by NSA] BRUTE-FORCE CRYPTANALYTIC ATTACKS Two published theoretical estimates of cost versus time to perform brute-force hardware attacks on selected cryptography key lengths differ between themselves and differ significantly from what we find when we buy or build computers to carry out such attacks. The differences lie in assumptions made in the theoretical estimates, which are not fully spelled out by the authors, and in scaling up hypothesized small machines to ever larger ones without accounting for physical realities. The factors not accounted for are: o R&D costs for the first machine, typically on the order of $10 million. o As more and more chips are added to a machine, two effects occur: o Interconnections increase and increase running time; o Heat from the chips eventually limit [sic] the size of a machine. o Memory costs are not included. o When get [sic] to the very fast processing speed estimates, machines can become Input/Output bound; so [sic] it cannot achieve the estimated speed. o Assuming every algorithm can be tested in same amount of time and key length is the only difference. Table 1 are [sic] the average time estimates made for a given cost done by Michael Wiener of Bell Norther Research in 1995. These are published in Bruce Schneier's Applied Cryptography book. Note that these are average times, one-half of the total exhaust time. Table 2 are [sic] the estimates for total exhaust times using Field Programmmable Gate Arrays (FPGA) and Application Specific ICs (ASICs) done for the Business Software Alliance by Blaze, Diffie, Rivest, Schneier, Shimomura, Thompson, and Wiener in 1996. In addition to the above factors not accounted for they have assumed ASICs cost as low as $10. We find ASICs more typically cost $1000 and their capabilities can vary considerably depending upon the specific task. Table 3 are out estimates based on our experience with a Cray T3D supercomputer with 1024 nodes. This machine costs $30 million. [Tables 1, 2, and 3 not transcribed here.]

3 3

No Subject
by Ernest Hua 17 Dec '03

17 Dec '03

> >If I had kids, I'd make sure that lots of negative memes were kept away > >from them until they reached an age where it no longer mattered, where > >there views are already basically set. > > I am sorry to hear. I think we underestimate childrens' ability to decide > for themselves what is right and wrong, and I think the seemingly inate > desire for parents to want children that are all but clones of themselves > is especially dangerous and certainly harmful. I think that restricting access > to "negative memes" from anyone (including children) actually does more > harm than good. I didn't particularly want to get into this, so I will (Don't make the point if you don't want to discuss it.) I have a child, and if you don't, you really should try to raise a child for a week. What a child considers "right" or "wrong" is very much dependent upon about a million different factors, very few of which, you have any serious notion, let alone control. In addition, a child, in parallel, learns behavior at the same time it is judging what to absorb; therefore, you can't just "turn on" learning mode and "turn off" judging, "download values", "turn off" learning and "turn on" judging. Most things children pick up are not really that "damaging". However, certain things in life are strictly designed to damage. Anything from a verbal "fuck you" to an Uzi. Therefore, restrictions on access to those sorts of things are not that unreasonable, until the child has learned enough to understand the consequences of their actions, and can functionally and socially adapt to their choice of environments. Ern

1 0

Re: Responding to Pre-dawn Unannounced Ninja Raids
by Vinnie Moscaritolo 17 Dec '03

17 Dec '03

Arun you are lost.. >particularly since you are far more likely to use this weaponry in a rage > against a loved one than against someone breaking down your door. Thats plain HCI statistic crap, DONT YOU BELIVE IT, those numbers are based on drug dealers killing other drug dealers.. read the real FBI numbers, they are on the net. Anyways the real reason that the "more likely" argument bothers me is that its like saying that Crypto is more likely to be used by criminals than law abiding citzens. > >I wonder about that -- between Tweedledee Clinton and Tweedledum >Dole, does it matter whether you vote or not? bad attitude. thats the reason we have Her Klinton to begin with,, apathy > The system seems to make sure that before you even get to a >position where someone can seriously vote for you, you've already >sold your soul. there is some truth to that Vinnie Moscaritolo ------------------ "friends come and friends go..but enemies accumulate." http://www.vmeng.com/vinnie/ Fingerprint: 4FA3298150E404F2782501876EA2146A

1 0

Re: Borders *are* transparent
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Sternlight blathered [regarding Tim]: ... >"Nyaah, nyaah, you can't catch me" doesn't mean that if they do they won't >prosecute. Your waving around that stuff in France is not only juvenile, Starting off with defamation is a sure tipoff that what follows is crap. And sure enough...[he sure makes it convenient for sarcastic "cowards" like me to use his own words against him.] >but also may put you in violation of French crypto law. ... Perry's right, DS *would* do it with a dawg. >>... Borders _are_ transparent. ... > >Again you make the long-discredited straw man argument that the purpose of >ITAR is to hermetically seal. It is not. It is to keep legitimate US mass >market purveyors from selling strong crypto overseas, ... You tell the stated purpose, the NSA's own lawyers have told PRZ and others (off the record, of course) that there is a domestic (and therefore a Constitutionally impermissible) purpose. Read the Bill of Rights. >[yadda yadda yadda.] >> >>_This_ is why I expect the Netscape beta to arrive overseas pretty soon. > >Nobody disputes that. It won't be readily available though, except for >those who have no compunctions about software piracy. Hell, they can pay Netscape anonymously. David, if you try double standards around here any more, I will make fun of you more, EVERY TIME. I will not stop. I note that you have the common [but not necessarily fucking] statist flaw of needing to get in the last word in every argument, rather than just agreeing to disagree. Chill out. For the health of the list, please try to tone down the volume and number of your posts to something more closely approaching reasonable.

1 0

lambda 2.09 - French Telco Act Censored?
by jt＠freenix.fr 17 Dec '03

17 Dec '03

netizen's --> Lambda Bulletin 2.09 <-- contents -->> www.freenix.fr/netizen + Censoring Censorship Attempts French Telco Act's Internet control sections may be unconstitutional. + Encryption : The OECD fails to act on key-escrow policy * * * * * * * * CENSORING CENSORSHIP ATTEMPTS -- A LA FRANCAISE The French Telco Act, which was voted by the Parliament on June 7, may follow the same path than the US Communications Decency Act. A group of Socialists Senators has sent a request to examine eventual unconstitutionality of the law. The new Act, due to meet new criteria for telecoms competition in France, has also taken some steps to create an administrative control of speech and services via online services and the Internet. The new council, le Conseil Supérieur de la Télématique, "could block the free communication of thoughts and opinions, and may eventually establish a principle of preliminary declaration" for online speech, reads the document given to the Conseil Constitutionnel, the supreme watchdog of the French 1958 Constitution (and the principles of the 1789 Declaration des Droits de l'Homme et du Citoyen). Indeed, the law may breach article 34 of the Constitution which says that the Parliament alone could indict rules concerning "the basic garanties given to citizens for the exercice of their civil liberties". But the newly created CST may appreciate if a Web site or a newgroup could be illicite according to the French Penal Code. This "appreciation" is not sufficiently well defined in the Telco Act, constitutionnal jurists said. Article 66 of the Constitution also states that the appreciation of the Penal Code should be the role of the penal judiciary (le Juge Penal), but shouldn't depend on any administrative body or any administrative judge (Juge Administratif). But other voices said that the existing Conseil Supérieur de l'Audiovisuel (which regulates broadcasting content) is based on the same principles. Then, the Conseil Constitutionnel will have to make a difference between a TV program and a Usenet feed. That's what the Philadelphia Court acted when they censored the CDA. Final decision awaited in Paris before the end of July (July 26th in theory). * * * * * * * * OECD FAILS TO ACT ON KEY-ESCROW ENCRYPTION; THE US ACCUSED OF "POLICY LAUNDERING" The Paris-based OECD, the 24-members club of industrialised nations, has failed to take a step towards international recongnition of key-escrow encryption. The meeting of June 26-28 in Paris, scheduled to take a firm decision about the possibility of law enforcement agencies to read electronic mail of private individuals and corporations, didn't succeed to act on a compromise. The OECD's general secretary has no special power to draw regulations and must find a common policy on the matter. Sources said the OECD has been set apart between "the key escrow group" -- mainly USA, France and Britain -- and the "laxist" group -- mainly Japan and Europe's Scandinavian countries like Sweden, Denmark and Finland (Germany was still uncertain). A press release of the OECD says that no final decisions were made. There will be no other comment of the case. "The OECD experts grappled with achieving a balance between respect of national sovereignty and developing an international approach. This dialogue will be continued at a third meeting of the group, scheduled to take place on 26-27 September, in Paris. An OECD spokeswoman said the organisation asked independant experts from the Electronic Privacy Information Center (Washington, DC) to participate in preliminary meetings. The EPIC prefers not to make any comment until the next meeting in September. Sources said the US were willing to "use" the OECD as a "policy laundering" machine : to pressure the organisation in order to have the key escrow policy approved by the 24 countries. US intelligence officials would have been using it as a political weapon at home, where Congress, public-interests groups and industry pressure groups are on the verge to act against any key-escrow policy. * * * * * * * * **LAMBDA SPECIALS -- WEB ONLY!!! - see www.freenix.fr/netizen** Forget the Internet. Here are some subversive archives. Unfortunatly, mainly in French. -->> Coca-Cola's weird business strategy during WW2. (You won't heard this story during 1996 Olympics). Based on a book published in 1993, "For God, Country and Coca-Cola, by Mark Pendergrast (Scribner's Sons Publishing, New York). From the Berlin Olympics to 1945, Coca-Cola builded a strong presence in Germany while sitting besides GI's in the Us War effort. Check interesting pictures taken from the book: >> www.freenix.fr/netizen/special/coca-colabo.html -->> Special Psychedelics French stories about the renewal of medical psychedelic research. And a letter from Tim Leary, psyche pope of the 60's, published in English. >> www.freenix.fr/netizen/special/tl-letter.html * * * * * * * * Jerome Thorel =-= Journaliste/Free-lance Reporter =-= Paris, France =+= the lambda bulletin --> http://www.freenix.fr/netizen =+=

1 0

Re: Firewall Penetration
by Cerridwyn Llewyellyn 17 Dec '03

17 Dec '03

At 05:29 PM 7/19/96 +0800, you wrote: >Is it possible to penetrate a firewall? yes. //cerridwyn//

1 0

Re: Filtering out Queers is OK
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"tcmay(a)got.net" 19-JUL-1996 04:37:28.75 >If I had kids, I'd make sure that lots of negative memes were kept away >from them until they reached an age where it no longer mattered, where >there views are already basically set. >I see nothing wrong in this. Anyone who disagrees is, of course, free to >set his filters differently, but not to insist that my filters be changed. >And the government is not free to pass any laws about what filter sites can >and can't do. >Unfortunately, I think many on this list are so taken by "liberalistic" >notions that they think the State needs to intervene to stop me from >filtering my son's access to "The Joys of Queer Sex." State? I'd call it right for private individuals as well. Ultimately, it's the job of the state, if it has one, to protect the rights of individuals... including minors. Private individuals can protect those rights as well, just as we can stop someone from getting mugged by shooting the mugger. >(As a libertarian, I really don't care what sexual practices others >practice, so long as I am not forced to either fund or witness their >practices. And so long as I am free to filter out their practices as I see >fit, including for my minor children and/or members of my household.) Well, as a libertarian the only excuse I can see for parental rights is parental responsibilities. If something is needed in order to carry out those responsibilities, then the parent has the right to make those decisions (unless it's shown that the parent isn't competent to). But I need to see something before I can say that the parent has that right. It's the same thing that I need to see before I can say that I'm harming some environmentalist by driving my car (global warming or whatever nonsense). It's called proof. >Some parents simply get tired of spending time each night trying to undo >the propaganda taught in many public school, such as books like "I Have Two >Mommies." Many of these parents eventually give up and put their kids in >religious or private schools (even though they continue to pay taxes for >schools their own children are no longer using). Actually, I perfectly well agree with you that schools (especially the public variety) shouldn't be promoting PC values. (We've got a college at Rutgers, Livingston, with the avowed purpose of promoting "diversity." Unsurprisingly, even the administration is beginning to admit it has a reputation for being, shall we say, scholastically unachieving?) Neither should they be promoting any other set of values, other than that of "learn." Parents smart enough to send their kids to such a school will see them succeed, in a properly meritocratic society; ones sending their kids to schools where ideology is more important than giving the kids the information they need to make up their own minds won't see them succeed, overall. >Queers are, as far as I'm concerned, perfectly free to practice their >AIDS-spreading practices to any and all receptive anuses they can find, but >I eschew this lifestyle and will fight to the death for this right to avoid >their practices from being forced on me or my children (if I had any, which >I don't). Fascinating. So you and I are both opinating from the same amount of direct knowledge of parenting... and I'm going with better and clearer memories of being a child and teenager. >I think of AIDS as "evolution in action." Retroviruses which have existed >for millenia now find new vectors for spreading in our population. I cry no >tears for those dying of AIDS, and work to reduce to tax dollars spent on >such things as "AIDS research." Let those who introduced the new vector pay >for the research. >What do you call ten million AIDS deaths? You figure it out. Well, let's see, it's currently spreading via heterosexual transmission since the "queers" are the ones who've been smart enough to start using condoms. (Check out Southeast Asia, for instance. I've looked at studies (such as from ChristNet) trying to show otherwise; they had so many scientific flaws that I stopped reading.) Think of it as evolution in action. -Allen

1 0

Re: Reverse Engineer
by Seth I. Rich 17 Dec '03

17 Dec '03

>> What do you mean by "reverse engineer?" I have heard this word several >> times especially in the world of hacking, but... can someone tell me >> what it really meant? >Interesting question. >Hmmm... > >I would answer this question for you but then I would have to kill >you. Well, I don't have to be subject to such childishness. Reverse engineering code is like decompiling it. Starting with the compiled code, you can translate it backwards (to some degree) and see how it works. It's not as easy as taking a compiled program and ending up with the original C code, but if it's worth enough to you you -can- end up with the same information. Seth --------------------------------------------------------------------------- Seth I. Rich - seth(a)hygnet.com "Info-Puritan elitist crapola!!" Systems Administrator / Webmaster, HYGNet (pbeilard(a)direct.ca) Rabbits on walls, no problem.

1 0

Subject: Re: Netscape download requirements
by David Sternlight 17 Dec '03

17 Dec '03

> >At 1:47 AM -0700 7/19/96, Cerridwyn Llewyellyn wrote: > >> >>>I'd bet on the first. Why screw with this? We worked hard >>>to make this possible and you want to ruin it. Sheesh. >> >>Because freedom doesn't come in degrees, it's all or nothing. > Wrong. Society has long made a distinction between liberty and license, and "freedom" is a definitional and even societal-situational thing that keeps advancing. Check out history. Read some Supreme Court decisions of the more thoughtful kind. > >> >>>"I hate the government so I'll blow up a federal building >>>and then the FBI will get more money and attention and >>>power and, um, that'll show 'em, er, ah....." >> >>Exporting crypto-systems and killing people is comparing apples >>and hand grenades. Please come up with a relevant analogy. > It IS relevant in the underlying principles it illustrates. That the details aren't of the same magnitude is irrelevant. Didn't you learn "reductio ad absurdum" in school? > >> >>1) Please don't chastise individuals who take direct action and use >>civil disobediance as a measure to change bad laws and policies (ie by >>making your companies software available internationally). When >>done on a mass scale, the long-term benefits FAR outweigh the short >>term consequences. While you as a corporation find it much more >>difficult to take such actions, as they would most likely ruin your >>corporation, individuals acting in this capacity cannot be ruined quite >>so readily. > It is ludicrous for some cypherpunks to try to compare their "cause" with freeing the slaves or overthrowing a tyrannical and abusive dictator. In fact it is romantic fantasy. Not every prosecution is of Jean Valjean; not every arrest for speeding is the destruction of freedom as we know it. Not every theoretical consequence is a current abuse. "Trust everyone, but always cut the cards" is a better guide for living in a democratic society than "distrust everyone and insist on all or nothing". > Essentially, one who opposes or deliberately sabotages Netscape's compromise with full ITAR deregulation is a fascist in that he is trying to force his will on those of his fellow citizens who want to download the secure US version in the US, and deny _them_ _their_ rights. David

1 0