December 2003 - cypherpunks-legacy

Re: crypto anarchy vs AP
by jim bell 17 Dec '03

17 Dec '03

At 04:21 PM 9/29/96 +0200, Gary Howland wrote: >jim bell wrote: >> >> On a related issue, GPS (global-positioning system) contains a de-accurizing >> mis-feature called S/A, which adds a little error to the location as >> detected by a receiver. Ostensibly, it was added so that this could be >> turned on in wartime, to deny the enemy the ability to make 10-meter fixes. >> Turns out that it was kept on all the time, probably because if it WASN'T it >> would become politically impossible to de-accurize the system even in wartime. > >Apparently S/A (selective availability) was turned *off* during the Gulf >war. "Military Intelligence" in action. Yes, because of lack of enough S/A-capable military receivers... They were stuck with using the commercial, off-the-shelf kind. Jim Bell jimbell(a)pacifier.com

1 0

PET_ard
by jya＠pipeline.com 17 Dec '03

17 Dec '03

Sci, 20 Sept 1996: "Redefining the Supercomputer" The word is petaflops, computer jargon for 1000 trillion computations per second. Think of it as a year's labor for a powerful workstation compressed into 30 seconds. Think of it, also, as 1000 times the speed of the current computing benchmark, a trillion operations a second -- teraflops -- which is on the verge of becoming a reality at Sandia National Laboratories after 5 years of effort. Now the federal government's high-performance computing program is aiming for a petaflops, and researchers are exploring new technologies, sketching new architectures, and pondering the software challenge of harnessing this staggering computational power. The NSA is a petaflops enthusiast, says a researcher, but "we're not allowed to think about their applications." ----- http://jya.com/petard.txt (20 kb) PET_ard

2 1

Re: Workers, Public Schools, Tradesmen, and Justice
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Fri, 27 Sep 1996 13:01:13 -0800, Timothy C. May wrote: >My conclusion is simple: Tell people if they don't work, they won't eat. If >they do something others are willing to give them money to do, they won't >get money. They won't get "entitlements" from the government (= taxpayers, >= those who are working, = me and thee). Tell them that a college education >should only be pursued if one has a "calling" to be an engineer, a >programmer (and probably not even that, judging by what I see), a doctor, a I've noticed that many places are concerned more with things like creativity, adapability, drive, etc when hiring a CS grad. I've found that having a resume that shows these kind of traits well overcame the lack of a degree (I'm working on that). There was a thread about this in comp.lang.cobol awhile back. >lawyer (on second thought, don't ever suggest they become lawyers), and so >on. The old way was that your HS provided what the mythical average person needed to go about life. College was for the more "complex" careers. >And make it easier to hire people, instead of harder. (And if one hires a >maid, and the maid steals, cut off her hand. We've lost sight of justice, >and people think that ripping off the rich is their kind of justice. This >needs to change.) You don't even need to be that harsh. Chain-gang work to pay off stolen property would be more effective, if for no reason other than that you'd get your money (or property) back. >Psychologists and similar psychobabblers call it "tough love." If one >always "enables" an addict, a layabout, a shiftless worker, with excuses >and handouts, the behavior does not change. To save a person, sometimes >harshness is needed. >This is why crypto anarchy's starving of the tax system is good. It may >"kill" some number of people, as nearly any new idea does, but ultimately >it will put things back on track. And you have to look at it from another point of view: If it would ameliorate the problems in the future for the majority of the population, it'd be worth a bit of discomfort now. # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

2 1

Re: crypto anarchy vs AP
by jim bell 17 Dec '03

17 Dec '03

At 02:06 PM 9/26/96 -0500, snow wrote: >Mr. Beck said: >> Been reading the AP thread, and thought I'd donate some of my views. > >> the Internet. You'd just cause the government to panic, and this >> would have negative effects, it would take ages for them to calm down, >> and the laws they'd pass in the mean time would mean a near certainty >> of mandatory GAK as a condition to switching the Internet back on. >> (Before someone takes me to task for the impossibility of switching >> the Internet off, it all depends on the level of government panic. >> More specifically perhaps they would disconnect key backbones, and >> ISPs briefly while they rushed into effect a few presidential decrees >> outlawing non GAKed crypto, anonymous ecash, remailers, PGP, DC-nets, >> etc.) > > This would be cutting their own throats. There is SO much commercial >and government traffic going across "The Net" that many businesses would >scream bloody murder, and the government would have MASSIVE trouble with >it's agenda. Yes, that "they'll cut off the Internet!" talk doesn't seem to be very practical. Society very quickly develops dependency on inventions. Try to take away their computers and they'd scream; take away their telephone and it'd be worse! Give Internet another couple of years and 50% of big business would be severely impacted should it be cut off. Wait five years and the world would practically stop rotating without Internet. On a related issue, GPS (global-positioning system) contains a de-accurizing mis-feature called S/A, which adds a little error to the location as detected by a receiver. Ostensibly, it was added so that this could be turned on in wartime, to deny the enemy the ability to make 10-meter fixes. Turns out that it was kept on all the time, probably because if it WASN'T it would become politically impossible to de-accurize the system even in wartime. Jim Bell jimbell(a)pacifier.com

5 4

Key-Escrow
by Scottauge＠aol.com 17 Dec '03

17 Dec '03

I have a question. There seems to be a lot of excitement over the key escrow stuff da gubermint is trying to install. Couldn't one burn off maybe 10 ** 200 keys and say, hey gubermint dude, these are like, gonna be my keys. Wouldn't this place them into a brute force search if they wanted to play with your info? Doing this will likely add to the tax burden for all dem disk drives needed to store them numbers. :( If ya can't do that, then they must be gonna sell key space like da radio spectrm - which means some number is gonna mean something to someone somewhere - yum yum say the hackers and the crackers. I'm thinking there will be a way no matter what happens....

3 2

GPS and other Dual-use technologies
by azur＠netcom.com 17 Dec '03

17 Dec '03

I used to be an avid RC modeler and have contemplated organizing an on-going amateur cruise missile contest. The object would be to accurately deliver various payload weights over courses of various terrain and distances (perhaps out to a hundred miles or more in the case of Giant Scale craft). Judging would be based on speed, stealth (noise, IR emissions and radar cross section) and accuracy. Craft are free to use any navigational technology, but must be autonomous from launch to delivery. To aid navigation I was considering the design of a substitute differential GPS beacon functionally interchangable with those offered by the USCG. My device would work on a different frequency, possibly using very wideband direct sequence spread spectrum (for low probability of intercept/detection) and be actuated by the missile as it neared the target in order to refine its position. -- Steve PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Steve Schear | Internet: azur(a)netcom.com Lamarr Labs | Voice: 1-702-658-2654 7075 West Gowan Road | Fax: 1-702-658-2673 Suite 2148 | Las Vegas, NV 89129 | ---------------------------------------------------------------------

2 1

Re: Making Remailers Widespread
by Bill Stewart 17 Dec '03

17 Dec '03

At 01:06 PM 9/28/96 -0400, "Mark M." <markm(a)voicenet.com> wrote: >Since maintaining a block list is probably one of the most time-consuming tasks >involved with operating a remailer, it would be a Good Thing to add an option >to the remailer cgi program to operate as a "middleman" remailer. This would >only require the remailer operator to add or remove entries from a list of >allowed destinations. The operator wouldn't have to deal with disclaimers and >would only receive complaints from other operators if the remailer is >malfunctioning in some way. That's another good approach, though a second-string objective compared to having full-scale terminal remailers running everywhere. But it's clearly a strong fallback position, and might be easier to get people to adopt and not turn off. It does depend on the availability of a list of working remailers with the correct feature sets, plus adequate distribution of either PGP keys or some S/MIME-related equivalent. One way to do that is to parse Raph's list appropriately (and check signatures on that); another is to have some centralized (sigh) DNS server do a round-robin distribution so that random.remailer.net picks a random known-good remailer to deliver through, perhaps also delivering a PGP key. I'd far prefer a distributed solution, but this does let people volunteer to take heat for a little while and dispose of their remailers if they have to. In particular, it may be useful for winsock remailers that are willing to connect up and be a delivery remailer when they're connected and disconnect when they're unavailable. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

2 1

Re: Transforming variable-length to fixed keys
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

>If the speed of your key generation is an issue, you could do something like: > > key[] = { 0 }; > const int nhashes = 4; > typedef void (*hashfnptr)(byte*, byte*, int); > /* array of hash functions */ > hashfnptr hash[ nhashes ] = { md5, sha1, haval, ... }; > > state = hash[ 0 ]( algorithm, mode, parameters, userKey ); > > for count = 1 to iterations > for length = 1 to keyLength (in hash_output_size blocks) > /* selecting a hash function based on the state */ > state = hash[ state % nhashes ]( state ); > key[ length ] = hash[ state % nhashes]( state, userKey ); > >This provides more expense in hardware for the same expense in software, so >for the same CPU time you get more hardware expense, and could reduce the >iterations for the same security. > >`nhashes' determined by the number of digest algorithms you consider >trustworthy. > >(They need hardware for `nhashes' different digest algorithms). > >You need to do something about resolving the differing output and state sizes. Yeah, that's a particularly evil way of making things harder for people with keysearch engines. That's why in cryptlib when I'm doing something like key exchange I encrypt all the parameters (algorithm, mode, etc etc) along with the session key, so an attacker can't even tell what algorithm you're using[1]. I'd thought of adding some sort of "choose a random algorithm and mode" capability to cryptlib, but the user interface was too difficult to handle (finding a way to let the user specify "We want a choice of DES-CFB, IDEA-OFB, DES-EDE-CBC, or Blowfish-PCBC" is a bit of a pain). In the end I took the easy way out by adding an extended initialisation mode which allows the user to specify the algorithm if they want, but left the possibility of one-algorithm-per-round hashing alone. A problem with using one of a fixed selection of algorithms is that as you add new modes the selection changes, so you need to add more state information to the key which specifies the choice of algorithms, which starts to get messy. I'd still love to add this in some form to keep the NSA amused... perhaps a bit vector of allowable algorithms and modes passed to the setup function. Peter. [1] There's a story from IBM when they were testing a new IBM-internal encryption system for long-haul telecoms applications. They were playing around with bouncing encrypted transmissions off an IBM-owned satellite when they were contacted by the NSA who said "You're not using DES. Stop it".

2 1

Internet 'terrorism' newsclips [CYPHER, but news]
by Donald Weightman 17 Dec '03

17 Dec '03

>From today's PARADE magazine, that valuable source for insight into the popular heart and mind, "explaining" why "we" haven't been able to catch Iranian terrorists: >Thanks to the highly sophisticated surveillance capabilities, American >intelligence agencies have intercepted enough telephone messages from Iran, >ordering acts of terrorism, that Iran's terrorist network stopped using the >phone. Reportedly this has caused them to start using codes on the Internet >that are "practically" impossible to track and isolate. >"Just when we thought we had outsmarted them, they caught on and started >using codes on the Internet", an expert in international terrorrism tells >us. "There's so much crazy srewball stuff on the Internet that it's >practically impossible to track down and isolate the terrorists. No >government can analyze those millions and millions of messages." And from another piece of hard-hitting quote-the-official-source journalism in PARADE, "A New Worry: Terrorism in Cyberspace" >The danger of computer-based "cyper" attacks is second only to that posed by >nuclear arms and other weapons of mass destruction, says CIA's Director, John >Deutch. He expects the threat to grow as we rush to connect the world on the >Internet. <SNIP> >There were more than 250,000 attacks on Department of Defense computers last >year, and 65% were successful. Little is known about who launched them, why, or >what they found. In a recent test, Defense Department "red teams" admit to >intentionally hacking into 18,200 systems, with only 5% of the attacks >detected; only 27% of those attacks were reported. Wonder if the timing of these stories has anything to do with the end of term legislative push on wiretapping. Don Weightman dweightman(a)radix.net

1 0

Re: Internet 'terrorism' newsclips [CYPHER, but news]
by azur＠netcom.com 17 Dec '03

17 Dec '03

>>There were more than 250,000 attacks on Department of Defense computers last >>year, and 65% were successful. Little is known about who launched them, >why, or >>what they found. In a recent test, Defense Department "red teams" admit to >>intentionally hacking into 18,200 systems, with only 5% of the attacks >>detected; only 27% of those attacks were reported. > >Wonder if the timing of these stories has anything to do with the end of >term legislative push on wiretapping. Quite possibly. The message from this article is clear. Step up investigation and prosecution of illegal government Net activities :-) -- Steve

1 0