December 2003 - cypherpunks-legacy

more IPG and random numbers
by Eric Murray 17 Dec '03

17 Dec '03

I did some more experiments with the IPG stream-cipher algorithim and random number tests. Since IPG claim that their algorithim passes chi-square tests of randomness, I found a chi-square test program. It's written by Peter Boucher and was posted to sci.crypt in '93 (<2bum8sINN98j(a)roche.csl.sri.com>). I found it on the web site crypto.com, sorry I don't remember the exact URL but I can send it on request. From the comments: > New, and improved anal.c, uses chi-square. > > Does the 'runs up' (or 'runs down') test with run-length equal to two > get me anything over the standard chi-square test? I left it in. > > BTW, the buf[i] = (((seed = (1103515245*seed +12345)) >> 16) & 0xff); > test fails this one at high numbers. It's too evenly distributed. > > -Peter > > /* *************************************************************** > * anal.c -- > * > * Copyright 1993 Peter K. Boucher > * Permission to use, copy, modify, and distribute this > * software and its documentation for any purpose and without > * fee is hereby granted, provided that the above copyright > * notice appear in all copies. > * > * Usage: anal [input_file [output_file]] > * > * This program counts the occurances of each character in a file > * and notifies the user when a the distribution is too ragged or > * too even. > * > * Because the chance of getting byte B after byte A should be 1:256 > * (for all A's and B's), the program also checks that the successors > * to each byte are randomly distributed. This means that for each byte > * value (0 - 255) that occurs in the text, a count is kept of the > * byte value that followed in the text, and the frequency distribution > * of these succeeding bytes is also checked. > * > */ [..] > #define Vmin (205.33) /* 1% chance it's less */ > #define Vlo (239.39) /* 25% chance it's less */ > #define Vhi (269.88) /* 75% chance it's less */ > #define Vmax (310.57) /* 99% chance it's less */ > > First I ran the output from my version of the IPG algorithim that I posted a couple days ago : % ./boucher < ipg.out Occurances: n = 12000000, V=-8375833.71 Character occurances non-random Successions: n = 46875, V=62287.82 Character successions non-random Then I ran output from a test RNG that's basically a loop around random(): % ./boucher < myrandom/out Occurances: n = 3414720, V=213050.62 Character occurances non-random Successions: n = 13338, V=1143.41 Character successions non-random As you'd expect, it doesn't look like the output from random() is all that great. Finally I generated some output from a random seed generator I wrote a while back. It gets randomness from high-resolution timers and hashing system files. It's not as fast as repeated calls to rand() but is faster than reading from /dev/random: % ./boucher < out Occurances: n = 594352, V=269.75 ================ Frequency distribution excellent! ==================== Successions: n = 2321, V=256.12 ================= Successor randomness excellent! ===================== So, from these tests it looks like IPGs PRNG, which their stream cipher is based on, is not a very good source of random values. Hence anything encrypted with it is succeptable to cryptoanalysis. How succeptable, I do not know. I am sort of curious, since IPG claimed that their PRNG produces "perfect" random data as measured by chi-square analysis, yet my analysis shows otherwise. Perhaps I have coded the algorithim incorrectly (I don't think so, it's pretty simple). Or perhaps IPG chose their keys for the ABC tables carefully to produce good results. Unfortunately that would mean that keys would have to be carefully chosen, something that's not very practical. Based on the work I've done, and the work Igor Chudov posted, it looks like the IPG algorithim is probably not very strong. If two relative crypto neophytes can find serious problems with it, imagine what might happen if experienced cryptoanalists look at it. If you were one of the people who said "it's snake oil unless it's been been tested for a zillion years" etc. you can pat yourself on the back now 'cause you were right. However I think that some of us owe Mr Wood, if not an apology for the excessive abuse he got on this list, at least some respect for putting his money where his mouth is and posting his algorithims. Maybe he'll do some research, tone down the hype, and come back with something better. -- Eric Murray ericm(a)lne.com ericm(a)motorcycle.com http://www.lne.com/ericm PGP keyid:E03F65E5 fingerprint:50 B0 A2 4C 7D 86 FC 03 92 E8 AC E6 7E 27 29 AF

1 0

No Subject
by logos 17 Dec '03

17 Dec '03

You wrote: >Sounds like a heck of a good idea, if: >1. You can ID the bad logic with a high percent of success >(90+ ?). I shall endevor to do my best. Initially, I shall only comment on the most flagrant violations. 90+% should be easy. >2. You can comment/reply for all members fairly, but if> >limited by the large number of postings (and fallacies ?), >give priority to ??? Worst first. >As far as Congress expelling members, are you saying that >the Senate and/or H.O.R. can permanently eliminate a person >elected by the people? Yes, the congress is the sole determiner of the qualifications of its members. >Has this ever been tested? Adam Clayton Powell. Logos out

1 0

Anyone considered adding crypto into Microsoft Outlook?
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

Hi, I've been playing around with the new beta of office '97. The main addition is a pretty nice integrated calendar, task list, address book and email doobrie. It just struck me that it would probably make the most convenient platform for integrating cryptography. After all MAPI is an open, extensible API allowing ready access to the email "hooks" necessary. The integration of an address book with the email system makes it very easy to add public key information into a person's entry. I'm not sure whether PGP or MOSS would be the most compatible format. Its quite possible that S/MIME would be more appropriate. It seems to me however that the main thing stopping the use of crypto has been the pretty weedy interfaces. I'm afraid the MH hacks just don't cut it. It seems to me that a downloadable plug-in would be very popular. I know a lot of lawyers who would jump at the chance to use email but realize they have to have crypto. The main problem so far seems to be the impenetrability of the MAPI documentation. Does anyone know of a usable reference or which of the gazillion Microsoft Developer network CDs one can find more information? Phill

2 1

No Subject
by logos 17 Dec '03

17 Dec '03

Blanc Weber wrote: >Statements like these, with which cpunks retort to each >other all the time, are examples of the ever-continuing >exercise of logic which goes on the list - even if not >formally delineated nor announced as being of such intent >(LOGOS). > >I am glad for the points which "Sir Galahad" brought up, >because they point out the difference between essential vs >non-essential elements in arguments like this one. My warmest thanks to Blanc Weber for 'beating me to the punch' about 'Sir Galahad's' thoughtful analysis. His post is the sort of give and take which focuses debate and raises the level of intellectual discourse. Thank you, 'Sir Galahad' and Blanc Weber. I hope other posters to this list can emulate your examples. Logos out

1 0

Re: PRIVACY: X-No-Archive and mail.cypherpunks
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

At 10:24 AM 12/3/1996, Timothy C. May wrote: >At 10:15 AM -0600 12/3/96, Igor Chudov @ home wrote: > >>This is primarily addressed to the person who supports cypherpunks >>mail-to-news gateway. If you know who such person is, please send >>his/her address to me. >.... >>I am opposed to seeing my articles showing up in DejaNews and other >>search engines. All my emails and usenet postings have this header >>line. However, when cypherpunks-to-newsgroup gateway reposts all >>articles, it strips this header line. I believe it to be a mistake >>and hope that it will be corrected. > >Igor raises an important point. > >I believe he is misguided in his expectation that his public utterances in >a forum containing at least 1200 readers (and probably more, through >gateways, etc.) that he can limit uses of his posts. Any recipient of his >public utterances may choose to quote them in other articles, forward them >to friends, archive them on his own disks, etc. > > ... > >In a free society it is impossible to control what people do with material >given to them. The best means of protecting one's writings is not to >distribute them. It is unlikely that anybody is going to pay money for our postings, even Igor's postings. Copyright is not the issue. Perhaps, Igor is worried about the unpredictable consequences of his posts being readable by anybody, anywhere, forever. The solution to that problem is straightforward and I leave it as an exercise. Red Rackham

4 4

Re: "Just call the police"...yeah, right
by logos 17 Dec '03

17 Dec '03

On Tue, 3 Dec 1996, Timothy C. May wrote: > Saying "just call the police" strikes me as being one of > the most absurd things I've ever heard on this list. > > (If I receive a "Logos-gram" warning me I am being > unpolite, you know where it'll go.) The name of the informal logical fallacy Tim May has *not* made is 'argumentum ad hominem' (literally, 'an argument to the man'; attacking one's opponent rather than dealing with the subject under discussion; aka name calling). Having said that, while Tim May has not committed a logical fallacy, neither has he advanced a logical argument. He has merely stated his conclusory opinion of the other person's comment. By itself, it adds little or nothing of substance to the argument. Logos out

1 0

Re: AOL
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

yes.... they did knock off that $3.00 an hour thing. now.. $20.00 unlimited.. I'd hate to do an AOL spam to the list.. but someone asked.. and for all you that say 'get a real internet provider'. Well.. I get ALL the same access most of you do. No shell account...But I can telnet from AOL to one. So there. Nah nah nah =}

1 0

No Subject
by Bovine Remailer 17 Dec '03

17 Dec '03

At 10:18 PM 12/3/1996, Matthew J. Miszewski wrote: >At 01:45 PM 12/3/96 EST, Bovine Remailer wrote: >>At 10:50 AM 12/3/1996, Matthew J. Miszewski wrote: >>>Take, for example, the practice of redlining. How are people who live in >>>"bad" neighborhoods supposed to not reveal that information. >> >>You may lend your own money to whomever you wish. If you do not wish >>to lend money to somebody, that is your business. > >I consider it my business also, when people are denied opportunity because >of where they live. Why not simply disagree with me? You do not believe that people may lend their very own money, earned honestly, to anybody they please. If you are ashamed of that, change your mind. If you are not ashamed, proclaim it the world and justify it. >I may also hire whomever I wish, but I would have to pay the >consequences if I happened to discriminate based on a protected class >while doing so. That is the society in which I live. If I dont like >it, I try to change it. Our society is not libertarian. Current policy doesn't matter if we are discussing the wisdom or justice of possible policies. >If I would prefer that form of society I would have to accept that >result. Therefore I choose a balance between liberty and social >justice. It isn't clear to me whether you are discussing policy options or whether one should violate laws one does not like. When an action is illegal, it is still permissible to discuss its legalization. >There are times when government should intervene. I believe it >should be as infrequent as possible, but would not want to live in a >society where disinfranchised people have no possible recourse. Your >choice would apparently be different. Perhaps. In any event, it is important to understand precisely the mechanisms through which people are disenfranchised, if that is in fact what has happened. It is also important to understand the ramifications of phrases like "no possible recourse". To borrow money? It is safe to say that most poor people should be saving money rather than borrowing it. >>It is difficult to understand why redlining should be illegal, to the >>extent that it even occurs. When it does occur, we expect that eager >>entrepreneurs such as yourself will rush in to grab new customers. > >I have not heard serious doubts for a while that redlining occurs. It seems likely that people draw lines around certain areas and decide not to lend money there. What is less clear is that this is unreasonable. There may be a few good credit risks in poor neighborhoods. But, it may just be too much trouble weeding through the others to make it a paying business. It may also be the case that people lending money are behaving irrationally and drawing lines around neighborhoods for simple racial reasons and for no others. There is a word for this: opportunity. Bank of America was built by a man who perceived and exploited one such opportunity. Italian shop keepers in California could not get good banking services for, it turned out, irrational reasons. >I would love to have the financial wherewithal to startup such an >enterprise. Unfortuantely I reside in one such neighborhood. People start businesses without their own capital all the time. If there really is such a great opportunity, go find some rich people. Rich people, like other people, are always happy to hear about ways to make more money. They don't even have to put the money in for a long time. Once you've set up a package of mortgages, you can sell them off on the CMO market which is liquid and, I believe, quite colorblind. The beauty of this scheme is that you can take your profits right away and let other people take on the long term interest rate risk, default risk, and management hassles. This will make your plan easier to sell to investors. You might also look into the microlending market. The idea is to lend poor people small amounts of money (less than $10,000) to start businesses and the like. The default rates are claimed to be surprisingly low. I have my doubts, but it sounds as if you do not. Good luck. >It is difficult enough to raise money to run a small business (and >turned out to be much easier to do without any bank lending at all). >I have talked with people about starting their own banks. In principle, there is no reason at all why banks are the only institutions that can lend money for mortgages. There may be legal impediments, but then we are back to the actual culprit, the government. You might find that opening a bank was easier if all you had to do was take deposits and lend money rather than wading through the morass of legal requirements and paperwork. >When you are working to make sure all the bills are paid it is a bit >difficult to also build an entirely new socio-economic structure. You don't have to build an entirely new socio-economic structure. You just have to find some good credit risks, some people with money to lend, and put them together taking a cut for yourself, unless the government has thrown up some obstacles to this. >>Of course, we hardly live in a free banking era. Most people would >>prefer to bank with a company that respects their privacy. Yet, banks >>are so tightly controlled in the United States that they most often >>will not dare to protect the privacy of their customers for fear of >>regulatory consequences. When the service is provided, it cannot be >>advertised. > >Whom would the service be more readily available to? Who uses tax-havens? >Who has access to swiss bank accounts? Are you insinuating that my local >bank actually has anonymous accounts and just won't tell me? I wish that >people DID value anonymous banking in this country. The fact is they just >don't care. No, actually they do care, they just don't think (correctly) that they can get it easily. I have no idea if your local bank has "anonymous accounts". More probably, they have accounts for which they do not report transactions in excess of $10,000, but which are held by people they know fairly well. This is more common than you might think, and not just for laundering drug money. Tax evasion is widely practiced. >As long as they get short lines or myriads of ATM machines they are >happy. I am largely in favor of banking deregulation. There are >places where I simply draw the line. Utter racism is one of them. But wouldn't the racist banks be hurting their business? Doesn't the punishment go quite closely with the "crime"? If you believe that there is a huge opportunity which the racist banks (i.e., all of them) will not take advantage of, you had better explain why there is nobody anywhere with any capital who wouldn't want to make even more money off poor people. Can it really be the case that 99+% of rich people will run fleeing from such a great opportunity? Oh, and speaking of racism, where do wealthy African-Americans invest their money? >Everyone can now clamor that it just isnt true. Banks have never >discriminated. Its all a big lie. Whatever. Banks have practiced discrimination, and not just against black people. They have been able to get away with it. How? Because the government has protected the banking guild from competition. If opening a bank were as easy as forming a corporation, you would not see much discrimination, I assure you. There is no reason why a bank shouldn't be that easy to open. >(snip) >>You are in the unpleasant position of appealing for protection from >>the very people who have robbed you of your privacy. > >You are right. It is far from a perfect system. We make trade-offs every >day. Appeals to the very people who are exploiting you are not likely to meet with success, are they? >The real world I live in is just not as simple as the Libertarian Wet >Dream(TM). Then it should be fairly easy to refute my points instead making fatuous remarks such as the one above. Red Rackham

1 0

OPE_nup
by John Young 17 Dec '03

17 Dec '03

Two reports on BSA's letter Monday to Gore opposing crypto export regulations as "headed in the wrong direction." And claims the administration has "significantly backtracked" since announcing the new policy October 1. IBM, MS, et al are withdrawing earlier support for it. Without change, BSA said, encryption export policies will fail as did Administration policy of Clipper. ----- OPE_nup

1 0

No Subject
by jens.melander＠vpress.se 17 Dec '03

17 Dec '03

unsuscribe cyberpunks

2 1