December 2003 - cypherpunks-legacy

Re: AP [was: Re: Kiddie porn on the Internet] [NOISE]
by jim bell 17 Dec '03

17 Dec '03

At 12:38 PM 9/22/96 -0400, hallam(a)vesuvius.ai.mit.edu wrote: > >I agree with Bill, AP sounds like a very good club for the Exon types >to beat us with. But they're not doing it. They know about it, but they're NOT using it. This should tell you something. This really is no surprise to me; before I started publicizing AP, I tried to carefully consider whether letting the cat out of the bag was going to assist the government in stopping it. My conclusion was that they didn't stand a chance. If anything, they're afraid of publicizing the idea, because their opposition to it can look only self-serving. >Jim's latest comments sounded no different to me than the mealy mouthed >"understanding" messages that Sinn Fein publish about the IRA. Given >the opportunity to condem any attack on the President under AP rules >we get a non commital non-condemnation. Its the type of thing that Gerry >Adams says after his men have just killed two kids with a bomb in a litterbin >outside a MacDonalds. Don't try to tar me with that brush. I made it clear long ago that I'm opposed to truly random attacks on ordinary citizens. However, I hasten to add that I'd very much prefer that these attacks be re-targeted against the people who deserve them. However, I usually find that the people who make the biggest deal about disliking random citizen attacks are the ones who recommend replacing them with...nothing...and have no plan to solve the problems with any other method, violent or otherwise. [doctrinaire BS deleted] >As the Marxist idealogues got frustrated by their evident lack of progress >they turned to terrorism. The Bader Minehof gang believed that they could >spark the revolution by jolting society out of its complacency. Their >strategy was remarkably like AP. Somehow, I doubt it. Anybody who thinks an AP-like system would be effective for bringing in his pet communist (or fascist, or monarchist, or anything other than pure-anarchic) government is an idiot. AP is fundamentally anti-heirarchical in its leanings and effects. >If the heads of large corporations were >likely to be assasinated then noone would want to lead a large firm. Who said companies need "leaders"? Remember, I said AP is anti-heirarchical. Any heirarchies, particularly those forced on people, are strongly deterred. This includes social and religious heirarchies, BTW. Even corporate heirarchies would only exist if approved-of by the vast majority of the shareholders, most of whom will be the workers as well. > In >fact as any person with counter terrorism experience will tell you the >threat of death is remarkably ineffective as a means of intimidation. It >creates the opposite effect, strengthening the resolve of the target. I >discussed this point recently with someone close to Mossad who agreed. Under a set of circumstances similar to the status quo, that is not surprising. But that can change. That WILL change. People occupy positions of authority when they feel, personally, they are better off doing so than not. Give the average member of the public (not merely crazed "terrorists") the opportunity to remove those people, and you won't be able to keep them around. I mean, presumably they do their job for a salary and benefits, right? How many bombs or bullets will they tolerate, rather than resigning and taking a safer job? >Terrorism is becomming an increasing concern. The amount of damage an >individual can cause is much greater than that possible in the past. If anything, I think the advantage of AP is that it REDUCES the amount of damage that any given person has to cause, per citizen, to achieve his anti-government political ends. I've pointed out that it would only take a penny or two from each citizen, on average, to remove one of even the highest-level US officeholders. Far less than that if you include resignations. What I'm advocating is a system that makes it impossible for agents of the status quo to resist the opposition of the public, which is unlike the current system. Rather than have to build a bomb, or wait for somebody else to do so, the ordinary citizen only needs to make a modest contribution to the "revolution fund." And today, an officeholder can claim to resist "terrorism" based on the fact that he opposes the extreme action of a handful of people. What happens when they have to admit that a million people paid for that gun to be fired or that bomb to be planted? >There >are plenty of exhausted ideologies about which can be fashioned into >a justification of murder. Don't blame me for them. > Jim's post shows very clearly how Libertarianism >can be converted into a justification for terrorism. Its a very short gap >between being opposed to government and actively fighting against it. What, exactly, is the MEANING of "being opposed to government"? If you pay taxes to support that government (even if that support is not voluntary) those taxes mean that you are indeed acting to strengthen that government and assist its efforts. I suggest that you can't realistically claim "opposition to government" (other than rhetorical) under these circumstances. >I see libertarianism as the exhausted remnant of the mercantilism of the >1980s. As constructed it recognises only those rights which favour the >privileged in society and none of those which benefit the ecconomically >disadvantaged. Politically it reached its peak influence almost a decade >ago when Regan and Thatcher were at their zenith. The '94 congress will >probably be seen as the turning point in the political tide with the mainstream >of politics moving back to the left again. There will always be people arround >who conclude that the failure was not being close enough to the ideology. You've already made it clear you don't consider yourself a libertarian. Why go on with this stuff? >If the libertarians are not carefull they will be inexorably linked in the public mind >with the terrorists who act in their name. I think the stereotypical "terrorist" doesn't really claim to "act in their [the public's] name." The one recent counter-example that I've heard of, that of the EPR in Mexico, is a very welcome exception. If anything, I think the governments of the world are truly frightened that "terrorism" as commonly practiced will change from the "blow up random airliner" mode, passing through the "blow up nearby government building" mode, to "find and kill a particular official" mode. Far less collateral damage, far harder to whip up public opposition to in the press, etc. Jim Bell jimbell(a)pacifier.com

7 7

Re: (Fwd) Australian "ITAR" regulations
by cjh＠osa.com.au 17 Dec '03

17 Dec '03

Peter Trei writes: > Forwarded from the cypherpunks list... > http://www.austlii.edu.au/cgi-bin/sinodisp.pl/au/legis/cth/consol_reg/cer43… Thanks for posting this URL Peter. Of particular note is the heading: > 43. Other goods as follows: An anonymous opinion from inside the Defence Dept holds that electronic bits on a wire do not constitute goods, and as a result if you ship electronically, you are not subject to the regulations. If you ship a CD or floppy or other physical media containing software, you violate the regulations. I'll add this to the SSLeay legality FAQ - standard disclaimers apply of course, obtain professional legal advice before exporting SSLeay. ------------------------------------------------------------ Clifford Heath cjh(a)osa.com.au Open Software Associates Limited 29 Ringwood Street / P O Box 401 Phone +613 9871 1694 Ringwood VIC 3134 AUSTRALIA Fax +613 9871 1711 ------------------------------------------------------------ Deploy Applications across the Internet and Intranets! Visit our Web site at http://www.osa.com

3 2

Re: Snake-Oil FAQ
by steven ryan 17 Dec '03

17 Dec '03

At 05:27 AM 9/22/96 -0700, you wrote: >My view is that people interested in buying and using crypto are either >bright enough to learn, or are not. A "Snake Oil FAQ" is largely >unnecessary, for either category. For the first, because they're bright. >For the second, because they're not. My view is that there is a large third group of people who are bright enough to learn, but don't have the time or inclination to read books or do extensive research on the subject. There are a lot of people using PGP for the wrong reason, not because they read the books or did the research. Nor do they even understand how it works as opposed to how it is used. They are using it because they cruised the net and read good things about it or heard it was cool. A Snake Oil Faq could help prevent these people from choosing wrong products. It would also be very helpful to have all the arguments in one place in one concise faq. Before I joined this list and read Applied Cryptography I was in a discussion in a previous job about securing one of our products. The programmer wanted to protect the key with a convoluted series of transpositions. I knew it was dumb but couldn't successfully argue the point why. A faq would have been helpful. There a lot of people with a casual interest in crypto who will remember that there is a faq on bad crypto. When the time comes they may be able to use those arguments to help avoid the use of bad crypto. Steven ------------------------------------ Steven Ryan - Reading Access - sryan(a)reading.com PGP Fingerprint: E8 A2 C5 A2 7A C4 77 93 0A 1B 1D C6 B9 2F 36 9B Finger me for my PGP public key

1 0

provably hard PK cryptosystems
by Adam Back 17 Dec '03

17 Dec '03

extracting from part of another thread... Dimitri Vulis <dlv(a)bwalk.dm.com> writes: > Adam Back writes: > > [...] I think I remember that you posted some time ago a way to have > > two plausible decryptions for one ciphertext, to enable things like > > duress keys, in terms of RSA. The problem with this, however is > > that RSA is currently very slow to use in its pure form for > > messages. > > I don't recall this one... My feeling about RSA is that one of these > days there will be a breakthrough allowing much faster factorization > (either through a better algorithm on a conventional computer, or by > a practical quantum computer) and then all the codes based on > factorization will become essentially plaintext. It's time to start > looking for other hard problem to base PKC on. I'm not sure about quantum computers, some people who know much more about particle physics than I do seemed initially sceptical, and didn't think it was doable. However I have read some optimistic sounding news clippings (on the list) which sounded as if things are progressing well, with techniques being found using redundancy to get around what were earlier problems of reliability. Is this accurate reporting (thinking of garbled stories by over enthusiastic journalists)? I'd be interested to hear opinions from anyone who does know about particle physics about the likihood of practical quantum computers being practical in the next 20 years or so. RSA has always had problems with two pitfalls in any proof of its hardness: no proof that RSA is as hard as factoring, and no proof that factoring is hard. Rabin and variants of it at least have the proof of being as hard as factoring. You mentioned your opinion that a vastly better factoring algorithm may yet be found. What about the possibility of finding proof of a useful lower bound for the complexity of factoring, do you have any thoughts on the likelihood of this being achieved? That would be a very significant result, and in the absence of a quantum attack would be as good as it gets. It would allow you to make realistic calculations about physical limits of attacking it, in a similar manner to the entropy calculations possible for brute force of symmetric ciphers. (Heat death of the sun before a solution even if every particle was part of hardware key cracking computer type arguments). One other area that did sound promising was some kind of mapping problem in n dimensional tiling that Tim was discussing at a physical meet while I was over in the US. A news clipping posted to cypherpunks a short time ago was talking about a researcher who had constructed a crypto system related to the problem of finding paths in a tiling problem (sounded like the same problem). The interesting part was that the researcher was reported as having a proof of hardness. Similarly is this being reported accurately? > E.g., does anyone know of any progress made on public-key > cryptosystems based on the word problem in semigroups, described in > Neal Wagner and Marianne Magyarik, _A public key cryptosystem based > on the word problem_, Advances in Cryptology: Proceedings of Crypto > '84, G. R. Blakley and D. Chaum, eds., Lecture Notes in Computer > Sciences #196, Springer Verlag, 1985, and also mentioned in Wayne > Patterson, _Mathematical Cryptology for Computer Scientists and > Mathematicians_, Rowman and Littlefield, 1987? Not familiar with the problem. Is it something you could explain briefly, or are there any on-line papers on the subject? > >From what I neard, NSA tried very hard to implement it and failed, > and the Soviets actually built a cryptosystem similar to what they > described. I tried to duplicate what the Soviets supposedly did, but > without success. Adam -- #!/bin/perl -sp0777i<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<j]dsj $/=unpack('H*',$_);$_=`echo 16dio\U$k"SK$/SM$n\EsN0p[lN*1 lK[d2%Sa2/d0$^Ixp"|dc`;s/\W//g;$_=pack('H*',/((..)*)$/)

1 0

Re: Macintosh Mixmaster port... Who's doing it?
by Greg Broiles 17 Dec '03

17 Dec '03

At 03:16 PM 9/22/96 -0500, Adam Shostack wrote: > A real Mac port of Mixmaster, that integrated with Claris >EMailer and Eudora would be a huge boon to the millions of Mac users >out there. I have no doubt that Vinnie's mac crypto conference talked >a lot about this sort of thing. Actually, the Mac crypto conference didn't spend any time at all on Mixmaster - which is not intended as a criticism of either the conference or of Mixmaster, but it just didn't happen. I gave a very short talk and said that I thought the Mac needed three apps, for people who wanted to jump in a write something useful to the cause of privacy on the net and didn't want to reinvent any wheels: a remailer client with a good user interface, a Mac-native remailer, and an implementation of DC-nets. Mixmaster would, of course, address two of those three. Lucky tells me that there is already a Mac implementation of DC-nets, but it doesn't seem to be very well known. My impression of the demographics of the conference was that it was folks who are mostly working developers who aren't necessarily up-to-the minute on crypto and ecommerce stuff, but are interested enough to at least think about including it in their applications. I'm pottering around with a Java-based remailer that acts like a POP client so it can run on a client machine, not a Unix box; but other people should take that as a challenge to see if they can finish one before/better than me, not a reason to avoid writing one. Hal Finney has already done some very nice work with Java and mailing; see his home page (the address of which I don't have immediately at hand) for more details. For what it's worth, I think future remailer/Mixmaster development might do well in Java. I'm not especially sold on or trusting of the alleged security or trustability features of Java (sorry, no offense) but I *do* think it's a neat tool for building non-machine specific network aware applications. Ignore the fact that people use it to build silly animations or that downloadaded applets may or may not be secure - it's still useful as a development tool. -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

4 3

Re: Internet File System?
by Scottauge＠aol.com 17 Dec '03

17 Dec '03

This is actually a good idea. There is something in the UNIX world called NFS (network file system). It is based on TCP/IP sockets. I do not know if you know anything about UNIX, but the file system used does not have logical drives (like a: or b: etc), just one huge tree that can span across many harddrives on many computers, thus making them all look like one. NFS helps to connect the other computer's file systems to the network tree. I think it is pretty cool... There is an RFC for it, though I do not remember the number. I read it once cuz I was planning a windows 95 version so I can hook my laptop up to my UNIX computers, but I found software to do it with and was like, why should I kill time on it when I could be using it to make money! It is very complete and designed to be implemented in C. Since Java is so close to C, a port could probably be made fairly easily (provided ya know something about writing file systems/operating systems ;) )

2 1

LD
by blanc 17 Dec '03

17 Dec '03

Dr. Dimitri Vulius, you made this remark to someone: ...You really should get to know L.D. better before you repeat the lies Timmy May spreads about him. ......................................................................................... May I recommend that you read the content within these urls: http://www.csn.net/~ldetweil/ and especially: ftp://crvax.sri.com/risks/15/risks-15.27 (and 28) These contain a history which will clarify for you some of the comments made about L.D.'s relationship to the list, Tim May, etc. .. Blanc

1 0

Transforming variable-length to fixed keys
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

I posted this to sci.crypt recently but the response to it was rather underwhelming, so I thought I'd repost it here to see if anyone has any comments on it. What it is is a scheme for transforming arbitrary user keys (typically a long passphrase) into a fixed-length key for a particular algorithm. This has the following properties: 1. The user key 'userKey' is transformed into an algorithm-specific key 'key' using a number of 'iterations' of a hash algorithm 'hash()'. 2. The transformation is strongly serialized so that any form of attack involving parallelization or precomputation isn't possible. 3. The transformation is non-reversible, so that recovering the transformed key won't recover the original key. 4. The result of the transformation is algorithm-dependant, so that if an attacker recovers a transformed key for one algorithm they can't recover the transformed key (from the same user key) for another algorithm. 5. The transformation can be iterated as often as required to make password-guessing attacks difficult. 6. The transformation process is algorithm-independant and can use any type of hash algorithm and original and transformed key size. The transformation algorithm (which was designed with the help of John Kelsey) is as follows: key[] = { 0 }; state = hash( algorithm, mode, parameters, userKey ); for count = 1 to iterations for length = 1 to keyLength (in hash_output_size blocks) state = hash( state ); key[ length ] = hash( state, userKey ); The state acts as an RNG which ensures that the key hashing is serialized. The initial state depends on all encryption parameters, not just the user key. If we hashed the user key directly and then used it for a number of algorithms then someone who could recover the transformed key for one algorithm could compromise it if used for other algorithms (for example recovering a DES key would also recover half an IDEA key). Hashing all algorithm-related parameters means that a successful attack one an algorithm, mode, or configuration won't allow the key for any other algorithm, mode, or configuration to be recovered. The code which implements the iterated hashing is: /* Hash the variable-length input to a fixed-length output */ memset( key, 0, keyLength ); for( count = 0; count < iterations; count++ ) { for( keyIndex = 0; keyIndex < keyLength; keyIndex += hashOutputSize ) { /* state = hash( state ); key[ n ] = hash( state, userKey ) */ hash( state, state, hashOutputSize, HASH_ALL ); hash( NULL, state, hashOutputSize, HASH_START ); hash( temp, userKey, userKeyLength, HASH_END ); | | | output input input size /* Copy as much of the hashed data as required to the output */ length = ( keyLength - keyIndex ) % hashOutputSize; for( i = 0; i < length; i++ ) key[ i ] ^= temp[ i ]; } } Peter.

2 1

RE: Where to write crypto?
by Will rodger 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Sat, 21 Sep 1996, Dan McGuirk wrote: >>| > If I want to go to a country outside the United States to write >>| > cryptographic code that will be freely distributable, what's the best >>| > place to go? >>| >>| Or, on the other hand, is there no way that a U.S. citizen can legally do >>| this? >> To which Adam Shostack replied: >> Thats not clear. The ITARs seem, on their face, to create a >>prior restraint on speech based on its content, and forbid Americans >>the right to leave the country to pursue their livlihoods. The odds >>of geting persecuted seem pretty low. Could be. But prominent crypto atty. Ken Bass told me he thought such actions would be vigorously prosecuted - quicker than you could say "global proliferation." Thing to notice here: no prominent cryptographer in the US has come forth and said "yes, I helped write strong crypto abroad." Which isn't to say most of them aren't traveling abroad frequently these days - take, e.g. the presence of M. Blaze, W. Diffie et al. at the OECD in Paris this week. >> As to the (predictable) comment that I'm not doing this, I'd >>be happy to entertain offers of crypto work that are not in the US, >>possibly leading to me being a test case. >> Call before you do, Adam; I'd kill to have that story first... Will Rodger Washington Bureau Chief Inter@ctive Week -----BEGIN PGP SIGNATURE----- Version: 2.9 iQEVAgUBMkXvQ0cByjT5n+LZAQGLyQf8Ctlf2JVeYI8Ws47YovJ0fhF3nzf9ihLd nHzZNqGpEVGVcOXYw2u84jV68y9Y7M3vdo/BDZCA3G0T8zZopmpiNZHgblh15ndP jPdYRkz4+7NnEn/Tz/1LQS6SVp/LA1G/qoCCNqGuYneSVkZxxsoeoEp9ZdCMhDE9 iq7IEI+pyY44vnSWvo65YNQZXt4thf94E94pspoNWC+DNwRDj8BkK28MpM3vduqD i/cViVUcKOLVg/b31HTVrq0rwWClfD0+J4a4F8AcGcf4SwedGCVaUAdSWRw0FQTJ 6AioCSd5Cs/g9k+xxaqRMzExJcBphwnlCZvA+qpgjY+KdagaEqJwGA== =vyTv -----END PGP SIGNATURE-----

1 0

Re: Bernstein hearing: The Press Release
by jim bell 17 Dec '03

17 Dec '03

At 05:15 PM 9/22/96 -0700, Rich Burroughs wrote: >At 04:39 PM 9/21/96 -0800, Jim Bell wrote: >>At 02:03 PM 9/18/96 -0700, John Gilmore wrote: > >[snip] >>>* Any legal framework that allows a government bureaucrat to >>>censor speech before it happens is an unconstitutional prior restraint. >>>The government is not allowed to set up such a drastic scheme >>>unless they can prove that publication of such information will >>>"surely result in direct, immediate, and irreparable damage to our >>>Nation or its people" and that the regulation at issue is necessary >>>to prevent this damage. >> >>At the risk of being a devil's advocate, let me suggest that you are >>conceding too much even with the preceding paragraph. The 1st amendment >>says nothing about preventing speech which (even admittedly) would result >>in "direct, immediate, and irreparable damage to our nation or its people." >[snip] > >Jim, that's a quote of Potter Stewart from the Pentagon Papers case, if I'm >not mistaken. It's not written in the Constitution, but Supreme Court >precedent is the next best thing as far as con law goes. Under the circumstances, I think it would be wise to actually EXPAND our protections. A lot has happened in the last 25 years. If a reasonably extensive list were made of situations and circumstances where the wool was pulled over the eyes of Americans by government...and how subsequent developments showed that these things were best revealed THEN and not later...it could be reasonably argued that there is no or almost no area where the "direct, immediate, and irreparable damage" exception is likely to realistically exist. You should point out that the Pentagon Papers case was decided notwithstanding an extraordinarily generous set of assumptions common in Cold-War America about the power and authority of government, many if not most of which would be no longer considered valid. Put the opposition on the spot: Insist that they provide a substantial number of examples where speech was expected, was attempted to be restricted by gov't under such an exception, where that speech actually occurred (either by refusal of the court to intervene or by refusal of a party to the case to restrict his speech), and show how this actually caused any "direct, immediate, and irreparable damage." In the absense of such examples, it is reasonable to presume that, generally, they don't exist or are so rare as to be ignorable. (For example, in the Progressive case from the middle 70's, the gov't dropped its case. What harm occurred?) >The government can restrict speech in time, place or manner, according to >the courts. Restricting content is more difficult, and places a much >heavier burden on the gov. > >To expect people writing about and arguing the case to completely ignore >the existing case law is foolish, IMHO. I am _not_ suggesting that case law be "ignored." Rather, point out that the case law, even though it goes in your favor, was still decided in a thoroughly biased atmosphere and therefore further reductions in government authority are appropriate. Jim Bell jimbell(a)pacifier.com

1 0