December 2003 - cypherpunks-legacy

RC4 analysis
by jcard＠st6000.sct.edu 17 Dec '03

17 Dec '03

Has anybody out there done any significant analysis of the RC4 stream cipher? What I am interested in is the expected cycle length of the standard implementation (256 byte state table)? Working with the reduced sizes, the cycle length appears to grow exponentially, but I am unsure how to verify this. Have there been any other results surfacing besides the reports on weak keys? thx. Justin

1 0

Re: one-body, one-cert
by Hal Finney 17 Dec '03

17 Dec '03

[This is picking up a discussion from the SPKI list on the topic of anonymous credentials. I think cypherpunks is a more appropriate forum.] From: Carl Ellison <cme(a)cybercash.com> > Yes. This protects me from the evil CA. However, the original posting > person wanted to make sure that once he had seen bad behavior on my part > (where "I" am identified by my DNA) that every future use of any key by me > will gain me no access to his service. > > I believe these two desires are fundamentally opposed -- irreconcilable. > If someone does a bad thing with some key I'm supposed to control, then I > want to be able to write that key off and get another one to give me > access. If *I* do the bad thing, then he doesn't want me ever to get > access again. > > This is resolvable only if we have a way to detect the DNA behind the actor > -- but we don't. All we have are keys which a person controls -- until he > doesn't. I think in a system like this, participants would need to understand the limitations and design the protocols with them in mind. Ideally, getting access to someone else's keys would be made very difficult, more so than it is today, since the consequences could be so much more drastic. It would be as though evil spirits roamed the world and could invade the consciousness of careless people, taking over their bodies and forcing them to commit horrendous acts. In such a world we could expect people to take whatever careful precautions are possible to avoid such threats. Furthermore, systems which apply punishments for bad behavior would have to be aware of the possibility of such occurances. It would generally not be appropriate to impose draconian consequences for a single bad act. Rather, the possibility would always have to be considered that such actions were not the fault of the apparent perpetrator. We might expect to see systems in which single instances of misbehavior are forgiven, but patterns of repetitive bad conduct are punished. I believe protocols similar to the ones Jim McCoy mentioned from Chaum can provide very flexible (although possibly inefficient) means for controlling credentials in a variety of ways. In the context of limited-participation credentials, then, a reasonable policy would be not to strictly cut off anyone who broke the contract, but rather to consider extenuating circumstances. For example, if a credential is stolen and the owner is aware of it (say it is locked in a hardened smart card), and he can prove that he made a good faith effort to notify service providers that they should invalidate the credential, then this would excuse misbehavior. Even without this kind of evidence, it may be appropriate to give people a limited number of second chances. True, this allows an unscrupulous person to violate the rules some number of times and get away with it. However this may be tolerable as a generally low level of background noise. No society is perfect. Being able to largely deter contract violations while still maintaining privacy for the participants would in my opinion be superior to the world we seem to be heading towards, one in which dataveillance, profiling, and tracking are the norm. Hal

1 0

Re: Apologies and Clarifications -
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> Some will contentiously assert that the key and other > parameters might be hacked. While we include within the > system facilitators that reduce that risk to a minimum, and > to near zero if you use simple precautions, it is true that > the hacking possibility exists. However, that possibility > exists for RSA, PGP, hardware sourced OTPs, or any other > form of security or encryption. We are better positioned in > that regard than others but in terms of the human element, > as we all know, there is no such thing as perfection. Listen fool, Much as we might advance this possibility we do not need to. Your system has been proven insecure by two cryptanalytic attacks, one by Adam and one by myself. if you cannot understand these attacks what are you doing creating cryptosystems and if you can understand them WHY are you still calling your system secure? Please enlihten us as to which of these two distinct cases you fall into, if 1. then you are a fool, if 2. then you are a stubborn fool. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

IPG algorithm - timing attack
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> The author of this private mail can step forward if he wishes; its a > good thing to have noticed. > > Adam > | > The algorithm is: [USELESS IPG ALGORITHM CUT] > | Also note this would be exceptionally vulnerable to Paul Kochers > | timing attacks if used as a real time stream cipher. > | > | Yet the author of this still claims it is a one time pad and as such > | cannot be cryptanalysed. I feel a snake oil attack coming on... The was my work... I meant to send this to the cypherpunks list but somehow my mail program just replied it privately to Adam. Has anyone else looked at this? BTW, this IPG guy could have invented the new FEAL here, the first algorithm anyone tries any new attack on!!! ;-) Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

Re: Apologies and Clarifications -
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> The assertion that an Ub must be an Rb, a truly Random bit, > is irrelevant ideology unless there exists the means to > convert the Unknown bit, Ub, into a Known bit, Kb. This is a plainly circular argument, what you are saying is that if a bit cannot be predicted it can be used, yet it does not have to be random. It is patently obvious to anyone with cryptographic experience and most people without any that to be unpredictable a stream of bits has to be random, otherwise if there is a correlation the next bits can be predicted from the previous bits. > That is the sublime basis of the IPG algorithm, which is to > generate a stream of "unknown bits" which cannot be > analytically reconstituted in the absence of the OTP > generator key, and possibly other related key like > parameters. RUBBISH, yes, I know i`m shouting but I really have taken enough of this crap from snake oil peddlers over the years. IF ARITHMETIC METHODS ARE USED TO CONSTRUCT A KEY THE RESULTING CRYPTOSYSTEM IS NOT A ONE TIME PAD.... END OF STORY You cannot mathematically prove the security of the generator used in this system and are unlikely to be able to ever. whatever the case you can never prove the security of the whole system, the only provably secure system is a one time pad. It may be predictable on output, we have already shown that it is vulnerable to many other cryptanalytic attacks, including Adams chosen plaintext attack and my timing attack. The whole system has a number of gaping holes in it and no ammount of high worded twaddle is going to make it secure. > The additional caveat of course is that the key > cannot be guessed, nor can it be derived from brute force > methodologies, both of which are patently impossible with the > IPG algorithm. The key can probably be guessed, on first examination, which took about 5 minutes before I dismissed the algorithm as snakeoil, the generator appeared to me to be an array or linear congruential generators which have been cryptanalysed and proved insecure, by this very fact there is obviously a cryptanalytic attack waiting out there on the generator which produces no unpredictable state whatsoever in the "randomness pool" > You do not have to be a Stephen Hawking to > comprehend why that is a fact; each of you, with possible > minor exceptions, will be able to discern that because it > quickly becomes self evident as you ply the algorithm. No, each of us has looked at the algorithm and decided that it is insecure, we have even proved it to you mathematically, and if your math was any better than high school level you would be able to comprehend our arguments, it is abundantly clear to me that nothing, not even the words of a world class cryptographer like Blaze or Rivest would convice you that your system is insecure, you have gone about creating a cryptosystem the same old way any idiot with no experience or knowledge of cryptography does. You have made up the most hideously complicated mess of data transformations you can imagine then constructed an inverse function to recover the data. you have given no thought to any complexity theoric or intuitive proof of the security of this algorithm, just done some irrelevant statistical tests on some keystream. your hope is that no-one else will be able to untangle this mess, you are deepy wrong. Please get a clue. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

Re: Q.E.D. reply to Perry Metzger
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> As in so many other cases, you are so F.O.S. that it is > unbelievable. Your eminence pontificating about it does make > it true. No, Mathematical proof makes it true... > thus the algorithm must be attacked analytically - as EVEN you, or anyone else, > will be able to clearly see, if you examine the algorithm, it cannot be > attacked analytically. Absolute sanctimonious twaddle, the algorithm has already been analytically compromised by Adam Shostack with a known plaintext attack requiring only a few bytes of known text, I have also theoretically compromised the system using timing attacks, furthermore I believe that linear and differential cryptanalysis may provide an even more efficient attack, though I have yet to take the time to see if this is indeed true, whatever the case, the algorithm is broken, there is nothing more to discuss > My algorithm most certainly does NOT produce a theoretical pure Random > Number Stream, accordingly it is a PRNG, but it most certainly does > produce an OTP that meets each and every requirement of such, other > than some theoretical definition that you seek to impose on it by your > dogmatic words. You do not have to take my word for it, the FULL > ALGORITHM, which has never before been published, is set out on our web > site. For the last time it is not a one time pad, it is a stream cipher, and furthermore it is an insecure stream cipher, soon available in a town near you. > There is no mathematical proof that my PRNG streams are not an OTP - > because they are OTPs. There are 156.8816 megabytes of raw encryptor > stream data at our site. They constitute 10 OTPs, all using the same key, > only the message numbers vary.but with different message numbers only. As I said, they are not OTPs and they never will be, they are not provably secure and are therefore not a one time pad. > You are so vane, so crass, so dogmatic, so blinded by your opinions, > that you obviously look at yourself in the mirror wheneever given the > opportunity. You do not know what the hell you are constantly > pontificating about. talking about and including the one under discussion > herein. Why not show everyone your prowess by telling us what the key and > the As, Bs, and Cs, are they were used to generate the 156.8816 megabytes > referred to above. Of course, you cannot, so you bray like an ass to cover > up your crypto impotence. Well said Perry. > > > Accordingly, obviously it is they, not us, who are > > > the ones that have "Nihil Est Demonstrandum," in this matter. It appears the IPG guy needs to perfect his Latin too, the phrase is nihil est demonstratum - nothing has been proved (perfect tense) There is no such Latin word as demonstandum. > > > While the vast majority of people knowledgeable about > > > cryptography have not heretofore believed that it is possible > > > for software to produce an OTP, And what they know believe is that you are a fool, in addition to this they can prove mathematically that the system you have put foward is a stream cipher and not a one time pad, and that it is insecure. > > The information content, or entropy, of the key stream is necessarily > > no larger than its keyspace. That is, if you have a software > > pseudo-random number generator using an N bit seed, the entropy of the > > keyspace is necessarily never greater than N. This is mathematically > > certain -- no amount of prayer on your part can change that. > > > > > that does not make it a > > > scientific fact, Absolutely, your system is therefore provably not a one time pad, the very definition of which is that it has equal or greater state than the message it is used to encrypt. > It is absolutely not perfect in the Shannon sense, but it does not have to > be theoretically perfect to fulfill the requirement of being an OTP. You > definition of an OTP, or a OTP as you mistakenly refer to it, is an > extraneous mathematical definition that people have mistakenly > extrapolated from Shannon. Rubbish, we have not extrapolated anything, Shannon proved in a statistical framework of pure mathematics that the only provably secure system is a true one time pad, NOT you system. > > > In support of their position, some have pointed out that John > > > von Neumann, to paraphrase, stated that ARITHMETIC cannot > > > produce random numbers, > > <SARCASM> So you are claiming now that your system does not use arithmetic? - tell us how my good man, you may well have discovered the worlds first non arithmeric algorithm to use a purely arithmeric machine to execute it. </SARCASM> > There you go again, pulling things out of you crazy hat, head, running > off at the brain again, stating a falsehood and hoping that people will > overlook it. I assume that you held a seance with von Neumann and he told > you that from the great beyond, since that is clearly not what he said. A > careful reading of von Neumann does not reveal that he said one thing and > meant another. He used the word ARITHMETIC, if he meant something else he > world have said so. Furthermore, he was referring random numbers, and to > repeat emphatically, my algorithm is a PRNG, but it also happens to be > an OTP, as we can prove. Q.E.D. The above passage is an oxymoron, it is plainly a contradiction in terms to call a PRNG an OTP. > > > We stipulate the obvious fact that the encryptor stream > > > generated by EUREKA is a PRNG stream, though we do consider > > > it gross denigration to castigate it as ONLY a PRNG stream. It is not only a PRNG stream, it is an insecure PRNG stream as Adam and I have shown. > It is a stream cipher, but it is also an OTP, just as a hardware sourced > RNG is a stream cipher that is also an OTP. Rubbish. If the entropy is limited, you do not have a One Time Pad, period, end of discussion, its over. > And for you to claim that my contention is analogous to comparing bread > to an automobile, petty nonsense and mindless hyperbole. Your whole diatribe on this subject has been utter bullshit, throughout the whole discussion you have made no effort to listen to what people have said, and you have made no effort to understand our attacks on your system, god only knows why we bothered, you system really doesn`t deserve our valuable time. > > > Think about that simple supposition for a moment. What do we > > > mean by an OTP? An insecure stream cipher you are planning to flog to unsuspecting people knowing nothing about cryptography using the same mindless technobabble and high worded crap you have used on this list. We have already established that your cipher is easy to break, so your mindless babble that it is secure really don't matter. We will ignore you from now on, you are really just an insignificant silly little man... Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

Re: Interesting article on ATM in Wired (of all places)
by Ryan Russell/SYBASE 17 Dec '03

17 Dec '03

We passed that article around the office here.. I found it interesting as I've not been a fan of ATM so far... My boss knows a guy at Sprint (in the article, there's a guy from Sprint's Internet group that has bad things to say about ATM, and says they aren't going to use it) so he called him up and asked about the article. They guy says "WHAT? We're installing a huge ATM network! Fax me that article!" The left doesn't know what the right hand is doing. Sounds like every place I've ever worked.. Ryan ---------- Previous Message ---------- To: cypherpunks cc: From: rcgraves @ ix.netcom.com (Rich Graves) @ smtp Date: 10/21/96 11:22:08 PM Subject: Interesting article on ATM in Wired (of all places) Since I ordinarily do nothing but bash the journal of hype and unreadable blue-on-orange type, I figured I should express appreciation for Steve Steinberg's "Netheads vs. Bellheads" article starting on page 145 of the October issue. The ATM v. real networks battle is one that is becoming increasingly important at gads of institutions, such as mine. In addition to economic efficiency, there are civil liberties reasons to favor the current packet-switched technology over circuit-switched bit-mangling. The nexus on this technical front isn't as tight as it is on the encryption front, but I'd urge people in positions of technical or budgetary responsibility to line up with the good guys, i.e., us netheads. You don't want an Internet controlled by ATM technology. It would make censorship, wiretapping, and other forms of nastiness by government and other armed thugs far too easy. I'm speaking only for myself, of course, and of course there are technical reasons I'd prefer to implement gigabit Ethernet as well. The leader "Why the net should grow up" in the October 19th issue of _The Economist_, whose net reporting has improved markedly with the addition of some new staff, may also be of interest. Some overlaps with the Wired article, though the writers probably weren't technically savvy enough to realize that they were talking about the same thing. More comments on that when I find time. -rich

1 0

Re: Prof Shamir arrested
by jim bell 17 Dec '03

17 Dec '03

At 03:01 PM 10/22/96 +0200, Alex de Joode wrote: >Bert-Jaap Koops (E.J.Koops(a)kub.nl) wrote: >: Jim Bell wrote: >: [many things on "fraud"] > >: Excuse me if I don't react on this in detail. We have already >: explained it, and there it stands: fraud means playing a game without >: abiding by its rules. It's perfectly legitimate to establish a game >: and to introduse rules of the game with it. If you want to play the >: game, play by its rules, otherwise don't play it. If you play it >: while cheating, though, you must bear the consequences ("go directly >: to jail" ;-). > >: Bert-Jaap > >What Mr. Bell probably means is that 'if the powers that be' decide >to unilateraly change the rules, you are lost in limbo. That's certainly one of my points. There is a concept in data theory called "Hamming distance," which is basically the number of steps it takes to go from "here" to "there." If we're excessively generous and call the countries we live in "free," the question is how much effort is required to move that country to a totalitarian system. If everyone uses encrypted telephones whose codes can't be broken, with no GAK-misfeature, the government can't easily force everyone to change to a situation where everyone fears being wiretapped. Assume a typical GAK system however, and there's apparently nothing to prevent things from going from free to unfree literally overnight. I've asked Koops to explain how he can help prevent fraud _by_ the government; he's silent on this point. I have to conclude that he doesn't consider that to be an issue. I think it's a big issue. > The notion >that 'the powers that be' can be relied opun is seriously flawed, >for example take in account some of the dealings of our own guvment, >the abolishing of the WIR -overnight-, the proposals of Vermeent >that totally neglected art. 1 WvSr. > >Basicly 'fraud' is a definition that benefits 'the powers that be', >one that seriously harms our rights and liberties. You also state >"If you want to play the game, play by its rules, otherwise don't >play it." Well sometimes people have no other option then to play, >and dropping out if gouvernment changes the rules unilateraly can >be to costly an option .. One of the things that Koops has repeated failed to do is to show how his invention would actually be desired by the users, enough to implement it. Why, exactly, would a person adopt a system like it? To whatever extent his system is a "solution in search of a problem," he needs to show what kind of problems would need that solution, and would it work? Why would a person participate in any sort of cooperative effort that might, hypothetically, make him guilty of "fraud"? Only because he's getting some benefit. I don't totally reject the possibility that a group of people might willingly set up some sort of shadow-Internet network possibly with better performance, agreeing among themselves to restrict encrypted communications to some type of GAK system, but it's necessary to ask what the benefit would be in doing this. Or, more particularly, why couldn't they set up the same network without any such agreement? Proposals like those of Mr. Koops will always fail if people can get benefits without agreeing to the costs, and it's clear that there are no strong reasons to adopt a mutually-agreed GAK-type system without some sort of external coercion. (Either bribing such an organization with money based on funds stolen from taxpayers, or punishing everyone who doesn't agree with higher taxes, or both.) This means that Koops' proposal is inextricably linked to government extortion, which is why we challenge it. Jim Bell jimbell(a)pacifier.com

1 0

Re: Japanese Export Restrictions
by tavik＠alias.cyberpass.net 17 Dec '03

17 Dec '03

schryver(a)radiks.net allegedly wrote: > Has any one been able to verify the anonymous posters assertion concerning > japanese crypto export restrictions? What counts as verification? I heard it straight from a crypto exporter in Japan, as the reason why the stuff they were sending me would be delayed, and by the way they needed more information for the export request. I might even be the original source of the news since I did mention it to a freind or two. (I am not the original anon poster). As to the details re: if/when/why the change was made, etc., I don't know. Is there a Japanese equivalent of the CFR wherein the government regs are published? Perhaps one of our bureau-savvy Japanese readers could check into it.

1 0

Re: Timmy May is a jerk
by c62op27＠ibx.com 17 Dec '03

17 Dec '03

Ok, I'm a new subscriber. I take it as a given that Timmy May is a jerk, but who is he?

2 1