December 2003 - cypherpunks-legacy

Re: how much entropy in common answers
by Pat Farrell 17 Dec '03

17 Dec '03

At 01:26 PM 11/23/96 -0800, Hal Finney wrote: >From: Pat Farrell <pfarrell(a)netcom.com> >> Clearly there are cultural issues involved. The entropy in a question >> such as "what is your favorite brother's name?" is low in an Irish >> family like mine where names cluster arround choices such as are Patrick, >> John, Sean, and Dan. >> So how do we measure the entropy objectively? > >You have to estimate the probability that the attacker will guess what you >have chosen. This will depend on how much the attacker knows about you. >If he knows that you're Irish, it will help in the question above. If he >knows the names of your brothers, it will help a lot more. Probably >it is best to be conservative in assuming what your attacker knows. I was really hoping for some insight into the general problem. If you knew that my family is Irish, that makes certain names much more likely. Obviously if you know that I've got five brothers, a little bit of work will probably let you know that they are Tom, Dick, Harry, Mike, and John. But that is an example of a terrible question for Carl's approach. I was asking the more general question. Carl suggested that in general a first name has about eight bits of entropy. But knowledge of the social environment can seriously reduce it. Jenifer was a hugely popular name for girls in the US ten to 20 years ago. You'd expect more Juan's and Jose's in a Hispanic community, just like you'd expect the Dan's, Pat's, Mike's, in an Irish community. I know that the classic definition of entropy is, but without knowledge of the statistical universe that we're dealing with, how can I measure it? The probability that a male's first name is Harry is probably pretty low in general, yet it is exactly 20% if you restrict the world to my brothers. Carl suggested "What was the name of the first person on whom I had a crush?" But if 33% of the women are named "Maria" in the local universe, then that is not much entropy. Yet a name of "Maria McGee" is probably fairly high entropy, as it is an unlikely combination. If you were raised in a small rural area, there might not be all that many possible answers to Carl's question. >If you have four brothers and nobody whom the attacker could ask will >know who is your favorite, but you think he could find out there names, >then he has probably a 1/4 chance of guessing right. (Actually he >might do better by preferring older brothers rather than younger, etc.) This is exactly the type of local social bias that I want to measure. We would expect that an older brother could be a role model, etc. and thus be more likely to be the "favorite" How do I know when I've got Carl's 90 bits of entropy? Pat Pat Farrell CyberCash, Inc. (703) 715-7834 pfarrell(a)cybercash.com #include standard.disclaimer

1 0

Re: IPG Algorith Broken!
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

At 12:33 PM 11/23/1996, Eric Murray wrote: >John Anonymous MacDonald writes: >> >> >> At 8:09 AM 11/23/1996, Eric Murray wrote: >> >No, you can't. It's impossible to prove an algorithim unbreakable. >> >> No? Please prove your assertion. > >You can't prove a negative. If it can't be proven, why do you believe it is true? The good news is that you can prove a negative. For example, it has been proven that there is no algorithm which can tell in all cases whether an algorithm will stop. >The best IPG could say is that >it can't be broken with current technology. >Next week someone might come up with a new way >to break ciphers that renders the IPG algorithim breakable. The best they can say is what they did say: they have a proof that their system is unbreakable. What you question, quite reasonably, is whether they have such a proof. >You point could have been that the same problem exists >for proofs- that next week someone could come up >with a way to prove, for all time, that an algorithim >really IS unbreakable. So, to cover that posibility >I should have said "it's currently impossible to >prove an algorithim unbreakable". :-) Or, more accurately, nobody credible has seen such a proof. But, a clever person might invent one. IPG is eager to demonstrate their proof. They should hire a professional skilled in the art to evaluate their proof and publicly announce the results. This costs less than $5000 and would be, presumably, a small part of their profits should they have invented such an algorithm. diGriz

7 6

Re: Sameer R.I.P.
by drose＠AZStarNet.com 17 Dec '03

17 Dec '03

On Sun, 24 Nov 1996 Sandy Sandfort <sandfort(a)crl.com> wrote: >On Sun, 24 Nov 1996 drose(a)AZStarNet.com wrote: > >> Sameer has decided, it seems, to get out of the anonymity >> business and pursue other interests. > >Well, I guess you could call privacy guaranteed by strong crypto, >"other interests." Seems right in the middle of what Cypherpunks >are all about. If you like strong crypto, you'll love what's >coming next from C2Net. Point well taken. Most people who are in the market for a Web server, however, are cognizant of the fact that along with Netscape, Microsoft, Open Market, O'Reilly et al, Sameer has been for some time now selling a well regarded product: namely, his proprietary version of Apache. I guess my point was that, notwithstanding Sameer's estimable commercial software offerings, the *news* is that he has, to repeat myself, abandoned the anonymity business with respect to many of his traditional public Internet services. Certainly, no slight was intended. I "like strong crypto", so I naturally look forward to stuff from C2Net that, in your opinion, I'll "love." David M. Rose drose(a)azstarnet.com

2 1

Re: IPG Algorith Broken!
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 4:21 PM 11/23/96 -0800, John Anonymous MacDonald wrote: >At 12:33 PM 11/23/1996, Eric Murray wrote: >>You point could have been that the same problem exists >>for proofs- that next week someone could come up >>with a way to prove, for all time, that an algorithim >>really IS unbreakable. So, to cover that posibility >>I should have said "it's currently impossible to >>prove an algorithim unbreakable". :-) > >Or, more accurately, nobody credible has seen such a proof. But, a >clever person might invent one. I thought Shannon proved one-time-pads to be unbreakable using information theory. ------------------------------------------------------------------------- Bill Frantz | The lottery is a tax on | Periwinkle -- Consulting (408)356-8506 | those who can't do math. | 16345 Englewood Ave. frantz(a)netcom.com | - Who 1st said this? | Los Gatos, CA 95032, USA

5 5

RE: Symantec's claim.
by James D. Wilson 17 Dec '03

17 Dec '03

See: http://www.alw.nih.gov/Security/security.html, and the attachment re Irina, Good Times, etc. ---------- From: cracker(a)icon.co.za Sent: Monday, November 25, 1996 3:45 AM To: cypherpunks(a)toad.com Subject: Symantec's claim. In light of recent claims,i would like somebody to clear this up for me. There seems to be a great deal of conjecture over wether or not the Deeyenda Virus exhists. Symantec denies it's existence,although i hear differently?? Greatly appreciate anyone who can shed some light on the subject,even though C-punks list doesnt usually deal with this topic of thought ;) Anyone come across the pkz300 trojan,if you have it send it please. A student,a paper,and a possible future career are at stake here,so please dig deep into your pockets!!!!!! Asking a lot i know! J a m e s "Lead.Follow. Or get out of the way" ----------------------------------------------------------------------------------------------- Type Bits/KeyID Date User ID pub 1024/9E318AA5 1996/09/24 Cracker <cracker(a)icon.co.za> -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3ia mQCNAzJHdKwAAAEEALl3A6auLG0JLdtgEzl6KfPNqbTTSDX4L4To2b7PLqGDVV5r BezC9dD/ITrCK9M64juiQ2p/DNjIihnXlEsJCy2btypStypQgU1fvAei3AnZ1cQ8 NiAnHNS+ImUAJgZjSHEQSevGE53IUovmWQ7YHUz9VpTTCtoJoUKxYuqeMYqlAAUR tBxDcmFja2VyIDxjcmFja2VyQGljb24uY28uemE+iQCVAwUQMkd0rkKxYuqeMYql AQEjagP/cYgGLAkWZJLeRcM4URwBX3J/0R54DadVnsvvoxDkzilv7U02IXZGZGnA CvXsu2sThS7qDBiHFop/OZs3WmlQbQ4BAZ/hiCs5tSU2e7fkk0EKxsGAD1pTbw/J rRU4WePLc++vv+6CBKw5NCSR5kMh8H3X4qtZZ9dYX9zsuzWKdpk= =YGH8 -----END PGP PUBLIC KEY BLOCK-----

1 0

Security of E-Money
by John Young 17 Dec '03

17 Dec '03

The Bank for International Settlements (BIS) published in August, 1996, "Security of Electronic Money," a long, detailed study. Compare this architecture to Anderson/Kuhn's and Biham/Shamir's recent demolition. The orginal is available at: http://www.bis.org/publ/cpss18.pdf Better, Ian Grigg has HTML-ed it at: http://www.systemics.com/docs/papers/BIS_smart_security.html

1 0

RE: Mass-market crypto phones
by Duncan Frissell 17 Dec '03

17 Dec '03

At 09:41 PM 11/22/96 -0800, Declan McCullagh wrote: >PS: Over margaritas and enchiladas tonight, I was talking with one of the >crypto-ITAR enforcers from State. I mentioned that I'd be going out of the >country soon and taking my PowerBook laptop. Quite sincerely, he urged me >to keep a record of when I left and when I returned for five years. You >see, I have domestic Netscape Navigator on it. Wacky stuff. Comments like that by Feds are meaningless absent the busts of a few "laptop smugglers." If they have never busted anyone, it's a dead letter (all the more so since they legalized casual carry with record keeping). DCF

1 0

Re: IPG Algorith Broken!
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Sun, 24 Nov 1996 02:20:25 -0600 (CST), snow wrote: >> > diGriz >> Use an anon. remailer and sign your posts. Brilliant. Just brilliant. > The Stainless Steel Rat. Harry Harrison. Just as an off-topic SF note, how many people on the list read this series during their formative years? How many of them thought it was a guide book? # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

1 0

Re: IPG Algorith Broken!
by eli+＠gs160.sp.cs.cmu.edu 17 Dec '03

17 Dec '03

Dale Thorn writes: >Is the concept here that: Whereas conventional crypto generates/hashes >a *key* with which to encode the text, IPG generates a *pad* from a key, >more or less the length of the text, with which to encode the text?? A cryptosystem is given a key by the user. A block cipher uses it to encrypt chunks of plaintext, perhaps 8 bytes long. (This is an oversimplification.) A stream cipher uses it to generate a pseudorandom sequence that is combined with the plaintext. IPG's product is a stream cipher. >It seems to me they're putting an additional layer of stuff ("OTP") between >the key generation and the actual encoding, so what's the problem with that, >as a concept? The first problem is the name "OTP". A one-time pad is a well-defined thing, and this isn't it; they'd like to be associated with the term because the one-time pad is in fact provably secure. So they have a stream cipher. Is it a good stream cipher? Well, nobody knows, because no cryptanalysts have taken the time to attack it. There aren't all that many who publish in the open literature, and there are thousands of amateur proprietary schemes out there -- who has the time? If it were designed by someone known to be competent (RC4), or if it were widely used (pkzip), somebody might think it worth looking at. If you're not a cryptanalyst yourself (and I'm not, but at least I know it!), all you have to go on is the history of similar schemes. This is not encouraging; there are outfits which for a moderate fee will crack the proprietary encryption offered by dozens of popular products. IPG's history is even less encouraging Maybe this one's different from all of those. How valuable a secret would you like to wager on that? If IPG wants credibility, they should retain a respected cryptographer, or several, to attack their scheme. (Or just publish Don's proof of unbreakability. Since the scheme is provably _not_ information-theoretically secure, this must be a proof of computational security, presumably a superpolynomial lower bound. And as the scheme is trivially breakable in NP time, Mr. Wood is sitting on a _major_ result, a resolution to the central problem in computational complexity theory: a proof that P != NP. Do publish, sir.) -- Eli Brandt eli+(a)cs.cmu.edu

2 1

Stewart Baker on HP-Intel-Microsoft Crypto Announcement
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Sun, 24 Nov 1996 22:14:34 -0500 From: Dave Farber <farber(a)cis.upenn.edu> To: interesting-people mailing list <interesting-people(a)eff.org> Subject: IP: HP-Intel-Microsoft Crypto Announcement Date: Sun, 24 Nov 96 21:43:47 EST From: "Stewart Baker" <sbaker(a)mail.steptoe.com> To: farber(a)cis.upenn.edu Subject: HP-Intel-Microsoft Crypto Announcement I also attended the Hewlett-Packard/Intel/Microsoft announcement, and I thought it might be useful to offer a slightly different perspective from Ross Stapleton-Gray's and Declan McCullagh's notes. It's understandable, given the coincidence of the two events, that Ross and Declan saw the announcement as tied to the government's key recovery initiative, but I think they may have been led astray by the timing. As I understand it, the HP framework is not so much an embrace of government regulation in this field as a recognition by some major companies that governments simply are not going to get out of the business of regulating encryption soon, or at least not soon enough for the people who want to build a secure global network right now. I see the announcement as an effort by business to sidestep the policy debate, to say to the politicians, "Whatever crypto policy you decide to adopt, this system will work with it." So, in my view, the HP technology is significant mainly for its flexibility rather than for supporting key recovery or any other particular policy. It allows PC manufacturers to build into their products virtually any form of encryption that a user could want and to ship those products around the world without falling afoul of export controls or domestic regulations on encryption. >From a security point of view, this is important because it allows commoditization of security hardware. One of the reasons why encryption hardware has not spread is that individualized licensing and local restrictions make it imprudent to include hardware security as a standard feature in PCs aimed at mass markets. The HP system has safeguards that have evidently persuaded governments that they can allow mass market sales of hardware encryption without giving up their current regulatory authority. What does this mean for the government's key escrow policy? First, as we heard at the news conference, HP's system will run the TIS commercial key recovery system (and presumably the CertCo./Bankers Trust system as well). So it will make key recovery products available to buyers. But it will also run 40-bit encryption, DES, and other strong algorithms without escrow. The customer decides what crypto to use; the framework doesn't favor one of those technologies over the other, except that it allows customers to buy strong key-recovery crypto today with the knowledge that the hardware won't become obsolete tomorrow if government policies change and something more attractive comes along. As a separate point, I'm not sure Declan is right to call this vaporware. The basic hardware has been available for a while. (I saw an early demo a few years ago.) It sounds as though the R&D is done; all that remains is engineering, and maybe not too much of that.

1 0