December 2003 - cypherpunks-legacy

Encryption Survey Summary
by 'Mark' M.J. Saarelainen 17 Dec '03

17 Dec '03

10/23/96 Dear Receiver, I completed a brief survey (SURVEY: Encryption in Commercial Enterprises) few weeks ago. I received quite good feedback and responses. I have now developed a short summary of all these responses. If you like to receive this summary, you can send me your e-mail message. My e-mail address is mjsus(a)ix.netcom.com - please, write in the subject of your message: "Encryption Survey Summary". Please, include your name and company/organization in your message - thanks in advance. Best regards, Mark

1 0

TIM_ely
by John Young 17 Dec '03

17 Dec '03

Two reports lagging the attack on tamperproof devices post last night from the Info Sec Group of NUS (which we've put at: http://jya.com/isghak.htm) 10-22-96. Reu: "Singapore scientists invent secure Internet system" The new system, developed by the NUS team in collaboration with several banks for Singapore at a cost of Singapore $500,000 (US$355,000), used smartcard technology which allowed the transmission of hidden digital signatures. Sponsors of the new system include Singapore's four large banks -- Development Bank of Singapore, Oversea-Chinese Banking Corp Ltd, Overseas Union Bank Ltd, United Overseas Bank Ltd -- as well as Singapore Telecommunications Ltd and Citicorp's Citibank. 10-22-96. PrNe: Biometric Technology Firm Refutes Reports of Vulnerability to Smart Card A biometric facial recognition protects smart cards from tampering by denying access even if digital codes are obtained. According to the company's president, recent reports from U.S. and Israeli researchers on ways to crack encryption codes are needlessly alarming security managers in government and industry. ----- http://jya.com/timely.txt (4 kb for 2) ftp://jya.com/pub/incoming/timely.txt TIM_ely

1 0

Eric Blossom - URL
by Black Unicorn 17 Dec '03

17 Dec '03

-- Forward complaints to : European Association of Envelope Manufactures Finger for Public Key Gutenbergstrasse 21;Postfach;CH-3001;Bern Vote Monarchist Switzerland ---------- Forwarded message ---------- Date: Tue, 8 Oct 1996 20:59:28 -0700 (PDT) From: Lucky Green <shamrock(a)netcom.com> To: cypherpunks(a)toad.com Cc: Paulo Barreto <pbarreto(a)uninet.com.br> Subject: Re: 2Re: Best-of-Crypto Eric Blossom is eb(a)comsec.com. His URL is http://www.comsec.com/ check out his nifty bump-in-the-cord 3DES phone encryption device. --Lucky

1 0

Re: wired wankers
by Greg Broiles 17 Dec '03

17 Dec '03

> ....seems like very few people know who or what cypherpunks are - good or bad? Doesn't matter if anyone likes it or not. "Cypherpunk" has no unambiguous or universally understood meaning. It's a cute turn of phrase. They are/it is a mailing list. It is the subject of a manifesto written several years ago. Sometimes people get together and talk about "cypherpunk" things. Assuming that "cypherpunk" will ever have even as much clarity of meaning as a term like "libertarian" is a mistake. It does not mean "people who agree with you". The best description I can think of is that "cypherpunk" refers to the intersection of politics, economics, and technology at the micro/street level, and people who are interested in that or the macro consequences of these micro changes. The fact that someone's interested doesn't mean you can predict what they think about any of the constituent subjects. Eric Hughes' "Cypherpunk Manifesto" puts a pro-liberty spin on cypherpunkism, which isn't bad but did not predict the tension between various factions/doctrines which has emerged, some of which are anti-liberty or liberty-agnostic. The cypherpunks list has become a discussion place for those various factions as well as a target for various mass mailings and crypto-law-politics related announcements. Some traditionalists (fundamentalists? :) continue to use it for discussions related to deploying tools for privacy in a technological age but they're a minority these days. One sect has split off to "coderpunks", seeking a return to the more traditionalist focus. You can describe yourself as a "cypherpunk" if you want to but if you mean "mailing list reader/participant" it's not especially interesting; and if you mean something else you're adopting a label whose meaning is more like a thermometer than a road sign. -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

1 0

NSA Report: Anyone seen this?
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Mime-Version: 1.0 Date: Wed, 23 Oct 1996 16:50:18 -0700 From: Somebody Subject: NSA Report To: rah(a)shipwright.com I don't recall seeing this report mentioned in any e$pam items, and thought you might be interested. Thanks for all your work on the e$ lists. <Somebody's .sig> ______________________________ Forward Header __________________________________ Subject: 21st Century Banking Alert No. 96-10-17 Author: "Ledig; Robert" <LEDIGRO(a)ffhsj.com> at internet Date: 10/17/96 2:51 PM 21st Century Banking Alert No. 96-10-17 October 17, 1996 National Security Agency Report Raises Systemic Security Issues Related to Anonymous Electronic Money A recent report prepared by the Cryptology Division of the National Security Agency's Office of Information Security Research and Technology discusses the potential for security failures in certain electronic cash systems and their likely consequences. While demonstrating concern over the attributes of non-traceable electronic money, the report points out methods that may be used to minimize security breaches and losses, including limiting the number of coins that can be affected by a single compromise, requiring traceability for large transactions or large numbers of transactions in a given period, and the creation of a mechanism to restore traceability under certain circumstances. The report contains an excellent summary of basic electronic money cryptographic tools, electronic cash protocols, authentication and signature techniques and related security issues. Copyright 1996. Fried, Frank, Harris, Shriver & Jacobson. All rights reserved. 21st Century Banking Alert is a trademark and servicemark of Fried, Frank, Harris, Shriver & Jacobson. --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Re: Call for Discussion - Time-Delay Protocol
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 01:07 AM 10/23/96 -0700, project_31(a)alias.cyberpass.net wrote: >Very simply put, it is desired to put an encrypted, paragraph-length >message into ubiquitous public distribution, contained in an explanatory >plaintext. >On a predetermined date stated in the plaintext, the passphrase is to be >released and the parties holding the message may decrypt the cyphertext >and know its contents. [Threats: content-leaks, counterfeiting/spoofing, alteration] > 1. A large-modulus PGP public key is prepared prior to the > experiment and placed on (a) the keyservers and (b) at an > "authenticating" website of neutral interest and good > reputation. This isn't enough - keyservers are NOT a substitute for the Web Of Trust. You probably need to have the authenticating key signed by other well-known-in-the-target-community keys. I don't know if you plan to use one authenticating public key for future jobs, or use a different one each time; in the latter case you'll also want to have a key to sign that one with. > 2. The critical message is encrypted conventionally (IDEA) in > ASCII format with a large passphrase and included in the > explanatory plaintext, which also includes the > authenticating key ID hexnumber and fingerprint, and > instructions on how to obtain the authenticating key. Fingerprint is critical - otherwise you're subject to the "0xdeadbeef" attack. You could also include the key itself in the signed message, if you don't mind a bit of extra volume. > 3. The entire plaintext message is clearsigned with the > authenticating public key, and the resulting textfile is > widely distributed. > 1. How may this protocol be improved? > 2. What are the security flaws in this protocol? > 3. May this protocol be simplified without compromising > security? The main alternative to PGP keys is Haber&Stornetta's "Surety" notary system - they use trees of hashes to establish that a given document was authenticated at a given time, making the trees publicly available, and the weekly master hash gets printed in the New York Times classifieds weekly. At minimum, you may want to notarize your PGP key that way. http://www.surety.com/ # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

1 0

Re: Random numbers for DES search.
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> I wrote: > > Yep. You don't need unpredictability or other attributes that > > are usually necessary for crypto PRNGs. Basically all you > > need is a good uniform distribution. A quality PRNG like the > > ones used for simulations and games will work fine. No need > > to use Blum-Blum-Shub or other fancy (and slow) generators. > > A linear-congruential generator or an LFSR would probably do > > the trick. This really doesn`t seem a good idea to me seeing as not only are we going to be wasting time on an LFSR runtime wise but we will be covering a lot of duplicate keyspace, if you look at the mersenne prime finding exercise which has its homepages somewhere on compuserve (i`ll give the address if you need it but I can`t remember it at the moment) they have a set of numerical blocks of exponent space that are allocated to people then removed from the list, not an option of course if we are going to be "stealing" runtime, unless we do it on networked workstations using some sort of UDP packet or similar. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

Re: Netescrow & Remailers?
by Steve Reid 17 Dec '03

17 Dec '03

> Would it make remailers more reliable to use a netescrow >system, so that if a remailer goes offline, the others can request its >keys, and continue moving its messages? Do you operate a malicious remailer? Have you just recieved a message from a person, encrypted for another remailer? Want to know who this person is communicating with? Bomb the next remailer in the chain or do whatever else to force it to reveal it's keys. Once that's done, you can peel away that layer of encryption and then go to work on bombing the next remailer in the chain to obtain it's keys. Repeat until you've peeled off all the layers of remailer encryption and can see the final destination address. Tell us, what have you done with the _real_ Adam Shostack? ;P

1 0

Re: Netescrow & Remailers?
by Matt Blaze 17 Dec '03

17 Dec '03

Here were my thoughts on the subject when this was mentioned to me a month and a half ago. -matt [by the way, please note that I don't read cypherpunks, so please include me in any reply that you want me to see. Thanks.] ------- Forwarded Message To: Adam Back <aba(a)dcs.ex.ac.uk> cc: peter.allan(a)aeat.co.uk, cypherpunks(a)toad.com Subject: Re: Job for netescrow ? (was Secure anonymouse server protocol... In-reply-to: Your message of "Fri, 06 Sep 1996 14:22:23 BST." <199609061322.OAA01150(a)server.test.net> Date: Fri, 06 Sep 1996 18:50:00 -0400 From: Matt Blaze <mab(a)nsa.research.att.com> Adam Back <aba(a)dcs.ex.ac.uk> writes: > >Peter Allan <peter.allan(a)aeat.co.uk> writes on cpunks: >> In the talk about replyable nym-mailers I haven't >> yet seen netescrow mentioned. >> >> You DID all read this ? >> >> [Matt Blazes Oblivious Key Escrow paper] >> >> This all hinges on a policy to be followed by archive holders defining >> the conditions under which they release their shares. >> This could be receipt of a signed request from the owner (remailer). >> >> Maybe the table relating nyms to reply addresses could be stored in >> netescrow style so that captured remailers reveal nothing. The problem >> of operator coercion is not addressed by this. > >Just to clarify, if I understand correctly you are proposing a penet >style system with the database held in `netescrow'. > >The remailer in normal operation has access to the database by making >requests satisfying the conditions of the secret share holders. > >When the remailer is compromised the memory resident key is lost when >the machine is switched off, and the owner refuses to release the key. > >Is what you are proposing? > >It sounds like a cross between Matt's netescrow and Ross Anderson's >eternity file system. Your penet database is being stored in a >distributed file system, with shares, and the identity of the share >holders is concealed. However the aim is not to prevent others >censoring your publically available writings, but to allow a second >avenue of access only in the case of `mob cryptography'. > >This changes the system over storing the database encrypted on the >remailer machines own disk in these ways: [well-thought-out stuff deleted] This is the first I've seen this proposal to use Oblivious Key Escrow (OKE) as a store for a remailer database; apologies if all this has been discussed already (I don't ready cypherpunks very often these days). My original idea for OKE was as a way to backup long-term, slow-changing sensitive data without also introducing a single point of failure for either security or availability. The remailer model is a bit different, and I'm not sure it's a good fit, in particular because I haven't thought about the various new failure modes in this application. But let me think ``out loud.'' Suppose we want to build a persistent-reply address anonymous messaging service (like the late anon.penet.fi) with the following properties: a) The database that maps anonymous addresses to real addresses is secure against erasure or other permanent loss of availability b) The database is also secure against accidental or coerced disclosure. Requirement (a) implies backups and persistent storage. Requirement (b) implies that both access to both operational and backup copies must be carefully controlled, preferably by technical means. So far, this looks like a good candidate for distributed security, in the style of OKE, Mike Reiter's Rampart service, or Ross Anderson's Eternity service. Actually, I think the best solution would be for the remailer itself to be a distributed process, split among enough places to make it difficult for anyone to attack enough nodes to compromise or recover the address translation database. It is not at all obvious how to do this in practice, however, since any solution would need to combine secure distributed computation (to calculate the mapping for each message sent without revealing to any party, including the sender, what the mapping is) with anonymous networking techniques such as mixes to prevent traffic analysis from revealing the mapping. There are a number of unsolved theoretical and practical problems here, and I think working out the details of such a system would make for a good PhD thesis or two (quite seriously, and I'd be interested in talking with anyone who wanted to pursue such a line of research). So for now let's limit ourselves to existing tools and techniques, or at least tools and techniques that are close to existing. Let's say, for the moment, that we wanted to base the system on OKE. Assume an unconditionally trusted remailer operator whose goal is to construct a system that resists attempts to force him or her to UNILATERALLY reveal the database. That is, it should not be possible to force the remailer operator to reveal the database contents without also enlisting the aid of the (collectively anonymous) oblivious key holders. My (not carefully considered) first thought is that the address database would be encrypted and stored locally, using a key that is escrowed using OKE. The key would never be locally stored; preferably, the key would exist only in memory. The operating system on which the remailer is run would delete this key ``at the drop of a hat,'' e.g., any time the system was rebooted, any time someone logs in, any time unusual activity of any sort is detected. The key release policy is controlled by a public key, for which the secret key is stored in a more persistent manner (e.g., in the file system). Whenever the database key is deleted, the OKE recovery process is used to recover the key automatically, and the database is re-encrypted with a new key that is distributed to a new set of shareholders. Under normal operation, this might happen once a month or so, and might entail (because of policy-based delays and the time required to collect shares) a few days of downtime. Under unusual conditions that might precipitate some kind of coercive situation, the remailer operator (or some automatic process on the remailer machine) would delete the signing key as well as the database. It might be reasonable, for example, to delete this file any time someone logs in to the remailer machine (which shouldn't be needed ordinarily). The OKE share policy would require that the shareholder operator examine unsigned key requests manually before releasing them. If the keys were deleted because of a false alarm or machine failure, the remailer operator would send a message saying something to the effect of ``Hey, I blew it. Please send me the key shares once you're convinced no one has a gun to my head.'' In the event of a public safety emergency, the police are free to attempt to issue their own appeal for key shares, but the ability to for them to do this is not a design goal, but rather a side-effect of the design. I see a number of problems with using OKE for this. In particular, key recovery is moderately expensive and key distribution with the oblivious multicast protocol in my paper can be very expensive. If keys are deleted regularly, the downtime could be unacceptable. I'm not sure OKE is entirely workable for this application, but perhaps a more clever design could prove me wrong. There are a whole bunch of engineering issues here, particularly related to automatically detecting ``unusual'' situations. So can this scheme be improved upon? Is there a better way to run a persistent-reply-address remailer? These are interesting, and I think largely open, questions. - -matt NB The oblivious key escrow paper that I presented at the Information Hiding workshop at the Isaac Newton Institute in May, is available at: ftp://ftp.research.att.com/dist/mab/netescrow.ps ------- End of Forwarded Message

1 0

No Subject
by Butler, Anthony 17 Dec '03

17 Dec '03

22/10/96 WASHINGTON - US First lady Hillary Rodham Clinton unveiled a new Superman comic book for Bosnian children during an East Room ceremony Monday. The comic book, written in three languages, shows the mythical American hero flying down to save two little boys in Bosnia- Herzegovina. The comic books will be distributed throughout the country. With several Bosnian children standing nearby, Mrs. Clinton pulled the drape on a blown-up reproduction of the cover of the comic book. Mrs. Clinton said the initiatives show the United States' "clear commitment to the people of Bosnia-Herzegovina." She said "Superman wlll bring a special message" to the Bosnian children.

1 0