December 2003 - cypherpunks-legacy

Re: Can we kill single DES?
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 07:50 AM 10/6/96 -0700, Declan McCullagh <declan(a)eff.org> wrote: >> >1. Is this a good idea? What will happen if DES becomes perceived >> > as insecure? >> That's Declan's department (and other non-clueless journalists - [...] >This is the meme I've been trying to spread -- that 56-bit DES is *not* >secure. In particular, it's N>>20 years old, the NBS originally certified it for five years, and kept recertifying it primarily because triple-DES was too slow on the popular bank computers of the time (e.g. cash machines and then PCs), and hardware implementations of 56-bit DES would need to be replaced if the algorithm were decertified. Public-key encryption was developed a few years after DES, with a solid mathematical background that lets it remain secure today. It's far more secure than DES but far slower, so it's only been practical the last few years. Newer encryption technology which is several times faster and much stronger than DES has been developed over the last decade. >This cuts through all the rhetoric about differences between key >recovery and key escrow, who's going to be in this industry alliance, etc. "Key Recovery" is the latest sleazy meme from the Government. The only difference from so-called "Key Escrow" is that it's deliberately obscure about who gets to keep your master keys, while "Escrow" implies that it's definitely somebody else besides you. >From the "Eternal Vigilance is Better than Hindsight" department, we should have seen this coming and done a pre-emptive strike on the term. One of the papers on Dorothy Denning's web site is a May 20, 1996 SUBJECT: Draft Paper, "Enabling Privacy, Commerce, Security and Public Safety in the Global Information Infrastructure" from OMB, which is one of the Clipper 3 announcements, and it uses the term "key recovery". # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

1 0

Re: picture encryption
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 04:04 PM 10/4/96 -0400, you wrote: >Sometime back someone mentioned a program that would hide messages inside a >picture, by replacing the LSB of the color with the message. There are several such programs. The general term is "Steganography", which means "hidden writing", so you'll see programs with names like stego, jsteg, mandelsteg, etc. Look in the usual archive locations such as ftp.ox.ac.uk and ftp.funet.fi. Also, for Romana Machado's stego programs, look at her home page on www.fqa.com. >I was thinking that if they outlawed high strength encryption (non GAK >approved), not letting them realize that you were sending encrypted >information would be an excellent alternative. It's not an _excellent_ alternative, but if it's all you can get, it's all you can get. It helps to use encryption algorithms that don't have special forms, e.g. don't begin with "----- BEGIN PGP" or other easy-to-spot headers, don't limit their output to printable ASCII, and (tougher) don't have other subtleties such as the statistical properties of RSA keys or checksums that can be tested without decrypting. There's been a lot of discussion on the subject here, and there are some stealth-PGP versions that obscure PGP's form. One difficulty with stego'd encrypted data is that it's tough to use it for applications like encrypting voice between your cellphone and the cellphone company, since _they_ won't be implementing it. One suggested place to stash encrypted data is in the low bits of compressed voice on an internet phone product. It's difficult - you need to pick a voice compression algorithm that has room to substitute bits without messing up the voice quality a lot, which means you need to work closely with the compression algorithm. For 64kbps PCM, this is easy (some of the T1 standards already do this to send signalling bits, which is why data is often limited to 56kbps.) ADPCM and Delta Modulation can probably handle it fairly well, though they're generally used only down to speeds of 16 kbps. Tighter compression algorithms have less room for noise, are much more sophisticated, require much more computation, and are probably a lot tougher to use, but they're where most of the internet phone products are. And then there are applications like CU-SeeMe (low-speed video conferencing) which are generally flaky enough that you could toss in the occasional stego frame and blame it on your cheapo camera or the overloaded reflector :-) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

1 0

Re: Voice Stress Analysis of Debates?
by jim bell 17 Dec '03

17 Dec '03

At 12:30 AM 10/7/96 -0700, cypherpunks(a)count04.mry.scruznet.com wrote: >PSE/VSE etc relys on a random 8-14 hz fm modulation appearing in the > the 3rd formant band of the voice... the Dektor PSE retailed for approximately 5k in the early 1970's the hagoth hs-2 was the early 80;s for 2k .. The technical details look vaguely familiar, but I probably last read them two decades ago. It doesn't sound like it would be too complicated to implement, with ordinary phase-lock loops, switched-capacitor filters, and other analog building blocks. >I bought 2 VSE units based on a new chip for 89.95 apiece recently... >this was on an article appearing in popular electronics in 1995 I'll have to look that up. Was it a DSP or some analog implementation? Most importantly, does it seem to WORK? >no software as of yet and it would be probably a FFT or DFT based algorithm >running on a sound blaster DSP(hardware DSP only) or as software > on a fast 150 Mhz + pentium I can give the basic facts known... it is a truth >detector only(not a lie detector), background music shows up a stress... >and scrubbing the modulation shows up as constant stress or "possible decption" Yes, it occurs to me that a vocorder-type compression/decompression of the voice would, effectively, remove FM modulation by averaging out short-term variations in voice frequencies. >truth is indicated by the modualtion showing up randomly over small increments >of time... the effect is caused by microscopic tremors of the larynx when the >speaker is relaxed and truthful the larnyx is relaxed and the random modulations >show up,(or the speaker believes what he is saying to be the truth, when lying >or under stress the larybx tightens and the random modulations >disappear indicating stress... it would be nice to have it in software... >to run on a laptop soundboard and spread to the net as widely as pgp... I think it's particularly revealing that the TV networks don't try to use it. They're supposed to be looking for an edge, something to make the news seem more interesting. The political establishment would see the publicizing of this as going beyond an unwritten limitation on the media. Jim Bell jimbell(a)pacifier.com

1 0

Re: Dole web site cracked?
by Rich Burroughs 17 Dec '03

17 Dec '03

At 10:08 AM 10/7/96 -0500, "Bruce M." <bkmarsh(a)feist.com> wrote: >On Mon, 7 Oct 1996, Black Unicorn wrote: > >> Actually, on further examination, looks like a cute little spoof, not a >> hack. >> >> The address for the actual dole page is : www.dolekemp96.org > > But, which one of these DNS entries looks more official? [snip] Heh. www.dolekemp96.org is definitely the address Dole gave at the close of the debate. The fact that the billing contact and one of the domain servers are at "getcaught.com" is perhaps just a fine bit of irony... I tried to connect to www.getcaught.com with no success, so I'm not sure what's there... Rich ______________________________________________________________________ Rich Burroughs richieb(a)teleport.com http://www.teleport.com/~richieb See my Blue Ribbon Page at http://www.teleport.com/~richieb/blueribbon U.S. State Censorship Page at - http://www.teleport.com/~richieb/state New EF zine "cause for alarm" - http://www.teleport.com/~richieb/cause

1 0

Re: Can somebody unsubscribe cyberpromo from CP?
by Rich Burroughs 17 Dec '03

17 Dec '03

At 10:23 AM 10/7/96 -0800, jim bell <jimbell(a)pacifier.com> wrote: >I think somebody subscribed that Cyberpromo organization to the Cypherpunks >list. It needs to be unsubscribed... I did a "who" and didn't see them. Maybe someone already took care of it... BTW, the messages I was receiving from "abusebot(a)savetrees.com" were sent to me, not the list. I wrote the address in their email and was told that apparently someone was forging notes to their "abuse" address from mine -- the information about reporting abuses, etc, comes back in response. I was told the messages would be blocked, but I'm not sure if it happened as I'm now filtering them. Rich ______________________________________________________________________ Rich Burroughs richieb(a)teleport.com http://www.teleport.com/~richieb See my Blue Ribbon Page at http://www.teleport.com/~richieb/blueribbon U.S. State Censorship Page at - http://www.teleport.com/~richieb/state New EF zine "cause for alarm" - http://www.teleport.com/~richieb/cause

1 0

Re: You can be forced to turn over your encryption keys?
by jim bell 17 Dec '03

17 Dec '03

At 10:17 AM 10/7/96 -0800, Timothy C. May wrote: >At 10:33 AM -0400 10/7/96, Geoffrey C. Grabow wrote: >>I thought we had a 5th amendment. Isn't turning over your key that may (or >>may not) expose encriminating evidence an extension of self-encrimination? >>Haven't there been dozens of famous witnesses (Patty Hurst, Oliver North, >>etc) that "take the 5th" dozens of times on the stand. Why couldn't I >>"take the 5th" when asked for my encryption keys? When asked for your key, >>can't you say: "I'm sorry your honor, but I respectfully refuse to answer >>that question on the grounds that it may incriminate me.". >Though IANAL, I know of many, many discussions of this question. So far as >I know, it remains one of The Great Unresolved Questions. I think that there was an idea that appeared in the last few months around here, which took advantage of the fact that a one-time pad makes all decrypts equally likely. If the cops sieze an apparently-encrypted file and they insist on the key, just ask them to give you the file back (although presumably you already had it) and present them with the OTP, revealing the fact (surprise!!!) that the thing decrypts to (for just one example) the first "N" bytes of the King James Bible, or the Cybernomicon, or "War and Peace" or the stock exchange results for August 1, 1989, etc... This suggests that there is a reason to have a program which uses OTP techniques but generates files which "look like" valid PGP output. The judge can't force you to reveal what you don't know, but more importantly if you give him a "key" that might be the correct one, and assuming it is impossible to prove that it wasn't the correct key, then it would be somewhat pointless and certainly unjustified for him to continue to insist on providing yet another key. Jim Bell jimbell(a)pacifier.com

1 0

Re: encrypting pppd?
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Sun, 06 Oct 1996 04:18:04 -0500, VaX#n8 wrote: >Thinking about it a bit more, if you only encrypt, say, telnet >then you've got a pretty predictable plaintext stream. If you >encrypt the entire link level properly then it might be much harder >to isolate the nonvariant bits of the protocols since the port and >that kind of header info is not available to the attacker at that >level. What about predictabilities in the PPP datastream? # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

2 1

Libel & Pseudonymous Reputation - permissions fixed!
by Stanton McCandlish 17 Dec '03

17 Dec '03

Sorry about that. The file is available now. http://www.eff.org/pub/Legal/CyberLaw_Course/cyberlaw.038 -- <HTML><A HREF="http://www.eff.org/~mech"> Stanton McCandlish </A><HR><A HREF="mailto:mech@eff.org"> mech(a)eff.org </A><P><A HREF="http://www.eff.org"> Electronic Frontier Foundation </A><P> Program Director </HTML>

1 0

Re: You can be forced to turn over your encryption keys?
by Greg Broiles 17 Dec '03

17 Dec '03

At 10:33 AM 10/7/96 -0400, Geoffrey C. Grabow wrote: >I thought we had a 5th amendment. Isn't turning over your key that may (or >may not) expose encriminating evidence an extension of self-encrimination? As Tim notes, this has been discussed several times. You might take a look at: Greg S. Sergienko, Self Incrimination and Cryptographic Keys, 2 RICH. J.L. & TECH. 1 (1996), <http://www.urich.edu/~jolt/v2i1/sergienko.html>. -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

1 0

Seeking help on WordPerfect 6.1 cracks
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Among the possessions of a murder victim (not suspect), the local police have found a floppy disk with some provocative-sounding files on it. Rather than getting them into the habit of cracking other people's personal files, I'd prefer to give them the password myself, but there seems to be no freely available cracker for WordPerfect 6.x, and I'm not sure this one-time use is worth $100 to me. Can anyone lend a hand? Just four small files. I can give you more than enough details off the list to assure you that this is totally on the level. Feel free to discuss the implications of providing such help. Failing that, does anyone have a technical, political, or personal preference for or against AccessData or CRAK, who sell the two commercial crackers I've found? - -rich [not on cypherpunks at the moment] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMllpfZNcNyVVy0jxAQHtcgH8D3oW21nsaNrIHxHMqhxE/Ho9/78L1elF DYHV3jeM4VSqTP6cKhMn5ZahB4b8KP9t7EG70NAtwn/usaKiWpw92Q== =uq4u -----END PGP SIGNATURE-----

2 2