December 2003 - cypherpunks-legacy

Re: Call for Discussion - Time-Delay Protocol
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 01:07 AM 10/23/96 -0700, project_31(a)alias.cyberpass.net wrote: >Very simply put, it is desired to put an encrypted, paragraph-length >message into ubiquitous public distribution, contained in an explanatory >plaintext. >On a predetermined date stated in the plaintext, the passphrase is to be >released and the parties holding the message may decrypt the cyphertext >and know its contents. [Threats: content-leaks, counterfeiting/spoofing, alteration] > 1. A large-modulus PGP public key is prepared prior to the > experiment and placed on (a) the keyservers and (b) at an > "authenticating" website of neutral interest and good > reputation. This isn't enough - keyservers are NOT a substitute for the Web Of Trust. You probably need to have the authenticating key signed by other well-known-in-the-target-community keys. I don't know if you plan to use one authenticating public key for future jobs, or use a different one each time; in the latter case you'll also want to have a key to sign that one with. > 2. The critical message is encrypted conventionally (IDEA) in > ASCII format with a large passphrase and included in the > explanatory plaintext, which also includes the > authenticating key ID hexnumber and fingerprint, and > instructions on how to obtain the authenticating key. Fingerprint is critical - otherwise you're subject to the "0xdeadbeef" attack. You could also include the key itself in the signed message, if you don't mind a bit of extra volume. > 3. The entire plaintext message is clearsigned with the > authenticating public key, and the resulting textfile is > widely distributed. > 1. How may this protocol be improved? > 2. What are the security flaws in this protocol? > 3. May this protocol be simplified without compromising > security? The main alternative to PGP keys is Haber&Stornetta's "Surety" notary system - they use trees of hashes to establish that a given document was authenticated at a given time, making the trees publicly available, and the weekly master hash gets printed in the New York Times classifieds weekly. At minimum, you may want to notarize your PGP key that way. http://www.surety.com/ # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

1 0

Re: Random numbers for DES search.
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> I wrote: > > Yep. You don't need unpredictability or other attributes that > > are usually necessary for crypto PRNGs. Basically all you > > need is a good uniform distribution. A quality PRNG like the > > ones used for simulations and games will work fine. No need > > to use Blum-Blum-Shub or other fancy (and slow) generators. > > A linear-congruential generator or an LFSR would probably do > > the trick. This really doesn`t seem a good idea to me seeing as not only are we going to be wasting time on an LFSR runtime wise but we will be covering a lot of duplicate keyspace, if you look at the mersenne prime finding exercise which has its homepages somewhere on compuserve (i`ll give the address if you need it but I can`t remember it at the moment) they have a set of numerical blocks of exponent space that are allocated to people then removed from the list, not an option of course if we are going to be "stealing" runtime, unless we do it on networked workstations using some sort of UDP packet or similar. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

Re: Netescrow & Remailers?
by Steve Reid 17 Dec '03

17 Dec '03

> Would it make remailers more reliable to use a netescrow >system, so that if a remailer goes offline, the others can request its >keys, and continue moving its messages? Do you operate a malicious remailer? Have you just recieved a message from a person, encrypted for another remailer? Want to know who this person is communicating with? Bomb the next remailer in the chain or do whatever else to force it to reveal it's keys. Once that's done, you can peel away that layer of encryption and then go to work on bombing the next remailer in the chain to obtain it's keys. Repeat until you've peeled off all the layers of remailer encryption and can see the final destination address. Tell us, what have you done with the _real_ Adam Shostack? ;P

1 0

Re: Netescrow & Remailers?
by Matt Blaze 17 Dec '03

17 Dec '03

Here were my thoughts on the subject when this was mentioned to me a month and a half ago. -matt [by the way, please note that I don't read cypherpunks, so please include me in any reply that you want me to see. Thanks.] ------- Forwarded Message To: Adam Back <aba(a)dcs.ex.ac.uk> cc: peter.allan(a)aeat.co.uk, cypherpunks(a)toad.com Subject: Re: Job for netescrow ? (was Secure anonymouse server protocol... In-reply-to: Your message of "Fri, 06 Sep 1996 14:22:23 BST." <199609061322.OAA01150(a)server.test.net> Date: Fri, 06 Sep 1996 18:50:00 -0400 From: Matt Blaze <mab(a)nsa.research.att.com> Adam Back <aba(a)dcs.ex.ac.uk> writes: > >Peter Allan <peter.allan(a)aeat.co.uk> writes on cpunks: >> In the talk about replyable nym-mailers I haven't >> yet seen netescrow mentioned. >> >> You DID all read this ? >> >> [Matt Blazes Oblivious Key Escrow paper] >> >> This all hinges on a policy to be followed by archive holders defining >> the conditions under which they release their shares. >> This could be receipt of a signed request from the owner (remailer). >> >> Maybe the table relating nyms to reply addresses could be stored in >> netescrow style so that captured remailers reveal nothing. The problem >> of operator coercion is not addressed by this. > >Just to clarify, if I understand correctly you are proposing a penet >style system with the database held in `netescrow'. > >The remailer in normal operation has access to the database by making >requests satisfying the conditions of the secret share holders. > >When the remailer is compromised the memory resident key is lost when >the machine is switched off, and the owner refuses to release the key. > >Is what you are proposing? > >It sounds like a cross between Matt's netescrow and Ross Anderson's >eternity file system. Your penet database is being stored in a >distributed file system, with shares, and the identity of the share >holders is concealed. However the aim is not to prevent others >censoring your publically available writings, but to allow a second >avenue of access only in the case of `mob cryptography'. > >This changes the system over storing the database encrypted on the >remailer machines own disk in these ways: [well-thought-out stuff deleted] This is the first I've seen this proposal to use Oblivious Key Escrow (OKE) as a store for a remailer database; apologies if all this has been discussed already (I don't ready cypherpunks very often these days). My original idea for OKE was as a way to backup long-term, slow-changing sensitive data without also introducing a single point of failure for either security or availability. The remailer model is a bit different, and I'm not sure it's a good fit, in particular because I haven't thought about the various new failure modes in this application. But let me think ``out loud.'' Suppose we want to build a persistent-reply address anonymous messaging service (like the late anon.penet.fi) with the following properties: a) The database that maps anonymous addresses to real addresses is secure against erasure or other permanent loss of availability b) The database is also secure against accidental or coerced disclosure. Requirement (a) implies backups and persistent storage. Requirement (b) implies that both access to both operational and backup copies must be carefully controlled, preferably by technical means. So far, this looks like a good candidate for distributed security, in the style of OKE, Mike Reiter's Rampart service, or Ross Anderson's Eternity service. Actually, I think the best solution would be for the remailer itself to be a distributed process, split among enough places to make it difficult for anyone to attack enough nodes to compromise or recover the address translation database. It is not at all obvious how to do this in practice, however, since any solution would need to combine secure distributed computation (to calculate the mapping for each message sent without revealing to any party, including the sender, what the mapping is) with anonymous networking techniques such as mixes to prevent traffic analysis from revealing the mapping. There are a number of unsolved theoretical and practical problems here, and I think working out the details of such a system would make for a good PhD thesis or two (quite seriously, and I'd be interested in talking with anyone who wanted to pursue such a line of research). So for now let's limit ourselves to existing tools and techniques, or at least tools and techniques that are close to existing. Let's say, for the moment, that we wanted to base the system on OKE. Assume an unconditionally trusted remailer operator whose goal is to construct a system that resists attempts to force him or her to UNILATERALLY reveal the database. That is, it should not be possible to force the remailer operator to reveal the database contents without also enlisting the aid of the (collectively anonymous) oblivious key holders. My (not carefully considered) first thought is that the address database would be encrypted and stored locally, using a key that is escrowed using OKE. The key would never be locally stored; preferably, the key would exist only in memory. The operating system on which the remailer is run would delete this key ``at the drop of a hat,'' e.g., any time the system was rebooted, any time someone logs in, any time unusual activity of any sort is detected. The key release policy is controlled by a public key, for which the secret key is stored in a more persistent manner (e.g., in the file system). Whenever the database key is deleted, the OKE recovery process is used to recover the key automatically, and the database is re-encrypted with a new key that is distributed to a new set of shareholders. Under normal operation, this might happen once a month or so, and might entail (because of policy-based delays and the time required to collect shares) a few days of downtime. Under unusual conditions that might precipitate some kind of coercive situation, the remailer operator (or some automatic process on the remailer machine) would delete the signing key as well as the database. It might be reasonable, for example, to delete this file any time someone logs in to the remailer machine (which shouldn't be needed ordinarily). The OKE share policy would require that the shareholder operator examine unsigned key requests manually before releasing them. If the keys were deleted because of a false alarm or machine failure, the remailer operator would send a message saying something to the effect of ``Hey, I blew it. Please send me the key shares once you're convinced no one has a gun to my head.'' In the event of a public safety emergency, the police are free to attempt to issue their own appeal for key shares, but the ability to for them to do this is not a design goal, but rather a side-effect of the design. I see a number of problems with using OKE for this. In particular, key recovery is moderately expensive and key distribution with the oblivious multicast protocol in my paper can be very expensive. If keys are deleted regularly, the downtime could be unacceptable. I'm not sure OKE is entirely workable for this application, but perhaps a more clever design could prove me wrong. There are a whole bunch of engineering issues here, particularly related to automatically detecting ``unusual'' situations. So can this scheme be improved upon? Is there a better way to run a persistent-reply-address remailer? These are interesting, and I think largely open, questions. - -matt NB The oblivious key escrow paper that I presented at the Information Hiding workshop at the Isaac Newton Institute in May, is available at: ftp://ftp.research.att.com/dist/mab/netescrow.ps ------- End of Forwarded Message

1 0

No Subject
by Butler, Anthony 17 Dec '03

17 Dec '03

22/10/96 WASHINGTON - US First lady Hillary Rodham Clinton unveiled a new Superman comic book for Bosnian children during an East Room ceremony Monday. The comic book, written in three languages, shows the mythical American hero flying down to save two little boys in Bosnia- Herzegovina. The comic books will be distributed throughout the country. With several Bosnian children standing nearby, Mrs. Clinton pulled the drape on a blown-up reproduction of the cover of the comic book. Mrs. Clinton said the initiatives show the United States' "clear commitment to the people of Bosnia-Herzegovina." She said "Superman wlll bring a special message" to the Bosnian children.

1 0

I'm Confused about Algorithm Patents in Canada
by janke＠unixg.ubc.ca 17 Dec '03

17 Dec '03

I have a library of crypto goodies that I would like to release, but am kinda stuck on the copyright: I read in a very new book that algorithms cannot be patented in Canada. In AC2, however, Scheneier mentions several of the algorithms as being patented in Canada. Today, I visited Ascom's home page and noticed that IDEA is not patented here, so I get the feeling the law might have changed just recently. If anyone can tell me anymore of what they know about the status of algorithm patents in Canada, or if they could point me to a good source of info on the net, I would be very appreciative. (Since my library will be free, you might be helping more than just me too. :) ) Thanks, Leonard (Visit http://www.interchg.ubc.ca/janke/index.html#lcrypt for an ouline of what I'd like to release, if you like.)

2 1

Re: Holding Netscape's and Microsoft's Feet to the Fire
by Greg Kucharo 17 Dec '03

17 Dec '03

The truly frightening thing here is that Bill gates has come out more often on the strong crypto side than Netscape, Apple, IBM and just about everyone else. Why is this? Has Justice crapped on him once too often, and now he's looking for payback? At first I thought that it may be that Microsoft has big financial transaction plans. If this were true, they would probably get the leniency that banks and others get for crypto. So what is it? Here is my theory, if you will indulge me for a minute; It was a dark and stormy...uh middle of the afternoon in Redmond. Bill is at his desk reading the latest sales figures for Windows and Office 95. "600 million, hot shit! But I grow bored with commonplace software, I need new money schem..uh challenges". Somehow Bill finds his way into Building 666 on the Microsoft campus. The building is home to Microsoft's Security and Crypto division. He hails a young minion. "Here my son, what have you done for me today?" The young man gulps, "Uh well let me see Mr Gates...". Suddenly Bill notices the boy's shirt. It is black, on the front are printed the words; "This T-Shirt is a Munition". Under the words are a few lines of code. Because they are not Basic, Bill is confused. He blurts out,"Say that isn't Java is it!". "No Mr. Gates, it's Perl. This is the RSA code implemented in it." Bill says,"I see, carry on my boy". The young man scurries back to his office. Suddenly it strikes Gates like the first time he envisioned the DOS liscening scheme. "Munitions! Hot shit, weapons on a floppy I could make billions! I could arm the whole world with Microsoft weapons of software and dominate any governments who got in my way! Then I could have Larry Ellison and Marc Andressen and any other punks who made fun of me locked away". I'm sure it didn't happen just this way. It's quite possible that Bill gates never says "hot shit". ---------- > From: Timothy C. May <tcmay(a)got.net> > To: cypherpunks(a)toad.com > Subject: Holding Netscape's and Microsoft's Feet to the Fire > Date: Tuesday, October 22, 1996 8:59 PM > > At 4:11 PM -0700 10/22/96, Jeff Weinstein wrote: > >John Young wrote: > >> > >> 10-17-96, BuWi: > >> > >> "Apple, IBM, JavaSoft, Motorola, Netscape, Nortel, Novell, > >> RSA, and Silicon Graphics Announce PICA Crypto-Alliance" > >> > >> The PICA specification will also be designed to make the > >> task of developing differing domestic and exportable > >> security requirements much easier. [GAK alliance 2.] > > > > John, I think you are misreading the intent here. By making > >it easier to develop separate domestic and exportable > >versions of a product, we foil the government's attempt to > >force weak domestic encryption because it is too much work to > >maintain two different versions. > > Thwarting the True Intent of GAK by ensuring that domestic crypto is > completely unhampered, unhindered, unlimited, and unGAKked is terribly > important. A year or so ago, when Netscape folks issued assurances that the > "relative convenience" of having one "world version" would not be the > determining factor, and that Netscape would have two versions (times the > number of platforms they support), was an incredibly positive development. > > (And Bill Gates, of the Evil Microsoft, had already isssued scathing > denunciations of key escrow and mandatory crypto, so MS was already > effectively in our camp.) > > So, if PICA helps this (along with the Elites Alliance, a rival type), more > power to them. I wouldn't be surprised if the Feds try to exert pressure on > them to change this purpose that Jeff W. describes. Government will realize > that industry consortia are a way to "build consensus" on getting GAK built > in to even domestic products. (The renaming of Clipper/Tessera/etc. to key > escrow and then to "key recovery" is essential to this strategy....got to > convince U.S. software companies that Mr. Policeman is Our Friend...not an > easy sell.) > > But I wonder if the PICA Alliance will be allowed to pursue this "dual > strength strategy." Mightn't it be a violation of the ITARs merely to > _conspire_ to keep domestic crypto unhindered and strong? > > (:-} for the :-}-impaired.) > > Though this is preaching to the choir, it's imperative that Netscape, > Microsoft, and the Other Minor Players remain committed to _never_ > compromising the security of _domestic_ products....Europe and Asia will > have to take of themselves, as the true battle always has and always will > be about the U.S. government's desire to surveil us and tap our > communications at will. > > (Anyone who doubts this should reread the recent comments of Janet Reno, > Louis Freeh, Jamie Gorelick, and all the others talking about the need to > read the communications of criminals and suspected criminals. The real goal > is to head off crypto anarchy, as the summary by Black Unicorn made clear > just a day or two ago.) > > --Tim May > > "The government announcement is disastrous," said Jim Bidzos,.."We warned IBM > that the National Security Agency would try to twist their technology." > [NYT, 1996-10-02] > We got computers, we're tapping phone lines, I know that that ain't allowed. > ---------:---------:---------:---------:---------:---------:---------:---- > Timothy C. May | Crypto Anarchy: encryption, digital money, > tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero > W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, > Higher Power: 2^1,257,787-1 | black markets, collapse of governments. > "National borders aren't even speed bumps on the information superhighway." > > > >

1 0

Re: Stopping the buying of candidates
by jim bell 17 Dec '03

17 Dec '03

At 10:57 AM 10/23/96 +0000, Matthew J. Miszewski wrote: > >> At 08:13 PM 10/22/96 -0700, Declan McCullagh wrote: >(snip) > >> Sure, you can't keep people from talking. However, one way to sabotage the >> usefulness of telling is to allow everybody else as well to make the same >> claim, with essentially no way for the candidates to tell who is REALLY >> giving the money. Make the lie just as credible as the truth, and the value >> of knowing the truth is destroyed. If nobody can trust anyone else's word, >> then no candidate could know who REALLY ought to be rewarded for a campaign >> contribution, breaking the circle of quid-pro-quo. > >Sorry, but this would depend upon equal access to a number of things. >Primarily, John Q. Public does not have sufficient real world access >to politicians to assert that he is the one who donated. Lobbyists, >OTOH, most certainly do. Secondly, access to the timing of donations >is something only the donor can know. > >"Wink, wink. Nudge, nudge, Senator. Look at your account balance >tomorrow. Never forget the National Association of Manufacturers was >there for you" (Obviously a completely random selection 8-) While I have worked through essentially none of the details, if the system can be implemented well enough, all this kind of information will be blinded into oblivion. Donations won't be tallied individually, and news of their arrival will be disguised, possibly by limiting the size that is credited to the candidate per day and thus in effect splitting up a donation to make it "arrive" over a period of a week or two. Only overall totals will be reported, possibly rounded to only two significant figures, and even then possibly only on a weekly basis. >> The candidate still gets the money, of course, and the contributor is still >> free to both donate and speak...separately. The thing that's been cut off >> is the association between the money and the speech...which is exactly what >> the problem is, isn't it? > >See above for why the connection is not. Try again. Rather than trying to prove that a system won't work, why not help develop one that will? >And the problem is >generally not money, but rather the delivery of votes. A candidate >will do whatever it takes to get elected. Often this means $$$ for >campaign expenses. More often it means vote delivery. But "vote delivery" can't be proven, or even demonstrated with a strong degree of assurance. >Get rid of the career politician and you get rid of the motivation >behind the pursuit of political money and vote delivery. I'd LOVE to "get rid of the career politician." And every other kind of politician, as well! > I hate to >actually advocate term limits, but a critical vote in Congress is >much harder to control when the rep is only interested in serving the >public because there is no chance of re-election. After all, it is >not donations that are the evil here, it is the control of gov't >action, right? What I consider wrong is that government affects way too large a fraction of our lives, without apparent Constitutional justification. If the government at all levels were only, say, 1/10th of its current size, there would be much less motivation for corruption. Jim Bell jimbell(a)pacifier.com

1 0

probability question for math-heads
by geeman＠best.com 17 Dec '03

17 Dec '03

I'm too tired &/or busy to work this out, via Knuth --- maybe you can help, with some implications for the DES keysearch strategy. What is the expected distribution, in a "random" binary sequence -- with all the fuzziness that implies as to what _exactly_ is "random" -- of gaps between runs of same-bits. i.e. what is the expected distribution of sequence length between occurances of two (and only two) 1-bits in a row? how about sequences of 3 1-bits? ETc. We know that in a _truly_ random sequence, taken over a long enough period, there should be all possible values of "gaps". But what is reasonable to expect in a "random" sequence as to how those gaps are distributed? Is my question equivalent to Knuth's gap test? If anyone feels like proffering some education on this, if I find anything useful in my investigations I'll certainly credit the help! TIA, etc. -- and hey: doesn't Nickelodeon have a trademark on GAK?

3 3

But first, something completely different... (fwd)
by Lucky Green 17 Dec '03

17 Dec '03

I know this forward is on the edge, but notice the request for increased wiretap capability. Besides, it is funny. --Lucky ---------- Forwarded message ---------- Date: Wed, 23 Oct 96 11:10:26 PDT From: Bruce Erickson <be1(a)ElSegundoCA.NCR.COM> To: ca-firearms(a)lists.best.com Subject: But first, something completely different... Motorcycle gangs, Banditos and Hell's Angeles, in Scandanavia have been fighting for a couple years. A previous story in this paper described how Hell's Angles broke into a Danish prison to throw a hand grenade into the cell of the Banditos' president. Our friends who want to ban mouse guns don't know what trouble is possible. It is possible to get anti-tank missiles on the black-market. [story] "Nordic summit on Biker Violence" Saskis Sissons "The Eurpoean" 10-16 October 1996 Denmark's justice minister justice has called a summit to discuss a joint Nordic campaign against the biker gangs whose violent confrontations are posing an increasing danger to the public throught the region. Bjorn Westh, who is said to be shocked and furious at the latest violence which left 2 people dead and 19 ingured after a rocket attack in Copenhagen, will meet his cunterparts from Sweden, Norway and Finland to consider strategies against the gangs. A justice ministry spokeswoman said: "It will ve an exchange of ideas between the ministers. It's a very serious situation in Denmark at the moment abd these levels of violence could easily spread to other parts of Scandanivia. Westh is looking into the possibility of a total ban on the gangs but his priority is to secure the safety of civilians." Westh's initiative follows a meeting on 7 Octobe bwtewen Danish Prime Minister Poul Nyrup Tasmussen and Swedish Prime Minister Goran Persson, who promised their countries would fight the bikers together. Calls for concerted national and regional action against the escalating gang warfare have been mounting. Only last week 1000 staged a demonstration outside the Hell's Angles compound at Titagade in Copenhagen's Norrebro district. A few days later were awakened in the early morning by an anti-tank rocket exploding in the bikers' clubhouse. [btw: this is the second missile attack on the HAs this year. the first was in the late spring] After months of prevarication the Danes have resolved to take tough action against the gangs. Parliament is this week rushing through legislation which will prevent members of the feuding Hell's Angles and Banditos meeting at their clubhouses in populated areas, and a national task force has been set up to combat the gangs. Commander Per Larsen, who is heading the new unit, said: "The new legislation is good news for us and we are pleased with the initiatives of the prime minuster and justiice ministers. But we would like to see parliament giving us further powers to bug and phone-tap suspects and to search houses secretly." The feud, which began in 1994, has claimed 9 lives and injured 50 people throughout the region. [end story] Diane: "We need stronger tank missile controls. Ban the sale of cheap easily concealed tank missiles. Require licensing and training classes. Store them at missile clubs" Tanya: "There is already total prohibition on the possession of tank missiles by private citizens and murder is still illegal." Diane: "Be quiet, this is a fund raising event."

1 0