December 2003 - cypherpunks-legacy

RE: ideal secure personal computer system
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 12:51 PM 11/16/96 -0800, John Fricker wrote: >In WinNT a program may impersonate a user such as Guest. Also, trojan horses >are ineffective in NT as typical users do not have write permission to system >binaries. I assume that administrators only run programs from trusted libraries and do not include their current directory in their path. They never run programs that aren't directly related to systems administration etc. etc. etc. The typical Trojan horest sits around until someone with the proper authority runs it. That is not the way NT is used at one large commercial operation I am somewhat familar with. (I'm being obscure to protect the guilty.) I think there are very few NT (or Unix) systems which are administrated with a safe level of paranoia. I would like to see more compartmentalization in the system. (Note that even if it only runs with a user's privileges, a Trojan horse will have no problem stealing e.g. that user's PGP secret key ring. Not everything of value is in system files. Question, can a user-level Trojan horse insert itself as a keyboard monitor and get the PGP pass phrase as well?) ------------------------------------------------------------------------- Bill Frantz | The lottery is a tax on | Periwinkle -- Consulting (408)356-8506 | those who can't do math. | 16345 Englewood Ave. frantz(a)netcom.com | - Who 1st said this? | Los Gatos, CA 95032, USA

1 0

Unsubscriving Briefly
by mpd＠netcom.com 17 Dec '03

17 Dec '03

I'm unsubscriving from the list for a few days (weeks?) until the noise level drops down a bit. I'll check it periodically on the Web and I'm pretty sure that if something happens that shakes the world of cryptography to its very foundations, someone will probably send me some email about it. Please continue to party while I am away. -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

2 1

Re: POC_ket
by Bryondp＠aol.com 17 Dec '03

17 Dec '03

Take me off the list!!!!

2 1

Re: Does John Gilmore...
by Dave Hayes 17 Dec '03

17 Dec '03

> The free market will ever be the only real path to free speech, because, > in essence, it is free speech. > Free speech does not, however, require that all speech be universally > broadcast to each and every citizen on the planet free of charge. That's > "subsidized speech." Given that the free market rule is "he who has the money makes the rules", please explain how anything less than "subsidized speech" (as you put it) is anything close to free speech? [For those who's assumptions rule their perception: I am *not* arguing that all speech should be subsidized. I am merely pointing out that the organization that is spending the money to broadcast is controlling the speech, hence it is *not* free speech in terms of freedom or cost.] ------ Dave Hayes - Altadena CA, USA - dave(a)jetcafe.org Freedom Knight of Usenet - http://www.jetcafe.org/~dave/usenet If you want to get rid of somebody, just tell them something for their own good.

2 1

DSA over Elliptic Curves
by janke＠unixg.ubc.ca 17 Dec '03

17 Dec '03

Has anyone implemented this yet? I am going to and was wondering what good sizes for q (the prime corresponding to the 160 bit prime in DSA) and p (the prime corresponding to the 512-1024 bit prime in DSA) would be? Leonard

1 0

Re: Computer CPU chips with built-in crypto?
by Hal Finney 17 Dec '03

17 Dec '03

From: Martin Minow <minow(a)apple.com> > I'm not sure if I can answer this but, at last week's SF cypherpunks > meeting, an Intel engineer asked whether there might be any interest > in a computer chip with some sort of encryption mechanism built > into the chip. As I understand it, this chip would process an > encrypted instruction stream. I.e., it could not execute a program > unless the "key" for that program was first loaded into the chip. > > An interesting idea: does anyone have more information? This sounds like something which might be used in a set-top-box or "information appliance" application where pay-per-use programs would be loaded from a CDROM or network connection. People have been dreaming about pay per use software for many years. It is a similar idea to the "mini application" concept which would replace the monolithic super-apps, the Microsoft Words and the giant do-everything web-browsers/newsreaders/mail-clients, with small, single function utilities. This is part of the idea behind Apple's OpenDoc and Microsoft's OLE. In the same way, instead of buying a big program for hundreds of dollars, you'd just download and use the functionality you needed for a small fee. Yet in practice it is not clear whether either of these trends will have any market success. Monolithic applications seem to be doing very well, with more integration being the trend, not less. And the whole idea of introducing metering to a market which is used to paying just once for access is one which is bound to meet resistance. Look at AOL which is going to single-charge unlimited access to the net. So in both cases the trend looks to be going in the opposite direction. Another possible application for the built in encryption is software piracy protection. You'd unlock software for your CPU but it would not run on anybody else's without a different key code. Here again there is not much benefit to the end user, unless software prices come down dramatically when this device is used. But otherwise the computer manufacturers are selling computers which have features which will limit the powers of the buyers, and having to sell them more expensively to boot because of the special chip. In these days of razor thin profit margins in the PC business it is hard to see how this will sell. Hal

2 1

Re: Members of Parliament Problem
by Hal Finney 17 Dec '03

17 Dec '03

From: ph(a)netcom.com (Peter Hendrickson) > At 1:39 PM 11/17/1996, Simon Spero wrote: > > Create a number up public/private key pairs, blind them, then do the > > cut-and-choose thing with the security officer. He signs the blinded key, > > then returns it. Unblind the remaining pubic key, and you've got a public > > key with the appropriate signature on it. > > Okay, this would work. But, it requires that all (or at least many) of the > Members of Parliament cooperate. If not, then the security officer will > be able to make very good guesses about who is speaking. > > Parliamentarians may not cooperate for a variety of reasons. They may > not wish to be attacked by terrorists for the words of others. They > may believe that cowardice is not to be encouraged. They may not believe > in anonymity. It might be too hard for them. > > What I would like to see is a method which relies only on published > public keys and no other cooperation from the people who are (more > or less) being used as shields. This may be impossible. The 4th method of Chaum's, from Eurocrypt 91, somewhat satisfies this, as does a method from the Eurocrypt 94 paper. Each person can choose his own public key g**x for a discrete log system. However, the problem is that all members of the group have to choose the same prime p as the modulus, and generator g, for their discrete logs. The issue of using a common modulus in discrete log systems has been somewhat controversial. I think when the government first proposed DSS they planned to do something like this, one modulus with everyone having different secret x values with corresponding public keys y = g**x mod p. This has the advantage that public keys are smaller since everyone uses the same g and p. So all you need is one value for your public key. Without this you have to have g, y, and p be your public key so it is 3 times bigger. The problem is that the way the main discrete log algorithms work, once you have broken one discrete log for a certain g and p you can break all the others very easily. So the particular g,p pair which is chosen for everyone to share becomes one very big, fat target to try to apply discrete log algorithms. Now this is not necessarily as bad as it seems. Unlike the case with RSA, there is no secret information which could be leaked to make solving these discrete logs easier. Nobody knows how to do it. So the only way it can be done is by a massive operation roughly similar to factoring an RSA modulus the size of p. Choosing p of 1000 or 2000 bits should still make it effectively impossible for anyone to do this. The numbers are simply far too large. Still the consensus of opinion with discrete logs is that the advantages of slightly smaller keys have not been great enough to justify the risk involved in having eveyone share a modulus, even though that risk is seemingly insignificant. On the other hand maybe for cases like this the additional advantages to common moduli would be enough to tilt the argument in the other direction. Hal

1 0

Re: Censor John Gilmore -- EFF is a disgrace!
by Dave Hayes 17 Dec '03

17 Dec '03

[Multiple CC's trimmed, I don't think anyone at msn.com cares...] > #From Phrack 49, file p49-09 published this month: ... > File 09 of 16 > by Dr.Dimitri Vulis (KOTM) > A Content-Blind Cancelbot for Usenet (CBCB) ... > And what follows, is Dr. Dimitri, defender of freedom of expression, > champion of the anti-censors on the net, posting code to the world to > engage in exactly those activities that everyone has been ranting about > as being so utterly "horrifying (forged cancellations etc)" as it > were. You call yourself on cypherpunks, and you blithely assume that a Phrack author actually signs his real name? Either I thought you guys were *real* hackers and you aren't, or this is a very funny troll. ------ Dave Hayes - Altadena CA, USA - dave(a)jetcafe.org Freedom Knight of Usenet - http://www.jetcafe.org/~dave/usenet "Better to be safe than to be sorry" is a remark of value only when these are the actual alternatives.

3 2

Re: Does John Gilmore...
by George A. Stathis 17 Dec '03

17 Dec '03

At 08:04 ìì 17/11/1996 -0500, Black Unicorn wrote: >> Given that the free market rule is "he who has the money makes the >> rules", please explain how anything less than "subsidized speech" (as >> you put it) is anything close to free speech? >> >> [For those who's assumptions rule their perception: I am *not* arguing >> that all speech should be subsidized. I am merely pointing out that >> the organization that is spending the money to broadcast is >> controlling the speech, hence it is *not* free speech in terms of >> freedom or cost.] >Again, you confuse free speech with free broadcast. Well, I propose a solution to this problem: I don't mind paying fees in fact, if the prices are reasonable. For instance THIS text was _paid_ for, since I pay my Internet provider a certain amount of money every month. It would be unthinkable, however, that my Internet Provider would mess around with THIS text, or with ANY opinion of mine (I am sure you agree). Now, a mailing list has _some_ similarities to the services of an Internet provider, except (usually) the _cost_. I am sure Mr. Gilmore would be more than happy to be _paid_ for the (faulty) services he provides (to his list-members), since e.g. 1900 members times $1 per 2 months (shall we say) would earn him (shall we say) 950 dollars a month; Not much perhaps in some countries, but enough in most places as compensation for the services he provides. The problem with Mr. Gilmore (apart from being an asshole) is really that he is rather a thick-minded proponent of censorship of his list's 'eccentric' members, that such subtleties don't even cross his mind. >Forward complaints to : European Association of Envelope Manufactures >Finger for Public Key Gutenbergstrasse 21;Postfach;CH-3001;Bern >Vote Monarchist Switzerland "Heaven is a place policed by the English, cheered-up by the the Greeks, and organized by the Germans. Hell is a place organized by the Greeks, policed by the Germans, and cheered-up by the English." ...And what have the noble Swiss got to with this shit? They are the bankers for both! :-) Regards George

2 1

HP's crypto technology
by Hal Finney 17 Dec '03

17 Dec '03

I was poking about on the hp web server, trying to get some more hints about the technology they are pushing: <URL: http://www-dmo.external.hp.com/gsy/press/sevcik.html> > Date: 7/11/96 > > Rich Sevcik, vice president and general manager of the Systems > Technology Group, testified to a U.S. Senate subcommittee June 12 on > the importance of cryptography to Hewlett-Packard's ability to compete > in the international marketplace and to the nation's high-technology > competitiveness. > > [...] > > In conclusion, he introduced HP's technology called the International > Cryptography Framework (ICF). Products based on ICF would contain a > suite of cryptography capabilities of various strengths and types, > all non-functional. A customer then could enable the desired types and > strengths of cryptography in conformance with export and host government > regulations by obtaining a stamp-size smart card (known as a "policy > card"), programmed to turn on the particular cryptography capability > allowed. This would protect the right of each nation to establish an > independent policy governing cryptography in digital communication and > storage. Sevcik showed the subcommittee members a prototype cryptography > unit and several policy cards. He said HP plans to have an initial > ICF product available later this year as part of a total smart card > system solution offered due to an alliance with Informix and GEMPLUS, > with other ICF-based products planned for next year. > > U.S. export license authorities are finishing their review of this > first-phase implementation of ICF. "We have been extremely pleased with > the responsiveness and cooperation of these agencies in the review of > our technology," Sevcik said. "We have every reason to believe that > the cryptographic unit and host systems will be granted liberal export > authorization consistent with our expectations for ICF." <URL: http://www.hp.com/csopress/95sep26.html> > Press Release > > HP Announces Alliance with Gemplus and Informix to Deliver Personal > Information Cards for Consumers > > U.S. Government Reviewing Industry-backed HP International Cryptography > Framework > > September 26, 1995 > > PALO ALTO, Calif., Sept. 26, 1995 -- Hewlett-Packard Company, Gemplus > and Informix today announced the formation of an alliance to develop a > secure infrastructure that will enable corporations to speed new services > to consumers via a credit-card-sized personal information card. > > These cards will carry several thousand times the amount of data carried > by currently available smart cards. Additionally, the data on these cards > will be fully encrypted for secure international communication, so the > card will be able to be used anywhere in the world. HP believes that > the U.S. government will authorize the export to commercial enterprises > of products in Phase I(1) of HP's international cryptography framework > standard -- one of the underlying technologies in the infrastructure > that will enable the international use of personal information cards. The > framework is based on HP's open cryptographic structure. > > [...]

1 0