December 2003 - cypherpunks-legacy

Re: Playing Cards - Caution!
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 10:57 AM 11/19/1996, Alan Bostick wrote: > Thirty-two bits of randomness in a space that is 225 bits wide leave > room for an awful lot of order. The maximum entropy after one riffle shuffle is actually about 48 bits, assuming the deck was split in half. That is, n! / k! (n-k)! = 52! / 2 * 26! ~= 4.9592 * 10^14. log_2 4.9592 * 10^14 = 48 bits. (Think of one half of the deck of k cards fitting into n possible holes. The order of each half of the deck is guaranteed, so this can be thought of as the number of ways k balls fit into n holes. What about the other half of the deck? They just fall into the empty holes.) Assume the split introduces about 4 more bits, and we get 52 bits of possible shuffles. However, in practice a riffle shuffle may be more predictable. It is possible that 32 bits of entropy are introduced with each riffle shuffle, but it is not obviously true. For a cryptographic application, the standard is higher than for almost any other. So, if it is not clear that something is the case, probably it shouldn't be used. >> A model is presented which Diaconis believes is similar to how people >> shuffle in real life. What is troubling from a cryptographic point of >> view is that there is little empirical evidence to back this up. What >> is more, Diaconis mentions that there is some variation in shufflers. >> A neat shuffler will be less random. (Side note: The Economist claims >> Diaconis can execute 8 perfect shuffles in less than a minute. This >> means the deck is returned to its original order!) > Mathematics does not rely on empirical evidence. ;-) That's true, but the application of mathematics certainly does depend on empirical evidence. I would be very surprised if Diaconis made a mistake with the math. I think the math is what primarily interests him. From his book I did not see a lot of evidence that a great deal of empirical research on card shuffling had been performed. Rather, a few mathematicians here and there appear to have tried out the model and decided that it more or less works. For the standards we should apply, those of a cryptographic application, this is not good enough. >> The study of randomness in cards looks much harder to me now. Also, >> flaws which may be exploitable for financial reasons when real money >> is on the table may have to be substantially more dramatic than the >> flaws required to exploit, for instance, an alleged one-time pad. > Do bear in mind that, unless you distill its entropy through hashing, > a randomly-ordered deck of cards is going to show a lot of seemingly > non-random properties if you try to use it as a one-time pad. Most > obviously, because each card in the deck is dealt once and only once, > there must of necessity be correlations between cards dealt early in > the deck and cards dealt later. (Card-counters at blackjack tables > make their money by exploiting these correlations.) I solved this problem in my original message on the subject. You use the order of the cards to represent your message. Then you use a fully shuffled deck to mix up the mapping of the cards to numbers. If the deck is truly randomly ordered, the scheme I proposed is a true one time pad. (If I made an error, I would like to hear about it!) Tangentially, I would be reluctant to rely on a one time pad whose key was produced by a hash function. We assume that the hash function is cryptographically secure, but if we can assume that, we might as well assume that some cryptosystem is secure. One time pads are supposed to avoid those types of assumptions. > The randomness of rolling dice is much more easy to interpret than that > of dealt cards. I agree completely. In practice, you pretty much have to have a computer to make use of the original schemes I proposed. The literature on card shuffling is quite interesting. A number of people over many years have worked on this. It looks to me like there's lots more interesting work to be done. Many readers of this list would probably find Diaconis's book interesting. There might even be a number of new attacks possible on card games. If 7 riffle shuffles does not, in fact, bring the deck to complete entropy it means that a number of combinations of cards are unlikely. Is the distribution of pokers hands perfectly even? They may not be. Solving this problem in the general case appears to be very hard. But, some progress could be made by modeling real shuffling and looking for patterns in the relationships between the cards electronically. Conceivably, poker hands are not as random as people believe. While the cards you have in your hand may be random, their relationship to other cards may not. This is like a pseudo random number generator. If you don't notice the pattern, you will believe you are looking at a random number stream, but in fact you are not. However, the entire subject is orthogonal to my goals right now. Peter Hendrickson ph(a)netcom.com

1 0

WinSock Remailer Resuming Operation
by Joey Grasty 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Y'all: I'm pleased to announce that the WinSock Remailer is resuming operation tonight at 11:00 PM EST from winsock(a)rigel.cyberpass.net. All messages to the remailer must be PGP encrypted. The public key for this remailer is: - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQBtAzKL9KEAAAEDANpSkWhtxPQXO4A/igS1TKsrHpBIgLd07sgKHmcwGsnPcI5K h2/T1rm3E8lRw5zKWd5MDs7b9Ku7+/V1SjEs2XmpiX1aJ7oN2LJvQ9OO5Z01CwUA 7LFnSfcOrGCnk0ADrQAFEbQuV2luU29jayBSZW1haWxlciA8d2luc29ja0ByaWdl bC5jeWJlcnBhc3MubmV0PokAdQMFEDKL9PjDgztlfPQWWQEBlYYC/iv5zt+v8E/N puymUHLHavlBr9XuP7XVECW3trUxSRdCqnVp1el7fHIQNaN0hw+DW9KutOuumm+u ZzwStZ94dimBYlmSedZ4t4f6DAOK0WZ6wosi/tV5IGlgCdIQA7o2W4kAdQMFEDKL 9M4OrGCnk0ADrQEBWCYDAIlhADaxwBSb2Edz9A5oqAq6YddIVSJdUwuIiN5TvKPa oRXdpkpEYRi1JOUPNy+vLCF21c9LLUYcKMxMvIJPGq6OSBy6VzCdaiOS/yBz7fsH 9I4X5IwoNnf0/Mm+di5zlA== =/UGi - -----END PGP PUBLIC KEY BLOCK----- Here's the info for the remailer-list: $remailer{"winsock"} = "<winsock(a)rigel.cyberpass.net> cpunk pgp hash cut ksub reord"; I'll be adding "post" to this list after I get a more thorough testing of the NNTP code that I added for authentication. "latent" is also pending. The remailer will run every 60 seconds from 12:00 AM to 8:00 AM every day and whenever I am online. Cyberpass automatically spools the messages when I am not connected. Those of you that want to run your own remailer may obtain a copy of the remailer from links from the WinSock Remailer Home Page at: http://www.cyberpass.net/~winsock/ Currently, the remailer runs only under Windows 3.1, but a version for Windows NT and 95 will be available shortly. Note: alt.religion.scientology and alt.clearing.technology are blocked. I'm not interested in run-ins with either supporters or detractors of the Church of Scientology. Binary and picture groups are also blocked, but only because I don't have the bandwidth to support them. I invite people who want remailers to post to these groups to download the remailer and operate it for themselves. Regards, Joey Grasty Jim Ray WinSock Remailer Operators -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMpJaEQ6sYKeTQAOtAQEhZwMAqPnQG0a6Vm4HSx111ha1VulP7ClWqRba 66v/Ff5hLssO+nWbnEKb3VQ/sJEEdQzGQk2lMGeradxQBt0YANiymGkpNR66uAGg a5rtisLAfmwJNJSGhvJtPaMd4r7HnSG3 =EN8y -----END PGP SIGNATURE-----

1 0

Re: Does John Gilmore...
by Dave Hayes 17 Dec '03

17 Dec '03

Black Unicorn writes: > Dave Hayes writes: > > > Again, you confuse free speech with free broadcast. > > Isn't broadcast a subset of speech, especially in this culture? > That which is broadcast is certainly speech. > Trying to draw some kind of "right to be broadcast" as a result is > stupidity or ignorance, or both. Then I suppose you want to control all mailing lists, USENET groups, and web pages. These are broadcasts, and of course they have no rights other than what you seem to want to give them. > Anyone has the right to, e.g., start a mailing list, or a newsletter. > No one has the right to compell ABC or FOX or John Gilmore or anyone > else to broadcast their speech. (The rarest exceptions, like equal time > rules, exist in election contexts). But what about this letter? It is cc'd to two mailing lists. I own the Freedom Knights one, John Gilmore owns the cyperpunks one. Does that mean that both of us have to approve it before it gets sent? Do we both own it? > Learn the difference. Go to law school before you argue free speech > concepts in any detail. "Laws" do not cover the net's "multicast" technology. Distinguishing communication types so as to control those who use them is not going to solve your problem. You are much better off, from a practical standpoint, learning to control what you see and hear rather than attempting to control others. One does not need a school to see this, it sits under one's nose like a milk moustache. ------ Dave Hayes - Altadena CA, USA - dave(a)jetcafe.org Freedom Knight of Usenet - http://www.jetcafe.org/~dave/usenet One only fights what one thinks is real.

2 1

Cracks Are Found In Smartcard Security (fwd)
by Z.B. 17 Dec '03

17 Dec '03

[This was on the Defcon list...apologies if it's already been posted today.] Zach Babayco zachb(a)netcom.com <-------finger for PGP public key http://www.geocities.com/SiliconValley/Park/4127 ----- If you need to know how to set up a mail filter or defend against emailbombs, send me a message with the words "get helpfile" (without the " marks) in the SUBJECT: header, *NOT THE BODY OF THE MESSAGE!* I have several useful FAQs and documents available. ---------- Forwarded message ---------- Date: Tue, 19 Nov 1996 21:17:49 +0000 From: Simon Gardner <simon(a)access.org.uk> To: aaa-list(a)access.org.uk Cc: dc-stuff(a)dis.org Subject: Cracks Are Found In Smartcard Security Cracks Are Found In Smartcard Security Researchers have found a way to attack tough codes, says Michael McCormack. A team of Cambridge and German researchers have used ordinary hacking methods and £150 worth of electronics equipment to crack the "world's most secure computer chip", used in automated teller machines worldwide. They say their technique could be used to reprogram a wide variety of supposedly secure smartcard applications, including the Mondex "money on a card" bankcard, GSM phones, and satellite TV descramblers. Dr Ross Anderson, of Cambridge University Computer Laboratory, working with German researcher Markus Kuhn, used methods pioneered by Sky-TV hackers to crack the Dallas chip, described by the manufacturer as having "the most sophisticated security features available in any microcontroller" and used in most of Britain's cash machines. The chip decodes the information read from bankcards and authorises the bank machine to process transactions ordered by the owner. It is also used by the Mondex system to verify the amount of electronic money available to the cardholder. Anderson and Kuhn used cheap and easily built electronic equipment to send wrong instructions to the chip, observing how it encrypted bad data. By sending such errors through all parts of the encryption system, they could work out its key. "You will have to have backup security" "Once you know that, you can instruct it to put some zeros on the end of your Mondex balance, start unscrambling your satellite feed, anything you like," Anderson said. "Breaking the average smartcard can be done by anyone with a modicum of technical knowledge by the methods we have described. The expense is negligible but it is time-consuming." Their discovery could spell the end of the Mondex system, which relies entirely on the security of the smartcards for its integrity. "I don't think you will be able to have floating systems like Mondex any more, where all the information is held on the smartcards," said Anderson. "You will have to have backup security with authorisation calls and auditing, just like ordinary credit cards. The smartcards are no longer reliable on their own." John Beric, head of security at Mondex, said security was a moving target, and he was unconcerned by the findings. "I welcome Dr Anderson's work, because it's a benchmark that establishes the difficulty of breaking the system," he said. "I take some comfort that it's taken a Cambridge academic and a very bright student to do this." Beric said Mondex had a scheme for continually improving its security by transparently introducing new smartcard chips every two years. "It's not static, we're ahead of the criminal now, and we believe the technology is there to ensure that we stay ahead." Anderson said his latest research indicated that two of the world's most widely used systems for encoding sensitive financial information - the RSA and DES encryption standards used by most banks - could also be cracked easily." [The London Telegraph, 19th November 1996]

1 0

Re: Does John Gilmore...
by George A. Stathis 17 Dec '03

17 Dec '03

At 08:17 ìì 19/11/1996 -0500, Black Unicorn wrote: [snip] >Forward complaints to : European Association of Envelope Manufactures >Finger for Public Key Gutenbergstrasse 21;Postfach;CH-3001;Bern >Vote Monarchist Switzerland ^^^^^^^^^^ Monarchiste et... Cypher-punk, n'est pas? :-) Alors, pour vous Monsieur, je dis: Liberte Egalite Fraternite. Peut'etre votre... Rois trouve le medecin contre la... Decapitation. <plonk> Alors, combien d'argent vou voulais pour mon droit dans votre "mailing list", Excellence? Dit mois, Dit! Je vous... pris !!! ROTFL Vive le Rois Georges :-) P.S. All the nutcases gather here at once? No wonder they're 'unemployable'.

1 0

My PGP Key
by The Deviant 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'd just like to say, to everyone with my PGP key, that the one you have should be removed, it is no longer valid (lost in disk crash). Also, I've finally gotten around to finding why PGP stopped running for so long on my machine, and it works now, so here's my new key. - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQENAzKSSsQAAAEH/1QbvzR/tN+L759w0oGhqOzp+FputqlVx0Rr7+rWxzULd5Qs +MXZjMh+187RA7Q2GwNIijOEL27nUqpAmMT8Rb5dc0k0T4ubDCD7/phN31eoUkDy iV/TnwajrfyEmiFX2Rz1iVc9Zg8VC+x4Uho9pEO9l7cc6PaCFhKXb+hJn/q6ZiCA GaQPu7wtL+bKu+aENFa+eCXOnCN1UsiTaNIfOYDlB5G+6XzE3yY8pN6kK0uDyfb3 C+ScCcxd7tEaFnn9w9I4Hp6GqNtwoL8RfCHPj9ojvODoLCa5TgQ0aT+LlGsDryhR 5T0vI7tPhuzw4h0hHcVZogIjakQkMJ0SHegg8BUABRG0JVRoZSBEZXZpYW50IDxk ZXZpYW50QHBvb2gtY29ybmVyLmNvbT4= =gbdI - -----END PGP PUBLIC KEY BLOCK----- --Deviant When we write programs that "learn", it turns out we do and they don't. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMpJkjTCdEh3oIPAVAQFNogf9FR+TarEEGpVvL/id/cP1mNiB9YsT5t09 8+OWNgIUYid2DIejVWBkNkbdcAmLxYMaqlOmAzqQxizaDqDIjFstNOPwLEmELv1B XXWv7BqRtI3yKkGs8ntamTbtV7cER1SknBIr5xnfbyDbltMcitApwZ7ixSywc8YQ o8qq/mEmftDIgoiFcK65Cj/IsMuW+jQIxu+7xH9l3ivoi5H79/lgLTKbPtH9ISdv e35Y1zIbfsblgyeveJwOVXTBYQd8TFvLylBxDyk+Oh9icpdkt/Qk5277BICw4l1z KmCkQ1spbumUcd0h2qnZijJPrQWiBqHZYGs/2MAl7pUGbx3gIR3d5w== =ECKT -----END PGP SIGNATURE-----

1 0

RE: [NOISE] aga isn't on cypherpunks... (and I'm glad)
by pclow 17 Dec '03

17 Dec '03

> > That is your last warning, Mike. If you start harasing my postmaster, > I will have your fucking ass in Federal Court before you can blink. Errrr..... what has Paul's oversexed donkey got to do with this list or the Federal Court? Sorry, I'm not in the US and my knowledge of US culture is very limited. ---------- From: paul@fatmans.demon.co.uk[SMTP:paul@fatmans.demon.co.uk] Sent: Monday, November 18, 1996 11:58 PM To: aga Cc: cypherpunks(a)toad.com Subject: Re: [NOISE] aga isn't on cypherpunks... (and I'm glad) > > That is your last warning, Mike. If you start harasing my postmaster, > I will have your fucking ass in Federal Court before you can blink. >

1 0

The NSA Responds
by se7en 17 Dec '03

17 Dec '03

The NSA responded to a series of 14 questions posed to them by the Houston Chronicle regarding their involvement and interest in cryptography. While this article is not recent, it is still very interesting. Because of the size, I have not posted it here. It can be found at: http://www.dis.org/se7en/ and click the on "The NSA" The question list is: 1. Has the NSA ever imposed or attempted to impose a weakness on any cryptographic code to see if it can thus be broken? 2. Has the NSA ever imposed or attempted to impose a weakness on the DES or DSS? 3. Is the NSA aware of any weaknesses in the DES or the DSS? The RSA? 4. Has the NSA ever taken advantage of any weaknesses in the DES or the DSS? 5. Did the NSA play a role in designing the DSS? Why, in the NSA's analysis, was it seen as desirable to create the DSS when the apparently more robust RSA already stood as a de facto standard? 6. What national interests are served by limiting the power of cyptographic schemes used by the public? 7. What national interests are served by limiting the export of cryptographic technology? 8. What national interests are at risk, if any, if secure cryptography is widely available? 9. What does the NSA see as its legitimate interests in the area of cryptography? Public cryptography? 10. How did NSA enter into negotiations with the Software Publishers Association regarding the export of products utilizing cryptographic techniques? How was this group chosen, and to what purpose? What statute or elected representative authorized the NSA to engage in the discussions? 11. What is the status of these negotiations? 12. What is the status of export controls on products uing cryptographic techniques? How would you respond to those who point to the fact that the expot of RSA from the U.S. is controlled, but that its import into the U.S. is not? 13. What issues would you like to discuss that I have not addressed? 14. What question or questions would you like to pose of your critics? se7en

1 0

Dogpile
by drose＠AZStarNet.com 17 Dec '03

17 Dec '03

While Rome is burning, and with apologies in advance for the lack of vitriol in this post, I would like to point out a new and effective means of searching the Web and Usenet. Check out Dogpile (with which I have no affiliation).

1 0

Playing Cards - Caution!
by ph＠netcom.com 17 Dec '03

17 Dec '03

A few days ago I suggested that playing cards are a good source of entropy. This was based on claim by Persi Diaconis which was quoted in The Economist. I've researched the claim and I now believe it would be wise not to use playing cards as a source of entropy for cryptographic applications. A fully random deck of 52 cards has about 225 bits of entropy. That means that each riffle shuffle introduces about 32 bits of entropy. Intuitively, that seems like a lot of entropy for one riffle shuffle. I've tried a few riffle shuffles with a sorted deck. While hardly scientific, the level of randomness does not look like 32 bits. Most of the time the cards alternate. The claim that 7 riffle shuffles of a deck of 52 cards will bring the deck to a state of near randomness appears in this book: Diaconis, Persi "Group Representations in Probability and Statistics" Hayward, California: Institute of Mathematical Statistics, 1988. ISBN 0-940600-14-5 The section "An Analysis of Real Riffle Shuffles" begins on page 77. A model is presented which Diaconis believes is similar to how people shuffle in real life. What is troubling from a cryptographic point of view is that there is little empirical evidence to back this up. What is more, Diaconis mentions that there is some variation in shufflers. A neat shuffler will be less random. (Side note: The Economist claims Diaconis can execute 8 perfect shuffles in less than a minute. This means the deck is returned to its original order!) >From the point of view of cryptography, neatness is not a very precise term and should not be relied upon. The book says that in the late 1960s, tournament bridge players started using computers (!) to shuffle the cards as hand shuffling was considered suspect. This is less than reassuring. Nothing I have written here is intended to reflect poorly on Dr. Diaconis. We were not solving the same problem, nor have I fully understood his work. In my first article I said this: "Playing cards are a nice source of randomness because they are widely available and their behavior has been under study for a long time by people with strong financial reasons for finding flaws. I slightly prefer cards to dice because dice may be slightly predictable or even loaded." The study of randomness in cards looks much harder to me now. Also, flaws which may be exploitable for financial reasons when real money is on the table may have to be substantially more dramatic than the flaws required to exploit, for instance, an alleged one-time pad. Here's why I now prefer dice: Dice are simple. Each die throw can be made to be quite independent of all other die throws. Even loaded dice may be used by throwing them repeatedly and adding the results mod the number of sides to the die. Dice which are suspect may be studied by repeated throwing. Non-independence can be more easily studied as it can be assumed that a throw of the die is, at most, related only to the previous throw and none before. Peter Hendrickson ph(a)netcom.com

3 2