December 2003 - cypherpunks-legacy

Re: encryption program
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Path: perun!news2.panix.com!panix!news.mathworks.com!newsfeed.internetmci.com!hunter.premier.net!news-peer.gsl.net!news.gsl.net!news-dc.gsl.net!news.gsl.net!news.sprintlink.co.za!NEWS!not-for-mail From: Pierre van Rooyen <jvrooyen(a)liasec.infolink.co.za> Newsgroups: alt.security Subject: encryption program Message-ID: <32D39684.285B(a)liasec.infolink.co.za> Date: Wed, 08 Jan 1997 04:43:48 -0800 Organization: Secunda Lines: 22 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit If you are familiar with encryption please help me with the following Firstly I want to know if there are a encryption program currently used that are completely succure from hackers. In other words, information encrypted that no person is able to decrypt. Well if there isn't such a program I really think I have one that I have written myself. It is simple text that I have encrypted and so far no one was able to decrypt it. You can go and have a look yourself at http://www.lia.net/pvrooyen/encrypt.txt (CLICK HERE to go there now) If you think this program can be used please reply to this letter and I will give you more information. **PLEASE reply via e-mail ---> <a href="mailto:jvrooyen@liasec.infolink.co.za">CLICK HERE</a> to reply now. Hope to hear from you soon. Regards Pierre van Rooyen

4 4

RE: IMPORTANT: Additional information about UDCM.
by Blake Coverett 17 Dec '03

17 Dec '03

Welcome once again to your weekly round of 'Smell that Snake Oil' > A detailed description of the IMDMP encryption algorithm will be posted to > this mailing list within a few days. An end-user application will be released > within a few weeks. I would appreciate it if all you cypherpunks out there > review the description and the software, and tell me what you think of IMDMP. This is a good start. You would do well to keep your wild claims to a minimum until after the first cursory reviews. > are referenced more often than "bytes". And, the "industry standard" that > IMDMP is obviously well above is DES, etc. Also, DES 128, PGP 1024, RSA 128, > IDEA 128, and IMDMP 2048 were applied at their maximum settings on a file DES 128 - no such beast PGP 1024 - this is presumably a RSA key size, and has nothing to do with the session key involved in actually encrypting the data RSA 128 - RSA is not suited to encrypting streams of data but if you wanted to use it for that purpose 128bits would be ridiculusly to small to be secure IDEA 128 - wow, you've actually named one real block cipher! IMDMP 2048 - feh > full of about 64 *million* repeating "A" ASCII character bytes. The mutation > levels the algorithms rendered on their individual trash test files were > compared. Subtle patterns where searched for. Binary character tallys where > taken. IMDMP did *not* leave *any* repeating patterns in the test file that > was used. In IMDMP, each of the 256 possible binary character combinations > had an approximate count of 0.390625% of all of the 64 million bytes. > 0.390625% is the best possible percentage. The fact that you would consider this to be a sufficient test is proof enough for me that you should not be designing cryptosystems. > Are all of you out there > satisfied? Not even close. -Blake (who's waiting for the first pyramid-scheme cipher to be announced here next week)

1 0

RE: Why are 1024 bit keys the limit right now?
by James A. Tunnicliffe 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- AaronH4321(a)aol.com writes: > I am just starting at this. I know that part of RSA/PGP's strength > comes from the size key you choose. What prevents someone from > writting a 2048 bit key? Is it because computers can't handle it? Is > 1024 top of the prime number size right now? Am I way off track? In just about every way possible... :-) The RSA algorithm can use keys of arbitrary length. All current versions of PGP allow key sizes up to 2048* bits. (When asked for the size of the key to generate, it allows you to select 512, 768, 1024, OR TO *TYPE IN THE NUMBER OF BITS DESIRED*.) There are older, partially incompatible versions that allow even larger keys, though there is little reason to go higher. Beyond something like 3100 bits, it is surmised that the 128-bit IDEA session key is easier to attack. As for prime numbers, no, 1024 bits isn't even close to the largest found (there are of course an infinite number of primes). The latest discovery was of a Mersenne prime, the 35th such found. It was 1,398,269 bits long (all 1's, of course). Tunny * OK, there is a minor bug in 2.6.2 that in some cases limits keys to "only" 2047 bits -- the difference is utterly insignificant in terms of security. This message is signed by such a 2047-bit key. ====================================================================== James A. Tunnicliffe | WWWeb: http://www.inference.com/~tunny Inference Corporation | PGP Fingerprint: CA 23 E2 F3 AC 2D 0C 77 tunny(a)Inference.com | 36 07 D9 33 3D 32 53 9C ====================================================================== -----BEGIN PGP SIGNATURE----- Version: 4.0 Business Edition Comment: which I won in the PGP raffle at Cypherpunks 12/96... iQEVAgUBMtPCuvAmQsmyRPddAQHQHwf+NcZ54woujQVBRRmmyH3CayYmCial2sLn py0RvaXP9UGhY+vZU2HgtzaCor32JnrC67LsHH/2XLIEqjpsNzor7YwCtllsl55M 1lo4dkXfjg/jW0ijLTEbbEealRm1LziZVjIrTNsibq1GZ0UdwTb8nPens2iuHZBB QJZTBkpi0yD8xnWZqvSBwjsdavJUUOy1xU4PgNE4Nr/xbWPA0OwMGOm1MSHFXxHL xOYJvLR9905mSxh+kNdcf3SpT5JRuBjH6MQmG8GjKRGc8KoXbfUkCiXeSXlygaGA q2/z2lO4E9eTZvlrsQN1sw8uIoKTnz3YPw9nWjXTeLWx9J7WbeGPSA== =RzVt -----END PGP SIGNATURE-----

4 3

Re: The Upcoming DES Challenge
by Ulrich Kuehn 17 Dec '03

17 Dec '03

Liz Taylor writes: > There is nothing unglamorous about a known plaintext attack, if the > plaintext is choosen carefully. I don't know anything about bank ATMs > and the protocols they use, but I presume the PIN is stored on the card > single DES encrypted. If this is so, anyone can take an ATM card, attack it > to recover the key and then use that key to recover the PIN for any stolen > ATM card of that bank (or that branch). Hopefully, the ciphertext/plaintext > pair that RSA announces will be a real target like this, with the actual key > disabled. Once the key is recovered, the press can then claim that ATM > cards are not safe any longer. > As far as I know, here in Germany (maybe also somewhere else) there is not the pin stored on the card. Instead, it is regenerated by the ATM every time using a secret key of the bank. In order to be able to use the ATM card even with ATMs of different banks, there are offsets stored on the card that relate to some commonly used pool keys. Ciao, Ulrich -- Ulrich Kuehn ------ kuehn(a)math.uni-muenster.de http://wwwmath.uni-muenster.de/~kuehn/

2 1

IMDMP: SOURCE CODE RELEASE ANNOUNCEMENT
by DataETRsch＠aol.com 17 Dec '03

17 Dec '03

Hello, In compliance with the large volume of source code requests DataET Research has been receiving, the undocumented Pascal source code of UDCM (containing the IMDMP encryption algorithm) will be released in approximately one month. Also, the shareware version of UDCM completely complies with ITAR since only 56-bit keys are allowed. The registered version allows 2048-bit keys. The registered version can only be sold within the U.S. and Canada. Also: IN RESPONSE TO THE FLAME MAIL DATAET RESEARCH HAS RECEIVED: A "comment:" is from a flame mail. A "reply:" is DataET Research's reply to the comment. Comment: "What do you mean by 'extensive research'." Reply: Benchmark tests. Source code comparisons. Documentations of other algorithms. "Applied Cryptography". Comment: "Yah, okay, since when is a DLL not royalty-free?!" Reply: Read some component catalogs. Go search the Internet. Comment: "That stupid line about 140 function bloats your ad." Reply: Is this constructive criticism or what? Comment: "What the hell does DLL size have to do with cost-effectiveness?" Reply: Upload time. Disk creation time. Minimal archive size increase. Comment: "I've never even heard of IMDMP before. Is this a joke?" Reply: UDCM (IMDMP) came out January 1st, 1997. How do you think successful companies start anyway, with millions of dollars upfront? DataET Research is a relatively new company. Comment: "What kind of industry standard is IMDMP above?" Reply: 128-bit encryption. Average DES is 128. PGP tops 1024. IDEA goes at 128. RSA the same. Full security IMDMP is 2048-bit. Any other questions? Comment: "Any bonehead can tell that 256 bytes is 2048 bits." Reply: Does anybody out there feel insulted? Comment: "Why does IMDMP need sub-algorithms? Is there something wrong?" Reply: Sub-algorithms of IMDMP are basically algorithm modes. There is nothing wrong with IMDMP's structure. Why don't you see what sub-algorithms are for yourself? Go try out UDCM: http://members.aol.com/dataetrsch/udcm.html. Comment: "What algorithm doesn't process both binary and ASCII?" Reply: Go search the Internet for one. You'll find many dinky ones. Comment: "What algorithm doesn't allow multiple encryption layers?" Reply: Go search the Internet for one. You'll find many dinky ones. Comment: "Who says IMDMP doesn't have any back-doors or magical keys?" Reply: What more do you want us to prove? The source code will be out in about a month. Comment: "Why is there a dumb 2,147,483,390 file size limit?" Reply: It has do with 2^32 DOS file pointer long integer variables. You developers should know that. Comment: "Why the hell is the file size limit 258 bytes off? What, are keys kept in file headers?" Reply: Keys are NOT stored in headers. The 258 (actually 256) byte header is used to store certain IMDMP special security option settings. The header is itself secured using a 128-bit encryption code. Comment: "What the do you mean by 'file specific unique encryption'." Reply: For the idiot who sent this message to us: Why don't you download UDCM V2.0 and view its documentation for yourself? Comment: "Isn't IMDMP illegal?!" Reply: The version of UDCM (IMDMP) being distributed on the Internet, the shareware version, allows only 56-bit keys. The registered version allows 2048-bit ones. The registered version is only sold within the U.S. and Canada. Comment: "I want the damn source code to IMDMP now. How do we know for sure that IMDMP is better than DES and all the others you mentioned?" Reply: Wait one month please. Jeremy K. Yu-Ramos President DataET Research Data Engineering Technologies

2 1

Ignore all the messages about...
by DataETRsch＠aol.com 17 Dec '03

17 Dec '03

Hi again, In the the help documentation of the shareware version of UDCM, there may appear to be a message that reads: Describing the algorithmic contents of the IMDMP encryption algorithm is well beyond the scope of this on-line manual. In fact, there is currently absolutely no documentation that exists outside of the corporate domain of DataET Research that actually explains the IMDMP encryption algorithm in any true detail, and DataET Research does not intend to release or disclose any such sensitive documentation to the general public, ETC. ETC. ETC. ETC. ETC. ETC. PLEASE DISREGARD THE ABOVE MESSAGE COMPLETELY. Jeremy... President DataET Research Data Engineering Technologies

2 1

Problems with UDCM V2.0?
by DataETRsch＠aol.com 17 Dec '03

17 Dec '03

Hi, If you are even having the slightest problem with UDCM, do not hesitate to send us a message at: DataETRsch(a)aol.com. Remember that the *shareware* version of UDCM MUST BE INSTALLED BEFORE USE. Run "install.exe" after decompression. JUST INCASE YOU DON'T KNOW WHAT THE HELL I AM TALKING ABOUT: Greetings! I am Jeremy K. Yu-Ramos, president of DataET Research, Data Engineering Technologies. I am sending you this message to let you know that DataET Research has recently initiated the distribution of UDCM, Universal Data Cryptography Module. UDCM implements a revolutionarily new, extremely advanced and sophisticated, digital data encryption algorithm named IMDMP, Integrated Mathematical Data Manipulation and Positioning. Extensive research shows that IMDMP is more advanced than DES, RSA, IDEA, and PGP. UDCM (the IMDMP algorithm)... o Is a royalty-free Windows DLL module featuring advanced cryptography. o Contains more than 140 procedures and functions. o Is a very cost-effective size of only 57 kilobytes. o Implements the IMDMP encryption algorithm. o Is more advanced than all of the industry standard encryption algorithms. o Allows encryption keys as large as 256 bytes (2048 bits). o Includes 18 sub-algorithms. o Processes all forms of binary and ASCII files. o Allows multiple encryption layer levels. o Has absolutely no back-doors or magical keys. o Does not store encryption keys in files. o Processes files as large as 2,147,483,390 bytes. o Has a 100% data preservation rating. o Includes Y2K compliant time and date locking features. o Has NCSC compliant data cleaning and wiping capabilities. o Includes file specific unique encryption features. o Includes file authentication guard features. o Includes unique encryption signaturing features. o Includes data importance and sensitivity stamping features. UDCM can be accessed through programs developed with popular application and database programming languages and environments such as: C, C++, Visual Basic, PowerBuilder, Delphi, OOP Pascal, Turbo Pascal, SmallTalk, dBase, Paradox, Access, Sybase, Oracle, etc. DataET Research has released a shareware version of UDCM named UDCM V2.0. To download UDCM V2.0 for free, please go to: http://members.aol.com/dataetrsch/udcm.html. I hope you will consider applying UDCM in the software you develop. Thank-you very much for your time. Jeremy... President DataET Research Data Engineering Technologies

2 1

Re: [IDEA] Cypherpunks Super Computer (was Re: The Upcoming DES Challenge)
by Hal Finney 17 Dec '03

17 Dec '03

[Sorry if this is a re-post...] From: "Frank O'Dwyer" <fod(a)brd.ie> > However, what if there was a safe scripting language with bignum > arithmetic and other cryptographic primitives, and what if > lots of people ran a service that would accept scripts in > that language and respond with the answer? Say, a Safe-TCL > interface to Peter Gutmann's cryptlib, running at idle > priority? Sort of like a distributed batch queue, and also > a bit like the way jobs are (were?) submitted to Crays. The > Cypherpunks Super Computer. It need not be significantly slower > than raw code if the primitives are high level enough. A few years ago I coded up a TCL interface to Pr0duct Cypher's PGPTOOLS library. It did bignum arithmetic from the command line, and also let you use MD5 and IDEA on files and buffers. Unfortunately I had a major disk crash and was never able to recover my last version, and I never got back to it. Safe-TCL has never gotten the scrutiny of Java, but IMO if it ever does it will be found to suffer from its own flaws. At this point I think Java is farther along the path to safety. I do like the idea of a widely available, installed, crypto-capable scripting language. This would be an ideal basis for trying out new crypto protocols and algorithms, without having to write a whole program from scratch. We have been talking about setting up DC nets for years, for example. The concept is so simple as to be almost trivial. But the infrastructure is the hard part - dealing with the I/O issues, the multiple architectures, all the configuration issues. I suspect that Java, when it gets its security API, may be a good candidate for this kind of system. It's already got high level socket I/O, and with a bignum package and some basic crypto primitives like one way functions, you could do a lot with it. You still have the problem of trading off safety for utility, though. Hal

3 2

IMPORTANT: Additional information about UDCM.
by DataETRsch＠aol.com 17 Dec '03

17 Dec '03

{Please read this *entire* e-mail message.} Hi, A detailed description of the IMDMP encryption algorithm will be posted to this mailing list within a few days. An end-user application will be released within a few weeks. I would appreciate it if all you cypherpunks out there review the description and the software, and tell me what you think of IMDMP. Also: The AOL web site address my company has may not always work out when the server is having problems or user overloads. Please try again later. Again, the web site address for UDCM, Universal Data Cryptography Module, is: http://members.aol.com/DataETRsch/udcm.html. IN RESPONSE TO THE FLAME MAIL DATA RESEARCH HAS BEEN RECEIVING: Note: The 18 "sub-algorithms" of IMDMP are basically algorithm "modes", and, yes, many algorithms do *not* have multiple encryption layers, although, obviously, the more advanced ones do. Also, 256 bytes is equal to 2048 bits. I realize that most of you out there know that, but some of you don't. "Bits" are referenced more often than "bytes". And, the "industry standard" that IMDMP is obviously well above is DES, etc. Also, DES 128, PGP 1024, RSA 128, IDEA 128, and IMDMP 2048 were applied at their maximum settings on a file full of about 64 *million* repeating "A" ASCII character bytes. The mutation levels the algorithms rendered on their individual trash test files were compared. Subtle patterns where searched for. Binary character tallys where taken. IMDMP did *not* leave *any* repeating patterns in the test file that was used. In IMDMP, each of the 256 possible binary character combinations had an approximate count of 0.390625% of all of the 64 million bytes. 0.390625% is the best possible percentage. Are all of you out there satisfied? Jeremy K. Yu-Ramos President DataET Research Data Engineering Technologies

7 7

[STATS] Cypherpunks subscriptions on and off
by Dale Thorn 17 Dec '03

17 Dec '03

The following table shows cypherpunks subscription activity for the period 12 Oct 1996 thru 07 January 1996. Date ~Days #Subs Gain Loss Gain / day Loss / day ----- ----- ----- ---- ---- ---------- ---------- 10/12 n/a 1361 n/a n/a n/a n/a 11/04 23 1353 211 219 9.2 9.5 11/30 26 1299 173 227 6.7 8.7 12/18 18 1262 120 157 6.7 8.7 01/07 20 1291 151 122 7.6 6.1 ----- ----- ---- ---- ---------- ---------- Totals: 87 655 725 7.5 8.3 Interpretation: Unless the reversal of gain/loss in the 5th data row is permanent, c-punks are losing 0.8 bodies per day, or 294 subscribers per year. Actually, the constant high turnover suggests something else: Many people join the list and get back off again due to the high volume and their own personal time constraints. Unless Sandy can cut *way* back on the number of posts to the list, i.e. excise a *lot* more postings than just the blatant Spam and "Timmy is a....." posts, it won't make any difference to those people who come and go. In effect, Sandy is going to have to cut the number of daily posts (to the moderated list) from, say, 100 per day down to, say, 20 or 25 per day. This would certainly be a goal of his, since most of the subscriber comments I've heard indicate that even 50 posts per day of "relevant political/social commentary" is way too high for them. As to the net loss in subscribers, the moderation of the list could have a substantial effect on the number of subscribers short-term, but whatever trend we have here will continue regardless, since the real value and character of the list is not determined by the posts which are removed (unless it were that some of the character and value is going to be removed), but by long-term factors which are to be expected when the principals get older, less involved, and less contentious (like Sandy, wanting to avoid conflict).

4 6