December 2003 - cypherpunks-legacy

Relative Strength of 40-bit Crypto Implementations
by Vin McLellan 17 Dec '03

17 Dec '03

A client asked me today about where he could find evidence of the relative strength of different encryption algorithms, when all are restricted to 40-bit keys. He assumed dot-Gov was going to restrict his export product to the 40-bit limit, but he wanted to provide the strongest security he could within that limitation. How should I have answered him? Vin McLellan + The Privacy Guild + <vin(a)shore.net> 53 Nichols St., Chelsea, MA 02150 USA <617> 884-5548

1 0

No Subject
by anonymous＠miron.vip.best.com 17 Dec '03

17 Dec '03

NOVEMBER 11, 1996 INFORMATION WARFARE U.S. sitting duck, DOD panel predicts BY BOB BREWIN AND HEATHER HARRELD (antenna(a)fcw.com and heather_harreld(a)fcw.com) The dependence of the United States on computers and communications systems to run its critical power, finance and transportation systems places the country at risk in the event of an information warfare (IW) attack, according to a report prepared by a top-level Defense Department advisory panel. This reliance, it said, has "created a tunnel of vulnerability previously unrealized in the history of conflict" and could have a "catastrophic effect on the ability of [DOD] to fulfill its mission." The report of the Defense Science Board Task Force on Information Warfare-Defense (IW-D), obtained by Federal Computer Week, called the threat of an IW attack "significant," adding that the nation's "vulnerabilities are numerous, [and] the countermeasures are extremely limited...." Citing a specific example, the DSB report said one building in Savannah, Ga., (a Bell South switching facility, FCW learned) houses not only a vital communications hub but information technology systems supporting key electric power and transportation companies. Because Savannah serves as a vital port of embarkation for Army troops based in that area, an IW attack against that one building would "make it impossible to deploy military forces at the pace specified in operations plans." The DSB task force, chaired by two former assistant secretaries of Defense for command, control, communications and intelligence (ASD/C3I), Duane Andrews and Donald Latham, viewed the IW problem as so severe that it urged the Pentagon to embark immediately on a crash course to protect against this new form of warfare, providing detailed policy, funding and legal recommendations. These recommendations included a controversial call for the Pentagon to have the legal power to protect nongovernmental portions of the infrastructure in the name of "the common defense." To defend DOD and critical nongovernmental systems against IW, the report recommends new legal authority that will allow "DOD, law enforcement and intelligence agencies to conduct efficient, coordinated monitoring of attacks on the critical civilian information infrastructure...." In carving out a position for DOD to take on this role in the civil sector, the report bluntly summed up the problem: "We should not forget information warfare is a form of warfare, not a crime or an act of terror." It took an equally blunt approach on how the Pentagon should respond to such an attack or intrusion. "The response could entail civil or criminal prosecution, use of military force...diplomatic initiatives or economic mandates." DSB, which said it has urged immediate and concerted action on the IW-D front for the past three years, had a number of recommendations on how DOD should get its own information warfare act together. The report said it would take $3 billion over the next five years to translate these recommendations into reality. This includes establishing the ASD/C3I as the single focal point for IW-D within the department - a necessary step to spread the diffusion of IW responsibilities among the services and Defense agencies, according to a source familiar with the thinking of the task force. Emmett Paige Jr., ASD/C3I, said he had read a copy of the DSB briefing to deputy secretary of Defense John White. Paige said, "I saw nothing in that briefing I do not agree with. I strongly support everything in their briefing." DISA's Role The Defense Information Systems Agency would take on a pivotal IW-D role, based on the recommendations in the report. It called for DISA to set up an IW operations center to provide tactical warning, attack, assessment and emergency response with infrastructure restoration capabilities, and it pegged funding for this center at $275 million over five years. DISA also should establish a joint office for system, network and infrastructure design, the report said, with funding estimated at $225 million over five years. DISA director Lt. Gen. Al Edmonds has already acted on these recommendations, setting up last week a Global Operations and Security Center and a Programs office (see Intercepts). Edmonds said DISA decided not to wait to have these recommendations approved. "We're doing this on our own. We want a new focus here...and we're funding it out of our own budget [by] prioritizing on Information Warfare-Defense. The DSB is right on target, and they got us rolling." The Pentagon also needs to refocus its IW research and development, the report said, recommending $580 million over five years. This poses a tough challenge, DSB said, because "prior R&D efforts have been in areas such as computer and network security.... Little attention has been paid to surviving willful malicious attack, or detecting and eliminating corrupt software." The DSB task force also took some potshots at some well-established and well-entrenched DOD IW policies and programs. Looking at the national debate over the key escrow encryption systems backed by the Clinton administration, the DSB report dismissed encryption as a "distraction.... Encryption simply does not solve all of the information security problems some are led to believe." The National Security Agency's long-running Multilevel-Secure Information Systems Security Initiative also received short shrift from the task force, which suggested commercial products such as security "tokens" rather than passwords could go a long way in the near term toward resolving DOD's security problems. The task force also brought sober realism to the theme of "information superiority" promulgated by all the services during the past several years to such an extent that it has become almost a mantra. "The doctrine of information superiority assumes the availability of information and information technology - a dangerous assumption.... Published service and joint doctrine does not address the operational implications of a failure of information and technology," the report said. The intelligence community's ability to handle IW also came in for a similar assessment by the task force, which called IW "a nontraditional intelligence problem [that is]...not easily discernible by traditional intelligence." Traditional intelligence skills "are largely irrelevant in the information warfare environment." Percy Pierre, an electrical engineering professor at Michigan State University and a member of the DSB task force, said DOD's interest in protecting critical infrastructure is a result of "the recognition that the Defense Department is dependent on private-sector assets for logistical support and other types of support." Any move by government toward civil electronic defense must be delicately balanced to avoid antagonizing the private sector, said Winn Schwartau, a security consultant and author of several information warfare books. "For them to blatantly say, `We want to monitor,' that creates a huge problem," he said. "If the government says, `You don't worry, private sector, we're going to take care of you,' they're going to have a problem." You must register to read this week's news or to use the search or forums. If you haven't signed up yet, fill out the registration form. Mail questions about this Web page to webmaster(a)fcw.com. URL: http://www.fcw.com

3 3

Divide & Conquer II
by Toto 17 Dec '03

17 Dec '03

ibid.

1 0

Re: Relative Strength of 40-bit Crypto Implementations
by Lucky Green 17 Dec '03

17 Dec '03

At 01:29 AM 1/7/97 -0500, Vin McLellan wrote: > A client asked me today about where he could find evidence of the >relative strength of different encryption algorithms, when all are >restricted to 40-bit keys. He assumed dot-Gov was going to restrict his >export product to the 40-bit limit, but he wanted to provide the strongest >security he could within that limitation. The best answer you can possibly give him is to move production overseas. Any 40 bit cipher is garbage. Period. It is easy to produce crypto overseas. Many medium sized companies are doing so today. Insiders claim that larger companies, such as Netscape, are in the process of setting up shop abroad as well. Clearly, one can't produce software containing crypto in the US and stay competitive at the same time. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred Make your mark in the history of mathematics. Use the spare cycles of your PC/PPC/UNIX box to help find a new prime. http://www.mersenne.org/prime.htm

2 1

[ANNOUNCEMENT] Secure envelopes
by mixmaster＠remail.obscura.com 17 Dec '03

17 Dec '03

Timothy C. May's aberrant sexual life has negatively impacted his mental integrity. /\ o-/\ Timothy C. May ///\|/\\\ / /|\ \

1 0

Re: The Upcoming DES Challenge
by Lucky Green 17 Dec '03

17 Dec '03

At 06:56 PM 1/6/97 -0800, Mike Duvos wrote: >Peter Trei (trei(a)process.com) writes: > >Ick. Why overly complexify things? A known plaintext attack >would be far more straightforward. After all, the goal is to >recover the key, not the message. Having to find a key which >decrypts to something having all high bits clear will discourage >people who might want to take a crack at this independent of the >canned program you are going to distribute. I agree. A real life crack of DES can almost always assume a know plain text. Why should the demo crack take the 10% hit? >[snip] > > > It will NOT run as a screen saver. > >Too bad. The screensaver paradigm is something the unwashed >masses can easily understand. I have been running the distributed prime search software (see my .sig) for about two months now. [2^1398269-1 is prime!] If you haven't tried this software, I'd urge you to do so now. Not only because it might make you famous, but because it will give you some ideas how a distributed DES crack might work. I always liked the screen saver idea, but a crack using screen savers only works while the screen saver is active. The mersenne prime program runs on the lowest priority thread under Win95/NT/Linux. It works even while you are working, using all the idle cycles it can find, while at the same time having no effect at all on any of the work you do. Install it and forget about it. It's better than a screen saver. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred Make your mark in the history of mathematics. Use the spare cycles of your PC/PPC/UNIX box to help find a new prime. http://www.mersenne.org/prime.htm

4 3

Re: High-tech tracking by police raises legal outcry
by jim bell 17 Dec '03

17 Dec '03

At 06:39 AM 1/6/97 -0600, Mike McNally wrote: >Secret Squirrel wrote: >> >> The technology, marketed by a company called Teletrac, is simple: >> A tramsmitter sends a radio signal to a computer ... > >Anybody know the frequencies used? > >(Anybody willing to guess whether the FCC might quietly introduce >prohibitions against scanners that can receive those frequencies?) > >(Gee, that looks paranoid.) This wouldn't do a great deal of good. The systems were already described as frequency-hopping. The hops are probably fast enough to outwit a scanner's receiver. However, it turns out that there is a comparatively simple way to detect such transmitters: An old-fashioned diode detector using modern components. Take a loop of wire (about a foot in diameter), add a microwave-capable signal diode to rectify the signal and send it to a small capacitor and then go to a DVM. (digital voltmeter.) (Sensitivity can be dramatically increased by also inserting a blocking capacitor in the loop and adding enough DC voltage to barely forward-bias the diode.) A momentary (or continuous) increase in output voltage indicates that the diode is rectifying AC, which indicates a transmitter. Buffering the DC-level signal and sending it to a set of earphones will indicate a pulsed transmitter. Interestingly, this is probably more or less the circuit that was originally used in 1970's Fuzzbuster-type radar receivers before the heterodyne systems were developed. The "disadvantages" of that circuit, in microwave-radar detection, are either not disadvantages or are in fact advantages in hidden-transmitter hunting. The first "disadvantage" was that this receiver was EXTREMELY broadband, practically "DC-to-daylight," or at least up to the rectification capability of the diode chosen. (I've implemented systems that will do 20 gigahertz easy, and I was using old diodes!) False triggers were a common result, due to hard-to-avoid rectification of CB and ham radio transmissions for example. In the case of transmitter hunting, that disadvantage is a solid advantage, because you don't need to know what frequency the transmitter is at. The second disadvantage, comparatively low sensitivity, was a problem if you're trying to detect a 100 milliwatt radar transmitter 300 meters away, but if you know you only have to search a car from a meter away, the inverse-square law indicates that you're going to see a signal with around 100,000 times the power level all other things being equal. Jim Bell jimbell(a)pacifier.com

1 0

Re: The Upcoming DES Challenge
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

Orbital mind control lasers made mpd(a)netcom.com (Mike Duvos) write: >Peter Trei (trei(a)process.com) writes: >>1. I'm astonished at the low level of reaction RSA's announcement that they >>will be sponsoring a DES Challenge, with a $10,000 cash prize. >I'm certainly jumping up and down and cheering. I said a while back that the >life expectancy of DES would be about two weeks if anyone forked over serious >cash. I'm still a bit nervous about what the reaction will be though - won't the US government (and anyone else pushing DES) be able to say "It took 10,000 Pentiums several weeks, noone would bother doing that, so it's safe" (with a possible side order of "Safer-SK64 is 256 times as secure, anyone we really like can use that provided they hand over the keys in advance"). Peter.

4 3

No Subject
by Success＠midlex.com 17 Dec '03

17 Dec '03

Àÿÿÿÿÿÿÿÿÿÿÿ¿ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿA;4!H@åÊC¥ÐEP6 5 PP*²ÈLE,3@$0

1 0

Special Discount for Pathfinder Users
by beta＠eb.com 17 Dec '03

17 Dec '03

Dear Pathfinder Free Trial Participant, Thank you for participating in the free trial offer of Britannica Online. Although your free trial has now ended, you can continue accessing one of the world's most reliable sources of information by becoming a subscriber. For a limited time only Pathfinder users can purchase Britannica Online at a special discounted rate -- $14.95 a month or $149 a year. As a subscriber, you'll enjoy all that Britannica Online has to offer, from its ease of use... to its in-depth articles... to its high quality Internet links. And now with our latest release there's even more to enjoy! Britannica Online 97 includes many new features: * Almost 1,000 new graphics, for a total of over 4,200 graphics * Over 5,400 related Internet links, plus approximately 50 new links added each week, hand-selected by our editors * Miniature versions of images within articles and the Index that can be enlarged with just one click. * A spell-checking device that runs automatically when you conduct searches and, of course, * Updated content. In addition to updates for the formal releases (2 or 3 times per year), Britannica Online articles are updated by our editorial department as frequently as world events dictate. Our editors also select new articles each week to provide you with background on today's world events. And don't forget the spotlight features of Britannica Online. Our recent addition, "The American Presidential Election," has been updated to include results from the recent election and features audio clips, presidential and vicepresidential biographies, and even links to the White House. To sign-up for Britannica Online -- * Access the registration form at http://www.eb.com:195/bol/ and select either the monthly or annual subscription option. * Enter PTF149A in the promotion code box for an annual subscription of $149 (our normal $25 registration fee will be waived for Pathfinder users) OR Enter PTF149M in the promotion code box for a monthly subscription of $14.95. * Review to make sure the information is complete and accurate, then submit. Don't let this special offer pass you by. We look forward to welcoming you as a Britannica Online subscriber. Sincerely, Lisa Girolimetti Marketing Manager, Online Products Encyclopaedia Britannica, Inc. http://www.eb.com ------------------------------------------------------------------ To remove yourself from our mailing list simply hit the reply button and add the text "Pathfinder Unsubscribe" to the body of the message. Reply messages sent to beta(a)eb.com will NOT be read. If you would like to offer feedback or ask a question please e-mail us at comments(a)eb.com. ------------------------------------------------------------------

1 0