December 2003 - cypherpunks-legacy

Re: One time pads and randomness?
by Bill Stewart 17 Dec '03

17 Dec '03

Welcome! You've asked a Frequently Asked Question, so you're obviously new here, but you're also thinking, so we'll cut you some slack :-) A good book on cryptography that you should read is Bruce Schneier's "Applied Cryptography", which talks about both math and practical issues. At 09:51 AM 1/18/97 -0500, AaronH4321(a)aol.com wrote: >I want to use a one time pad pased crypto system. I understand that the >randomness of the pad genorator is key to security (other than lossing >the keys). What I want to know is if I use a psuedo-RNG that .... Pseudo-Randomness isn't Real Randomness, and OTPs need Real Randomness. [Von Neumann said that anyone using mathematical methods to generate random numbers "is, of course, in a state of sin."] If you've got a Pseudo-RNG, your random number generator has some state at step 1 that totally determines the output at steps 2...infinity. This means that anybody who can determine the state of the PRNG at step n can decode all messages for steps n+1, n+2, ...., and often for steps 1....n-1 as well (depending on the particular PRNG.) If you're got Real Randomness*, even if you know the value of the pad at step n, it tells you entirely nothing about any other step. To make it worse, the popular PRNGs turn out to be annoyingly easy to crack, i.e. to determine the state from a small number of samples. >Say I create a 1 million character one time pad that passes all of the >randomness tests. It is "truely random". Unfortunately, passing randomness tests doesn't tell you a pad is "truly random" - it just eliminates the blatantly easy stuff. For instance, x[n+1] = Hash( x[n] ) or X[n+1] = Encrypt( x[n] ) for a cryptographically strong hash function or encryption like MD5 or SHA or 3-DES will pass randomness tests just fine, but it's still totally deterministic. Still not a OTP. However, say you create the pad from really random sources like flipping lots of coins or counting gamma rays, and haul it to your computers by well-armed guys with briefcases handcuffed to their wrists. >"A" grabs a chunk of the one time pad starting at a random point and >encrypts it....There "B" moves to the random point and begins decryption. If the pad is _really_ random, and you're sure nobody's seen any of it, then there's no difference between starting at a random point and starting at the beginning, and the bookkeeping is much cleaner. >During to process both computers mark that section of the OTP used so >that they don't retransmit with it. I realize this has a limited amount >of messages before it is used up. But would this be secure? Yeah, you've got it (once you remember to use a really random pad so there's entirely no relationship between bits n and n+1.) And you've also hit one of the basic difficulties with using OTPs, which is making sure you only use the once, and that this means that sometimes you run out AND YOU STILL CAN'T USE THE PAD AGAIN. [*Some philosophers will argue that there isn't any Real Randomness, that there's just a deterministic State Of The Universe that's more complex than you happen to know, and some will rant about Quantum Mechanics, and others who actually have some clue about Quantum will tell you that it doesn't get you off the hook; in any case, as long as the universe is messy enough it's be close enough for government work.] The NSA was able to crack a bunch of Russian OTP transmissions back in the 50s (the project name was Venona, and it was recently announced) because the Russians did two major things wrong: They used pads more than once when they were sloppy or out of new pads, and they didn't use very good randomness - clerks banging "randomly" on typewriters generate data with more correlation and less even distribution than they'd expect, and in nearly-pre-computer days they weren't able # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: Eudora PGP
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:07 AM 1/18/97 -0800, Some Anonymous Remailer User wrote: >If somebody wants to play with the new Eudora PGP >but don't have Eudora Pro 3.0, it is available at >ftp://ftp.catalog.com/aussie/biscoe/Eudora30.zip Rather than ripping off a commercial product, from a company that's nice enough to give away free versions, you can get Eudora Lite 3.0.1 from www.eudora.com; I haven't yet installed PGPmail with it, but it should work, and meanwhile it's nicely junking the more common flamers. It is a beta version, but there should be another out soon. >Btw, is it legal for a moderator to let messages >like this one through to the list...? This list isn't currently moderated. The legality if it were is unclear. > > > # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: Keyword scanning/speech recognition
by Bill Stewart 17 Dec '03

17 Dec '03

At 03:34 AM 1/19/97, pgut001(a)cs.auckland.ac.nz wrote: >I was talking to someone recently about the feasibilty of >keyword-scanning phone conversations. He thought it was probably still >beyond the reach of current technology, I thought it wasn't I'd guess it's in-between, and it depends a _lot_ on how error-tolerant you are - do you want to catch them _all_, or just reduce the set of tapes that you'll have humans listen to later, since you're trolling for leads but don't mind missing the occasional one? Speaker-dependent isolated-word recognition is pretty doable. Speaker-independent small-vocabulary isolated-word is also pretty good (though the AT&T calling-card bot does a better job when I read it numbers than when I rapidly tell it "calling card" early in its dialog.) Connected-word is a lot harder. But word-scanning isn't the only thing "They" would troll for - it's probably easier to look for possible matches for specific voices, since you don't have to be too accurate. You want to catch Big Joey's calls from Vinnie, but don't care about his wife's calls. Some of the problems are with modeling speech well enough to do good algorithms; some are just getting enough horsepower to do it in real time. Can "They" afford enough DSP chips to do the job? They certainly can't follow a significant fraction of domestic traffic, and probably not even of US-to-overseas international traffic, but they may be able to pick out calls to/from phones of usual suspects, at least if they're mainly trying to filter for what tapes to listen to. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Gilmore and Sandfart (spit) died of AIDS
by Bovine Remailer 17 Dec '03

17 Dec '03

that's why there is no traffic.

1 0

RE: Take it to sci.math
by Blanc Weber 17 Dec '03

17 Dec '03

From: someone using WinSock Remailer Will all those people who are talking about set theory and the countability of various number systems take their discussion to sci.math, please? 'Cuz 1) All that stuff is irrelevant to crypto, its science or politics. .................................................. And as everyone on this list acutely knows, neither math, science, nor politics has anything to do with crypto. In fact, history bears out the fact cryptologists have neither cause nor reason for what they do. It is a useless by-product of excess mental activity for which only a few can find application, while fewer yet have any concern for its ramifications in a globally connected society of lightning communication. .. Blanc

1 0

Re: Eudora PGP
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:07 AM 1/18/97 -0800, Some Anonymous Remailer User wrote: >If somebody wants to play with the new Eudora PGP >but don't have Eudora Pro 3.0, it is available at >ftp://ftp.catalog.com/aussie/biscoe/Eudora30.zip Rather than ripping off a commercial product, from a company that's nice enough to give away free versions, you can get Eudora Lite 3.0.1 from www.eudora.com; I haven't yet installed PGPmail with it, but it should work, and meanwhile it's nicely junking the more common flamers. It is a beta version, but there should be another out soon. >Btw, is it legal for a moderator to let messages >like this one through to the list...? This list isn't currently moderated. The legality if it were is unclear. > > > # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Question on Diffie-Hellman patent
by Amanda Walker 17 Dec '03

17 Dec '03

Please excuse if this is a FAQ. I'd been operating under the assumption that the Diffie-Hellman patent (4200770) will expire on April 29, 1997 (17 years after the date of issue). Several people have recently told me it doesn't expire until September, evidently confusing the date of issue with the filing date. However, does anyone know of another patent (Hellman-Merkle, perhaps?) that would hve an impact on software that does D-H key exchange? We've got some planned uses of DH; while it doesn't seem cost effective to pay to license DH at this point, that six-month difference is something I need to plan around if necessary. Thanks, Amanda Walker Senior Software Engineer InterCon Systems Corporation

1 0

Using the political opportunity Was: Newt's phone calls
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

Sarah L. Green <greens(a)hiwaay.net> wrote in article <5bo2df$7ui(a)life.ai.mit.edu>... > On Thu, 16 Jan 1997, Phillip M. Hallam-Baker wrote: > > > > It was a conference call but over a cellular phone. Martin had hacked his > > Radio Shack Scanner using a well known technique. He had a radio ham > > license. > > > Phill > Actually I'd love to see this go to court & have the law itself > tossed out. How many years have the airwaves been free? Now it is > illegal to listen on the cellular frequencies. Well I would love to see the case go to court but I prefer to see someone else being harassed. I don't imagine for a minute that anyone will want to take it to court though. Newt can hardly want his crookery to continue to be before the public eye. He wants it buried as soon as possible so he can make similarly "arcane" charges "nobody understands" against Clinton. Interestingly the tax law that Newt broke was the use of non profit funds for political purposes. Newt should know all about these since the Republicans used these laws to shut down political comment by the likes of the Sierra club etc under Reagan. I know several people who used to be involved in non-profits who either resigned or changed the status of the group because the cost of administration and risk of politically motivated prosecution was not worth the tax advantages. Given the "butterfly under the wheel" nature of the Republican attack I would expect jury nullification in a big way. Meanwhile there would be several weeks of questions asking why Newt is not being prosecuted, only the Martins. Despite the fact that I don't think the Democrats are smart enough to mount such a conspiracy it would be a bloody good one if they had done. I think that the challenge the crypto lobby must take on is to use the event to raise public consciousness for crypto rights. What we probably need is a single issue lobby group that the media can call on for this and only this issue and nothing else. The energies of the CDT and EFF are inevitably spread between this and other issues such as the CDA. The problem is that a journalist does not immediately think EFF or CDT when a cellphone case comes up. A single issue crypto lobby could fill that purpose. Phill

1 0

Re: One time pads and randomness?
by Bill Stewart 17 Dec '03

17 Dec '03

Welcome! You've asked a Frequently Asked Question, so you're obviously new here, but you're also thinking, so we'll cut you some slack :-) A good book on cryptography that you should read is Bruce Schneier's "Applied Cryptography", which talks about both math and practical issues. At 09:51 AM 1/18/97 -0500, AaronH4321(a)aol.com wrote: >I want to use a one time pad pased crypto system. I understand that the >randomness of the pad genorator is key to security (other than lossing >the keys). What I want to know is if I use a psuedo-RNG that .... Pseudo-Randomness isn't Real Randomness, and OTPs need Real Randomness. [Von Neumann said that anyone using mathematical methods to generate random numbers "is, of course, in a state of sin."] If you've got a Pseudo-RNG, your random number generator has some state at step 1 that totally determines the output at steps 2...infinity. This means that anybody who can determine the state of the PRNG at step n can decode all messages for steps n+1, n+2, ...., and often for steps 1....n-1 as well (depending on the particular PRNG.) If you're got Real Randomness*, even if you know the value of the pad at step n, it tells you entirely nothing about any other step. To make it worse, the popular PRNGs turn out to be annoyingly easy to crack, i.e. to determine the state from a small number of samples. >Say I create a 1 million character one time pad that passes all of the >randomness tests. It is "truely random". Unfortunately, passing randomness tests doesn't tell you a pad is "truly random" - it just eliminates the blatantly easy stuff. For instance, x[n+1] = Hash( x[n] ) or X[n+1] = Encrypt( x[n] ) for a cryptographically strong hash function or encryption like MD5 or SHA or 3-DES will pass randomness tests just fine, but it's still totally deterministic. Still not a OTP. However, say you create the pad from really random sources like flipping lots of coins or counting gamma rays, and haul it to your computers by well-armed guys with briefcases handcuffed to their wrists. >"A" grabs a chunk of the one time pad starting at a random point and >encrypts it....There "B" moves to the random point and begins decryption. If the pad is _really_ random, and you're sure nobody's seen any of it, then there's no difference between starting at a random point and starting at the beginning, and the bookkeeping is much cleaner. >During to process both computers mark that section of the OTP used so >that they don't retransmit with it. I realize this has a limited amount >of messages before it is used up. But would this be secure? Yeah, you've got it (once you remember to use a really random pad so there's entirely no relationship between bits n and n+1.) And you've also hit one of the basic difficulties with using OTPs, which is making sure you only use the once, and that this means that sometimes you run out AND YOU STILL CAN'T USE THE PAD AGAIN. [*Some philosophers will argue that there isn't any Real Randomness, that there's just a deterministic State Of The Universe that's more complex than you happen to know, and some will rant about Quantum Mechanics, and others who actually have some clue about Quantum will tell you that it doesn't get you off the hook; in any case, as long as the universe is messy enough it's be close enough for government work.] The NSA was able to crack a bunch of Russian OTP transmissions back in the 50s (the project name was Venona, and it was recently announced) because the Russians did two major things wrong: They used pads more than once when they were sloppy or out of new pads, and they didn't use very good randomness - clerks banging "randomly" on typewriters generate data with more correlation and less even distribution than they'd expect, and in nearly-pre-computer days they weren't able # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: UNS_top
by Bill Stewart 17 Dec '03

17 Dec '03

# Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0