December 2003 - cypherpunks-legacy

Re: The Upcoming DES Challenge
by jim bell 17 Dec '03

17 Dec '03

At 10:49 PM 1/7/97, pgut001(a)cs.auckland.ac.nz wrote: >Orbital mind control lasers made mpd(a)netcom.com (Mike Duvos) write: > >>Peter Trei (trei(a)process.com) writes: >>>1. I'm astonished at the low level of reaction RSA's announcement that they >>>will be sponsoring a DES Challenge, with a $10,000 cash prize. >>I'm certainly jumping up and down and cheering. I said a while back that the >>life expectancy of DES would be about two weeks if anyone forked over serious >>cash. > >I'm still a bit nervous about what the reaction will be though - won't the >US government (and anyone else pushing DES) be able to say "It took 10,000 >Pentiums several weeks, noone would bother doing that, so it's safe" (with a >possible side order of "Safer-SK64 is 256 times as secure, anyone we really >like can use that provided they hand over the keys in advance"). This was exactly my concern months ago. PC's are remarkably _inefficient_ systems for attempting to crack codes. I recall estimating, quite approximately, that it might take somewhere about $500,000 of electricity cost alone to check all 2**56 possible decrypts, most of which is going to power unnecessary components. (monitors, hard drives, sound cards, modem cards, etc, etc, etc.) By doing the decrypts on PCs (term used generically; it applies just as well to Mac's, PowerPC's, DEC Alpha's, etc) we make it look like DES is better than it really is. But I'm under no illusion. As the saying went, "When the only tool you have is a hammer, you treat every problem as if it were a nail.) People have PC's, and will use them. Let me suggest, however, that somebody familiar with the details of DES and FPGA's (or other kinds of high-density programmable logic) figure out a ballpark estimate of how much it would cost to implement a minimalist DES-cracker in hardware. Don't do it, just estimate it. Then, when somebody has finally cracked that DES message and someone the news media is trying to suggest that this was an expensive effort, a more economical figure will be quotable. Jim Bell jimbell(a)pacifier.com

1 0

Commercial Encryption Packages
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

How much word has there been on any commercial encryption packages (such as point n crypt..etc) of any types of backdoors installed in them? Any comments or knowledge about this would be good edition to the list :) Adam

2 1

Why are 1024 bit keys the limit right now?
by AaronH4321＠aol.com 17 Dec '03

17 Dec '03

I am just starting at this. I know that part of RSA/PGP's strength comes from the size key you choose. What prevents someone from writting a 2048 bit key? Is it because computers can't handle it? Is 1024 top of the prime number size right now? Am I way off track?

1 0

RE: [STATS] Cypherpunks subscriptions on and off
by Juriaan Massenza 17 Dec '03

17 Dec '03

Hi Dale, I am usually lurking cypherpunks, I decided to reply to your message just to give you an idea of why _I_ subscribed to cypherpunks. (English is not my first language, not even the second, please forgive me my grammar monstruosities) I am very intested in crypto, _application_ of crypto, remailers and security, I usually trash flames, political/social implication of crypto and of course commercial emails. Looks like the last 3 categories are the main topic. I don't have problem in bandwith but I think that if I was forced to use a phone connection instead of a digital one like I have now I will unsubscribe to the list since it will not be worth for me to spend hours in downloading a lot of emails knowing that I will trash the 90% of them. I don't want to criticize people who talk all the time about the above mentioned 3 categories because it is in my understanding that someone is interested in those and I will remain subscribed to the list just to pick up the real juice. Best wishes to all, Juriaan >-----Original Message----- >From: Dale Thorn [SMTP:dthorn@gte.net] >Sent: Wednesday, January 08, 1997 4:06 AM >To: cypherpunks(a)toad.com >Cc: freedom-knights(a)jetcafe.org >Subject: [STATS] Cypherpunks subscriptions on and off > >The following table shows cypherpunks subscription activity >for the period 12 Oct 1996 thru 07 January 1996. > >Date ~Days #Subs Gain Loss Gain / day Loss / day >----- ----- ----- ---- ---- ---------- ---------- >10/12 n/a 1361 n/a n/a n/a n/a >11/04 23 1353 211 219 9.2 9.5 >11/30 26 1299 173 227 6.7 8.7 >12/18 18 1262 120 157 6.7 8.7 >01/07 20 1291 151 122 7.6 6.1 > ----- ----- ---- ---- ---------- ---------- >Totals: 87 655 725 7.5 8.3 > >Interpretation: > >Unless the reversal of gain/loss in the 5th data row is permanent, >c-punks are losing 0.8 bodies per day, or 294 subscribers per year. > >Actually, the constant high turnover suggests something else: >Many people join the list and get back off again due to the high >volume and their own personal time constraints. Unless Sandy can >cut *way* back on the number of posts to the list, i.e. excise a *lot* >more postings than just the blatant Spam and "Timmy is a....." posts, >it won't make any difference to those people who come and go. > >In effect, Sandy is going to have to cut the number of daily posts >(to the moderated list) from, say, 100 per day down to, say, 20 or >25 per day. This would certainly be a goal of his, since most of the >subscriber comments I've heard indicate that even 50 posts per day of >"relevant political/social commentary" is way too high for them. > >As to the net loss in subscribers, the moderation of the list could >have a substantial effect on the number of subscribers short-term, >but whatever trend we have here will continue regardless, since the >real value and character of the list is not determined by the posts >which are removed (unless it were that some of the character and value >is going to be removed), but by long-term factors which are to be >expected when the principals get older, less involved, and less >contentious (like Sandy, wanting to avoid conflict). > >

2 1

[ADMINISTRATIVIUM] Forgery detection
by nobody＠zifi.genetics.utah.edu 17 Dec '03

17 Dec '03

Tim Maya grew a beard to look like his mother. /\_/\ ( x x ) -oo0-(o o)-0oo- Tim Maya

1 0

IBM Key Recovery Propaganda on United Airlines
by Bill Stewart 17 Dec '03

17 Dec '03

The commercials between the movie and news show on the airline include an IBM spot on their new Key Recovery software. Sigh. The explanations they gave were mixed; one person was talking about making sure that if you lose the key that people with a legitimate need to access the material can do it. The other example they gave, with pictures, was along the lines of "Suppose you're going on vacation and you want to leave a key with a neighbor to feed the dog. A safe way to do it would be to put your house key in a lockbox that needs several keys to open it, and give those keys to people you trust." Yeah, right - cops can get in, but Dog's gonna get pretty hungry.... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

5 5

Re: The Upcoming DES Challenge
by Ulrich Kuehn 17 Dec '03

17 Dec '03

Liz Taylor writes: > There is nothing unglamorous about a known plaintext attack, if the > plaintext is choosen carefully. I don't know anything about bank ATMs > and the protocols they use, but I presume the PIN is stored on the card > single DES encrypted. If this is so, anyone can take an ATM card, attack it > to recover the key and then use that key to recover the PIN for any stolen > ATM card of that bank (or that branch). Hopefully, the ciphertext/plaintext > pair that RSA announces will be a real target like this, with the actual key > disabled. Once the key is recovered, the press can then claim that ATM > cards are not safe any longer. > As far as I know, here in Germany (maybe also somewhere else) there is not the pin stored on the card. Instead, it is regenerated by the ATM every time using a secret key of the bank. In order to be able to use the ATM card even with ATMs of different banks, there are offsets stored on the card that relate to some commonly used pool keys. Ciao, Ulrich -- Ulrich Kuehn ------ kuehn(a)math.uni-muenster.de http://wwwmath.uni-muenster.de/~kuehn/

2 1

sig. files with PGP
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi there, I have a question reg. PGP: If certain parts of an encrypted message are known, does that compromise the security of the rest of the message? Example: If I always use a signature file, in plaintext messages as well as in encrypted messages, could an attacker knowing that signature file to be part of my encrypted message crack the rest too? Please copy replies to my private e-mail, for I am currently not subscribed to the CP list... Thanks in advance for your help, Harka /*************************************************************/ /* This user supports FREE SPEECH ONLINE * */ /* and PRIVATE ONLINE COMMUNICATIONS! * * */ /* * * */ /* E-mail: harka(a)nycmetro.com * * */ /* * */ /* Finger or E-Mail for PGP public key. * * */ /* Key Size: 2047 / KeyID: 04174301 * * */ /* Fingerprint: FD E4 F8 6D C1 6A 44 F5 http://www.eff.org */ /* 28 9C 40 6E B8 94 78 E8 */ /* Note: My old key (KeyID: B2728495) has been revoked. */ /*<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>*/ /* May there be peace in this world, may all anger dissolve */ /* and may all living beings find the way to happiness... */ /*************************************************************/ ___ Blue Wave/386 v2.30 [NR] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAgUBMtN8SjltEBIEF0MBAQEEoQf/TVZO2Z9gr8Jik0SnbfE7VbrORETlD7q3 nqIsU5FY6iCJKmXy9Us/VW6LOyuRr0qAMbM8IAdMaX96P1FFFGoZ+6QAH1txV+xs i6+w6TKtHmLZDyMaa40hH5F3/sUUECT5MyW59McO2+seX3gYDwi+jLp6XVZq8BFs uLymgoDmh+NsDXBcOUs9ULCQy8rsu/nYmbwQxlWqhUnPw1o1nnuUGuBZaEfU6xJj gthebIpjCPh9YAthdI/XxE4bmYmS1AVhL4Fz6cwR9yMQ4JC3eEoZnhIUvFd16w6i eOo1Og9sD241ksJTjH7lT0qaRAQFh0ccEQoFoCP/7dAesVjwXKjRhg== =3u9n -----END PGP SIGNATURE----- If encryption is outlawed, only outlaws will have encryption...

1 0

Keyserver Draft
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Wed Jan 08 08:39:12 1997 Having gotten the subject in the spotlight (!), I'd like to clarify a couple of points about my draft proposal: 1: it is aimed at supporting _automatic_ realtime - as in supporting crypto-aware email packages, so that if an unknown key turns up, the encryption program can go out and collect key data _without_ user intervention. 2: port "assignment" was arbitrary; if the protocol would work better with a single port for send/receive, then "make it so, Number One" :-) 3: I expected that data transfer would work best using ascii text (like ascii-fied keys); if something else would work better, so be it. 4: if checksums or other error-detection/correction isn't necessary, then by all means, leave it/them out. I offered the draft as a _proposal_, fully expecting that it would require modification, editing, revision, et al. I'm not sufficiently pompous/egotistical to believe that I am He Who Knows All. Too, I have a reasonable idea of my own limitations; I'm simply trying to establish *some* kind of common reference point toward a solution of something I see as a possible problem. Happily, I haven't received any _personal_ flames, the comments I've received have been professional/technical. If I get a brownie point or atta-boy out of this, cool. If not, that's fine, too, _as long as the problem is addressed_. I didn't dare propose anything so grand as a distributed system - it seemed that a variation of DNS would handle that. We return you now to FlameFest '97 :-) Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMtMI1sVrTvyYOzAZAQH5fgP+M5kJntTNM+LWd67jt+WGoiGLq8SdRwCa 0MljMYuO0oMzgiTrMTchNaj+cxtVkyUrzz+cgj3XQdJF6cdRlDnSW9xGV9rJJC/B lPf6RD9Vp5Pih9KkqWc+DqKMynGzEm1WXvNZKHDtn3/1etkv0RsEeQejqdNG+5dI rfZhi4xp9mk= =1Pcn -----END PGP SIGNATURE-----

2 1

Re: Moderation
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Ray Arachelian <sunder(a)brainlink.com> writes: > Oh, of course, since you spammed the list with so much vitriol and flames, ^^^^^^^^^^^^^^^^^^^^^^^^^^^ You mispeled "since you challenged John Gilmore to remove you from the list".

1 0