December 2003 - cypherpunks-legacy

Re: 40-bit RC5 crack meaningless?
by Peter Trei 17 Dec '03

17 Dec '03

Subject: Re: 40-bit RC5 crack meaningless?? From: Peter Trei <ptrei(a)acm.org> > Subject: 40-bit RC5 crack meaningless?? Mr. Strassman allegedly sent the quoted letter to Winn Schwartaus' "infowar" mailing list, and it was then posted by persons unknown to the sci.crypt usenet group. Identity on the internet being the fluid thing it is, I apologize in advance if he never sent this letter, or if it has been modified before it reached me. The quoted letter attempts to minimize the importance of Ian Goldberg's recent bruteforce decryption of export-strength RC5 encryption. In my opinon, as described below, Mr. Strassman's arguments are without merit when applied to the situation the RSA challenges are intended to model - the security of encrypted Internet protocols. As such, I feel that his letter may lull some people into an unjustified and dangerous sense of security. > >Date: Thu, 30 Jan 1997 20:10:36 -0500 > >From: "Paul A. Strassmann" <paul(a)strassmann.com> > >Subject: Further to Goldberg's Cracking Accomplishments > >Gentlemen: > > > >As I suspected (see earlier private comment), the > >highly promoted RSA cracking contest offered > >a number of clues that ordinarly would not be > >volunteered by info-terrorists or info-criminals to > >IW Defense teams. > >These clues made the cracking significantly easier, > >because it made it possible to eliminate an enormous > >range of possible searches. What's the target, and who is doing the encrypting? These "clues" _are_ available to adversaries engaged in industrial and economic espionage; a important part of a covert infowar. It's certainly true that "info-terrorists or info-criminals" will not be so easy to tap, but the absence of these 'clues' is a red herring. They will be secure because they will use good encryption, which is not what US firms can export today. The challenges are realistic models of encrypted Internet protocols, for example IPSEC with ESP data encryption. As such, they accurately display the vulnerability of data on the Internet to espionage. > >The following was extracted verbatim from the > ><The RSA Data Security Secret-Key Challenge> > >posted on <http://www.rsa.com/rsalabs/97challenge/>: > > > >Clue #1: > > > > " ...all the RC5 contests posted as part of the RSA Secret-Key Challenge > >will use 12-round RC5 with a 32-bit word size. " > > > >Clue #2: > > > > " ...The first RC5 contest will consist of some unknown plaintext > >encrypted using a 40-bit key;." Clues #1 and #2 are absolutely reasonable - in an open standard, it is absolutely normal to know the cipher being used, it's mode, and the length of the key. See the SSL specification, or IPSEC's RFCs. > >Clue #3: (a giveway!) > > > > " ... For each contest, the unknown plaintext message is preceded by three > > known blocks of text that contain the 24-character phrase "The > > unknown message is: .....". To those who are unfamiliar with Internet protocols, this would appear to give the cryptanalyst an unrealistic head-start. This is not the case. Most Internet protocols have highly stereotyped packet headers; for example, _every_ normal return packet from a web server starts out with the string "HTTP/1.0" (servers using something other than version 1.0 are rare as hen's teeth at the moment). When you consider that such a packet may contain a firm's confidential earnings predictions or trade secrets (hopefully encrypted), the economic importance of such data is clear. Similar stereotyped headers exist for many other protocols, such as NNTP and SMTP. As such, a known-plaintext attack, as modeled by RSADSI's symmetric key challange, is quite realistic. Even if a full known plaintext for the first block is unavailable, a knowlegable cryptanalyst can usually make some very reasonable assumptions which will greatly speed his or her task. (I'm assuming DES here - which has a 64 bit block, but the argument extends easily to other block sizes). For example, if we know that the data contains only printable ASCII characters (true for the headers of most Internet protocols), then for a 64 bit block, there are 8 bits which we _know_ will be zero in the decrypted block. This lets us dispose of 255 out of every 256 incorrect trial decryptions immediately, and we will have to perform more extensive tests on less then 0.4% of candidate keys. Similar intelligent guesses can be made about the headers of other protocols, for example IPSEC-secured IPv6 packet headers in tunneling mode. Some people have noted that the challenges include the IV, or 'initialization vector' used in CBC (cipher-block-chaining) modes of encryption, and argue that this would not be available to an adversary. Once again, this assertion falls when examined in the light of actual usage. The purpose of an IV is to make dictionary and replay attacks more difficult. It is not intended to prevent brute force attacks, and so is _normally_ included in the clear in communications protocols (for example, see RFC 1827 for it's clear transmission in IPSEC). If it is not included, it is effectively part of the keying material, and thus adds it's bits to the strength of the key. As such, its value would have to be transmitted and protected as carefully as the rest of the key. > >In summary: The claim of exportable cryptography being totally > >insecure, because it can be cracked in 3.5 hours is not > >realistic. The three clues announced in the contest > >would not apply under infowar conditions. As I have shown above, Mr. Strassman's optimism is misplaced in the case of actual, fielded use of encryption on the Internet. It may apply to some classified systems, but they don't use exportable cryptography anyway. A covert inforwar against commercial and private targets is _quite_ plausible. > >What other clues may have been provided to Goldberg > >to support private agendas and gain shrill headlines > >is also a matter of speculation, but I rest my case. What exactly is he hinting at here? > >I certainly cannot assert that a 40 bit key cannot be decyphered. Of course he can't. 40 bits of RC4 encryption (as used in the exportable version of Netscape) was brute-forced not once, but three separate times in the fall of 1995, the fastest effort taking about 28 hours. Today it could be done much more quickly, as Ian demonstrated with RC5 (an algorithm of similar complexity). > >However, I do not think that the RSA unqualified claims > >offer full and appropriate disclosure. I disagree. The RSA challenges accurately model the use of encryption on the unclassified Internet. Ian's decryption of 40-bit RC5 is of considerable importance in demonstrating the insecurity of American citizens caused by Administration efforts to compromise exportable encryption. In my opinon, Mr. Strassman's assertions as to the strength of exportable encryption are too dangerous to be left unchallenged. > >Paul A. Strassmann > >55 Talmadge Hill Road, New Canaan, CT. 06840 > >Telephone: 203-966-5505; Fax: 203-966-5506 > >INTERNET: paul(a)strassmann.com > >WorldwideWeb: http://www.strassmann.com Peter Trei ptrei(a)acm.org Disclaimer: I am speaking as a knowlegable private citizen, not as a representative of my employer. This posting represents my opinon only.

1 0

faulty moderation software: duplicate messages
by Attila T. Hun 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Virtually all list postings to the cypherpunks main list are doubled; the first, which is a standard pass through with the message ID of the sender, the second with the message ID of toad.com. Obviously, the first is destined for the unedited list --which did _not_ receive the message. The second has been re-IDd, which I presume is your censorhip mark. I happen to subscribe to all three lists, even though main + flames == unedited is supposedly the intention, it is not. In order to divide the output stream from toad.com, sorting on "Sender: " is the only reasonable differentation (when toad's filters are working): Sender: owner-cypherpunks(a)toad.com Sender: owner-cypherpunks-flames(a)toad.com Sender: owner-cypherpunks-unedited(a)toad.com Sender: owner-coderpunks(a)toad.com in the case cited below, the only differentation between the destinations is that the censored message has a "Message-ID: " from toad.com, while the one intended for unedited has a "Message-ID: " not from toad.com. was either of these destinated from flames? --the main list with duplicated messages has contained any number of messages, including ones from the ASCII art series which should have gone to flames. so, why is the pass through message not being reliably re-headered at toad.com to mark "Sender: owner-cypherpunks-unedited(a)toad.com" --but if it is, why is unedited receiving a duplicate --obviously the duplicate should have gone to flames. BOTTOM LINE: your software is inadequate. my neighbors' kids write better filters than you have installed. +Received: from toad.com (toad.com [140.174.2.1]) + by primenet.com (8.8.5/8.8.5) with ESMTP id EAA05103 + for <attila(a)primenet.com>; Fri, 7 Feb 1997 04:24:48 -0700 (MST) +Received: (from majordom@localhost) by toad.com (8.7.5/8.7.3) id +DAA20391; Fri, 7 Feb 1997 03:21:24 -0800 (PST) Received: from +hermes.ex.ac.uk (hermes.ex.ac.uk [194.83.11.25]) by toad.com +(8.7.5/8.7.3) with SMTP id DAA20386; Fri, 7 Feb 1997 03:21:20 -0800 +(PST) Received: from aba(a)p28-dove-gui.tch.virgin.net [194.168.60.88] +by hermes via ESMTP (LAA22615); Fri, 7 Feb 1997 11:21:06 GMT Received: +(from aba@localhost) by server.test.net (8.6.12/8.6.12) id LAA00460; +Fri, 7 Feb 1997 11:15:30 GMT Date: Fri, 7 Feb 1997 11:15:30 GMT +Message-Id: <199702071115.LAA00460(a)server.test.net> +From: Adam Back <aba(a)dcs.ex.ac.uk> +To: mark(a)infolawalert.com +Cc: cypherpunks(a)toad.com, mclow(a)owl.csusm.edu +In-reply-to: <199702052256.OAA06322(a)toad.com> (message from Mark + Voorhees on Wed, 05 Feb 97 17:05:51 -0400) +Subject: Re: Deloitte-Touche? +Sender: owner-cypherpunks(a)toad.com +Precedence: bulk +X-UIDL: 5456a9a45ccaf4617ae176a63b26efb4 +Received: from toad.com (toad.com [140.174.2.1]) + by primenet.com (8.8.5/8.8.5) with ESMTP id JAA26045; + Fri, 7 Feb 1997 09:00:01 -0700 (MST) +Received: (from majordom@localhost) by toad.com (8.7.5/8.7.3) id +HAA24892; Fri, 7 Feb 1997 07:12:54 -0800 (PST) Message-Id: + <199702071512.HAA24892(a)toad.com> +Date: Fri, 7 Feb 1997 11:15:30 GMT +From: Adam Back <aba(a)dcs.ex.ac.uk> +To: mark(a)infolawalert.com +Cc: cypherpunks(a)toad.com, mclow(a)owl.csusm.edu +Subject: Re: Deloitte-Touche? +Sender: owner-cypherpunks(a)toad.com +Precedence: bulk +X-UIDL: 83079c59aea2b28dc5ded2dc73c5219a -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQCVAwUBMvtvF704kQrCC2kFAQEFAwP/RyyZswe9GznJt4TAEMPnhKcgA9pUsf+k mw+pDcjaJyUfKttoaVz0qRM2hIe33igoPtBDXWf5VD9r+Gz+gry6K+UK7rYCNNE9 MMdYHRV51hYuLKJAY4LNU6j5hoqf5q2Btt/m3F9SFQtD0ellsi4QH/vseJC1YNYh tq3TA+hny/U= =v3sl -----END PGP SIGNATURE-----

1 0

Metzger, Denninger square off
by Damaged Justice 17 Dec '03

17 Dec '03

[Forwarded from Wired news. Let's cut to the chase: Which side is in the right? Who can tell me, in plain and simple language, who is fighting for individual freedom and property rights, and who is not?] [LINK] Foes Vow to Take Domain Name Fight to FCC by Gene Koprowski 5:01 pm PST 6 Feb 97 - A proposal by the International Ad Hoc Committee (IAHC) to expand the number of Internet top-level domain names is stirring opposition among alternative domain name providers. Opponents call the plan "unenforceable," and are considering filing a protest with the Federal Communications Commission, indicating that the IAHC policy might violate the 1996 Telecommunication Act's open access provisions. "We didn't want to have to get my guns, rifles, and bombs out - but now we have to," Carl Denninger, president of Macro Computer Solutions, Chicago, a long-time opponent of IACH, tells Wired News. "If someone doesn't point a revolver at them, they will be able to do whatever they want to do." On Tuesday, the intergovernmental body issued a proposal to expand the number of generic top-level domains (GTLDs), adding seven new listings in addition to the existing ones, which include the familiar .com, .net, and .org. The new GTLDs would include .firm, for businesses; .store, for retail businesses; .web, for Web-related companies; .arts, for cultural organizations; .rec, for recreation and entertainment facilities; .info, for information services; and .nom, for individuals. Perry Metzger, a member of the IAHC board, said that the organization, whose members include the International Telecommunications Union and the World Intellectual Property Organization, will likely formally approval the proposal very quickly. "This is not a done deal. The paperwork needs to be signed. An association to handle this has to be set up," says Metzger. "But it will go forward very soon. I'm sure plenty of people will not be in favor of it. But the question is: What can they do to stop it?" The answer is plenty, says Denninger. He and others, like Eugene Kashpureff of Alternic, have long fought the IAHC's attempts to expand the number of GTLDs. They think the creation of these new categories may lead to trademark infringement and other intellectual property problems. They also think the new domain names will "fragment" the Internet, leaving some users unable to communicate with others, if a server does not recognize the name request. Denninger said he received a leaked copy of the IACH proposal earlier this week, and he and his colleagues are considering bringing their protests to the FCC. "We're given open access under the telecom law," says Denninger. "We might talk to the FCC or the Clinton administration about this." Barring that, Denninger will lobby Internet service providers around the country, asking them not to recognize the new GTLDs. "There is no reason to support it. We will do everything in our power to convince ISPs not to go along," he says. As part of that, he is launching a national public relations and lobbying campaign to alert the Internet community about the IACH proposal. [LINK] Copyright © 1993-97 Wired Ventures, Inc. and affiliated companies. All rights reserved.

1 0

censorship and headers/example of ascii art which passed filters
by Attila T. Hun 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- the "message" example which follows is obviously a message which should have been destinated for owner-cypherpunks-flame. there is absolutely no indication of the differentation and the header shows: Sender: owner-cypherpunks(a)toad.com when it should have shown: Sender: owner-cypherpunks-edited(a)toad.com let's put it this way, if cp is to be censored, might as well do the job correctly as this message was dumped into the main list. regardless, censoring what is supposed to be the free speech defenders of the online world is a poor example of our toleration for differing viewpoints, regardless of their alledged stupidity or off-topic value, or lack of value. So far, cypherpunks is showing less tolerance for freedom of speech that the United State Supreme Court. You all know something I dont? or do I need to start cleaning and oiling real soon? --attila +Received: from toad.com (toad.com [140.174.2.1]) + by primenet.com (8.8.5/8.8.5) with ESMTP id FAA10780 + for <attila(a)primenet.com>; Fri, 7 Feb 1997 05:23:55 -0700 (MST) +Received: (from majordom@localhost) by toad.com (8.7.5/8.7.3) id +EAA21727; Fri, 7 Feb 1997 04:19:54 -0800 (PST) Received: from +sirius.infonex.com (root(a)sirius.infonex.com [206.170.114.2]) by +toad.com (8.7.5/8.7.3) with ESMTP id EAA21718; Fri, 7 Feb 1997 +04:19:47 -0800 (PST) Received: from mail.infonex.net +(dfbfl4-37.gate.net [199.227.103.228]) by sirius.infonex.com +(8.7.3/8.7.3) with SMTP id EAA26850 for cypherpunks(a)toad.com; Fri, 7 +Feb 1997 04:19:33 -0800 (PST) Message-Id: +<199702071219.EAA26850(a)sirius.infonex.com> Date: Friday, 07 Feb 97 +07:19:25 EST +To: cypherpunks(a)toad.com +From: winsock(a)rigel.cyberpass.net (WinSock Remailer) +X-Mailer: WinSock Remailer Version ALPHA1.3 +X-Comments: - +X-Comments: This message is NOT from winsock(a)rigel.cyberpass.net. It +was X-Comments: remailed by an automated anonymous remailer. +X-Comments: - +X-Comments: SEND ALL COMPLAINTS AND BLOCKING REQUESTS DIRECTLY TO: +X-Comments: REOP-L(a)cornell.edu <Remailer Operator's Network> +X-Comments: - +X-Comments: WinSock Remailer (winsock(a)rigel.cyberpass.net) +X-Comments: http://www.cyberpass.net/~winsock/ X-Comments: - +X-Remailer-Setup: Maximum Message Size -- None +X-Remailer-Setup: Reordering is ON, Mail Poolsize is 3 +X-Remailer-Setup: News Posting DISABLED +X-Remailer-Setup: Subject Header KILLED +X-Remailer-Setup: Logging OFF +X-Remailer-Setup: All messages must be PGP encrypted +Subject: Re: Sphere packings +Sender: owner-cypherpunks(a)toad.com +Precedence: bulk +X-UIDL: e2bae6a70f8b97f156939d711ba124ba +Dickhead Vermin K[ondom]OTM has been a source of endless +embarassments to his sympathizers on and off the net. + _ O O _ + \-|-\_/-|-/ Dickhead Vermin K[ondom]OTM + /^\ /^\ + ^^ ^^ ^^ ^^ -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQCVAwUBMvtzDL04kQrCC2kFAQF8UwQAi2uqgh2IX8zy9BgXmuBK5hI0yza9XeJ1 +o/aa6KXnKA5+aBuFF5VFufijsJgMQ+2TI+OVi1oPy9OpWofZ1mHzzzNDndypfv6 Bnb05Yrz3ikJXitr7zs26+f8ImeC++5hrkNanPUVBuwa09l2NMYjvGRf+980XLIA 3TIkjAlpcrk= =1Izr -----END PGP SIGNATURE-----

1 0

Project 25 Radio
by John Young 17 Dec '03

17 Dec '03

The National Communications Systems published in the Federal Register of February 6, a notice of FTR1024 covering Land Mobile Radio, Project 25. The recommentation specifies encryption: DES (Type 3) and Type 1 for classified use. The specifications are based on seven public TIA documents and one classified NSA document. "This recommendation is intended to facilitate interoperability among telecommunication facilities and systems of the Federal Government." The official document is available in PDF format at: http://members.aol.com/Project25/1024.pdf We've prepared a hypertext version: http://jya.com/ftr1024.htm

1 0

No Subject
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Date: Fri, 07 Feb 1997 07:13:18 -0800 From: Dale Thorn <dthorn(a)gte.net> :When I was in the Perot camp Gotta be Dale! A measure of my health; I admit preferring the invective of Tim and Dr. V. to this purile nonsense. Pablum for the c'punk masses. Ciao

1 0

[IMPORTANT] Zero-knowledge interactive proofs
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Many forgeries are traceable with mathematical certainty to feebleminded Timmy C. May's poison keyboard. .oooO Oooo. ( ) _ _ ( ) \ ( / ) ( \ ) / ----\_)-/ (---) \-(_/---- ( ) ( ) oooO Oooo

1 0

Re: My messages not appearing on either of the lists?
by Mike Duvos 17 Dec '03

17 Dec '03

Tim May writes: > My posting seem to be going into Limbo, being sent neither to the > Cypherpunks Heaven Sandy administers nor to the flames of the Cypherpunks > Hell. At least this is how things now appear. > I sent the message below to the list this morning (Thursday) at 8:43 a.m. > PST. As of tonight, 12 hours later, I haven't seen it on either the > Singapore Web site--last archived 30 minutes ago--or on the "Flames" list > to which I have temporarily subscribed (to see what Sandy counts as a > "flame"). Now that a few weeks have passed, I have decided that moderation delays are the most annoying feature of the new experiment. I am subscribed to the unedited list under another account, and its almost instantaneous traffic is in great contrast to the time required for posts to trickle through the Sandfort-Bot. > By the way, I noted that many of the messages which appeared at the > Singapore Web archive site have dates much later than mine, including > several dated at least 8-10 hours after my message. Likewise, some of the > Flames messages are dated much later than my message. Messages apparently do not get moderated in the order in which they are received. Some messages take a very long time, as other later messages pass them by and are posted to the list. Again, I have no explanation for this unusual behavior. -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

1 0

Cool Names, Lost in Flames
by Otto Matic 17 Dec '03

17 Dec '03

Some time ago Human Gus-Peter wrote something that went like this: > I still think that you should just let your kids run your machine or > just pick the guy with the coolest name, like Attila the Hun or > Genocide or OttOmatic. Thanks, Human Gus-peter. I think my name is cool also. I am only suscribeed to the flames list, because my uncle (a secret guy) reads the CENSORED list. This way we can see what the other secret guys are up to, and what kind of KewL StUfF they throw into the Flames Trashcan. Human Gus-peter, I think you should be very careful. They throw everything you write into the trash. That could mean they are watching you. That could be VERY bad for you. We will see where this message goes. otto =-=-=-=-=- Otto Matic "Fuckin' A, Miller!" Bud, Repo Man --------------------------------------------------------- Get Your *Web-Based* Free Email at http://www.hotmail.com ---------------------------------------------------------

1 0

Re: 40-bit RC5 crack meaningless??
by John Young 17 Dec '03

17 Dec '03

Paul Strassmann served on the "Information Warefare - Defense" Task Force sponsored by the Defense Science Board. He has a Web site at: http://www.strassmann.com The IW-D report recounts most of the well-known info-war memes to buttress its plea for more info-warfighting funds, and says that business needs DoD protection. It de-emphasizes the encryption debate, claiming that crypto is not an important part of the problem or the solution. Remailers are not mentioned. Short and long versions of IW-D: http://jya.com/iwd.htm Winn Schwartau's infowar.com offers it too. SAIC was generously represented on the Task Force: Strassmann, Bellcore's head, a couple more. As well as others committed to "raising the bar" against attack on Info-Maginot: http://jya.com/iwdaff.htm

1 0