December 2003 - cypherpunks-legacy

Re: [ANNOUNCEMENT] Elliptic curves
by Anonymous 17 Dec '03

17 Dec '03

Tim May's wee-wee is so tiny that only his mommy is allowed to touch it. /\ /..\ Tim May /_\/_\

1 0

Full strength Email Clients.
by Steven Herod 17 Dec '03

17 Dec '03

Hello, I'm in search of an *EASY TO USE* Internet Email client software that uses full strength (outside US export restriction) RSA encryption. It would be used for end to end encryption of Patient Pathology results, hence the need for "full strength". Any pointers to sites of interest? Best Regards Steven Herod Computer Systems Officer Med-E-Serv Connect, a division of CITEC

1 0

Re: FCPUNX:ecure Phones
by Lucky Green 17 Dec '03

17 Dec '03

At 09:41 PM 2/3/97 -0700, C. Kuethe wrote: >As we were both saying (meaning to say) there's a lot of holes in there... and >you're rich if you'd trust $1e4 to this box.... I'd put maybe $100 on it. Not >that I have a problem with wealth. My point there is that I don't think this >device is secure enough to be placing a lot of trust in... For 1E3, you can get the CS8191 from Communication Security Corporation. http://www.comsec.com/ It uses 3DES. No silly "voice inversion". Sigh. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

1 0

Re: Embarrass a Marylander, Go to Jail
by tmcghan＠mail.bcpl.lib.md.us 17 Dec '03

17 Dec '03

in a message allegedly from: Robert Hettinga <rah(a)shipwright.com> this appeared... > A Maryland bill that would make it illegal to send "annoying" or > "embarrassing" e-mail was introduced this week by Democratic General > Assembly member Samuel Rosenberg. {snip} > "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle As a marylander, in particular, a baltimoron, I am both embarrassed and annoyed that these legislative bozos have the unmitigated gall to expend time and energy on pursuits such as these. Perhaps they feel that our state attorney general needs to earn his excessive salary by attempting to defend this constitutionally indefensible mental excrement. Did the defeat of CDA not resonate?

1 0

Re: More Hacking of the Mykotronx Site!
by John Young 17 Dec '03

17 Dec '03

While this report may be true, I wonder if it's not a spoof or even official disinformation to mislead about the details of Aaron's mission as well as what Rainbow and others are really peddling to rabble-fearing paranoids. This last sentence seems a bit too melodramatic even for a suck-up crippled-chip manufacturer: >The MYK-82, developed by Mykotronx and fabricated by VLSI Technology, >Inc., is the first of a series of security products to be developed as >part of an alliance with the NSA, targeting both Government and >commercial citizen monitoring markets. Granted that defense to LEA-market conversionists like to pornograph the godawful carnage their technology can wreak on disobedient civilians to arouse ex-military-to-LEA converted glands -- do they actually write SOF drool like this?

1 0

No Subject
by owner-cypherpunks 17 Dec '03

17 Dec '03

1 0

Re: Secure Phones
by Peter Gutmann 17 Dec '03

17 Dec '03

>My guess on the CESCOMM device is that they (would like us to belive that >they) use pure RSA with optional hybrid links... this seems a bit obvious >because of: > >"Guessing the unique Keys is out of the question. Acquiring the keys through >wiretapping is impossible, since they are never transmitted." <--RSA? This thing is snake oil. What it does is move the data through an FIR filter with the taps being controlled by a secret key. The data itself isn't encrypted, but is spread out over a wide spectrum in a (they hope) difficult-to-analyse manner. However with only 1K possible taps and (presumably) something as high-security as an LFSR driving it, I think the strength of the system has been overestimated somewhat. It wasn't designed for security at all, it was designed by an ex-Canterbury uni engineer to provide add-on noise-immunity to fax machines, and they only decided to market it as an encryption device later on - the designer apparently knows very little about encryption. I've got a photo of it, it's in a box the size of a small modem and consists of a circuit board with an ASIC on it and a bit of interface circuitry. The company has a patent on it, but a search for the patent has so far been unsuccessful (mind you I didn't search very hard). If anyone wants to check it themselves, the patent will probably be assigned to Ken Stokes of Cardinal Encryption Services - they claim to have worldwide coverage. >I emailed the German team about the LC-1... don't know if I'll hear back from >them, but if I do, I'll pass on everything I get. This is rather cool, it was designed by a couple of students at the University of Saarbruecken. It uses the Lintel RSA chips which are fast enough to do real-time RSA voice encryption, either singly for 512 bits or chained for 1033 bits. I've got a brochure somewhere which shows one of the inventors using it, it's a small motherboard containing the RSA chip, some other unidentifiable circuitry (presumably a modem chipset), an EPROM, etc etc. It was done as a research project by students who are unlikely to have put backdoors in it. The BSI (German NSA) were not at all happy about it. It's a pretty neat product, but unfortunately due to its origins it's having difficulty getting any market penetration. In addition the Lintel chips are f-ing expensive and there are many other components that go in on top of that, I doubt the whole thing sells for less than DM 1000-1500. Peter.

1 0

Re: PCS Encryption?
by Phil Karn 17 Dec '03

17 Dec '03

>Phil Karn is, of course, the expert on this -- I hope he'll chime in soon >-- Phil, you out there?? Yup, I'm out here. Just buried under a pile of email. >Working from my not-so-great memory, CDMA uses a fixed spreading code that >is determined by a pretty simple "cipher-like" process. I believe the >details are covered by an NDA, sorry. At any rate, it isn't "encryption" >by any means -- and tapping it requires little more than building a new >base station (again, given $ and the fact that you're going to have to >follow the bloody thing around as it moves). No, it's not covered by NDA. It is, however, all heavily covered by Qualcomm patents. It's all specified in complete detail in TIA IS-95A. The actual spec is copyrighted TIA (even though we did almost all the work) but you can find an early version, plus a much more readable overview paper, through my web page. The air interface is essentially the same as you'll find on the air. <http://www.qualcomm.com/people/pkarn/cdma.html> There is essentially no "encryption" in the usual sense of the word in CDMA. It is true that the complexity (and until recently, the obscurity) of the modulation method provides some modest protection against casual eavesdropping (e.g., someone with a Radio Shack scanner). But phones containing the necessary ASICs are now being shipped by the hundreds of thousands per month, and as I said earlier the complete air interface spec has been public for some time. I do note that the forward (base to mobile) and reverse (mobile to base) modulation methods are totally different, because the jobs they have to do are different. Only the reverse link is truly CDMA, as there you have many transmitters sending to a single receiver. Both links are spread to 1.25 MHz bandwidths, but that's about where the similarities end. The phone ASIC contains only a forward link demodulator function and a reverse link modulator function. The base station ASICs are not yet generally available. Also, an echo canceller in the base station effectively blocks any reverse link audio from coming back out on the forward link. Consider also the very low and tightly controlled transmitter powers typically used on the reverse link. One can now make certain conclusions about the relative ease of intercepting the forward link as compared to the reverse link. The closest thing to "encryption" in CDMA is the "private long key" mechanism. The private long key is the starting state of a 42-stage linear feedback shift register (LFSR) that is used to spread (reverse link) or scramble (forward link) the vocoder data. (The IS-95 signal path is too complex to describe fully here -- see the documents on my web page for the details, including the difference between scrambling and spreading). As anyone with even a rudimentary knowledge of cryptanalysis knows, LFSRs are not at all cryptographically secure. The Massey-Berlekamp algorithm can easily determine the state of the long code shift register with a short (42-chip) sample of its output. Furthermore, the long key sequence has other specified uses on the reverse link; in particular it is used as a pseudorandom sequence generator to control the puncturing (on-off transmitter gating pattern) when the phone is transmitting at a low data rate between talk spurts. This obviously suggests other ways to determine the LFSR state without demodulating individual CDMA chips. Nevertheless, NSA has repeatedly objected to the export of the "private long code" feature, and I'm not even sure it's implemented on the domestic models currently being deployed. Phil

1 0

Re: Trigger-Words...Trigger-Fingers
by Larry Johnson 17 Dec '03

17 Dec '03

Dale Thorn wrote: > > Larry Johnson wrote: > > Cynthia H. Brown wrote: > [snippo] > > Theres not many girls on this list, is there? > [mo' snippo] > > Anyway, my uncle prints out the girl-cypherpunks stuff for the girls > > on my list and they think its real cool and they all want to marry > > technicians so that they can make them work on the computers for them, > > kind of like making them do the computer dishes, you know. > [yet mo' snippo] > > I want to get married. Lots of times. Are the girls cute? > I don't do hardware, tho, I'm a software guy. Yeah their real cute, most of them anyway. Their all nice though. Some of them would like you cause they dont like regular guys, cause their troublemakers too. I know your a troublemaker (I think thats a good thing) because Ive read your stuff and myu uncle keeps you in his NotADork/MyAssholes dir. Thats where he keeps the troublemakers but its not an insult because he likes what Kevin (hes a Bodston Celtic said--"Danny Ange is an asshole, but hes _our_ asshole." He taght me how to read by using the Froggie manual since I could boot it myself when he was out of the rooom when I was two year old. Now he teachs me how to read with the cypherpunk messages and stuff from his govbernment friends. (Their good government guys though, they like you guys. Their really secret guys not lamer regualar secret guys. They laugh at those regular secret guys who screw with you guys cause they leave their pecker tracks all over the place.) Some people thik Im a lamer cause Im not good with grammer (not on the kids lists thogh) bu tmy uncle says Ill learn how to do that but Im better to learn how tho think first. Ive got dsylexia too so I use a spell checkerif I want to look smart but emailers dont have it. You guyhs should keep being troublemakers. Really. My uncle says that if you guys get too polite then you better watcvh your backs when you curtsy, cause you never know whos sneaking up behind you. He told me that if I watch you rmodernation that I wont have to have sex educaton laterer cause I'll already know how to get f*)&%ed. (Hes funny. His governmnt friends call him the fool becaise hes dumb like a fox.) Excuse my spelling but I spell things good once I see them in a dir cause myu uncle make s me look stuff up before I put it in a dir or he erases myu dir to make me learn. I think the girls would like you cause yuou are a computer guy. Ill show them your letter. Theeir smart, too. They dont like lamer guys. When their school computer guy messes up ecveyones stuff then they fix it but they dont tell him cause it makes him mad. Im not real good at 4reading code and stuff but the secret computer guys let me drink Scotch with them evcen in the bar at the Holiday In in Santafe cause Im smarter than them abou t som e stuff even if they are really good. (I go tm y uncles password on his secret machine by putting my video camera on the frige with a dead battery and pluging it into his power supply) (Now when he boots up he will getr Duke Nukem3D and when he leacves it he will get a message telling him hes a _lamer_.) He had to go to Lost Alamo again because of you guys and hell gibve me sh*&)( when he gets back but not too much cause he said I could do anything I want on his secret machine if I got on it. Im getting to play with Unix cause he has a Spark Card on it that has Unix on it. (Dos is for lamers but Bill Gates owns ecerything so its cheaper for kids) Some lamer said on cypherpunks today that it takes him an hour to get the pecker messages off his computer. My uncle has me to do it for him sometimes and it only take me like maybve two minutes. If the guy is such a lmaer that it take s hinm an hour then maybe he should just read only the pecker messages cause they have pictures and then when he mobes his lips to read then he coul d put them on the peckers. (Thats a joke) I like that Tim May is bacvk, if only even for a little while. When you guys fight at least you say stuff that isnt kissing ass for other guys money. Im going to make a message to cypherpunsk that says if anyone wants me to be their moderator then they should not write any messages to the cypherpunks. Then the 2000 people who dont post will be voting for me to be their moderator and I will be their boss. If Im the moderator then I will givbe everyone free pizz a and lots and lots of Scotch. (<--Dewars) I hope you guys stay together. My uncle says sometimes you learn by looking and sometimes you leran by seeing whos looking back. But he tells the secret gobvernmetn guys not to look back cause their might be a cypherpunk gaining on them. (Thats a joke) Ive got to go to bed so I can pretned to get up again. Im sick so I can do what I want bu t Im not supposed to stya up all night either. I wont let the door hit me in the ass on my wayout. Bye, Human Gus-Peter p.s. - dont write me after Thursday cause my dad will be back and Ill get in trouble. My uncle will help me clean u p my mess cause hes not a squealer.

1 0

Moderation, Tim, Sandy, me, etc. * Strong crypto == DES?!
by John Gilmore 17 Dec '03

17 Dec '03

I'm glad we're talking about some of the real issues here. Tim May said: > I don't want Sandy Sandfort sitting in judgment on my > posts, deciding what the Cypherpunks--a group I co-founded for God's > sake!!!!--are to be allowed to read and what they may not. Tim, the Cypherpunks have chosen to follow Sandy's lead for this month. I'll admit I made it easy for them, but the results are conclusive. There are 1311 addresses in the cypherpunks list today; 42 in the unedited list; and 19 in the flames list. Forty people cared enough to read every posting; the other thousand either wanted to try the experiment -- or didn't care enough to send an email message. Which, as we all know, is a very low threshold. If I was a social scientist I might want to run the experiment both ways, or six different ways. Name it this, or name it that. I'm not; all I want is something that works. The cypherpunks list was unusable for this kind of discussion, only a month ago. It's usable now. I'm definitely bugged by the community's attitude toward my "censorship". Rather than being glad that someone, anyone, was doing something about the major problem on the list, 99% of the reaction was to create even more ill-considered, emotional flamage. *I* didn't make the signal/noise get worse at that point -- *you-all* did. Perhaps at that point I should have shut down the list, as Lucky is now suggesting. "Asking the list what to do" was clearly not a useful option. Sandy cared enough about the community to make some concrete suggestions to me about how to get the list back on track. They involved a lot more work than the previous setup. I told him if he was willing to do the work, we could try it. As Dale suggests, I wasn't about to waste my time reading the whole list in real time and passing judgement on the postings. Sandy was, for a month. The element I find most lacking from the whole discussion, until recently, has been responsibility. In an anarchy, *everyone* is responsible; nothing is "somebody else's job". Sandy felt responsible, so he proposed something. I felt responsible, so I helped. But a large part of the community sat on the sidelines and criticized, without making attempts to make things better; indeed the volume and tone of the criticisms themselves made things worse. Unpaid labor for a peanut gallery of spoiled children isn't very gratifying. You-all remind me of a passage from Booker T. Washington's book _Up From Slavery_, describing what happened on the night that news of the Emancipation Proclamation reached the South: The wild rejoicing on the part of the emancipated coloured people lasted but for a brief period, for I noticed that by the time they returned to their cabins there was a change in their feelings. The great responsibility of being free, of having charge of themselves, of having to think and plan for themselves and their children, seemed to take possesion of them. It was very much like suddenly turning a youth of ten or twelve years out into the world to provide for himself. In a few hours the great questions with which the Anglo-Saxon race had been grappling for centuries had been thrown upon these people to be solved. These were the questions of a home, a living, the rearing of children, education, citizenship, and the establishment and support of churches. Was it any wonder that within a few hours the wild rejoicing ceased and a feeling of deep gloom seemed to pervade the slave quarters? To some it seemed that, now that they were in actual possession of it, freedom was a more serious thing than they had expected to find it. Most of the people on the list haven't bothered to face that freedom. Your de-facto "leaders" have faced it for you. It is a more serious thing than than you expect. All it takes it hard work and judgement. Be responsible for setting your society's privacy policy -- without knowing whether you are right. Face the uncertainty and build anyway. Shall I post you an Emancipation Proclamation -- as if you needed one? Start a mailing list on another site! Move this list to somewhere! Create and nurture an alt group! Make an independent moderated list drawn from the unedited list! Hold meetings! Establish for it a home, a funding, the rearing of newbies, education, citizenship, and the establishment and support of philosophies. Dead simple for people as capable as us. Just takes work. Who's volunteering? Just do it! The experiment will be over in a few weeks. Who's going to take over deciding how to run the list, and running it? If you want to help organize what I'll call the `progressive crypto community', for lack of a better term, then please do. Otherwise, in the immortal words of Lazarus Long, "PIPE DOWN!". John PS: Can we talk about crypto too? It's clear from the last few days of press releases that the pro-GAK forces are again working to confuse novices into thinking that two very different things are the same thing. Last time it was "public key infrastructure" and "key recovery". This time it's "strong crypto" and "56-bit DES". What should we do about this? Educate the public?

5 4