December 2003 - cypherpunks-legacy

Re: [CRYPTO] PRNG
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Timmy May, a product of anal birth, appeared with a coathanger through his head. o o o o o /~> <><><> <> Timmy May o...(\ |||||| ||

2 1

Re: Market Failures, Monocultures, and Dead Kids (Oh My!)
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Toto <toto(a)sk.sympatico.ca> writes: > Dale Thorn wrote: > > > > Really? Define _common_. I have lived in the Mid West for about 85% of > > > my life, and I know no one who learned these things from their parents. > > > > C'mon guys. Parents diddling with their kids is more than common - > > probably 1/3 of all fathers do something sexual with one or more > > of their children at some point. People just suppress it. > > I can't believe it could be that common without the government > finding a way to 'tax' it. Def: relative humidity - the sweat on snow's balls as he fucks his sister. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: WebWorld 3-4
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

William Ono wrote: > > Toto, you're being careless again. Moi?

1 0

key revocation
by Robert Hettinga 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm revoking my old key, and creating a new, bigger one. Yes, there's a story behind it, and it's a dumb one, and I'll tell it later. Cheers, Bob Hettinga - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCPAy/xh8wAAAEEALAk362NR2Q9eLzwdm/GmMInQj9Z+Mc/t0bng3VTcgZYW+Kg da3Vwiomksh16Jo5r/zva32W826HZqYE4wW/cwznq2k87kMwuNdIGOhbcVlpg0cU 2d6zE+C0myq2uOc2Xddo3zdwdUSgafZVNwqJjCeS88SMeHmtMvgyLN8bw6ZVABEB AAGJAJUDBSAzMI6U+DIs3xvDplUBAYAGA/9eUNjgLgcCmeLxn1pUCzAACPe17bdy Smn83xfZGHCubj0Ylp2hAx3kEy4N98s2TOvPipvga44ckTtyRbG4+ptEhGQ0/pjG TJ8KghRJ3iSmjreSwKiLyBOQ4cj9l0JD9zSXX0+sWCDaZwXat21KlYXJllfSqppd jknFP+NxQ+u7ALQnUm9iZXJ0IEEuIEhldHRpbmdhIDxyYWhAc2hpcHdyaWdodC5j b20+iQCVAgUQMqWfksKmlvJNktGxAQGUgAQAhzF8RRRIwMLLdEwa9MdMrUoW5d/o S2qdA1gxgDLp+fIToYe60z0l6hYPCMWMCb64eZadgjBS6TzvyYBX762TZvuH5BOg FvIovQe0DGscDe9XAGj07I1ynzjBGr8Rq4qe+ZQsnCUE0lHLt25LLj56RUbnBAlW TP78ZOySqCAgBYCJAJUDBRAv+o4Q+DIs3xvDplUBAbtyBACNRQuctSPBgWgX47BT xeOlyzEa6pt0/jB9ZKehe64p0H+raxvgXXc48z0Vg2ePk9g46y48sOIPiFiKj4lR 9zMzujpHQ0YjBmDmCTJvM/LmBAcKiFbSq9GZv5WhzIeoqAaWBbIDcJcl4btEqoxx zzXOCBSYY21cKqWK3II9pmhFQokAogMFEDJIKy96rtRInhTs1QEBc4sEYgLC1HVj J6kcKVZ5L2cttdH+gW8cZaJLKTN6r+O/ec7abE8+BgYNAMyYaf13Ie5W5ilFm3b4 HdCQ1F5fS4UJac6QolOoMYM5QWyd075MFuHdokkMT6a88w0X3I+XxKh8K65YcYmx 24hpbbbWeQVKA3ec2y7R1f4W88ny+sLD3byV5vywgpzw8SzjSYbvCQ== =EPeQ - -----END PGP PUBLIC KEY BLOCK----- - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQEPAzMwdgMAAAEIALXtk50b0KQWz0RiTBOa25SbWk8cCR6WtafoH3QHwbajqTMI ZwOmujLRGjwAvrdqZbW9RIUP7WAe3XnDiCN+vt7ufBk1YoRuZPb5T01X5pCcVNpw rd4DrMhgoSqLkcbn4+ShUxfPwnc8VemFanQicbcmnsK9CzFB/D2IxmOMVttecx9n Afd2C6h3kWZ4VJARL7g4vvqE+hWJs7z5g1jHJkCr/0KsVVaI/uhE4sha5Bt3Kaxr 0GOi+VS/UQDc+GTjSAgC/AZSQWWNkME3Tn8vQZcso0eRvPLxXrDMYL4gNRYlji8v 40PUaWOX3oW+svXhBJOP7u8SZG7BxQIbDGZZweEAEQEAAbQnUm9iZXJ0IEEuIEhl dHRpbmdhIDxyYWhAc2hpcHdyaWdodC5jb20+ =5U1v - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMzDj7cUCGwxmWcHhAQFa6Af7BXR73ty08djlqgWlC6Ul9kP3JCYd2kcZ QVDYwJBgj4xFdxEldxP1JeJuCI6cjWpRF8lV81roboJSPZ6IjTTRwuDyWNNXvLp6 hJgEOomnfRiBTxAM2/Ombbos2RtatRctDIVQVzvmYECwOXJcOkceJdXah0pozl4O NpVcBVtuQ2G7EaBwfdN7r9xqOeYl4FSEYDaD8LjYPlT3+nC0IujgS76nNHvBqOOt +oJQD0lPJfkl0PIUz9zAqioRof40W1a6JubLVIxZVoolK9DRYZlqpujPell6rk9x /QwU24cuLUmzxd+qGhYXOAE6fS8KPJezI2Ijlvd/5sDjd8/Zw/nIFA== =qhZ5 -----END PGP SIGNATURE----- ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/

1 0

WebWorld 5-6
by Bubba Rom Dos 17 Dec '03

17 Dec '03

1 0

PGP Security
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

I am passing along the following message, not because of my belief in the accuracy or veracity of its contents, but merely because of the fact that it seems to have kept getting eaten up by various email systems in the attempts to send it to its original destination. The first time it was sent via a remailer, it was bounced for ill- defined reasons. The second time it was sent, the remailer was shut down, and remains shut down. Efforts to send it through a second remailer also failed, with no notice from the server of any problems being received. Other email sent through the remailer at the same time encountered no difficulties. I am only noting the facts, here, not proferring any personal judge- ments on the matter, although I have formed my own opinion as to the meaning of these facts, particularly since I, myself, came by this post during the process of email interception. > X-Anon-Password: XXXXXXXXXX > X-Anon-To: XXXXXXXXXXX > X-Anon-Name: XXXXXXXXXXXX XXXXXXXXX, I thought I would reply privately to you, since you seem to at least have a willingness to allow the possibility of compromises to the security of the encryption methodologies behind PGP programs, among others. To begin with, I'm not sure whether you realize it, or not, but the Navy's spook tenacles run deeper, and extend further, than those of any of the more notable or visibly involved agencies who lurk in the background of security and privacy issues. One of the reasons for this is that their physical existence could be said to mirror the Internet in many respects. The very nature of their 'global' home (the sea), has always permitted them access to people and regions which are denied to others. Also, they are often in the position to be involved in what looks to be merely the 'transporting' of people and information. Whether providing escort services or getting drunk in foreign bars, the expertise of naval intelligence has always lain in the area of observation, first and foremost. By far the greatest tool of intelligence agencies on the Internet, has been traffic analysis. Their techniques are sufficiently sophist- icated that I would not be surprised to find out that they can tell more about us from our Internet activity than can be learned from the satellites capable of reading the newspaper over our shoulder as we sit in the park. Traffic analysis involves all measurable quantum of information, the chief concerns being the patterns and timing of data transfer, from which everything ranging from content and motivation can be deduced. If you wish to think in terms of back-doors, then you would be well advised to go beyond the concepts of 'passwords' and 'holes' and try to think in terms of patterns and timing, and other such 'structures' which are peripheral to concerns regarding 'code' and 'mathematics.' i.e. As well as considering the 'content' of what a program returned, you must also consider 'when' the program returned the result, and the patterns in the timing, as well as the content. An analogy could be made to a person who, being interrogated, answers all questions with a predictable rhythm and then 'pauses,' however slightly, in answering a certain question. You can see that what is revealed by the 'content' of the answer can be greatly insignificant compared to what is revealed by the 'delay' in answering. To expand your concept of 'back-doors' and 'holes,' you have to ask questions such as: "Does it take a program or hardware longer to return a result of '0', than to return a result of '1'?" "What factors can be introduced into the hardware and/or software that can influence the patterns and/or timing of various processes and the results they return?" "Can key searches be made more efficient by analyzing such things as rhythm, syntax, etc? What 'details' or 'qualities' of an individual, group, or 'arena of concern' can be analyzed for the purpose of being able to group them into structures which can be searched for?" "How can 'assigning' a value to certain sequences of numbers be used as a pattern to 'filter' the input data into a form which is easier to analyze?" You are aware of 'tricks and techniques' that apply to mathematics and are widely known. i.e. The process of shifting and adding numbers when multiplying by the number '11'. However, what about those quantum of information which are of no consequence to those seeking for the 'final result' of that multi- plication? Can the peripheral effects of mathematic calculations be used to analyze what has taken place, to narrow the scope of inquiry? My nephew describes numbers as getting 'wider' as they get larger, and he does quick checks of his result through his 'feel' for how much 'wider' a number should be when he is done, even in complicated equations which he ill-understands. (He reminds me of Steven Wright, who claims that someone told him that his socks didn't match, and he replied, "Sure, they do. I go by thickness.") I am currently working on a project which involves merging chaos theory with traffic analysis and other processes to analyze the effects that algorithms display when processed through the filters of varying hardware and software structures and methodologies. The RSA algorithm and accompanying RSAREF subroutines were our first focus, for the very reason that there were certain factions behind the scenes of the Zimmerman/RSA agreement who seemed to have an inordinate amount of interest in the subroutines being chained to the algorithm (for reasons that have nothing to do with patent protection). Those whose expertise goes far beyond my own in this area look at the initial results of the analysis as confirming that their is a 'relationship' between the RSA algorithm and the RSAREF subroutines which will enable them to break the system down into workable units for fairly quick analysis. What is interesting is that the results from small probes into other encryption systems show the same potential for exploitation using varying analysis methodologies and processes. (One fairly well-known encryption routine is almost lame enough to reveal its secrets to anyone with a pencil and a stopwatch, as well as the file size and time it takes to encrypt.) While I would rather you didn't publicize the preceding information, as a general rule, I think that is something that should be shared with anyone who is seriously focusing their efforts on better methods of encryption and analysis of encryption methodologies. I am aware of two other groups who are working along the same lines, although with a narrower range of variables than ourselves, and I am certain that there must be more than a few other entities out there who are also pursuing this line of research. I would appreciate any comments you may have on the above, as well as any suggestions you may have. (Despite having a post-graduate degree in an area which required a thorough grounding in mathematics I may have to refer any highly technical suggestions to those in the group who dream in numbers, sunset to sunrise.)

6 7

Cell Phone Code Cracked
by John Young 17 Dec '03

17 Dec '03

For details of the crack see the cryptographers' press release at: http://www.counterpane.com/cmea.html The New York Times, March 20, 1997, pp. A1, D2. Code Set Up to Shield Privacy Of Cellular Calls Is Breached By John Markoff San Francisco, March 19 -- A team of well-known computer security experts will announce on Thursday that they have cracked a key part of the electronic code meant to protect the privacy of calls made with the new, digital generation of cellular telephones. The announcement, intended as a public warning, means that -- despite their greater potential for privacy protection -- the new cellular telephones, which transmit streams of digital information in code similar to computer data, may in practice be little more secure from eavesdropping than the analog cellular phones, which send voice as electronic patterns mimicking sound waves, that have been in use the last 15 years. It was such eavesdropping, for example, that caused trouble for Newt Gingrich when a Florida couple listened to his cellular phone conversation in December about the Congressional ethics inquiry. Now that digital wireless networks are coming into use around the nation, the breaking of the digital code by the team of two computer security consultants and a university researcher confirms fears about privacy that were raised five years ago when the communications industry agreed under Government pressure to adopt a watered-down privacy technology. Several telecommunications industry officials said the pressure came from the National Security Agency, which feared that stronger encryption technology might allow criminals or terrorists to conspire with impunity by cellular phones. But independent security experts now say that the code is easy enough to crack that anyone with sufficient technical skills could make and sell a monitoring device that would be as easy to use as a police scanner is. Such a device would enable a listener to scan hundreds of wireless channels to listen in randomly on any digital call within a radius ranging from 1,000 feet to a number of miles. Or, as with current cellular technology, if a specific person was the target of an eavesdropper, the device could be programmed to listen for any nearby digital call to that person's telephone number. Other possible transgressions would include using the device to automatically harvest all calling card or credit-card data transmitted with nearby digital wireless phones. And, because of a loophole in the Communications Act of 1934, making and selling such devices would not be illegal, though actually using one would technically be against the law. These monitoring devices are not yet available, but security experts said that a thriving gray market was certain to develop. And with technical details of the security system already circulating on the Internet instructions for cracking it will almost certainly make their way into the computer underground, where code breaking and eavesdropping are pursued for fun and profit. Technical details of the security system were supposed to be a closely guarded secret, known only to a tight circle of industry engineers. But the researchers performed their work based on technical documents that were leaked from within the communications industry and disseminated over the Internet late last year. "The industry design process is at fault," said David Wagner, a University of California at Berkeley researcher who was a member of the team that broke the code. "We can use this as a lesson, and save ourselves from more serious vulnerabilities in the future." Communications industry technical experts, made aware of the security flaw earlier this year, have been meeting to determine whether it is too late to improve the system's privacy protections. Already the digital technology is in use in metropolitan areas, including New York and Washington, where either the local cellular networks have been modified to support digital technology or where new so called wireless personal communications services are being offered. "We're already in the process of correcting this flaw," said Chris Carroll, an engineer at GTE Laboratories, who is chairman of the industry committee that oversees privacy standards for cellular phones. But Greg Rose, a software designer for the Qualcomm Inc. a leader in digital cellular systems said that fixing the flaw would be "a nightmare." Tightening the security system, Mr. Rose said, would involve modifying software already used in the computerized network switching equipment that routes wireless digital telephone calls, as well as the software within individual phones. Currently, about 45 million Americans have cellular phones, though most of them so far are based on an older analog standard that offers no communications privacy. But cellular companies are gradually converting their networks to the new digital standard, and the new personal communications services networks going into operation around the country also employ the digital encryption system. Nearly a million P.C.S. phones have been sold in the United States, according to cellular industry figures. Besides Mr. Wagner, the other researchers who cracked the code were Bruce Schneier and John Kelsey of Counterpane Systems, a Minneapolis consulting firm. Mr. Schneier is the author of a standard textbook on cryptography. The new digital wireless security system, which was designed by cellular telephone industry engineers was never intended to stop the most determined wiretappers. But because digital calls are transmitted in a format corresponding to the one's and zero's of computer language, they are more difficult to eavesdrop on than conventional analog calls, which are transmitted in electronic patterns. And digital calls protected with encryption technology -- basically a mathematical formula in the software that scrambles the signal -- would be all the harder for a third party to listen to surreptitiously. Because the encryption system that the industry adopted in 1992 was deliberately made less secure than many experts had recommended at the time, privacy rights advocates have been warning since that the code could be broken too easily. An announcement Thursday that the code has indeed been cracked would seem to bear out those concerns. "This should serve as a wake-up call," said James X. Dempsey, senior staff counsel for the Center for Democracy and Technology, a public interest group. "This shows that Government's effort to control encryption technology is now hindering the voice communications industry as well as the data and electronic communication realm." Industry executives acknowledged that steps must be taken to address the problem. "We need strict laws that say it is illegal to manufacture or to modify a device which is designed to perpetrate the illegal interception of P.C.S. telephone calls," said Thomas E. Wheeler, president of the Cellular Telephone Industry Association, a Washington-based trade group. Mr. Wheeler said the weaker privacy technology had been adopted not just to appease the Government but because makers of wireless communications hardware and software wanted to embrace a technical standard that would meet export regulations. Those rules, based on national security considerations, sharply curtail the potency of American-made encryption technology. The three computer researchers who broke the code belong to an informal group of technologists who believe strongly that powerful data-scrambling technologies are essential to protect individual privacy in the information age. These technologists, who planned to release their findings in a news release on Thursday, argue that the best way to insure that the strongest security codes are developed is to conduct the work in a public forum. And so they are sharply critical of the current industry standard setting process which has made a trade secret of the underlying mathematical formulas used to create the security codes. "Our work shows clearly why you don't do this behind closed doors," Mr. Schneier said. "I'm angry at the cell phone industry because when they changed to the new technology, they had a chance to protect privacy and they failed." Mr. Carroll, head of the industry's privacy committee, said it planned to revise the process for reviewing proposed technical standards. [End]

1 0

WebWorld 7-8
by Bubba 17 Dec '03

17 Dec '03

1 0

FBI Wiretap Payments
by John Young 17 Dec '03

17 Dec '03

The FBI has published in the Federal Register today: Implementation of Section 109 of the Communications Assistance for Law Enforcement Act AGENCY: Federal Bureau of Investigation, DOJ. ACTION: Final rule. ----------------------------------------------------------------------- SUMMARY: This rule implements section 109 of the Communications Assistance for Law Enforcement Act (CALEA), which requires the Attorney General to establish regulations which set forth the procedures that telecommunications carriers must follow in order to receive reimbursement under Sections 109 and 104 of CALEA. CALEA requires that this rule enable carriers to receive payments in a timely and cost- efficient manner while minimizing the cost to the Federal Government. Specifically, this rule sets forth the means of determining allowable costs, reasonable costs, and disallowed costs. Furthermore, it establishes the requirements carriers must meet in their submission of cost estimates and requests for payment to the Federal Government for the disbursement of CALEA funds. In addition, this rule protects the confidentiality of trade secrets and proprietary information from unnecessary disclosure. Finally, it sets forth the means for alternative dispute resolution. ----- http://jya.com/fbi032097.txt (177K)

1 0

Re: U.S Mint Electronic Cash Study
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: e$(a)thumper.vmeng.com Reply-To: jmuller(a)brobeck.com (John D. Muller) Mime-Version: 1.0 Precedence: Bulk Date: Thu, 20 Mar 1997 08:38:05 -0800 From: jmuller(a)brobeck.com (John D. Muller) To: Multiple recipients of <e$(a)thumper.vmeng.com> Subject: Re: U.S Mint Electronic Cash Study Federal Reserve Governor Kelley and New York Fed President McDonough have both stated that the Fed has no plans to issue electronic money. See: http://www.bog.frb.fed.us/BOARDDOCS/SPEECHES/19960618.htm http://www.ny.frb.org/pihome/news/speeches/sp961008.html ---------- The e$ lists are brought to you by: Intertrader Ltd - Commerce Solutions in the UK Visit <http://www.intertrader.com/> for details ... Where people, networks and money come together: Consult Hyperion http://www.hyperion.co.uk info(a)hyperion.co.uk Like e$? Help pay for it! See <http://www.shipwright.com/rah.html> Or, for e$/e$pam sponsorship, see <http://www.shipwright.com/rah/> Thanks to the e$ e$lves: Of Counsel: Vinnie Moscaritolo <mailto:vinnie@webstuff.apple.com> (Majordomo)^2: Rachel Willmer<mailto:rachel@intertrader.com> Commermeister: Anthony Templer <mailto:anthony@atanda.com> Interturge: Rodney Thayer <mailto:rodney@sabletech.com> --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/

1 0