December 2003 - cypherpunks-legacy

Cryptanalysis
by Scott Auge 17 Dec '03

17 Dec '03

Was wondering if anyone could help me with short explainations on the cryptanalysis of SKIPJACK and DES. If ya hit www.sauge.com/crypt you might get a better idea of what i'm trying to accomplish. Vague explanations are OK. Dont want long drawn out explainations on the implementation of an attack (source code, proofs, statistical analysis and the like), just a short explaination of the attack. Thanks all, Scott -- How has the government interfered in your life today?

1 0

Cryptanalysis
by Scott Auge 17 Dec '03

17 Dec '03

Was wondering if anyone could help me with short explainations on the cryptanalysis of SKIPJACK and DES. If ya hit www.sauge.com/crypt you might get a better idea of what i'm trying to accomplish. Vague explanations are OK. Dont want long drawn out explainations on the implementation of an attack (source code, proofs, statistical analysis and the like), just a short explaination of the attack. Thanks all, Scott -- How has the government interfered in your life today?

2 1

Re: Waiting for Mac version [was Re: Full strength Email Clients]
by Fred Condo 17 Dec '03

17 Dec '03

At 3:30 PM -0800 2/13/97, P.J. Westerhof wrote: >At 12:10 7-02-97 -0500, Timothy Hill wrote: >>Meanwhile, a beta version of "Pretty Safe Mail" >><http://www.highware.com/highware/PSM/safemail.htm> is available from >>Highware in Belgium. It's PGP compatible, and its user interface is a >>great leap forward from any Mac PGP front end I've seen. But, it still has >>some deficiencies, it's very slow (25 seconds to sign this message on a 25 >>MHz 68040 vs. 4 seconds for ViaCrypt PGP 2.7.1), and (as was recently >>discussed on a couple of these lists) its source code hasn't been published >>or externally audited. > >And today - one week later - *no* version is currently available. >I would say this adds to the reservations some of us may have had about PSM. >Thus far PGPMail 4.5 leaves out not only Mac-users, but W3.11-users also. I >have asked PGP.com what they intend to do about the 3.11-users >(W32s-enhanced or not). Since I'm sticking to W3.11 for the time being: >somebody else have any suggestions? I notice that PSM has had a name change concurrent with its availability change. Could the unavailability have to do with a trademark dispute between Highware & PGP, Inc.? Is Highware going to release the source code of VSM? Is PGP, Inc. going to release the source code of PGPMail 4.5? If the answer is no, I am sticking with the free PGP. If the answer is no, I guess these firms are expecting ignorance to be the primary characteristic of their customers.

1 0

Re: Private property & the cypherpunks list(s)
by Dale Thorn 17 Dec '03

17 Dec '03

Kent Crispin wrote: > ichudov(a)algebra.com allegedly said: > > Firebeard wrote: > > > >>>>> Igor Chudov @ home writes: > > > And once I'm up and running, my cypherpunks list server will > > > not be interconnected with any server which has a similar AUP. The > > > implication of the AUP is that if you _don't_ comply with it, you will > > > be blocked. Without such an implication, the AUP is meaningless, and > > > I'm dedicated that there should be no filtering/blocking of any kind, > > > of the list. Persons behaving 'unacceptably' should be handled by > > > social pressures by others in the 'community' of the list, and not by > > > policies of the list operators. > I can understand this sentiment, given the events of the past couple > of months, but it seems short-sighted. If this scheme grows there > could be several hundred or more mailers involved, and there is no > technical reason why moderated lists couldn't be included. > Remember that each list operator actually represents a community of > users, users who are *free* to go elsewhere if they choose. Clearly, > some people would chose to populate a filtered list. There is no > reason whatsoever to discriminate against them. There could be, but that would be on a case-by-case basis. There are times when carrying a censored feed that you'd be giving tacit approval to the censorship itself. Again, case-by-case basis.

1 0

Re: [Declan McCullagh: "A List Goes Down In Flames," from Netly]
by Dale Thorn 17 Dec '03

17 Dec '03

Mike Duvos wrote: > John Gilmore <gnu(a)toad.com> writes: > [Fluffy Gilmore apologia by Declan expunged] > Two small points. > 1. The rift between Gilmore/EFF and Cypherpunks is hardly > of recent origin, and dates back to when the EFF first > demonstrated to horrified Cypherpunks that its policy > would be one of appeasement and capitulation towards > clearly unacceptable legislation. This is all in the > archives, including Tim May's essay on why he chose not > to renew his EFF membership. > 2. The article fails to mention Gilmore's new nickname. :) I'm so disgusted by the other disinformation put out by John's loyal friends (i.e. "respected" cypherpunks) on the subject of "disrupters and sociopaths", etc. that I try not to reply to any of the crud I see posted by those clowns. But when someone tries to be reasonable, conversation is possible. So how about some points on "disrupters": 1. Disrupters don't like bullies. 2. Disrupters don't like mindless authorities. 3. Disrupters don't like control freaks. 4. Disrupters don't like liars and hypocrites. 5. Disrupters don't like NSA/CIA/DEA/FBI trolls. 6. Disrupters don't like Animal Farm policies and elitists. In short, if Gilmore had come down on the real problem people once in a while, they wouldn't have agitated the "disrupters" nearly as much as they did. But he wasn't about to do that, because he's one of the problem people himself. Fooey on you, Gilmore. May you never work in this business again.

1 0

Re: Moderation experiment almost over; "put up or shut up"
by Dale Thorn 17 Dec '03

17 Dec '03

paul(a)fatmans.demon.co.uk wrote: > I do not begin to believe this is correct. I happen to believe that > sexism, not in the sense of believing women inferior but in the sense > of believing homosexuals inferior can be, in some instances, a form > of bigotry but it is merely a matter of semantics and not of interest. > I wholeheartedly agree with the last point, anybody who believes in > any form of deity or higher being (call it god if you like) is, IMHO, > a fool. However, this has proven in history to be contradicted on a > number of occasions, for example, Albert Einstein was a Jew but did > not just accept without enquiry, rather, his religious views were > subtle and well thought through. I thought Einstein's ideas on social matters (incl. religion) were naive and sentimental. There's a difference in saying "I believe there's a God" and "I believe in a God". Of course, either way one could be implying a hidden or unspecified set of agendas concomitant with such a belief. In the movie "Jesus Of Nazareth" is a classic example of why to believe or not believe in a religion, i.e. things unseen: At the end, the followers are in a small room, fearing for their safety and all, and they say to Jesus "how is anyone going to believe all this stuff" (or words to that effect), and Jesus replies "because you are my witnesses. Tell them and they will believe". See how simple that was?

1 0

Re: Moderation experiment almost over; "put up or shut up"
by Against Moderation 17 Dec '03

17 Dec '03

dlv(a)bwalk.dm.com (Dr.Dimitri Vulis KOTM) writes: > > * If gays ruined usenet, does that mean at one point usenet was a > > good thing before it was ruined? If so, gay people at least > > deserve credit for creating something good, even if they didn't > > manage to run it well. > > Suppose for argument's sake that the people who created Usenet all > happened to be gay. Why would "gay people" as a whole, most of whom > had nothing to do with it, deserve credit for it? Okay. Suppose for argument's sake that the people who are censoring Usenet all happen to be gay? Why, then, would all gay people deserve blame for these actions? Now suppose they aren't gay. Them whom are these homohpobic rants really attacking? Gay people or censors? If you say, for instance, "New cypherpunks list for heterosexuals only", who do you think is actually going to be affected by this? Certainly not Gilmore who is completely disillusioned with cypherpunks at this point and not likely to subscribe any mailing list a person like that runs anyway. Rather, you are attacking people who happen to be gay but would otherwise be interested in subscribing to the mailing list. Now suppose it's not instantly possible to discern a person's sexual orientation over the internet, as Dr. Grubor claims it is. Suppose further that some of the people who censor Usenet are gay, and others aren't. Some of the people in favor of free speech are gay, others are not. Many of those who are straight don't just come out and say, "I am not gay," for the simple reason that they oppose discrimination based on sexual orientation and don't believe one's sexual orientation should be relevant to a debate on censorship. In such a case, refocusing the debate on homosexuality rather than censorship hardly furthers your objectives. I believe homophobia is a great way to bring out the censors in people. However, inducing censorship is only part of fighting it. You also need respectable people to some in, argue cogently against the dangers of censorship, perhaps even get some extremely reasonable articles suppressed, and then spread the word about it. I find the freedom-knights tactics' extremely lacking in this second, "clean up and analyze the mess" phase. As a recent example illustrates well, Vulis did a nice job of inducing censorship on cypherpunks. However, I think most peoples' opinions didn't really turn, or at least people didn't realize how serious things were and didn't really care, until Tim May [someone the many freedom-knights hate] started criticizing this censorship in extremely reasonable messages that were suppressed from both the -edited and -flames mailing list.

1 0

Re: More on digital postage
by snow 17 Dec '03

17 Dec '03

Mr. Bell wrote: > At 03:31 AM 2/14/97 -0800, John C. Randolph wrote: > >Tim may says: > >>By the way, I think the "junk fax" and "junk phone call" laws are clearcut > >>violations of the First Amendment. I understand why the herd _wants_ these > >>laws, as it reduces the costs involved in replacing fax paper, running to > >>the telephone only to find someone trying to sell something, etc., but it > >>is quite clearly a prior restraint on speech, however well-intentioned. > >I have to disagree here. The junk fax law is a restraint on unauthorised > >use of property, i.e. *my* fax machine, *my* phone, etc. > However, you connect that fax machine to a phone line, when you know full > well that should it be enabled to do so, it will automatically pick up the > phone when it "hears" a ring, and will print out a fax based on information > provided. It isn't clear why sending a fax is any "wronger" than mailing > junk mail, or making a (voice) phone call to somebody. That is a ridiculous argument. The door to my home is connected to the street,m and I know full well that that makes it easy for anyone to come wandering in to my home. Is it legal, just because I have my home hooked to the street, for someone to come in and help themselves to a beer out of my fridge? Nope. Sure I realize that they _can_, but that doesn't make it right, and it doesn't make it legal.

1 0

Re: Excerpt on SPAM from Edupage, 11 February 1997
by snow 17 Dec '03

17 Dec '03

> Well, they will stop sending you money if they find out that you do not buy > their products. > > - Igor. As long as they stop sending the Ads.

1 0

DES and RSA crypto hardware from the free world
by Peter Gutmann 17 Dec '03

17 Dec '03

I've just got the details on two new crypto chips produced by the Dutch company Pijnenburg Custom Chips B.V. These are the PCC 201 bignum coprocessor and the PCC 101 DES-with-everything processor (the official names are slightly different :-). The PCC 101 sells for approximately US$27, the PCC 201 sells for approximately US$50 (for people who aren't familiar with the market for these things, these are very good prices, especially for the 201). The PCC 201 is officially a "Large number modular arithmetic coprocessor" which is designed to perform the operations: A^x mod N AB mod N C mod n very quickly for quantities of up to 1024 bits. Typical procesing times for 1K-bit operands is 40ms, for 512 bits it's 12ms when clocked at 25 MHz. Unfortunately you can't directly chain them for larger operands, although it's possible to use two 201's and some software tricks for CRT decrypts to stretch the operand size to > 1024 bits. The way the 201 works is that you load the fixed components (exponent and modulus for A^x mod N, modulus only for AB mod N and C mod N) into one of three sets of on-chip registers, and then use them to perform arbitrary numbers of operations on data. This means that for something like a micropayment application you would load the necessary private key components once and then generate signatures at the (theoretical) rate of 25 a second. To date the cost of this kind of hardware has been such that the most viable solution was to run racks full of cheap P5 boards booting a bare-bones RSA-processing application through a network card, but with the PCC 201 you could populate a board with 201's and a few microcontrollers a la a Wiener machine and use these as a payment transaction processing engine. They'd also make fairly cool SSL co-processors for web servers. The PCC 101, officially a "DES encryption device", does DES, 3DES (EDE with 2 or 3 keys), and DESX in ECB, CBC, CFB, OFB, and MAC modes at a maximum rate of 132 Mbits/s (16.5 Mbytes/sec) for single DES, or 1/3 that for 3DES, when clocked at 33 MHz. It's possible to load either single or triple-DES encrypted keys which are then decrypted using onboard key encryption keys (KEKs). The chip contains onboard storage for 24 keys, 3 KEKs, 4 IV's, and 2 DESX keys (pre/post-whitener). Processing is done in a 3-stage pipeline, so once you feed in 3 64-bit blocks it churns out a new result every 16 clocks (this also allows overlapped I/O operation). You can add an external battery to save the internal state when power is removed, so you could keep your keys permanently stored onboard (although given that these keys can be recovered given enough money and effort I'm not sure if this is a good thing). The PCC 101 is available in 44-pin PLCC/TQFP packages, the PCC 201 is available in 68-pin PLCC and 80-pin TQFP packages. The PCC 201 contains a multiplexed address/data bus and a few control signals (most of the pins are unused), the PCC 101 contains data and address ports and a few control signals. They look fairly easy to interface. There's an ISA evaluation board available which contains the PCC 201 and the slightly older PCC 100 (predecessor of the 101) and some test software. Note that this is an evaluation board only, Pijnenburg make the chips but don't sell general encryption cards. A fast PCI card containing these chips and drivers for various common operating systems and MSDOS is currently being designed by an international cabal. This will be a PCI 2.1-compliant card containing a PCC101, an optional PCC201, and possibly a few other things (we're still arguing about the design). I'll be writing DOS and Win16 drivers for it, and someone else will do an NT and possibly Linux driver (again, it's still at the design stage). cryptlib (http://www.cs.auckland.ac.nz/~pgut001/cryptlib.html) will probably end up having native support for it when it's ready. Pijnenburg don't have a web page yet but are working on it, I'll post the details here when it becomes available. Until then you can contact them at asic(a)pijnenburg.nl. The only slight problem is that they're subject to the Dutch governments export rules (the usual Wassenaar stuff) which means that if you're not using it for an authentication/integrity-only application or a financial application, you'll probably need to go through some paperwork to show that it's for your use only and you won't be passing it on to your friend Jose from Columbia. Pijnenburg have a standard Statement of Application which people can use as to write their own statement for export approval. These chips look *very* promising. Who needs Clipper, or HP's Clipper-under-another-name, when you can get triple DES from the free world at prices like this? Peter.

1 0