December 2003 - cypherpunks-legacy

Re: Devisive comments [sic]
by Alec McCrackin 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 10:17 PM 6/20/97 -0700, you heatedly wrote: |Take a gander at this out-of-the-blue and off-the-wall thing I just got |from Georgia's finest. Proves to me that what they say about Georgia is |right. Hey, Tim. Fill me in. Perhaps other list members would like to know also. What do _they_ say about Georgia? And to whom do _they_ say it? And just who are _they_? Or was this just Tim in a snit? Alec BTW the most recent Mixmaster remailer (remailer(a)anon.efga.org) and nym server are in Ga. Try them out, Tim, when you want to blow off some steam without appearing foolish in public. -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQCVAwUBM67T3iKJGkNBIH7lAQHRKwP9HmtQIDMeB57Oj4zvwRmh/JizkcIi9Q0D WAYPrDXNxGDibBZs6EnXMBar3ltY1ZyspXYyf39w69DY02WCIBFfpuw1Cj4LhXpb Ws0LhszVWaG75voqDbDLGkCl37XfGfrHUW3osftLJ3hV3HaAuSWGPImMKQuVb8Xm xjJH3SDCqJc= =D1ql -----END PGP SIGNATURE-----

1 0

Re: Canarypunk: Jim Bell in a coalmine
by Michael Myers 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 11:53 PM 6/22/97 -0700, Blanc wrote: >Having said that, I'll consider the possibility, if visitors are allowed on >weekends. Perhaps several cpunks could go (if anyone else around here >interested? (Wei, Joel, I know you're just dying to go <g>)), if more than >one visitor at a time is allowed . Well, I work in Tacoma, and have thought of visiting...PNW area physical meet, anyone? A jail is a reasonably appropriate setting, If this horrid legislation isn't stopped, just think of it as house-hunting ;-> Has John Young sussed out the visitor situation yet? -----BEGIN PGP SIGNATURE----- Version: 4.5 iQCVAgUBM67bmpmFdfLoqDWNAQF9QAQAl5M339rLKpfWMesrSvXoo4J/xd0F/Dlu gtEiTkKNR1g0BzbaSdyYOxG+YV2EwP9f8nTWHCtI5T7Y+ha7N2sdKzHy+QrAKS4/ JbL9eBVw4cEcsRBGYMFZIWQilw2IHzlRNPCpmWRQsy30k5HYSIXqOqstiKj/Vi1P TI8JgQnyeYU= =nzca -----END PGP SIGNATURE----- -- /```````Instead of being born again, why not just GROW UP?`````````\ Michael Myers Vote Libertarian....you'll sleep better! Don't like abortion? Don't have one. Don't like guns? Don't buy one. blackavr(a)aa.net root(a)crowncollege.com PGP public key on keyservers \_________________ http://www.aa.net/~blackavr/____________________/

2 1

New Middleman Mixmaster
by Medusa Admin 17 Dec '03

17 Dec '03

I have just set up a new mixmaster with the following key. It's purely a middleman remailer, and hence will only forward mail to other mixmasters. If it's used as the last link in the chain, or you send a request for the key or statistics information, this will be sent out via a randomly chosen remailer. Because all mail to the remailer goes through the nymserver as well as my system, you should expect latency of a couple of hours. Here is the public key for Medusa Remailer =-=-=-=-=-=-=-=-=-=-=-= medusa medusa(a)weasel.owl.de d34e77b9c0e4f52a51767c20a9e9b942 2.0.4b1 MC -----Begin Mix Key----- d34e77b9c0e4f52a51767c20a9e9b942 258 AATU6i9jf6U7CE08LTZA+JOUQzRd4RLPTW1v+PB3 ju0+oxGgLvPGAQ6N6ZlVnFGV8NpbYjc08S/dLlik T41DcQcPoi9rCy9UgzWh8WcsxGr6GsCTgXrTyhOw rw2WRJI3S/GH6+Zdexvw4+8ABtn8nGzh0vftpzUo Jl+dX+kiSsbGvQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB -----End Mix Key-----

1 0

Comparing Cryptographic Key Sizes
by Adam Back 17 Dec '03

17 Dec '03

Below is a explanation of the meaning of cryptographic key sizes which started as an explanation I wrote for a journalist friend of mine, on being asked about how relatively secure a system using DES and RSA (SET) was as compared to netscapes export version of SSL. I've re-written it to make it more general in scope. One of the most common errors I see in news stories about cryptographic breaks is to (say) compare 1024 bit RSA keys with 56 bit symmetric keys as if the two key sizes are directly comparable. This new document is intended to be simple and understandable to give people a handle on how to describe and compare cryptographic systems strengths. This document by design glosses over some details, where I think this is reasonable. It could use some criticism. If you are not that crypto aware, does it make sense to you? If you are crypto aware, what do you think of my off the cuff estimates of hardness? I wrote it with journalists in mind. If you are a journalist and find it useful, feel free to quote parts/all of it without attribution. Adam Comparing Cryptographic Key Sizes There are two types of key sizes: public key (sometimes called asymmetric key) and symmetric keys. Examples of public key algorithms are RSA, and Diffie-Hellman. Examples of symmetric key algorithms are RC4, DES, IDEA. You can not directly compare public key lengths (for example RSA keys) with symmetric key lengths (DES, RC4). This is an important point which confuses many people. For example 40 bit RC4 (a symmetric key cipher) can be broken in a few hours with a few hundred workstations. 40 bit RSA (a public key cipher) can be broken in a fraction of a second on one PC. RSA keys need to be I'd guess around 350 bits to be equivalent in strength to 40 bit RC4. 56 bit DES is probably roughly similar to 512 bit RSA in hardness to break. Symmetric keys sizes are easy to reason with: one more bit in key length is twice as hard to break, for the same algorithm. It is more complicated estimating the hardness to break of public key (say RSA) keys of varying sizes as they get harder more gradually than symmetric keys. This is why public key systems have longer keys, you need more bits to get the same security level. Most systems use a mixture of public and symmetric key ciphers. This is because public key ciphers are _slow_. Symmetric key ciphers are fast, and so are used in combination with public key systems to speed up the combined system. Public key systems are used because of the advantages of public key management they make possible. When considering the strength of a system using two ciphers one public key and one symmetric key, the strength of the system is equal to the strength of the weakest link. For example: consider the export version of SSL, as shipped in the export version of Netscape browsers and servers. It uses 512 bit RSA, and 40 bit RC4. It is easier to crack 40 bit RC4 than it is to crack 512 bit RSA, so export SSL can be broken by breaking the 40 bit RC4 component. Ian Goldberg recently broke a 40 bit RC5 key himself with Berkeley univ machines in 3.5 hours. 40 bit RC4 could be broken in a similar amount of time. 512 bits RSA is not enough either, and you can rest assured that the NSA, other governments' secret services, and any corporation or organised crime group with sufficient funds can break it. 512 bits is likely within reach of a distributed internet effort, of similar or smaller scale than the recent DES breaking. 56 bit DES is harder to break than 40 bit RC4 (SSL), from the number bits you might think it would be 65536 times harder, but it's less than that because DES is faster than RC4. In software it's about 5 times faster, so that means breaking DES in software is about 10000 times harder than breaking 40 bit RC4 (as used in export SSL) in software. But, if the Russian Mafia, or a corporation involved in industrial espionage wanted to break 56 bit DES they would not do it in software. They would build a special purpose piece of hardware which was designed only to break DES. DES was designed to be fast in hardware, it is a relatively slow ciphers in software. About 10 years ago now Michael Wiener made a design for such a DES breaking machine. He estimated it would cost $10,000,000 to build a machine which would break a 56 bit DES encrypted message a few hours. His machine was scalable, pay more money, break the key faster, pay less take longer. The estimate was that could build one with enough DES key searching units to break it in a day for $1,000,000. That was 10 years ago. 10 years is a long time in the computer industry. Nowadays you build the machine more cheaply as chip technology has progressed, and computers are much faster per $. Estimates are around $100,000 to build the machine (neglecting hardware engineers consultancy fees). Everyone expects that NSA, GCHQ, SCSSI have built such a machine for $100,000+. This is obvious because the NSA and SCSSI allow export of 56 bit DES. $100,000 is not much money for a secret service. Algorithms using 40 bit keys aren't secure at all, past a very superficial casual level of protection. Systems using DES, such as SET are only secure against organisations who can't raise $100,000 and can't find people who know lots about crypto and hardware design. $100,000 is not much money for a secret service. It's not much for the Rusian Mafia either. END

1 0

Re: McCain Talks Crypto
by geeman＠best.com 17 Dec '03

17 Dec '03

At 01:23 AM 6/23/97 -0700, Bill Stewart wrote: I still think that there is a huge power behind the effort - and that is based in dollars. The child-porn/national security issues just make it understandable for the CNN digest of reality, and the clueless among the Government. Appealing to those arguments with compelling counterarguments in the same terms will effect results, perhaps, but only if big dollar$ are behind it. Money will change the course of events here, and I doubt anything else will. > >Sigh. Make the laws and then work out the details -- I don't think so :-) > >However, if his real concern IS national security, then perhaps >he can be reached - not only is our real national security based on >the economy, but any vaguely competent foreign government or >major terrorist organization has access to all the crypto they need: >unlike fully assembled missiles and plutonium, which are hard to get and >hard to smuggle across borders, crypto is easy to buy anywhere in the US, >and the Enemies Of The State just have to take one copy out, by laptop, >by floppy disk, by modem, or by satellite, and you've lost control. > >I assume he knows he's using the child pornography excuse as a >cynical play to the media - the obvious response is that > McCain's Pro-Forgery Bill >by making good crypto tools less available, and by making sure >that people will choose to get their important digital certificates >from multiple CAs and non-US-controlled CAs, or just go uncertified, >will make it forgery more common and digital signatures less trusted. >So <wave hands wildly here> your kids are more likely to have fake IDs >like we did to drink when we were younger and <wave hands again> >that'll lead to more pornography on the net, imported from foreign >countries that have lower standards than our fine American communities, and... > > ># Thanks; Bill ># Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com ># You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp ># (If this is a mailing list or news, please Cc: me on replies. Thanks.) > > >

1 0

The spam thread
by Jason William RENNIE 17 Dec '03

17 Dec '03

Ooops, looks like i started a raging debate. Sorry if this debate bores anybody but as was said to me, just delete it. I notice nobody commented on the i just dont want advertising in my mailbox point, and why shouldn't they be billed. What i suggested WASN'T a new law that could be abused etc. It was a very minor legal precedent, where the owner of a phone or email box could be paid for advertising in in IF the marketer was informed. To Ross, SPAM may be freedom of expression as my child pornography, but 2 things, 1. What about my rights to privacy, and my rights to my mailbox that I pay for. Why should it be used as an advertising medium if i font want it to be used for one ?? 2. By your argument, mailbombing of all flavours is free expression and should be allowed. Seeing as this follows logically RU going to get upset if i mail bomb you ?? All this started when i asked if SPAM might be coming through this list, i didn't think it would have tyhis effect, but discussion is healthy. Anyway shall we let this thread die at this point ?? Jason =8-]

2 1

Re: spam on this list (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Mon, 23 Jun 1997 19:25:51 -0400 > From: "Philip A. Mongelluzzo" <phimon(a)ix.netcom.com> > Subject: Re: spam on this list > I support the constitution. In the case of the first ammendment: The > freedom it allows you, or whoever, to send spam and indulge in child > pornography is the same freedom provided to those who say those ideas are > wrong. Got it? But it isn't the same as you present it. I will explain below. > How do we deal with child pornography and free speech in such a way as to > allow both to exist and insure our children are not exposed to pornographic > material until they are at a maturity level where they can deal with it? Let's look at this carefuly for a moment. Child pornography in and of itself is irrelevant. The issue is sexual acts involving one or more children by adults which are committed with (or without) the specific intent of creating some physical record for personal use or to pass to others (with or without profit). Now let's contrast this with a simple pencil drawing of a child and an adult having sex (eg. Greek pottery). The question is are these two acts, one involving a real physical act involving a minor, and the other as a physical expression of the artists imagination equivalent? Some would have you believe they are the same. Unfortunately, I have yet to see a clear explanation of the view. Now the other side is that they are different. This belief rests on at least two basic tenents. The first being that it is the physical act that constitutes the crime and not simply thinking about it. The second is that there is a fundamental difference of quality between an item and its representation in some symbology. From this it becomes clear that the issue is how do we reduce the initial sexual contact. If THAT can be resolved the other problems resolve themselves. Now, let's assume for a moment that we have in fact resolved this issue. Should we then regulate representations of these acts by persons when it is assumed no actual child was involved? The representation is nothing more than the ramblings of an expressive mind. So are we not making certain thought illegal? This certainly contrasts with the belief that a crime requires an act. That doesn't sound very rational to me. And what about if I don't draw it but rather write a story? Or perhaps use my image editor to take children bathing suite adds and medical sources to fill it out, why should this be any different than a written description? Or perhaps that image on the Greek pot? No, these sort of line drawing was meant to be prohibited by the Constitution. The founding fathers must have known the world was a gray sort of place so they took special precautions (ie 10 Amendments) to make nice and clear boundaries for the federal government (ie 1'st Amendment). It is clear that they expressely did not want the government involved in human expression. > If pornography is the enemy of crypto then that is enemy that must be fought. This is a straw man. There is no crypto involved in the physical act. Nice strawman argument though, got almost the whole damn world swallowing at this point.... > A battle that must be won without killing the enemy to insure continued > free speech. Quite a challenge I think. Only if you are confused about exactly what the issue at hand is. We need diagnostic proceedures usable by regular physicians and the issue really needs to be handled as a medical and not a legal issue. Putting people in jail won't effect this sort of human behaviour one damn bit. By the time the guy gets to jail some poor kid has been really abused, is that how you want your kid dealt with? ____________________________________________________________________ | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: A better DES challenge
by Lucky Green 17 Dec '03

17 Dec '03

At 06:15 PM 6/23/97 -0700, Mike Duvos wrote: >Really. It appears that the DESCHALL frivolities actually >enhanced the reputation of DES, fluffy press releases by C2 and >Security Dynamics notwithstanding. Which is why I opposed a distributed crack ever since the crack was first proposed. But once the crack got underway, the only thing to do was to participate and hope it wouldn't take all that long. Stressing the individual that found the key over the group effort was the best thing that could be done in an already bad situation. Spin control is a fact of life. Now on to breaking 56 bit RC5 (a waste of time, but until that's out of the way there will be no sufficient support to break 64 bit RC5). I am encouraging corporate sponsorships for breaking RC5-64. If we can get $100,000 together (should be easy), people will find cycles you didn't even know existed. :-) --Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred. DES is dead! Please join in breaking RC5-56. http://rc5.distributed.net/

1 0

digital signature software
by chewp＠pacific.net.sg 17 Dec '03

17 Dec '03

Hi Besides PGP and RIPEM/SIG, is anyone aware of other US-exportable digital signature software? Thanks Lip Ping chewp(a)pacific.net.sg

2 1

Who is going to HIP'97?
by Lucky Green 17 Dec '03

17 Dec '03

Who on this list intends to go to HIP'97? http://www.hip97.nl I would like to organize a C*punks meeting there. Thanks, --Lucky --Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred. DES is dead! Please join in breaking RC5-56. http://rc5.distributed.net/

5 5