December 2003 - cypherpunks-legacy

Mega Death
by John Young 17 Dec '03

17 Dec '03

White House press briefing May 8: Q Mike, Attorney General Reno today confirmed that the Justice Department is investigating the possibility of a high-level Israeli spy in the U.S. government. How is it going to impact relations with Israel at this point? MR. MCCURRY: No comment on that subject.

1 0

[ADMIN] Stego in posts
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

>> In a message dated 97-05-05 20:54:49 EDT, you write: >> >> << >> Write a guys/girls name here_______________ or say aloud. In 21 days he/she >> will show his/her love 4-U!! CAUTION! Any guy/girl who breaks this chain >> will have bad like w/ guy/girls 4-ever!!!!!!!!!!! >> Pass this on 10 times!!!!!!!!!!!!!!!!! >>

1 0

Re: key recovery vs data backup
by Kent Crispin 17 Dec '03

17 Dec '03

On Wed, May 07, 1997 at 09:56:21PM -0700, Lucky Green wrote: > At 11:47 PM 5/7/97 -0400, Carl Ellison wrote: > >I was saying that if Sam needs to read my encrypted file/mail, then I should > >list Sam as a crypto-recipient. If Acme,Inc. needs to read my encrypted > >file/mail, then I should list Acme,Inc. as a crypto-recipient. > > > >There's no safe of keys. It's even simpler to explain to an executive. > > Several people on this list asked me to elaborate on my claim that KR is > not required. I doubt that I could put it more succinctly than Carl has in > his post. Unfortunately, it doesn't solve the problem at all. In fact it doesn't even address the problem. So much so that reading these replies makes me think that I am looking at different problem than you. So perhaps backing up to discuss the problem a bit would be helpful. I hope you will forgive me if this is old ground. The problem is key management for an organization. The keys are used to protect and authenticate data owned, not by any individual, but by an organization. Keys are generated for the organization's purposes, not the purposes of any individual. Furthermore, the individual privacy of an individual who works for an organization is not a necessary priority for the organization. Organizations are composed of many individuals, some of which may not share the goals of the organization, or who may indeed be inimical to the organization. And the members of an organization may vary widely in competence, personal responsibility, and so on. Thus, the members of an organization cannot be trusted to do the "right thing". [I am using "organization" in a loose sense, so that we can consider a business an organization, and an employee as a member of that organization.] In fact, in most cases, only a small fraction of the members of an organization care more about the welfare of the organization than about their personal welfare. So people will almost always be more concerned about their own personal data security than they will for that of an organization. This, coupled with difficulties of coordination and control, and the above conditions, means that in a global sense information security for an organization will always be difficult, regardless of the security of the crypto they use. For a moment consider the analogy with physical keys. Consider the key management problem of a moderate sized corporation that occupies a large office building. There are office keys, storeroom keys, supply room keys, conference room keys, bathroom keys, keys to filing cabinets -- there are *lots* of keys, lots of different delegations of authority involved. In many cases there is a "key czar", a "building coordinator" that hands out keys, and gets them back when someone changes offices or jobs. It *has* to be this way -- you can't rekey the entire building when a janitor quites. So, occasionally it is necessary to rekey a lock, but typically keys are just reused. Many office keys are designed to be difficult to casually duplicate, for this reason. Of course any key *can* be duplicated, but that's not really that important -- the building is full of employees during the day, and the night watchman checks each person that enters after normal hours. All these physical keys all fit locks that can be broken quite easily -- there is essentially *no* possibility of something valuable being lost behind a lock that cannot be broken. This is vastly different from cryptographic keys -- for all systems of interest, encryption represents locks that cannot be broken. Data behind a lost cryptographic key is gone forever. You can't call a locksmith or a safe cracker. It's really just gone. With this background, perhaps now you can see why I say that Carl's solution doesn't even address the problem. The problem is management of complexity. Carl says "encrypt to Acme Corp". Who in Acme Corp? What part of the organization that is Acme Corp is authorized to know this particular bit of information? Because some of the employees are idiots you want this built automatically into the application they are using for encryption/email/whatever. How does this software know what policy is appropriate for which employee? How is that policy distributed? What is the interface that allows a policy to be defined? How do you protect the policy definition from subversion? Contrast that with a key-safe model, where a copy of every encryption key is kept in a secure database. The encryption client software only talks to the key-safe when a new key is generated, over a cryptographically secure channel, of course. There is no policy the client has to know. The user encrypts freely without concern about who else should get copies. The organization knows that there is very little chance of data loss because of lost keys, and can use any policy it chooses to recover keys, from the company president's ad hoc whim to a carefully specified organization al security policy. Access to the key-safe is critical, of course, but it can be made very secure -- a special-purpose piece of hardware that requires passwords from n out of m key czars before access is granted, for example. Or the contents of the key safe can be encrypted via keys escrowed through a secret sharing mechanism -- Kent Crispin "No reason to get excited", kent(a)songbird.com the thief he kindly spoke... PGP fingerprint: B1 8B 72 ED 55 21 5E 44 61 F4 58 0F 72 10 65 55 http://songbird.com/kent/pgp_key.html

3 10

Cryptography Short Course
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Thu, 8 May 1997 22:09:58 -0400 (EDT) From: Christof Paar <christof(a)ece.WPI.EDU> To: DCSB <dcsb(a)ai.mit.edu> cc: Arlene Lowenstein <arlowenstein(a)jake.WPI.EDU> Subject: Cryptography Short Course MIME-Version: 1.0 Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: Christof Paar <christof(a)ece.WPI.EDU> WPI's Continuing Education Program is offering a 5-day short course in cryptography. I will be teaching the course from August 4-8, in Waltham. Waltham is 10 miles West of Boston. Please find below a detailed course description and a registration form. If you have any question about course contents etc., please feel free to contact me by email. For questions regarding registration, contact Arlene Lowenstein at: arlowenstein(a)jake.wpi.edu Best regards, Christof ************************************************************************* Christof Paar http://ee.wpi.edu/People/faculty/cxp.html Assistant Professor email: christof(a)ece.wpi.edu Cryptography Group phone: (508) 831 5061 ECE Department, WPI fax: (508) 831 5491 100 Institute Road Worcester, MA 01609, USA ************************************************************************* ----------------------------------------------------------------------- Worcester Polytechnic Institute 5-Day Short Course APPLIED CRYPTOGRAPHY AND DATA SECURITY Seminar Leader: Dr. Christof Paar Many of today's information technology applications have data security as a central system requirement. Applications such as wireless computer networks, electronic commerce, and many www applications rely heavily on a high degree of system security. This five-day course will provide you with an in-depth introduction to the field of applied cryptography. Virtually all important aspects of public-key and private-key algorithms as well as protocols will be introduced. The course keeps the theoretical background and technical applications well-balanced. You will leave the course with a solid, broad knowledge of state-of-the-arts cryptography. You will have skills to carefully choose and design a security scheme for a given application. Background Note: The seminar is based on a highly successful course which has been taught to more than 150 professionals in industry and graduate students on campus. COURSE OUTLINE Day 1, AM - Introduction Principles of cryptography. Classical algorithms. Attacks on cryptographic systems. Day 1, PM - Private-key algorithms Stream ciphers. Pseudo-random generators. One-time pads. Day 2, AM - Private-key algorithms Data Encryption Standard (DES): Function, performance, implementation, security. Overview on other modern block ciphers. Key length and long-term security. Day 2, PM - Usage of private key-algorithms Operation modes of block ciphers. Multiple encryption. Key whitening. Day 3, AM - Public-key cryptography Introduction. One-way functions. Some number theory. Day 3, PM - Public-key algorithms RSA: Function, performance, implementation, security. Recent attacks. Day 4, AM - Public-key algorithms The generalized discrete logarithm problem. Diffie-Hellman key exchange. ElGamal encryption. Elliptic curve cryptosystems. Day 4, PM - Protocol building blocks Digital Signatures. Hash Functions. Security Services: Privacy, authentication, integrity, identification, non-repudiation. Day 5, AM - Key distribution Key distribution protocols. Principle of Kerberos. Certificates. Trusted authorities. Day 5, PM - Identification Smart Cards. Principles of identification. Challenge-and-response protocols. Course summary. WHO SHOULD ATTEND Engineers and other technical professional who develop, implement, or assess information security applications in software or hardware. Technical managers who need a solid understanding of data security issues will also greatly benefit from the course. ABOUT THE INSTRUCTOR Dr. Christof Paar leads the Cryptography and Data Security group at WPI's ECE Department. His research interests include security issues in wireless and ATM networks, efficient algorithms for elliptic and hyperelliptic curve systems, and hardware implementation of cryptosystems. DATES AND LOCATIONS August 4 - 8, 1997 in Waltham, MA (10 miles from Boston) FEE $1795 for first registration $1625 for subsequent registrations --------------------- print and cut here ----------------------------- WPI CONTINUING EDUCATION REGISTRATION FORM Please print out, complete, and return this form to Office of Continuing Education, WPI, Worcester, MA 01609-2280, call (508) 831-5517 or FAX this form to (508) 831-5694. Make copies of this form for multiple registrations. Title of Seminar: APPLIED CRYPTOGRAPHY AND DATA SECURITY Date of Seminar: August 4-8, 1997, WPI Waltham Campus, Waltham, MA Name (Mr.)(Ms.) ___________________________________________________ Title _____________________________________________________________ Organization ______________________________________________________ Business Address __________________________________________________ City _______________________________________ State ________ Zip _________________________ Business Phone ____________________________ FAX _____________________ Home Phone ______________ Fee Enclosed (Make checks payable to WPI) ______ Bill my Company, P.O.# __________ Please charge my: VISA Mastercard Discover Name on card ________________________________________________ Exp. date _____________________ Card # ______________________________________________________ Signature ___________________________________________________ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To unsubscribe from the dcsb list, send a letter to: Majordomo(a)ai.mit.edu In the body of the message, write: unsubscribe dcsb Or, to subscribe, write: subscribe dcsb If you have questions, write to me at Owner-DCSB(a)ai.mit.edu --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

Re: Banking Secrecy and Nazi Gold
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- According to the archives, Tim May wrote: > I suspect the U.S. pressure on Swiss banks has a political dimension > related to forcing a New World Order on international banking. The > U.S. wants banking secrecy subject to U.S. control (so that banks > like Castle Bank, Nugan Hand Bank, Banco Ambrosiano, BCCI, and the > Bank of America can continue to be used for U.S. interests, and > only U.S. interests). I think this is the first time I've ever said this about Tim, whom I usually read first, but "That's nuts." The political game is simple: The Wiesenthal Center and the World Jewish Congress are in a pissing contest to see who can recover the most cash. (There are two different class action lawsuits going, one from each organization.) Senator Alphonse "I Love to Make Noise" D'Amato is pandering. Some former members of the intelligence community are involved, but that shouldn't be surprising given the fact that they grew up as Nazi hunters. In general I agree with Tim's argument and the mean (if not all the details) of the followups, but I'd like to restress a few things: 1) The reason Jews used Swiss banks is precisely that they were secret, fercryingoutloud. 2) Sure, some banks took advantage of the power disparity (even if the victims had little guarantee that they'd be able to recover their assets, if they didn't squirrel them away soon they'd be sure to go to the Nazis). That makes them scum. But screwing with bank secrecy ain't the way to fix that Reputation Problem. 3) The reason governments and not just banks & individuals are involved is that some unclaimed deposits went to the government, which sent them off to Eastern Europe. - -rich http://www.stanford.edu/~llurch/ -----BEGIN PGP SIGNATURE----- Version: 4.5 iQBVAwUBM3LIZpNcNyVVy0jxAQERfgIAiaOqRZrwRxyNWqRUo0ypLT4WDzawsdvB VxiYN3E/nw5k9ZL7AUQQes2AJHS3tDaN086rflJ0GHUwg4TFA8Vsng== =shYb -----END PGP SIGNATURE-----

1 0

Re: e$: In Vino Veritas
by Stephen Cobb, CISSP 17 Dec '03

17 Dec '03

Robert Thanks so much for a truly enjoyable and thought-provoking piece of writing. It gladdens my heart to know that there are still people out there who know what happened to the Romantics! But you do have to be careful about typing behavior with age. I live in Florida and yes, we have a lot of old folks, but a sadly significant number of the moralists are in their 20s and 30s. In Brevard County where I live (and shuttles are launched) they have banned nude sunbathing, even on Federal property (also thong bikinis and male swim wear that "permits discernible turgidity" -- by this standard most of the Olympic finalists in the men's 100 meters would have been breaking the law if Brevard County had been hosting). Much of the ban-the-nudist lobbying was done people well under 40. There was a great moment at the televised County meeting when a frail old man made his way to the podium and we all braced for another "skin is sin" speech. But this is what he said "I'm a nudist and believe me, you have no idea who else is." So, it is not age that makes folks stupid. My mother took me on a ban-the-bomb march when I was 6. I helped disrupt a tour by the all-white South African rugby team when I was 17. But in the town were I grew up we had both hippies and Nazi-loving, Paki-bashing skinheads (I use the term Paki-bashing only because that is what people called it). We also had Young Conservatives, aging beatniks, and leftists who were so far left they actually admired Stalin (they were so screwed up that, despite being atheists, they protested the British government's decision to deny a priest, jailed for helping the IRA blow up parts of Coventry, conduct mass in prison). Me, I'm 45 and hope I will be my own kind of libertarian until I die. My mother is in her 70s and still working for the cause of freedom and dignity. My brother quit banking to write security software, some of which is causing brains to hurt at the UK's DTI. But getting back to prohibition, do the words "when will they ever learn?" strike a chord? It is so damn obvious that prohibition=organized crime I can't believe it isn't genetic already, like not eating things that smell rotten. But I digress. A book worth reading on the subject, if only for the examples and footnotes, is "Ain't Nobody's Business If You Do: The Absurdity of Consensual Crimes in a Free Society" by Peter McWilliams Now available in paperback, published by Prelude Press. Personally, I look forward to reading more of your postings. Stephen Certified Information Systems Security Professional Owner, Cobb Associates: "An independent information technology & security consulting firm...since 1987" "The best weapon with which to defend information.. ..is information." Cobb, Guide to PC & LAN Security 2825 Garden, Suite 7-11, Titusville, Florida 32796 Tel: 1 407 383 0977 Fax: 0336 Email: stephen(a)iu.net Try http://www.2cobbs.com & http://www.cobweb.co.uk

1 0

FREE REFERRAL SERVICE
by MOBILE.CONNECTION＠texoma.net 17 Dec '03

17 Dec '03

HELLO!! THIS IS TO INFORM YOU THAT THERE IS NOW A FREE DOCTORS REFERRAL SITE FOR ALL CONCERNED PEOPLE LOOKING FOR QUAILIFIED DOCTORS,IN ALL 50 STATES. PLEASE LET YOUR DOCTORS KNOW THAT THIS SITE IS AVAILABLE, IF HIS NAME IS NOT YET POSTED, KINDLY PASS ON HIS INFORMATION SO WE CAN POST IT. DOCTOR'S INFORMATION REQUESTED: NAME TYPE OF SPECIALIST ADDRESS TELEPHONE STATE AND TOWN THE SITE IIS LOCATED AT: http://www.mobilconnect.net/ THANK AGAIN JOHN ......................................................................................................................................................... ALSO AT MY SITE ARE THE LINKS TO THE GREATEST CONNECTIONS TO ALL OF THE BEST SEARCH SITES THOUGHOUT THE WORLD. FOR PERSONS WHO WOULD LIKE FREE E-MAIL ADDRESSES, HERE ARE 2 THOUSAND THAT I COLLECTED RECENTLY,(the e-mail address are changed often) FREE, ALSO IS THE GREATEST BULK E-MAILER DEMO PROGRAM ..MY SPECIAL PRICE IS $100.00 ,(program only) , SO, DOWN LOAD THE DEMO AND AGREE WITH ME,, IT IS EQUAL TO THE BEST ONES OUT THERE RANGING FROM PRICES $300-$400. People who have there own WEB SITE now you can get the the best program to put yourself on al search engines automactly, and it updates itself and sends to new search engines, demo available People who do not want this program , can register with us and we send to all 200 plus sites, for a small fee. CIGAR LOVER WE HAVE GREAT TASTEING CIGARS AT UN- BEATABLE PRICES, GO TO OUR SITE FOR MORE INFORMATION NOTICE : I AM NOT SENDING BY A LIST , SO THERE IS NO REMOVAL AT THIS TIME.

1 0

64-bit CPU 10x faster in crypto?
by Bill Stout 17 Dec '03

17 Dec '03

During a Digital seminar, a statement was made that 64-bit CPUs are about 10x faster than a 32-bit CPU in dealing with crypto, and that Alphas are favorites of Crypto-affiliated Gov't agencies. I spoke with a reference within Digital and the following logic was presented: o A 128-bit key is processed in two 64-bit chunks, vs four 32-bit chunks, greatly reducing processing time. o The Alpha executes four instructions per clock cycle. o Alpha clock ratings are 600MHz this summer. o Caveat: The O.S. needs to support 64-bit processing (Digital UNIX or Linux, not NT). I'm concerned about the strength of personal/corporate crypto in face of large jumps in processing power. I do not subscribe to cypherpunks due to the volume, so please respond to me directly on this question. stoutb(a)pios.com Bill Stout

2 1

Re: [ADMINISTRATIVIUM] Cyclic codes
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

There's a rumor that Timmy May sells his dead relatives as fertilizer as they constitute the best shit in California. <<<< o(0-0)o -ooO-(_) Ooo-- Timmy May

2 1

EAR Revisions
by John Young 17 Dec '03

17 Dec '03

BXA has published in today's Federal Register a final rule for revisions and clarifications to all Parts of the EAR. Encryption is affected. http://jya.com/ear050997.txt (123K)

1 0