December 2003 - cypherpunks-legacy

Federal Key Recovery Demonstration Project ?!
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: 20 Oct 1997 14:29:39 -0400 From: Mark Atwood <zot(a)ampersand.com> (by way of rah(a)shipwright.com (rah-news)) To: rah(a)shipwright.com Subject: Federal Key Recovery Demonstration Project ?! Mime-Version: 1.0 Path: thing1.leftbank.com!thing2.leftbank.com!cam-news-feed2.bbnplanet.com!cam-news-hu b1.bbnplanet.com!cam-news-feed5.bbnplanet.com!news.bbnplanet.com!ftp.ampersand.c om!not-for-mail Newsgroups: talk.politics.crypto Organization: Ampersand, Inc. Lines: 62 NNTP-Posting-Host: colon.ampersand.com X-Newsreader: Gnus v5.2.40/Emacs 19.31 Xref: thing1.leftbank.com talk.politics.crypto:23766 X-Newsreader: Yet Another NewsWatcher 2.3.0 -----BEGIN PGP SIGNED MESSAGE----- Just saw the fallowing ad on pg 42 of Federal Computer Week, Vol 11, Num 33, Oct 20, 1997. If I was closer, I would go, just to see what the "enemy" has to demonstrate. ================================================== The Government Information Technology Services Board Federal Key Recovery Demonstration Project invites you to attend A TECHNOLOGY CONFERENCE Wednesday, November 15, 1997, Omni Shoreham Hotel, Washington DC 7.30 a. m. - 8: 00 a. m. Conference with exhibit demonstrations following from 8:00 a.m. - 5:30p.m. For details, visit out Web site: http://gits-sec.treas.gov or contact Lisa McGrady Pellegrin at (202) 293-3835 or Terry Painter at (202) 986-0200 Registration fee: $100.00 (includes breakfast, lunch) To register, please call and mail check by October 24, 1997 payable to: McPell Communications Company 1140 Connecticut Avenue, N.W. Suit 606, Washington, D.C. 20036 ================================================== -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: noconv Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface iQCVAwUBNEui9jecHWvdAD3dAQF2uAP+OJMD/t7wFl1YiHqS+P/Dor0D5lDXOk6S 0b4fkVqeBih/gRwM0UYOxqlpxh7uyHjXyQQIsaLRUtMD3f+Rg3vPkBHubGwPq513 98upODawMD5znT/xUT5TZHeWWxlnisBrmcH308jG1zLYh4Ls1qJat75n2ldj+HWI RhdMsNvIn/Y= =VJyz -----END PGP SIGNATURE----- -- Mark Atwood | Thank you gentlemen, you are everything we have come to zot(a)ampersand.com | expect from years of government training. -- MIB Zed --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

2 1

[rc5] The unknown message is...
by David McNett 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 It is a great privilege and we are excited to announce that at 13:25 GMT on 19-Oct-1997, we found the correct solution for RSA Labs RC5- 32/12/7 56-bit secret-key challenge. Confirmed by RSA Labs, the key 0x532B744CC20999 presented us with the plaintext message for which we have been searching these past 250 days. The unknown message is: Its time to move to a longer key length In undeniably the largest distributed-computing effort ever, the Bovine RC5 Cooperative (http://www.distributed.net/) under the leadership of distributed.net, managed to evaluate 47% of the keyspace, or 34 quadrillion keys, before finding the winning key. At the close of this contest our 4000 active teams were processing over 7 billion keys each second at an aggregate computing power equivalent to more than 26 thousand Pentium 200s or over 11 thousand PowerPC 604e/200s. Over the course of the project, we received block submissions from over 500 thousand unique IP addresses. The winning key was found by Peter Stuer <peter(a)dinf.vub.ac.be> with an Intel Pentium Pro 200 running Windows NT Workstation, working for the STARLab Bovine Team coordinated by Jo Hermans <Jo.Hermans(a)vub.ac.be> and centered in the Computer Science Department (DINF) of the Vrije Universiteit (VUB) in Brussels, Belgium. (http://dinf.vub.ac.be/bovine.html/) Jos only comments were that "$1000 will buy a lot of beer" and that he wished that the solution had been found by a Macintosh, the platform that represented the largest portion of his teams cracking power. Congratulations Peter and Jo! Of the US$10000 prize from RSA Labs, they will receive US$1000 and plan to host an unforgettable party in celebration of our collective victory. If youre anywhere near Brussels, you might want to find out when the party will be held. US$8000, of course, is being donated to Project Gutenberg (http://www.promo.net/pg/) to assist them in their continuing efforts in converting literature into electronic format for the public use. The remaining US$1000 is being retained by distributed.net to assist in funding future projects. Equally important are the thanks, accolades, and congratulations due to all who participated and contributed to the Bovine RC5-56 Effort! The thousands of teams and tens of thousands of individuals who have diligently tested key after key are the reason we are so successful. The thrill of finding the key more than compensates for the sleep, food, and free time that weve sacrificed! Special thanks go to all the coders and developers, especially Tim Charron, who has graciously given his time and expertise since the earliest days of the Bovine effort. Thanks to all the coordinators and keyserver operators: Chris Chiapusio, Paul Chvostek, Peter Denitto, Peter Doubt, Mishari Muqbil, Steve Sether, and Chris Yarnell. Thanks to Andrew Meggs, Roderick Mann, and Kevyn Shortell for showing us the true power of the Macintosh and the strength of its users. Wed also like to thank Dave Avery for attempting to bridge the gap between Bovine and the other RC5 efforts. Once again, a heartfelt clap on the back goes out to all of us who have run the client. Celebrations are in order. Id like to invite any and all to join us on the EFNet IRC network channel #rc5 for celebrations as we regroup and set our sights on the next task. Now that weve proven the limitations of a 56-bit key length, lets go one further and demonstrate the power of distributed computing! We are, all of us, the future of computing. Join the excitement as the world is forced to take notice of the power weve harnessed. Moo and a good hearty laugh. Adam L. Beberg - Client design and overall visionary Jeff Lawson - keymaster/server network design and morale booster David McNett - stats development and general busybody -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNE5sy7N5xKXkPF/DEQLBMwCfadBDxP97DhosT7ILs9vdYRha9nIAnRCl ydiRYhdAplj25nDSZNbXYILS =4dNQ -----END PGP SIGNATURE----- -/\/ugget ________________________________________________________________________ |David McNett |To ensure privacy and data integrity this message has| |nugget(a)slacker.com|been encrypted using dual rounds of ROT-13 encryption| |Birmingham, AL USA|Please encrypt all important correspondence with PGP!| ---- To unsubscribe, send email to majordomo(a)llamas.net with 'unsubscribe rc5' in the body.

4 4

World-wide GAK
by Jeffrey Gold 17 Dec '03

17 Dec '03

For those who thought GAK was merely a local political issue, isolated to those barbarians in the USA, one that they could afford to ignore and morally refuse to address -- Quelle surprise! It's spreading: FRANCE PROPOSES KEY ENCRYPTION LAW The French government has proposed a law that would mandate a key-recovery system for all encrypted electronic documents, a move that is opposed by the business community and the European Commission. Earlier this month, the European Commission rejected the key-recovery approach to encryption, which some believe would make it easier for competitors to gain access to a company's business secrets. "I do not say this is the best system," says the chief of France's Central Service for the Security of Information Systems. "It is the least bad in trying to find a balance between national-security interests, economic interests and the protection of personal privacy." (Wall Street Journal 20 Oct 97)

3 2

Re: PGP, Inc.--What were they thinking?
by spencer_ante＠webmagazine.com 17 Dec '03

17 Dec '03

With all due respect to Tim May: As a person whose been at work on a very long feature about PGP Inc. for Wired, I can tell you that businesses really don't care that much about PGP's civil liberties advocacy. In fact, its rep could hurt as much as help them. The Fortune 500 is much more pragmatic: They want solutions that work, that help them maintain security for their intellectual property and capital. To that extent, PGP 5.5--which enables IS directors to manage a public key infrastructure and enforce company-wide security policies-- is a step in the right direction. But with this new product, I agree that they run the risk of alienating their core user group of cypherpunks and hackers. Encryption is a very complicated topic that doesn't lend itself well to sloganeering and histrionics. And one major thing that needs to be pointed out: PGP's key recovery system is *voluntary and private*--not mandatory and gov. controlled, which is what the Feds and Louis Freeh have been pushing for. One potential positive side effect of PGP 5.5 is that it could realign the crypto debate and force people to consider this question: Whose back door should netizens be more worried about: Big Brother or The Boss? Spencer E. Ante Associate Editor THE WEB Magazine To: cypherpunks(a)toad.com, fight-censorship(a)vorlon.mit.edu cc: (bcc: Spencer Ante/PCWORLD) Subject: Re: PGP, Inc.--What were they thinking? At 1:45 PM -0700 10/22/97, Anonymous wrote: >>Agreed. What amazes me is how PGP, Inc. would decide this should be a core >>part of their company. "PGP for Business," indeed. What were they thinking? > >Um, maybe that they wanted to stay in business? This is a truism, that businesses want to stay in business. (And thrive, etc.) The interesting question is whether this action will help them. Why it may not is what we're talking about. For example, if PGP loses its "little guy fighting the system" image, and the company is seen as a major supplier of snoopware and GMR systems, it will have squandered the good will which led many of us to support PGP. And it's by no means clear that corporations will pay enough for PGP for Business if this good will has been squandered. The free status of most versions of PGP is indeed an impediment to PGP making a profit. That's an unchangeable situation. Lots of copies of PGP are already out there, and lots more are available from many sites. The "commercial use" vs. "personal use" dichotomy is largely unenforceable. If Joe Employee uses PGP 2.6 or even 5.0 for his messages, PGP, Inc. will have a very hard time proving in court that Joe or his employer can be held liable for this use (at most, maybe Joe will have to pay $50 or so...and probably not even that, as PGP 5.0 is not serialized (so far as I can find) and records aren't kept...Joe can just claim he did in fact buy it, blah blah). This means PGP, Inc. faces a Netscape-like battle in finding revenue sources. Will they succeed? Will people like us continue to give PGP, Inc. the good will it has enjoyed? Stay tuned. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

6 10

SSZ - ISDN repairs today...
by Jim Choate 17 Dec '03

17 Dec '03

Hi, As most of you are aware SSZ has been experiencing a great deal of ISDN stability issues the last 4-6 weeks (since the move to the new location). To date we have been through a cable throw from one trunk line to another which involved switching CO's. Since that throw we have seen intermittent outages lasting from a minute or so up to 15 minutes (perhaps longer but I didn't see them since logging is not always turned on). Well I get up this morning and find the ISDN exhibiting the exact same sort of intermittetent outages from last weekend, except now they ain't so intermittent. Seems the cool weather and light rain have exacerbated the issue such that we are in a nearly continous connect-disconnect cycle. We are still passing packets with no loss, beit slowly. I called SWBT and they are sending a installer out to put the line on another distinct pair as well as putting in a repeater to boost the pair-gain. Expect there to be intermittent outages of an hour or more today. If the fixes work we should be rock-solid again. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Freeh-style Encryption needed to fight infowar threat
by Tim May 17 Dec '03

17 Dec '03

I just saw the principle author of the recently released report of the "Commission on Critical Infrastructure Protection," interviewed on CNBC, a business program. Robert Marsh called for increased use of encyption to proect the nation's computer networks against hackers and crackers and info-terrorists. The catch? It's the FBI proposal he wants to see adopted. Personally, I think this issue, and Marsh in particular, are sleep-inducers to most people, so I don't see this as a driving force for GAK the way a building being blown up, or a child porn ring, will be. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

A5
by klockstone＠cix.compulink.co.uk 17 Dec '03

17 Dec '03

The A5 code in the back of Schneier's 'Applied Cryptography' seems to have some errors in it - has anybody else had a serious play with it? Keith.

1 0

Re: puff pieces vs tough crypto issues (Re: Singapore TOILET ALERT)
by Ariel Glenn 17 Dec '03

17 Dec '03

Kent Crispin writes: >They could wave around TIS's products (designed by noted cypherpunk >Carl Ellison, I believe), or NorTel's Entrust, just as well. Hell, in >a few months they may be able to wave around Adam Backs CDR product, >which also facilitates GAK...[deleted] sure, but PGP has a certain name recognition that appears to extend beyond the computing business community; ask your average cs student what PGP is and they'll have heard of it *and* its reputation. Ask them about Entrust and see if you get the same result. (I could do that here with my managers as a demo. :-) Now figure out what your representatives in Congress know: even less. So, PGP gets cited by Congress as an example, and the other corporations building in GAK or who have signed on to get that good export license for DES don't. Ariel Glenn ariel(a)columbia.edu

1 0

Re: PGP, Inc.--What were they thinking?
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

I should point out before starting that I now work for Verisign. This following personal opinion however and may not reflect any corporate policy that may or may not exist. I can understand the pressures on PGP to support key escrow. When I designed the Shen trust system for the Web I allowed for an escrow facility for much the same reasons that have been cited. If it was not for the unrelenting pressure from the US government to support GAK I am sure that commercial escrow would be a checkbox item. The problem is that as long as the pressure is there any step towards commercial escrow is also a step towards GAK. The problem with PGP's move is that it is the first significant break by the Internet software provider community. This will make it much easier for Netscape or Microsoft to cave in. It will also build the pressure on them. I wonder what would happen to Bills problem with the DoJ if he had a sudden change of heart. Somehow I don't see Netscape and Microsoft holding the line on GAK if PGP are happily exporting their product and grabbing market share. I really did not expect Phil Zimmerman to be the first to blink. I also don't understand it from the corporate perspective. PGP may be picking up some business in the corporate market but at the cost of alienating a significant part of the hacker community which has been his best supporter up till now. I would think his best strategy would have been to build on this customer base rather than sell it out at the first opportunity. If Phil Z. wants to get into the Enterprise market he is going to have to start speaking their language. Most companies today are looking for open standards. PGP may have been the de facto security solution three years ago but the reality today is several million copies of Comminicator and Explorer with S/MIME built in. If you are prepared to load certs manually for each person you communicate with you can even use the Web of trust model with S/MIME. Its easier if you can rely on a CA. I probably don't have to remind many people on this list that few people make security a priority although they are prepared to do so if it has little impact on them personally. I really don't want to get into a standards flamewar, the point I'm making is that this is a bigger issue in the Enterprise market than key escrow at this point. Phil claims to have an RSA license, if he wants to go after the enterprise market he can support S/MIME. Phill

4 3

Use crypto, face a death squad
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

There have been various rumours and comments over the past few years that the use of crypto in certain countries (Syria, Iraq, possibly China) is very dangerous for the end user, but very little actual evidence to substantiate this. About a week ago I got some evidence (well, something better than the usual rumours) on the situation with using crypto in Iraq which people might find interesting. I was talking to someone who worked for a large multinational corporation which maintains a comprehensive directory of who to contact in each country they operate in (basically every country on earth, this was before the gulf war so Iraq was included) for any kind of emergency. This consists of a huge file of data intended to cover every imaginable type of situation. Included in the information on Iraq was a comment to the effect that you should never, ever use any form of encryption when sending messages to the contact people there. He can't remember the exact details any more, but the implication was that any encrypted messages sent to them would result in them quietly disappearing. Since this was a very big company with a lot of sensitive information which it would go to great lengths to protect, I would assume they had very good reasons for advising against the use of crypto in this instance. Peter.

4 3