- cypherpunks-legacy - lists.cpunks.org

cryptoIDs
by Trevor Perrin 02 Nov '03

02 Nov '03

Hi cypherpunks, First-time poster. I've lurked awhile. I'm working on a system for key infrastructure, and I'd like to invite criticism, comments, help, etc., from anyone interested. You can find the paper and code here: http://trevp.net#cryptoID Here's a summary - The system is based on a critique of X.509-style PKI. The critique is this: Any key infrastructure has to handle the twin tasks of: - Public-key distribution (Bob finding Alice's public-key) - Private-key management (Alice keeping her private-key(s) secure yet accessible) PKI handles the former through certificates, and the latter through certificate revocation. These force a tight coupling between subjects (e.g. Alice) and CAs - subjects must contact CAs to get their certificates, and also to revoke keys and renew certificates. Since the function of Trusted-Third-Parties (e.g. CAs) is to provide information to *relying parties* (e.g. Bob), I argue that this coupling of *subjects* with TTPs is inappropriate for a decentralized environment like the Internet. In such an environment, different relying parties will trust different TTPs. For the subject to procure certificates that would satisfy all these RPs, he'd have to predict the future to know which RPs will contact him, read the minds of these future RPs to know what they care about, and then contact the hundreds of TTPs these different RPs trust to procure relevant certificates. It would be better to decouple subjects from TTPs, so that subjects could perform private-key management without the involvement of TTPs, and so that TTPs could perform key distribution without the involvement of subjects. The key to this separation of tasks is to use fingerprints as the interface between the "private" and "public" domains: the subject will use private-key management to perpetuate a long-lived public-key. The fingerprint of this key will be the subject's "cryptographic identifier" - it will be passed around by TTPs and RPs to "speak about" the subject. Now, private-key management and public-key distribution can proceed independently. For private-key management, the subject will most likely keep his long-lived "root key" in a safe place, and use it only occasionally to certify "subkeys". The subject may also do things such as splitting the root key into shares, using proactive and/or threshold signing schemes, using "threshold subjects" a la SPKI, using multiple layers of subkeys as "intermediate CAs", using revocation/revalidation to quickly disable compromised subkeys, or even just giving his root key to someone he trusts who has better security, and more competence with these techniques, than himself. For public-key distribution, online trusted directories (such as DNS, LDAP, XKMS, etc.) should replace CAs. Users would have address books containing trusted fingerprints, which they populate manually or by querying directories. In sum, the argument is that fingerprints are better than certificates for key distribution, but that fingerprint key distribution is most effective when supported by cert-based private-key management, to secure the long life of the fingerprints. This is similar to PGP (without the Web of Trust) - PGP uses fingerprints to authenticate distributed keys, and has subkeys that can be used for private-key management. However, if you take this approach seriously, PGP's fingerprints and subkeys aren't good enough. PGP fingerprints are too long, and PGP subkeys don't support important techniques like revalidation, threshold subjects, or multiple layers of subkeys. So the paper presents "cryptoIDs", which are 20-character-long fingerprints; and cryptoID certificates, which are a certificate format designed solely for private-key management. Anyways, I'm interested to hear what anyone thinks. Thanks, Trevor

1 0

Re: Spelling corrections are now export-controlled
by Major Variola (ret) 02 Nov '03

02 Nov '03

At 11:12 AM 11/2/03 -0800, Steve Schear wrote: >At 01:47 AM 11/2/2003 -0800, Major Variola (ret) wrote: >>"Congress shall make no law respecting an establishment of religion, or >>prohibiting the free exercise thereof; or abridging the freedom of >>speech, >>or of the press; or the right of the people peaceably to assemble, and >>to >>petition the Government for a redress of grievances." >>Everything else is, of course, allowed. -Sunder > >So, for those of us who worship science it looks like we're home free. It >seems that such a religious bent isn't too far out. Both the recognized >religions and scince fall within the academic category of philosophy. Both >attempt to explain the nature of the world around us. Has there ever been >a 'formal' attempt to legitimize science as a religion? 1. You might try "empirical gnostic" when dealing with lawyer types. 2. There's also the Church of Strong Cryptography. Its kind of uptight though, it has sins, even mental sins, like considering arithmetical methods of producing random digits. 3. Always remember that the 14th restricts not only Congress but State and local vermin. And everything they give money to.

1 0

Re: Spelling corrections are now export-controlled
by Major Variola (ret) 02 Nov '03

02 Nov '03

At 04:05 PM 11/2/03 +1300, Peter Gutmann wrote: >Still... it occurs to me that the State >department is setting itself up for a DOS attack -- what would happen if 10% >of all US academics were to apply for one of these licenses? It would facilitate the blacklisting and later roundup. And hmm, where do academics get their $ from? Any questions? Imagine McCarthy with computers. McCarthy on a paranoid speed binge, with computers. Or don't imagine, just visit DC. Hmm, if it didn't cause problems for the list maintainers I'd post some technical queries from a spoofed address from an axis of whatever nation. Then again, maybe I'm from an axis country spoofing the US, and you're all as fucked as a Chinook with a SAM locking onto its tail :-) ---- Of course there are limits in regards to freedom of speech. They are as follows: "Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances." Everything else is, of course, allowed. -Sunder

2 1

Re: ECC and blinding.
by James A. Donald 02 Nov '03

02 Nov '03

-- James A. Donald: > > Simple Chaumian blinding works fine on EC. On 31 Oct 2003 at 15:26, Adam Back wrote: > So Chaumian blinding with public exponent e, private exponent d, and > modulus n is this and blinding factor b chosen by the client: > > blind: > b^e.m mod n -> > sign: > <- (b^e.m)^d mod n > = b.m^d mod n (simplifying) > > and divide by b to unblind: > m^d mod n > > how are you going to do this over EC? You need an RSA like e and d to > cancel. See:"Anonymous Electronic Cash" http://www.echeque.com/Kong/anon_transfer.htm Lower case letters represent integers, capital letters elliptic curve points. Let k be the banks secret key. The bank promises to pay a specific sum of money for any secret of the form ( x, P), such that P = k * H(x) where H is a hash function mapping random integers onto points on an elliptic curve and k is a secret known only to the token issuer Bob has an existing old used token of this form, and therefore knows that V= k * U even though he does not know k. Bob invents the random numbers t and q, constructs an elliptic point R = t *U + Hash( q ) and pays the bank to construct T= k * R He then calculates Q = T- t * V He now has a new token ( q , Q) of the required form, even though the Bank did not generate Q, has never seen it before, and when it sees it will not recognize it as having any relationship to T or R. --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG ONKujWd8zHpibnZny18642N1+yn2u22b10pYMq9S 4JTKi/HgEDA3K9dghxgfMcU8LPnOgG8ibhebtAfJR

2 1

Spelling corrections are now export-controlled
by pgut001＠cs.auckland.ac.nz 01 Nov '03

01 Nov '03

Looks like the USG is going to outdo its ITAR silliness of a few years ago with something even more ridiculous: Grammar and spelling corrections now require an export license. The following was forwarded to me by Clark Thomborson: -- Snip -- Dear colleagues, If I'm reading http://chronicle.com/free/2003/10/2003100201n.htm correctly, any US citizen must get a license (from the US State department) before providing editorial services to any citizen or resident of any country embargoed by the US. ... The Treasury Department's response on Wednesday, in a letter to the IEEE, affirmed its position that editing scholarly papers provides a service to authors. "U.S. persons may not provide the Iranian author substantive or artistic alterations or enhancement of the manuscript, and IEEE may not facilitate the provision of such alterations or enhancements," wrote R. Richard Newcomb, director of the Office of Foreign Assets Control. Trade policy prohibits "the reordering of paragraphs or sentences, correction of syntax, grammar, and replacement of inappropriate words by U.S. persons," according to the letter. The institute may apply for a license to edit papers, Mr. Newcomb wrote. ... I guess this embargo would apply to professors as well as to editors of technical journals headquartered in the US, although I'm not keen to ask the State department for a ruling on this! Apparently this embargo on editorial services applies to Iran, Cuba, Iraq, Libya, and Sudan. I guess I must check http://www.ustreas.gov/offices/eotffc/ofac/sanctions/index.html frequently, if I wanted to be a really obedient US citizen. Wow. I have to laugh, but of course it's not really funny unless you look for the humourous side. For example I have tried to infer the public-policy objectives that might be (in some bureaucrat's mind) served by this regulatory decision. Perhaps one of the objectives is to make it easier to recognise terrorists -- some terrorists will have bad grammar when they speak English, and no US citizen will dare to help them improve it! (This could be good new for the Kiwi English-education industry I guess, but if NZ did this in a big way there might be diplomatic repercussions or even trade sanctions.) Of course there'll be a lot of "false positives" in any terrorist recognition- by-grammar scheme but hey, it's apparently good public policy (from the perspective of the US Congress) to hassle (or maim, kill, or whatever seems appropriate at the time) a large number of non-US citizens if this might save a few US lives? Anyway I don't have to worry about being falsely recognised as a terrorist becuz my grammer and speling is alwys good. I don't think I'll bother to apply for a license to supply editorial services to citizens of embargoed countries. Still... it occurs to me that the State department is setting itself up for a DOS attack -- what would happen if 10% of all US academics were to apply for one of these licenses? Clark

1 0

Jim Bovard on C-SPAN, Sunday 11/02 8-9pm Booknotes, Terrorism and Tyranny
by Freematt357＠aol.com 01 Nov '03

01 Nov '03

Author James Bovard will appear on C-SPAN 's Booknotes with Brian Lamb this Sunday, 11/02, from 8 pm to 9 pm (I believe it may re-air from 11 pm to midnight). Bovard will be discussing his new book "Terrorism and Tyranny: Trampling Freedom, Justice, and Peace to Rid the World of Evil". I've read the book and recommend it highly. For program notes go to: http://www.booknotes.org/Program/?ProgramID=1752 For additional information on the works of James Bovard please go to: http://www.jimbovard.com bfrom the publisher's website "The war on terrorism is the first political growth industry of the new Millennium." So begins Jim Bovard's newest and, in some ways, most provocative book as he casts yet another jaundiced eye on Washington and the motives behind protecting "the homeland" and prosecuting a wildly unpopular war with Iraq. For James Bovard, as always, it all comes down to a trampling of personal liberty and an end to privacy as we know it. From airport security follies that protect no one to increased surveillance of individuals and skyrocketing numbers of detainees, the war on terrorism is taking a toll on individual liberty and no one tells the whole grisly story better than Bovard. Regards, Freematt-

1 0

Re: Chaumian blinding & public voting?
by Major Variola (ret) 01 Nov '03

01 Nov '03

First, much thanks to Howie Goodell for his reply. (Note that printing stuff on transparencies was proposed (by Shamir?) some time ago, perhaps for quorum-required info.) At 09:17 PM 10/31/03 -0600, Neil Johnson wrote: >On Friday 31 October 2003 12:10 pm, Major Variola (ret) wrote: >> Is is possible to use blinding (or other protocols) so that all votes >> are published, you can check that your vote is in there, and you >> (or anyone) can run the maths and verify the vote? Without being >> able to link people to votes without their consent. >> > >Doing this would allow vote buyers to verify a voter voted the way they >wanted. Yeah, so? I've voted from home for a decade. Nothing stops me from showing Vinny (Vinny the votebuyer, he's Eve's cousin on Mallory's side) my ballot before I mail it. Or registering my cat to vote. They are illegal, and detectable, that suffices. [Note to furriners: in the US you don't need "ID" to register or to vote, just a signature, and for that an X suffices.] Although I *do* agree with you --resistance to votebuying is a desirable feature if you can have it. (Insert cellphone-with-camera-in-voting-booth discussion here.) (And yes, voting at home is succeptible to spousal coercion. Better than queueing up with the sheeple! Which is also a form of *meteorological* coercion, folks don't go out in crappy weather. Also snipers and bombs, in places with that kind of weather, will deter centralized voting.) >One option might be to give the voter a MAC of their ballot and then print the >MAC's in the paper. The voter could check to see if their vote had been >altered. That's a good idea. I don't think Chaum's transparency-printing scheme does this. Its also possible to write-in candidates for elections you don't care about as "tracers" to make sure your ballot (albeit not other votes in the same bundle) made it. I voted for Monica Lewinsky a few times that way. >I still think far better methods for improving voter turn out other than >Internet voting are: >1. A National Election Holiday (but in the middle of the work week so people >can't use it to extend a vacation). Too expensive. >2. Couple the Election with a National Lottery with local, state, and national >prizes. With appropriate delink of voter's identity from the way they voted >of course. Well, lotteries are evil in my book, but they certainly do inspire the innumerate sheeple. I doubt it would work unless the "prizes" were huge --I only get DoS'ed by queues at 7-11s when the prizes orders of magnitude larger than 1e6. >(I'm not claiming that this would actually improve things overall, just >increase voter turnout). Have a hollywood actor run. Or have recalls every year. Worked in Calif! On the other hand, perhaps it should be made harder to vote. Democracy is mob rule, after all. Testing citizens on the Bill of Rights would be a good start.

1 0

anonymous weblog publishing
by Nomen Nescio 01 Nov '03

01 Nov '03

http://invisiblog.com/ Coolt Uses Mixmaster and GPG

1 0

Cisco LEAP (fwd)
by J.A. Terranson 31 Oct '03

31 Oct '03

I thought this forum would be able to provide the good gentleman with more accurate data that the typical that is to be found on the below mentioned mailing list. -- Yours, J.A. Terranson sysadmin(a)mfn.org "Every living thing dies alone." Donnie Darko ---------- Forwarded message ---------- Date: Fri, 31 Oct 2003 08:11:59 -0800 (PST) From: No Man <noman4222(a)yahoo.com> To: pen-test(a)securityfocus.com Subject: Cisco LEAP I'm sure everyone is aware of the recent discussion regarding LEAP and it's suceptiblity to dictionary attacks. As I understand it, it is basically the MS-CHAP problem: the 16 byte RC4 hash is padded with 5 nulls, split into three 7 byte chunks, then each chunk is encrypted with DES. The last chunk, since you know it has 5 nulls, is pretty easy to get That gives you the last two bytes of the hash, which you then compare for matches with the last two bytes in a precompiled dictionary of hashes. What about using a very large dictionary of all possible combinations for a given password length to, in effect, "brute force" it? Take for example a 6 character password made of lowercase letters and numbers. 36^6 works out to about 2.2 billion possibilities. Your dictionary or 2.2B rc4 hashes would take up roughly 40GB. I guess the plain text that the hash was calculated from would be in there too, so it would be a little larger, but suffice it to say that it would fit on a fairly typical hard drive. So, I'm wondering several things. Consider typical newer Intel hardware. 1) what would it take time-wise to create the dictionary? 2) how long would it take to cycle through 40 gigs of hashes to find the matches? 3) how many matches on the last two bytes of the hash are there likely to be? Thanks in advance for any help in deciding how big of an issue this really is! Michael __________________________________ Do you Yahoo!? Exclusive Video Premiere - Britney Spears http://launch.yahoo.com/promos/britneyspears/ --------------------------------------------------------------------------- Network with over 10,000 of the brightest minds in information security at the largest, most highly-anticipated industry event of the year. Don't miss RSA Conference 2004! Choose from over 200 class sessions and see demos from more than 250 industry vendors. If your job touches security, you need to be here. Learn more or register at http://www.securityfocus.com/sponsor/RSA_pen-test_031023 and use priority code SF4. ----------------------------------------------------------------------------

1 0

ECC and blinding.
by Neil Johnson 31 Oct '03

31 Oct '03

Will ECC work with blinding (Chaum, Brands, etc.) techniques? Just curious. -- Neil Johnson http://www.njohnsn.com PGP key available on request.

4 4