- cypherpunks-legacy - lists.cpunks.org

Life is not economics.
by Jim Choate 31 Jul '03

31 Jul '03

On Thu, 31 Jul 2003, Professor Rat. wrote: > the shoat brings it up,life is not propping up statist dictatorships either > so what have you done for us lately? Choate? What have you done at all? -- ____________________________________________________________________ We are all interested in the future for that is where you and I are going to spend the rest of our lives. Criswell, "Plan 9 from Outer Space" ravage(a)ssz.com jchoate(a)open-forge.org www.ssz.com www.open-forge.org --------------------------------------------------------------------

1 0

Re: Someone at the Pentagon read Shockwave Rider over the weekend
by Jim Choate 31 Jul '03

31 Jul '03

On Tue, 29 Jul 2003, Mac Norton wrote: > Tim has identified the problems, including what may be the most important > one, that the "market," unlike other such markets, is subject to gaming > for motives that are other than economic. Actually this is the fundamental failure of your view, Tim's, and most other CACL sorts. ALL markets are subject to parameters that are -not- subject to strictly economic motives. In fact a purely 'economic motive' isn't fundamentally about money, it's about either insecurity or power, it's about inter-personal relationships. It's about 'using'. -- ____________________________________________________________________ We are all interested in the future for that is where you and I are going to spend the rest of our lives. Criswell, "Plan 9 from Outer Space" ravage(a)ssz.com jchoate(a)open-forge.org www.ssz.com www.open-forge.org --------------------------------------------------------------------

1 0

RE: Secure IDE?
by Trei, Peter 31 Jul '03

31 Jul '03

> pgut001@cs.auckland.ac.nz[SMTP:pgut001@cs.auckland.ac.nz] wrote: > > > "Trei, Peter" <ptrei(a)rsasecurity.com> writes: > > >No info on chaining modes, if any, nor of IV handling. > > DES/ECB, originally with a 40-bit key, more recently with 56-bit and 3DES. > Keys generated by the manufacturer onto a USB dongle. No easy way to make > backups of the dongle. It's a messy tradeoff: If you want something like > laptop/data-theft-protection (which will suit the majority of the market), > then DES-40/ECB is fine, but you want to be able to back up the dongle > because > if that goes (and after multiple insertions and removals it will) you've > lost > all your data. OTOH if you want protection from the MIB the fragile > nature of > the key storage is probably a benefit, but then you want 3DES/CBC to go > with > it. At the moment you have laptop-theft-protection crypto and > MIB-protection > key storage. > > You can buy truckloads of these things on ebay for about $20 a pop if you > want > to play with one. > > Peter. > Color me dissapointed. It's a move in the right direction, but I wish they had followed through and done the right things: * [AES | 3DES]/CBC with a good distribution of IVs * User-generated keys (before initial disk setup, of course). * Shutdown on dongle removal. * Some kind of PIN or password protection on the dongle. eNova claims not to keep a database of keys (they don't say that 'there is no database of keys', which is a little different), and to get a key copied you have to send it to them. They do seem to supply a spare. Back a few years ago, I calculated that with the DES key search software then available, a single 200MHz machine could search 40 bits of keyspace over a long weekend. Today it would take a few hours. 40 bit DES is not secure against your kid sister (if she's a cypherpunk :-), much less industrial espionage. Quote from http://www.abit.com.tw/abitweb/webjsp/english/mb_spec.jsp?pPRODUCT_TYPE=Moth erBoard&pMODEL_NAME=SecureIDE : "40-bit DES (US Data Encryption Standard) is adequate for general users" Yeah. Right. Peter

1 0

RE: Secure IDE?
by pgut001＠cs.auckland.ac.nz 31 Jul '03

31 Jul '03

"Trei, Peter" <ptrei(a)rsasecurity.com> writes: >No info on chaining modes, if any, nor of IV handling. DES/ECB, originally with a 40-bit key, more recently with 56-bit and 3DES. Keys generated by the manufacturer onto a USB dongle. No easy way to make backups of the dongle. It's a messy tradeoff: If you want something like laptop/data-theft-protection (which will suit the majority of the market), then DES-40/ECB is fine, but you want to be able to back up the dongle because if that goes (and after multiple insertions and removals it will) you've lost all your data. OTOH if you want protection from the MIB the fragile nature of the key storage is probably a benefit, but then you want 3DES/CBC to go with it. At the moment you have laptop-theft-protection crypto and MIB-protection key storage. You can buy truckloads of these things on ebay for about $20 a pop if you want to play with one. Peter.

1 0

RE: Someone at the Pentagon read Shockwave Rider over the weekend (fwd)
by Jim Choate 31 Jul '03

31 Jul '03

> ---------- Forwarded message ---------- > Date: Tue, 29 Jul 2003 14:49:51 -0400 > From: "Trei, Peter" <ptrei(a)rsasecurity.com> > Over on Dave Farber's IP list, it's been pointed out that there > is a pre-existing, live, real-money market in futures on these > types of events. Go over to www.tradesports.com, and click on > 'Current Events' under 'Trading Catagories' on the left. Drill down > and you'll find things like 'WMDs will be found in Iraq on or before > Sept 31', the value of which has dropped from 80 to 25 over the > last few months. Which only goes to show how inaccurate and generaly confused these sorts of systems are. Based on what people feel rather than what they know. The failure of all free markets to conform to what 'economists' consider the ideal. This example actually blows your whole suppostion away. -- ____________________________________________________________________ We are all interested in the future for that is where you and I are going to spend the rest of our lives. Criswell, "Plan 9 from Outer Space" ravage(a)ssz.com jchoate(a)open-forge.org www.ssz.com www.open-forge.org --------------------------------------------------------------------

1 0

Re: Japan making RFID-trackable cash
by R. A. Hettinga 31 Jul '03

31 Jul '03

--- begin forwarded text Status: U User-Agent: Microsoft-Entourage/10.1.1.2418 Date: Thu, 31 Jul 2003 09:08:39 +0100 Subject: Re: Japan making RFID-trackable cash From: "David G.W. Birch" <dgw-lists(a)birches.org> To: Digital Bearer Settlement <dbs(a)philodox.com> Cc: Bob Hettinga <rah(a)shipwright.com> On 31/7/03 3:41 am, Bill Stewart e-said: > Japan's starting to add RFIDs to their 10000-yen (~$100) bills. > Notes will come with Hitachi's 0.3mm "mew-chip" To protect against cat-burglars? Regards, Dave Birch. P.S. It's "Mu" chip, as in the Greek letter. -- -- My own opinion (I think) given solely in my capacity -- as an interested member of the general public. -- -- mail dgw(at)birches.org, web http://www.birches.org/dgwb --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Pac Bell's Internet arm sues music industry over file-sharer IDs (fwd)
by Jim Choate 31 Jul '03

31 Jul '03

http://www.bayarea.com/mld/mercurynews/news/local/6424740.htm?template=cont… -- ____________________________________________________________________ We are all interested in the future for that is where you and I are going to spend the rest of our lives. Criswell, "Plan 9 from Outer Space" ravage(a)ssz.com jchoate(a)open-forge.org www.ssz.com www.open-forge.org --------------------------------------------------------------------

1 0

Re: Pentagon discovers Assasination Politics, deadpools
by Tyler Durden 31 Jul '03

31 Jul '03

Variola wrote... "As well as a feedback channel to the domestic psyops boys." Are we sure this idea (and TIA) wasn't actually floated by those same Psyops boys? Something seems a little strange about the notion that they'd telegraph their intentions on this idea. Seems to me if they wanted to do it they'd just do it, and possibly not even announce their involvement in it, creating a string of shell companies to fund their international terrorist operations...Oops. Sorry, that's Al Qaeda I'm talking about. -TD PS: Does Variola feel insulted if we do not address him with his rank? >From: "Major Variola (ret)" <mv(a)cdc.gov> >To: "cypherpunks(a)lne.com" <cypherpunks(a)lne.com> >Subject: Re: Pentagon discovers Assasination Politics, deadpools >Date: Wed, 30 Jul 2003 09:51:00 -0700 > >At 10:56 PM 7/29/03 -0700, Bill Stewart wrote: > >Assuming it can be legally structured as a "Futures Market", > >rather than as "Illegal Gambling", it could make money. > >(There are obviously some bets it's unlikely to handle, > >such as the bet that Idea Futures markets would be successfully >prosecuted > >as illegal gambling :-) > >*Real* futures markets are effectively integrating all the AP >type risks (plus others, like weather) relevant to their markets. > >The Pentagon plan was trying to get the same kind of >private but well-done research that real futures traders >do, with emphesis on issues of interest to it. > >As well as a feedback channel to the domestic psyops boys. > >CNN, etc. also perform a sort of gambling (probabilistic investment, >"futures"), in how they distribute >their resources in anticipation of regional "news". _________________________________________________________________ Add photos to your e-mail with MSN 8. Get 2 months FREE*. http://join.msn.com/?page=features/featuredemail

3 2

The Register - MCI denies national security 'compromised' (fwd)
by Jim Choate 31 Jul '03

31 Jul '03

http://www.theregister.co.uk/content/5/32074.html -- ____________________________________________________________________ We are all interested in the future for that is where you and I are going to spend the rest of our lives. Criswell, "Plan 9 from Outer Space" ravage(a)ssz.com jchoate(a)open-forge.org www.ssz.com www.open-forge.org --------------------------------------------------------------------

1 0

RE: Secure IDE?
by Trei, Peter 31 Jul '03

31 Jul '03

> pgut001@cs.auckland.ac.nz[SMTP:pgut001@cs.auckland.ac.nz] > > "Trei, Peter" <ptrei(a)rsasecurity.com> writes: > > >It's a move in the right direction, but I wish they had followed through > and > >done the right things: > > > >* [AES | 3DES]/CBC > > I get the feeling they use ECB for speed (heavy pipelining) rather than > cluelessness. > Possibly - they're using an ASIC, so I'd have thought that speed would not be the issue. I have not run the numbers. > >with a good distribution of IVs > > Where would you store them? The feature of this is that it's fully > transparent, so you can't store IVs anywhere. > I'm not really up on crypto file systems, but I beleive at least some use the sector address as the IV. IVs don't need to be random, secret, or unpredictable - they just need to be unrepeated. (I'm assuming sector-at-a-time encryption). > >* User-generated keys (before initial disk setup, of course). > > That one's the only thing I can't find a good technical reason for... > perhaps > it's just commercial, since they see the dongles as a revenue source and > will > sell you software to set up n dongles yourself, where price is > proportional to > n. > Having the user generate the key and load it on the dongle means that he has good assurance that the manufacturer doesn't have the key. Any kind of backup will open a possible route of attack. If the user can specify the raw key value (it's short - this is symmetric crypto), they can choose their own backup - up to and including writing it on paper and carefuly hiding it. > >* Some kind of PIN or password protection on the dongle. > > How would you do this without a custom BIOS (remember that their general > product is for dropping into any PC)? > We're talking about two different products. The ABIT is a MB, presumably with it's own custom BIOS, so that's not an issue there. > >40 bit DES is not secure against your kid sister (if she's a cypherpunk > :-), > >much less industrial espionage. > > I'm more worried about key backup - it's bad enough having > cheapest-possible- > components IDE drives without complicating it further with a second point > of > failure. In the meantime a better option is still the triumvirate of: > > - Sensitive data saved only to RAM disk. > > - 3DES-encrypted volume mounted as a filesystem, which I can back up in > encrypted form if necessary, and with all crypto done in software with > per- > sector random IVs, user-generated keys, and all the other stuff you > asked > for. > > - Encrypted swap. > > (Oh yeah, and a UPS so you're not tempted to temporarily save stuff to > disk > elsewhere in case the RAM drive goes away suddenly). > > >"40-bit DES (US Data Encryption Standard) is adequate for general users" > > > >Yeah. Right. > > If you're worried about Joe Burglar grabbing your laptop (for the value of > the > laptop) and your business data being leaked as collateral damage, or > someone > stumbling across your warez or pr0n, then it's probably adequate. Since > this > is what general users would be worried about, I'd agree with the > statement. > Anyone worried about more than that (probably about 0.01% of the market) > isn't > a general user any more. > > Peter.(G) > Peter (T)

1 0