- cypherpunks-legacy - lists.cpunks.org

Further PGP Security Doubts
by Graham Toal 10 Sep '93

10 Sep '93

In article <199308261827.AA25477@xtropia> an31144(a)anon.penet.fi writes: > I have been seeing yet more criticisms of PGP, this time from some > character calling himself "Raymond Paquin." He claims to be a > professor of mathematics who has been working at an unnamed university > exclusively on cryptographics for the past twelve years. He implies > that he is working for some government in a classified capacity and is > thus unable to either publish or discuss the matter openly. I missed that one (had <pressing> matters to attend to ;-) ) - could someone repost it please? I'd quite like to see if my text style analysis skills are still working :) G -- Personal mail to gtoal(a)gtoal.com (I read it in the evenings) Business mail to gtoal(a)an-teallach.com (Be careful with the spelling!) Faxes to An Teallach Limited: +44 31 662 4678 Voice: +44 31 668 1550 x212

1 0

Mailer hooks for PGP
by Graham Toal 10 Sep '93

10 Sep '93

In article <9308271722.AA11690(a)ah.com> hughes(a)ah.com writes: > >check your public ring and automatically sign/encode outgoing mail to > >eligible users > > As a general rule, mere presence of a key on a keyring should not > indicate that this person wishes to receive encrypted mail. There > should be a separate installation for that, either by an enhanced > alias file or similar. There are many for whom reading encrypted mail > is not always desirable, because the effort required to download it > and decrypt it is more time than the content is worth. I myself fall > into this category, unfortunately. This is very true. I hacked my mailer to encrypt when possible, and it drove Phil Zimmerman batty every time I mailed him and forgot to override it. G -- Personal mail to gtoal(a)gtoal.com (I read it in the evenings) Business mail to gtoal(a)an-teallach.com (Be careful with the spelling!) Faxes to An Teallach Limited: +44 31 662 4678 Voice: +44 31 668 1550 x212

1 0

No Subject
by koontzd＠lrcs.loral.com 10 Sep '93

10 Sep '93

>From: "David LANDGREN, PUB " <David.D.L.LANDGREN(a)pub.oecd.fr> >To: cypherpunks(a)toad.com >Subject: ... long live DES (sic) >Importance: Normal >Status: R > >>>>This chip takes a single plaintext/ciphertext pair and quickly tries >>>>DES keys until it finds one that produces the given ciphertext from the >>>>given plaintext. > >It's all very well to be able to crack DES in 3.5 hours, but I don't know >of too many people who obligingly send out the plaintext and cyphertext of >a message together, or in some other way combinable. If U can get the >plaintext of a DES-encrypted msg then U don't need to dick around with DES >anyway. No-one ever said it was bulletproof; a direct consequence is that DES users change their keys awful frequently. The way to get plaintext is through what is known as revealed-plaintext, where you can with a high degree of accuracy 'guess' part of the plaintext of a message, such as "From: Col. Dimwitt" in a message format, or the title of a paper or document, which is usally unclassified and knowable from another source. Fearing such, our illustrious 3 letter governmental organization implemented with the advent of electronic crypto gear (set your way back machine, sherman) something called traffic flow security, where on a radio net or dedicated line a cryptographic stream continously runs. The idea is to make it hard to distinguish boundaries of messages, and thus revealed-plaintext. This also allows the use of the caveat - EFTO (Encrypted For Transmission Only) seen on unclassified messages, hey the line was otherwise idle, waiting for classified traffic, right? Modern communications are swinging toward the use of packets, which beside allowing traffic analysis unless the transmission medium is denied (Such as using link encryption as a super encryption, or dedicated lines, etc.). The way to offset to offset the vulnerability to revealed-plaintext attacks is to use filling where some random data followed by a sync or start of message symbol preceeds the the actual message. All message traffic should be encrypted in general, making it hard to separate the wheat from the chaff. Ideally the only unencrypted data should be that required for operating the communications protocol, including denial of packet ordering if possible. There's a paper found on the NIST anonymous ftp site entitled 'Security in ISDN' by William E. Burr that can be informative. Its available in PostScript and is around 70 pages long.

1 0

Re: ... long live DES (sic)
by smb＠research.att.com 10 Sep '93

10 Sep '93

It's all very well to be able to crack DES in 3.5 hours, but I don't know of too many people who obligingly send out the plaintext and cyphertext of a message together, or in some other way combinable. If U can get the plaintext of a DES-encrypted msg then U don't need to dick around with DES anyway. No-one ever said it was bulletproof; a direct consequence is that DES users change their keys awful frequently. It's not that simple; Wiener's design is indeed a major breakthrough (for the open literature, of course). First of all, one can often guess probable plaintext for some of the message. Here's the first line of your note as it (apparently) left your machine: Date: 10 Sep 93 10:30:12 GMT If I've ever received mail from you, and hence know that format, I know at least the first 6 bytes, and the format of the next two. If I know the date of the intercept, I have even more. Poof -- a crib. I can do even better. Look at the $10,000,000 machine -- the one with a 21-minute solution. I can afford to try several guesses for where the string `Date: ' occurs. It doesn't take that much more complex a chip to look for obvious variants, such as that string occuring shifted over one or two bytes in either direction. You may get some false positives, but a second-order search machine can then apply more complex heuristics to possible keys returned by Wiener's design. And historically, enemies have been able to get probable plaintext -- or even some chosen plaintext -- for at least a few messages. Read ``The Codebreakers'' or ``Seizing the Enigma'' for many such examples. There's one more step here, described in detail in Garon and Outerbridge's ``DES Watch'' paper. If the DES session key is transmitted encrypted by DES using a 56-bit master key, you're dead meat. I can crunch for weeks to recover one session key, using many possibilities for the plaintext and its location in the ciphertext. But once I recover that long-gone session key, I can use it as the known plaintext to recover your master key. And after that, the jig is up. No, there should be no mistake about it. Single DES is *dead*, for any application where recovery of a single session key is bad. If you want to stick with single DES, you need to change session keys very often (every few seconds against an enemy who can build a $10M machine), and you need to distribute session keys by some other mechanism (i.e., RSA, Diffie-Hellman, triple DES). --Steve Bellovin

1 0

Cracking DES - A practical implimentation?
by ferguson＠fiber.sprintlink.net 10 Sep '93

10 Sep '93

On Thu, 09 Sep 93 16:14:56 -0700, <gnu(a)toad.com> John Gilmore wrote - > Be the first on your block! No kidding. I just ftp'd the des_key_search.ps file from ftp.eff.org and browsed through the first few pages (hats off to Michael for a fine piece of work). This is indeed an important milestone and will have an impact on the cryptographic implementations used by banks, etc. in the very near future. It should be interesting to see what the future holds .... > The paper was written as a warning to DES users (bankers) and their > customers (depositors). DES is used to protect electronic money > transfers among banks all over the world. Several billion dollars per > day are moved in this way. Within a day of finishing the machine, a > criminal could easily pay back the $1.5M in capital. In the second > day, they'd have the capital required to build a second machine, and > in the third day a positive cash flow would begin. Banks can do > nothing to stop this -- if they shut down their comm links, they go > out of business; if they keep moving money over them, intruders suck > money out at will. I recommend not keeping your money in banks... ...and in another communique - > Oho! I now suspect why RC2 and RC4 must remain trade-secret...NSA > doesn't want people to know what particular internal algorithm > features their brute-force chips are capable of handling! I recall > the discussion of how RC2/4 were invented; NSA told the designer > (since identified as Ron Rivest): "No, this is too big; weaken this > over here; do fewer rounds here; etc..." What resulted was suitable > for NSA brute-force using chips they had readily available. It's > possible that simple changes to the algorithm would render it much > less penetrable by NSA's current hardware. Ron even knows *which* > changes, and I encourage him to tell us. That would be an interesting revelation, wouldn't it? ,-) _____________________________________________________________________________ Paul Ferguson Mindbank Consulting Group fergp(a)sytex.com Fairfax, Virginia USA ferguson(a)icp.net

1 0

Re: "Code Warriors" Article in "Metro" Newspaper
by doug＠netcom5.netcom.com 10 Sep '93

10 Sep '93

tcmay(a)netcom.com (Timothy C. May) said: >Julian Dibbell's excellent article that appeared in the "Village >Voice" (August 3rd, cover story) is the *cover story* as well in the >latest "Metro" newspaper, the free San Jose area paper (but we get it >down here in Santa Cruz as well). Over lunch yesterday I was telling a friend (who had previously exhorted me to find folks on the net more appropriate than sci.crypt to discuss crypto schemes with) about discovering cypherpunks, and on our way out he noticed this Metro issue, commenting "Zeitgeist." Quite. :-) It quotes Tim, btw: You can get further away in cyberspace than you could in going to Alpha Centauri", says Tim May, and he should know. Before he retired seven years agao, a wealthy man at age 34, May was a reasonably illustrious corporate physicist. Now he's a Cypherpunk, part of a loose-knit band of scrappy, libertarian-leaning computer jockeys who have dedicated themselves to perfecting and promoting the art of disappearing into the virtual hinterlands. Concentrated in Silicon Valley but spread out across the country and as far away as Finland, the Cypherpunks maintain daily e-mail contact, collaboratively creating and distributing practical software answers to modern cryptography's central question: How to wrap a piece of digital information in mathematical complexity so dense that only literally astronomical expenditures of computer time can breach it? "Some of these things sound like just a bunch of fucking numbers," May explains. "But what they really are is they're things which in computability space take more energy to get to than to drive a car to Andromeda. I'm not kidding. I mean, you can work the math out yourself." Well, no, you probably can't, but even those unversed in rocket science can appreciate the social value of such calculations... And Eric: "Cryptography is a greater equalizer than the Colt .45," says Eric Hughes, the long-haired, cowboy-hatted and not entirely lapsed Mormon who, along with May, conceived the Cypherpunks just seven months before the Clipper hit the fan. "These are power-leveling techniques," he adds, pointing out that the hermetically sealed voice-and-data channels that could arm every citizen against state wire-surveillance are just the simplest of the crypto toys the Cypherpunks are playing with. Nicely provocative article. Doug -- Doug Merritt doug(a)netcom.com Professional Wild-eyed Visionary Member, Crusaders for a Better Tomorrow Unicode Novis Cypherpunks Gutenberg Wavelets Conlang Logli Alife HC_III Computational linguistics Fundamental physics Cogsci SF GA VR CASE TLAs

1 0

Re: Crack DES in 3.5 hours for only $1,500,000!
by smb＠research.att.com 10 Sep '93

10 Sep '93

Oho! I now suspect why RC2 and RC4 must remain trade-secret...NSA doesn't want people to know what particular internal algorithm features their brute-force chips are capable of handling! I recall the discussion of how RC2/4 were invented; NSA told the designer (since identified as Ron Rivest): "No, this is too big; weaken this over here; do fewer rounds here; etc..." What resulted was suitable for NSA brute-force using chips they had readily available. It's possible that simple changes to the algorithm would render it much less penetrable by NSA's current hardware. Ron even knows *which* changes, and I encourage him to tell us. I'll let Rivest speak for himself about NSA's influence -- but I've spoken to cryptographers who've seen the algorithm (under non-disclosure agreements), and they say that RC2 and RC4 are quite strong *if* you use a long enough key. They're algorithms with variable-length keys, and their strength -- and not just their resistance to exhaustive search -- is related to the key size used. The gotcha is that only the 40-bit version is exportable. But we don't need stories about weakened algorithms to know that NSA can crack 40-bit RC2/4; they'd never have granted a license otherwise. (And what does that tell us about 512-bit RSA?) One more point -- it's been claimed that RC2 and RC4 have an inherently- slow key setup mechanism. That can slow down brute-force attacks tremendously, since it then takes a long time to try each case. But it's fine for point-to-point encryptions, where you can amortize that overhead over many messages. --Steve Bellovin

1 0

... long live DES (sic)
by David LANDGREN, PUB 10 Sep '93

10 Sep '93

>>>This chip takes a single plaintext/ciphertext pair and quickly tries >>>DES keys until it finds one that produces the given ciphertext from the >>>given plaintext. It's all very well to be able to crack DES in 3.5 hours, but I don't know of too many people who obligingly send out the plaintext and cyphertext of a message together, or in some other way combinable. If U can get the plaintext of a DES-encrypted msg then U don't need to dick around with DES anyway. No-one ever said it was bulletproof; a direct consequence is that DES users change their keys awful frequently. David Landgren <david.landgren(a)oecd.fr> <dlandgren(a)bix.com> [standard disclaimer: this is my personal point of view] A B O L I S H F E A R -- E S T A B L I S H T R U S T

1 0

Crack DES in 3.5 hours for only $1,500,000!
by gnu 10 Sep '93

10 Sep '93

Be the first on your block! Michael Wiener <weiner(a)bnr.ca> produced a complete design for a DES key search machine, which he presented in the "rump session" at Crypto '93 last month. He designed a single custom chip which can do 50 million test encryptions per second, and the boards and racks and frames into which it fits. The full design has about 60,000 copies of the chip, solves DES in 3.5 hours, and is fully described in the paper. Here is an excerpt from his conclusions: It is possible to build a $1 million machine that can attack DES and recover a key in an average time of 3.5 hours. The machine uses a known plaintext to exhaustively search through the DES key space and could be developed for $500000 in about 10 months. Because a great deal of detail has gone into the design of the key search machine, we can have high confidence in the assessment of its cost and speed. The key search design presented here is one to two orders of magnitude faster than other recently proposed designs. Even cryptosystems with 64-bit keys may be vulnerable. If DES were modified to use 64-bit keys, there would be 2**8 times as many keys to search through, and a $10 million machine would take an average of 3.7 days to find a key. It is possible to build a key search machine that can support a range of modes of DES with little penalty in run-time. A $1 million machine would take 8 hours on average to find a key used in 1-bit CFB mode and 4 hours on average for any of ECB, CBC, 64-bit OFB, 64-bit CFB, or 8-bit CFB mode. This work shows that exhaustive DES key search is alarmingly economical. If it ever was true that attacking DES was only within the reach of large governments, it is clearly no longer true. A fairly painless way to improve security dramatically is to switch to triple-DES. The paper was written as a warning to DES users (bankers) and their customers (depositors). DES is used to protect electronic money transfers among banks all over the world. Several billion dollars per day are moved in this way. Within a day of finishing the machine, a criminal could easily pay back the $1.5M in capital. In the second day, they'd have the capital required to build a second machine, and in the third day a positive cash flow would begin. Banks can do nothing to stop this -- if they shut down their comm links, they go out of business; if they keep moving money over them, intruders suck money out at will. I recommend not keeping your money in banks... Most organizations who would build such a machine (national governments and other forms of organized crime) have probably already constructed many similar machines. This paper will not help them. It is intended to help people who thought that DES was secure. The full paper is available in PostScript via ftp from: ftp.eff.org:/pub/crypto/des_key_search.ps cpsr.org:/cpsr/crypto/des/des_key_search.ps cpsr.org also makes it available via their Gopher service. CPSR.org is on a slow link; use the ftp.eff.org archive if possible. (The file will appear there shortly; apologies for any delay.) John Gilmore Electronic Frontier Foundation Feel free to hack this up and send me back revised copy... John

1 1

Re: WACO: commentary, addresses to write
by remail＠tamsun.tamu.edu 10 Sep '93

10 Sep '93

Is there any ethical person inside Treasury with a digitizer and net access (or a freind with net access)? A great opportunity for use of alt.whistleblowers.

1 0