- cypherpunks-legacy - lists.cpunks.org

Re: genetic algorithms for crypto analysis
by cme＠ellisun.sw.stratus.com 21 Aug '93

21 Aug '93

The problem I see for finding spikes is that this is still a brute force approach. The advantage that biological populations have is in growing new test processors exponentially, so that there is a chance to attack something which is merely exponential. An algorithm or breaking method which helps against modern cryptosystems would have to turn the spikes into gentle hills by some sort of mapping of the problem space. Biological attack machines would still run up against limits (e.g., the amoung of carbon in the solar system), so we have to spread the spikes. In fact, we have to spread them over the whole space since enlargement of the key space can take a gentle but limited-width hill and make it look/act like a spike.

1 0

Re: "Clipper" in Norway (FYI)
by George A. Gleason 21 Aug '93

21 Aug '93

Okay, here comes a test case. Can enough copies of PGP and other decent crypto get circulating in Norway, and posted on public-accessible terminals (in bookstores and so on, perhaps with an attendant or coinbox to cover telephone charges), and posted on every university machine and anywhere else that seems useful, to prevent the Clipper-or-else law from being passed...? If it passes, are there enough people willing to do civil disobedience to get the law overturned in the courts...? Precedent is contagious. Even internationally. If the nasties get away with it over there, it's just an incentive for their colleagues everywhere else to try more of same. Does anyone here know the status of the crypto scene over there, in terms of how many people involved, how many using good crypto, how many will hop on the bandwagon if things get worse...? -gg

1 0

soundcard programming
by bart＠netcom.com 21 Aug '93

21 Aug '93

In addition to ALT.SB.PROGRAMMER another useful Usenet group is COMP.SYS.IBM.PC.SOUNDCARD. From the latter comes a FAQ listing various sources of software and documentation. It is found at rtfm.mit.edu in the /pub/usenet/news.answers/PCsoundcards directory called generic-faq.

1 0

building a sound sampler for cryptophone application...
by greg＠ideath.goldenbear.com 21 Aug '93

21 Aug '93

uunet!an-teallach.com!gtoal (Graham Toal) writes: > In article <9308201757.AA04239(a)soda.berkeley.edu> hughes(a)soda.berkeley.edu wr > > That said, I think that designing custom hardware for sound sampling > > is a waste of time, given the abundance of multimedia cards that > > already work. > > Yes, but have you ever tried to drive them from a C program? From the > scanty docs I got with my Soundblaster, I wouldn't know where to start. Sorry I can't provide an exact pointer, but there's a whole newsgroup about it. It *might* be alt.sb.programmer, but I don't actually have a soundblaster, and hence didn't pay a lot of attention. A friend of mine has done quite a bit of soundblaster programming (more about music generation than accepting sound input, tho) and I'll track down the newsgroup name if anyone cares. > Oh, and multimedia cards are pretty expensive. This will cost maybe $25 > at most. It's the sort of thing that once designed, hardware-inclined > cypherpunks could hack up dozens of at home and pass them on at > conventions like HoHoCon or the one we just had in the Netherlands... Soundblaster clones are (I'm certain) available for $50 retail and I think I've seen them for $35 wholesale. I can find a reference for the retail price, am less sure where I saw the reseller price. None of my comments here are intended to dissuade Graham's uncle from building something useful - I do think it'd be nice to have a public domain (or shareware?) design for a hardware device useful in this context. It is reinventing the wheel, but if the reinvention is (a) fun to do, and/or (b) publicly distributable, it doesn't sound like wasted effort to me. -- Greg Broiles greg(a)goldenbear.com Golden Bear Computer Consulting +1 503 342 7982 Box 12005 Eugene OR 97440 BBS: +1 503 687 7764

1 0

Key Mgmt GUI
by felix＠hu.se 21 Aug '93

21 Aug '93

I'm designing a (public) key managament utility. I have no experiense with cryptography, but I have worked much with GUI design. Please let me know your opinion on the following questions. 1 - Is the key/keyring methaphor the easiest one to understand (both respect to encryption and signatures)? Is there another better methaphor, such as users (instead of keys) having a public and a secret id. For example, Apple OCE uses the notation of signer objects instead of keys. 2 - Each keyring is naturally stored as a file. The obvious way to view a keyring is to show a list of all keys in it. How much information should be visible in the list, and how should it be presented (so that the user can navigate thru very large keyrings)? Should the list include certificates? If not, how are they managed. 3 - How should key pairs be treated? Should a user's public key be "associated" with his secret key (and maybe stored together)? Should it be possible to mix public and secrets keys in a keyring? Is it neccesary to have a secret key ring when there's only one secret key? ---------------------------------------------------------------------- - RealName: Felix Ungman InterNet: felix(a)hu.se AppleLink: SW0358 - - Felix gor det goda godare! - ----------------------------------------------------------------------

1 0

anonymus@charcoal.com is going away
by hfinney＠shell.portal.com 21 Aug '93

21 Aug '93

It does not really surprise me that Kleinpaste is shutting down his server. He always seemed to be a weak supporter of anonymity, IMO. I remember how he was one of the loudest complainers when the contro- versy arose over Julf's anonymous remailer. This is how I would have handled the situation. If the sysop of this system sent mail to me (he couldn't get my phone number, I don't think), asking whether so-and-so sent mail to such-and-such, I would only be able to say, "I haven't the faintest idea." I don't keep logs, and one of the reasons I don't is so that I have no expectation of being able to answer such questions. What I would then do is to ask the sysop for the addresses which are receiving the objectionable mail, and I would add them to my "blocked" list, so that my remailer would no longer send mail to those individuals. They would then have no more reason to complain to me. All mail from my remailer includes a header message telling people that they should complain to me if they get objectionable mail. In the several months that I have been running my remailer, only one person has asked to have his name blocked. Parenthetically, this incident shows the value of remailers which add some delay to the message forwarding process. This would then make it harder to correlate the arrival of anonymous mail with the transmission of mail from a particular user. Hal Finney hfinney(a)shell.portal.com

1 0

No Subject
by Anonymous 21 Aug '93

21 Aug '93

Posted by a misguided, hysterical, raster-burned ranter: What happens when one of these HR4079, Digital Telephony, Clipper/Capstone/Skipjack proposals passes, and Cyphernacht takes place? Storm troopers will throw your nice little PC's on the ground to ruin the hard drives, and only the new, improved hard drives, with access for legitimate law enforcement needs will be sold. Storm troopers? You take this all a little too seriously. What makes you think that you and your nasty little private secrets warrent the time, money and effort of non-existant storm-troopers?

2 1

ONE BBSCON
by Stanton McCandlish 21 Aug '93

21 Aug '93

Well the time draws near. My offer to distribute anti-clipper, and pro-CP flyers, at my expense, still stands, but I don't have time to write up the material. If anyone has any good, one-page, flyer material for this effort, please mail it to me directly, and soon. Mon. will be the cut- off, as I leave Tue morn (Aug. 24) Again, send this by pvt. mail please, I've got the list turned off temporarily (to get elm's filtering working, but it refuses to cooperate, so I may just give up on that. Just doesn't seem to do ANYTHING, it just sits there when the filter command is executed. <shrug>) -- Stanton McCandlish * Space Migration * Networking * ChaOrder * NO GOV'T. * anton(a)hydra.unm.edu * Intelligence Increase * Nano * Crypto * NO RELIGION * FidoNet: 1:301/2 * Life Extension * Ethics * VR * Now! * NO MORE LIES! * Noise in the Void BBS * +1-505-246-8515 (24hr, 1200-14400, v32bis, N-8-1) *

1 0

KOH software topic
by fergp＠sytex.com 21 Aug '93

21 Aug '93

-----BEGIN PGP SIGNED MESSAGE----- On Fri, 20 Aug 93 17:11:51 CDT, Karl Lui Barrus <uunet!owlnet.rice.edu!klbarrus> wrote - > In summary, I am posting this because I intend to post KOH code > when it becomes available. The feelings expressed about this > may very well affect the future of the list. In fact, I may > post to virus-l because it has come to my attention the topic > has surfaced there as well. And I know that anti-virus > professionals are always interested in the facts of any matter. While I may have been one of the first to "sound the alarm," let's get it straight -- up front -- that I do not condone any type of OS subversive program that conducts it's "activities" without the user's knowledge, or any code that has the potential to propogate without user's knowledge. That said, I think I qualify well enough as an "anti-virus professional," even though I don't -officially- produce any antivirus software for public consumption. In any case, I'm mano-en-mano with most of the notables in the field. > A few people have requested copies of the program from me, and I > know of at least one person actively working on a disassembly. I'd like to examine a copy myself. > I mention this partly in an effort to mentally prepare some people on > this list for an event that is certain to happen in the future: the > posting of KOH source code. I say this: when a disassembly of the > program becomes available, if I receive a copy, I fully intend to post > it to this list. Words escape me at the moment -- perhaps its all those damned Mooseheads... > I would like to point out the charter of this list includes the phrase > "Cypherpunks write code." [Mooseheads-kicking-in mode] "Cypherpunks write code" should be expanded (in fact, it -is- expanded, to a certain extent) to include beneficial vs non-beneificial software. But what delineates the two? This is a -very- touchy subject. "Subversive software," is a term which I use to demonstrate the properties of software which spoofs someone, in one way or another. Viruses do this, especially what we call "stealth" viruses, because of their ability to spoof the operating system. "Subversive software," in the terminolgy of KOH may be something else entirely, but any software that marks sectors bad on my disks without my permission automatically falls into the clssification of "unwanted" or "bad" software. Perhaps I don't understand or haven't familiarized myself enough with this software, but it sounds ominously like some timebomb which harbors the potential to hose the user at any given time. IMHO, this sounds like badware, but I would have to examine it further, under a debugger. > As we all know software development is a time consuming process and > thus not many programming projects are discussed, due to complexity, > time constraints, slow development, etc. One such project a few list > readers expressed interest in was the so called "CryptoStacker" > project - a program which would funtion very much like Stacker does > (it automatically compresses and uncompresses disk drives) except > the CryptoStacker would automatically encrypt and decrypt. > Suddenly, a program which claims to do all this surfaces. KOH claims > to install itself, encrypt and decrypt with IDEA and an unspecified > quick algorithm, and uninstall from the hard drive on request. The > author explicity states he intends no maliciousness, and will even > accept bug reports and perform patches. How then can we ignore such > a program? Firstly, by not jumping the gun. Secondly, by examining the software extensively. Thirdly, by making an honest analysis of its merits, its pitfalls and its contentions. All in all, if all it does is actively encrypt and compress, then it is certainly non-threatening to the general public. If it does otherwise, or has some odd caveats, the it needs to be advertised "up front." Now, don't get ne wrong -- I don't condone someone posting a debug script on the net and saying "This may hose your system," knowing full well that it will do exactly that! Comments? -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLHWMTJRLcZSdHMBNAQF4EAQAmCtz1LYKZmh21UJcyZ5K3UuVv5rJ+4c/ L3K8oYjnqFevBQvjYBgiXIMqglxvu6R4XKXRAOXHLvUeUIHZk/3Da8UrfWbDyR14 ds72gn+5l/XldKw60DvJPuFJFvsjcYigNrvnVwMbzgUbpkN8zsi6Rfy85AfeclfG AzfnMlO+cQc= =QK5G -----END PGP SIGNATURE----- Paul Ferguson | "Government, even in its best state, Network Integrator | is but a necessary evil; in its worst Centreville, Virginia USA | state, an intolerable one." fergp(a)sytex.com | - Thomas Paine, Common Sense Type bits/keyID Date User ID pub 1024/1CC04D 1993/03/15 Paul Ferguson <fergp(a)sytex.com> Key fingerprint = EE D2 93 7D 04 6D C6 05 AC 36 AD 9D 8E 4F 41 58

1 0

Hardware Homebrew
by Hastings＠courier8.aero.org 21 Aug '93

21 Aug '93

One of those "too many Erics" wrote: > I think that designing custom hardware for sound sampling is > a waste of time, given the abundance of multimedia cards... I think we should build fluidic computers and communication links to resist an EMP attack. How better could we meet TEMPEST requirements than using water instead of electrons. None of this namby-pamby off-the-shelf baby stuff. If users can't build their own computers and write their own OS, they deserve to be crushed under a jackboot forever. ;-) > The solutions that we make should be to the greatest extent > available to all without special prerequisites. That means > that hardware should be freely purchasable, since the > resource of money is more widely available [THAN HOMEBREW]. And we're not talking beer, here. "When you've said DUFF, you've said enough." OK, buy when there is a variety of retail sources, but for something as limited as RSA for example, it is wise to use PGP. Is it unreasonable to prefer free software with source code to commercial 'ware without source code? Even for hardware that is freely purchaseable, shouldn't we review the security of any privacy solution ourselves rather than take some manufacturer's word that it's safe? I grant you a sound board isn't the most critical item. Writing device drivers for existing sound cards, as you suggest we should do, assumes that the user already has a general purpose computer system up and running. Isn't that a "special prerequisite?" The guy who started all this hoped his sampler would be "dead cheap and easy to build" but admittedly was still talking about an add-on to a PC. Computers and add-in boards seem cheap compared to automobiles, but not everyone has thousands of dollars to throw away on this junk. I can't believe that when microcontrollers are available for $1-$4 each, that we can't design a simple non-Unix, non-DOS standalone gadget for use by non-Nerds. One project we should consider is a non-proprietary hardware/software privacy product for mass consumption. I'd like to have a cheap audio sampler as part of a DVR module to record and play voice messages, spread-spectrum radio to give unlicensed users access to the airwaves, a self-configuring backbone of home radio voice/e-mail mailboxes, perhaps combining omni and uni-directional links for efficient message forwarding, and the ability of any user to transmit a message from their portable DVR transceiver to anyone's home mailbox and get a response, without any record of the message paths. Maybe this sounds really complicated, but a single CPU can do compression, generate chip bits per the spreading code (direct sequence software) to define a spread spectrum channel, select the best address for efficient message forwarding, and toast your bread in the morning. It should be mostly software, no? The 75% of the world's people who have no access to any phone service have more time than money, so homebrew hacking is one way for them to get privacy and freedom. It is illegal to BUY a 10-meter amplifier for ham radio because it may be abused by a CB operator (in the 11-meter band). But it is legal to BUILD a 10-meter amplifier for ham use. If it were illegal, and if you want it, but can't buy it, what other choice do you have? What happens when one of these HR4079, Digital Telephony, Clipper/Capstone/Skipjack proposals passes, and Cyphernacht takes place? Storm troopers will throw your nice little PC's on the ground to ruin the hard drives, and only the new, improved hard drives, with access for legitimate law enforcement needs will be sold. Like Chuck Hammill says: "If you don't learn how to beat your plowshares into swords before they outlaw swords, you'd better learn before they outlaw plowshares." Kent - jkhastings(a)aol.com

1 0