- cypherpunks-legacy - lists.cpunks.org

Computer Shopper encryption
by nobody＠alumni.cco.caltech.edu 18 Jun '93

18 Jun '93

If Kragen's RNG from Computer Shopper is called repeatedly with range=256, so that the resulting values are in the range 0-255 for xor'ing, it is very weak. That will mean that the RNG will repeat with period of at most 256, and so the only question is which of the 256 possible starting points was used. In other words you only need to do 256 trial decryptions (just try seeds from 0-255) and you've got it. Using the low-order bits of an LCM RNG like this one is a bad idea. You should use the high order bits, or use a range which is not a power of 2 so you end up using all the bits. Even then LCM RNG's aren't crypto- graphically strong, although from what I have seen the techniques of breaking them are what a layman would call complicated. Compared to breaking, say, DES, though, they are no doubt trivial. Hal Finney 74076.1041(a)compuserve.com

1 0

Re: xor w/prbs
by bear＠eagle.fsl.noaa.gov 18 Jun '93

18 Jun '93

>How *do* you break this cypher? He is generating a lot of random numbers >between 0 and 255, and xor'ing each successive one with the next byte of plain- >text. I know that this is a trivial cypher to break, according to PRZ at >least, but how do you do it? In this case, since the modulus is a small power of 2, you can do exhaustive search. There is _one_ sequence of 256 distinct values. Still want to know how long it will take to crack his ciphertext? >#define MULTIPLIER 0x015a4e35L >#define INCREMENT 1 > >long RandomSeed; > >int GetRandomNumber(int Range) > { > RandomSeed = MULTIPLIER * RandomSeed + INCREMENT; > return(RandomSeed % Range); > } > >So how do you crack this cipher without trying all the keys, guys? Since max_integer / gcd (range, max_integer) > range you can move the modulus operation around without worrying about weird effects from the finite word size. This is because the closed form of the loop is: seed[k] = (seed[0] * mult^k + incr * sum (j = 0 to k-1) of mult^j) % range which is equal to seed[k] = (seed[0] % range) * (mult % range)^k + (incr % range) * sum (j = 0 to k-1) of (mult % range)^j and the modulus operation with a power-of-2 range simply keeps the last n bits. But, this also means there are effectively only "range" possible values for the initial seed. Even if you make the increment and multiplier part of the key, they must (both?) be odd so you only have 22 bits of key. Of course at this point you can simply use the fact that this "one time pad" is actually a Vigenere cipher with 256 columns -- easy to crack if you have some insight into the nature of the plaintext (e.g., English text). For instance, 10-15 small documents (40 lines) encrypted with the same key is enough to crack it even if the multiplier and increment are unknown but constant. Bear Giles

1 0

xor w/prbs
by TO1SITTLER＠APSICC.APS.EDU 18 Jun '93

18 Jun '93

Some MORON wrote an article in Computer Shopper, about doing a one-time pad with a PRBS... in fact, he even challenged any cryptographers to break it. (He used a 32-bit seed for the PRBS.) He also included a number of fallacies in the article, among them that you change your algorithm when you think the enemy knows what it is, but you change your keys regularly even when you don't have any basis to think so. How *do* you break this cypher? He is generating a lot of random numbers between 0 and 255, and xor'ing each successive one with the next byte of plain- text. I know that this is a trivial cypher to break, according to PRZ at least, but how do you do it? This arrogant moron with pretensions to cryptographic knowledge needs to be corrected. (Some might say the above epithet applies to me too, to which I reply: I don't pretend to know crypto. I just read cypherpunks.) He is: David Stafford, care of Computer Shopper ONe Park Avenue New York, NY 10016 This kind of misinformation is dangerous to the public at large. The article is on page 558 af the July, 1993 Computer Shopper. It uses a random number generator, (now that I look, it's not a PRBS) from the June, 1993, Computer Shopper, by the same author. The random number generator used is like this: It uses a global variable called RandomSeed, and each time thru the random function, RandomSeed, a 32-bit long, is multiplied by 0x015a4e35, and incremented; and then the new Randomseed, modulo the largest desired return value, is returned. (Actually, mod the largest desired value +1.) a code fragment: #define MULTIPLIER 0x015a4e35L #define INCREMENT 1 long RandomSeed; int GetRandomNumber(int Range) { RandomSeed = MULTIPLIER * RandomSeed + INCREMENT; return(RandomSeed % Range); } So how do you crack this cipher without trying all the keys, guys? Kragen

1 0

Blasting Bidzos Blather
by L. Detweiler 18 Jun '93

18 Jun '93

The following message is FOR CYPHERPUNKS ONLY. I specifically *prohibit* further distribution past the mailing list! Please do not betray my trust! [Bidzos] >I'm genuinely > confused, as I believe the situation is as simple as I put it to you. > Our claims of patent infringement by DSS, made over the last 18 > months, were well-known and publicized. NIST has capitulated. Seems > pretty straightforward to me. The more I read from Bidzos, the less I believe he has any overall control or even awareness of the company, or is purposely duplicitous. His vague and weak defenses I find personally intelligence-insulting. DSS seemed to defy the face of all public input into the standard, which opposed the NIST algorithms (`handed down' in a dictatorial and authoritarian manner, sound familiar?) in favor of RSA. How is it that Bidzos makes no reference to this? Apologists for DSS such as Denning do so on two major grounds: 1) it is part of the larger plan involving Clipper, therefore lack of duality in encryption and authentication features (an implicit characteristic of RSA) is not a problem 2) the security is `no weaker' (cunningly disguised as to appear to say `better') than RSA. Both are noxiously misleading arguments in themselves, but are also decoys (like key escrow agencies and procedures) to the critical issues at stake. The critical point is that even the *appearance* of a `fair and impartial' standards making process was totally defied, to the point of suggesting a complete clandestine backroom collusion! (hm, sound familiar?) But gosh, I wonder how many people would have advocated RSA back then when they could predict the future: that NIST would not only embrace PKP but would award them a complete monopoly on signature standards. Somehow proponents of this new NSA-Clipper-Capstone obscenity are now pointing back to history and saying that the main objections to DSS standards were *technical* (strength of the algorithm) and *legal* (PKP patenting) and that they have been wholly ameliorated by improvements (in key size) and recent events (PKP support). This is historical revisionism at its worst! From my point of view, critical main objections were on the warped process that permitted an unpopular (and perhaps even subversive) standard be adopted! This revisionism definitely suggests something deeper and `ulterior' is going on---that a comprehensive NSA-PKP alliance is in place? > BTW, on Clipper, ATT, Motorola, IBM could have done Clipper without > ever talking to us. Contrary to popular belief, we don't dictate > terms to licensees. First, I find it absolutely ridiculous for an informed agent of PKP, and for that person to coincidentally be called the *president*, to claim that `we don't dictate terms to licensees'. This is only true in the sense that if the licensee does not agree to the terms put down by PKP, they don't get the license! Second, I would like to see PKP contracts. There are probably more clauses than a bad run-on sentence. I'll go out on a limb and wager that PKP *does* limit the use of RSA in the company's products, and that the licenses are fairly specific. It seems rather inconceivable to me that any such corporate agreement that could be so simplistically summarized as `PKP gives rights to company [x] to use RSA in *any* of their products as long as they pay [y] royalties'. The agreement is very likely product-specific and implementation-limiting. Perhaps Mr. Bidzos or representatives of companies involved would be willing to forward copies of these agreements for our consideration of Mr. Bidzos' claims, assuming they are not `classified'... Third, regardless of presence of product-specific limitations in the licenses, and even if PKP has sold licenses to companies that somehow permit them the latitude to include RSA technology in their Clipper implementations, PKP can certainly take the future stance that they will prohibit that use in future corporate contracts! If Mr. Bidzos really thinks that Clipper is `ill-conceived, ill-timed, and undesirable' perhaps he should figure out how to keep his company from supporting, nay, *promoting* and *profiting* from it. Let's look again at the announcement: >PKP will also grant a license to practice key management, at no >additional fee, for the integrated circuits which will implement >both the DSA and the anticipated Federal Information Processing >Standard for the "key escrow" system announced by President Clinton >on April 16, 1993. `at no additional fee'? What does that mean, `for free'? This apparently means Mycotronx, despite being a private company, does not need to license (read: pay for) the RSA patents on the critical key-exchange function for use in Capstone for *any* implementations (public or private), nor does any other company NSA decides to induct into its privileged enclave. Hm, I wonder how RSA's other `customers' feel about that? And why would PKP voluntarily give up this potentially valuable revenue source? Clipper implementations could be *extremely* lucrative for PKP. That they don't license them specifically, and in fact voluntarily give up the perogative to do so, suggests that they gave up something greater in return for them. Namely, the award of an official U.S. government-endorsed monopoly on DSS and arguably all valuable cryptographic techniques. By the way, let's look Mr. Bidzos' quote on Clipper. Clipper is `ill-timed'? What does this suggest, that a NSA-PKP partnership would be better served if it came out sooner or later? Clipper is `ill-conceived and undesirable'? For who? Was it that PKP perhaps didn't hear about it soon enough to rob all the tasty new cryptographic algorithm patents surrounding it, like it did with the Schnorr patent? The licensing notice (which was probably reviewed and approved by PKP representatives) refers to Clipper as `an anticipated Federal Information Processing Standard?' How, Mr. Bidzos, can this new revelation possibly be construed to indicate that Clipper `will go away'? Yes, I suppose Mr. Bellovin was right. The omnipresent underlying message here is that nothing is unethical if PKP profits from it. I advise cypherpunks not to take Mr. Bidzos' comments literally. They are, however, interesting from the perspective of the study of the speech of either an uninformed figurehead or a capitalist (or even nationalist) co-conspirator. P.S. all cypherpunks `for' an alliance with PKP, please raise your hand. I personally find the image of `lumbering but ultimately benevolent corporation' too incredible to hold in the face of recent events, and am now actually quite embarrassed to have advocated some `good faith' proposals involving the company which look naively misguided in hindsight. PKP is not going to go away when a few of its patents expire. To the contrary, it appears to be clutching everything within reach to ensure its eternal domination in the commercial cryptographic field. (sound familiar? a PKP-NSA alliance makes perfect sense.)

1 0

Clipper fact
by fergp＠sytex.com 18 Jun '93

18 Jun '93

On Wed, 16 Jun 93 22:41:33 PDT, Marc Briceno <uunet!ideath.goldenbear.com!mbriceno> wrote - > I am representing the anti-clipper side in an ongoing debate in > the "Wired " conference on OneNet. The governmental lemmings > question the existence of the "Law Enforcement Exploitation > Field" and want citations. Would the person who posted the > hard facts about Clipper please send me all the info? > Thanks in advance, I've collected about 700 kb worth of information regarding Clipper/Capstone, but this post from Dorothy Denning should be exactly what you are looking for. It was originally posted to sci.crypt and reposted to cypherpunks by Tim May. 8<------- Cut Here --------------------

1 0

Stegosaurs
by fnerd＠smds.com 17 Jun '93

17 Jun '93

Hal Finney <74076.1041(a)compuserve.com> sez > (...did anyone notice that there weren't any stegosaurs in Jurassic > Park? Just another sign of the government crackdown on crypto?) No, silly! They were hiding behind treetrunks and disguising themselves as tourguides! Don't you know the first thing about stegosaurs? -fnerd quote me time to recycle some elephant jokes

1 0

Re: Weak steganography
by kqb＠whscad1.att.com 17 Jun '93

17 Jun '93

Hal Finney said: > Another problem is that encrypted files look different from executable > files. Encrypted files have a uniform histogram (that is, all 256 different > possible byte values are equally frequent), but exe files do not. ... I am building a "steganosaurus" and eventually will need to solve a similar problem. (A "steganosaurus" applies a primitive steganographic technique to English text by using a thesaurus to generate enough word variation to encode a hidden message.) One of the weaknesses of this "steganosaurus" is that the resulting output has statistical differences from normal English text. For example, word frequency will be skewed. Worse, I have to assume that the eavesdropper knows my steganization algorithm and can "desteganize" any innocuous-looking text I produce. That "desteganized" text will show clearly the existence of a hidden, encrypted message because, as Hal pointed out, it has a uniform histogram. What I want is a program that will transform an encrypted file to a (slightly larger) file that mimics the distribution achieved by applying the "desteganization" algorithm to normal English text that does *not* contain any hidden message. The steganization algorithm then gets applied to this stealthy, mimic file, not directly to the encrypted hidden message. By the way, since we must assume that the eavesdropper knows all our algorithms but not our secret keys, this algorithm will require a *second* secret key in addition to the secret key used in the original encryption. I'm not ready to tackle that yet. Unless I hear otherwise, I'll assume that if anyone knows how to achieve this, they're not telling... Kevin Q. Brown INTERNET kqb(a)whscad1.att.com or kevin_q_brown(a)att.com PS: I found that a simple, semi-automatic algorithm can generate a public message only 5 to 10 times as long as the hidden message. Unfortunately, the public message from my simple algorithm is almost always a bizarre, disconnected sequence of rants, which, for most people, is not normal. That is why I am building my "steganosaurus". After that I will see if combining a natural language parser with transformational grammars can produce a less primitive, more efficient "trans-steganosaurus".

1 0

Re: "RSA sells out" hue and cry (fwd)
by Stanton McCandlish 17 Jun '93

17 Jun '93

This is in reference to the material direct from Jim Bidzos of RSA that I have posted, re: the charges that NSA is selling out to the Clipper scheme by licensing NIST to use their "patented algorithms" <snort> Quoth FutureNerd Steve Witham, verily I saith unto thee: > > Draw your own conclusions. I sure will. > > What the hell kind of conclusions are you drawing? Will you cut the > sniffing and say what you mean? Sniping is tiresome. Sniping that > doesn't even make a whiff of sense is doubly so because it's > confusing. Pardon my pique but there's a *real* war on. RELAX, fnerd! I almost sent you my new "Dear flamer" form letter, but I guess this deserves an answer. Please don't yell at me like this. My cautious conclusion from this and other discussions with Jim directly (at least I presume it is he; as I said before I get suspicious when the head of the worlds largest cryptography corp. does not use his own signatory authentication software), is that 1) RSADSI/PKP cares only for its bottom line. People like Jim Bidzos may care about stopping Clipper, but that is largely irrelevant in a corp. It's like your brain deciding it doesn't want food. Your body will go on craving food if you like it or not. 2) DSI is more-or-less anti-clipper, because it will hurt their biz in the long term. It is, being a typical corp., driven more by immediate profit motive; thus it calls bullshit on the Gov't violating their "patent", and thus accepting the deal when the govt "capitulates". In typical corporate double think, it does not see the blindinly obvious conflict of interests here. The weasel factor is likely the rationalization that key escrow does not equal clipper, which is true, though as we all know, they two are intertwined like snakes in a basket. 3) there is no conspiracy of PKP/RSA with NIST/NSA. It's just a product of commercial short-sightedness and even outright stupidity and illogic. 4) regardless of this, this move on the part of RSA is likely to be detrimental to the cause, and is dangerous. As for your other points: A) I am "sniffing" and I said this is a "cautious" conclusion, because all the evidence is not in. B) sniping is USEFUL. Ask any revolutionary. This is not a pitched battle, it is a guerilla war, a propaganda war, & a political cold war. C) it makes plenty of sense. My intent was to present the facts and material I find (for which I actually expected some thanks, imagine that! Who else among you bothered to make the effort to contact Big Jim personally and get their side of the story?), and to encourage people to think about it and weigh the data and "draw your own conclusions". I do not Know All in this matter, and did not wish to try to force my view on the whole. Furthermore, I think you are upset with the messenger, rather than concentrating on the message. All I am doing is saying, "Here I got this. It made me think. Look at it and think about it too." D) Yes there's a war on. But I am not Rambo, I'm the USAF journalist who doesn't feel like getting shot thank you very much ;) Note this is being passed on to the appropriate list and groups, in case others need this clarification. -- Stanton McCandlish * Space Migration * Networking * ChaOrder * NO GOV'T. * anton(a)hydra.unm.edu * Intelligence Increase * Nano * Crypto * NO RELIGION * FidoNet: 1:301/2 * Life Extension * Ethics * VR * Now! * NO MORE LIES! * Noise in the Void BBS * +1-505-246-8515 (24hr, 1200-14400, v32bis, N-8-1) *

1 0

Re: fast des
by smb＠research.att.com 17 Jun '93

17 Jun '93

The DEC gigabit/second DES chip was based on the FURY VSC15K gate array from Vitesse. It's a gallium arsenide device. The full paper is ``A High-speed DES Implementation for Network Applications'', by Hans Eberle, SRC Research Report 90, DEC Systems Research Center. Abstracts are (apparently) online in pub/DEC/srcabstracts.list, on gatekeeper.pa.dec.com. You can get hard-copy by sending email to src-report(a)src.dec.com. Oh yeah -- he gives the search time as 16 days, for about $1M in DES chips alone, without any support circuitry. The chips are estimated to cost $300 apiece. His chip is well-suited for DES-cracking because it has a separate key-loading port, so you can change the key each cycle without slowing down the pipeline.

1 0

Contempt of Court
by axelrod＠s106.es.llnl.gov 17 Jun '93

17 Jun '93

If the key itself had embedded testimony that was incriminating, then it is possible one could invoke the 5th amendment to avoid disclosure of the key. But, I suppose a court could do an end run around that by giving limited use immunity for the incriminating content of the key. Comments? Mike.

1 0