- cypherpunks-legacy - lists.cpunks.org

Hellman and DES
by Dave Banisar 27 Feb '93

27 Feb '93

I've talked to Martin Hellman quite a few times (he came to my last crypto conference and gave an overview of the field), he has never said that he could crack true DES. When DES first came out, he was one of the people most actively opposing the 56 bit key as being too small. At the time, he estimated that a machine of parallel processors could be built for $10M that would crack DES keys easily. DES at the time was only supposed to be for 10 years and then a new system was supposed to replace it. Today, he advocates for security that you triple-DES your communications/files. At last word (and I may have missed any advancements in the flame wars on sci.crypt), Shamir and Biham had cracked up to 2^^46, thats still quite a ways computationally from 2^^56. Dave

1 0

Re: DES
by John.Nieder＠f33.n125.z1.FIDONET.ORG 27 Feb '93

27 Feb '93

* Reply to msg originally in Cypherpunks <INET> phiber(a)eff.org (Phiber Optik) writes: BK> Slow down. Firstly, DES encrypts a 64-bit block with a 56-bit key. BK> Are you talking about key lengths? Yes. BK> It was originally proposed to use a BK> 128-bit key space, alla IBM's LUCIFER. But they opted on the smaller BK> key, which fuels this NSA conspiracy theory. As was their reaction to Hellman's proposal for a 64-bit key and any other proposed out-of-house improvement at that time. BK> Saying that Hellman "broke" anything is a bit BK> strong. I remember reading a published paper, I believe by Hellman and BK> one other, describing that they were able to WEAKEN DES (with a smaller BK> key space for their experiment), using a statistical approach, and that BK> this could possibly be applied to the DES standard. I refer you to Warren on this. It was my understanding of the article that Hellman had actually decrypted DES cyphertext prepared with the then-proposed 54-bit key standard. BK> If you're not just some NSA-paranoid wacko, BK> reference some papers to back up your claims. Otherwise, you're just BK> another NSA-conspiracy theorist, and part of the noise. Please, there's no need for abuse here. I was referring to a published column by Jim Warren of the Electronic Frontiers Foundation in _MicroTimes_, a Bay Area computer paper. I do not know if you consider Warren or the EFF to be reputable. I assumed Warren's statements were factual. The assertion that Israeli intelligence made short work of DES was presented as I got it - an interesting rumor from someone who has been a fairly-reliable source of information in the past. BK> We're all BK> capable of suspecting underhandedness on the part of the NSA, but when BK> you start misrepresenting your opinions as fact, you're being BK> nonconstructive. I was merely relating published assertions by the EFF. If you believe these to be incorrect, then I'd advise you to take the issue up with Warren. I have no "opinion" in the matter, only suspicions. A great many people with academic background superior to mine also share these. My own background is in applied rather than theoretical security. I defer to academics in academic matters, but know that in matters of top security it is difficult to invest confidence in any mechanism as mired in continuing controversy as DES. That's all. JN ... "Oceania, 'tis for thee..." --- Blue Wave/Opus v2.12 [NR] -- John Nieder - via FidoNet node 1:125/555 UUCP - ...!uunet!hoptoad!kumr!fidogate!33!John.Nieder INTERNET - John.Nieder(a)f33.n125.z1.FIDONET.ORG

1 0

What We Need to Censor
by tcmay＠netcom.com 27 Feb '93

27 Feb '93

I, too, am disturbed and worried by the abuses and politically incorrect postings being sent through anonymous remailers, so I support the calls by some on this list for censorship of various "bad" postings. Topics for banning: - hatred, such as the hatred some have for particular operating systems (unless the hatred is for DOS, which is justifiable, and hence acceptable). - advocacy of violence, which is why postings about Rambo movies and various porno movies (violence against women, don't you know?) need to be blocked by remailers. "Women Against Pornography" will be happy to instruct us on what media materials are acceptable and what are not. Jesse Helms, who is working closely with Andrea Dworkin and other feminists, will be happy to provide a list of banned topics. - this ban on advocating violence will also of course cover discussions of the Mideast, Bosnia, and the student uprisings in China several years ago (there was a lot of advocacy of violence then--can't have a repeat of that!). Let's all chant: "Hey Ho, Hi Ho, "rec.guns" has got to go." - ethnic slurs and advocacy of racial superiority (unless it involves the heartfelt calls for action by our oppressed African-American brothers and sisters, who have every right to call us honkies and advocate burning down our cities--we just can't tolerate those who call themselves "Aryan-Americans"). - advocacy of illegal acts, including nearly all postings to alt.drugs, alt.sex.children, talk.bizarre, and sci.crypt.underground. Come to think of it, perhaps those groups should just be shut down? - anonymous phone calls apparently are possible...perhaps we can require all phone calls go through government-cleared operators? And I have even heard that anonymous letters--even threats, blackmail (wonder where _that_ name came from?), pornography, and extortion demands--are possible using the U.S. mail system! How can this be? What can we do? I know, let's censor the mail system the same way we plan to censor the Net! So, you anarchists, let's implement these bans on what goes through remailers! One small problem: how can we do this when everyone's a remailer? When multiple routes exist? When sites are in many countries? Hmmmhhh...perhaps we censors just need to shut down the nets and stop all this loose talk. -Tim, applying for a job as a Usenet censor -- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: MailSafe and PGP available.

2 1

Real World Kinda Guys Unite
by deltorto＠aol.com 27 Feb '93

27 Feb '93

>>Hal >> >>P.S. How about Deadbeat posting a public key? He keeps signing his >>messages but I can't check them. Yeah. How 'bout that, 'Beat? At _least_ we'd have the false security of being able to check your Pkey now and then... I feel full of Piss and Vinegar, so I'm volunteering to help get this WhistleBlowers thingus up and rolling. First, we need to disseminate PGP in it's various forms (UNIX, Amiga, Mac, DOS, etc) to some news agencies (e.g. TV stations, newspapers, radio like KQED, etc.). I need each person who represents a platform to send me a full package of PGP with Docs that I can have duped for mailing (for educational purposes only). No charge. We'll begin with a core group of media people and see how it goes. I have floated a few trial balloons and they're ready to bite. I suspect that we'll see it take off like a rocket, as Tim May suggested. All this discussion is truly fascinating, but if it doesn't get out into the real world it ain't worth the media it's magnetized on. I guess I'm just a real world kinda guy. 1. Let's get a reasonably friendly anon remailer process going for them. It *must* come with complete instructions for the hapless many. Get writing and send 'em to me. I am working on some simple instructions for MacPGP and will post an example as soon as I can get through all the damn mail in my various mboxes. (Overload!) 2. Let's hook some Govt. employees into it ASAP and really get this whistleblowing thing going. I want to stir up some mud at the bottom like Kelly suggests and I want it done NOW. 3. I need help from ALL of you to do this. I am beginning to compile a comprehensive list of Govt Officials from the White House on down thru the Congress to the Cabinet and the Joint Chiefs. This database will include their various addresses (USM and email), their many phone and fax numbers, and other pertinent info (party, salary, etc.). Anyone can have a copy when I finish it. I hope to make it fairly administration-independent so it will last and will probably set up a process on CompuServe so that public can send in updates as officials are un-appointed, die and/or are voted out of office, etc. 4. Eventually, we'll do an anonymous posting to a massive number of Govt sites inviting WBlowers to post to the list and inviting Press people to log on and download the dirt. I will be at the Modern Times bookstore event on March 7th in San Francisco if anyone wants to discuss this. I would also dearly like to attend CFP, but I haven't yet found a way to do it without money (anyone who knows a way I can volunteer my way in and help out please say so - I'll sweep up after, anything...). d2t

1 0

Re: more ideas on anonymity
by George A. Gleason 27 Feb '93

27 Feb '93

I agree with Jim that I may be treading a thin line on censorship, but consider the following: someone posts a series of inflammatory statements with the intent of stirring up trouble, attracts a following, and starts organising them for some kind of violence. Then one day along comes a message to start the race war or whatever. The next day there are a bunch of random acts of violence. Uh-oh... The point is that this is a broadcast medium, though without the limitations of conventional broadcast. I think we may end up facing these issues one way or another, sooner or later. Hopefully, LE can prevent violent acts by conventional means without resorting to limiting privacy. The thing is though, given the increasing cultural diversity in society and its resulting flattening of the normal curve of acceptable behavior, we're more and more going to be facing issues which are located in the depths of murky gray areas and in which we may find ourselves needing to tread fine lines, split hairs, and make all kinds of distinctions where there are no firm certainties. (run-on sentence alert!) -gg

1 0

Biham and Shamir on cracking DES
by Marc Horowitz 27 Feb '93

27 Feb '93

This is, I believe, the state of the art in published techniques to break DES. Note that this attack is basically useless against one-time or short-lived keys, since there's no chance to make repeated chosen plaintext attacks against the key. Short form: If you can get me to encrypt 2**37 plaintexts *of* *your* *choice* against my key, you can crack it. Marc This info is forwarded from a friend. Eli Biham and Adi Shamir, "Differential Cryptanalysis of the full 16-round DES," December 19, 1991. The paper was announced in Dec. '91 on the net, and paper copies circulated from people who had gotten copies directly from Biham & Shamir. The paper was submitted to Crypto '92 and presented there on August 20, 1992. The Crypto '92 proceedings will be published by Springer-Verlag at some point, so you could also reference it this way: {\sl E.~Biham and A.~Shamir}, Differential Cryptanalysis of the full 16-round DES, {\sl Advances in Cryptology: Proceedings of Crypto '92}, E.~Brickell, ed., {\sl Lecture Notes in Computer Science}, Springer-Verlag, New York, to appear. Biham is at Technion - Israel Inst. of Tech. Shamir is at Weizmann Inst. of Science. I don't know of an FTP site where the paper is available.

1 0

Re: DES
by hkhenson＠cup.portal.com 27 Feb '93

27 Feb '93

My take on breaking DES would be to just try all 2**56th keys on a massively parallel machine, though there may be better approaches. Keith

4 3

timestamps and signatures
by root＠rmsdell.ftl.fl.us 27 Feb '93

27 Feb '93

> ||use electronic ... public-key signatures, the kind that make it impossible > ||for one to deny having signed something. ^^^^^^^^^^^^^^^^^^ > ||^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > | Nice theory, but too simple. > | I can always deny signing something by claiming that my private key was > | compromised. I can even deliberately let it be known, if it's important > There's some very nice work by two people at Bell Labs (whose names I can't One of them is Stuart Haber (stuart(a)bellcore.com) > unforgeable digital timestamps. This is a much trickier problem than it firs > appears to be, but they have a nice solution. It's not too complicated. Basically, what you do is produce a hash of your text, and publish it widely in a medium that is being archived, and likely to be accessible and authenticable at a later time, for example by posting it in a classified ad in a large newspaper. Later, when verifying the timestamp one can get a copy of that newspaper from a library (or from several libraries, for greater security) and compare the published hash with that of the text. For greater efficiency, there's a simple way to combine a lot of messages and produce only one hash which is published. The information you get back and store as a part of the timestamp is enough to prove that this particular hash was one of the many combined to produce the published value. This system is actually operating, look in any Sunday New York Times in the Business Classifieds. > Given timestamps, we can then require that messages be not just > signed but dated. If my key becomes compromised, I revoke all > my signatures from some time on. By looking at the timestamp > that goes with the signature, we can determine whether it was > created before or after the compromise, and discard it if "after". Once can always claim that they "just found out" that their key has been compromised a year ago, and so deny having signed that signature. -- Yanek Martinson yanek(a)novavax.nova.edu

1 0

DES chips
by root＠rmsdell.ftl.fl.us 27 Feb '93

27 Feb '93

> Speaking of which, does anyone know who makes "the DES chip" (is > there more than one?)? I'd like to find a data sheet for it. There's no such thing as "the DES chip". "Since publishing the Data Encryption Standard, NBS has validated 45 (as of May 7, 1991) hardware and firmware implementations. Approximately three implementations are validated each year. The list of companies with validated chips is quite varied. It contains very small companies as well as many of the large U.S. electronics corporations. The implementations range from firmware programmable read-only memories (PROMs), which implement only the basic DES algorithm, to electronic chips that provide several different modes of operation running at speeds up to 45 million bits per second." ... "Hardware implementations of DES are widely available in the United States at prices under $100; DES encryption boards that can encrypt stored and transmitted data in a personal computer are available for under $1000; and stand-alone encryption units may be purchased for under $3000." (This is from "The Data Encryption Standard, Past and Future" by Miles Smid and Dennis Branstad, first appeared in Proceedings of the IEEE, vol. 76, no. 5, May 1988) I'm sure that since this was written the number of implementations has increased, the prices decreased, and the speeds increased. -- Yanek Martinson yanek(a)novavax.nova.edu

1 0

Re: more ideas on anonymity
by George A. Gleason 26 Feb '93

26 Feb '93

John, I missed where I might have been advocating censorship... maybe it's so late at night that my logic filter is getting fuzzy... Of course one can't see the content of an encrypted anonymised message, but the case I'm concerned with here is where someone receives an encrypted threat message or some such, and wants it traced. In that case there ought to be some means. I'm speaking from recent experience, having received what the Berkeley PD considered a credible death threat on my answering machine last week... Okay, maybe your point hinges on the "advocating violent acts" item. Well this is a pretty tight issue: hard to differentiate between someone advocating insurrection, advocating race war, and advocating going out in your own neighborhood and killing (whoever). Either way it is advocacy of violence against someone. And I honestly don't have a simple answer to that one. The main point I was trying to go for is pretty unambiguous, that direct threats of violent actions are much more significant than for instance advocacy of committing some victimless crime or another... but that's a dull-obvious one compared to the advocating violence item. Somehow I believe we're going to need to consider the threats & violence questions sooner or later, if for no other reason than to have some solutions at hand when it happens and people start clamoring for restrictions on public access to crypto and anonymity. (jeez my writing is a mess at this hour!) -gg

2 1