- cypherpunks-legacy - lists.cpunks.org

Coupled programs and security by obfuscation
by mjr＠netcom.com 27 Jan '93

27 Jan '93

**** Pat Farrel <pfarrell(a)cs.gmu.edu> writes >I expect that current terminal/menu based BBSes will disapear >once folks realize how much better easier, faster, and all >around better programs that use computers as computers work. I hope not... At least not until the BBS operators and writers agree on some standardized API so people like me and other third parties can write PC based interfaces in a language of our choice. The problem with current "coupled systems" (for example the Coconet BBS software) is that they all rely on proprietary interface programs on the PC. If I communicate with 10 BBS systems (large or small), I must have 10 different communications programs... No thanks... Also keep in mind that much of the value of these systems comes from their availability to the widest possible audience. There are people in many parts of the world who still have nothing better then 1970's style glass tty's and even paper-output type terminals! ****** Back on the issue of privacy and anonymity, I don't understand the lure of all these schemes for hiding mail paths, etc. If encrypted messages pass through one aliaser, and get decrypted (and aliased again) on another machine, you are protected. The machine that knows who you are can't read your material, and the machine that can read you doesn't know who you are. Any further obfuscation adds little (IMHO) to your security. Revelation of your identity (in either case) depends on collusion between system administrators on the different hosts. True this might be even less likely where 3 or more hosts are involved, but how much less so? If some agency is powerful enough to force two systems in different parts of the world (and the net) to reveal what they know about you, the chances are they can force three or four, etc. matthew rapaport Philosopher/Programmer At Large KD6KVH mjr(a)netcom.com 70371.255(a)compuserve.com

3 4

Re: Computerized OTP (was 5th AMENDMENT & DECRYPTION)
by Marc.Ringuette＠GS80.SP.CS.CMU.EDU 27 Jan '93

27 Jan '93

thug(a)phantom.com (Murdering Thug) writes, > A person I know is working on a computerized version of the OTP that > extracts a truly random stream of bits from TV/RF static and massages it > using a DSP to be highly variable (e.g.: no runs of 0's or 1's longer than > 5 bits). Cool! You've managed to weaken the one time pad enough for someone to crack it! [ I can collect statistics on the plaintext based on the fact that if five zeroes occur in the OTP then the next bit is constrained to be one. Of course, I don't have complete access to the OTP, but it's an extremely useful statitistical foot-in-the-door. ] This failure occurred because your friend tried to create a number sequence that is somehow "more random than random". Such a sequence is, by definition, weak. -- Marc Ringuette (mnr(a)cs.cmu.edu)

2 1

5th AMENDMENT & DECRYPTION
by John.Nieder＠f33.n125.z1.FIDONET.ORG 26 Jan '93

26 Jan '93

from: john.nieder(a)f33.n125.z1.fidonet.org > In a recent message, Murdering Thug said: > | The Fifth Ammendment is the tastiest one of all when it comes to > | encryption. By pleading the Fifth, you do not have to decrypt anything > | for the prosecution. The Fifth Ammendment gives you the right not to > | testify or provide evidence that would incriminate you. Providing a > | key to decrypt your hard disk would incriminate you, and you don't > | have to do it. I should like to see the body of case law on which this opinion is based, if any. . Recently this question came up in another forum on encryption & an "authority" on communications law claimed the probable scenario would be that the arresting agency would have the encrypted material decrypted by a competent government or academic agency & the costs of said decryption would eventually be recovered from the defendant through civil suits, presuming the defendant had sufficient assets. It is my memory of the thread that he claimed this had been done in previous cases. JN ... Gun control: It ain't about guns, it's about *control*. --- Blue Wave/Opus v2.12 [NR] -- John Nieder - via FidoNet node 1:125/555 UUCP - ...!uunet!hoptoad!kumr!fidogate!33!John.Nieder INTERNET - John.Nieder(a)f33.n125.z1.FIDONET.ORG

3 4

Re: Rational PC mail , was Re: PGP on BBS
by jim＠tadpole.com 26 Jan '93

26 Jan '93

> From pfarrell(a)cs.gmu.edu Tue Jan 26 12:28:05 1993 > > While serial ports do lose characters, especially if you don't have > a 16550afn serial chip, I don't see this as a major hassle. In a pure > DOS space, you really arn't likely to lose the characters, and this > is the initial space of NUpop. With Windows, you have to learn to play > with the priorities to make it work well, or get one of the intellegent > serial driver DLLs that make it transparent. Let me try to put it another way. The higher you drive the DTE rate, the more likely you are to loose characters. At the same time, you start to care less about the (small) protocol overheads involved. > It is possible that the authors of the NUpop document don't worry too > much about single character dropouts. There is plenty of redundancy in > english. PGP will complain, but I can see retransmitting a message > half a dozen times to get it thru cleanly will lose. But if characters change during transmit, how can you tell that the message wasn't altered by some agent other than the device/driver? Further, if it happens only occasionally, won't you react with mistrust of the original message? "Hey, this message doesn't check with the author's key!" If it happens a lot, aren't you more likely to say, "Well, he must have meant $10,000, not $1000, the serial port must be loosing again." rather than resending some number of times? > I never allow my private key anywhere near a serial port. The public keys > are checksummed, so it is easy to see that a character is wrong. > I'd love to be able to use CSLIP. We (a bunch of folks on this campus) have > just convinced the admin to allow POP services. It will take a while before > we can convince them to allow SLIP, CSLIP, and PPP. The older I get, the more I understand, "Power to the people." Cheers, Jim

1 0

withdraw
by Vincent Dileonardo 26 Jan '93

26 Jan '93

I would like to request that I be removed from your mailing list as soon as possible. Thank you. Vinnie DiLeonardo

1 0

Re: Computerized OTP (was 5th AMENDMENT & DECRYPTION)
by pmetzger＠shearson.com 26 Jan '93

26 Jan '93

> From: thug(a)phantom.com (Murdering Thug) > Since none of us have ever been inside the NSA, we cannot > underestimate > their power and resources. For all we know they may have 500 Intel > Delta > supercomputers linked together, each having 65,536 i860-XP/50mhz > chips. > We really don't know what kind of iron they possess. Thus we can't > assume > that they can't factor extremely large numbers easily. Mr. Thug doesn't seem to understand the issue here. Your fear should be that the NSA knows something about number theory we don't, not that they possess a huge number of supercomputers. Consider that we believe the factoring problem to be exponential in the number of digits. That means that doubling the number of digits doesn't double the size of the problem -- it makes it far, far, far worse. Indeed, I suspect that it could be shown that using a key of only a few thousand digits, barring a change in factoring algorithm there would be no way to factor the number in the lifetime of the universe even were all the matter and energy in the universe given over to the factoring problem. There are problems that are known to be that size, by the way -- such as trying to do a complete search on the game tree for chess. So, if you are worried that the NSA might have 10,000 times the resources you suspected, you can just add a few more digits on to your key and defeat that possibility. Myself, I always use a key thats as long as possible to be safe, but I think that paranoia about their HARDWARE is wholely misplaced. The thing to be paranoid about is that they know something about factoring algorithms that we do not. Perry

1 0

manifesto
by P30TMR8%NIU.bitnet＠UICVM.UIC.EDU 26 Jan '93

26 Jan '93

how would I get a copy of the manifesto? Thanks, Micheal Roberts

1 0

Re: Rational PC mail , was Re: PGP on BBS
by pfarrell＠cs.gmu.edu 26 Jan '93

26 Jan '93

Jim, While serial ports do lose characters, especially if you don't have a 16550afn serial chip, I don't see this as a major hassle. In a pure DOS space, you really arn't likely to lose the characters, and this is the initial space of NUpop. With Windows, you have to learn to play with the priorities to make it work well, or get one of the intellegent serial driver DLLs that make it transparent. It is possible that the authors of the NUpop document don't worry too much about single character dropouts. There is plenty of redundancy in english. PGP will complain, but I can see retransmitting a message half a dozen times to get it thru cleanly will lose. I never allow my private key anywhere near a serial port. The public keys are checksummed, so it is easy to see that a character is wrong. I'd love to be able to use CSLIP. We (a bunch of folks on this campus) have just convinced the admin to allow POP services. It will take a while before we can convince them to allow SLIP, CSLIP, and PPP. In the meantime, I'll happily live with NUpop's serial support. Pat

1 0

Re: 5th AMENDMENT & DECRYPTION
by pmetzger＠shearson.com 26 Jan '93

26 Jan '93

> From: karn(a)qualcomm.com (Phil Karn) > > On the other hand, several other lawyers I've asked have responded "of > course!" when I ask them whether the 5th amendment would protect a > defendant from being compelled to divulge an encryption key without > immunity for the evidence it might decrypt. > > My own opinion, given that I seem unable to get a complete consensus > from the lawyers, (has this *ever* been possible?) is that the issue > is as yet untested in court and could go either way depending on the > actual case. But Mike seems much more pessimistic, and he *is* a > lawyer. I'm not. One might, of course, validly ask what the potential penalty would be for failing to divulge the key. Presumably, you would be held to be in contempt of court and sent off to jail until you divulged the key -- but at best you are likely to be locked up for a few months before the judge gives up. Given that, one can make a decision on whether the data you had encrypted is worth the loss of a few months of your life. (Remember, by the way, that merely having been in contempt is not nearly the same as having, say, a felony conviction on your record.) So even if they might have an argument for why they should be able to order you to give them a key, that doesn't mean that they have any real way to get it -- you can still fail to hand it over if you are willing to pay the price. Perry

1 0

Re: Computerized OTP (was 5th AMENDMENT & DECRYPTION)
by jim＠tadpole.com 26 Jan '93

26 Jan '93

> From: thug(a)phantom.com (Murdering Thug) > Since none of us have ever been inside the NSA, we cannot underestimate > their power and resources. For all we know they may have 500 Intel Delta > supercomputers linked together, each having 65,536 i860-XP/50mhz chips. > We really don't know what kind of iron they possess. Thus we can't assume > that they can't factor extremely large numbers easily. Um, I've been inside the NSA, (and I don't have a clearence.) They have a very nice visitors center, where they display some of their more arcane technology, along with little placards explaining what the hardware does. For instance, they display a very nice looking u-wave radio-based computer (complete with wax lenses), and a light-based floating-point engine that develops God-only-knows how many hundres Gflops, and yes, it can be custom programmed. They display a RISC core (of their own design) than also has a custom crypto unit on-chip, said unit can be field re-programmed. Also displayed are various arcane (antique) crypto devices. Jim P.S. Admittedly, I didn't get very far inside..

1 0