- cypherpunks-legacy - lists.cpunks.org

Re: Secure key exchange
by edgar＠spectrx.Saigon.COM 03 Dec '92

03 Dec '92

Anserwing some comments about my suggestions for key verification. Phil Karn pointed out that the next version of PGP will display an MD-5 hash of any public key for phone comparison purposes. That's great, but that version of PGP isn't here quite yet. I suspect, in any case, that the added security isn't all that great since I suspect it's very hard to find another valid key-pair where the public key matches the last 24 bits plus some fragment of another 20 bits or so from the middle of the key. Phone, as opposed to mailed paper verifications has the following problems: Phil says you have to recognize the voice, which implies you've met him in close quarters, which implies you could have exchanged keys physically anyway. If the only place you've heard the voice is over the phone, that's not a very good criterion. Phone verification is good, IMHO, *only* if the person being verified is *called at a listed number*. You can't verify a person who calls you, (unless you know the voice). You can't verify a person you call at an unlisted number which you got over the net!! Economics: Net participants are scattered over the country and even the world. Paper verification costs about $2-$3 allowing for my fee, copying costs and two-way international postage. Adding notarization adds about $5.00. Phone verification is economical locally (maybe cheaper than mail), but more expensive when long-distance rates apply, especially international rates. Meeting at parties or face-to-face is most expensive of all, unless the meeting happens fortuitously. Overseas plane fare to exchange keys is beyond the means of most of us. Phil says: I would much rather trust a simple verification procedure based on redundancy and close personal relationships than a single, complex, impersonal process involving people I don't know. This is not to impugn your integrity, of course -- I'm simply speaking on principle. No offense taken! I, on the other hand, would rather have in my hand a signed statement of identity with photocopied ID that I can keep and file away. I also don't want to go broke making international phone calls. As it happens, I, so far, have not been able to sign a single key!! I called Phil Zimmerman at a listed number, I read him my key and he signed it, but he was called away from the phone before he could verify his key to me. So I can't sign his! I've met a few people at parties I've given my paper key (fragments) to. So far none of them have signed my key, but none of them had paper key fragments to trade, so I can't sign theirs. George Gleason commented about supplying home addresses. Your comments are well taken. Phil Zimmerman also commented to me in E-mail that some people don't want the serial numbers on their photo ID copied. Everyone please feel free not to supply a home address and to obscure any home address or serial number on the photocopied photo ID. I'll still sign your key, although I'll note what you did in my signed key directory, which I'll send to customers & publish here. If you don't want *me* to know your home address, you can use a P.O. box for me to return my (or other customers') ID certificate(s) to you. On the other hand, as the service provider, MY home address and phone are public info. I also acknowledge George's criticism re the "I'm not a cop" statement. I'm going to leave it in my statement, because it's true, but in general you should be aware that any legal protection is questionable at best. The lack of protection has been verified by a source on Extropians and by an attorney on the RIME network. In the meantime, I guess we can discuss illegal subjects not with "I've done ..." but with "I've heard that ..." or "I used to know somebody who ...". Also anonymous remailers will be a big help. -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Silicon Valley, Ca

1 0

Re: digest (not splitting)
by andrew_derry＠sfu.ca 03 Dec '92

03 Dec '92

Richard Childers <rchilder(a)us.oracle.com> says: >So do I, but a digest ( 225 / 4 == 56.25 messages per day, concatenated >into one giant digest of messages, sans headers ) would also make the >traffic manageable, while preserving the ability for the various groups >to benefit from one another's divergent, but relevant, insights into the >overall process and its possible applications. I'm for the digest format. Should make it much more managable. --- Andrew Derry | ACS@HCC - Simon Fraser University | Internet: derry(a)sfu.ca |

1 0

RE: digital banking, file formats, etc.
by DrZaphod 03 Dec '92

03 Dec '92

In Message Wed, 2 Dec 92 20:17:19 -0600, Karl L. Barrus <tree.egr.uh.edu!barrus(a)netcomsv.netcom.com> writes: >1) Alice chooses x, r > Alice computes B = r^3 * f(x) mod n > Alice sends the following message to the bank via an anonymous >remailer > > :: > withdraw > <account name> > <B = r^3 * f(x) mod n> > Reply-To: <an anonymous remailer> > <remailing request to Alice encrypted with appropriate remailer >public key> > What happens if the bank mails $$$ to Alice. Somebody intprive Alice of HER money. I havn't read much about digital money protocols so correct me if I'm wrong. TTFN! DrZaphod [AC/DC] / [DnA][HP] [drzaphod(a)ncselxsi.uucp] Technicolorized

2 1

Info Wanted
by nraizman＠winchester.pp.psc.edu 03 Dec '92

03 Dec '92

Wiggidi-wiggidi-whassup? I'm new here, and , while I can follow the digital money threads, and otehr such things, I am lost when it comes to this PGP and Public Key stuff. Could someone please explain it to me? Thanx a lot! nraizman(a)winchester.pp.psc.edu

1 0

No Subject
by nobody＠rebma.rebma.mn.org 03 Dec '92

03 Dec '92

Here's a new look for electronic cash. Instead of having a bank where people have accounts, have the "banker" be a money changer. He changes Federal Reserve Notes into crypto dollars. Anybody can send him dollars, and include an email address and public key, and he will email them that same amount of electronic cash. Anybody can email him electronic cash, and include a snail-mail address, and he will send them that same amount of U.S. dollars. You don't have a permanent relationship with him, you just use the service when you need to change between electronic and paper dollars. With the Chaum cash that was discussed here a while ago, where you need to "deposit" it right away when you get it, here's what you could do instead. Send it to the money changer, and ask for fresh crypto cash back. It's like you combined a "deposit" with an exactly equal "withdrawal". What you get back is good cash that you can hold or spend as needed. There are no account numbers involved, no demand deposits, no bank account at all. Eric Hughes mentioned demand deposits as defining a bank, so maybe this would be a way around that. -- Mr. Money --

1 0

Re: Suggest splitting things up
by crunch＠netcom.com 03 Dec '92

03 Dec '92

I recommend that we adopt Yim May's idea for how the mailing lists are split up. BTW, if that ever happens, I only want to me on the cypherpunks-technical, and cypherpunks-announce mailing lists. Cheers JD

1 0

Re: Suggest splitting things up
by John W Noerenberg 03 Dec '92

03 Dec '92

At 1:22 PM 12/2/92 -0800, John Draper wrote: >To Cypherpunks: > >Greetings, Back on-line again, after wading through about 225 messages >that has accumulated in the last 4 days. The volume of messages >is really getting high, and perhaps we might want to try and break >them up into the following proposed lists. Sounds like a fine idea. john noerenberg jwn2(a)qualcomm.com noerenberg.j (Applelink) =========================================================== Do not uselessly lament your luck that is giving way, your work that has failed, your life's plans that have all ended in despair. Like a man long prepared, like a man of courage, bid her farewell, the Alexandria that leaves you. -- "The God Abandons Anthony", Constantine Peter Cavafy [1911] ===========================================================

4 4

enjoy enjoy
by Fan Li TAI 03 Dec '92

03 Dec '92

Hiya, Below's something I found... I know you all have been swamped with mail... but this one is in the spirit of things, I think... Found it in Life... ____begin____ From: sherman@.cs.umbc.edu (Dr. Alan Sherman) Subject: Superpolylogarithmic Subexponential Functions Newsgroups: rec.music.dementia Announcing: Technical Report TRCS-91-17, University of Maryland Baltimore County. A preliminary version of this paper appeared in two parts in {\it SIGACT News}, {\bf 22}:1 (winter 1991), Whole Number~78, 65--73, and {\bf 22}:2 (spring 1991), Whole Number~79, 51--56. On Superpolylogarithmic Subexponential Functions Alan T. Sherman Computer Science Department University of Maryland Baltimore County Baltimore, Maryland 21228 and Institute for Advanced Computer Studies University of Maryland College Park College Park, Maryland 20742 June 21, 1990 (revised April 1, 1991) Abstract A superpolylogarithmic subexponential function is any function that asymptotically grows faster than any polynomial of any logarithm but slower than any exponential. We present a recently discovered nineteenth-century manuscript about these functions, which in part because of their applications in cryptology, have received considerable attention in contemporary computer science research. Attributed to the little-known yet highly-suspect composer/mathematician Maria Poopings, the manuscript can be sung to the tune of ``Supercalifragilisticexpialidocious'' from the musical Mary Poppins. In addition, we prove three ridiculous facts about superpolylogarithmic subexponential functions. Using novel extensions to the popular DTIME notation from complexity theory, we also define the complexity class SuperPolyLog/SubExp, which consists of all languages that can be accepted within deterministic superpolylogarithmic subexponential time. We show that this class is notationally intractable in the sense that it cannot be conveniently described using existing terminology. Surprisingly, there is some scientific value in our notational novelties; moreover, students may find this paper helpful in learning about growth rates, asymptotic notations, cryptology, and reversible computation. Keywords. Algorithms, asymptotic notation, complexity theory, cryptography, cryptology, DTIME, mathematical humor, Maria Poopings, Mary Poppins, musical computer science, reversible computation, Supercalifragilisticexpialidocious, superpolylogarithmic subexponential functions, SuperPolyLog/SubExp. --- lyrics --- Superpolylogarithmic Subexponential Functions (Sung to the tune of ``Supercalifragilisticexpialidocious.'') Um diddle diddle diddle, um diddle ay! Um diddle diddle diddle, um diddle ay! Superpolylogarithmic subexponential functions! Faster than a polylog but slower than exponential. Even though they're hard to say, they're truly quintessential. Superpolylogarithmic subexponential functions! Um diddle diddle diddle, um diddle ay! Um diddle diddle diddle, um diddle ay! For Alice to send a message through to Bob when Eve's eavesdropping, do use a trapdoor one-way function---not a one-key mapping. First take a message x, let's say, and raise it to the e; then mod it out by p times q but keep these secretly. Oh! (Chorus) Um diddle diddle diddle, um diddle ay! Um diddle diddle diddle, um diddle ay! The process takes but poly-time and appears to be secure: why even just a single bit is one over polylog pure. Though Alice thinks that Eve must spend time at least exponential, by using Lenstra's elliptic curves, Eve splits n subexponentially. Oh! (Chorus) Um diddle diddle diddle, um diddle ay! Um diddle diddle diddle, um diddle ay! we remove the heat with water but there's a better strategy. Since thermodynamics does not apply when info is not doomed, the laws of physics don't require that power be consumed. Oh! (Chorus) Um diddle diddle diddle, um diddle ay! Um diddle diddle diddle, um diddle ay! Now Bennett said in `73, to run a program P, you simulate the program P, but do so reversibly. The problem with this method is that space is exponential, so trade off time to save on space---this really is essential! Oh! (Chorus) Um diddle diddle diddle, um diddle ay! Um diddle diddle diddle, um diddle ay! Did you know if you invert one, you get a funtionential subexporithmic logapolyrepus? But that's quite a singularity! So, If you are in an oral exam and cannot find the way, just summon up these words and then you've got a lot to say. But better use them carefully or you could fail the test. A professor once asked me, ``What do you call functions that grow faster than any polylogarithm but slower than exponential?'' There're, Superpolylogarithmic subexponential functions! Superpolylogarithmic subexponential functions! Superpolylogarithmic subexponential functions! Superpolylogarithmic subexponential functions! --- end of lyrics --- Note: See paper for detailed performance notes and mathematical proofs by anagramming.

1 0

Re: Suggest splitting things up
by Richard Childers 03 Dec '92

03 Dec '92

>>Greetings, Back on-line again, after wading through about 225 messages >>that has accumulated in the last 4 days. The volume of messages >>is really getting high, and perhaps we might want to try and break >>them up into the following proposed lists. >Sounds like a fine idea. "I aggree." So do I, but a digest ( 225 / 4 == 56.25 messages per day, concatenated into one giant digest of messages, sans headers ) would also make the traffic manageable, while preserving the ability for the various groups to benefit from one another's divergent, but relevant, insights into the overall process and its possible applications. Even if you split the list into multiple 'sub-topical' lists, you'll be 'swamped' with N times the maintenance ( and I suspect maintenance is already a bit of a hassle, with bounce messages and the like 'deluging' the hapless administrative staff with a 'rain' of problems ), as well as 'flooded' with N times as many subscribe and unsubscribe requests ... and will probably still contemplate a digest format eventually. (-: An interactive direct mail option should be preserved, in fact, it would remain the primary entity ... all that's needed is to add some sort of alias that evaluates to a queue to the list, then write a script to read the queue ( with some queue management to avoid race conditions ), strip out all but trivial header information and '> ' those left behind, and generate email to those individuals whom have transferred themselves from the primary alias to the secondary digestifier-and-remailer. There's a thing called majordomo(a)greatcircle.com that does this, I think. I don't know if it's public domain, but it does a lot of this, firewalls and firewalls-digest are both served by it, and I think it also provides archival services and such. ( There are others, also. ) My $0.02. -- richard

1 0

bank protocol run through
by Karl L. Barrus 03 Dec '92

03 Dec '92

I find it useful to work through a protocol by hand a few times to really see what's going on. Here is an example of the digital bank protocol. It is meant for people who are curious to see if it works, as educational material for new subscribers, or general interest. I'm choosing relatively small numbers to use: in a real implementation, they would be much much larger. OK, let's start! ---------------------------------------- On the bank's side, it chooses the primes p = 2038074743 and q = 2038074947 and so the public key n = pq = 4153749073821763621 also phin = Euler totient function of n = (p-1)(q-1) = 4153749069745613932 The bank decides to make people use the exponent 5 (it's just easier to tell if GCD[5, phin] is 1) 1) Alice chooses a random x, r. She hashes x to yield fx x = 3141526535 r = 5772156649 fx = 2718281828 Here, I just picked the value of the hash function from the mathematical air, so to speak. Alice computes B = r^5 fx mod n = (5772156649^5 2718281828) mod 4153749073821763621 = 592088213321408342 -> B = PowerMod[r^5 fx, 1, n] in Mathematica Alice sends B to the bank. 2) The bank takes fifth root of B. Or, it raises B to the power that is the inverse of 5 mod n. To find the inverse of 5 mod n, compute inv1 = 5^(-1) mod phin = 5^(-1) mod 4153749069745613932 = 1661499627898245573 The bank can do this since it knows the factorization of n. -> inv1 = PowerMod[5, -1, phin] in Mathematica So, to take the fifth root: D = B^inv1 mod n = (592088213321408342 ^ 1661499627898245573) mod 4153749073821763621 = 1189395596986402260 -> D = PowerMod[B, inv, n] in Mathematica Just as a check: D^5 mod n = = (1189395596986402260 ^ 5) mod 4153749073821763621 = 592088213321408342 = B So we're OK. -> Mod[D^5, n] in Mathematica Bank sends Alice D. 3) Alice extracts C by dividing D by r. Or, she solves the following equation for C: D = C r mod n, or 1189395596986402260 = C 5772156649 mod 4153749073821763621 This can be solved by multiplying D by the inverse of r mod n, and taking the result mod n. You don't need to know the factors of n. As a technical note, there will be only one solution since GCD[D,n] = 1, which is usually true since n only has two factors p and q. The bank is in trouble if GCD[D, n] != 1 since that means n can be factored by the information in D. inv2 = r^(-1) mod n = 5772156649 ^ (-1) mod 4153749073821763621 = 3900656075651054436 -> inv2 = PowerMod[r, -1, n] in Mathematica So, C = (D inv2) mod n = (1189395596986402260 3900656075651054436) mod 4153749073821763621 = 3844350519262422248 -> C = Mod[D inv2, n] in Mathematica Just as a check: C r mod n = = (3844350519262422248 5772156649) mod 4153749073821763621 = 1189395596986402260 = D So we're OK. -> Mod[C r, n] in Mathematica So now Alice has x = 3141526535 and C = 3844350519262422248 4) Alice pays Bob by giving him (x, C) 5) Bob verifies that C = fx ^ (1/5) mod n. Or, he verifies that fx = C^5 mod n C^5 mod n = = 3844350519262422248 ^ 5 mod 4153749073821763621 = 2718281828 which does indeed equal f(3141526535) = 2718281828 where f is our hashing function. So Alice isn't cheating by sending a bogus (x, C) But Bob must also send (x, C) to the bank to verify Alice isn't trying to spend the money more than once! ---------------------------------------- So there it is, with numbers and Mathematica statements for those who have access to Mathematica. Hopefully, the numbers are large enough to convince people it didn't work out by chance. Now, the code to perform the math must be written, as well as the scripts to support the bank. Has anyone used the RSAREF routines, or should we stick to what's supplied with PGP? I haven't thought that far ahead. Like I said earlier, I'll pick up work on this in a few weeks. --- /-----------------------------------\ | Karl L. Barrus | | barrus(a)tree.egr.uh.edu (NeXTMail) | | elee9sf(a)menudo.uh.edu | \-----------------------------------/

1 0