- cypherpunks-legacy - lists.cpunks.org

Re: Infrared flash?
by Major Variola (ret) 28 Apr '04

28 Apr '04

At 10:28 PM 4/26/04 +0200, Thomas Shaddack wrote: >But when I want a really bright flash on about 800-900 nm, what approach >is the best? A 1 watt IR laser diode used for burning wood. They show up on eBay for ~$100. Might start a fire though :-) Also has pointing issues. >What would be the best approach? The energies here are more in the range >of rotation/vibration changes than electrons jumping up and down between >the energy states. How to convert a blast of electrical energy into a >shower of near-IR photons? Regular tungsten driven to red but not bright, with a piece of low-pass filtering glass over it. You can't get rapid modulation with tungsten, of course, but a few Hz is possible. Years ago IR leds on baseball caps were posited for defeating certain (eg ATM) cameras. Don't know if they worked.

1 0

Tipper "piggy" Gore
by Major Variola (ret) 28 Apr '04

28 Apr '04

At 06:39 PM 4/26/04 -0400, Steve Furlong wrote: >And, like all statists, they went widely astray of their goals. Frank >Zappa's _Jazz from Hell_ got a "Tipper Sticker", indicating obscene >lyrics. They didn't notice that _JfH_ was an instrumental album. I didn't know that album got Tippered. I do know that the she-pig's voice is on the Mothers of Prevention album.

1 0

RE: Lowering the Bar for Threats
by Trei, Peter 28 Apr '04

28 Apr '04

> -----Original Message----- > From: owner-cypherpunks(a)minder.net > [mailto:owner-cypherpunks@minder.net]On Behalf Of Eric Cordian > > I wonder how long it will be until Americans get their houses > pushed over > with bulldozers for criticizing the government. Probably at > least until > after the election. Didn't they do that at Waco? I remember the heavy vehicles knocking in the walls, as all the while the loudspeakers advised the men, women, and children trapped inside that 'this is not a raid'. Peter Trei

1 0

Re: Bank transfer via quantum crypto
by R. A. Hettinga 28 Apr '04

28 Apr '04

--- begin forwarded text

1 0

The crypto whiz
by R. A. Hettinga 28 Apr '04

28 Apr '04

<http://news.com.com/2102-7355_3-5201504.html?tag=st.util.print> CNET News http://www.news.com/ The crypto whiz By Michael Kanellos and Charles Cooper Staff Writer, CNET News.com http://news.com.com/2008-7355-5201504.html Story last modified April 28, 2004, 4:00 AM PDT Paul Kocher, president and chief scientist of Cryptography Research, came to prominence in the industry by breaking things. In 1998, the company cracked security on smart cards by monitoring how much power their internal microprocessors used. Kocher also came up with the software inside Deep Crack, a machine tailored to crack encrypted documents. Of course, he also fixes things. In the last few years, Kocher has emerged as one of the key technologists for financial companies and studios that are hoping to protect their intellectual property. He recently sat down with CNET News.com to discuss the ongoing melodramas surrounding privacy, piracy and stolen information. Q: What is the top agenda issue for cryptography? A: Let me tell you what it is not. The one thing that is stable--and really, nobody should be spending too much time worrying about--is which algorithms to use and what key sizes to use. Those are simple problems. The huge challenge, from a technical perspective, is handling complexity, because we are getting systems that are just more and more complicated, and nobody knows how to get the bugs out. The software side or hardware? Every legacy feature is a potential exposure. Software, hardware--everything. You pick it, and it is a lot more complicated today than it used to be, whether it is your network, whether it is your individual PC, whether it is a device of some kind, whether it is your microprocessor. Nobody ever removes features; they only add them--and from a security perspective, every legacy feature is a potential exposure. If you have one component that you understand really well, it is pretty easy to get your hands around your one simple piece. But then you start having 600 components that all talk to each other. Not only do you have 600 times as many components to worry about, you have to worry about all of the interactions between these things. So you have now got 360,000 different interactions. This is just horrible, because one person can no longer understand it; one person can no longer even begin to debug it. So, then you try to assign groups of people to individual pieces of the problem. But a lot of people staring at different angles of the elephant often will miss the big picture. In order to just handle this technical problem, what we often try to do is first simplify things. If you look at some of those things that we design, once you get your mind on what it is doing, it seems simple, compared to a lot of other things. That way, we can be more confident that we have not missed something. Can you give us an overview of what Cryptography Research does? Typically, our goal is to bring new technical approaches to solving really hard security problems. When you are dealing with any kind of new technology, if it backfires, there is a substantial risk. The ones that we have had the most success with have been with the security challenges of financial institutions like credit card organizations. Another area we are focusing on increasingly is piracy. We also do a lot of work with infrastructure wireless systems. Most of our revenues are from technology licensing, but most of our time goes into services. How bad is the privacy situation getting? Privacy is going to become a bigger and bigger problem over time, because sensors and data collection capabilities are improving along with Moore's Law. People collect data but do not have any plan of how they are going to get rid of it or what they are going to do with it, and so you end up aggregating vast quantities of data. It is a huge privacy risk. I can now record as much audio as I will ever experience in my entire life, and video will be there in just a few years. The chips to do location tracking are getting smaller and smaller. There is one in my cell phone. Anybody who knows what they are doing can know where I am. There is this notion that information is bad in aggregate--but good in the cases where you need it. This is something that is very alien to a lot of people, and I am not sure how to solve it. Piracy continues to be a huge, hot potato, with the studios blaming the device makers and the hardware makers trying to put responsibility on the studios. How will this get resolved? The studios are rightly upset that these companies are not spending as much money as they should to solve their security problems. But is it my job to keep your house from getting broken into? The way that I believe that it should work instead is that the studio should put some security code on the disk, and the player should run it. The technical impediments to piracy that's based on copying and storing the data are going to go away. The studios have a pretty powerful incentive to protect these materials, so how come this system isn't in place now? It turns out that there are some very complicated technical problems in making this work. And fixing the problem from an economic perspective is not the way most engineers look at it. Most people look at security as this binary thing: Either it is insecure, or it is secure. If you take that kind of a perspective, this whole notion of apportioning risk does not even really apply. One of the advantages our research group has is a lot of experience in working with credit card industries. The philosophy you learn there is really valuable, because there is this notion of risk. You can copy your average credit card with a piece of VCR tape and an iron. It is completely insecure technology, and you are always going to have fraud. But what matters is not whether you have fraud; it is what your fraud rate is. So, Visa's published numbers are 0.07 percent and 0.08 percent. Overall, it is profitable for the different participants. If the fraud rates went up by a factor of 10, it would not be. I think it has to be applied to other unsolvable problems like spam, like PC security, like piracy. Your goal here is to keep the rate of compromise low but to recognize that you cannot get rid of piracy completely or get rid of spam completely. But if piracy is below 1 percent of your revenues, it is the cost of doing business. How is the notion of risk sitting with the entertainment field? We have a guy in Japan who is meeting with CD companies. We've usually got somebody in Japan and somebody in LA. I am spending about half my time with studios right now. Nobody is saying anything publicly, but we have unofficial and strong support from much of the studios for what we are doing. Some studios have one person whose job is piracy across the entire studio. Others have an actual group of people that are reasonably technical. Who is more open to this concept--the music or the movie studios? I think that with the movie industry in particular, there is going to be this sudden and catastrophic point in time, where it becomes more convenient or more economically advantageous for your average person to pirate a movie instead of obtaining it legitimately. The music industry has sort of crossed a threshold already. They are really getting hammered by piracy. With movies, the only big difference is that you have a lot more data, which takes time to download. Instead of having a couple megabytes, you have a couple gigabytes. But Moore's Law clearly shows that is going to change, and when that changes, piracy rates are going to go up dramatically. Hard disks double about every 12 months. You will be able to put every major Hollywood release ever onto an $80 hard disk in high definition, and if it is not 2013, it will be 2015. The technical impediments to piracy based on copying and storing the data are going to go away. How did you get into cryptography, anyway? Well, you grow up in Oregon, and you have no driver's license, and you have a PC in your house--that's part of it. I went to Stanford and studied biology, so I cannot really credit my formal education with anything, but while I was there, I worked part-time for Martin Hellman (co-inventor of Public Key Cryptography). When I graduated, Hellman retired the same year and sent consulting projects my way. Also, the neat thing about cryptography is that almost any aspect of society you pick has some connection to it. When you look at the government and espionage and military issues, personal liberties to voting, it is very hard to find any issue that does not have some cryptography angle to it. ? -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[Neuclear-general] ANNOUNCE: Released version 0.7 of NeuClear Commons
by R. A. Hettinga 28 Apr '04

28 Apr '04

--- begin forwarded text

1 0

[Neuclear-general] ANNOUNCE: NeuClear XMLSig 0.13 Released
by R. A. Hettinga 28 Apr '04

28 Apr '04

--- begin forwarded text

1 0

The future of security
by R. A. Hettinga 28 Apr '04

28 Apr '04

--- begin forwarded text

1 0

RSA-576 Factored
by R. A. Hettinga 28 Apr '04

28 Apr '04

<http://mathworld.wolfram.com/news/2003-12-05/rsa/> MathWorld Headline News RSA-576 Factored By Eric W. Weisstein December 5, 2003--On December 3, the day after the announcement of the discovery of the largest known prime by the Great Internet Mersenne Prime Search on December 2 (MathWorld headline news, December 2, 2003), a team at the German Federal Agency for Information Technology Security (BIS) announced the factorization of the 174-digit number 1881 9881292060 7963838697 2394616504 3980716356 3379417382 7007633564 2298885971 5234665485 3190606065 0474304531 7388011303 3967161996 9232120573 4031879550 6569962213 0516875930 7650257059 known as RSA-576. RSA numbers are composite numbers having exactly two prime factors (i.e., so-called semiprimes) that have been listed in the Factoring Challenge of RSA Security.. While composite numbers are defined as numbers that can be written as a product of smaller numbers known as factors (for example, 6 = 2 x 3 is composite with factors 2 and 3), prime numbers have no such decomposition (for example, 7 does not have any factors other than 1 and itself). Prime factors therefore represent a fundamental (and unique) decomposition of a given positive integer. RSA numbers are special types of composite numbers particularly chosen to be difficult to factor, and they are identified by the number of digits they contain. While RSA-576 is a much smaller number than the 6,320,430-digit monster Mersenne prime announced earlier this week, its factorization is significant because of the curious property of numbers that proving or disproving a number to be prime ("primality testing") seems to be much easier than actually identifying the factors of a number ("prime factorization"). Thus, while it is trivial to multiply two large numbers p and q together, it can be extremely difficult to determine the factors if only their product pq is given. With some ingenuity, this property can be used to create practical and efficient encryption systems for electronic data. RSA Laboratories sponsors the RSA Factoring Challenge to encourage research into computational number theory and the practical difficulty of factoring large integers and also because it can be helpful for users of the RSA encryption public-key cryptography algorithm for choosing suitable key lengths for an appropriate level of security. A cash prize is awarded to the first person to factor each challenge number. RSA numbers were originally spaced at intervals of 10 decimal digits between one and five hundred digits, and prizes were awarded according to a complicated formula. These original numbers were named according to the number of decimal digits, so RSA-100 was a hundred-digit number. As computers and algorithms became faster, the unfactored challenge numbers were removed from the prize list and replaced with a set of numbers with fixed cash prizes. At this point, the naming convention was also changed so that the trailing number indicates the number of digits in the binary representation of the number. Hence, RSA-576 has 576 binary digits, which translates to 174 digits in decimal. RSA numbers received widespread attention when a 129-digit number known as RSA-129 was used by R. Rivest, A. Shamir, and L. Adleman to publish one of the first public-key messages together with a $100 reward for the message's decryption (Gardner 1977). Despite widespread belief at the time that the message encoded by RSA-129 would take millions of years to break, it was factored in 1994 using a distributed computation that harnessed networked computers spread around the globe performing a multiple polynomial quadratic sieve (Leutwyler 1994). The result of all the concentrated number crunching was decryption of the encoded message to yield the profound plain-text message "The magic words are squeamish ossifrage." (An ossifrage is a rare predatory vulture found in the mountains of Europe.) Factorization of RSA-129 followed earlier factorizations of RSA-100, RSA-110, and RSA-120. The challenge numbers RSA-130, RSA-140, RSA-155, and RSA-160 were also subsequently factored between 1996 and April of this year. (Amusingly, RSA-150 apparently remains unfactored following its withdrawal from the RSA Challenge list.) On December 2, Jens Franke circulated an email announcing factorization of the smallest prize number RSA-576. The factorization was accomplished using a prime factorization algorithm known as the general number field sieve. The two 87-digit factors found using this sieve are 3980750 8642406493 7397125500 5503864911 9906436234 2526708406 3851895759 4638895726 1768583317 x 4727721 4610743530 2536223071 9730482246 3291469530 2097116459 8521711305 2071125636 3590397527 and can easily be multiplied to verify that they do indeed give the original number. Franke's note detailed the factorization process in which "lattice" sieving was done by J. Franke and T. Kleinjung using hardware at the Scientific Computing Institute and the Pure Mathematics Institute at Bonn University, Max Planck Institute of Mathematics in Bonn, and Experimental Mathematics Institute in Essen; and "line" sieving was done by P. Montgomery and H. te Riele at CWI, F. Bahr and his family, and NFSNET (which at that time consisted of D. Leclair, P. Leyland, and R. Wackerbarth). Post-processing of this data to construct the actual factors was then done with the support of the BSI. For their efforts, the team will receive a cash prize of $10,000 from RSA Security. However, award seekers need not be deterred. As the following table shows, RSA-640 to RSA-2048 remain open, carrying awards from $20,000 to $200,000 to whoever is clever and persistent enough to track them down. A list of the open challenge numbers may be downloaded from RSA or in the form of a Mathematica package from the MathWorld package archive. number digits prize factored RSA-100 100 Apr. 1991 RSA-110 110 Apr. 1992 RSA-120 120 Jun. 1993 RSA-129 129 $100 Apr. 1994 RSA-130 130 Apr. 10, 1996 RSA-140 140 Feb. 2, 1999 RSA-150 150 withdrawn? open RSA-155 155 Aug. 22, 1999 RSA-160 160 Apr. 1, 2003 RSA-576 174 $10,000 Dec. 3, 2003 RSA-640 193 $20,000 open RSA-704 212 $30,000 open RSA-768 232 $50,000 open RSA-896 270 $75,000 open RSA-1024 309 $100,000 open RSA-1536 463 $150,000 open RSA-2048 617 $200,000 open References Franke, J. "RSA576." Privately circulated email reposted to primenumbers Yahoo! Group. Gardner, M. "Mathematical Games: A New Kind of Cipher That Would Take Millions of Years to Break." Sci. Amer. 237, 120-124, Aug. 1977. Leutwyler, K. "Superhack: Forty Quadrillion Years Early, a 129-Digit Code Is Broken." Sci. Amer. 271, 17-20, 1994. NFSNet: Large-Scale Distributed Factoring. http://www.nfsnet.org RSA Security.. "The New RSA Factoring Challenge." http://www.rsasecurity.com/rsalabs/challenges/factoring RSA Security.. "The RSA Challenge Numbers." http://www.rsasecurity.com/rsalabs/challenges/factoring/numbers.html Weisstein, E. W. Mathematica package RSANumbers.m. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Lowering the Bar for Threats
by Eric Cordian 28 Apr '04

28 Apr '04

Federal Prosecutors say the conviction of Matthew Hale on charges including trying to have a federal judge killed sends an important message. But don't they always? The "plot" to kill the federal judge in this case consisted of a recorded conversation with an FBI Informant which went something like this... FBI Shill: Are we gonna exterminate the rat? Hale: I'm going to fight within the law and, but, ... if you wish to, ah, do anything, yourself, you can. Uh, right. Emboldened by their latest success in pushing the envelope, the Feebs now plan to monitor so-called "Hate Sites" more closely, and warn that under the new standards, simply publishing someone's address could be considered a murder threat. Meanwhile, a man totally unconnected with the case is under 24 hour Feeb protection because he has the same name as the aforementioned FBI Shill, and someone posted his address on the Web by mistake. Murder plotting is easy. Comedy is hard. In other threat related news, a 15 year high school freshman in Washington was questioned by the Secret Circus after a portfolio of drawings he turned in featured an armed Middle Eastern man holding an oversized Shrub head on a stick. We can all thank God he didn't publish the President's address. So apparently, if someone asks me if I plan to kill the President, and I reply that I intend to conform my behavior to all the requirements of the law, but that I wouldn't cry uncontrollably if Shrub were dropped by parachute into a mob of screaming Iraqi women with cleavers, that's apparently good for a long prison sentence these days. I wonder how long it will be until Americans get their houses pushed over with bulldozers for criticizing the government. Probably at least until after the election. -- Eric Michael Cordian 0+ O:.T:.O:. Mathematical Munitions Division "Do What Thou Wilt Shall Be The Whole Of The Law"

1 0