- cypherpunks-legacy - lists.cpunks.org

Happy New Year 1999 - Export Trade
by anali 17 Dec '03

17 Dec '03

30-12-1998. DEAR SIR, WE ARE ONE OF LEADING EXPORT ORGANIZATION IN SRI LANKA.WE WISH FORWARD OUR EXPORT MARKETS INFORMATINS FOR YOUR REFERENCES.OUR EXPORT COMMDITIES DETAIL GIVEN BELOW: EXPORT COMMODITIES- ******************* 1.FRESH FRUITS AND VEGETABLES. 2.CEYLON BLACK TEA IN BAGS,PACKETS OR BULK. 3.CEYLON HERBAL TEA IN BAGES,PACKETS OR BULK.DETAILS AS FOLLOWS: i.Bevila Tea (Sida Racemosa)Recommended for Reumatic pains/Cooling. ii.Ginger Tea (Zingiber Officinale)Recommended for Stimulant/Carminative. iii.Beli Tea (Aegle Marmelos)Recommended for Chronic Fever/Piles. iv.Ranawara Tea (Cassia Auriculata)Improve complexion in Woman. v.Gotukola Tea (Centella Asiatica)Improve the Memory. vi.Cinnamon Tea (Cinnamomum Zeylanicum)Recommended for Reumatism/Cold. vii.Clove Tea (Eugenia Caryophyllata)Recommended for Cold/Stomachie. viii.Polpala Tea (Aerva Lanata)Recommended for Kidney flushing. ix.Lantana Tea (Phyla Nodiflora)Recommended as Diuretic/Carminative. 4.CEYLON HERBAL PORRIDGE IN CONSUMER PACKETS.(HATHAWARIYA,- GOTUKOLA,WEL-PENELA,MUKUNUWENNA & IRAMUSU). 5.CEYLON HERBAL TEA (BLOOD PURIFYING TEA)- TEPHROSIA PURPUREA,TINOSPORA CORDIFOLIA,PHYLLANTHUS EMBLICA,- EVOLVULUS ALSINOIDES & CASSIA AURICULATA. 6.CEYOLN HERBAL TEA (SLIMMING TEA)-GYRINOPS WALLA,- BAUHINIA VARIEGATE,ATALANTIA MISSIONIS,MINOSA PUDICA- & CALOTROPIS GIGANTEA. 7.SPICES (BLACK PEPPER,CARDAMONS,CLOVES,GINGER,MACE,NUTMEG TUMERIC AND CINNAMON). 8.FRESH COCONUTS AND DESICCATED COCONUT. 9.FIBER(COIR PRODUCTS)-FIBER MOSSTICK,HUSK CHIPS,COMPRESSED COCOHUSK,DUST,PEAT. 10.SEA FOODS.DETAILS FOLLOWS: i.Fish -Frozen/Chilled ii.Shrimp. iii.Black Tiger Farm Prawns. iv.Giant Tiger Prawns. v.Cattle fish. vi.Octopus. vii.Live Prawns. vii.Lobster (Live or Frozen) Processing and Packing can be arranged to suite your requirements.All shipments by Air and Carry Sri Lanka Government Health Certificate of Origin. 11.RICE AND DHAL (RED LENTILS ). 12.NARURAL RUBBER. 13.SUGER. 14.INTERNATIONAL BRAND NAME CIGARETTES. 15.INTERNATIONAL BRAND NAME BEER AND NON ALCOHOLIC BEER AND LIQUOR. 16.ALL INTERNATIONAL BRAND NAME PERFUMES. 17.CRUDE OIL,PETROLEUM BY - PRODUCTS. 18.MEAT PRODUCTS-CHICKEN/BEEF/PORK WE ARE THANKING YOU IN ADVANCE FOR YOUR EARLY ATTENTION IN THIS REGARD. BEST REGARDS, LIONES ENTERPRISES NO-30,SUNETHRADEVI ROAD,KOHUWALA, P.O.BOX-77 ,NUGEGODA, SRI LANKA. TEL :0094 1 823464 (5 Lines) FAX :0094 1 823464 E.MAIL:anali@slt.lk **************************** We are following brand name Cigarettese and Beer manufacturer's Agent. Details as follows: CIGARETTES - ALL PRICES IN F.O.B.COLOMBO/SRI LANKA (USD.) ********************************************************** ONE (01)CASE CONTAIN 10,000 STICKS ********************************** 1/MARLBORO - LIGHT/REGULER Origin:U.S.A. 2/MILD SEVEN -HARD PACK Origin:U.K. AND SWITZERLAND 3/DAVIDOFF -CLASSIC Origin:GERMANY 4/SUPER KING Origin:U.K. 5.REGAL KING SIZE Origin:U.K. 6.TEDLAPIDUS Origin:U.K. 7/ROTHMANS Origin:U.K. 8/DUNHILL Origin:U.K. 9/555 -REGULER/LIGHT Origin:U.K. 10/555 -INTERNATIONAL Origin:U.K. 11.Camel,Winston,Salem and More Brand Cigarettes we can supply at the rate of USD.315.00 QUANTITY: 1 MASTER CASE = 10.000 Cigs 1 x 20' Container = 430 Master cases 1 x 40' Container = 920 Master cases SHIPMENTS - 20' AND 40' FCL'S ONLY. ************************* BEERS ***** 1.BARON'S BEER (MADE IN HOLLAND) ******************************** Packing :24 cans per shrink-wrapped tray 2277 trays 24 x 330ml per 20'FCL Quality :5% Vol.Alc. 2.MASTER BEER(MADE IN HOLLAND) ****************************** Packing :24 cans per shrink-wrapped tray 2277 trays 24 x 330ml per 20'FCL Quality :5% Vol.Alc. 3.HOLLANDIA BEER(MADE IN HOLLAND) ********************************* Packing :24 cans per shrink-wrapped tray 2277 trays 24 x 330ml per 20'FCL Quality :5% Vol.Alc. 4.BAVARIA BEER(MADE IN HOLLAND) ******************************* Packing :24 cans per shrink-wrapped tray 2261 trays 24 x 330ml per 20'FCL Quality :5% Vol.Alc. 5.ORANJEBOOM PREMIIM BEER(MADE IN HOLLAND) ****************************************** Packing :24 cans per shrink-wrapped tray 2300 trays 24 x 330ml per 20'FCL Quality :5% Vol.Alc. 6.REMBRANDT MASTERPIECR LAGER BEER(MADE IN HOLLAND) *************************************************** Packing :24 cans per shrink-wrapped tray 2300 trays 24 x 330ml per 20'FCL Quality :5% Vol.Alc. 7.MELCHERS PREMIUM EXPORT PILSENER(MADE IN HOLLAND) *************************************************** Packing :24 cans per shrink-wrapped tray 2300 trays 24 x 330ml per 20'FCL Quality :5% Vol.Alc. 8.VAN DELFT PREMIUM EXPORT PILSENER(MADE IN HOLLAND) **************************************************** Packing :24 cans per shrink-wrapped tray 2300 trays 24 x 330ml per 20'FCL Quality :5% Vol.Alc. 9.HEINEKEN (GREEN LABEL)MADE IN HOLLAND *************************************** Packing :24 cans per shrink-wrapped tray 2300 trays 24 x 330ml per 20'FCL Quality :5% Vol.Alc. GENERAL TERMS AND CONDITION *************************** SHIPMENTS - 20' or 40' FCL'S ONLY. DELIVERY TIME :Received your L/c to our Bank arrange the shipment Further informations ******************** ATLANTIC NAVIGATIONS LINES (PVT) LTD NO-30,SUNETHRADEVI ROAD , KOHUWALA , NUGEGODA.COLOMBO. SRI LANKA. TEL: 0094-1-823464 (5 LINES) FAX: 0094-1-823464 E.Mail: anali(a)slt.lk

1 0

Re: Triple DES "standard"?
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Reply-To: <rankney(a)erols.com> From: "Rich Ankney" <rankney(a)erols.com> To: <dcsb(a)ai.mit.edu>, "Digital Bearer Settlement List" <dbs(a)philodox.com>, "Robert Hettinga" <rah(a)shipwright.com> Subject: Re: Triple DES "standard"? Date: Wed, 30 Dec 1998 09:40:38 -0500 Sender: <dbs(a)philodox.com> List-Subscribe: <mailto:requests@philodox.com?subject=subscribe%20dbs> <snip> > Actually, as I recall the tale, the Amercian Bankers > Association-sponsored ANSI-accredited X.9 Committee's blessing of DES3 was > itself pretty interesting. > > I understood that the NSA lobbied bitterly against the X9 effort to > standardize 3DES as an ANSI standard, insisting that DES would surfice > until its successor was chosen. > > A couple years ago, when the X9 committee -- or maybe one of the X9 > crypto subcommittees -- rejected that advice and initially recommended that > 3DES be made a standard, I was told that the NSA rep angrily declared that > 3DES would _never_ get an export license and would never be shipped > overseas. (Which may have put a damper on the 3DES standardization > effort;-) > > Unfortunately, these standards development efforts usually escape > the media's attention. Anyone on the list active in X9 and can give us the > real story? > I was at the meeting. This was a meeting of (I think) X9F3, which is a working group in X9F, which has several working groups doing security. 3DES was being pushed really hard by the Fed. The vote was to get a sense of how much interest there was in a 3DES standard. (There is no requirement to have such a vote to work on something; the X9 rules require a new work item ballot sent to all X9 members.) The NO votes were, IIRC, from NSA (with the above quote, more or less), IRS, and IRE (a commercial outfit located in Baltimore). NIST abstained. I don't recall the official X9 vote, but it was along the same lines. The work was done in a different working group, X9F1, chaired by the legendary Blake Greenlee. The standard was published a few months ago. Again, the Fed pushed really hard on this; kudos to them. I'm sure Cindy Fuller of the X9 Secretariat (cfuller(a)aba.com) would have the official X9 ballot results if anyone is interested... > Since the birth of X9 in the late 70s, the US National Security > Agency has its own representative on the X9 Committee. As one might > expect, the NSA has traditionally had significant influence over the ANSI > "F" (crypto) subcommittees and cryptographic standards in financial > services. There was a time when Ft. Meade effectively dictated those > standards. Now, that is not necessarily so.... > > (After the NSA blundered so badly in trying to force the Banking > industry to switch from DES to CCEP/Clipper in the late 80s, the Agency's > mesmerizing control broken. The initial intro of CCEP/Clipper -- at an ABA > meeting -- proposed that only US owned institutions could have access to > Clipper. At the time, as I recall, maybe 10-15 percent of the US banks > were foreign owned;-) The bankers couldn't believe that these idiots -- > obviously so ignorant about the workings of the industry they were trying > to defacto regulate -- were from the NSA of Legend and Lore.) > I didn't start attending meetings till the early '90's, but I can certainly testify that Clipper/Fortezza were pushed really hard. In fact, X9F1 may still have open work items on some of this stuff (no work going on, but it needs a formal vote to remove it from the list). My major objection was the attempt to standardize on a particular *product*, which used classified algorithms, vs. standardizing on a public algorithm which could be implemented in H/W or S/W. So X9 ended up with: 3DES instead of Skipjack; DSA and RSA (and ECDSA real soon now) for signatures; and DH, RSA, and EC (real soon now) for key management. It's interesting that our DH standard seems to have reinvented much of the interesting stuff in KEA. Regards, Rich --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: CLT&G Update: 29 Dec 98
by Michael Motyka 17 Dec '03

17 Dec '03

>> Jefferson and Madison were fearful, as more Americans should >> be today, of allowing power to be concentrated in the central >> government. > >The entire point of a consitutional democracy is to avoid >centralization. > >A better way to word this is that we should be afraid of the federal >government becoming the central government. > The ENTIRE point? ONE of the points was to define and limit the extents of centralization. There is no cure for the chronic tendency of people in power to try and increase their scope. The repeated application of palliatives is the only way to deal with that social disease.

1 0

Re: CLT&G Update: 29 Dec 98 (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Wed, 30 Dec 1998 08:53:44 -0800 > From: Michael Motyka <mmotyka(a)lsil.com> > Subject: Re: CLT&G Update: 29 Dec 98 > >The entire point of a consitutional democracy is to avoid >centralization. > > > >A better way to word this is that we should be afraid of the federal > >government becoming the central government. > > > The ENTIRE point? The ENTIRE point. > ONE of the points was to define and limit the extents of centralization. No, the point of a democratic government is to eliminate centralization of authority. To distribute and limit what each level can do from the top to the bottem. Read the 9th and 10th again. > There is no cure for the chronic tendency of people in power to try and > increase their scope. The repeated application of palliatives is the > only way to deal with that social disease. If you truly believe this then you should shoot yourself now and get it over with. There is a cure, that cure is to recognize the behaviour in people and build systems that limit the opportunity to express it. The best plan we've come up with so far is constitutional democracy. ____________________________________________________________________ What raises the standard of living may well diminish the quality of life. The Club of Rome The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

2 1

Crackers Set Sights on Iraq
by Mark 13 17 Dec '03

17 Dec '03

Geniuses at work: http://www.wired.com/news/print_version/politics/story/17074.html?wnpg=all > "It's a crime in itself to build weapons of mass destruction when the > children of the country are starving," said a group member who goes by > the name "kInGbOnG." And do they hope to kill Saddam, or help in NOT starving the nation? No, they plan to attack the government information systems used to rationing and planning deliveries of the food! > Though the systems' geographic origin could not be positively confirmed, > login prompts contained phonetic spellings of Arabic words. And to top it off, they're not even sure which country they are attacking! They can't possibly hit any military targets with this attack! And they hope to further the human rights with this attack? God save us from this kind of stupidity. -------------------------------------------------------------------------- http://www.wired.com/news/print_version/politics/story/17074.html?wnpg=all Crackers Set Sights on Iraq by James Glave 3:00 a.m. 30.Dec.98.PST A global group of 24 hackers and crackers spent Monday night probing, mapping, and preparing to attack computer networks owned by the government of Iraq. Quoting at one point from the Declaration of Independence, Steve Stakton, a member of the seven-year-old Legions of the Underground group, called for a concerted one-week cracking campaign against Iraq. "Iraq has treated human rights issues as poorly as China has," said Stakton in a meeting of the group that was held Monday night on Internet Relay Chat. "We need to carry out what the government won't, and can't, do." Stakton, 24, quoted from the group's mission statement: "We are ready to commence, and take [part] in electronic warfare if requested." Iraq has no connection to the public Internet, though Iraq Net, an official government homepage, is based in New York. Group members claim to be targeting an older, nonpublic network inside Iraqi borders that they say runs on a vintage protocol called X.25. "We are targeting them via terminal dialup," said Stakton in an interview conducted with group members on Tuesday over IRC, a global text-based chat network where identities can easily be forged. Group members said they were probing sequential network numbers within an older network owned by MCI, which they believed were assigned to Iraq. They described the system as "a gateway that handles systems that have no local chain of numbers." "It would effectively isolate them from the world if we took out the X.25," added a 19-year-old member based in Minnesota who goes by the name "lothos." "If we wanted we'd be able to dial up and make a huge amount of connection to their systems and possibly bring it down to its knees," Stakton said. One member said that he was analyzing network scans from the Iraqi cities of Ar Rutbah and Al Kut. Scott Ellentuch, a network security specialist with Internet consultancy TTSG, said X.25 networks are commonly used to connect older equipment. Iraq hasn't received any computers or computer supplies since the United Nations embargo was put in place at the time of the Gulf War. "If they do have an X.25 connection into Iraq, and that is their only network capability, someone could hop off the Internet and hop on to the X.25 and ride into the X.25 network," said Ellentuch. The group said its efforts partly involved "wardialing," a process of automatically dialing one phone number after another looking for modems. Members said that many modems answered at 2400 bps -- a speed common in the late 1980s. "Many other countries don't have ... technology as [advanced as] the United States," said Ellentuch. "The exploits that are possible on these machines have been around for ages." A member of the group supplied Wired News with a log of attempted connections to various institutional computer systems and bulletin board systems. Though the systems' geographic origin could not be positively confirmed, login prompts contained phonetic spellings of Arabic words. Stakton said that Legions' scanning efforts would continue Monday night, but declined to say when the group hoped to launch its attack. The Legions said that the attack was a legitimate act of protest against a rogue dictator. "It's a crime in itself to build weapons of mass destruction when the children of the country are starving," said a group member who goes by the name "kInGbOnG." In recent months, Legions of the Underground, whose members are largely in their 20s, has launched numerous attacks against China to draw attention to that nation's human-rights record. Last July, in a demonstration of their technical abilities, members claimed to have remotely moved a satellite dish owned by Time Warner Cablevision. The company confirmed a security breach in that incident.

1 0

New Crypto Regs
by John Young 17 Dec '03

17 Dec '03

Thanks to Ed Roback, NIST: BXA issued a press release today on new crypto regulations: http://www.bxa.doc.gov/press/98/1230encryption.html (copy below) The regs themselves are available today only in hardcopy in Washington DC on display at the Federal Register, but the electronic version will be published in the Federal Register tomorrow and will be on the BXA Web site <www.bxa.doc.gov>. Anybody in DC who could get a copy of the hardcopy and fax it to us, it would be appreciated: Fax: (212) 799-4003 Vox: (212) 873-8700 ---------- Commerce Updates Export Controls on Encryption Products (Washington, D.C.) The Commerce Department will publish new regulations significantly streamlining government export controls on powerful encryption -- products that scramble computer data -- as part of the Clinton Administration initiatives to make government more efficient and enhance the global competitiveness of U.S. businesses. These amendments to the Export Administration Regulations, on public notice today at the Federal Register, end the need for licenses for powerful U.S. encryption products to companies worldwide in several important industry sectors after a one time review by the Commerce Department. The regulations implement the policy changes announced by Vice President Gore in September. "Through the hard work of industry and government officials to finalize this regulation, U.S. encryption firms will be better able to compete effectively with encryption manufacturers around the world," said William A. Reinsch, Commerce Under Secretary for Export Administration. Virtually eliminated are restrictions on selling powerful computer data scrambling products to subsidiaries of U.S. corporations. There will also be favorable licensing treatment to strategic partners of U.S. companies. Strong U.S.-made encryption products are now available, under license exception, to insurance companies headquartered in 46 countries and their branches worldwide. Sales of powerful encryption to health and medical organizations in the same countries are also eased. To facilitate secure electronic transactions, between on-line merchants in those same countries, and their customers, the updated regulations permit, under a license exception, the export of client-server applications (e.g. SSL) and applications tailored to on-line transactions to on-line merchants. A list of eligible countries is posted on the BXA web-site. Further easing government restrictions are new allowances for U.S. encryption manufacturers to share their source code with their own foreign subsidiaries (while requiring that any resulting new products remain subject to U.S. regulation ) and streamlining reporting requirements for U.S. firms so that compliance is less burdensome. The new regulations expand the policy of encouraging the use of recoverable encryption by removing the requirement to name and approve key recovery agents for exports of key recovery products from regulations. It also defines a new class of "recoverable" encryption products which can now be exported under Export Licensing Arrangements to foreign commercial firms for internal company proprietary use. As part of its stated goal to balance the needs of national security and public safety with the desire to protect personal privacy and strong electronic commercial security, the Administration continues to encourage the development and sale of products which enable the recovery of the unscrambled data, in an emergency situation. Finally, the regulations eliminate the need to obtain licenses for most encryption commodities and software up to 56-bits or equivalent strength. [End]

2 1

National Know Your Bank Day
by Jim Burnes - Denver 17 Dec '03

17 Dec '03

In the interest of National Know Your Bank Day, for what its worth, I'd like to address the issue of perpetual public debt that the Federal Reserve System and our esteemed Congress has foisted on us. Here is a wonderful and powerful quote from Mr Jefferson. "To preserve [the] independence [of the people,] we must not let our rulers load us with perpetual debt. We must make our election between economy and liberty, or profusion and servitude. If we run into such debts as that we must be taxed in our meat and in our drink, in our necessaries and our comforts, in our labors and our amusements, for our callings and our creeds, as the people of England are, our people, like them, must come to labor sixteen hours in the twenty-four, give the earnings of fifteen of these to the government for their debts and daily expenses, and the sixteenth being insufficient to afford us bread, we must live, as they now do, on oatmeal and potatoes, have no time to think, no means of calling the mismanagers to account, but be glad to obtain subsistence by hiring ourselves to rivet their chains on the necks of our fellow-sufferers." --Thomas Jefferson to Samuel Kercheval, 1816. ME 15:39

1 0

limitations of fed power (was CLT&G Update: 29 Dec 98 (fwd)) (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Wed, 30 Dec 1998 11:46:39 -0700 (MST) > From: Jim Burnes - Denver <jim.burnes(a)ssds.com> > Subject: limitations of fed power (was CLT&G Update: 29 Dec 98 (fwd)) > > > >The entire point of a consitutional democracy is to avoid >centralization. > > > > > > That would be a valid point if we were living in that arrangement. I > like to be a little more specifc. We are living in a democratically elected > reprentative constitutional republic. A representative democracy is still a democracy. The ONLY guarantee of limits in ANY democracy is whether it is constitutional or not. That is the defining issue because that is what limits and defines the governmental structures. The defining issue is not whether it is representative or direct but rather that it has a constitution. A constitution and a bill of rights are in no way a requirement for a democracy (representative or direct). That constitution is what prevents mob-rule. > The point of that constitution is to shackle the tendancy of > a bureaucracy from assuming authority over matters never > assigned to it and using its enforcement powers to assure it. Which is the point under discussion after all. > Eventually the people, wallowing in ignorance, forget the > infraction and the bureacracy assumes de facto control. That is a function of human psychology and not democracy. Blaiming democracy for a function of human behaviour is more than a little misleading. People are social animals. It's gotten us this far and there is no reason to expect a radical shift in human population dynamics in the near term. Really a moot point. It is also the reason the constitution splits authorities, per the 9th and 10th, as it does. The fundamental aspect of a working democracy is conflict, not cooperation as much of todays spin doctor press would have you believe. And by conflict I don't mean spilled blood in the streets. What is really amazing about it is that we have the intelligence to recognize and deal with the trait at all. ____________________________________________________________________ What raises the standard of living may well diminish the quality of life. The Club of Rome The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

[ISN] Academic Attacks on SAFER+ (fwd)
by Max Inux 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Subject: [ISN] Academic Attacks on SAFER+ Forwarded From: "Jay D. Dyson" <jdyson(a)techreports.jpl.nasa.gov> Originally From: John Kelsey <kelsey(a)plnet.net> I believe I have found two attacks on the SAFER+ version with 256-bit keys. While these attacks aren't practical, they demonstrate a weakness in the SAFER+ key schedule design, and may lead to more practical attacks in the future. The first attack is a modified meet-in-the-middle attack, requiring 2 known plaintexts and their corresponding ciphertexts, 2^{37} bytes of memory, and work equivalent to about 2^{241} SAFER+ encryptions. I have discussed this attack with Massey, and am fairly confident it really works. The second attack is a related-key attack, requiring 256 chosen plaintexts and their corresponding plaintexts encrypted under two related keys, and work equivalent to about 2^{216} SAFER+ encryptions. This is a much newer attack (about two days old), and I am less certain of it, but I believe it works. I will be writing these attacks up for publication fairly soon, but I wanted to announce them here to get the word out, and to see if anyone can either improve on them or find problems with them. Both attacks exploit two useful properties of SAFER+. First, I will describe the two useful properties, then I will describe the two attacks very briefly. The rest of this note assumes familiarity with SAFER+. 1.0. The Two Useful Properties of SAFER+ Consider SAFER+ with a 256-bit key. The key schedule is quite simple: We extend the key by a parity byte, getting a 33 byte extended key. We then use the 33 byte extended key to generate the entire sequence of subkeys. Each subkey byte is determined by only one key byte. If you know a given key byte, you know all the subkey bytes it determines; if you know a subkey byte, you know the key byte from which it was derived. SAFER+ rounds use 32 bytes of subkey each, in two blocks of 16 bytes. If the key bytes are k[0..32], then we have First Round: k[0..15] k[1..16] Second Round: k[2..17] k[3..18] Third Round: k[4..19] k[5..20] etc. This means that it takes quite a while in the encryption process for the last couple key bytes to affect the encryption. SAFER+ with a 256 bit key has 16 rounds and an output transformation. The output transformation uses only sixteen key bytes. Now, consider how many key bytes have affected the encryption at all after each round: After the first round (round 0), 17 key bytes have been used. After the second round, 19 key bytes have been used. After the third, 21. Continuing, we can see that it takes 9 (out of 16) rounds before SAFER+ has used all 32 key bytes. This allows both of my attacks. 0 17 1 19 2 21 3 23 4 25 5 27 6 29 7 31 8 all The other useful property is that we don't have to know all the key bytes to be able to recognize an output from a round of SAFER+ as being correct. Consider the situation where we know all but the last byte of the key of some round, and we know its input block. Each SAFER+ round consists of the keyed byte substitution layer, and the mixing layer. If we know k[0..14], but not k[15..16], then we end up knowing all but two bytes of the input into the mixing layer. The result is that we end up knowing *none* of the bytes of the output. However, we still know relationships between the bytes of the output. The matrix that describes the mixing layer makes it easy to see how to combine the output bytes into values that are not dependent on the unknown bytes of input. Now, consider a situation where we know all but the last two key bytes for round 0, and all but the first two key bytes for round 1. We can go backward through the mixing layer of round 1 (it's unkeyed), and then go back through the keyed byte substitution layer, learning all but two bytes of the output from round 0. We then make use of the trick described above. We will know relationships between the remaining known bytes of output from round 0, regardless of the unknown key bytes. 2.0. The Meet-in-the-Middle Attack The real insight that makes the low-memory attack work is that we can do meet-in-the-middle with two rounds whose key material we don't know all of. That is, we guess the keys for rounds 1-7 (numbering from one), which gives us all but two of the bytes for round 8. That's 29 key bytes guessed. We then compute some expressions in the output bytes of round 8 that don't rely on knowing the two unknown bytes of key, and that don't rely on knowing the two bytes of round 8's output that will depend on the two unknown key bytes when doing the guess on the other side. We guess the keys for the output transformation (16 bytes), plus the keys for rounds 10-16. That means 30 bytes of key guessed, and it also gives us enough information to get knowledge of all but two bytes of the output of round 8. We then compute those same expressions in those bytes. The result is that we can do the meet-in-the-middle at the output from round 8, despite not knowing all the key bytes used in round 8 or 9. Round | Key Bytes Guessed 1 17 2 19 3 21 4 23 5 25 6 27 7 29 8 29 (two unknown key bytes) - - -------------- (this is where the meet-in-the-middle happens) 9 30 (two unknown key bytes) 10 30 11 28 12 26 13 24 14 22 15 20 16 18 OX 16 That is, we can compute a set of bytes that are dependent only on the 29 bytes of key guessed from the top, or the 30 guessed from the bottom. Now, this would seem to take up a lot of memory to do this meet-in-the-middle attack. Fortunately, however, most of the key bytes guessed from the top are also guessed from the bottom. We thus mount the attack by first guessing all key values in common from the top and the bottom. We then do the meet-in-the-middle by trying all possible 2^{24} values from one side, and all possible 2^{32} values from the other. We compute this intermediate value that doesn't need any other key material from both sides, store our results in a sorted list, and look for duplicates from the top and bottom. With two plaintexts, it's easy to get more than 32 bytes of intermediate values, meaning that we don't expect to see any matches from incorrect guesses. 3.0. The Related-Key Attack The related-key attack works on a similar principle. My current attack is very simple: We choose a pair of keys, K,K^*, such that the keys differ only in the first two bytes; in these two bytes, we have a difference of 0x80. Under K we encrypt 256 plaintexts, P[i], each identical except with a different leftmost byte. Under K^* we encrypt 256 plaintexts, P[i]^*, with some fixed difference D<>0x80 from P[i] in the leftmost byte, and with fixed difference 0x80 in the next byte over. With probability about 1/2, we get at least one pair of plaintexts P[i],P[i]^*, whose values after two rounds are identical under the different keys. When this happens, their values are also identical after nine rounds. Now, we do our trick from the meet-in-the-middle attack, again, and guess the last 26 bytes of relevant key material. This lets us peel off the output transformation and the last five rounds, leaving us with access to the output from the eleventh round. We can peel off the PHT layer, since we know it and its inverse. We can then learn all but two of the bytes input to the eleventh round. We now know all but two bytes of the output from the tenth round, and we know a pair of texts for which only the last two bytes of the input to the tenth tound had changed. We can check to see if the values we've computed as being the outputs from the tenth round are consistent with this situation, and thus are consistent with this being a right pair. We expect to have to check 256 different pairs of texts in this way, each with work equivalent to 2^{208} SAFER+ encryptions. This leaves us with work equivalent to about 2^{216} encryptions, total, to learn 208/256 of the SAFER+ key bits. The remaining 48 bits can be brute-forced after these are known. We thus break SAFER+ with a differential related-key attack, using 2 related keys, 512 plaintexts encrypted under each key, and 2^{216} work. Comments? - - --John Kelsey, kelsey(a)counterpane.com / kelsey(a)plnet.net NEW PGP print = 5D91 6F57 2646 83F9 6D7F 9C87 886D 88AF -o- Subscribe: mail majordomo(a)repsec.com with "subscribe isn". Today's ISN Sponsor: Internet Security Institute [www.isi-sec.com]

1 0

'Tis the day after Christmas And something's not right
by qiy68＠leica.com.au 17 Dec '03

17 Dec '03

'Tis the day after Christmas And something's not right Were painfully aware That our clothes are too tight. We ate lots of gravy And pumpkin pie too Oh, no, not a diet... But what shall we do? Now you can lose weight without suffering. Call Tides of Life at 1-888-817-7443 for information on safe, natural, and effective weight loss products. Our premier product, Cheat & Eat, contains 1000 mg of chitosan per tablet along with herbs. This binds to fats and sugars in the intestinal tract, blocking absorption and passing them out of the body before you can absorb the calories! Also stops sugar cravings. Clinical studies show an average weight loss of 4 pounds per week with no drugs, side effects or starvation diets! We are offering a great introductory price of $29.50 plus $2.50 shipping for a 6 week supply. You can buy much weaker chitosan products for $70/bottle but we have located the best product for you at the best price. Call 1-888-817-7443 for more information on Cheat & Eat and other natural weight loss products. Tides of Life has specialized in natural hormonal products and related health supplements since 1993. Free price list upon request. *-*-*-*-*-*-*-* Removal from lists, please go to http://209.216.69.189/remove/ #2167659jdfv94894hde nqr is <qiy68@leica

1 0