- cypherpunks-legacy - lists.cpunks.org

joy of export, h/ware
by Anonymous 17 Dec '03

17 Dec '03

At 10:06 AM 12/3/98 -0800, Michael Motyka wrote: >> Their architecture has real $$ value because it cracks 99% of >> "encrypted" traffic. >> >What type of attack was used in the famous test? Known plaintext? It >gets a bit tougher in the real world doesn't it? Not really. >> Offering the real stuff for sale in US requires some investment. >> >Really? Interesting question. Open a delaware corporation and sell munition-quality gate arrays in the back pages of Popular Electronics or EE Times... keep us posted... >I expect it would be easier to convince a manufacturer to participate >with a working prototype than it would with only an idea. Duh :-) >> Hardware is overkill for the single voice line. PGPfone works fine >> there. ^^^^^^^^ >> >No it is not. 500k gates may be too much but I maintain that you simply >cannot trust the Wintel HW, Windows or anything you cannot analyze in >detail and freeze. Besides, people like little palm-sized gadgets. * 10,000 gates cost less than a paper clip. 500K is high for a block cipher. * If we don't find something to do with them, at the rate we're producing them, the earth will be covered with silicon and its compounds soon. :-) * Its not like we'd ever put floating point routines, or blitting routines, out of business by integrating those functions in Si, is it? Naah, we'd never accelerate encryption with hardware, the CPU is bored and has nothing better to do, and its soooo expensive to print chips.. (That being said, I'll point out to myself how many asics have been replaced by dsps...but not without some inefficiency) * PGPfone on a very fast cpu plus fast link is still less pleasant than a noisy cordless (no pun intended). * We'd never take encryption hardware through the same path as modems, would we? First used between companies, then used for remote access, eventually you can't buy a bloody machine without one. Getting cheaper, faster, closer to the motherboard, taken for granted by applications. Ever seen a 300 baud, 40 lb modem, cost probably $3000 in 1970 dollars? The final level of deployment is when garage-door-openers, car remotes, and childrens' toys (e.g., radio controlled cars) use encryption chips... or chips with encryption, anyway. >Now an embedded system for secure e-mail that used a PC as a gateway >might be kind of cool. You drop encrypted attachments onto a driver that >sends them to the unit where you read them. Anything you enter and >encrypt at the unit is presented as a file at the host to be attached >and sent. USB would be plenty quick for that sort of stuff. Yes, the PC can be used as an untrusted router if the encryption is done outside it. The outside encrypting unit should also perform NAT, otherwise the PC (doing the tunnelling) can broadcast traffic ('trap and trace' in the pots world) info. The lower power used in PDAs really helps keep the boys in the White Van Across the Street busy. Email is so low-bandwidth that software suffices. Secure video conferencing on your Dick Tracy (tm) telewatch needs h/w support. --- Is 5% of YOUR communications encrypted or anonymous in '98 ?? ---

1 0

Re: Wassenaar Statement
by Anonymous 17 Dec '03

17 Dec '03

If these reports are correct, the United States could end up being one of the countries with the most LIBERAL export controls. In the United States, it is currently legal to export any cryptographic software you like - as long as it is in printed form. This is because of fears of violating the First Amendment. Not all countries have such strong conventions for protecting the printed word. PGP source code is being exported in printed form, scanned in overseas, and then distributed from there. If the Wassenaar Arrangement prevents it from being exported from its current overseas distribution site, a solution can be to ship it in printed form from the U.S. to a wide range of other countries. As long as those countries don't prohibit domestic distribution of crypto software, strong cryptography can still be made available almost everywhere. The PGP source code books begin with a section that is, in effect, a "how-to" for printing software in such a way that it can be reliably scanned. Each page and each line has a checksum. The books come with a Perl script short enough to enter by hand that does basic checksum verification. This is used to read a second, longer Perl script that can do error correction; and this is then used to bootstrap into the full script which will read the books, create all the files, organize the directories, and reconstruct the entire source code tree. It may be that in the future this will be the most effective way to communicate internationally about security software. It would be good for other groups to become familiar with this technology which has been pioneered by PGP.

1 0

Send email list - go to jail for life in China [/.]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > X-within-URL: http://news.bbc.co.uk/hi/english/world/asia-pacific/newsid_224000/224907.stm > Cyber dissident awaits trial in China > By China Analyst James Miles > > A man is awaiting trial in Shanghai prison charged with using the > Internet to try to subvert the government. > > Patrick Lin, 30, was arrested in March for sending 30,000 Chinese > e-mail addresses to an Internet magazine run by Chinese dissidents > abroad. [text deleted] ____________________________________________________________________ Technology cannot make us other than what we are. James P. Hogan The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Ethical programming guild? [/.]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > X-within-URL: http://slashdot.org/features/98/12/04/1158251.shtml > The following was written by Slashdot Reader James Moyer . > > In proposing this idea, I think that it would a little bit of > background would be appropriate. I am a student at Ohio State, and I > have a strong interest in civil liberties and privacy issues. In fact, > I am now in the process of organizing an on-campus student > organization to criticize Ohio State's overuse of the social security > number, biometric identification and other related issues to privacy > directly concerning the university. > > Here on Slashdot I use the nickname JimBobJoe posting from email > address vampire(a)innocent.com. > > I also consider myself a Libertarian, and from many of the postings on > Slashdot, it appears that there are quite a lot of Libertarians out > there too. There is no coincidence, in my mind, that some of the most > stringent privacy laws in the nation hail from a highly technical, > Libertarian state, being Washington state. In the same vein, it is > rather amusing to see countries such as Malaysia attempt to draw > computer professions into their country, where the severity of their > laws turn many away. [text deleted] ____________________________________________________________________ Technology cannot make us other than what we are. James P. Hogan The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

export of printed crypto [Was Re:Wassenaar Statement]
by Anonymous 17 Dec '03

17 Dec '03

The PGP source code is open, published in book form and this gets stronger 1st amendment protection. US crypto companies have also read the relevant portions of the EAR. Yet, none, to my knowledge, have tried this. Would any attorney reading the list care to comment? The EAR clearly states that printed crypto is not subject to the EAR whether the material is publically disseminated or not. Anyway, about one second after somebody did this another extra- constitutional "emergency" executive order would prohibit it. -Wassenaar >In the United States, it is currently legal to export any cryptographic >software you like - as long as it is in printed form. This is because >of fears of violating the First Amendment. Not all countries have such >strong conventions for protecting the printed word. >PGP source code is being exported in printed form, scanned in overseas,

1 0

Streams, Voice, and Sensitive Dependence
by Lee Davis 17 Dec '03

17 Dec '03

It is my understanding that the PGP algorithm is primarily intended as a block cypher. Therefore, wouldn't an Outer Block stream cypher be more effective for phone conversations? Both solutions require hardware for a practical (tolerably noiseless) implementation, so there's nothing to be gained by streaming data into a block format. In any case, there has been a lot of recent work in dynamic systems (Chaos), especially in the fast computations of Julia Sets. Has anyone seen a paper on exploiting the sensitive dependance in these systems for pseudorandom number generation?

2 2

Re: joy of export, h/ware
by Michael Motyka 17 Dec '03

17 Dec '03

>>What type of attack was used in the famous test? Known plaintext? It >>gets a bit tougher in the real world doesn't it? > > Not really. > Even if you don't know what you're looking for? Help me out with that one. > * PGPfone on a very fast cpu plus fast link is still less pleasant > than a noisy cordless (no pun intended). > You trust PGPfone on commercial HW enough to do your spy work with it? A system with dedicated audio compression ( http://www.dspg.com/ e.g. ) and a modem could probably be used to establish a secure, full-duplex link over the POTS. A microP, possibly with a small gate array to accel the crypto, would be able to handle the rest of job. Actually a pretty simple product. It could even use your dial-up account and be your internet phone. I know it has been done. I just won't be happy 'til it's in 50 million homes. > * We'd never take encryption hardware through the same path as modems, > would we? First used between companies, then used for remote access, > eventually you can't buy a bloody machine without one. Getting > cheaper, faster, closer to the motherboard, taken for granted by > applications. Ever seen a 300 baud, 40 lb modem, cost probably $3000 > in 1970 dollars? > Yes, I have. Fortunately encryption HW will not have to go through that sort of process. The frontier has been tamed, there are freeways everywhere - all you have to do is pick a lot and build. IOW - that 300 baud modem if done from scratch now would cost nowhere near $3000/unit. > The final level of deployment is when garage-door-openers, car > remotes, and childrens' toys (e.g., radio controlled cars) use > encryption chips... or chips with encryption, anyway. > The time is ripe. > The outside encrypting unit should also perform NAT, otherwise > the PC (doing the tunnelling) can broadcast traffic ('trap and trace' > in the pots world) info. > Clueless again! What is 'NAT'? > Email is so low-bandwidth that software suffices. > Absolutely. The issue there is more one of trustworthy HW and SW. Back to WINTEL/MICROSNORT. Again, !barf!.

1 0

Wassenaar Addendum
by John Young 17 Dec '03

17 Dec '03

Caspar Bowden in the UK says by telephone that a Wassenaar spokesman told him today that the WA org will issue next week a detailed "template" which specifies terms of the recent agreement to control encryption. It will go well beyond what has been heretofore generally agreed to by the member states under which there was a good bit of latitude for each to determine its own policy. This is an unprecedented united front by the members, and the paper will be a first for detailed export controls issued by the Wassenaar org rather than by each nation. When ready it will be put on the Wassenaar Web site: http://www.wassenaar.org. We've made a request to DoC for elaboration of the press release yesterday which featured David Aarons' general claims, but no response yet. The USG may not comment until the WA paper is issued. Caspar posted a capsule of his infor on UK Crypto: From: "Caspar Bowden" <cb(a)fipr.org> To: <ukcrypto(a)maillist.ox.ac.uk> Subject: News from Wassenaar Secretariat Date: Fri, 4 Dec 1998 16:23:58 -0000 Message-ID: <000101be1fa2$9da127e0$dc77e4d4@cpsb> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal Just talked to Dirk Weicke, Senior Adviser to Wassenaar Organisation. (Tel:+43 1 516360) No written details will be issued until next week, but gist is: *) No alteration to question of whether Wassenaar covers intangible exports. Up to signatory states to interpret and legislate. *) mass-market software, symmetric key length limited to 56-bits *) software generally available, but with other restrictive tests on end-user re-configurability, symmetric key length limited to 64-bits *) Assymetric key lengths (not sure how relates to above) limited to: RSA & Digital logarithm: 512 bits Elliptic curve : 112 bits -- Caspar Bowden http://www.fipr.org Director, Foundation for Information Policy Research Tel: +44(0)171 354 2333 Fax: +44(0)171 827 6534 ----------

1 0

Re: Streams, Voice, and Sensitive Dependence
by Jim Gillogly 17 Dec '03

17 Dec '03

"Lee Davis"<lee.davis(a)thomasmore.edu> skribis: > In any case, there has been a lot of recent work in dynamic systems (Chaos), > especially in the fast computations of Julia Sets. Has anyone seen a paper on > exploiting the sensitive dependance in these systems for pseudorandom number > generation? A number of attempts have been made to apply chaos to cryptosystems. The two that I've broken suffered from the same fault: although it's difficult to find the precise starting point (key) due to sensitive dependence, chaotic systems are by definition non-random, and have preferred orbits. If the cryptanalyst finds an orbit that's close to the one used by the actual key, the stream is mostly the same; this is good enough to hone the attack for the next pass. I'm not saying chaos has no applications in cryptography; only that the applications are not obvious. -- Jim Gillogly Trewesday, 14 Foreyule S.R. 1998, 19:37 12.19.5.13.7, 6 Manik 20 Ceh, Sixth Lord of Night

1 0

Re: Mixmaster client 4 the Mac OS?
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Mime-Version: 1.0 X-Sender: loki(a)sirius.infonex.com Date: Fri, 4 Dec 1998 10:08:01 -0800 To: Robert Hettinga <rah(a)shipwright.com>, mac-crypto(a)vmeng.com From: Lance Cottrell <loki(a)infonex.com> Subject: Re: Mixmaster client 4 the Mac OS? Sender: <mac-crypto(a)vmeng.com> Precedence: Bulk Several people have offered, but none have produced a fully functional version. -Lance At 8:53 PM -0500 12/3/98, Robert Hettinga wrote: >--- begin forwarded text > > >Date: Fri, 4 Dec 1998 01:42:19 +0100 >From: Anonymous <nobody(a)replay.com> >Comments: This message did not originate from the Sender address above. > It was remailed automatically by anonymizing remailer software. > Please report problems or inappropriate use to the > remailer administrator at <abuse(a)replay.com>. >Subject: Mixmaster client 4 the Mac OS? >To: cypherpunks(a)toad.com >Sender: owner-cypherpunks(a)cyberpass.net >Precedence: first-class >Reply-To: Anonymous <nobody(a)replay.com> >X-Loop: cypherpunks(a)cyberpass.net > >I heard sometime last summer that the mixmaster client was being ported to >the Mac. Does anyone know the status of this project? > >--- end forwarded text > > >----------------- >Robert A. Hettinga <mailto: rah(a)philodox.com> >Philodox Financial Technology Evangelism <http://www.philodox.com/> >44 Farquhar Street, Boston, MA 02131 USA >"... however it may deserve respect for its usefulness and antiquity, >[predicting the end of the world] has not been found agreeable to >experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' ---------------------------------------------------------- Lance Cottrell loki(a)infonex.com PGP 2.6 key available by finger or server. http://www.infonex.com/~loki/ "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ---------------------------------------------------------- --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0