- cypherpunks-legacy - lists.cpunks.org

Re: Moderation, Tim, Sandy, me, etc. * Strong crypto == DES?!
by Dale Thorn 17 Dec '03

17 Dec '03

John Gilmore wrote: > I'm glad we're talking about some of the real issues here. > I'm definitely bugged by the community's attitude toward my "censorship". I'll bet you are. > Perhaps at that point I should have shut down the list, as Lucky is > now suggesting. He'd really like to, but... > You-all remind me of a passage from Booker T. > Washington's book _Up From Slavery_, describing what happened on the > night that news of the Emancipation Proclamation reached the South: What we most remind him of are slaves. > Most of the people on the list haven't bothered to face that freedom. Which freedom is that? > If you want to help organize what I'll call the `progressive crypto > community', for lack of a better term, then please do. Otherwise, in > the immortal words of Lazarus Long, "PIPE DOWN!". i.e., stop saying what I don't want to hear and start saying what I do want to hear, after all, it's *my* list.

1 0

Re: GAK/KR spin
by Peter Trei 17 Dec '03

17 Dec '03

> Date: Mon, 3 Feb 1997 14:34:49 -0800 > From: Steve Schear <azur(a)netcom.com> > To: cypherpunks(a)toad.com > Subject: GAK/KR spin > Several months back there were discussions on the list regarding renaming > the government's key escrow/recovery proposals (KRAP comes to mind). I > think we need something that's catchy and simple (perhaps already familiar) > to understand for the semi-litterate citizen units. I propose we encourage > use of the terms "crippleware" or "crypto crippleware" when refering to the > products limited to their weak crypto and/or key escrow/recovery. > > --Steve For some time, I have been using the term 'espionage-enabled software' to describe GAK'd products. Also, 'compromised software' - I want to make the point that 'key escrow/recovery' == insecure.' Peter Trei trei(a)process.com PS: I have SW for working on the $10,000 DES challenge available.

1 0

RE: My Departure, Moderation, and "Ownership of the List"
by Jason Vagner 17 Dec '03

17 Dec '03

>(And if Sandy wants comity and good cheer, let him either form >his own list or establish a filtered list just the way Blossom >and Arachelian did. Hijacking the list to reform it in his own >image is dirty pool.) Just something from another perspective: I've been on the list for quite a long time, though I've never posted. I've been online for over ten years, ran my share of mailing lists, and understand majordomo quite well. As far as I can tell, nobody has ever advertised or posted instructions for joining Blossom's or Arachelian's lists. At one time I gave a little bit of an effort to find them, to no avail. They don't seem readily available on the search engines (again, as of about 6 months ago). I never did flat out post a request for the information, as it was not that important for *me* to find it. I imagine that these individuals might have limited resources for a list-too-large, but is there really a reason this is request-only info? --- Jason Vagner <jlv(a)sig.bsh.com> Resist KRAP and GAK. Police States Are Bad. "All that one can give is what is going to happen, which may have little to do with a present that you can grasp." - Avital Ronell.

1 0

Re: New X-Ray Imager
by Adam Shostack 17 Dec '03

17 Dec '03

| A poll last week by the Los Angeles Times found that a majority of people -- | 58 percent -- said they would curtail some civil liberties if it would help | thwart terrorism. Thirteen percent said it would depend on what rights were | at stake. The poll didn't ask people to single out any rights. Its worth noting the 'if it would help thwart terrorism.' The 'best,' most expensive anti-terrorism measures ever used in the US were at the Summer Olympics. The White House point man on encryption admitted at last years CFP that Clipper and its derivatives would not have prevented the Oklahoma city bombing. A question worth asking is do we want to apply evolutionary pressure to terrorists? I prefer hijacking to bombings wrt aircraft, but the FAA disagrees. I prefer having my car stolen without me in it as well. (I think John Gilmore asked that question, but I could be wrong.) Adam -- Pet peeve of the day: Security companies whose protocols dare not speak their name, because they don't have one. Guilty company of the day is now V-One.

1 0

IBM's SecureWay Key Recovery technology
by Marshall Clow 17 Dec '03

17 Dec '03

>From <http://www.ibm.com/Security/html/prkeyrec.html>: >At the RSA Conference, IBM announced the details of its highly >anticipated SecureWay key recovery technology. IBM is developing this >technology in response to market demands for exportable strong >encryption required to advance the growth of global e-business. >[ yada yada yada snipped ] I attended this presentation. Basically, what they do is to add two packets to the "channel setup process", one that depends only on the coorespondents, the other that contains the information about this particular session. A problem with this, as I pointed out to the presenters, is that the first packet can be trivially used for traffic analysis. The eavesdropper may not be able to determine who is cooresponding, but they can tell if it is the same people as in a previous conversation. >From <http://www.ibm.com/security/html/wp_keyrec2.html> >In order to minimize the preparation overhead, the recovery information >is prepared in two phases: one phase is independent of the particular >session/archive key being prepared; the second phase is dependent on the >particular key and session parameters. The first phase, which uses >public-key encryption, can be shared across multiple invocations of key >recovery preparation, thus reducing overhead. The public-key encryptions >can be stored for repeated use. > As you can see, IBM suggests cacheing the contents of the first packet, so that you don't have to recalculate it each time. Imagine how easy traffic analysis would be if the identification packets were identical instead of just related. -- Marshall Marshall Clow Aladdin Systems <mailto:mclow@mailhost2.csusm.edu> Warning: Objects in calendar are closer than they appear.

1 0

AltaVista Tunnel
by Rick Osborne 17 Dec '03

17 Dec '03

The Digital / Microsoft "Driving Force" tour is in our parking lot today and I got the opportunity to have a look around. One of the 'stations' inside the truck is on intranets. They were showing off a product called "AltaVista Tunnel" which I assume is their PPTP product. I say "I assume" because the guy showing it off had absolutely no clue what he was talking about. He triumphantly exclaimed that the encryption was 128-bit, but when I said "128-bit what?" he cowered and muttered that he didn't know and went on with his little speech. The rest of my crypto-specific questions met with equal dark stares. And these are the people setting industry standards... _________ o s b o r n e @ g a t e w a y . g r u m m a n . c o m _________ Real programmers programs never work right the first time. But if you throw them on the machine they can be patched into working in only a few 30-hours debugging sessions.

1 0

DES keyspace
by Joel McNamara 17 Dec '03

17 Dec '03

Is anyone coordinating (formally or informally) which chunks of the keyspace has been searched for the DES challenge? Yes, I know all the arguments about potential fraud and verification, but it would be nice to have a Web site that informally listed what had been scanned so far (verified or not). Did I perhaps miss something and this is already out there? URLs appreciated if so. If it doesn't exist, I'd be willing to host a site and play coordinator... Joel

1 0

Re: Embarrass a Marylander, go to jail
by Scottauge＠aol.com 17 Dec '03

17 Dec '03

Think they are trying to expand the harrassment laws to directly effect the E world, but I would think the laws on harrassment would apply anyhow (provided your in their domain, but then again thats true for all governments...) --- How has the government interfered in your life today?

1 0

DES keyspace
by Joel McNamara 17 Dec '03

17 Dec '03

Is anyone coordinating (formally or informally) which chunks of the keyspace has been searched for the DES challenge? Yes, I know all the arguments about potential fraud and verification, but it would be nice to have a Web site that informally listed what had been scanned so far (verified or not). Did I perhaps miss something and this is already out there? URLs appreciated if so. If it doesn't exist, I'd be willing to host a site and play coordinator... Joel

1 0

IBM's SecureWay Key Recovery technology
by Marshall Clow 17 Dec '03

17 Dec '03

>From <http://www.ibm.com/Security/html/prkeyrec.html>: >At the RSA Conference, IBM announced the details of its highly >anticipated SecureWay key recovery technology. IBM is developing this >technology in response to market demands for exportable strong >encryption required to advance the growth of global e-business. >[ yada yada yada snipped ] I attended this presentation. Basically, what they do is to add two packets to the "channel setup process", one that depends only on the coorespondents, the other that contains the information about this particular session. A problem with this, as I pointed out to the presenters, is that the first packet can be trivially used for traffic analysis. The eavesdropper may not be able to determine who is cooresponding, but they can tell if it is the same people as in a previous conversation. >From <http://www.ibm.com/security/html/wp_keyrec2.html> >In order to minimize the preparation overhead, the recovery information >is prepared in two phases: one phase is independent of the particular >session/archive key being prepared; the second phase is dependent on the >particular key and session parameters. The first phase, which uses >public-key encryption, can be shared across multiple invocations of key >recovery preparation, thus reducing overhead. The public-key encryptions >can be stored for repeated use. > As you can see, IBM suggests cacheing the contents of the first packet, so that you don't have to recalculate it each time. Imagine how easy traffic analysis would be if the identification packets were identical instead of just related. -- Marshall Marshall Clow Aladdin Systems <mailto:mclow@mailhost2.csusm.edu> Warning: Objects in calendar are closer than they appear.

1 0