- cypherpunks-legacy - lists.cpunks.org

Article requests
by Tim Philp 17 Dec '03

17 Dec '03

I have received many requests for the articles that I wrote on Cryptography so I will post them to the list with the subject "ARTICLES" Regards, Tim Philp =================================== For PGP Public Key, Send E-mail to: pgp-public-keys(a)swissnet.ai.mit.edu In Subject line type: GET PHILP ===================================

1 0

MD4 collision
by norm＠netcom.com 17 Dec '03

17 Dec '03

Hans Dobbertin in Germany has found two messages to which MD4 assigns the same hash.

1 0

ARTICLES
by Tim Philp 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Copyright (C) 1995 Tim Philp Brantford, Ontario Canada Article appeared in The Expositor, Brantford, Ont., Canada June 10th, 1995 - COMPUTER CRYPTOGRAPHY - - PROTECTING YOUR PRIVACY - by Tim Philp Last week I discussed ways that the computer has made our lives less private. Today we take up that thread and talk about the stuff of spy novels.Cryptography, in the context that we are discussing it, is a means of preventing unauthorized people from reading our files or correspondence. Cryptography is not new. It has been used throughout history and has played its part in shaping events. Mary Queen of Scots was beheaded because the cipher that she used to arrange a rebellion against Elizabeth I was decoded by the government. Julius Caesar used a primitive cipher, now known as a Caesar Cipher, to disguise his messages to Rome during his military campaigns. Every letter in his messages was replaced by the letter three letters farther in the alphabet. Thus A would become D, B would become E, until you reached the end of the alphabet. You would then wrap around to make X equal to A, Y equal to B and Z equal to C. In this way the word CAESAR would become FDHVDU. Simple substitution ciphers like this one are easily broken and today are used in puzzle books to provide a few moments diversion to puzzle fanciers. The role of computers in cryptography goes back to the early days of computers. One of the first computers was used to help decode enemy messages in England during the second world war. The 'boffins of Bletchley' were the true progenitors of the computer, not IBM. Cryptography has progressed far beyond the simple Caesar Cipher. Indeed, today's methods of encoding messages have progressed to the point where the ciphers are unbreakable within any reasonable amount of effort. It does no good to break a cipher if it takes 1500 years of computer time to do it! Of interest to computer users is the development of a type of cryptography called Public Key Cryptography. With this method you have two keys, a public key and a private key. Simply speaking, a key is a very long number that is used by your program to encode and decode messages. Each person that you want to communicate with has a public key that is published and is known by everyone. To send a message to your friend you would use his public key to encode the message. Your friend receives the message and uses his private key to decode the message. The beauty of this technique, is an eavesdropper can intercept the encoded message and the public key of the recipient, but he cannot use this information to decode the message without the secret key of the recipient. In older systems you had to transmit the secret key to the recipient. The secret key could be intercepted and used to decode the messages. Public key systems require that only the public key be transmitted to the recipient. The message cannot be decoded using only the public key and the message. The availability to the general public of secure, military grade cryptographic methods has generated considerable controversy. The US government has placed this software under export control and has suggested the use of their own system called Clipper. Clipper has a 'backdoor' that will allow the government to decode secret messages. They claim that they need this power to combat drugs and crime. Civil libertarians claim that the government has no business intercepting private communications. Cryptography can be used to protect E-Mail messages and computer files. The software to do this is freely available on the Internet (search for PGP). The US government, it seems, is locking the barn door after the horses have escaped. This file may not be reproduced by any means without the permission of the author -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBMHM8unseeMISF+fVAQFesQP/YxFgW3BAjnvDCMU4SfksgpKLEGMDMv9M YQpn/0BqUZSUnO3yye1bIN5KsDofePaCd6PcE6RcnvZJTBVu9PiZvxiBkr/a76wf 5Ft+F4p2tH0gxPunXZyjDqEnfHDcXY+X0FM7JgmeMyjDxzbq6GIqEX7gLoPAszwp Ayu4jIl2smg= =76yF -----END PGP SIGNATURE----- =================================== For PGP Public Key, Send E-mail to: pgp-public-keys(a)swissnet.ai.mit.edu In Subject line type: GET PHILP ===================================

1 0

ARTICLES
by Tim Philp 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Copyright (C) 1995 Tim Philp Brantford, Ontario Canada Article appeared in The Expositor, Brantford, Ont., Canada Sept 9th, 1995 - THE CODEBREAKERS - by Tim Philp A couple of weeks ago an extraordinary event took place that has implications for all users of the Internet. A group on the Internet, who call themselves CYPHERpunks, ran a test of a code system that was considered uncrackable in any reasonable amount of time. This in itself was not the extraordinary event. This code was broken by the cypherpunks in only 31.5 HOURS! That's right, hours. This code, called SSL used a 40 bit encypherment key with 1,099,511,627,776 possible combinations. To give you an example of just how incredible this feat was, let's examine the security of this code. If you were to try 1 key per second it would take you just over 34,841 years to try them all. That is almost five times longer than all of recorded history. How was this done and what does this mean to users of the Internet? The how part is simple to explain, the meaning will be more difficult to divine. The security of a code must rely only upon the key used to encipher the plaintext. It is assumed that the method of encryption is well known, as indeed it would be if it were used in a commercial product. Someone would disassemble the code and figure out the method. It is for this reason that security cannot reside in a secret means of encypherment. SSL is one such code. This group, the Cypherpunks, wrote a program that would try keys in sequence and then they distributed it to the Internet community. They then set up a central computer that people all over the world could call into and get assigned a group of keys to try. These people would then feed these keys into the code cracking program and report the results to the central computer. With hundreds of users taking part, using computers that were sitting idle at nights running screen savers, they cracked the code in 31.5 hours. One of the greatest arguments against people trying this kind of brute force attack on codes, is that the computer time and power required would cost the earth. In actual fact, this successful attack cost nothing at all as the computers used were sitting idle. Everything from little 286 PCs to mini-computer workstations were pressed into service labouring long over the weekend tirelessly trying one possible key after another until they cracked the code. Because this was an academic excersise, there was no harm done. The purpose was to prove how quickly a 40 bit code could be cracked. I confess to be astounded at just how fast this was accomplished. This points out two remarkable possibilities for the new communications technology that we are only now beginning to use. If that code were protecting sensitive information, such as a bank funds transfer, this group could be very rich. It does also point out a new way of using the Internet to solve problems that have long eluded solution because of the shear computational size of the problem. If the problem were to be divided up into small chunks and given to hundreds of computers worldwide, solution may become possible. We are just beginning to understand the possibilities. This file may not be reproduced by any means without the permission of the author -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBMHM8znseeMISF+fVAQEGzgP+L+JQfTSZ1un83/oh2g/5Nthw3tiHVtb9 eDiOtuzvuQiLxMO/SUPnjM5cXlSYhTNCN8wF49IXEO5Istg58oIA8wf4MPr8aDML dsK8h34rBQqVXjaxC9staKtKnTGLfZFLmKGwRShLJECgs6Bzqu25TptSYIa8RRGk ncYhNj6Lalc= =RE7O -----END PGP SIGNATURE----- =================================== For PGP Public Key, Send E-mail to: pgp-public-keys(a)swissnet.ai.mit.edu In Subject line type: GET PHILP ===================================

1 0

Re: CyberAngels
by jgrubs＠left.webcasters.com 17 Dec '03

17 Dec '03

To: morning(a)npr.org Cc: root Subject: CyberAngels From: jgrubs(a)left.webcasters.com (Jim Grubs (W8GRT)) Reply-To: jgrubs(a)left.webcasters.com (Jim Grubs (W8GRT)) Message-ID: <9qJZBD1w165w(a)left.webcasters.com> Date: Mon, 25 Sep 95 09:09:55 EDT Organization: WebCasters(tm) -----BEGIN PGP SIGNED MESSAGE----- Just what this world needs -- more vigilantees. To my mind, they are the moral equivalent of the right wing militia groups. A technical point: The piece would have the people who are not computer literate believe that GIF and JPG are code words for porn pictures and are used only in that context. The truth is they are merely computer filename extensions used for two different graphical data formats. You will also find GIF and JPG formatted images used on the Whitehouse WWW page, the Library of Congress' THOMAS, and the WWW page for the Pope's visit to Baltimore - not to mention the WWW page I just created for a customer selling polluted water filtration systems. I have never in my 62 years witnessed any news story on any subject about which I had any personal knowledge or expertise that did not contain factual errors. Is it any wonder that people are increasingly skeptical of the news media? -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: LIBERTY!! Use it or lose it!! iQCVAwUBMGavg974r4kaz3mVAQG+AgP9GWJ7B7QPCuIQ0HRhAebFkQHODTakPBQv jHgaIZGrCkCcYVZ3BaVl1aYdDhCMDekkw6gfj9kcdlYN96sVxkqLv9gFVIZMu0sk 7/j4o9ishO8ALmZx7DYxhVfJZhCwYq7a5hZZaGz9nLxdRaQnzUNsYJKeE0bBfdLI ZnPKM34WB0k= =qELG -----END PGP SIGNATURE----- -- WebCasters(tm) James C. Grubs jgrubs(a)left.webcasters.com 6817 Maplewood Avenue Tel.: 419-882-2697 Sylvania, Oh 43560 Fax: 419-885-2814 Internet consulting, HTML programming, Information brokering

1 0

Re: Net Regulation
by Duncan Frissell 17 Dec '03

17 Dec '03

B >Let me illustrate by taking myself as an example. I'm reasonably B >well connected networkwise and knowledgeable. I could decide to B >become one of these Permanent Tourists. But where would I go? B > B >What will be my concerns? Obviously, money will be one of them. B >But so also will be climate, people, activities I might not be B >willing to do without, and on and on. Furthermore, other B >governments are, almost without exception, more repressive than B >the one I have. The rest of the world has as wide (or wider) a range of climates as the US. The people you will be interacting with are the same people as you do now on the nets. I know some people have problems with expatting (to coining a term) themselves because of homesickness. Harry Browne couldn't adjust to Switzerland and so moved to Walnut Creek, CA. Not everyone is like that though. And the nets means that you can take your surroundings with you. Particularly once we get a VR interface. Besides, the nets mean that you will be able to *virtually* expat yourself and remain physically in the US if you like while working "overseas." B >than I am now. So I think that most Permanent Tourists would B >likely stay right where they are, more or less. Certainly they'd B >stay in the developed world, where most governments are willing to B >cooperate to some extent in the attempt to collect revenues. Few governments tax the overseas earnings of their own expats. Any Brit who expats himself physically and works via the nets would have *no* UK tax liability to be busted for. If this Brit was physically remaining temporarily in different countries as a Permanent Tourist (even the US) and working on the nets, he would have *no* income tax liability. Just as if I spend 6 months in France "on vacation" while I write my latest novel and negotiate the screen rights to my previous novels over the phone, I may have "earned" $2 million in France but would have *no* French tax liability as well as no right to work in France. That sort of activity is not considered "work in France." The nets mean that more and more people (musicians, surgeons, lawyers etc.) will be able to work as writers have always done -- from anywhere, to anywhere. No tax consequences. B >It is a sad fact that governments collectively possess the means B >to physically regulate all of the desirable real-estate and most B >are more willing than ours to use physical force to pursue their B >ends. So Permanent Tourist or not, one can't really escape them. Governments are more likely to (as indeed they have already done) offer PTs special treatment to encourage them to hang their hat for a temporary basis. This is sort of a reverse auction in which governments offer lower and lower taxes to snag the PTs who can go anywhere. For example, you can't legally have a secret securities account or buy treasury bonds anonymously in the US but foreigners can. A bank can acquire and hold T-Bonds for anonymous foreigners as long as it swears they are not Americans. The Feds did this because they *need* anonymous foreign buyers for their debt instruments. Why don't the Feds nuke any banks that try this. They have the bomb after all? Why, instead, do they explicitly allow this loophole by regulation? They need the money. B >Sooner or later, of course, this won't matter but, as I've said, B >at least for the short term, it _does_. There are already hundreds of thousands of American PTs living overseas. That was done under *old* technology. 61% of expat Americans don't file federal income tax forms even though they are required to do so whether or not they fall under the $70K exemption for overseas earned income. B >Not this year or even the next. But what happens when the B >printing-press equivalents cease to stave off bankruptcy? The Government of the USSR went out of business. B >Lots. Because people never do seem to learn the lessons of B >history, sigh. Not, mind you, that I think they'd "win" for long. B >They, too, prefer to ignore history. But while they're attempting B >to prevent the working of the laws of nature, a lot of people B >will suffer. *More* will suffer if we don't pay attention to this B >reality. I try and pay attention. I just think that some over-romanticize the state by investing it with magic powers that it doesn't have. Depending on your exact place of residence, you are more likely to be mugged by private parties than by the state. The technology doesn't strengthen the state, it weakens it. Duncan Frissell --- WinQwk 2.0b#1165

2 1

Unabomber ?
by John Young 17 Dec '03

17 Dec '03

Bill, Both the Times and Post report that only the Post is publishing the FC-piece. I'm scanning it now and will offer it in a while -- it's a long, long pole. I'll ask by this post if someone wants to offer it FTP, I can only do multiple e-mail bites from this hole.

3 2

The Evolution of Cooperation (Towards a mathematical theory of reputation?)
by norm＠netcom.com 17 Dec '03

17 Dec '03

I highly recommend Axelrod's short book, The Evolution of Cooperation, for those (like me) who find it hard to think clearly about trust issues. You have probably heard about prisoner's dilemma, tit-for-tat etc. Axelrod is a very early worker in this field. He set up a tournament of programmed bugs that competed with each other in an artificial environment. They could survive only by cooperation with other bugs. The could also cheat. Axelrod does not use the term "reputation" but it what one bug gains or looses as it interacts with other bugs in iterated encounters. I read the book about two years ago. Only last night did I realize that those ideas helped me think about the MITM threat.

2 1

Time release crypto
by keelings＠wu1.wl.aecl.ca 17 Dec '03

17 Dec '03

Incoming from Stephen D. Williams: > > What minimal requirements would be needed to support encrypted packets/files > that a holder could only decrypt after a certain date/time? > (Time Escrow?) How do you expect the system to reliably tell accurate time? What's to stop anyone from just resetting the clock to get at what they want? As always, physical access to the system breaks all security. -- "Remember, obsolescence (Win95) isn't an accident; it's an art form!" keelings(a)wu1.wl.aecl.ca s. keeling, aecl - whiteshell labs

1 0

(Yet Another?) Netscape Crack Web page
by Laurent Demailly 17 Dec '03

17 Dec '03

I've been waiting to see here an annoucement of some web page toward which direct ppl that want more infos on the great (congrats) job from Ian and David, but as I saw none (maybe it's on its way, delay seem pretty high those days on the list mail, in that case, sorry...) and someone asked me more infos, on my sources,... I've set up a small web pages with some infos collected here on http://hplyot.obspm.fr/~dl/netscapesec/ It includes few remote pointers, a copy of the original ian's post, the NYT article, the Wall Street journal one, and... the source file that I received from an european source (and incidently a summary from me in french) Please send me comments , corrections, additional pointers,... (it is not meant to ne exhaustive anyway) Best regards dl -- Laurent Demailly * http://hplyot.obspm.fr/~dl/ * Linux|PGP|Gnu|Tcl|... Freedom Prime#1: cent cinq mille cent cinq milliards cent cinq mille cent soixante sept

1 1