- cypherpunks-legacy - lists.cpunks.org

more IPG and random numbers
by Eric Murray 17 Dec '03

17 Dec '03

I did some more experiments with the IPG stream-cipher algorithim and random number tests. Since IPG claim that their algorithim passes chi-square tests of randomness, I found a chi-square test program. It's written by Peter Boucher and was posted to sci.crypt in '93 (<2bum8sINN98j(a)roche.csl.sri.com>). I found it on the web site crypto.com, sorry I don't remember the exact URL but I can send it on request. From the comments: > New, and improved anal.c, uses chi-square. > > Does the 'runs up' (or 'runs down') test with run-length equal to two > get me anything over the standard chi-square test? I left it in. > > BTW, the buf[i] = (((seed = (1103515245*seed +12345)) >> 16) & 0xff); > test fails this one at high numbers. It's too evenly distributed. > > -Peter > > /* *************************************************************** > * anal.c -- > * > * Copyright 1993 Peter K. Boucher > * Permission to use, copy, modify, and distribute this > * software and its documentation for any purpose and without > * fee is hereby granted, provided that the above copyright > * notice appear in all copies. > * > * Usage: anal [input_file [output_file]] > * > * This program counts the occurances of each character in a file > * and notifies the user when a the distribution is too ragged or > * too even. > * > * Because the chance of getting byte B after byte A should be 1:256 > * (for all A's and B's), the program also checks that the successors > * to each byte are randomly distributed. This means that for each byte > * value (0 - 255) that occurs in the text, a count is kept of the > * byte value that followed in the text, and the frequency distribution > * of these succeeding bytes is also checked. > * > */ [..] > #define Vmin (205.33) /* 1% chance it's less */ > #define Vlo (239.39) /* 25% chance it's less */ > #define Vhi (269.88) /* 75% chance it's less */ > #define Vmax (310.57) /* 99% chance it's less */ > > First I ran the output from my version of the IPG algorithim that I posted a couple days ago : % ./boucher < ipg.out Occurances: n = 12000000, V=-8375833.71 Character occurances non-random Successions: n = 46875, V=62287.82 Character successions non-random Then I ran output from a test RNG that's basically a loop around random(): % ./boucher < myrandom/out Occurances: n = 3414720, V=213050.62 Character occurances non-random Successions: n = 13338, V=1143.41 Character successions non-random As you'd expect, it doesn't look like the output from random() is all that great. Finally I generated some output from a random seed generator I wrote a while back. It gets randomness from high-resolution timers and hashing system files. It's not as fast as repeated calls to rand() but is faster than reading from /dev/random: % ./boucher < out Occurances: n = 594352, V=269.75 ================ Frequency distribution excellent! ==================== Successions: n = 2321, V=256.12 ================= Successor randomness excellent! ===================== So, from these tests it looks like IPGs PRNG, which their stream cipher is based on, is not a very good source of random values. Hence anything encrypted with it is succeptable to cryptoanalysis. How succeptable, I do not know. I am sort of curious, since IPG claimed that their PRNG produces "perfect" random data as measured by chi-square analysis, yet my analysis shows otherwise. Perhaps I have coded the algorithim incorrectly (I don't think so, it's pretty simple). Or perhaps IPG chose their keys for the ABC tables carefully to produce good results. Unfortunately that would mean that keys would have to be carefully chosen, something that's not very practical. Based on the work I've done, and the work Igor Chudov posted, it looks like the IPG algorithim is probably not very strong. If two relative crypto neophytes can find serious problems with it, imagine what might happen if experienced cryptoanalists look at it. If you were one of the people who said "it's snake oil unless it's been been tested for a zillion years" etc. you can pat yourself on the back now 'cause you were right. However I think that some of us owe Mr Wood, if not an apology for the excessive abuse he got on this list, at least some respect for putting his money where his mouth is and posting his algorithims. Maybe he'll do some research, tone down the hype, and come back with something better. -- Eric Murray ericm(a)lne.com ericm(a)motorcycle.com http://www.lne.com/ericm PGP keyid:E03F65E5 fingerprint:50 B0 A2 4C 7D 86 FC 03 92 E8 AC E6 7E 27 29 AF

1 0

Re: The Rise and Fall of Cypherpunks WAS [Re: the Dennings]
by Dave Hayes 17 Dec '03

17 Dec '03

attila(a)primenet.com writes: > > we, and I mean all of us, who contribute the bulk of the > > "opinions" to cypherpunks gave the mainstream press the biggest > > possible hole to run straight over us, declaring us anarchists > > and wild-eyed fanatics. unless we as a group mend our ways, and > > turn out intelligent reasoning for the advance of cryptography as > > a mainstream way of life, we will be forever consigned not only to > > the dustbin, but subject to the ridicule of both the press and the > > government. Quite surprising. This proves (to me) that cypherpunks is nothing more than lipservice, covertly contributing to the death of the human spirit which most people seem to want. "Unless we as a group mend our ways", indeed. By whose standard of "mending"? If they construct the proper standard can they not control you by that choice? Is your goal in life to be controlled by the press and the government? > > None of us are above a little sarcasm --but let's get the > > vituperative effluent out of the system. do whatever you wish in > > private mail, but keep the profane rantings off the list. The very existance of the "profane" keeps the "sacred" in existance as well. If you cannot see that, then John Grubor's lesson is wasted on you. ------ Dave Hayes - Altadena CA, USA - dave(a)jetcafe.org Freedom Knight of Usenet - http://www.jetcafe.org/~dave/usenet It is only knowledge that will destroy bias.

4 4

Re: AOL
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

yes.... they did knock off that $3.00 an hour thing. now.. $20.00 unlimited.. I'd hate to do an AOL spam to the list.. but someone asked.. and for all you that say 'get a real internet provider'. Well.. I get ALL the same access most of you do. No shell account...But I can telnet from AOL to one. So there. Nah nah nah =}

1 0

No Subject
by Bovine Remailer 17 Dec '03

17 Dec '03

At 10:18 PM 12/3/1996, Matthew J. Miszewski wrote: >At 01:45 PM 12/3/96 EST, Bovine Remailer wrote: >>At 10:50 AM 12/3/1996, Matthew J. Miszewski wrote: >>>Take, for example, the practice of redlining. How are people who live in >>>"bad" neighborhoods supposed to not reveal that information. >> >>You may lend your own money to whomever you wish. If you do not wish >>to lend money to somebody, that is your business. > >I consider it my business also, when people are denied opportunity because >of where they live. Why not simply disagree with me? You do not believe that people may lend their very own money, earned honestly, to anybody they please. If you are ashamed of that, change your mind. If you are not ashamed, proclaim it the world and justify it. >I may also hire whomever I wish, but I would have to pay the >consequences if I happened to discriminate based on a protected class >while doing so. That is the society in which I live. If I dont like >it, I try to change it. Our society is not libertarian. Current policy doesn't matter if we are discussing the wisdom or justice of possible policies. >If I would prefer that form of society I would have to accept that >result. Therefore I choose a balance between liberty and social >justice. It isn't clear to me whether you are discussing policy options or whether one should violate laws one does not like. When an action is illegal, it is still permissible to discuss its legalization. >There are times when government should intervene. I believe it >should be as infrequent as possible, but would not want to live in a >society where disinfranchised people have no possible recourse. Your >choice would apparently be different. Perhaps. In any event, it is important to understand precisely the mechanisms through which people are disenfranchised, if that is in fact what has happened. It is also important to understand the ramifications of phrases like "no possible recourse". To borrow money? It is safe to say that most poor people should be saving money rather than borrowing it. >>It is difficult to understand why redlining should be illegal, to the >>extent that it even occurs. When it does occur, we expect that eager >>entrepreneurs such as yourself will rush in to grab new customers. > >I have not heard serious doubts for a while that redlining occurs. It seems likely that people draw lines around certain areas and decide not to lend money there. What is less clear is that this is unreasonable. There may be a few good credit risks in poor neighborhoods. But, it may just be too much trouble weeding through the others to make it a paying business. It may also be the case that people lending money are behaving irrationally and drawing lines around neighborhoods for simple racial reasons and for no others. There is a word for this: opportunity. Bank of America was built by a man who perceived and exploited one such opportunity. Italian shop keepers in California could not get good banking services for, it turned out, irrational reasons. >I would love to have the financial wherewithal to startup such an >enterprise. Unfortuantely I reside in one such neighborhood. People start businesses without their own capital all the time. If there really is such a great opportunity, go find some rich people. Rich people, like other people, are always happy to hear about ways to make more money. They don't even have to put the money in for a long time. Once you've set up a package of mortgages, you can sell them off on the CMO market which is liquid and, I believe, quite colorblind. The beauty of this scheme is that you can take your profits right away and let other people take on the long term interest rate risk, default risk, and management hassles. This will make your plan easier to sell to investors. You might also look into the microlending market. The idea is to lend poor people small amounts of money (less than $10,000) to start businesses and the like. The default rates are claimed to be surprisingly low. I have my doubts, but it sounds as if you do not. Good luck. >It is difficult enough to raise money to run a small business (and >turned out to be much easier to do without any bank lending at all). >I have talked with people about starting their own banks. In principle, there is no reason at all why banks are the only institutions that can lend money for mortgages. There may be legal impediments, but then we are back to the actual culprit, the government. You might find that opening a bank was easier if all you had to do was take deposits and lend money rather than wading through the morass of legal requirements and paperwork. >When you are working to make sure all the bills are paid it is a bit >difficult to also build an entirely new socio-economic structure. You don't have to build an entirely new socio-economic structure. You just have to find some good credit risks, some people with money to lend, and put them together taking a cut for yourself, unless the government has thrown up some obstacles to this. >>Of course, we hardly live in a free banking era. Most people would >>prefer to bank with a company that respects their privacy. Yet, banks >>are so tightly controlled in the United States that they most often >>will not dare to protect the privacy of their customers for fear of >>regulatory consequences. When the service is provided, it cannot be >>advertised. > >Whom would the service be more readily available to? Who uses tax-havens? >Who has access to swiss bank accounts? Are you insinuating that my local >bank actually has anonymous accounts and just won't tell me? I wish that >people DID value anonymous banking in this country. The fact is they just >don't care. No, actually they do care, they just don't think (correctly) that they can get it easily. I have no idea if your local bank has "anonymous accounts". More probably, they have accounts for which they do not report transactions in excess of $10,000, but which are held by people they know fairly well. This is more common than you might think, and not just for laundering drug money. Tax evasion is widely practiced. >As long as they get short lines or myriads of ATM machines they are >happy. I am largely in favor of banking deregulation. There are >places where I simply draw the line. Utter racism is one of them. But wouldn't the racist banks be hurting their business? Doesn't the punishment go quite closely with the "crime"? If you believe that there is a huge opportunity which the racist banks (i.e., all of them) will not take advantage of, you had better explain why there is nobody anywhere with any capital who wouldn't want to make even more money off poor people. Can it really be the case that 99+% of rich people will run fleeing from such a great opportunity? Oh, and speaking of racism, where do wealthy African-Americans invest their money? >Everyone can now clamor that it just isnt true. Banks have never >discriminated. Its all a big lie. Whatever. Banks have practiced discrimination, and not just against black people. They have been able to get away with it. How? Because the government has protected the banking guild from competition. If opening a bank were as easy as forming a corporation, you would not see much discrimination, I assure you. There is no reason why a bank shouldn't be that easy to open. >(snip) >>You are in the unpleasant position of appealing for protection from >>the very people who have robbed you of your privacy. > >You are right. It is far from a perfect system. We make trade-offs every >day. Appeals to the very people who are exploiting you are not likely to meet with success, are they? >The real world I live in is just not as simple as the Libertarian Wet >Dream(TM). Then it should be fairly easy to refute my points instead making fatuous remarks such as the one above. Red Rackham

1 0

No Subject
by jens.melander＠vpress.se 17 Dec '03

17 Dec '03

unsuscribe cyberpunks

2 1

No Subject
by logos 17 Dec '03

17 Dec '03

An anonymous poster wrote: >Timothy C[*] May, a product of a* birth, appeared with >coathanger through his head. >/o)\ Timothy C[*] May >\(o/ I respectfully ask that the author of this post contact me. I am curious about his or her motives and would appreciate it if he or she would address these questions: 1) Why are you attacking Tim May? Has he harmed you in some way? 2) Do you think such posts harm Tim May or help you in some fashion? 3) What do you hope to accomplish by these posts? 4) Do you favor the use of strong cryptography to preserve privacy? 5) If Yes, do you think such posts are constructive to that end? If No, is it your intent that your posts harm the cause of strong cryptography and privacy? 6) Why have you chosen to hide your true identity? Logos out

4 3

Re: Logos here
by logos 17 Dec '03

17 Dec '03

Dr.Dimitri Vulis KOTM <dlv(a)bwalk.dm.com> wrote: > LOGOS <logos(a)c2.net> writes: > > > Sovereign collegues, > > You already sound like a jerk. Perhaps you should suspend judgment until you have the opportunity to evaluate the content of my posts. What are you antagonistic to the use of honorifics? > > I am Logos. I have adopted this pseudonym to conceal my > > 'true name'. I want the ideas which I shall be espousing > > to stand or fall on their own merits and not on the basis > > of biases that my name, sex, ethnicity, etc. might otherwise > > sexual preferences... Yes, that and other catagorizations which are irrelevant to the primary focus of this list. > That's right. You lack the decorum to spell either my > first name or my last name correctly. 'Decorum' has to do with polite behaviour. While I was certainly remiss in my hasty spelling of your name, it was not intentional, therefore not a lack of decorum. I do apologize for my negligence. I shall endeavor to spell you name correctly in the future. > "Cypher punks" are a gang of uncouth juveniles I'm not sure I understand the relevance of this comment. Was it made in response to my error in spelling? In any case, it is a good example of the informal logical fallacy of 'over generalization'. As I understand it, there are circa 1000 people subscribed to Cypherpunks. To paint an entire group with such a characterization is both illogical and unfair. I also question your use of the word 'uncouth'. I have seen no posts on Cypherpunks that were any more 'uncultured; crude; or boorish' than those posted by you. I am not saying that uncouth posts have not been made by others, but it is disingenuous for one to judge others by a standard that one does not apply to one's self. > What logic? "Cypher punks" such as Paul Bradley are incapable of > discussing a technical topic (such as Don Wood's IPG proposal) without > putting "(spit)" after Don's name I could be wrong, but I believe this was done as an intentional parody of your own similar posts. If it is illogical for Paul Bradley to do this, does it not follow that is was illogical when you did it as well? It is obvious to me that you are an intelligent person. I am concerned, however, with your apparent intellectual dishonesty. It would appear that you know perfectly well that your posts serve no purpose in the cause of promoting privacy through the use of cryptography. It is hard to draw any other conclusion then that you are intentionally being provocative for the purpose of disrupting the work of this list. If this is not so, I apologize, but how else can we judge your actions? Please step outside of yourself for a moment and give us an honest self-assessment of your behavior and the motives behind it. Respectfully yours, Logos out

2 1

(no subject)
by Wolf 17 Dec '03

17 Dec '03

unsubscibe cypherpunks

1 0

RE: IP address
by Internaut 17 Dec '03

17 Dec '03

Even greater than denial of service I believe that there are other threats. Like I just found this file on c2.org (I believe it was) on using an IP address to explore somebody's hard drive under certain conditions. EXPORTING YOUR ENTIRE FILESYSTEM Samba When a Windows for Workgroups or Windows 95 machine shares any folder, bugs in Microsoft's SMB implementation over all network protocols allow access to the whole drive, with whatever permissions the sharename was given. These resources are advertised on a browse list that is made available to anyone on the local network by default, and to anyone on the Internet who knows the machine's IP address. Any user sharing any folder over TCP/IP without a password is opening the whole disk to the whole Internet (for those that can locate the machine) and those with a password should be aware that Windows has no protection against brute force attacks. SMBCLIENT, an ftp-style browser for any UNIX, plus a complete file system for Linux and a few UNIX versions, are available from the Samba web site. Please note that Samba's exploitation of this fundamental bug in Microsoft file sharing was unintentional, and was immediately reported to Microsoft. It could have happened with any client over any protocol. An alleged fix for Windows for Workgroups was quietly released in early October, and Microsoft publicly announced a fix for Win95 on October 20th. It has not been rigorously tested, but it appears to fix the problem. The fix for Windows for Workgroups might not be a complete fix, but rather a patch for one way to exploit the problem. (The release version of Win95 prevented cd .. below the shared folder "root," but not cd ../) The patches and Microsoft press releases (which have been corrected at least twice, but which still erroneously identify Samba as shareware, neglect to credit the people who notified Microsoft of the problem, and neglect to mention that this is a fundamental bug in Windows, not a problem specific to TCP/IP or Samba) are available on Microsoft's Windows 95 Updates Page. The patch only works on the US/English version of Windows 95; at this writing, all non-English versions of Windows 95 are still vulnerable. Troy Varange wrote: > Well, the "danger" of posting a static IP must be even > greater than with a temporary IP. > > Just call the police if you uncover a bonafide case of a > denial of service attack. From what I gather, they take > this shit seriously, and have better capacities of > getting lazy admins to reveal the relevent data in their > logs. I just have this gut feeling that sitting out here without any protection somebody could write something that could hook into a program, or even worse the system (i.e. Explorer). Perhaps my fears are totally unfounded (besides above problem w/ samba), but I have not heard anyone say that one *is* secure. -- Internaut PS: I am running win95 but feel free to answer this question for any os.

1 0

Sorry for the "TWIT" messages
by William H. Geiger III 17 Dec '03

17 Dec '03

Hi, Well seems I had a rather intresting morining. :) After receiving several "Phreak messages I went to modify my "twit" scripts. Unfortunatly the changes I made caused ~50 "twit" messages to go out. My appologies to anyone who received these messages. Thanks, -- ----------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting WebExplorer & Java Enhanced!!! Cooking With Warp 4.0 Author of PGPMR2 - PGP Front End for MR/2 Ice Look for MR/2 Tips & Rexx Scripts Get Work Place Shell for Windows!! PGP & MR/2 the only way for secure e-mail. Finger whgiii(a)amaranth.com for PGP Key and other info ----------------------------------------------------------- *MR/2 ICE: OS/2: Logic, not magic.

1 0