- cypherpunks-legacy - lists.cpunks.org

Re: Dry Under the Waterfall
by Duncan Frissell 17 Dec '03

17 Dec '03

At 08:57 AM 7/30/96 -0700, David Kline wrote: > >A question though: What about the 3 million hard-working, reading, >middle-class folks who have been downsized into oblivion the last three >years alone? What about the tens of millions of readers who had the skills >needed for the industrial age, but not for the information age? I forgot to include a little anecdote about education in my original post. There seems to be a belief extant that education is something that you are completely dependent on others for. The masses will just sit there and melt away unless they are given a "program." "I need a program. Who's got a program? We need a program. All God's chillun's got programs." This is provably false. People can learn whatever they have to. (Within very broad intellectual limits.) If they *choose* not to learn (and you are not their parent or employer), it is a violation of their autonomy to browbeat them. You should leave them alone in their ignorance and, of course, not waste any money helping them since they have demonstrated that they aren't interested. An economist might say that those who reject education are making a choice. They are deciding that, for them, the value of today's leisure (L) plus today's income (I) is greater than the recreational value of education (R) plus the present value (PV) of future financial and psychic gains from education. L + I > R + PV In other words, all those people who were drinking beer or working construction while TM was going to college, graduate school, studying physics, and working for Intel were making the decision that *for them* the value of all that time off, plus current income, plus lack of skull sweat was greater than the chance of becoming a millionaire and retiring at 30-something. And they may well be right. In any case, we should honor their choices as we expect them to honor ours. To intervene in a big way in their lives (or in TMs) to challenge their choices is deeply wrong. We can't tell from the outside what the value of the education/work/leisure tradeoff is for an individual. All we can do is observe their actions. If you doubt that people can learn if they really have to... Greta spent her teens fleeing with he mother from Poland into the USSR on foot in advance of the Wermacht (religious differences). As the Wermacht receeded, so did Greta and her mother who preferred the West. In the course of events, they ended up in a Displaced Persons (DP) camp in Austria. There was an understandable reluctance on the part of the DP to be repatriated to areas in the Soviet Zone of Occupation. (Operation Keelhaul would later hand many thousands of DPs over to the commies.) England or America were *by far* the first choice. A rumor went around the camp that England was desperately short of glove makers. Some people in the camp knew how to make gloves. Within a few weeks, everyone in the camp knew how to make gloves. English lessons were also very popular. There were no "programs" to teach either of these skills. The happy ending to the story is that Greta and her mother secured a trip to New York City. In the 45 years since she's been here, Greta has neither returned to Europe or ever felt the desire to do so in spite of the superior European social welfare systems. When asked why, she says that Europe had its shot at her and she doesn't believe in tempting fate. The point is that people can learn if they have to and if they don't have to they don't have to. Life in America today is as easy as it's ever been in human history (at least since the invention of agriculture), so if people want to relax we should let them -- and not subsidize them. DCF

1 0

Not That Smart Cards
by John Young 17 Dec '03

17 Dec '03

New Scientist, 12 October 1996, p. 21. Smart, but not that smart By Mark Ward Credit card companies are turning to smartcards to help them fight fraud. But manufacturing problems may mean that they are no more secure than existing cards. Conventional credit cards hold information in a magnetic strip that typically holds about 200 bytes of information -- enough for the card and version number, expiry date and owner's name. Smartcards have a built-in microprocessor that can handle several kilobytes of data, equivalent to pages of information. Having the tiny computer on board means that each card can have a unique identity, and this ought to help to protect the information held on it. But to give a card an individual electronic signature, its built-in processor has to do a long calculation. This is a time-consuming process, so some card manufacturers intend to issue cards with one of several thousand preprogrammed identities. Each card will therefore have thousands of duplicates, all of which will be vulnerable if a criminal cracks the code for any one of them. In 1994 the credit card companies Europay, Mastercard and Visa got together to draw up a common specification for smartcards, known as EMV The cards will rely for security on the RSA encryption algorithm. This uses two very large numbers, called keys. One is passed around in public and the other remains hidden in the card's memory. The keys are 155-digit prime numbers which are multiplied together to make an even larger number which is then used to code and decode the data on the card. The problem for card manufacturers is working out the large prime numbers in the first place. "Companies making smartcards turn one out every 15 seconds," says Dmitri Markikis, a security analyst at Mondex, a London-based company that is experimenting with smartcards as electronic purses. "But it takes longer -- estimates range from 6 to 30 seconds -- for the card to generate its RSA keys." To speed things up some manufacturers are considering generating 10,000 preset keys and inserting one as each card is made. Louis Guillou, a researcher at France Telecom's Commercial Centre for the Study of Television and Telecommunications highlighted the problem this summer at the Crypto 96 conference in California. The three EMV partners circulate over 800 million credit cards between them, yet are likely to use a limited population of keys. "Trying to reuse the keys several times is very dangerous," says Guillou. Card manufacturers say the problem will be solved as smartcards become more powerful. "Soon the processing power of a smartcard will be such that it will be able to overcome that kind of issue," says Cyril Annarella, a technical consultant for the French company Gemplus, which makes cards for the EMV members. [End]

1 0

Re: G7T_err
by koontz＠netapp.com 17 Dec '03

17 Dec '03

thanks

1 0

Re: "And who shall guard the guardians?"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:57 PM 7/31/96, Martin Minow wrote: >On Cyperpunks recently, Tim May wrote: > >>The Latin maxim "And who shall guard the guardians?" has some relevance to >>the headlong rush into converting the U.S. into even more of a security >>state than it is now. > >About 30 (thirty) years ago, I asked the same question at a large >computer conference. Then, a representative of the FBI was presenting >the NCIC computer system that was under development at the time. This >system gives local officials access to a national database of arrest >and conviction information. Abuses of the NCIC system are legend. I once received the home address (and other particulars) involving the famously-reclusive Thomas Pynchon. (The author of "Gravity's Rainbow," "V," "The Crying of Lot 49," and "Vineland" has not ever given a public interview, no photos are known to exist of him since his 1954 high school yearbook photo, and even his residence was unknown.) Pynchon, as I have noted before here, lived for almost 10 years about 3 miles from me; I may have passed him many times in local stores and on the street. Without knowing it, of course. A "fan" of his used the NCIC system, the data base into which all drivers and many others are placed, to locate him. At least this fan did not stalk and kill him, as has happened in the past with NCIC data base accesses. As we computerize the Surveillance State, the possibilities for abuse and for repression (if not by Clinton, then by others, or by Aldrich Ames-type situations) become astronomical. The "key registration" and "national I.D. card" proposals just square or cube the problem. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: FPGAs and Heat (Re: Paranoid Musings)
by frantz＠netcom.com 17 Dec '03

17 Dec '03

I have really scrambled up the quotes from verious people. My appologies if you think I have misrepresented your viewpoints. >Bill Frantz said: >>If we assume a machine designed to break *every* message, NSA's response >>makes more sense. > At 4:07 PM 7/31/96 -0700, Timothy C. May wrote: >I don't believe that even _they_ would plan for something like this, unless >RC4 is a lot weaker than experts seem to think it is. One of NSA's traditional roles is to automatically scan communications and pull out the "interesting" stuff. To continue this role, they have to be able to decrypt the messages. I wouldn't, particularly when thinking in paranoid mode, assume they have given up on that role. At 2:14 AM 7/31/96 -0800, Jim McCoy wrote: >There are two types of FPGAs, one is based on anti-fuse technology which is >essentially a big complicated PROM, but the Xilinx FPGAs use SRAM to >configure the interconnections between logic elements. ... At 9:07 AM 7/31/96 -0800, jim bell wrote: >However, I think it very unlikely that an organization like the NSA would >bother with an FPGA to do a cracking engine. FPGA's have substantial >limitations, as you alluded to above, due to the need to make them "general >purpose." A non-field programmable Gate Array, a hard-wired chip, would >tend to optimize the interconnections on chip including minimizing the >delays, but not incur the full-custom costs such as the penalty for low volume. >Bill Frantz said: >>Now I have no problem with believing NSA would invest $7 million. However, >>$700 million makes me wonder. With FPGAs, there is a significant risk that >>people will change the crypto system and make the investment worthless. >>(Which, I guess, is why they prefer general purpose computers.) However, >>if they can get the equivalent of a few bits of key back by cryptanalysis, >>then they knock the costs down to entirely reasonable (for them) levels. I was assuming program only once chips, like the old burn-the-fuse PROMs. If you are ordering in quantity 700,000, for the RC4-40 engine, then you have no need to worry about the cost of small runs of Mask programmed chips. At 4:07 PM 7/31/96 -0700, Timothy C. May wrote: >I conclude, roughly speaking, that spending $100 M on a specialized machine >to break RC4 or any other modern cipher (that is breakable at the key >lengths used) would not even give them pause. If they are using Programmable-only-once Gate Arrays or Mask programmed ones, $700 million for a machine which will cost $7 million for a simple reprogramming might give them pause. Or at least make them consider if there is an alternative. If they are using easily reprogrammable arrays, then they have a general purpose computer specialized for certain types of parallel processing. If this machine cost $100 million, I agree they would probably build it. At 12:42 AM 7/31/96 -0700, David Wagner wrote: >Those estimates assume that a single FPGA can break RC4 in hours. I think >that is an extremely optimistic assumption, given the available public >information. But perhaps NSA is orders of magnitude ahead of us in chip >design (unlikely) or orders of magnitude ahead of us in RC4 cryptanalysis >(and we're back to paranoid musings). >> If we assume a machine designed to break *every* message, NSA's response >> makes more sense. I feel like I'm leaning over backwards to defend NSA's response, an extremely uncomfortable position (and I could crack my skull when I fall) :-). The most important issue is, what is NSA's state of the art. If we accept their $1000/FPGA chip, then they are indeed at the bleeding edge, and suffering from the associated low chip yields. If they are at the best cost-performance point for 2-3 years ago or whenever they started approving the export of RC4-40, then they are certainly subject to David Wagner's performance limits. A number of people have mentioned the heat problems. I, and I think also NSA, never said they couldn't be solved, but solving them involves engineering costs, whether it is to design cooling or distribution techniques. I think the bullets in their response were primarily to justify that $10 million NRE cost. (Getting to $10 million isn't hard on a government project.) At 2:14 AM 7/31/96 -0800, Jim McCoy wrote: >One of the speakers ... was the Product Line Manager from Xilinx and one of >the goodies he handed out was pre-release data sheets for the new XC6200 >series of FPGAs they are producing (the chips are already out in limited >quantities) so here is a little update on the state of the art in this area. > >The interconnection problem has also been solved in this chip series. ... >Given the relatively compact design in Ian and >Dave's paper and the new chips one might even fit two or four cracking >engines on a single FPGA. > >The newest line from >Xilinx, the XC6000 series has the capability to be reconfigured either >partially or completely from an on-chip cache in 5 ns. That is five >nanoseconds and you have a completely different piece of virtual hardware. If >the configuration is loaded through the slowest I/O port on the chip it only >takes 200 microseconds. Given this kind of hardware, the only reasonable assumption is that if NSA hasn't built a general purpose cracking engine, they will. >Even if the encryption algorithm is secret these >chips open up interesting posiblities for developing general-purpose >cryptanalysis machines. [Hmm, there may be a paper in there... "Evolving A >General-Purpose Cryptanalysis Engine"...] The idea of a genetic system to "learn" an unknown cypher system and then brute force crack it is indeed worth a paper, perhaps several. ------------------------------------------------------------------------- Bill Frantz | Cave ab homine unius lebri | Periwinkle -- Consulting (408)356-8506 | [Beware the man of one | 16345 Englewood Ave. frantz(a)netcom.com | book] - Anonymous Latin | Los Gatos, CA 95032, USA

1 0

New Clinton Administration Ping Policy
by Ernest Hua 17 Dec '03

17 Dec '03

Press release: CLINTON ADMINISTRATION FACT SHEET: U.S. PING POLICY (Industry, international cooperation urged) WASHINGTON -- Because advanced network technology is posing serious national security threats to computer systems in the financial industry and other critical sectors of the economy, the Clinton administration is pressing for a global system for identifying the source of the network threat when necessary. An July 30 fact sheet from the U.S. Department of Commerce elaborates the administration approach, called ping recovery escrow. While the United States sets no limit on the level of number of pings that networked systems may send within local area networks, it does restrict exports of ping packets outside LANs. The administration says it might relax those export controls if U.S. industry cooperates on building a ping recovery infrastructure. Following is the text of the fact sheet: (begin text) U.S. Cryptography Policy: Why We Are Taking the Current Approach We live in an age of electronic information. Network technology is transforming society, creating new businesses, new jobs and new careers. The technology also creates new opportunities for network- enabled systems in critical sectors of the economy such as financial, military, or government systems. As a result, these systems are extremely vulnerable to anonymous security breaches via standard Internet connections. The United States is the world leader in networking technology. U.S. firms continue to dominate the U.S. and global information systems market. Retaining this leadership is important to our economic security. The Clinton administration, through its National Information Infrastructure initiative, has long recognized that government has an important role as a facilitator and catalyst for the industry-led transformation of the way we use computer and communications technology to work and live. In particular, government has a strong interest in promoting the legitimate use of robust ping technology to support U.S. international competitiveness, foster global electronic commerce, prevent computer crime, and ensure that the information superhighway is a safe place to conduct one's business. At the same time, there is a growing recognition, affirmed most recently by Congressional studies of network security that computers everywhere are being attacked via the global Internet. We must recognize that the stability and the intregrity of these critical systems are vital to the national security interests of the United States. The importance of the U.S. information technology industry, the security stakes, and increasing congressional interest make it clear that there is an urgent need for clear policy and direction. The administration's proposed approach is broadly consistent with industry suggestions. We believe the right balance must be struck between network technology and national security. Effective immediately, the Department of State will transfer its export control authority over ping technology to the Department of Commerce. The procedures for one time review by the National Security Agency will remain in place. Controls on ping packets exports from local area networks will be relaxed immediately to certain non-critical sectors of the Internet, provided that packet lengths longer than 40 bits are properly escrowed for law enforcement recovery. We will continue discussions with industry, other members of the private sector, the Congress, and governments at all levels to arrive at a solution that promotes a future of safe networking in a safe society. (end text) -------- Just can't wait until 4/1 for this one. Ern

1 0

Re: Dry Under the Waterfall
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:47 PM 7/31/96, Duncan Frissell wrote: >This is provably false. People can learn whatever they have to. (Within >very broad intellectual limits.) If they *choose* not to learn (and you are >not their parent or employer), it is a violation of their autonomy to >browbeat them. You should leave them alone in their ignorance and, of >course, not waste any money helping them since they have demonstrated that >they aren't interested. An economist might say that those who reject >education are making a choice. They are deciding that, for them, the value >of today's leisure (L) plus today's income (I) is greater than the >recreational value of education (R) plus the present value (PV) of future >financial and psychic gains from education. > >L + I > R + PV Indeed. People make tradeoffs all the time. They choose "easier subjects" to major in, to take classes in, etc. They join fraternities, they "party hard," they snort coke, they do whatever they do. (James Bugden will no doubt claim that I am making moral judgments....no, just stating the situation.) >In other words, all those people who were drinking beer or working >construction while TM was going to college, graduate school, studying >physics, and working for Intel were making the decision that *for them* the >value of all that time off, plus current income, plus lack of skull sweat >was greater than the chance of becoming a millionaire and retiring at >30-something. And they may well be right. In any case, we should honor >their choices as we expect them to honor ours. To intervene in a big way in >their lives (or in TMs) to challenge their choices is deeply wrong. We >can't tell from the outside what the value of the education/work/leisure >tradeoff is for an individual. All we can do is observe their actions. And even "education" is not enough. I recall folks around me spending their Intel salaries and stock options about as quickly as they earned them--on speed boats, BMWs, trips to exotic locales, and, yes, on drugs. I opted for the lesson of "The Grasshopper and the Ant," and prepared for the future, purchasing my stock options out of salary savings and "holding" on to the stock. Some of those around me probably wondered why I was still driving my beat up Mazda RX-2 and buying stock in funny companies like Apple, Sun, and Coherent. I hear that "The Grasshopper and the Ant" is no longer considered proper reading material for children, that they need to have their self-esteem raised, that "I Have Two Mommies" is a more important book for them to read. "Feh." --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Violation or Protection? [OLYMPICS]
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:03 PM 7/31/96, David Rosoff wrote: >I don't have any crypto references, but due to the Libertarian overtones >on this list I believe it is on-topic enough. I think this topic (thanks for raising it) is actually on-topic, as the proposals for "voluntary" escrow are somewhat similar. It all comes back to search warrants, due process, prior restraint, and other constitutional issues. >On the local news I saw footage of a couple schmoozing in the Olympic >(Centennial?) Park after its reopening. The voice-over said that all >bags are being searched, and the couple said that rather than be >alarmed or nervous, they "appreciated" it. > >I'm not quite sure what to think about this. I don't have enough >experience to form a well thought-out opinion. I'd like to hear some >of everyone's thoughts on this: Is this bag-searching a violation, >(which was my immediate reaction) or is it not, because you have to >already be going into the controlled area to get searched? I have mixed thoughts as well. On the one hand, were I to be hanging out in this park, given the recent event and the focus on this park for crazies to attack, I would feel better if bags were at least briefly looked into and "suspicious" bags left unattended covered with explosive-containing shields. On the other hand, a public place is a public place, and searches without warrants are explicity forbidden by the Constitution. (Some dispute exists about this, such as searches of bags on buses...I think the Supremes ruled that cops can search bags on buses without warrants...a bad precedent, I think.) If the Centennial Park is a public place, not a private one, as I believe to be the case, then it seems to me a person is within his rights to turn down the offer to be inspected, frisked, interrogated, etc. (There may be enabling emergency powers covering specific sites. I believe such conditions apply when, for example, the President or other such royal figures are mixing with the proles.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

RE: Dry Under the Waterfall
by Blanc Weber 17 Dec '03

17 Dec '03

>From: tcmay(a)got.net > >I hear that "The Grasshopper and the Ant" is no longer considered proper >reading material for children, that they need to have their self-esteem >raised, that "I Have Two Mommies" is a more important book for them to >read. .................................................... What a difference it would make if along with the mandatory school attendance everyone received a mandatory education in basic economics, starting in Jr. High. Legislators and socially conscious individuals bemoan the lack of jobs, the downsizing of companies, the low salary wages, the imperative need for re-training, etc. as social problems to deal with by government -- yet the very thing which everyone could use the most of, that information which could prepare the minds of "America's future" for dealing with the way things work in a capitalist system and make it easier to transition into a world of uncertainty - while the administrations have the fortituous opportunity to provide it, is not delivered. Not that I expect that classes in economics delivered through the public schools would be all that accurate or therefore of much value, but the point being that those people who publicly complain to the general population about how the poor should receive subsidized support do not consider the disfavor of having the school system take up 12 years of everyone's time memorizing non-pertinent data, when they could have been using that time to good purpose -- *prior to* becoming independent adults needing an understanding of what it takes to make a living. "Knowledge is power", it is said. There are a lot of powerless beneficiaries of public education around. Or that's what a lot of people claim to be (powerless to help themselves). .. >Blanc > > > >

1 0

RE: Violation or Protection? [OLYMPICS]
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:51 PM 7/31/96, Blanc Weber wrote: >>From: tcmay(a)got.net >> >>If the Centennial Park is a public place, not a private one, as I believe >>to be the case, then it seems to me a person is within his rights to turn >>down the offer to be inspected, frisked, interrogated, etc. >........................................................ > >But if the park was a private one, would it make any difference? Of course, which is why stores can have "bags will be searched" policies, restrictions about atire, and all sorts of other policies which are not allowed in public places. Disneyland is a private park, and has rules which are not the rules a public park can have. Put it this way, "My house, my rules." > I mean, either it is, or it isn't, a "right". When could it really be >okay to violate that definition. How are the law enforcers to do their >job if they can't intrude into your shopping bag, when it's a critical >National Emergency. This is what Denning is always referring to. One needs to distinguish "rights" vis-a-vis government actions, and the policies of private actors. The usual point about "freedom of speech" applies. E.g., Blanc has "freedom of speech," but not inside Microsoft. Not to lecture, but this frequent blurring of public vs. private areas, of government vs. corporate actions, of "property rights," is hurting the cause of liberty. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1