- cypherpunks-legacy - lists.cpunks.org

Re: Native American Encryption?!
by doug＠netcom.com 17 Dec '03

17 Dec '03

tcmay(a)netcom.com (Timothy C. May) said: >They were the Navajo (or Navaho) code talkers. Kahn's "The >Codebreakers" has a discussion of this, as I recall. Probably the >"Encyclopedia Britannica" will also a mention of it. It's mentioned in a bunch of crypto sources, but coincidentally, PBS just ran an entire show about this precise subject a couple weeks back. Not just passing mention...the whole show was about this. Therefore talking to PBS people would likely yield some good info... and possibly videos. >> 2) If one used a natural language for encryption, and the would-be code >> crackers did not know it was natural language (say, Hittite), could they crack >> it? I seem to remember that hieroglyphs were undecipherable until the >> Rosetta Stone was discovered. But maybe current techniques would do a >> better job....? > >These are codes, not ciphers, and are of course not very secure. Err...."of course"??? Codes are (all else being equal) quite a bit more secure than ciphers. (or do I have "code" and "cypher" reversed...whatever. :-) There's a classic SF story, whose title I forget, about anthropologists trying to figure out writings of a dead species on Mars. The table of elements finally proved to be the Rosetta Stone equivalent. The interesting thing about codes, which in a sense includes all natural languages, versus ciphers, is that code systems represent semantics. If the underlying semantics is radically different than what the code-breaker knows...too bad. >Germans and Japanese in WW II obviously did not have enough time to >find native Navajo speakers, and I suspect few books on that language >were available at that time, hence the scheme was temporarily secure. > >Otherwise, forget it. It was more complicated than that. They used a hybrid system that native Navajo speakers could not decrypt, because the system used not only Navajo, but on top of that, arbitrary (and newly invented) metaphors for concepts, and (newly invented) puns to represent ciphers, too. It is certainly true that part of the security was "through obscurity", but (A) that part was effective..."security through obscurity" can be effective over short periods of time...and (B) they layered ciphers on top of codes. The obscure linguistic aspects of Navajo vs. other modern languages is also said to have played a part, but I haven't researched this yet, so I won't comment. Arthur Chandler <arthurc(a)crl.com> said: >I seem to remember that hieroglyphs were undecipherable until the >Rosetta Stone was discovered. But maybe current techniques would do a >better job....? In the absence of a Rosetta-Stone-sort-of-thing, we're still lost. For instance, the Easter Island hieroglyphs are still completely mystifying. Some of Nyquist's mathematical results are still classified, so one never knows, but... Arbitrary semantic systems encoded in writings are not decipherable, period, barring some breakthrough in mathematical semantics...don't hold your breath. :-) Doug

1 0

Re: Native American Encryption?!
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Median writes: > I may be in trouble for not knowing basic literature, but if so so be > it. Would a code you created yourself be secure? If you create your > own language from scratch, and the 'enemy' never gets something to act > as Rosetta Stone, is it still not secure? Or is the "aliens figure out > our language with lots of computers" cliche bogus? > I want to avoid casually dismissing Median's question without writing a mini-essay on code-breaking. Especially when so many fine and accessible (easy to read) books on code-breaking are available. (To find them, cruise your local library. I recall the Herbert S. Zim book as being a very fine introduction. Basic, and nonmathematical. But a good start. I read it in junior high school, many years ago. I was reminded of it recently, when I think Whit Diffie cited it as an influence on him as well--he obviously was more influenced by it than I was, as he went into crypto and I went into physics, a much less interesting field.) Basically, word-frequency analysis kill simple codes. Replace the word "the" with the string "globflq" and it's still going to be fairly obvious that "globflq" means "the." And so on. And, as Median mentioned, a few words may become known, in all the usual ways, and thus a Rosetta Stone has been found. The issue of communication with extraterrrestrials--some day perhaps--is an interesting one. I have no idea what work has been done on "breaking the code" when almost no clues exist. Some SF writers have explored this idea. But in summary, codes are a poor approach. The entropy of coded messages gives clues about the underlying plaintext and eventually the code falls. Usually fairly quickly. Ciphers (or cyphers) are superior, as the entropy of the ciphertext can be very high (roughly, "maximally random," though I don't want to get into what randomness means here). Kahn's "The Codebreakers" remains the definitive book. All Cypherpunks should at least read the paperback abridgment of the original massive book. "Kahn on Codes" is also pretty good. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. Note: I put time and money into writing this posting. I hope you enjoy it.

1 0

Re: Breaking DES
by wmo＠rebma.rebma.mn.org 17 Dec '03

17 Dec '03

Whenever Perry Metzger defends an opinion of his well, somebody whines. Whenever Perry Metzger disagrees with someone's arguments, someone else crys "unfair! He's using his WITS on me!" Whenever Perry Metzger has to stop and demonstrate something as simple as arithmetic to end an argument, someone cries "foul! sarcasm! Hey, he's not playing nice!" Y'all need to develop slightly thicker skins. Perry's efforts could serve to raise the thought level of other posters to this list, if they'd stop reacting to each prod with an irritated swipe back at the prodder. I like the strife on this list. Happy people getting along famously are dull. (Someone could consider adding to the cypherpunk philosophy: Cypherpunks write code, and cypherpunks are irritable.) -Bill

1 0

Re: Spread-spectrum net (vulnerability of)
by doug＠netcom.com 17 Dec '03

17 Dec '03

Matthew J Ghio <mg5n+(a)andrew.cmu.edu> said: >Depends how you place them. If you put them _on top_ of things, you'd need >a helicopter to shoot 'em. I used to work with the person who set up 80% of the West Coast ham radio digital packet system repeaters. He had a bit of money to burn, and he set up a *bunch* of these repeaters on various mountain tops up and down the West Coast. This was circa '85 by the way. Each repeater required: 1) a source of power -- this is easy to forget, but it is nontrivial. Batteries just don't cut it. Rather than explain about batteries, I invite people to ponder power requirements for given broadcast distances and guess battery lifetime. Anyway, he had a PG&E (electric power) hookup and a monthly bill for each of these. Good thing he had all that money... He had trouble finding people who were willing to allow his stations; people who live on mountain-tops tend to be rugged individualists. :-) But he managed. 2) Line of sight reception and transmission. The higher the frequency used, the more that line of sight is required by the physics of the situation. Even if line of sight isn't strictly required, signal strength drops when you get out of line of sight -- if you depend on radio wave diffraction to get the signal to you and from you, you can count on heavy signal loss in the process. 3) Protection from the elements. He used rack-mounted 286 cards in an industrial enclosure, but there was *no way* he could leave the boxes exposed to the elements. A roof was required. This is the kind of issue that is easy to neglect, but is absolutely essential for real life conditions: weatherproofing of the assembly. If you don't use as roof and walls, you'd better have a genius mechanical engineer design the enclosure. This is a lot harder than it sounds. >Someone walking around a city shooting a rifle is likely to attract a >lot more attention than a secret network would. Your opponents wouldn't do that...the "enemy" here is simply the FCC, count on it. They have field agents who triangulate illicit transmitters, and once they find one, they simply get all the warrants and court orders needed to deal with it. >Secondly, the >transmitter doesn't necessarily have to be exposed, it could be kept >hidden and only the antenna would need to be exposed. You'd have to be >a damn good shot to hit a wire antenna. Plus the antenna would be easy >to disguise or hide in many places. Sure, this is possible. But it doesn't help *that* much. Triangulation of signal spots any antenna quickly, and they cut that off immediately. You can get increasingly elaborate about hiding the signal source, and restoring antennae quickly as they're pinched, but it's sort of a losing battle unless you assume real time response by the underground lead by a brilliant EE type. I am not saying that an underground wireless net is impossible. I *am* saying that the difficulties are much higher than they may seem at first blush. I think doing something like this is possible, and it would have definite benefits. But anyone moving on this would do well to get in touch with the existing ham radio crowd who have dealt with the pragmatic issues involved for the better part of a decade (or more). > Hence we have achieved >our objective - you know how to contact site #3 in netspace - it has a >cybernetic location relative to other sites, but that tells you nothing >about it's actual physical location. Right...in a sense, this is the easy part. Definitely one can hide physical locations if everything is set up carefully. Doug

2 1

from a source who said "NOT FOR ATTRIBUTION" re: National Performance Review (fwd)
by Stanton McCandlish 17 Dec '03

17 Dec '03

A "National Privacy Protection Board" ?! Forwarded message: > Posted-Date: Wed, 13 Oct 1993 08:35:15 -0400 > Message-Id: <9310131235.AA08993(a)linc.cis.upenn.edu> > X-Sender: farber(a)linc.cis.upenn.edu > Mime-Version: 1.0 > Content-Type: text/plain; charset="us-ascii" > Date: Wed, 13 Oct 1993 08:35:15 -0400 > From: farber(a)central.cis.upenn.edu (David Farber) > Subject: from a source who said "NOT FOR ATTRIBUTION" re: National Performance Review > Precedence: list > > > "The Vice President's recent report "From Red Tape to Results: Creating a > Government that Works Better and Costs Less (National Performance Review) > is peppered with recommendations about how to use information technology to > "reinvent government." They would put in place an administrative > infrastructure that empowers agencies and tracks progress, and undoing much > of the entrenched bureaucracy that evolved and got ossified in the single > vendor-mainframe era. > > The meat behind the recommendations, teased together with much help from > industry and information technology experts, is in a yet unreleased > technical report, and it appears that it may never be vetted in public. The > reason seems to be fears within the VP's public relations hirearchy, that > the background report may generate controversy. This one should- among the > ossified. Early and inaccurate drafts have begun circulating, raising risks > that many of the good ideas will be stillborn as bureaucratic barriers that > threaten the status quo are errected. > > The recommendations include no-brainers (placing all agencies on the > Internet and spreading e-mail through all agencies), huge $ savers > (generating agency agreements for integrating tactical law enforcemnt > network technology) and actual innovations (replacing the infamous "GSA > Schedule" (which slows federal procurement of IT and raises costs) with a > real time electronic marketplace. Some short acronym agencies appear > sensitive to a proposal for a National Privacy Protection Board. > > Curious? Take a look at the report on the UNC Sunsite Gopher. Want to know > more contact the VP and tell him!" > > > -- -=> mech(a)eff.org <=- Stanton McCandlish Electronic Frontier Foundation Online Activist & SysOp NitV-DC BBS 202-232-2715, Fido 1:109/? IndraNet 369:111/1, 14.4V32b 16.8ZyX

1 0

Notes from House Hearing on Cryptography Export Controls
by djw＠eff.org 17 Dec '03

17 Dec '03

October 12, 1993 House Foreign Affairs Committee Subcommittee on Economic Policy, Trade, and the Enviornment Hearing on mass market cryptography and export controls Rep. Sam Gejdenson (D-Conn.), Chair [A hopefully informative and probably biased account of the hearing by EFF] Committee Members present: Gejdenson, Cantwell (D-Wash.), Fingerhut (D-Ohio), Rohrbacher (R-Calif.) Manzullo (R-Ill.) Witnesses: PANEL 1 (Open) J. Hendren, Arkansas Systems (A data security firm that does a lot of international banking work) Ray Ozzie, IRIS Associates for Business Software Alliance (Lotus Notes developer) Stephen Walker, Trusted Information Systems for Software Publishers Association Philip Zimmermann, PGP developer Don Harbert, Digital Eqiupment Corp. PANEL 2 (Secret Session) NSA representative Opening Statement of Gejdenson: "This hearing is about the well intentioned attempts of the National Security Agency to try to control the uncontrollable.... The NSA itself acknowledges that if you have a long distance telephone line and a modem, you can send this software anywhere in the world. If you have a computer and a modem you can take this software off of the Internet anywhere in the world.... I do not question the value of the information sought by the National Security Agency. But once it is determined that the dispersion of this software cannot be controlled, then however much we might want to protect our ability to obtain information, it is beyond our means to do so. Just as in the case of telecommunications, the National Security Agency is attempting to put the genie back in the bottle. It won't happen; and a vibrant and productive sector of American indsutry may be sacrificed in the process." The main points raised by witnesses were these: 1. DES and other strong encryption which is barred by ITAR is in the public domain and available on the global market from foreign software manufacturers: -Ray Ozzie used his laptop and a modem to show how to get a DES implementation from ftp.germany.eu.net. The committee loved it and most of them seemed to understand what was going on on the screen, even though they had never heard of ftp. -Stephen Walker described the results of an SPA study which uncovered over 250 cryptography packages which offer DES-based or stronger algorithms. -Phil Zimmermann testified that he designed PGP from publicly available information. 2. Foreign DES implementations are just as good as US versions. Surprisingly enough, this is a contentious issue. Some members of the committee seemed to have been told by someone or another that foreign versions of DES may not be as strong as those that are made in the USA. If this were true, then export controls might still be justified despite the numerous foreign versions of DES on the market. In my view, this is a pretty desperate argument. -Steve Walker demonstrated that all DES works the same way by encrypting a passage from Mozart's Eine Kleine Nachtmusik with several different foreign DES packages, and then decrypting them. Surprise! They all sounded just the same. 3. Lots of money is being lost by US software/hardware vendors: -Don Harbert from DEC told of loses of over $70 Million in just the last few months. -BSA estimates that export controls exclude access to a global market the is $6-9 Billion. 4. People want their privacy -Phil Zimmermann told the committee about his experience with PGP users and how badly people need and want to protect their privacy in electronic environments Committee Responses: Overall, the committee was quite sympathetic to the witnesses. Chairman Gejdenson seemed very supportive of changing export controls. Rep. Dana Rohrbacher, no flaming liberal, said, "the cold war is over. I sympathize with everything that has been said here." ................................................................... Daniel J. Weitzner, Senior Staff Counsel <djw(a)eff.org> Electronic Frontier Foundation 1001 G St, NW Suite 950 East Washington, DC 20001 202-347-5400 (v) 202-393-5509 (f)

2 1

Re: Native American Encryption?!
by koontzd＠lrcs.loral.com 17 Dec '03

17 Dec '03

>If nothing else, adding encryption on top of the Navajo >language makes known-plaintext much more difficult. Navajo has no written language.

1 0

Re: Native American Encryption?!
by lefty＠apple.com 17 Dec '03

17 Dec '03

> I remember hearing many years ago that one of the branches of the armed >aervices during WWII used a native American -- Cherokee? Apache? -- >language to communicate. The Japanese (the story goes) went nuts trying to >crack the code -- unsuccessfully. It was Navajo. > Two questions: > 1) Can anyone give me a reference for this story (assuming it's true)? There was a recent (i.e. within the past year) article in Smithsonian magazine on the "code talkers". I believe only one or two of them are still surviving. This sort of thing doesn't constitute what would properly be called a cipher; it's either a code, or perhaps a species of steganography. -- Lefty (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

1 0

Native American Encryption
by A little like having bees live in your head. 13-Oct-1993 1306 17 Dec '03

17 Dec '03

>>If nothing else, adding encryption on top of the Navajo >>language makes known-plaintext much more difficult. > >Navajo has no written language. Not so. There has been a written form for Navajo for the last few decades (at least). It uses the Roman alphabet but the mapping of sound-to-character is not the same as for English. Vowels aren't even a, e, i, o, and u, which certainly doesn't help speakers of English trying to form syllables. To my eye, it more closely resembles modem noise on an ASCII terminal than anything else, but it does exist. (no, I can't read it) Navajo code talkers spoke with Navajo words, but not with Navajo meanings. Parts of speech that should be nouns became adjectives, etc. Navajo Elders who heard the code talkers commented "It sounds like Navaho, but it doesn't make any _sense_!". -Ya-ha'-tey! Bill Yerazunis

1 0

Internet Security Scanner available
by System Operator 17 Dec '03

17 Dec '03

For those of you without FTP access who would like to take a look at the Internet Security Scanner, it is available on my BBS in /public/crypto. Call +1 410 730 6734, 12/24/96, login "cypher" password "punk". Dan -- system(a)decode.UUCP (System Operator) Cryptography, Security, Privacy BBS +1 410 730 6734 Data/FAX

4 3