- cypherpunks-legacy - lists.cpunks.org

Greetings and Thank You
by schneier＠chinet.com 17 Dec '03

17 Dec '03

Thank you all for welcoming me to the cypherpunks meeting last weekend. I enjoyed myself, and will attend again if our schedules ever match. Following are two files. The first is the latest errata for my book, and the second is the index. I am trying to get permission to publish the bibliography electronically. Cheers, Bruce

1 0

an idle little thought
by m5＠vail.tivoli.com 17 Dec '03

17 Dec '03

I was just sitting here thinking about DES software, when it occurred to me that (say, in the case of UNIX crypt) a lot of the keyspace is typically lost because the first 32 ASCII characters are "unfriendly". Has anyone thought of (or maybe implemented) some sort of DES-type symmetric cypher (one that uses typed ASCII passwords) and explicitly allowed, say, 16 byte passwords? Seems like you could take pairs of characters and do some shifting and XORing to get better utilization of the keyspace. Just a minor little idea. (I'm waiting on a big "make"... :-) -- | GOOD TIME FOR MOVIE - GOING ||| Mike McNally <m5(a)tivoli.com> | | TAKE TWA TO CAIRO. ||| Tivoli Systems, Austin, TX: | | (actual fortune cookie) ||| "Like A Little Bit of Semi-Heaven" |

1 0

Questions about hardware RNG design and implementing RSA/DES/IDEA in hardware
by HO JUNYA 17 Dec '03

17 Dec '03

(I apologize for the crossposting; I feel that this is relevant to the newsgroups and mailing lists that I've posted this to) Hi, we're trying to design and build a hardware random number generator for use in key generation for secret key cryptosystems (likely to be at least a one time pad, perhaps DES or IDEA), as part of a hardware design project. We'll be putting the transmitter and receiver on expansion cards for ibm-compatible pc's, and hopefully be able to keep as much of the work as possible in hardware. My question is, I am trying to come up with ways of building this true RNG (random number generator) using a few simple components. For my noise source, I will probably be using thermal noise in electrical components. I understand that noise has a Gaussian distribution through time (i assume time referring to the time interval between successive signals of a certain power/amplitude?), and will be finding the median of this distribution so as to sample the random binary bits on either side of this median. We will attempt to design something which will automatically find the median in a given set of conditions. (I am told this is called anti-biasing?) My questions are: does anyone know of any actual implementations of this sort of RNG? can anyone suggest a good introductory reference to noise, random behaviour or sampling from random sources? what sort of hardware requirements do the DES, IDEA and RSA algorithms have? We will not be using IC's built for the DES or RSA encryption, but will perhaps program a controller of some sort to do this. I am afraid that RSA (for the initial secret key exchange) will take too long on an 8088 or lesser processor. we're looking for bitrates of about 1kbits/s from the RNG, since 75% of that will likely be thrown away in the process of 'pairwise (something)'. (if two consecutive bits are the same, throw them out, if they are different, take the first one) I would appreciate any comments, answers, concerns, &c Junya hojunya(a)ecf.toronto.edu

1 0

Curve Encrypt 1.0 Release Announcement
by W. Kinney 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Curve Encrypt 1.0, IDEA encryption for the Macintosh is now available for ftp from ripem.msu.edu, directory: pub/crypt/other/curve-encrypt-idea-for-mac Read the file pub/crypt/GETTING_ACCESS for information on how to get access to the ftp site. I plan to also make CE available through csn.org (Mike, are you listening? Your mail is bouncing). Curve Encrypt is a freeware drag-and-drop encryption application for the Macintosh. It uses IDEA cipher-feedback mode with a 255 character pass phrase, and encrypts both the data and resource forks of files. Source code is provided. Distribution: Curve Encrypt (c)1994 Curve Software. Permission granted for distribution within the United States only. It's fine with me if you make the software available by giving it to your friends, putting it on _local_ BBS's, taping floppies to stalls in the men's room, things like that. But don't export the software, and don't make it available on places like international anonymous ftp sites. And please make sure that the people you give the software to understand the export restrictions. This applies the application and the source and anything that _contains_ Curve Software copyrighted source. Is this sufficiently clear to keep me from getting Swanked? All releases are verified with PGP signatures. Public key: - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3 mQCPAiz+bEEAAAEEAMUbtdwYC1vY+s5559ERIvC1MT+Yaw3ozheaHcUciJe7cSAk k9TpAQd7iKukKnQe5kK1YtvYm0JP6fmNrcO8AmG5ukvcOlyuri618sjpXncpQ1cL 5xeV80f3JtmheGMnqAzTK8OyfJ7zRh1PhAZcT/vVzf+JGuCuVcJkEfxTVMrJABEB AAG0K0N1cnZlIFNvZnR3YXJlIDxraW5uZXlAYm9nYXJ0LmNvbG9yYWRvLmVkdT6J AJUCBRAtBLJRIDvxOj7zTo0BAQLFA/9fmt+S3PyHcl4OpfRz0iGhtYvfq9gZW/Oq vxWJiQBExgjtDhwq6keAO6c75D7MqJJKxIUGXOU97h92DmEn54M5SKtwVGDPkG78 I3WMDA90SUAdzhbXbKKKtO+rgeCBHuPftoI/PXGxSaDNspuIzoUjpIpNYrR9o6he gIJsbMDi/YkAlQIFECz/Arz37+E6SINj8QEB43kD/R8Vfk6fhnFz+C410Nv6cdlx 3pPAnFRv1JNOWwlfgEAoBx/TEbgNjQv70M3Q3rDoU5HdG5kgBTHbnFL3JEFIwt7W A7Dqoj0L+W06+HvJygoKQ4Gqh7qiKxHNESEivdT4VBdEi7tCGfkRMSWNGNa9Dp+F 6iGsuFIZWx+kFoq1vZ9X =OBJZ - -----END PGP PUBLIC KEY BLOCK----- This key is also available from the key servers. Enjoy! -- Will Curve Software <kinney(a)bogart.colorado.edu> -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLT0xCMJkEfxTVMrJAQHGlwP/TtbZFG+Dt0UcAnswiG6pgKBRgP9OCsih nGx33tKxFJRwUwIp8kQrayG6MwjDfYXuk/mRALtHnmvjsure5Hi3NpgjwWxibYg8 2Ua00VhZQygm+vyrZ7Tf9Tat8u2zpYzfDIPUS119gznDSQ0tzwwRpRqfn8cLrpme KHTWBVqFkE8= =Ybhj -----END PGP SIGNATURE-----

1 0

Thanks
by W. Kinney 17 Dec '03

17 Dec '03

I just wanted to say thanks to the people who lent a helping tentacle by beta-testing Curve Encrypt. I appreciate your help. -- Will

1 0

Offshore Banking FAQ or Guide
by Al Billings 17 Dec '03

17 Dec '03

Someone should make a FAQ or Guide to offshore banking. It would be useful. Is anyone here qualified and willing? (*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*) | Al Billings aka Grendel Grettisson | "You are, each one, a priest, | | mimir(a)u.washington.edu | Just for yourself." | | Sysop of The Sacred Grove (206)322-5450 | | | Admin for Troth, The Asatru E-Mail List | -Noble Drew Ali- | (*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)

1 0

subscribe
by rarachel＠prism.poly.edu 17 Dec '03

17 Dec '03

subscribe rarachel(a)prism.poly.edu Please subscribe me. (My rarachel(a)ishara.poly.edu account is not really usable as the machine is pretty screwey these days, so I thought I'd resubscribe from here instead.)

1 0

Detweiler's SQUISH broadcast: can remailers filter out addressee?
by Anthony Garcia 17 Dec '03

17 Dec '03

I'm not familiar with anonymous remailer internals. Would it be cheap in terms of hack-time to add the capability for an anonymous remailer to maintain a list of addresses (or address regexp's) which do not wish to receive anonymous remailed messages? That way, if Detweiler is sending unwanted msgs to say, "chess-fans(a)foo.bar.com" via an anonymous remailer, and the readers of chess-fans complained to the (hopefully responsive) remailer operator, the remailer operator could add the "chess-fans" address to a "don't- remail-to-these-folks" list so that the nice readers of chess-fans can read mail in peace. However, if the "Don't-mail-to-these-folks" list gets too long, it would probably degrade remailer performance... sigh. (remailer authors: is this a correct assumption?) (Perhaps the "don't-mail" addresses could be tagged with amount of time somebody last attempted them; addresses that no one's attempted to hit in say, a year, could be expired.) -Anthony Garcia agarcia(a)sugar.neosoft.com NeoSoft is a commercial access provider, not my employer. (They didn't demand identity verification when I signed up, either. Yay, capitalism!) P.S. Larry: I didn't make the "tentacle" list in your SQUISH post? I feel slighted! Please correct in the next version.

2 1

Squish
by Zog Archer 17 Dec '03

17 Dec '03

You guys have way too much time on your hands... Where did the prize money come from? Oh, and what if Medusa WANTS to go to hell, so folks like you aren't there to pester her/him/it??

1 0

RSA Question
by charliemerritt＠BIX.com 17 Dec '03

17 Dec '03

an56238 on Jan 19: >what I was asking is the _list of possible values for d_. The list is all the numbers less than N that are relatively prime to ((p-1*(q-1)). These are all possible D's for N - the list is smaller for a given e. See below. >Any general formulas giving the probability of solutions for the d's ? The number of D's for a given N and E is gcd((p-1),(q-1)) Some messages can be spoofed with more D's but the gcd is the number of D's for all messages. The distribution of these D's is one every ( (p-1)*(q-1) )/ gcd ((p-1)*(q-1))

1 0