- cypherpunks-legacy - lists.cpunks.org

Silly technical question from a non-technical person
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

> If it costs $10,000 to crack one 40-bit key (putting aside whether we > agree on that price or not), could not the software be designed in such a > manner that it is able to check, say, 10,000 keys at the same time? Ie, > it computes a key, and then checks it against the array of data to see if > it fits any of them, and then goes on to the next one. Hmm yes and no. - For pure RC4-40 yes. - For export SSL no. It has what is effectively an 88 bit salt (familiar with unix password salts? like that only 88 bits). - For full 128 bit SSL, yes, but 128 bits is a rather large even if you have a few million keys to try at once with speed up gains. 2^128 is a biiig number. - For DES I think so, asked for others opinions, this might be the next one to die, big project but possibly doable with lots of keys at once Adam

1 0

Non-News Govt Announcement on Key Escrow
by banisar＠epic.org 17 Dec '03

17 Dec '03

The White House and NIST annouced today that they were planning to hold two open meetings next month to develop standards for "acceptable" software key escrow. The standards will then be made into a FIPS. The programs cannot have keys larger than 64 bits. Its great to see that it only took them 18 months (since Feb. 94) to come up with a call for public meetings for something that nobody really wants anyway, expcept for the officals who plan to make it mandatory by slipping it through bit by bit and a couple of vendors. (sorry, sarcasm mode off...) -d (in non-official sarcastic mode today from home) David Banisar (Banisar(a)epic.org) * 202-544-9240 (tel) Electronic Privacy Information Center * 202-547-5482 (fax) 666 Pennsylvania Ave, SE, Suite 301 * ftp/gopher/wais cpsr.org Washington, DC 20003 * HTTP://epic.digicash.com/epic

1 0

Re: SSL challenge -- broken !
by ab411＠detroit.freenet.org 17 Dec '03

17 Dec '03

John Pettitt <jpp(a)software.net> writes: >On Wed, 16 Aug 1995, Damien Doligez wrote: >> The exportable SSL protocol is supposed to be weak enough to be >> easily broken by governments, yet strong enough to resist the attempts >> of amateurs. > >Exactly. > >> It fails on the second count. Don't trust your credit >> card number to this protocol. > >Huh? So you run on 120 workstations worth how much? to steal a credit >card number worth how much? Get real - there are hundreds of ways >to get credit card numbers that cost less. ... SSL can of course be used to protect information other than credit card #s. It is supposed to be strong enough to resist the attempts of amateurs, yet it was broken not by a government, not by a three letter agency, not by a major corporation, but by a grad student with a lot of spare cycles. In other words, it was broken by an amateur. The real issue is not cc#s, the real issue is: does it do what it was designed to do (foil amateur attempts), and the answer is: no, not so long as it is export-restricted to only 40 secret bits of key. -- David R. Conrad, ab411(a)detroit.freenet.org, http://www.grfn.org/~conrad Finger conrad(a)grfn.org for PGP 2.6 public key; it's also on my home page Key fingerprint = 33 12 BC 77 48 81 99 A5 D8 9C 43 16 3C 37 0B 50 Jerry Garcia, August 1, 1942 - August 9, 1995. Requiescat in pace.

1 0

Re: SSL challenge -- broken !
by Pierre Uszynski 17 Dec '03

17 Dec '03

Says Joe Buck: > > >Should some bad person get hold of your card number and misuse > > >it, you're not out any money: > > > > I'm not so sure....Checked the fees/interest lately? > > "There ain't no such thing as a free credit card theft." > > Yes, it's true that this contributes to high interest rates (though > defaults cost more than fraud). Certainly not only that. In fact you pay directly for weak credit card security through taxes used to legislate, police, try, and jail fraudsters. Add to that the cost to society of keeping these people in jail instead of more productive occupations. Add the time wasted straightening out bogus transactions. Add the cost of delaying purchases and action because of the (maybe irrational) fear that no secure payment system is available. The argument that fraud existed before credit cards is only a technically correct statement. It does not bear. The point is, credit card transactions could be much more secure, at sometimes trivial cost, making much fraud disappear. Unfortunately, in this case, insecure credit cards are not an obstacle to banks making money, so why should they care? Credit card fraud does not prevent politicians from being re-elected, so why should they care? Same would apply to car manufacturers: easily stolen cars do not prevent them from making money, so why should they care? When 'bad persons' misuse credit cards, the cost to us is very real, just well hidden by all involved. Pierre. pierre(a)shell.portal.com

1 0

Re: I need exportable crypto revisited.
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199508180030.RAA04988(a)mycroft.rand.org>, jim(a)acm.org (Jim Gillogly) wrote: >> "Perry E. Metzger" <perry(a)piermont.com> writes: >> If you have hooks for arbitrary encryption, you will find it to be >> virtually impossible to export the product. > >That's my understanding also (as I told him in e-mail) but I haven't found >any legal justification for it. You migh as well stop looking, because there isn't any. The brownshirts have long ago decided that the law means what they say it does. Welcome to reality. - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMDQd8ioZzwIn1bdtAQGyEwF9HHGf5vVL0EbVt7RVrXwLlQQUGLF+nFEl +KP+YB4/JYjjvE9G8By7RlezFhZF3Iy6 =MRsO -----END PGP SIGNATURE-----

1 0

Cheap Brute Force Attacks
by John A. Limpert 17 Dec '03

17 Dec '03

The use of idle cycles on workstations or PCs for brute force attacks made me think about the economics of this problem. How cheaply could a massively parallel system be built for key cracking? Much of the cost and complexity of current massively parallel systems is in the inter-processor communications and memory systems. Why not build a system with a large number of single chip processors (ROM/RAM/IO on one chip) and a simple/slow/cheap communication bus? I'm assuming that each processor can attack a small chunk of the keyspace without needing any external support. One or more PC boards could be populated with an array of cheap processors. There would be a master controller to assign chunks of key space and check for results. It could also download the software if it was to be stored in on-chip RAM. A PC board could be designed that would provide 5V power, a shared serial I/O bus and a wired-or interrupt for the microprocessors to signal the master controller that a key has been cracked. What would be a good microprocessor for this task? It would have to be cheap, reasonably low power with lots of integer MIPS. A decent amount of on-chip RAM would allow the software to be downloaded instead of being masked or burned into ROM. 1000 processors could be put into a relatively small box, lets say 10 boards each containing 100 single chip microprocessors. It shouldn't cost more than $10-$20 per processor, about the same total cost as one decent workstation ($10K-$20K). -- John A. Limpert johnl(a)Radix.Net

1 0

Re: (event 8/17) panel on the Net:Privacy, Security, and Parental Control
by Bill Stewart 17 Dec '03

17 Dec '03

At 04:10 PM 8/14/95 -0700, you wrote: >Perhaps some of us should be here to keep things in perspective. Thanks; it was an interesting panel. I missed the first half hour, since traffic was appalling :-), but got to the rest; maybe an hour of panel discussion and 15 minutes of organized q&a, then wine&cheese. Just about everybody was concerned about pornography on the net, and thought that the government had no clue what they were doing and shouldn't be regulating it; most thought that the whole issue was really a smokescreen for the government wanting to regulate the nets and especially interstate commerce ("Hmm, we tried scaring everybody about terrorists on the net, that fizzled, let's scare them about porn and their kids - that always works!"). About half the panel had kids between 4 and 15. Lots of concern about media concentration and how this is currently the only widely accessible medium for 1:N communications so it's a target. Some interesting discussions about changes in society and our relationships with other people that come from net-style communications and artificiality - Mark Slouka was mainly taking the side of "this is different and I'm not sure I like it, and the fact that people are desperately seeking community through this virtual stuff says our communities out in the real world are probably having some real crises", with interesting thought behind it. PGN brought in some RISKS stuff, including the how-rumors-spread dynamics; he also talked a bit about cryptography (he's on that national policy review), somewhat from the perspective of "it's an international problem and trying to do things within national borders is ineffective" - I'm not sure he's on our side here though he's at least clueful. Dan Gillmor had some good perspectives on objectivity in reporting - the news business knows it's not objective, and he's at least concerned with trying to be fair and balanced and as quick as possible about correcting mistakes, but then he edits the SJMerc business page so it's a lot clearer what "mistakes" are than in, say, political reporting. >> * George Baldwin, California State University, Monterey Bay George Baldwin is involved with the IndianNet project, putting things like Native American artwork on the Web, including for sale. He brought up some cultural perspectives - a lot of people have been viewing it, but Native Americans don't actually _buy_ much of it because they tend to view artwork as personal and want to know the artist and what it means to him/her, and the net doesn't do that very well. If you haven't heard of CSU Monterey Bay, it's opening RSN. >> * Bill Bauriedel,Stanford University He's on an inter-university study to address things like how to do on-line registration while preserving privacy (doesn't like export laws at all.) >> * Dan Gillmor, San Jose Mercury News >> * Richard Gingras, Apple Manages E-World and some network things. >> * Peter Neumann, SRI >> * Craig Newmark, Digital Threads Used to wear plastic pocket protectors when he was younger :-) Consults to big companies that need clues. >> * Mark Slouka, University of California, San Diego One of the liberal arts types on the panel. Either he or George Baldwin was talking about college students learning creative writing on MUDs and MOOs. #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- "The fat man rocks out Hinges fall off Heaven's door "Come on in," says Bill" Wavy Gravy's haiku for Jerry

1 0

Re: Export policy change
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 12:12 AM 8/18/95, Timothy C. May wrote: >My neighbor has agreed to be the escrow agent for my keys. He doesn't know >anything about computers, so he's taking my word that the things I give him >every couple of months are disks. He figures that if the Justice Department >ever asks for them, he'll point to the dusty box on the floor of his garage >and say, "There they be." You wouldn't want them to get *dusty*, Tim. Why not embed them in something like epoxy, better, Lexan, to protect them from the elements? Say about a foot thick in all directions... Should make sure the media itself is sufficiently coated too. Don't want the little electrons getting hurt, you know... I see a market opportunity here. Time to buy DuPont stock. I hear it's been depressed lately. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

NIST Key Escrow Issues Meeting
by Carl Ellison 17 Dec '03

17 Dec '03

I don't know if it's been posted, but I have in my hands a statement that these meetings will be open to the public. "The meeting will be open to the public, although seating is limited. Advance registration is requested, please contact Arlene Carlton on 301/975-3240, fax: 301/948-1784 or e-mail: carlton(a)micf.nist.gov " - Carl P.S. Anyone going to CRYPTO95? I'll be there starting tomorrow (Sat). +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme/home.html | |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | ``Officer, officer, arrest that man! He's whistling a dirty song.'' | +----------------------------------------------------------- Jean Ellison -+

1 0

Attend Windows NT Intranet Solutions!
by announce＠lists.zdnet.com 17 Dec '03

17 Dec '03

----------------------------------------------------------------- ZDNET ANNOUNCEMENT 8/6/97 ----------------------------------------------------------------- Are you looking to evaluate the latest Windows NT products? Attend Windows NT Intranet Solutions August 11-15. What: Windows NT Intranet Solutions August 11-15 Where: Moscone Center -- San Francisco, CA When: August 11-15 Windows NT Intranet Solutions, the NT Event, features a conference and expo program focused on all the major NT issues: - Integrating Unix/NetWare and NT - Migrating applications to NT - NT scalability and clustering - Managing and securing NT networks and much more. The expert-led Conference program, co-sponsored by PC WEEK, Inter@ctive Week and Windows Sources, runs August 11-15 and the 3-day Expo, featuring all the leading vendors and the latest NT products and solutions, runs August 13-15. To register free for the Expo and get complete conference info, call (888)800-8920 or visit the Windows NT Intranet Solutions on the Web at: http://www.wintis.com Windows NT Intranet Solutions is presented by SOFTBANK Forums, the producers of NetWorld+Interop and Seybold Seminars. _______________________________________________________________ ZDNet Announcements are periodic notices of new features, special events and free offers available to members of ZDNet. --To subscribe to ZDNet Announcements, please send mail to: announce-on(a)lists.zdnet.com You can leave the subject and body blank. --To unsubscribe to ZDNet Announcements, please send mail to: announce-off(a)lists.zdnet.com You can leave the subject and body blank. _______________________________________________________________ Powered by Mercury Mail: http://www.merc.com

1 0