- cypherpunks-legacy - lists.cpunks.org

RE: 64 bit crypto
by John A. Limpert 17 Dec '03

17 Dec '03

<code deleted> >Then the prepare_key routine would take much much longer. > >The idea is that a 64 bit crypto routine can be arbitrarily >secure against brute-forcing, if you are willing to pay a >runtime penalty every time you use it. My thought was that there might be shortcuts that the attacker could use to compute the permutation of the state array in less time. I wrote a small test program to look for cycles and weak keys in the 65536 iteration permutation. I assumed a 40 bit key. One weak key was found, 0x0101010101, that produces a 255 iteration cycle. 375 randomly chosen keys were tested and no cycles were found. There ought to be a faster way to compute the permutation with a more analytical approach. My skepticism tells me that nothing is a replacement for more key bits. In a semi-related question, why don't we see Feistel systems with larger numbers of rounds? Would a modified DES with 256 rounds be any more secure than standard DES?

1 0

Re: GAK
by Duncan Frissell 17 Dec '03

17 Dec '03

At 09:25 PM 9/3/95 -0400, Brian Davis wrote: >I, of course, know of the "dislike" of GAK here. I am curious to know, >however, if the "dislike" is because government would have access under >any circumstances or if the primary worry is that government will cheat >and get access when most would agree that they shouldn't (either by the >judge "cheating" or a TLA stealing it). Individuals will have their individual objections. My objections are that I don't like governments spending tax money that they don't absolutely have to. Their own survival is *not* a necessity. I think controlling people's speech is a waste of money. Very few Common Law crimes (ie real crimes) are dependent on wiretap evidence for solution. Only phoney bureaucratic crimes (the retail pharmaceutical trade, insider trading, gambling, conspiring to overthrow the government, etc) need wiretaps. My second objection is the control of people's speech. If I communicate with someone, I want to communicate with *them*. I don't want to communicate with the Feds. The Supremes have held that the right to speak includes the right not to be forced to speak. By implication, I would argue that I have the right to choose my own channels of communication including my intended audience (and this has been upheld by the Supremes in other contexts). If the Feds want to know what I've written or said (non-publicly) let them subpoena me and I will be happy to tell them to go to hell. If we can deploy technologies to protect our freedom to communicate the way *we* choose to, then we have the right to do so. Beyond rights, we have the power to do so --- which is worth even more. >In other words ... if it took agreement by a review board composed of >non-LEA members of this list, would the escrow be acceptable?? I don't think many of us would feel better if a private party had to approve the invasion of our privacy. DCF "You can ignore all of the rest of bullshit. All that you need to know about an enemy is how many guns and men does he have and can they stand fire."

3 2

KILL Robert Cain mail
by paul＠hawksbill.sprintmrn.com 17 Dec '03

17 Dec '03

see subj line

1 0

Testing
by rcain＠netcom.com 17 Dec '03

17 Dec '03

to see if 20 some copies of this note also go to the list. Sorry about that last one, I've never had that problem from netcom before and sorta suspect it is the list software. Peace, Bob -- Bob Cain rcain(a)netcom.com 408-354-8021 "I used to be different. But now I'm the same." --------------PGP 1.0 or 2.0 public key available on request.------------------

1 0

Re: Crypto Regulation Reform
by rcain＠netcom.com 17 Dec '03

17 Dec '03

Sameer sez: > > Idea: > Apply for the patent. If they decide to classify it release > the idea through the anonymous remailers. Right, spend a bunch of money for nothing and risk prison for "espionage". I think that is what they charge you with when you release classified info. No thanks, Sameer. There isn't an anonymous mailer yet that I would trust and do you honestly think my account (hell, my life) would not be monitored if such a classification were to occur? I do have an idea though that might satisfy the skeptics. I will divulge the method to *one* of you for evaluation that is considered capable and trusted by this community at large under a non-disclosure agreement if my attorney says there is such a thing that can be written between individuals which has teeth. If anybody wants to take me up on this, first get permission from the individual and email me the name and email address. He/she must have PGP and it must reside on a stand alone machine connected only by a modem to another machine on the net. Fair enough? I would prefer someone that has followed everything in crypto though for a few years to help me determine if there is in fact any prior art I am not aware of. That was one of the reasons I brought it up here, to see if I would get a bunch of "It's already been done" responses. None so far. In fact if that person is the creative type and can bring something to the party (I think there is a way to make it even more secure between strangers but I haven't been able to tease it out of my brain completely yet) I would conider co-filing with that person. Peace, Bob -- Bob Cain rcain(a)netcom.com 408-354-8021 "I used to be different. But now I'm the same." --------------PGP 1.0 or 2.0 public key available on request.------------------

1 0

For Pr0duct Cypher
by Derek Atkins 17 Dec '03

17 Dec '03

I really wish there were some way to email you directly. I really hate wasting bandwidth like this... (For everyone else, I'm sorry. Please hit 'd' now). -derek -----BEGIN PGP MESSAGE----- Version: 2.3a hIwCwagUhZdVih0BBACXtR1JP6vWKBEaN3LaxpRbRorRpvmsA3MOD4Sco+F5RgvH xgO5dVBh0aRwDV3zbNLSIk6lF0MpmINu6uRqiwH/OlFErV+ALeSG4RkWONUdpYz+ MZs4vbRuMqjf8rFdF9JORy7Oq0bGY030/HicCP1Zv8HVxOCEL9LZbUYAhZDobaYA AAWV4D6AjWA2gRZrHsycYEV5U2Pc48wq8Rcg5lIKvNTfFYJ+6RufwHfK/7J8kJHJ xzTg7a2l4WiEnsb+VT1en+7hfIi5K2HZ2uFtyY9kqikdi/zPgjBsT/TM5eyvxRV1 MrCSltSmHXzbKxC9QWk3zuqb8LKjA8495hx6VRv4s2KT4rua6ntmsEopJtCTsK6g fQKESkiZYi7gb6b0LaI/jgZ1vY9pnM8JerKzi8A8QfP1Ck5mQu+0ldyEekSGChv8 zGTkhJrwK+ZIPynT/uwks7SUk7YKRv28ezIVGzp7mSk+7oGWvlZEYBGfQOGJwlqX vriYdzfmmbSqkLZw5/Y9awq3+7xF6gjBkgiqdoKbi5sIuFodhLoky/W7KnRqYzi9 jW4FS1JUZncJXlEFYBcmHA+7JzjFIu9nplRjR7SaIF58xwUphyZ8pVweIi/JZiwc 5E/CVRlR3VuBebY69bTcBJKZZ2HJDm2zEsWh/ggjRSEkH+sE9r8WaKRPwvPtlEZA Tigp2a5O9DFLAuuK0KpRWiZoOAd++haYSgGhRfqa5lsCfCsAjcNXIKWNwxpGFTsL 9r/Xr4L6n+3RIiTx8rZQam+83a3YUCO0Ems/JGfbSqckF4/MUJPbLX/HDnmIlRbW lXhDtaNIO7zy4O57cxhgAUQHTg5Yx53YSUxXShHnSz1Cw/2gbv5izlV93tLTIeq/ dVDFDqfnC4hGvLb84y9xSz1n3QnPANSWCGvcybHDX1nNph4iZRPiQfNtWtR7Hbj2 IxmOMI63IAIbou1ybcLFe/GVXpQC7NA42IfDBPnRt/JjwybrYdRa6Gp2dLoW/dge xFTKo1r4B4EW1hpa5ldWDhoC5yT21MX1rocSp+Zqf+rKiRSnx7gPO7ESpX1xidO5 3ffieyuSaARvSaa/2BnK2A/J7jss45S0KW78/rz4RmSCGBVeg17+VFutSPKNyr+b r3GGeYf83lz9sugdbB2CHLmb22hNvWyWilPL0WhPpgxmjTo0fpQKgkfM7mdKlTCz jGOlbH+EfL8kL837FKQOX74Ban1iDCdwFSIlkYWLJLxIz05J6CayPkUzPVDsJUUT nUjEKZoe9S99CCkm4OqDlMrX7zWiwbUQj6Pe/JwxnoGEAvz8GwDYHlQDhm9t8Wom p1pEKbQDLxkpIuEEp7C96cartcq3fun1vmEUuwhlKXoj6p+nXR0NxuUbQPhYnmHH xKTBgOzDC1n7OXC7/5SmdWRvygnKKwl6KI/IZ4TK6gCyv5YwN6HS7/pJNOnb075h WQFKi+Fy9QvgojGxp7+04DV6ZbUwy/UQsVUjHjmCEXGMBF1C23thawRjmcCBOC01 0QKRYlHMerEKvY2tHpvGl4TWM+W/xDXQbUZmDBE7FL2O2Nb5BdNpV+BrxejE8yb0 XBgq127JAzAqMMLTgEkc+SnT24nBrNQxAVuapsvwkUxJ2W7XjouGUjP0t9miYQCg aoIpagGEdIuznve/ZwBfJaXl1GLT8VTmvIU/zTsdJih1U6bzZvERwwDHpwMJx+hI b1sQXZdxagOGuV/W+g3ErTJlqrZFTPBh6beLll99ibD6V6mjYMCI1ho4Nqzx/gHN a7gXyfueIb+Ft7vJ4xU70X099ZSbei4U+Gr0ahKkxIrMEw7gUrbv55kKEHNRHV6w RwwVrJ+GsApGD31mwAcT+VYnnQ5Ye/617cwQ5b+fL5tVNvGrtvGxb00+BOZl5X72 b86sy6zjRxliBi1sv4itk+5XgQrrc8krTbGUQ+561m9iHwjrEsMkFfEvLfMRbate fNL/bz6cAZnqz5t9i62Neydh2RQqp/QDsrcj6O6quwdrEvm4wVTS5Ysh/8T390dt 0uqqi+4Amr3egZkGeBTYQyjo3jmGmZxdZWD2lLCowYFMeFxwLdnNKw== =Fxw+ -----END PGP MESSAGE-----

1 0

Bug in PGP MPI library
by anonymous＠extropia.wimsey.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Someone please prove me wrong, but I think there is a bug in the function mp_modexp_crt (RSA decryption and signing) in PGP23a's MPI library. Attached to this message is a program which demonstrates the bug. While testing Magic Money for lingering bugs, the client gave the error "Coin from server has bad signature!" I tried again with different coins, and the program worked. The proto.dat file had been cleared as the coins were read, so there was no way to repeat the error. I set up a batch file to repeatedly cycle coins between the client and the server, backing up proto.dat each time. After an hour or so, the error happened again, and I started tracing it. There didn't seem to be any bug to find. For this particular coin, the unblinded coin was garbage. For any other coin, the program worked. I wrote this test program, bug.c, to find the error. It uses the same coin, blinding factor, public, and secret key as Magic Money was using when it crashed. The program first blinds the coin, then signs it, then unblinds it, decrypts the RSA signature, and displays the results. If you just run "bug", Here's what happens: >bug e=0001 0015 n=A8DF 1E61 234B E660 800A 4167 40A9 102D FC01 6962 AD6C BE39 2664 92AE E8B4 CE3A 93EB F4BE FFD1 104A DB81 2F95 684E C188 0901 379C 99BC 5E24 7EC2 660B 1463 139F d=4612 D56D AA0A B760 3561 60C6 EE7A 5CE8 A74B D0C9 501E D7B1 C145 D654 3B38 E90A 6FF4 BC13 221E E354 345D B789 38D6 3427 DA7A 48D6 570C 3860 FC86 0B8F AB80 FCE5 p=C737 3481 985A B4B3 4E0F 0ECB 8E58 1B49 74F4 70D4 0B81 CF2C F858 781F D70F 79EB q=D901 B376 D73A 2163 56D8 3B7B EE02 73F8 9A3F E7FD AC56 F4D9 E072 CECF 85B1 CC1D u=825E FE26 ED64 7E91 6256 A8E8 3DC7 C8E5 0E52 46FE 56B0 B3C9 3559 2C03 BFA1 C06B original coin=0001 FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FF00 3020 300C 0608 2A86 4886 F70D 0205 0500 0410 14C1 A83C 1B84 FCAD 472F 6425 3F74 7C80 blinding fact=005B 52D8 BA8D 6AE9 4652 8C2D 5CBB 4BEB D0C7 80C9 48BC 797A CDEE BDE0 E53D 4329 9E7A 00B3 8FF1 5BA4 E78B 81C8 C99A 9C16 CFA7 33A3 93D0 A5C0 7604 8F85 87D9 4D31 blinded coin=797B A351 2280 62DC 1D02 84F8 1812 52E8 152B A421 D7C8 8CD1 E061 776C 138A 9776 E2D6 5764 AF64 4C21 D589 176D 0FD2 F346 7A45 5EB9 7E1F 964A 189C 55BC FD53 0775 signed coin=9994 B5AF A3A5 7B30 9058 5D76 C531 3EF2 81F6 B973 3805 2673 C8D3 C4A8 051A 4979 7882 F598 BB66 57C8 8104 76BB 06D7 F85D 4AA1 AEF3 18EC A105 C8B2 64D4 96ED 6BE4 final coin=2EF9 8656 2799 3071 692A D693 3EF3 AF4D D296 B6AE E3A3 A283 94B1 242E 43BD 9042 086A CCED 5A0A A4F4 F4A9 C1FE B3D0 5C22 BF60 D14D 717F C188 4701 57E5 C9E1 5A77 Notice that the final coin is gibberish. By running "bug b" it increments the blinding factor by one, then performs the same calculation. >bug b original coin=0001 FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FF00 3020 300C 0608 2A86 4886 F70D 0205 0500 0410 14C1 A83C 1B84 FCAD 472F 6425 3F74 7C80 blinding fact=005B 52D8 BA8D 6AE9 4652 8C2D 5CBB 4BEB D0C7 80C9 48BC 797A CDEE BDE0 E53D 4329 9E7A 00B3 8FF1 5BA4 E78B 81C8 C99A 9C16 CFA7 33A3 93D0 A5C0 7604 8F85 87D9 4D32 blinded coin=7010 DE32 C491 A343 F041 2779 BA9B BEF3 C394 3DAE 2B48 8110 2260 7D18 876A 820F AFB1 9913 6E77 4D95 185E 17F7 2496 7137 8212 5509 B641 D3BD F67A 685A 0A20 8B9B signed coin=2879 A082 C7DE 2BFC C39D 8E21 F245 17B7 96DC 2458 A201 4756 DA93 8D09 23F2 7741 964C 1984 5A15 AC6F 4AD7 50AB CE98 5E12 CDC6 C1F8 5F14 8699 3FB7 036F B439 F39A final coin=0001 FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FF00 3020 300C 0608 2A86 4886 F70D 0205 0500 0410 14C1 A83C 1B84 FCAD 472F 6425 3F74 7C80 The final coin is now correct. By running "bug c" the coin itself is incremented by one, but the blinding factor is not incremented. >bug c original coin=0001 FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FF00 3020 300C 0608 2A86 4886 F70D 0205 0500 0410 14C1 A83C 1B84 FCAD 472F 6425 3F74 7C81 blinding fact=005B 52D8 BA8D 6AE9 4652 8C2D 5CBB 4BEB D0C7 80C9 48BC 797A CDEE BDE0 E53D 4329 9E7A 00B3 8FF1 5BA4 E78B 81C8 C99A 9C16 CFA7 33A3 93D0 A5C0 7604 8F85 87D9 4D31 blinded coin=5F91 E5B7 95F7 C37B 5CE6 F0A3 A7CC A51B 7C0E ED85 2E2D CE1F F8E8 75B0 1559 7945 0CA5 BE69 AD2E A75E 5F4E 1D8E 0704 DA3B 8957 D63C E195 1078 5E75 0F31 7E7C DA68 signed coin=4A0B EA0E C336 DE7E 3BC6 0448 9B4B 6185 9964 91BD 3A5E E424 520D 2AEF BF9A 7FBA 382C 136C 0FA4 9D58 A237 8160 C00C EE76 5817 D39E 92B6 BD6F 05DD 91CE 4C97 CB85 final coin=0001 FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FF00 3020 300C 0608 2A86 4886 F70D 0205 0500 0410 14C1 A83C 1B84 FCAD 472F 6425 3F74 7C81 Again, the final coin is correct. By running "bug r" everything happens as though you just ran "bug". Neither the blinding factor or coin is incremented. But, the program uses the slower mp_modexp instead of mp_modexp_crt to perform the signature. >bug r original coin=0001 FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FF00 3020 300C 0608 2A86 4886 F70D 0205 0500 0410 14C1 A83C 1B84 FCAD 472F 6425 3F74 7C80 blinding fact=005B 52D8 BA8D 6AE9 4652 8C2D 5CBB 4BEB D0C7 80C9 48BC 797A CDEE BDE0 E53D 4329 9E7A 00B3 8FF1 5BA4 E78B 81C8 C99A 9C16 CFA7 33A3 93D0 A5C0 7604 8F85 87D9 4D31 blinded coin=797B A351 2280 62DC 1D02 84F8 1812 52E8 152B A421 D7C8 8CD1 E061 776C 138A 9776 E2D6 5764 AF64 4C21 D589 176D 0FD2 F346 7A45 5EB9 7E1F 964A 189C 55BC FD53 0775 signed coin=6613 B2B0 75FD 398B 30EE C3FD 6A84 9E7D 39D2 738A 387B 4100 CD3F 0DFD C8A7 1D13 7941 0CA7 BE13 1C5E 1E9F 7174 648F 494E B57B 32BA 585E DC04 45DF C40A 468E 32BC final coin=0001 FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FF00 3020 300C 0608 2A86 4886 F70D 0205 0500 0410 14C1 A83C 1B84 FCAD 472F 6425 3F74 7C80 The final answer is right, and the signed coin is different from the signed coin in the first example. That pins down the error to mp_modexp_crt. Maybe I'm missing something, but it appears there are a few values for which this function just does not work right. If you want to try it, here's the program. Pr0duct Cypher =========================== cut 8< here ================================= /* bug.c Strange bug demo - "bug b" increments blinding factor "bug c" increments coin "bug r" uses regular mp_modexp instead of mp_modexp_crt Compile with mpilib and mpiio, define DEBUG for mpiio */ #include <stdio.h> #include <stdlib.h> #include "usuals.h" #include "mpilib.h" #include "mpiio.h" typedef unit unitarr[MAX_UNIT_PRECISION]; /* Multiplicative inverse - used for finding d */ void mp_inv(unitptr x,unitptr a,unitptr n); char e_string[]="0001,0015h"; char d_string[]="\ 4612,D56D,AA0A,B760,3561,60C6,EE7A,5CE8\ A74B,D0C9,501E,D7B1,C145,D654,3B38,E90A\ 6FF4,BC13,221E,E354,345D,B789,38D6,3427\ DA7A,48D6,570C,3860,FC86,0B8F,AB80,FCE5h"; char n_string[]="\ A8DF,1E61,234B,E660,800A,4167,40A9,102D\ FC01,6962,AD6C,BE39,2664,92AE,E8B4,CE3A\ 93EB,F4BE,FFD1,104A,DB81,2F95,684E,C188\ 0901,379C,99BC,5E24,7EC2,660B,1463,139Fh"; char p_string[]="\ C737,3481,985A,B4B3,4E0F,0ECB,8E58,1B49\ 74F4,70D4,0B81,CF2C,F858,781F,D70F,79EBh"; char q_string[]="\ D901,B376,D73A,2163,56D8,3B7B,EE02,73F8\ 9A3F,E7FD,AC56,F4D9,E072,CECF,85B1,CC1Dh"; char u_string[]="\ 825E,FE26,ED64,7E91,6256,A8E8,3DC7,C8E5\ 0E52,46FE,56B0,B3C9,3559,2C03,BFA1,C06Bh"; char original_coin_string[]="\ 0001,FFFF,FFFF,FFFF,FFFF,FFFF,FFFF,FFFF\ FFFF,FFFF,FFFF,FFFF,FFFF,FFFF,FF00,3020\ 300C,0608,2A86,4886,F70D,0205,0500,0410\ 14C1,A83C,1B84,FCAD,472F,6425,3F74,7C80h"; char blinding_factor_string[]="\ 005B,52D8,BA8D,6AE9,4652,8C2D,5CBB,4BEB\ D0C7,80C9,48BC,797A,CDEE,BDE0,E53D,4329\ 9E7A,00B3,8FF1,5BA4,E78B,81C8,C99A,9C16\ CFA7,33A3,93D0,A5C0,7604,8F85,87D9,4D31h"; main(int argc,char *argv[]) { int rflag; unitarr e; unitarr d; unitarr n; unitarr p; unitarr q; unitarr u; unitarr dp; unitarr dq; unitarr original_coin; unitarr blinding_factor; unitarr temp; unitarr blinded_coin; unitarr signed_coin; unitarr unblinded_coin; unitarr final_coin; set_precision(MAX_UNIT_PRECISION); /* Load all the values */ str2reg(original_coin,original_coin_string); str2reg(blinding_factor,blinding_factor_string); str2reg(e,e_string); str2reg(d,d_string); str2reg(n,n_string); str2reg(p,p_string); str2reg(q,q_string); str2reg(u,u_string); /* Increment variable if condition entered */ if(argc==2) { if(*argv[1]=='b'||*argv[1]=='B') mp_inc(blinding_factor); if(*argv[1]=='c'||*argv[1]=='C') mp_inc(original_coin); if(*argv[1]=='r'||*argv[1]=='r') rflag=TRUE; else rflag=FALSE; } /* Display them to check */ mp_display("e=",e); mp_display("n=",n); mp_display("d=",d); mp_display("p=",p); mp_display("q=",q); mp_display("u=",u); printf("\n"); mp_display("original coin=",original_coin); /* Raise the blinding factor to the power e */ mp_modexp(temp,blinding_factor,e,n); /* Blind the coin */ stage_modulus(n); mp_modmult(blinded_coin,original_coin,temp); printf("\n"); mp_display("blinding fact=",blinding_factor); printf("\n"); mp_display(" blinded coin=",blinded_coin); /* Sign the blinded coin */ if(rflag) mp_modexp(signed_coin,blinded_coin,d,n); else { mp_move(temp,p); mp_dec(temp); mp_mod(dp,d,temp); mp_move(temp,q); mp_dec(temp); mp_mod(dq,d,temp); mp_modexp_crt(signed_coin,blinded_coin,p,q,dp,dq,u); } printf("\n"); mp_display(" signed coin=",signed_coin); /* Invert the blinding factor */ mp_inv(temp,blinding_factor,n); /* Unblind the coin */ stage_modulus(n); mp_modmult(unblinded_coin,signed_coin,temp); /* Decrypt the signed coin */ mp_modexp(final_coin,unblinded_coin,e,n); printf("\n"); mp_display(" final coin=",final_coin); return(0); } #define swap(p,q) { unitptr t; t = p; p = q; q = t; } #define iplus1 ( i==2 ? 0 : i+1 ) /* used by Euclid algorithms */ #define iminus1 ( i==0 ? 2 : i-1 ) /* used by Euclid algorithms */ #ifdef OLD_MPINV void mp_inv(unitptr x,unitptr a,unitptr n) /* Euclid's algorithm extended to compute multiplicative inverse. Computes x such that a*x mod n = 1, where 0<a<n */ { /* The variable u is unnecessary for the algorithm, but is included in comments for mathematical clarity. */ short i; /* unit y[MAX_UNIT_PRECISION], temp[MAX_UNIT_PRECISION]; unit gcopies[3][MAX_UNIT_PRECISION], vcopies[3][MAX_UNIT_PRECISION]; #define g(i) ( &(gcopies[i][0]) ) #define v(i) ( &(vcopies[i][0]) ) Major stack space hog! */ unit *y=safemalloc(sizeof(unit)*MAX_UNIT_PRECISION); unit *temp=safemalloc(sizeof(unit)*MAX_UNIT_PRECISION); unit *gcopies[3]; unit *vcopies[3]; for(i=0;i<3;i++) { gcopies[i]=malloc(sizeof(unit)*MAX_UNIT_PRECISION); vcopies[i]=malloc(sizeof(unit)*MAX_UNIT_PRECISION); } #define g(i) gcopies[i] #define v(i) vcopies[i] /* unit ucopies[3][MAX_UNIT_PRECISION]; */ /* #define u(i) ( &(ucopies[i][0]) ) */ mp_move(g(0),n); mp_move(g(1),a); /* mp_init(u(0),1); mp_init(u(1),0); */ mp_init(v(0),0); mp_init(v(1),1); i=1; while (testne(g(i),0)) { /* we know that at this point, g(i) = u(i)*n + v(i)*a */ mp_udiv( g(iplus1), y, g(iminus1), g(i) ); mp_mult(temp,y,v(i)); mp_move(v(iplus1),v(iminus1)); mp_sub(v(iplus1),temp); /* mp_mult(temp,y,u(i)); mp_move(u(iplus1),u(iminus1)); mp_sub(u(iplus1),temp); */ i = iplus1; } mp_move(x,v(iminus1)); if (mp_tstminus(x)) mp_add(x,n); mp_burn(g(iminus1)); /* burn the evidence on the stack...*/ mp_burn(g(iplus1)); mp_burn(v(0)); mp_burn(v(1)); mp_burn(v(2)); mp_burn(y); mp_burn(temp); #undef g #undef v free(y); free(temp); for(i=0;i<3;i++) { free(gcopies[i]); free(vcopies[i]); } } /* mp_inv */ #else /* !OLD_MPINV */ /* Faster mp_inv, based on "Fast Multiplicative Inverse in Modular * Arithmetic", J. Gordon, in Cryptography and Coding, edited by * Henry J. Beker and F.C. Piper, 1989. * The mapping from the variables in that paper to our variables is, * roughly, M->n, X->a, HCF->u(iminus1), U->u(i), temp->u(iplus1), * INV->v(iminus1), V->v(i), temp->v(iplus1). We rotate the assignment * to temp and INV in their 2nd block of code. */ void mp_inv(unitptr x,unitptr a,unitptr n) /* Euclid's algorithm extended to compute multiplicative inverse. Computes x such that a*x mod n = 1, where 0<a<n */ { /* The variable u is unnecessary for the algorithm, but is included in comments for mathematical clarity. */ int shifts; int i; int enterloop; /* unit vcopies[3][MAX_UNIT_PRECISION], ucopies[3][MAX_UNIT_PRECISION]; #define u(i) ( &(ucopies[i][0]) ) #define v(i) ( &(vcopies[i][0]) ) Stack space hog deleted */ unit *ucopies[3]; unit *vcopies[3]; for(i=0;i<3;i++) { ucopies[i]=malloc(sizeof(unit)*MAX_UNIT_PRECISION); vcopies[i]=malloc(sizeof(unit)*MAX_UNIT_PRECISION); } #define u(i) ( ucopies[i] ) #define v(i) ( vcopies[i] ) i = 1; /* Modify this to do one division at the beginning. That makes it faster. mp_move(u(0),n); mp_move(u(1),a); mp_init(v(0),0); mp_init(v(1),1); mp_init(v(2),1); */ mp_move(u(0),a); mp_init(v(0),1); /* Init U to n%a, V to -n/a. */ mp_udiv(u(1), v(1), n, a); mp_neg(v(1)); mp_move(v(2),v(1)); do { enterloop = 0; shifts = -1; if (mp_compare(u(i),u(iminus1)) > 0) /* if U > HCF then */ mp_init(u(iplus1),0); else { enterloop = 1; mp_move(u(iplus1),u(i)); /* temp := U */ while (mp_compare(u(iplus1),u(iminus1)) <= 0) { /* temp<=HCF */ ++shifts; mp_shift_left(u(iplus1)); /* leftshift(temp,1) */ } mp_shift_right_bits(u(iplus1),1); /* rightshift(temp,1) */ } mp_sub(u(iminus1),u(iplus1)); /* temp := HCF - temp */ mp_move(u(iplus1),u(iminus1)); i = iplus1; /* V := tempV, tempV := INV, INV := V, */ /* U := tempU, tempU := HCF, HCF := U; */ /* (All simultaneous) */ if (enterloop) { while (shifts--) mp_shift_left(v(i)); /* leftshift(V,shifts) */ mp_sub(v(iplus1),v(i)); /* temp = temp - V */ } mp_move(v(i),v(iplus1)); /* V := temp */ } while (testne(u(i),0) && mp_compare(u(i),u(iminus1))!=0); mp_move(x,v(iminus1)); if (mp_tstminus(x)) mp_add(x,n); mp_burn(u(0)); /* burn the evidence on the stack...*/ mp_burn(u(1)); mp_burn(u(2)); mp_burn(v(0)); mp_burn(v(1)); mp_burn(v(2)); for(i=0;i<3;i++) { free(ucopies[i]); free(vcopies[i]); } #undef u #undef v } /* mp_inv */ #endif /* !OLD_MPINV */ =========================== cut 8< here ================================= -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLVmP6MGoFIWXVYodAQHBdgP7B9n/nep0Y1hV2ze3GMJoBpZvq0BKfT3y EjLFvk2+z9Y3kRTqsA42lGFV0rcQwgkm588VbE7JmT/b0AvGoOm4Hqp9wEzYMfFz iMy8fVRitUHT2VFryLpzCdRtwPzDkW62yIQUMgWcgpW05Vu+GMEgtgD70CpJbKfb GuIT2jH6Tzc= =UcS4 -----END PGP SIGNATURE-----

2 1

Re: CYPHERPUNK considered harmful.
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 10:43 AM 9/13/95, Peter Trei wrote: > "CYPHERPUNK" considered harmful > > I would like to propose that we, the 'cypherpunks', are making a >strategic error, which will make it far more difficult to achieve the >goal we share. Discussing some goals we might share, or ought to share, is certainly not out-of-line. Indeed, this discussion has come up many times on this list, though perhaps not much in the past year. (Those C coders do seem to be having their way...:-} ). > Our error lies in our approach to encouraging the widespread use of >crypto. It is an error of hubris - overweening pride. I think many people here are doing a lot to encourage wide use of encryption, remailers, etc. They write hooks to popular mail programs, they give public talks, they fight against restrictions and regulations, and they deploy new systems. That some folks have very occasionally mentioned "Joe Sixpack" does not mean that much. in my opinion. > > We too often think of ourselves as an elite - smarter and better in >various ways to our non-cpunk neighbours. We refer to these others as >'Joe Sixpack" and other such derogatary terms. > > The problem is that in doing so we are marginalizing ourselves. > > We call ourselves 'cypherpunks'. While this is derived from the SF >term 'cyberpunk', consider the image we are creating for ourselves: > > A 'punk' is a marginalized young adult, one who rejects the norms >of his or her society, and takes delight in irking those around him with >his or her rejection. The older of us will think of James Dean in 'Rebel >Without a Cause', or Brando in 'The Wild One'. Later, you get images >such as Peter Fonda in 'Easy Rider', and more recently, Sid Vicious and >other icons of the 'punk rock' movement. While I have had some qualms about the name, on balance I think it has been good for us. After all, it's not as if _other_ groups don't already exist! In particular, the British branch of Cypherpunks disliked the name "Cypherpunks" so much that they used a different name for themselves, the "U.K. Crypto Privacy Association." It doesn't seem to exist anymore, for whatever reasons. But the name may have been a factor, at least. Similarly, there's the Libertarian Party, with similar themes to our own, the International Association of Cryptographic Research (or somesuch), and even several nascent groups like "Terra Libre" and "DigitalLiberty" which purport to have a similar focus to what we have. And of course there are _several_ groups devoted specifically to lobbying for various sorts of cyberspatial rights, laws, etc.: EFF, EPIC, CPSR, VTW, and the ACLU. All of these groups have a different focus than we have. If I were to pick one that matches Peter Trei's proposed organization, it would be the EFF. Thus, I suggest Peter and others of like mind look into helping out the EFF in its worthy causes. I mean no disrespect here to Peter's views, nor am I suggesting he leave this list. Plenty of room for support of the EFF and being on this list. I'm a member of the EFF, for example (though their computer has me as "Tim Mat" for some reason). But for some reason--draw your own conclusions--the Cypherpunks list has a membership of something like 600-800 subscribers, more if you count folks who subscribed for a while, or who read it in other places. I don't think "Terra Libre" or "DigitalLiberty" are quite as successful and visible. We fill a certain niche which is useful to have filled, a more radical facet of things. If we didn't exist, or renamed ourselves "Concerned Citizens for Cryptographic Protection," CCCP, then somebody would have to _invent_ the Cypherpunks! I addressed the issue of our name, pluses and minuses, in an early chapter of my Cyphernomicon (http://www.oberlin.edu/~brchkind/cyphernomicon/) 2.4.10. "Where did the name 'Cypherpunks' come from?" + Jude Milhon, aka St. Jude, then an editor at "Mondo 2000," was at the earliest meetings...she quipped "You guys are just a bunch of cypherpunks." The name was adopted immediately. - The 'cyberpunk' genre of science fiction often deals with issues of cyberspace and computer security ("ice"), so the link is natural. A point of confusion is that cyberpunks are popularly thought of as, well, as "punks," while many Cyberpunks are frequently libertarians and anarchists of various stripes. In my view, the two are not in conflict. - Some, however, would prefer a more staid name. The U.K. branch calls itself the "U.K. Crypto Privacy Association." <check this> However, the advantages of the name are clear. For one thing, many people are bored by staid names. For another, it gets us noticed by journalists and others. - - We are actually not very "punkish" at all. About as punkish as most of our cyberpunk cousins are, which is to say, not very. + the name - Crypto Cabal (this before the sci.crypt FAQ folks appeared, I think), Crypto Liberation Front, other names - not everybody likes the name...such is life -------- Getting back to your suggestion that "we" change the name to something more respectable. How could "we" do this, given that "we" are an effective anarchy? I can't imagine a vote on this, and the endless debates on what "we" ought to call ourselves would be a waste of time. Fortunately, there's an elegant solution: form your own group. Form your own group, your own mailing list, with a catchy name, something like "The Privacy Education Foundation," or "The American Civil Liberties Union" (whoops, taken), or "The Society for the Preservation of Cyberspatial Liberty." Then announce it on our list, and elsewhere. People will vote with their feet. If your "meme" is catching, your list will rapidly gain members. Maybe this Cypherpunks list will even atrophy away. Evolution in action. The market in action. A better approach than trying to get the name and the charter changed. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Unknown address
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

Hi! Could you tell me why I receive this message?!? I *never* sent anything to your place... What is it that is wrong? The cypherpunks remailer? Your site? (how?) ========== original e-mail from you ================ >From warehouse.mn.org!postmaster(a)kksys.com Mon Feb 12 04:06:24 1996 Return-Path: <warehouse.mn.org!postmaster(a)kksys.com> From: postmaster(a)warehouse.mn.org (Postmaster) Subject: Unknown address Date: Sun, 11 Feb 1996 22:19:49 GMT Organization: The Warehouse BBS To: jf_avon(a)citenet.net ) >The user this message was addressed to does not exist at this site. Please >verify the name and domain in the original message that follows. >Message was addressed to: SAMUEL.KAPLIN(a)warehouse.mn.org > > ----- Original Message follows ----- > >From: jf_avon(a)citenet.net (Jean-Francois Avon (JFA Technologies, QC, Canada)) >To: cypherpunks(a)toad.com >Date: Sun, 11 Feb 1996 23:41:06 -0500 >Subject: Re: "Rights" > >Ed.Carp(a)linux.org, ecarp(a)netcom.com wrote: <various blah blah from me snipped> ========= end original message from you ================ **** NEW PGP 2.6.2 KEY ********* 2048 bits Key ID:24201BA1 1996/02/13 Jean-Francois Avon <jf_avon(a)citenet.net> Key fingerprint = 23 B6 24 31 86 67 FB 35 C7 A7 AF 12 A1 61 E9 3D **** OLD KEY: DO NOT USE ANYMORE UNLESS FOR VERIFYING SIGNATURES **** 1024 bits Key ID:57214AED 1995/10/04 Jean-Francois Avon <jf_avon(a)citenet.net> Key fingerprint = 84 96 76 AE EB 7C AB 15 88 47 87 B0 18 31 74 9F

6 6

Meeting Logs
by Robert A. Hayden 17 Dec '03

17 Dec '03

If anyone is interested, I do have some logs from tonights Cypherpunks virtual meeting. It's not a perfectly clear file, as it has lots of help requests in it (I don't know MOO too well, but the substance is still there. If you want it, just drop me a line and I'll get it right off to you. It is about 90k big. ____ Robert A. Hayden <=> hayden(a)krypton.mankato.msus.edu \ /__ -=-=-=-=- <=> -=-=-=-=- \/ / Finger for Geek Code Info <=> In the United States, they \/ Finger for PGP 2.3a Public Key <=> first came for us in Colorado... -=-=-=-=-=-=-=- (GEEK CODE 1.0.1) GAT d- -p+(---) c++(++++) l++ u++ e+/* m++(*)@ s-/++ n-(---) h+(*) f+ g+ w++ t++ r++ y+(*)

1 0