- cypherpunks-legacy - lists.cpunks.org

bulk RC4 brute forcing
by lyalc＠ozemail.com.au 17 Dec '03

17 Dec '03

Some time ago, I wrote about testing multiple plain/cipher pairs against a key as a possible speed up for brute forcing 40 bit RC4 key cracking. I have finally done something about it, written some code, and run tests which I believe gives a about 6-8 times improvement over single key/plain/cipher testing against RC4-40 encryption. Basically: A single RC4 master "key schedule" is generated. This is copied to an master array of 126 RC4_keys (126 chosen due to segment boundary probs). Then each of 126 plain/cipher (P/C) pairs are tested for a match. Acquiring the plain/cipher pairs in real life is another question. If a match is found, the pair is marked 'found', and testing continues on the remaining unfound P/C pairs. This loops until all 126 plain/cipher/keys have been tested and found. 8 plaintext, 8 cipher bytes are used. Keys are 8 bytes, the last 5 of which are variable (40 bits). Test results : A test set of data was created by incrementing a key byte, and making a P/C pair. Then all keys bytes are set to 0, and testing commenced. Typically, a 486/33 with the above in 'C' code running on DOS achieves about 15000 tests per second. One extended test ran about 480 million tests in 7.5 hours and found 68% of the keys - approx 17,700/sec, averaging 5.6 million tests per found key. My reasoning follows thus: For 126 plain/cipher pairs, with "randomly" generated keys, one valid key/plain/cipher pairs 'should' be located in 2^33 key tries (126 is approx. 2^7) 15000 tests/sec across 126 P/C pairs is about 119 keys/second tested. at 119/second, 2^33 key tests will take 835 days. This should "guarantee" a key match is found. By contrast: The "bruterc4.c" code used by this forum earlier showed approximately 2200 key tests per second on my machine. Testing 2^40 keys at 2200/sec will take 5784 days to guarantee a key match (using 2^39, 2892 days). This is a 6.9(3.46) ratio, that finds a single key match. Finding all 126 keyswould should take approximately 293 years in "bulk" mode, or 1996 years in single mode (126x5784 days). The code is available, and will be posted here is desired (it is messy). Ideally, faster key/plain/cipher testing could be accomplished if a larger array of keys could be used. The Intel segment problem has prevented me for making larger arrays - I don't know how to turn these features in my compiler (yes - I am a beginner at coding, but the "huge" directive in Borland C did not seem to work, and I don't know why - yet). Tests on 31, 63 and 126 P/C pairs showed results of 10689, 13326 and 15689 tests/sec, respectively. This indicates array size has a direct relationship with test/sec. I invite others who can better manipulate statistics, or better exeprienced, to comment, refute, or otherwise contribute to this. lyal All mistakes in this message belong to me - you should not use them!

2 1

Radikal: raid in the netherlands
by tank 17 Dec '03

17 Dec '03

PRESS-DECLARATION 14-12-96 After the German authorities tried to force their censorship on people's thoughts and writings worldwide on the Internet, Germany now tries to prosecute a person who lives in the Netherlands for the making of the left-wing newspaper Radikal. In the morning of the 11th of December there was a houseraid in the village of Vaals (The Netherlands). In the raid ten local police-officers, a high officer from the Maastricht-court, two LKA (Landes Kriminal Ambt) German officers and two BKA (Bundes Kriminal Ambt) German officers took place. The 16 German and Dutch officers forced themselves into the house with the help of a lock specialist. The only person at home during the raid only noticed it after some time when the room next to her was already being searched. The german and dutch police refuged to explain the reason for this raid. German autorities refered to the dutch ones for explanations and the other way around. It was only after insisting that they explained the search warrant came from the german authorities in Karlsruhe. During the two hour raid two personal computers, floppy-discs, foto's, a pamflet and some Radikal stickers were seized. During this whole operation it was not clear against who or what this action was aimed and why this house was searched. It only became clear after the raid when another person came home from his work and phoned his mother in Aachen (Germany). At his mothers house there was also a house raid going on, nothing was taken there. At this house-raid six LKA officers took part and in a paper they declaired to have reasons for this raid because of evidence found in the raid in Vaals. "During the raid at the suspect's house evidence was found (...) that show the suspect (...) is using the house of his mother as well". This evidence consisted of his mother's car papers. The declaration paper alsow showed the purpose of the raid: " The search for Radikal publications, subscribers lists and financial information". The suspect is being charged with the making and distributing of the left wing newspaper Radikal. A newspaper that is forbidden only in Germany . The supposed involvement with a political magazine, forbidden in Germany, apparently is enough for the Dutch authorities to work for the German juridical apparatus. This means that the German idea of law and order concerning magazines leads to the joint persecution of a Spanish citizen living in the Netherlands. Although the magazine is entirely legal in the Netherlands. The dimension of the German-Dutch cooperation within the framework of the new "European Security Policy" is shown here in a very clear way. It shows that an attempt is made to completely redefine the persecution, across all borders, of politically unwanted people. Solidaritygroup Political Prisoners P/o box 3762 1001 AN Amsterdam The Nertherlands <tank(a)xs4all.nl>

1 0

Re: FW: websurfer 4.6 (fwd)
by James A. Donald 17 Dec '03

17 Dec '03

At 11:56 AM 12/2/95 -0500, Michael Froomkin wrote: >so much for compatibility....guess I'm sticking with netscape for now. Websurfer is intolerably buggy. The latest Mosaic seems pretty good to me. > --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: your mail
by James A. Donald 17 Dec '03

17 Dec '03

>At 11:32 PM 12/2/95 -0800, sameer wrote: > I hate to repeat myself, but sometimes people don't listen. >http://www.c2.org/apachessl/ > This Web page fails to explain what Apache-SSL actually is, what it is good for, and why people should use it. Looks like the page was constructed by the same marketing experts as Central Point Software employed before it went under. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

SURVEY SHOWS COUNTIES ARE BEHIND ON Y2K FIX
by DOOM Anonymous Untraceable User 17 Dec '03

17 Dec '03

A survey by the National Association of Counties shows that one-third of the nation's counties aren't even aware of the Y2K problem -- and about 75% of the 119 counties with populations below 10,000 haven't developed a plan for updating their computer systems to deal with the millennial data change. Total Y2K spending among counties is expected to reach $1.7 billion, according to the association. (Information Week 14 Dec 98) #!/usr/local/bin/perl -0777-- -export-a-crypto-system-sig -RC4-3-lines-PERL @k=unpack('C*',pack('H*',shift));for(@t=@s=0..255){$y=($k[$_%@k]+$s[$x=$_ ]+$y)%256;&S}$x=$y=0;for(unpack('C*',<>)){$x++;$y=($s[$x%=256]+$y)%256; &S;print pack(C,$_^=$s[($s[$x]+$s[$y])%256])}sub S{@s[$x,$y]=@s[$y,$x]}

1 0

Globally legal Netscape
by fc＠all.net 17 Dec '03

17 Dec '03

If Netscape wants a global product that is completely legal anywhere, all they have to do is eliminate all encryption. The deal they are cutting now is to claim that they provied privacy when they do not. The saddest part is that many people will believe they are secure: -> the credit card companies and ecash banks will charge interest on every transaction to pay for the fraud rates, -> the government will close its grip even tighter on individual freedom and get an even tighter stranglehold on free speech, -> politicians and right wing demogogues will begin to expose individuals for having abortions and reading smut and thinking the "wrong" way. I'm not asking you to believe this - only to look at history and see the parallels throughout time. - The Russian revolution resulted in purges killing hundreds of thousands of innocent people because of their private, turned public, views as expoused in their private writings. - The Soviet government took away personal privacy to keep their stranglehold on their people. - The Chinese government used cameras and other similar privacy-removing techniques to track down the peaceful protesters who stood for free speech in Tien-a-men square. - The Germans under Hitler used personal records to identify and murder millions of Jews and other peoples. These are just four examples of selected from this century! There are many more in each century. Personal privacy - freedom from unreasonable search and seizure - the right to bear arms - all of these tell me that the US constitution secures the ability of Americans to have secure personal encryption in the information age. The president of the United States, each member of congress, and each CIA and NSA and FBI agent swears to God that they will protect and defend these rights as a condition of taking their offices. Those that fail to support the constitution in this way should be tried as traitors. But instead, we see these people coercing Netscape into breaking the law on their behalf. Breaking the law by cooperating with the government in illegal search and seizure, breaking the law in preventing Americans from attaining privacy, and breaking the law by defrauding the public with false claims of privacy protection. This is the time for Netscape to prove itself to the public by taking a stand for the Constitution, for the law of the land, and for the people of the United Stated and the world. If Jeff the Netscape munitions expert sees this, I hope he forwards it to his boss, and I hope his boss considers seriously that he may be the instrument of a totalitarian state arising in the US and throughout the world. It's easy to say that you're not responsible and that it's the government's fault, and that you're just following orders. But there is an old saying - evil flourishes when good people do nothing. If money is what you worship, you can get it by standing on the dead bones of your fellow human beings. Hitler did it, it was done in the Russian revolution, it was done in the Soviet Union, it was done in China, and it will be done again and again, as long as the Netscapes of the world fail to make a stand when it counts. -> See: Info-Sec Heaven at URL http://all.net/ Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

4 4

RE: Do the Right Thing
by Pat Farrell 17 Dec '03

17 Dec '03

I personally believe that this topic does not deserve the heat that it has generated on this list. This opinion could change. I'll have a much better idea Tuesday evening when I've had a chance to hear the latest from NIST on GAK for export. Much of the complaining in September was that vendors didn't want to build two versions, one domestic and one for "export" Netscape is currently doing at least two, and probably closer to ten if you count Windows 16, 32, Mac, Motif, etc. tcmay(a)got.net (Timothy C. May) writes: > Netscape, being the dominant browser company, and Microsoft, being the > dominant OS company, are in special positions to "build in Big Brother." > I'm not claiming they are, just that they are clearly in a position to > make it technologically more feasible to make non-GAK illegal. They both > need to carefully think about the role that's been "given" to them > (whether by fortune, hard work, or being in the right place at the right > time) and do what's right. Except for Louis Freeh and Dorrthy Denning, I haven't heard real people support GAK domestically, although Geoff Grevildinger's pitch at the Sept NIST meeting was 99 & 44/100% domestic. I'll be listening pretty carefully this Tuesday. I think we need to save out fury for real statements about making non-GAK illegal for domestic use. If this starts to condense out of the Ether, I expect that the civil liberties lobbies will get real loud. the ACLU and VTW were both vocal at the September meeting, and EPIC was there, along with folks like Proffessor Hoffman of GW. > And what Netscape agrees to put in future releases of its browsers or its > servers could have dramatic effects on the whole climate. I have no problem with Netscape having a GAK-ified browser in addition to a real one. At least as long as the GAK'd version is clearly identified -- a logo saying "big brother inside" covering 25% of the screen should do it for me. > And if export laws demand GAK in exported products, Netscape should "do > the right thing" and have two versions. It may add to their costs a > little, but it's better than building in the machinery for a GAK law to > later be passed. Netscape is currently doing two (or ten) version. This simple fact seems to have been lost by most of the posters in the past few days. If the issue is just that people don't like the idea that the free, downloadable is GAK'd and that they have to pay $50 for a browser with strong crypto, please take your whining off list. Or find one you like (Netmanage's is too buggy for me, but Mosaic version 2 is quite usable, as is Microsoft's, IMHO) > (Explain something to me. I have never, ever understood why it is a > concern of the U.S. government that we help build in GAK for foreign > governments, that we make sure that products intended for export to > France or Syria have GAK that allows those governments to read the > traffic of their citizens. And if the concern is that exported versions > of software must be readable to the _United States_, then this is a > non-starter in terms of sales in many or even most foreign countries! I'm > sure France will welcome with open arms a version of Netscape that allows > the NSA to read the traffic of French citizens. Oh, by the way, what > legal jurisdictions will be involved in obtaining the escrowed keys of > foreigners? The answers are both clear and murky, if you catch my drift.) The "criteria" (see my http://www.isse.gmu.edu/~pfarrell/nistmeeting.html page) clearly say that approved systems can _not_ interoperate with unapproved systems. This means that exportable systems can not interoperate with, say, PGP. There was talk about having multinational treaties so the French, Iranian, and other "friends" could access the GAK's messages, but that was recognized as being many years out. Diplomacy is slow. It was quite clear from multinational vendors that they thought that non-US corporations would _absolutely not_ accept GAK in the US. The main effect of this stupid export stuff is to drive crypto development offshore. > If the U.S. insists on GAK _within the U.S._, as many of us fear is the > long-term danger, then all bets are off anyway. But I would hope that > Netscape does nothing to make it _easier_ to make this the case! It was quite clearly implied at the September meetings that the Government expected that vendors would do only one version, GAK'd. This would allow the LEAs to tromple all over US civil liberties at will. > A viable thing for Netscape to do is to announce forthrightly that it will > separate the issue of export from what it sells in the U.S., that there > will be NO GAK included in any U.S.-sold packages. The quest for an "all > world" version, freely exportable, should not take precedence over the > civil liberties issues. And I predict that any slight losses in market > share or slight increases in product cost will be _less_ than the effects > Netscape will see if their product comes to be associated with "Big > Brother Inside." I've been developing software too long to accept that the increases in product support costs will be "slight". But I agree that Netscape should _continue_ to have three separate versions, one for domestic use, a second one for export from the US, and the third with Fortessa for sale to Govie agancies that want it. They probably need to add a fourth version, a strong foreign version developed offshore. Tim's suggestion of a formal statement that separates domestic product from export, and clearly leaves GAK out of US products, is a very good one. It is close to what Netscape is doing now, it is completely consistant with current and publically announced policies, and it would let this list return to discussions that are relevant to cryptography. Pat Pat Farrell Grad Student http://www.isse.gmu.edu/students/pfarrell Info. Systems & Software Engineering, George Mason University, Fairfax, VA PGP key available on homepage #include <standard.disclaimer>

2 1

FW: SEC Rule Announcement
by Trei, Peter 17 Dec '03

17 Dec '03

[sorry if you get this twice - pt] I have not been able to confirm the claim in this letter - the EMA does not seem to have a web site. Note that it refers to employers monitoring employee's HOME computers. Peter Trei > -----Original Message----- > From: Larry Layten [SMTP:larry@ljl.com] > Sent: Wednesday, February 04, 1998 11:04 AM > To: cryptography(a)c2.net > Subject: SEC Rule Announcement > > I received information in an Electronic Mail Association (EMA) > bulletin that said the Securities and Exchange Commission > approved a rule that would go into effect February 15th that > requires securities employers to have the ability to monitor > electronic communications between employees and customers > on employees' home computers or through third party systems. > > Does anyone have any more information on this and how it > might apply to encrypted email? > > Larry

2 1

info?
by j.miranda3＠genie.com 17 Dec '03

17 Dec '03

Can you send me information about your organization? --Joseph Miranda

1 0

Re: GAK, Netscape, CyberDog, and you.
by Ed Carp 17 Dec '03

17 Dec '03

> Date: Fri, 1 Dec 1995 11:58:26 -0500 > To: semper.fi(a)solutions.apple.com > From: rah(a)shipwright.com (Robert Hettinga) > Subject: GAK, Netscape, CyberDog, and you. > Cc: cypherpunks(a)toad.com, mcip(a)deepeddy.com, www-buyinfo(a)allegra.att.com, > ecm(a)ai.mit.edu, bsdc(a)ai.mit.edu > I hear that with CyberDog, building a secure Netscape-compatible browser in > OpenDoc is now pretty simple. That adding economically useful -- and Where can one get more information on CyberDog?

1 0