- cypherpunks-legacy - lists.cpunks.org

Re: NetScape's dependence upon RSA down for the count!
by jbass＠dmsd.com 17 Dec '03

17 Dec '03

and yes I'll accept server hacks which run's on linux and bsd too :) John

1 0

The 4th Estate
by Tim Philp 17 Dec '03

17 Dec '03

I am a freelance journalist who has been 'lurking' on your list for about six months now. I have a great interest in cryptography and the mathematics behind cyphers. I write a weekly column about computers and the Internet in a small town newspaper in Brantford Ontario. I was particularly interested in the SSL crack that took place recently and I wrote an article about the feat and talked about some of the implications of this use of the Internet. In previous articles I have spoken about the need for widespread, strong, cryptography to both protect personal privacy and to aid secure business communications. I have been following the debate about a Cypherpunk spokesperson with some interest and I thought that I would throw in my two cents worth (2.5 cents Canadian! :-}) It is always difficult to get a group of strong individualists to agree to a common cause or to allow one person to become a spokesman for the group. Such a position grants a certain amount of 'power', for lack of a better word, to such a person. I think that there is no need for such a person. Each of us has a different point of view that, while sharing some common ideas, cannot be reconciled with any 'official' position. I think that the accomplishments of the group speak volumes and have no fear, the public is listening. I do, however, detect some small amount of smugness attached to comments about 'Joe Sixpack'. While it is true that the average citizen is not interested in esoteric subjects such as cryptography, do not underestimate the importance of communicating with them. Their votes and elected representatives will control the future legislation regarding cryptography. It is vital that they understand just what is at stake in this debate, and that they make decisions based upon knowledge and not upon fear. Therefore, it is important that we ALL do our share of communicating with the press and the public. Without our input, the scaremongerers will carry the day. In the meantime, keep up the good work. If anyone wants copies of the articles that appeared in the paper, E-mail me and I will send them. If there is enough demand I will post them to the list. Don't worry, they are only about 700 words each. Regards, Tim Philp Brantford, Ontario Canada -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCNAy/KL1MAAAEEALIrcJLNr3LTauphCzkU1SNtZkUPCEH14xIxVaiSM/7850/y 6qkA17N0/4E20RiyQIZ7TZf2vpbaTHs88+jU4Lvb/fBWBnL1AZBdW7I1+vNSMGzG ljBzU9X+BXrBFYi4CzpWhqOo+a2IQaJx4sZ7w/GG59gdFIyps3seeMISF+fVAAUR tCBUaW0gUGhpbHAgPGJwbGliQG5pYy5ob29rdXAubmV0Pg== =6Rrp -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: my favorite random-numbers-in-software package (unix)
by David K. Merriman 17 Dec '03

17 Dec '03

At 03:46 PM 9/30/95 -0400, you wrote: ... <deletia> ... >The basic idea is that you exploit randomness in the drift between >the processor clock and the rate at which interval timer interrupts >occur. Such drift occurs even on idle processors. randbyte() assumes >that there's at least about .4 bits of "entropy" per interrupt, which is >(probably) a safe assumption on modern processors. Randomness introduced >by the OS (scheduler, etc.) can add to the overall entropy, but shouldn't >be relied upon by itself. > >An advantage to this approach (using clock skew) is that the randomness >doesn't depend on external events like user input, network traffic or >processor load. That makes it especially attractive for generating keys >on unattended servers, e.g., for generating Diffie-Hellman exponents. >Note, however, that very (very) slow and heavily-loaded processors may >not provide enough cycles to the truerand process between interrupts for >these assumptions to hold. Also, all bets are off on processors that use >a single clock source for both interval timing and CPU clocking. Even with the exclusion of processors using single-source clocking for interval and CPU timing, this would *seem* to be somewhat hazardous. Any two clocking mechanisms that are 'mixed' are going to result in a number of harmonics, or beat frequencies. While your system - at any given instant - is quite likely to have a decent amount of randomness in it, I'd hazard a guess that repetitive use would result in a discernible pattern. Even something as 'coarse' as an interrupt timer has a finite range that it can (must) operate in. Even if the CPU oscillator is based on a ceramic resonator (nowhere near as stable/accurate as a crystal), the clock on it is going to stay within +/-1% (worst case, for a *really* cheap oscillator) of frequency, and drift not more than some number of Parts Per Million per Period. Mixing the innate (relative) accuracy of two oscillators, and the necessarily limited amount of drift that they're capable of, would seem to result in an unacceptably low-yield source of 'real' randomness. Of course, I'm kind of math-impaired when it comes to crypto, so my 20+ years of electronics (hardware) experience may not apply in this case :-) Dave Merriman This is a test (3 UUE lines) of the unconstitutional ITAR - 1/713th of the PGP executable. See below for getting YOUR chunk! ------------------ PGP.ZIP Part [015/713] ------------------- M=$<(&L`#*IPP",(G6(,,S,`P](<2RWU96XCW86/JBYV8A\D8@X'HB_9H#&\X MX'PCUB.,13B"X8`R?^J-:UB.M_`U\>[#)BS&5$0C,Y#^1CS>1`\T1QTXX6!3 M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/ <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geopages.com/CapitolHill/1148

2 1

Auto-signing
by gmixo＠alpha.c2.org 17 Dec '03

17 Dec '03

would someone please send me information about any autosigning services.... like the gratis auto-signing.... and others like it.... thanks gmixo

2 1

Re: Simple Hardware RNG Idea
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:57 PM 9/30/95, zinc wrote: >regarding the use of radioactive material for generating random >numbers, lantern mantles are fairly radioactive. i'd say they would >be able to emit sufficient particles for OTP use, especially if one >builds a device that just constructs the pads all the time (ie, it >just sits there making various pads of X min length and Y max length, >storing them on a hard drive, or RAM if you're that rich). you just >request a pad from the machine when you need it and encrypt whatever >with it... Thorianated lantern mantles are only slightly radioactive. The counts per second is what matters. This will be a function of a lot of things, not the least of which is the detector area and the fluence of alphas intercepted. At the risk of repeating myself, there are easier ways of generating essentially random numbers. --Tim May (P.S., as my last word on this for a while. You may have heard that RAM chips can have bits flipped by the alpha particles emitted by low levels of uranium and thorium present in packaging materials. And that cosmic rays can do the same thing, at a lower error rate. Well, I discovered these effects in 1977 and wrote the original papers on this "soft error" effect. I'm not making an appeal to authority here, just telling you why I'm skeptical of all of these proposals to make a radioactive decay-based random number source. There are much easier ways.) ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

3 3

Java idea
by Mike Fletcher 17 Dec '03

17 Dec '03

Well, security bugs aside (and I've got the sun4.1.3_u1 and Win32 ns2b distributions :) has anyone given any thought to using Java to do some sort of Chinese Lottery attack. I was re-reading App. Crypto. last night and it could be feasable. If you could get your key cruncher thread loaded into a good many browsers to run when idle . . . . How many estimated copies of NS are there? Anyone want to do the math? :) --- Fletch __`'/| fletch(a)ain.bls.com "Lisa, in this house we obey the \ o.O' ______ 404 713-0414(w) Laws of Thermodynamics!" H. Simpson =(___)= -| Ack. | 404 315-7264(h) PGP Print: 8D8736A8FC59B2E6 8E675B341E378E43 U ------

2 1

Re: NetScape's dependence upon RSA down for the count!
by Don.Stephenson＠Eng.Sun.COM 17 Dec '03

17 Dec '03

Yes, but the certificate that contains the public key of the server is digital signed by the certificate authority (CA). To create such a certificate requires the secret key of the CA. The public key of the CA is contained in the client software, which uses it to verify the validity of the server certificate. - Don > From jbass(a)dmsd.com Sat Sep 30 17:15:36 1995 > Date: Sat, 30 Sep 95 16:50:05 -0600 > From: jbass(a)dmsd.com (John L. Bass) > To: www-security(a)ns2.rutgers.edu, cypherpunks(a)toad.com > Subject: Re: NetScape's dependence upon RSA down for the count! > > > Ok ... one more time ... the filter has to replace the client/server > keys in the packet stream with it's own ... > > John > >

1 0

Simple hardware RNGs
by John A. Thomas 17 Dec '03

17 Dec '03

Having built devices for generating random data, I can tell you the problem is more difficult than it appears. The problem is removing biases and correlations from the process. A good place to start is Murry, Herschell, "A General Approach for Generating natural Random Variables", IEEE Transactions on Computers, December 1970, p. 1210-1213. --------------------------------------------------------------------- John A. Thomas | (214) 263-4351 | jathomas(a)netcom.com Bowles & Thomas, L.L.P. | Voice | CompuServe 75236,3536 410 N.W Eleventh St. | (214) 262-6520 | Grand Prairie, Tx 75050 | Fax | PGP public key available ---------------------------------------------------------------------

1 0

Digests No Longer Available
by skaplin＠skypoint.com 17 Dec '03

17 Dec '03

Due to some personal issues, I am being forced to cut back my net involvement. Cypherpunks and its digests are a causality of this. Effective immediately I will no longer be keeping digests of the list. Hopefully in a few months I'll be back. Sam

1 0

T-shirt on French TV
by Rich Salz 17 Dec '03

17 Dec '03

Timing is everything... I happened to be flipping the channels while on the TV in my hotel room Friday evening between 8 and 8:30 when I saw someone wearing the UK crypto shirt on a talk show on French TV3. I know no French. A guy was standing up wearing the shirt, turning around, holding it out for the camera, etc. Someone sitting down was talking about it to the moderator -- I heard words like cryptographique a few times. When the speaker pointed to the "may be illegal in France" part, the guy took the shirt off and the crowd laughed. The segment was about 10 minutes. /r$

1 0