- cypherpunks-legacy - lists.cpunks.org

Re: Are "they" really the enemy?
by jdd＠aiki.demon.co.uk 17 Dec '03

17 Dec '03

In message <9408160310.AA13160(a)phoenix.aps.muohio.edu> Shalder Flow writes: > > What I said was : "to work with a system, you need to understand it > > objectively". [snip snip] > > I've been watching this for a bit (I lurk here a lot) and this discussion > is really interesting. I have some questions. How are we going to > understand the system objectively? By objectively do you mean logically, > mechanistically, magically? To understand something you must become somewhat dispassionate about it. Otherwise your observations are warped and you simply do not see what does not agree with your preconceptions. > Its clear you can't seperate yourself from > "the system," even the "government system" as a member of this country. Well, in some sense this is true, and the universe is one, and so on and so forth. But actually all of us observe systems in operation every day. For example, the police force in your city is a distinct little system. If you do not believe this, go out and buy yourself a uniform, a gun, etc, and walk around the town for a while. You will find that the police will disagree with your simplistic theory and will arrest you. > Sure, you can not vote, not participate, and try to observe it, but we're > all part of those average americans that you point out make up the > government. (a) It is not necessary to withdraw from participation in order to observe; it is only necessary to be dispassionate, specifically in regard to your explanations or theories about things. In fact, participation will probably make you a better observer. (b) My comments about average Americans are somewhat more guarded than what you say I say. My point was that in trying to understand the government it is best to start from the elementary observation that it is staffed by a more or less random selection of Americans, not devils incarnate. If you look more closely, you will find that certain types tend to concentrate in certain departments, and then again experience causes some to become alienated from the population at large. > > > In _Systemantics_, John Gall conducts a very interesting examination of > > > man-made systems and their behavior. He notes that all man-made systems > > > exhibit certain traits, among them growth, encroachment and promulgation > > > of intra-system goals. Your observation on the people employed by > > > government may be right on target, but it doesn't take into account the > > > entity of government itself. This entity cannot be touched, > > > communicated with or coerced. The last sentence has a certain noble silliness about it. A mob is a man-made system. It often grows, encroaches, and promulgates its own goals. Yes. But all of us know that it can touch and be touched, it can be communicated with (ask any demagogue), and coerced (read Napoleon's remarks on the utility of grapeshot in coercing mobs). > I'll have to check out this book-- it sounds very interesting. I'm > bothered by the statement "all man-made systems." I find it hard to > believe that such generalizations can be made. Is it all man made > systems of a certain size? Of Western philosophical culture? Does my > family exhibit these traits? My circle of friends? I must read this > book myself to fully understand you point. > > > I more or less agree. Now apply your arguments to this list as a > > man-made system. > > OK, I should have read along a bit farther. > > > > Put another way, even though every person within the system may be a > > > "good man", the system itself isn't necessarily good. > > > > I agree. But recall that I never spoke of goodness; I just said that > > the people who work for the government are pretty much a random > > assortment of Americans. On the other hand, there have been several > > heated statements to the effect that 'all lawyers are X' and 'all > > government employees are Y'. It is this that I disagree with the most. > > Makes sense... you dislike generalizations based on occupation. Not really. What really bothers me is generalizations that are based on nothing and/or generalizations that the generalizer is unwilling to defend. I _like_ generalizations, whether based on occupation or anything else, that are accurate. And I was trained in the scientific method, which means first you take a good look at the real world, then you make up theories, then everyone has a good time poking holes in them, then you do it all over again. > So what do we do? It seems we've pretty much agreed that governments are > beasts beyond anyone's control, but so is _society_. So is the entire > human population. Personally, I find these statements very disturbing, because they are so empty. The 'beast beyond control' is your image in the mirror. The government that you are so concerned about controlling is staffed by people like you and me. They look in _their_ mirrors and they feel threatened too and they want to control what they see too. > Where do we start? If, or based on the words of many > on this list, we tear down the government, will we understand the > resultant human-made system any better? You won't tear down the government without replacing it. And I would argue that the more violent the means used to tear down the government, the more repressive its successor. Governments exist in part because we are such dangerous animals. -- Jim Dixon

2 1

Re: CIA Using Remailer System?
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 1:46 PM 8/18/94 -0500, Paul Ferguson wrote: >That's patently false -- we're located in Herndon, Virginia, right >across the street from Dulles Airport and a hop, skip & jump down >the street from the new NRO office. ,-) Hi. I interested in talking to a marketing person at Sprint. I want "secure" ;-) high bandwidth internet access for an internet access service a client wants to start up. Can you just forward this to someone you know? Thanks! Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

NSA Spy Machine and DES
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

It is a fun game to contemplate the powers of the machine that Cray Research is creating for the NSA. Early reports note that it will have 512,000 SIMD processors. The proceedings of Crypto 92 contains a paper I wrote describing a slightly strange design for a DES cracking machine that used "off-the-shelf" associative memory chips built by Coherent Research Inc in Syracuse, NY. (Incidentally, the chips still aren't "on-the-shelf" yet.) Each line in the chip had 42 bits and a really, really dumb processor. That meant you could get 1024 processors on a chip. They weren't packed very densely and I'm sure it would be possible to get 16k or maybe even 64k processors on the chip today. The processors are really dumb. They take 57126 cycles to encrypt one 64 bit block of data with a 56 bit key using standard DES. At 50 Mhz, it took 1 million chips to search the entire DES keyspace in one day. That was 1 billion processors running at once. I calculated at the time that this would cost $30 million in the 92 paper. I've revised this and I think it is eminently possible to get it for about $2 million if you bargain with the fabrication plants. This is, though, just a guess. It was also possible to estimate how long it would take to crack UNIX passwords. A 2 million processor machine could knock off all 7 character passwords composed of alphanumeric characters (A-Z, a-z, 0-9) in one day. Given that the processors I used are probably as dumb as could ever be invented, I think it is fair to say that 7 character passwords could be cracked by this new Cray in four days. Also, DES could be cracked in 2000 days using this machine and a very brute force approach. But let's give the NSA/SRC some credit. These new SIMD processors are probably smarter. Let's say that they're 64 bit wide RISC machines which can only access their own local on chip memory. If they can run 2 times faster (100 MHz) and do DES encryption in 1000 cycles, then this means that the brute force attack on DES could be done in 4 days. Bam. Is it fair to do DES in 1000 cycles? There are 16 rounds and each round consists of passing a value through an S Box and adding it in with a key and part of the result. The most time consuming part is computing the sbox result. There are 8 sboxes in play that operate on 4 bits at a time. Lets assume that they compute the sboxes by looking them up in a table. If it takes 4 cycles to go to memory and an extra cycle to add in the result, then that is 40 cycles to compute the sbox. The key computation involves several shifts and some more adds. Let's say 10 cycles. Use the other 14 cycles for book keeping and that leaves 64 cycles per round or 1024 cycles to do the encryption. That translates into 4 days per DES attack. Could it go faster? On chip memory access could be done in one cycle. You might be able to push things down to 24 cycles per round. That would get you near 1 day per attack. I don't see going any faster. Is it fair to assume that you can build 512,000 low-grade 64 bit processors for a price? The newspaper stated that the contract was worth $4.5 million. Let's allocate $512,000 for the SIMD chips. That $1 a processor. Let's say you can get 800,000 transistors for $10 in bulk quantities today. That's 80,000 transistors per processor. It seems reasonable to me that you can get a pretty okay 64 bit processor with some local memory for that amount if you strip away all of the cache management, floating point and multiplication. But this really isn't my area of expertise. I would welcome more informed analysis. The best data point, though, would be some papers about the Processor-In- Memory project run by the Supercomputing Research Center in Bowie, MD. This is a semi-public project and there have been some pre-prints circulating. They built some early machines that added a few processors to each memory chip. You could write to these chips like normal memory until you flipped a logic line. Then all writes would be routed to the processors which would treated the write as an instruction. There were something like 8 or 16 processors on a chip. I can't seem to find my copies of them. They would give great insight into the past work of the NSA. Given this, I conclude that this new machine is the first public acknowledgement that the NSA will have the ability to use a brute-force attack on DES in about 4 days. It also implies that 7 character alphanumeric UNIX passwords can be knocked off in no time of consequence. These are all back of the envelope computations about people pushing the technological envelope. I would enjoy hearing about any arguments or suggestions that people have about the details. The RISKS? Passwords _REALLY_ need to be longer. DES needs to be replaced by triple-DES or something similar.

4 3

Re: Are \\"they\\" really the enemy?
by John Young 17 Dec '03

17 Dec '03

Responding to msg by tcmay(a)netcom.com (Timothy C. May) on Thu, 18 Aug 4:41 PM >I'd be a lot more interested if there were >some tie-ins to crypto policy and technology. Yep, this is what I want also but need participation by others so I don't stick out too much and get Dixon-ized by Perry, or, bless him, Nzook-ized by Graham. Just see what happens when I post shortly. John

1 0

Re: Remailer ideas
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> From: Hal <hfinney(a)shell.portal.com> > . . . I still think that there would be real utility in the > ability to specify that a particular piece ofmail should be > re-transmitted if it does not get delivered to the destination > machine within a certain period of time. > That's one reason I like the "enabledmail" approach. All we have to do > is persuade everyone . . . . You *can't* get everybody to agree on anything, or limit themselves to anything. It'll be a long time before everybody starts supporting all the X.400 semantics, especially since people keep introducing useful competitors like MIME or painful ones like MicroSoft Mail - I'd be happy to get people to all agree to support RFC822 and SMTP... In the context of this discussion, automatic replies are probably unacceptable for many remailer-users, and don't work very well for replying to anonymous senders. Confirmation really does have to come from the user, and can only work if the user is able to build a return path. A useful surrogate for end-to-end replies are link-based bouncegrams. I'm not sure how much security you lose if you get remailers to support even one-hop NAKs, since the delays inherent in reordering mean you need to keep a return path step around in the remailer at least until you can do address validation; perhaps you could at least bounce on invalid syntax, but even that means decrypting incoming messages a while before sending and keeping them around in cleartext, which is Bad (or doubling the decryption work.) Bill

1 0

Re: Voluntary Governments?
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> From: Hal > What does it mean to speak of a government in cyberspace? It is the > government in physical space I fear. Its agents carry physical guns > which shoot real bullets. > ................................................................ Yeah. I recently reread Vinge's _True Names_; the protagonist is disturbed one day by a bunch of armed government thugs walking up to his house and letting him know they know his cyberspace alias, and that he'd better help them catch his friends or he'll lose his National Information Infrastructure Users' License. (It's not called that, but it's still a good prediction of what happens when you let government build the superhighways - he gives in because 98% of the jobs, and all of the good ones, require use of computer terminals.) Without cryptography, all you've got left is security by obscurity, the main technique used by the hackers in the book; even cryptographic systems need strong enough implementations built around the mathematically-strong parts to be truly safe. Bill

1 0

Oops, Sorry
by Jeff Davis 17 Dec '03

17 Dec '03

Sorry guys. I'll kill the message agent asap. I forgot about it. -- PGP PUBLIC KEY via finger! JAFEFFM Speaking & Thinking For Myself! * eagle(a)deeptht.armory.com email <info(a)eff.org> * *** O U T L A W S On The E L E C T R O N I C F R O N T I E R **** ***** Committed to Free Public Internet Access for World Peace ***** "When cryptography is outlawed, bayl bhgynjf jvyy unir cevinpl!" JPB

1 0

Another crypto talk in NYC (Wed., Aug. 24)
by dmandl＠panix.com 17 Dec '03

17 Dec '03

A friend has invited me to give a cypherpunk/crypto/clipper talk at ABC No Rio in scenic downtown Manhattan later this month. Here's the announcement: ------- Start of forwarded message ------- From: diseased(a)panix.com (Edward Hirsch) Newsgroups: panix.events Subject: Privacy in Cyberspace Talk Date: 15 Aug 1994 21:33:41 -0400 Organization: PANIX Public Access Internet and Unix, NYC NNTP-Posting-Host: panix.com Hi folks. On August 24, at 7pm, cypherpunk, Semiotext(e) editor, WFMU personality, and panix resident Dave Mandl will be leading an open discussion on privacy in cyberspace. The talk will be at ABC No Rio, a non-profit, collectively-run art gallery and performance space located at 156 Rivington Street, on the Lower East Side. Admission is free/donation, and all are encouraged to attend. For more info, email to diseased(a)panix.com. ------- End of forwarded message ------- -- Dave Mandl dmandl(a)panix.com

1 0

medusa & xsplit
by Arsen Ray Arachelian 17 Dec '03

17 Dec '03

Please forgive the delay, I've been busy restoring my files due to a nasty hard drive failure. Not to worry, I haven't lost the sources to Medusa nor Xsplit, and yes I do have a fix for xsplit.... =============================================================================== | + ^ + || ' . . . . . . . Ray (Arsen) Arachelian || | \|/ || . . . ' . ' . : . . rarachel(a)photon.poly.edu || |<--+-->||. . . |' '| .' . . ... ___ sunder(a)intercom.com || | /|\ || . . \___/ . . . : .... __[R] || | + v + || . oOOo /o.O\ oOOo :. : .. |A|"And disks to fix before I sleep" =========/---vvvv-------VVVV------------|I|----------------------------------/ / . : . ' : ' |D| This signature pannel is / / The Next Bug to kill(tm) --- now open. / /___________________________________________________________________/

1 0

Would you guys object to a posting of source code?
by Arsen Ray Arachelian 17 Dec '03

17 Dec '03

Would you guys object if I posted Medusa on here in compressed/uuencoded form? (I won't include the Detweiler fuzzybase, nor the executables to save bandwidth..) Since Medusa isn't crypto software it shouldn't pinch ITAR's ass too hard... =============================================================================== | + ^ + || ' . . . . . . . Ray (Arsen) Arachelian || | \|/ || . . . ' . ' . : . . rarachel(a)photon.poly.edu || |<--+-->||. . . |' '| .' . . ... ___ sunder(a)intercom.com || | /|\ || . . \___/ . . . : .... __[R] || | + v + || . oOOo /o.O\ oOOo :. : .. |A| "And bugs to kill before I sleep"|| =========/---vvvv-------VVVV------------|I|----------------------------------/ / . : . ' : ' |D| This signature pannel is / / The Next Bug to kill(tm) --- now open. / /___________________________________________________________________/

1 0