- cypherpunks-legacy - lists.cpunks.org

Re: crypto and bagpipes [NOISE]
by Alan Olsen 17 Dec '03

17 Dec '03

At 10:55 PM 6/28/96 -0400, Declan B. McCullagh wrote: >Excerpts from internet.cypherpunks: 27-Jun-96 Re: crypto and bagpipes >[NO.. by "Perry E. Metzger"@pierm >> No one who has heard sustained bagpipe playing can deny the fact that >> bagpipes are indeed an instrument of war, with no legitimate place in >> peaceful everyday society. > >Hmm... Carnegie Mellon University is the only school in the country with >a bagpipe major, you know. You haven't lived until you've heard a >screeching 'pipe at 3 am in front of Hunt Library. I guess this explains the pro-censorship outlook of the students and staff there. Maybe someone should be investigating the evil effects of bagpipes on the mind. (The Freudian implications of bagpipe playing alone should get someone there to do something about it...) --- |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

Re: crypto and bagpipes [NOISE]
by Michael Myers 17 Dec '03

17 Dec '03

At 12:37 PM 6/29/96 -0500, Adam Shostack wrote: >Damnit, Perry, the fact that you don't like them doesn't mean we >should outlaw them! :) > >Adam > >Perry E. Metzger wrote: >| vinnie moscaritolo writes: >| > >>>Mr Brooks, the piper, (...) >| > >>>claims he wasn't playing a musical >| > >>>instrument, but practising with a weapon! >| > >>> >| > >>>The imagination boggles if his claim is successful! >| >| No one who has heard sustained bagpipe playing can deny the fact that >| bagpipes are indeed an instrument of war, with no legitimate place in >| peaceful everyday society. >| >| Perry Of course...when bagpipes are outlawed... -- Michael Myers Vote Libertarian....you'll sleep better! Don't like abortion? Don't have one. Don't like guns? Don't buy one. | Don't like bagpipes? Don't play one! | blackavr(a)aa.net E-mail for PGPv2.6.2 public key \____________ http://www.aa.net/~blackavr/homepage.htm ________________/

1 0

Hardware RNG
by Jack Mott 17 Dec '03

17 Dec '03

I just recently built a hardware RNG, I just wanted to see what you guys think of it, here is how it works: Got a geiger counter plugged into the game port Weak radioactive source next to it (dont worry wont fry you) Use a PRNG string to do create an RC4 S-box Cycle through the S-box in a tight loop, each time checking to see if the geiger counter got a hit, if it did, record that number in the S-box as our first byte, do this 100 times, and we have 100 random numbers. With my radioactive source and geiger settings, you can grab 100 random numbers in about 8 seconds, and the S-box will make a complete cycle between 1000 and 350,000 times between geiger hits, depending on how long between hits. any thoughts? It seems to work well, no basic stat analysis reveals any pattern, and physicists have backed me up on radioactive decay being 'the great randomizer'. seeya -- thecrow(a)iconn.net "It can't rain all the time" RSA ENCRYPTION IN 3 LINES OF PERL --------------------------------------------------------- #!/bin/perl -sp0777i<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<j]dsj $/=unpack('H*',$_);$_=`echo 16dio\U$k"SK$/SM$n\EsN0p[lN*1 lK[d2%Sa2/d0$^Ixp"|dc`;s/\W//g;$_=pack('H*',/((..)*)$/)

1 0

Re: Crack for DOS
by frantz＠netcom.com 17 Dec '03

17 Dec '03

Bill Stewart wrote: > Blowfish is new, so perhaps there are flaws that 10-20 years of analysis > will find. But it's pretty good - it's small, fast in software, > and has an annoyingly slow key-schedule which makes it difficult to > use brute-force crackers on. It's got variable key lengths. This comment about "annoyingly slow" key setup made me think of pipeline hardware to set up the keys. Now with blowfish, key setup requires running the Blowfish algorithm 521 times in setting up the key, so the pipeline will require 521 stages if you want a new key for every "real" decryption. Ignoring chip size restrictions, this pipeline will increase the chip real estate by 521 which will have approximately the same economic effect on the cost of cracks as extending the key by 9 bits. For CBC cypher systems, brute force attacks will require at least two decryptions (one for the initialization vector, and one for the first block of the message). however, these decryptions can take place in parallel (for the first block of the message) so they do not change the above argument. However if the design calls for more than the first block, then the pipeline can run slower and becomes a smaller portion of the cost of the system. Of course if you are using Blowfish with anywhere near its full 448 bit key, brute force attacks are simply not practical. ------------------------------------------------------------------------- Bill Frantz | The Internet may fairly be | Periwinkle -- Consulting (408)356-8506 | regarded as a never-ending | 16345 Englewood Ave. frantz(a)netcom.com | worldwide conversation. | Los Gatos, CA 95032, USA

1 0

Re: Cookies anyone?
by jfricker＠vertexgroup.com 17 Dec '03

17 Dec '03

At 04:34 PM 6/29/96 -0700, vanished(a)alpha.c2.org wrote: >While rummaging around in my cookie jar, I found this message--along with some cookies. > >:Netscape HTTP Cookie File >:# http://www.netscape.com/newsref/std/cookie_spec.html >:# This is a generated file! Do not edit. > >Rather than bring down my system by experimenting, I thought I'd ask the list, "What happens if I delete this file?" and "What happens if I delete (edit) the cookies?" > >This may have been discussed before, but until now I never checked for cookies. > >Thanks for your consideration of this matter. > >Vanished > Delete it at will. Cookies are small tidbits of information that server side CGI progs (and client side JavaScript progs) have saved. Cookies are generally used to identify web users when they return to a site. I've seen cookies named "lastvisit", "userid", and so on. If pathfinder.com creates a cookie, it is only visible to pathfinder.com (that's the theory anyway). Deleting the cookie.txt file will have no ill effects unless you are using one of those "build yer own Start Pages" at MSN or wherever. Altering cookies would send garbage down when the cookie is requested. If you would rather that cookies (and crumb trails) not be allowed simply delete any cookies present and make the nominal file read only. John.

1 0

RNG
by David Lesher 17 Dec '03

17 Dec '03

> > I just recently built a hardware RNG, I just wanted to see what you guys > think of it, here is how it works: > > Got a geiger counter plugged into the game port > Weak radioactive source next to it (dont worry wont fry you) > Use a PRNG string to do create an RC4 S-box > Cycle through the S-box in a tight loop, each time checking to > see if the geiger counter got a hit, if it did, record that number in > the S-box as our first byte, do this 100 times, and we have 100 random > numbers. > Tony Patti just gave the DC 'Punks a great talk on this topic. He built a faster RNG he called RANGER -- it connects to the parallel port. Plans for it are available in Cryptosystems Journal.... -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

Re: FTS2000 and Encryption?
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 1:57 PM 6/30/96 -0400, Mark O. Aldrich wrote: >... The [FTS2000 follow-on contract - WSF] >security policy and RFP materials are on the 'net (I can't get to the web >right now, or I'd post the URL with this message). Please post the URL when you can. >From what I remember, >the RFP does state that all payload data will be encrypted by the >Government using NSA-approved crypto and that the vendors are not to >"worry about" what's in the payloads. All they have to do is carry it >from point a to point b. Given that FTS2000 supports X.25 Packet Assembly Disassembly (PADs), there is a wide field ahead for screwing up such useful features as 8-bit transparent characters and data forwarding (i.e. When does the PAD decide it has a complete packet and actually send it). Try running emacs without good data forwarding control. ------------------------------------------------------------------------- Bill Frantz | The Internet may fairly be | Periwinkle -- Consulting (408)356-8506 | regarded as a never-ending | 16345 Englewood Ave. frantz(a)netcom.com | worldwide conversation. | Los Gatos, CA 95032, USA

1 0

MD5 breaks, etc.
by Perry E. Metzger 17 Dec '03

17 Dec '03

1) On the question of MD4, it has been demonstrated that one can generate multiple documents with the same hash -- an example was given in a paper a while back of two contracts, identical but for the dollar sum agreed two, with identical MD4 hashes. That demonstrates that MD4 is useless. 2) Hans Dobbertin on May 2nd released a short paper that circulated widely on the net describing collisions in the MD5 compression function. Several people have asked me for references on this. I cannot give you anything -- all I have is postscript of the document, which had not been published in any journal when I last checked. However, the result is widely known. MD5 is *not* something that should be trusted going forward, and I hope the next version of PGP uses SHA-1. Perry

1 0

SAFE Forum--some comments
by tcmay＠got.net 17 Dec '03

17 Dec '03

I was at the "SAFE" forum yesterday. Too many things to report on, so I'll just add comments here and there. And here I'll comment on Ken Bass's excellent comments (there were many excellent points). Bass is a D.C.-area lawyer with the prestigious Venable law firm (the venerable Venable firm?), and a former Reagan Administration official. He pointed out that the driving force for crypto policy is probably the _law enforcement_ camp, not the _intelligence agency_ camp. And that the NSA is regretting the ITAR stuff, as it has sparked an "arms race" to develop stronger crypto. Bass noted that people now equate permission to export with weakness, and that had the U.S. not restricted exports, users probably would've been "fat, dumb, and happy" to keep using breakable crypto. (Many interesting points to make. Bass is no supporter of Clipper and Escrow, and made many points about why the policy won't work. His later dialog with Michael Froomkin and Jerry Berman, about the constitutionality of crypto laws was a highpoint for me.) His comments fit in with the points made by Diffie that the 40 bit restriction is unlikely to satisfy either the user community or the surveillance community. 40 bits is too weak for a targetted attack, but too strong for "vacuum cleaner" intercepts such as NSA SIGINT uses. (Diffie also gave an excellent summary of cryptographic work factors, using 30 bits, 60 bits, 90 bits, and 120 bits as examples. For example, 30 bits needs about a billion operations to brute force, which any modern PC can do in several seconds. 60 bits is a billion times harder, which NSA machines can handle, and 90 bits is beyond current capabilities...) I said I wouldn't do a summary, but I'll make a few comments: -- Both Congresswimmin, Eshoo and Lofgren, seemed genuinely interested in the issues -- Senator Leahy, on t.v. from Vermont, emphasized _privacy_ and made the Cypherpunk/libertarian/ACLU point that he and his neighbors are not criminals and don't think the government has any right to demand that communications, computer files, diaries, and the like be "escrowed." -- Senator Conrad "I ain't no Democrat" Burns was there in person and was entertaining and strongly blasted key escrow and the ITAR restrictions. I found his comments refreshing. -- The whole affair was "preaching to the choir," as many speakers noted. That is, there was little controversy and little disagreement. This was a point made nicely by Phil Zimmermann, who told a humorous story of going to Congressman Dana Rohrabacher's office, seeing the picture of Ollie North on the wall (much laughter), but finding Rohrabacher's staffers aghast at the crypto laws and ITARs. Then, Phil took a hotel shuttle and ended up talking to the driver, who was also aghast. "Where else can you find this kind of consensus?" (A point many of us have made as well, that nearly everyone who has the issues explained to them comes down on the side that the government has no right to tell us we can't use codes and ciphers, that it's all similar to Big Brother demanding video cameras in our homes....) -- Craig Mundie, currently of Microsoft, made excellent points about the costs of a key escrow infrastructure. (By the way, those who read "The Soul of a New Machine" should be interested that Mundie was the leader of the North Carolina research facility of Data General that lost the "shootout at HoJos." If this means nothing to you, read the Kidder book--soon!) -- Michael Froomkin, a law professor (and member of our list of course), pointed out despite the various constitutional issues, the crypto laws are mostly having their desired effect, namely, slowing the deployment of crypto and creating confusion. (That Windows 95 has no crypto modules, and that most browsers and mail programs have nothing built in tells us that the FUD worked.) In summary, for me the SAFE forum was a success. Though it was periods of boring platitudes we all agreed with interspersed with good insights from the speakers and audience. Not much that was new to a Cypherpunk, of course. (In fact, the forum was almost a kind of Cypherpunks physical meeting, in terms of the topics, and in terms of who attended....it was even where we've been having recent physical meetings.) A day well spent. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

5 5

"----- Message body suppressed -----"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:10 AM 8/21/96, Skip wrote: > ----- Message body suppressed ----- > Sounds good to me. Keep it up. --Tim May -- [This Bible excerpt awaiting review under the U.S. Communications Decency Act of 1996] And then Lot said, "I have some mighty fine young virgin daughters. Why don't you boys just come on in and fuck them right here in my house - I'll just watch!"....Later, up in the mountains, the younger daughter said: "Dad's getting old. I say we should fuck him before he's too old to fuck." So the two daughters got him drunk and screwed him all that night. Sure enough, Dad got them pregnant, and had an incestuous bastard son....Onan really hated the idea of doing his brother's wife and getting her pregnant while his brother got all the credit, so he pulled out before he came....Remember, it's not a good idea to have sex with your sister, your brother, your parents, your pet dog, or the farm animals, unless of course God tells you to. [excerpts from the Old Testament, Modern Vernacular Translation, TCM, 1996]

3 2