- cypherpunks-legacy - lists.cpunks.org

Cable TV...... No Monthly Bills
by mudoe38＠hokomaha.co.nz 17 Dec '03

17 Dec '03

This is really cool! PREMIUM CHANNELS........No Monthly Bill! EASY to assemble plans for only $7.00 ! We will send your plans the day we receive your order! YOU WILL BE WATCHING HBO, SHOWTIME, THE MOVIE CHANNEL, Adult stations, and any other scrambled signal NEXT WEEK! You can EASILY assemble a cable descrambler in less than 30 minutes! You have probably seen many advertisments for similar plans.... ** BUT OURS are BETTER! *** We have compared it to all the others and have actually IMPROVED the quality and SIMPLIFIED the design !!! ** We even include PHOTOS! ** OUR PLANS ARE BETTER! We have NEW, EASY TO READ,EASY to assemble plans for only $7.00! We have seen them advertised for as much as $29.00 and you have to wait weeks to receive them! WHAT THE OTHERS SAY IS TRUE! Parts are available at "The TV HUT" or any electronics store. Trademark rights do not allow us to use a national electronics retail chains' name but there is one in your town! Call and ask them BEFORE you order! They are very familiar with these plans and will tell you that it....... DOES INDEED WORK! ASK THEM! You will need these easy to obtain parts : 270-235 mini box 271-1325 2.2k ohm resistor 278-212 chasis connectors RG59 coaxial cable, #12 copper wire, and a variable capacitor. They may have to special order the variable capacitor.... But WHY WAIT for a special order? WE have them! All you need now is the EASY TO ASSEMBLE plans to show you how this money saving device in 30 MINUTES! ** WE have secured a supply of the capacitors directly from the manufacturer, and We WILL include one with your plans for an ADDITIONAL $10.00 only! It is LEGAL, providing of course you use these plans for educational purposes only. IT'S FUN! We're sure you'll enjoy this! Our FAMILIES sure do! * you need one descrambler for each TV. NO MORE MONTHLY BILLS! $ 7.00 for plans only $10.00 for variable capacitor only $17.00 for The easy to assemble plans and one variable capacitor! Pay by check or money order payable to: The Hobby Pros 336 Bon Air Center #254 Greenbrae, Ca. 94904 Please provide a self addressed stamped envelope (.64) So we can RUSH your order to you! If this E-mail offends anyone, we apologize ......and feel free to use the DEL key. "By deleting your unwanted EMail you waste one key stroke, yet by throwing away paper mail you waste a planet! SAVE OUR TREES and support internet EMail instead of traditional mail"! ^^

1 0

IP: Going Cashless: Bank ends ECash trial period
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Delivered-To: ignition-point(a)majordomo.pobox.com X-Sender: believer(a)telepath.com Date: Sat, 19 Sep 1998 07:47:55 -0500 To: believer(a)telepath.com From: believer(a)telepath.com Subject: IP: Going Cashless: Bank ends ECash trial period Mime-Version: 1.0 Sender: ignition-point-request(a)majordomo.pobox.com Precedence: first-class Source: ComputerWorld http://www.computerworld.com/home/news.nsf/all/9809174ecash (Online News, 09/17/98 12:16 PM) Bank ends electronic cash trial By Mary Lisbeth D'Amico The sole U.S. bank to show interest in online payment via electronic cash this week abruptly ended its three-year trial of DigiCash, Inc.'s ECash software. Citing a new strategy and market conditions, St. Louis-based Mercantile Bank this week ended a trial that allowed customers to make purchases over the Internet with electronic coins, Mercantile spokeswoman Beth Fagen confirmed. The trial used ECash, an electronic cash software program created by Palo Alto, Calif.-based DigiCash. The bank was the sole U.S. client for DigiCash, which hopes to have another major U.S. trial in place by year's end, according to William Donahoo, DigiCash's vice president of business development. The trial brought together 5,000 customers with 300 Internet merchants. Customers gave the bank their credit-card information only once, then created electronic "coins" at the bank, allowing them to make small purchases -- or micropayments -- of goods over the Internet without having to enter a credit-card number each time. The buyer also remains anonymous to the merchant because the coins don't identify the customer. Mercantile inherited the ECash project when it purchased Mark Twain Bank in 1997, Fagen said. After reviewing its strategy, the bank decided to call a halt to the trial after it became apparent that few of the project's participants were Mercantile's core customers in the six Midwestern states where it operates, she explained. Fagen also cited the changing climate in the U.S. for Internet payments. When the trial was started in 1995, she said, "people were more fearful of using credit cards to pay for things over the Internet. Now that seems to have disappeared." Although Mark Twain was the first bank worldwide to try out ECash, its core business never was quite a match for the product, according to Donahoo. "But we are still bullish about our prospects for this market," Donahoo said, pointing out that automated teller machines took nearly 20 years to gain favor with consumers. DigiCash will concentrate on finding the right type of merchants for its U.S.-based projects, he said. In Europe, DigiCash has ECash projects in progress at Credit Suisse, the Bank of Austria and Deutsche Bank. Copyright © 1998 Computerworld, Inc. ----------------------- NOTE: In accordance with Title 17 U.S.C. section 107, this material is distributed without profit or payment to those who have expressed a prior interest in receiving this information for non-profit research and educational purposes only. For more information go to: http://www.law.cornell.edu/uscode/17/107.shtml ----------------------- ********************************************** To subscribe or unsubscribe, email: majordomo(a)majordomo.pobox.com with the message: (un)subscribe ignition-point email@address ********************************************** www.telepath.com/believer ********************************************** --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: GPS privacy/ECM
by jim bell 17 Dec '03

17 Dec '03

At 11:03 AM 4/15/96 +0100, Ed Carp wrote: >Clinton is supposed to have either turned off dithering or will soon >(crossing fingers). Dithering is a real nuisance at times... True, but we'll still need DGPS for 1-meter accuracy, as opposed to 20-meter accuracy for uncorrected C/A GPS. Jim Bell, N7IJS

2 1

Announcement: New Twofish Results
by Bruce Schneier 17 Dec '03

17 Dec '03

Results Announcement: N. Ferguson, , "Upper Bounds on Differential Characteristics in Twofish," Twofish Technical Report #1, Counterpane Systems, Aug 1998. Abstract: In our initial paper the Twofish block cipher was introduced, and initial estimates of an upper bounds on the probability of a 12-round differential were given. These results used an imperfect model of Twofish. We present an improved model, and show that any 12-round differential characteristic has a probability of at most $2^{-102.8}$. This paper is available at http://www.counterpane.com/twofish.html, and will be made available at the AES Workshop next week. Cheers, Bruce ********************************************************************** Bruce Schneier, President, Counterpane Systems Phone: 612-823-1098 101 E Minnehaha Parkway, Minneapolis, MN 55419 Fax: 612-823-1590 Free crypto newsletter. See: http://www.counterpane.com

1 0

IDEA(tm) weakness?
by Anonymous 17 Dec '03

17 Dec '03

Title: Privacy Page Privacy How private is your electronic communication ? [taken from the PGP FAQ] You should encrypt your e-mail for the same reason that you don't write all of your correspondence on the back of a post card. E-mail is actually far less secure than the postal system. With the post office, you at least put your letter inside an envelope to hide it from casual snooping. Take a look at the header area of any e-mail message that you receive and you will see that it has passed through a number of nodes on its way to you. Every one of these nodes presents the opportunity for snooping. Encryption in no way should imply illegal activity. It is simply intended to keep personal thoughts personal. Do you trust your mail servers/gateways/virtual redirects ? With the increasing use of virtual email accounts which allow you to keep the same email address no matter if you change jobs, ISPs, etc, the opportunity for snooping increases. Is PGP secure ? PGP uses acombination of IDEA, RSA and MD5. RSA is used to allow the transfer of session keys and MD5 is used to generate a unique message digest from the passphrase for generating the IDEA key and signatures. IDEA is the core algorithm used to encrypt the actual message. Thus the security of IDEA is also means the security of PGP <read the section 'is IDEA secure'>. Is IDEA secure ? The IDEA algorithm (patented by ASCOM) is the core algorithmm used in PGP. It is based on a rotating 128 bit key split into 16 bit segments. The algorthm converts 64 bits of data at a time using the following operations '+', '^' (exclusive-or) and '*'. The formulas are : 64 bit data => D1, D2, D3 and D4 (all 16 bits) => K1,K2,K3....rotating extra 25 bits after all 128 bits are used There are 2 phases in each round and 8 rounds in total + 1 final round of just phase 1. Phase 1: R1 = D1 * K1 R2 = D2 + K2 R3 = D3 + K3 R4 = D4 * K4 Phase 2: E1 = R1 xor (((R2 xor R4) + ((R3 xor R1) * K5)) * K6) E2 = R3 xor (((R2 xor R4) + ((R3 xor R1) * K5)) * K6) E3 = R2 xor ((((R2 xor R4) + ((R3 xor R1) * K5)) * K6) + ((R3 xor R1) * K5)) E4 = R4 xor ((((R2 xor R4) + ((R3 xor R1) * K5)) * K6) + ((R3 xor R1) * K5)) Given a large random data message (ie 1000 samples - 64*1000 = 8Kb file). The distribution of the above operations can be used to break the key. ie both the '+' and the '^' operations give an even distribution but the '*' operator gives a biased distribution towards '0'. Distribution (where '*' has a bias towards 1 of a) R1 = a R2 = even R3 = even R4 = a (a5 & a6 are the bias for K5 and K6) E1 = (bias a5) * (bias a6) E2 = (bias a5) * (bias a6) E3 = (bias a5) - (2 * (bias a5) * (bias a5) * (bias a6)) + ((bias a5) * (bias a6)) = (bias a5) * (1 + (bias a6) - (2*(bias a5)*(bias a6))) E4 = (bias a5) - (2 * (bias a5) * (bias a5) * (bias a6)) + ((bias a5) * (bias a6)) = (bias a5) * (1 + (bias a6) - (2*(bias a5)*(bias a6))) Also as the '*' operator is biased towards its own bit for the result '1' - approx (60% to 100% depending on bit position). [Working from the low bit upwards will provide an even greater approximation as then you would have the relevant Key bits against a random data. ie for 1st bit, it is 100% dependant on the bit for a '1',...] eg using a simple 3x3 matrix on second bit, gives (only demonstrating the ratio): if K bit is 1 => bias a ~ (2/8), if K bit is 0 => bias a ~(1/8) ==> We can determine when : K5=0 and K6=0 as (bias a5) and (bias a6) will be at their highest ==> E1 & E2 are highest K5=1 and K6=1 as (bias a5) and (bias a6) are at their lowest ==> E1 & E2 are Lowest To determine between K5=0,K6=1 and K5=1,K6=0. K5 can be determined by check with E3 & E4 as they are both equal to : (bias a5) * (1 + (bias a6) - (2*(bias a5)*(bias a6))) => directly relate to (bias a5) => K5 =>When K5=0, both E3 & E4 will be low. => When K5=1, both E3 & E4 will be high. The Key rotation start bits are : Phase K1 K2 K3 K4 K5 K6 1 0 16 32 48 64 80 2 96 112 25 41 57 73 3 89 105 121 9 50 66 4 82 98 114 2 18 34 5 75 91 107 123 11 27 6 43 59 100 116 4 20 7 36 52 68 84 125 13 8 29 45 61 77 93 109 final 22 38 54 70 n/a n/a Working backwards with these distributions you can deduce the key. ie work out K5 (93..108) and K6 (109..124) from its distribution pattern [using just the distributions for E2 & E3, as E1 & E4 have had the '*' operation applied in the final phase], then with K5 and K6 work out K1..K4 (22..85). You now have the key values for K1 to K6 !!!. Modify the Samples such they are back a phase and repeat (ie for each sample work backwards using known K1..K6 to find the E1..4 values). MAJOR ASSUMPTION : Assume that a large random sample provides a close to even distribution at the end of each phase (For E2 & E3) such that the bias (ie a5 & a6) used to determine E2 and E3 are the only significant factors. Reasoning : If the distribution is not even, then it is very much easier to break (ie only the key values can cause the change in distribution pattern => know the pattern, know the key). I have developed a program which does just this (NOTE: not tested with real PGP data, as I have not had the time to investigate how the PGP file is structured, ie where the IDEA code starts and ends). It is available under a copyleft license similar to GNU. The Java Source code can be found at : [Application will not be released until beginning of 1999 when enough people are aware of the potential problem, and solutions are widely available - thus the threat to the general users privacy is kept to a minimal. Software houses which would like a delay in the release of this application so as to provide a solution should email: SGOSHA33(a)mailexcite.com with their request] What can we do ? The above crack works because there is a large sample involved. If however you pre-encrypted the file such that you got your pre-encrypted file and a key file, where this key file is small and contains only the key required to open the pre-encrypt file. You then PGP the two files, this would make it much harder to break as the key file cannot be broken from the sampling technique descibed above. I have developed an application which does just that. It is available under a copyleft license similar to GNU. The Java source code can be found here : kiss.zip To run the application you will need Java installed on your machine. Place the files in a directory named KISS. The command line is : java KISS.kiss e <filename> - encrypt java KISS.kiss d <filename> - decrypt (do not add the kiss extension to the filename) After encryption you will get 2 files. The '.kiss' file is the encrypted file and the '.lips' file contains the key used to encrypt the file. You should then encrypt both files with PGP. What is in the pipeline for the future ? Task 1 The above 'kiss' pre-encryption is not 100% safe from non-bruteforce cracking !! As the majority of files encrypted are text messages which are based mainly on the characters 'a' to 'z' thus the Ascii codes of the characters are of the form 011xxxxx. From this you can see that the rotating distribution as used above will tend toward '1'. Thus with enough samples they can deduce the key with the simple equation. KeyValue xor 1 = CommonValue ==> KeyValue = !CommonValue To prevent this my next application (codename Stable) will be a stabiliser program which will ensure that the distribution of the data has an even distribution. Target Release Date : 30/9/98. Task 2 The integration of both 'kiss' and 'stable'. Target Release Date : 15/10/98. Task 3 Port of both kiss and stable to C/C++ (for speed and also for Task 4). [Wrote Kiss and Stable in Java to test the speed of Java and also how it handled bit manipulation operations]. Target Release Date : 31/10/98. Task 4 Integration with PGP to provide uses with a much easier encryption method. Target Release Date : 31/11/98. Author : SGOSHA33 Return to Albert's Home Page.

1 0

http://stuffed.net/98/8/18/
by STUFFED/EUREKA! 17 Dec '03

17 Dec '03

Welcome to today's issue of Stuffed. To read it you should click on the URL below. If it is not made clickable by your email program you will need to use your mouse to highlight the line, copy it and then paste it into your browser (then press Return). http://stuffed.net/98/8/18/ If you have an email program that can display web pages you will find today's front cover should have already been disp- layed and can be clicked on to take you straight to Stuffed. This email is never sent unsolicited. Stuffed is the supplement for the Eureka newsletter you subscribed to. Full instructions on unsubscribing are in every issue of Eureka!

1 0

Re: European freedoms...
by Rob Carlson 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- America is the only country that requires me to be anally violated by one of their official queens as a condition of entry into a country I'm a citizen of. In my view, Americans were fooled into trading their freedom for a piece of paper that everyone roundly ignores. Namely, the Bill of Rights. We should've known America was not a free country when they kept repeating that it was all the time. America is actually a land of intolerant, bigoted people who can't wait to kill their neighbors. While all the time proclaiming themselves to be the most moral and free people in the universe. Don't bother suggesting that I 'Love it or Leave It'. I already have. Rob Carlson <robc(a)xmission.com> -----BEGIN PGP SIGNATURE----- Version: PGPsdk version 1.0 (C) 1997 Pretty Good Privacy, Inc iQCVAwUBNdmOSsymxXJdz3TJAQH2zAP+OdkqB92urN2oEKOVK0Ni+uDtmJeb5Bes mbugAPHVdVbHNiLTuaI8882rAJmSwxQa7cJ0ic2RLfHWlt/meDehEM/PcNL0cmaw UskfE7aIZewURTa3LBBak+gwGhaqEDDZbAGgYfGAiXjMOxBITir67IPbeNIqj+iW p5FwFMHfFsQ= =Z8cJ -----END PGP SIGNATURE-----

1 0

CTIA Daily News from WOW-COM - August 18, 1998
by CTIA Daily News 17 Dec '03

17 Dec '03

========================================== Welcome to today's edition of the CTIA Daily News from WOW-COM. Please click on the icon / attachment for the most important news in wireless communications today. If you cannot open the icon/attachment, please visit http://www.wow-com.com/professional/ for the wireless daily news. Don't miss the major conference on implementing Phase 2 of the E-911 requirement--August 26-27 in San Francisco. For more information, click http://www.wow-com.com/pdf/locntech.pdf ===========================================

1 0

Re: Private Doorbell - Re: CRYPTO-GRAM, August 15, 1998
by Jean-Francois Avon 17 Dec '03

17 Dec '03

On Mon, 17 Aug 1998 09:29:12 -0700, Bill Stewart wrote: >so Louis Freeh should be happy enough >(since it meets the "legitimate needs of law enforcement", Not to bug you personnally, just a comment on the general state of affairs: IMHO, there is no such thing as "legitimate needs of law enforcement" that could justify such a limitation of the freedom of the individuals who had done nothing wrong. "legitimate" in our present context means to "counter things that are presently illegal", notwithstanding that an immense portion of the population, which in essence does not try to get a free ride from some sort of law, do not agree at all with the said law. Somehow, I think that it is time to emphasize our taking of the moral high ground. Ciao jfa Definition: FACISM: n.: a political and economic movement, strongly nationalistic, magnifying the rights of the state as opposed to those of the individual, in which industry, though remaining largely under private ownership, and all administrative political units, are controlled by a strong central government. ------------------------------------------------- "One of the ordinary modes by which tyrants accomplish their purpose, without resistance, is by disarming the people and making it an offense to keep arms". - Joseph Story, U.S. Supreme Court Justice. ------------------------------------------------- the German gun control laws were enacted by the "liberal" Weimar Republic government that preceded Hitler, and were a strong aid to his coming to power -- because they disarmed Hitler's opponents, and Hitler's adherents ignored them -- as criminals have always ignored gun control laws. Disarming the public is a frequent first step toward dictatorships and genocides. Once the disarming is complete, the public is helpless against those who have the guns. ------------------------------------------------- PGP keys: http://bs.mit.edu:8001/pks-toplev.html PGP ID:C58ADD0D:529645E8205A8A5E F87CC86FAEFEF891 PGP ID:5B51964D:152ACCBCD4A481B0 254011193237822C Jean-Francois Avon, B.Sc. Physics, Montreal, Canada DePompadour, Société d'Importation Ltée Limoges fine porcelain and french crystal JFA Technologies, R&D physicists & engineers Instrumentation & control, LabView programming PGP keys: http://bs.mit.edu:8001/pks-toplev.html PGP ID:C58ADD0D:529645E8205A8A5E F87CC86FAEFEF891 PGP ID:5B51964D:152ACCBCD4A481B0 254011193237822C

1 0

Re: CHALLENGE? Toto/signature attack w. unpublished public key
by Adam Back 17 Dec '03

17 Dec '03

Anonymous writes: > > So next we would like to solve: > > > > s ^ e mod n = m > > > > or in other words find e, k and n st: > > > > s ^ e - m = k * n > > In addition it has to be that n is the right length based on the "s" > padding. This limits it to an 8 bit range, in this case 1024-1031 > bits. The constraint I gave was that log(n) = 1024. Bear in mind that the msbyte of s = 0x08, so we know that n > s, and I think we know that n < 2^1024 also based on the s padding from the signature. So based on this n would be in the range 1020 - 1024 bits, right? > If you make n be a product of a bunch of small primes, so that you > can make signatures with it, then a third party can detect this and > know it is bogus. He has to factor your n to determine that it is bogus though? This would imply that he had more compute than you do. (Not unreasonable threat model mind). > Also, this approach won't match the keyid of the original signature. Agree. Weak counterpoint is that the keyid is not authenticated, though if IRS have a key, they know it's keyid, and if that keyid is the one posted (unauthenticated inside the armor 0xCE56A4072541C535), this tips the probability of authorship towards the key they have. This though is perhaps not incontroverible proof, if one posits that Toto or unknown others were trying to create a complicated mess for people to confuse themselves analysing. Evidence suggests that this was/is the case: there are other messages, for example one with a signature with what is perhaps a 0xdeadbeef attack against a key on the keyservers, with the same 32 bit keyid, but a 64 bit key id differing by 1 bit. Another key which almost but not quite makes sense to PGP (a few bits twiddled). Plus lots of still undecrypted encrypted messages posted to the list, plus possibly stegoed images posted (one image was posted together with a password which was also publically posted together with instructions for recovering using S-TOOLS4.ZIP (a stego package for windows), and lots of other anonymously and pseudonymously posted images.) (One of the encrypted keys which passphrases were forwarded to the list for just today had been posted to the list over a year ago -- Carl Johnson couldn't have posted the passphrase because he is incarcerated). > Another approach is to generate an n such that the discrete logarithm > is solvable mod n. Then you can solve for e in s^e = m mod n, with > the base of the discrete log being s. Doing this you can match the > keyid and size of n without too much difficulty. Yes! Excellent. This construct (discrete logs over composite modulus to allow the same operation) is used by the identity based crypto people. The trap door is not that good, because 512 bit discrete logs are as you suggest rather expensive to compute. > Unfortunately e will not be small; it will be about the same size as n. > There are one or two keys on the public keyring which have large e's, > apparently generated by hacked versions of pgp. Some people feel > safer with random e than a small e. So this could perhaps be accepted. It's not a hacked version of PGP, I've generated such keys myself also: it is just a lesser documented feature of pgp2.x, (pgp -kg 1024 768) would give you a 1024 bit n and a 768 bit e). > (OTOH given two keys that both sign the same message, one with a small > e and one with a large one, it is obvious that the first is the legit > one and the second is the cloned one.) Not so obvious with the other key tinkering which has been going on here. It seems likely that Toto et al were purposefully trying to sow confusion, and seem to delight in leaving little clues to people trying to understand it looks like this strategy has been operational for over a year now (some of the encrypted messages which passphrases were forwarded to the list for just today had been posted to the list over a year ago -- Carl Johnson couldn't have posted the passphrase because he is incarcerated). > Unfortunately with a 1024 bit RSA modulus it is not going to be > feasible to solve 512 bit discrete logs using a reasonable amount > of effort. However by using more factors in the RSA modulus it should > become practical. The number of factors needed will depend on how much > resources you have to work on the discrete log. Resources available: one low end pentium based linux PC? :-) Just that the attack is clearly feasible is interesting though a demonstration would be perhaps more convincing to less technically aware IRS people. The biggest resource overhead is implementing that lot though, unless there exist packages or libraries which already do most of it for you. > Once you have your n and e you can sign other messages with the key. > The n looks OK from outside because the fact that it has more than two > factors is not detectable, as long as its factors are not too small. > Actually there may be a way of distinguishing n's with two factors from > n's with more, check into this. > > Also check into whether n's of this form can be factored via a p-1 > factoring attack. It may be that making the discrete log easy also makes > the modulus factorable. I think the answer to that is yes. In connection with previous discussions of implementing forward secrecy using identity based crypto (search archives for cypherpunks / coderpunks /cryptography for posts with Subject: non-interactive forward secrecy / identity based crypto ) another Anonymous describes some of the identity based crypto papers on this topic, which suggests another method of being able to compute discrete logs mod composite n. : Maurer describes an alternative set of parameters as well. Rather than : choosing small primes for the discrete logs, larger primes with a : special form are used which make the problem easy. This is based on the : Pohlig-Hellman discrete log algorithm, which applies when p-1 has all small : factors. The problem is that there also exists a p-1 factoring algorithm : which works when p-1 has all small factors. However the former algorithm : costs the square root of the size of the factors, while the later takes : work proportional to the size of the factors themselves. This gives a : window where the discrete log can be done but the factoring will fail. : : For this embodiment, Maurer suggests a modulus which is the product of : two primes, each 100 digits (333 bits) in length. This will produce : a 666 bit modulus. Have each of the primes be such that (p-1)/2 is a : product of several 13-15 digit (43-50 bit) primes. So it could be done, I think, and in such a way that you have lower cpu overhead than the attacker trying to prove one key more likely than the other. Adam

1 0