- cypherpunks-legacy - lists.cpunks.org

Re: Re: RSA breaking
by [0m [5m Toth 17 Dec '03

17 Dec '03

> System of Russian dolls? What would you suggest? My idea(it is not me that found that) is that tou could have many public keys, when someone want to send you something, he just mail you his(or her) keys, and then you encrypt with the first key, then with the second, etc... This system is used by some anonymous remailers: Each one has a key, you encript your text with the key of the last remailer, then you put your text, the adress of the people tou want the letter to be sent, then encrypt it with the key of the before the last remailer, and put the adress to be sent of the last remailer, etc So your letter is decripted by the first remailer, then sent to the adress found, then the second remailer decrypts it, etc, like an onion. The fact is that you can obtain a very good privacy if you have some keymaker programm. Let suppose you want to send me a crypted text(don't, it's forbidden to crypt in france), you mail to my remailer, that choose 1000(arbitrary number) keys, that send it to you, crypted with your key, you crypt your text the necessary number of times. This way, the message will be maybe uncrypted by someone, but if the key change for each message, someone can't find your key, i insist on this danger, having one key is useless as soon as someone found it. >What kind of system do you think would be needed to crack RSA coded messages? As i said, it is impossible to break an RSA code with softwares, the best attempt was 25 days with ten Crays linked for a key of only 50 numbers. But this can be done as i said before with a simple eratosten crible "translated" into hardware. Sorry electronic is not my way, but for the exemples i saw in class, it is really to the ability of a basic electronician, and they were more complicated than what i am talking about. The best components you have, the faster you'll go, so a governement or a bog private lab can afford this kind of prices.

1 0

TIC_hip
by jya＠pipeline.com 17 Dec '03

17 Dec '03

5-29-96. FiTi: Chips Galore [Editorial] Texas Instruments' claim to have developed a technology capable of inscribing 125m transistors, or computing elements, on a thumbnail-sized slice of silicon is remarkable chiefly because the technique is commonplace. ... The consequences for society of this continued rise in complexity are perhaps not fully grasped even in an age in which computers are taken for granted. The latest technology promises ubiquitous, tiny packages of electronic intelligence. Today's model is the smart card and the tiny videocamera. Tomorrow, tiny processors will be embedded in jewellery, spectacles, buildings and furniture. ... Widely distributed computer power will confer substantial advantages on society; but it will create new ethical problems for society, such as the individual's right to privacy, which may be at least as difficult to master as the technology. ----- FiTi reported yesterday and today on TI's new chip: TIC_hip

1 0

Re: Internet traffic is monitored.
by jim bell 17 Dec '03

17 Dec '03

At 11:37 AM 5/29/96 +0200, Anonymous wrote: >Date: Tue, 28 May 1996 10:03:11 -0700 >X-Sender: bstout(a)osc.hidata.com >To: Firewalls(a)GreatCircle.COM, Return requested <firewalls(a)GreatCircle.COM> >From: Bill Stout <bill.stout(a)hidata.com> >Subject: Re: Encryption Technology >Sender: firewalls-owner(a)GreatCircle.COM > >Extrapolations of fact: > 1. Internet traffic is monitored. > 2. The ability to snoop for encrypted traffic is present > 3. The ability to identify encryption levels is present > (How else can they differentiate DES-1 from DES-3?) > 4. The ability to crack DES-1 in near real-time mode is present. > (See above). > 5. If above=true, then Feds dropping the Zimmerman PGP case probably > also points to it also being crackable in a similar manner. >Bill I think the Feds non-prosecution of Zimmermann had absolutely nothing to do with the crackability/non-crackability of PGP. They just had an extremely weak case: They probably had no way to demonstrate that any particular person exported PGP, which means that prosecuting Zimmermann would have looked like sour grapes. (or, in the alternative, if they had records to show that PGP was exported, they might not have wanted to reveal the extent of their Internet monitoring.) Jim Bell jimbell(a)pacifier.com

1 0

Re: [crypto] crypto-protocols for trading card games
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

At 12:15 AM 5/29/96 -0400, you wrote: >Design a set of crypto protocols to support the issuing, trading, and >playing of such card games in real time (100ms compute time per move) Well, not quite the same thing, but the cool stored-value cards in Japan (for things like phones and the like) are very collectible. Everyone wants a Armitage (anime) card! _______________________ Regards, If it weren't for the last minute, nothing would ever get done. Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0

Scientology subpoenas operator of "freezone" anon remailer
by modemac＠netcom.com 17 Dec '03

17 Dec '03

Path: netcom.com!ixnews1.ix.netcom.com!howland.reston.ans.net!swrinde!newsfeed.internetmci.com!cdc2.cdc.net!news.texas.net!nntp.primenet.com!news.cais.net!bofh.dot!news.his.com!news.lightlink.com!light.lightlink.com!homer From: "Homer W. Smith" <homer(a)light.lightlink.com> Newsgroups: alt.religion.scientology,alt.religion.scientology.xenu,comp.org.eff.talk,misc.legal Subject: Body of Subpoena (fwd) Date: Wed, 29 May 1996 15:12:09 -0400 Organization: ART MATRIX - LIGHTLINK Lines: 28 Distribution: inet Message-ID: <Pine.SUN.3.91.960529151032.12441B-100000(a)light.lightlink.com> NNTP-Posting-Host: light.lightlink.com Mime-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII To: Multiple recipients of list IAP <IAP(a)VMA.CC.ND.EDU>, Remailer Operators List <Remailer-Operators(a)c2.org> Xref: netcom.com alt.religion.scientology:185032 comp.org.eff.talk:85083 misc.legal:174678 DOCUMENTS AND THINGS TO BE PRODUCED 1.) All documents relating to the posting, the header of which is attached hereto as Exhibit A, which was made through the anonymous remailer, freezone.remailer, including, without limitation, the identity of the person or persons who made the posting. 2.) All documents relating to logs or other records kept by the computer of any individuals who sent messages through freezone.remailer at the time the Exhibit A posting was made. 3.) All documents relating to how records are kept by the freezone.remailer computer of the source of postings made or messages send through the computer. Exhibit A is the header as received by netcom.com of Scamizdat #3, posted on April 1st 1995. Homer ------------------------------------------------------------------------------ Homer Wilson Smith News, Web, Telnet Art Matrix - Lightlink (607) 277-0959 SunOS 4.1.4 Sparc 20 Internet Access, Ithaca NY homer(a)lightlink.com info(a)lightlink.com http://www.lightlink.com -- Reverend Modemac (modemac(a)netcom.com) First Online Church of "Bob" "There is no black and white." PGP Key Fingerprint: 47 90 41 70 B4 5B 06 90 7B 38 4E 11 8A ED 80 DF URL: http://www.tiac.net/users/modemac/ (FINGER modemac(a)netcom.com for a FREE SubGenius Pamphlet!)

1 0

Where does your data want to go today?
by Marshall Clow 17 Dec '03

17 Dec '03

>From <http://www.pcweek.com/news/0527/27stor.html>: >Helping pave the way toward cost-effective disaster recovery >systems, MCI Communications Corp. this week will join a growing >number of providers offering file backup and storage over the >Internet. [snip] >MCI and Connected house data on servers at two mirrored sites. >Both companies are adding an extra dimension of security over the >Internet by encrypting data. > >MCI's networkMCI Backup software, for Windows 95 or 3.x, will >scan a file for viruses, encrypt it using an RSA Data Security Inc. >public key and compress it before it is uploaded onto MCI's Internet >backbone network to a secure storage facility, said MCI officials in >Atlanta. [snip] Some comments (off the top of my head): * What kind of encryption? [The article says RSA. ] How big is the key? * Why encrypt before compression? If the encryption is any good, then the encrypted data won't compress much at all. However, compression before encryption has its own problems. * Who does the key management (if any)? * Does MCI store copies of the keys used? * How does MCI authenticate users who request copies of files, and do they then return them encrypted or as plaintext? If encrypted, how does the recepient decryt the files? (He/she just had a disk crash, and this is their backup medium, remember?) I looked on MCI's web site <http://www.mci.com>, but couldn't find anything. Besides, it's slower than sludge. [ 90 secs/page over my 128K link. :-( ] -- Marshall Marshall Clow Aladdin Systems <mailto:mclow@mailhost2.csusm.edu> "We don't have to take it; never have, never will. Gonna shake it, gonna break it; let's forget it: better still" --The Who, "Tommy"

1 0

[SF Bay Area] A talk on Pari by Carl Hansen
by stevenw＠best.com 17 Dec '03

17 Dec '03

Seen on the net: Pari talk by Carl Hansen Monday, June 10 from 7:30 pm to 9 pm BMUG, 2055 Center Street, Berkeley Carl will give an introductory talk on Pari, software that supports arbitrary precision arithmetic and includes many function for doing number theory. He will compare it to other math software and show the special features of this program, including how Pari can be used as a cryptographers workbench. This presentation will be at the BMUG office at 2055 Center Street in Berkeley. The office is near the north west corner of Center Street and Shattuck Ave. which is half a block from the Berkeley BART station. Driving directions: Take the University exit off 80. Head east on University toward the UC Berkeley campus. Turn right at Shattuck (McDonalds will be at the corner.) Go 2 blocks. Turn right on Center and look for parking. I recommend the parking garage on the left, as the one on the right may close at 8 pm. For more information on the Berkeley Macintosh Users Group (BMUG) Mathematics Special Interest Group (SIG), contact: Nancy Blachman Variable Symbols, Inc. 6537 Chabot Road Oakland, CA 94618-1618 Email: nb(a)cs.stanford.edu nb(a)eeyore.stanford.edu Fax: 510 652 8461 Telephone: 510 652 8462 ------------------------------------------------------------------------- Steven Weller | Technology (n): | | A substitute for adulthood. stevenw(a)best.com | Popular with middle-aged men.

1 0

Re: Statistical analysis of anonymous databases
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:12 PM 5/29/96, Alan Horowitz wrote: >I would ask, is there any known medical gain that has resulted from >such a data-base correllation. > >I do not accept a researcher's own statements as to the utility of the work >(S)he's done with someone's funding. Seen too much of it at close >quarters... Nor do I accept reeports in the lay press - these are >nothing more than re-gurgitated press releases from PR depts of institutions. Separating out issues of privacy, and addressing only your basic point about a "known medical gain that has resulted from such a data-base correllation," there are many obvious correlations which have been discovered by use of various data in data bases. The increased prevalence of sickle cell anemia in blacks, the increased prevalence of Tay-Sachs in Jews....all of these things are well-established (and important for dealing with health issues of these groups...that is, it is important and beneficial that someone made such correlations). Back to privacy issues. I am not arguing that the privacy wishes, contractually agreed to, of a patient be ignored. I am simply refuting your point that no medical gain has come from data base correlations. As to the "lay press," I read some issues of "Nature," "Science," "New Scientist," "Discover," and "Scientific American," the journals in which the scientists speak more or less directly, and I am convinced that statistical inference from data bases is indeed a powerful tool. (I am not saying that the privacy wishes and contractual language of patients is to be ignored on this basis, only saying that statistical inference is indeed valuable. So valuable, in fact, that the libertarian/cypherpunk solution is for patients to "sell" this information.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

NRC Cryptography Report: One More Recommendation
by John Gilmore 17 Dec '03

17 Dec '03

Sigh. Add one more Recommendation. It wasn't on the summary page of the fax copy I got, but it was in the text of the Report, and is in the Web page: Recommendation 6: The U.S. government should develop a mechanism to promote information security in the private sector. John

1 0

Statistical analysis of anonymous databases
by Clay.Olbon＠dynetics.com 17 Dec '03

17 Dec '03

I ran across an interesting problem on the STAT-L mailing list. I came up with an initial solution, but it didn't fully solve the problem. I will summarize: In medical research (this particular application - there are others I am sure) it is desirable to have a large database of individual medical histories available to search for correlations, risk factors, etc. The problem, of course, is that many individuals want their medical histories kept private. It is therefore necessary to maintain a database that is not traceable back to individuals. An additional requirement is that people must be able to add additional information to their records as it becomes available. The researcher who initially posed the question suggested adding random data to "encrypt anonymity". My first cut solution was to hash the individual's name (perhaps including some other info or random info to thwart dictionary attacks) and send the records in under the hashed name. If done correctly, this should protect the anonymity of the record. The problem with this is that with the volume of data available in a medical record, it is very probable that a person could be tied to that record. Does anyone have any insights into this problem? <disclaimer> This is of purely academic interest to me, I don't know the person who asked the intial question (other than through email). It just sounds like a neat problem. </disclaimer> Clay --------------------------------------------------------------------------- Clay Olbon II | Clay.Olbon(a)dynetics.com Systems Engineer | ph: (810) 589-9930 fax 9934 Dynetics, Inc., Ste 302 | http://www.msen.com/~olbon/olbon.html 550 Stephenson Hwy | PGP262 public key: on web page Troy, MI 48083-1109 | pgp print: B97397AD50233C77523FD058BD1BB7C0 TANSTAAFL ---------------------------------------------------------------------------

4 4