- cypherpunks-legacy@lists.ogf.org

DCASH: Two Digital Cash Reports Available
by edgar＠spectrx.Saigon.COM 17 Jul '93

17 Jul '93

-----BEGIN PGP SIGNED MESSAGE----- I have two reports on new ideas for digital cash which I retrieved from Amsterdam. Both are in PostScript format. I have a hardcopy of the larger one kindly supplied by mail by the author, Stephen Brands. If there is any interest, I will bring both soft and hard-copies to the next Physical Meeting, which I presume will take place on the 2nd Sat of August, 8/8, noon, at Cygnus in Mtn. View. (I didn't see any announcement/agenda for the July meeting, but I understand it occurred anyway). Here are summaries of the reports: [Newsgroup sci.crypt] Post: 1070 of 1149 From: brands(a)cwi.nl (Stefan Brands) Newsgroups: sci.crypt Subject: * REPORT ON PRIVACY-PROTECTING OFF-LINE CASH AVAILABLE * Date: 19 Apr 93 14:37:17 GMT Organization: CWI, Amsterdam Lines: 60 I recently published a new privacy-protecting off-line electronic cash system as a technical report at CWI. Being a PhD-student at David Chaum's cryptography-group, our group has a long history in research in the field of privacy-protecting cash systems. The report is called CS-R9323.ps.Z, contains 77 pages, and can be retrieved from ftp.cwi.nl (192.16.184.180) from the directory pub/CWIreports/AA. The postscript-file is suitable for 300dpi laserprinters. ==================================================================== ABSTRACT (from coverpage): We present a new off-line electronic cash system based on a problem, called the representation problem, of which little use has been made in literature thus far. Our system is the first to be based entirely on discrete logarithms. Using the representation problem as a basic concept, some techniques are introduced that enable us to construct protocols for withdrawal and payment that do not use the cut and choose methodology of earlier systems. As a consequence, our cash system is much more efficient in both computation and communication complexity than any such system proposed previously. Another important aspect of our system concerns its provability. Contrary to previously proposed systems, its correctness can be mathematically proven to a very great extent. Specifically, if we make one plausible assumption concerning a single hash-function, the ability to break the system seems to imply that one can break the Diffie-Hellman problem. Our system offers a number of extensions that are hard to achieve in previously known systems. In our opinion the most interesting of these is that the entire cash system (including all the extensions) can be incorporated in a setting based on wallets with observers, which has the important advantage that double-spending can be prevented in the first place, rather than detecting the identity of a double-spender after the fact. In particular, it can be incorporated even under the most stringent requirements conceivable about the privacy of the user, which seems to be impossible to do with previously proposed systems. Another benefit of our system is that framing attempts by a bank have negligible probability of success (independent of computing power) by a simple mechanism from within the system, which is something that previous solutions lack entirely. Furthermore, the basic cash system can be extended to checks, multi-show cash and divisibility, while retaining its computational efficiency. ==================================================================== Cryptographers are challenged to try to break this system! I made a particular effort to keep the report as self-contained as possible. Nevertheless, if you have any questions, please e-mail to me and I will try to reply as good as I can. Any comments are also welcome! Stefan Brands, - -------------------------------------------------------- CWI, Kruislaan 413, 1098 SJ Amsterdam, The Netherlands Tel: +31 20 5924103, e-mail: brands(a)cwi.nl [Newsgroup alt.privacy] Post: 452 of 458 From: Niels Ferguson <Niels.Ferguson(a)cwi.nl> Newsgroups: alt.privacy,comp.society.privacy,alt.security,comp.security.announce,comp.security.misc,sci.crypt Subject: new Electronic Cash scheme: technical report available Date: 25 Jun 93 13:48:26 GMT Organization: Computer Privacy Digest Lines: 58 Approved: comp-privacy(a)pica.army.mil X-Submissions-To: comp-privacy(a)pica.army.mil X-Administrivia-To: comp-privacy-request(a)pica.army.mil X-Computer-Privacy-Digest: Volume 2, Issue 054, Message 4 of 4 New electronic cash system: report available by FTP. --------------------------------------------------- Electronic cash is the equivalent of paper cash in an electronic form. It has all the same basic properties as ordinary cash: It carries value, can be used to pay other people without contacting any central organization and is completely anonymous. Recent work at the CWI has resulted in significantly improved protocols for electronic cash. The following CWI technical report is now available by FTP: Title: Single Term Off-Line Coins Author: Niels Ferguson Report: CS-R9318 Site: ftp.cwi.nl directory:/pub/CWIreports/AA file: CS-R9318.ps.Z (compressed PostScript file) Abstract -------- We present a new construction for off-line electronic coins that is both far more efficient and much simpler than previous systems. Instead of using many terms, each for a single bit of the challenge, our system uses a single term for a large number of possible challenges. The withdrawal protocol does not use a cut-and-choose methodology as with earlier systems, but uses a direct construction. This report is slightly more extensive than the version that appeared in the pre-proceedings of EuroCrypt '93. If you are interested in this report, you might also be interested in a report by my colleague Stefan Brands entitled "An Efficient Off-line Electronic Cash System based on the Representation Problem". It can be found under the name "CS-R9323.ps.Z" in the same directory. Note: Followup set to sci.crypt Niels -------------------------------------------------#include<stddisclaimer>------ ... of shoes and ships and sealing-wax, of | Niels Ferguson cabbages and kings, and why the sea is boiling | CWI, Amsterdam, Netherlands hot, and whether pigs have wings ... | e-mail: niels(a)cwi.nl -----BEGIN PGP SIGNATURE----- Version: 2.3.2/EWS iQCVAgUBLEW2Wd4nNf3ah8DHAQFQIAP/eCwkHJzjINs+0GHpW/USH0mI/CZGbtlx wSCPZOHBfgboEOrttam/vz5SApghRHwraVcXYnCR+6cZaCkmdISkcZ8ISj6V/77w L5q992BR5SZ7vVV31lLjEgTTw8Va2n9y2ry6ubZCMF0j5nTZy44OOYIU5gLQDHhR fT0u8iwQY2s= =4CNQ -----END PGP SIGNATURE----- -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Cupertino, Ca

2 1

TEST: Ignore me
by hughes 17 Jul '93

17 Jul '93

More mailing list testing. Please ignore. Eric

1 0

ADMIN: cypherpunks mail configuration change
by hughes 16 Jul '93

16 Jul '93

Effective immediately, all cypherpunks mail will appear to originate from 'owner-cypherpunks'. Previously the name was 'cypherpunks-request'. This change only affects those of you using mail filters which are filtering on the out-of-band "From " line. This change was made so that I can more easily separate bounce messages from list requests. Eric

1 0

No Subject
by Thomas Grant Edwards 16 Jul '93

16 Jul '93

-----BEGIN PGP SIGNED MESSAGE----- Does anyone know of C source code for low speed CELP or vocoder software available on the net? I feel if we can develop even a low-speed software based answer to the secure-phone, it will probably be used and distributed to many people. I think it would have to be based around the soundblaster card though. Perhaps we can also devise an internet secure-phone standard, and clients can be written for NeXTs, Suns, PCs, and etc. I've had no luck getting our SparcStations to decompress ADPCM encoded Internet Talk Radio in real time...either the software I have is truly sad (could be), or we need to look at other compression methods such as CELP, or at worst, vocoder. - -Thomas -----BEGIN PGP SIGNATURE----- Version: 2.2 iQBVAgUBLEcE4DAI9D7h8UTJAQHGSgIAgleqJLQnpwQck4b8FQi79uL6RPGv1j01 LlLX+ICFA/yFfVheh43tWt9vsHrG0d+Vgbo3SX4FHUniDBlqAHYnfw== =QYED -----END PGP SIGNATURE-----

2 1

DCypherpunks
by fergp＠sytex.com 16 Jul '93

16 Jul '93

Washington, DC area Cypherpunks: I have accepted a consulting position in the DC area which will not require consistent travel (unlike my current job), which I will begin the first of August. This position will be designing, implementing and configuring routed Internet access data networks for one of the big three carriers (no, not AT&T). Anyway, I'd like to find out how many of the DCypherpuuks are willing to plan a physical meeting for mid-August to discuss current happenings, sign keys and the likes. E-mail me if you are interested. Cheers. Paul Ferguson | "Confidence is the feeling you get Network Integrator | just before you fully understand Centreville, Virginia USA | the problem." fergp(a)sytex.com | - Murphy's 7th Law of Computing Quis Custodiet Ipsos Custodes? being used for, what I consider, unethical, immoral and possibly illegal activities. ---- begin forwarded message ------------- AIS BBS Capture log. To: all interested parties, especially Americans who may wish to ask relevant questions of relevant people. Capture log from a BBS that claims to be run by the US Treasury Department, Bureau of the Public Debt. Notice - I have not verified that the US government is actually running this BBS, only that the BBS claims that it is. The capture was made live. I have cut out parts where the same area was visited twice, and the information is identical. Also cut out, is any information that could lead to the caller being identified, as the caller wishes to retain privacy. If indeed this is being run by the US Government, the caller would not wish to be harassed by that organisation. Also omitted are the "More" prompts for paging the display. And, after the first few displays of the main menu, some of those have also been omitted for brevity. The file 27-ASM.ZIP was downloaded, to check that there really were source codes. In fact, there were mostly recompilable disassemblies, some good, some bad. I've included, at the end of this file, the beginning of 512.ASM, a disassembly of Number of the Beast. But I've only included the header, the first couple of instructions (discover Dos version) and the end (the '666'). All the meat of the code, I've omitted for brevity, and because this capture is likely to become publicly available. [End of forwarded transcript] Immediately following the above text, was contained a list of computer viruses, virus construction tools and virus disassemblies. In the subsequent storm of debate, there have been several scathing articles written about the way the situation was brought into public knowledge, including a front-page article in the Washington Post and several rather scathing articles in Computer Underground Digest (CuD 5.51) and a rebuttal (of sorts, CuD 5.52) in which I stated my own position on the matter. It is also been brought to my attention that certain underground hackers have vowed to seek revenge in some fashion, which really worries me the least. My main concern is that this instance of valid utilization of "whistleblowing" has been overshadowed by the ravings of virus exchange enthusiasts and underground virus distribution and propagation groups who are calling "Foul!" without closely examine the implications of their own actions (a topic which I will not launch into at this time). In fact, I applaud Peter G. Neumann, moderator of RISKS Forum for allowing the anonymous post to be posted to the list in the first place. Another copy of the message was sent anonymously to VIRUS-L Digest (comp.virus list) where Ken van Wyk, the moderator, decided not to post it. (A raspberry to Ken for that one.) Perhaps the remainder of the net is not quite ready to acknowledge anonymity? As I stated above, I'd really like to hear some of your thoughts on the matter... Cheers. Paul Ferguson | "Confidence is the feeling you get Network Integrator | just before you fully understand Centreville, Virginia USA | the problem." fergp(a)sytex.com | - Murphy's 7th Law of Computing Quis Custodiet Ipsos Custodes?

1 0

steganography and cryptography
by Mike Johnson 16 Jul '93

16 Jul '93

Kragen Sittler says: > . . . > For a steganographically strong code, the cyphertext must not be recognizable > to its home program. This means, among other things, no CRC's, no MD5's, etc, > intended to assure data integrity. This means no delimiter-structured files. > (I think--I'm not absolutely sure on this one.) Every field in the file must > be either fixed-length or have a number somewhere in it > (in a format indistinguishable from the rest of the cyphertext) which tells it s > length. And every field, individually, must not be recognizable as something > unusual. (For instance, no sending of large prime numbers in the clear, as the y > are very unlikely to appear in a random file.) > > The foregoing "field" stuff has to do with things like PGP, which have a > message cyphertext, encrypted with a session key, and a session key, encrypted > with a PKC, in the same message. (Possible several cyphertexts of the session > key.) > > Oh, and it would be nice, though not essential, if a corruption in the file > made it completely, rather than partially, nonsense when decrypted. This way > you can't have a file with no use to the recipient used as evidence against > them. > > The important qualifications seem to rule out any crypto package in current > widespread use, don't they? > . . . For a steganographically strong code, it is not enough to make it unrecognizable to its home program. The ciphertext must look like something "innocent" to either a human reader or a computer program designed to look for ciphertext. For example, the message could be hidden in the least significant intensity bits of a bitmapped picture that the intended recipient has an unmodified copy of. If data that looks like random noise is innocent enough, then it is not hard to hack PGP or write another encryption program that intentionally lacks any signature information. I wrote several programs with this property. The two best examples are CRYPTE and CRYPTMPJ, both of which are available on the Rainbow Missions BBS at 303-938-9654. This makes them a little harder to use than PGP and similar programs, because the user has to know in advance when encryption and decryption are appropriate, and which algorithm to use. Allowing a signature in the file format makes it obvious which program was used to encrypt the data (thus slightly reducing security), but it makes it easier to use the program. This increase in ease of use makes it more likely that it will be used, and that increases security.

1 0

Re: WARNING: NON-CYPHERPUNK QUESTION
by anonymous＠extropia.wimsey.com 16 Jul '93

16 Jul '93

Clark Reynard asked: Are there any fast, quick, reliable methods of forestalling phone disconnection due to failure to pay the bills, and the ugly reconnection fee which ensues thereupon? I can't offer a method of *eliminating* your phone bill, but I have been practicing a method of drastically *reducing* the charge for local phone service. Simply ask Pac Bell (In California) for "Lifeline" service. The monthly bill is $1.31, after "credits" for "inside wire repair" and "Tel Equip" (for buying your own phone(s)). Clark, do you think you could afford that? This gets you a local (outgoing) call allowance of 60 calls per month (about 2 a day). Unlike regular measured service, which measures (and charges) by call *and length of call*, each of your 60 calls under lifeline can be of unlimited length. Back when I had a 2400 baud modem, I frequently had single calls of 2-4 *hours* while uploading & downloading files from various local BB's. Calls beyond your 60-call allowance are charged at $.08 per call. Of course, there's a catch. Lifeline service is only offered to "poor" people. You have to sign a statement every year certifying that your combined family income doesn't exceed their guidlines. But although they warn you that the Public Utilities Commission "may investigate" your claim; they apparently never do! Unlike the PG&E lifeline program, Pac Bell doesn't ask for *any* documentation of your income like W-2 forms or copies of your tax returns. I've been on lifeline service for *years*, I think almost since they started offering it, back when the Bell system was broken up, and local phone rates were raised sharply. During most of that time, I earned around $50,000/year. Now I'm retired & my pension is about $24,000, still well above the lifeline "guideline". One caveat, I live in an area of San Jose where many of my neighbors are working-class, a few on welfare, etc. This scam might not work from an address in Hillsboro, Los Gatos, or Saratoga; but who knows, the PUC may be so incompetent and/or lazy that it might. Considering the moral factors, if you *don't* claim lifeline eligibility, then you are *charged* a few cents a month to pay for the people who *do*! You are also charged $1.75 for "access to a long distance carrier", even if you don't call long distance. (but lifeline customers get an offsetting credit and still have long distance access). So you have to choose to be a sheep or a wolf, a victim or a victimizer, to either take unfair advantage of the system or have it take unfair advantage of you; there is no middle ground. Consider the pragmatic factors. Based on my experience, the chances of getting "caught" seem remote. If I'm ever investigated, I plan to play dumb and claim I didn't understand the lifeline forms I signed. Since I didn't provide any false documentation of a low income (they didn't *ask* for any), be pretty hard to prove intent to commit fraud. So I expect the worst that could happen is that I'd have to pay some estimate of what my correct bill might have been less what I actually paid. I suspect there's a statute of limitations, which I've already exceeded for most of the time I've been on lifeline. So this sounds like a good bet. If you win, you win big; if you lose, you break even, with chances of losing being much less than 50/50.

1 0

Crypto Conference from Hell
by paul＠poboy.b17c.ingr.com 16 Jul '93

16 Jul '93

The attached message was originally posted in comp.dcom.telecom. I haven't contacted these people, but some 'punk in the DC area might be able to weasel in. Consider the list of speakers: - well-known (notorious) - Denning, Bidzos, Clint Brooks from NSA, Kammer from NIST - people we should be talking to - the mgr of AT&T's Secure Comm Systems division, that same division's chief scientist - Big Wheels - Rosenthal (chief counsel for SPA), Willis Ware, Jerry Berman. Fun for the whole family! -Paul Path: infonode!uunet!spool.mu.edu!telecom-request Date: Mon, 12 Jul 1993 16:26:13 -0500 From: Matthew Lucas <matt(a)telestrat.com> Newsgroups: comp.dcom.telecom Subject: Conference With Dorothy Denning: Encrypting Voice and Data Message-ID: <telecom13.468.1(a)eecs.nwu.edu> Organization: TELECOM Digest Sender: telecom(a)eecs.nwu.edu Approved: telecom(a)eecs.nwu.edu X-Submissions-To: telecom(a)eecs.nwu.edu X-Administrivia-To: telecom-request(a)eecs.nwu.edu X-Telecom-Digest: Volume 13, Issue 468, Message 1 of 9 Lines: 151 Conference Announcement: A TeleStrategies Conference with Dr. Dorothy Denning Encrypting Voice and Data: Strategies for the Future Aug. 3-4, 1993 Washington, DC Tuesday, August 3, 1993 8:30-9:00 Registration 9:00-10:30 CRYPTOGRAPHY OVERVIEW The basic concepts of cryptography and encryption, including single-key and publickey, authentication, digital signatures, key negotiation or distribution, and cryptanalysis (code breaking) will be introduced along with the Data Encryption Standard (DES), the RSA public-key system, and the Digital Signature Standard (DSS). The speaker will also discuss the need for encryption and the role of encryption in telephony and communications networks. Dr. Dorothy E. Denning, Professor and Chair of Computer Science, Georgetown University 10:30-10:45 Coffee Break 10:45-11:45 SURVEY OF ENCRYPTION PRODUCTS The speaker will survey commercial hardware and software products that contain encryption capabilities, including the types of products that are available, their relative strengths and weaknesses, and the major vendors. Jim Bidzos, President, RSA Data Security, Inc. 11:45-12:30 CELLULAR ENCRYPTION Cellular calls are especially vulnerable to eavesdropping. PrivaFone's approach, which is interoperable on cellular and land lines, will be described. Digital cellular standards that provide voice privacy and authentication for TDMA or CDMA technologies also will be discussed. Dr. Ming Lee, President, Synacomm Technology Charles Wistar, President, PrivaFone Corp. 12:30-1:45 Hosted Lunch 1:45-2:30 THE CLIPPER AND CAPSTONE CHIPS The Clipper and Capstone Chips are part of a new U.S. technology initiative to provide secure communications and legitimate law enforcement access through a key escrow system. The speakers will describe the initiative, the security functions provided by the chips, and the use of the Clipper Chip in the AT&T Telephone Security Device. William M. Agee, Manager, Secure Communication Systems - Government, AT&T Raymond G. Kammer, Acting Director, National Institute of Standards and Technology 2:30-3:00 BUSINESS CONCERNS WITH ENCRYPTION The speaker will give a snapshot of one computer security program and discuss business concerns with encryption, including practical needs and requirements, organizational constraints, operational concerns, security of the process, and balancing concerns and practical use. Randolph N. Sanovic, Manager of Computer Security Planning, Mobil Corp. 3:00-3:15 Coffee Break 3:15-4:00 USING CRYPTOGRAPHY TO ARCHITECT DISTRIBUTED OPEN SYSTEMS SECURITY: A CASE STUDY Securing networks and computers in a distributed environment presents several new challenges. The speaker will describe Bell Atlantic's enterprise-wide approach to architecting security in such an environment, showing how encryption fits into the design. Ravi Ganesan, Specialist, Security Research and Planning, Bell Atlantic 4:00-5:00 ENCRYPTION IN ELECTRONIC COMMERCE AND ELECTRONIC MAIL Encryption is becoming an integral tool for building secure applications. The speakers will discuss the use of encryption and digital signatures in Electronic Data Interchange (EDI) and Internet Privacy Enhanced Mail (PEM). Michael S. Baum J.D., Principal, Independent Monitoring Dr. Stephen D. Crocker, Vice President, Trusted Information Systems, Inc. 5:00-6:00 Reception Wednesday, August 4, 1993 8:30-10:30 CRYPTOGRAPHY POLICY IN THE U.S. The speakers will discuss the Clipper and Capstone chips, law enforcement needs and the Digital Telephony proposal, export and import of encryption products, international markets, industry growth and competitiveness, and individual privacy. They will also report on the national policy review in progress. Dr. Willis H. Ware, Chair, Computer Systems Security and Privacy Advisory Board (Moderator) Jerry Berman, Executive Director, Electronic Frontier Foundation Clinton C. Brooks, Special Assistant to Director, National Security Agency Alan R. McDonald, Special Assistant (Legal) to the Assistant Director, Technical Services Division, Federal Bureau of Investigation Ilene Rosenthal, General Counsel, Software Publishers Association 10:30-10:45 Coffee Break 10:45-11:30 CRYPTOGRAPHY IN THE EUROPEAN COMMUNITY In the European Community, government controls on cryptography differ across countries and affect achievement of secure open systems and, consequently, achievement of the Open Market and transborder electronic trading. The speaker will summarize the current situation in Europe, describe some of the initiatives to address the issues, and comment on the recent initiatives in the US. Christopher E. Sundt, Business Strategy Manager, ICL Secure Systems 11:30-12:15 THE FUTURE OF CRYPTOGRAPHY IN TELECOMMUNICATIONS Several fast-moving trends in telecommunications demand cryptographic solutions, including wireless transmission, multi-media conferencing, and electronic commerce. As broadcast and multiple access technologies are used increasingly for information transmission, and everyday business is carried out in "cyberspace," structures that ensure privacy, authenticity, and (often) anonymity must become part of the natural landscape. Dr. David P. Maher, Chief Scientist for AT&T Secure Communications Systems, AT&T For complete information call TeleStrategies Inc. at (703) 734-7050.

1 0

OPIN: PGP: When to sign keys
by edgar＠spectrx.Saigon.COM 16 Jul '93

16 Jul '93

-----BEGIN PGP SIGNED MESSAGE----- J. Michael Diehl wrote: I'm having a philosophical problem regarding when to sign someone else's public key. Obviously, if you watch someone generate a key, and they physically hand you a copy of it, you should sign it. Fortunately, life has been this good to me about 5 times. But what if life isn't so good? Lets say someone emails me a key and the return address matches that of the address in the key. Do I assume no one is spoofing me? Bad idea! The danger is not especially that the person you're talking to isn't who he says he is. Chances are you've never met him and never will. The danger is that a third person is intercepting messages and substituting his own keys. This allows him to monitor your encrypted traffic, which is what encryption is supposed to prevent. My own rule for signing keys is that there must be a key verification independent of the net. i.e. nothing received by e-mail can be depended on to verify a key. If you live any distance from the other person, the most economical method is by postal mail. I will sign keys when I receive a mailed photocopy of any "official" picture ID, along with a signed statement containing the key "fingerprint" (-kvc), which matches the fingerprint of a key received via e-mail. You can mail a letter anywhere in the world for less than $1.00. Any "spoofer" short of governments (at either end) or organized crime will have a hard time intercepting much less altering letter mail. Another possibility is a phone verification. The person who will be signing the key should call the owner of the key at a -listed- phone number (use the out-of-town phone books at the library, or check with information at (xxx)555-1212.) Don't rely on a phone number in e-mail; it could be the spoofer's. Once again, though, a government or OC could arrange to intercept/divert incoming phone calls. I also carry business-card-size pieces of paper with my name, net address, and key fingerprint, with me. I give them out at parties, or anytime I physically meet someone who is on the net. Person's receiving the paper can use it to verify that the key I send them via e-mail has the same fingerprint as on the paper. Ideally, anyone giving you such a card should also show you a driver's license or other picture ID, before expecting you to go home and sign his key. Phil Zimmerman has endorsed the idea of mail and phone verification; this is the main reason the key fingerprint feature was added to PGP. Phil signed my key based on a phone call. Based on mail verification I just signed a key from Taiwan! I've also signed two keys from Germany with mail verification. There are those (e.g. Perry Metzker) who think this standard is too loose. Opinions differ. -----BEGIN PGP SIGNATURE----- Version: 2.3.2/EWS iQCVAgUBLEThEt4nNf3ah8DHAQGJfgP/W85P6IEkGYkmKeFe/px0XPfMvDqTMWXA 5kJ2cTIDRdSbLqDh0VdMsUaAtDR2nkWJKCFRnXA+GEttXy31gPGq6bY/Q19U8dAq VzNHY0o2ldzrDmp77BQo2kqTapENvIxKkXFiFAATleoLt6hMAgfejRlci/uTfG7Z NoCwQVeac7c= =wwV4 -----END PGP SIGNATURE----- -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Cupertino, Ca

1 0

steganography
by TO1SITTLER＠APSICC.APS.EDU 16 Jul '93

16 Jul '93

In a previous message, which my VMS newsreader is too stupid to remember and can just barely quote, an Evil Genius For A Better Tomorrow, mike(a)egfabt.org, says he thinks that xor'ing 'x' over a message would help to hide the fact that it is cyphertext. Problem: If someone is looking for encrypted information, IDEALLY we would like steganographically for it to be unconditionally impossible to determine that a file is cyphertext w/o the key. (It is of course only computationally infeasible to guess the key, if we pick our cryptosystem right.) The suggestions that the Evil Genius makes could easily be defeated with an hour or two of programming using pieces of PGP's source, or ripem, or a little piece of software designed to tell whether a file is Dolphin Encrypted or Mailsafed. The resulting program could check hundreds of database files easily, probably in almost exactly the time required for an open, a single disk access, and a close on each file. For a steganographically strong code, the cyphertext must not be recognizable to its home program. This means, among other things, no CRC's, no MD5's, etc, intended to assure data integrity. This means no delimiter-structured files. (I think--I'm not absolutely sure on this one.) Every field in the file must be either fixed-length or have a number somewhere in it (in a format indistinguishable from the rest of the cyphertext) which tells its length. And every field, individually, must not be recognizable as something unusual. (For instance, no sending of large prime numbers in the clear, as they are very unlikely to appear in a random file.) The foregoing "field" stuff has to do with things like PGP, which have a message cyphertext, encrypted with a session key, and a session key, encrypted with a PKC, in the same message. (Possible several cyphertexts of the session key.) Oh, and it would be nice, though not essential, if a corruption in the file made it completely, rather than partially, nonsense when decrypted. This way you can't have a file with no use to the recipient used as evidence against them. The important qualifications seem to rule out any crypto package in current widespread use, don't they? Kragen, an ignorant crypto-wannabe

1 0