- cypherpunks-legacy@lists.ogf.org

Violation of 3rd Amendment
by starr＠genie.slhs.udel.edu 19 Jun '93

19 Jun '93

I don't think it's correct to say that the 3rd amendment isn't violated. If you consider police forces standing armies and policemen soldiers, then the cases of confiscation of private homes under civil forfeiture for the occupation of cops constitutes violation of the 3rd amendment. The problem with this is that it takes some doing to persuade that police are standing armies and cops soldiers by different names. Tim Starr - Renaissance Now! Assistant Editor: Freedom Network News, the newsletter of ISIL, The International Society for Individual Liberty, 1800 Market St., San Francisco, CA 94102 (415) 864-0952; FAX: (415) 864-7506; 71034.2711(a)compuserve.com Think Universally, Act Selfishly - starr(a)genie.slhs.udel.edu

1 0

weak pseuodrandom number generator
by wet!naga 19 Jun '93

19 Jun '93

A pseudorandom number generator recently proposed here, namely: int rand1(int seedval) { return (seed * 183041 % 183319 + 1); } needs some cleaning up. It should be something like: unsigned long rand1(unsigned long n) { return ( ( ( n * 183041L) % 183319 ) + 1 ); } where n is initally set to some seed value. However, this is particularly weak, and quickly degenerates into a cycle, usually of length 208, as the following program will confirm: #include <stdio.h> #include <stdlib.h> unsigned long a[15000]; unsigned long rand1( unsigned long n ); void main(int argc, char **argv) { unsigned int i=0, j; if ( argc < 2 ) return; a[0] = atol(argv[1]); while ( ++i < 15000 ) { a[i] = rand1(a[i-1]); for ( j=0; j<i; j++ ) { if ( a[i] == a[j] ) { printf(" Cycle of length %d found.\n",i-j); return; } } } } unsigned long rand1( unsigned long n ) { return ( ( ( n * 183041L ) % 183319L ) + 1 ); } The other generator proposed is equally weak. This does not demonstrate that pseudorandom number generators cannot be used as a basis for strong encryption.

1 0

correction on pgp 2.3 problem
by Linda Boyd 19 Jun '93

19 Jun '93

Please forgive me! It seems that the signature generated by the pgp 2.3 _IS_ good (according to 2.2), in any form. It's just that pgp 2.3 will not read a signature that is appended to an ascii message and ascii armored. If the signature is in a separate file, or if it isn't armored, it will read it fine. Just not a message with the signature block attached to it... So the problem is in the reading of the pgp signature block, not in the generation of the signature. I'm not very adept at programming, but am trying to work my way through it to see if I can find the problem. Sorry for the previous mistake. Again, maybe this is just my machine... sean

1 0

The Computer Shopper cipher
by Tyler Yip - UnixWeenie 19 Jun '93

19 Jun '93

Compared to the lines of the Computer Shopper program, how would this variant evaluate out time-complexity wise? I'm not sure how sophisticated the attacks on pseudo-random generators are. This one includes an random generator shift, based upon the random numbers. ----------------------------------------------------------------------------- #include <stdio.h> static int seed; int rand1(int seedval) { return (seed * 183041 % 183319 + 1); } int rand2(int seed) { return (seed * 502001 % 502441 + 1); } void main(int argc, char *argv[]) { int current; FILE *input, *output; if (argc !=3) { fprintf(stderr, "Usage: %s input output\n", argv[0]); exit(1); } if ((input = fopen(argv[1], "rb")) == NULL) { fprintf(stderr, "Error opening inputfile %s\n",argv[1]); } if ((output = fopen(argv[2], "wb")) == NULL) { fprintf(stderr, "Error opening outputfile %s\n",argv[1]); } printf("Enter cipher key: "); seed = getc(stdin); current = fgetc(input); while(!feof(input)) { fputc(current ^ seed, output); current = fgetc(input); if (seed && 8) { seed = rand1(seed); } else { seed = rand2(seed); } } fclose(input); fclose(output); } -- Tyler Yip, UnixWeenie(tm) \ God put me on Earth to accomplish a certain email: davros(a)ecst.csuchico.edu \ number of things. Right now I am so far California State University, Chico \ behind I will never die. -Calvin & Hobbes

1 0

PGP 2.3
by Linda Boyd 19 Jun '93

19 Jun '93

Help!! I don't have Usenet access, so I can't post this on the pgp newsgroup, and this is the only other place I know of to ask this... I just got pgp23.zip and pgp23src.zip from soda, and I can't make it give valid signatures with the -a option (well, actually the Armor=on line in the config.txt file)! It will work correctly if Armor=off, and if the file is also encrypted, but a straight signature with ascii armor appended to the message doesn't work. Even pgp22 gives me an invalid signature "doesn't match contents" message! Has anyone else had this problem with 2.3? I've even re- compiled with Borland C++ 3.1, and get the same problem. sean

1 0

backpack left at Cygnus
by Brendan Kehoe 19 Jun '93

19 Jun '93

There's a steel blue backpack in my office here at Cygnus; it's got "Kahn on Codes" in it. If it's yours, drop me a line and we can figure out a way for you to get it. Brendan -- Brendan Kehoe brendan(a)cygnus.com Cygnus Support, Mountain View, CA +1 415 903 1400 ``Ya know Quaker Oats make you feel good twice?'' Hmm.

1 0

Re: Software infrastructure
by karn＠qualcomm.com 19 Jun '93

19 Jun '93

I'm just catching up on a very large mail backlog (much of which is Cypherpunks). Many Cypherpunks are apparently unaware of the security work going on within the Internet Engineering Task Force (IETF). Besides the infamous Privacy Enhanced Email (PEM), there are lesser known groups working on application layer security interfaces and on IP-level security (encryption and/or authentication of individual IP datagrams). Okay, I'm not saying all this work is being done right. In some cases it's not being done at all (or very slow progress is being made). In my opinion, the situation is ripe for some highly motivated Cypherpunks to read the stuff that's already been published (available from the standard FTP repositories like nic.ddn.mil) digest and critique it, and either implement the ideas that have been proposed or do them better yourself. But you should really be aware of what other work is going on in these areas before you reinvent the wheel. My personal interests and preferences lie in doing security at the IP layer. It doesn't solve all problems, but it is an approach that has been almost totally unexplored until now. And with the ever-increasing use and availability of low-cost dialup SLIP/PPP connections as an alternative to dumb terminal emulators and UUCP, I think it's a powerful technique. But I just don't have as much time to work on this as I'd like, and it would really be nice to find others to help in the effort. Phil

1 0

Re: Helping from Canada re Clipper
by Phil Karn 19 Jun '93

19 Jun '93

>Another argument the U.S. government is making is that they surveyed >encryption policy in various countries and "it's not beyond the pale >to limit domestic encryption -- France does it, for example". Is this an actual Administration quote? If so, they're playing with fire because France is the very same country that the US has recently accused of using its national security apparatus to spy on foreign corporations. It shouldn't be too hard to draw a link between these two policies that would cause this particular quote to blow up in the Administration's face. Phil

1 0

Re: Blasting Bidzos Blather
by fnerd＠smds.com 18 Jun '93

18 Jun '93

Let's see if I understand L. Detweiler's recent comments: 1) PKP licensed key exchange for use with Clipper and DSS. Clipper and DSS are bad. Therefore PKP is "supporting, nay, *promoting* and *profiting* from" DSS and Clipper. a) "supporting, nay, *promoting*"--this is not good publicity against Clipper and DSS. Therefore PKP is our enemy. b) "*profiting from*"--this is dirty money, therefore PKP is dirty and we can't trust them. 2) They did it "at no additional charge." (Someone please explain relation to 1b, above.) Therefore they must be receiving some other compensation behind our backs. Therefore they're bad guys and we shouldn't trust them. 3) Bidzos says they don't dictate terms, yet their licenses DO have terms. Therefore he is lying, should not be trusted, etc. 4) They should have refused to license bad uses of "their" technology, but they didn't. Therefore they're bad, etc. Have I got that right? -fnerd quote me

1 0

Re: Blasting Bidzos Blather
by fnerd＠smds.com 18 Jun '93

18 Jun '93

> Oh, here goes another Big Bad Corporation abusing our rights...! Well, are > there any Libertarians out there who will please speak up for the right of > Bidzos & co to earn a legal profit any way they see fit...? I'm a libertarian. I happen to be a type of libertarian who doesn't believe in patents. So I think nobody has a "right" to use government (or any force) to enforce their patents. BUT, many people believe patents are okay, and many feel they do have a right to enforce their patents. I think the RSADSI/PKP people are like this. It's a perfectly common belief. So except for the whole patent issue, (including the validity of their particular patents), I think they have a right to sell or not sell licenses to anyone they choose. BUT, to libertarians there's a big distinction between "You have a right to..." and "It's right for you to..." It's possible they're acting within their rights (with the exception noted above) and yet doing something wrong or evil. BUT, in this case I'm not sure whether what they're doing is particularly wrong, although I haven't seen a good case one way or the other. -fnerd quote me

1 0