- cypherpunks-legacy@lists.ogf.org

Re: DES
by hkhenson＠cup.portal.com 27 Feb '93

27 Feb '93

My take on breaking DES would be to just try all 2**56th keys on a massively parallel machine, though there may be better approaches. Keith

4 3

timestamps and signatures
by root＠rmsdell.ftl.fl.us 27 Feb '93

27 Feb '93

> ||use electronic ... public-key signatures, the kind that make it impossible > ||for one to deny having signed something. ^^^^^^^^^^^^^^^^^^ > ||^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > | Nice theory, but too simple. > | I can always deny signing something by claiming that my private key was > | compromised. I can even deliberately let it be known, if it's important > There's some very nice work by two people at Bell Labs (whose names I can't One of them is Stuart Haber (stuart(a)bellcore.com) > unforgeable digital timestamps. This is a much trickier problem than it firs > appears to be, but they have a nice solution. It's not too complicated. Basically, what you do is produce a hash of your text, and publish it widely in a medium that is being archived, and likely to be accessible and authenticable at a later time, for example by posting it in a classified ad in a large newspaper. Later, when verifying the timestamp one can get a copy of that newspaper from a library (or from several libraries, for greater security) and compare the published hash with that of the text. For greater efficiency, there's a simple way to combine a lot of messages and produce only one hash which is published. The information you get back and store as a part of the timestamp is enough to prove that this particular hash was one of the many combined to produce the published value. This system is actually operating, look in any Sunday New York Times in the Business Classifieds. > Given timestamps, we can then require that messages be not just > signed but dated. If my key becomes compromised, I revoke all > my signatures from some time on. By looking at the timestamp > that goes with the signature, we can determine whether it was > created before or after the compromise, and discard it if "after". Once can always claim that they "just found out" that their key has been compromised a year ago, and so deny having signed that signature. -- Yanek Martinson yanek(a)novavax.nova.edu

1 0

DES chips
by root＠rmsdell.ftl.fl.us 27 Feb '93

27 Feb '93

> Speaking of which, does anyone know who makes "the DES chip" (is > there more than one?)? I'd like to find a data sheet for it. There's no such thing as "the DES chip". "Since publishing the Data Encryption Standard, NBS has validated 45 (as of May 7, 1991) hardware and firmware implementations. Approximately three implementations are validated each year. The list of companies with validated chips is quite varied. It contains very small companies as well as many of the large U.S. electronics corporations. The implementations range from firmware programmable read-only memories (PROMs), which implement only the basic DES algorithm, to electronic chips that provide several different modes of operation running at speeds up to 45 million bits per second." ... "Hardware implementations of DES are widely available in the United States at prices under $100; DES encryption boards that can encrypt stored and transmitted data in a personal computer are available for under $1000; and stand-alone encryption units may be purchased for under $3000." (This is from "The Data Encryption Standard, Past and Future" by Miles Smid and Dennis Branstad, first appeared in Proceedings of the IEEE, vol. 76, no. 5, May 1988) I'm sure that since this was written the number of implementations has increased, the prices decreased, and the speeds increased. -- Yanek Martinson yanek(a)novavax.nova.edu

1 0

Re: more ideas on anonymity
by George A. Gleason 26 Feb '93

26 Feb '93

John, I missed where I might have been advocating censorship... maybe it's so late at night that my logic filter is getting fuzzy... Of course one can't see the content of an encrypted anonymised message, but the case I'm concerned with here is where someone receives an encrypted threat message or some such, and wants it traced. In that case there ought to be some means. I'm speaking from recent experience, having received what the Berkeley PD considered a credible death threat on my answering machine last week... Okay, maybe your point hinges on the "advocating violent acts" item. Well this is a pretty tight issue: hard to differentiate between someone advocating insurrection, advocating race war, and advocating going out in your own neighborhood and killing (whoever). Either way it is advocacy of violence against someone. And I honestly don't have a simple answer to that one. The main point I was trying to go for is pretty unambiguous, that direct threats of violent actions are much more significant than for instance advocacy of committing some victimless crime or another... but that's a dull-obvious one compared to the advocating violence item. Somehow I believe we're going to need to consider the threats & violence questions sooner or later, if for no other reason than to have some solutions at hand when it happens and people start clamoring for restrictions on public access to crypto and anonymity. (jeez my writing is a mess at this hour!) -gg

2 1

subscribe
by Coyote Jack 26 Feb '93

26 Feb '93

subscribe cjack(a)mead.u.washington.edu

1 0

Re: more ideas on anonymity
by Hal 26 Feb '93

26 Feb '93

I want to add to John Gilmore's point about the practical difficulty of controlling anonymous postings and mailings if you are going to allow them at all. Johan is taking a very principled position by promising not to reveal true identities behind the pseudonyms. Instead, he offers to warn abusers, and if problems continue, to block their access to the service. Unfortunately, as more remailer sites develop, this tactic may become ineffective. It will be possible to chain remailers together in different ways, so that the effect is that you can post through Johan's system from many different addresses. With multiple remailers and chaining there is no way for the final remailer in the chain to know when two messages are coming from the same person. This will mean that it will not, in practice, be possible to block access for a given user. We discussed this earlier in the context of anonymous email. I had received a complaint from a young lady about receiving some offensive anonymous mail through my remailer. (This story was resolved surprisingly, BTW: it turned out that it was a joke message sent by a good friend of hers, someone who knew one of the Cypherpunks and who knew about the remailers. So she is no longer upset about the message at all. But I didn't know this at the time.) Realizing that it would not be practical to do source blocking, my suggestion was to implement destination blocking: no mail from my remailer would go to this person. Eric Messick expanded upon this idea recently so that only people who had actually requested anonymous mail would receive it. (A variation would be to first send a note to a person saying, "I have some anonymous mail for you; please reply within 48 hours if you'd like to receive it, otherwise it will be deleted.") Other variations upon this approach could help to keep anonymous remailers politically acceptable. But the idea doesn't generalize well to anonymous posting, except to do as Johan has done and forbid posting to certain newsgroups (sci.*, news.*, I'm not sure what else). This throws out the good postings along with the bad, though. I think the bottom line is that it will be difficult to provide anonymous/pseudonymous postings in a way which won't elicit the kinds of strong objections Johan has been facing. His controls are OK for now, but in the long run I think they won't work. What would happen if Johan just started ignoring the objectors? What if he stopped reading his mail for a while and left the service operating? Would his newsfeed eventually get cut off by Finnish authorities goaded into action by email complaints? Are there ANY sites in the world which would be immune to such pressures? I read that at the Hacker's Conference, the owner of Portal offered to run a remailer. Would he be able to stand up to these pressures? How about John Gilmore's machine? He made a powerful argument recently that he was not subject to various restrictions. Would it be possible to run a remailer there, perhaps based on Johan's code, which simply ignored complaints and allowed anonymous postings to all groups? Hal Finney

2 1

DES
by John.Nieder＠f33.n125.z1.FIDONET.ORG 26 Feb '93

26 Feb '93

* Reply to msg originally in Cypherpunks <INET> marc(a)Athena.MIT.EDU (Marc Horowitz) writes: BK> I also believe that nobody's security is perfect, and that if BK> something as big as DES was broken, even at the NSA, we would have BK> heard about it. If the world banking industry trusts DES for their BK> trillions of dollars a day, I'm willing to trust it for my little, BK> insignificant messages. I'm surprised that you haven't had 53 replies to this already, but in that you haven't I suppose I ought not let this go by unchallenged. In a _MicroTimes_ article by Jim Warren of the EFF, the unreliability of DES was discussed at length. In a nutshell, Marty Hellman of Stanford broke the "unbreakable" 54-bit DES _prior to its adoption as a standard_. He promoted the idea of a 64-bit DES instead, but was _opposed by the NSA_ for reasons we can all speculate upon at length. This opposition is the basis of the rumors (?) of DES being backdoored by the NSA. The upshot was that DES was adopted _after_ being demonstrably compromised. The postscript to this is that Hellman's proposed "unbreakable" 64-bit DES variant was later cracked as well. The post-postscript is an apocryphal story I personally got from an Israeli communications tech and minor spook. He claimed that DES was broken by the cryptanalytic arm of Israeli intelligence _in two hours_. It is relatively certain that a DES-encrypted cyphertext can be easily decrypted by well-equipped agencies. Whether decryption is now trivially accomplished by private parties is another question. JN ... "He isn't my president & these aren't my people." --- Blue Wave/Opus v2.12 [NR] -- John Nieder - via FidoNet node 1:125/555 UUCP - ...!uunet!hoptoad!kumr!fidogate!33!John.Nieder INTERNET - John.Nieder(a)f33.n125.z1.FIDONET.ORG

2 1

Re: dispatches from the front lines of anonymity
by John.Nieder＠f33.n125.z1.FIDONET.ORG 26 Feb '93

26 Feb '93

* Reply to msg originally in Cypherpunks <INET> julf(a)penet.FI (Johan Helsingius) writes: BK> Penet.fi will be PGP:s as soon as I get PGP running reliably on the BK> Interactive UNIX system I use. This weekend, I hope... But if you all BK> keep coming up with other new features I have to add, I don't know how BK> long it's going to take. It must seem a thankless task sometimes, I'm sure. One thing I noticed about penet.fi's processing of messages is that it at least scrapes off the trailing addresses automatically tacked on at the end of every outgoing message leaving all Fido BBSs. A test message sent via the babani remailer arrived anonymously, but with all three lines of the address footer (see below) attached. Hardly anonymous... > Yes, and preferably at a site outside the US, just for good measure. > There is an obvious appeal to having servers outside the jurisdiction of > American law-enforcement busybodies. BK> Yeah, seems that (and the fact that I have 100% control not only of BK> the site but of the network as well) is what has kept anon.penet.fi up BK> this long... Yes, and don't think that we don't appreciate your efforts! JN ... Criticism is nothing but a mild form of envy. --- Blue Wave/Opus v2.12 [NR] -- John Nieder - via FidoNet node 1:125/555 UUCP - ...!uunet!hoptoad!kumr!fidogate!33!John.Nieder INTERNET - John.Nieder(a)f33.n125.z1.FIDONET.ORG

1 0

archives
by corwin＠Cayman.COM 26 Feb '93

26 Feb '93

Is there an archive for this list? thanx, corwin

2 1

Was: Poor man's anon server ...
by Anonymous＠cs.Buffalo.EDU 26 Feb '93

26 Feb '93

There was a mention uptopic of ANI "demo" numbers. Anyone have one of them kicking about?

1 0