Re: Schneier on Bernstein factoring machine
On Tue, 16 Apr 2002, Anonymous wrote: >Bruce Schneier writes in the April 15, 2002, CRYPTO-GRAM, >http://www.counterpane.com/crypto-gram-0204.html: > >> But there's no reason to panic, or to dump existing systems. I don't think >> Bernstein's announcement has changed anything. Businesses today could >> reasonably be content with their 1024-bit keys, and military institutions >> and those paranoid enough to fear from them should have upgraded years ago. >> >> To me, the big news in Lucky Green's announcement is not that he believes >> that Bernstein's research is sufficiently worrisome as to warrant revoking >> his 1024-bit keys; it's that, in 2002, he still has 1024-bit keys to revoke. > >Does anyone else notice the contradiction in these two paragraphs? >First Bruce says that businesses can reasonably be content with 1024 bit >keys, then he appears shocked that Lucky Green still has a 1024 bit key? >Why is it so awful for Lucky to "still" have a key of this size, if 1024 >bit keys are good enough to be "reasonably content" about? Because Lucky Green is a well-known paranoid who has no business requirement to put up with second-class crypto for the sake of compatibility and can reasonably control other methods of accessing his important stuff. Conversely, your typical businessman has few or no business secrets not known to at least half-a-dozen employees and after trusting that many people, better crypto would add essentially nothing to the businessman's security. For a handy metaphor, you can think of a kilobit-keyed cipher as a potentially weak link in Lucky's security (worth the attention) and probably the strongest link in a typical businessman's security (not worth the attention). Bear - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
Re: Schneier on Bernstein factoring machine
Anonymous <[EMAIL PROTECTED]> writes: > Bruce Schneier writes in the April 15, 2002, CRYPTO-GRAM, > http://www.counterpane.com/crypto-gram-0204.html: > > > But there's no reason to panic, or to dump existing systems. I don't think > > Bernstein's announcement has changed anything. Businesses today could > > reasonably be content with their 1024-bit keys, and military institutions > > and those paranoid enough to fear from them should have upgraded years ago. > > > > To me, the big news in Lucky Green's announcement is not that he believes > > that Bernstein's research is sufficiently worrisome as to warrant revoking > > his 1024-bit keys; it's that, in 2002, he still has 1024-bit keys to revoke. > > Does anyone else notice the contradiction in these two paragraphs? > First Bruce says that businesses can reasonably be content with 1024 bit > keys, then he appears shocked that Lucky Green still has a 1024 bit key? > Why is it so awful for Lucky to "still" have a key of this size, if 1024 > bit keys are good enough to be "reasonably content" about? I see no contradiction at all. Bruce believe that Lucky is one of "those paranoid enough" that "should have upgraded years ago". In other words, Bruce is surprised that Lucky didn't already upgrade to a key larger than 1024 bits, due to his "paranoia". No offense meant, Lucky... -derek -- Derek Atkins Computer and Internet Security Consultant [EMAIL PROTECTED] www.ihtfp.com - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
Re: Schneier on Bernstein factoring machine
> Does anyone else notice the contradiction in these two paragraphs? > First Bruce says that businesses can reasonably be content with 1024 bit > keys, then he appears shocked that Lucky Green still has a 1024 bit key? "The big news is" does not mean the same as "I'm shocked that". He appears to agree with Lucky Green's decision to keep 1024 bit keys up until now despite the prediction some years ago that 1024 bit keys would only be safe until sometime between 2000 and 2002. If you accept the table as being a reasonable prediction at the time it was made, the "big news" is that someone like Lucky Green has continued to consider 1024 bits safe up to now. -- sidney - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
Re: Schneier on Bernstein factoring machine
On Tue, Apr 16, 2002 at 08:44:06PM +0200, Anonymous wrote: > Bruce Schneier writes in the April 15, 2002, CRYPTO-GRAM, > http://www.counterpane.com/crypto-gram-0204.html: > > > But there's no reason to panic, or to dump existing systems. I don't think > > Bernstein's announcement has changed anything. Businesses today could > > reasonably be content with their 1024-bit keys, and military institutions > > and those paranoid enough to fear from them should have upgraded years ago. > > > > To me, the big news in Lucky Green's announcement is not that he believes > > that Bernstein's research is sufficiently worrisome as to warrant revoking > > his 1024-bit keys; it's that, in 2002, he still has 1024-bit keys to revoke. > > Does anyone else notice the contradiction in these two paragraphs? > First Bruce says that businesses can reasonably be content with 1024 bit > keys, then he appears shocked that Lucky Green still has a 1024 bit key? > Why is it so awful for Lucky to "still" have a key of this size, if 1024 > bit keys are good enough to be "reasonably content" about? > My read of this is not that Bruce thought Lucky silly for having 1024-bit keys, but rather that *if* Lucky has had them until now, it shows that they aren't really old-hat, thrown out by every half-sensible cryptographer years ago, that in fact it's reasonable to assume they're still "reasonably" secure (for some definition of "reasonably"). I have no idea if that's what Bruce intended, but that's how I took it. Regards, Jeremey. -- Jeremey Barrett [[EMAIL PROTECTED]]Key: http://rot26.com/gpg.asc GnuPG fingerprint: 716E C811 C6D9 2B31 685D 008F F715 EB88 52F6 3860 - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
RE: Schneier (and RSA) on Bernstein factoring machine
> Anonymous[SMTP:[EMAIL PROTECTED]] > > Bruce Schneier writes in the April 15, 2002, CRYPTO-GRAM, > http://www.counterpane.com/crypto-gram-0204.html: > > > But there's no reason to panic, or to dump existing systems. I don't > think > > Bernstein's announcement has changed anything. Businesses today could > > reasonably be content with their 1024-bit keys, and military > institutions > > and those paranoid enough to fear from them should have upgraded years > ago. > > > > To me, the big news in Lucky Green's announcement is not that he > believes > > that Bernstein's research is sufficiently worrisome as to warrant > revoking > > his 1024-bit keys; it's that, in 2002, he still has 1024-bit keys to > revoke. > > Does anyone else notice the contradiction in these two paragraphs? > First Bruce says that businesses can reasonably be content with 1024 bit > keys, then he appears shocked that Lucky Green still has a 1024 bit key? > Why is it so awful for Lucky to "still" have a key of this size, if 1024 > bit keys are good enough to be "reasonably content" about? > Anonymous is missing the joke here. Bruce suggests that ordinary non-paranoid users (here represented as 'businesses') should feel reasonably content with 1024 bit keys, but 'military institutions and those paranoid enough to fear them should have upgraded years ago'. So, we have three categories of users: 1. businesses (ie, 'ordinary users) 2. Military institutions. 3. The paranoid (whether justified or not). Well, Lucky's not a business, and he's certainly not a military institution (despite his fondness for ordinance). What does that leave? Most of us who know him got a little chuckle out of this. For RSA's 'official' position on this issue, take a look at: http://www.rsasecurity.com/rsalabs/technotes/bernstein.html If there's a call for it, I'll post the whole text so you can read it without visiting our site (it's not too long). Peter Trei RSA Security - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
Re: Schneier on Bernstein factoring machine
> > Businesses today could > > reasonably be content with their 1024-bit keys, and military institutions > > and those paranoid enough to fear from them should have upgraded years ago. > > > > To me, the big news in Lucky Green's announcement is not that he believes > > that Bernstein's research is sufficiently worrisome as to warrant revoking > > his 1024-bit keys; it's that, in 2002, he still has 1024-bit keys to revoke. > > Does anyone else notice the contradiction in these two paragraphs? > First Bruce says that businesses can reasonably be content with 1024 bit > keys, then he appears shocked that Lucky Green still has a 1024 bit key? > Why is it so awful for Lucky to "still" have a key of this size, if 1024 > bit keys are good enough to be "reasonably content" about? No contradiction at all. "[M]ilitary institutions and those paranoid enough to fear from them should have upgraded years ago." Anyone paranoid enough to think Bernstein's back-of-the-very-large-envelope calculation makes a 1024-bit key insecure should have already been concerned enough to think that SOMEthing would do so. - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
Schneier on Bernstein factoring machine
Bruce Schneier writes in the April 15, 2002, CRYPTO-GRAM, http://www.counterpane.com/crypto-gram-0204.html: > But there's no reason to panic, or to dump existing systems. I don't think > Bernstein's announcement has changed anything. Businesses today could > reasonably be content with their 1024-bit keys, and military institutions > and those paranoid enough to fear from them should have upgraded years ago. > > To me, the big news in Lucky Green's announcement is not that he believes > that Bernstein's research is sufficiently worrisome as to warrant revoking > his 1024-bit keys; it's that, in 2002, he still has 1024-bit keys to revoke. Does anyone else notice the contradiction in these two paragraphs? First Bruce says that businesses can reasonably be content with 1024 bit keys, then he appears shocked that Lucky Green still has a 1024 bit key? Why is it so awful for Lucky to "still" have a key of this size, if 1024 bit keys are good enough to be "reasonably content" about? - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
Black Mac
http://www.wired.com/news/print/0,1294,51670,00.html A Top-Secret, One-of-a-Kind Mac By Leander Kahney 2:00 a.m. April 15, 2002 PDT In a drafty shed in rural northern California is perhaps the rarest Macintosh ever made: an electronically shielded Mac used by a spy or military agency. The machine appears to be unique, and is so secret, no one knows anything about it. Sitting on a dusty shelf in an old Boulder Creek, California, barn owned by programmer and author Bruce Damer, the Macintosh SE 30 1891 ST at first appears to be a standard all-in-one Mac from the mid-1980s. But instead of the regular plastic case, the 1891 ST has an all-metal enclosure that has been "Tempest shielded" to prevent it from being snooped on. Tempest shielding is a standard form of electromagnetic protection defined by the U.S. government for protecting computing equipment from spies. The shielding prevents computers and monitors from emitting electromagnetic signals that can be used to reconstruct sensitive information. Tempest shielding is not new, and there are a number of companies that add Tempest shielding to Windows PCs for agencies like the National Security Agency, CIA or Department of Defense. Tempest shielding is also used by corporations to prevent industrial espionage. The 1891 ST is by no means the only Tempest-shielded Mac. A company called TechMatics Technologies used to sell a Tempest-shielded Mac Plus. But the 1891 ST does appear to be the only Tempest-shielded Mac made by Apple; and Damer appears to have the only one. "It's a black Mac," said Damer, in reference to the black helicopters used by shady government agencies. "We don't know who used it -- the CIA, the Department of Defense -- or where it came from." Unlike many other Tempest-shielded computers, the Black Mac looks like an ordinary computer, a move that may have been intentional so as not to attract attention. But its innocent-looking beige metal case is in fact a Faraday Cage, a metal mesh that stops it from radiating electromagnetic signals. It has a flip-down panel on the front for a Bernoulli drive -- a removable drive common at the time. "The operative could take everything with him at all times," Damer explained. The opening for the drive is also protected by an emissions-busting ring of copper coils. Unfortunately, the motherboard of the Black Mac has been removed. So has the panel at the back housing shielded connectors for keyboard, mouse and networking. Damer plans to display the Black Mac in his private computer museum, the DigiBarn Computer Museum, due to open in July. The DigiBarn will be housed in a converted barn on Damer's farm, located just over the Santa Cruz Mountains from Silicon Valley. Very little is known about the Black Mac. As far as Damer knows, the Black Mac is undocumented. There's no record if it anywhere. Apart from the model number on the front, there are no identifying markings or serial numbers. Damer, who is well-connected in Silicon Valley, has made extensive inquiries about the Black Mac, to no avail. "It's the rarest Mac in the world," Damer said. "This is the only one known. There's no evidence of any other existing machines out there. There's no record of it at Apple. But it's a real Apple machine -- it wasn't made or adapted by another company -- so it must have been a classified project." Damer said there may well be others, but he has no idea where they'd be. Damer was given the machine by Greg Wassmann, a former employee of the legendary Weird Stuff Warehouse, a computer junk shop in Sunnyvale, California, that acts as a clearinghouse for companies all over Silicon Valley. Wassmann also said he has no idea where it came from. "It was just sitting there on a pallet," he said. "I'm a Mac nut. I wanted it because it was weird. The owner sold it to me for $5, and I gave it to Bruce for his museum." Requests for comment at Apple have not yielded a response. And a number of Mac experts and historians are unable to shed any light on the Black Mac. "Unfortunately, I don't know anything about the Black Mac," said Alex Soojung-Kim Pang, principal author of Making the Macintosh, Stanford University's history of the Mac. "I've never heard of this Mac and suspect it was a prototype or after-market alteration, because it doesn't appear in any literature from Apple that I've ever seen," said Owen Linzmayer, author of Apple Confidential, an Apple history. "I was actively covering all things Macintosh during the 1986 to '87 time period, and I'm sure I would have remembered this unit had it ever been officially released." Dan Knight, publisher of the Low End Mac, was familiar with Tempest-shielded PCs but had never come across a shielded Mac. Hal Layer, a professor emeritus at San Francisco State University and the owner of the only Tempest-shielded Mac documented on the Net, was also unfamiliar with the 1891 ST. Unlike the Black Mac, which was made by Apple, Layer's TPI-863 was an after-market mo
