From: dat@ebt.com (David Taffs)
Date: Tue, 10 May 94 12:12:07 PDT
To: cypherpunks@toad.com
Subject: From Todays' RISKS column
Message-ID: <9405101910.AA09815@helpmann.ebt.com>
MIME-Version: 1.0
Content-Type: text/plain




I'm sending this because of the first item, but thought the rest were
relevant also, although I would assume that most c'p'ers would read
comp.risks anyway...


If you haven't seen it, be sure to check out the piece by EFFector
Online 07.08 and Digital Media, "Ever Feel Like You're Being Watched?
You Will..." -- see below for details...

...

from: RISKS-LIST: RISKS-FORUM Digest  Tuesday 10 May 1994  Volume 16 : Issue 04

----------------------------------------------------------------------

Date: 06 May 94 00:06:10 -0500
From: Dave.Leibold@f730.n250.z1.fidonet.org (Dave Leibold)
Subject: Secret elevator codes baffle Metro Toronto government

An article in _The_Toronto_Star_ on 5 May 1994 described secret codes which
are necessary to maintain elevators at Metro Hall, the building which houses
Metro Toronto municipal council and services. The elevators, made and
maintained by Schindler Elevator Corp., require secret password codes in order
to maintain them. This means that only Schindler staff can maintain the Metro
Hall lifts, and as such forced Metro Council to award a 10 year contract of
$3.5 million to Schindler. Meanwhile, Metro is also suing the building's
developer, Marathon Realty, to try to get the codes. Without the passwords,
elevator maintenance contracts cannot be given to a competing firm.

Metro Councillor Howard Moscoe wanted the Council to issue a $10 000
reward to the first person to successfully crack Schindler's Code.
This motion probably didn't get approval.

David Leibold       Fidonet 1:250/730  dave.leibold@f730.n250.z1.fidonet.org

------------------------------

Date: 09 May 94 06:31:56 EDT
From: "Mich Kabay [NCSA]" <75300.3232@CompuServe.COM>
Subject: Dartmouth prof spoofed

Here is some old news that was new to me:

According to the _Dartmouth Life_ newsletter (Feb 1994--I'm just clearing up
my in basket today), an article appeared in _The New York Times_ on 94.01.05
entitled "Confronting changing ethics of the computer age."

The unsigned article begins, "Hanover, N.H. -- Somebody in Prof. David
Becker's course on Latin American politics did not want to take the midterm
exam, so he or she used Dartmouth's innovative electronic mail network to
impersonate a department secretary and cancel the test.
     "At 11 o'clock on the night before the test in the Government 49 class, a
message flashed on students' computer screens.  Because of a family emergency,
the message said, Professor Becker would be unable to administer the midterm."

The article explains that half the class understandably failed to show up for
the test.  No one has been identified yet as the culprit.

The rest of the article talks about the extensive electronic mail system on
campus.  One of the key concerns of the unregulated network is the rapid
spread of rumours: "Late in August computer flashed an account of a woman
being raped while jogging near campus.  The message was intended as a warning,
but there had been no rape."

The Hanover police department were swamped with calls.  The Chief of Police now
has his own electronic mail account to try to squelch rumours.

M. E. Kabay, Ph.D. (Dartmouth '76) / Dir Educn / Natl Computer Security Assn.

------------------------------

Date: Mon, 9 May 1994 18:04:54 +0100
From: pcl@foo.oucs.ox.ac.uk (Paul C Leyland)
Subject: Re: Bellcore cracks 129-digit RSA encryption code (RISKS-16.03)

>   predicted would take "40 quadrillion years" to break.  ...

>   This mathematically arduous task was accomplished in eight months by
>   600 volunteers in 24 countries who used their organizations' spare
>   computing capacity.  ...

There are two risks, one amusing.  Ron Rivest now regrets ever making that 40
quadrillion years estimate.  It was silly when he made it; his papers in the
scientific literature from that era give estimates which are within an order
of magnitude of how much computation we actually used.  From those estimates,
and the observation that way back then it wasn't feasible to hook together
hundreds of computers, we can deduce that a late 70's supercomputer using the
best algorithms available then would have taken a few decades, maybe a
century.  Certainly much less than the 40 quadrillion years.  The risk is:
making predictions about the runtime of computer programs can sometimes make
you look silly 8-)

The other risk is more serious.  RSA is widely used to protect commercially
significant information.  512-bit keys are widely used for this.  Most, if not
all, smart-card implementations are restricted to 512-bit keys.  RSA-129 has
425 bits.  I estimate (taking a risk 8-) that 512-bit keys are only about 20
times harder to break than 425-bit keys.  Readers are left to draw their own
conclusions.  However, it is not by chance that I have a 1024-bit PGP key.

Oh yes, as Arjen Lenstra had pointed out: if you had used RSA-129 as
the modulus in a digital signature for a 15-year mortgage, you would
have been cutting it pretty fine.  It is the use of RSA for long-lived
signatures which needs to be examined with a very critical eye.

Paul Leyland (one of four RSA-129 project coordinators)

------------------------------

Date: Fri, 6 May 1994 02:45:26 +0200
From: Dik.Winter@cwi.nl
Subject: Re: Bellcore cracks 129-digit RSA encryption code

Perhaps because there is no risk beyond the known ones?  Bob Silverman of
MITRE (well known in number factoring circles) has publicly predicted already
some time ago that it would require about 5000 MIPS years to factor the
number.  Reasonably close to the actual figure.

That the team was led by Bell Communications Research is untrue.  It is a team
led by four people from Bellcore (Arjen Lenstra), MIT (Derek Atkins), Iowa
State University (Michael Graff) and Oxford University (Paul Leyland).

dik t. winter, cwi, kruislaan 413, 1098 sj  amsterdam, nederland, +31205924098
home: bovenover 215, 1025 jn  amsterdam, nederland; e-mail: dik@cwi.nl

------------------------------

Date: Thu, 5 May 94 20:02 PDT
From: paulb@teleport.com (Paul Buder)
Subject: Re: Bellcore cracks 129-digit RSA encryption code (RISKS-16.03)

I've heard this 40 quadrillion years figure a couple of times now and I
find it odd.  Is that what the Scientific American said?  I have the
original document from MIT's Laboratory for Computer Science.  It's
titled "A Method for Obtaining Digital Signatures and Public-Key
Cryptosystems" by Ronald Rivest, Adi Shamir, and Len Adleman, April
1977.  I can't do superscripting with vi so 10 10th means 10 to the
10th power.  It has the following table in it:

Digits        Number of Operations          Time
===================================================
50            1.4 X 10 10th                 3.9 hours
75            9.0 X 10 12th                 104 days
100           2.3 X 10 15th                 73 years
200           1.2 X 10 23rd                 3.8 X 10 9th years
300           1.5 X 10 29th                 4.8 X 10 15th years
500           1.3 X 10 39th                 4.2 X 10 25th years

200 digits was supposed to take 3.8 trillion years and 100 a mere 73.
So where does the 40 quadrillion figure come from?

paulb@teleport.COM  Not affiliated with teleport.

------------------------------

Date: 9 May 1994 15:26:52 GMT
From: daugher@cs.tamu.edu(Walter C. Daugherity)
Subject: White House May Issue National ID Cards

>From Prodigy 5/9/94:

White House May Issue National ID Cards

The Clinton administration is working on a national ID card that every
American would need in order to interact with any federal agency, reports
Digital Media: A Seybold Report, a computer industry newsletter based in
Media, Pa.

The so-called U.S. Card would be issued to citizens by the Postal Service.  It
would be issued as a "smart card," with its own internal CPU, or as a plug-in
"PCMCIA" card with megabytes of built-in memory.

Administration approval of the plan "could come at any time," states the
newsletter.

Walter C. Daugherity  daugher@cs.tamu.edu  uunet!cs.tamu.edu!daugher
Texas A & M University, College Station, TX 77843-3112  DAUGHER@TAMVENUS

   [Several folks sent me Mitch's piece from EFFector Online 07.08, and
   Digital Media, "Ever Feel Like You're Being Watched?  You Will..."  
   However, I cannot run it in RISKS because of its copyright notice.  
   Contact Mitch Ratcliffe <godsdog@netcom.com> (NOT RISKS) if you want 
   a copy of the whole article.  PGN]

------------------------------


-- 
dat@ebt.com (David Taffs)