November 2002 - cypherpunks-legacy

Don`t Miss Out: Name your price with NO obligation to buy!
by Great Deals 08 Nov '02

08 Nov '02

1 0

RE: Did you *really* zeroize that key?
by Patrick Chkoreff 08 Nov '02

08 Nov '02

>From: "James A. Donald" <jamesd(a)echeque.com> >... >If the optimizer ever optimizes away a write to volatile >memory, device drivers will fail. Most device drivers are >written in C. If anyone ever produces a C compiler in which >"volatile" does not do what we want, not only are they out of >spec, but smoke will start coming out of hardware when the >device drivers are recompiled. Good point #1. Excellent point, in fact. >From: "Dave Howe" <DaveHowe(a)gmx.co.uk> >... >Yup, granted. >however, saying after a security breach "this wasn't my fault, the compiler >was out of spec" isn't going to help much. >in the real world, murphys law applies more often than anyone elses; you can >virtually guarantee you will meet up *sometime* with an out of spec compiler >... Good point #2. Excellent point, in fact. So, given 1 and 2, it sounds like a good strategy might be: a. Declare your sensitive variables volatile and zero them normally. b. Check the assembler output because you have to do that anyway :-) c. If (b) exposes an out-of-spec compiler, report it far and wide to all available e-mail lists. Then preferably use a different compiler. If that's not an option, try the va_list trick and go to (b). -- Patrick http://fexl.com

1 0

[Anonymity, Blacknet, Mil secrecy] Photos in transport plane of prisoners
by Major Variola (ret) 08 Nov '02

08 Nov '02

Note that the Cypherpunks Image/Postscript Document Examination Laboratories should be able to amplify some of the (US; the unPOWs are black-bagged) faces in the pix.. Pentagon Seeks Source of Photos By PAULINE JELINEK Associated Press Writer WASHINGTON (AP)--The Pentagon was investigating Friday to find out who took and released photographs of terror suspects as they were being transported in heavy restraints aboard a U.S. military plane. Four photographs of prisoners--handcuffed, heads covered with black hoods and bound with straps on the floor of a plane _ appeared overnight on the Web site of radio talk show host Art Bell. ``Anonymous mailer sends us photos taken inside a military C-130 transporting POWS,'' the headline said. http://www.ocnow.com/news/newsfd/shared/news/ap/ap_story.html/Washington/AP…

1 0

Re: Did you *really* zeroize that key?
by Sunder 08 Nov '02

08 Nov '02

> Back in the early days of compiler benchmarks, one fancy compiler noticed > that the result of a lengthy calculation wasn't being used, and dutifully > removed the calculations. That calculation was, of course, the kernel of > the benchmark. The solution was to print the result. Or you do something like using binary OR from both ends of the memory chunk simultaneously, so when they finish, you're guaranteed to have 0xff (all 1's) all over your memory. This is off the top of my head, so bugs may exist, etc. int zapmem(uint8 *mem, size_t size) { int i,j,a,b; for (a=0xaa,b=0x55,i=0, j=size-1; i<size, i++,j--) { a|=mem[i]; mem[i]=a; b|=mem[j]; mem[j]=b; } return a|b; } At the end of the loop, mem will be 0xff. Why? Because we use OR, and since one half is using 010101 and the other half is using 10101010, as i,j pass each other and OR themselves, you're guaranteed to have 0xff (11111111) as output. You could also use 0xf0 and 0x0f or any other complementary values for the initial a and b values. There's a return value, the compiler has to return it, and thus can't easily optimize it out. I don't think there exist smart compilers that will figure out what this does - if you can write such a compiler that can figure out what you indend in all cases, you will be a very rich man. Of course if some compiler writer decides to make the above a special case and optimize it out, all bets are off.

1 0

RE: Did you *really* zeroize that key?
by Gil Hamilton 08 Nov '02

08 Nov '02

Peter Gutmann writes: >"James A. Donald" <jamesd(a)echeque.com> writes: > > >If the optimizer ever optimizes away a write to volatile > >memory, device drivers will fail. Most device drivers are > >written in C. If anyone ever produces a C compiler in which > >"volatile" does not do what we want, not only are they out of > >spec, but smoke will start coming out of hardware when the > >device drivers are recompiled. > >The people who assume that any compiler which compiles their code gets >an obscure feature like volatile exactly as per the spec are probably the >same ones who assume that fixed-size buffers will never be exceeded. I don't understand this extraordinary level of concern As both James and Perry have tried to point out, 'volatile' is *not* an obscure feature. Maybe it was obscure back in the mid-1980s, but every C compiler I've seen in years supports volatile. Its behavior has been part of the C std for a long time now, and it's a critical part of a large body of code on pretty much every platform. It's interesting that you bring up the subject of "fixed size buffers" being overrun. That also results from ignorance and carelessness on the programmer's part *not* from incorrect compiler implementation. >It's my job to be paranoid. I will assume that an arbitrary compiler >gets a while() loop right (it'd be obvious if it didn't), but I won't >gamble my crypto keys over assumptions about the correct handling of >volatile in all compilers. It sounds like the problem is more a lack of understanding of what 'volatile' means. Nowhere in this thread (or from what I can tell, the thread on vuln-dev) has anyone alleged that an actual compiler didn't handle 'volatile' correctly. - GH _________________________________________________________________ The new MSN 8: smart spam protection and 2 months FREE* http://join.msn.com/?page=features/junkmail

1 0

Re: Did you *really* zeroize that key?
by Patrick Chkoreff 08 Nov '02

08 Nov '02

At 02:22 PM 11/8/2002 +0000, Vincent Penquerc'h wrote: >while (!is_all_memory_zero(ptr)) zero_memory(ptr); Right, unfortunately the compiler might be insightful enough just to optimize that whole thing to skip() -- Dijkstra's null statement. Even Welschenbach calls "ispurged" immediately after "purgevars" to make sure the memory is actually zero. The ispurged routine is also defined using va_list, and if you turn on assertion checking it dies if the memory is nonzero. The problem is you NEVER KNOW if the compiler is just being clever and optimizing the assertion away, e.g.: sensitive = 0; if (sensitive) abort(); The compiler will simply "know" to optimize this whole thing to skip(). However, it is highly unlikely the compiler will be able to see through va_list manipulations. This problem is a real bear. I guess you just have to check the assembler output, eh? -- Patrick http://fexl.com

1 0

Aussies to censor web
by Major Variola (ret) 08 Nov '02

08 Nov '02

Ellison to pull plug on protest websites Sean Parnell and Matthew Fynes-Clinton 07nov02 THE Federal Government plans to stop Australians gaining access to websites used to organise protests. The move is part of a major crackdown on Internet-assisted crime. Justice Minister Chris Ellison, acting on a request from NSW Police Minister Michael Costa, will look at upgrading federal powers to block certain websites. A police ministers meeting in Darwin this week agreed it was "unacceptable websites advocating or facilitating violent protest action be accessible from Australia". <snip> http://www.couriermail.news.com.au/common/story_page/0,5936,5437553%5E8362,…

1 0

Re: Did you *really* zeroize that key?
by Patrick Chkoreff 08 Nov '02

08 Nov '02

>From: "Trei, Peter" <ptrei(a)rsasecurity.com> > >[Moderator's note: FYI: no "pragma" is needed. This is what C's >"volatile" keyword is for. Unfortunately, not everyone writing in C >knows the language. --Perry] Thanks for the reminder about "volatile." It is an ancient and valuable feature of C and I suppose it's implemented correctly under gcc and some of the Windoze compilers even with high optimization options like -O2. > >From RISKS: >http://catless.ncl.ac.uk/Risks/22.35.html#subj6 > >Those of us who write code need to be reminded of this >now and then. Everybody probably also knows about the gnupg trick, where they define a recursive routine called "burn_stack": static void burn_stack (int bytes) { char buf[64]; memset (buf, 0, sizeof buf); bytes -= sizeof buf; if (bytes > 0) burn_stack (bytes); } Then there's the vararg technique discussed in Michael Welschenbach's book "Cryptography in C and C++": static void purgevars_l (int noofvars, ...) { va_list ap; size_t size; va_start (ap, noofvars); for (; noofvars > 0; --noofvars) { switch (size = va_arg (ap, size_t)) { case 1: *va_arg (ap, char *) = 0; break; case 2: *va_arg (ap, short *) = 0; break; case 4: *va_arg (ap, long *) = 0; break; default: memset (va_arg(ap, char *), 0, size); } } va_end (ap); } Here's an example of how you might call the routine: purgevars_l(2, sizeof (la), &la, sizeof (lb), &lb); But hey, if "volatile" keyword works then so much the better. I would recommend examining the assembly language output of your compiler to verify that it honours "volatile." -- Patrick http://fexl.com

2 1

US Airways E-Savers to Frankfurt
by ESavers＠usairways.com 08 Nov '02

08 Nov '02

Dear E-Savers Subscriber, US Airways is pleased to present this special International E-Savers offer: ************************************************************ 1. This Week's International E-Savers 2. US Airways Vacations Deals 3. Dividend Miles Offers 4. E-Savers Fare Requirements 5. Subscription Information ************************************************************ 1. THIS WEEK'S INTERNATIONAL E-SAVERS ************************************************************ You may depart on Sundays to Thursdays, between November 10 and November 28, 2002. Return travel is Mondays to Fridays, between November 18 and December 6, 2002. Travel is not permitted to Frankfurt on November 27. Travel is not permitted from Frankfurt on December 2. Saturday night stay is required. Tickets must be purchased by November 13, 2002. For travel, make your reservations online at http://www.usairways.com/promotions/esavers/offer_fra.htm These special fares can also be purchased by calling 1-888-359-3728. Tickets must be purchased at the time of reservation. For more information on Frankfurt, please visit http://www.usairways.com/travel/destinations/europe/fra.htm ROUNDTRIP FROM: TO: FARE: ------------------------------------------------------------- Baltimore, MD Frankfurt, Germany $255 Boston, MA Frankfurt, Germany $255 Buffalo, NY Frankfurt, Germany $265 Charlotte, NC Frankfurt, Germany $235 Columbus, OH Frankfurt, Germany $285 Greensboro, NC Frankfurt, Germany $265 Greenville/Spart., SC Frankfurt, Germany $265 Hartford, CT Frankfurt, Germany $255 Indianapolis, IN Frankfurt, Germany $285 Los Angeles, CA Frankfurt, Germany $315 New York LaGuardia, NY Frankfurt, Germany $255 Philadelphia, PA Frankfurt, Germany $235 Pittsburgh, PA Frankfurt, Germany $235 Providence, RI Frankfurt, Germany $255 Raleigh/Durham, NC Frankfurt, Germany $265 Richmond, VA Frankfurt, Germany $265 Rochester, NY Frankfurt, Germany $265 San Francisco, CA Frankfurt, Germany $315 Syracuse, NY Frankfurt, Germany $265 Washington National, DC Frankfurt, Germany $255 Fares shown are based on roundtrip Coach travel on US Airways/US Airways Express, during the period specified above. Depending upon your travel needs, alternative routings may be available at the same fares, with part of the service on regional aircraft operated by US Airways Express carriers Allegheny, Air Midwest, CCAIR, Chautauqua, Colgan, Mesa, Piedmont, PSA, Shuttle America or Trans States. ************************************************************ 2. US AIRWAYS VACATIONS DEALS ************************************************************ US Airways Vacations is pleased to offer Frankfurt land packages to provide a complete vacation experience. Vacations include hotel accommodations, breakfast daily, hotel taxes and service charges. A variety of optional features including attraction admissions and sightseeing tours are available. US Airways Vacations offers packages to 80+ destinations. EXPERIENCE FRANKFURT!!! ----------------------- Land only based on per person, per night from: Excelsior $47 Heidelberg Marriott $57 Monopol $62 Rudesheimer Schloss - Rudesheim am Rhein $77 Purchase these land packages online at http://www.usairwaysvacations.com/pricing_res.htm Simply enter your origin and destination cities, departure date, number of adults, children's ages and click "Search For Vacation." Choose "Hotel Vacations for 1-59 nights," confirm your departure date and indicate the number of nights for your vacation. Click "Check Availability" and continue with your choices for hotels and options as the system presents them until you reach the final price. You may then purchase your vacation with a secure credit card transaction. If you prefer to speak with a reservations agent, call 1-800-352-8747. Rates shown are per person, per night based on double occupancy for departures 11/10/02 through 12/6/02. Hotel space is limited and may not be available at all hotels on all days. Additional travel dates, hotels and rates are available. Prices are subject to change with or without notice and do not include miscellaneous hotel charges typically paid by the customer directly to the hotel. Substantial restrictions apply for refunds. Other conditions may apply. ************************************************************ 3. DIVIDEND MILES OFFERS - EARN 500 MILES WITH E-STATEMENTS ************************************************************ "Sign Up For E-Statements, Get 500 Miles" If you like E-Savers, you will really like Dividend Miles E-Statements. E-Statements are sent monthly via e-mail and include your account summary along with exclusive bonus mile offers, US Airways news, special discount travel awards and other offers. Earn 500 miles when you sign up for E-Statements at usairways.com/estatements now through December 31, 2002. E-Statements = More Miles, More Offers, More Awards and Your Statement, More Often." Reminder: Make sure your Dividend Miles account number is in your E-Savers reservation, so you can earn miles for worldwide award travel on US Airways and our partners. To enroll in Dividend Miles, go to http://www.usairways.com/ To earn even more miles, book E-Savers using your US Airways Dividend Miles Visa card. To apply for the Dividend Miles Visa card issued by Bank of America, please visit us at http://www.usairways.com/dmcreditcards Please note: Mileage bonus for booking online does not apply to E-Savers. ************************************************************ 4. E-SAVERS FARE REQUIREMENTS ************************************************************ - Restrictions: Roundtrip purchase required. Seats are limited and are not available on all flights/days. Fares cannot be combined with other fares, discounts, promotions or coupons. Travel must begin and end in the same city. One-way travel, stopovers, waitlisting and standbys are not permitted. Tickets must be purchased at the time of reservation. Fares will not be honored retroactively or in conjunction with the exchange of any partially used ticket. - Travel: Depart to Frankfurt 11/10-11/28/02, Sunday-Thursday, and return from Frankfurt 11/18-12/6/02, Monday-Friday, except for the following blackout dates: Travel is not permitted to Frankfurt on November 27 and travel is not permitted from Frankfurt on December 2. Saturday night stay required. All travel must be completed by 12/6/02. - Ticketing: Tickets must be purchased by 11/13/02. - Taxes/Fees: Depending on the itinerary, passenger facility charges of up to $18 and the September 11th Security Fee of up to $10 may apply in addition to the fare. Fares shown do not include total government-imposed taxes/fees/surcharges of up to $105. - Changes: Tickets become non-refundable 24 hours after making initial reservation, and may be changed prior to the departure of each flight segment for a minimum $200 fee. If changes are not made prior to the departure date/time of each flight, the entire remaining ticket will have no further value. - Miscellaneous: Lower fares may be available in these markets. Other conditions apply. ************************************************************ 5. SUBSCRIPTION INFORMATION ************************************************************ This is a post-only mailing sent to CYPHERPUNKS(a)ALGEBRA.COM. If you would like to change your e-mail address, you will need to unsubscribe and resubscribe at the E-Savers Enrollment page: http://www.usairways.com/promotions/esavers/enroll/index.htm To unsubscribe from this list, please click here: http://www.usairways.com/cgi-bin/delete.cgi?email=CYPHERPUNKS@ALGEBRA.COM To change your departure city preferences, please visit: http://www.usairways.com/promotions/esavers/enroll/index.htm Please do not respond to this message. Copyright US Airways 1996-2002. All rights reserved.

1 0

US Airways E-Savers to Frankfurt
by ESavers＠usairways.com 08 Nov '02

08 Nov '02

Dear E-Savers Subscriber, US Airways is pleased to present this special International E-Savers offer: ************************************************************ 1. This Week's International E-Savers 2. US Airways Vacations Deals 3. Dividend Miles Offers 4. E-Savers Fare Requirements 5. Subscription Information ************************************************************ 1. THIS WEEK'S INTERNATIONAL E-SAVERS ************************************************************ You may depart on Sundays to Thursdays, between November 10 and November 28, 2002. Return travel is Mondays to Fridays, between November 18 and December 6, 2002. Travel is not permitted to Frankfurt on November 27. Travel is not permitted from Frankfurt on December 2. Saturday night stay is required. Tickets must be purchased by November 13, 2002. For travel, make your reservations online at http://www.usairways.com/promotions/esavers/offer_fra.htm These special fares can also be purchased by calling 1-888-359-3728. Tickets must be purchased at the time of reservation. For more information on Frankfurt, please visit http://www.usairways.com/travel/destinations/europe/fra.htm ROUNDTRIP FROM: TO: FARE: ------------------------------------------------------------- Baltimore, MD Frankfurt, Germany $255 Boston, MA Frankfurt, Germany $255 Buffalo, NY Frankfurt, Germany $265 Charlotte, NC Frankfurt, Germany $235 Columbus, OH Frankfurt, Germany $285 Greensboro, NC Frankfurt, Germany $265 Greenville/Spart., SC Frankfurt, Germany $265 Hartford, CT Frankfurt, Germany $255 Indianapolis, IN Frankfurt, Germany $285 Los Angeles, CA Frankfurt, Germany $315 New York LaGuardia, NY Frankfurt, Germany $255 Philadelphia, PA Frankfurt, Germany $235 Pittsburgh, PA Frankfurt, Germany $235 Providence, RI Frankfurt, Germany $255 Raleigh/Durham, NC Frankfurt, Germany $265 Richmond, VA Frankfurt, Germany $265 Rochester, NY Frankfurt, Germany $265 San Francisco, CA Frankfurt, Germany $315 Syracuse, NY Frankfurt, Germany $265 Washington National, DC Frankfurt, Germany $255 Fares shown are based on roundtrip Coach travel on US Airways/US Airways Express, during the period specified above. Depending upon your travel needs, alternative routings may be available at the same fares, with part of the service on regional aircraft operated by US Airways Express carriers Allegheny, Air Midwest, CCAIR, Chautauqua, Colgan, Mesa, Piedmont, PSA, Shuttle America or Trans States. ************************************************************ 2. US AIRWAYS VACATIONS DEALS ************************************************************ US Airways Vacations is pleased to offer Frankfurt land packages to provide a complete vacation experience. Vacations include hotel accommodations, breakfast daily, hotel taxes and service charges. A variety of optional features including attraction admissions and sightseeing tours are available. US Airways Vacations offers packages to 80+ destinations. EXPERIENCE FRANKFURT!!! ----------------------- Land only based on per person, per night from: Excelsior $47 Heidelberg Marriott $57 Monopol $62 Rudesheimer Schloss - Rudesheim am Rhein $77 Purchase these land packages online at http://www.usairwaysvacations.com/pricing_res.htm Simply enter your origin and destination cities, departure date, number of adults, children's ages and click "Search For Vacation." Choose "Hotel Vacations for 1-59 nights," confirm your departure date and indicate the number of nights for your vacation. Click "Check Availability" and continue with your choices for hotels and options as the system presents them until you reach the final price. You may then purchase your vacation with a secure credit card transaction. If you prefer to speak with a reservations agent, call 1-800-352-8747. Rates shown are per person, per night based on double occupancy for departures 11/10/02 through 12/6/02. Hotel space is limited and may not be available at all hotels on all days. Additional travel dates, hotels and rates are available. Prices are subject to change with or without notice and do not include miscellaneous hotel charges typically paid by the customer directly to the hotel. Substantial restrictions apply for refunds. Other conditions may apply. ************************************************************ 3. DIVIDEND MILES OFFERS - EARN 500 MILES WITH E-STATEMENTS ************************************************************ "Sign Up For E-Statements, Get 500 Miles" If you like E-Savers, you will really like Dividend Miles E-Statements. E-Statements are sent monthly via e-mail and include your account summary along with exclusive bonus mile offers, US Airways news, special discount travel awards and other offers. Earn 500 miles when you sign up for E-Statements at usairways.com/estatements now through December 31, 2002. E-Statements = More Miles, More Offers, More Awards and Your Statement, More Often." Reminder: Make sure your Dividend Miles account number is in your E-Savers reservation, so you can earn miles for worldwide award travel on US Airways and our partners. To enroll in Dividend Miles, go to http://www.usairways.com/ To earn even more miles, book E-Savers using your US Airways Dividend Miles Visa card. To apply for the Dividend Miles Visa card issued by Bank of America, please visit us at http://www.usairways.com/dmcreditcards Please note: Mileage bonus for booking online does not apply to E-Savers. ************************************************************ 4. E-SAVERS FARE REQUIREMENTS ************************************************************ - Restrictions: Roundtrip purchase required. Seats are limited and are not available on all flights/days. Fares cannot be combined with other fares, discounts, promotions or coupons. Travel must begin and end in the same city. One-way travel, stopovers, waitlisting and standbys are not permitted. Tickets must be purchased at the time of reservation. Fares will not be honored retroactively or in conjunction with the exchange of any partially used ticket. - Travel: Depart to Frankfurt 11/10-11/28/02, Sunday-Thursday, and return from Frankfurt 11/18-12/6/02, Monday-Friday, except for the following blackout dates: Travel is not permitted to Frankfurt on November 27 and travel is not permitted from Frankfurt on December 2. Saturday night stay required. All travel must be completed by 12/6/02. - Ticketing: Tickets must be purchased by 11/13/02. - Taxes/Fees: Depending on the itinerary, passenger facility charges of up to $18 and the September 11th Security Fee of up to $10 may apply in addition to the fare. Fares shown do not include total government-imposed taxes/fees/surcharges of up to $105. - Changes: Tickets become non-refundable 24 hours after making initial reservation, and may be changed prior to the departure of each flight segment for a minimum $200 fee. If changes are not made prior to the departure date/time of each flight, the entire remaining ticket will have no further value. - Miscellaneous: Lower fares may be available in these markets. Other conditions apply. ************************************************************ 5. SUBSCRIPTION INFORMATION ************************************************************ This is a post-only mailing sent to CYPHERPUNKS(a)ALGEBRA.COM. If you would like to change your e-mail address, you will need to unsubscribe and resubscribe at the E-Savers Enrollment page: http://www.usairways.com/promotions/esavers/enroll/index.htm To unsubscribe from this list, please click here: http://www.usairways.com/cgi-bin/delete.cgi?email=CYPHERPUNKS@ALGEBRA.COM To change your departure city preferences, please visit: http://www.usairways.com/promotions/esavers/enroll/index.htm Please do not respond to this message. Copyright US Airways 1996-2002. All rights reserved.

1 0