December 2003 - cypherpunks-legacy

Breaking RC4-40 for less
by fc＠all.net 17 Dec '03

17 Dec '03

Since messages sent with netscape are fairly standard for the first so many bytes, why not make a 2^30 element table, store it on a few gigabytes of disk space, use a hash table on the message, and find the keys to one in every 1,000 messages about 1 time per second. If this code is being used to send millions of credit transactions per day, we should be able decode thousands of credit card numbers per day for a one-time cost of about $5,00. The $10,000 estimate of the cost of computing time is far too high for a production-based attack on the netscape codes. -- -> See: Info-Sec Heaven at URL http://all.net Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

1 0

Re: Netsacpe's Offical Response
by Rev. Mark Grant 17 Dec '03

17 Dec '03

> In this case he had to use roughly > $10,000 worth of computing power (ballpark figure for having access to > 120 workstations and a few parallel supecomputers for 8 days) to break > a single message. Hmm, I don't know about anyone else around here, but my workstation is idle 99% of the time. I could almost certainly get access to all the spare CPU cycles on 120 workstations for free, and I suspect that a lot of people (particularly hackers) could do so as well. There's no need to spend $ 10,000 on renting them. Mark

1 0

First known purchase of physical goods with cyberbucks
by Rev. Mark Grant 17 Dec '03

17 Dec '03

[Feel free to forward to anywhere you feel is appropriate] -----BEGIN PGP SIGNED MESSAGE----- For some time now, Adam Back has been offering to sell RSA T-shirts for cyberbucks (DigiCash's experimental anonymous digital cash system), but no-one has had enough available to take him up on it. However, thanks to the success of the ecm mailing list (ecm(a)ai.mit.edu) and WWW site (http://www.c2.org/~mark/ecash/ecash.html) today I finally managed to collect enough c$ to buy one. It was something of a feat to gather that many c$ in one place, as the number of sellers is limited. There are many more buyers than sellers, everyone wants c$, but few people are selling at a realistic price. As it stands, we have managed to take a worthless currency (c$ are not backed with anything) and give it value based solely on what the market is willing to pay for it, due to its security, anonymity and ease of use advantages compared to the other digital payment systems on the Net. Once a DigiCash licensee starts offering to sell (and buy) ecash via VISA/MasterCard and chequing account, I could see ecash getting very popular very quickly. Using ecash once you've got the c$ in your ewallet/DigiCash bank account is near instant. If used through the WWW forms interface as provided by the Windows and X-windows user interface, the transaction is as easy as clicking on a button. Instant buy, much more convenient than filling in credit card forms, talking to people on the phone, sending things in snail mail, etc, and anonymous too. Now you can even use the beta-test currency to buy and sell physical goods as well. Anyway, if anyone knows of an earlier transaction of cyberbucks for physical goods than this (at 15:00 GMT 17th August 1995), then please let me know. Also, if you have c$ that you wish to sell, or have run out and want to buy some more, come along and join in the fun on the WWW site or mailing list... Mark P.S. If anyone in the UK wants to buy a rusty but reliable FIAT X1/9 convertible, it's yours for only 5,000 cyberbucks... (For the record, I have no connection to DigiCash other than as an ecash beta tester, and the ecash market is not supported by them in any way.) -----BEGIN PGP SIGNATURE----- Version: 2.6 iQEVAgUBMDN1YFVvaTo9kEQVAQE4Bwf/WYTlYShkIyP0jOLyDmOpG/Bzdya5q+Xp QY60CS8Po/cSIEPy26cDs62Yn5HIEq0g+afw0NZS4BiH2xanqDFnwrumNE78q2iW 03AlX/RuDkGFabpxUfFoYRkf2qgsDI1wnt7vzryKlxgBSGzoEGS7j7UKesEtASIl 3iw3EgINnX+BN7nSWsLcpyN3BHUPKxLSKWUg/hduS7D8AlVqMFq8JUu2wDKxJwJV 1FJ5oN8dF5bSa+VQINA4LXK9Nx/DVqMGAedg37E3/CGuassGBfW1YtTiRwauaj6q cV7D2zg52hvoq7qeQdesWHLUeqBbK9U/7Xbb80SP87eny+1XkIsgig== =M1jD -----END PGP SIGNATURE-----

2 1

Re: First known purchase of physical goods with cyberbucks
by Marcel van der Peijl 17 Dec '03

17 Dec '03

> Anyway, if anyone knows of an earlier transaction of cyberbucks for physical > goods than this (at 15:00 GMT 17th August 1995), then please let me know. As far as I know, the first transaction took place when I (while testing) bought a postcard from GlobalX, the first ecash store to open besides our own (and mine). It is stored in the 'DigiCash museum' next to early prototypes of all kinds of smartcards, emulators, wallets etc. This must have been around October last year (or August? Can't make out the postmark). Hundreds of cards were shipped by several shops, and stickers, lotteries, etc. Check the 'physical objects' section on http://www.digicash.com/shops/categorical.html Maybe you should restrict the 'first known' claim to 'first known purchase of physical goods with cyberbucks traded at the ECM'. Sorry! // Marcel van der Peijl, DigiCash bv, http://www.digicash.com/~bigmac/ // The hottest instruction on a P90? JMP $ @ 2.633A or 52C (with fan)

2 1

Denver area meeting, SUNDAY, 8/20, 2 pm
by adwestro＠ouray.cudenver.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- This one is on SUNDAY, 2 pm, at the Tivoli Food Court (at least initially). Send email for directions, etc. Alan Westrope <awestrop(a)nyx10.cs.du.edu> __________/|-, <adwestro(a)ouray.cudenver.edu> (_) \|-' 2.6.2 public key: finger / servers PGP 0xB8359639: D6 89 74 03 77 C8 2D 43 7C CA 6D 57 29 25 69 23 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Exon blows goats...but I suspect you already knew that. iQCVAwUBMDOBpVRRFMq4NZY5AQEnVAP8CLg9z5AwjIw0ouJtxPPr6CUytFOeVPrt cMrEm8MRUt0ay0S4F+TGMq1npcF8pxdU0jwWk9EBj+1XvTOKVpEED+kp8shafsVj qlWGplAVUHMTF19H1VAByoz7j3VGMB2zmdNDm2ifDMNzR5Di81o7CeyvQT0sZ6zt 5XGWmHkoX3g= =GD3W -----END PGP SIGNATURE-----

1 0

Re: Idle compute cycles [Re: Netscape's Offical Response]
by Damien.Doligez＠inria.fr 17 Dec '03

17 Dec '03

>From: Jim Gillogly <jim(a)acm.org> >and one thing that seems to miss the point. As usual, I agree with all Jim has to say, but there's another problem with Netscape's response: they UNDERestimate the cost of breaking RC4-128 (by brute force) by a factor of about 300 trillion. If someone know of an URL for Netscape's response, I'll be glad to include a pointer in my virtual press conference. I would have to ask for permission before I put a copy on my disks. Copyrights, you know... -- Damien

1 0

Breaking DES anyone? (was: Breaking RC4-40 for less)
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

Fred Cohen <fc(a)all.net> wrote on cpunks: > Since messages sent with netscape are fairly standard for the first > so many bytes, why not make a 2^30 element table, store it on a few > gigabytes of disk space, use a hash table on the message, and find > the keys to one in every 1,000 messages about 1 time per second. If > this code is being used to send millions of credit transactions per > day, we should be able decode thousands of credit card numbers per > day for a one-time cost of about $5,00. Nice idea and one which works for pure RC4, but unfortunately not for 128 bit, 88 bit known + 40 bit unknown "export" SSL. Netscape's SSL uses "40 bit keys" that are composed in a strange way: you are given 88 bits of known key, and this is combined with the 40 bit key, to give a 128 bit key. That key is used to do the encryption. The problem is that this has a unix password salt like effect, only this time there are 88 bits of salt rather than 12 bits. So this means that you can't precompute anything on the 40 bits as the 88 bits are randomly generated, and likely vary with each session. > The $10,000 estimate of the cost of computing time is far too high > for a production-based attack on the netscape codes. Agreed, it's too high for the other reason that lots of people have spare compute cycles. Idle cycles have low to non-existant incremental cost, and there are plenty of them around in the world. Back to breaking crypto systems. There are a couple of things you can do, there is your pre-compute some proportion of the key space - so that you get some of them, this would work well for straight 40 bit RC4 - and there are quite probably such products around - microsoft has a number of "secure" [sic] things around the Microsoft Access we were looking at earlier, another system for doing remote access (modem) and having the sessions encrypted. The problem with micro$oft is they are a darn closed system, and no-one so far has invested the time to decode what they're doing with a debugger. That was the reason for the failed brute RC4 a while back - no specs. So precompute regions of keys would work on pure RC4-40 as you describe. It would be fast too - a disk seek time being the bounding factor - per key! Another approach is to do lots of keys simultaneously - so you set up this distributed effort which is continually re-sweeping the 40 bit keyspace, say every couple of days or whatever. You can sweep for more than one key at once at very low incremental cost, an extra key costs close to nothing. So say you are searching for 1000 keys at once - a dragnet approach - well keys just pop out at random as they are hit, maybe straight away maybe at worst case the sweeping roll-over time, but on average a key will fall out every 3 minutes. The same approach is applicable to 1 guy with 1 humble PC, it'll sweep the full keyspace it in a year or two, but what does he care if he gets a couple of keys a day, and they're all nice transactions he can pilfer / make nefarious use of. DES breaking schemes... Something similar applies to DES, I mean what's a piffling 56 bit keyspace if you don't really care *which* key of several thousand that you actually want. There are bound to be a large enough supply of DES encrypted banking transactions flowing around the various financial networks in the US to make a nefarious breaking of them emminently possible. It moves on the time for a complete sweep as you now have 56 bits to contend with - but I think with a team of say 1024 workstations like the one I am typing on (an SGI Indy ~$5k workstation) in a distributed effort, and a large supply of DES keys, you could get a workable break on *one* of those keys in a shortish time how long? Well I'm not sure how fast DES can be made to go for these purposes, but 60k keys/sec is a figure I have for DES set_key (Eric Youngs code on a Sparc 20) I'm not too sure of the details of what you'd need to brute a DES key, but setting up the key, and presumably a small additional cost to test the first byte and every 256 tries to test 2 bytes etc. Anyone know if 60k keys/sec sounds reasonable for a DES brute? Anyway working on that, 1024 workstations, 60k keys/sec = 60 M keys/sec = 37 years! But (here's the saving bit) if you try say 64k keys *at once* so you've hoovered up a stack of keys (hypothetically - technically plausible too a tap on a banking network should yield you a whole load of them) *then* you can get much nicer figures: A DES key every 5 hours! I'm thinking 1024 workstation equivalents shouldn't be insurmountable to organise - lots of people have faster / multiprocessor machines, and farms of workstations / PCs etc. Perhaps 64k keys is a bit generous, and 1024 keys would be a more sensible figure, even then that translates to 13 days expected. As some one said a while ago (breaking) Netscape is the big win! Breaking DES is *the* big win! Adam -- HAVE *YOU* EXPORTED RSA TODAY? --> http://dcs.ex.ac.uk/~aba/rsa/ --rsa--------------------------8<------------------------------- #!/bin/perl -s-- -export-a-crypto-system-sig -RSA-3-lines-PERL $m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2%Sa 2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*',$_)while read(STDIN,$m,($w=2*$d-1+length($n)&~1)/2) -------------------------------8<------------------------------- TRY: rsa -k=3 -n=7537d365 < msg | rsa -d -k=4e243e33 -n=7537d365

2 1

Re: Netsacpe's Offical Response
by Doug Hughes 17 Dec '03

17 Dec '03

>So in conclusion, we think RC4-40 is strong enough to protect consumer-level >credit-card transactions -- since the cost of breaking the message is >sufficiently high to make it not worth the computer time required to do so .... .... >Finally, we'd like to reiterate that all this person has done is decrypt >one single RC4-40 message. RC4 the algorithm and products which use the >algorithm remain as secure as always. > > > I disagree with the cost assumptions that it costs $10K. These are "relatively" imaginary costs. If you already have the machines (like a lot of universities and corporations) then the marginal cost of breaking the key is practically nil. The person doing the cracking certainly doesn't incur any costs. So what if it takes 2 weeks. An evil student/hacker/whatever would be willing to wait two weeks for a credit card with a $5-$oo limit if he could just use the machines at night when people might not notice. Just my $.02 Re: security of RC4 - agreed completely.

1 0

Cost to Crack Keys
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:45 PM 8/17/95, Rev. Mark Grant wrote: >> In this case he had to use roughly >> $10,000 worth of computing power (ballpark figure for having access to >> 120 workstations and a few parallel supecomputers for 8 days) to break >> a single message. > >Hmm, I don't know about anyone else around here, but my workstation is >idle 99% of the time. I could almost certainly get access to all the spare >CPU cycles on 120 workstations for free, and I suspect that a lot of >people (particularly hackers) could do so as well. There's no need to >spend $ 10,000 on renting them. But, Mark, estimates of the cost to crack a key _must_ be based on market prices, not on opportunistic access to machines. Such access is good for occasional, or one-shot, deals, but not for routine use. For example, one doesn't say "Hey, I don't see how Hertz can charge $40 a day to rent a car...my friend lets me use his for free." The technical issues of whether there are faster ways to break the keys, or how fast and far MIPS prices will drop, is a separate issue. "Standard accounting practices" dictate the way to estimate production costs. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

3 2

RC40 and what we still need to do
by Robert A. Hayden 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have been watching the backlash of the cracking of RC40 and am quite impressed with the fact that it is being used as a positive reason for repealing ITAR. I expected the media to jump on the "hacker" bandwagon and denounce the efforts. However, I think there is still value in writing the software that will allow cooperation amoung hundreds or thousands of people. That way, we could harness the space CPU of machines all over the globe and make the cracking of this kind of stuff routine. So instead of taking 8 days, it takes only a day or so, further eliminating the idea that it "takes too long to be worthwhile". Maybe there would even be value in going at a 128-bit key (granted, it would take a year). I'd anticipate with proper advertising, easy-to-use software, and little programming knowledge require, we could easily harness 10,000+ machines and a few dozen parallel machines. I know we have a 99.9% idle MasPAR I can contribute to the effort, which should be able to do 1million+ keys/sec. It's just dying to have a purpose.... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: PGP Signed with PineSign 2.2 iQCVAwUBMDNwmDokqlyVGmCFAQEzTQQAtkDhi0XD1L1PGJgSYA0XcxMXOIszjtB0 sQcHdSqeVHBpIn7K0/F4JE0tiIgXFhmaKsU8FaIaf/5sbDpRj/cTZXnvE/evt4G0 GKploXjcqXQ/dBpSWakCzsKLJvqvhKEyZyAnF/5VHgSI5WChMKYm68qiuDNyN05Q He6bvbZGbBs= =oPni -----END PGP SIGNATURE----- ____ Robert A. Hayden <=> hayden(a)krypton.mankato.msus.edu \ /__ Finger for Geek Code Info <=> Finger for PGP Public Key \/ / -=-=-=-=-=- -=-=-=-=-=- \/ http://krypton.mankato.msus.edu/~hayden/Welcome.html -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GED/J d-- s:++>: a-- C++(++++) ULU++ P+ L++ E---- W+(-) N++++ o+ K+++ w--- O- M+ V-- PS++>$ PE++>$ Y++ PGP++ t- 5+++ X++ R+++>$ tv+ b+ DI+++ D+++ G+++++ e++ h r-- y++** ------END GEEK CODE BLOCK------

2 1

Re: First known purchase of physical goods with cyberbucks
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:39 PM 8/17/95, Marcel van der Peijl wrote: >> Anyway, if anyone knows of an earlier transaction of cyberbucks for physical >> goods than this (at 15:00 GMT 17th August 1995), then please let me know. > >As far as I know, the first transaction took place when I (while >testing) bought a postcard from GlobalX, the first ecash store to >open besides our own (and mine). It is stored in the 'DigiCash >museum' next to early prototypes of all kinds of smartcards, >emulators, wallets etc. > >This must have been around October last year (or August? Can't make >out the postmark). Hundreds of cards were shipped by several shops, >and stickers, lotteries, etc. Check the 'physical objects' section >on http://www.digicash.com/shops/categorical.html > >Maybe you should restrict the 'first known' claim to 'first known >purchase of physical goods with cyberbucks traded at the ECM'. > >Sorry! Also, there are other potential claims for this sort of thing. Based on varying extents to which the "electronic money" is really secure, is cryptographically interesting, etc. For example, more than two years ago on this list (I think it was spring of '93, but it could've been spring of '94) there were a flurry of transactions involving the "MagicMoney" and "TackyTokens" of Pr0ductCypher and others. I recall Black Unicorn and others talking about transactional exchanges involving sixpacks of beer or soft drinks. I could check my archives, but you get the point. And before that, there were "HExmarks" being used on the Extropians list. There was a nominal conversion rate to real dollars, and at the time I left that list, I had more HExmarks than anyone else. And dozens of token-based systems, coupons, LETS systems, etc. Not to mention the various commercial smartcards and "e money" systems. Granted, most of these are not "Chaumian," which is what most of us think of us as digital cash. Claiming credit for being first is a tough issue. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

The Official Cypherpunks Screen Saver?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:11 PM 8/17/95, Jim Gillogly wrote: >I would hazard a guess that 90% of the compute cycles in the world are used >running screen savers... this gives a <lot> of slack for people who would >like to harness them to perform productive work like making points about >the strength of security. It would really be cool to have a screen saver that did useful work while displaying pretty pictures. Imagine a screen saver, maybe with code modules running in "After Dark," that updates the screen with keys tried...could be a nice demonstration of bignums in crypto, etc. Every now and then the user would get lucky and alarms would go off... (Details: getting the modules to automatically divvy-up keyspace...or maybe just let user pick his own key, or from a list, or whatever. A la the "Chinese lottery" keycracking scheme, where set-top cable boxes (containing computers) crunch on keys and try to match to signals sent over the air...Schneier may have something on this in his book.) Just a thought. The "Official Cypherpunks Screen Saver"? I'd rather have this running on my Mac than have a t-shirt. --Tim May (Berkeley Systems, makers of "After Dark" for Macs and Windows, supports third-party modules. Maybe the "Flying Toasters" could swoop down, pick up a "key" laying on the "ground" and proceed to munch on it...the mind boggles.) ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

2 1

Re: First known ... (stop this thread please)
by Marcel van der Peijl 17 Dec '03

17 Dec '03

> Also, there are other potential claims for this sort of thing. Based on > varying extents to which the "electronic money" is really secure, is > cryptographically interesting, etc. Sorry, I think we should kill this thread while we're still on top of it. The discussion was CyberBucks, not electronic payments or anything like that. I _KNOW_ what the first transaction was, since I made it, I saw it at the bank, I received the goods, and got an email from the sender saying it was the first transaction. I do not wish to take claim for any of that other stuff, whether it is Chaumian or not. No doubt somebody traded some baseball cards for a few bits somewhere back in the fifties. Let's not dig up any other dead bodies. My claim (which was only to show the incorrectness of the other) is a very restrictive one, and is only for the CyberBucks trading. // Marcel van der Peijl, DigiCash bv, http://www.digicash.com/~bigmac/ // The hottest instruction on a P90? JMP $ @ 2.633A or 52C (with fan)

1 0

Cost to Crack Keys
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

Tim May <tcmay(a)got.net> writes: > >Hmm, I don't know about anyone else around here, but my workstation is > >idle 99% of the time. I could almost certainly get access to all the spare > >CPU cycles on 120 workstations for free, and I suspect that a lot of > >people (particularly hackers) could do so as well. There's no need to > >spend $ 10,000 on renting them. > > But, Mark, estimates of the cost to crack a key _must_ be based on market > prices, not on opportunistic access to machines. Such access is good for > occasional, or one-shot, deals, but not for routine use. > > For example, one doesn't say "Hey, I don't see how Hertz can charge $40 a > day to rent a car...my friend lets me use his for free." > [...] > "Standard accounting practices" dictate the way to estimate production costs. Agreed. *But* the real cost to a particular organisation, is subsidised by the amount of idle compute cycles they have. You can't take this into account very easily or accurately for a general figure, where raw $ are probably the best figure. For instance I know someone who works for a large UK newspaper (he's admin for their unix workstations), and he says there are acres of RS6000s just sitting there idling most of the time. They are used for document preparation only (what a waste all that lovely silicon just burning cylces, and being occasionally used as a glorified word processor). Anyway point being to that particular organisation, if they for some reason (I dunno but say a big scoop - they need to nefariously break something to get the low down on a politician - unofficially of course), their real cost is quite a bit lower than the raw $, perhaps 0 cost even if they can wait long enough for their impromptu farm to do the job. This doesn't really affect the raw $ cost as such, people just need to estimate the amount of wasted $ equivalent of idle compute they already have in their personal calculations. It would sound better if various news papers would care to print something along the lines of "with idle compute powers as many typical organisations have in abundance". Papers printing high sounding $ figures is though technically accurate (perhaps not too sure about the accuracy), mis-leading to general public who probably don't realise that there is a few $100 tho of idle compute lying around in the accounts department already! In summary, yes but it doesn't sound as good, and folks don't equate idle CPU to $ intuitively. Adam -- HAVE *YOU* EXPORTED RSA TODAY? --> http://dcs.ex.ac.uk/~aba/rsa/ --rsa--------------------------8<------------------------------- #!/bin/perl -s-- -export-a-crypto-system-sig -RSA-3-lines-PERL $m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2%Sa 2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*',$_)while read(STDIN,$m,($w=2*$d-1+length($n)&~1)/2) -------------------------------8<------------------------------- TRY: rsa -k=3 -n=7537d365 < msg | rsa -d -k=4e243e33 -n=7537d365

1 0

Re: Breaking DES anyone? (was: Breaking RC4-40 for less)
by Hal 17 Dec '03

17 Dec '03

> From: aba(a)dcs.exeter.ac.uk > Another approach is to do lots of keys simultaneously - so you set up > this distributed effort which is continually re-sweeping the 40 bit > keyspace, say every couple of days or whatever. You can sweep for > more than one key at once at very low incremental cost, an extra key > costs close to nothing. So say you are searching for 1000 keys at > once - a dragnet approach - well keys just pop out at random as they > are hit, maybe straight away maybe at worst case the sweeping > roll-over time, but on average a key will fall out every 3 minutes. I don't see how you can sweep for more than one key at once at low cost. Because of the salt, every possible SSL encrypted message has to be swept independently. You can't sweep for two messages' keys at once because the input to the MD5 is different even for the same 40-bit key. If digital cash in micro amounts became practical, people could be paid to let the "idle cycles" on their computers be used for this kind of highly parallel application. (Some people have speculated that graphics rendering would be another suitable choice.) It would be interesting to see what the market price of cycles became in such an environment. That would give a better benchmark for the cost to break keys. Hal

1 0

Re: SSL challenge -- broken !
by Hal 17 Dec '03

17 Dec '03

I can see three ways in which RC4-40 is weaker now than it was when it was approved for "fast track" export approval. First, of course, computers get faster every year. So any fixed cipher becomes relatively weaker as time goes on. Second, until earlier this year RC4 was secret. Then it was posted anonymously to the cypherpunks list and later to sci.crypt. Before that time, only a much smaller number of people would have been in a position to launch an exhaustive search attack. But now that the source is public, virtually anyone can try to crack it. So this is really a very significant loss of security. It also illustrates the difficulty in keeping secrets which will occur due to the kind of technology we advocate. Third, there is much more interest now in actually doing massively parallel encryption attacks. The RSA-129 project got a lot of publicity, and it was followed by the attack on the "Blacknet" 384 bit PGP key by a small private group earlier this year. People are aware now of how easy it is to use parallelism in this kind of work, and with the software Adam Back has worked on this could become even more popular in the future. So all this talk about "6,000 MIPS years" will not be as impressive if any moderately sized hacker group can put that much computing power together in a few days. With these changes, RC4-40 has lost a significant amount of the cryptographic strength it may have had a year or two ago. It is certainly time for the exportable key size to be expanded. Hal

1 0

Strong encryption for credit cards only
by Hal 17 Dec '03

17 Dec '03

In response to the SSL break, Netscape has said they are working on improved encryption specifically for credit card numbers. This would use 56 bit keys, presumably DES. I got this from the SJ Mercury News online, <URL:http://www.sjmercury.com/nav.htm>. While we can applaud any measure to increase user privacy and security, it will be unfortunate if this enhanced encryption, which will apparently be limited strictly to credit card information in order to get export approval, weakens support for efforts to allow expanded export approval of all sorts of encryption. There are many aspects to privacy beyond credit card numbers. The bottom line remains that overseas companies are able to put stronger encryption in their products than American companies can in their export versions. We need to keep offering good arguments for why users will need strong encryption for more than their credit card info. If the message gets out that this new measure solves the security problems on the internet then that will be a big loss for our goals. Hal

1 0

Silly technical question from a non-technical person
by Robert A. Hayden 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm be piceing together things on this list that I have only a passing understanding of (at a code level). If it costs $10,000 to crack one 40-bit key (putting aside whether we agree on that price or not), could not the software be designed in such a manner that it is able to check, say, 10,000 keys at the same time? Ie, it computes a key, and then checks it against the array of data to see if it fits any of them, and then goes on to the next one. Maybe that would be an interesting test. Randomly compute say 10,000 sessions and they try to crack them all at the same time. Theoretically, it would reduce that $10,000/crack cost dramatically. Of course, I could very well be wrong.... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: PGP Signed with PineSign 2.2 iQCVAwUBMDOByjokqlyVGmCFAQHFeAP9Hi9rXt1Ij4+nXISXMdfQL7TglB5T0p5P o80KP3PExZ7BqPVrLK9at831SOOVBIN2qzkFcLo7VTOfsrtc95Oyit6Kkk6+PBQQ 4dmuTjbBtRTFi92a4r5RAIXBlLYaATGSZGI3UUSE4m/PoeOWwAhjl/sweu/g/1Q2 ZsRCz9wefR4= =HlUL -----END PGP SIGNATURE----- ____ Robert A. Hayden <=> hayden(a)krypton.mankato.msus.edu \ /__ Finger for Geek Code Info <=> Finger for PGP Public Key \/ / -=-=-=-=-=- -=-=-=-=-=- \/ http://krypton.mankato.msus.edu/~hayden/Welcome.html -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GED/J d-- s:++>: a-- C++(++++) ULU++ P+ L++ E---- W+(-) N++++ o+ K+++ w--- O- M+ V-- PS++>$ PE++>$ Y++ PGP++ t- 5+++ X++ R+++>$ tv+ b+ DI+++ D+++ G+++++ e++ h r-- y++** ------END GEEK CODE BLOCK------

1 0

Re: Breaking DES anyone? (was: Breaking RC4-40 for less)
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

Hal Finney <hfinney(a)shell.portal.com> writes on cpunks: > > Another approach is to do lots of keys simultaneously - so you set up > > this distributed effort which is continually re-sweeping the 40 bit > > keyspace, say every couple of days or whatever. You can sweep for > > more than one key at once at very low incremental cost, an extra key > > costs close to nothing. So say you are searching for 1000 keys at > > once [...] on average a key will fall out every 3 minutes. > > I don't see how you can sweep for more than one key at once at low cost. > Because of the salt, every possible SSL encrypted message has to be swept > independently. You can't sweep for two messages' keys at once because the > input to the MD5 is different even for the same 40-bit key. Agreed. I was not being clear and mixing various things in one post. I was talking about 3 different systems: 1) export SSL 88 + 40 2) pure RC4-40 (hypothetical - possible microsoft / other apps) 4) DES (56 bits, can it be done) In the part you quote I was talking about pure RC4 40, I'm not sure which applications fall into this category, but it is one thing we have yet to determine. Perhaps Microsoft Access falls in to this category? Other microsoft applications / other vendor applications? someone needs to do the microsoft equivalent of a FOIA to extract this info. Anyone have any Microsoft software with encryption that they could quiz Microsoft tech support about? For export SSL it does not work for the reason you describe, the 88 bit salt effect. For DES I think it does work (attacking many keys at once), but then my understanding of DES is limited, but as a block cipher, presumably you can just brute keys in a straight forward manner? If so you can try multiple keys at once, unless there is some salt effect involved with typical CBC 56 bit DES operation too? Depending on the relative costs of the parts of the block cipher, a) key-setup b) block / stream decrypt pure RC4 is designed so that a) is vastly more expensive than b). How does this pan out for DES? DES (and RC4) are designed for fast encrypt / decrypt, but is there an appreciable key setup phase? I have these figures courtesy of Andy Brown: > Using Eric Young's very fast libdes code, and using the supplied speed > test program I get the following output on a Sparc 20 (1 processor): > > Doing set_key for 10 seconds > 582771 set_key's in 9.83 seconds > Doing des_ecb_encrypt's for 10 seconds > 989184 des_ecb_encrypt's in 9.85 second > Doing des_cbc_encrypt on 8192 byte blocks for 10 seconds > 982 des_cbc_encrypt's of 8192 byte blocks in 9.92 second > Doing crypt for 10 seconds > 37101 crypts in 9.89 second > set_key per sec = 59284.94 ( 16.9uS) > DES ecb bytes per sec = 803398.17 ( 10.0uS) > DES cbc bytes per sec = 810941.94 ( 9.9uS) > crypt per sec = 3751.37 (266.6uS) So what is a brute DES program on multiple keys with CBC mode (is this the most common mode?) going to look like in terms of calls to these various calls? The set_key looks slow compared to the DES cbc bytes per sec, even if you have to cycle a couple of blocks to get to your known plaintext location. Am I on the right tracks? It seems to me that you gain considerably by doing multiple keys even with CBC and random IV due to relatively fast block decrypt as compared to key setup. > If digital cash in micro amounts became practical, people could be paid > to let the "idle cycles" on their computers be used for this kind of > highly parallel application. (Some people have speculated that graphics > rendering would be another suitable choice.) It would be interesting to > see what the market price of cycles became in such an environment. That > would give a better benchmark for the cost to break keys. I think this would be an interesting way to determine the market value of idle cycles, and likely lead to cheaper figures for breaking things than are touted (by newspapers, and people to whose advantage it is to estimate generously the cost). Adam

1 0

Silly technical question from a non-technical person
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

> If it costs $10,000 to crack one 40-bit key (putting aside whether we > agree on that price or not), could not the software be designed in such a > manner that it is able to check, say, 10,000 keys at the same time? Ie, > it computes a key, and then checks it against the array of data to see if > it fits any of them, and then goes on to the next one. Hmm yes and no. - For pure RC4-40 yes. - For export SSL no. It has what is effectively an 88 bit salt (familiar with unix password salts? like that only 88 bits). - For full 128 bit SSL, yes, but 128 bits is a rather large even if you have a few million keys to try at once with speed up gains. 2^128 is a biiig number. - For DES I think so, asked for others opinions, this might be the next one to die, big project but possibly doable with lots of keys at once Adam

1 0

Dumb question (Re: RSA T-Shirt)
by George T. Talbot 17 Dec '03

17 Dec '03

Sorry to bother the entire list with this...anybody got the e-mail address of the USA seller of the 3-lines of Perl RSA T-Shirt? I haven't received mine yet and I can't find the e-mail address. Again...Sorry for adding to the traffic. ---------- George T. Talbot <george(a)phat.com>

1 0

Re: First known purchase of physical goods with cyberbucks
by Matt Thomlinson 17 Dec '03

17 Dec '03

don't forget GhostMarks! :) matt ---------- From: Timothy C. May <tcmay(a)got.net> To: "Marcel van der Peijl" <bigmac(a)digicash.com>; <mark(a)unicorn.com> Cc: <cypherpunks(a)toad.com>; <ecm(a)ai.mit.edu>; <steve(a)webmedia.com> Subject: Re: First known purchase of physical goods with cyberbucks Date: Thursday, August 17, 1995 11:59AM At 6:39 PM 8/17/95, Marcel van der Peijl wrote: >> Anyway, if anyone knows of an earlier transaction of cyberbucks for physical >> goods than this (at 15:00 GMT 17th August 1995), then please let me know. > >As far as I know, the first transaction took place when I (while >testing) bought a postcard from GlobalX, the first ecash store to >open besides our own (and mine). It is stored in the 'DigiCash >museum' next to early prototypes of all kinds of smartcards, >emulators, wallets etc. > >This must have been around October last year (or August? Can't make >out the postmark). Hundreds of cards were shipped by several shops, >and stickers, lotteries, etc. Check the 'physical objects' section >on http://www.digicash.com/shops/categorical.html > >Maybe you should restrict the 'first known' claim to 'first known >purchase of physical goods with cyberbucks traded at the ECM'. > >Sorry! Also, there are other potential claims for this sort of thing. Based on varying extents to which the "electronic money" is really secure, is cryptographically interesting, etc. For example, more than two years ago on this list (I think it was spring of '93, but it could've been spring of '94) there were a flurry of transactions involving the "MagicMoney" and "TackyTokens" of Pr0ductCypher and others. I recall Black Unicorn and others talking about transactional exchanges involving sixpacks of beer or soft drinks. I could check my archives, but you get the point. And before that, there were "HExmarks" being used on the Extropians list. There was a nominal conversion rate to real dollars, and at the time I left that list, I had more HExmarks than anyone else. And dozens of token-based systems, coupons, LETS systems, etc. Not to mention the various commercial smartcards and "e money" systems. Granted, most of these are not "Chaumian," which is what most of us think of us as digital cash. Claiming credit for being first is a tough issue. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

More on Netscape
by Sean A. Walberg 17 Dec '03

17 Dec '03

I guess most everybody has seen the response that Netscape put on their page, but did people check out the "for more info" link (http://home.netscape.com/newsref/std/key_security.html) It says that the commerce server supports (among others) DES and DES3 (same as 3DES?). They list the key sizes as 64 and 192 bits respectively. My question is, isn't DES 56 bits? (with an 8 bit salt that would be 64 I guess), but isn't DES3 112 bits, not 192? Just wondering... Sean o-------------------o----------------------o-----------------------o | Sean Walberg, | Tech Support | Pas_al, _obol, BASI_, | | sean(a)escape.ca | escape communication | PostS_ript, T_L... | | Mail for PGP key | 925-4290 | C fills all the holes | o----------------] http://www.escape.ca/~sean [--------------------o

2 1

new o'reilly security book
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

------- Forwarded Message Date: Tue, 15 Aug 1995 14:08:44 -0700 From: Sara Winge <sara(a)ora.com> Subject: New "Computer Crime" book from O'Reilly FOR IMMEDIATE RELEASE August 15, 1995 TO REQUEST A REVIEW COPY, CONTACT: Sara Winge sara(a)ora.com 707/829-0515 O'REILLY RELEASES HANDBOOK ON FIGHTING COMPUTER CRIME SEBASTOPOL, CA--"Computer Crime: A Crimefighter's Handbook" is a resource for anyone who needs to know what today's computer crimes look like, how to prevent them, and how to detect, investigate, and prosecute them if they do occur. It contains basic computer security information as well as extensive guidelines for investigators, law enforcement, managers, and computer system administrators. The book has been reviewed by representatives of the U.S. Secret Service, the Department of Justice, local police departments, district attorney's offices, and law enforcement abroad. "Computer Crime" describes the varieties of computer crimes and profiles the computer criminal, using techniques developed for the FBI and other law enforcement agencies. It outlines the vulnerabilities of computer systems and discusses personnel, operational, physical, and communications measures that can be taken to prevent computer crimes. In addition, it contains a thorough treatment of effective methods for investigating and prosecuting computer crimes, ranging from the supplies needed for criminal investigation, to the detection and audit tools used in investigation, to the presentation of evidence to a jury. # # # Computer Crime: A Crimefighter's Handbook By David Icove, Karl Seger & William VonStorch, with Consulting Editor Eugene H. Spafford 1st Edition August 1995 464 pages, ISBN: 1-56592-086-4, $24.95

1 0

nontoxic neuron interface built
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

for all of you eagerly awaiting the day you can literally "jack in" to cyberspace.. ------- Forwarded Message Date: Wed, 16 Aug 95 13:44:34 -0400 Subject: FW: 'Cyberpunk' neural interface? - - ---------- From: James McDaniel X-MsXMTID: red-14-msg950816203742MTP[01.00.00]0000009e-34570 The following item is taken from: http://www.hep.net/documents/newsletters/pnu/1995/pnu-236.html James - - -------------------- PHYSICS NEWS UPDATE The American Institute of Physics Bulletin of Physics News Number 236: August 7, 1995 by Phillip F. Schewe and Ben Stein A SILICON DEVICE FOR TRIGGERING ELECTRICAL ACTIVITY IN A NERVE CELL has been constructed, opening possibilities for two-way, non-toxic communication between computer chips and nerve cells. Previous devices for stimulating nerve cells were metallic devices generating ordinary electric currents. Not only do such devices have corrosion-prone electrodes, but their currents create electrochemical byproducts and heat that could damage the nerve cells and themselves. The silicon device, constructed by researchers at the Max Planck Institute for Biochemistry in Germany, contains a "stimulation spot" that triggers neural activity simply through the rearrangement of electric charge. Insulated by silicon oxide, the stimulation spot has a size (between 10 and 50 microns) matched to that of a leech nerve cell to which it is connected. A voltage pulse applied to the spot rearranges electric charge on the silicon oxide film and the insulating membrane of the nerve cell, creating a buildup of positive charge in the nerve cell which causes it to fire above a certain threshold. The silicon device is capable of triggering a single nerve cell without affecting other nearby neurons. The device complements the previously designed "neuron transistor," which receives ionic signals from nerve cells and transcribes them to electronic signals in silicon. "These two devices join the two worlds of information processing, the silicon world of the computer and the water-world of the brain," says the Max Planck Institute's Peter Fromherz (fromherz(a)vms.biochem.mpg.de) Developing this device for biomedical applications, such as computer-controlled artificial limbs, is not envisioned at the present moment, as researchers will first need to build and understand devices that interact with connective tissue and other non-neuronal cells in the body. (Peter Fromherz and Alfred Stett, upcoming article in Physical Review Letters; text and figures are available from AIP Public Information, 301-209-3091, physnews(a)aip.org.) - ------- End of Forwarded Message ------- End of Forwarded Message

1 0