December 2003 - cypherpunks-legacy

Re: NSA leak (fwd)
by Secret Squirrel 17 Dec '03

17 Dec '03

Subject: Re: NSA leak (fwd) Ian Goldberg <iang(a)cs.berkeley.edu> writes: > 2. Their cracker changes the state of 2^128 bits in 33 minutes. This is > being extremely generous; > (Actually, for all I know, terawatt power sources > may exist; that's out of my field. Please let me know if this is the case. Not within a few million miles of here, and they'd be hard to conceal. A few GW is fairly easy, by several methods. Terrestrial fusion is not a serious contender yet, and I doubt it will be for a long time. > 3. They have a quantum computer, or some alien technology, or something > else we know pretty much nothing about. > Given this choice, I would vote for #3. :-) However, I'd go out on a limb > and say that the NSA guy was simply lying (or that the anecdote itself is > mistaken). I agree. The 'something else' could be info about RNG flaws I suppose. This guy couldn't be thinking about DES could he ?

3 2

Re: SSL challenge -- broken !
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Joe Buck writes: <snip> >Your credit card number, expiration date, etc, are continually being >revealed to minimum-wage clerks all the time, unless you never use the >card. A chain is only as strong as its weakest link; it makes no sense to >buy an expensive lock when your door has a big enough opening to climb >through. Should some bad person get hold of your card number and misuse >it, you're not out any money: I'm not so sure....Checked the fees/interest lately? "There ain't no such thing as a free credit card theft." [Apologies to Milton & Rose Friedman.] ;) >you just tell the card company "I didn't buy >that". Since there's so much tracing in the system, if you buy a physical >something with a stolen credit card number it can usually be traced to you >(who'd they ship the package to?). They only *sometimes* find the person/loot. >It's not clear to me that *any* >encryption is really essential if the only purpose is to protect credit >card #'s from snoopers. OK, but I had an idea a number of years ago. It's not too new, either, and considering the BILLION$ in credit-card fraud, I think the credit card companies could implement it with little trouble at every site the cards are used. Why not PIN numbers. Banks and their customers are already used to them, they could be entered over the phone (I know, not too secure) or in person, and considering the dollar ammount of the current fraud, they would be cheap (I think). [There is probably a flaw in my idea, but I haven't found it.] <snip> >Q: Of the 20,000 credit card #'s stolen from Netcom's computer, how many >were used to buy things? Answer: not sure, but expect the answer is "zero". Probably so, but imagine being a Netcom customer (or a Netcom stockholder). Not all of the costs of crime are monetary. JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMDKdH21lp8bpvW01AQGBTwP/VQ7BNPAAna6ba3avp+y9us0E5hhpUGdJ 6shHmZjPDWrSZz9aGzq5xhkQzSKdlLy/lFePt8acFBbDaGnK8wzAvoo1S69mr4bA AUJ+IsI5j/Ctvic0RGbiIlfy+thXna6iwTgDovBB7u311+UMCgMg0A89onIjWCQQ jKN2sSimEHg= =0TzV -----END PGP SIGNATURE----- Regards, Jim Ray Don't investigate Mena, Arkansas and contra-coke. Embarrassment is a threat to national security... ------------------------------------------------------------------------ PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 ------------------------------------------------------------------------ Support the Phil Zimmermann (Author of PGP) Legal Defense Fund! email: zldf(a)clark.net or visit http://www.netresponse.com/zldf ________________________________________________________________________

2 1

Re: SSL challenge -- broken !
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Joe Buck <jbuck(a)Synopsys.COM> wrote: <snip> >Yes, it's true that {fraud} contributes to high interest rates (though >defaults cost more than fraud). Sometimes there's little difference. <snip> >> They only *sometimes* find the person/loot. > >Doesn't matter, this is a disincentive to theft and you are never liable >unless you lost your physical card. I was referring to my previous point, whether or not you're *individually* liable, "somebody" always pays. <snip> >It would cost billions to get every single merchant that accepts credit >cards set up with PIN equipment. Agreed. Fraud/defaults cost billions too, the billions I propose spending would be a one-time, rather than yearly, cost. > >> Why not PIN numbers. <snip> > >You have to make sure the clerk that gets your order doesn't see the >PIN (so you need a secure path between you and your credit card co. >that avoids the merchant). I was thinking of some piece of hardware the clerk could hand you, but "shoulder surfing," by the clerk or by other customers, will always be possible, just as with ATMs or phonecards. My idea isn't perfect, just better than the present reality, IMO. >And what about the tellers? Do you know >how badly they are treated? They can get all those #'s. Yes, it >can be done: ATMs are set up that way. But as long as it's not done, >those who scream at the horrors of sending credit card #'s over the >net aren't thinking clearly. > >Never forget that social engineering is the easiest hack. Technical >solutions that ignore wide-open social engineering paths are worse >than useless (worse because they give an illusion of security). Agreed. My idea *is* imperfect. Social engineering works well. I just don't want to let the great be the enemy of the good, and the credit card fraud situation now is intolerable. JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMDKxtm1lp8bpvW01AQFiCQQArDkX2OS/9FitoMYfKHa2K5O9UsAw+Yv9 yVrp1T8NtvieQkVMEpAbhAq3ISEcam2WsVOAOUPT7goK4yyzSz2UURaDsAru8kRO 66A9p0QSmS7sciNV4N2tGz/KlM44wV8axNs/9R9AAktnHhD/YbhtF0ONXTUXzrDi FwTSwgVD71o= =a9+Y -----END PGP SIGNATURE----- Regards, Jim Ray "The important thing is not to stop questioning. Curiosity has its own reason for existing. One cannot help but be in awe when he contemplates the mysteries of eternity, of life, of the marvelous structures of reality. It is enough if one merely tries to comprehend a little of this mystery every day. Never lose a holy curiosity." -- Albert Einstein ------------------------------------------------------------------------ PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 ------------------------------------------------------------------------ Support the Phil Zimmermann (Author of PGP) Legal Defense Fund! email: zldf(a)clark.net or visit http://www.netresponse.com/zldf ________________________________________________________________________

1 0

Randal Schwartz Petition
by Robert A. Hayden 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I hate to do this, but for any of you that have been following the Randall Schwartz (or Perl fame) fiasco, there is now a URL with information about collecting petition signatures and letters of support for the sentencing judge. The URL is found at http://www.ugcs.caltech.edu/~kluster/petition.html/ Personally, I think it's rediculous all the crap that went into this conviction, but that's just my personal opinion. This probably isn't the correct place to discuss it, but misc.legal.computing has taken it up. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: PGP Signed with PineSign 2.2 iQCVAwUBMDKdnDokqlyVGmCFAQGUNgP+NgqXU3p7Pb0vXYMb9gBiqDzGcIYeXdLG KfhmbTG0mOaVvcWzrrD7oEkdTXiPUhtzOknWH4C6OalSV54JwYGVEueOPfpeztBG 2u0izzyTX1UB2cCb352PxstpwSkrFoQHUqVCDRpHZcSNcTwfrS3vmYK5fLE5VY6n 203SEqfYupA= =Q4x2 -----END PGP SIGNATURE----- ____ Robert A. Hayden <=> hayden(a)krypton.mankato.msus.edu \ /__ Finger for Geek Code Info <=> Finger for PGP Public Key \/ / -=-=-=-=-=- -=-=-=-=-=- \/ http://krypton.mankato.msus.edu/~hayden/Welcome.html -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GED/J d-- s:++>: a-- C++(++++) ULU++ P+ L++ E---- W+(-) N++++ o+ K+++ w--- O- M+ V-- PS++>$ PE++>$ Y++ PGP++ t- 5+++ X++ R+++>$ tv+ b+ DI+++ D+++ G+++++ e++ h r-- y++** ------END GEEK CODE BLOCK------

1 0

Re: Phone call for Mr. Doligez, was Re: SSL challenge -- broken !
by cmcmanis＠scndprsn.Eng.Sun.COM 17 Dec '03

17 Dec '03

jweis wrote: > I have to agree, Netscape may spend some energy to upgrade their > encryption, but it really won't buy them all that much. SSL, to me, is > like using a "security envelope" to mail cash or putting the club on your > car. It presents just enough of an obstacle to keep honest people honest. This is the problem of using "physical" world analogies with the network. A similar argument that is posited is that "Sure its not 100% secure but its better than the carbons from a receipt (now gone) or people who don't shred their garbage." I respond that the network isn't the "real" world so the laws of physics don't apply. Someone in Boston MA is unlikely to fly into Sunnyvale to paw through my garbage, but it would be "trivial" for them to see my receipt go flashing by can throw some spare compute cycles at breaking it. A snooper/cracker program on a "spare" machine might yield a half dozen credit cards a week. I prefer the attitude of better vigilance through layered encryption. That is the transaction might be 40bit RC4 but the "jewels" (otherwise known as the credit authorization information) should be DES3. --Chuck Just my opinion of course.

1 0

ELINT easier than HUMINT
by tcmay＠got.net 17 Dec '03

17 Dec '03

(I've deleted the other list that was cc:ed here....) At 4:03 AM 8/17/95, Chuck McManis wrote: >This is the problem of using "physical" world analogies with the network. >A similar argument that is posited is that "Sure its not 100% secure but >its better than the carbons from a receipt (now gone) or people who >don't shred their garbage." I respond that the network isn't the "real" >world so the laws of physics don't apply. Someone in Boston MA is unlikely >to fly into Sunnyvale to paw through my garbage, but it would be "trivial" >for them to see my receipt go flashing by can throw some spare compute >cycles at breaking it. A snooper/cracker program on a "spare" machine >might yield a half dozen credit cards a week. I agree. This has direct parallels to "physical eavesdropping" vs. "electronic eavesdropping." After all, one might argue, why bother with encrypting phone conversations when a physical bug could pick up the audio? As Whit Diffie has noted, the difference is one of ease of use. It is hard to plant physical bugs...and expensive, prone to error, etc. It would also be pretty obvious, eventually, if every office in a building were physically bugged, but it would be almost undetectable if the Northern Telecom PBX box in the basement was being tapped on the way out. Crypto with back doors is even easier for the wiretapper. Electronic surveillance and related technologies (packet sniffers are a form of surveillance) are cheap by comparison to physical surveillance. And the concentration of communication lines and systems makes ELINT and COMINT much cheaper _per target_ than HUMINT. Now I don't personally worry too much at this time about giving my VISA number over the phone, or even over the Net...I can always deny making an authorization and the CC companies will not charge me (assuming the goods ordered were not also shipped to my address). But the future lies with protecting electronic transactions against surveillance. The breaking of SSL in Netscape is not terribly important in and of itself, given the government-imposed limits on key size, and given the sorts of things now being encrypted (like VISA numbers). It gets more important as the types of things encrypted become more serious. At least now we know how people were "vanished" in that recent movie. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

SmartCash (NewsClip)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Alliance formed to develop first nationwide smart card company New York, Aug. 16 (Reuters) - The United States is a step closer to cashless commerce. Fourteen banks and financial instutions said Wednesday that they will form a company to develop and issue the first debit card that can be used nationwide instead of cash for purchases under $20. The new company, to be called SmartCash, will help speed the implementation of so-called "smart card" technology that uses a micro-processor chip embedded in the card to store vast amounts of information, including improved security features. "The chip gives the card an amazing abitity to contain stored information," said Nancy Elder, a spokeswoman for MasterCard International Inc., one of the companies participating in the creation of SmartCash. In addition to Mastercard International, other founding companies include Banc One Corp., Bank of America, Chemical Bank Corp., CoreStates Financial Corp., NationsBank Corp. and Wachovia Corp. However, participation in SmartCash will be open to all U.S. financial institutions and card providers, the companies said. "SmartCash represents a shared vision and a shared commitment to deliver the increased convenience, flexibility and efficiency of electronic cash to U.S. consumers, merchants and banks," said Hatim Tyabji, chairman of VeriFone Inc., a pioneer in stored value technology and another founder of SmartCash. The SmartCash card also will be standardised with similar efforts already underway for smart cards developed by credit card companies Europay, MasterCard and Visa. "Standardized specifications are all woven into the process. If you use your card in New York, it will be the same as if you use it on the West Coast," Elder said. The stored value application, one of the many uses of the card's embedded chip, enables funds from the cardholder's bank or credit-card account to be loaded into the card from an automated teller machine or from one of the terminals now under developement specifically for the SmartCash card. Elder said the companies have not identified what the cost to the consumer would be, but noted, "the consumer is going to have to see the value in it for them to want to use it." She also said there was a potential for the card to be expanded for use by those without bank accounts, who could credit the card in person at various locations. Elder added that the demand for such a versatile card was the driving force behind the broad alliance of companies already signed on to the SmartCash plan. "Sixty percent of consumers surveyed in the U.S. said they would be willing to switch banks to get the use of stored value (cards)," Elder said. Amy Brinkley, executive vice president at NationsBank, said the venture showed "unprecedented industry cooperation to develop an innovative financial product." SmartCash will combine assets and staff of the founding companies and pursue technology being developed by MasterCard, VeriFone, Electronic Payment Services Inc., and privately held Gemplus. A pilot programme is already under development in Delaware that will be overseen by Wilmington Trust and Electronic Payment and other regional pilot programmes were likely to spring up around the country next year, Elder said. -----

1 0

Re: Phone call for Mr. Doligez, was Re: SSL challenge -- broken !
by Dave Crocker 17 Dec '03

17 Dec '03

At 11:32 AM 8/16/95, Jason Weisberger wrote: >like using a "security envelope" to mail cash or putting the club on your >car. It presents just enough of an obstacle to keep honest people honest. As the Mitnick experience shows, the vulnerability of the providers' host systems is a concern not addressed by link-oriented schemes such as SSL. Longer keys for SSL would not have improved the protection on the 30,000 credit card numbers he stole. d/ -------------------- Dave Crocker +1 408 246 8253 Brandenburg Consulting fax: +1 408 249 6205 675 Spruce Dr. page: +1 408 581 1174 Sunnyvale, CA 94086 USA dcrocker(a)brandenburg.com

1 0

SSL Challenge - Some thoughts
by goedel＠tezcat.com 17 Dec '03

17 Dec '03

1. What kind of pseudo random number generator does Netscape use? 2. If it is a cryptographically secure sequence, doesn't that run up against ITAR restrictions? 3. Can we improve upon the brute force algorithm in a non-probabilistic way? 4. If we are happy with a 5% yield, we can restrict ourselves to the same 5% of the key space for each message. DJK

1 0

Phone call for Mr. Doligez, was Re: SSL challenge -- broken !
by rah＠shipwright.com 17 Dec '03

17 Dec '03

>-----BEGIN PGP SIGNED MESSAGE----- > >SSL challenge -- broken Indeed, it seems so, and the feeding frenzy in the press has begun. I zinged this over from cypherpunks to www-buyinfo this morning, and this afternoon I got a rather interesting call from a reporter. I told him about ITARs, its effect on internet commerce and the silliness of a 40 bit key, etc. He wanted to know if I knew Damien's phone number(!), and I told him to have ATT put one of their translators-for-hire on the line and call INRIA, Ecole Polytechnique, or Ecole Normale Superieure, and track him down there. Meanwhile, if Mr. Doligez sees this, call Alan Beck at 619-625-0700, or email him at alan(a)tgc.com. I can see the headlines now: "Netscape Security Broken, Stock Falls". Make-a the Ganglia Twitch. Haven't had this much fun since the hogs ate my little brother... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

2 1

SmartCash
by nobody＠valhalla.phoenix.net 17 Dec '03

17 Dec '03

Alliance formed to develop first nationwide smart card company New York, Aug. 16 (Reuters) - The United States is a step closer to cashless commerce. Fourteen banks and financial instutions said Wednesday that they will form a company to develop and issue the first debit card that can be used nationwide instead of cash for purchases under $20. The new company, to be called SmartCash, will help speed the implementation of so-called "smart card" technology that uses a micro-processor chip embedded in the card to store vast amounts of information, including improved security features. "The chip gives the card an amazing abitity to contain stored information," said Nancy Elder, a spokeswoman for MasterCard International Inc., one of the companies participating in the creation of SmartCash. In addition to Mastercard International, other founding companies include Banc One Corp., Bank of America, Chemical Bank Corp., CoreStates Financial Corp., NationsBank Corp. and Wachovia Corp. However, participation in SmartCash will be open to all U.S. financial institutions and card providers, the companies said. "SmartCash represents a shared vision and a shared commitment to deliver the increased convenience, flexibility and efficiency of electronic cash to U.S. consumers, merchants and banks," said Hatim Tyabji, chairman of VeriFone Inc., a pioneer in stored value technology and another founder of SmartCash. The SmartCash card also will be standardised with similar efforts already underway for smart cards developed by credit card companies Europay, MasterCard and Visa. "Standardized specifications are all woven into the process. If you use your card in New York, it will be the same as if you use it on the West Coast," Elder said. The stored value application, one of the many uses of the card's embedded chip, enables funds from the cardholder's bank or credit-card account to be loaded into the card from an automated teller machine or from one of the terminals now under developement specifically for the SmartCash card. Elder said the companies have not identified what the cost to the consumer would be, but noted, "the consumer is going to have to see the value in it for them to want to use it." She also said there was a potential for the card to be expanded for use by those without bank accounts, who could credit the card in person at various locations. Elder added that the demand for such a versatile card was the driving force behind the broad alliance of companies already signed on to the SmartCash plan. "Sixty percent of consumers surveyed in the U.S. said they would be willing to switch banks to get the use of stored value (cards)," Elder said. Amy Brinkley, executive vice president at NationsBank, said the venture showed "unprecedented industry cooperation to develop an innovative financial product." SmartCash will combine assets and staff of the founding companies and pursue technology being developed by MasterCard, VeriFone, Electronic Payment Services Inc., and privately held Gemplus. A pilot programme is already under development in Delaware that will be overseen by Wilmington Trust and Electronic Payment and other regional pilot programmes were likely to spring up around the country next year, Elder said. -----

1 0

Re: SSL challenge -- broken !
by Bill Stewart 17 Dec '03

17 Dec '03

At 04:39 PM 8/16/95 -0500, you wrote: >> I haven't seen any news stories about this on the wire >> services. Someone would have to write a story about it first before >> people would know... > >I've suggested this to a few reporters I know.. It's worth suggesting this _carefully_ so the spin's right. For instance "Oh, no, Netscape lets Hackers suck all the money out of your credit cards" would be bad :-) On the other hand, "The US Government's Evil Plans to block encryption are limiting Netscape's export products to an encryption system already broken by a French university. This means you can send credit card numbers safely to American web sites, but not to foreign ones - like the airline or hotel reservations you were making for your vacation, or those Irish handcrafts or bottle of Scotch you were ordering, or that Hong Kong magazine you were subscribing to, or the CD from that band in Budapest that had the great sound samples out there. And when you were donating to that Amazon rainforest conservation group, the NSA's arbitrary export rules may have just helped the Colombian drug cartels rip off your credit card." #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- "The fat man rocks out Hinges fall off Heaven's door "Come on in," says Bill" Wavy Gravy's haiku for Jerry

1 0

Re: SmartCash (NewsClip)
by Duncan Frissell 17 Dec '03

17 Dec '03

>She also said there was a potential for the card to be >expanded for use by those without bank accounts, who >could credit the card in person at various locations. Or even those who don't exist. Sounds like real cash to me. Note that 20% of the population have no bank accounts. DCF "Coercion-based systems only work if the person coerced is immobile, stupid, or weak."

1 0

WSJ on SSL Crack
by John Young 17 Dec '03

17 Dec '03

The Wall Street Journal, August 17, 1995, p. B3. French Hacker Cracks Netscape Code, Shrugging Off U.S. Encryption Scheme By Jared Sandberg A computer hacker in France has breached the encryption scheme of new Netscape software for navigating the Internet, the global computer network. The breach underscores flaws in U.S. rules restricting the export of more-sophisticated security measures. The hacker, a French student at the Ecole Polytechnique, cracked the weaker encryption scheme that U.S. government policy forces Netscape Communications Corp. to use in a foreign version of its Navigator software. Yesterday, he posted the results of his efforts on the Internet's Cypherpunks discussion group. The student took up a challenge issued on July 14 in the Cypherpunks group, which is frequented by cryptography experts and hackers and mathematicians. He used 120 powerful computer workstations and two supercomputers to crack a piece of information encrypted in Netscape's "browser" software. The security is aimed at scrambling sensitive financial data to keep credit-card numbers, sales transactions and other material safe from breakms. The highly sophisticated computers took eight days to break the code -- far more power and time than the typical illegal hacker would be able to muster for criminal pursuits. But the chore nonetheless highlights the vulnerabilities that could make customers shy away from conducting commerce on the Internet, particularly international users who can't get hold of the tougher security measures allowed within the U.S. The French hacker was able to crack the so-called 40-bit encryption scheme in Netscape's overseas version of its software. In the U.S., Netscape employs a far more powerful design -- 128 bits, a number that refers to length of the encoding "key," which is used to scramble data. U.S. rules limit Netscape to exporting only 40-bit encryption overseas. Yet the 128-bit version takes exponentially more power to crack: Compared with violating the 40-bit scheme, the 128-bit key would take 10-to-the-26th-power more time to breach, experts say. That's a 1 followed by 26 zeroes, a factor of time that makes it all but impossible for hackers to break in. Netscape wasn't surprised at the findings. The company said it has always known and stated that 40-bit security could be breached by "brute force," the use of massive computing power to descramble the information. "This is a good indication of why the government should allow us to ship more secure software," said Mike Homer, Netscape's vice president of marketing. "The laws are archaic." Clinton administration officials have viewed strong encryption as a weapon for foreign terrorists, who could exchange communications without fear of eavesdropping by law enforcement officials. That policy, however, has raised the hackles of industry executives, who say that without strong encryption abroad, the growth of electronic commerce could be significantly stunted. Last week, a group of software executives told the White House that restrictive export regulations might blunt American competitiveness in foreign markets. "Netscape security is fine," said Dietrich Cappe, a senior partner at Red Planet LLC, an Internet consulting company. "As long as the government's export restriction exists, commerce is going to be severely hampered." Netscape licenses the encryption algorithm from RSA Data Security Inc., one of the most prominent software security firms that licenses its software to most major software companies. "We've warned the government that the level of security they allow our customers to export is too weak," said James Bidzos, president of RSA. "Maybe they'll listen now." Netscape's Mr. Homer noted, however, that the amount of effort and computing power, which could cost as much as $10,000 in addition to the cost of the machines, don't make even breaches of 40-bit security practical from a thief's perspective. "You'd be better off working in a shoe store, stealing credit card numbers for a week." Mr. Homer said. [End]

1 0

Re: SSL challenge -- broken !
by Perry E. Metzger 17 Dec '03

17 Dec '03

It has occured to me that, because the RC4 key crackers spend most of their time in key setup, you can crack N SSL sessions that you captured in not substantially more time than it took to crack 1. This is analagous to the way brute force Unix password file hacking operates. Perry

1 0

Re: SSL challenge -- broken !
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

> It has occured to me that, because the RC4 key crackers spend most > of their time in key setup, you can crack N SSL sessions that you > captured in not substantially more time than it took to crack > 1. This is analagous to the way brute force Unix password file > hacking operates. This occurred to me a whila ago too, and I thought it a very cool idea, as it would mean you could do loads of keys at once with little additional compute time. Then I changed my mind, there's a reason this doesn't work with 40 + 88 SSL, I think. It works well enough for straight RC4, as you just compare lots of keys at once, the RC4 output which will be XORed just gets compared against lots of sample plain text / cipher texts simulataneously. The actual key used is the 40 bit key you're bruting, plus what is effectively an 88 bit salt (in unix password nomenclature, only unix password salts are typically 12 bits). The actual 128 bit RC4 key is generated by taking the MD5 of the known and unknown key bits, plus a couple of other things. As the 88 known bits are randomly generated you can't combine work. If I have misunderstood something, or there is a way to work around this, please explain, because being able to do this would be a huge boon to the key breaker. It would allow you to break keys at a ferocious rate if you had lots of keys to break. Adam

2 1

Re: Phone call for Mr. Doligez, was Re: SSL challenge -- broken !
by Damien.Doligez＠inria.fr 17 Dec '03

17 Dec '03

>In general, it just adds more flames to the fire started by the >letter written by Microsoft, IBM and Lotus. Their point is bolstered >by this easy attack. Well, that was the whole point of the challenge, wasn't it ? Why didn't the journalists didn't write their articles one month ago when Hal posted his challenge ? What I find surprising is that it took as long as one month. I was even surprised when it wasn't done after two weeks, and that's when I started working on it. -- Damien P.S. check out <URL:http://pauillac.inria.fr/~doligez/ssl/press-conf.html>

1 0

(fwd>>)309,485,009,821,345,068,724,781,056
by rah＠shipwright.com 17 Dec '03

17 Dec '03

--- begin forwarded text From: "John Hemming - CEO MarketNet" <JohnHemming(a)mkn.co.uk> Date: Thu, 17 Aug 1995 08:39:37 AM PDT To: www-buyinfo(a)allegra.att.com Mime-Version: 1.0 Subject: 309,485,009,821,345,068,724,781,056 Like .. er ... a big number maan. "SSL" has not been cracked "EXPORT SSL" has been cracked. Then if someone in the next few years can crack SSL with a confidential master key of 128 bits with 2^88 as many required key checks (say half the keyspace at 2^87 as our mate Damien did) then that will be a much bigger story. Then again it was not me floating last week .... In the mean time we encounter the usual inane US government's export restrictions. Can someone put in a word for me please ... Please Please Please Mr Clinton .... keep those export regulations It gives people like myself a major commercial lead in provision of encryption software. So what can we do. Well not being a very trusting soul at times I tried out sending the 01 (SSL 128 bit confidential) message to an export Netscape browser and lo and behold it came up with a cipher conflict. Well that would have been an easy way out. Realistically my internal browser is almost at beta test level and we will put cipher 01 in our selection of ciphers as well as cipher 2. We will also make available our browser to link securely to our servers. If anyone outside US/CA wants work done to bring their systems up to 128 bit confidential ciphers please email jane(a)jhc.co.uk (JHC plc - JHC Internet Services - yes it does mean John Hemming & Co) In the mean time: My credit card number is 5434 8012 0900 2563 expires 3/97 My name is John A M Hemming My address is 15, Chantry Road, Moseley, Birmingham B13 8DL Who loses if you use that: Firstly, I now have to check my credit card statements for items that are not mine. This will be a pain, but it makes a point clear. Secondly, if you use it you will be breaking the law. Thirdly, when the merchant has to refund up to 6 months of trading turnover on any duff orders the merchant will be seriously upset. My name and address are a matter of public record in the UK. I have only made the job easier by putting all of the information in one place. The card number and expiry date are available in any one of a number of places. (As a City Councillor in Birmingham my address has to be available to the public). 1. Export SSL is good enough for credit card numbers. 2. My bank account is protected by export SSL (I mean that you need to crack export SSL to look at the balances) Alternatively you can phone up the bank and pretend to be the police/head office/inland revenue and ask them. 3. Export SSL or even import SSL is not good enough for entering into contracts. Digital signatures are needed for that. In the mean time ..... I have managed to implement PGP into my workhorse program (which is gradually coming up to beta standard). It seems interoperable with the PGP.exe file in Europe. (As long as you keep the message reasonably short) This allows two interesting additions <A HREF="mailto:abc@def.com"> has been extended to <A HREF="mailto:abc@def.com" PGPKEY="abcddbdb etc"> When you click on that it does a mailto, but also loads the PGP key (public key and userid packets). The program saves both the plaintext and encrypted version and then mails out the encrypted version. The PGP key packet has to have the same email address as that in the mailto otherwise the program will freak. see http://mkn.co.uk/ Which uses that. Similarly <FORM HREF="mailto:banana@orange.com" PGPKEY="asdfj"> allows the encryption of a form before it is mailed. I do have a test form somewhere try the pages in http://mkn.co.uk/help+dir+test\*.* This is quite a nice solid way of ensuring high level encryption for passing around confidential information from forms. Sadly the program that does it ftp://193.119.26.70/mktnet/pub/horse.zip is still a little flaky. Once I have finished off getting 128 bit confidential SSL built into my program I shall be putting in the extensions for electronic cheques (probably today or tomorrow, but I won't be putting that on release even as alpha for the moment). see http://mkn.co.uk/help/policy/htmlext for more details. John --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: SSL challenge -- broken !
by Damien.Doligez＠inria.fr 17 Dec '03

17 Dec '03

>From: Joe Buck <jbuck(a)Synopsys.COM> >However, I disagree with your conclusion: [...] >There's plenty of stuff that *does* need protection, but I'm not sure >credit card #'s head the list. You're right, of course, if you discount the hassle of getting the transactions cancelled whenever your credit card number is used fraudulently. I have much a better example (and a real one, too): I have an account at Wells Fargo Bank near San Fransisco. They recently started offering web access to their customers. That would be great for me because banking by phone is pretty expensive when I'm in France, and it's not always easy for me to understand American accents. So they would give me a password that I can use for some set of operations. I don't know which one exactly, but I would expect it to include electronic transfers from my account to anywhere else. The password is protected by the SSL connection. That would be fine if I had the full SSL security, but in France I can only get the exportable version of Netscape. As a result, I won't be using this service. There's the beginning of a market for full-SSL clients and servers outside the US. Maybe Netscape should go multinational right now. -- Damien

1 0

UK Independent on SSL crack
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

from the "ukpipeline" :-) >>>>>>>>>>>>>>>>>>>> UK Indpendent newspaper, 17/8/1995 Internet's 30bn Pound Secret Revealed Charles Arthur Technology Correspondent A French student has cracked the most commonly used encryption system used to pass financial transactions over the Internet, threatening a business forecast to be worth billions of pounds worldwide. Damien Doligez, 27, a PhD student at the Inria research centre near Paris, broke a software "key" used by the Netscape browsing program, which lets users navigate the World Wide Web. With Netscape, Internet users can visit shopping "sites" on the Web and order goods by sending their credit card and address over the network to the site. To prevent anyone picking up those confidential details as they pass through the network, they are encrypted first using a software "key". This is the system used for example by Barclays Bank's "BarclaySquare" project, launched in May, which offers access to eight major retailers. Market research companies forecast that money transmission over the Internet will be worth more than 30bn pounds by 2005. At the launch of BarclaySquare, Roger Alexander, managing director of the unit said: "The encryption method has been rigorously tested by us". But Mr. Doligez has compromised that security by decoding a test example of an encrypted transaction, posted on a number of Internet discussion groups in July. The transaction was scrambled using a digital key 40 bits long, which offers about 1,000 billion ( a million million) possible combinations. Mr Doligez harnessed spare time on 120 workstations and parallel computers. The computers turned up the answer after eight days. "I wouldn't trust my credit card number to Netscape," Mr Doligez told the Independent from Paris yesterday. Netscape Communications, whose flotation on the New York Stock Exchange raised more than $1bn, said "We have always said this would be theoretically possible." [end]

1 0

Predicament Again
by Duncan Frissell 17 Dec '03

17 Dec '03

Just because I love beating a dead horse... Back in June we had the argument over whether or not Phil Z should be worried because of the threat of prosecution hanging over him. And a prosecutor (?) by the name of Brian Davis as well as Tim and others thought that I was wrong to say that I would enjoy the process because of the opportunities for verbal abuse and point scoring that I would have were I under threat of prosecution in a case the government couldn't win. (Mostly pure 1st Amendment cases.) The reason that this is important is a big fat tactical fact. Defeat is a process that takes place in the mind of the enemy. It is well known to military types that it is possible for the weaker force to overcome the stronger force if the stronger force can be convinced that it has lost. People are rapidly becoming the stronger force in conflicts with governments because of technology, but governments are trying to use intimidation where they lack the capabilities. They are trying to psych us (and particularly the more credulous) out. We can fight this weapon by constant hammering at the fact of the government's weakness and its failure to intimidate us. Since most of what we do on the nets is speech and since speech enjoys a great deal of protection in the US, it is important to hit the opposition hard in speech cases where we have a strong hand. I certainly don't advocate abuse of prosecutors in other cases (taxes and drugs) where conviction is likely. But in pure speech cases, we should really heap on the derision. I happen to think that the prosecution of the award-winning Phil Zimmermann is one of those kinds of cases. Another similar case surfaced in Connecticut. The "Greenwich 5" had conspired so that nonsense syllables in their high school yearbook photo captions spelled out "Kill all the [African Americans]." (Note the cypherpunk significance of code use.) There was a bit of controversy of course and the young scholars volunteered to attend a "Civil Rights Boot Camp" run by the now neo-conservative CORE. Some weeks later, local and state prosecutors announced that they would not prosecute the 5 under CT's civil rights laws because of "lack of evidence." Calls to The Butcher of Waco for federal prosecution followed but have as yet had no results. This is the sort of case in which I would advocate that the "object of prosecutorial interest" be as aggressive and abusive as possible. The reason the prosecutors declined to prosecute was not lack of evidence but lack of law violation. The prosecutors were too cowardly to state that the Greenwich 5's action was perfectly legal. Since the public servants won't, it is up to those who are attacked to do so. The benefits of cutting through the exon in a case like this is that prosecutors are less likely to proceed in similar cases in the future and the public is educated as to the true state of the law. It is recreational as well. DCF "Few generals have ever been defeated because they had too many soldiers under their command."

1 0

Another SSL breakage...
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- All hell seems to have broken loose whilst I was lazing on the beach yesterday. SSL breakings, big name newspaper newsreports (of varying degrees of accuracy), and much ITAR bashing (yay!) or perhaps that should be nooooh! 'cos I might be doing myself out of work as a UK crypto hacker (as John Hemming said in the article Robert Hettinga forwarded) if we loose the fun advantage of being in the free world, and not having to follow the ITAR nonsense. Anyway, congratulations Damien! As Hal said, another group was working on the SSL challenge (albiet just for software testing purposes). Here's the story.... on Tue, 15 Aug 1995 10:43:15 +0200 I recieved this from David Byers <davby(a)ida.liu.se>: > Eureka! > > Encrypted Master Key: 7ef0961fa6 > > [...] So who was first? David hit it Tue 10:43 GMT+2. Doesn't matter, the more the merrier, and the better to demonstrate the silly ITAR export restrictions. This was a trial run at breaking it which two people had done just to check if their respective software was working correctly. It appears that it was :-). This testing was some of the reason for the slowness in getting the group effort started, we were very keen to ensure it really would work, and that the software was working perfectly. Disappointment with the RC4 bruting demonstrated the importance of checking first. On with the story, Davids eureka arrived Tuesday, I tinkered with it some, but was interpreting it wrongly and left it for that day, then I was away yesterday (at the beach with wife and kids, nice weather over here), and figured out how to apply the key this morning (with a bit of prompting from Hal as to what I was doing wrong), just after reading Damien's announce on cpunks, where he independently bruted it on a farm of workstations. Here's the output, with the "Mr Cosmic Kumquat" from "SSL Trusters Inc": > PPOST /order2.cgi HTTP/1.0Referer: https://order.netscape.com/order2.cgi > User-Agent: Mozilla/1.1N (Macintosh; I; PPC) > Accept: */* > Accept: image/gif > Accept: image/x-xbitmap > Accept: image/jpeg > Content-type: application/x-www-form-urlencoded > Content-length: 472 > > source-form=order2-cust.html&order_number=31770&prod_80-01020-00_Mac=1&carrier_code=UM&ship_first=Cosmic&ship_last=Kumquat&ship_org=SSL+Trusters+Inc.&ship_addr1=1234+Squeamish+Ossifrage+Road&ship_addr2=&ship_city=Anywhere&ship_state=NY&ship_zip=12345&ship_country=USA&ship_phone=&ship_fax=&ship_email=&bill_first=&bill_last=&bill_org=&bill_addr1=&bill_addr2=&bill_city=&bill_state=&bill_zip=&bill_country=USA&bill_phone=&bill_fax=&bill_email=&submit=+Submit+Customer+Data+ (I won't bother formating it more cleanly as Damien has already done the honors). I think a group effort ought to be done now that we are confident of the software, just to see how darn fast we (cypherpunks as a group) can knock off SSL keys. (This one was done by 2 people for testing purposes, and independently by Damien (who we didn't know was working on it)). I'd really like to work up to a really meanly few hours breakage, as it looks that much more impresive. The next media release ought to be of a steady offer, of the form, cpunks break keys in x hours, where x is a very small number. And not just break one key, but will break lots of keys, as required, until something is done about it (ITAR) :-) Eric Young is currently away on holiday, but I have his machine stats from earlier email, where he explained the hardware he was testing on. Eric swept 8000 - FFFF, and David 0000 - 7ef0 (where he hit the key) Machine stats for this bruting: 1 x 16k processor MasPar MP-1 - 1.5M keys/sec 4 CPUs of R4400 200mhz - 24000 keys/sec 4 CPUs of sparc 60mhz - 17500 keys/sec 2 CPUs of sparc 50mhz - 14800 keys/sec 1 CPU of Pentium 75mhz - 10200 keys/sec 1 CPU of Alpha - 10000 keys/sec 2 CPUs of 88100 - 8000 keys/sec 1 CPU of 88000 - 3500 keys/sec 1 CPU of R3000 36mhz - 3800 keys/sec 49 CPUs of 486DX 50mhz - 3780 per src The workstations total: - 424,320 keys/sec, and the Maspar 1.5M keys/sec on it's own. The 0000 - 8000 sweep was finished Aug 11 (he might have finished a day or two earlier, that's when he replied to my question as to how he was getting on. He left for his holiday after that email. The MasPar sweepings were going fast, swept 0000 - 795d (this was sometime before the 11th Aug) but someone else wanted the machine, so a pause ... and then (presumably Tues morning) 795d - 7ef0 and bang he hit it. We were getting worried about the possibility of software failure by then as we'd already swept 8000 - FFFF and 0000 - 795D accounting for 97.4% of the key space. It was hiding away in the last bit of unswept keyspace. Luck of the draw... A few quick calculations: The maspar alone could do the entire keyspace in 8 1/2 days, or an expected average time of ~100 hours. I believe I'm right that there would be lots of organisations which would sell you idle maspar hours for a lot less than $100 / hr. Heck you could do it with PC's, if they (WSJ article) think it's worth $10k all I can say is "give me the $10k", and I'll do it and make a handsome profit. The workstation farm, at 424k keys/sec could do the job in 30 days, or 15 days average. The workstation farm was only used to sweep half the key space, and was used overnight (12 hours) and weekends (61 hours) only as people were using the machines during the day. Could it have been done with out anyone knowing? Hell, yes - it was in fact, no announce was made as it was just testing etc. Adam - -- HAVE *YOU* EXPORTED RSA TODAY? --> http://dcs.ex.ac.uk/~aba/rsa/ - --rsa--------------------------8<------------------------------- #!/bin/perl -s-- -export-a-crypto-system-sig -RSA-3-lines-PERL $m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2%Sa 2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*',$_)while read(STDIN,$m,($w=2*$d-1+length($n)&~1)/2) - -------------------------------8<------------------------------- TRY: rsa -k=3 -n=7537d365 < msg | rsa -d -k=4e243e33 -n=7537d365 -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQCVAwUBMDNbnSnIuJ1VakpnAQHe9AP8DJBhZ8LyRNx7PO1GY076Cap+xzdS0/ys WE/tdm0GBfjqxvjtar85mmc1hZVPCn1m5Swsflk2ZpieLbwUzHz+g1ciW3IiZu1Y 8Qc2HJxWRrez3J5CeiMHgMJl6Bj6vF5XAWLW0v6NpujbOR9XuIjsKnH3jKvkhLF5 z0u7Oui0AX0= =nkmn -----END PGP SIGNATURE-----

5 4

Re: SSL challenge -- broken !
by goedel＠tezcat.com 17 Dec '03

17 Dec '03

>At 04:39 PM 8/16/95 -0500, you wrote: >>> I haven't seen any news stories about this on the wire >>> services. Someone would have to write a story about it first before >>> people would know... >> >>I've suggested this to a few reporters I know.. > >It's worth suggesting this _carefully_ so the spin's right. >For instance "Oh, no, Netscape lets Hackers suck all the money >out of your credit cards" would be bad :-) On the other hand, >"The US Government's Evil Plans to block encryption are limiting >Netscape's export products to an encryption system already broken >by a French university. This means you can send credit card numbers >safely to American web sites, but not to foreign ones - like the >airline or hotel reservations you were making for your vacation, >or those Irish handcrafts or bottle of Scotch you were ordering, >or that Hong Kong magazine you were subscribing to, or the CD from >that band in Budapest that had the great sound samples out there. >And when you were donating to that Amazon rainforest conservation >group, the NSA's arbitrary export rules may have just helped the >Colombian drug cartels rip off your credit card." Thats pretty much the spin on page B3 of the WSJ. I'll type it in when I get the chance. Dietrich J. Kappe | Red Planet http://www.redweb.com/ Red Planet, L.L.C.| "Chess Space" /chess 1-800-RED 0 WEB | "MS Access Products" /cobre Web Publishing | E-mail: RedPlanet(a)redweb.com

1 0

Re: Another SSL breakage...
by Damien.Doligez＠inria.fr 17 Dec '03

17 Dec '03

>From: aba(a)atlas.ex.ac.uk >on Tue, 15 Aug 1995 10:43:15 +0200 I recieved this from David Byers ><davby(a)ida.liu.se>: > >> Eureka! >> >> Encrypted Master Key: 7ef0961fa6 Then David beat me by about two hours. My program found the result at 12:23 +0200 on the same day. I was not at work (aug 15 is a holiday in France), so I saw it a few hours later, and I wrote my announcement yesterday. I will happily redirect all the journalists to David... -- Damien

1 0

Netsacpe's Offical Response
by Glenn Powers 17 Dec '03

17 Dec '03

Originally From shank(a)netscape.com Thu Aug 17 11:42:39 1995 Received: from lydia.bradley.edu (root(a)lydia.bradley.edu [136.176.5.15]) by spectrum.bradley.edu (8.6.12/8.6.9) with ESMTP id LAA02511 for <gpowers(a)spectrum.bradley.edu>; Thu, 17 Aug 1995 11:42:36 -0500 Received: from bradley.bradley.edu (daemon(a)bradley.bradley.edu [136.176.5.10]) by lydia.bradley.edu (8.6.9/8.6.9) with ESMTP id KAA02851 for <gpowers(a)lydia.bradley.edu>; Thu, 17 Aug 1995 10:39:21 -0500 Received: (from daemon@localhost) by bradley.bradley.edu (8.6.12/8.6.12) id KAA01320 for gpowers(a)lydia.bradley.edu; Thu, 17 Aug 1995 10:39:18 -0500 Received: from neon.netscape.com (neon.netscape.com [198.93.92.10]) by bradley.bradley.edu (8.6.12/8.6.12) with ESMTP id KAA01310 for <gpowers(a)bradley.edu>; Thu, 17 Aug 1995 10:39:12 -0500 Received: from [198.93.94.118] (Shank.mcom.com [198.93.94.118]) by neon.netscape.com (950215.SGI.8.6.10/8.6.9) with SMTP id IAA26102 for <gpowers(a)bradley.edu>; Thu, 17 Aug 1995 08:38:34 -0700 X-Sender: shank(a)pop.mcom.com Message-Id: <v02110107ac5914142373(a)[198.93.94.118]> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Date: Thu, 17 Aug 1995 08:44:45 -0700 X-PH: V4.1@bradley To: gpowers(a)bradley.edu From: shank(a)netscape.com (Peter Shank) Subject: Netscape security Glen, We're sending this response to the press and interested parties; it may also get posted on home.netscape.com. Best regards... -Peter Late Tuesday evening a person from France posted a news article to the hacker community claiming success at decrypting a single encrypted message that had been posted as a challenge on the Internet sometime on or before July 14, 1994. His response to the challenge is described in an email that has been forwarded widely across the Internet. What this person did is decrypt one encrypted message that used RC4-40 for encryption. He used 120 workstations and two parallel supercomputers for 8 days to do so. As many have documented, a single RC4-40 encrypted message takes 64 MIPS-years of processing power to break, and this roughly corresponds to the amount of computing power that was used to decrypt the message. Important points to understand: 1. He broke a single encrypted message. For him to break another message (even from the same client to the same server seconds later) would require *another* 8 days of 120 workstations and a few parallel supercomputers. The work that goes into breaking a single message can't be leveraged against other messages encrypted with other encryption keys. 2. The standard way to determine the level of security of any encryption scheme is to compare the cost of breaking it versus the value of the information that can be gained. In this case he had to use roughly $10,000 worth of computing power (ballpark figure for having access to 120 workstations and a few parallel supecomputers for 8 days) to break a single message. Assuming the message is protecting something of less value than $10,000, then this information can be protected with only RC4-40 security. For information of greater value, currently available RC4-128 security should be used. 3. Inside the US, software can support a range of stronger encryption options, including RC4-128, which is 2^88 times harder to break. Meaning that the compute power required to decrypt such a message would be more than 1,000,000,000,000 (trillion) times greater than that which was used to decrypt the RC4-40 message. This means that with forseeable computer technology this is practically impossible. So in conclusion, we think RC4-40 is strong enough to protect consumer-level credit-card transactions -- since the cost of breaking the message is sufficiently high to make it not worth the computer time required to do so -- and that our customers should use higher levels of security, particularly RC4-128, whenever possible. This level of security has been available in the U.S. versions of our products since last April. Because of export controls it has not been available outside the U.S. We would appreciate your support in lobbying the U.S. government to lift the export controls on encryption. If you'd like to help us lobby the government send email to export(a)netscape.com. Finally, we'd like to reiterate that all this person has done is decrypt one single RC4-40 message. RC4 the algorithm and products which use the algorithm remain as secure as always.

3 2