December 2003 - cypherpunks-legacy

Re: in defense of Lon Horiuchi
by Brian B. Riley 17 Dec '03

17 Dec '03

On 9/11/97 12:16 PM, Zooko Journeyman (zooko(a)xs4all.nl) passed this wisdom: >Lest any naive readers who aren't familiar with the details of >the event buy this kind of spin-doctoring, please be aware that >the woman in question was probably not visible to the sniper, >and it is almost certain that he was aiming at her armed >husband who was shooting back. The bullet travelled through a >door or some such obstruction I think (I forget the details) >before hitting the victim. >You could more reasonably blame the husband for having the >stupidity or carelessness to get in a firefight with his wife >and child in the building. This doesn't sound like any accounts I have read of what happened at Ruby Ridge ... Zooko I think you are the one off base here. Brian B. Riley --> http://www.macconnect.com/~brianbr For PGP Keys - Send Email Subject "Get PGP Key" "Lord, what fools these mortals be!" -- Puck, A Midsummer Night's Dream

1 0

Let sleeping dogs lay
by Tim May 17 Dec '03

17 Dec '03

"Nothing good can come out of crypto legislation." --said by several of us over the past year The big mistake was ever introducing the SAFE and Pro-CODE bills, as it brought the NSA and FBI out of their warrens and into the warrens of Congress. Without any crypto bills at all, it is possible (though by no means certain) that no legislation at all would have been introduced this year. But once SAFE and Pro-CODE were out there, on the table, the forces in favor of a surveillance state began their lobbying in earnest, giving the infamous "if you only knew what we knew" scare tactic pitches. Last minute amendments and even complete bill replacements are easier to slip in than a Big Brother bill from the gitgo. Sure enough, the tide is now moving swiftly toward a future far, far, far worse than the mere annoyance of export controls. Several committees are now competing to see which can "protect us" from the Four Horsemen the best. The archives say this many times. For a change, and to forestall criticism, I'll find a quote from someone other than me. For example, Mike Duvos said this, last June, 1997-06-19: "You really can't fight Congress. Ten minutes after you defeat a bill and spend all your resources, it will be back on the floor under another name and the whole thing will start over again. After you defeat that one, you will discover that the text of the measure got passed late one night as an ammendment to something completely unrelated. "The government has infinite resources to harp incessantly on anything until they engineer consent for it and get what they want. Resistance is Futile. You will be Assimilated." Recall that several of us were involved in a serious battle with Rotenberg over the basic wisdom of the CDT and EPIC types pushing for export legislation, with (even then) unacceptable language about "use a cipher, go to prison." The current language is of course a full-blown disaster. Pandora's box was opened by SAFE and Pro-CODE. And so here we are. Multiple committees in both houses jockeying to see who can clamp down the hardest on crypto. CDT, EPIC, and all the other Beltway insiders ought to think about this mess. Sometimes it's better just to let sleeping dogs lay. Or lie. Or whatever. Time to just pull out of D.C. It is corruption on Earth. --Tim May There's something wrong when I'm a felon under an increasing number of laws. Only one response to the key grabbers is warranted: "Death to Tyrants!" ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: in defense of Lon Horiuchi
by Brian B. Riley 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 9/11/97 3:43 PM, Chip Mefford (cmefford(a)avwashington.com) passed this wisdom: >Even dumb ole me, who ain't no crack shot, with one of those nifty >(off theshelf) Styer-Mannlicher countersniper rifles with the neato >Zeiss autoranging scope was able to punch a coke can 5 for 5 after >one ranging(cheater) shot at 600 meters. I'm told that the FBI has >much nicer rifles than that. And I ain't trained. > >(couldn't hit the Mountain Dew can, couldn't see it) Horiuchi shot Mrs Weaver at slightly over 200 meters .... not much o of a chnace he didn't hit what he was aiming at ... which begs the question of *wha* was he aiming at? The rules of engagement promulgated by Louis Freehs buddy Potts (I think) were nothing more than a death warrant and I have heard that most of the FBI marksmen balked at them ... but not good ole 'doin what I'm told to do' Lon ... yeah right! -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNBiGFcdZgC62U/gIEQJyPgCgu0oNx/mVZ9fjtI6d7AYfXAT4nfcAoLX3 0nQZslJNDD1x8EG+YfCeqY9x =Rqj8 -----END PGP SIGNATURE----- Brian B. Riley --> http://www.macconnect.com/~brianbr For PGP Keys - Send Email Subject "Get PGP Key" "Do not go where the path may lead, go instead where there is no path, and leave a trail" - Ralph Waldo Emerson

1 0

Re: Another Netscape Bug (and possible security hole)
by Peter Trei 17 Dec '03

17 Dec '03

> Received: from relay3.UU.NET [192.48.96.8] by alcor.process.com > with SMTP-OpenVMS via TCP/IP; Fri, 22 Sep 1995 03:36 -0400 > Received: from toad.com by relay3.UU.NET with SMTP > id QQzigj22616; Fri, 22 Sep 1995 03:27:16 -0400 > Received: by toad.com id AA02740; Fri, 22 Sep 95 00:24:28 PDT > Received: from quilla.tezcat.com by toad.com id AA02734; Fri, 22 Sep 95 00:24:24 PDT > Received: from [206.1.161.4] (clubred.redweb.com [206.1.161.4]) by quilla.tezcat.com (8.6.12/8.6.12) with SMTP id CAA23469 for <cypherpunks(a)toad.com>; Fri, 22 Sep 1995 02:24:21 -0500 > X-Sender: goedel(a)204.128.247.5 > Message-Id: <v01510100ac8821ac2b23(a)[206.1.161.4]> > Mime-Version: 1.0 > Content-Type: text/plain; charset="us-ascii" > Date: Fri, 22 Sep 1995 02:25:21 -0600 > To: cypherpunks(a)toad.com (Cypherpunks Mailing List) > From: goedel(a)tezcat.com (Dietrich J. Kappe) > Subject: Re: Another Netscape Bug (and possible security hole) > Sender: owner-cypherpunks(a)toad.com > Precedence: bulk > > -----BEGIN PGP SIGNED MESSAGE----- > > >Ray Cromwell writes: > >> I've found a Netscape bug which I suspect is a buffer overflow and > >> may have the potential for serious damage. If it is an overflow bug, > >> then it may be possible to infect every computer which accesses a web > >> page with Netscape. To see the bug, create an html file containing > >> the following: > > > >Oh brother, this is unbelievable ! > > > >I'm using Netscape 1.1N under SunOS 4.1.2. I can crash Netscape 1.1N under NT by entering a URL with a very long domain name in the 'Location:' window. Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

1 0

Re: in defense of Lon Horiuchi (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Subject: Re: in defense of Lon Horiuchi > Date: Thu, 11 Sep 97 20:07:27 -0400 > >Even dumb ole me, who ain't no crack shot, with one of those nifty > >(off theshelf) Styer-Mannlicher countersniper rifles with the neato > >Zeiss autoranging scope was able to punch a coke can 5 for 5 after > >one ranging(cheater) shot at 600 meters. I'm told that the FBI has > >much nicer rifles than that. And I ain't trained. > > > >(couldn't hit the Mountain Dew can, couldn't see it) > > Horiuchi shot Mrs Weaver at slightly over 200 meters .... not much o > of a chnace he didn't hit what he was aiming at ... which begs the > question of *wha* was he aiming at? The rules of engagement > promulgated by Louis Freehs buddy Potts (I think) were nothing more > than a death warrant and I have heard that most of the FBI marksmen > balked at them ... but not good ole 'doin what I'm told to do' Lon ... > yeah right! Whether what he did was right or wrong needs to be decided in a court of criminal law. He killed an individual in the name of the people using our tax dollars, the people are deserving of an accounting. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

[fwd][news] Netscape meets gov't security standard
by Vipul Ved Prakash 17 Dec '03

17 Dec '03

*** Netscape meets gov't security standard Netscape Communications Corporation announced Monday the National Institute of Standards and Technology and the Canadian Security Establishment validated the security code in Netscape Communicator client software and Netscape SuiteSpot server software as meeting Federal Information Processing Standards Publications 140-1, "Security Requirements For Cryptographic Modules." Netscape is the only Internet software vendor to comply with the FIPS 140-1 security standard, the company said. (PR Newswire) See full story at http://www.infobeat.com/stories/cgi/story.cgi?id=4840046-429 -- Vipul Ved Prakash | - Electronic Security & Crypto vipul(a)pobox.com | - Web Objects 91 11 2233328 | - PERL Development 198 Madhuban IP Extension | - Linux & Open Systems Delhi, INDIA 110 092 | - Networked Virtual Spaces

3 4

No Subject
by lethin＠ai.mit.edu 17 Dec '03

17 Dec '03

I just received the following email message: I just concluded a small number of trades whereby I purchased cb$ with US$ at the rate of US$8 per cb$100. An obvious concern with ticker tapes is the loss of privacy. The truly paranoid should avoid even posting exchange rates, but even regular folks might want to avoid the details of each of their transactions. I still think a ticker tape to ecm with concluded transactions and bids taking place on the electronic cash market web pages is useful. I don't want to spend time polling various exchanges. The ticker tape could also be used to do arbitrage between exchanges. The names of the participants can be omitted to protect anonymity of traders. Besides, if the traders really want to protect anonymity they'll be working through remailers or TCP tunnels. The exchange SHOULD be listed on the ticker tape, so that people wanting to trade can find the spot where they can make the trade. This then serves as an advertising means for the exchanges which are offering the best prices and volume, etc. In any transaction one of the two parties will have wished they'd known the market price, if the price of the transaction is not at the market price. This ignores the value of the reputation of the parties involved, etc. So I propose that transactions and offers be sent to ecm in the following form: E=<number> US=<number> BUY-OFFER|SELL-OFFER|CONCLUDED DATE TIME serial# EUID=<exchange-uid> which is more or less the original syntax for ecm, substituting the exhange UID for the email address of the person making the offer. As usual the syntax is optional, so you should feel free to append other information as you'd like (expiration date, method of concluding transaction, etc.) --- Concurrent VLSI Arch. Group 545 Technology Sq., Rm. 610 MIT AI Lab Cambridge, MA 02139 (617)-253-0972 (To subscribe to ecm, send email to ecm-request(a)ai.mit.edu with the word subscribe in the body. A digest version is available at ecm-digest-request.)

1 0

Re: Exchange random numbers (was: Re: netscape's response)
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> > This isn't a problem as I see it, he'll only know what bits he > flipped, not the actual state. Wouldn't even know that if you permuted it. You _could_ use a fixed permutation, or you could use input information from another source to select the permutation. Even something as simple as taking 5 bits from one source and using another source mod(random seed length) to decide where to xor it into the random seed. (Rotating back to the front if needed, or you could let the bits fall off the end.) And if all you ever give out to randomness partners is the result of a good hash there's no way they could ever determine anything from it, or determine what effect their contribution had. Shoot, they wouldn't know if their contribution went into the seed, or merely affected how someone elses contribution went into the seed. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Re: More on House Intelligence committee on crypto
by Mike Duvos 17 Dec '03

17 Dec '03

Declan McCullagh <declan(a)well.com> writes: > So I'm reading through the 43-page amendment to SAFE that > the House Intelligence committee approved today. It > includes: > * Ban on sale of crypto without a backdoor. Five year & > fine (maybe $250,000?) if violated. Prosecutions can be held > in closed-door courtrooms, publishers of info about case to > be held in contempt of court. [snip] Clearly the entire House Intelligence Committee should be "suitcased" immediately. -- Mike Duvos $ PGP 2.6 Public Key available $ enoch(a)zipcon.com $ via Finger $ {Free Cypherpunk Political Prisoner Jim Bell}

3 2

Re: Another Netscape Bug (and possible security hole)
by pdlamb＠iquest.com 17 Dec '03

17 Dec '03

HotJAVA apparently doesn't suffer from this bug, at least the 1.03 Alpha NT version. On the other hand, HotJava does truncate the URL to fit in its window. (I suppose I could try a very large screen with a very small font, just to make sure -- anyone willing to donate a 19" screen or bigger?) Pat -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQENAzACleQAAAEH/2+41W3bZPuWU1gv6A0bq3a57bgCiCAbU1QY41f+NI1I8i/+ a/L314RIpCR0iCZhsNMHNI9rVovsbmOQE4Cf9YYL3cClUoE2VAsLOi9LAjlN8qYc kmAqpsGQ39eaKrnlC/0lxJtFZgypT4m9UIsTU986y3gyy+ZTWwxtbDaLBEdsTiH/ e+zosoBiXmwWYY1n+5yvaKLGMUwa20AKdoRCUgqhJQpkW0nAvItU6WhaqxwH6JXp KCNsuP6k8FBmcKZfSSvUphSOIJnARAq9K9UPhj5BeAy1vKZ416jfgeYQUTxHQOMT rTiQOYR/oAR35gBpGYg6p1lu6Ma5eDPtpBPadUUABRG0IFBhdHJpY2sgTGFtYiA8 cGRsYW1iQGlxdWVzdC5jb20+ =DZzp -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: More on House Intelligence committee amendment on crypto
by Bill Frantz 17 Dec '03

17 Dec '03

At 3:38 PM -0700 9/11/97, Declan McCullagh wrote: >So I'm reading through the 43-page amendment to SAFE that the House >Intelligence committee approved today. It includes:... They're really foaming at the mouth back in 'ol DC. Lets see: (1) Free speech is dead. c.f. Judge Pattel's opinion in the Burnstein case. (2) The right to a public trial is gone too. (3) The right to privacy is forgotten. Close those clinics. (4) If crypto is an armament, then the right to keep and bear it is gone. (But that right was already in tatters.) (5) The right to be safe from unreasonable search is gone if you can't challenge a search in the courts. (6) etc. etc. And over what is merely the practical application of some obscure mathematics, these turkeys are willing to trash the constitution they are sworn to support and defend. It would be really funny if it wasn't so grim. ------------------------------------------------------------------------- Bill Frantz | The Internet was designed | Periwinkle -- Consulting (408)356-8506 | to protect the free world | 16345 Englewood Ave. frantz(a)netcom.com | from hostile governments. | Los Gatos, CA 95032, USA

3 2

Re: Freeh says FBI doing great, supports Weaver killer
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Tim May wrote: > I wonder how the SS at Stanford will react to my "Death Penalty for Waco > Commander in Chief!" placard? I'll ask around at alt.threaten.the.president, but they seem to have lost a lot of posters, even though the group is only a week old.

1 0

Munition (RSA/Perl) T-shirts Now Shipping From Stock!
by dhenson＠itsnet.com 17 Dec '03

17 Dec '03

By now, everyone knows about the TSHIRT that has been classified as a MUNITION by the US Goverment. If you don't know, just send email to wepinsto(a)colossus.net with a subject of 'TSHIRT STORY' and you will receive full details via return email. We have thus far shipped over 850 of the RSA/Perl Munition T-shirts and are now in a position to ship most orders from stock. You no longer have to pay your money and wait for months to get your t-shirt while someone else collects interest on YOUR money. We (WEPIN Store) can ship your t-shirt within two weeks of receiving your order. Orders are still pouring in. Don't be left out. Order your's today. (Read some comments of our customers at the end of this post.) For more information on how to own this classic example of civil disobedience, just send email to wepinsto(a)colossus.net with the subject of 'SHIRT'. (You don't have to be a US/Canadian citizen to request the info.) Or, if you have WWW access, just point your Web browser to: http://colossus.net/wepinsto/wshome.html By the way, 25% of the profits from the sale of the tshirt (in the US/Canada) goes to the PHIL ZIMMERMANN LEGAL DEFENSE FUND to help defend the author of PGP from harassment and possible prosecution by the Fedgoons. And if you get arrested for wearing the Munitions Tshirt, we'll refund your purchase price. :-) ====++++====++++ Here are some testimonials from a few of our many satisfied customers: "Got mine this afternoon. Wooohhaah!! Already had some folks at Blockbusters point, mumble to themselves, and then ask me what the munitions warning meant. This is going to be fun!! I'm a cyphernerd for sure..." "Thanks for the great T-shirt. I'm making copies of your paper order form for others." "I think I'll have to wear the shirt over to Logan Airport and hang around the International Arrivals terminal a few times. <G>" "I received the T-shirt on 8/3. Thank you, it has been a pleasure dealing with you!" "The first thing that I did after it arrived was to don it and then go visit the office of one of our visiting researchers from Russia. :)~" ====++++====++++ Get your Munitions Tshirt now. Who knows how long they'll stay in production! Don Henson, Managing Director (PGP Key ID = 0X03002DC9) West El Paso Information Network (WEPIN) email: wepinsto(a)colossus.net Check out The WEPIN Store at URL: http://colossus.net/wepinsto/wshome.html

1 0

Killing & Communicating
by bureau42 Anonymous Remailer 17 Dec '03

17 Dec '03

Best Way To: 1. Kill an evil politician without using a gun. 2. Plan the killing of a politician without using crypto. 3. Threaten the life of a politician without breaking the law. ------------------------------------------------------ 1. 2. 3. ------------------------------------------------------ 1. 2. 3. ------------------------------------------------------ 1. 2. 3. ------------------------------------------------------ 1. 2. 3. ------------------------------------------------------ 1. 2. 3. ------------------------------------------------------

1 0

new source of PGP sourcecode
by Michael Hortmann 17 Dec '03

17 Dec '03

Michael Hortmann Dept. of Mathematics University of Bremen michaelh(a)informatik.uni-Bremen.de PGP public key by finger ____________ Reconstructing PGP 2.6.1 Sourcecode by Scanning and OCR'ing the MIT-Press Book It has always been somewhat awkward to produce legal versions of PGP outside the US, requiring a lot of extra work. Recently, MIT-Press published the book Philip Zimmermann PGP Source Code and Internals which can be purchased in any bookstore. In the foreword it is mentioned that this book may not be exportable, because it has not been granted a "Commodities Jurisdiction" (CJ) by the US State Department. However, the international book distributors don't seem to take notice of that. Presently, I'm trying to find out what the legal status of the book may be in Germany, if it would be legitimate to request me to destroy it, or if on the contrary I can legally extract its contents and publish the result on the Internet. In the meantime I have asked some of my students to scan the book. This has already been accomplished, resulting in about 150MB image files. Right now the OCR process is on its way; by looking at samples we are optimistic that most mistakes will be found and corrected by a semiautomatic editing process; what mistakes remain should be detected by the compiler. As we will keep the image files, the original OCR files, the awk-scripts and intermediate files of the editing process, there can be no doubt that the final sourcecode has resulted from the book, and not from an illegal ftp. Each file will be marked as of this origin. When I'm convinced of the legality of this course of action, I will give notice on the Net and deposit the final product and the intermediate files under appropriate names in ftp://ftp.uni-Bremen.de/pub/security/crypt/ For the Net-community it may be interesting to know now that such a project is on its way. _______

1 0

Executing code on the stack, was Re: netscape bug
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> very big, and you can do what you like. The 8lgm people wrote a demo > for Sparc as a proof of concept. It's worth mentioning that 8lgm (Eight little green men;) has recently changed their policy on how long they wait to make exploit scripts available. It has resonance with what's happened here on cypherpunks lately. They used to publish that there was a hole, but would hold up quite a while on making the exploit scripts available. They were trying to make it safer for manufacturers and give them time to make fixes available first. What actually happened is that manufacturers would put the fixes on the backburner, and often not get around to them at all. 8lgm found that publishing the exploit scripts usually resulted in quick fixes from the vendors. Now the exploitation details are available quite quickly. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Re: Another Netscape Bug (and possible security hole)
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> > [I hear Perry in the background groaning and muttering "I told you so"] > These buffer overflow bugs should be taught in every programming > 101 course along with fencepost errors. > > I'm not even sure if I want to write the obligatory program to exploit > the hack given that some malicious jerk would probably use it > on his home page to attack people. > You should consider that there are people with a lot of expertise that are constantly on the lookout for things like this. I would bet a nickel to a donut that many people in the cracker community discovered this a long time ago and that exploit code was written long ago. How many people logged in as root use netscape? If the source was available we'd have told them about this long ago. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Re: The problem of playing politics with our constitutional rights
by Syniker＠aol.com 17 Dec '03

17 Dec '03

I still maintain... they can diddle one another all they want in washington... if ENOUGH people use crypto everyday... there's bascially not a damned thing they can do about it... If it becomes 'fashionable' to use it -- whatever it takes... the sheer numbers will work... Why not a 'crypto' YES WWW thing like our blackout pages??? If enough people put those perl lines on their hompage... there you are -- instant mass 'export'.... boom... Larry.

23 35

Reformatted Weak Keys in RC4 for readability.
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

I modified only the formatting to get rid of the wrap...I did it so that I could enjoy reading it and I send it in to y'all so you won't have to do it as well...it's a wonderful paper. Patrick A CLASS OF WEAK KEYS IN THE RC4 STREAM CIPHER PRELIMINARY DRAFT ANDREW ROOS VIRONIX SOFTWARE LABORATORIES 1. INTRODUCTION This paper discusses a class of weak keys in RSA's RC4 stream cipher. It shows that for at least 1 out of every 256 possible keys the initial byte of the pseudo-random stream generated by RC4 is strongly correlated with only a few bytes of the key, which effecitively reduces the work required to exhaustively search RC4 key spaces. 2. STATE TABLE INITIALIZATION IN RC4 Although the RC4 algorithm has not been published by RSA Data Security, source code to implement the algorithm was anonymously posted to the Cypherpunks mailing list several months ago. The success of the Cypherpunks' brute-force attack on SSL with a 40-bit key indicates that the source code published did accurately implement RC4. RC4 uses a variable length key from 1 to 256 bytes to initialize a 256-byte state table which is used for the subsequent generation of pseudo-random bytes. The state table is first initialized to the sequence {0,1,2,...,255}. Then: 1 index1 = 0; 2 index2 = 0; 3 4 for(counter = 0; counter < 256; counter++) 5 { 6 index2 = (key_data_ptr[index1] + state[counter] + index2) % 256; 7 swap_byte(&state[counter], &state[index2]); 8 index1 = (index1 + 1) % key_data_len; 9 } Note that the only line which directly affects the state table is line 7, when two bytes in the table are exchanged. The first byte is indexed by "counter", which is incremented for each iteration of the loop. The second byte is indexed by "index2" which is a function of the key. Hence each element of the state table will be swapped at least once (although possibly with itself), when it is indexed by "counter". It may also be swapped zero, one or more times when it is indexed by "index2". If we assume for the moment that "index2" is a uniformly distributed pseudo-random number, then the probability that a particular single element of the state table will be indexed by "index2" at some time during the initialization routine is: P = 1 - (255/256) ^ 255 = 0.631 (The exponent is 255 because we can disregard the case when "index2" and "counter" both index the same element, since this will not affect its value.) Conversely, there is a 37% probability that a particular element will _not_ be indexed by "index2" during initialization, so its final value in the state table will only be affected by a single swap, when it is indexed by "counter". Since key bytes are used sequentially (starting again at the beginning when the key is exhausted), this implies: A. Given a key length of K bytes, and E < K, there is a 37% probability that element E of the state table depends only on elements 0..E (inclusive) of the key. (This is approximate since "index2" is unlikely to be uniformly distributed.) In order to make use of this, we need to determine the most likely values for elements of the state table. Since each element is swapped at least once (when it is indexed by "counter"), it is necessary to take into account the likely effect of this swap. Swapping is a nasty non-linear process which is hard to analyze. However, when dealing with the first few elements of the state table, there is a high probability that the byte with which the element is swapped has not itself been involved in any previous exchanges, and therefore retains its initial value {0,1,2,...,255}. Similarly, when dealing with the first few elements of the state table, there is also a significant probability that none of the state elements added to index2 in line 6 of the algorithm has been swapped either. This means that the most likely value of an element in the state table can be estimated by assuming that state[x] == x in the algorithm above. In this case, the algorithm becomes: 1 index1 = 0; 2 index2 = 0; 3 4 for(counter = 0; counter < 256; counter++) 5 { 6 index2 = (key_data_ptr[index1] + counter + index2) % 256; 7 state[counter] = index2; 8 index1 = (index1 + 1) % key_data_len; 9 } Which can be reduced to: B. The most likely value for element E of the state table is: S[E] = X(E) + E(E+1)/2 where X(E) is the sum of bytes 0..E (inclusive) of the key. (when calculating the sum of key elements, the key is considered to "wrap around" on itself). Given this analysis, we can calculate the probability for each element of the state table that it's value is the "most likely value" of B above. The easiest way to do this is to evaluate the state tables produced from a number of pseudo-randomly generated RC4 keys. The following table shows the results for the first 47 elements from a trial of 100 000 eighty-bit RC4 keys: Probability (%) 0-7 37.0 36.8 36.2 35.8 34.9 34.0 33.0 32.2 8-15 30.9 29.8 28.5 27.5 26.0 24.5 22.9 21.6 16-23 20.3 18.9 17.3 16.1 14.7 13.5 12.4 11.2 24-31 10.1 9.0 8.2 7.4 6.4 5.7 5.1 4.4 32-39 3.9 3.5 3.0 2.6 2.3 2.0 1.7 1.4 40-47 1.3 1.2 1.0 0.9 0.8 0.7 0.6 0.6 The table confirms that there is a significant correlation between the first few values in the state table and the "likely value" predicted by B. 3. WEAK KEYS The RC4 state table is used to generate a pseudo-random stream which is XORed with the plaintext to give the ciphertext. The algorithm used to generate the stream is as follows: x and y are initialized to 0. To generate each byte: 1 x = (x + 1) % 256; 2 y = (state[x] + y) % 256; 3 swap_byte(&state[x], &state[y]); 4 xorIndex = (state[x] + state[y]) % 256; 5 GeneratedByte = state[xorIndex]; One way to exploit our analysis of the state table is to find circumstances under which one or more generated bytes are strongly correlated with a small subset of the key bytes. Consider what happens when generating the first byte if state[1] == 1. 1 x = (0 + 1) % 256; /* x == 1 */ 2 y = (state[1] + 0) % 256; /* y == 1 */ 3 swap_byte(&state[1], &state[1]); /* no effect */ 4 xorIndex = (state[1] + state[1]); /* xorIndex = 2 */ 5 GeneratedByte = state[2] And we know that state[2] is has a high probability of being S[2] = K[0] + K[1] + K[2] + 2 (2+1) / 2 Similarly, S[1] = K[0] + K[1] + 1 (1+1) / 2 So to make it probable that S[1] == 1, we have: K[0] + K[1] == 0 (mod 256) In which case the most likely value for S[2] is: S[2] = K[2] + 3 This allows us to identify a class of weak keys: C. Given an RC4 key K[0]..K[N] with K[0] + K[1] == 0 (mod 256), there is a significant probability that the first byte generated by RC4 will be K[2] + 3 (mod 256). Note that there are two special cases, caused by "unexpected" swapping during key generation. When K[0]==1, the "expected" output byte is k[2] + 2, and when k[0]==2, the expected value is k[2] + 1. There are a number of similar classes of "weak keys" which only affect a few keys out of every 65536. However the particular symmetry in this class means that it affects one key in 256, making it the most interesting instance. Once again I took the easy way out and used simulation to determine the approximate probability that result C holds for any given key. Probabilities ranged between 12% and 16% depending on the values of K[0] and K[1], with a mean of about 13.8%. All these figures are significantly greater than the 0.39% which would be expected from an uncorrelated generator. The key length used was again 80 bits. This works the other way around as well: given the first byte B[0] generated by a weak key, the probability that K[2]==B[0]-3 (mod 256) is 13.8%. 4. EXPLOITING WEAK KEYS IN RC4 Having found a class of weak keys, we need a practical way to attack RC4 based cryptosystems using them. The most obvious way would be to search potential weak keys first during an exhaustive attack. However since only one in every 256 keys is weak, the effective reduction in search space is not particularly significant. The usefulness of weak keys does increase if the opponent is satisfied with recovering only a percentage of the keys subjected to analysis. Given a known generator output which includes the first generated byte, one could assume that the key was weak and search only the weak keys which would generate the known initial byte. Since 1 in 256 keys is weak, and there is a 13.8% chance that the assumed value of K[2] will be correct, there is only a 0.054% chance of finding the key this way. However, you have reduced the search space by 16 bits due to the assumed relationship between K[0] and K[1] and the assumed value of K[2], so the work factor per key recovered is reduced by a factor of 35, which is equivalent reducing the effective key length by 5.1 bits. However in particular circumstances, the known relationships between weak keys may provide a much more significant reduction in workload. The remainder of this section describes an attack which, although requiring very specific conditions, illustrates the potential threat. As a stream cipher, a particular RC4 key can only be used once. When multiple communications sessions are required, some mechanism must be provided for generating a new session key each time. Let us suppose that an implementation chose the simple method of incrementing the previous session key to get the new session key, and that the session key was treated as a "little endian" (least significant byte first) integer for this purpose. We now have the interesting situation that the session keys will "cycle through" weak keys in a pattern which repeats every 2^16 keys: 00 00 00 ... Weak (510 non-weak keys) FF 01 00 ... Weak (254 non-weak keys) FE 02 00 ... Weak (254 non-weak keys) FD 03 00 ... Weak ... 01 FF 00 ... Weak (254 non-weak keys) 00 00 01 ... Weak (510 non-weak keys) FF 01 01 ... Weak (Least significant byte on the left) Now while an isolated weak key cannot be identified simply from a known generator output, this cycle of weak keys at known intervals can be identified using statistical techniques since each of the weak keys has a higher than expected probability of generating the _same_ initial byte. This means that an opponent who knew the initial generated bytes of about 2^16 session keys could identify the weak keys, and would also be able to locate the 510-key gap between successive cycles of weak keys (although not precisely). Since the 510-key gap occurs immediately following a key which begins with 00 00, the opponent not only knows that the keys are weak, but also knows the first two bytes of each key. The third byte of each key can be guessed from the first output byte generated by the key, with a 13.8% chance of a correct guess. Assuming that the "510-key gap" is narrowed down to 1 of 8 weak keys, the attacker can search a key space which is 24 bits less than the size of the session keys, with a 13.8%/8 chance of success, effectively reducing the key space by approximately 18 bits. Although this particular attack depends on a very specific set of circumstances, it is likely that other RC4 based cryptosystems in which there are linear relationships between successive session keys could be vulnerable to similar attacks. 5. RECOMMENDATIONS The attacks described in this algorithm result from inadequate "mixing" of key bytes during the generation of the RC4 state table. The following measures could be taken to strengthen cryptosystems based on the RC4 algorithm: (a) After initializing the algorithm, generate and discard a number of bytes. Since the algorithm used to generate bytes also introduces additional non-linear dependencies into the state table, this would make analysis more difficult. (b) In systems which require multiple session keys, ensure that session keys are not linearly related to each other. (c) Avoid using the weak keys described. 6. CONCLUSION This preliminary analysis of RC4 shows that the algorithm is vulnerable to analytic attacks based on statistical analysis of its state table. It is likely that a more detailed analysis of the algorithm will reveal more effective ways to exploit the weaknesses described. Andrew Roos <andrewr(a)vironix.co.za> _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Defense against a class of programming bugs
by Rich Salz 17 Dec '03

17 Dec '03

In light of the continuing vulnerability to long user input, I humbly offer the following aphorism, suitable for display on all Netscape programmer cubicles: Copy strings with strdup, not strcpy.

1 0

House Intelligence Committee Press Release
by Dave Del Torto 17 Dec '03

17 Dec '03

INTELLIGENCE COMMITTEE OFFERS ALTERNATIVE ENCRYPTION LEGISLATION TO ADDRESS SECURITY CONCERNS SEPTEMBER 11, 1997 CONTACT (202) 225-4121 The House Permanent Select Committee on Intelligence (HPSCI) today approved, by voice vote, legislation proposing an alternative to pending encryption legislation, known as the "Security and Freedom Through Encryption Act" (H.R. 695). The HPSCI amendment in the nature of a substitute to HR 695 proposes safeguards in the law to meet national security and law enforcement concerns in the debate over the future of United States Encryption policy. "All members of Congress, and particularly those of us on the Intelligence Committee, have a responsibility to find the proper balance between forward thinking commercial policies and the unquestioned need to protect the security of the American people and America's national interests. We are offering proposals to ensure that we do not plow full steam ahead into the 21st century's information age having seriously weakened our ability to protect the national security, " said HPSCI Chairman Porter J. Goss (Fl-14). "American citizens have a right to their privacy and their access to the freest possible markets. But they also have a right to their safety and security. Terrorist groups that plot to blow up buildings; drug cartels that seek to poison our children, and those who proliferate in deadly chemical and biological weapons are all formidable opponents of peace and security in the global society. These bad actors must know that the United States' law enforcement and national security agencies, working under the proper oversight, will have the tools to frustrate illegal and deadly activity and bring international criminals to justice," Goss said. "The bill referred to the Intelligence Committee attempts to deal with complex issues. The substitute adopted by the Committee addresses the legitimate national security and law enforcement concerns that are simply not addressed in H.R. 695. In that respect, the Committee substitute, in my judgment, furthers the debate on these important matters," noted Ranking Democrat Norm Dicks (WA-6). The main elements of the Intelligence Committee's proposal are: * Requires exports of encryption products to submit to a one-time review and to include features or functions (that need not be enabled by the manufacturer) allowing for immediate access to plaintext or to decryption information; * Requires that encryption products manufactured and distributed for sale or use, or import for sale or use, in the United States after January 31, 2000 include features or functions that provide, upon presentment of a court order, immediate access to plaintext data or decryption information from the encryption provider; * Does not change law enforcement's statutory requirements prior to intercepting oral, wire, or electronic (wireless) communications, or law enforcement's requirements prior to obtaining stored data. Law enforcement will specifically be required to obtain a separate court order to have data, including communications, decrypted; * Allows for law enforcement access with delayed notification requirements, similar to those allowed in current wiretap statutory provisions: * Provide civil remedies and criminal penalties for unlawful access to or disclosure of plaintext or decryption information; * Require US government procurement of encryption technology that includes functions or features allowing for immediate access to plaintext or decryption information. "Our committee has weighed in on these issues in the interest of furthering the important debate now underway about how best to accomplish the multiple goals of a sound encryption policy. Any encryption legislation we consider must take a balanced approach to the national security, law enforcement, public safety and privacy issues at stake. Our action today marks another step in this process, which no doubt will continue to unfold in the days and weeks ahead. I look forward to working with all sides on this debate as we tackle this complex but important issue," Goss said. The HPSCI, which sought and received sequential referral of H.R. 695, is one of five House committees with jurisdiction on this issue. The Committees on Judiciary, International Relations, National Security and Commerce have also considered this legislation. The HPSCI expects to file its committee report with the House tomorrow, meeting its deadline for action set by the Speaker. -30-

8 7

Forwarding of Federalist Papers from Canada for U.S. Citizens promoting democracy
by Six 17 Dec '03

17 Dec '03

If you have a desire to educate the citizens of foreign countries as to the value of democracy, I would be pleased to forward a copy of the Federalist Papers to any email address you desire, upon receipt of only the email addresses, with no instructions or requests.

1 0

(noise) Subject: Married with Children (was: Re: Netscape closes up 1 3/8 today!)
by ab411＠detroit.freenet.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Christopher J. Shaulis <cjs(a)netcom.com> writes: > Yeah. Thats the way it works sometimes. I remember back when that > housewife from minnasota launched her media campaign to have "Married > With Children" taken off the air. All it did was make the show a > hundred times more popular and extend its life for years after it > probably would have been canceled on its own. Terry Rakolta is from Bloomfield Hills, Michigan, just a few short miles from where I sit, typing at my keyboard. After being offended by the episode "Her Cups Runneth Over", Rakolta took notes on things she found offensive in subsequent episodes and then mailed a complaint to Fox. Fox's reaction? According to executive producer Michael Moye, "Everybody did the manly thing which was immediately dive behind desks and point the finger at us. You couldn't get your legs under a desk for all the executives under there. You have never seen such wussing. And we're going, 'One letter? *One letter?*'" [emphasis his] The resulting media incident almost certainly increased the show's ratings, but it also brought the wrath of the Fox censor down on the producers. For an interesting account of this, see Playboy, July 1990, (the one with Sharon Stone topless on the cover ;), "Hanging out with the Bundys", Pamela Marin, p.114 et seq. Something else which has happened here in the Greater Detroit SMSA, just in the last few days, is the mother of a ten year old boy has demanded that _The_Stand_ by Stephen King be removed from the school's library after her son checked it out from said library. Turns out Stephen included some graphic descriptions of sex. The punch line, if you like, is that in tv news coverage the young lad was shown sitting in front of the tv, playing a Mario-like video game. Thank God they got that book away from him just in the nick of time, eh? He might be reading even as we speak! They walked still further and the girl said, "Is it true that long ago firemen put fires *out* instead of going to start them?" "No." -- Ray Bradbury ``Officer, officer, arrest that man! He's whistling a dirty song.'' -- Jean Ellison Crypto relevance? None. drc -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMGLunREcrOJethBVAQFnbwP/SI1df4BtSIOZryK+pcoatMy7jePQQF4W fj6cONy6ulf/0KqswS1md91qZMUKJ0EpCJGf+qbaXTblASCZ08spGlgZ3rp0yYiK wGlWEHxatgqbrSO6XKJAEAIccd2aArtpnWPBfnnXpCGaSXQ4lLrg+/a3b+q9JZ9m BvLSyhaTqkM= =Ijia -----END PGP SIGNATURE----- -- David R. Conrad, conrad(a)detroit.freenet.org, http://www.grfn.org/~conrad Hardware & Software Committee -- Finger conrad(a)grfn.org for public key Key fingerprint = 33 12 BC 77 48 81 99 A5 D8 9C 43 16 3C 37 0B 50 No, his mind is not for rent to any god or government.

1 0

Strong Crypto Forwarding From Canada For U.S. Citizens
by Six 17 Dec '03

17 Dec '03

Anyone who wishes to export strong encryption to Internet addresses to which it is prohibited to do so by U.S. law may send a copy to me as a file attachment, along with the addresses to send it to in the message body. I will accept up to 100 addresses per crypto program received for forwarding. If for any reason you feel that the terrorists who are ruling your country might be able to persecute you for exercising free speech, I would be happy to forward PGP 5.0 upon receipt of only the email addresses, with no instructions or requests. SixUALDV8

1 0

business intelligence or BI
by mjsus＠atlanta.com 17 Dec '03

17 Dec '03

>It's important here to distinguish economic "espionage" and economic >"intelligence." > There is also the difference between the business intelligence and business espionage ! The business intelligence is used to collect, evaluate, analyze etc. the business information and data that may include competitors, markets, economic trends, suppliers among others. The sources of this information are publicly and legally available for all companies and individuals. The formal or informal business intelligence system can be used. The successful use of the traditional business intelligence will result in the best results, when this information and data is eveluated, analyzed and disseminated in the most intelligent, reliable, timely and accurate manner. 100% of companies are already using the business intelligence (all companies are just not calling it the BI): some more successfully than others. The business intelligence can be used both for strategic and tactical purposes. Regards, Mark

1 0