December 2003 - cypherpunks-legacy

Re: Another Netscape Bug (and possible security hole)
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> > [I hear Perry in the background groaning and muttering "I told you so"] > These buffer overflow bugs should be taught in every programming > 101 course along with fencepost errors. > > I'm not even sure if I want to write the obligatory program to exploit > the hack given that some malicious jerk would probably use it > on his home page to attack people. > You should consider that there are people with a lot of expertise that are constantly on the lookout for things like this. I would bet a nickel to a donut that many people in the cracker community discovered this a long time ago and that exploit code was written long ago. How many people logged in as root use netscape? If the source was available we'd have told them about this long ago. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Re: The problem of playing politics with our constitutional rights
by Syniker＠aol.com 17 Dec '03

17 Dec '03

I still maintain... they can diddle one another all they want in washington... if ENOUGH people use crypto everyday... there's bascially not a damned thing they can do about it... If it becomes 'fashionable' to use it -- whatever it takes... the sheer numbers will work... Why not a 'crypto' YES WWW thing like our blackout pages??? If enough people put those perl lines on their hompage... there you are -- instant mass 'export'.... boom... Larry.

23 35

Reformatted Weak Keys in RC4 for readability.
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

I modified only the formatting to get rid of the wrap...I did it so that I could enjoy reading it and I send it in to y'all so you won't have to do it as well...it's a wonderful paper. Patrick A CLASS OF WEAK KEYS IN THE RC4 STREAM CIPHER PRELIMINARY DRAFT ANDREW ROOS VIRONIX SOFTWARE LABORATORIES 1. INTRODUCTION This paper discusses a class of weak keys in RSA's RC4 stream cipher. It shows that for at least 1 out of every 256 possible keys the initial byte of the pseudo-random stream generated by RC4 is strongly correlated with only a few bytes of the key, which effecitively reduces the work required to exhaustively search RC4 key spaces. 2. STATE TABLE INITIALIZATION IN RC4 Although the RC4 algorithm has not been published by RSA Data Security, source code to implement the algorithm was anonymously posted to the Cypherpunks mailing list several months ago. The success of the Cypherpunks' brute-force attack on SSL with a 40-bit key indicates that the source code published did accurately implement RC4. RC4 uses a variable length key from 1 to 256 bytes to initialize a 256-byte state table which is used for the subsequent generation of pseudo-random bytes. The state table is first initialized to the sequence {0,1,2,...,255}. Then: 1 index1 = 0; 2 index2 = 0; 3 4 for(counter = 0; counter < 256; counter++) 5 { 6 index2 = (key_data_ptr[index1] + state[counter] + index2) % 256; 7 swap_byte(&state[counter], &state[index2]); 8 index1 = (index1 + 1) % key_data_len; 9 } Note that the only line which directly affects the state table is line 7, when two bytes in the table are exchanged. The first byte is indexed by "counter", which is incremented for each iteration of the loop. The second byte is indexed by "index2" which is a function of the key. Hence each element of the state table will be swapped at least once (although possibly with itself), when it is indexed by "counter". It may also be swapped zero, one or more times when it is indexed by "index2". If we assume for the moment that "index2" is a uniformly distributed pseudo-random number, then the probability that a particular single element of the state table will be indexed by "index2" at some time during the initialization routine is: P = 1 - (255/256) ^ 255 = 0.631 (The exponent is 255 because we can disregard the case when "index2" and "counter" both index the same element, since this will not affect its value.) Conversely, there is a 37% probability that a particular element will _not_ be indexed by "index2" during initialization, so its final value in the state table will only be affected by a single swap, when it is indexed by "counter". Since key bytes are used sequentially (starting again at the beginning when the key is exhausted), this implies: A. Given a key length of K bytes, and E < K, there is a 37% probability that element E of the state table depends only on elements 0..E (inclusive) of the key. (This is approximate since "index2" is unlikely to be uniformly distributed.) In order to make use of this, we need to determine the most likely values for elements of the state table. Since each element is swapped at least once (when it is indexed by "counter"), it is necessary to take into account the likely effect of this swap. Swapping is a nasty non-linear process which is hard to analyze. However, when dealing with the first few elements of the state table, there is a high probability that the byte with which the element is swapped has not itself been involved in any previous exchanges, and therefore retains its initial value {0,1,2,...,255}. Similarly, when dealing with the first few elements of the state table, there is also a significant probability that none of the state elements added to index2 in line 6 of the algorithm has been swapped either. This means that the most likely value of an element in the state table can be estimated by assuming that state[x] == x in the algorithm above. In this case, the algorithm becomes: 1 index1 = 0; 2 index2 = 0; 3 4 for(counter = 0; counter < 256; counter++) 5 { 6 index2 = (key_data_ptr[index1] + counter + index2) % 256; 7 state[counter] = index2; 8 index1 = (index1 + 1) % key_data_len; 9 } Which can be reduced to: B. The most likely value for element E of the state table is: S[E] = X(E) + E(E+1)/2 where X(E) is the sum of bytes 0..E (inclusive) of the key. (when calculating the sum of key elements, the key is considered to "wrap around" on itself). Given this analysis, we can calculate the probability for each element of the state table that it's value is the "most likely value" of B above. The easiest way to do this is to evaluate the state tables produced from a number of pseudo-randomly generated RC4 keys. The following table shows the results for the first 47 elements from a trial of 100 000 eighty-bit RC4 keys: Probability (%) 0-7 37.0 36.8 36.2 35.8 34.9 34.0 33.0 32.2 8-15 30.9 29.8 28.5 27.5 26.0 24.5 22.9 21.6 16-23 20.3 18.9 17.3 16.1 14.7 13.5 12.4 11.2 24-31 10.1 9.0 8.2 7.4 6.4 5.7 5.1 4.4 32-39 3.9 3.5 3.0 2.6 2.3 2.0 1.7 1.4 40-47 1.3 1.2 1.0 0.9 0.8 0.7 0.6 0.6 The table confirms that there is a significant correlation between the first few values in the state table and the "likely value" predicted by B. 3. WEAK KEYS The RC4 state table is used to generate a pseudo-random stream which is XORed with the plaintext to give the ciphertext. The algorithm used to generate the stream is as follows: x and y are initialized to 0. To generate each byte: 1 x = (x + 1) % 256; 2 y = (state[x] + y) % 256; 3 swap_byte(&state[x], &state[y]); 4 xorIndex = (state[x] + state[y]) % 256; 5 GeneratedByte = state[xorIndex]; One way to exploit our analysis of the state table is to find circumstances under which one or more generated bytes are strongly correlated with a small subset of the key bytes. Consider what happens when generating the first byte if state[1] == 1. 1 x = (0 + 1) % 256; /* x == 1 */ 2 y = (state[1] + 0) % 256; /* y == 1 */ 3 swap_byte(&state[1], &state[1]); /* no effect */ 4 xorIndex = (state[1] + state[1]); /* xorIndex = 2 */ 5 GeneratedByte = state[2] And we know that state[2] is has a high probability of being S[2] = K[0] + K[1] + K[2] + 2 (2+1) / 2 Similarly, S[1] = K[0] + K[1] + 1 (1+1) / 2 So to make it probable that S[1] == 1, we have: K[0] + K[1] == 0 (mod 256) In which case the most likely value for S[2] is: S[2] = K[2] + 3 This allows us to identify a class of weak keys: C. Given an RC4 key K[0]..K[N] with K[0] + K[1] == 0 (mod 256), there is a significant probability that the first byte generated by RC4 will be K[2] + 3 (mod 256). Note that there are two special cases, caused by "unexpected" swapping during key generation. When K[0]==1, the "expected" output byte is k[2] + 2, and when k[0]==2, the expected value is k[2] + 1. There are a number of similar classes of "weak keys" which only affect a few keys out of every 65536. However the particular symmetry in this class means that it affects one key in 256, making it the most interesting instance. Once again I took the easy way out and used simulation to determine the approximate probability that result C holds for any given key. Probabilities ranged between 12% and 16% depending on the values of K[0] and K[1], with a mean of about 13.8%. All these figures are significantly greater than the 0.39% which would be expected from an uncorrelated generator. The key length used was again 80 bits. This works the other way around as well: given the first byte B[0] generated by a weak key, the probability that K[2]==B[0]-3 (mod 256) is 13.8%. 4. EXPLOITING WEAK KEYS IN RC4 Having found a class of weak keys, we need a practical way to attack RC4 based cryptosystems using them. The most obvious way would be to search potential weak keys first during an exhaustive attack. However since only one in every 256 keys is weak, the effective reduction in search space is not particularly significant. The usefulness of weak keys does increase if the opponent is satisfied with recovering only a percentage of the keys subjected to analysis. Given a known generator output which includes the first generated byte, one could assume that the key was weak and search only the weak keys which would generate the known initial byte. Since 1 in 256 keys is weak, and there is a 13.8% chance that the assumed value of K[2] will be correct, there is only a 0.054% chance of finding the key this way. However, you have reduced the search space by 16 bits due to the assumed relationship between K[0] and K[1] and the assumed value of K[2], so the work factor per key recovered is reduced by a factor of 35, which is equivalent reducing the effective key length by 5.1 bits. However in particular circumstances, the known relationships between weak keys may provide a much more significant reduction in workload. The remainder of this section describes an attack which, although requiring very specific conditions, illustrates the potential threat. As a stream cipher, a particular RC4 key can only be used once. When multiple communications sessions are required, some mechanism must be provided for generating a new session key each time. Let us suppose that an implementation chose the simple method of incrementing the previous session key to get the new session key, and that the session key was treated as a "little endian" (least significant byte first) integer for this purpose. We now have the interesting situation that the session keys will "cycle through" weak keys in a pattern which repeats every 2^16 keys: 00 00 00 ... Weak (510 non-weak keys) FF 01 00 ... Weak (254 non-weak keys) FE 02 00 ... Weak (254 non-weak keys) FD 03 00 ... Weak ... 01 FF 00 ... Weak (254 non-weak keys) 00 00 01 ... Weak (510 non-weak keys) FF 01 01 ... Weak (Least significant byte on the left) Now while an isolated weak key cannot be identified simply from a known generator output, this cycle of weak keys at known intervals can be identified using statistical techniques since each of the weak keys has a higher than expected probability of generating the _same_ initial byte. This means that an opponent who knew the initial generated bytes of about 2^16 session keys could identify the weak keys, and would also be able to locate the 510-key gap between successive cycles of weak keys (although not precisely). Since the 510-key gap occurs immediately following a key which begins with 00 00, the opponent not only knows that the keys are weak, but also knows the first two bytes of each key. The third byte of each key can be guessed from the first output byte generated by the key, with a 13.8% chance of a correct guess. Assuming that the "510-key gap" is narrowed down to 1 of 8 weak keys, the attacker can search a key space which is 24 bits less than the size of the session keys, with a 13.8%/8 chance of success, effectively reducing the key space by approximately 18 bits. Although this particular attack depends on a very specific set of circumstances, it is likely that other RC4 based cryptosystems in which there are linear relationships between successive session keys could be vulnerable to similar attacks. 5. RECOMMENDATIONS The attacks described in this algorithm result from inadequate "mixing" of key bytes during the generation of the RC4 state table. The following measures could be taken to strengthen cryptosystems based on the RC4 algorithm: (a) After initializing the algorithm, generate and discard a number of bytes. Since the algorithm used to generate bytes also introduces additional non-linear dependencies into the state table, this would make analysis more difficult. (b) In systems which require multiple session keys, ensure that session keys are not linearly related to each other. (c) Avoid using the weak keys described. 6. CONCLUSION This preliminary analysis of RC4 shows that the algorithm is vulnerable to analytic attacks based on statistical analysis of its state table. It is likely that a more detailed analysis of the algorithm will reveal more effective ways to exploit the weaknesses described. Andrew Roos <andrewr(a)vironix.co.za> _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Defense against a class of programming bugs
by Rich Salz 17 Dec '03

17 Dec '03

In light of the continuing vulnerability to long user input, I humbly offer the following aphorism, suitable for display on all Netscape programmer cubicles: Copy strings with strdup, not strcpy.

1 0

House Intelligence Committee Press Release
by Dave Del Torto 17 Dec '03

17 Dec '03

INTELLIGENCE COMMITTEE OFFERS ALTERNATIVE ENCRYPTION LEGISLATION TO ADDRESS SECURITY CONCERNS SEPTEMBER 11, 1997 CONTACT (202) 225-4121 The House Permanent Select Committee on Intelligence (HPSCI) today approved, by voice vote, legislation proposing an alternative to pending encryption legislation, known as the "Security and Freedom Through Encryption Act" (H.R. 695). The HPSCI amendment in the nature of a substitute to HR 695 proposes safeguards in the law to meet national security and law enforcement concerns in the debate over the future of United States Encryption policy. "All members of Congress, and particularly those of us on the Intelligence Committee, have a responsibility to find the proper balance between forward thinking commercial policies and the unquestioned need to protect the security of the American people and America's national interests. We are offering proposals to ensure that we do not plow full steam ahead into the 21st century's information age having seriously weakened our ability to protect the national security, " said HPSCI Chairman Porter J. Goss (Fl-14). "American citizens have a right to their privacy and their access to the freest possible markets. But they also have a right to their safety and security. Terrorist groups that plot to blow up buildings; drug cartels that seek to poison our children, and those who proliferate in deadly chemical and biological weapons are all formidable opponents of peace and security in the global society. These bad actors must know that the United States' law enforcement and national security agencies, working under the proper oversight, will have the tools to frustrate illegal and deadly activity and bring international criminals to justice," Goss said. "The bill referred to the Intelligence Committee attempts to deal with complex issues. The substitute adopted by the Committee addresses the legitimate national security and law enforcement concerns that are simply not addressed in H.R. 695. In that respect, the Committee substitute, in my judgment, furthers the debate on these important matters," noted Ranking Democrat Norm Dicks (WA-6). The main elements of the Intelligence Committee's proposal are: * Requires exports of encryption products to submit to a one-time review and to include features or functions (that need not be enabled by the manufacturer) allowing for immediate access to plaintext or to decryption information; * Requires that encryption products manufactured and distributed for sale or use, or import for sale or use, in the United States after January 31, 2000 include features or functions that provide, upon presentment of a court order, immediate access to plaintext data or decryption information from the encryption provider; * Does not change law enforcement's statutory requirements prior to intercepting oral, wire, or electronic (wireless) communications, or law enforcement's requirements prior to obtaining stored data. Law enforcement will specifically be required to obtain a separate court order to have data, including communications, decrypted; * Allows for law enforcement access with delayed notification requirements, similar to those allowed in current wiretap statutory provisions: * Provide civil remedies and criminal penalties for unlawful access to or disclosure of plaintext or decryption information; * Require US government procurement of encryption technology that includes functions or features allowing for immediate access to plaintext or decryption information. "Our committee has weighed in on these issues in the interest of furthering the important debate now underway about how best to accomplish the multiple goals of a sound encryption policy. Any encryption legislation we consider must take a balanced approach to the national security, law enforcement, public safety and privacy issues at stake. Our action today marks another step in this process, which no doubt will continue to unfold in the days and weeks ahead. I look forward to working with all sides on this debate as we tackle this complex but important issue," Goss said. The HPSCI, which sought and received sequential referral of H.R. 695, is one of five House committees with jurisdiction on this issue. The Committees on Judiciary, International Relations, National Security and Commerce have also considered this legislation. The HPSCI expects to file its committee report with the House tomorrow, meeting its deadline for action set by the Speaker. -30-

8 7

Forwarding of Federalist Papers from Canada for U.S. Citizens promoting democracy
by Six 17 Dec '03

17 Dec '03

If you have a desire to educate the citizens of foreign countries as to the value of democracy, I would be pleased to forward a copy of the Federalist Papers to any email address you desire, upon receipt of only the email addresses, with no instructions or requests.

1 0

(noise) Subject: Married with Children (was: Re: Netscape closes up 1 3/8 today!)
by ab411＠detroit.freenet.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Christopher J. Shaulis <cjs(a)netcom.com> writes: > Yeah. Thats the way it works sometimes. I remember back when that > housewife from minnasota launched her media campaign to have "Married > With Children" taken off the air. All it did was make the show a > hundred times more popular and extend its life for years after it > probably would have been canceled on its own. Terry Rakolta is from Bloomfield Hills, Michigan, just a few short miles from where I sit, typing at my keyboard. After being offended by the episode "Her Cups Runneth Over", Rakolta took notes on things she found offensive in subsequent episodes and then mailed a complaint to Fox. Fox's reaction? According to executive producer Michael Moye, "Everybody did the manly thing which was immediately dive behind desks and point the finger at us. You couldn't get your legs under a desk for all the executives under there. You have never seen such wussing. And we're going, 'One letter? *One letter?*'" [emphasis his] The resulting media incident almost certainly increased the show's ratings, but it also brought the wrath of the Fox censor down on the producers. For an interesting account of this, see Playboy, July 1990, (the one with Sharon Stone topless on the cover ;), "Hanging out with the Bundys", Pamela Marin, p.114 et seq. Something else which has happened here in the Greater Detroit SMSA, just in the last few days, is the mother of a ten year old boy has demanded that _The_Stand_ by Stephen King be removed from the school's library after her son checked it out from said library. Turns out Stephen included some graphic descriptions of sex. The punch line, if you like, is that in tv news coverage the young lad was shown sitting in front of the tv, playing a Mario-like video game. Thank God they got that book away from him just in the nick of time, eh? He might be reading even as we speak! They walked still further and the girl said, "Is it true that long ago firemen put fires *out* instead of going to start them?" "No." -- Ray Bradbury ``Officer, officer, arrest that man! He's whistling a dirty song.'' -- Jean Ellison Crypto relevance? None. drc -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMGLunREcrOJethBVAQFnbwP/SI1df4BtSIOZryK+pcoatMy7jePQQF4W fj6cONy6ulf/0KqswS1md91qZMUKJ0EpCJGf+qbaXTblASCZ08spGlgZ3rp0yYiK wGlWEHxatgqbrSO6XKJAEAIccd2aArtpnWPBfnnXpCGaSXQ4lLrg+/a3b+q9JZ9m BvLSyhaTqkM= =Ijia -----END PGP SIGNATURE----- -- David R. Conrad, conrad(a)detroit.freenet.org, http://www.grfn.org/~conrad Hardware & Software Committee -- Finger conrad(a)grfn.org for public key Key fingerprint = 33 12 BC 77 48 81 99 A5 D8 9C 43 16 3C 37 0B 50 No, his mind is not for rent to any god or government.

1 0

Strong Crypto Forwarding From Canada For U.S. Citizens
by Six 17 Dec '03

17 Dec '03

Anyone who wishes to export strong encryption to Internet addresses to which it is prohibited to do so by U.S. law may send a copy to me as a file attachment, along with the addresses to send it to in the message body. I will accept up to 100 addresses per crypto program received for forwarding. If for any reason you feel that the terrorists who are ruling your country might be able to persecute you for exercising free speech, I would be happy to forward PGP 5.0 upon receipt of only the email addresses, with no instructions or requests. SixUALDV8

1 0

business intelligence or BI
by mjsus＠atlanta.com 17 Dec '03

17 Dec '03

>It's important here to distinguish economic "espionage" and economic >"intelligence." > There is also the difference between the business intelligence and business espionage ! The business intelligence is used to collect, evaluate, analyze etc. the business information and data that may include competitors, markets, economic trends, suppliers among others. The sources of this information are publicly and legally available for all companies and individuals. The formal or informal business intelligence system can be used. The successful use of the traditional business intelligence will result in the best results, when this information and data is eveluated, analyzed and disseminated in the most intelligent, reliable, timely and accurate manner. 100% of companies are already using the business intelligence (all companies are just not calling it the BI): some more successfully than others. The business intelligence can be used both for strategic and tactical purposes. Regards, Mark

1 0

Re: Another Netscape Bug (and possible security hole)
by ab411＠detroit.freenet.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Jeff Weinstein <jsw(a)neon.netscape.com> writes: > Not that I want to divert attention away from netscape(OK, maybe I > do :-) ), but does this bug exist in any other common browser? Lynx can handle it on the info page (reached by pressing '='), but: In response to selecting the long domain name found in the Warning link in http://www.grfn.org/~conrad/test.shtml, lynx replied: - - - Sorry, you have encountered a bug in Lynx Ver. 2-4-2 Please send a concise mail message to lynx-bug(a)ukanaix.cc.ukans.edu describing what you were doing, the URL you were looking at or attempting to access, your operating system name with version number, the TCP/IP implementation that your system is using, and any other information you deem relevant. Do not mail the core file if one was generated. Lynx now exiting with signal: 11 Exiting via interrupt: exit(0) - - - [No core file was generated] My system is: (uname -a) Linux russell 1.3.26 #2 Thu Sep 14 08:34:38 EDT 1995 i486 Netscape 1.1N for linux crashed in a way that locked my system up, and caused endless trashing. I had to reboot, but my filesystem was undamaged. Not sure why it crashed and burned on my system while others have gotten such nice SegVs and core files. I guess I managed to get just the right (wrong) thing onto the stack. :-) :-( (P.S. Whoops, just realized that I rebooted with a different kernel; Lynx did indeed crash under 1.3.26 (post-reboot), but Netscape crashed under 1.2.13 (pre-reboot). Pardon me if I don't re-try under 1.3.26, but having X lock up and hearing my disk trash is not something I relish.) drc -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMGLu1BEcrOJethBVAQEhwwP/cPZ2Gr/MClaywXEAtagNa7n5IyIsqFGI LmCDxjTMdK/zXzuPcU3Xa53QxOn4dSxQv2PRKHrLGSrVn5vvZHRiYmH5z4NgWvmJ ETFlFascANzqN2VbHgrn80u3RlFIH0UAUiTgoIFiJ4E3TUzrmt5w4qeXxvfA9PKQ LQi2oeIArS8= =EEup -----END PGP SIGNATURE----- Last line above should read: "hearing my disk *thrash* ...," not trash. Signing messages is non-trivial with my current set up, so I don't feel like re-doing it for such a minor glitch. -- David R. Conrad, conrad(a)detroit.freenet.org, http://www.grfn.org/~conrad Hardware & Software Committee -- Finger conrad(a)grfn.org for public key Key fingerprint = 33 12 BC 77 48 81 99 A5 D8 9C 43 16 3C 37 0B 50 No, his mind is not for rent to any god or government.

1 0

Information Please
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

I am interested in researching possible legal grounds for taking armed action against politicians governments and law enforcement agencies. I would appreciate any pointers anyone might be able to provide to any material of this nature. Of particular interest would be information as to the application of International law in this area. I am assuming of course that there must be some form of law somewhere which recognizes the right to resist oppression and violation of human rights by any government elected or not. Thank you. ps If possible I would like to receive this information before September 16th 1997 as it is a two day drive to southern California and I would like at least one day to rest.

5 4

YET ANOTHER BAD NETSCAPE BUG (no it isnt!)
by Ray Cromwell 17 Dec '03

17 Dec '03

Just another reminder that the second bug I posted about was a fluke on my system and not a real bug. I'm hoping that putting the reminder in the subject will stop people from forwarding it on to other lists before reading the retraction. Although this was a false bug, the overflow bug is very real and verified. -Ray

1 0

Netscape bug and the IMG tag.
by goedel＠tezcat.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- You can plunk a nasty url into the SRC field of an IMG tag, thus eliminating the need for clicking on the offending url. Also, it makes it harder to check the html of a page. Check out http://www.redweb.com/experiment/bug2 html if you feel like rebooting. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBgAwUBMGMCc3If3YegbdiBAQFTMgJYsAEPkSWTtGDswAYpT1repQjd8n3unMg3 CIXNlxmg43BkMgyNRrqYP2P61aMJt4FwPZt+PgE4NYxVj6PzaPtsf/Y/6BSsWNxb cKcr =/ORS -----END PGP SIGNATURE----- Dietrich Kappe | Red Planet http://www.redweb.com Red Planet, LLC| "Chess Space" | "MS Access Products" | PGP Public Key 1-800-RED 0 WEB| /chess | /cobre | /goedel/key.txt Web Publishing | Key fingerprint: 8C2983E66AB723F9 A014A0417D268B84

1 0

Reno and Freeh to be assassinated!
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Dave Del Torto wrote: > "All members of Congress, and particularly those of us on the Intelligence > Committee, have a responsibility to find the proper balance between forward > thinking commercial policies and the unquestioned need to protect the > security of the American people and America's national interests." said > HPSCI Chairman Porter J. Goss I think we should all send Chairman Goss a letter of appreciation for his offer to assassinate Child Murderer Janet Reno and Murderer Louis Freeh. Most politicians are too cowardly to promise strong actions such as this. > Terrorist groups that plot to blow up buildings; drug cartels > that seek to poison our children, and those who proliferate in deadly > chemical and biological weapons are all formidable opponents of peace and > security in the global society. These bad actors must know that the United > States' law enforcement and national security agencies, working under the > proper oversight, will have the tools to frustrate illegal and deadly > activity and bring international criminals to justice," Goss said. Chairman Goss is also going to prosecute the employees of the CIA as well. It is good to finally see someone taking a strong stance in this regard. What a wonderful, wonderful man. He is probably a good husband and father too.

1 0

Re: XDM has the same problem as netscape ?!
by Arve Kjoelen 17 Dec '03

17 Dec '03

Ian Goldberg wrote: >Nelson Minar <nelson(a)santafe.edu> wrote: >>Last time I looked, the MIT-MAGIC-COOKIE-1 scheme used in X11R4 had >>the same problem: the random seed was based on the current time to the >>microsecond, modulo the granularity of the system clock. I think I >>figured that on my hardware, if I could figure out which minute the X >>server started (easy with finger), I'd only have to try a few >>thousand keys or so. Caveat: I never actually proved the idea. >Wow. I just checked, and Nelson's right. >[ code extracts snipped] I just checked X11R6, and the same method is used there, so it hasn't changed since X11R4. -Arve.

1 0

TAMPERPROOFING OF CHIP CARDS
by William H. Geiger III 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The below message was posted to one of my mailing lists and I thought it amy be of intrest here. I found this in our database. I've never seen it before. I found it pretty interesting, despite being somewhat old. Truncation in original. * * * * * TAMPERPROOFING OF CHIP CARDS Ross J. Anderson Cambridge University Computer Laboratory Pembroke Street, Cambridge CB2 3QG Email: ross.anderson(a)cl.cam.ac.uk Abstract There are two ways of attacking smartcards - destructive reverse engineering of the silicon circuit (including the contents of ROM), and discovering the memory contents by other means; a well equipped laboratory can do both. Persistent amateurs have often managed the latter, and may shortly be able to do the former as well. 1 Reverse engineering the chip A recent article[1] gives a good introduction to how reverse engineering can be carried out in a moderately well equipped academic microelectronics laboratory (there are three such in the UK, and perhaps two hundred academic or industrial facilities worldwide which can carry out such work). We will start off by summarising it and giving some background. 1.1 How attacks are done The authors of the article cited above worked at the Cambridge University microelectronics lab, which is part of the department of physics. They got interested in reverse engineering chips five years ago to help an industrial client locate manufacturing defects. They built an apparatus which consists of a slightly modified electron beam lithography machine (this functions in effect as an electron microscope) and a PC with an image processing system (a DCT chip and locally written software). They then developed techniques for etching away a layer at a time without doing too much damage. Conventional wet etching causes too much havoc with half micron chips, so dry etching is used in which gases such as CF4 or HF strip off layers of silica and aluminium in turn. One of their innovations is a technique to show up N and P doped layers in electron micrographs. This uses the Schottky effect: a thin film of a metal such as gold or palladium is deposited on the chip creating a diode effect which can be seen with the electron beam. Finally, image processing software has been developed to spot the common chip features and reduce the initially fuzzy image of the metal tracks into a clean polygon representation. There are also routines to get images of successive layers, and of adjacent parts of the chip, in register. The system has been tested by reverse engineering the Intel 80386 and a number of other devices. The 80386 took two weeks; it takes about six instances of a given chip to get it right. The output can take the form of a mask diagram, a circuit diagram or even a list of the library cells from which the chip was constructed. This is typical of the kind of attack which an academic lab can mount. Even more sophisticated attacks, invented at Sandia National laboratories and recently published[2], involve looking through the chip. Light-Induced Voltage Alteration is a non- destructive technique that involves probing operating ICs from the back side with an infrared laser to which the silicon substrate is transparent. The photocurrents thus created allow probing of the device's operation and identification of logic states of individual transistors. Low-Energy Charge Induced Voltage Alteration relies on a surface interaction phenomenon that produces a negative charge-polarization wave using a low- energy electron beam generated by a scanning electron microscope. This allows imaging the chip to identify open conductors and voltage levels without damage, although it does not operate through metalization layers. Of course, even more sophisticated techniques may be available in classified government facilities. 1.2 The threat to smartcard systems Smartcards typically have a few kilobytes of ROM, which being metal can be read with the above techniques; a few hundred bytes of RAM, which being cleared between transactions stores no long term secrets; and a few kilobytes of EEPROM, which typically holds the user data and key material. The techniques described above are not directly relevant to reading out EEPROM. However any laboratory at the level under consideration would be able to determine EEPROM contents using microprobe techniques. More simply, a reverse engineering operation would pinpoint the physical location of the write protect bit, which could then be reset using ultraviolet light. As mentioned, the number of organisations worldwide which can do electron beam lithography is of the order of 100-200. These potential attackers include a number of universities, all the big chip makers and the governments of the USA, Canada, the UK and China. Of these, the US and Chinese governments appear to have the greatest experience at chip breaking. For a respectable firm to join this club costs about $2m - $1.5m for the electron beam lithographer and ancilliary equipment, plus a year's salary for about five professionals to get it all going (typically a physicist to deal with the ion beams, a chemist to deal with packaging, two computer people to write software, and a chip person to run the whole operation). The number of club members may rise as more and more firms, especially in the Far East, start producing ASICs. However it is not likely that electron beam lithography will ever become a really widespread technology. The total number of sites with the capability to do regular hi-tech attacks might rise to about 1000 at most. An outsider without $2m still has a number of options. For ex- ample, there are three universities in the UK alone which possess the necessary equipment (Cambridge, Edinburgh and Southampton) and an attacker might enrol for a PhD or other degree in order to acquire access and training. It is also possible to use more primitive equipment at the cost of spending months rather than weeks on each reconstruction; this is apparently the approach of the Chinese government, and could be viable where workers are paid little (or are expecting a share of large criminal profits). Finally, there are apparently places in the Far East, and at least one in Silicon Valley, which reverse engineer chips for cash. How much cash, and how many questions would be asked, are not known to this writer. 1.3 Possible defences A number of copy trap features are incorporated into commercial chip designs. For example, we have heard of design elements that look like a transistor, but are in reality only a connection between gate and source; and 3-input NORs which function only as 2-input NORs. Many of these copier traps are based on holes in isolating layers or on tricks done in the diffusion layer with ion implantation (based on the assumption that it is hard to distinguish N from P). However the layer etching and Schottky techniques developed by Haroun Ahmed's team can detect such traps. Another possibility is to introduce complexity into the chip layout and to use nonstandard cell libraries. However the chip still has to work, which limits the complexity; and nonstandard cells can be reconstructed at the gate level and incorporated in the recognition software. Finally, in the Clipper chip there are a number of silicon features, of which the most important is a fusible link system. These links are only fused after fabrication and hold the long term key and other secret aspects of the chip. Details can of course be found in a paper in the relevant data book[3], and from the scanning electron micrographs there, it is clear that the secret information can be recovered by sectioning the chip. This technique has been used by Professor Ahmed's team on occasion on obscure features in other chips. Thus the effect of current silicon level copy traps is just to slow down the attacker. In fact, we have heard from a usually reliable source that Intel has reverse engineered the Clipper chip, but that the results have been classified. The same appears to be the case for chemical measures. Chips intended for classified military use are often protected by passivation layers of a tenacity never encountered in civilian packaging[4]. But here again, informed sources agree that with enough effort, techniques can be developed to remove them. 1.4 Relevance to smartcard products We understand that neither silicon copy traps not advanced passivation techniques are used by smartcard manufacturers in the bulk of their products. The marketing director of a smartcard manufacturer said that they simply had no demand from their users for anything really sophisticated[5]. The most that appears to be done is an optical sensor under an opaque coating[6]. Hi-tech techniques may indeed have been used by commercial pirates to duplicate satellite TV smartcards[7]. Recent postings to a TV hackers' mailing list recount how an undergraduate used nitric acid and acetone to remove ICs intact from Sky-TV smartcards; he then put them in the University's electron beam tester (an ICT 8020, also sold as the Advantest E 1340 - a 1991 machine). The chips were run in a test loop, but he had been unable to remove the silicon nitride passivation layer; the many secondary electrons removed from this caused it to get charged positive very quickly, which obscured the underlying circuit. He did not have access to a dry etching facility to remove this layer, and could get no further. However it is significant that a person with no funding or specialist knowledge could get even this far. However, amateur hackers have managed to break smartcard security without having to penetrate the device physically. Instead, they have used flaws in the design of the card's hardware or software to determine its contents. 2 Determining the EEPROM contents Many methods have been employed to determine the EEPROM contents of smartcards. In addition to the very general reverse engineering techniques described above, there are a lot of shortcut attacks on particular designs. 2.1 How attacks are done The following list is not exhaustive: o raising the supply voltage above its design limit; o cutting the supply voltage below its design limit; o resetting random memory locations using ultraviolet light until the read protect bit is found; o exploiting misfeatures in the hardware, including the manufacturer supplied ROM code; o exploiting misfeatures in the customer written EEPROM code (current attacks on UK satellite TV systems take this route); o some combination of the above. The appendix contains accounts from a hacker mailing list of two actual attacks carried out on chips. 2.2 Threat assessment All systems have bugs, and so the level of threat to smartcard systems presented by exploitable loopholes is a function of how many bugs remain (i.e. how mature the design is) and how much effort is spent in looking for them (i.e. how many motivated attackers there are). This in turn depends on the application area. Satellite TV systems attracted a great many attackers for historical reasons; in the USA, many rural households had got into the habit of watching satellite TV feeds as there were no terrestrial stations in range, even although these feeds were intended for rebroadcast rather than direct consumption. When the feeds were encrypted, the families who depended on them for their news and entertainment - and often could not buy decoders through any legal channel - were outraged. In Europe, a similar problem arose when the final season of 'Star Trek: The Next Generation' was encrypted. This program's fans included many with appropriate skills, and soon (March 94) there appeared a program called Season which decoded Sky TV. Since then, there has been a battle of wits between Sky and the Trekkies, which has probably cost Sky somewhere between $10 million and $100 million. On May 18th 1994, Sky changed from issue 07 cards to their new issue 09 card. Hackers refer to May 18th as Dark Wednesday. The 09 card proved harder to hack but a temporary solution appeared in June. It only lasted a few weeks before Sky changed codes again. Though some attempts at an issue 09 Season were made, a code change by Sky stopped it until just before Christmas. Then no less than three new versions of Season appeared - two for the PC and one for the MAC. Successive code changes on January 4th and January 25th led to further updates of Season, and by about 8th March all the secrets in the Sky 09 card were known - and published! Hackers are awaiting the release of series 10 Sky cards with relish. In addition to the attacks on satellite TV, there have been a number of attacks on banking systems and prepayment electricity meter systems which are documented in three of my recent papers [8, 9, 10] Most of the attacks documented there resulted from similarly opportunistic exploitation of design and operational errors, and some of the target systems were based on smartcards. Finally, some concern has been expressed that attack skills may be transferable. For example, a banking industry security expert is worried that the satellite TV hacking community might next turn its attention to eftpos systems. 2.3 Possible defences The main conclusion to be drawn from the above is probably that just as we do not know how to make a device which resists tampering by a funded organisation, we do not know how to build a device of any complexity to resist logical as opposed to physical tampering. There are a number of other lessons. For example, companies which rely on smartcard systems should if possible avoid making a lot of enemies. Diversity of attack has been significant in pay-TV, metering and banking systems and just as a funded organisation can break the silicon directly, so one must expect that many tinkering amateurs will eventually find a flaw in any piece of software. It is well known in the software testing community that a significant number of bugs come to light when a piece of software is passed on to another tester or to a customer; this is because different testers and/or users exercise different parts of the input space[11]. It is also imprudent to start off with weak security and then improve it gradually in response to attacks. The satellite TV people did this, and trained up a community of hackers. At some point, you must invest enough to put clear water between your systems and your opponents, and the sooner you make this investment the smaller it is likely to be. The main investment should be in getting the overall design right, or at least as right as one can, from the beginning. It is unwise to spend a lot of money on tamperproofing while ignoring the much simpler and dirtier attacks which exploit errors in design and operation. Quality control, and examination by multiple independent experts, should take priority over attempts to mimic the passivation techniques used by the military. After all, the three published attacks on Clipper all involve the logical design (key management protocols and modes of operation) rather than penetration of the device itself. 3 Conclusion At present, there are no portable tamperproof devices. If secrets are held on smartcards which are allowed outside protected spaces, then both physical and logical attacks should be expected. The scale of such attacks will depend on many things. If there is a capable motivated opponent, such as a chip maker or the government of a NATO country or China, then it must be assumed that a complete penetration will take at most weeks. If there are many less capable but still motivated opponents, then penetrations based on the opportunistic exploitation of design flaws are to be expected in due course. We conclude that systems based on portable tamper-resistant devices should be designed with caution. They should avoid motivating a determined attack on the cards, and the penetration of a small number of cards should not be fatal to the system owner. These considerations interact; for example, if the scope of secrets kept within the card is limited so that breaking a card allows access to only one bank account, then it is unlikely that an attack would be economic to an attacker or prove more than a minor nuisance to the card issuer. APPENDIX First account This short essay will show you how to read the EPROM of an AMD87C51, with all security programmed. .... the SM-card I had was programmed with both Lock bits and it was impossible to read out the IROM. But the data sheet also tells: To ensure proper functionality of the chip, the internally latched value of the EA pin must agree with its external state. Perhaps it was possible to confuse the processor. I build a small device with external EPROM (64KBytes) and RAM. The EPROM was coded with a monitor program in the upper address range which gives me the possibility to load and execute code by control of a PC. Starting the processor with external ROM access disables the access of the internal ROM and due to the latching of the EA pin during RESET, changes at the EA pin had no effect. Also the MOVC returns only external ROM values. Know my idea was to start the processor with internal ROM and then to confuse him so that he accesses the external EPROM and run into the monitor program. I tried ... But reduction of the power supply voltage works. At about 1,5 Volt the processor starts to access the external ROM. Rising the voltage back to 5 Volt the processor (most of the times) still run external, but with the possibility of access to the internal ROM... I programmed a small routine, which calls an address within the internal ROM and execute this. I started at the higher end of the internal ROM and decreased the calling address with each try by 10h. Most of the time the processor hangs up. But at some addresses I got a return to the monitor program. So I analysed this addresses and prepared the registers in a way to verify that the routine could read ROM data. And I found the routine which did this. So the internal ROM code reads itself and returns himself to the monitor program for storage. It took about 3 days to go through the ROM and find the routine and one long week to understand the code. Second account This short story shows how to get access to a secured 87C51 microcontroller. It's a different way, than the one described by ..... Referring to his article, I assume, that this 87C51 microcontrollers and their features (including security bits) are known. The idea was, that the security bits are not located near the EPROM array on the silicon. After some tests in erasing standard EPROMS, I had the right tools to try it on a real device: With a mask designed from black, thick paper with a small hole in it, I started to lighten the silicon on the outer edges and sides. Moving the mask carefully and checking the security bits (by reading the device in a microcontroller programmer) after each try is a long job. I did additional tests to open the chip (by removing the windows or dividing the ceramic carrier material). But this always led to permanent damage to the chip (broken silicon, destroyed wires between pads and pins), so I gave this up. So after 4 destroyed chips the fifth was the right one. You have to be sure, that your mask is good prepared and the erasing light doesn't diffuse across the chip. No I'am able to erase such a device in less than 10 minutes. But ... it's only easy if the device is one of AMD or Philips. The Intel devices have a window, which is formed like a lens (the silicon looks very big). On this devices it's nearly impossible to lighten a specific part of the silicon. The job is easier on devices with standard window and a _big_ EPROM Array (seems to be devices aged two or more years). . . . if somebody is interested in the 4K codes of the MasterCard (bad and dirty code) or MovieCard (very elegant algorithm and i/o implementation), just gimme' a direct mail. Disassembled and commented listings in WinWord format are also available (comments in mixed English and German language). REFERENCES [1] 'Layout Reconstruction of Complex Silicon Chips', S Blythe, B Fraboni, S Lall, H Ahmed, U de Riu, IEEE J. of Solid-State Circuits v 28 no 2 (Feb 93) pp 138-145 [2] 'Two New Imaging Techniques Promise To Improve IC Defect Identification', C Ajluni, Electronic Design Vol 43 No 14 (10 July 1995) pp 37-38 [3] 'Conducting Filament of the Programmed Metal Electrode Amorphous Silicon Antifuse', KE Gordon, RJ Wong, International Electron Devices Meeting, Dec 93; reprinted as pp 6-3 to 6-10, QuickLogic Data Book, 1994 [4] see FIPS PUB 140-1 section 4 level 4: "Removal of the coating shall have a high probability of resulting in serious damage to the module" [5] Philippe Maes, GemPlus, during a panel discussion at Cardis 94 [6] message <CovCG9.581(a)apollo.hp.com> posted by Anne Anderson of Hewlett-Packard aha(a)apollo.HP.COM to sci.crypt 26 Apr 1994 [7] apparently tiny jets of hot acid have been used to remove the passivation layers over parts of the chip at a time [8] 'Why Cryptosystems Fail' [9] 'Liability and Computer Security - Nine Principles' [10] 'Cryptographic Credit Control in Pre-payment Metering Systems' All these can be got from http://www.cl.cam.ac.uk:/users/rja14/ [11] 'Thermodynamic description of the defects in large information processing systems', RM Brady, RC Ball, RJ Anderson, to appear - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBNBimLI9Co1n+aLhhAQGVFAP9F/tJe/iAeghu8+FPHsJMoaYXzQT05MTr KAo4ibq7Qe+zJaIOEfMRc8sjRJgVjBHeey7XD0ApvRX9SK0wY0x44KxruBTJqzSq x/o7jiI8efMBTLuIuJzPqnMYsMYdCrcgmRDzyMj+TSI8cFu5NZKkSaSWVajtq7D1 svv5/ACuQos= =GfBt -----END PGP SIGNATURE-----

2 2

Pro-censorship lobbyist calls for AOL boycott
by Declan McCullagh 17 Dec '03

17 Dec '03

CHEYENNE, Wyo. (AP) - Marc Klaas, whose daughter Polly was abducted from her bedroom and killed in 1993, is calling for a boycott of American Online until it stops allowing access to a Florida woman who posts writing and art by serial killers on the Internet. Klaas particularly objects to the work of Keith Hunter Jesperson, who is serving three life sentences in Oregon for killings in the Northwest and is charged with one murder in Wyoming. "America Online is hiding behind freedom of speech in allowing this monster to have a public forum," said Klaas, who was in Wyoming this week to promote the Klaas Foundation for Children, which he established after his daughter's slaying. Officials for the nation's largest Internet access provider said Thursday that some material from the home page of Sondra London of Jacksonville, Fla., would be removed within 24 hours. "We find the information that is in this site and in some of the (associated AOL sites) offensive and objectionable and we did not wish to have our name associated with it," said AOL spokeswoman Tricia Primrose. London said she had removed from her home page one part of Jesperson's material - the "self-start serial killer kit" - on the urging of an AOL attorney who said he was investigating the site. In a letter to Wyoming Gov. Jim Geringer, AOL Senior Vice President and general counsel George Vradenburg III said the material was removed and that none of it was "authored, sponsored or condoned by AOL." "They missed the point," Geringer said. "They failed to acknowledge the remaining material, such as Jesperson referring to his victims as piles of garbage." Geringer, who has asked Oregon officials to extradite Jesperson to Wyoming so he can stand trial in a 1995 slaying, said he supports Klaas' call for a boycott. He also asked AOL on Thursday to remove the rest of Jerperson's material. He called London's Web page "a direct pipeline for his rantings and ravings and advocacy of serial killing." London has said she feels it is important to post such information to gain insight into how serial killers think. Polly Klaas' killer, Richard Allen Davis, is on death row in California. None of his work has appeared on London's Web page.

2 1

Re: Another Netscape Bug (and possible security hole)
by Duncan Frissell 17 Dec '03

17 Dec '03

At 01:17 PM 9/22/95 -0400, Thomas Grant Edwards wrote: >On Fri, 22 Sep 1995, Dietrich J. Kappe wrote: > >> Netscape 1.1N on a powermac crashes hard on that url. If anyone wants to try >> it out, I've put up a simple page with the url at >> http://www.redweb.com/experiment/bug.html > >Netscape also crashes (error 1) on regular Macs...sigh. I'm contacting >someone who just wrote a http server to see how tough it would be drop >some code on the stack. > >-Thomas On my 486 running Windoze for Workgroups 3.11 and the latest Netscape Beta it causes Netscape to die but doesn't lock me up. Generally I've found Netscape blows up in a much firendlier way than other Windoze programs. I can often recover the Netscape session itself and it doesn't lock me up as much. DCF > > >

1 0

Crypto Sync Issue
by kelso＠netcom.com 17 Dec '03

17 Dec '03

Hello, I am interested in encrypting a SLIP link between my PC (running Linux) and my Netcom shell account (running SLIRP). My question has to do with error conditions on the line. If I drop a character or packet, the two sides will loose crypto sync and result in things scrambled from then on. The modems will fix most of the low level problems. However, Murphy's Law has not been repealed. :) Are there any standard methods to provide the SYNC between the sender(encryption) and the receiver(decryption) on an Async connection ? Since Slip uses IP packets, I was planning on an encryption of the data portion of the IP packets (leaving the header alone). Thanks, Tom Rollins <kelso(a)netcom.com>

2 1

Worms and New Netscape Bug
by lethin＠ai.mit.edu 17 Dec '03

17 Dec '03

Although Netscape will certainly fix their new bugs, it's likely that many old copies will remain on computers on the net, and the holes will remain. Netscape could "fight" against this with a modified worms/webcrawler which looks for blatantly dangerous domain names in URLs and reports them to "CERT" or blockware companies like Surfwatch. For example, they'd find the foo* link at the bottom of My page Not a complete solution obviously (e.g. the server could selectively reply to requests, and hide from the webcrawler IP). What happens when someone using the AOL browser clicks on one of these HREF's... does it crash all of AOL? --- Concurrent VLSI Arch. Group 545 Technology Sq., Rm. 610 MIT AI Lab Cambridge, MA 02139 (617)-253-0972

1 0

Privacy secrecy law for driver's records struck down
by Declan McCullagh 17 Dec '03

17 Dec '03

AM-Driver's Privacy,0594 Judge blocks driver's records secrecy law in S.C. By MONA BRECKENRIDGE Associated Press Writer COLUMBIA, S.C. (AP) - A federal law that prohibits the release of personal information from driver's licenses and car registrations is unconstitutional, a judge ruled Thursday in blocking enforcement of the law in South Carolina starting this weekend. State Attorney General Charlie Condon had challenged the Driver's Privacy Protection Act of 1994 on behalf of media groups from five states and two national media organizations. Condon contended the law was an improper infringement on states' rights. U.S. District Judge Dennis Shedd agreed, ruling that Congress "clearly exceeded its power." He said the government, which argued that the law would prevent stalkers from tracking their victims, failed to show that it was necessary to protect a constitutional right of privacy. Drivers should not expect their names, license numbers, addresses, phone numbers and photographs to be private, the judge said. Shedd's ruling blocks enforcement of the law, which is to take effect nationwide on Saturday, in South Carolina only. The only other state to challenge the law so far has been Oklahoma, where the case is pending. "This is a real victory for open governments and open records," said Bill Rogers, executive director of the South Carolina Press Association. "South Carolina already has a very good law to protect people from stalkers and harassing phone calls." Thirty-four states make motor vehicle records public in some form, according to the Reporters Committee for Freedom of the Press. The federal law would restrict almost everything in state motor vehicle records that can be looked up using a license plate or driver's license numbers, unless an individual agrees to its release. The law was sponsored by Sen. Barbara Boxer, D-Calif., in response to the 1989 slaying of actress Rebecca Schaeffer, who was killed at her California home by a man who used a private investigator to obtain her driver's records. The law, however, might not have prevented Schaeffer's slaying, since it would keep motor vehicle records open to police, private investigators, insurance companies, credit agencies and direct-marketing companies. States that did not designate their records as secret could face federal penalties of $5,000 a day. State workers who give out such information could be penalized $2,500 each time. "We are very disappointed by Judge Shedd's decision. We think that driver's privacy protection is an important anti-crime measure," said David Sandretti, Boxer's spokesman in Washington. Justice Department spokesman Joe Krovisky said he could not comment because the agency had not seen Shedd's ruling. Agency officials have 60 days to decide whether to appeal to the 4th U.S. Circuit Court of Appeals, he said. Shedd relied partly on the U.S. Supreme Court's June ruling on the so-called Brady Law, in which the justices said Congress could not make local police do criminal background checks on people who want to buy handguns. "Unquestionably, the states have been, and remain ... responsible for maintaining motor vehicle records, and these records constitute property of the states," Shedd wrote. The media groups that challenged the law were the press associations of South Carolina, North Carolina, Virginia, West Virginia and Maryland-Delaware, and the Newspaper Association of America and the American Society of Newspaper Editors.

1 0

Re: Project: a standard cell random number generator
by koontz＠MasPar.COM 17 Dec '03

17 Dec '03

>At 02:50 PM 9/20/95 -0700, you wrote: >> In this sense, NSA ought to be *encouraging* Intel and >>IBM and Motorola to put "generate random bits" instructions into >>their instruction sets... Intel produces a random generator (in a chip package) that is used in STU-II..'s. You can't buy such devices, random sources good enough to be used for initialization for military grade cryptography are Controlled Cryptographic Items. One would think that the NSA is attempting to exploit the lack of availability of random initialization values against their targets. The question becomes one of whether or not the general populace (of the U.S.) is considered a potential target, or simply casualties of the situation in undeclared hostilities. As a minimum one could infer that the availability of random numbers is considered quite important for NSA secure communications. I used to work at a company that subscribed to NSA (National Standards Association) which provided government and other standards on microfiche and/or hardcopy. There was an interval before Reagan took office when the NSA provided all of their unclassified standards into general availability, an era of open- ness that came to an end with the Star Wars era. One of those standards was for random data sources. The only recent standards that come to mind are the X.509 stuff for session key generation, FIPS PUB 140-1 which describes randomizer tests, and the recent FIPS PUB for a password generator. These three use block ciphers to produce psuedo-random output. If NSA requires real stochastic results for military crypto, what would we as casual cryptographers feel comfortable with? The Netscape episode shows the comfort level needs improving. How good is good enough?

1 0

Netscape sub rosa?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:33 AM 9/20/95, Alan Olsen wrote: >At 03:06 PM 9/19/95 -0500, you wrote: >>NPR reported on the security flaw in Netscape, >> >>3:05 pm CDT. > >As well as CNN Headline news. (With the big Netscape N logo and ^^^^^^^^^^^^^^^^^^^ >everything.) They spent a fair amount of time (for CNN Headline news) on >the story. Gee, where's that "Cypherpunks logo" when you really need it? A rose covering the Netscape "N" logo? A crypto eagle swooping down and pecking at weak keys? Netscape sub rosa? --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Re: Forwarding of Federalist Papers from Canada for U.S. Citizens promoting democracy
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Six wrote: > If you have a desire to educate the citizens of foreign countries > as to the value of democracy, I would be pleased to forward a copy of > the Federalist Papers to any email address you desire, upon receipt > of only the email addresses, with no instructions or requests. I think we should all send a copy of the Federalist Papers to Sadaam Hussein. It would be the American thing to do. Six also wrote: > If for any reason you feel that the terrorists who are ruling your > country might be able to persecute you for exercising free speech, > I would be happy to forward PGP 5.0 upon receipt of only the email > addresses, with no instructions or requests. I am certain we can trust Six not to mix up the addresses with no instructions and no requests meant for forwarding the Federalist Papers with the addresses with no instructions and no requests meant for forwarding strong encryption. TrustingMonger

1 0

Government promotes strong crypto!!!
by EFF 17 Dec '03

17 Dec '03

[Electronic Forgery Foundation] <Bienfait, Saskatchewan> [Washington, DC] In a startling turn of events, the U.S. government has come out in support of the use of strong encryption. In order to give incentives to criminals to use strong encryption, the government has announced that the penalty for using weak encryption in the commission of a crime will be an extra five years in prison. Lying Nazi Fuck Freeh stated, "Theoretically, the law applies to those criminals who use strong encryption, as well, but in practice, we will not be able to prosecute, because if we can't break it, then we have no way to prove it is being used for criminal purposes." Dog-faced Child Murderer Reno stated that the high level of publicity given to the effective use of encryption in crime has served the government's aim of making certain that the vast majority of criminals will recognize the value of using encryption to hide evidence. Lying Nazi Slut Dying FineSwine stated that she opposed the use of strong encryption by child pornographers because she and the vice police had grown so accustomed to high-quality computer graphics of child pornography, that they just couldn't get off on photographs any more. Marked for deletion SwineSwine said that she would like to comment more on child pornography, but talking about it made her hot, and she then rushed of to the ladies room. ----------------------------------------------------------------------- This message was forged under the auspices of the Electronic Forgery Foundation. Any misuse or abuse of this message will probably give your Congressman a hard on. They're weird that way. -----------------------------------------------------------------------

1 0