December 2003 - cypherpunks-legacy

hi you
by 2ancesca9＠net.kitel.co.kr 17 Dec '03

17 Dec '03

!!!!! YES YOUR XXXX PASSWORD AWAITS YOU !!!!!! > To get your password... Just: <a href="http://204.71.176.71/members4/rufina522/index.html"> Click Here</a> ................ ..................//

1 0

Differential Power Analysis
by Paul Kocher 17 Dec '03

17 Dec '03

Information is now available online about three related attacks we have developed at Cryptography Research: Simple Power Analysis, Differential Power Analysis, and High-Order Differential Power Analysis. The basic idea of the attacks is that the power consumption of a device (such as a smartcard) is statistically correlated to the operations it performs. By monitoring the power usage (or electromagnetic radiation, etc.) during cryptographic operations, it is possible to obtain information correlated to the keys. The collected data is then analyzed to actually find the keys. The three attacks use increasingly sophisticated analysis methods. We have implemented the attack against a large number of smartcards, and have found all to be vulnerable. At this point, we do not believe that any smartcards on the market are immune to these analysis techniques. There is now an initial summary on Differential Power Analysis on our web page at http://www.cryptography.com/dpa, and more information will be put on the website as it becomes available. A condensed text version is attached below. At this point, it's fine to talk about this with anyone and to forward this message. Anything you can do to keep discussion of this technically accurate would be much appreciated. Regards, Paul Kocher --------------------------------------------------------------------- Introduction: Power Variation Integrated circuits are built out of individual transistors, which act as voltage-controlled switches. Current flows across the transistor substrate when charge is applied to (or removed from) the gate. This current then delivers charge to the gates of other transistors, interconnect wires, and other circuit loads. The motion of electric charge consumes power and produces electromagnetic radiation, both of which are externally detectable. Therefore, individual transistors produce externally observable electrical behavior. Because microprocessor logic units exhibit regular transistor switching patterns, it is possible to easily identify macro-characteristics (such as microprocessor activity) by the simple monitoring of power consumption. DPA type attacks perform more sophisticated interpretations of this data. Simple Power Analysis (SPA) In SPA attacks, an attacker directly observes a system's power consumption. The amount of power consumed varies depending on the microprocessor instruction performed. Large features such as DES rounds, RSA operations, etc. may be identified, since the operations performed by the microprocessor vary significantly during different parts of these operations. At higher magnification, individual instructions can be differentiated. SPA analysis can, for example, be used to break RSA implementations by revealing differences between multiplication and squaring operations. Similarly, many DES implementations have visible differences within permutations and shifts (e.g., the PC1 permutation or rotates of the C and D registers), and can thus be broken using SPA. While Cryptography Research found many smartcards to be vulnerable to SPA analysis, it is not particularly difficult to build SPA-resistant devices. The figure above [see web site] shows SPA monitoring from a single DES operation performed by a typical smartcard. The upper trace shows the entire encryption operation, including the initial permutation, the 16 DES rounds, and the final permutation. The lower trace is a detailed view of the second and third rounds. Differential Power Analysis (DPA) DPA is a much more powerful attack than SPA, and is much more difficult to prevent. While SPA attacks use primarily visual inspection to identify relevant power fluctuations, DPA attacks use statistical analysis and error correction techniques to extract information correlated to secret keys. Implementation of a DPA attack involves two phases: Data collection and data analysis. Data collection for DPA may be performed as described previously by sampling a device's power consumption during cryptographic operations as a function of time. For DPA, a number of cryptographic operations using the target key are observed. The following steps provide an example of a DPA attack process for technical readers. (More detailed information will follow in the near future.) The following explanation presumes a detailed knowledge of the DES algorithm. 1. Make power consumption measurements of the last few rounds of 1000 DES operations. Each sample set consists of 100000 data points. The data collected can be represented as a two- dimensional array S[0...999][0...99999], where the first index is the operation number and the second index is the sample. For this example, the attacker is also assumed to have the encrypted ciphertexts, C[0...999]. 2. The attacker next chooses a key-dependent selection function D. In this case, the selection function would have the form D(Ki,C), where Ki is some key information and C is a ciphertext. For the example, the attacker's goal will be to find the 6 bits of the DES key that are provided as the input to the DES S box 4, so Ki is a 6-bit input. The result of D(Ki,C) would be obtained by performing the DES initial permutation (IP) on C to obtain R and L, performing the E expansion on R, extracting the 6-bit input to S4, XORing with Ki, and using the XOR result as the input to the standard DES S4 lookup operation. A target bit (for example, the most significant bit) of the S result is selected. The P permutation is applied to the bit. The result of the D(Ki,C) function is set to 0 if the single-bit P permutation result and the corresponding bit in L are equal, and otherwise D(Ki,C) yields 1. 3. A differential average trace T[0...63][0...99999] is constructed from the data set S using the results of the function D. In particular: [See web site for formula] 4. The attacker knows that there is one correct value for Ki; other values are incorrect. The attack goal is to identify the correct value. In the trace T[i][0...99999] where i=Ki, D(i,C[k]) for any k will equal the value of the target bit in L of the DES operation before the DES F function result was XORed. When the target device performed the DES operations, this bit value was stored in registers, manipulated in logic units, etc. -- yielding detectable power consumption differences. Thus, for the portions of the trace T[i=Ki] where that bit was present and/or manipulated, the sample set T[i] will show power consumption biases. However, for samples T[i != Ki], the value of D(i,C[k]) will not correspond to any operation actually computed by the target device. As a result, the trace T[i] will not be correlated to anything actually performed, and will average to zero. (Actually, T[i != Ki] will show small fluctuations due to noise and error that is not statistically filtered out, and due to biases resulting from statistical properties of the S tables. However, the largest biases will correspond to the correct value of Ki.) 5. The steps above are then repeated for the remaining S boxes to find the 48 key bits for the last round. The attack can then be repeated to find the previous round's subkey (or the remaining 8 bits can be found using a quick search.) While the effects of a single transistor switching would be normally be impossible to identify from direct observations of a device's power consumption, the statistical operations used in DPA are able to reliably identify extraordinarily small differences in power consumption. The figure below [see web site] is a DPA trace from a typical smartcard, showing the power consumption differences from selecting one input bit to a DES encryption function used as a random number generator. (The function of D was chosen to equal the value of plaintext bit 5.) The input initial permutation places this bit as part of the R register, affecting the first-round F function computation and results. Round 2 effects (due to the use of counter mode) are also strong. The trace was produced using 1000 measurements, although the signals would be discernable with far fewer. High-Order Differential Power Analysis (HO-DPA) While the DPA techniques described above analyze information across a single event between samples, high-order DPA may be used to correlate information between multiple cryptographic suboperations. Naive attempts to address DPA attacks can introduce or miss vulnerabilities to HO-DPA attacks. In a high-order DPA attack, signals collected from multiple sources, signals collected using different measuring techniques, and signals with different temporal offsets are combined during application of DPA techniques. Additionally, more general differential functions (D) may be applied. More advanced signal processing functions may also be applied. The basic HO-DPA processing function is thus a more general form of the of the standard DPA function, for example: [see web site for formula] Today HO-DPA are primarily of interest to system implementers and researchers, since no actual systems are known that are vulnerable to HO-DPA that are not also vulnerable to DPA. However, DPA countermeasures must also address HO-DPA attacks to be effective. Solving the Problems Cryptography Research has undertaken a substantial development effort to understand hardware security issues and their countermeasures. Cryptography Research has pending patents directed to the technologies and techniques below. DPA and related attacks span the traditional engineering levels of abstraction. While many previously-known cryptanalytic attacks (such as brute force) can be analyzed by studying cryptographic algorithms, DPA vulnerabilities result from transistor and circuit electrical behaviors which propagate to expose logic gates, microprocessor operation, and software implementations. This ultimately compromises the cryptography. Techniques for addressing DPA and related attacks can be incorporated at a variety of levels: Transistor: No feasible alternatives to semiconductors are available today, but alternate computation technologies (such as pure optical computing) may exist in the future. Cryptography Research has developed gate-level logic designs that leak substantially less information. Circuit, Logic, Microprocessor, and Software: In physically large systems, well-filtered power supplies and physical shielding can make attacks infeasible. For systems with physical or cost constraints, Cryptography Research has developed hardware and software techniques that include ways of reducing the amount of information leaked, introducing noise into measurements, decorrelating internal variables from secret parameters, and temporally decorrelating cryptographic operations. In applications where attackers do not have physical possession of the device performing cryptographic operations, such techniques can be effective. However, because externally-monitorable characteristics remain fundamentally correlated to cryptographic operations, we do not recommend these approaches as a complete solution for applications where attackers might gain physical possession of devices. Software and Algorithms: The most effective solution is to design and implementing cryptosystems with the assumption that information will leak. Cryptography Research has developed approaches for securing existing cryptographic algorithms (including RSA, DES, DSA, Diffie- Hellman, ElGamal, and Elliptic Curve systems) to make systems remain secure even though the underlying circuits may leak information. In cases where the physical hardware leaks excessively, the leak reduction and masking techniques are also required. _____________________________________________________________________ Paul Kocher President, Cryptography Research Tel: 415-397-0123 (FAX: -0127) 870 Market St., Suite 1088 E-mail: paul(a)cryptography.com San Francisco, CA 94102 _____________________________________________________________________ Paul Kocher President, Cryptography Research Tel: 415-397-0123 (FAX: -0127) 870 Market St., Suite 1088 E-mail: paul(a)cryptography.com San Francisco, CA 94102

1 0

Media lies exposed
by Global Web Builders 17 Dec '03

17 Dec '03

G'day One Nation supporters in NSW Channel 9 has embarked on a blatant campaign of misinformation against One Nation over the last two weeks. The timing in the lead up to the Queensland State election and the resulting impact on voters cannot be ignored by ANY Australian who believes in freedom of speech and the democracy that we hold so dear. Ray Martin exposed: http://www.gwb.com.au/un.html 60 Minutes discredited: http://www.gwb.com.au/60.html Below is a copy of an article that appeared in Perth's Sunday times recently. GWB Scott Balson Judge says no to black state by Joe Poprzeonzy A former Chief Justice of the Australian High Court has urged that any claims by activists for the creation of a separate Aboriginal nation or independent black states be rejected. Sir Harry Gibbs said Arnhein Land, parts of central Australia,, north west WA, islands in the Torres Strait or off northern Australia would be targeted for Aboriginal independence. In a keynote address yesterday at a Perth meeting of the influential conservative group, the Samuel Griffith Society, he said separate laws were emerging in Australia to cover black and white Australians. "There is no doubt that any claims by the Aborigional peoples to determine their own political status, and to assert a right to sovereignty or independence, must be rejected as contrary to the interests of Australia as a whole," Sir Harry said. "Just as any attempt to put the Aboriginal peoples outside the Australian nation must be firmly opposed, so should any attempt to grant statehood, or any degree of autonomy to any particular group or Aboriginal people. "It would obviously be impracticable... to grant sovereign or dominant power to the Aboriginal people in areas such as country towns in which persons entirely of European descent were as numerous as the descendants of the Aboriginal people, many of whom would themselves have had European ancestors. "Experience elsewhere has shown that associations of States, Federal or otherwise, do not endure when one state is composed of persons distinctly different in race, religion or culture from those of another. "The future existence of Australia would be put at risk if statehood or any form of autonomy were granted to small communities chosen on the grounds of race in areas of great strategic importance to this country." Sir Harry who was Chief Justice of Australia between 1981 and 1987 said some people were arguing that there was a right of self-determination within countries. He said groups were working within the UN for the development of such doctrines.

1 0

CYPHERPUNKS INVADE BERKELEY! June 98 Physical Meeting Announcement
by Hugh Daniel 17 Dec '03

17 Dec '03

June's meeting will be at Soda Hall in Berkeley, near Hearst&LeRoy. There's a map at http://www.berkeley.edu/campus_map/maps/ABCD345.html Ian has reserved the 4th floor lounge and the adjacent patio in Soda Hall on the UC Berkeley campus for the June 13 meeting. There's power, whiteboard, and Metricom coverage in the room. If there are computer demos needed, we can go down the hall to my office. The biggest problem will be parking; Ian is having the staff here look in to that, but he may need to know _in advance_ who's going to need parking permits. Otherwise, you'll have to pop out every so often to feed the meter. Thanks! Bill Bill Stewart, bill.stewart(a)pobox.com PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639

1 0

Don't Risk Losing That Great Domain Name!
by net138＠mail.domain-serv.com 17 Dec '03

17 Dec '03

********************************************************************* Don't Risk Losing That Great Domain Name For Your Personal Or Business Use. ********************************************************************* Register your Domain Name for a one time fee of $35.00. Planet Net's Domain Registration Services will not only register your domain name, but for no monthly charge, allow you to use the Planet Net Name Service. When you are ready to post your web site or use your domain for mail, The decision is up to you; select another website hosting company or Host with Planet Net. We'll even waive the set-up fees. Also available are packages with custom "under construction" pages and mail services allowing you to use your new domain for e-mail. Planet Net, the Internet's premier webmasters resource, offers high performance Website Hosting and Dedicated Servers. Lightning fast 30 MB virtual web hosting packages starting at $19.99/Month. Reseller packages with domain hosting as low as $10 /month All packages include bundles of free webmaster tools. Sign-up before June 30, 1998 and receive up to 3 Free months of web site hosting. If you would like to check the availability of your domain name or learn more about Planet Net type the following address in your web browser. http://www.serveramerica.com See You On The Net!!

1 0

Moderator Nazi Update!
by StanSqncrs＠aol.com 17 Dec '03

17 Dec '03

Cypherpunks, I may've found a 3rd picture of my "Moderator Nazi". I have it posted here with the others at - http://members.aol.com/WhtsAMetaU/ofir.html I'd like expert opinion from the Cypherpunks (and any FBI agents that may happen to be lurking the list :-), actually, ESPECIALLY any FBI agents that may be working the list ;-) ) as to whether you think it's the same person. Look at it as if he's losing weight over the years. Write me in private if you wish, and thanks in advance! Stan

1 0

hello hello !!
by 2ncesca9＠net.kitel.co.kr 17 Dec '03

17 Dec '03

!!!!! YES YOUR XXXX PASSWORD AWAITS YOU !!!!!! > To get your password... Just: <a href="http://204.71.176.71/members4/rose541/index.html"> Click Here</a> ................ ..................//

1 0

Second Notice of Appeal FILED
by bill payne 17 Dec '03

17 Dec '03

Wednesday 6/10/98 2:34 PM John Young The second attached NOTICE OF APPEAL was stamped FILED UNITED STATES DISTRICT COURT DISTRICT OF NEW MEXICO 98 JUN 10 AM 9:52 Robert M. March Clerk, ALBUQUERQUE I put stamped copies of both in the mail to you. The government only MAYBE understands FORMAL actions. Informal actions, like letters etc, go into the waste paper basket. Even formal actions such as the FOIA, PA, lawsuit, and criminal complaint affidavit the government will try to BLACK HOLE. While, naturally, we would like to settle this unfortunate matter so that we can all get on to more constructive pursuits, it appears that we will be doing a FORMAL ACTION at least TWICE through the Tenth Circuit court of appeals. Later bill UNITED STATES DISTRICT COURT FOR THE DISTRICT OF NEW MEXICO William H. Payne ) Arthur R. Morales ) ) Plaintiffs, ) ) v ) CIV NO 97 0266 ) SC/DJS ) Lieutenant General Kenneth A. Minihan, USAF ) Director, National Security Agency ) National Security Agency ) ) Defendant ) NOTICE OF APPEAL Santiago E. Campos MEMORANDUM OPINION AND ORDER FILED 98 APR 30 AM 11:45 1 COMES NOW plaintiffs Payne and Morales [Plaintiffs] to exercise their rights under the Federal Rules of Appellate Procedure http://www.ca5.uscourts.gov/docs/frap-iop.htm FRAP 4. APPEAL AS OF RIGHT--WHEN TAKEN http://www.ca5.uscourts.gov/docs/frap-iop.htm#4 a) Appeal in a Civil Case. (1) Except as provided in paragraph (a)(4) of this Rule, in a civil case in which an appeal is permitted by law as of right from a district court to a court of appeals the notice of appeal required by Rule 3 must be filed with the clerk of the district court within 30 days after the date of entry of the judgment or order appealed from; but if the United States or an officer or agency thereof is a party, the notice of appeal may be filed by any party within 60 days after such entry. If a notice of appeal is mistakenly filed in the court of appeals, the clerk of the court of appeals shall note thereon the date when the clerk received the notice and send it to the clerk of the district court and the notice will be treated as filed in the district court on the date so noted. 2 Defendant Minihan is officer of the United States. 3 Plaintiffs appeal A NOW, THEREFORE, IT IS ORDERED that sua sponte, Defendant is DEEMED by the Court to be the NSA, and not Lt. Gen. Kenneth A. Minihan. Future captions for this case should reflect this change. B IT IS FURTHER ORDERED that Defendant's Motion to Dismiss Plaintiff Morales is GRANTED. C IT IS FURTHER ORDERED that Plaintiff's Motion for Summary Judgment Based on Evidence from Admissions is DENIED as MOOT. seen at http://jya.com/whp043098.htm to the Tenth Circuit Court of Appeals. Respectfully submitted, William H. Payne 13015 Calle de Sandias NE Albuquerque, NM 87111 Arthur R. Morales 1024 Los Arboles NW Albuquerque, NM 87107 Pro se litigants CERTIFICATE OF SERVICE I HEREBY CERTIFY that a copy of the foregoing memorandum was mailed to Lieutenant General Kenneth A. Minihan, USAF, Director, National Security Agency, National Security Agency, 9800 Savage Road, Fort George G. Meade, MD 20755-6000 and hand delivered to Jan E Mitchell, Assistant US Attorney, 9 Floor, Bank of America Building, 3rd and Tijeras, ABQ, NM 87102 this Wednesday June 10, 1998. 2

1 0

backdoor trojan in ICKill
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

----Forwarded text-------------------------------------------------- Subject: backdoor trojan in ICKill Date: Sun, 7 Jun 1998 19:44:28 -0400 From: Bachrach <bachrach(a)netreach.net> To: BUGTRAQ(a)NETSPACE.ORG First off, I'm not 100% sure if this is the apropriate forum for this since it's not really a weakness, but rather a programmer who is putting backdoors into some programs. Then again technically that's an exploits... Oh I don't know. If this is the wrong place then I apologize profusely for the waste of bandwidth and plead ignorance, but here goes: Well, chances are none of you guys have ever used this program, or even heard of it, but there are alot (35,000) of people who have. I originally downloaded it becasue I've been researching a lot of the weaknesses in the ICQ protocol, (which has become easier as time has gone on. :)) Anyway, after you run it, (ICKill), it creates a file in the directory called 1.exe that acts as a fake explorer. 1.exe accesses your regedit database, and copies itself to windows/system. It changes the regedit so that the fake one will run on startup. It acts mostly the same as the normal explorer with one very crucial execption. It contacts a host (I still can't figure out which one), and executes the commands that are embedded within a text file on the computer. Anyone see it yet? Backdoor city. I contacted the author (who left his e-mail address in the readme), and he's the one who explained th backdoor thing. He also told me a few other things that made me write up to this group. He said that he had gotten almost 35,000 different people's systems calling up his computer at one point; essentuially he has backdoors to 35,000 systems accross the globe. When I asked him why he would go through all the trouble to do this he gave me two reasons: 1. IF (and he emphasized the if) he was a hacker he could use a couple of other people's computers as hops when hacking into a system. Kind of nasty for the sysadmin trying to trace a breaking huh? 2. To quote him "And the backdoors can auto-uptade themselves.. so Imagine I can code a virus like backdoor... Whoaaa! This will be like THAT internet worm.." 3. He also said "Imagine also.. 35,000 backdoored (yeah, I reached this number) connections pinging or SYN flooding some server.." Well if anyone out there is using or has ever used ICKill then get rid of it. I have actually set up a page on this to both inform people and explain how to get rid of all traces of the program that I currently am able to at http://members.tripod.com/~hakz/ICQ/index.html That site also has all of the letters I wrote to him and he wrote to me if you want to see the entire things. It's also got some other info I couldn't fit into this message, including all of the mistakes the author made (guess he needed better beta testing). My last question is this: if one person has backdoors into thousands of computer systems, doesn't that pose some sort of risk to the interent community as a whole? There's one person who's been saying that I should notify the FBI about this. As you can see decided to start here first.

3 2

[SPAM] No really. It _is_ spam. It's spam, i tell you. You've been warned!
by Zane Lewkowicz 17 Dec '03

17 Dec '03

From: incognito(a)incognito.com Date: Thu, 11 Jun 1998 To: (Recipient list suppressed) Subject: This is fun!!! Hi, Would you like to send someone a letter from Bangkok? Well, you can! Put the letter to be remailed in a larger envelope with US$3 cash and I will post it from Bangkok bearing a Bangkok postmark to any country in the world. If you want the letter to go registered then enclose US$4 cash. I will pay the postage from the enclosed fee. The letter must be lightweight air-mail only containing not more than 2 sheets of writing paper. Here's the address... Incognito P.O. Box 3, 10704, Bang Orr, Bangkok, Thailand. ... Please register your mail to me. - -------------------------------- A must for secret lovers. Great for practical jokes and pranksters. Inform your boss what you think about her/his ideas. Tell your ex-wife/husband you're living in Bangkok. Go on, give it a try it's great fun. You can put as many envelopes in the larger one as you like but you must enclose the fee for each remailed item. The 10th letter goes free! Here's another way... 1. Send US$10 cash and I'll send you three picture postcards of various places in Thailand. I send them to you and you write them out and post back to me for remailing. Or... 2. Enclose a slip of paper with the US$10 giving details of names and addresses and messages to go on the three postcards. Mail to be remailed is sent the same day it is received unless you specify a date for it to be remailed. No records kept and you are completely unknown to me so don't put your name and address on any of the envelopes. Please send a copy of this email to your friends. Have fun!!! *********** ------- End of Forwarded Message

1 0