December 2003 - cypherpunks-legacy

Re: SSL challenge -- broken !
by Damien.Doligez＠inria.fr 17 Dec '03

17 Dec '03

>From: Joe Buck <jbuck(a)Synopsys.COM> >However, I disagree with your conclusion: [...] >There's plenty of stuff that *does* need protection, but I'm not sure >credit card #'s head the list. You're right, of course, if you discount the hassle of getting the transactions cancelled whenever your credit card number is used fraudulently. I have much a better example (and a real one, too): I have an account at Wells Fargo Bank near San Fransisco. They recently started offering web access to their customers. That would be great for me because banking by phone is pretty expensive when I'm in France, and it's not always easy for me to understand American accents. So they would give me a password that I can use for some set of operations. I don't know which one exactly, but I would expect it to include electronic transfers from my account to anywhere else. The password is protected by the SSL connection. That would be fine if I had the full SSL security, but in France I can only get the exportable version of Netscape. As a result, I won't be using this service. There's the beginning of a market for full-SSL clients and servers outside the US. Maybe Netscape should go multinational right now. -- Damien

1 0

UK Independent on SSL crack
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

from the "ukpipeline" :-) >>>>>>>>>>>>>>>>>>>> UK Indpendent newspaper, 17/8/1995 Internet's 30bn Pound Secret Revealed Charles Arthur Technology Correspondent A French student has cracked the most commonly used encryption system used to pass financial transactions over the Internet, threatening a business forecast to be worth billions of pounds worldwide. Damien Doligez, 27, a PhD student at the Inria research centre near Paris, broke a software "key" used by the Netscape browsing program, which lets users navigate the World Wide Web. With Netscape, Internet users can visit shopping "sites" on the Web and order goods by sending their credit card and address over the network to the site. To prevent anyone picking up those confidential details as they pass through the network, they are encrypted first using a software "key". This is the system used for example by Barclays Bank's "BarclaySquare" project, launched in May, which offers access to eight major retailers. Market research companies forecast that money transmission over the Internet will be worth more than 30bn pounds by 2005. At the launch of BarclaySquare, Roger Alexander, managing director of the unit said: "The encryption method has been rigorously tested by us". But Mr. Doligez has compromised that security by decoding a test example of an encrypted transaction, posted on a number of Internet discussion groups in July. The transaction was scrambled using a digital key 40 bits long, which offers about 1,000 billion ( a million million) possible combinations. Mr Doligez harnessed spare time on 120 workstations and parallel computers. The computers turned up the answer after eight days. "I wouldn't trust my credit card number to Netscape," Mr Doligez told the Independent from Paris yesterday. Netscape Communications, whose flotation on the New York Stock Exchange raised more than $1bn, said "We have always said this would be theoretically possible." [end]

1 0

Predicament Again
by Duncan Frissell 17 Dec '03

17 Dec '03

Just because I love beating a dead horse... Back in June we had the argument over whether or not Phil Z should be worried because of the threat of prosecution hanging over him. And a prosecutor (?) by the name of Brian Davis as well as Tim and others thought that I was wrong to say that I would enjoy the process because of the opportunities for verbal abuse and point scoring that I would have were I under threat of prosecution in a case the government couldn't win. (Mostly pure 1st Amendment cases.) The reason that this is important is a big fat tactical fact. Defeat is a process that takes place in the mind of the enemy. It is well known to military types that it is possible for the weaker force to overcome the stronger force if the stronger force can be convinced that it has lost. People are rapidly becoming the stronger force in conflicts with governments because of technology, but governments are trying to use intimidation where they lack the capabilities. They are trying to psych us (and particularly the more credulous) out. We can fight this weapon by constant hammering at the fact of the government's weakness and its failure to intimidate us. Since most of what we do on the nets is speech and since speech enjoys a great deal of protection in the US, it is important to hit the opposition hard in speech cases where we have a strong hand. I certainly don't advocate abuse of prosecutors in other cases (taxes and drugs) where conviction is likely. But in pure speech cases, we should really heap on the derision. I happen to think that the prosecution of the award-winning Phil Zimmermann is one of those kinds of cases. Another similar case surfaced in Connecticut. The "Greenwich 5" had conspired so that nonsense syllables in their high school yearbook photo captions spelled out "Kill all the [African Americans]." (Note the cypherpunk significance of code use.) There was a bit of controversy of course and the young scholars volunteered to attend a "Civil Rights Boot Camp" run by the now neo-conservative CORE. Some weeks later, local and state prosecutors announced that they would not prosecute the 5 under CT's civil rights laws because of "lack of evidence." Calls to The Butcher of Waco for federal prosecution followed but have as yet had no results. This is the sort of case in which I would advocate that the "object of prosecutorial interest" be as aggressive and abusive as possible. The reason the prosecutors declined to prosecute was not lack of evidence but lack of law violation. The prosecutors were too cowardly to state that the Greenwich 5's action was perfectly legal. Since the public servants won't, it is up to those who are attacked to do so. The benefits of cutting through the exon in a case like this is that prosecutors are less likely to proceed in similar cases in the future and the public is educated as to the true state of the law. It is recreational as well. DCF "Few generals have ever been defeated because they had too many soldiers under their command."

1 0

Re: SSL challenge -- broken !
by goedel＠tezcat.com 17 Dec '03

17 Dec '03

>At 04:39 PM 8/16/95 -0500, you wrote: >>> I haven't seen any news stories about this on the wire >>> services. Someone would have to write a story about it first before >>> people would know... >> >>I've suggested this to a few reporters I know.. > >It's worth suggesting this _carefully_ so the spin's right. >For instance "Oh, no, Netscape lets Hackers suck all the money >out of your credit cards" would be bad :-) On the other hand, >"The US Government's Evil Plans to block encryption are limiting >Netscape's export products to an encryption system already broken >by a French university. This means you can send credit card numbers >safely to American web sites, but not to foreign ones - like the >airline or hotel reservations you were making for your vacation, >or those Irish handcrafts or bottle of Scotch you were ordering, >or that Hong Kong magazine you were subscribing to, or the CD from >that band in Budapest that had the great sound samples out there. >And when you were donating to that Amazon rainforest conservation >group, the NSA's arbitrary export rules may have just helped the >Colombian drug cartels rip off your credit card." Thats pretty much the spin on page B3 of the WSJ. I'll type it in when I get the chance. Dietrich J. Kappe | Red Planet http://www.redweb.com/ Red Planet, L.L.C.| "Chess Space" /chess 1-800-RED 0 WEB | "MS Access Products" /cobre Web Publishing | E-mail: RedPlanet(a)redweb.com

1 0

Re: Another SSL breakage...
by Damien.Doligez＠inria.fr 17 Dec '03

17 Dec '03

>From: aba(a)atlas.ex.ac.uk >on Tue, 15 Aug 1995 10:43:15 +0200 I recieved this from David Byers ><davby(a)ida.liu.se>: > >> Eureka! >> >> Encrypted Master Key: 7ef0961fa6 Then David beat me by about two hours. My program found the result at 12:23 +0200 on the same day. I was not at work (aug 15 is a holiday in France), so I saw it a few hours later, and I wrote my announcement yesterday. I will happily redirect all the journalists to David... -- Damien

1 0

Re: Out of state gambling
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 10:02 AM 8/17/95, Anonymous wrote: >Hello C-Punks: > >(nb This is posted anonymously because I had this idea the implementation >of which would be (probably) illegal. I'm not sure whether putting my It's being done. Many of us have talked about the implications of this. Writing about it is not against the law in the U.S., at this time. A little matter of the First Amendment, don't you know. See for example the Cypherpunks Web site archives, http://www.hks.net/cpunks/index.html, or grep/search for "gambling" in my Cyphernomicon FAQ (in my ftp directory at Netcom: ftp.netcom.com, /pub/tc/tcmay/CP-FAQ, and in a couple of Web sites, including http://www.swiss.ai.mit.edu/6095/articles/cyphernomicon/CP-FAQ) My point? Not a bad idea, but also not one you should have any fear of discussing publically (unless you believe certain conspiracy theories!). I've been talking and writing about the implications of this stuff since late 1987, and have not yet been "disappeared." I don't happen to like a lot of what's going on in Washington, but I doubt that Louis Freeh or Dorothy Denning are going to silence or threaten me! >name to the idea would be a good idea for the reason that I can't be >sure that I wouldn't be implicated under the overbroad "conspiracy" or >"Rico" powers which are oh so popular as a way of putting people away >for thought crimes. This message will in any case have appeared via I'm not a fan of RICO either, but we need to be careful not to impute to RICO things which just don't happen. So far as I know, no "thought crimes" have been prosecuted under RICO. Prosecutors--and I am not one, but I watch them all day on t.v.!--have certain procedures they have to follow. They just don't have the time, budget, and mandate to try to prosecute writers and speakers, especially when the words and speech are clearly protected under the First Amendment. The _potential_ prosecution of Phil Zimmermann--and I say "potential" because at the time I'm writing this, no indictment has been made--is not because Phil was writing inflammatory stuff, but is related to the circumstances surrounding the appearance of PGP 1.0 in foreign countries. These would be ITAR issues, not "thoughtcrime." Or at least this is what most people believe is the issue, as the Grand Jury has not said anything publically. (By the way, I'm not being critical of Anonymous here. I, too, have used the term "thoughtcrime," as shorthand for what I think are the implications of certain trends in the U.S. and elsewhere. Criminalizing "hate speech" fits the Orwellian definition, in my opinion. But we all have to be careful not to use this metaphor too broadly.) >a couple of foreign remailers on it's way. I am proud of the idea, but >I appreciate those of you who know who I am keeping quiet about it, as >I'm just being prudent, and extra cautious. > >The idea.....Out of state gambling, Internet style - lets give them a >taste of whats to come. As you note, the Internet Casino does this (they claim), becoming operational "soon." Also, various sports books are accessible in offshore locations, such as Costa Rica. Phone calls. And the idea of betting on events and outcomes is already extant. Lloyd's of London used to take such bets. But more germane to the Internet, there are several groups working on "idea futures." Robin Hanson, at Caltech, is working on this. And a Web page exists with various odds on different situations, such as "Windows '95 will be delayed 3 months" and "Strong crypto will be banned by April 1996." Try a Web search on "bet" and "gambling." I did one on "bet" and got a hit on "Proposition Wagering": http://www.netaxs.com/people/sportbet/prop.htm. (I couldn't get into it, so your mileage may vary.) >The aim in writing this short missive to cpunks is to encourage >someone who is more able legally to help this idea happen. It'll only happen when someone makes it happen. Thinking about it can also be useful, as the actual programmers may not have the same focus, but actual examples carry more weight. We saw betting schemes on the Extropians list, a couple of years ago. Fairly primitive, but an example. >Any comments on the practical and legal issues (such as exactly what >laws I'm violating) or on getting publicity for such a scheme? This >might be easier than we think, as the media [at least the WSJ] is well >aware of the bookie's superior accuracy & lower cost. First, don't worry too much about remaining anonymous. Discussing an idea, even building a system, is not the same as operating it. Folks publically discuss and build remailers, but operating them is another matter. (Yes, folks here also operate remailers....). Second, check out the "idea futures," "proposition wagering," and "betting" references. Third, build on what these folks are doing. Or do it differently, but only if your approach is superior. Good luck! --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Over 350 RSA/Perl 'Munitions T-shirts' Shipped
by Ferreira, Ben 296-4158 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Tue, 15 Aug 1995 14:17:36 -0600 From: Don Henson <dhenson(a)itsnet.com> To: libernet(a)Dartmouth.EDU Subject: Over 350 'Munitions T-shirts' Shipped We have thus far shipped over 350 of the RSA/Perl Munition T-shirts. Orders are still pouring in. Don't be left out. Order your's today. Now you can wear a TSHIRT that has been classified as a MUNITION by the US Goverment. That's right! The US International Traffic in Arms Regulations (ITAR) makes exporting cyrptographic materials illegal. ITAR further defines export as providing cryptographic information to a non-US/Canadian citizen even if you are inside the US at the time. Providing information is further defined as telling or showing information to a non-US/Canadian citizen. The Munitions Tshirt has a Perl implementation of the RSA algorithm (the one used by PGP) printed on the front along with a bar-code of the same algorithm. What all the above means is that if you wear the Munitions Tshirt where a non-US/Canadian citizen can see it, even if it is inside the US, you have just exported cryptographic material (which is already freely available outside the US) and have become a criminal in the eyes of the US Government. Now you too can become an international arms dealer for the price of a tshirt (US$15.95 - US$19.95, depending on size) and the guts to wear it. If you are a non-US/Canadian citizen, you can still own a Munitons Tshirt by ordering the tshirt from a source that is outside the US. The email response to a request for info (see next paragraph) includes full instructions for ordering the tshirt no matter where you live. For more information on how to own this classic example of civil disobedience, just send email to dhenson(a)itsnet.com with the subject of 'SHIRT'. (You don't have to be a US/Canadian citizen to request the info.) Or, if you have WWW access, just point your Web browser to: http://colossus.net/wepinsto/wshome.html By the way, 25% of the profits from the sale of the tshirt (in the US/Canada) goes to the PHIL ZIMMERMANN LEGAL DEFENSE FUND to help defend the author of PGP from harassment and possible prosecution by the Fedgoons. And if you get arrested for wearing the Munitions Tshirt, we'll refund your purchase price. :-) Get your Munitions Tshirt now. Who knows how long they'll stay in production! Don Henson, Managing Director (PGP Key ID = 0X03002DC9) West El Paso Information Network (WEPIN) Check out The WEPIN Store at URL: http://colossus.net/wepinsto/wshome.html -- ------------------------------------------------------ | A L B E R T A Advanced Computing | | R E S E A R C H & Engineering Dept. | | C O U N C I L | | | | Mailing Address J u l i a n B r o m w i c h | | 3rd Floor Junior Research Officer | | 6815 - 8th Street NE bromwich(a)skyler.arc.ab.ca | | Calgary, Alberta | | Canada T2E 7H7 | ------------------------------------------------------ ------------------------------------------------------ | R A D S S | | Technologies | | | | Mailing Address J u l i a n B r o m w i c h | | Alberta Pool Software Specialist | | Box 2700 JBromwich(a)awp.com | | 505 Second Street SW | | Calgary, Alberta Ph: (403) 290-5491 | | Canada T2P 2P5 Fax: (403) 290-5550 | ------------------------------------------------------

1 0

Message from a nobody...
by Censored Girls Anonymous 17 Dec '03

17 Dec '03

I'm kind of a nobody..... I can't write elaborate code. I can't even crack keys, unless it's plug & play cracking. But I do know SOMETHING important was done here. And once it's been done, it only gets easier each time. Congratulations to all of you! Love Always, Carol Anne Member Internet Society - Certified BETSI Programmer - WWW Page Creation ------------------------------------------------------------------------- Carol Anne Braddock <--now running linux 1.0.9 for your pleasure carolann(a)censored.org __ __ ____ ___ ___ ____ carolab(a)primenet.com /__)/__) / / / / /_ /\ / /_ / carolb(a)spring.com / / \ / / / / /__ / \/ /___ / ------------------------------------------------------------------------- A great place to start My Cyber Doc...

1 0

Breaking RC4-40 for less
by fc＠all.net 17 Dec '03

17 Dec '03

Since messages sent with netscape are fairly standard for the first so many bytes, why not make a 2^30 element table, store it on a few gigabytes of disk space, use a hash table on the message, and find the keys to one in every 1,000 messages about 1 time per second. If this code is being used to send millions of credit transactions per day, we should be able decode thousands of credit card numbers per day for a one-time cost of about $5,00. The $10,000 estimate of the cost of computing time is far too high for a production-based attack on the netscape codes. -- -> See: Info-Sec Heaven at URL http://all.net Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

1 0

Re: Netsacpe's Offical Response
by Rev. Mark Grant 17 Dec '03

17 Dec '03

> In this case he had to use roughly > $10,000 worth of computing power (ballpark figure for having access to > 120 workstations and a few parallel supecomputers for 8 days) to break > a single message. Hmm, I don't know about anyone else around here, but my workstation is idle 99% of the time. I could almost certainly get access to all the spare CPU cycles on 120 workstations for free, and I suspect that a lot of people (particularly hackers) could do so as well. There's no need to spend $ 10,000 on renting them. Mark

1 0