December 2003 - cypherpunks-legacy

Re: More on Netscape
by koontz＠MasPar.COM 17 Dec '03

17 Dec '03

>It says that the commerce server supports (among others) DES and DES3 >(same as 3DES?). They list the key sizes as 64 and 192 bits >respectively. My question is, isn't DES 56 bits? (with an 8 bit salt >that would be 64 I guess), but isn't DES3 112 bits, not 192? DES keys are specified as 64 bits, of which 8 bits provide odd parity. The 192 bits would specify three independent keys (not triple DES)

2 1

Re: SSL challenge -- broken !
by ab411＠detroit.freenet.org 17 Dec '03

17 Dec '03

John Pettitt <jpp(a)software.net> writes: >On Wed, 16 Aug 1995, Damien Doligez wrote: >> The exportable SSL protocol is supposed to be weak enough to be >> easily broken by governments, yet strong enough to resist the attempts >> of amateurs. > >Exactly. > >> It fails on the second count. Don't trust your credit >> card number to this protocol. > >Huh? So you run on 120 workstations worth how much? to steal a credit >card number worth how much? Get real - there are hundreds of ways >to get credit card numbers that cost less. ... SSL can of course be used to protect information other than credit card #s. It is supposed to be strong enough to resist the attempts of amateurs, yet it was broken not by a government, not by a three letter agency, not by a major corporation, but by a grad student with a lot of spare cycles. In other words, it was broken by an amateur. The real issue is not cc#s, the real issue is: does it do what it was designed to do (foil amateur attempts), and the answer is: no, not so long as it is export-restricted to only 40 secret bits of key. -- David R. Conrad, ab411(a)detroit.freenet.org, http://www.grfn.org/~conrad Finger conrad(a)grfn.org for PGP 2.6 public key; it's also on my home page Key fingerprint = 33 12 BC 77 48 81 99 A5 D8 9C 43 16 3C 37 0B 50 Jerry Garcia, August 1, 1942 - August 9, 1995. Requiescat in pace.

1 0

I need an exportable crypto algorithm.
by Darrell Perko 17 Dec '03

17 Dec '03

Greetings; I realize that bad crypto is offensive to some here but I am in desperate need of an exportable, public-domain, general-purpose crypto algorithm. Or at least the rules for creating such. Sorry to bother y'all with this, but I am in dire straights. Thanks, Darrell Perko dperko(a)efn.org

2 1

Re: WANTED: anonymous remailer source code
by Alex de Joode 17 Dec '03

17 Dec '03

Quazi sez: : I'm interested in porting some remailer code to work on NT (most : likely using NTMail as the smtp service). I'd like to be sure I'm : starting my port from the most recent revisions, and the sources at : the archive at berkeley seem a bit dated. Are they the latest sources? : Are there more recent sources available somewhere? Try ftp.hacktic.nl:/pub/remailer -- Alex de Joode Fear Uncertainty Confusion and Kaos, Inc.

1 0

Another SSL breakage...
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- All hell seems to have broken loose whilst I was lazing on the beach yesterday. SSL breakings, big name newspaper newsreports (of varying degrees of accuracy), and much ITAR bashing (yay!) or perhaps that should be nooooh! 'cos I might be doing myself out of work as a UK crypto hacker (as John Hemming said in the article Robert Hettinga forwarded) if we loose the fun advantage of being in the free world, and not having to follow the ITAR nonsense. Anyway, congratulations Damien! As Hal said, another group was working on the SSL challenge (albiet just for software testing purposes). Here's the story.... on Tue, 15 Aug 1995 10:43:15 +0200 I recieved this from David Byers <davby(a)ida.liu.se>: > Eureka! > > Encrypted Master Key: 7ef0961fa6 > > [...] So who was first? David hit it Tue 10:43 GMT+2. Doesn't matter, the more the merrier, and the better to demonstrate the silly ITAR export restrictions. This was a trial run at breaking it which two people had done just to check if their respective software was working correctly. It appears that it was :-). This testing was some of the reason for the slowness in getting the group effort started, we were very keen to ensure it really would work, and that the software was working perfectly. Disappointment with the RC4 bruting demonstrated the importance of checking first. On with the story, Davids eureka arrived Tuesday, I tinkered with it some, but was interpreting it wrongly and left it for that day, then I was away yesterday (at the beach with wife and kids, nice weather over here), and figured out how to apply the key this morning (with a bit of prompting from Hal as to what I was doing wrong), just after reading Damien's announce on cpunks, where he independently bruted it on a farm of workstations. Here's the output, with the "Mr Cosmic Kumquat" from "SSL Trusters Inc": > PPOST /order2.cgi HTTP/1.0Referer: https://order.netscape.com/order2.cgi > User-Agent: Mozilla/1.1N (Macintosh; I; PPC) > Accept: */* > Accept: image/gif > Accept: image/x-xbitmap > Accept: image/jpeg > Content-type: application/x-www-form-urlencoded > Content-length: 472 > > source-form=order2-cust.html&order_number=31770&prod_80-01020-00_Mac=1&carrier_code=UM&ship_first=Cosmic&ship_last=Kumquat&ship_org=SSL+Trusters+Inc.&ship_addr1=1234+Squeamish+Ossifrage+Road&ship_addr2=&ship_city=Anywhere&ship_state=NY&ship_zip=12345&ship_country=USA&ship_phone=&ship_fax=&ship_email=&bill_first=&bill_last=&bill_org=&bill_addr1=&bill_addr2=&bill_city=&bill_state=&bill_zip=&bill_country=USA&bill_phone=&bill_fax=&bill_email=&submit=+Submit+Customer+Data+ (I won't bother formating it more cleanly as Damien has already done the honors). I think a group effort ought to be done now that we are confident of the software, just to see how darn fast we (cypherpunks as a group) can knock off SSL keys. (This one was done by 2 people for testing purposes, and independently by Damien (who we didn't know was working on it)). I'd really like to work up to a really meanly few hours breakage, as it looks that much more impresive. The next media release ought to be of a steady offer, of the form, cpunks break keys in x hours, where x is a very small number. And not just break one key, but will break lots of keys, as required, until something is done about it (ITAR) :-) Eric Young is currently away on holiday, but I have his machine stats from earlier email, where he explained the hardware he was testing on. Eric swept 8000 - FFFF, and David 0000 - 7ef0 (where he hit the key) Machine stats for this bruting: 1 x 16k processor MasPar MP-1 - 1.5M keys/sec 4 CPUs of R4400 200mhz - 24000 keys/sec 4 CPUs of sparc 60mhz - 17500 keys/sec 2 CPUs of sparc 50mhz - 14800 keys/sec 1 CPU of Pentium 75mhz - 10200 keys/sec 1 CPU of Alpha - 10000 keys/sec 2 CPUs of 88100 - 8000 keys/sec 1 CPU of 88000 - 3500 keys/sec 1 CPU of R3000 36mhz - 3800 keys/sec 49 CPUs of 486DX 50mhz - 3780 per src The workstations total: - 424,320 keys/sec, and the Maspar 1.5M keys/sec on it's own. The 0000 - 8000 sweep was finished Aug 11 (he might have finished a day or two earlier, that's when he replied to my question as to how he was getting on. He left for his holiday after that email. The MasPar sweepings were going fast, swept 0000 - 795d (this was sometime before the 11th Aug) but someone else wanted the machine, so a pause ... and then (presumably Tues morning) 795d - 7ef0 and bang he hit it. We were getting worried about the possibility of software failure by then as we'd already swept 8000 - FFFF and 0000 - 795D accounting for 97.4% of the key space. It was hiding away in the last bit of unswept keyspace. Luck of the draw... A few quick calculations: The maspar alone could do the entire keyspace in 8 1/2 days, or an expected average time of ~100 hours. I believe I'm right that there would be lots of organisations which would sell you idle maspar hours for a lot less than $100 / hr. Heck you could do it with PC's, if they (WSJ article) think it's worth $10k all I can say is "give me the $10k", and I'll do it and make a handsome profit. The workstation farm, at 424k keys/sec could do the job in 30 days, or 15 days average. The workstation farm was only used to sweep half the key space, and was used overnight (12 hours) and weekends (61 hours) only as people were using the machines during the day. Could it have been done with out anyone knowing? Hell, yes - it was in fact, no announce was made as it was just testing etc. Adam - -- HAVE *YOU* EXPORTED RSA TODAY? --> http://dcs.ex.ac.uk/~aba/rsa/ - --rsa--------------------------8<------------------------------- #!/bin/perl -s-- -export-a-crypto-system-sig -RSA-3-lines-PERL $m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2%Sa 2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*',$_)while read(STDIN,$m,($w=2*$d-1+length($n)&~1)/2) - -------------------------------8<------------------------------- TRY: rsa -k=3 -n=7537d365 < msg | rsa -d -k=4e243e33 -n=7537d365 -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQCVAwUBMDNbnSnIuJ1VakpnAQHe9AP8DJBhZ8LyRNx7PO1GY076Cap+xzdS0/ys WE/tdm0GBfjqxvjtar85mmc1hZVPCn1m5Swsflk2ZpieLbwUzHz+g1ciW3IiZu1Y 8Qc2HJxWRrez3J5CeiMHgMJl6Bj6vF5XAWLW0v6NpujbOR9XuIjsKnH3jKvkhLF5 z0u7Oui0AX0= =nkmn -----END PGP SIGNATURE-----

5 4

RC40 and what we still need to do
by Robert A. Hayden 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have been watching the backlash of the cracking of RC40 and am quite impressed with the fact that it is being used as a positive reason for repealing ITAR. I expected the media to jump on the "hacker" bandwagon and denounce the efforts. However, I think there is still value in writing the software that will allow cooperation amoung hundreds or thousands of people. That way, we could harness the space CPU of machines all over the globe and make the cracking of this kind of stuff routine. So instead of taking 8 days, it takes only a day or so, further eliminating the idea that it "takes too long to be worthwhile". Maybe there would even be value in going at a 128-bit key (granted, it would take a year). I'd anticipate with proper advertising, easy-to-use software, and little programming knowledge require, we could easily harness 10,000+ machines and a few dozen parallel machines. I know we have a 99.9% idle MasPAR I can contribute to the effort, which should be able to do 1million+ keys/sec. It's just dying to have a purpose.... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: PGP Signed with PineSign 2.2 iQCVAwUBMDNwmDokqlyVGmCFAQEzTQQAtkDhi0XD1L1PGJgSYA0XcxMXOIszjtB0 sQcHdSqeVHBpIn7K0/F4JE0tiIgXFhmaKsU8FaIaf/5sbDpRj/cTZXnvE/evt4G0 GKploXjcqXQ/dBpSWakCzsKLJvqvhKEyZyAnF/5VHgSI5WChMKYm68qiuDNyN05Q He6bvbZGbBs= =oPni -----END PGP SIGNATURE----- ____ Robert A. Hayden <=> hayden(a)krypton.mankato.msus.edu \ /__ Finger for Geek Code Info <=> Finger for PGP Public Key \/ / -=-=-=-=-=- -=-=-=-=-=- \/ http://krypton.mankato.msus.edu/~hayden/Welcome.html -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GED/J d-- s:++>: a-- C++(++++) ULU++ P+ L++ E---- W+(-) N++++ o+ K+++ w--- O- M+ V-- PS++>$ PE++>$ Y++ PGP++ t- 5+++ X++ R+++>$ tv+ b+ DI+++ D+++ G+++++ e++ h r-- y++** ------END GEEK CODE BLOCK------

2 1

Re: Cost to Crack Keys
by Damien.Doligez＠inria.fr 17 Dec '03

17 Dec '03

This is how you can crack SSL RC4-40 sessions for $1000 each: Go to your bank and get a $250,000 loan over 10 years. Assuming a 10% interest rate, you will have to pay about $40,000 per year. Use the $250,000 to buy 50 low-cost high-speed pentium PCs. Don't bother with a screen, keyboard or mouse. Get the minimum of memory. Get a huge discount (you're a really good client). Pay $10,000 for the electricity bill, the real-estate rent, etc. The machines will crack 50 keys per year on average. They cost you $50,000 per year. That's $1,000 per key. Does anyone see any hole in the above plan ? It seems to me that Netscape's estimate is one order of magnitude too high. -- Damien

2 1

More on Netscape
by Sean A. Walberg 17 Dec '03

17 Dec '03

I guess most everybody has seen the response that Netscape put on their page, but did people check out the "for more info" link (http://home.netscape.com/newsref/std/key_security.html) It says that the commerce server supports (among others) DES and DES3 (same as 3DES?). They list the key sizes as 64 and 192 bits respectively. My question is, isn't DES 56 bits? (with an 8 bit salt that would be 64 I guess), but isn't DES3 112 bits, not 192? Just wondering... Sean o-------------------o----------------------o-----------------------o | Sean Walberg, | Tech Support | Pas_al, _obol, BASI_, | | sean(a)escape.ca | escape communication | PostS_ript, T_L... | | Mail for PGP key | 925-4290 | C fills all the holes | o----------------] http://www.escape.ca/~sean [--------------------o

2 1

Re: SSL challenge -- broken !
by Pierre Uszynski 17 Dec '03

17 Dec '03

Says Joe Buck: > > >Should some bad person get hold of your card number and misuse > > >it, you're not out any money: > > > > I'm not so sure....Checked the fees/interest lately? > > "There ain't no such thing as a free credit card theft." > > Yes, it's true that this contributes to high interest rates (though > defaults cost more than fraud). Certainly not only that. In fact you pay directly for weak credit card security through taxes used to legislate, police, try, and jail fraudsters. Add to that the cost to society of keeping these people in jail instead of more productive occupations. Add the time wasted straightening out bogus transactions. Add the cost of delaying purchases and action because of the (maybe irrational) fear that no secure payment system is available. The argument that fraud existed before credit cards is only a technically correct statement. It does not bear. The point is, credit card transactions could be much more secure, at sometimes trivial cost, making much fraud disappear. Unfortunately, in this case, insecure credit cards are not an obstacle to banks making money, so why should they care? Credit card fraud does not prevent politicians from being re-elected, so why should they care? Same would apply to car manufacturers: easily stolen cars do not prevent them from making money, so why should they care? When 'bad persons' misuse credit cards, the cost to us is very real, just well hidden by all involved. Pierre. pierre(a)shell.portal.com

1 0

I need exportable crypto revisited.
by Darrell Perko 17 Dec '03

17 Dec '03

Greetings; Thank you all for your amazingly quick responses! However, I should have noted in my original message that this encryption is to meet a contractual point for a commercial product to be delivered soon. The product can have one and one only version to be boxed and shipped and will be sold internationally. The encryption portion will be dynamically linked, so real encryption will be available on the net just not in the box. Thanks, Darrell Perko dperko(a)efn.org

4 3