December 2003 - cypherpunks-legacy

Re: Purple Boxes
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:30 PM 8/15/95 -0400, Dave Emery wrote: > I reiterate my suggestion of a few months ago that >one could quite easily adapt the firmware on one of the new simultanious >data and digital voice on the same phone line modems to incorperate >encryption, and quite possibly encryption/key exhange interoperable >with some mode of PGPphone. Doing this would relieve one of the >need to develop or manufacture any hardware at all - all that would >be required to have a portable "bump in the cord" encrypter widely >available for a low price would be creating a new version of the >downloadable flash ROM image that did encryption and PGPphone >key exchange. Most modems I've seen only have one set of audio interfaces, and a bump-in-the-cord phone needs two (one for the voice side, one for the modem line side.) (Having two jacks doesn't count.) So you'd need at least two modems, one straight and one re-educated, and you'd probably need lots more flash ROM than the average modem has. On the other hand, laptops are increasingly getting multimedia capabilities like built-in sound cards, and if there's a microphone jack you're in business (uh, well, for $3K or so) Or a cheaper laptop with two PCMCIA modems, if you can re-educate one, which also lets you move the non-audio parts of your secure phone program into the PC. Of course, if you want long conversations from the airport, you'll still need to find a payphone within 4-6 feet of an electric socket and not located under a MegaMuzak speaker, but that's easier than trying to balance a TI Silent 700 under similar conditions :-) #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- "The fat man rocks out Hinges fall off Heaven's door "Come on in," says Bill" Wavy Gravy's haiku for Jerry

2 1

Re: Phone call for Mr. Doligez, was Re: SSL challenge -- broken !
by Steven Champeon - Imonics Development 17 Dec '03

17 Dec '03

| Subject: Re: Phone call for Mr. Doligez, was Re: SSL challenge -- broken ! | From: Peter Wayner <pcw(a)access.digex.net> | | I don't think that there is any serious worry for Netscape. Their | security is fine-- it's just crippled by the US Government. They | could probably start distributing binary versions of their software | that used full 128 bit keys in several hours. It's just that the | Government gets pissed off about these things. The netscape client already has these capabilities built in. During the negotiation stage, the client talks to the server, which announces which strength to use. For exported versions of both the client and the server they are limited to 40 bit RC4. For US versions, all available strengths are supported with an option to enable them. Pull up Netscape, and for the URL type: "about:". It will tell you which algorithms are used, but not their key bit length. When you configure their Commerce server, you have the option to enable any of the supported bit lengths and algorithms, including RC2 and RC4, IDEA, 40 -> 128 bits, 64 -> 192 for DES. Netscape's server, since it must service foreign requests, probably doesn't even waste its time asking for >40 bit, since that would add to the time it takes to negotiate a common scheme. If anyone has any insight into this, please fill me in. I just wanted to clarify a few things. Steve -- Steve Champeon Technical Lead, Imonics Web Services

1 0

Re: Purple Boxes
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199508152206.SAA23244(a)acmex.gatech.edu>, gt7508b(a)prism.gatech.edu (PHrEaK!) wrote: >Does anyone know of sources for des chips??? >Are there any public key chips out there??? >Has anyone ever tried putting PGP on a chip??? RSA??? (Are these too >slow for realistic real time hardware voice/data encryption??) >I know a little about digital electronics (I am a computer engineering >student) and I would love to get some data books and see if I could >come up with a secure "encryption box" that people could build. I don't know off the top of my head who makes DES and RSA chips. I am sure there are many manufactors of DES chips. Try TI, National, and Motorola. I belive that Schneier has a list of RSA chip makers. For the DSP part of a "bump in the cord" encrytion box, you want to get the "TI TMS320 Family Development Support" booklet by calling (800) 477-8924. You also want to look at Motorola's 68000 CPU, DSP, and controller on one chip. I can't recall the exact product number. Just call Motorola and ask for it. Have fun, - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMDE5iSoZzwIn1bdtAQETkgGAjfPRJ09tGSauoSSWuaQiBqeVjI0sWXWH vJ5Ft3efVPBaZTEMXh0Q4MOkH23ot3hS =FJ9y -----END PGP SIGNATURE-----

5 5

Re: SSL challenge -- broken !
by Alex de Joode 17 Dec '03

17 Dec '03

Hal sez: [..] : I am a little alarmed by the suggestion that this news could have some : marked impact on the Netscape stock price. From our perspective this was : certainly an unsurprising result (not to take anything away from Damien : and others who worked on it). It is a useful reminder that the things we : work on here can have profound consequences. Just to bad Ecash and the ON-Line Stock/Options Broker [TM] aren't available, would be a good time to buy some put options on Netscape Communications. -- Alex de Joode Fear Uncertainty and Doubt, Inc.

1 0

Re: SSL challenge -- broken !
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 1:45 PM 8/16/95, Hal wrote: >I am a little alarmed by the suggestion that this news could have some >marked impact on the Netscape stock price. My apologies for causing alarm. I was merely making a too-subtle joke about hysteria in the press and the capital markets for Netscape, and its inevitable backlash. Madness of crowds and all that... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Question: DSA status and export requirements?
by doug＠openmind.com 17 Dec '03

17 Dec '03

Does anyone know if there have been any major developments in the DSA patent issue in the past year? I've read that some large companies have used DSA in products without paying royalties to Bizdos, but they also have separate licensing deals for RSA itself. On another note, I would much appreciate advice on whether a product which does only signature verification using, say, DSA and SHA, would require ITAR export approval? I've read that the NSA has specifically stated that they are not concerned with products that cannot be easily used for privacy -- so would such a product (which can verify but not generate signatures) even be required to apply for an export license? Doug Cutrell doug(a)OpenMind.com ________________________________________________ fuck the Exxon Communications Decency ammendment

1 0

Re: Phone call for Mr. Doligez, was Re: SSL challenge -- broken !
by Peter Wayner 17 Dec '03

17 Dec '03

I don't think that there is any serious worry for Netscape. Their security is fine-- it's just crippled by the US Government. They could probably start distributing binary versions of their software that used full 128 bit keys in several hours. It's just that the Government gets pissed off about these things. In general, it just adds more flames to the fire started by the letter written by Microsoft, IBM and Lotus. Their point is bolstered by this easy attack. -Peter

3 2

Erroneous HPCwire phone #
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Whoops... Hope this helps! Cheers, Bob Hettinga --- begin forwarded text Date: Sat, 12 Aug 95 04:22:08 PST From: "Alan Beck" <alan(a)tgc.com> X-Minuet-Version: Minuet1.0_Beta_4 Reply-To: <alan(a)newsmaster.tgc.com> X-Popmail-Charset: English To: rah(a)shipwright.com Subject: Erroneous HPCwire phone # Robert, I can't reach my managing editor, who's a cypherpunk subscriber, so I'm emailing you: HPCwire's telephone number was posted incorrectly. Our real number is: 619-625-0070. I'd appreciate it if you could revise the post. Thanks much! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Alan Beck HPCwire Associate Editor 8445 Camino Santa Fe HPCwire Suite 204 alan(a)hpcwire.tgc.com San Diego, Calif. 92121 Voice: 619/625-0070 Fax: 619/625-0088 For a free trial subscription, email: <trial(a)hpcwire.tgc.com> ~~ Diagonally parked in a parallel universe. ~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: SSL challenge -- broken !
by Joe Buck 17 Dec '03

17 Dec '03

Congratulations on demonstrating the effort required to break SSL with a 40-bit key. It seems clear demonstrated that this is not adequate to store, say, company-confidential information for communication over insecure networks, since it seems the average grad student at a large university could get access to similar computing power that you used (spare cycles on a hundred workstations or more). However, I disagree with your conclusion: > Many people have access to the amount of computing power that I used. > The exportable SSL protocol is supposed to be weak enough to be > easily broken by governments, yet strong enough to resist the attempts > of amateurs. It fails on the second count. Don't trust your credit > card number to this protocol. Your credit card number, expiration date, etc, are continually being revealed to minimum-wage clerks all the time, unless you never use the card. A chain is only as strong as its weakest link; it makes no sense to buy an expensive lock when your door has a big enough opening to climb through. Should some bad person get hold of your card number and misuse it, you're not out any money: you just tell the card company "I didn't buy that". Since there's so much tracing in the system, if you buy a physical something with a stolen credit card number it can usually be traced to you (who'd they ship the package to?). It's not clear to me that *any* encryption is really essential if the only purpose is to protect credit card #'s from snoopers. There's plenty of stuff that *does* need protection, but I'm not sure credit card #'s head the list. Q: Of the 20,000 credit card #'s stolen from Netcom's computer, how many were used to buy things? Answer: not sure, but expect the answer is "zero".

2 1

Re: SSL challenge -- broken !
by goedel＠tezcat.com 17 Dec '03

17 Dec '03

Perry E. Metzger <perry(a)piermont.com> writes: >Joe Buck writes: >> However, I disagree with your conclusion: >> >> > Don't trust your credit card number to this protocol. >> >> Your credit card number, expiration date, etc, are continually being >> revealed to minimum-wage clerks all the time, unless you never use the >> card. > >On the other hand, those clerks can be traced down in most cases and >have fairly limited numbers of cards they get. It might be very >profitable to run a vacuum cleaner operation on the net slurping down >credit card number or other confidential information and then selling >it in bulk to people who could exploit it. Most credit card companies ship their registration information off shore to low tech developing countries. The idea is that the people entering the information are unlikely to be able to exploit the information they are exposed to. Capturing a set of credit card tapes is certainly profitable, as would be capturing large volumes of numbers, as you suggest. Now, are those West African credit fraud rings dialing up DEC, SUN, and SGI? :-) DJK P.S. There could be an article in tomorrows WSJ about the SSL Challenge. The technical details and facts will surely be mangled. :-(

1 0