December 2003 - cypherpunks-legacy

Re: Weekly MixMaster list
by Duncan Frissell 17 Dec '03

17 Dec '03

At , Daniel Miskell wrote: > >What is the MixMaster list, and what is it for? >Apologies on my newbie status. > >Munster Mixmaster is a modern remailer protocol which breaks packets up into standard sizes and shuffles them among active remailers to make traffic analysis impossible. The list lists active mixmaster remailers. DCF

1 0

Using deterministic programs to select private RSA keys.
by norm＠netcom.com 17 Dec '03

17 Dec '03

Much has been said recently here about how to produce truly random primes. Suppose you are selecting a secret key to be used by a bank to sign its documents. Short of examining the code very closely, or writing your own, you are vulnerable to a program that selects primes from a vastly reduced set. If this program behavior is known then discovering the secret primes may be vastly easier. Writing your own code, or examining other's code, is error-prone and requires trusting someone who knows more math than most programmers. Here is an alternative that requires only simple high school math to understand. I define a simple protocol and commission several independent programmers to implement it. The protocol is to accept a sequence of key strokes for printable ASCII characters. Whitespace is ignored except that two successive newlines terminate the input. MD5 is applied to the input stream and the result is used to start the search for the prime. The required entropy must come from the keyboard. Each of these programs are used with the same input and the yields are compared. It is even better if the programs are bought on the open market. The more divers the interests of the programmers, the less likely there can be an undetected conspiracy. The naive objection to this is that the keyboard input will be less than perfectly random. That is certainly true. The input need not be random--it is only necessary that there be sufficient entropy. There is a real hazard that the user does not understand the issues and will merely type in the first paragraph of the Gettysburg address, having heard that there is about one bit of entropy per character in the English language. If several bank officers trust each other but not the other's grasp of entropy they can each enter text since the accumulated entropy only increases. (They need not hide the text from each other.) MD5 only produces 128 bits. It might be wise to require more than 128 bits of entropy. The scheme as described can only ever produce 2^128 distinct primes. That is small compared with the number of 1K primes. But having to test 2^128 primes seems hard enough. Are there other attacks? You might argue that trusting a program to choose secret keys is no worse than trusting your operational signing software. True. You can confine that operational software and compare the yields of programs by different programmers. (The software of the Space Shuttle uses such redundancy.) The confinement program must supply any required random salt or padding.

1 0

Security Spectra
by P.J. Ponder 17 Dec '03

17 Dec '03

In your recent post to the cypherpunks mailing list you proposed a taxonomy of security weaknesses and vulnerabilities, adding that these may be perhaps categorized and ranked. Standard practice in the computer and communications security business has for many years been based on the idea of risk analysis. More or less systemmatic approaches to risk analysis have been put forward over the years. One example is FIPS Pub 65 which attempted to systematize risk analysis and ideally lead one to a quantified level of risk at the end. The method was too burdensome to be effective, and most people today use a more qualitative approach. The whole idea of categorizing or ranking holes and vulnerabilities ab intitio, outside of their contextual application to a real system is not very helpful. Systems vary so widely in their criticalities, sensitivities, costs, etc., that each of your pre-defined categorized weaknesses would have to be rejudged - in the context of the system being analyzed - to determine how, and to what extent it could effect the system. For example, a system with a weakness in logging events would be a disaster in a busy commercial transactional system that may need logs to recover from errors or to trace mischievious actions. Another system, however, may find the lack of effective logging an inconvenience at worst (maybe even a plus, if the Pennsylvania cops are at the door). The standard approach as I understand it is to analyze the system against all the known vulnerabilities and attempt to measure (maybe only qualitatively) the risks associated with the vulnerabilities. I think analyzing holes by themselves, outside of any context, is a good academic exercise, and may lead to useful knowledge that people analyzing real systems can use, but it is not an advantage to attempt to grade them in the abstract. -- PJ you'll probably get lots more useful advice from others more articulate than I, but I hadn't posted to the list in awhile and am curious about how all these bounce messages everyone is talking about. Are there lots others besides the guy with 1000 messages in his mailbox? I guesss I'll see.....

1 0

PGP article in American Survival Guide
by Brad Dolan 17 Dec '03

17 Dec '03

There's a brief intro article re. PGP in the issue of *American Survival Guide* which is currently on the stands. ASG has a sort of cammo-right orientation, FWIW. bd

1 0

Re: Bug Bounty [noise]
by Alan Olsen 17 Dec '03

17 Dec '03

At 05:47 PM 10/16/95 -0700, you wrote: >Alan Olsen wrote: >> >> Something I noticed about the Netscape Bug Bounty that seems to not have >> been mentioned here... >> >> "Linux users need not apply." > > If a linux user finds a security hole that is reproducible in >any supported version then they are still eligible for the prizes. >If a linux user finds a security hole that only applies to linux, >I don't know what the company would do, but I would push for them >being payed as well. If you look at what versions are eligible for rewards of any sort, Linux is not on the list. Was it an oversight or are they only eligible for the security cash? | Visualize a world without lawyers! | alano(a)teleport.com | |"The moral PGP Diffie taught Zimmerman unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.| | http://www.teleport.com/~alano | <fnord> |

1 0

Re: Netscape rewards are an insult
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

> The idea that Netscape (like Microsoft) thinks they can get free > testing services from all over the net by real experts just by offerring > a tee shirt is down right offensive. > > I have a better idea. How about an open market in break-in > software. We crack Netscape and offer the crack code to the highest > bidder. Bids start at US$25K per hole. For the insult, Netscape has to > outbid the competition by a factor of 2 to get the details of the hole. > Here's how it works: [snip of judging, verification, bidding ...] Hmmm. I'm glad that some people still have a bit of a sense of haha about these things. It's only computer code, right?? Right?? ;-( Your idea about a bidding war for this type of code is _interesting_ but not something I'd really like to see develop. Good security and good code are possible without this. Good people are out there. The *best* people might be in academia or they might be in retirement or even on a sabbatical. They might even be in other fields, or other countries, or as Netscape discovered to its chagrin, they might be Berkeley students. The question is how to secure co-operation when they aren't motivated by ego, need, or greed. How do you attract the ones who simply know who they are, and WHAT they can do, and simply won't put up with twaddle?? And frankly offering someone a cup, or a shirt or even offering someone a $1,000 isn't the way to bring them on side. I can't even get my lineprinter serviced on Christmas Eve for $1,000. There's always a fine line between an insult and an offer. > I have an even better idea. How about if Netscape gets some > competent programmers with real security expertise, adds in some good > change controls, a serious internal testing program, quality control ala > ISO-9000, internal IT auditors, external IT auditors, training and > education for their employees, and everything else it takes to be in the > software business in a serious way. This would be a *basic* start. Whether or not ISO-9000 is the way to go, or whether it should be TQM, or something more modern is moot. In addition to some of the above, I might suggest parallel development units. Two separate program teams kept completely apart from each other, each duplicating the other's work with the eventual goal of utilizing the first reconciliation sets of production code as "learning experience", and then, as part of a planned design goal re-evaluation and refinement, disposing of the reconciliation set before "Fresh-Start"(TM) implementation. (This might necessarily lead to attendant presentation of individual outplacement opportunities to select persons, as a team regrouping component.) Essentially a real-life simulation of the anticipated code-writing process. Each group could develop its own unique vision and approach within the context of the design goal, and should have demonstrated a willingness to utilize challenge and justification modelling. The groups themselves might be dynamically balanced and re-balanced vis-a-vis personality and code-writing styles. A positive creative environment should be provided, possibly in an incubator-type setting, which meets creative, psycho-social, and psycho-physical requirements. Essentially, the right balance between spa and boot-camp, a realized vision. An evolutionary development of Scott Adams' "Vision: Empowered Employees Working Toward A Common Plan". A plan that centers around People. A New Plan that views employees as assets to be developed, nurtured, and cared for rather than as expenses to be eliminated or reduced. A New Vision emphasizing Quality by remedying the marginalization of the companies prime assets -- the employees. An applied corrective ... a focussed deemphasis on productivity in anorectic organizations. I might, humbly, suggest as a title: A New Vision, A New Plan: Applied Complexity Theory (A.C.T.) in Action. It truly is a long list ... as part of an "ACT in Action Plan"(TM), Netscape should source long-range planners who can meet and exceed day-to-day corporate expectations. > As an alternative, we could help them contact the shareholders > for a lawsuit. After all, they are a public company now and are responsible > to the shareholders for the value of their stock. If it goes down because > they aren't doing an adequate job of software quality control, the officers > may be personally liable. I think whether or not it goes down, is not relevant. If there has been proper material event disclosure, then I doubt that there are actionable grounds. If there has been active acts of misrepresentation, then that's simple fraud. Fiduciary obligations can be very complex without good counsel. Clearly by not having official announcements, it might lead a reasonable man to believe that there might be trading improprieties through-out the high-tech sector, among so-called "friends and family" or alternatively, that Netscape's strategic misrepresentation program might be operative. Who know's?? One thing is certain though, disclosure obligations attach to all public companies. Sun, Microsoft, Netscape, AT&T, Viacom ... Maybe I should email postmaster?? Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

Empennage Seminar -- Sun Microsystems
by stevenw＠iglou.com 17 Dec '03

17 Dec '03

Seen on ba.seminars and posted here: Mathematical Sciences Research Institute Empennage Seminar An Introduction to Cryptopolitics Whitfield Diffie Sun Microsystems Mountain View, California Some years ago, Andy Gleason observed that during World War II, the physicists had discovered that what they did had an impact on the real world and that now it was the mathematicians turn. The talk will explore why seemingly arcane technology has become a political football. We will examine the significance of communications privacy in human affairs, how communications intelligence functions, and how cryptography affects that functioning. In the process we will look at a variety of proposals for controlling cryptography and the possible impact of those propsals on intelligence, law enforcement, commerce, and the personal life. 2 PM, Tuesday October 24, 1995, MSRI Lecture Hall Next Month: Scott Mitchell, Sandia National Laboratories, on hexahedralization ##################################################################### About Empennage As part of our effort to build bridges between Mathematics and the larger world, the Mathematical Sciences Research Institute is sponsoring a seminar where mathematicians can meet adventurers on the technological frontier. The Empennage Seminar will meet in the MSRI lecture hall Tuesday afternoons from 2 to 3. The seminar is intended to bring together not only scientists from the Bay Area involved directly with mathematical computing, but also people involved in envisioning and implementing new technologies, people concerned with the social and political ramifications of the development of information technology, and people working on problems, the formal nature of which brings them close to mathematics. The seminar is aimed at breaking down the walls which in this century have isolated mathematics from intellectual life outside of its own tradition. While the Empennage seminar is still in its infancy, we have begun to attract an audience beyond MSRI, including scientists from other institutions and disciplines, both within and without academe. If you have any recommendations for possible speakers, please let me know. Also, anyone interested in attending should contact me: Joe Christy, joe(a)msri.org, (510)643-6069. About MSRI The Mathematical Sciences Research Institute (MSRI) is an independently funded research institute located on the UC Berkeley campus, high above the Lawrence Hall of Science. At any given time, MSRI is host to 50 to 100 post-doctoral fellows and more senior researchers who come from all over the world for periods of a week to a year. Most of them participate in one of two topical programs which change from year to year, with a smaller group in "Area III", our catch-all. Currently the programs are Holomorphic Spaces and Several Complex Variables. MSRI is aiming to become a model site for the integration of computing into mathematical research. In practical terms this means not only the development and use of software for numerical calculation, symbolic manipulation, and geometric visualization, but also exploration of the uses of technology in other areas of scholarly life. This includes network access and distribution of structured information, new modes of scholarly communication (incorporating Email, formatted and illustrated mathematical text, and shared interactive software for experimental mathematics), and the development of software engineering tools necessary to put the creation of useful, shareable special purpose software within the reach of the average individual scientist. directions to MSRI are available at the URL: http://www.msri.org/housing/info/howtoget.html About the word "empennage" Empennage is the French word for fletching - the act of putting feathers on the tail of an arrow. This makes the arrow fly strighter by giving it a spin. ------------------------------------------------------------------------- Steven Weller | "The Internet, of course, is more +1 415 390 9732 | than just a place to find pictures | of people having sex with dogs." stevenw(a)iglou.com | -- Time Magazine, 3 July 1995

1 0

Seminar
by AFDA2＠aol.com 17 Dec '03

17 Dec '03

A quick update on the Association's upcoming seminar. As many of you know, on Saturday, November 4, 1995, the Association of Federal Defense Attorneys (AFDA) will be presenting a one-day seminar for defense attorneys entitled, "What Every Defense Attorney Should Know About The Federal Bureau of Prisons." The seminar will be held at the Los Angeles Airport Marriott Hotel, from 9:00 a.m. - 4:30 p.m. The purpose of the program is to provide defense attorneys with two avenues of insight into BOP. The first, which covers the morning and part of the afternoon, focuses on the administrative/policy-oriented makeup of the agency, and the defense attorney's strategic application of these rules. Speakers from the BOP, private defense bar and Federal Public Defenders Office will cover the following subjects: 1. Types of BOP facilities, including the key operating features of the USP, FCI and camp. 2. The flow chart of key players in BOP administration that attorneys should be familiar with, including the Community Corrections Manager, Community Corrections Staff, Regional Designator, and the legal offices at the various facilities and regional offices such as Dublin, Ca. 3.The BOP documentation system, which has its own unique classification and numbering system. This topic includes special attention to the key documents most likely to affect defense attorneys, such as Program Statements, Operations Memoranda, and Directives. 4. The key BOP terms that attorneys should be familiar with in order to communicate more effectively with staff and understand better the agency's documentation. 5. How to anticipate where the defendant will serve his/her sentence and secure a favorable outcome (to the degree possible). This subject includes: Designation of place of confinement Custody classification Institutional transfer and redesignation 6. Sentence computation (calculating release dates) 7. How to efficiently contact appropriate staff on matters of concern 8. Intensive Confinement Centers (boot camp) The second prong of the seminar, which covers about two hours in the afternoon, focuses on the "grass-roots" perspective of the federal inmate, in terms of basic facts about federal incarceration that lawyers need to pass on to their clients before the clients are designated to a facility. The speakers will be two former inmates who have done time at camps and FCIs. If you would like a fax-flyer for the program, email us a short note at AFDA2(a)AOL.com

1 0

java flaw
by an407769＠anon.penet.fi 17 Dec '03

17 Dec '03

Sun and Netscape fix Java-Navigator flaw >From PC Week for October 16, 1995 by Michael Moeller Netscape Communications Corp. has identified a flaw in Sun Microsystems Inc.'s Java development language that caused a security hole in Netscape's Navigator 2.0 Internet browser. The flaw left open the possibility for corrupted files or viruses to be downloaded over the Internet to a host PC. Netscape officials, in Mountain View, Calif., said the problem occurred when porting Java to the Netscape platform. Sun, also based in Mountain View, issued a fix that performs a tighter security scan of Java applets, or portions of code. Sun officials said no users were affected by the security flaw. The company is beta testing Java now, and the final version is scheduled to be released next month. Ironically, Java was designed as a secure development language to prevent users from contracting a virus when downloading an application over the Internet. With Java, World-Wide Web application developers can create applets that are turned into full-scale application code once downloaded by a Java- enabled browser. A security feature in Java scans for viruses before activating the applet. Java applications are designed to be run within the secure environment of a Java-enabled browser. When Java was ported to Netscape, one of the security features "fell through the cracks," said Arthur van Hoff, senior staff engineer at Sun and a principal architect of Java. As a result, a user could have downloaded a corrupt applet that could have continued to function outside the secure environment of the browser shell and infected other programs on a user's computer. Netscape has since released two new versions of its Navigator 2.0 browser for beta testing, one with Java support and one without. However, Netscape officials said that once the browser is released in mid-December, all versions of Navigator 2.0 will be Java-enabled. --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

1 0

Re: java flaw
by James A. Donald 17 Dec '03

17 Dec '03

At 06:59 AM 10/17/95 UTC, jerry the golden retriever wrote: > A security feature in Java scans for viruses before activating the > applet. I hope that this is false. Even if one had genuine artificial intelligence, it would be impossible to detect all viruses, only particular viruses and classes of virus. If Java is secure, virus scanning should be unnecessary, indeed impossible, because there could be no code configuration capable of acting as a virus. If virus scanning occurs, then it is possible to write a virus in Java, then Java is inherently insecure. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

4 3