December 2003 - cypherpunks-legacy

Netscape's random numbers
by Rich Salz 17 Dec '03

17 Dec '03

Congrats, nice job! The Netscape license explicitly prohibits decompiling (except where such prohibition is illegal). When this hits the media it will be important to avoid being tarred with the "hacker breaks rules and breaks in" brush. More subtly, it's probably a bad idea to call into question the overall business model of client binaries on the net. Instead, emphasize importance of open code, public reviews, ability to link in your own code that meets public specs, etc. All of these things the Internet was designed to do, and U.S. ITAR regulations are designed to prohibit (globally, anyway). And also that the bad guys will never play by the rules. And re-emphasize that solutions are possible, just that the U.S. government prevents them from being deployed in a global economy. Perhaps draw parallels to the recent Microsoft Word virus. /r$

2 1

Time release crypto
by sdw＠lig.net 17 Dec '03

17 Dec '03

What minimal requirements would be needed to support encrypted packets/files that a holder could only decrypt after a certain date/time? (Time Escrow?) Or a server that releases keys if a 'heartbeat' isn't or a trigger is received? (Escrow in the banking/legal sense.) (Video/sound recordings for security, opened at court's request., Ecash Escrow, missing persons) The obvious is a server that releases keys periodically (and serves old keys at will). Is there any way to make this trustable? Multiple servers with shared (xor split, etc.) keys of some kind? Design ideas? Applications: Gov. docs with expiration dates for privacy/secrecy. Source code for projects (if a company folds, copyright expires, etc.). Contract release to companies, public, etc. (15 minute stock data, agreements for commercial use initially, public/fair use later) sdw -- Stephen D. Williams 25Feb1965 VW,OH (FBI ID) sdw(a)lig.net http://www.lig.net/sdw Consultant, Vienna,VA Mar95- 703-918-1491W 43392 Wayside Cir.,Ashburn, VA 22011 OO/Unix/Comm/NN ICBM/GPS: 39 02 37N, 77 29 16W home, 38 54 04N, 77 15 56W Pres.: Concinnous Consulting,Inc.;SDW Systems;Local Internet Gateway Co.;28May95

1 0

Code of Law
by anonymous＠robo.remailer 17 Dec '03

17 Dec '03

Financial Times, Sept 18, 1995. Code to deny the money launderer The International Bar Association will this week call for the establishment of a code of practice for lawyers worldwide to deny criminals access to legal services which facilitate money laundering. At the IBA's business law conference in Paris, which opens today, Professor Ross Harper, IBA president, will ask representatives from 167 bar associations to pass a motion supporting efforts to counter money laundering and for the creation of common professional standards on the issue. "We are anxious that there be no safe havens for the ill-gotten proceeds of criminal activities throughout the world," he said yesterday. Estimates put the amount of money laundered worldwide each year at more than 500 billion pounds. On such a scale it is possible for economies, world trade and global banking to be subverted by organised crime, the IBA says. The motion urges member bar associations to press their national governments to adopt the principal recommendations of the Financial Action Task Force on money laundering set up in 1989 by the Group of Seven industrialised countries and the European Commission. Robert Rice, London ----- Newsweek, Sept 25, 1995. A Law of Their Own: Extremists create do-it-yourself courts. One day last month Wichita District Attorney Nola Foulston looked at her copy of the Daily Record, a trade newspaper, and was stunned to read that she had been subpoenaed. She was ordered to appear in District Court and produce her license to practice law. If she failed to appear, the sheriff would be directed to arrest her. Her alleged crime: holding public office. The subpoena was an unofficial document drafted and filed by a local man who had been charged with a misdemeanor for burning trash without a permit. Angered by the government interference, he joined a growing number of disgruntled Americans who think they've found a better arbiter ofjustice. He went to a "Common Law court, " one of the latest incarnations of the extremist right. Foulston ignored the subpoena. "I don't practice in false courts," she says. But they're growing. Common Law courts have sprung up in at least 11 states in the farm belt and the West over the last year, organized by a cross section of people bent on directly challenging government. In living rooms, bingo halls and convention centers, dozens gather weekly to form juries, present evidence and issue kangaroo-court indictments, liens, arrest warrants -- and even death sentences. None of this has the force of law. The movement is based on a mixture of crackpot conspiracy theories and bizarre interpretations of the U. S. Constitution, the Bible and the Magna Charta. In brief, its leaders preach that Franklin Delano Roosevelt's "bank holiday" edict of 1933, which temporarily shut down the nation's banks, stripped the country of its safeguards against tyranny. "When you get to digging into what's going on today, you have a government operating outside the Constitution," says David Schechter, a court organizer. Court members keep in touch on the Internet, swapping information, posting meetings and organizing court sessions . They also vent their views in a Texas magazine called the AntiShyster. Mostly white men form Common Law courts; many come from the militia movement. Some are closely aligned with white-supremacy and anti-Jewish groups. "The basic idea behind the movement," says University of Oregon history professor Richard Brown, "is 'popular sovereignty,' that people are above the law. These people are alienated from the legal system. To some extent it sounds like they're also trying to settle personal scores." Nuisance filings: At times, the movement spills out of its bogus courts and into real ones. Followers have tied up courts and IRS offices with thousands of pages of nuisance filings. Common Law court "marshals" have even burst into federal courtrooms wearing official-looking badges and uniforms to serve their papers. Last year in Garfield County, Mont., 36 men and women formed a Common Law court and briefly occupied a courthouse. Another court offered $1 million bounties for the arrest of local officials and threatened to hang them. Garfield County Attorney Nick Murnion charged some members of the Common Law court with "criminal syndicalism," alleging that the group had advocated acts of violence for political purposes. One court member was sentenced to 10 years in prison. Others received smaller sentences. Some members try to use the rump courts to reverse real ones. Favorite targets are divorce decrees and foreclosure notices. "People who don't want to or can't pay their bills are turning to something that tells them they don't have to." says Kansas City attorney Berry F. Laws III, who has been targeted by Common Law courts because he forecloses on farm mortgages for the Farmers Home Administration. This is a serious business, but it has elements of unintended burlesque. William Ellwood of Columbus. Ohio, joined up after his small business collapsed and he found that he still owed the Internal Revenue Service $5,100. Frustrated and annoyed, he took to researching the Constitution and concluded that he was living in a land that infringed on his personal liberty. One thing led to another until he found himself ticketed by a police officer for weaving on a highway. His reading of the Constitution made the ticket null and void. "What we're saying," he patiently explains, "is the motor-vehicle laws are laws of commerce. I don't use the laws for private gain, so why do I have to be stopped?" Ellwood eventually paid the ticket, but not before he and a small group of like-minded citizens reached out to organizer Schechter. Now they meet every Tuesday to have their day in a court of their own making. Thomas Heath in Denver and Connie Leslie -----

4 3

Re: Netscape's random numbers
by Rich Salz 17 Dec '03

17 Dec '03

>It would be remarkably stupid for them to try to enforce the >provision. Perhaps, but it that's secondary to the bad spin the media could end up having on it. Preventing that problem was a major point of my article, which discussed the media and netscape not at all. /r$

1 0

Your name in print
by Rich Salz 17 Dec '03

17 Dec '03

>From owner-www-security(a)ns2.rutgers.edu Mon Sep 18 17:36:41 1995 Received: from ns2.rutgers.edu (ns2.rutgers.edu [128.6.21.2]) by postman.osf.org (8.6.9/8.6.x) with ESMTP id RAA13528; Mon, 18 Sep 1995 17:36:34 -0400 Received: (from daemon@localhost) by ns2.rutgers.edu (8.6.12+bestmx+oldruq+newsunq/8.6.12) id MAA00546 for www-security-outgoing; Mon, 18 Sep 1995 12:35:37 -0400 Received: from whiz.mfi.com (whiz.mfi.com [198.71.19.34]) by ns2.rutgers.edu (8.6.12+bestmx+oldruq+newsunq/8.6.12) with SMTP id MAA00534 for <www-security(a)ns2.rutgers.edu>; Mon, 18 Sep 1995 12:35:18 -0400 Received: from ccmail2.mfi.com by whiz.mfi.com (AIX 3.2/UCB 5.64/4.03) id AA31083; Mon, 18 Sep 1995 09:26:41 -0700 Received: from ccMail by ccmail2.mfi.com id AA811441583 Mon, 18 Sep 95 09:26:23 PST Date: Mon, 18 Sep 95 09:26:23 PST >From: "Prince, Cheryl" <cprince(a)mfi.com> Encoding: 663 Text Message-Id: <9508188114.AA811441583(a)ccmail2.mfi.com> To: www-security(a)ns2.rutgers.edu Subject: security article Sender: owner-www-security(a)ns2.rutgers.edu Precedence: bulk Errors-To: owner-www-security(a)ns2.rutgers.edu Status: RO I am an editor at a business technology publication and am currently researching a piece on network security at financial institutions as well as the feasability of secure Internet transactions and banking on the world wide web. I will be interviewing individuals who can speak to these issues and can talk about whether the banking industry can in fact move much of its activity on line without risking the loss of billions of dollars to online theft and other related damage. If you are familiar with this subject matter and/or have any experience in the financial industry, please email me at: cprince(a)mfi.com Thanks, CJ Prince

1 0

Crypto Hearings
by John Young 17 Dec '03

17 Dec '03

Declan, or anyone, are there any transcipts of this SAFE hearing, or news reports, or other documents: September 4, 1997 SECURITY AND FREEDOM THROUGH ENCRYPTION ACT Committee on Commerce: Subcommittee on Telecommunications, Trade, and Consumer Protection held a hearing on H.R. 695, Security and Freedom Through encryption (SAFE) Act. Testimony was heard from Representatives Goodlatte and Lofgren; William P. Cowell, Deputy Director, NSA, Department of Defense; William A. Reinsch, Under Secretary, Export Administration, Department of Commerce; Robert S. Litt, Deputy Assistant Attorney General, Criminal Division, Department of Justice; and public witnesses. ----------------------------------------------------------------------- And for these of the coming week: Congressional Record: September 5, 1997 (Digest): CONGRESSIONAL PROGRAM AHEAD Week of September 8 through 13, 1997 [Excerpts] House Committees Committee on National Security, September 9, to markup H.R. 695, Security and Freedom Through Encryption (SAFE) Act, 1 p.m., 2118 Rayburn. Permanent Select Committee on Intelligence, September 9, executive, hearing on Encryption legislation, 10 a.m., H-405 Capitol. September 11, executive, to markup Encryption legislation, 10 a.m., H-405 Capitol. Committee on Science, September 10, hearing on Next Generation Internet Initiative, 10 a.m., 2318 Rayburn. September 11, Subcommittee on Courts and Intellectual Property, hearing on H.R. 2265, No Electronic Theft (NET) Act, and also on electronic copyright piracy, 10 a.m., 2237 Rayburn. September 11, Subcommittee on Crime, hearing regarding cellular telephone fraud, 9:30 a.m., 2141 Rayburn. Senate Committees Select Committee on Intelligence: September 10, to hold a closed briefing on intelligence matters, 2:30 p.m., SH-219. Committee on Labor and Human Resources: September 11, to hold hearings to examine the confidentiality of medical information, 10 a.m., SD-430.

2 1

Re: SSL implementation problem at Netscape
by dawagner＠flagstaff.princeton.edu 17 Dec '03

17 Dec '03

It looks like there's some confusion about the Netscape security problem Ian Goldberg (iang(a)cs.berkeley.edu) and I found, as mentioned recently on cypherpunks. If we'd foreseen that such a silly bug would receive so much attention, I think we would've tried to prepare a more comprehensive description... But we didn't. Anyhow, let's see what I can clear up for you now. [Note: Ian isn't here right now, so he hasn't had a chance to look at this. Any errors are mine, any opinions are mine, etc.] In article <david-1909951219130001(a)192.0.2.1> from sci.crypt, David Sternlight <david(a)sternlight.com> wrote: > If the above is, in fact, accurate it appears to apply to previous > versions of Netscape, not the 2.0 versions for which the public beta goes > out next week. We haven't tried it on v2.0, as we only have a copy of v1.1 right now. But the front-page New York Times article today said that the next version also has the same flaw, and that it'll be fixed before release. A Netscape official press release is available at http://www.netscape.com/newsref/std/random_seed_security.html Also our prototype code can be found at ftp://ftp.csua.berkeley.edu/pub/cypherpunks/cryptanalysis/unssl.c > In addition the flat statement that "keys can now be found > in appx 1 min." is not, as it seems, a general one but (if one reads the > details) requires a number of special assumptions, applies only to some > machines, and applies only if one can develop certain collateral > information. You are partially correct. It all depends on the threat model. If the attacker has user-level access (e.g. an account) on the machine where you run Netscape, your encrypted sessions can be broken quickly. (Our tools took about 1 minute on 1 machine, but was just a proof of concept -- I believe the time could be significantly reduced, and automated completely.) This model is not entirely unreasonable IMHO. If the attacker is simply sniffing the wire somewhere between you and the https: server, and has no account on your machine, things are a bit more complicated. Ian & I are still discussing this case, but I'll mention a few of our observations: * the time, pid, and ppid are mixed together in such a way that there is certainly no more than 47 bits of entropy (which is a far cry from the 128 bits claimed for their commercial domestic version). * the attacker can guess the current time to within a few seconds easily. * maybe the attacker can get this down to about 10 msec uncertainty, possibly even less in some cases. * the ppid is often 1 (e.g. when you start up Netscape from a X-windows menu). * if not 1, the ppid is often just a bit smaller than the pid. * on personal workstations, the pid and ppid are often quite small. * one can remotely determine pid's by talking to sendmail on the attacked machine and bouncing mail -- the pid will usually be in the Message-ID. (if the attacker host runs sendmail, which is a usual case) because pids are assigned sequentially, this leaves very little uncertainty in Netscape's pid. * there's no notion of pid or ppid on MS-DOS: God only knows what Netscape does there. maybe it's just seeded from the time!! * the PRNG is never reseeded for the duration of a cached connection. While we don't yet know exactly how long it would take to break Netscape's PRNG in this threat model, I think it's clear that Netscape's current implementation is insufficient and insecure. You mention that our attack is only applicable to certain machines. You may well be correct -- this is one area where our experiments were still proceeding when the media descended on us today. <chuckle> Certainly the Solaris 2.0 and HP-UX versions of Netscape v1.1 are vulnerable: we tested them ourselves. Ian told me he got email from people who are trying unssl.c on other architectures, and apparently the SunOS 4.x.x version is vulnerable too (and tests of other machines are in progress). We don't know about e.g. PC's yet -- this is another area we were still working on. I will note that Netscape didn't try to claim that any version was safe from this flaw, for what that's worth... Hopefully this will be quickly fixed by Netscape, and then we can all stop worrying about it! :-) David Wagner, daw(a)cs.berkeley.edu, speaking {for,to} himself

1 0

After Key Escrow Passes
by bureau42 Anonymous Remailer 17 Dec '03

17 Dec '03

"Badges? We don't need no stinking _badges_!" PlagaristMonger

1 0

Re: netscape's response
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:53 AM 9/20/95, Jeff Weinstein wrote: > Of course none of this reduces the magnitude of the screw up/bug/design >flaw/whatever. I really can't say which of these it was since I wasn't >around at the time that this code was being written. I must admit that >the RNG seed code was not an area that I thought to examine when I took >over our security library. In _retrospect_ (:-}), the approach taken by Goldberg and Wagner seems pretty obvious. Where PGP, for example, asks the user to go through a laborious process of "generating entropy" through ostensibly-random keyboard button presses, Netscape does not do this. Nor does it, for example, "listen" to a microphone input for some amount of time (to at least make a plausible pretense of gathering entropy), nor does it measure a Zener diode, or count clicks of a Geiger counter, or whatever. The very speed of Netscape's PRNG process suggests the usual weakness in PRNGs: simply not enough entropy. That is, a limited search space allows the guessing of a seed or entry point in a deterministic process. > This was a bad mistake on our part, and we are working hard to fix it. >We have been trying to identify sources of random bits on PCs, Macs, and >all of the many unix platforms we support. We are looking at stuff that >is system dependent, user dependent, hardware dependent, random external >sources such as the network and the user. If anyone has specific >suggestions I would love to hear them so that we can do a better job. I think a reasonable way to generate several hundred seemingly random (or at least highly unpredictable) bits is the "swirling the mouse" approach mentioned by several people. All implementations of Netscape involve mice, I assume, and this is a fairly fast way of generating hard-to-guess bits. Colin Plumb has code to do this, as has been mentioned. (I'm not saying that some number of "mouse swirlings" will generate some number of bits of entropy...this depends on the platform, the granularity of mouse measurements, etc. Better to take several times as many bits as needed and distill them down, with MD5 or other hash functions....can't have too many bits of entropy to start with!) This could be done fairly quickly by Netscape, and doesn't assume the platform has microphones to "measure background noise" or other exotic and nonstandard inputs. Years ago, I recall articles in sci.crypt about getting "pretty good random numbers" from complicated measurements of disk accesses on a local machine, ticks of the system clock, times between keyboard button presses, etc., all mixed and convolved together. Not perfect, of course, but if enough bits are started with (e.g, 2000) when "only" 126 or 512 or whatever are ultimately used, this "mixing" can probably be pretty damned good. At least, I doubt any t-shirts will be won. > Do you mean that cypherpunks offered to review the netscape code >if only we made all the source available on the net? I think that it >is unrealistic to expect us to release all of our source code to the >net. > > We will be having at least some of our code reviewed by a >wider audience, but I don't yet know which code, or how wide a review >group. If anyone has specific suggestions for pieces of code that >you would like to see widely reviewed (such as RNG and seed generation) >let me know. > > I realize that some cypherpunks think that we should make all of >our code publicly available. In an ideal world that would be great, >but we live in a world with politicians, crooks, lawyers, stockholders, >etc... Don't expect to see us posting our entire security >library source code to cypherpunks. I think a better approach is to modularize the functions, so that a "PRNG" chunk could be shown without "damaging" Netscape's market situation. (I doubt the crypto section is seen as Netscape's market edge, and use of industry-verified crypto modules would be a net plus, anyway.) In other words, keep secret (arguably) the things you don't want competitors to have access to. But things like crypto modules are rarely trade secrets--if only because the cores are so often licensed anyway--and can be shown and vetted without affecting the rest of the product. (I said "arguably" because many will argue for showing all of the source code, anyway, as the almost-ultimate check on integrity and reliabilty. And there may be subtle security flaws that hinge on the overall program, not just specific parts.) > I would love to hear your suggestions for good sources of entropy >on any systems that our products run on. See above. This has been a recurring topic in sci.crypt and Cyherpunks---so recurring, in fact, that several of us have expressed bemusement at seeing "yet another "How do I generate entropy" argument." I guess we all (save for Mssrs. Goldberg and Wagner) tacitly assumed that a modern product claiming to have strong crypto would use commonly-accepted techniques for generating enough entropy. (Commonly used in RSA's crypto products, and in PGP.) I suggest you take RSADSI up on their offer to advise you. (Or Cylink, as the case may soon be.) --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Interactive Journal Launches New Tech Center
by WSJ Interactive Edition Editors 17 Dec '03

17 Dec '03

Dear Interactive Journal Subscriber: If you haven't noticed it already, I wanted you to be aware of our new Tech Center (http://interactive.wsj.com/edition/current/summaries/techmain.htm) which represents a dramatic expansion of the Interactive Journal's coverage of technology companies, trends and stocks. Since we launched the Interactive Journal more than a year ago, our technology pages and articles have consistently been among our most popular. Tech Center, we think, not only organizes our coverage better but also increases the number of stories we follow and the depth of background we can deliver. Tech Center reflects news contributions not only from the print editions of The Wall Street Journal and from Dow Jones Newswires, but also from an expanded Interactive Journal news staff in New York and San Francisco dedicated to original coverage for the section. Its four news areas, all updated throughout the day and night, are: · Systems - Breaking stories in hardware and software. · Ventures - Alliances and new businesses shaping the technology landscape. · Fast Forward - The converging worlds of telecommunications, media and computing. · Tech Stocks - Major earnings announcements and other trends of interest to technology investors. In addition, Tech Center will offer a growing library of "Issue Briefings," concise background reports on key technology trends such as Java and online privacy; exclusive Interactive Journal profiles of dozens of top technology companies; and reader forums on major technology stories and controversial issues. Naturally, we also include the latest from Personal Technology columnist Walter S. Mossberg, along with an archive of all his recent columns. Please take a moment to explore Tech Center and let us know what you think, and what else you would like to see there. Neil F. Budde Editor The Wall Street Journal Interactive Edition feedback(a)interactive.wsj.com _______________________________________________________________ Check out Small Business Suite, a new Interactive Edition feature covering issues that matter most to small business owners, entrepreneurs, and anyone who markets products or services to small businesses. http://wsj.com/edition/current/summaries/small.htm ________________________________________________________________ This is the New Features Alert e-mail list. If you do not wish to continue to subscribe to this list, sign on to The Wall Street Journal Interactive Edition and go to the following URL: http://wsj.com/user-cgi-bin/userMenu.html to change your account preferences. Or you can just send email to: stopmkt(a)lists.wsj.com Cancelling your subscription to The Wall Street Journal Interactive Edition will automatically un-subscribe you from any e-mail lists you might be subscribed to through our service. For further questions, please call our customer service department at 1-800-369-2834. __________________________________________________________________

1 0