December 2003 - cypherpunks-legacy

Re: One-Time-Pad generation from audio device
by MIGUELDIAZ＠megaweb.com 17 Dec '03

17 Dec '03

>Date: Mon, 2 Oct 1995 16:42:04 +0100 (BST) >From: "Rev. Mark Grant" <mark(a)unicorn.com> >Sender: owner-cypherpunks(a)toad.com >To: cypherpunks(a)toad.com >Subject: One-Time-Pad generation from audio device > > >Over the weekend I hacked up a one-time-pad generator from > the random >number code I've been writing for Privtool, which uses noise > from the >audio device to generate random numbers. > >The code basically reads in a 512-byte block from > /dev/audio, then takes >the MD5 of that block to generate 16 bytes of the OTP. The > raw audio data >I'm getting is not particularly random and will compress by > 3:1 using gzip >or compress, so I'm assuming that using a 32:1 ratio here > via MD5 will >give a truly random output (it's certainly uncompressible). > >Before I release the source code to the Net, can anyone give > me any good >reasons to believe that this won't produce physically random > output, or >make suggestions on how to test, or improve, the generated > output ? There's >a #define which can be used to easily increase the amount of > data fed into >the MD5, but at the moment it will only generate about 1 MB > per hour on a >Sparcstation (limited by the audio input rate), so I don't > want to >increase that if I don't have to. > > Mark There are many ways to test for randomness. you might want to start by accumulating instance of "1" and "0" and over a long time you should have roughly an equal number of both. If you have access to a spectrum analyzer with an auto-correlation function (or cross-correlation will do) feed in similar lengths of output at different time intervals and check to ensure a low (close to zero) correlation exists. Also while you are at it you might want to checks the ouput's frequency spectrum, it should be fairly uniform accross the generating range. Noise (or randomness) which is not normally distributed can lead to nasty hacks. Be Well!! >

1 0

re: `NOISE' what crypto is that ? [was Re: NT and C2]
by Weld Pond 17 Dec '03

17 Dec '03

>Weld Pond writes: >[...] > > http://www.iquest.net/cgi-bin/gate2?|mmMgT008://bbb.PHDx10.ix0/ibLD1P7= >i/ExUP0e/A1vxiw.T05smgmRibLD1P7iggyR/D1UgM/ppp/6DYsPv/ibLD1P7i/ExUP0e/Ex= >UP0egMmN1xAUvTgrmNvgmwONgOmyMyYnlXkKCfX,ve8TxU8Di31,nlXk6CllpW,ve8TxU8Di31= >MRmypd > > >What kind of (en)coding is that ? some kind of rot13++ ? > I know it looks funny but that is the actual URL. I think it is some kind of verity search engine they use at IQuest. To get it to work I had to paste in the 4 lines individually into Netscape because the URL edit windows doesn't seem to do linefeeds. It's getting pretty bad when you feel like you should uuencode the URL so that people get it straight. Here is the URL again: http://www.iquest.net/cgi-bin/gate2?|mmMgT008://bbb.PHDx10.ix0/ibLD1P7i /ExUP0e/A1vxiw.T05smgmRibLD1P7iggyR/D1UgM/ppp/6DYsPv/ibLD1P7i/ExUP0e/Ex UP0egMmN1xAUvTgrmNvgmwONgOmyMyYnlXkKCfX,ve8TxU8Di31,nlXk6CllpW,ve8TxU8D i31MRmypd Weld Pond - weld(a)l0pht.com - http://www.l0pht.com/~weld L 0 p h t H e a v y I n d u s t r i e s Technical archives for the people - Bio/Electro/Crypto/Radio

1 0

Re: `Hack Microsoft' challenge is NYT Computer News Daily's top story
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:37 PM 10/2/95, MIGUELDIAZ(a)megaweb.com () wrote: >I don't know about everyone else, but a T-shirt seems a very >small reward for uncovering a "hole" in the encryption >algorithm of Microsoft products. Does that apply to any and >all bugs?? i.e. not necessarily security problems?? You are of course welcome to offer a richer prize. Meanwhile, Sameer is the one making the offer, so it's not for us to say he's being cheap. Also, the history of science is filled with cases where bets with trivial payoffs intensely motivated people. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Information, We want information
by Glenn Mackintosh 17 Dec '03

17 Dec '03

> From: todd(a)lgt.com (Todd Glassey) > I an immediate need of info on the liabilities of BSD type systems, and in > particular the BorderWare products. > > I heard that in the BorderWare product itself, there are several recently > discovered potential "holes"... > > I have a particular interest in both the Attack MO against the BSD > platforms in general and the Border products in particular... > > Please do not send the reply to the lists but to me personally > (todd(a)lgt.com) I will summarize if I get enough info to be worth the > effort. > > Any comments? Let me make a very clear statement. No site protected by BorderWare has ever had its Firewall penetrated. Never. This is the second time I've heard rumors about insecurities in the BorderWare software with nothing being brought out to substantiate them. I guess this is just an unfortunate part of doing business - especially in the security domain. I get a bit annoyed by this kind of thing since, regardless of whether we refute such comments, after the discussion itself is forgotten people will often remember that they heard something about a problem with product X. This isn't a criticism of you Todd - you are just reporting that you've heard rumors and asking about them, which is a perfectly reasonable thing to do. Obviously the rumors you heard haven't come along with any facts since you're asking here for the "Attack MO". I would very much like to here about any problem that is real, since if there were any weaknesses we would want to fix them and disseminate the fix as fast as possible. Border takes any potential problem very seriously. A couple of months ago there was a potential weakness that was discovered in the process of Border's ongoing efforts to ensure the security of the product. It was only a security risk with a very specific configuration. No customer has ever reported seeing this. Within two days of this discovery we had a fix and the fix was being actively pushed through the distribution channels to the customer base. It was given high priority and we had our support people calling down to the reseller channels to ensure that they were aware and that they got it out to their clients. We intended to make sure that this potential problem was immediately removed from the firewall even though no one had actually reported a problem. The fix was given free of charge to anyone whether they had a support contract or not. Some customers were even upgraded to a newer version of BorderWare so they could receive the fix. We strongly believe that our customers are entitled to the best available protection. They bought a Firewall for security and they should expect it to be secure. Border will do everything that we can to ensure this is always the case. So, anyone out there if you believe you have some real attack mechanism we want to know. Now that you've sat through the general ranting part of my comments, let me try to answer the BSD specific part. As far as BSD based OS's in general I don't think there is reason to believe that they are any more or less secure than System V based Unix's (or other non-Unix based operating systems for that matter). They all have pro's and con's and they have all had problems and I don't think that one variant has had more problems historically than the other. That said, Border doesn't use a stock BSD based OS anyway. We have put a large amount of effort into "hardening" the kernel so that it is a solid base upon which to build a secure firewall. We don't believe that any stock OS which was designed for a dynamic environment with users on it will really be secure. There are far too many instances (with just about any OS, Unix or otherwise) where someone has gained privilege or increased access to a system by taking advantage of some feature once they managed to get on the box. A firewall should be a static, non-user environment which means that many features are just not required and can be removed or their behavior significantly changed and limited. We spent a considerable amount of manpower stripping down the kernel and leaving only what was really needed. We removed the mechanisms which can be used to gain privilege or increase the levels of access to the system. The BorderWare kernel is in fact one of its strongest assets, and not a potential weakness. Glenn Mackintosh V.P. Technology ------------------------------------------------------------------------ Border Network Technologies Inc. Email: glenn(a)border.com 20 Toronto Street, Suite 400, Tel: +1 416 368 7157 Toronto, Ontario, Canada, M5C 2B8 Fax: +1 416 368 7789

1 0

SAIC Ideas SCI
by anonymous＠freezone.remailer 17 Dec '03

17 Dec '03

URL: http://baretta.ideas.com/capabilities SAIC Ideas Group 7120 Columbia Gateway Dr. Columbia, MD 21046-2115 (410) 312-2000 Fax:(410) 312-2250 Contact: Bill Howard (410) 312-2060 wjh(a)ideas.com [Snip] 1.2 SAIC acquired the government sectors of IDEAS, Inc. in November 1994. Now known as the SAIC Ideas Group, this business area encompasses 230 technical people (165 SCI cleared) located in a company owned 100,000 Sq. Ft. Columbia, Maryland facility. [Snip] 2. TECHNICAL SKILLS The SCI cleared skills mix for the SAIC Ideas Group is listed in the table below. Table 1: Ideas Group SCI Cleared Skills Mix (7/95) Skill Category SCI Cleared Staff Project Management 8 Software Engineering 48 Hardware Engineering 10 Hardware Technician 14 Test Engineering 24 ILS 12 Training 12 Systems Engineers 28 Administrative 9 3. COLUMBIA, MD FACILITIES The SAIC, Ideas Group, 100,000 square foot building is located at 7120 Columbia Gateway Drive, Columbia, MD. This facility offers "one-stop shopping" for your system and hardware needs. [Snip] 3.2 Sensitive Compartmented Information Facility (SCIF) features: 13,000 square foot certified SCIF Secure conference areas Secure office spaces Project rooms Raised floor staging areas Two large shielded rooms Class A storage vault Secure STU-III telephone Secure Facsimile The largest SCIF conference room will support approximately 65-75 people; smaller conference rooms are available. Secure staging areas have self-contained environmental control and AC wiring for single or three phase, 50 or 60 Hz, power. The staging areas also provide separate digital and analog ground radials referenced to a single-point independent earth ground to effectively emulate most customer locations. Several SCIF areas can be arranged to provide secure space -- screened if necessary. Systems with 200 racks of equipment have been staged and operated in the Ideas Group SCIF. [Long snip] _________________________________________________________________ webmaster(a)ideas.com // (c) Copyright 1995 by Science Application International Corporation

1 0

Re: NetScape's dependence upon RSA down for the count!
by jbass＠dmsd.com 17 Dec '03

17 Dec '03

Sorry David, The offer was for a server/filter/MITM/proxy that logged clear text not cyphered text for the SSL stream. Combine your program with SLL code from other sources and 95% of the program is complete. Add to that a way to produce a valid certificate for the client and you will earn the $50 and a lot of praise for a job well done from everybody. > > I have a Fifty dollar bill for the first person to submit to the mail box > > nethack(a)dmsd.com a working Unix server (with cleartext session logs) which > > accepts all connections on a unix based host to the www port and redirects > > them to netscape.com leaving a clear text log of each session's SSL packets > > in /tmp by session. All entries become the property of DMS Design. The winner > > and I will submit a claim for one of Community COnneXion's "I HACKED NETSCAPE" > > tee shirts as a server hack. (Have Fun!!) > > > > This is a trivial program! I can't believe anyone considers this > technically difficult. But hey, who am I to question, if you'll > pay $50! > > Ok, let me back that up with real code. Here's a proxy I've been > using for experimenting, in lieu of root access & tcpdump. For the rest of you, David gave you a small jump start. Checkout the web pages at C2.org and netscape.com for access to the ssl prototype code. Have fun, John Bass Owner, DMS Design

1 0

SAIC Snags INFOSEC
by anonymous＠freezone.remailer 17 Dec '03

17 Dec '03

URL: http://www.disa.mil/ciss/itsc/docs/brochure.html INFOSEC Technical Services Contract The Solution to Your Security Needs Now! What is INFOSEC Information Systems Security (INFOSEC) is defined as the protection of information systems against unauthorized access to or modification of information, whether in storage, processing or transit, and against the denial of service to authorized users or the provision of service to unauthorized users, including those measures necessary to detect, document, and counter such threats. For operations and for economic efficiencies INFOSEC is an enabling feature. It is the discipline that protects the integrity, availability, and confidentiality of our information assets and systems. All information is important and valuable to its users and requires some level of protection from unauthorized disclosure (confidentiality), assured access by users (availability), and protection from unauthorized change (integrity). We believe that good security is a mission enhancer, not a mission detractor! Our overall approach to information systems is security is to PROTECT information using a layered defense based on risk management and cost benefit analysis. We must be able to monitor all our systems and networks in real time to DETECT intrusions or hostile actions at all levels, and then REACT to isolate the systems, correct the security breach, restore service to the users, and act to prevent future attempts. Center for Information Systems Security Background In July 1990, the Assistant Secretary of Defense for Command, Control, Communications, and Intelligence ASD(C3I), started an investigation effort for coordinated DOD-level management of defense INFOSEC initiatives. DCA, now DISA, was designated as the lead agency with assistance from the National Security Agency (NSA). A DISA/Center for Information Systems Security (CISS) and NSA plan was developed and approved for establishment of the Defense Information Systems Security Program (DISSP). CISS has its origin in the Defense Information Systems Security Program (DISSP), a joint DISA/NSA program. Continuing as a joint program office CISSs mission is to manage, coordinate and provide direct INFOSEC application support to DOD programs, develop standards and protocols for INFOSEC and expedite the implementation of MLS command, control and communications systems for DOD. The CISS provides a means to fully review, coordinate, and make recommendations concerning the implementation of policy, architecture, and products to support DOD objectives. Mission The Center for Information Systems Security (CISS) is a joint DISA/NSA organization charged with executing the centrally managed Defensive Information Warfare (IW-D) and INFOSEC functions within DOD. CISS is the focal point for assuring availability, integrity, and confidentiality of all DII systems and information. We provide direct support to DOD services and agencies, and define requirements for DII INFOSEC standards. Additionally, CISS provides central coordination and reporting response to all DOD INFOSEC incidents, and operational protection, detection, reaction, and vulnerability analysis to the DII. What is the INFOSEC Technical Services Contract? DISA awarded the INFOSEC Technical Services Contract (INFOSEC TSC) on 12 July 1995 to two large businesses (CSC and SAIC) and one small business (MERDAN Group, Inc.). CISS, a joint DISA/National Security Agency (NSA) program, has been chartered to provide INFOSEC services throughout DoD. INFOSEC support will be provided by CISS infrastructure resources with contractual assistance from the INFOSEC TSC. The primary responsibility of the joint program office is to assure the effective and coherent application of INFOSEC to the overall Defense Information Infrastructure (DII). The contract offers technical support in the areas of: * INFOSEC Security Policy * INFOSEC Requirements Support * INFOSEC Architecture and Engineering * INFOSEC Independent Validation and Applications Verifications * INFOSEC Products and Applications DoD Goal Security Architecture (DGSA) * INFOSEC Certification and Accreditation Master Transition Plan * INFOSEC Technology and Training Documentation, and Countermeasures Information Dissemination * INFOSEC Multilevel Security Technology * INFOSEC Technical Managemet and Capabilities Planning (TMP) * INFOSEC ProfessionalizationProgram and Project Management * INFOSEC Standards and Protocols The contract is not a Federal Information Processing (FIP) hardware or software procurement contract. All DOD departments and agencies requiring INFOSEC services can utilize the INFOSEC TSC. The contracts are Indefinite Delivery, Indefinite Quantity (IDIQ) with individual firm fixed price, cost plus fixed fee, and time and material Delivery Orders (DOs) awarded for each requirement. Ceiling on the INFOSEC TSC is $1.095B which includes authority for other Federal (non-DOD) Agency use of 10% of current contract value. An additional 10% authority for non-DOD federal agencies is anticipated from GSA. There will be a 2 percent fee applied to all Delivery Orders. Details for submitting requirements are spelled out in the Guide for the INFOSEC TSC. Advantages of Using the INFOSEC Technical Services Contract * Provides contractual assistance in support of INFOSEC and INFOWAR requirements * Provides a means to obtain assistance in addressing complex systems security issues * Provides a high level of expertise to support systems certification and accreditation * Provides necessary DII/NII security support for DII/NII open systems architecture * Provides hardware and software support for INFOSEC prototyping and incidental hardware/software required to perform the task _________________________________________________________________ The INFOSEC TSC guide can be obtained from the: INFOSEC Technical Support Office (ITSO) Center for Information Systems Security 5111 Leesburg Pike, Suite 100 Falls Church, VA 22041-3201 Attention: Ms. Nanette Chopin (703) 681-1331 ---or--- Attention: Mr. James Lindou (703) 681-1333 FAX (703)681-1393 ---or--- through the World Wide Web at http://www.disa.mil/ciss/itso.html. _________________________________________________________________ SAIC Team Members * Bell Atlantic * Bellcore * CTA, Inc. * George Mason University * Information Security Systems, Inc. * JANUS Associates * Lockheed Martin * MICON Services Company * Pailen-Johnson Associates, Inc. * Secure Solutions, Inc. * Sprint * Technautics, Inc. * TeleCommunication Systems (TCS) * TELOS CSC Team Members * A.B. Floyd * Automation Research Systems (ARS), Ltd. * Bowie State * Computer Associates * DEC * DMR Group * Group Technologies * Intermetrics * IRE * Metters Industry * MIS Training Institute * Northrop Grumman * ORA * Oracle * RSSI * Space Applications Corporation * Systems Engineering Solutions, Inc. * Sparta * Spyrus * SRA * TASC * USATREX * Xerox Merdan Group, Inc. Team Members * Advanced Data Concepts, Inc. * Management Technology Strategic Association, Ltd. _________________________________________________________________ For More Information Contact the INFOSEC Technical Support Office Ms. Nanette Chopin, COR/DPM Voice: (703) 681-1331 Fax: (703) 681-1393 E-Mail to Ms. Nanette Chopin Mr. Jim Lindou, ACOR/PM Voice: (703) 681-1333 Fax: (703) 681-1393 E-Mail to Mr. Jim Lindou Defense Information Systems Agency 5111 Leesburg Pike, Suite 100 Falls Church, Virginia 22041 _________________________________________________________________ Return to: CISS TSC Home Page DISA CISS Home Page DISA Home Page _________________________________________________________________ You can mail any questions about these documents to: Ms. Nanette Chopin You can mail any questions about the DISA server to: yorkw(a)ncr.disa.mil - Last revision: 16 August 1995 okonw(a)ncr.disa.mil _________________________________________________________________

1 0

Re: Certificate proposal & X509 clarifications
by Rich Salz 17 Dec '03

17 Dec '03

> Therefore, you >have to get someone owning an OBJID tree branch to define meanings for you >- -- and you have to publish some worldwide book of mappings, etc. While I am no big fan of OID's (and I really dislike ASN.1 -- and nobody ever explained to my why the ISO RPC standard doesn't use it), if anybody really needs an ISO OID tree, I will probably be willing to tear off a piece of OSF's: 1.3.22 { iso(1) identified-org(3) osf(22) }

1 0

Re: Time Lag
by Rich Salz 17 Dec '03

17 Dec '03

Internet email is highly dynamic. Hosts can be up/down. Routers can be up/down. Gateways can be up/down. Routing databases can be out of date. Cables can be cut. Load averages can affect whether a host accepts SMTP connections. And so on. Sending one message and rigorously studying timestamps in the Received lines and using that to draw conclusions about mail propagation is a complete waste of time. /r$

1 0

RNG's and time-stamps
by Jim Choate 17 Dec '03

17 Dec '03

Now that is an idea, exploit the dynamic nature of Internet. Us the difference in times between the stamp and when the mail arrives to generate a RNG. Just a thought.

1 0