December 2003 - cypherpunks-legacy

Re: Win NT proprietary pw encryption (Was: Re: Windows .PWL cracker...)
by Ted Cabeen 17 Dec '03

17 Dec '03

At 11:39 AM 12/11/95 +0000, you wrote: >Futplex wrote: >> someone quoted: >> Microsoft Knowledge Base article Q102716 says: >> > Storage of the Passwords in the SAM Database >> [...] >> > The second encryption is decryptable by anyone who has access to the >> > double-encrypted password, the user's RID, and the algorithm. The second >> > encryption is used for obfuscation purposes. >> >> Anyone feel like putting together some sample plaintext/ciphertext pairs ? > >This will be really difficult, and in practice rather pointless. NT does >not allow any user, priviliged or not, to gain access to any form (encrypted >or not) of the passwords. They are stored in a protected area of the system >registry that only the OS itself can access. The best that you can do is >to ask the OS whether a given username/password pair is valid or not, and it >took until version 3.51 before MS let you do even that! I took a quick look in my NT registry and you can get access to the Account Manager section of the registry by manually changing the permissions and giving yourself access. I didn't have the time to look at all of the entries in the registry, but there's a lot of stuff there and I wouldn't be suprised if the encryted passwords were available. Of course, you have to be an administrator to change the permissions, but it is possible. _____________________________________________________________________________ Ted Cabeen cabeen(a)netcom.com Finger for PGP Public Key secabeen(a)midway.uchicago.edu "I have taken all knowledge to be my province." cococabeen(a)aol.com

2 1

*fnord* "Encryption Flaw Rattles Security Industry *fnord*
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

"Encryption Flaw Rattles Comuter Security Industry" SAN FRANCISCO - The discovery of a vulvnerability has shaken the computer world's faith in the safe use of the data-security technologies on which most current and planned electronic banking, shopping and "digital cash" systems are based. The vulnerability has been found in a class of technologies known as public-key encryption - designed to provide electronic transactions by scrambling data so they can be read only by people with the proper mathematical keys to the code. The flaw was identified by Paul C. Kocher, a 22-year-old researcher, who demonstrated a way that an electronic eavesdropper who is able to monitor the repeated process of unscrambling the incoming messages could figure out the private key. It can be done by repeatedly keeping track of the precise length of time it takes to unscramble each message. --From TimesFax, Mon. Dec. 11 Internet Edition

1 0

Re: More FUD from First Virtual
by Bill Stewart 17 Dec '03

17 Dec '03

At 08:51 AM 12/10/95 -0500, Nathaniel Borenstein <nsb(a)fv.com> (Tense Hot Alien In Barn) wrote: >In any event, I could write a virus that sits in >front of the e-cash program and steals your keys when next you run the >e-cash program. Software's just too easy to fool. That's why I regard >the risk of catastrophe as being fairly large in software-based e-cash >schemes. How is this different for an ecash program vs. a First Virtual email acknowledgement program, where either a (really hairy) virus, or, more practically, an active email interloper could fake FV acks? While hardware may be the best encryption solution for the average user (as you say, and I think I agree with you), it needs to have some password interface such as a small keypad on the front of the smartcard, to prevent its usability after theft. Of course, there are problems with digicash as well; my Digicash play-money account thinks it's empty (in spite of having half a dozen coin-looking files), and doesn't recognize any of the half-dozen passwords I've guessed I might have used with it, so I'm not able to use Sameer's digicash-powered remailer. #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

4 3

*fnord* "Encryption Flaw Rattles Security Industry *fnord*
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

"Encryption Flaw Rattles Comuter Security Industry" SAN FRANCISCO - The discovery of a vulvnerability has shaken the computer world's faith in the safe use of the data-security technologies on which most current and planned electronic banking, shopping and "digital cash" systems are based. The vulnerability has been found in a class of technologies known as public-key encryption - designed to provide electronic transactions by scrambling data so they can be read only by people with the proper mathematical keys to the code. The flaw was identified by Paul C. Kocher, a 22-year-old researcher, who demonstrated a way that an electronic eavesdropper who is able to monitor the repeated process of unscrambling the incoming messages could figure out the private key. It can be done by repeatedly keeping track of the precise length of time it takes to unscramble each message. --From TimesFax, Mon. Dec. 11 Internet Edition

1 0

EXON
by SBinkley＠atitech.ca 17 Dec '03

17 Dec '03

Could someone please explain to me what this "EXON" thing is??

3 2

*fnord* Addition info *fnord*
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

From: pck(a)netcom.com (Paul C. Kocher) Subject: Announce: Timing cryptanalysis of RSA, DH, DSS Message-ID: <pckDJEEzH.DJ3(a)netcom.com> Organization: NETCOM On-line Communication Services (408 261-4700 guest) Date: Mon, 11 Dec 1995 01:33:17 GMT Lines: 67 Sender: pck(a)netcom20.netcom.com I've just released details of an attack many of you will find interesting since quite a few existing cryptography products and systems are potentially at risk. The general idea of the attack is that secret keys can be found by measuring the amount of time used to to process messages. The paper describes attacks against RSA, fixed- exponent Diffie-Hellman, and DSS, and the techniques can work with many other systems as well. My research on the subject is still in progress and the current paper does not include many of my findings. I will eventually publish a full paper, but am releasing a preliminary draft now to alert the community as quickly as possible. A copy of the abstract is attached at the end of this message and the full text can be downloaded in PostScript format from: ftp://ftp.cryptography.com/pub/kocher_timing_attack.ps ftp://ftp.cryptography.com/pub/kocher_timing_attack.ps.gz I've also made an HTML version which is accessible at: http://www.cryptography.com (The HTML uses subscripts and superscripts which aren't supported in older web browsers. The PostScript version is the "official" one and looks nicer.) The results have already been seen by Matt Blaze, Martin Hellman, Ron Rivest, Bruce Schneier, and many others. While the full significance of the attack is not yet known, I think everyone who has seen it considers it important (including Netscape who awarded me a $1000 bugs bounty prize). ABSTRACT. Cryptosystems often take slightly different amounts of time to process different messages. With network- based cryptosystems, cryptographic tokens, and many other applications, attackers can measure the amount of time used to complete cryptographic operations. This abstract shows that timing channels can, and often do, leak key material. The attacks are particularly alarming because they often require only known ciphertext, work even if timing measurements are somewhat inaccurate, are computationally easy, and are difficult to detect. This preliminary draft outlines attacks that can find secret exponents in Diffie- Hellman key exchange, factor RSA keys, and find DSS secret parameters. Other symmetric and asymmetric cryptographic functions are also at risk. A complete description of the attack will be presented in a full paper, to be released later. I conclude by noting that closing timing channels is often more difficult than might be expected. Cheers, Paul Kocher ********************************************************************* VERY IMPORTANT: If you send me e-mail, please understand that I probably won't have time to respond to all who write. Please keep messages SHORT and send them to pck(a)cryptography.com (**not** my netcom address -- misdirected messages will be ignored). PGP when used for e-mail is not vulnerable to the attack. Please state in your note whether you would like a reply. ******************************************************************** __________________________________________________________________________ Paul C. Kocher Independent cryptography/data security consultant E-mail: pck(a)cryptography.com (please see above before replying) ======== Xref: news2.new-york.net sci.crypt:5320 Path: news2.new-york.net!spcuna!uunet!in1.uu.net!newsfeed.internetmci.com!howland.reston.ans.net!ix.netcom.com!netnews From: jmrubin(a)ix.netcom.com (Joel M. Rubin) Newsgroups: sci.crypt Subject: Re: Announce: Timing cryptanalysis of RSA, DH, DSS Date: 11 Dec 1995 04:35:47 GMT Organization: Union of anti-organizationalists Lines: 11 Message-ID: <4agcf3$enr(a)ixnews2.ix.netcom.com> References: <pckDJEEzH.DJ3(a)netcom.com> NNTP-Posting-Host: ix-sf17-18.ix.netcom.com X-NETCOM-Date: Sun Dec 10 8:35:47 PM PST 1995 X-Newsreader: WinVN 0.99.7 I just saw a small article with your name on page 1 of the N.Y. Times Fax 8-page Internet Edition. (Monday, December 11, 1995) They change the edition at about 10:30-11 P.M. Eastern Standard Time (0330-0400 the next GMT day) so if you read this before then, you might want to download http://nytimesfax.com/times.pdf. It is in Adobe Acrobat format. Of course, there is probably a larger article in the paper edition. ======== From: jmrubin(a)ix.netcom.com (Joel M. Rubin) Newsgroups: sci.crypt Subject: Re: Announce: Timing cryptanalysis of RSA, DH, DSS Date: 11 Dec 1995 04:38:58 GMT Organization: Union of anti-organizationalists Lines: 7 Message-ID: <4agcl2$enr(a)ixnews2.ix.netcom.com> References: <pckDJEEzH.DJ3(a)netcom.com> NNTP-Posting-Host: ix-sf17-18.ix.netcom.com X-NETCOM-Date: Sun Dec 10 8:38:58 PM PST 1995 X-Newsreader: WinVN 0.99.7 In case you don't already know, there is an article about your work in Monday's N.Y. Times. I just read a very small version of it in http://nytimesfax.com/times.pdf. (Adobe Acrobat-format 8-page edition) The N.Y. Times Fax on the web changes edition about 10:30 or 11 P.M. New York time so if you want it, get it before then.

1 0

Timing Cryptanalysis Attack
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

pck(a)netcom.com (Paul C. Kocher) writes: > I've just released details of an attack many of you will > find interesting since quite a few existing cryptography > products and systems are potentially at risk. The general > idea of the attack is that secret keys can be found by > measuring the amount of time used to to process messages. I just read this paper, and while it is somewhat interesting, I don't think the walls of cryptography are in any danger of crumbling. People employing systems like PGP are already advised to use them on private machines, with only one user, and untampered-with binaries. Under such circumstances, the collecting of statistics necessary to employ a timing attack would be difficult at best, and anyone doing a "black bag" job on the platform would be better advised to use a direct attack like a passphrase-sniffer as opposed to a complex statistical approach. On Networked systems with many users, where one is advised not to decrypt with or store ones private key, the situation is of course different. But again, another user with the ability to monitor the timing of specific subroutines in ones cryptographic software or feed that software enough chosen data to generate a statistical profile of the key, would doubtless have an opportunity to compromise the system in other ways. In the particular case of RSA used to sign messages or transmit session keys, the values being exponentiated are either highly random or strongly hashed, and the opportunity of an opponent to time numerical routines with data of his own choosing is non-existant. So while this is a very nice piece of work, and certainly of theoretical interest, I don't think it will modify the way in which people are advised to utilize cryptographic software, or cause companies like Netscape of RSADSI to shed any tears. -Bourbaki 137

14 25

Time-based cryptanalysis: How to defeat it?
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Assuming Alice is decrypting a secret message sent to her by Bob (on her very slow C64 ;), and Mallet is watching with a stopwatch in hand, hoping to determine Alice's secret key... It would be good to place inside the decryption routines a timer (WELL PLACED!) that waits a random-number of cycles (based on key-strokes, mouse position, etc.) to defeat this type of cryptanalysis?

1 0

key escrow arguments (fwd)
by David W. Crawford 17 Dec '03

17 Dec '03

Forwarded message: >From rre-request(a)weber.ucsd.edu Thu Sep 18 23:31:28 1997 Resent-Date: Thu, 18 Sep 1997 17:47:16 -0700 (PDT) Date: Thu, 18 Sep 1997 17:39:21 -0700 (PDT) Message-Id: <199709190039.RAA19449(a)weber.ucsd.edu> From: Phil Agre <pagre(a)weber.ucsd.edu> To: rre(a)weber.ucsd.edu Subject: key escrow arguments Resent-Message-ID: <"36_1eD.A.HwE.7mcI0"@weber> Resent-From: rre(a)weber.ucsd.edu Reply-To: rre-maintainers(a)weber.ucsd.edu X-URL: http://communication.ucsd.edu/pagre/rre.html X-Mailing-List: <rre(a)weber.ucsd.edu> archive/latest/1680 X-Loop: rre(a)weber.ucsd.edu Precedence: list Resent-Sender: rre-request(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Thu, 18 Sep 1997 13:08:56 -0400 From: Andrew Grosso <agrosso(a)ACCESS.DIGEX.NET> [Published last year in the Federal Bar Journal.] THE LAW ENFORCEMENT ARGUMENT FOR MANDATORY KEY ESCROW ENCRYPTION: THE "DANK" CASE REVISITED by Andrew Grosso (This article is a revised version of a talk given by the author at the 1996 RSA Data Security Conference, held in San Francisco, California. Mr. Grosso is a former federal prosecutor who now has his own law practice in Washington, D.C. His e-mail address is agrosso(a)acm.org.) I would like to start by telling a war story. Some years ago, while I was an Assistant U.S. Attorney, I was asked to try a case which had been indicted by one of my colleagues. For reasons which will become clear, I refer to this case as "the Dank case." The defendant was charged with carrying a shotgun. This might not seem so serious, but the defendant had a prior record. In fact, he had six prior convictions, three of which were considered violent felonies. Because of that, this defendant was facing a mandatory fifteen years imprisonment, without parole. Clearly, he needed an explanation for why he was found in a park at night carrying a shotgun. He came up with one. The defendant claimed that another person, called "Dank," forced him to carry the gun. "Dank," it seems, came up to him in the park, put the shotgun in his hands, and then pulled out a handgun and put the handgun to the defendant's head. "Dank" then forced the defendant to walk from one end of the park to other, carrying this shotgun. When the police showed up, "Dank" ran away, leaving the defendant holding the bag, or, in this case, the shotgun. The jurors chose not to believe the defendant's story, although they spent more time considering it than I would like to admit. After the trial, the defendant's story became known in my office as "the Dank defense." As for myself, I referred to it as "the devil made me do it." I tell you this story because it reminds me of the federal government's efforts to justify domestic control of encryption. Instead, of "Dank," it has become, "drug dealers made me do it;" or "terrorists made me do it;" or "crypto anarchists made me do it." There is as much of a rationale basis behind these claims as there was behind my defendant's story of "Dank." Let us examine some of the arguments the government has advanced. It is said that wiretapping is indispensable to law enforcement. This is not the case. Many complex and difficult criminal investigations have been successfully concluded, and successfully argued to a jury, where no audio tapes existed of the defendants incriminating themselves. Of those significant cases, cited by the government, where audio tapes have proved invaluable, such as in the John Gotti trial, the tapes have been made through means of electronic surveillance other than wire tapping, for example, through the use of consensual monitoring or room bugs. The unfetted use of domestic encryption could have no effect on such surveillance. It is also said that wiretapping is necessary to prevent crimes. This, also, is not the case. In order to obtain a court order for a wire tap, the government must first possess probable cause that a crime is being planned or is in progress. If the government has such probable cause concerning a crime yet in the planning stages, and has sufficient detail about the plan to tap an individual's telephone, then the government almost always has enough probable cause to prevent the crime from being committed. The advantage which the government gains by use of a wiretap is the chance to obtain additional evidence which can later be used to convict the conspirators or perpetrators. Although such convictions are desirable, they must not be confused with the ability to prevent the crime. The value of mandating key escrow encryption is further eroded by the availability of super encryption, that is, using an additional encryption where the key is not available to the government. True, the government's mandate would make such additional encryption illegal; however the deterrence effect of such legislation is dubious at best. An individual planning a terrorist act, or engaging in significant drug importation, will be little deterred by prohibitions on the means for encoding his telephone conversations. The result is that significant crimes will not be affected or discouraged. In a similar vein, the most recent estimates of the national cost for implementing the Digital Telephony law, which requires that commercial telecommunications companies wiretap our nation's communications network for the government's benefit, is approximately three billion dollars. Three billion dollars will buy an enormous number of police man hours, officer training, and crime fighting equipment. It is difficult to see that this amount of money, by being spent on wire tapping the nation, is being spent most advantageously with regard to law enforcement's needs. Finally, the extent of the federal government's ability to legislate in this area is limited. Legislation for the domestic control of encryption must be based upon the commerce clause of the U.S. Constitution. That clause would not prohibit an individual in, say, the state of California from purchasing an encryption package manufactured in California, and using that package to encode data on the hard drive of his computer, also located in California. It is highly questionable whether the commerce clause would prohibit the in-state use of an encryption package which had been obtained from out of state, where all the encryption in done in-state and the encrypted data is maintained in- state. Such being the case, the value of domestic control of encryption to law enforcement is doubtful. Now let us turn to the disadvantages of domestic control of encryption. Intentionally or not, such control would shift the balance which exists between the individual and the state. The individual would no longer be free to conduct his personal life, or his business, free from the risk that the government may be watching every move. More to the point, the individual would be told that he would no longer be allowed to even try to conduct his life in such a manner. Under our constitution, it has never been the case that the state had the right to obtain evidence in a criminal investigation. Rather, under our constitution, the state was given the right to attempt to obtain such evidence. The distinction is crucial: it is the difference between the operation of a free society, and the operation of a totalitarian state. Our constitution is based upon the concept of ordered liberty. That is, there is a balance between law and order, on the one hand, and the liberty of the individual on the other. This is clearly seen in our country's bill of rights, and the constitutional protections afforded our accused: evidence improperly obtained is suppressed; there is a ban on the use of involuntary custodial interrogation, including torture, and any questioning of the accused without a lawyer; we require unanimous verdicts for convictions; and double jeopardy and bills of attainder are prohibited. In other words, our system of government expressly tolerates a certain level of crime and disorder in order to preserve liberty and individuality. It is difficult to conceive that the same constitution which is prepared to let a guilty man go free, rather than admit an illegally seized murder weapon into evidence at trial, can be interpreted to permit whole scale, nationwide, mandatory surveillance of our nation's telecommunications system for law enforcement purposes. It is impossible that the philosophy upon which our system of government was founded could ever be construed to accept such a regime. I began this talk with a war story, and I would like to end it with another war story. While a law student, I had the opportunity to study in London for a year. While there, I took one week, and spent it touring the old Soviet Union. The official Soviet tour guide I was assigned was an intelligent woman. As a former Olympic athlete, she had been permitted in the 1960's to travel to England to compete in international tennis matches. At one point in my tour, she asked me why I was studying in London. I told her that I wanted to learn what it was like to live outside of my own country, so I chose to study in a country where I would have little trouble with the language. I noticed a strange expression on her face as I said this. It was not until my tour was over and I looked back on that conversation that I realized why my answer had resulted in her having that strange look. What I had said to her was that I had chosen to go to overseas to study; further, I had said that I had chosen where to go. That I could make such decisions was a right which she and the fellow citizens did not have. Yes, she had visited England, but it was because her government chose her to go, and it was her government which decided where she should go. In her country, at that time, her people had order, but they had no liberty. In our country, the domestic control of encryption represents a shift in the balance of our liberties. It is a shift not envisioned by our constitution. If ever to be taken, it must be based upon a better defense than what "Dank," or law enforcement, can provide. end

1 0

OGY, chaotic scrambling
by Laurent Den-Hollander 17 Dec '03

17 Dec '03

A few years back i ran thru a paper emanating from a navy labs researcher (i think the name was Peccora) about using synchronised chaotic signal generators as a signal scrambling/encrytpion scheme. Has there been any kind of progress in this line of work, practical applications ? Answer on C4i-pro or directly email to Denholl(a)ceram.fr L. Den-Hollander. OIT engineer.

1 0