December 2003 - cypherpunks-legacy

Needed: Dongles and "Crypto Boxes" on Ports
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:56 PM 3/5/96, Hal wrote: ... >It will be just as easy to steal the mixmaster executable as to steal a >script file containing a pass phrase. And it might even be possible to >run the stolen mixmaster directly to decrypt intercepted incoming mail >messages, without even having to type in the pass phrase. Failing that >the attacker could easily extract the pass phrase from the mixmaster >executable file. > >The other suggestion that was made here, that the operator would have to >manually type in the pass phrase every time the computer rebooted, would >be a way of avoiding having the information in the clear on the disk. >However it would probably not be a practical method of operation given >the reliability of at least the Unix operating systems that I am familiar >with. And even then the information is in memory. An attacker who could ... It seems to me that we get some of the advantages of "secure hardware" (and I don't mean in a formal NSA "Orange Book" sense) by having secure dongles attached to serial or other ports on machines. "Dongles" are the much-hated copy protection devices used with some products: they typically are a small plastic-packages doodad plugged into a serial port on a PC. (The Mac versions are less common; don't know if Unix boxes have ever used them.) In the case described by Hal, there might be two imaginable modes of operation: 1. The dongle feeds a passphrase at boot time. This is not very secure, as means could be found to either intercept the supplied passphrase and/or find system commands that would trigger the providing. But at least the passphrase is nominally not stored on a disk accessible to outsiders. (The passphrase is still presumably in memory, as noted above by Hal, and by others. But at least it's not on a disk.) 2. Some sort of zero knowledge protocol in which the dongle possesses the secret knowledge and does part of the decryption, etc. Seen more broadly, this dongle might actually be a separate PC box, 386- or 486-based, and connected to the main Unix box. The main box would still do the usual stuff, but the "secure box" would have a constrained set of operations--maybe running a stripped-down Linux or FreeBSD a la our discussions a few years ago--and would essentially only operate as a crypto box. A separate crypto box could be quite cheap, and one could imagine measures to make it less prone to physical tampering (*) and certainly less prone to network snooping. (* Tamper-resistant vs. tamper-responding. See the FAQ. Basically, there is no such thing as a "tamper-proof box." But "tamper-resistant" can mean PC boards potted in epoxy, locked lids, no floppies, alarms, etc. And "tamper-responding" means there is evidence given that a security barrier has been breached.) A "crypto box" could in fact handle most of the mix functions directly, bypassing the Unix box. The Unix box--the one hooked to the Net in the usual way--would get the incoming packets, send them to the crypto box, then get back the processed messages. If done right, the crypto box could ensure that no records are kept of the mapping between incoming and outgoing messages. A court order to produce the mapping could then be honestly responded to with a "no records are kept, or can even possibly be kept." (Without modification of the software/hardware, something which Digital Telephony II could certainly mandate, but it doesn't exist now.) I think a "crypto box" based on a cheap 486 box, a reduced functionality Linux, and very limited storage capabilities (possibly no disk, only RAM), could be an interesting way to solve both the passphrase-snarfing and LEA-subpoenaing problems. While not as secure as either a Chaumian tamper-responding digital mix (cf. the 1981 paper in CACM) or as a software-based DC-Net, it sure does beat the current model of multiuser Unix boxes running remailers out of user accounts! (A word on separating the functions into a "network box" (what I've also called a "Unix box") and a separate "crypto box." There is no reason one box cannot do both....but by separating the two functions and linking the boxes via a secure connection, one faces less temptation to add more capabilities, storage, and users to the "crypto box." So, I think it better for remailer operators to continue to have their powerful, capable, net connection boxes and then have a stripped-down, possibly RAM-only box that only does limited things. It's also possible to have several boxes, just with different Net addresses, but there might still be the temptation to give the "remailer box" more capabilities. My intuition is that it would be easier and more secure to just have the crypto/remailer box as a slave or dongle to the more capable box.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

FT on Crypto Cloud
by jya＠pipeline.com 17 Dec '03

17 Dec '03

Financial Times, March 6, 1996, IT Section, p. V. Network Security: Operating under a cloud of uncertainty Companies face a complex web of technical, legal and moral questions The IT security threat has long been depicted in terms of wild-eyed hackers hunched over terminals late into the night. But while there is real cause for concern about criminal activity over computer networks, large corporations are very worried about another threat to their use of electronic communications. Meanwhile, government restrictions on the use of data encryption codes in various countries are limiting the ability of commercial organisations to protect themselves. Cryptography is at the heart of this dilemma. Governments all over the world rely on specialist intelligence units to break down data transmissions from other nations and individuals while encrypting their own messages. The US National Security Agency and the UK's Government Communications HQ are the best-known of these agencies. The NSA is notorious for obsessive secrecy. Meanwhile, in the UK, the GCHQ has lifted its traditional reticence in recent years to offer advice to British companies concerned with data security. Mr Roger James, chairman of Cheshire-based communications software specialist Boldon James, has worked with GCHQ to define data standards for UK government departments. Mr James plays down the cloak-and-dagger imagine of GCHQ, but instead he describes his contact with its staff as "horribly technical". He also portrays the Cheltenham code-breakers as "very down-to-earth people". There are two ways of looking at security, he says "one is the practical approach, which means accepting that perfect security is impossible to obtain. The other is the Ivory Tower approach, which involves dreaming of a world in which security is absolute. There are a lot of 'practicalists' in GCHQ". Mr James, whose clients include the Britannia Building Society and the German Navy, is active in the European Electronic Messaging Association. He is concerned at the lack of a co-ordinated European policy on encryption. And he fears that effective security measures could become illegal with the advent of future legislation curbing the availability of encryption software. It is illegal at the moment to use strong cryptography techniques in France without first depositing the key to unlocking your codes with the French government. UK companies developing sophisticated security programs find their software classified as munitions and subject to tight export restrictions, even within the EC. In the US, the author of strong encryption program, called 'Pretty Good Privacy', found himself facing a Grand Jury and possible charges of exporting prohibited technology. The NSA has proposed that all personal computers made in the US contain the Clipper Chip. This security feature would give easy access to any data communications, however the user chose to encode it. The proposal is currently stalled, having met with ferocious opposition. Both suppliers of information technology and industry at large need to clear a path through this international maze. The legal structure surrounding the use of encryption technology is of particular concern to anyone working in electronic commerce. "The Clipper Chip debate raised a fundamental moral issue," says Mr James. "Software technology means that strong encryption, previously available only to the military, can now be obtained by the public. If governments then find messages hard to break, it leads immediately to a conflict of interest." One company that has confronted this apparent conflict of interest between state and commerce, with its attendant uncertainty, is the Anglo-Dutch oil giant, Shell. Mr Nick Mansfield, a Shell technical consultant specialising in information security, says the company is enthusiastic about the potential for eliminating paperwork across its sprawling global operations -- "we are committed to electronic trading," he says. "We have a vast electronic-mail network. But there is still a section of our business where we have to use paper". Contract agreements are at issue here. Until security can be absolutely guaranteed, bilateral agreements must be seen to be tamper-proofed. Shell is about to deploy technology to secure personal computers and PC servers across the world. This e-mail security system will cost around L1m in software purchasing plus L100,000 a year to run. It will have 4,000 users. Far from escalating costs, Mr Mansfield explains that expenses are falling as security improves. Shell used to run a secure telex network that cost L4m in technology and required L200,000 a year to support 120 sites. This was superseded by a secure fax network costing L1m in systems, plus L100,000 in annual maintenance for 200 sites. The latest system will expand secure messaging beyond the fax network's remit. But setting up this security system involved Shell in a long and involved process. Its chosen security software is subject to close scrutiny by the UK authorities, who worked with Shell to customise the program before it could be released for use overseas. While Mr Mansfield is pleased that Shell's security system is so strong, it required an export licence and he echoes the concerns of EEMA's Mr James -- "it's a cart and horse situation. Until governments agree on policy and relax some restrictions, industry won't be encouraged to development extreme standards of encryption". There needs to be a broad European debate on this issue. Until this complex web of technical, legal and moral questions are resolved, secure commercial data networks will be operating under a cloud of uncertainty. Michael Dempsey [End] Note: Shell's Nick Mansfield was a speaker at the OECD cryptography conference in Paris in December. This issue of FT includes a 22-page special section on Information Technology.

1 0

Returned mail: User unknown
by Mail Delivery Subsystem 17 Dec '03

17 Dec '03

The original message was received at Mon, 4 Mar 1996 17:28:57 -0800 from cmyk.warwick.com [198.102.205.163] ----- The following addresses had delivery problems ----- <majorodomo(a)toad.com> (unrecoverable error) ----- Transcript of session follows ----- ... while talking to toad.com.: >>> RCPT To:<majorodomo(a)toad.com> <<< 550 <majorodomo(a)toad.com>... User unknown 550 <majorodomo(a)toad.com>... User unknown ----- Original message follows ----- To: majordomo(a)toad.com Subject: unsubscribe cypherpunks From: cypherpunks(a)warwick.com Date: Tue, 5 Mar 1996 15:11:06 -0500 unsubscribe cypherpunks

1 0

new netscape servers
by Alex Strasheim 17 Dec '03

17 Dec '03

>From the Netscape home page: "Netscape also announced FastTrack Server 2.0, an entry-level Web server that combines all the new capabilities of the next-generation Netscape Servers into one easy-to-use package. FastTrack comes with SSL security, Java and JavaScript support, and Netscape Navigator Gold content-creation software - for only $295." There are two reactions we can have to this. On the one hand, it's a good thing because it's going to make SSL servers a lot more popular. But at the same time, it raises some serious questoins about how Netscape plans on dealing with competitors. It's not clear whether or not the $295 price tag includes a certificate or not. But is it coincidental that people who want to use alternative technology like apacheSSL will have to pay the same price for the cert along as Netscape's customers will have to pay for a plug and play package? (The rest of this post is based on the assumption that you do get a cert with the "fast-track" server. That's not clear, so if I'm wrong, I apologize to the folks at Netscape.) There are two things keeping an organization like c2.org from competitng with Netcape on price: verisign and the licensing fees on rsaref. Both companies have close ties to Netscape. It's imperative that we challenge Netscape's control over the CAs. Obviously they can preinstall whatever CAs they want in their browsers. But that doesn't mean we're powerless. I think we ought to: (1) form a new non-profit low cost CA (2) make a concerted effort to explain the issue to the public and encourage people to ok the new CA. (3) try to create a sense that using a preinstalled CA is a form a collaboration (this will be hard, but I think it's true). If enough people will use a new CA, then it will be as good as one of the pre-installed ones. We can't let this sort of power concentrate in Netscape's hands. It's not a question of whether or not they're good people. It's just a bad development for everyone. -- Alex Strasheim, alex(a)proust.suba.com

3 2

Welcome to cypherpunks
by Majordomo＠toad.com 17 Dec '03

17 Dec '03

-- Welcome to the cypherpunks mailing list! If you ever want to remove yourself from this mailing list, you can send mail to "Majordomo(a)toad.com" with the following command in the body of your email message: unsubscribe cypherpunks cypherpunks(a)warwick.com Here's the general information for the list you've subscribed to, in case you don't already have it: About cypherpunks ----------------- I. Administrivia (please read, boring though it may be) The cypherpunks list is a forum for discussing personal defenses for privacy in the digital domain. It is a high volume mailing list. If you don't know how to do something, like unsubscribe, send mail to majordomo(a)toad.com and the software robot which answers that address will send you back instructions on how to do what you want. If you don't know the majordomo syntax, an empty message to this address will get you a help file, as will a command 'help' in the body. Even with all this automated help, you may still encounter problems. If you get really stuck, please feel free to contact me directly at the address I use for mailing list management: cypherpunks-owner(a)toad.com Please use this address for all mailing list management issues. Hint: if you try to unsubscribe yourself from a different account than you signed up for, it likely won't work. Log back into your old account and try again. If you no longer have access to that account, mail me at the list management address above. Also, please realize that there will be some cypherpunks messages "in transit" to you at the time you unsubscribe. If you get a response that says you are unsubscribed, but the messages keep coming, wait a day and they should stop. For other questions, my list management address is not the best place, since I don't read it every day. To reach me otherwise, send mail to eric(a)remailer.net This address is appropriate for emergencies (and wanting to get off the list is never an emergency), such as the list continuously spewing articles. Please don't send me mail to my regular mailbox asking to be removed; I'll just send you back a form letter. Do not mail to the whole list asking to be removed. It's rude. The -request address is made exactly for this purpose. To post to the whole list, send mail to cypherpunks(a)toad.com If your mail bounces repeatedly, you will be removed from the list. Nothing personal, but I have to look at all the bounce messages. There is no digest version available. There is an announcements list which is moderated and has low volume. Announcements for physical cypherpunks meetings, new software and important developments will be posted there. Mail to cypherpunks-announce-request(a)toad.com if you want to be added or removed to the announce list. All announcements also go out to the full cypherpunks list, so there is no need to subscribe to both. II. About cypherpunks The cypherpunks list is not designed for beginners, although they are welcome. If you are totally new to crypto, please get and read the crypto FAQ referenced below. This document is a good introduction, although not short. Crypto is a subtle field and a good understanding will not come without some study. Please, as a courtesy to all, do some reading to make sure that your question is not already frequently asked. There are other forums to use on the subject of cryptography. The Usenet group sci.crypt deals with technical cryptography; cypherpunks deals with technical details but slants the discussion toward their social implications. The Usenet group talk.politics.crypto, as is says, is for political theorizing, and cypherpunks gets its share of that, but cypherpunks is all pro-crypto; the debates on this list are about how to best get crypto out there. The Usenet group alt.security.pgp is a pgp-specific group, and questions about pgp as such are likely better asked there than here. Ditto for alt.security.ripem. The cypherpunks list has its very own net.loon, a fellow named L. Detweiler. The history is too long for here, but he thinks that cypherpunks are evil incarnate. If you see a densely worded rant featuring characteristic words such as "medusa", "pseudospoofing", "treachery", "poison", or "black lies", it's probably him, no matter what the From: line says. The policy is to ignore these postings. Replies have never, ever, not even once resulted in anything constructive and usually create huge flamewars on the list. Please, please, don't feed the animals. III. Resources. A. The sci.crypt FAQ anonymous ftp to rtfm.mit.edu:pub/usenet-by-group/sci.crypt The cryptography FAQ is good online intro to crypto. Very much worth reading. Last I looked, it was in ten parts. B. cypherpunks ftp site anonymous ftp to ftp.csua.berkeley.edu:pub/cypherpunks This site contains code, information, rants, and other miscellany. There is a glossary there that all new members should download and read. Also recommended for all users are Hal Finney's instructions on how to use the anonymous remailer system; the remailer sources are there for the perl-literate. C. Bruce Schneier's _Applied Cryptography_, published by Wiley This is required reading for any serious technical cypherpunk. An excellent overview of the field, it describes many of the basic algorithms and protocols with their mathematical descriptions. Some of the stuff at the edges of the scope of the book is a little incomplete, so short descriptions in here should lead to library research for the latest papers, or to the list for the current thinking. All in all, a solid and valuable book. It's even got the cypherpunks-request address. IV. Famous last words My preferred email address for list maintenance topics only is hughes(a)toad.com. All other mail, including emergency mail, should go to hughes(a)ah.com, where I read mail much more regularly. Enjoy and deploy. Eric ----------------------------------------------------------------------------- Cypherpunks assume privacy is a good thing and wish there were more of it. Cypherpunks acknowledge that those who want privacy must create it for themselves and not expect governments, corporations, or other large, faceless organizations to grant them privacy out of beneficence. Cypherpunks know that people have been creating their own privacy for centuries with whispers, envelopes, closed doors, and couriers. Cypherpunks do not seek to prevent other people from speaking about their experiences or their opinions. The most important means to the defense of privacy is encryption. To encrypt is to indicate the desire for privacy. But to encrypt with weak cryptography is to indicate not too much desire for privacy. Cypherpunks hope that all people desiring privacy will learn how best to defend it. Cypherpunks are therefore devoted to cryptography. Cypherpunks wish to learn about it, to teach it, to implement it, and to make more of it. Cypherpunks know that cryptographic protocols make social structures. Cypherpunks know how to attack a system and how to defend it. Cypherpunks know just how hard it is to make good cryptosystems. Cypherpunks love to practice. They love to play with public key cryptography. They love to play with anonymous and pseudonymous mail forwarding and delivery. They love to play with DC-nets. They love to play with secure communications of all kinds. Cypherpunks write code. They know that someone has to write code to defend privacy, and since it's their privacy, they're going to write it. Cypherpunks publish their code so that their fellow cypherpunks may practice and play with it. Cypherpunks realize that security is not built in a day and are patient with incremental progress. Cypherpunks don't care if you don't like the software they write. Cypherpunks know that software can't be destroyed. Cypherpunks know that a widely dispersed system can't be shut down. Cypherpunks will make the networks safe for privacy. [Last updated Mon Feb 21 13:18:25 1994]

1 0

Re: (Fwd) Gov't run anon servers
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:43 PM 3/5/96, Andrew Loewenstern wrote: (my mention of secure "remailer boxes" elided) >While a solution like that would be optimal, even just a version of >Mixmaster that can use a secure RSA card would do wonders for security. The >secret key is protected in the card and can't be stolen, even by root, >without physically stealing the card. As long as the most of the remailers >in your chain don't have compromised secret keys, it probably won't matter >too much if the individual ops can examine the messages flowing through their >remailer. > >The cards are getting cheaper and can be bought off the shelf (for now). >The hardest part of retrofitting existing remailer software would probably be >extracting the data from the remailer packet and formatting it properly for >the card to do encryption operations on it (and back). I just wrote and sent off to the list some thoughts on using cheap PC hardware to do the crypto and remailer functions, thus taking the onus off the networked box to do the same. The idea of a _card_ is a good one, and one we did in fact kick around a couple of years ago. Recall the days of the "Hardcard"? A Winchester mounted on a card that plugged into a PC slot (this was back in the days when slots for cards were sometimes much more available than spare drive bay slots). A crypto card is an elegant approach, but may be less hacker-available than a really cheap PC. (And in my more paranoid moments, I imagine taking a nice, steel-cased cheapo PC and welding it shut...won't stop someone from seizing it and cutting it open, but you'd probably know if it happened...or, a return to sealing wax and seal rings! A low-tech solution to physical security, but something that may still be useful as an option.) --Tim Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Bidzos on CNBC, discussing Leahy's Bill
by tcmay＠got.net 17 Dec '03

17 Dec '03

I'm watching Jim Bidzos being interviewed on CNBC...mainly about Leahy's bill (he's in favor of it)....(One of the benefits of having CNBC business news on all the time while I'm here online.) He thinks it's a good bill, good for U.S. industry, good for California...says some of the language in the bill still provides for "key escrow" of some sort (I think he means the criminal use of crypto provisions....). He still thinks customers absolutely do not want any other parties to hold their keys ("You don't give copies of the keys to your front door or your filing cabinets to the government now, so why should you just because the medium changes from filing cabinets to computer form."--paraphrased). No further word on RSADSI going public, though. (I'm constantly surprised that this hasn't happened, what will all the later-comers going public, and the general hyping of "Internet security" (not that it isn't important, just that it seems that any company with these magic words in its name or prospectus zooms through the roof on IPO). --Tim Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Mail loop?
by rah＠shipwright.com 17 Dec '03

17 Dec '03

It looks to me like the mailing list got subscribed to itself again. I saw the intro message go by... Cheers, Bob ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

Re: (INFO) Leahy/Goodlatte introduce crypto bill
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 12:17 PM 3/5/96 -0500, Voters Telecommunications Watch wrote on Cypherpunks(a)toad.com: > SEN. LEAHY (D-VT) AND REP. GOODLATTE (R-VA) INTRODUCE > "ENCRYPTED COMMUNICATIONS PRIVACY ACT" > TO THWART CLINTON ADMINISTRATION'S FLAWED CLIPPER PLAN >VTW believes this legislation is an excellent initiative. It may be MOSTLY good, but I see a big problem. [stuff deleted] >ANALYSIS OF ENCRYPTED COMMUNICATIONS PRIVACY ACT > >The Leahy and Goodlatte bills are not exactly alike. For the moment, >we will concentrate on the Leahy bill for purposes of analysis. We >find it to be fleshed out in many areas. [stuff deleted] >DISCOURAGES THE USE OF ENCRYPTION TO THWART A FELONY INVESTIGATION >This is probably the one provision we wouldn't have put in the bill, >were we drafting it. Clearly added to appease law enforcement, it >creates a new crime to "willfully" attempt to thwart a law enforcement >investigation by using encryption. VTW feels that such a crime is >unnecessary, but we're happy to see this is a fairly narrowly-tailored >statute. It only applies to individuals who are engaging in a felony >and using encryption to communicate information while in the commission >of the felony, and whose intent, in using encryption, is to foil a law >enforcement investigation. For reasons which will be obvious to anyone who has read my "Assassination Politics" idea, I assert that the operation of the central organization could be absolutely legal under current black-letter law. I may be right about this. The description of the proposed bill, however, clearly attempts to criminalize any encryption which may have the effect of preventing discovery of people who ARE guilty of felonies, or are planning them. While the bill is not specifically quoted, the broad description given by VTW clearly suggests that it is an attempt to cover not merely the felon, but also anyone (including entirely innocent people) whose communication thwarts the ability of the cops to investigate the felon. Regularly receiving encrypted, anonymous communications encrypted with your public key would qualify as a crime, I'll bet, if one of the people who sent them was "suspected" of a felony. For that reason, I can't possibly support this bill; as usual, any such provisions will be abused, and obviously I consider any attempt to turn an otherwise-legal activity by private individuals into an illegal one is questionable at best. >This provision only applies to you if you are using encryption to >specifically foil a law enforcement investigation AND the communication >relates to a felony AND you are using the communication to commit the >felony. VTW feels this is a fairly narrowly drawn statute that is not >likely to be easily abused. Oh, really? Why is it that I think this provision was specifically written to deal with ME, huh? > >THE BILL SHOULD INSTRUCT ESCROW AGENTS TO REPORT DISCLOSURES AS WELL >The bill currently requires law enforcement to notify the Office of the >Courts as to the number of court orders served on key holders and for >what crimes the court orders were obtained. The Office is required to >make this information public annually. What about the users themselves? Why shouldn't they be told if their info was decrypted? >VTW feels that accountability should never be in short supply. >Requiring key holders to notify the Office of the Courts whenever they >are ordered to disclose a key will allow the public yet another way of >making sure that appropriate procedures are being followed to protect >the public. How about insisting on a provision which requires a key-holder to inform the source of the encrypted data, as well? >VTW believes that a new statute is needed to dissuade those few >over-zealous law enforcement officials from violating the public's >trust in these matters. I already have a plan to "dissuade over-zealous law enforcement officials." It is called, "Assassination Politics" and I think it will work as well against cops as it would against politicians. >On the whole, we believe that this bill is a win for the Internet >public and Internet businesses that require strong market-driven >cryptography. VTW urges you to become familiar with it and support >Leahy and Goodlatte in their efforts. By what measure? A mixture of 1 pound of food and a couple grams of cyanide is "on the whole" mostly a healthy product. Yet if you eat it, it will kill you. It is those exceptions that make this bill unacceptable to me. Sounds like it's about time to teach myself C++. Jim Bell jimbell(a)pacifier.com Klaatu Burada Nikto Something is going to happen... Something....Wonderful! _ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMTybRPqHVDBboB2dAQHAxAP/T4XHscUSy9SbcZLIvU+gDlaBilk7wX2a RBk5dnbC/5bItWfYwes60p1/Y+0+8ol1BDyZHD/AfLbv3OQdIOSOyvw30A7s5p5d 6WdYSPa+KKomDnpK9Wa/el9h0KnJF/sU2A2c99cKSyMU1NDH3jVw9HU/Tq4J5He3 C81QvDySrgI= =0Rut -----END PGP SIGNATURE-----

1 0

Re: (Fwd) Gov't run anon servers
by Hal 17 Dec '03

17 Dec '03

From: mccoy(a)communities.com (Jim McCoy) > > Hal Finney writes: > [...] > > And even then the information is in memory. An attacker who could > >gain root privileges (and let's not pretend that the NSA can't do that) > >can dump memory and later comb it for the key information. > > > > "Security is economics" -E. Hughes > > The point is not to make a system which is absolutely, positively, no > doubt about it, secure against any attacker. If cypherpunks could do > this they would be working for defense contractors and others who make > certified systems. The objective is to make a system which is difficult > to attack, one which costs the attacker time/money. After securing > a host against the obvious attacks one can turn to the esoteric ones > such as you present: move the key to kernel memory and remove tools > for accessing or manipulating that area, run the memory-space encrypted > and do not let it dump the contents to disk, etc. Systems which > have been certified to high Orange book levels already exist, so there > are obviously solutions to the problems you present. The tools and > tricks of these systems just need to be migrated into systems which > people actually use. I was speaking of present conditions. If and when proven-secure Unix systems start being used as remailer servers on the net then it may be worthwhile having a larger key. The point is that there is no advantage in strengthening an element of the system which is not its weakest link. Factoring my remailer keys of 510 bits is not, I am sure, the easiest ways of finding the secret keys. > Then remember that remailers gain strength in numbers. The more > remailers you chain your message through the better your chances of > passing through a single node which is not compromised, at which > point your message has been "mixed." As long as it is easier for > someone to create new remailers than to break existing remailers > we are winning. It's not clear that this is the case, though, is it? What is the rate of creation of new remailers? It doesn't seem that high to me. We can't know how quickly they are being broken, but it is just a matter of getting root privileges on the remailer machine. From what I hear of the capabilities of experienced hacker/cracker types, it is very possible that remailers are being broken faster than they are being created. Of course, there is no way to know. > >My point remains that strong keys are pointless for remailers which run > >on Unix systems connected to the net. > > "Insisting on perfect security is for people who do not have the > balls to live in the real world" -paraphrased from M. Shaefer > > You give far too much credit to the potential attackers. One advantage > that unix systems connected to the net have over your hypothetical > PC at home is the advantage of persistence, what is the point of > running a remailer if it is never up, or only up when you need to use > it? Traffic analysis of that particular node becomes a pretty easy > task :) I meant that the home PC system would have an ongoing connection to the net, perhaps in the form of periodic uucp or POP connections. By using batching, traffic analysis would be no easier for such a system than for any other. > The unix hosts running remailers also have the advantage in > that they have been subjected to attack for quite a while now and > most of the obvious problems (and some of the non-obvious problems) > have been fixed. I am not sure what you mean by this. My experience is that new CERT advisories come out every few months which represent security holes big enough to steal remailer keys. The most recent one, out just a couple of weeks ago, is a bug in sendmail and maybe some other programs which could allow remote users to get root access if they have access to a DNS server: ftp://cert.org/pub/cert_advisories/CA-96.04.corrupt_info_from_servers Even if a remailer host operator is on the ball and fixes each one as it is announced, he still was vulnerable before the announcement was made. In many cases these bugs are found by hackers who exploit them for bad purposes before the good guys figure out what they are doing. Suppose a reasonably large prize of several hundred or a few thousand dollars were offered for someone who could break in and steal the key of some remailer on a net-connected Unix system. Wouldn't you agree that the prize would be claimed before too long? > A strong key on such a host is better than a weak key, so why not > make systems as strong as you can? The only way to have a completely > secure computer is to encase it in concrete, cut any network connections, > and drop it into the ocean; OTOH the only thing you have created in this > case is a fairly unique boat anchor. You are beginning to sound like > the people who claim that the NSA can crack any encryption system, not > because they have any proof but just because they extrapolate their > limited knowledge into the unknown and mix in a bit of paranoia. No, my point is that it doesn't really help to strengthen something which is not the weakest link in the chain. My rationale for having a short key is that it more accurately reflects my estimate of the degree of security provided by my remailer. Actually probably an even shorter length than 510 bits would be appropriate, maybe something more like 300 or 400 bits. Going to a 1000 bit key would probably mislead people into thinking that they only way an attacker could trace their message would be by using a zillion mips-years of computing power or something. > >Recall that my original comments were in connection with the claim that > >the government was running most of the remailers. As I said, I still > >think that is absurd when it would be so much easier to simply steal > >their keys. > > But the point is that it is _not_ easier to steal the keys. It is > much easier to put up a remailer than to attack an existing remailer, > this is why the remailer system is winning the battle of security > economics. By putting up its own remailers a potential attacker > probabalistically diminishes the number of systems which they must > break. > > jim Yes, I think I misstated my point here. My real point was that large keys are inappropriate. Maybe you are right that it is easier to start up a remailer than to break one. On the other hand, unless you also break the ones you don't run, you (as a LEA) are not in a position to accomplish your presumed goal, which is to track criminal messages to their source. So in practice I think they would try to break remailers, and again I am sure they will not do so by factoring keys, even for mine. It's also my personal impression that remailers are not mostly run by LEA's, just on the basis of the occasional postings I have seen by remailer operators here. Frankly I doubt that remailers are enough of a problem to be worth the effort on the part of a LEA to run one and deal with all of the hassles. But this may change in the future. Hal

1 0