December 2003 - cypherpunks-legacy

Magic Money vulnerabilities?
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- People have mentioned possible attacks against Magic Money. I don't think it is possible to send the server a value to sign which would reveal the server's secret key. The server signs your message x by raising x to the power d. If you know x^d and x, finding d would seem to be a discrete-logarithm problem, which is just as intractible as factoring. Can a small or otherwise rigged x help you to find d? If so, participating in any blind signature protocol is very dangerous, but I don't think that you can find d this way. wcs(a)anchor.ho.att.com wrote: (some deleted) (attack 1) >One security hole in online digicash systems of the Chaum variety is >that you _do_ need to make sure the money is only transmitted in >encrypted forms not susceptible to playback attacks. >If Eve can read the cash either before Bob gets it or before Bob's >message gets from his fast LAN across the slow part of the net >to the bank, then she can occasionally spend it before Bob can. (attack 2) >If Eve stomps on the Account-number bits, even though she can't >break the encryption to substitute her account number for Bob's, >she can substitute a random account number for Bob's. >This acts as a denial-of-service attack against Bob. >As a defense, either the message has to contain signatures or at least >MACs for validation, and be rejected if invalid, or the format >needs to make it impossible to find the account number field >or to modify it without trashing the cash as well. Magic Money is not susceptible to the first (intercept) attack, because the coins are encrypted with the server's public key. The reply is also encrypted with a response key sent to the server inside the encrypted packet. The server signs its responses, so you couldn't send someone some bogus coins and then fake the server's response to fool the person into believing that the coins were good. Magic Money has no account numbers; the server just exchanges old coins for new coins immediately. A version of the second attack is a problem. The message from the user to the server has no authentication. It is just an encrypted PGP message to the server. There is an RSA packet and an IDEA packet, and the data is directly inside the IDEA packet. If you were to dearmor the message and garble something near the end, then re-armor it, the server would bounce the garbled coins with a bad signature. Some of the first coins would already have been cancelled, and their value would be lost. To prevent this, the next version will MD5 the data packet before encrypting it, and include the MD5 value. This will be checked, and if it is bad, the message will be thrown out before processing any of the coins. This is not a pressing problem. Who would go to all the trouble to make a remailer detect and corrupt certain messages? The person doing the corrupting would not have anything to gain. A while ago I read of a program in alpha-test called Nautilus. This was specifically designed to compress speech for modem transmission. The author said that the beta, when it was ready, would be Copylefted. PGP Tools, if combined with Nautilus, has everything you need to do a secure phone. With the Clipper push, we need one badly, and now. It should use PGP keys for authentication, but either DH or a one-shot RSA key for key exchange. That way they can't record the session and demand your key later, as they could if you used your regular PGP key for the key exchange. Pr0duct Cypher -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLVSdtMGoFIWXVYodAQHC9AQApMjaIF2+h0k6Zb2YSwjkFL1/zAgCXJU+ Dm+kS0us9kusKMc2wr2pc4cEzQow9apM/Od2CisXAaRtHZNUyE8tN3mYWEPxAdcd 6qG03ZekvTqQB+do2HBGRAH3KXGscPIDCyjuh9iIKp9bB7/GWLNoAYm7fPjxpIYz gnWTuRyBme4= =wOox -----END PGP SIGNATURE-----

1 0

Government Policy makes Internet breakins easier
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Newsgroups: comp.org.eff.talk,comp.security.misc,talk.politics.crypto,alt.security,alt.activism Subject: Government Encryption Policies Simplify Internet Break-ins Distribution: [Sure would be nice if the EFF or CPSR would put out a press release along these lines. Anybody?] The news from the Information Superhighway hasn't been good this week. Major breakins have been occurring from someone who's been stealing users' passwords as they log in across the net, using them to break into their machines, and using their machines to watch the net for more passwords. It's not really that hard to stop - encryption technology has been available for several years that sends passwords across the net in encrypted form the eavesdroppers can't use - but most people haven't deployed encryption. Why not? Well, part of it's just laziness, but in large part the use of encryption has been restricted by the government's Cold War era policies against developing, using, or distributing encryption software. Encryption is the mathematical privacy coding that lets people send their passwords and conversations privately. If you want to sell encryption software overseas, you have to get a munitions export license, just as you would for exporting assault rifles or nuclear weapon parts, and they'll only give you a license for crippled software that the NSA can break easily, unless you're a bank or selling to a "friendly" government's military. If you want to sell encryption software in the US, you can't export it, which means you have to sell separate US and export versions. And if you want to give it away free, like lots of university and public domain software, you can't just post it to the net or make it available for ftp (the Internet version of the public library), without risking years in jail or at least having your computers confiscated while the government tries to decide whether to indict you - and you'd better be able to afford some *very* good lawyers. Can this sort of free speech really be illegal? Nobody's really sure, the government won't give you permission and few people want to risk the jail time to find out if they'll give you forgiveness. Meanwhile, most computer systems have simple password systems that can't protect against wiretappers. It's especially a problem on international long-distance circuits, where the connections are more exposed, because export rules say your business can't ship it the package you use on your US computers to your foreign branches. The Clinton Administration has announced that they're going to relax the export rules a bit, if you use their new Escrow Encryption Chip (which has built-in wiretapping capabilities) or simple encryption systems with short, easy-to-guess keys. The paperwork will be simpler, and you won't need an arms dealer license to carry your cellular phone or laptop computer on a business trip, but the NSA still retains control over what technology you can use. Proposed legislation in Congress would transfer control of crypto exports to the Commerce Department, which handles most other export licensing. Without the Communist Party to kick around, U.S. Administration press releases bring up spectres of drug dealers, terrorists, and pornographers, but some of the major applications for the wiretapping capabilities of the new Escrow Chip appear to be financial transactions and tax evasion, since banks will need to replace their current encryption systems with something newer, as faster generations of computer technology will make the present systems insecure over the next 5-10 years. Because the Escrow Chip is a hardware-only approach, it's adequate for automatic teller machines, but you'd need to buy a government encryption module if you want to do your banking over the Information Superhighway - more secure encryption can be done cheaply, in software, but the NSA's 55 mph speed limit won't let you - for now. On the other hand, the Cold War's over and you can get good encryption software from Finland, Moscow, Bulgaria, Switzerland, or Australia, often free, and it's becoming widely used by political activists in post-Communist countries. --------- The preceding has been the personal opinion of Bill Stewart, and does not necessarily represent the views of the EFF, CPSR, Cypherpunks, or my employer, but I'll be happy to have my rhetoric stolen :-) --------- Bill Stewart billstewart(a)attmail.com

1 0

signoff list
by BOBES_PIERRE＠delphi.com 17 Dec '03

17 Dec '03

Pleas remove me from the list bob

1 0

For Pr0duct Cypher
by nobody＠jarthur.Claremont.EDU 17 Dec '03

17 Dec '03

1 0

A Nice Summary of Motives for Clipper
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

This fellow has written a nice summary of the "carrot and stick" motivations on Clipper. Nothing we haven't seen discussed, but a nice synopsis. His analysis is accurate: - the government will make Clipper use very easy to export, and to use (perhaps by subsidizing production costs of the MYK-xx chip for some time) - the government will make non-Clipper use very hard to export, may harrass those who post code to ftp sites (a la PGP, Moby Crypt, etc.), and will do other things to throw roadblocks up - the result will probably be that in 5 years mosts crypto use is of the key escrow sort, with all that that implies Comment from TCM: Yes, we've "already won" in some sense, in that strong crypto can't be completely eliminated. But if 99% of all crypto users are using key escrow in 1999, for practical reasons, then in some sense we have lost. I'm curious about what RSA Data Security Inc. thinks of all this, as this carrot-and-stick move worsens the export situation immmensely: key escrow technologies get a "pass," while non key escrow technologies get scrutinized, delayed, and generally told not to bother to try to export (this is my interpretation). Could be real bad news for Bidzos and Company. (Don't flame me for urging an alliance with RSADSI! I'm just speculating on who will be hit hard here. Could have some implications for what Cypherpunks support.) Here's the article: Newsgroups: alt.activism,alt.politics.datahighway,alt.privacy,alt.privacy.clipper,alt.security.pgp,alt.wired,comp.org.eff.talk,talk.politics.crypto From: shephard(a)fraser.sfu.ca (Gordon Shephard) Subject: Re: CRYPTO: DoJ's new rules for access to Clipper keys Message-ID: <shephard.760538361(a)sfu.ca> Sender: news(a)sfu.ca (seymour news) Organization: Simon Fraser University, Burnaby, B.C., Canada Distribution: inet Date: Sun, 6 Feb 1994 12:39:21 GMT Lines: 107 strnlght(a)netcom.com (David Sternlight) writes: >You still don't get it. Clipper is a system for the private sector with good >security except for the escrow. The escrow is there to prevent the bad guys >from using what would otherwise be a very hard to break system. This reveals some of the mindset behind Government encryption policy. For the past year or so, I've been discussing the "Clipper Concept", and have constantly bewildered myself and others with the question: Why on earth would the black hats use a system which can be compromised by law enforcement agencies? The conclusion which we normally came to was that after the introduction of Clipper technology, the United States Government would work towards making it illegal for cryptographic systems other than Clipper (or some other Government controlled Key Escrow system) to be sold or produced in the United States. Now, Mr. Sternlight's view that Government is not attempting to prevent black hats from using non-clipper technology, and that they simply do not wish to allow criminals to use the Governments strong encryption system, contrasts somewhat with the current dialogue on the subject. And it makes sense - Clipper is going to dominate the market. We may all strut about and swear up and down how we will never use a cryptographic system which the Government can break, but, given that commerical providers will probably have huge incentives to develop clipper chip systems, (Govt. Contracts and such :) this is the system that you and I will probably be purchasing. A careful re-reading of the Press Releases provides supporting evidence. In particular, the administration will allow export of key escrow technologies, and their new policies will result in: - expedited delivery of products - reduced shipping and reporting costs - fewer individual licenses - personal exemptions for the use of encryption technology taken out of the country by business persons. The administration is going to also work with industry, with the NIST leading these efforts. Mention was made of money being tossed into this effort (Staff will be hired....) So, that's the carrot, now for the stick: "The Administration will continue to restrict export of the most sophisticated encryption devices." So, picture in your mind a Company such as AT&T, or U.S. Robotics, that is about to start selling an encrypting modem/telephone: They can either provide to Joe Public a Key Escrow technology, or they can put together their own proprietary encryption system. The Key Escrow technology system can be sold to the U.S. Government (Big Bucks, How much would you like to bet that in the next 3 or 4 years, numerous government departments will be allocated large sums of money to purchase encryption devices, regardless of whether they need it or not - The press releases reveal that All Govt. Purchases will be Key Escrow - Never underestimate the impact of Government contracts) The Key Escrow technology system will be free of Red Tape, can be exported, will not require individual licensing for each country, can be taken out of the country by business persons (The vast majority of which could care less whether the Govt. can crack their communications, it's the competition they are concerned about), etc, etc.... Or, they can create a proprietary system and face the mother of all red tape trying to sell the damn thing (At a significantly increased cost.) The Result: 1) Commerical Companies will not produce Non Key Escrow Technology. 2) The few that do, will have their lives made so difficult by the Administration, it will be difficult to find their product. And this is an issue that Nobody seems to discuss: Encryption is only useful if BOTH ends of the communciation line are using the same encryption technology. Who will you be able to talk to if you are using a proprietary encryption system. (A technically alert member of the press should ask the following question: Will the administration seek to prevent encryption systems which incorporate the clipper chip from having secondary encryption technolgies embedded (I.E. Imagine if the modem you manufactured could only talk V.32terbo, and not V.32/V.32bis - Nobody would buy it because everyone else has a V.32bis modem. ) And here is where the Government may have made a strategic error though; by not revealing their encryption algorithm, they may have opened up a market for people who are concerned about the strength of the encryption algorithm. E.G. AT&T can come along and market their encrypting telephones with multiple levels of security, standard "Clipper" encryption, or new and improved AT&T laboratory technology which has been attacked by every encryption researcher on the planet. Of course this device would still face the Red tape which the government will be using as its primary weapon against non key escrow technology in the coming years. You heard it here first. (Well, maybe not. Anyone hear how the Government has been treating PGP lately? :) | Gordon Harry Shephard, shephard(a)sfu.ca,(message)252-4387, (res)524-8622 | In No Way am I speaking for my Employers or Simon Fraser University. --

2 1

Re: CypherPUNKS. Not!
by qwerty-remailer＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Anthony Garcia wrote, "> Get Off the Internet and Write Us a Real Encryptor. Get a copy of Schneier's "Applied Crypto" and write it yourself. Don't expect other people to provide encryption technology for you, because they probably won't." You sadly misunderstand. "Us" means US. All of us. Humanity. You also didn't understand the point of the Dead Kennedy's "Anarchy For Sale." Fortunately Phil Zimmerman and a few others do, and hopefully they will also give PGP a "random data block" format output. If we (all of us using PGP on this planet), don't get PGP off the internet and into the hands of MOST Mac and Windows users, as well as in hardware form in devices like phones, then as the last song I quoted said, "You'll (Cypherpunk activists) be the first to go." I don't code. I make molecules, and soon I will be using standing waves made by lasers to deposit atoms on surfaces, working at Harvard, Bell Labs, and NIST to help develop the next next generation of CPUs, sensors and other devices. If you want something to write code for, 10 years from now, don't disrespect those who do sciences other than programming. Your answer is what the government WANTS the programmers to be like, like this: "You want bulk vitamin C powder which has been rumored to cure that new AIDS strain that started spreading by air? Well that wouldn't make me or anyone else any cash, and since the FDA has banned vitamin supplements, you better go pick up a book on synthesis. I think you start with glucose. Oh, and include organometallics, since it's only certain mixed oxidation state Copper complex dimers that seems to work. Fairly complex stuff. Hurry up though, I hear that AIDS (Clipper) virus kicks in pretty fast! But don't expect chemists to give you any, well since you see, that would be altruistic and that is not logical, since my value system is selfishness. As long as I can cure myself, and you aren't paying me large sums, well, bye bye." And making PGP better and posting it anonymously or not, is no where as illegal as if I were to offer an unapproved medicinal to patients in need, something that would immediately put me in handcuffs. Happily, drugs that are truly effective become available to terminal patients, since of course that makes money. I'm going into crystal and surface chemistry anyway, and the FDA seems to be failing in its ongoing attempts to take away my legal vitamin C powder. I fear though that they may succeed in 10 years, and the Clipper's going to send my e-mail into the FDA's "bad guy" files, as being a person who takes more vitamin C than can be found in a can of Coca Cola. I just want privacy and to be left alone. And research funds ;-). -=Xenon=- -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLVT86QSzG6zrQn1RAQGNgwP/YONeGygK20IMXXL96hgu6MKDqZToslzK BLgaWOYAvCz9e48aR6AemamQ3R7Dm9ZdqTyf2QIIgV/2VliARX4+9ADBiS3BUtET Kck3gALq88weWfysdrxkc433b+sP9s28GOdMK2sHAjWaf9PImmoeqsaVBaAi9DzN rTMRSKnp6ko= =JKEA -----END PGP SIGNATURE-----

1 0

a reference to STS
by hughes＠ah.com 17 Dec '03

17 Dec '03

Here's the reference for the STS paper. STS is the Station-to-Station protocol. _Authentication and Authenticated Key Exchanges_ by Diffie, Oorschot, Wiener _Designs, Codes and Cryptography 2_, pp 107-125 1992 Eric

1 0

No Subject
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

I'm moving to Oceania.

4 3

Fwd: More on remailers
by Matthew J Ghio 17 Dec '03

17 Dec '03

Does anyone know what this is??? ---------- Return-path: <genie-postmaster(a)geis.com> Received: from po2.andrew.cmu.edu via trymail ID </afs/andrew.cmu.edu/usr12/mg5n/Mailbox/UhJJW=O00UdaEa=k5z>; Sun, 6 Feb 1994 15:52:27 -0500 (EST) Received: from relay2.geis.com (relay2.geis.com [192.77.188.3]) by po2.andrew.cmu.edu (8.6.4/8.6.4) with SMTP id PAA09729 for <mg5n+(a)andrew.cmu.edu>; Sun, 6 Feb 1994 15:51:36 -0500 From: genie-postmaster(a)geis.com Received: by relay2.geis.com (1.37.109.4/15.6) id AA26116; Sun, 6 Feb 94 20:51:28 GMT Message-Id: <9402062051.AA26116(a)relay2.geis.com> Date: Fri, 4 Feb 94 00:51:00 BST To: mg5n+(a)andrew.cmu.edu Subject: More on remailers Original Msg Id: Not Found genie-postmaster response to your message Subject: More on remailers System: QUIK-COMM Date: Fri 4-Feb-94 0:51 Status: 5 Message picked up by receiving system and delivered to all recipients with NO exceptions. ----------

1 0

TEMPEST - Electronic eavesdropping
by R.O.Jackson-SE1＠computer-science.birmingham.ac.uk 17 Dec '03

17 Dec '03

Transient Electromagnetic Pulse Emanation Standard (TEMPEST) is the US standard defining the amount of electromagnetic radiation that a device may emit without compromising the information it is processing. In the US it not illegal to posess TEMPEST-surveillance equipment but it is illegal to take appropriate counter-measures to prevent surveillance. The US government has refused to release details of its TEMPEST research and has restricted the dissemination of independent research by classifying it. The US Drug Enforcement Agency (DEA) makes use of TEMPEST secured electronics and computers as they believe that the drug cartels may possess surveillance equipment. I am interested in gathering comments on the social, legal, ethical, and technical aspects of use of TEMPEST surveillance equipment in the US and Europe with the aim of including it in a discussion of the threats to computer/digital systems. Please reply by E-mail. I will provide a summary to anybody who requests one. thanks, - Rob Jackson (more information on TEMPEST can be found in the paper "Eavesdropping On the Electromagnetic Emanations of Digital Equipment: The Laws of Canada, England, and the US" by Cristopher Seline - available on FTP from csrc.ncsl.nist.gov)

4 4