December 2003 - cypherpunks-legacy

Intel introduces new compression technology for surfers [CNN]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > > INTEL INTRODUCES TECHNOLOGY TO SURF THE WEB FASTER > > January 19, 1998 > Web posted at: 9:35 p.m. EST (0235 GMT) > > HILLSBORO, Oregon (AP) -- The World Wide Wait may be over. > > Computer chip giant Intel on Monday announced a way for Internet > surfers to download images twice as fast over regular phone lines > without any special equipment or software -- but it will add about > $5 to monthly access fees. > > The technology called Quick Web is installed on the computers called > servers that Internet services use to store and relay data. The > combination of Intel hardware and special software compresses all > the graphic images that are piped through the server, boosting > access speed. > > "The more pictures on the screen, the faster it is," said Dave > Preston, Internet marketing manager for Intel. > [text deleted] ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

6 7

Additional Source of Income
by B_Crawford49＠earthlink.net 17 Dec '03

17 Dec '03

<HTML><PRE> ************************************************************* Our Research Has Indicated That The Following Message Will Be Of Interest To You. ************************************************************* THE HOME WORKERS SURVIVAL GUIDE If you plan on finding legitimate work at home, you need this book! Years of experience and thousands of hours of research have gone into "The Home Workers Survival Guide". There is no better source of information on at-home income opportunities. Use our listings to contact the right companies and you can start to receive weekly checks up to $1000! Please read on so you can get started right away! Get Your First Check in as Little as a Week! Hi, my name is Brian Crawford, and I have tried just about every work- at-home opportunity out there, from stuffing envelopes to assembling miniatures. Most of them turned out to be nothing more than a waste of time and money. However, among all the scams and rip-offs, I did come across many legitimate companies willing to pay for my services. I started to think, "Why doesn't someone just keep track of all the honest companies so that no one else would need to get ripped off when trying to find a decent work-at-home job?" I decided to do just that. Throw Away That Junk Mail! See, the reason most of us encounter problems is because we usually look for these jobs by responding to junk mail. Let me ask you, when was the last time an employer sent you a job offering in the mail? Probably never! You had to look for the job yourself, and it is exactly the same with work-at-home positions. The companies are out there, but you need to look for them. That is where my book "The Home Workers Survival Guide" really comes in handy. Over 200 Companies Waiting to Hear from You! In chapter three, you will find page after page of job listings for all kinds of work. Find something you like, and then contact them at the address listed. You could be on your way to a great paying at-home job for the cost of a stamp. Never send in $20-$30 for a bogus "processing fee" again! Anyone in the U.S. can work- no one is refused. What Do You Like To Do? What kind of work are you looking for? It's all here! -Sewing baby clothing -Building doll houses -Crafts of every kind -Assembling holiday decorations -Painting -Circular Mailing -Food/game/software testers -Baking (Yes, get paid to cook!) -Health products/food/jewelery -Plus many, many more opportunities including distributorships and sales All of these opportunities are available to anyone- no experience is needed. Just contact the listing that interests you and you can get started right away. These companies offer legitimate work and will be happy to send you full information before you make a decision. Watch Out For Scams! Chapter four will let you in on some of the most common work-at home scams. Make sure you read this. If you come across something that sounds too good to be true, remember- it probably is. Here are just two quick examples of information found in this chapter. 1. "Assemble Miniatures" If a company requires a large deposit or registration fee to get started but promises great pay, be careful. Most legitimate companies will charge only a small fee for the supplies they send you, and wil pay you a reasonable amount as well. After sending in a large payment, you may find that the company will call your finished work "inferior" and refuse to pay you. They were only after your registraion fee, and probably never intended on paying you. 2. "Stuff Envelopes" Nobody is going to pay you a dollar or even 50 cents to stuff an envelope. There are machines that can stuff thousands of envelopes a day for only pennies. What these companies should really tell you is that you will be mailing junk advertisements for them. They expect you to place an ad in your local newspaper offering "Home Workers Needed". You only get the "dollar per envelope" when people actually reply to this ad! Are They All Bogus? Like I said before, there are a lot of dishonest companies out there looking to take your money, but not all of them are like that. We list over 40 companies offering assembly work, from toys to clothes to weaving rattan. Choose the kind of work you like and write to the companies who offer it. Ask them any questions you have BEFORE you send in any money or buy any supplies. There are also several companies out there that will pay you a substantial commission for mailing their advertisements, and you won't have to pay them anything to be able to do it, just contact them and ask! Need Cash Fast? 48 Hours Soon Enough? When you get the book, look over the many excellent opportunities. Each listing includes a brief description of what is offered. Write to the companies you like and request an application form. They have openings right now, and they'll be happy to get you started. You can begin to make money even faster if you choose one of the programs or plans that the book describes in detail. I'll tell you everything you need to know to get started. By taking a few simple steps, you can already be making money just 48 hours after you receive the book. How Much Is This Going To Cost Me? "The Home Workers Survival Guide" costs just $29.95 plus $3.00 pastage and handling. I'm so sure this book will help you find legitimate work that I am backing it by an unconditional guarantee. If for ANY reason you do not feel the book helped you earn enough extra income, simply return it for a full refund, including postage and tax. What's better is that this rock-solid guarantee is good for two full months, which allows you to really look it over and check out the opportunities. You deserve to feel the joy of getting huge weekly paychecks. Please complete the order form and mail it today. Everything will be rushed to you by first class mail. Sincerely, Brian Crawford P.S. I've just added some great new information to the book. Some people are already making as much as $3000 a week with a new program that lets them work in the comfort of their own home. It costs nothing to get started and anyone can do it. It's like nothing I have ever seen before, and it is sure to make people a lot of money. Details will be rushed to you along with your book order. Please Print and Mail This Order Form to: cut here ------------------------------------------------------------------------------------------------- ANP #MP11 c/o Brian Crawford P.O. Box 712102 Santee, CA 92072-2102 ( ) Yes, I would love to get started immediately. Please rush me "The Home Workers Survival Guide" under your unlimited two month guarantee. Enclosed is $29.95 plus $3.00 shipping and handling.* $32.95 total. *Checks may be made payable to ANP Name____________________________________________ Address___________________________________________ City, State, Zip_____________________________________ Internal Code [E8SB(c)120] ------------------------------------------------------------------------------------------------- cut here

1 0

Re: (eternity) Eternity as a secure filesystem/backup medium (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sun, 18 Jan 1998 22:00:24 -0800 > From: Bill Stewart <bill.stewart(a)pobox.com> > Subject: Re: (eternity) Eternity as a secure filesystem/backup medium > (fwd) > Assume the existence of a for-profit service provider. > The service provider needs to cover the costs of the service, Which in general are a flat rate. I'll try to fill in the various issues you raise with as real-world numbers as I can get. > plus enough profit to make the effort interesting. > The prices charged need to reflect the costs (or be higher) > or the service provider can't make money and goes out of business. > So what are the costs, and who can be talked into paying for them? Everyone who uses the system. The question is who do we want to define as 'using'. I believe the provider of information is not 'using' the system in the strictest sense but rather making an investment of their time and effort in somebodies elses business model and hoping that work will bring them profit. > 1) Storage of information - Storage currently costs < $1/MB for raw disk, > and getting cheaper by the minute, Assuming your 5 year plan, a 1G drive costs $100 or less. That's roughly $20/G-yr. > but sysadmins, lawyers, etc. > cost money and they're not getting cheaper as fast. Granted, but except for the sys-admin you don't need them often. In all the years I have been in business I've needed a lawyer only a couple of times. Say $1k/lawyer-year. > The costs of the equipment for permanent storage are probably about > 10-50% more than the costs for storing for 5 years; A Cyrix P200 runs about $600 for a working box (I bought one just a few weeks ago). So that gives us about $120/cpu-year. > the costs of administration (assuming inflation is limited to > some small number) can be covered by an annuity. For reliable system administartion you're looking at 5 people (3 8-hr. shifts plus weekend coverage of 2 12 hour shifts). A sys admin with the skills and maturity to work in this environment is going to run you in the neighborhood of $40-60k/yr. So this means we're looking at, on the outside, $300k/sysadmin-yr. This is the real cost of doing business. > Every technology upgrade or two you need to copy the archives to > new storage media, and data that doesn't get accessed often may > get migrated out to slower or perhaps even offline media; > storage contracts need to reflect that retrieving data that hasn't > been accessed in a while may involve some delay. Not shure what the normal ratio for online versus offline storage actualy is currently, say 10:1. > 2) Transmission of information - Roughly proportional to MB/time - This seems overly simplistic to me. The actual cost of the bandwidth is reasonably fixed for a given site. Also if we throw in the other servers this model becomes a bit more flexible. Remember, under the Eternity model we don't know *which* server is being hit for the request. This means we have to consider the actual end user costs in a much more complicated fashion. It's one of the issue I'm working on myself. It does not seem clear cut nor well researched at all. > unlike storage, this one's not predictable, unless the provider and > author agree in advance (e.g. N free accesses per year, per password.) > So the provider could charge the reader for access, I fail to see the profit in giving away plans for man portable nukes or to turn commen cooking yeast into a THC producing horde when the various groups around the world would pay so many millions (or would that be billions) for some to get it and some to keep others from getting it. The potential for a access auction hasn't been explored as far as I am aware. > or use advertising > banners to fund retrieval costs (if that remains a valid model > for financing the web over the next N years, especially if the > readers retrieve data through anonymizers.) I believe advertising would be a necessity. The question is how. Would the payoff for doing a print ad in a magazine be worth it? Should it only be advertised on the net? > 3) Legal defense - This one's harder to predict :-) If the Eternity model works the question becomes which one and where are they located? Whose legal defense? Which jurisdiction? Put up an offer for 1 weeks notice of any pending legal actions against the network and make it worth the while. Say $500M. It would of course be fully anonymous and the information would have to be testable prior to payout. Leaves two option. First, the data is verified and the source is paid. Second, the server goes down and the source isn't paid - thus ruining the reputation of a server. It isn't clear to me what the total impact would be on the network as a whole. One way to mediate this impact on a given server would be to share the cost of the payout between the various servers. It is after all in all the servers best interest to keep as many going unharrassed and as well prepared and for-warned as possible. > The current US climate is that service providers are relatively immune > as long as they cooperate with subpoenas and court orders, True, but the current model doesn't allow anonymous providers as the norm either. The users may be anonymous but the ISP isn't. > If they want their names known, they can include them in the contents > of the data that readers retrieve, independent of what the server does. Then there is no reason to use an anonymous network, simply put the data on their own webpage and sell it direct, cut out the middle-man a tried and true business tactic. > and accumulate reputation capital under those nyms. One of the assumptions is that the source, individual server, and sink are all anonymous to each other as well as Mallet. Now we're changing the rules of the game in the middle of the game. Apples and oranges. If I were actualy going to impliment something like this I wouldn't even consider it unless I had at least $500k worth of funding for each of the first 5 years. That start up cost, $2.5M, is what is going to kill it. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

[Long] How to recover private keys for various Microsoft products
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

How to recover private keys for Microsoft Internet Explorer, Internet Information Server, Outlook Express, and many others - or - Where do your encryption keys want to go today? Peter Gutmann, <pgut001(a)cs.auckland.ac.nz> Summary ------- Microsoft uses two different file formats to protect users private keys, the original (unnamed) format which was used in older versions of MSIE, IIS, and other software and which is still supported for backwards-compatibility reasons in newer versions, and the newer PFX/PKCS #12 format. Due to a number of design and implementation flaws in Microsofts software, it is possible to break the security of both of these formats and recover users private keys, often in a matter of seconds. In addition, a major security hole in Microsofts CryptoAPI means that many keys can be recovered without even needing to break the encryption. These attacks do not rely for their success on the presence of weak, US-exportable encryption, they also affect US versions. As a result of these flaws, no Microsoft internet product is capable of protecting a users keys from hostile attack. By combining the attacks described below with widely-publicised bugs in MSIE which allow hostile sites to read the contents of users hard drives or with an ActiveX control, a victim can have their private key sucked off their machine and the encryption which "protects" it broken at a remote site without their knowledge. Once an attacker has obtained a users private key in this manner, they have effectively stolen their (digitial) identity, and can use it to digitally sign contracts and agreements, to recover every encryption session key it's ever protected in the past and will ever protect in the future, to access private and confidential email, and so on and so on. The ease with which this attack can be carried out represents a critical weakness which compromises all other encryption components on web servers and browsers - once the private key is compromised, all security services which depend on it are also compromised. A really clever attacker might even do the following: - Use (say) an MSIE bug to steal someones ActiveX code signing key. - Decrypt it using one of the attacks described below. - Use it to sign an ActiveX control which steals other peoples keys. - Put it on a web page and wait. On the remote chance that the ActiveX control is discovered (which is extremely unlikely, since it runs and deletes itself almost instantly, and can't be stopped even with the highest "security" setting in MSIE), the attack will be blamed on the person the key was stolen from rather than the real attacker. This demonstrates major problems in both Microsoft's private key security (an attacker can decrypt, and therefore misuse, your private key), and ActiveX security (an attacker can create an effectively unstoppable malicious ActiveX control and, on the remote chance that it's ever discovered, ensure that someone else takes the blame). Background ---------- About a year ago I posted an article on how to break Netscape's (then) server key encryption to the cypherpunks list (Netscape corrected this problem at about the same time as I posted the article). However more than a year after the code was published, and 2 1/2 years after a similar problem with Windows .PWL file encryption was publicised, Microsoft are still using exactly the same weak, easily-broken data format to "protect" users private keys. To break this format I simply dusted off my year-old software, changed the "Netscape" strings to "Microsoft", and had an encryption-breaker which would recover most private keys "protected" with this format in a matter of seconds. In addition to the older format, newer Microsoft products also support the PKCS #12 format (which they originally called PFX), which Microsoft render as useless as the older format by employing the RC2 cipher with a 40-bit key. In a truly egalitarian manner, this same level of "security" is used worldwide, ensuring that even US users get no security whatsoever when storing their private keys. However even RC2/40 can take awhile to break (the exact definition of "a while" depends on how much computing power you have available, for most non-funded attackers it ranges from a few hours to a few days). Fortunately, there are enough design flaws in PKCS #12 and bugs in Microsofts implementation to ensure that we can ignore the encryption key size. This has the useful - to an attacker - side-effect that even if Microsoft switch to using RC2/128 or triple DES for the encryption, it doesn't make the attackers task any more difficult. By combining the code to break the PKCS #12 format with the code mentioned above which breaks the older format, we obtain a single program which, when run on either type of key file, should be able to recover the users private keys from most files in a matter of seconds. A (somewhat limited) example of this type of program is available in source code form from http://www.cs.auckland.ac.nz/~pgut001/pubs/breakms.c. Because it's meant as a proof-of-concept program it's somewhat crude, and restricted to recovering passwords which are single dictionary words. Note: This does not mean that using (say) two words as a password instead of one will protect your private key. All it means is that I haven't bothered to write anything more sophisticated - no doubt anyone who was serious about this could adapt something like cracklib's password-generation rules and routines to provide a more comprehensive and powerful type of attack. Similarly, by making trivial changes to the key file data format it's possible to fool the program until someone makes an equally trivial change to the program to track the format change - this is meant as a demonstrator only, not a do-everything encryption breaker. To use the program, compile and invoke it with: breakms <Microsoft key file> <word list file> Here's what the output should look like (some of the lines have been trimmed a bit): File is a PFX/PKCS #12 key file. Encrypted data is 1048 bytes long. The password which was used to encrypt this Microsoft PFX/PKCS #12 file is 'orthogonality'. Modulus = 00BB6FE79432CC6EA2D8F970675A5A87BFBE1AFF0BE63E879F2AFFB93644D [...] Public exponent = 010001 Private exponent = 6F05EAD2F27FFAEC84BEC360C4B928FD5F3A9865D0FCAAD291E2 [...] Prime 1 = 00F3929B9435608F8A22C208D86795271D54EBDFB09DDEF539AB083DA912D [...] Prime 2 = 00C50016F89DFF2561347ED1186A46E150E28BF2D0F539A1594BBD7FE4674 [...] Exponent 1 = 009E7D4326C924AFC1DEA40B45650134966D6F9DFA3A7F9D698CD4ABEA [...] Exponent 2 = 00BA84003BB95355AFB7C50DF140C60513D0BA51D637272E355E397779 [...] Coefficient = 30B9E4F2AFA5AC679F920FC83F1F2DF1BAF1779CF989447FABC2F5628 [...] Someone sent me a test Microsoft key they had created with MSIE 3.0 and the program took just a few seconds to recover the password used to encrypt the file. One excuse offered by Microsoft is that Windows NT has access control lists (ACL's) for files which can be used to protect against this attacks and the one described below. However this isn't notably useful: Most users will be running Windows '95 which doesn't have ACL's, of the small remainder using NT most won't bother setting the ACL's, and in any case since the attack is coming from software running as the current user (who has full access to the file), the ACL's have no effect. The ACL issue is merely a red herring, and offers no further protection. Further Attacks (information provided by Steve Henson <shenson(a)bigfoot.com>) --------------- There is a further attack possible which works because Microsoft's security products rely on the presence of the Microsoft CryptoAPI, which has a wonderful function called CryptExportKey(). This function hands over a users private key to anyone who asks for it. The key is encrypted under the current user, so any other program running under the user can obtain their private key with a single function call. For example an ActiveX control on a web page could ask for the current users key, ship it out to a remote site, and then delete itself from the system leaving no trace of what happened, a bit like the mail.exe program I wrote about 2 years ago which did the same thing for Windows passwords. If the control is signed, there's no way to stop it from running even with the highest security level selected in MSIE, and since it immediately erases all traces of its existence the code signing is worthless. Newer versions of the CryptoAPI which come with MSIE 4 allow the user to set a flag (CRYPT_USER_PROTECTED) which specifies that the key export function should be protected with no protection (the default), user notification, or password protection. However the way this is implemented makes it pretty much useless. Firstly, if the certificate request script used to generate the key doesn't set this flag, you end up with the default of "no protection" (and the majority of users will just use the default of "no protection" anyway). Although Microsoft claim that "reputable CA's won't forget to set this flag", a number of CA's tested (including Verisign) don't bother to set it (does this mean that Microsoft regard Verisign as a disreputable CA? :-). Because of this, they don't even provide the user with the option of selecting something other than "no security whatsoever". In addition at least one version of CryptoAPI would allow the "user notification" level of security to be bypassed by deleting the notification dialog resource from memory so that the call would quietly fail and the key would be exported anyway (this is fairly tricky to do and involves playing with the CPU's page protection mechanism, there are easier ways to get the key than this). Finally, the "password protection" level of security asks for the password a whopping 16 (yes, *sixteen*) times when exporting the key, even though it only needs to do this once. After about the fifth time the user will probably click on the "remember password" box, moving them back to zero security until they reboot the machine and clear the setting, since the key will be exported with no notification or password check once the box is clicked. To check which level of security you have, try exporting your key certificate. If there's no warning/password dialog, you have zero security for your key, and don't even need to use the encryption-breaking technique I describe elsewhere in this article. Any web page you browse could be stealing your key (through an embedded ActiveX control) without you ever being aware of it. Details on Breaking the Older Format ------------------------------------ The Microsoft key format is very susceptible to both a dictionary attack and to keystream recovery. It uses the PKCS #8 format for private keys, which provides a large amount of known plaintext at the start of the data, in combination with RC4 without any form of IV or other preprocessing (even though PKCS #8 recommends that PKCS #5 password-based encryption be used), which means you can recover the first 100-odd bytes of key stream with a simple XOR (the same mistake they made with their .PWL files, which was publicised 2 1/2 years earlier). Although the password is hashed with MD5 (allowing them to claim the use of a 128-bit key), the way the key is applied provides almost no security. This means two things: 1. It's very simple to write a program to perform a dictionary attack on the server key (it originally took me about half an hour using cryptlib, http://www.cs.auckland.ac.nz/~pgut001/cryptlib/, another half hour to rip the appropriate code out of cryptlib to create a standalone program, and a few minutes to retarget the program from Netscape to Microsoft). 2. The recovered key stream from the encrypted server key can be used to decrypt any other resource encrypted with the server password, *without knowing the password*. This is because there's enough known plaintext (ASN.1 objects, object identifiers, and public key components) at the start of the encrypted data to recover large quantities of key stream. This means that even if you use a million-bit encryption key, an attacker can still recover at least the first 100 bytes of anything you encrypt without needing to know your key (Frank Stevenson's glide.exe program uses this to recover passwords from Windows .PWL files in a fraction of a second). The problem here is caused by a combination of the PKCS #8 format (which is rather nonoptimal for protecting private keys) and the use of RC4 to encryt fixed, known plaintext. Since everything is constant, you don't even need to run the password-transformation process more than once - just store a dictionary of the resulting key stream for each password in a database, and you can break the encryption with a single lookup (this would be avoided by the use of PKCS #5 password-based encryption, which iterates the key setup and uses a salt to make a precomputed dictionary attack impossible. PKCS #5 states that its primary intended application is for protecting private keys, but Microsoft (and Netscape) chose not to use this and went with straight RC4 encryption instead). This is exactly the same problem which came up with Microsoft's .PWL file encryption in 1995, and yet in the 2 1/2 years since I exposed this problem they still haven't learnt from their previous mistakes. For the curious (and ASN.1-aware), here's what the data formats look like. First there's the outer encapsulation which Microsoft use to wrap up the encrypted key: MicrosoftKey ::= SEQUENCE { identifier OCTET STRING ('private-key'), encryptedPrivateKeyInfo EncryptedPrivateKeyInfo } Inside this is a PKCS #8 private key: EncryptedPrivateKeyInfo ::= SEQUENCE { encryptionAlgorithm EncryptionAlgorithmIdentifier, encryptedData EncryptedData } EncryptionAlgorithmIdentifier ::= AlgorithmIdentifier EncryptedData = OCTET STRING Now the EncryptionAlgorithmIdentifier is supposed to be something like pbeWithMD5AndDES, with an associated 64-bit salt and iteration count, but Microsoft (and Netscape) ignored this and used straight rc4 with no salt or iteration count. The EncryptedData decrypts to: PrivateKeyInfo ::= SEQUENCE { version Version privateKeyAlgorithm PrivateKeyAlgorithmIdentifier privateKey PrivateKey attributes [ 0 ] IMPLICIT Attributes OPTIONAL } Version ::= INTEGER PrivateKeyAlgorithmIdentifier ::= AlgorithmIdentifier PrivateKey ::= OCTET STRING Attributes ::= SET OF Attribute (and so on and so on, I haven't bothered going down any further). One thing worth noting is that Microsoft encode the AlgorithmIdentifier incorrectly by omitting the parameters, these should be encoded as a NULL value if there are no parameters. In this they differ from Netscape, indicating that both companies managed to independently come up with the same broken key storage format. Wow. For people picking apart the inner key, Microsoft also encode their ASN.1 INTEGERs incorrectly, so you need to be aware of this when reading out the data. Details on Breaking the PFX/PKCS #12 Format ------------------------------------------- The PFX/PKCS #12 format is vastly more complex (and braindamaged) than the older format. You can find an overview of some of the bletcherousness in this format at http://www.cs.auckland.ac.nz/~pgut001/pfx.html. After Microsoft originally designed the format (calling it PFX) and presented it to the world as a fait accompli, cleanup crews from other companies rushed in and fixed some of the worst problems and security flaws. However by this time Microsoft had already shipped implementations which were based on the earlier version with all its flaws and holes, and didn't want to change their code any more. A side-effect of this was that to be compatible, other vendors had to copy Microsofts bugs rather than produce an implementation in accordance with the standard. Newer versions of the standard have now been amended to define the implementation bugs as a part of the standard. Anyway, as a result of this it's possible to mount three independant types of attack on Microsoft's PFX/PKCS #12 keys: 1. Attack the RC2/40 encryption used in all versions, even the US-only one. 2. Attack the MAC used to protect the entire file. Since the same password is used for the MAC and the encrypted key, recovering the MAC password also recovers the password used to encrypt the private key. The cleanup crews added a MAC iteration count to make this attack harder, but Microsoft ignored it. 3. Attack the private key encryption key directly. Like the MAC's, this also has an interation count. Microsoft don't use it. Even if one of these flaws is fixed, an attacker can simply switch over and concentrate on a different flaw. I decided to see which one could be implemented the most efficiently. Obviously (1) was out (you need to perform 2^39 RC2 key schedules on average to find the key), which left (2) and (3). With the refinements I'm about to describe, it turns out that an attack on the private key encryption is significantly more efficient than an attack on the MAC. To understand how the attack works, you need to look at how PKCS #12 does its key processing. The original PFX spec included only some very vague thoughts on how to do this. In later PKCS #12 versions this evolved into a somewhat garbled offshoot of the PKCS #5 and TLS key processing methods. To decrypt data which is "protected" using the PKCS #12 key processing, you need to do the following: construct a 64-byte "diversifier" (which differs depending on whether you want to set up a key or an IV) and hash it; stretch the salt out to 64 bytes and hash it after the diversifier hash; stretch the password out to 64 bytes (using incorrect processing of the text string, this is one of Microsofts implementation bugs which has now become enshrined in the standard) and hash it after the salt hash; complete the hash and return the resulting value as either the key or the IV, depending on the diversifier setting; (it's actually rather more complex than that, this is a stripped-down version which is equivalent to what Microsoft use). This process is carried out twice, once for the key and once for the IV. The hashing is performed using SHA-1, and each of the two invocations of the process require 4 passes through the SHA-1 compression function, for a total of 8 passes through the function. Because the PKCS #12 spec conveniently requires that all data be stretched out to 64 bytes, which happens to be the data block size for SHA-1, there's no need for the input processing which is usually required for SHA-1 so we can strip this code out and feed the data directly into the compression function. Thus the compression function (along with the RC2 key setup) is the limiting factor for the speed of an attack. Obviously we want to reduce the effort required as much as possible. As it turns out, we can eliminate 6 of the 8 passes, cutting our workload by 75%. First, we observe that the the diversifier is a constant value, so instead of setting it up and hashing it, we precompute the hash and store the hash value. This eliminates the diversifier, and one pass through SHA-1. Next, we observe that the salt never changes for the file being attacked, so again instead of setting it up and hashing it, we precompute the hash and store the hash value. This eliminates the diversifier, and another pass through SHA-1. Finally, all that's left is the password. This requires two passes through the compression function, one for the password (again conveniently stretched to 64 bytes) and a second one to wrap up the hashing. In theory we'd need to repeat this process twice, once to generate the decryption key and a second time to generate the decryption IV which is used to encrypt the data in CBC mode. However the start of the decrypted plaintext is: SEQUENCE { SEQUENCE { OBJECT IDENTIFIER, ... and the SEQUENCE is encoded as 30 82 xx xx (where xx xx are the length bytes). This means the first 8 bytes will be 30 82 xx xx 30 82 xx xx, and will be followed by the object identifier. We can therefore skip the first 8 bytes and, using them as the IV, decrypt the second 8 bytes and check for the object identifier. This eliminates the second PKCS #12 key initialisation call which is normally required to generate the IV. As this analysis (and the program) shows, Microsoft managed to design a "security" format in which you can eliminate 75% of the encryption processing work while still allowing an attack on the encrypted data. To make it even easier for an attacker, they then dumbed the key down to only 40 bits, even in the US-only version of the software. In fact this doesn't really have any effect on security, even if they used 128-bit RC2 or triple DES or whatever, it would provide no extra security thanks to the broken key processing.

5 5

Intel, MS, & Compaq to boost Inet access x30 w/ new modem [CNN]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > > REPORT: VENTURE PROMISES SPEEDIER INTERNET ACCESS > > Internet graphic January 20, 1998 > Web posted at: 9:21 a.m. EST (1421 GMT) > > NEW YORK (AP) -- Lightning-quick Internet access is in the works > under a reported new venture between three titans of the computer > industry and most local telephone companies. > > Executives at Intel, Compaq Computer and Microsoft said in The New > York Times on Tuesday that they want to develop a new type of > personal computer modem that would allow access to World Wide Web > pages at speeds 30 times faster than the usual several seconds to > minutes it now takes. > > Perhaps more important, the product would plug into normal telephone > lines, which would remain connected to the outside world. > Consequently, users would not need to dial a service and could > conduct normal voice conversations over the same line, the Times > said. > [text deleted] ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

China's New Net Regs
by John Young 17 Dec '03

17 Dec '03

Thanks to MK we offer the new Chinese net regulations as published by the US Embassy in Beijing: http://jya.com/cn-netreg.htm

1 0

Re: Your local phone company (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Hi, Ooops, I needed to do some editing that I missed....sorry for the confusion. > that base 4800 baud. Faxes get the 9600 because they use dual-tones, neither > of which is above the 4800. The problem with shoving more tones is that afer I should have changed all those 4800's to 1200's. I couldn't remember which one so I had picked one distinct from the example provided by ya'll and missed changing it to the correct value per the references. I got sloppy. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

No Subject
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

ISLAMABAD, Pakistan (AP) - In a fresh move to promote Islamic culture, Pakistan's TV censors have been busy. They have slashed footage of pop musicians sporting long hair and jeans. Male and female co-hosts of local television programs are no more. Scores of commercials and programs have ended up on the cutting room floor since the launching recently of a campaign by Prime Minister Nawaz Sharif's government to impose its regimen of Islamic decency on television. For example, a toothpaste advertisement was considered unseemly because it showed a toothy young couple grinning at each other affectionately. Gone are the soap and shampoo commercials that showed "female glamour related to their bathing." Government officials say the campaign reflects Pakistan's traditional Muslim culture. The new policies are aimed at promoting Pakistan's rich heritage and Islamic traditions, not at trampling "acceptable" artistic expression, said Saddiq-ul Farooq, prime minister's spokesman. "The line of demarcation is that the animal instincts should not be aroused." But advertisers and artists say the new rules more reflect a slide toward Islamic fundamentalism that stifles freedom of expression - and costs them money. The campaign began in October after Prime Minister Nawaz Sharif reportedly complained that lascivious Western culture was polluting state-run Pakistan Television (PTV). PTV's censors took Sharif's gripe to heart. The censor board announced a new policy that banned footage of women "giving indecent and vulgar looks which are considered contrary to Islamic values." It also banned women from appearing in "jeans and seductive dress." Then a letter went out to advertisers saying commercials which depict "an alien locale and dresses not in harmony with our national culture will not be sanctioned for telecast." In conservative Pakistan, where sex outside marriage is a crime and many women don't venture outside the home without a veil, local film and television is traditionally conservative. Even before the newest campaign, Pakistani censors were discriminating, slicing footage of nudity, sexual intercourse, gratuitous violence and foul language from imported films and television programs. But critics say the new rules have gone too far. Advertisers have been warned against "exhibiting of body contours" and advised to avoid "unnecessary featuring of females." One of the first victims of the new rules was a soap commercial that featured a head and shoulder shot of a well-known Pakistani actress washing her face. Saying the footage was too seductive, censor board officials said it left to the imagination whether the actress was wearing any clothes, said Kareem Ramaal, an executive with Asiatic Advertising Ltd., the agency that produced the commercial. "It's quite a perverted attitude," he said. Ramaal and other advertising executives say the new rules could mean big losses for Pakistan's burgeoning advertising industry. Asiatic's clients have spent as much as $10 million producing some of the commercials that have been forced off the air. "That's just money down the drain," he said. If advertisers pull out, it could mean millions of dollars in losses for the cash-strapped state-run channel. PTV is Pakistan's only channel, but satellite dishes are making headway in this nation of 140 million people, offering dozens of channels over which the government has no control. A 1996 Gallup poll found that 58 percent of adults, about 38 million people, watch television. Seven percent said they had access to a satellite dish. "Culture and religious faith mean different things to different people ... the government should not even attempt to define them," the independent English-language newspaper The News wrote in an editorial. Pakistani singer, Salman Ahmed believes that the government worries that Western-influenced pop music and culture could foment discontent among the country's young. Ahmed said it wasn't his long hair and jeans that got his rock band, Junoon, banned from television, but rather government unhappiness over its hits, which speak of Pakistan's social ills and government corruption. "I think they are scared of us," Ahmed said. "The young generation listens to us and follows us - especially the social songs." PTV officials dismissed Ahmed's accusation, saying there was a difference between modernism and Westernization.

1 0

Re: [Long] How to recover private keys for various Microsoft
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

On avoiding use of commercial encryption products: In a session yesterday with a group of Japanese visiting the US to gather information on security products and export controls, a Westerner advised the group to avoid all commercial security products in any country, domestic or exportables, due to probability of being compromised. It was suggested instead to arrange a private service with a banking institution to covertly ride financial transactions, inland and external. Better was to arrange the same through military or governmental channels. Fees were claimed to be fairly reasonable depending on whether protection against national courts and counter-intelligence was needed at either origin or destination points. It was emphasized that these practices are now normal in countries where strongest info security was required for national economic protection against commercial and intelligence espionage, and that no one knowledgeable in the field would rely on commercial products from any source. The Western briefers were not identifed.

1 0

Taxonomy of crypto applications
by David Honig 17 Dec '03

17 Dec '03

Trying to make sense of the various applications of crypto, I came up with an illustration of their 'dependancies' at http://rattler.otc.net/crypto/mydocs/taxonomy.gif This picture illustrates topics that you should learn before others. For instance, digital watermarking depends on steganography and message-authentication codes. Anonymity requires understanding traffic mixing and practical encryption; practical encryption requires understanding public and secret key encryption. FWIW. Comments welcome. ------------------------------------------------------------ David Honig Orbit Technology honig(a)otc.net Intaanetto Jigyoubu "How do you know you are not being deceived?" ---A Compendium of Analytic TradeCraft Notes, Directorate of Intelligence, CIA http://www.jya.com/cia-notes.htm

1 0