December 2003 - cypherpunks-legacy

Secure DAC?
by SINCLAIR DOUGLAS N 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I was looking through the PMI analog IC databook from 1988. Specifically, I was looking at the "DAC-08 8-bit high-speed multiplying D/A converter". The chip is interesting in that it has two outputs. One is the current corresponding to the digital value on the input lines, and the other is the current corresponding to NOT the digital values. Thus, the two currents sum to a constant. The book says: "Power consuption may be calculated as follows: Pd = (I+) (V+) + (I-) (V-). A useful feature of the DAC-08 design is that supply current is constand and independent of input logic states; this is useful in cryptographic applications and further serves to ^^^^^^^^^^^^^ reduce the size of the power supply bypass capacitors." -- Page 11-34. All typos mine. I fail to see how this would increase cryptographic potential. However, it would seem to mask the device's EMR. The application notes state that it is useful in CRT display drivers, audio encoders, &c. These are all devices that are succeptable to TEMPEST monitoring (or whatever the correct name is). If one output goes to the desired next stage (the electron gun in a CRT for example) and the other goes to a matched dummy load, it would seem that the overall EMR is constant. This approach would obliviate the need for bulky shielding, though it might not be as secure. -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLuhtmcyi36CIyUXVAQHPOgQAtfWIF40YQU+pYhYok734qzePhkDmmaaR 8WLXVB9UvZBi7psIuXRsXoKkODaQIJecQZ6UsIrEfBr1Lor+ZBe7e7fOpWiO5jkE gMC+/a62z4xOyr4ukrEsZPG4WfHLR1SSob+CFla/JjiL2Hp3+I2wgtieY7KHTn0m 13Zpr/eayLM= =F8pd -----END PGP SIGNATURE-----

3 2

Netscape SSL protocol URL
by ddt＠lsd.com 17 Dec '03

17 Dec '03

Check out: http://home.mcom.com/info/SSL.html First few lines reproduced below. Sorry no sign on this one, must jet now! dave =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= cut here =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= The SSL Protocol The SSL protocol has been submitted to the W3O working group on security for consideration as part of a general security approach for the Web, and we are actively working within the W3O and with many of its member entities on establishing open security standards for the net. This protocol specification was last revised on November 29th, 1994. Recent changes include: a fundamental correction to the client-certificate authentication protocol, the removal of the username/password messages, corrections in some of the cryptographic terminology, the addition of a MAC to the messages [see section 1.2], the allowance for different kinds of message digest algorithms. Internet Data Security Document Experimental Kipp E.B. Hickman Request For Comments: XXXX Netscape Communications Corp. Last Update: Nov. 29th, 1994 ______________________________________________________________________________ The SSL Protocol Status of this Memo This RFC specifies a security protocol for the Internet community, and requests discussion and suggestions for improvements. Distribution of this memo is unlimited. Abstract This document specifies the Secure Sockets Layer (SSL) protocol, a security protocol that provides privacy over the Internet. The protocol allows client/server applications to communicate in a way that cannot be eavesdropped. Server's are always authenticated and clients are optionally authenticated. [elided]

1 0

Question #1 to the community regarding National...
by CRYPTO 17 Dec '03

17 Dec '03

Subject: Question #1 to the community regarding National Cryptography Policy As many of you know, the National Research Council is undertaking a study of national cryptography policy (description available on request to CRYPTO(a)NAS.EDU) This note is the first of a number of questions that will be posted to the Internet community in our attempt to solicit input on a broad scale. Please circulate this request to anyone that you think might be able to contribute. The question of this posting is the following: How, if at all, do capabilities enabled by new and emerging technology in telecommunications (e.g., key-escrow encryption technologies, digital telephony) and electronic networking make it _easier_ for those who control that technology to compromise and/or protect the interests of individual end users? Please use as the standard of comparison the ease _today_ of compromising or protecting these interests. We are interested in scenarios in which these interests might be compromised or protected both individually and on a large scale. Please be sure to tell us the interests you believe are at stake. Please send your comments on this question to CRYPTO(a)NAS.EDU.

1 0

BofA+Netscape
by ddt＠lsd.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Lads, I thought many of you would be interested in the text of this story. I'm wondering if anyone has any comments on the excryption mechanism (i.e. "eavesdropping" protection) being used. I believe, from my visits to the Netscape (formerly Mosaic) Communications Inc. offices that they are using RSA, but I'm not sure how *secure* their implementation is (eg. key size, etc.). I'll be contacting my local branch to inquire as to how soon I'll be able to use the service and will post my experiences with it as soon as possible. This development certainly signals a major breakthrough in E$ technology. dave ____________________________________________________________ "Money is the root of all Evil. Send $9.95 for more info." =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= cut here =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Bank of America Goes Online With Credit Card Service By David Einstein, Chronicle Staff Writer In a major step toward electronic commerce, Bank of America announced yesterday it will launch a system next month for processing credit card transactions on the Internet. The bank, second largest in the United States after Citicorp, will use software from Netscape Communications to make it safe for merchants and consumers to do business online. Lack of a secure way to transmit credit card information has been the biggest obstacle to conducting business on the Internet, a global computer network reaching some 30 million people. "Secure payment processing is a critical element to making elec tronic commerce happen," said Netscape spokeswoman Rosanne Siino. She called the BofA announcement "a pretty big deal for us." Netscape's software incorporates data encryption that protects online communications from eavesdroppers. It also gives both parties in a transaction the ability to verify each other's identity. BofA intends to market its new service to merchants for whom it currently processes ordinary credit card transactions. The service will be free to consumers, who will be able to make purchases with almost any major credit card. Officials of the San Francisco based bank said they do not expect online processing to generate a flood of business immediately. "We anticipate that the maturity of this product is going to take a year if not years to develop," said Jim Aviles, vice president of marketing for BofA Merchant Services. Electronic shopping is not expected to catch on until the public gains widespread, low-cost access to the Internet. Full access is still expensive and not available everywhere. Netscape, an 8-month-old company based in Mountain View, is one of the leading makers of software used to navigate the Internet via a Windowslike interface. One of the company's founders is Marc Andreessen, the 23-year-old whiz kid who developed Mosaic, the navigation program that ignited interest in the Internet last year. Yesterday's announcement was the latest in a series of deals involving Netscape. Late last month, MCI said it would use the company's technology as the core of its planned internetMCI electronic shopping service. San Francisco Chronicle 6 December 94 (Business) Section D, Pg 1 ("D1") - -30- -----BEGIN PGP SIGNATURE----- Version: 2.6somethingorother iQCVAgUBLugg0KHBOF9KrwDlAQFxNQP+NZCPCkuIoWfp4PJszoYDlY2UmkBPcLfa VyfuU0yMimJa1MW3Oolf5PyNpK2M7+yastFIRL1MmjxUi8FOZ6qQjIIsMe8ahuJV YVwCf9+v2Ll8XaDywG9+zvhQI4WoTBCL0aoCbKZkhm56IKj00aXMDP+zXYpx/SZM Z6bp0YNKk/Y= =UTZA -----END PGP SIGNATURE-----

5 6

Re: BofA+Netscape
by JEFF LICQUIA (CEI) 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > It my personal feeling that Netscape doesn't have the right >talent mix to develop secure software. For example, they may well get >the RSA parts right, and then store the passphrase in a text file, >'for ease of use.' The RSA is secure, but the system is not secure if >usnauthorized people using your machine is a possibility. > > Writing secure software is a difficult and tricky buisness >that requires a lot of effort; early versions of Mosaic had problems. > > Netscape really needs to develop a threat model that allows >them to assess the severity of potential problems. It is my guess >that they have not done so, although, I'd be pleased to hear I'm >wrong. > > Everyone's favorite company, First Virtual, seems to have >developed a threat model that allows them to offload allmost all risk >and security problems to their customers. It may not be a good >solution, but at least they have considered how the security of their >system intersects the real world. Just integrating RSA does not do >that. This intrigued me, so I checked it out. I didn't see anything about a threat model, but they did have some extensive discussion about their security, including things I found interesting... They call their system "Secure Sockets Layer" (SSL), which appears to be a kind of link-level encryption which they layer below HTTP. This is opposed to SHTTP, which is more MIME-like. They don't seem to think much of SHTTP; their FAQ answers the question "Are there other secure browsers available?" with "Nope; no one else uses SSL at this time." (paraphrased) What's interesting is that they're planning to put NNTP, FTP, etc. on top of SSL as well, allowing for "secure FTP" and "secure news", etc. SSL is supposedly an open standard, and Netscape is pressing for it to become a true standard. Apparently, they've even issued an RFC for it. The full text of the SSL protocol is on their Web site. As for technical issues, they aren't very satisfactory concerning the kind of questions Adam raised; it's mostly about RC4 layered on top of RSA and MD5 hashes sent at this time, etc... The SSL spec contains a section on attacks which seems elementary even to my novice mind. Is there interest in posting the spec? It's in RFC format, but hasn't even been assigned a number yet, so it doesn't appear to be uncopyable, as it were. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLuiwnjER5KvPRd0NAQGBNAP+PpTRHhzVq+ogPkCUP4vBSYG9ooOnSVOi tOaG+4zQYJa7iPBP11/aODYM9JjlNr8zGBDfKr1SzOI7ntg59C8/aGscc5XvJh5I wE2TxHOqA+OE+AtSy4jDE09yVG/TUZuO69Ig5+v/xJy+XU1nspUoJ02mi5EQo/59 Qq1nDoeKpoE= =vBg6 -----END PGP SIGNATURE-----

1 0

Saturday weekly L.A. gatherings
by Agorist003＠aol.com 17 Dec '03

17 Dec '03

TAKE 2!: It's always something. Saturday, December 10, 1994, and weekly henceforth (on a trial basis, excluding vacations and holidays unless someone else wants to host it): There will be a meeting under the announced name "L.A. Cypherpunks" at the California Coffee House, 4455 Overland Avenue, Culver City, CA 90230 (310) 559-8868 to discuss privacy issues and tactics. If any of y'all want to show up and flame on about your pet projects and sell stuff, it is a free, informal gathering -- show up any time between noon and 5 P.M. The first logical order of business after introductions, is "is this the time and the place?" The California Coffee House is close to my home, and it is a compromise between the extremes of a restaurant and a meeting hall without food. They serve sandwiches and coffee. They are open 9 a.m. - 5 p.m. on Saturday. The meeting will start if anyone shows up besides myself and continue until closing time. And you'll even get a little brochure! Gosh, golly, gee whiz!! BCNU! Kent - jkh(a)story.com (consarn it all, skippy)

1 0

Re: How to Destroy the Internet (was Info about Linux)
by Rich Salz 17 Dec '03

17 Dec '03

Is /etc/utmp still world-writeable on most machines these days? Hell, even CERT put out an advisory about this years ago.

1 0

Re: crypto email to France
by farr＠evtech.com 17 Dec '03

17 Dec '03

> > Rebecca Farr said: > > Does anyone here know any details or where I might find out more about > > what, if anything, needs to be done to legally exchange encrypted email > > with our office in Paris? > > It would be great if you could post a summary of the practical > procedure, once you find out. It's nice to have (an approximation of) > the legal text, but that's usually quite removed from the actual > paperwork. > > Thanks, > Pierre. > pierre(a)shell.portal.com > Thank you, Pierre, and everyone else who has responded both privately and through the cypherpunks mailing list. I will post a summary of the procedure and any other relevant information when I (finally!) find out what that is. Thanks also for the translation of the french law you posted. Someone from France had sent me the original, and while I can read it, this will save me some work writing up a translation for our lawyer. Best wishes to all, Rebecca Farr farr(a)evtech.com

1 0

Looking for Hackers' Story
by sghahn＠math1.kaist.ac.kr 17 Dec '03

17 Dec '03

I am looking for the sources about the general aspects of the hackers. I am writing an article for a Korean journal <The Database World>. I am writing about the origins, the history, the developments, the new trends, and its impact on the industry, etc. Pla Please send me an e-mail if you know any good sources. Thanks in advance.

1 0

Argh, apologies
by L. Todd Masco 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- My most sincere apologies: due to a Truly Heinous filesystem lossage mode, (thanks, DEC, for ultrix 4.2!) the sign/forward service cypherpunks(a)hks.net has been broken since late Wednesday and everything through it has been lost. I just got back from DC/MD/VA and corrected the problem. I've modified things so that this will not happen again (at worst, signing and forwarding will be delayed until the queue is manually run). Again, I very much apologize for this. - -- Todd Masco | It's sometimes difficult to be too loud about your cactus(a)hks.net | enumerated rights when you're busy exercising your cactus(a)bb.com | unenumerated rights. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLumIeyoZzwIn1bdtAQFU6AGAu3BVYAsmo+8+mVRRhm5i4rPijBDOjUC0 b00JXC27ejVCzr2ZGis1f1pbwH+/9bDJ =xfn3 -----END PGP SIGNATURE-----

1 0