December 2003 - cypherpunks-legacy

BUY_lou
by John Young 17 Dec '03

17 Dec '03

8-16-95. NYPaper: "The F.B.I. and Ruby Ridge." [Editorial] Since the paranoid days of J. Edgar Hoover, the F.B.I. has been struggling to free itself of an institutional incapacity to admit its mistakes and punish wrongdoing by senior officials. Mr. Freeh, who was entrusted with this task, seems to have put misplaced confidence in a longtime friend and associate. Mr. Freeh is said to be infuriated that his trust was abused. Well he should be furious -- especially at himself. "Separatist Family Given $3.1 Million From Government." The Government agreed today to pay $3.1 million to the family of a white separatist whose wife and teen-age son were killed three years ago by Federal agents in a standoff on a remote Idaho mountainside. The decision to give Mr. Weaver and his children any money was particularly stunning, since Federal prosecutors tried two years ago to have him convicted in the killing of a Federal marshal at Ruby Ridge, and sought the death penalty. Federal investigators involved in the case were rebuked by the judge who presided over the trial. The case has also taken on political dimensions. Some conservative groups have cited the shootout, along with the 1993 F.B.I. assault on the Branch Davidian compound near Waco, Tex., as examples of Government abuse of power. BUY_lou

2 1

DSP's, Purple Boxes, Etc...
by Alan Patterson 17 Dec '03

17 Dec '03

For those interested in design of these purple boxes, etc., you might want to check out a couple of magazines that are FULL of advertisements and specs on DSP's, CPU's, communications design equipment, etc: Data Communications (800) 525-5003 and Computer Design Circulation Director (918) 832-9287 email paulw(a)pennwell.com Both magazines are free. Alan Patterson (lep(a)wsnet.com) PGP public key available at MIT keyserver. WSNetwork Communications Services, Inc. Fngpt: 41D0F61B496FECC09FABECF686AB2AIC Montgomery, Alabama (334) 263-5505 (800) INET-750 PGP Encrypted Email Preferred

1 0

Re: Phone call for Mr. Doligez, was Re: SSL challenge -- broken !
by Peter Wayner 17 Dec '03

17 Dec '03

I don't think that there is any serious worry for Netscape. Their security is fine-- it's just crippled by the US Government. They could probably start distributing binary versions of their software that used full 128 bit keys in several hours. It's just that the Government gets pissed off about these things. In general, it just adds more flames to the fire started by the letter written by Microsoft, IBM and Lotus. Their point is bolstered by this easy attack. -Peter

3 2

Re: SSL challenge -- broken !
by Hal 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- From: Damien.Doligez(a)inria.fr (Damien Doligez) > This is to announce the solution of the SSL challenge posted by Hal > Finney on July 17, 1995 (message-ID: <3u6kmg$pm4(a)jobe.shell.portal.com>), > also found at: <URL:http://www.portal.com/~hfinney/sslchal.html> Although it is hardly necessary, I can confirm the accuracy of the decryption found, and I extend my congratulations for this achievement! Ironically, I understand that an independent effort coordinated by Adam Back also discovered the key at approximately the same time. In addition, Eric Young had done a search starting at 8000000000 and upwards; unfortunately the key value of 7ef0961fa6 was only about one percent below his starting point. Hopefully Adam will supply more information. It will be interesting to see what the fallout is from this accomplishment. It should provide ammunition for the current effort by Microsoft and other companies to try to persuade the government to allow the export of full 56 bit DES. Knowing the tendency of the media and the net to oversimplify, this will probably come out as "SSL is broken" just as the RSA-129 result led to "RSA is broken" stories. This would not be as egregious an oversimplification as in the RSA case, but in fairness it should be recognized that SSL as a spec provides support for much stronger ciphers than the intentionally weakened RC4-40 which was broken here, but Netscape was constrained by the government to supply browsers with only the weak encryption. I am a little alarmed by the suggestion that this news could have some marked impact on the Netscape stock price. From our perspective this was certainly an unsurprising result (not to take anything away from Damien and others who worked on it). It is a useful reminder that the things we work on here can have profound consequences. Hal Finney hfinney(a)shell.portal.com -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBVAwUBMDIuehnMLJtOy9MBAQHQbwH+I0YL1ewcCbXOGw8yYvKXIJMg15O0jmqW wMb6SKrethbJzpWXJBpC1oKrl8wVzPvqBCLJtfJFWcN9xD4pTOluhA== =0GPy -----END PGP SIGNATURE-----

7 7

Re: Phone call for Mr. Doligez, was Re: SSL challenge -- broken !
by Steven Champeon - Imonics Development 17 Dec '03

17 Dec '03

| Subject: Re: Phone call for Mr. Doligez, was Re: SSL challenge -- broken ! | From: Peter Wayner <pcw(a)access.digex.net> | | I don't think that there is any serious worry for Netscape. Their | security is fine-- it's just crippled by the US Government. They | could probably start distributing binary versions of their software | that used full 128 bit keys in several hours. It's just that the | Government gets pissed off about these things. The netscape client already has these capabilities built in. During the negotiation stage, the client talks to the server, which announces which strength to use. For exported versions of both the client and the server they are limited to 40 bit RC4. For US versions, all available strengths are supported with an option to enable them. Pull up Netscape, and for the URL type: "about:". It will tell you which algorithms are used, but not their key bit length. When you configure their Commerce server, you have the option to enable any of the supported bit lengths and algorithms, including RC2 and RC4, IDEA, 40 -> 128 bits, 64 -> 192 for DES. Netscape's server, since it must service foreign requests, probably doesn't even waste its time asking for >40 bit, since that would add to the time it takes to negotiate a common scheme. If anyone has any insight into this, please fill me in. I just wanted to clarify a few things. Steve -- Steve Champeon Technical Lead, Imonics Web Services

1 0

Re: SSL challenge -- broken !
by Alex de Joode 17 Dec '03

17 Dec '03

Hal sez: [..] : I am a little alarmed by the suggestion that this news could have some : marked impact on the Netscape stock price. From our perspective this was : certainly an unsurprising result (not to take anything away from Damien : and others who worked on it). It is a useful reminder that the things we : work on here can have profound consequences. Just to bad Ecash and the ON-Line Stock/Options Broker [TM] aren't available, would be a good time to buy some put options on Netscape Communications. -- Alex de Joode Fear Uncertainty and Doubt, Inc.

1 0

Re: SSL challenge -- broken !
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 1:45 PM 8/16/95, Hal wrote: >I am a little alarmed by the suggestion that this news could have some >marked impact on the Netscape stock price. My apologies for causing alarm. I was merely making a too-subtle joke about hysteria in the press and the capital markets for Netscape, and its inevitable backlash. Madness of crowds and all that... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Question: DSA status and export requirements?
by doug＠openmind.com 17 Dec '03

17 Dec '03

Does anyone know if there have been any major developments in the DSA patent issue in the past year? I've read that some large companies have used DSA in products without paying royalties to Bizdos, but they also have separate licensing deals for RSA itself. On another note, I would much appreciate advice on whether a product which does only signature verification using, say, DSA and SHA, would require ITAR export approval? I've read that the NSA has specifically stated that they are not concerned with products that cannot be easily used for privacy -- so would such a product (which can verify but not generate signatures) even be required to apply for an export license? Doug Cutrell doug(a)OpenMind.com ________________________________________________ fuck the Exxon Communications Decency ammendment

1 0

Erroneous HPCwire phone #
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Whoops... Hope this helps! Cheers, Bob Hettinga --- begin forwarded text Date: Sat, 12 Aug 95 04:22:08 PST From: "Alan Beck" <alan(a)tgc.com> X-Minuet-Version: Minuet1.0_Beta_4 Reply-To: <alan(a)newsmaster.tgc.com> X-Popmail-Charset: English To: rah(a)shipwright.com Subject: Erroneous HPCwire phone # Robert, I can't reach my managing editor, who's a cypherpunk subscriber, so I'm emailing you: HPCwire's telephone number was posted incorrectly. Our real number is: 619-625-0070. I'd appreciate it if you could revise the post. Thanks much! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Alan Beck HPCwire Associate Editor 8445 Camino Santa Fe HPCwire Suite 204 alan(a)hpcwire.tgc.com San Diego, Calif. 92121 Voice: 619/625-0070 Fax: 619/625-0088 For a free trial subscription, email: <trial(a)hpcwire.tgc.com> ~~ Diagonally parked in a parallel universe. ~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: SSL challenge -- broken !
by Joe Buck 17 Dec '03

17 Dec '03

Congratulations on demonstrating the effort required to break SSL with a 40-bit key. It seems clear demonstrated that this is not adequate to store, say, company-confidential information for communication over insecure networks, since it seems the average grad student at a large university could get access to similar computing power that you used (spare cycles on a hundred workstations or more). However, I disagree with your conclusion: > Many people have access to the amount of computing power that I used. > The exportable SSL protocol is supposed to be weak enough to be > easily broken by governments, yet strong enough to resist the attempts > of amateurs. It fails on the second count. Don't trust your credit > card number to this protocol. Your credit card number, expiration date, etc, are continually being revealed to minimum-wage clerks all the time, unless you never use the card. A chain is only as strong as its weakest link; it makes no sense to buy an expensive lock when your door has a big enough opening to climb through. Should some bad person get hold of your card number and misuse it, you're not out any money: you just tell the card company "I didn't buy that". Since there's so much tracing in the system, if you buy a physical something with a stolen credit card number it can usually be traced to you (who'd they ship the package to?). It's not clear to me that *any* encryption is really essential if the only purpose is to protect credit card #'s from snoopers. There's plenty of stuff that *does* need protection, but I'm not sure credit card #'s head the list. Q: Of the 20,000 credit card #'s stolen from Netcom's computer, how many were used to buy things? Answer: not sure, but expect the answer is "zero".

2 1