December 2003 - cypherpunks-legacy

Re: SSL challenge -- broken !
by Pierre Uszynski 17 Dec '03

17 Dec '03

Jordan (jordan(a)Heuristicrat.COM) attempts to correct me ;-) > > From pierre(a)shell.portal.com Thu Aug 17 18:29:41 1995 > > > > Unfortunately, in this case, insecure credit cards are not an > > obstacle to banks making money, so why should they care? > > [...] if you think that the major card issuers "don't care" about > cutting (or eliminating) fraud, you're not talking to the right > people. Fraud eats away a big chunk of revenue [...] Creative quoting aside, the point of my post, if it needs further clarification, was that the cost of fraud is not only a burden to the banks as some people seem to think. It is not even only transmitted back to the customers in the form of higher fees and interest rates. Card issuers can, do, and should as long as they can get away with it, rely on methods against fraud that are less costly to them. That's because they answer to their bottom line, to their share holders. There are disincentives to fraud in the form of legal penalties and threat of same, even the impression that credit cards are insecure may help by limiting what (some) people dare to do with them. The costs of these methods of fighting fraud is carried in part even by us who don't even usually use credit cards! The highest the penalties and cost of enforcement, the lowest the direct burden on banks, but that does not necessarily mean that our (user's) bottom line will improve. For citizens and tax payers who are not significant share holders, it's not enough to ask the card issuers what the cost of card insecurity is to them. "Our cost is higher." By making some credit card fraud illegal, enforcing, etc... we actually allow card issuers to use less secure mechanisms and procedures (although I'll agree this does not apply to the 40 bit key nonsense, that's one case where banks and businesses would be happy to use longer keys.) (the equivalent mis-quote about politicians applies here :-) Pierre. pierre(a)shell.portal.com (And I will not contribute further to this side thread.)

1 0

Re: Where is the key cracking farming software?
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

Dan Bailey <dan(a)milliways.org> writes on cpunks: > There must be several versions of the code at this point. The > Cypherpunks release, Damien's release and whoever else wrote some code > to do the chore. If someone could pass me a pointer to the version > that's best-commented and most understandable (one man's C is another > man's crypto) I'd like to port it to Windows NT and write a simple > installation to install it as a service. Yep there's lots of versions of the brutessl software, ones I know of (in no particular order): - Damien Doligez wrote one - Andrew Roos wrote on (this is the one we're using for the challenge) - Eric Young wrote one - I wrote one More related softwares, specifications etc. - Piete Brookes, Andy Brown, and I wrote a protocol specification for a SMTP style key doler - SKSP (Simple Key Search Protocol) - draft RFC like document on brute (www url below). - Piete wrote a unix socket based key server and client for generic unix machines (in perl). - Andy Brown wrote a Windows NT client which talks the same protocol - David Byers did a MasPar port of the brutessl code > Perhaps a general-purpose OO bruteforcing library (addition to > Crypto++?) would be a good idea. Just pass a pointers to the > encrypt() and decrypt() functions to use for this session to the > Cracker object, which in turn takes a number of bits and starts > cracking.:) The socket based key distributer allows you to write clients which interact with the key server. Take a look at Andy's code. > The problem with this is the disparity among out-of-the-box encrypt > and decrypt functions. But I suppose it's nothing that couldn't be > overcome with wrapper functions. Just thinking out loud. :) Not sure how Andy addresses this in the NT code (I don't have NT), but for the unix client you'd just get another brute force program, compile it and update the client. Piete has a WWW URL for the software (the protocol spec is there too) at: http://www.brute.cl.cam.ac.uk/brute/ (Brute is a subsubdomain he set up for the purpose). Also this: ftp://ftp.brute.cl.cam.ac.uk/pub/brute/ should work. And the socket server runs on: sksp.brute.cl.cam.ac.uk (port 19957). I think we're ready to start another challenge, this one a collaborative project like the brute rc4 one. Just need some challenges now (asked Hal about this). Adam

4 3

NSA leak magic
by Zooko Journeyman 17 Dec '03

17 Dec '03

A million monkeys operating under the pseudonym "Ian Goldberg" typed: > Uh-huh. Unless the Administration has granted a secret Executive Order > repealing the Laws of Physics for the NSA, the above statement, if true, > would imply one of the following things: > > 1. <snip> > 2. <snip> > 3. <snip> 4. It takes 33 minutes to view the satellite images, wiretaps, and TEMPEST recordings, and bribe, threaten, cajole or torture the subject's friends and business partners, and run the "stupid passphrase/weak random seed" cracker. I believe it. Z who is still trying to grok how the girl scouts figure in. "You're a thought criminal!"

1 0

SSL challenge and escrows
by fc＠all.net 17 Dec '03

17 Dec '03

I think a lot of people miss the distinction between automated message cracking and dumpster diving. Dumpster diving is not free. It costs at least a dollar each to get credit card slips by dumpster diving. Consider that in order to use the information, you have to get the slip, pull off the numbers, enter them into a computer (or even worse yet, create a phoney card or make a phone call) in order to use the information. The break-even point for an automated cracking and usage system is more than a dollar per stolen card. My parallel processor is actually more cost effective for crimilar theft via credit card fraud. What does this have to do with escrow? My escrow offer costs less than the cost of crimial attack. If it reduces attack, it is cost effective and should lower the overall cost of transaction processing. In fact, I have a friend who says he will escrow keys for free, but he is less trustworhty than I am, and I think he wants to get his dollar on the other side. -- -> See: Info-Sec Heaven at URL http://all.net Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

2 1

Perot and Scrap Cycles
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:31 AM 8/19/95, Michael Froomkin wrote: >Didn't Ross Perot make his fortune by running data processing tasks nights >and weekends on machines he leased to other people (all legal)? I hadn't heard this. And until I hear more details, I'm skeptical. (Trivia sidenote: I was in high school in 1970 and met Ross Perot at a shindig in Dallas--his wife picked me up at the airport and drove me to the hotel. He had just that spring lost a billion dollars in a single day, due to a glitch in EDS stock. A billion dollars in 1970 was a lot of money.) Now in 1970 EDS was indeed leasing lots of IBM mainframes to customers, and running them. Also, doing processing jobs. But how many IBM mainframes were idle at night? Not many. This was the day of multimillion dollar mainframes and programmers making $10,000 a year to keep them busy at all times. So, I doubt the machines were idle in the same way our workstations and PCs are largely idle (obviously, machines now cost less $2000-6000, and programmers make 10-20 times that...the tables have turned). I don't discount the possibilty that EDS made a deal on the lease rates. I haven't read up on EDS in this era. I just know that Perot wasn't using "scrap cycles" (to use Doug Barnes' term), because there probably weren't many of them. But I'd like to hear the details. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

House Committee Hearing on Money Laundering
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: e$(a)thumper.vmeng.com Reply-To: jmuller(a)brobeck.com (John D. Muller) Mime-Version: 1.0 Precedence: Bulk Date: Sun, 27 Jul 1997 20:32:04 -0700 From: jmuller(a)brobeck.com (John D. Muller) To: Multiple recipients of <e$(a)thumper.vmeng.com> Subject: House Committee Hearing on Money Laundering For those with a strong stomach for testimony on the need to strenghten money laundering laws and extend know-your-customer requirements to non-banks, material from last week's hearings on money laundering and the drug trade by the House Judiciary Committee's Subcommittee on Crime are now on-line at http://www.house.gov/judiciary/364.htm John Muller jmuller(a)brobeck.com ---------- The e$ lists are brought to you by: Intertrader Ltd: "Digital Money Online" <http://www.intertrader.com/library/DigitalMoneyOnline> Where people, networks and money come together: Consult Hyperion http://www.hyperion.co.uk info(a)hyperion.co.uk Like e$? Help pay for it! <http://www.shipwright.com/beg.html> For e$/e$pam sponsorship, mail Bob: <mailto:rah@shipwright.com> Thanks to the e$ e$lves: Of Counsel: Vinnie Moscaritolo <mailto:vinnie@webstuff.apple.com> (Majordomo)^2: Rachel Willmer<mailto:rachel@intertrader.com> Commermeister: Anthony Templer <mailto:anthony@atanda.com> Interturge: Rodney Thayer <mailto:rodney@sabletech.com> --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

Re: Netscape security
by Rich Salz 17 Dec '03

17 Dec '03

> There is no word as to how to become a KSA. Netscpe has >ignored the question on several occaisons. I'm fairly sure that I remember Taher saying at the W3C security meeting that they intend to do this, and that hardcoding the CA's into the library was as quick hack. I also have the impression that they don't know how to do it, but my recollection is fuzzier there. /r$

1 0

PGP encryption for HTML forms
by Dorab Patel 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I've developed a simple protocol for encrypting the submission of HTML forms using PGP. I've written up the protocol in an "Internet Draft". We are distributing two reference implementations (with sources --- copyrighted, but freely redistributable). One is a modification to lynx sources to handle this protocol natively. The other is a "helper application" (by Jun Hamano) to do the encryption written in python. You can get the package via anon ftp. ftp://ftp.cs.ucla.edu/pub/sitp.tar.gz Comments welcome. Snarf it before it becomes illegal! -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by Mailcrypt 3.2, an Emacs/PGP interface iQCVAwUBMDTTYGnoQvE1ROndAQE5dQP/SWII7eR/eFYWsdU6mOilLZautmtS1rb9 kRcifS02p7WS3N3sY+MRu20uuPmuL+f+5rriYWJWVgd//s3jgegs8HGqmRuxVQdL qMFRmtMB5oUfYkLmTiDebHsksr2YLF+AB8vrBCgXIbgKAcSRF4OStRyXBUeXfZ/3 gp9MiACvXV4= =PxCp -----END PGP SIGNATURE-----

1 0

DCSB: Duncan Frissell and MarketEarth
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: rah(a)mail.shipwright.com Mime-Version: 1.0 Date: Mon, 28 Jul 1997 07:36:46 -0400 To: dcsb(a)ai.mit.edu, dcsb-announce(a)ai.mit.edu From: Robert Hettinga <rah(a)shipwright.com> Subject: DCSB: Duncan Frissell and MarketEarth Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: Robert Hettinga <rah(a)shipwright.com> -----BEGIN PGP SIGNED MESSAGE----- The Digital Commerce Society of Boston Presents Mr. Duncan Frissell, Frissell Associates "Markets Rule! OK Bet on MarketEarth -- Bet Against Bureaucracy" Tuesday, August 5, 1997 12 - 2 PM The Downtown Harvard Club of Boston One Federal Street, Boston, MA Mr. Frissell, the Net's most enthusiastic Technoptimist will answer such questions as: Why did Central Planning, Deutsche Telecom, and X.25 lose and the Market, telecoms competition, and TCP/IP win? Can banks compete with nonbanks? Why controlling the Nets is as hard as controlling the thoughts of other people. Why popular measures like immigration control are doomed. What do such phenomenon as the Jewish Holiday Effect, the Sack Full of Cats in the River Effect, the Canadian Air Service Effect, the Saturday Morning Shopping Trip Effect, and the Taiwanese Privatization Effect tell us about the future of government and the individual? Why things are not the same and never will be again? Why the Market is "X-The Unknown," "The Blob," -- and why even Steve McQueen couldn't save us from it? "Duncan Frissell makes Kevin Kelly sound like Jimmy Carter." -- Anonymous Mr. Frissell, an Attorney, privacy consultant, and author, has worked in what he insists on calling the "Right Wing Nut Investment Community" for more than 20 years. This meeting of the Digital Commerce Society of Boston will be held on Tuesday, August 5, 1997, from 12pm - 2pm at the Downtown Branch of the Harvard Club of Boston, on One Federal Street. The price for lunch is $30.00. This price includes lunch, room rental, various A/V hardware, and the speaker's lunch. ;-). The Harvard Club *does* have dress code: jackets and ties for men (and no sneakers or jeans), and "appropriate business attire" (whatever that means), for women. Fair warning: since we purchase these luncheons in advance, we will be unable to refund the price of your lunch if the Club finds you in violation of the dress code. We will attempt to record this meeting and put it on the web in RealAudio format at some future date We need to receive a company check, or money order, (or, if we *really* know you, a personal check) payable to "The Harvard Club of Boston", by Saturday, August 2, or you won't be on the list for lunch. Checks payable to anyone else but The Harvard Club of Boston will have to be sent back. Checks should be sent to Robert Hettinga, 44 Farquhar Street, Boston, Massachusetts, 02131. Again, they *must* be made payable to "The Harvard Club of Boston", in the amount of $30.00. If anyone has questions, or has a problem with these arrangements (We've had to work with glacial A/P departments more than once, for instance), please let us know via e-mail, and we'll see if we can work something out. Upcoming speakers for DCSB are: September Christof Paar Elliptic Curve Cryptography October Peter Cassidy Military Fiat and Digital Commerce November Carl Ellison Identity and Certification for Electronic Commerce We are actively searching for future speakers. If you are in Boston on the first Tuesday of the month, and you would like to make a presentation to the Society, please send e-mail to the DCSB Program Commmittee, care of Robert Hettinga, <mailto: rah(a)shipwright.com> . For more information about the Digital Commerce Society of Boston, send "info dcsb" in the body of a message to <mailto: majordomo(a)ai.mit.edu> . If you want to subscribe to the DCSB e-mail list, send "subscribe dcsb" in the body of a message to <mailto: majordomo(a)ai.mit.edu> . We look forward to seeing you there! Cheers, Robert Hettinga Moderator, The Digital Commerce Society of Boston -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQEVAwUBM9yEOcUCGwxmWcHhAQHq2ggAr93eyPf+gg23sANSwkHQpzDCHUZl9UaI rXjmSA1EkDTWSEWxy90BlWexUdHa4a+rKtYU3DNpMSB5WPAzq0Et3rnqCHEkYh3D NM9cOCSkP7HOP07yISh3yFhyisqIDQR5fK3f3NBjGfDjzT8QDkaGWEOAh4O7nzuL kKdm6diPBMUePtHxGzUbqtWP239vpY3kfhu2CbdP766NxsMD2Hsq4bLaAnUk2NPy NkzS3Vv9+opl01IbJQ05MWm4E23ATSsjVJGvFnO6l0HOQ7W6NMqDKFHxS/i9WLmz vQS2sKrNHqnr7Z8eXEXk8HdmzCim7b+P0BhvEGyrbPW0xD9d+dExtg== =gSKM -----END PGP SIGNATURE----- ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To unsubscribe from this list, send a letter to: Majordomo(a)ai.mit.edu In the body of the message, write: unsubscribe dcsb-announce Or, to subscribe, write: subscribe dcsb-announce If you have questions, write to me at Owner-DCSB(a)ai.mit.edu --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

Re: Netscape security
by koontz＠MasPar.COM 17 Dec '03

17 Dec '03

>Now, I can see calling a MasPar a "parallel supercomputer"; another effort >at the SSL challenge got the answer about 2 hours before Damien's did, >and used about 4 days of spare time on the MasPar. Last time I looked, >a MasPar was selling for about $150K, though I don't know how big the one >used on SSL was. At that price, you could have your own for ~$500/day, >and ripping off $2000 on a credit card isn't tough in today's automated world. >Next year - computer time costs half as much. Well, lets put it this way, an MP-2 with 16K processors could attack a 56 bit key about as fast as a 486 could attack a 40 bit key. The next generation MP will be less than an order of magnitude faster, although able to use more processors. An MP2 with 1K processors can do 220K crypt(3)/sec. Now, if it weren't so darned hard to program one for performance... One tends to wonder if there are analytical methods to reduce the search space.

2 1