December 2003 - cypherpunks-legacy

Re: NYT on Netscape Crack
by Duncan Frissell 17 Dec '03

17 Dec '03

At 11:00 PM 9/18/95 -0400, John Young wrote: > The New York Times, September 19, 1995, pp. A1, D21. > > > Security Flaw Is Discovered In Software Used in Shopping > > By John Markoff On the Front Page, *above* the fold. Perhaps John was trying to make up for being scooped by the WSJ on the SSL Crack story. DCF "The key to the age may be this, or that, or the other, as the young orators describe; the key to all ages is-Imbecility; imbecility in the vast majority of men, at all times, and, even in heroes, in all but certain eminent moments; victims of gravity, custom, and fear." -- Ralph Waldo Emerson

1 0

Re: NYT on Netscape Crack
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

Eric Young <eay(a)au.oz.mincom> writes: > I will defend Netscapes code on the point about the RNG even though > I have not seen any. I assume the Netscape code is quite large and > each release would have to pass various fuctionality tests. How can > you test that the RND seeding is wrong? You have to actually look > at the code, the number coming out are still random. As of last > week I was told by Mike_Spreitzer.PARC(a)xerox.com that the random > number generator seed routine in my DES library was only copying in > 4 bytes of passed data instead of 8. Given des_cblock data;, it was > > memcpy(init,data,sizeof(data)); > > it should have been > > memcpy(init,data,sizeof(des_cblock)); > > Rather hard to notice unless you know that des_cblock is passed as a > pointer and even this can be compiler dependent. Sure that's hard to notice, but what you describe was an accident, ie the code wasn't working as you thought it was. The netscape one by the sound of it, and the earlier posts of the reverse-engineered ran no code, was working to spec, it was just a dumb spec. I felt sorry for netscape when they got chosen as the example of an ITAR crippled app to break, the breakers intention obviously being to tar ITAR, but some of the bad publicity rubbing off on netscape, who were obviously fully aware of the weakness of 40 bit keys. This one tho' sounds very much like due to sloppy design which is inexcusable, especially given that they are going around selling the 128 bit RC4 browser to people who may have been relying on it, at it's word, and presume the rest of the cryptographic system was up to suitable standard to match 128 bit keys. aka what's the point having 128 bit keys if you use a 32 bit, or 40 bit or 48 bit seed, which can be further narrowed with non-root access to the machine, and even with external info leaked by the machine. > The moral of the story I suppose is to be > paranoid about checking routines relating to RNG. Well that is a valid, and very good moral, but the netscape story is a different story I think, as they knew what their code was doing, and somehow didn't think it was a problem, or didn't even pause to consider the ran no generation security. Reckon any bad publicity they get out of this one is entirely their own fault. The moral in netscapes story is that closed systems are bad news. These things ideally need open review. And of course designing things with the expectation that they are secure with the *given* that the full algorithm is known. Real shame because the rest of the software is very innovative compared to other browsers, and apparently good quality. Also may be a set back for net commerce, which is bad news. Adam -- Munitions-T home page: http://www.obscura.com/~shirt/ #!/bin/perl -s-- -export-a-crypto-system-sig -RSA-3-lines-PERL $m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2%Sa 2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*',$_)while read(STDIN,$m,($w=2*$d-1+length($n)&~1)/2)

2 1

Time release crypto
by keelings＠wu1.wl.aecl.ca 17 Dec '03

17 Dec '03

Incoming from Stephen D. Williams: > > What minimal requirements would be needed to support encrypted packets/files > that a holder could only decrypt after a certain date/time? > (Time Escrow?) How do you expect the system to reliably tell accurate time? What's to stop anyone from just resetting the clock to get at what they want? As always, physical access to the system breaks all security. -- "Remember, obsolescence (Win95) isn't an accident; it's an art form!" keelings(a)wu1.wl.aecl.ca s. keeling, aecl - whiteshell labs

1 0

(Yet Another?) Netscape Crack Web page
by Laurent Demailly 17 Dec '03

17 Dec '03

I've been waiting to see here an annoucement of some web page toward which direct ppl that want more infos on the great (congrats) job from Ian and David, but as I saw none (maybe it's on its way, delay seem pretty high those days on the list mail, in that case, sorry...) and someone asked me more infos, on my sources,... I've set up a small web pages with some infos collected here on http://hplyot.obspm.fr/~dl/netscapesec/ It includes few remote pointers, a copy of the original ian's post, the NYT article, the Wall Street journal one, and... the source file that I received from an european source (and incidently a summary from me in french) Please send me comments , corrections, additional pointers,... (it is not meant to ne exhaustive anyway) Best regards dl -- Laurent Demailly * http://hplyot.obspm.fr/~dl/ * Linux|PGP|Gnu|Tcl|... Freedom Prime#1: cent cinq mille cent cinq milliards cent cinq mille cent soixante sept

1 1

articles
by sameer 17 Dec '03

17 Dec '03

If you could, please send me the name of the reporter and contact information for any articles you see regarding the netscape hack. Thanks, -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 An Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

3 2

Re: Caribbean Internet Services?
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> (Yes, there have been more hurricanes this year than in most years...not > clear if it's just a Poisson fluctuation, or symptomatic of deeper weather > pattern changes.) > See September 95 Popular Science, article, "Hurricane Alert" in which the worlds leading hurricane scientist says that we're only just seeing the beginning of several years of large numbers of large hurricanes. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Fundamental Netscape hack
by Bill Stewart 17 Dec '03

17 Dec '03

Of course, one of the most serious security problems with Netscape servers is that they run on machines sitting out there on the Internet where anybody who can browse their services can attack them - that 128-bit bullet-proof iron-clad front door isn't much help if the garage door is unlocked because of some sendmail bug. For most web applications, the big security need is to send a chunk of encrypted data to some server that will decrypt it and get you credit-card number or whatever, but the standard SSL and S/HTTP protocols want to decrypt the data to plaintext on the Web server before it can do anything like that. (OK, I guess this doesn't win me a T-Shirt, since enough other people have said similar things, but do I at least get a gif of the shirt and a crayon so I can roll my own? :-) Good work, folks! #--- # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

3 2

Re: Intellectual Property and Crypto collision
by cme＠acm.org 17 Dec '03

17 Dec '03

>Date: Sun, 17 Sep 1995 13:20:06 -0700 >From: John Gilmore <gnu(a)toad.com> > >> ELECTRONIC MEDIA PROTECTED UNDER COPYRIGHT LAW >> A presidential task force has recommended that electronic transmission of [...] > >Would this make it illegal to produce tools for decrypting key-escrowed >software? :-) Yup -- except you will have volunteered. See the Feynman account (citation in http://www.clark.net/pub/cme/html/censor.html ) - Carl

1 0

Cypherpunks Hold a Cracking Party
by Duncan Frissell 17 Dec '03

17 Dec '03

Just to let everyone know that I've got an assignment from Wired to do a story with the above working title. Since Wired is monthly it will be feature rather than news but will give a bit of an inside look at the process. I will be hitting various people up for help and would appreciate it if you send any URLs on the SSL and other such cracks to me. DCF "The freedom of the press belongs to the man who owns one."

1 0

Re: (Yet Another?) Netscape Crack Web page
by Duncan Frissell 17 Dec '03

17 Dec '03

At 04:31 PM 9/19/95 +0200, Laurent Demailly wrote: > >I've been waiting to see here an annoucement of some web page toward >which direct ppl that want more infos on the great (congrats) job Here are some URLs I've collected: http://pauillac.inria.fr/~doligez/ssl/press-conf.html SSL challenge virtual press conference http://www.brute.cl.cam.ac.uk/users/pb/ Piete Brooks home page http://dcs.ex.ac.uk/~aba/ Adam Back's home page http://dcs.ex.ac.uk/~aba/brutessl/ Index of /~aba/brutessl/ http://www.brute.cl.cam.ac.uk/brute/ brute page DCF

1 0