December 2003 - cypherpunks-legacy

(Fwd) Netscape Commerce Server and Certificates
by Peter Trei 17 Dec '03

17 Dec '03

>From www-security... ------- Forwarded Message Follows ------- Date: Sat, 23 Sep 95 01:07:38 From: <atri(a)netscape.com> Subject: Netscape Commerce Server and Certificates To: "john hemming ceo marketnet" <johnhemming(a)mkn.co.uk>, www-security(a)ns2.rutgers.edu Cc: The Commerce server is significantly less vulnerable because: 1. Key pairs are generated only once 2. Access to the actual server is limited for hackers to try to guess with some accurace when the key pair was generated. 3. The time it takes to generate key pairs is about 5 seconds on a reasonably powerful UNIX machine. 4. Since the random number seed address space is 30 bits, even if one knew approximately when the server key-pair was generated it only reduces this dows to say 20 bits. Therefore the operation can take anywhere from (2**20 to 2**30) * 5 seconds = 5 million to 5 billion seconds. 5 million seconds = 57.8 days 5 billion seconds = 158 years 5. We plan to have the patch available by next week 6. You are right about server owners having to get new certificates. Netscape and VeriSign will offer new six month certificates to all current certificate owners at no charge. --Atri At 09:58 PM 9/22/95 PDT, John Hemming CEO MarketNet wrote: >>Netscape Commerce server certificates use RSA key pairs generated by the >>user, i.e. with "Netscape's shoddy random number genrator" (sic). All the >>server running in "secure" mode need new RSA keys and certificates as noted >>in the following excerpt from the official Netscape response. > >>"In addition, the current version of the Netscape Commerce Server has a >>similar vulnerability during it's initial key-pair generation. Therefore, a >>patch will be made available from Netscape and should be applied by Commerce >>Server customers to generate a new key pair and server certificate." >If that is really what Netscape have issued then it needs correcting unless >for some reason RSA's private key is stored in the Commerce Server. I would >presume that a certificate request would be needed instead. > >There is really quite a high noise to signal ratio in dealing with the >non randomness of the unix Navigator (which is what I understand >the problem to be). > > > > ____________________________________ Atri Chatterjee Server Marketing Netscape Communications Corporation (415) 528-2834 (ph) (415) 528-4120 (fax) Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

1 0

Self-Prohibition List
by Fuck You 17 Dec '03

17 Dec '03

List of things you should prohibit yourself from putting in writing in a GAK'ed Universe: 1. You're Jewish.

3 2

Re: Seeds which depend on machine states
by James A. Donald 17 Dec '03

17 Dec '03

At 08:19 AM 9/22/95 -0700, Patrick Horgan wrote: > That assumes that you have someway of measuring the timing to microsecond > precision. On most machines I've been on, if you get something time- > stamped, even if there is a microsecond portion of the timestamp it's > meaningless because it wasn't based on a timer with the required precision. On Windows there is a timer with the required precision -- not microsecond accuracy of course -- microsecond precision. For our purposes the less accuracy the better. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: HEY!!! WAS: The Next Hack
by dmandl＠panix.com 17 Dec '03

17 Dec '03

Looks like we've got a perfect candidate for the first Official Cypherpunks Press Release, folks. --D. At 7:16 AM 9/23/95, Censored Girls Anonymous wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >Hey wait a minute!!! > >You HAD stated a patch would be available by Friday. >Now we are at early next week. > >I watched the stock rise in the face of bad facts. >Almost 25% of your stock changed hands yesterday. > >For the moment, it seems to me, anyway, you're getting >a lot of work done here for dirt cheap. I don't know >cypher codes very well, but I know Wall St. codes really >well. And THEY ARE BEING VIOLATED! I am glad there is no >anonymity on Wall St. We are starting to get into the >realm of SEC action. And I could really care much about >what happens out on the list. > >This is not a problem that lends itself to 'quick fixes'. >For the only "quick fix you can give is still insecure crypto". > >That is the point of this. >You can't really fix it. >Most of us know it. >The lies mount up >on the stock price. > >I normally couldn't care less, I'm a Coca-Cola trader. >My stock is at an all time high as I write this. >It's up over 1200% in 10 years. No one can match it. (even MSFT) > >This is much worse than NEW COKE! > >For you are now better off letting them break key after key, >server after server, until the laws change. > >I'd go back and talk to your management fast. >For now you've become a pawn in a political game. >And millions of dollars change hands daily as a result. > >Soon they will halt your stock trading if this keeps up. > >Something, in a way far worse than ever having Netscape cracked! > >Think about it. > >Love Always, > >Carol Anne >ps I shipped all the postings to Washington already. > >> What exactly is the point of this? We have: >> >> 1) acknowledged that the RNG used in the server private-key >> generation has the same problem >> >> 2) said that we will provide a patch early next week >> >> 3) said that we will provide new certificates for all customers >> >> 4) promised to make source code for our new seed generation code >> publicly available > >> What else do you hope to gain by breaking a server key? I think >>Jeff Weinstein - Electronic Munitions Specialist >>Netscape Communication Corporation >>jsw(a)netscape.com - http://home.netscape.com/people/jsw >>Any opinions expressed above are mine. > > >-----BEGIN PGP SIGNATURE----- >Version: 2.6.2 > >iQCVAwUBMGP6MIrpjEWs1wBlAQFh3QP8D+m5NyD4WNZEyOSzollcUDqEQusjxr5s >0t9455KBAGnvt/5UAyaQ0JdDqZ3wRePsoC9VVxHiiITjhZGbwalcgrDVmajAXVbG >T+Hm4PEpM7tWt+R6pMvjhGcP2ldtzZf+OErE/yCSPTooxuOX5H6bBpb5e88n0eqo >JpbxSBXgCX4= >=C7J9 >-----END PGP SIGNATURE----- >-- > >Member Internet Society - Certified BETSI Programmer - Webmistress >*********************************************************************** >Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 >My Homepage >The Cyberdoc >*********************************************************************** >------------------ PGP.ZIP Part [017/713] ------------------- >M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M >MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ >MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` >------------------------------------------------------------- >for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/ -- Dave Mandl dmandl(a)panix.com http://wfmu.org/~davem

2 1

Re: Seeds which depend on machine states
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> > Miguel Diaz writes: > > It is my suspicion that seeds which depend on machine > > states(ie state of your computer at a specific instance of > > time) would always be subject to scrutiny and de-cryption. > > As long as the software used to encrypt is not self-modifying, > > the machine state can (through careful manipulation involving > > temperature, clocks, processes etc)always be replicated and > > fixed to an acceptable degree. > > Try getting a human to type with the same timing, to microsecond > precision, the same way twice. > That assumes that you have someway of measuring the timing to microsecond precision. On most machines I've been on, if you get something time- stamped, even if there is a microsecond portion of the timestamp it's meaningless because it wasn't based on a timer with the required precision. If a timer can only resolve milliseconds, the microseconds don't have any meaning. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

2 1

Cypherpunks mailing list starts in Japan
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: hanabusa(a)postbox.bnn-net.or.jp Mime-Version: 1.0 Date: Sat, 13 Sep 1997 00:44:50 +0900 To: gnu(a)toad.com, tcmay(a)got.net, hugh(a)xanadu.com, shamrock(a)netcom.com, vince(a)offshore.com.ai, ddt(a)lsd.com, eb(a)comsec.com, sameer(a)c2.net, rah(a)shipwright.com, sandfort(a)crl.com, iang(a)cs.berkeley.edu From: "Sh.Hanabusa" <hanabusa(a)bnn-net.or.jp> Subject: Cypherpunks mailing list starts in Japan -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 News. Today we have a new mailing list "cypherpunks-j". (for Japanese and English) It is hosted by Joichi Ito. This is the first step for cypherpunk movement in Japan. I hope this list changes this country. > Mailing-List: contact cypherpunks-j-help(a)htp.org; run by ezmlm > Sender: cypherpunks-j-owner(a)htp.org > Reply-To: cypherpunks-j(a)htp.org > X-ftpsite-URL: ftp://ftp.htp.org/pub/crypto/ > X-unsubscribe-URL: mailto:cypherpunks-j-unsubscribe@htp.org > X-subscribe-URL: mailto:cypherpunks-j-subscribe@htp.org > Delivered-To: mailing list cypherpunks-j(a)htp.org > X-Sender: joiito(a)pop4.ibm.net > Date: Fri, 12 Sep 1997 16:20:41 +0200 > From: Joichi Ito <jito(a)eccosys.com> > Subject: [cpj:65] welcome to cypherpunks-j > Mime-Version: 1.0 > > so... this is the new list... lets see if it works. > > I made it cypherpunks-j, but I put cpj in the subject... what do you think? > > I hope this works... > > - Joi > _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ Shuichiro Hanabusa (hanabusa(a)bnn-net.or.jp) Producer/Special Programs, NHK Enterprises 21 Inc. Location: Tokyo / Japan PGP Fingerprint (DSS) 5696 2D67 8DF1 89C6 6E30 6E9A 7A7E 08A9 A75E 5BD7 _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.0 for non-commercial use <http://www.pgp.com> Charset: noconv iQA/AwUBNBlji3p+CKmnXlvXEQKQbQCgrWomTzjNkdjOKKCig7x/0VFxunYAnjQ5 lRPXC+CpQ5dDa5BXCmMK5zNC =U5qX -----END PGP SIGNATURE----- --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

Are we men or mice? Re: House panel votes behind closed doors to build in Big Brother (fwd)
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Fri, 12 Sep 1997 14:27:06 -0400 From: "Shabbir J. Safdar" <shabbir(a)vtw.org> To: fight-censorship(a)vorlon.mit.edu, fight-censorship-announce(a)vorlorn.mit.edu Subject: Are we men or mice? Re: House panel votes behind closed doors to build in Big Brother At 11:37 PM -0700 9/11/97, Declan McCullagh wrote: > ---------- Forwarded message ---------- > Date: Thu, 11 Sep 1997 23:37:39 -0700 (PDT) > From: Declan McCullagh <declan(a)well.com> > To: fight-censorship-announce(a)vorlon.mit.edu .. > That's why the encryption outlook in Congress is abysmal. Crypto-advocates > have lost, and lost miserably. A month ago, the debate was about export > controls. Now the battle is over how strict the //domestic// controls will > be. It's sad, really, that so many millions of lobbyist-dollars were not > only wasted, but used to advance legislation that has been morphed into a > truly awful proposal. This suggests the battle is over and lost. It's not, and a tone of this sort only plays into the FBI's hands. Feeling like they're on a roll, if the community throws in the towel now, as your tone above suggests, we cede defeat and get domestic restrictions. We have a goddamn right to use encryption without a government backdoor, and I, and nobody else, should give up until it's dragged from our rigor-mortis-addled hands. In Congress, there are still votes left, and we should be fighting to make sure that no member of Congress that has a vote at any point in this process should cast that vote without knowing that their net constituents care about this. They may not always vote with their constituents' wishes (and that is frustrating to all of us) but we certain-as-hell shouldn't let them make that call without having at least constituent input. You want to see effectiveness and change, do something constructive instead of whining on the net. For example, let people know that by signing up for the Adopt Your Legislator program at http://www.crypto..com/member/ they will be notified before and after every vote that their legislator is a party to, complete with phone and fax nnmbers. It may look gloomy now, but bad votes should only make us madder and more determined to lobby Congress. It's easy to complain about the fact that you don't like the direction the boat is going; much harder to devote your energies to actually changing the course. Pick up an oar and row. If you get domestic restrictions on encryption and you haven't been calling your member of Congress on a regular basis to tell them to do the right thing, you'll get exactly the kind of government you've invested in. -S PS I would like this to go to fight-censorship-announce as well, please.

4 3

MacRandoms
by W. Kinney 17 Dec '03

17 Dec '03

I tried posting this a few days ago, but it evidently got lost because of the problems with the list. Anyway, I've uploaded my random number generator number generation code for the Mac to: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/randomness/MacRandoms.sea.hqx This file contains Colin Plumb's randpool code, my Macintosh wrapper for it, and a nice 68K assembler implementation of MD5 as a bonus. Enjoy. -- Will

1 0

Re: FCPUNX:Are we men or mice? Re: House panel votes behind closed doors to build in Big Brother
by She Devil With A Modem 17 Dec '03

17 Dec '03

Also Sprach Ray Arachelian: > > On Fri, 12 Sep 1997, Declan McCullagh wrote: > > > We have a goddamn right to use encryption without a government backdoor. It is not just a right, it is very nearly almost a law of NATURE. Not just a creation of logic, but a certainty that cannot be compensated for or guarded against. > Frankly among certain crowds many backdoors and other bugs have been > detected in most OS's, how will the mother fuckers keep them from being > found and used? I mean, all you have to do is simply get their attention > and have them snoop on you, meanwhile you watch all the packets and record > the weird ones and you've got a copy of their session. Don't get distracted by wasting too much time in inappropriate places. My definition of "inappropriate places" being "places that do not yield enough information perceived as useful". The people who are viewed as the "enemy" here have a hell of a lot more experience judging the value of information as a weapon. (Not that this should be discouraging, just taken into consideration.) The weapon can and does become useless, especially if it concerns personal information, if the person involved has the emotional strength to be able to resist emotional blackmail. An enormous victory can be won by the STRONG, who are capable of withstanding personal attack in this regard and causing the enemy to waste enormous amounts of their time trying to accomplish impossible goals of erosion on individual self esteem. If you believe that this is mere paranoia, I urge you to make a serious examination of the circumstances of Alan Turing's death. As cypherpunks, you should all be interested enough to do so. His death and the shady circumstance surrounding it are a thing to be learned from. > After the evil laws, our jobs will be to break ALL GAK'ed software. How > will they prevent that? Passing more laws to make the exposure of bugs > and holes illegal? Sort of like the cell scanner laws? :) There is a certain amount of quality control that the cypherpunks are doing for the intelligence agencies, and those same are perfectly willing to allow you to continue to do that...for now. Nor is it any coincidence that (I'm sure) some of you have been approached by said places with terms of employment and/or indoctrination. And of course this publicly available list is well populated with people who are perfectly willing to spam it with controversial and time-wasting rhetoric, designed to make those of you who are good at coding angry enough to waste your time denouncing their "chaff" instead. You are not dealing with either stupid or moral people when it comes to TLAs. Remember this, please. Once I believed in this country enough to die for it, I believed their propaganda and their lies. That was before I got a good eyeful of the incompetence, cruel lack of concern for human lives, the obsession with power and the selfish greed that permeates the American military; the unnamed "fourth branch" of our government; the sort of people who would allow a five BILLION dollar facility in Maryland to be built for their pleasure while people in New York and Los Angeles and Austin and Chicago - CITIES IN THE SAME COUNTRY THEY HAVE SUPPOSEDLY SWORN TO DEFEND - are dying of starvation, drug addiction, poor medical care, and the odd police brutality incident! I ask, no, I BEG you now, those of you who have the power to fight this: retain your individualistic morals and let no one subvert them by any means, because they are TRULY what our country was founded upon! I still believe in those ideals, yes - in SPITE of my exposure to the pack of misguided, selfish, greedy sons of bitches who have managed after two hundred years to turn it into a travesty of what it once was, and what it once meant to me. Don't let them jam you with their chaff! Ignore the bullshit and THINK! It's the LAST thing THEY want you to do! -- "It was sweet to hear of the Pathfinder | Do not CD c engineer's bumper sticker: 'My other | taunt --------P===\==/ vehicle is on Mars!'" -- Stan Kelly-Bootle, | happy fun /_\__ Unix Review Oct 1997 | fencer! _\ \

1 0

Random crypto legal stuff
by Greg Broiles 17 Dec '03

17 Dec '03

I just talked to a docket clerk at the Ninth Circuit - they say that no oral argument has been scheduled in the Bernstein case (case # is 97-16686 at the appellate level), and no action has been taken since the government's emergency stay motion was filed. Also, I spoke with someone at BXA re their updated crypto EARs - they confirmed that a second draft has been prepared, but say that it's circulating "at the inter-agency level" and is not available to the public, even though they'll be discussing it in Portland in two weeks. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto.

1 0