December 2003 - cypherpunks-legacy

Re: Golden Coy Freeh
by R. J. Harvey 17 Dec '03

17 Dec '03

At 06:10 PM 9/25/95 -0400, Black Unicorn wrote: >On Mon, 25 Sep 1995, John Young wrote: >> >> Last week, Mr. Freeh stressed that he preferred a voluntary >> approach. But "if consensus is impossible" on the >> encryption issue, he said, the F.B.I. might consider other >> approaches. >> > >I think it *tremendously* disturbing that the F.B.I. suddenly thinks >itself part of the Legislative branch, able to make law and dictate >policy to the rest of the country. > >In fact there is a plague of this kind of thing, law making in the wrong >channels, as if the executive agencies in the United States were suddenly >able to implement their own law. > Today I attended the Telecommunications Conference here in Blacksburg sponsored by Rep. Rick Boucher (D-VA), in which an interesting cast of characters (including Clarence Irving, Asst Secretary of Commerce for Telecommunication Policy, and presidents and Sr. VPs of Sprint, Time-Warner, GTE, Bell Atlantic) served as panelists. One purpose of the conference was to discuss the upcoming conference committee that will try to reconcile the House and Senate telco reform bills (which Boucher will likely be on). After hearing each of these folks stress the importance of competitiveness, privacy, and security, during the Q&A session I asked the panel what they thought about the likelihood of government-mandated key escrow, which the FBI and others are likely to push. Only Boucher stood up to address the question, and he offered a forceful denunciation of the entire logic of mandated escrow, citing the litany of reasons against it, including the observation that it was ridiculous from a competitiveness standpoint, noting that no foreign customers would ever buy such systems because of the fear that, among others, "the CIA would be reading their mail." He hastened to note that although he felt strongly that in the current congress the calls for mandatory key escrow would go nowhere, "things could look very different" after the next round of elections. The guy from Commerce had nothing to say on the question. rj ------------------------------------------------------------ R. J. Harvey email: harveyrj(a)vt.edu WWW for job analysis/personality: http://harvey.psyc.vt.edu/ PGP key at http://harvey.psyc.vt.edu/RJsPGPkey.txt

1 0

Re: Net KiddiePorn Hype on TV
by jkandt＠mail.wsdot.wa.gov 17 Dec '03

17 Dec '03

> That's not all. This morning I was listening to National Peoples > Radio when there was a story about the "Cyber Angels." It appears > that the "Guardian Angels" from NYC are now out on the net trying to > catch people talking about child pornography. > > This will be real interesting to watch. I don't remember all of the > story, but the best part I heard was when some "Cyber Angel" was > talking about listening a chat session and according to her, GIFs are > codewords for pornography. > > wsh I heard that piece too. Sounded like a total PR move for Curtis Slewah(sp?) and his Guardian Angels. They certainly didn't sound like they knew what they were doing, technically speaking. Representatives from the EFF _AND_ the FBI talked about their "concerns" over private attempts to patrol cyberspace. The EFF representative pointed out that when you "see" a 15 yo female being propositioned by a 45 yo male you really have no idea if either party is what they purport to be. The FBI guy pointed out that there is no provision in the current law for anyone other than law enforcement to posess child pornography and the mere act of downloading such images, even if the intention is to turn them over to the police, would put the "Angels" in violation of the law; also concerned that they might get in the way of police undercover investigations. Slewah himself admitted that there is no way to guarantee that his "Angels" don't tend towards pedophilia themselves and might not have completely pure motives. -Jeff ------- Jeff Kandt "They that give up essential liberty to obtain a little jkandt(a)wsdot.wa.gov temporary safety deserve neither liberty nor safety." Ph:(360)664-3510 (W) --Benjamin Franklin, 1759 PGP Fingerprint: F1 59 8F 88 85 4F 2F 65 C2 5F D3 B5 8C 71 E0 E3

2 1

Security Update news release
by Jeff Weinstein 17 Dec '03

17 Dec '03

Here is the press release we put out this morning regarding the fix for RNG seed and stack overflow problems. --Jeff BETA VERSIONS OF NETSCAPE SECURITY UPDATE TO BE AVAILABLE WEDNESDAY FOR FREE DOWNLOADING Company Puts New Code on Net for Examination; Outside Security Experts Reviewing Software MOUNTAIN VIEW, Calif. (September 25, 1995) -- Netscape Communications Corporation (NASDAQ: NSCP) today announced that it has completed beta versions of the security update for its client and server software and will post the new software for free downloading from the Internet on Wednesday, September 27. The beta versions of the software updates, being posted following a review by internal and outside experts, are in response to the potential vulnerability in the company's security implementation discovered last weekend by two University of California at Berkeley students. In addition, Netscape is taking the opportunity to include other improvements with this update. Netscape addressed the potential vulnerability by increasing the amount of random information it uses to seed the random number generator in its security implementation. In Netscape's security approach, the random number generated is used in a mathematical formula to create a "session key" for encrypting information to be sent across the Internet. The new solution uses many times more random information than the previous version, ensuring much greater degrees of difficulty in identifying the key used to encrypt a particular session. The solution is also now assembled in a platform-dependent manner which, when combined with the increase in random information, makes Netscape's products substantially more secure than before the update. Netscape's source code that will be used to address the potential vulnerability has already been posted on the Internet so that it can be reviewed by anyone wishing to do so. This technique is often used in the development of security software to ensure the highest level of inspection possible before the final software is made available to customers. The code is also being reviewed by external security experts retained by Netscape and various Netscape platform partners with expertise in specific operating system environments to provide additional checks on the soundness of Netscape's approach. "We have always encouraged users to provide feedback on new versions of our software, and our posting of this security source code on the Internet is a natural extension of that approach," said Mike Homer, vice president of marketing at Netscape. "We plan to continue to use the Internet to test new software versions, as we will shortly with the beta version of our newly announced Netscape Navigator 2.0. We expect that this kind of open review will help us continue to create products of the highest quality." Netscape is using the opportunity of this week's beta releases to also update other portions of its software, addressing such issues as domain-name limitations in international versions of Netscape Navigator and potential stack overflow conditions. Netscape is also placing the beta versions of the security updates for its Netscape servers on the Internet for free download by customers. "We process hundreds of customer orders daily using Netscape software. Netscape's commitment to excellence as evidenced by the company's immediate action in response to reported vulnerabilities is one of the many reasons Internet Shopping Network has chosen Netscape products for conducting Internet commerce," said Randy Adams, president of Internet Shopping Network. "We have built a multi-million dollar business on the Internet using Netscape products and they are a major factor in our success." The beta versions of the updated software -- Netscape Navigator 1.2.1b for Windows, Netscape Navigator 1.1.1b for Macintosh and UNIX, Netscape Commerce Server 1.1.1b, and Netscape Proxy Server 1.1.1b -- will be available on Wednesday for downloading from Netscape's home page at http://home.netscape.com. All Netscape users are encouraged to download the new versions as soon as possible to ensure they are using the most up-to-date security software from Netscape. Final versions of the updates will be posted after all testing is complete. Netscape Communications Corporation is a premier provider of open software to enable people and companies to exchange information and conduct commerce over the Internet and other global networks. The company was founded in April 1994 by Dr. James H. Clark, founder of Silicon Graphics, Inc., a Fortune 500 computer systems company; and Marc Andreessen, creator of the NCSA Mosaic research prototype for the Internet. Traded on Nasdaq under the symbol "NSCP", Netscape Communications Corporation is based in Mountain View, California. ### Additional information on Netscape Communications Corporation is available on the Internet at http://home.netscape.com, by sending email to info(a)netscape.com or by calling 415-528-2555. Netscape Communications, the Netscape Communications logo, Netscape, Netscape Navigator, Netscape Commerce Server and Netscape Proxy Server are trademarks of Netscape Communications Corporation. All other product names are trademarks of their respective companies. -- Jeff Weinstein - Electronic Munitions Specialist Netscape Communication Corporation jsw(a)netscape.com - http://home.netscape.com/people/jsw Any opinions expressed above are mine. We issued the following news release this morning: ---------------------- FOR IMMEDIATE RELEASE BETA VERSIONS OF NETSCAPE SECURITY UPDATE TO BE AVAILABLE WEDNESDAY FOR FREE DOWNLOADING Company Puts New Code on Net for Examination; Outside Security Experts Reviewing Software MOUNTAIN VIEW, Calif. (September 25, 1995) -- Netscape Communications Corporation (NASDAQ: NSCP) today announced that it has completed beta versions of the security update for its client and server software and will post the new software for free downloading from the Internet on Wednesday, September 27. The beta versions of the software updates, being posted following a review by internal and outside experts, are in response to the potential vulnerability in the company's security implementation discovered last weekend by two University of California at Berkeley students. In addition, Netscape is taking the opportunity to include other improvements with this update. Netscape addressed the potential vulnerability by increasing the amount of random information it uses to seed the random number generator in its security implementation. In Netscape's security approach, the random number generated is used in a mathematical formula to create a "session key" for encrypting information to be sent across the Internet. The new solution uses many times more random information than the previous version, ensuring much greater degrees of difficulty in identifying the key used to encrypt a particular session. The solution is also now assembled in a platform-dependent manner which, when combined with the increase in random information, makes Netscape's products substantially more secure than before the update. Netscape's source code that will be used to address the potential vulnerability has already been posted on the Internet so that it can be reviewed by anyone wishing to do so. This technique is often used in the development of security software to ensure the highest level of inspection possible before the final software is made available to customers. The code is also being reviewed by external security experts retained by Netscape and various Netscape platform partners with expertise in specific operating system environments to provide additional checks on the soundness of Netscape's approach. "We have always encouraged users to provide feedback on new versions of our software, and our posting of this security source code on the Internet is a natural extension of that approach," said Mike Homer, vice president of marketing at Netscape. "We plan to continue to use the Internet to test new software versions, as we will shortly with the beta version of our newly announced Netscape Navigator 2.0. We expect that this kind of open review will help us continue to create products of the highest quality." Netscape is using the opportunity of this week's beta releases to also update other portions of its software, addressing such issues as domain-name limitations in international versions of Netscape Navigator and potential stack overflow conditions. Netscape is also placing the beta versions of the security updates for its Netscape servers on the Internet for free download by customers. "We process hundreds of customer orders daily using Netscape software. Netscape's commitment to excellence as evidenced by the company's immediate action in response to reported vulnerabilities is one of the many reasons Internet Shopping Network has chosen Netscape products for conducting Internet commerce," said Randy Adams, president of Internet Shopping Network. "We have built a multi-million dollar business on the Internet using Netscape products and they are a major factor in our success." The beta versions of the updated software -- Netscape Navigator 1.2.1b for Windows, Netscape Navigator 1.1.1b for Macintosh and UNIX, Netscape Commerce Server 1.1.1b, and Netscape Proxy Server 1.1.1b -- will be available on Wednesday for downloading from Netscape's home page at http://home.netscape.com. All Netscape users are encouraged to download the new versions as soon as possible to ensure they are using the most up-to-date security software from Netscape. Final versions of the updates will be posted after all testing is complete. Netscape Communications Corporation is a premier provider of open software to enable people and companies to exchange information and conduct commerce over the Internet and other global networks. The company was founded in April 1994 by Dr. James H. Clark, founder of Silicon Graphics, Inc., a Fortune 500 computer systems company; and Marc Andreessen, creator of the NCSA Mosaic research prototype for the Internet. Traded on Nasdaq under the symbol "NSCP", Netscape Communications Corporation is based in Mountain View, California. ### Additional information on Netscape Communications Corporation is available on the Internet at http://home.netscape.com, by sending email to info(a)netscape.com or by calling 415-528-2555. Netscape Communications, the Netscape Communications logo, Netscape, Netscape Navigator, Netscape Commerce Server and Netscape Proxy Server are trademarks of Netscape Communications Corporation. All other product names are trademarks of their respective companies. Rosanne M. Siino Director of Corporate Communications Netscape Communications Corp. 415-528-2619

2 3

Re: `Random' seed.
by David Van Wie 17 Dec '03

17 Dec '03

Matt Blaze <mab(a)crypto.com> wrote: >Here's my current favorite quick-and-dirty true-random-in-software generator. >Use at own risk and read the comments carefully... [...] > * Physically random numbers (very nearly uniform) > * D. P. Mitchell > * Modified by Matt Blaze 2/95 [...] > * WARNING: depending on the particular platform, truerand() output may > * be biased or correlated. In general, you can expect about 16 bits of > * "pseudo-entropy" out of each 32 bit word returned by truerand(), > * but it may not be uniformly diffused. While this comment provides some general information, it does not give the expected entropy in the form of testable assumptions. A first step in this direction is to provide the entropy series used to arrive at the 16 bit per 32 bit word estimate. The second step, as I recommended last week (RE: RNG Resource FAQ... on 9/22), is to provide a concise argument drawn directly from the mathematical weaknesses of the entropy series. In that post, I posed the following four criteria because they address the mathematical (theoretical) weaknesses of the entropy series, while using a vocabulary that should be sensible to a rigorous designer: 1) The states exist and can be identified. 2) The number of states n is known. 3) The index value i uniquely identifies a state. 4) The function P_i is known and well-behaved. In this way, an analyst can review both the entropy series itself, and a _concise_ statement of the criteria under which the series is defined (i.e. when the 4 mathematical weaknesses have been appropriately addressed), and the argument "why" has been scrutinized against the code or proposed design. dvw

1 0

RE: More on "Entropy"
by David Van Wie 17 Dec '03

17 Dec '03

David Van Wie wrote: >>The entropy E is defined by the sum across n states of -P_i log_2(P_i), Timothy C. May wrote: >Hah! Another physicist converted to the information-theoretic view of entropy! Indeed. I was able to track down the literature, and it is most interesting. I am still a little bit skeptical of the "superset including thermodynamic entropy" school of thought, but I haven't finished reading all of the materials yet! Clearly, the IT "version" of entropy is a well defined and useful thing.... >I should've pointed out in my reading list that several names stand out in >this interpretation: I'll read with that endoresement in mind. Your thoughts on rigorous, _concise_, design criteria for sources of entropy would be appreciated (unless there is good quality work in the literature I haven't come to yet). dvw

1 0

RE: Netscape "random" number seed generator code available
by David Van Wie 17 Dec '03

17 Dec '03

Phil Karlton wrote: >[You will be expected to show your work. :-)] In the spirit of showing work, how about a run through the entropy series? dvw

1 0

The Law of ElectronicCommerce: EDI, E-mail and Internet
by rah＠shipwright.com 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Mon, 25 Sep 1995 20:49:03 -0700 From: Davidwfox(a)eworld.com To: www-buyinfo(a)allegra.att.com, e-payment(a)bellcore.com Subject: The Law of ElectronicCommerce: EDI, E-mail and Internet FYI... Little Brown and Co. announces release of _The Law of Electronic Commerce: EDI, E-mail and Internet_ (Second Edition) by Benjamin Wright. This 640 page book has been updated to cover the latest developments in electronic commerce, including the Utah Digital Signature Act, electronic cash, computer records, and Internet commerce. For more information, contact Little, Brown at tel: 800-331-1664; tel: +1-617-890-0250; fax: +1-617-890-0875. The summary table of contents is available on the world wide web at http://infohaus.com/access/by-seller/Benjamin_Wright --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: Primality verification needed
by William Allen Simpson 17 Dec '03

17 Dec '03

While you folks are poking at Phil's latest, perhaps you could verify the others that he generated, already in the Photuris internet-draft: A 1024-bit strong prime (p), expressed in hex: 97f6 4261 cab5 05dd 2828 e13f 1d68 b6d3 dbd0 f313 047f 40e8 56da 58cb 13b8 a1bf 2b78 3a4c 6d59 d5f9 2afc 6cff 3d69 3f78 b23d 4f31 60a9 502e 3efa f7ab 5e1a d5a6 5e55 4313 828d a83b 9ff2 d941 dee9 5689 fada ea09 36ad df19 71fe 635b 20af 4703 6460 3c2d e059 f54b 650a d8fa 0cf7 0121 c747 99d7 5871 32be 9b99 9bb9 b787 e8ab The recommended generator (g) for this prime is 2. A 1024-bit strong prime (p), expressed in hex: a478 8e21 84b8 d68b fe02 690e 4dbe 485b 17a8 0bc5 f21d 680f 1a84 1313 9734 f7f2 b0db 4e25 3750 018a ad9e 86d4 9b60 04bb bcf0 51f5 2fcb 66d0 c5fc a63f bfe6 3417 3485 bbbf 7642 e9df 9c74 b85b 6855 e942 13b8 c2d8 9162 abef f434 2435 0e96 be41 edd4 2de9 9a69 6163 8c1d ac59 8bc9 0da0 69b5 0c41 4d8e b865 2adc ff4a 270d 567f The recommended generator (g) for this prime is 5. Bill.Simpson(a)um.cc.umich.edu Key fingerprint = 2E 07 23 03 C5 62 70 D3 59 B1 4F 5E 1D C2 C1 A2

1 0

Suspicious Action Reports
by Brad Dolan 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- [...] And as for FinCEN, it has recently become the repository for the new SAR's (Suspcious action reports) to be filed by all banking entities and replacing the multiple paperwork forms and sites, as stated in the Federal Register. One thing I noted was the expansion of surveillance responsibility for banks and other financial transaction organizations. And whether new or not, I experienced horror upon reading that financial institutions are supposed to file a SAR for any suspicious activity, as perceived by the bank, and is prohibited from disclosing the fact of the SAR to the subject and required to make financial transaction records, which must be retained for ten years, available to law enforcement "upon request" - a description which is lacking a search warrant. The regulations in the FR, identical for all institutions, actually discussed bankers and related organizations as entering into "partnerships" with the federal gestapo in naming names. Names, that is, of people and monetary transactions that bank and other financial facilities find "suspicious" - a subjective assessment based on whatever criteria happen to be in the minds of employees.

1 0

Re: Hack Microsoft?
by dan＠milliways.org 17 Dec '03

17 Dec '03

On Tue, 26 Sep 1995 00:04:08 -0400 (EDT) you wrote: > > > Microsoft recently got C2-security status approved for Windows NT by >the National Computer Security Center, a division of the NSA. They >are supposed to put systems through "laborious testing and review" before > If Cypherpunks can find flaws that the NSA can't, or won't divulge, >what does that say about their so-called COMSEC ability. > For fun ways to hack NT, check out http://www.somar.com/security.html. Some of these are really laughable. You can use NT's LogonUser API call to repeatedly guess passwords until you hit it, since NT offers no way to limit number of login attempts. There also is no way to stop remote users from modifying the registry. *Any* user with an account can remotely dump and modify the system registry. So in theory you can write a bruteforce program to keep guessing until it gets a password, then modify the registry to make the system to "interesting" things. The worst part of all this is that the Registry is very poorly documented, MSoft must consider most of that info "confidential." Fortunately, when using NT's SMB services such as drive and file sharing, passwords are never sent in the clear. Just make sure you disable that "Guest" account.:) Dan Bailey *************************************************************** #define private public dan(a)milliways.org Worcester Polytechnic Institute and The Restaurant at the End of the Universe ***************************************************************

2 1