December 2003 - cypherpunks-legacy

NYT on Nscp Flaw 3
by John Young 17 Dec '03

17 Dec '03

The New York Times, September 26, 1995, p. D19. Hackers Alert Netscape to Another Flaw By Bloomberg Business News Mountain View, Calif., Sept. 25 -- The Netscape Communications Corporation said today that a third flaw had been discovered in its Internet access software by a group of computer hackers who call themselves the Cypherpunks. The hackers -- computer users and mathematicians who try to discover weaknesses in computer software and networks -- found a design flaw that can shut down Netscape's Navigator browser software, which helps people travel on the Internet. Two American college students last week broke Netscape's software security code, a design flaw that could jeopardize financial transactions done using Navigator. A month earlier, a French hacker broke a different Netscape security code. "We are learning a lot from these problems," said Michael J. Homer, vice president of marketing at Netscape. Shares of the company, which sold its first stock to the public last month, rose $4.25 today to close at $67 in Nasdaq trading. The latest flaw found by the hacker group is a programming error in Netscape software used to navigate the World Wide Web, a part of the Internet made up of photos, sounds and drawings. End]

1 0

Mixmaster Remailer FAQ
by Mixmaster 17 Dec '03

17 Dec '03

Frequently Asked Questions about Mixmaster Remailers [FAQ Verson 1.5 Sept 22 1995] by Lance Cottrell This document is a semi-technical discussion of Mixmaster remailers. I wrote this to answer questions often asked by new users of Mixmaster, and to explain why you would want to use Mixmaster remailers. At the end of this FAQ is a list of currently active Mixmaster remailers. What is the most recent version of Mixmaster? I am pleased to announce the release of Mixmaster 2.0.2 It contains many bug fixes. It also provides random remailer chaining. What is Mixmaster? Mixmaster is a new class of anonymous remailers. Inspired by the existing "cypherpunk" remailers and discussions on the Cypherpunk mailing list <cypherpunks(a)toad.com>, Mixmaster is the next generation in the evolution of remailer technology. What is an anonymous remailer? Quoting from Andre Bacard's remailer FAQ: An anonymous remailer (also called an "anonymous server") is a free computer service that privatizes your e-mail. A remailer allows you to send electronic mail to a Usenet news group or to a person without the recipient knowing your name or your e-mail address. For a non-technical introduction to remailers (not including Mixmaster), I recommend Andre's FAQ. It is posted regularly to: alt.privacy,alt.privacy.anon-server,alt.anonymous or you can get it by sending mail to: To: abacard(a)well.com Subject: Help1 Message: [Ignored] What do I need to use Mixmaster remailers? Unlike other remailers, you can't just make your own message and send it to the remailer. Mixmaster's security comes in part from using a special message format. The disadvantage of this is that you need a special program to make the message for you. Once you have that program (the client) remailing is as easy as running the program, and telling it which remailers you want to use. How do I get the Mixmaster client software? There are two sites for distribution. The first is my machine: http://obscura.com/~loki/Welcome.html/ or ftp to obscura.com and read /pub/remail/README.no-export The other is by anonymous ftp to jpunix.com You will have to follow the instructions there to get Mixmaster. Because Mixmaster contains cryptography, it may not be exported from the U.S and Canada. The reason for the circuitous route to download Mixmaster is to show my good faith efforts to keep Mixmaster from being exported. I have heard rumors that someone has already broken this law, and that Mixmaster is available from Europe. I do not approve of this and will not support that site. How do I get the software to run a Mixmaster remailer? The remailer software is available from the same sites as the client. But I only see one Mixmaster distribution? The same program is used for both the client and the remailer. The only difference is in the installation. For the client you just compile it and you are ready to go. For the remailer, you need to set up mail forwarding and cron jobs. What kinds of computers does Mixmaster run on? Unfortunately, not PCs or Macs. But it is being ported to those right now. Mixmaster runs under UNIX. The only machine it is known not to work on is Dec Alpha. It has been tested on Linux, FreeBSD, SunOS 4.1.3, Solaris, and several others. It has been compiled and tested on Netcom. If you use it on a machine or service not on this list, please let me know so I can add it. How does Mixmaster work, and why should I use it? You should use Mixmaster if you want the highest level of anonymity available, or if your are tired of building remailer messages your self. A discussion of how Mixmaster provides this level of security is beyond the scope of this FAQ, but I put an essay on the subject on my home page <http://obscura.com/~loki/remailer-essay.html> Does Mixmaster use PGP? No, Mixmaster uses the rsaref package from RSA. Mixmaster uses its own keys and key file formats. To add a key to a key ring, simply append the key to your key file using your favorite text editor. When Was Mixmaster Released? Mixmaster was originally released on an experimental basis in late 1994. There were only ever two remailers running Mixmaster 1.0. Mixmaster 2.0 was released on May 3, 1995. There are now 18 publicly available Mixmaster remailers. What is the latest version of Mixmaster? Version 2.0.2 was released on Sept 22, 1995. Mixmaster remailers can now accept messages containing multiple Mixmaster packets. Mixmaster can be told to choose a random set of remailers to chain your message through. It will now route multiple packet messages over independant chains. Several minor bugs were fixed. Version 2.0.1 was released on May 27, 1995. The only changes from 2.0 are some improvements in the documentation, and the inclusion of a more up to date list of remailers. What remailers run Mixmaster? The most recent list of remailers is available on my homepage, along with the remailer list and key file for Mixmaster. You can simply replace your old files with the ones from my site to keep up to date. These files are in ftp://obscura.com/pub/no-export/ They are also available by ftp. Here is the current list of Mixmaster remailers. Send mail to the remailer with the subject remailer-key to retrieve the remailers Mixmaster key. mix mixmaster(a)obscura.com vishnu mixmaster(a)vishnu.alias.net crown mixmaster(a)kether.alias.net knight mixmaster(a)aldebaran.armory.com robomix robo(a)c2.org hroller hroller(a)c2.org syrinx syrinx(a)c2.org replay remailer(a)replay.com hacktic remailer(a)utopia.hacktic.nl crynwr remailer(a)crynwr.com spook remailer(a)spook.alias.net flame remailer(a)flame.alias.net gondolin mixmaster(a)gondolin.org q q(a)c2.org Armadillo remailer(a)armadillo.com precipice mixmaster(a)mix.precipice.com anon mixmaster(a)anon.alias.net secrets secret(a)secret.alias.net Since this is a new FAQ, I am sure it is far from comprehensive. Watch this space for changes to the FAQ. It will be evolving rapidly for a while. Please send any questions you think should be here to: loki(a)obscura.com My outpost on the WWW is <http://obscura.com/~loki/Welcome.html>

1 0

Netscape "random" number seed generator code available
by karlton＠neon.netscape.com 17 Dec '03

17 Dec '03

Once again I speak for myself and not Netscape. The random number seed generation code is now available for review: ftp://ftp1.netscape.com/pub/review/RNGsrc.tar.Z The README from that file is appended below. Netscape has fixed other less glaring but potentially interesting problems and those fixes will be included with the patch that goes out in the near future. As is mentioned in the README, more will need to be done to find more bits of entropy. (Too much of a good thing is still not enough.) However the security team believes that the RNG seed is no longer the weak link and candidate for attack. So I am personally volunteering to have my had shaved if a discovered deficiency in this code results in an easily attacked generated seed. [You will be expected to show your work. :-)] ============================== README =========================== This code represents the heart of Netscape's random number seed generator. The initialization routines are called by the various client front ends and servers and other Netscape software. Furthermore, the server will be putting seed information into the environment of each of the CGI invocations. Here's some things a client does: * Application specific files are passed to SEC_FileForRNG(). For the client this includes the global history file. * The clients then read a portion of the screen depending upon the current state of the hash. * The Update functions feed into an MD5 hash. The MD5 code isn't ours to publish. * User input is used for server side key generation and in client front ends for increasing RNG state entropy over time. This code needs to be portable. We can't access device specific registers that are not guaranteed to be on all relevant platforms. Recommendations to users of Netscape who rely on the security of their transactions: If the attacker has physical access to your machine, security cannot be assured. Netscape continues to point out that if unwanted agents can log into your machine, little can be secure. For secure servers, any insecure connection mechanism could be suspect. Multi-user UNIX platforms will not be as secure as single-user machines. Details: Some of the system specific information that is used in the seed generation is available to any user on that system. To help mitigate this, the entire user environment is passed into the seed generation algorithm. A wary user can alter his user environment before running Netscape software. If someone can get root (superuser) access to your machine, they can pretty much do anything. Netscape security could be weak if run on a platform emulator. Use a version native to the platform on which you are running. Details: Some of the usefulness of the seed generation depends upon the unpredictability of the low order bits of various clocks and timers. The clocks of many emulators may have much less entropy than the actual builtin clocks. If you are running on a UNIX platform, make sure of the security of your X server. This is also true if the X connection is not to a local machine as all of the events and the data from the screen read may be captured from the ethernet. Details: If the attacker is monitoring your user input then its randomness is not useful. It is better to perform some user action before connecting to a secure site. This means you should not set your home page to a secure site or launch your client from a command line to a secure site. Details: While navigating through menus or typing into various form fields, the Navigator uses the unpredictability of details of the user actions to increase the entropy of the RNG state. For this patch, proposed changes had to fit into the existing code and UI structure. We will rely on the user interactions leading to the initial secure page. In future versions, the Navigator will force the user to explicitly use the keyboard or mouse to help generate the initial seed before doing any secure transactions. That seed will be maintained across invocations of the Navigator. The files are not compilable as is. They have been extracted from the Netscape's cross platform build environment, and all of the headers needed to compile them are not included. They should be compilable with some simple edits on their platforms (MFC on Windows, CodeWarrior on Mac). ================================================================= PK -- -- Philip L. Karlton karlton(a)netscape.com Principal Curmudgeon http://www.netscape.com/people/karlton Netscape Communications Corporation

10 11

Another Netscape Bug (and possible security hole)
by Ray Cromwell 17 Dec '03

17 Dec '03

I've found a Netscape bug which I suspect is a buffer overflow and may have the potential for serious damage. If it is an overflow bug, then it may be possible to infect every computer which accesses a web page with Netscape. To see the bug, create an html file containing the following: <a href="http://foo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.f…! o.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo/foo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.! bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo .foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo/foo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.f! oo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foofoo.bar.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo.foo> blah </a> On my BSDI2.0 machine running Netscape 1.1N, this causes a segmentation fault and subsequent coredump. GDB reports nothing useable (stripped executable) As you can see, I just chose an extremely long domain name. I guessed that the authors of netscape probably thought something like "well, a buffer size of 256 characters is good enough to hold any domain" It's definately the domain that's causing it, and not the length of the URL or the data after the domain name. I also tried to overflow some netscape servers using similar techniques (and shell metacharacters in all sorts of URLs), to no avail. I suspect a similar attack may work against the Netscape Server if it is proxying. Does anyone have a disassembly of Netscape, or more specifically, a disassembly of the URL parse and domain lookup routines? I'd be happy to collaborate and "Hack Netscape" ;-) Happy Hacking,

9 20

RE: More on "Entropy"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:29 PM 9/25/95, David Van Wie wrote: >David Van Wie wrote: > >>>The entropy E is defined by the sum across n states of -P_i log_2(P_i), > >Timothy C. May wrote: > >>Hah! Another physicist converted to the information-theoretic view of >entropy! > >Indeed. I was able to track down the literature, and it is most >interesting. I am still a little bit skeptical of the "superset including >thermodynamic entropy" school of thought, but I haven't finished reading all >of the materials yet! Clearly, the IT "version" of entropy is a well >defined and useful thing.... Well, the more you adapt to the information theory point of view, the more the Shannon-Kolmogoroff-Chaitin definitions become the natural ones, then the more the whole "thermodynamic" definition of entropy will seem the odd one. One is left with the conclusion that Gibbs-style entropy has _something_ fundamental to do with information theory, and can then consider what those relationships may be. But, perforce, one is left with the most basic interpretation of algorithmic complexity: the complexity of a system is related to the length of the algorithm describing it. A "random" system is one which has no shorter algorithmic description than itself. (The connection of this statement to IQ test questions about describing a sequence is left as an IQ test question for the reader.) --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Please send me SSL problems...
by Christopher Allen 17 Dec '03

17 Dec '03

At 3:04 AM 9/20/95, Jeff Weinstein wrote: > I'd just like to let all cypherpunks know that I'm really interested in >getting any feedback you might have about security problems with Netscape >products. I'm particularly interested in bugs in the our implementation >of SSL, and problems in the protocol that are not addressed in SSL 3.0. > > We have been collecting comments on SSL 3.0, and have started incorporating >that feedback into our spec. Please don't assume that our lack of response >means that we are ignoring your comments. Between Navigator 2.0 and >things like the SSL challenge and the RNG fire drill, we just have not had >the time to get a new rev of the spec out. Hopefully soon... As you may know, Jonathan, who is an active member this list, has already written about Consensus' intention to continue to upgrade RSAREF. We'd like to help make sure that RSAREF stays in sync with SSLREF as we upgrade it. For instance, the next major release of RSAREF will be encrypting the private key (which now has to be done outside of RSAREF.) One area in particular we could use some feedback on from you: Currently SSLREF makes 4 calls that are not in the published program interface of RSAREF. These calls are DES_CBCInit, DES_CBCUpdate, RSAPublicEncrypt, RSAPrivateEncrypt. With your license with RSA for RSAREF you are allowed to go under the published interface by using the DES routines only for securing the channel, and the RSA routines are limited to endpoint authentication only. >From what I've heard, SSLREF 3.0 may go beyond those limits, requiring SSLREF 3.0 developers only to use RSA's BSAFE rather than the less expensive (or at least, no up-front fee) RSAREF. What Consensus Development would like to do is extend the RSAREF API such that RSA's concerns as regards direct access to those routines is taken care of, and can be called by non-PEM/non-Mail applications such as SSLREF. We need to extend the API for PGP, so ideally anything new we add to the API should be general purpose as possible, yet also deal with RSA's issues. BTW, to explain RSA's issues regarding the RSAREF API: Consensus is contractually required to get prior approval before licensing RSAREF for any program that goes underneath the published API. This allows RSA to make sure that these routines are not used in patented ways that RSA does not have rights to. In designing new API and getting them to sign off on the new API allows us to offer licenses to anyone without getting RSA's prior approval. ------------------------------------------------------------------------ ..Christopher Allen Consensus Development Corporation.. ..<ChristopherA(a)consensus.com> 1563 Solano Avenue #355.. .. Berkeley, CA 94707-2116.. ..<http://www.consensus.com/> o510/559-1500 f510/559-1505..

1 0

ADMIN: Sudden CP Vacation, rest up while you can...
by hugh＠ecotone.toad.com 17 Dec '03

17 Dec '03

Toad.com (the cypherpunks host machine provided by John Gilmore) was down today for about 12 hours due to disk/netnews problems, and not the NSA or little green men (is there a difference...? :r) ||ugh Daniel Majordomo Potty Trainer Owner-Cypherpunks(a)toad.com hugh(a)toad.com

1 0

truerand
by Jeff Barber 17 Dec '03

17 Dec '03

Could someone please send me a copy of the truerand code Matt Blaze posted yesterday? I inadvertently deleted the message and Todd's Cpunk archives seem to have shut down about a month ago. Many thanks. -- Jeff

1 0

Re: Golden Coy Freeh
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <Pine.SUN.3.91.950925144659.21198A-100000(a)nic.cerf.net>, paulp(a)CERF.NET (Paul Phillips) wrote: >On Mon, 25 Sep 1995, John Young wrote: [...] >> If the head of the F.B.I. acknowledged that his agency was >> powerless to crack a cryptography program like Pretty Good >> Privacy, the stampede for that software on the Internet >> would make the run on Windows 95 look puny. > >That's a bizarre and naive statement. Is there anyone that thinks the >spread of strong crypto has been less than rapid only because people are >afraid it won't protect them against the government? Um, sorry, no. The general public doesn't use PGP. If the FBI director admitted that using PGP is safe even against the FBI, the general public just might become aware of it. Perhaps the statement isn't so naive after all. - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMGdpbioZzwIn1bdtAQG5zwGAmmSuPLdrDV9rBAUmJFuywUC4x1KgeVqP HiD9C8pP+L5xkZw8pyH8xhwfKPZeKOHb =w1IS -----END PGP SIGNATURE-----

1 0

Re: RSA/Cylink arbitration agreement on-line
by Jonathan Zamick 17 Dec '03

17 Dec '03

At 7:13 AM 9/25/95, Brian A. LaMacchia wrote: >[I haven't seen this mentioned yet on the list...] > >Cylink has been kind enough to put a copy of the arbitration panel's >decision on their web page. Cylink's home page is www.cylink.com. The >URL for the actual agreement is: > > http://www.cylink.com/arbtrn_1.html > >Spin doctors aside, it doesn't look like either company gained much over >the other. I'm not an attorney, but the way I read the agreement RSAREF >can continue to be used without violating the Stanford patents. RSA DSI >cannot *sublicense* the Stanford patents to third parties, but can *sell >code* that practices the methods claimed in the Stanford patents. That >code can then be incorporated into other products, which is exactly what >PGP 2.6.2 does (it's linked against a copy of the RSAREF library, which >is covered by the RSAREF license agreement). > As far as I can tell, that seems to sum it up. In addition, RSA agrees in all their contracts to indemnify the licensee regarding RSA's rights to assign the various technologies. When I called to speak to them, they reiterated their stance. Since, we are going to be handling RSAREF, the validity of RSAREF licenses was of some importance. Having gone through the arbitration ruling things seem to be on track. I'll post more of this to the RSAREF Announce list for folk. Jonathan ------------------------------------------------------------------------ ..Jonathan Zamick Consensus Development Corporation.. ..<JonathanZ(a)consensus.com> 1563 Solano Ave, #355.. .. Berkeley, CA 94707-2116.. .. o510/559-1500 f510/559-1505.. ..Mosaic/WWW Home Page: .. .. Consensus Home Page ..

1 0