December 2003 - cypherpunks-legacy

screensavers and idle computation.
by nefud＠io.com 17 Dec '03

17 Dec '03

To the folx working on the RC4 et. al. distributed keysearch Net: Add a module that will be run from things like "xscreensaver". As Tim May pointed out, current use of crypto is a "tiny fraction of the total computons consumed running screen savers". So let use them, eh? Besides, it'd be kind of neat seeing the "galaxies in hyperspace" displayed in a fractal like screensaver image. -- Allan Bailey | "Freedom is not free." _O_ Senlima Diverseco je Senlimaj Kombinajxoj.| nefud(a)io.com | KC5KSF | GCS w+ v-/+ C++++ U@$ P+++ L++ E++ N++ po--- Y++ b++ ============================================================ = When Privacy Is Outlawed, Only Outlaws Will Have Privacy = = I Support the Phil Zimmermann Legal Defense Fund! = = email: zldf(a)clark.net http://www.netresponse.com/zldf = ============================================================

1 0

FinCen Blurb in local paper
by Kevin L Prigge 17 Dec '03

17 Dec '03

Found this in the St Paul Pioneer Press yesterday, no wire service attribution. Cyber banking risks cited New York Smart Cards, on-line banking and other high-tech consumer payment services could be exploited by money launderers and other crooks, a Treasury Department official warned Wednesday. Stanley Morris, director of the Financial Crimes Enforcement Network, said that government and regulatory agencies believe the new systems, known as cyber banking, will profoundly alter financial services in the future. "The government has got to get its act together" and quickly decide on whether on-line banking systems and smart cards require new regulations," Morris said. Morris spoke to reporters after a day-long closed-door meeting of bankers, regulators, law enforcement officials and technology executives sponsored by FinCen, the governments anti-money laundering agency. --- end article --- -- Kevin Prigge | Holes in whats left of my reason, CIS Consultant | holes in the knees of my blues, Computer & Information Services | odds against me been increasin' email: klp(a)cis.umn.edu | but I'll pull through...

1 0

Assessing Netscape Commerce Server Risk
by millar＠pobox.upenn.edu 17 Dec '03

17 Dec '03

Would anyone care to critique this assessment? >Q: What is the risk of implementing the Commerce Server without waiting for >the Oct. 9 patch (which fixes the randomness problem with the server's >public/private key pair)? >A: The exposure is essentially this: if someone were to make a concerted >attack on your public/private key pair, they might be able to discover your >private key. Combined with net eavesdropping this would allow interception >and decrypting of SSL-encrypted traffic to your Commerce Server, and >combined with IP address and DNS domain impersonation would allow someone >to masquerade as your server. > >I would characterize this risk as low to moderate, with the higher risk >only applying if your Commerce Server is handling larger financial >transactions or extremely sensitive information. > >The time required for an attack on your key pair depends on how close the >attacker can come to guessing exactly when your key pair was generated, and >what the pid/ppid were for the key generation program at the time the key >was generated, as well as how fast the attacker can generate candidate key >pairs. Since the time and pid/ppid are probably guessable only within >broad limits (e.g., within a few days for the time), and generating key >pairs takes on the order of a second or so, the estimated attack times are >much longer than the attack times for SSL messages. I believe Netscape has >published estimates like 60 days or so to crack a key pair; even if those >estimates are too high by factors of two or three the times are still >comparable to the time until the patch is available. > >So if you're really concerned you can certainly eliminate the risk by >shutting down SSL-secure services until you get the patch; however I'd >weigh that against the downside of not having those services accessible. > >P.S. If you do continue running your Commerce Server with SSL, one simple >thing that might help thwart attacks is to do a "touch" on your server key >file and server certificate file (or copy them somewhere and then copy them >back) to update the date/time modified on the files. This eliminates one >possible clue as to when the key pair was generated. _________________________________________________ Dave Millar University Information Security Officer 3401 Walnut St., Suite 265C Philadelphia, PA 19104-6228 University of Pennsylvania For security matters: security(a)isc.upenn.edu (read by Data Admin. staff) Other matters: millar(a)pobox.upenn.edu voice: (215) 898-2172 fax: (215) 898-1729 For PGP 2.6 Public key: http://www.upenn.edu/security-privacy/ PGP Fingerprint: 28 FB 09 DC C7 96 C2 53 1A B8 BE 3B 73 32 46 4C

1 0

Netscape hole without .Xauthority (fwd)
by Jyri Kaljundi 17 Dec '03

17 Dec '03

Haven't seen this on the cypherpunks yet, sorry if this has been here already. Juri <o Jüri Kaljundi e-mail: jk(a)digit.ee o< >o tel: +372 6308994 o> <o DigiTurg http://www.digit.ee/ o< ---------- Forwarded message ---------- There's a huge hole in the Netscape remote control mechanism for the X-Windows based clients. Potential impact : anybody can become any user that uses Netscape on any system without sufficient X security. Let's suppose that you have an account on a target machine, where somebody is using Netscape, and either the xhost checking is disabled, or you can set the xhost yourself (e.g. if you have an account and the target user has no .Xauthority, as is frequent in university computer rooms). Then you can gain access to the target user's account using the following steps : - make a text file containing only "+ +" accessible (as file, as URL, or whatever you like) to the target Netscape client. This is quite easy, either if you have a personal WWW page (http://... URL) or an account on the target machine (file://... URL), or even by uploading it to an anon FTP - set your DISPLAY environment variable to the target display - run the following set of commands : netscape -noraise -remote "openURL(<put-your-URL-here>)" netscape -noraise -remote "saveAs(.rhosts)" netscape -noraise -remote back In the second command, the path should be specified whenever possible (~ is not accepted). If the target user does not already have a .rhosts and is not looking at that precise moment, then the chances are it worked ! Solution to the problem : every user concerned should either create a Xauthority file, or stop using Netscape. MXK PS: WHY do they bother with PGP and RSA security when they keep such holes ???? +------------------------------------+---------------------------------+ | Denis AUROUX (MXK) | Ecole Normale Superieure | | 255 rue Saint-Jacques | 45 rue d'Ulm | | 75005 PARIS FRANCE | 75005 PARIS | | email: auroux(a)clipper.ens.fr | FRANCE | +------------------------------------+---------------------------------+ | This .sig is SHAREWARE. If you use it often, please send me $50. | | After registering you will receive a fully functional .sig and all | | updates for free. | +----------------------------------------------------------------------+

7 6

Re: netscape NSRANDFILE compatible with /dev/random ?
by Carl Ellison 17 Dec '03

17 Dec '03

>From: "Jeff Weinstein" <jsw(a)netscape.com> >Date: Wed, 27 Sep 1995 00:40:41 -0700 >> What happens if NSRANDFILE is set to /dev/random ? >> will netscape try to read an infinite number of random bytes ? > > In the current patch it will read up to 1 megabyte before stopping. >In 2.0 I will add a way to specify a size. As a temporary hack you >could use 'dd' to get the number of bytes you want into a file, then >remove the file once netscape had started up. or you can define a named pipe file (on UNIX at least) which runs /dev/random through dd.

1 0

Re: Simple Hardware RNG Idea
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:14 PM 9/28/95, cjs wrote: >Hello all. > >Someone mentioned this on IRC last night, and it sounded like a really >cool idea, so I thought I'd mention it. > >The idea is to generate random numbers using a geiger counter tube and >a small portion of radioactive substance (like perhaps the stuff they >use in smoke detectors?) Would that be random enough? > >I thought it was a neat idea anyway. It's a well-known idea. My FAQ has a section on this, and the Cypherpunks archives have many mentions of this. For the newcomers, here are some of the issues, very briefly presented: 1. Incorporating a "Geiger counter tube" is nontrivial. A solid-state detector does the same thing, and is a better approach. 2. Incorporating Am-241 or other alpha emitters in microcurie levels would require licensing, regulatory oversight, etc., etc. Don't count on it. 3. Data rates are fairly low. Anything that "clicks" at high rates (> 1K counts per second) would be too radioactive to ship. 4. Zener diodes and other random noise sources are cheaper to build, more consistent in output, and easier to integrate into actual products. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

3 2

Traveling abroad with laptops
by rajaram＠morgan.com 17 Dec '03

17 Dec '03

What would happen if I flew out of the US with a portable computer that has crypto software (like PGP) installed ? Assuming that I had no intention of distributing the software abroad, would I be violating some US export law ? Matt Blaze (?) had written about his humorous experience in trying to do the right thing. It seems that the US Govt. does not seriously enforce its own export policies. But they may start doing so any time. I am sure that today many people regularly fly into Europe with crypto software, without intending to break any laws. At one point, I had heard that some sort of exception was planned for export of crypto for personal use. Does anyone know if this is real or just a rumor ? regards -raj

1 0

Re: X.509, S/MIME, and evolution of PGP
by Christopher Allen 17 Dec '03

17 Dec '03

At 3:22 PM 9/27/95, Bill Stewart wrote: >2) RSA patent - can this be built with RSAREF? Or RSAREF with permission >for a couple extra activities? Or built out of RIPEM or RIPEM-SIG? >The latter has the benefit of already being exportable. It certainly can be built from RSAREF, as I use my Apple DigiSign X.509 key (ultimately created with TIPEM in the Mac system software) with RIPEM/Mac (which uses RSAREF.) Some additional info: my company, Consensus Development, has commercial rights to license developers RSAREF also has a good relationship with VeriSign. We helping them writea variety of tools to make issuing X.509 certs easier. >5) S/MIME - real S/MIME compliance requires support for RC2 as well as >publicly available algorithms, though this is really just an X.509 handler. I've been working on getting RC2/RC4 in object-only exportable size key form from RSA for RSAREF customers, and Jim Bidzos has agreed in principle. We have to work out details, however. >6) It's a lot of work - well, yeah, it is. And I'm lazy. Is there enough >related code in SSLeay to steal to help implement it? I spoke with Eric yesterday and I think he was working on some ASN.1 related classes for a future version of SSLeay. ------------------------------------------------------------------------ ..Christopher Allen Consensus Development Corporation.. ..<ChristopherA(a)consensus.com> 1563 Solano Avenue #355.. .. Berkeley, CA 94707-2116.. ..<http://www.consensus.com/> o510/559-1500 f510/559-1505..

1 0

COE Document
by Dave Banisar 17 Dec '03

17 Dec '03

------------------------------------------------------------------------ A HTML Version of this document is available at the Privacy International Archives at www.privacy.org/pi/intl_orgs/coe/info_tech_1995.html Recommendation No. R (95) 13 of the Committee of Ministers to Member States Concerning Problems of Criminal Procedure Law Connected with Information Technology (Adopted by the Committee of Ministers on 11 September 1995 at the 543 meeting of the Ministers' Deputies) The Committee of Ministers, under the terms of Article 15.b of the Statute of the Council of Europe. Considering that the aim of the Council of Europe is to achieve a greater unity between its members; Having regard to the unprecedented development of information technology and its application in all sectors of modern society; Realizing that the development of electronic information systems will speed up the transformation of traditional society into an information society by creating a new space for all types of communications and relations; Aware of the impact of information technology on the manner in which society is organised and on how individuals communications and interrelate; Conscious that an increasing part of economic and social relations will take place through or by use of electronic information systems; Concerned at the risk that electronic information systems and electronic information may also be used for committing criminal offenses; Considering that evidence of criminal offenses may be stored and transferred by these systems; Noting that criminal procedure laws of members states often do not yet provide for appropriate powers to search and collect evidence in these systems in the course of criminal investigations; Recalling that the lack of appropriate special powers may impair investigating authorities in the proper fufilment of their tasks in the face of the ongoing development of information technology; Recognising the need to adopt the legitimate tools which investigating authorities are afforded under criminal procedure laws the the specific nature of investigations in electronic information systems; Concerned by the potential risk that member states may not be able to render mutual legal assistance in an appropriate way when requested to collect electronic evidence within their territory from electronic information systems; Convinced of the necessity of strengthening internation co-operation and achieving a greater compatibility of criminal procedural laws in this field; Recalling Recommendation No. R (81) 20 of the Committee of Ministers on the harmonisation of laws relating to the requirement of written proof and to the admissibility of reproductions of documents and recordings on computers, Recommendation No. R. (85) 10 on letters rogatory for the interception of telecommunications, Recommendations No. R (87) 15 regulating the use of personal data in the police state and Recommendations No. R (89) 9 on computer-relating crime, Recommends the governments of member states: i. when reviewing their internal legislation and practice, to be guided by the principles appended to this recommendation; and ii. to ensure publicity for these principles among those investigating authorities and other professional bodies, in particular in the field of information technology, which may have an interest in their application. Appendix to Recommendation No R. (95) 13 concerning problems of criminal procedure law connected with information technology I. Search and seizure ----------------------------- 1. The legal distinction between searching computers systems and siezing data stored therein and intercepting data in the course of transmission should be clearly delineated and applied. 2. Criminal procedure laws should permit investigating authorities to search computer systems and seize data under similar conditions as under traditional powers of search and seizure. The person in charge of the system should be informed that the system has been searched and of the kind of data that has been siezed. The legal remedies that are provided for in general against search and seizure should be equally applicable in case of search in computer systems and in case of seizure of data therein. 3. During execution of a search, investigating authorities should have the power, subject to appropriate safeguards, to extend the search of other computer systems within their jurisdiction which are connected by menas of a network and seize the data therein, provided immediate action is required. 4. Where automatically processed data is functionally equivalent to a traditional document, provisions in the criminal procedure law relating to search and seizure of documents should apply equally to it. II. Technical Surveillance ------------------------------------- 5. in view of the convergance of information technology and telecommunications, law pertaining to technical surveillance for the purpose of criminal investigations, such as interception of telecommunications, should be reviewed and amended, where necessary, to ensure their applicability. 6. The law should permit investigating authorities to avail themselves of all necessary technical measures that enable the collection of traffic data in the investigation of crimes. 7. When collected in the course of a criminal investigation and in particular when obtained by means of intercepting telecommunications, data which is the object of legal protection and processed by a compuer system should be secured in an appropriate manner. 8. Criminal procedure laws should be reviewed with a view to making possible the interception of telecommunications and the collection of traffic data in the investigation of serious offenses against the confidentiality, integrity and availability of telecommunications or computer systems. III. Obligations to co-operate with the investigating authorities -------------------------------------------------------------------- 9. Subject to legal privileges or protection, most legal systems permit investigating authorities to order persons to hand over objects under their control that are required to serve as evidence. In a parallel fashion, provisions should be made for the power to order persons to submit any specified data under their control in a computer system in the form required by the investigating authority. 10. Subject to legal privileges or protection, investigating authorities should have the power to order persons who have data in a computer system under their control to provide all necessary information to enable access to a computer system and the data theirin. Criminal procedure law should ensure that a similar order can be given to other persons who have knowledge about the functioning of the computer system or measures applied to secure the data therein. 11. Specific obligations should be imposed on operators of public and private networks that offer telecommunications services to the public to avail themselves of all necessary technical measures that enable the interception of telecommunications by the investigating authorities. 12. Specific obligations should be imposed on service providers who offer telecommunications services to the public, either through public or private networks, to provide information to identify the user, when so ordered by the compentant investigating authority. IV. Electronic Evidence ------------------------ 13. The common need to collect, preserve, and present electronic evidence in ways that best ensure and reflect their integrity and irrefutable authenticity, both for the purposes of domestic prosecution and international co-operation, should be recognized. Therefore, procedures and technical methods for handling electronic evidence should be further developed, and particularly in such a way as to ensure their compatability between states. Criminal procedural law provisions on evidence relating to tradition documents should similarly apply to data stored in a computer system. V. Use of Encryption --------------------- 14. Measures should be considered to minimise the negative effects of the use of cryptography on the investigation of criminal offenses, without affecting its legitimate use more than is strictly necessary. VI. Research, statistics and training ------------------------------------- 15. The risks involved in the development and application of information technology with regard to the commission of criminal offenses should be assured continuously. In order to enable the competent authorities to keep abrest of new phenomena in the field of computer related offenses and to develop appropriate counter-measures, the collection and analysis of data on these offenses, including modus operandi and technical apsects, should be furthered. 16. The establishment of specialised units for the investigation of offenses, the combating of which requires special expertise in information technology, should be considered. Training programmes enabling criminal justice personnel to avail themselves of expertise in this field should be furthered. VII. International Cooperation ------------------------------ 17. The power to extend a search to other computer systems should also be applicable when the system is located in a foreign jurisdiction, provided that immediate action is required. In order to avoid possible violations of state sovereignity or international law, an unambigious legal basis for such extended search and seizure should be established. Therefore, there is an urgent need for negotiating international agreements as to how, when and to what extent such search and seizure should be permitted. 18. Expedited and adequate procedures as well as a system of liason should be available according to which the investigating authorities may request the foreign authorities to promptly collect evidence. For that purpose the requested authorities should be authorized to search a computer system and seize data with a view to its subsequent transfer. The requested authorities should also be authorized to provide trafficking data rtelated to a specific telecommunication, intercept a specific telecommunication or identify its source. For that purpose, the existing mutual legal assistance instruments need to be supplemented. _________________________________________________________________________ Subject: COE Document _________________________________________________________________________ David Banisar (Banisar(a)epic.org) * 202-544-9240 (tel) Electronic Privacy Information Center * 202-547-5482 (fax) 666 Pennsylvania Ave, SE, Suite 301 * HTTP://www.epic.org Washington, DC 20003 * ftp/gopher/wais cpsr.org

1 0

Re: Netscape "random" number seed generator code available
by Martin Diehl 17 Dec '03

17 Dec '03

on 9/24/95 karlton(a)neon.netscape.com (Phil Karlton) at Internet-USA wrote: The random number seed generation code is now available for review: ftp://ftp1.netscape.com/pub/review/RNGsrc.tar.Z My platform is DOS 6.22, Windows 3.11 Can someone suggest a program (and where to get it) that will run on my platform and extract the tar.z files into DOS ASCII files so that I can review the key generator code? Thanks for your help. Martin G. Diehl

2 1