December 2003 - cypherpunks-legacy

Re: Microsoft & new Internet Security specs
by Marshall Clow 17 Dec '03

17 Dec '03

> [Company News on Call] [Return to Company Listing] > [Return to Headlines] > > MICROSOFT PUBLISHES SPECIFICATIONS DESIGNED TO HELP > IMPROVE SECURITY ON THE INTERNET > > ATLANTA, Sept. 27 /PRNewswire/ -- Microsoft Corp. (Nasdaq: MSFT) > today announced the publication of two specifications that address key > Internet security issues. [ blah, blah, blah ] > Both can be found on the Microsoft home page (http//:www.microsoft.com). > I command-clicked on that URL, and my mail program asked me what program I wanted to use to resolve "http//" URLs :-) The correct URL is, of course, <http://www.microsoft.com> -- Marshall Marshall Clow mclow(a)coyote.csusm.edu I'm an engineer. I make slides no one can read. Sometimes I eat donuts.

1 0

Re: Timothy C. May: Mini-mailbombs and Warning Letters
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:33 PM 9/27/95, Travis Corcoran wrote: >I'm not sure whether you're objecting to someone asked for your key, >or the fact that they did it through a semi-automated process. If you go back to my original message you'll see that I was discussing the rising number of spams, advertisements, and "automatically-generated" posts. What I call a robo-warning was this: " P.S. This mail was composed by my mailreading sftwr, which automatically scans incoming mail, looking for failed keyserver requests, and prompts me whether it should automatically send this msg on my behalf. If there is a bug w this sftwr (for example, you never PGP sign your msgs, so this entire msg makes no sense), or if you're interested in the software itself (mail-secure.el: a package in lisp for emacs; this is just one of the many crypto/privacy related things it does) please mail the author of this package ( tjic(a)openmarket.com) for details. As to whether I needed to respond to your robo-warning about how your automatic scan of incoming mail produced some kind of Signature Failure Condition Red at your end, I just ignored your message. (As others will attest, when people ask me for my key in a non-automated way, I usually send it to them. I often regret this, as they then send me PGP-encrypted mail with innocuous contents---the same reason PRZ hates to get PGP mail.) My _overall_ point was not to attack Travis C., who I don't think I even mentioned by name, but to point out that great care must be taken in running automated mail-response programs (including "vacation" programs, "I'm away from my terminal" messages, and these kinds of automated PGP messages). Finally, since Travis is making a fairly big deal over my citing of his post (though anonymously, as I recall), I'd like to see the post he claims I signed. If it has a PGP signature, it's probably an obvious spoof or satire. >If anyone has a constructive suggestion as to how this mail could be >changed to convey more information or to be less "threatening", please >mail me. Simple, don't bother to ask in the first place. Or ask informally, in ordinary English. Skip the "This mail was composed by my mailreading sftwr, which automatically scans incoming mail, looking for failed keyserver requests..." nonsense. On a list with well over 1000 people, I don't need some fraction of them running their own "key etiquette agents" inspecting my posts for conformance to their preferences. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

25 Crays a Year to Break STT
by John Young 17 Dec '03

17 Dec '03

Financial Times, September 28, 1995, p.1. Rivalry for Internet Security Grows By Louise Kehoe in San Francisco The Internet rivalry between Microsoft, the world's largest software company, and Netscape Communications increased yesterday when they announced competing encryption technology intended to ensure the security of financial transactions over the global computer network. Mr James Clark chairman of Netscape, the leading supplier of browser software that enables personal computer users to "surf" the Internet, also revealed the company had turned down a move by Microsoft to take a minority stake in Netscape earlier this year, before Netscape's public offering. Microsoft's encryption technology, developed with Visa International the credit card processing organisation, is intended to solve Internet security problems which have become a serious barrier to electronic commerce. Recent incidents, including the hacking of supposedly secure Internet software developed by Netscape, have heightened concerns about sending sensitive data such as credit card numbers over the Internet. Microsoft said its Secure Transaction Technology (STT), was designed to provide a much higher level of security for credit card transactions on the Internet. Netscape's general purpose encryption system uses a 40 or 128-bit electronic "key", while STT will use 2,000-bit keys. "By Christmas of 1996 you will be able to shop on the Internet to your heart's content, without even thinking about security," said Mr Warren Dent, Microsoft director of business development for consumer systems. Although no encryption system was totally secure, Mr Dent estimated it would take "25 Cray supercomputers a year" to break the STT codes. Netscape, however, said a new version of its Navigator software, which will become available next week will provide the same level of security. Netscape's "Secure Courier" technology has been developed in conjunction with MasterCard, Visa's credit card rival. To encourage widespread adoption of STT, Microsoft and Visa are making its technical specifications available at no charge to third parties to allow them to develop software. Netscape said Microsoft is expecting to charge transaction fees each time the STT technology is used. Commercial software products incorporating STT are expected to be available by April, Microsoft said. Netscape says Secure Courier will be available sooner. [End]

1 0

Re: [ PROPOSED NEW STANDARD ] "I-like-encrypted-mail" tag
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:21 PM 9/27/95, Travis Corcoran wrote: >Summary: > > This message tosses out an idea for conveying within an { email | > usenet } message the datum "the author of this message prefers to > receive PGP encrypted communications" in a standard machine-readable > form. I don't dislike this idea, so my comments here are only possible routes for those who want to get PGP-encrypted mail. First, I think Hal Finney was offering at one time to remail the list to anyone in encrypted form (encrypted on his machine(s) to their PGP key, of course). This would increase the volume of PGP mail, of course. Second, others could make the same offer. Third, remailers could be used. Now encrypting a public list doesn't do much, of course, but it does increase the amount of encrypted traffic. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Using sound cards to accelerate RSA?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:39 PM 9/27/95, Simon Spero wrote: >Somebody mentioned the possibility of using the a/d stage of a sound card >as a source of random bits, and that brought a thought back to mind: >given that a lot of sound cards are now shipping with DSP chips on board, >has anyone written any code that uses the cards DSP to accelerate RSA >processing? > >Maybe there's a mass market market for a crypto-blaster- an RNG, 3 or 6 >DES chips, and a DSP. It would make for a killer linux based SHTTP server... But I don't think Soundblaster-class DSP performance is especially impressive compared to where the market is going with Pentiums. (AMD and Cyrix have both announced plans to exit the 486 market as rapidly as they can--and of course Intel has been doing that for some time already.) It made more sense 2-3 years ago, and a couple of people were talking about finding ways to use modems and DSP cards to accelerate crypto functions. (Paul Rubin, for example, was looking at Trailblazer modems...) Another problem with such solutions is that they often get marginalized, or left on the sidelines. This has to do with lots of things, including the percentage of people who have various add-on cards, the power of their main CPUs, etc. (Many things to touch on here. Apple used a DSP chip in their 840av and 660av models, but various problems in supporting these chips cropped up, and Apple phased them out in favor of PPC-only configurations. Intel is pushing "native signal processing" to both sell faster CPUs and ease the programming efforts in supporting DSP chips. Time will tell.) For other reasons, software solutions are generally preferable to hardware-dependent solutions. Finally, few crypto applications seem to be limited very much by speed at this time. Audio and video apps, of course, put a strain on processing power, and this is where DSP capabilities make the most difference, probably. Finally (for real), the effort in supporting DSP chips could probably better be spent elsewhere, given the small effects of a slight increase in speed. Getting PGP more widely integrated into popular programs would seem to me to be a bigger win than in reducing the time to encrypt a message from 3.2 seconds to 1.9 seconds. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Looking for advice.
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

For two programs communicating via TCP/IP and exchanging authentication information, I want to make sure that the authentication info, (user's name and password,) doesn't pass in the clear. I can think of a few ways to handle this. 1) Encrypt via shared key using symetric encryption. This works but key management is a problem. 2) Encrypt via public keys using public key encryption. There's licensing issues, and how do you generate public and private pairs for all of the programs? That could be a lot of primes! 3) The "server" could keep user names and passwords stored as hashed values. That way the "client" could do a hash (MD5?) before sending it. This has the drawback of the server not having access to the unhashed values...if it needs that access this method won't work. What are other possibilities? What are the answers to my questions and issues above? Can you help? Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Patch release of Netscape available
by Phil Karlton 17 Dec '03

17 Dec '03

On ftp://ftp.netscape.com/pub/netscape, you can find the new UNIX, Macintosh and Windows executables. Note that these executables only support 40-bit RC4. We are working out a mechanism to be able to upgrade the 128-bit versions that is acceptable to the U.S. government. PK -- Philip L. Karlton karlton(a)netscape.com Principal Curmudgeon http://www.netscape.com/people/karlton Netscape Communications Corporation

2 2

Re: "Notes" to be Eclipsed by "Netscape"
by Erik E. Fair 17 Dec '03

17 Dec '03

At 15:21 9/27/95, Bill Stewart wrote: >Notes was a PC network reimplementation of PLATO, the system that also inspired >notesfiles, a distant cousin of Netnews (though I'm not sure if netnews was >originally inspired by PLATO or not...) Netnews assumes that articles are >going to propagate for a while and then be trashed; notesfiles assumes you're >building a knowledge bases that sticks around. (This transitoriness has >allowed >netnews to scale to its current N*100MB/day of trash :-) Netnews was the old "msgs" program on serious steroids - the thing everyone was supposed to run in their .login (or .profile) scripts to get system-wide announcements. My bet is that msgs was inspired by the TOPS-20/ITS equivalents at MIT. Netnews subsequently underwent relatively rapid forced evolution in its early days to meet the scaling demands of the UUCP network, and the Internet of that time (~1983). The "notesfiles" system from UIUC that Rob Kolstad and Ray Essick wrote was not so much a distant cousin of NetNews as it was a similar system designed to solve the same problem (distributed message-based computer conferencing); I would argue that NetNews had the better transports and backends, but notesfiles was one or two up on NetNews in UI features (message threads, etc). The two were sufficiently close that (bad) gateways were written to move messages from one system to the other. With any luck, the next round of NetNews user interfaces will remove all of the UI advantages of notesfiles - the hooks have always been there, but writing good UI's hard work, and most NetNews hackers (me included) have had more fun/luck/interest in hacking the transport level to be ever more slightly efficient. >AT&T Network Notes is a joint AT&T/Lotus project that uses AT&T's public IPX >network >to support Notes on; I think it's now rolled out an accepting customers, >but it was mostly in press-release stage while I was at AT&T. I had the impression from what I read that this was going to be an IPX WAN, and that after announcing this Brave New Service, the partners discovered just how poorly IPX behaves on a WAN, and so have backed out to Notes on IP for this thing. I haven't heard much about it since, but I'd be surprised to find AT&T being foolish enough to try and operate an IPX WAN. >Notes does have encryption, using RSA and I think RC4; I'm not sure if they >do the >40 bits exportable/ 128 domestic bit or just use 40 bits. Don't know about >overflow >kinds of bugs; the bugs I've heard about were more problems integrating with >Cc:Mail :-) Lotus is indeed one of RSA's licensees; I remember reading that in the WSJ at about the same time that Apple became one. I still place my message-based distributed collaboration bets on NetNews technology, or some obvious derivative of it. Erik Fair

1 0

Netscape seems to fix the overflow bug
by goedel＠tezcat.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Simple testing with the Netscape update would seem to indicate that the overflow bug has been fixed. How about the RNG hole? -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBgAwUBMGpDRHIf3YegbdiBAQFf4wJWIaseQP3CL4V7aEs8HMmU4MB2jYVpyLhx C4ER+a9Ho9bIbaipATtuL+E0oaq77AEeaB7TMQBl+upzcttifH9Y9hANYUQ7Q8vS jkRa =wN48 -----END PGP SIGNATURE----- Dietrich Kappe | Red Planet http://www.redweb.com Red Planet, LLC| "Chess Space" | "MS Access Products" | PGP Public Key 1-800-RED 0 WEB| /chess | /cobre | /goedel/key.txt Web Publishing | Key fingerprint: 8C2983E66AB723F9 A014A0417D268B84

1 0

Re: WSJ on Netscape Hole 3
by cman＠communities.com 17 Dec '03

17 Dec '03

Somebody wrote: >> With Netscape 1.1 the state of the stack is much more dynamic, in >> particular the user can be viewing documents at an arbitary depth in >> the "web tree", each recursion will increase the stack pointer (or >> decrease with some architectures) There is no way of knowing for >> certain where you code will end up and thus no way to reliably alter >> the return address on the stack to execute your arbitary code. > I just tested this under Solaris 2.4 and it "turns out not to be the case." I approached my "bad" URL from a variety of other places, passing through various other pages, and the stack structure was still the same when I clicked on the bad guy. The big problem I'm having on this platform is the windowing register system on the SPARC architecture, which interacts in weird ways with the debugger. The lack of determinacy about where the stack is loaded in global memory _does_ seem to be a much bigger problem on the Mac, which is still not anything approaching a multi-tasking OS. Under Unix, proceses get their own address space to play in, which is always the same; on Macs, with their weird relocatable heaps, you never know where stuff is going to get loaded. I wonder how this is handled in Windows 95.... As for objections about how worthwhile this is, it's pretty clear that a patch will be available for this problem before we can finish and publicize an exploit. This is not, however, the last piece of network software that will contain problems of this sort, and it is a good idea to build up expertise in this area. I'd also suggest going after some of the other browsers... I know, for instance, that AOL's browser dies horribly on these same sort of URLs. Good luck, all. Doug

3 2