December 2003 - cypherpunks-legacy

Attacking Clipper with timing info?
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

Could this timing attack be used to obtain the various keys used by Clipper devices? Jim_Miller(a)suite.com

3 2

(U)
by Francisco Encarnacao 17 Dec '03

17 Dec '03

SUBSCRIBRE Regards, Francisco Encarnacao - Equipment Maintenance Technician Internet E-mail address:Francis@e-mail.com

1 0

CryptoLib 1.0 now available
by Matt Blaze 17 Dec '03

17 Dec '03

[Note! This is posted for Jack Lacy; please direct responses to him at cryptolib(a)research.att.com. -matt] Announcing CryptoLib - Release 1.0 12/13/95 Jack Lacy, AT&T Bell Labs CryptoLib is a portable and efficient library of primitives for building cryptographic applications. It runs under most versions of Unix as well as DOS, Windows and Windows-NT (and 95). We are pleased to make CryptoLib source code available without charge to researchers and developers in the US and Canada. (Because of export restrictions on cryptographic software, we are only able to make the software available within the US and Canada to US and Canadian citizens and US permanent residents.) CryptoLib is intended for research and experimental use, and is distributed without warranty or support. In particular, please note the following license conditions: * Copyright (c) 1995 by AT&T. * Permission to use, copy, and modify this software without fee * is hereby granted, provided that this entire notice is included in * all copies of any software which is or includes a copy or * modification of this software and in all copies of the supporting * documentation for such software. * * This software may be subject to export controls. * * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR IMPLIED * WARRANTY. IN PARTICULAR, NEITHER THE AUTHORS NOR AT&T MAKE ANY * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE MERCHANTABILITY * OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR PURPOSE. The attached describes the library and some timing results. To obtain source code send electronic mail to: cryptolib(a)research.att.com with a statement of the following form: "I am a U.S. or Canadian citizen or a legal permanent resident of the U.S. and am aware that some parts of CryptoLib may be restricted under United States export regulations. I have read and understand the CryptoLib license." Name: Location: E-mail: Are you licensed to use the RSA patent? If yes, give name of licensed organization: =============================================================================== CryptoLib includes the following: arbitrary length bignums. bigmath package: bigAdd, bigSubtract, bigMultiply, bgiDivide, bigLeftShift, bigRightShift, bigAnd, bigOr, bigXor, bigCopy, Euclid's extended GCD, modular reduction and exponentiation crypto primitives DES and 3DES + modes Diffie-Hellman DSA (Signing and verification roughly equally efficient) El Gamal Rabin's scheme Random Number generation (PSEUDO and TRUE) MD[2,4,5] Prime generation RSA (provided only if you convince me that you have a license) SHA truerand (For Unix, NT and 95) quantization (Defense against Kocher's timing attack) quantized RSA, DSA and El Gamal private key operations. support functions asn1.c ioutils.c netIface.c Some timing information: All times assume 32X32 bit assembly of multiplication primitives. bigPow times (a^b mod c with a,b,c the same length) 512 bits 1024 bits -------- --------- bigPow 0.12s 0.72s Sparc II Brickell bigpow 0.43s 3.0s Sparc II with asm (gcc) 0.12s 0.78s Sparc 10 with asm 0.03s 0.17s Sparc 10 with asm (Brickell) 0.084s 0.45s SGI Indigo (150MHz) 0.109s 0.75s 100 MHz Pentium (gcc under DOS) Strong Prime Generation -- ProbTestAttempts = 5 100 primes generated in each test. Times below are: (total test time)/100 = avg. time per prime generated. Using Gordon's strong prime algorithm. 256 512 1024 Machine --- --- ---- ------- 2.8s 24.0s 5.11m Sparc II .45s 2.7s 77s 100 MHz pentium RSA Times (64 bit public exponent, message encrypted is full length) --------- 512 768 1024 bits machine --- --- --------- ------- encrypt 30ms 50ms 80ms sparc II decrypt 160ms 480ms 930ms encrypt 15ms 33ms 56ms 100 MHz Pentium (Under NT) decrypt 38ms 104ms 214ms DSA Times --------- 512 768 1024 bits machine --- --- --------- ------- sign 99ms 166ms 216ms sparc II (Brickell speedup) verify 156ms 316ms 416ms sign 21ms 38ms 49ms 100 MHz Pentium (Under NT) verify 27ms 43ms 71ms

2 2

Re: And the standard continues to lower...
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >If the misuse of "One Time Pad" wasn't enough for ya, check out this ad that >I was e-mailed. > >And the chair of a CS department, no less. > >- ------- start of forwarded message (RFC 934 encapsulation) ------- >Subject: Secure No-overhead Online Order System for Publishers >Date: Wed, 13 Dec 1995 12:24:03 -0800 (PST) > >A secure no-overhead online title-ordering system is now available. It may >be viewed in operation at the home page for Blue Water Publishing, a >publisher, software developer and distribution company, at >http://www.bluewaterp.com/~bcrissey/ >or from the online bookstore area of ISCNI, the Institute for the Study of >Contact with Non-Human Intelligence at >http://www.iscni.com > >Blue Water's innovative online ordering system is called SimplySafe. It is >a needle-in-the-haystack approach to online security. It requires no >encryption or secure servers, yet the probability that a dedicated hacker >scanning 100 internet messages a second will intercept a usable credit >card number sent via SimplySafe is less than the probability of picking >our Sun out of the Milky Way. That is less than 1 in 200 billion. Safe >enough for most folks. There are easier ways for a hacker to pick up >credit card numbers than to waste time with SimplySafe transactions. Try >it out! > >SimplySafe currently supports secure online orders from Blue Water >Publishing, Wild Flower Press, Swan-Raven & Co., and ISCNI. >Direct inquiries to >SimpleSafe(a)aol.com > >***Dr. Brian L. Crissey, Chair CS Dpt, Linfield Col., McMinnville, OR 97128 >(503)-434-2426 brianc(a)linfield.edu >Professionals built the Titanic, amateurs built the Ark... The scheme is to send 4 digits of the credit card at a time. The "explanation" follows. >In order to proceed with your SimplySafe® encryption of your credit card >number, please enter the SECOND set of (4) digits of your credit card number: > >In the 41 seconds since you sent your first packet of four digits, >approximately 2869959 packets of information have passed across the internet. >Assuming that a hacker can scan 100 packets of information per second for >credit card information, there is 1 chance in 699 that he has scanned your >first packet of digits. >He is unlikely to have found anything useful. Sigh. Wilhelm Busch -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMM9w94iUi5SQtQ3tAQENnAf6A2SdN+AZGryzJ/eCE/fj+YO71ngQXk8A 2tAomwUqAPmrCll+ucnDc/knsct2VYo4I9b+j84Ah+Gzz6rAu3LKY+joBrgDBmBY j79BOxik6tz9GCdBYDxTQ1BJpwbDAxaQHpNJYgEFryB59yxo4gi9xZbKZnnQv571 uQfuk1rAJbI+ESJK1Wlw8YrT+q8PoW8m5Y1qjBhxczRNaYAENsrVqHsz8L8bEBkW WEfi6wIQpRkB6Fo9hH2HAVamvUwJvDtPgll6U1zBgh/zEs1Jyot3XLV5UHrdL7oM 6FRPD1LW/cWGjUv2YNyv6a3vDFz9LdcCk9eX+gekODzaE+fgeQWI3g== =2n1S -----END PGP SIGNATURE-----

2 1

Re: IDEA encryption
by cactus＠hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <Pine.LNX.3.91.951212212447.94B-100000@localhost>, Mark M. <markm(a)omni.voicenet.com> wrote: >> Last thing -- how secure is unix "rm"? If something is rm'd, is it >> really really gone? >> > >Not very secure. I have heard that there is a Linux undelete and there might >be a similar program for other Unices. If the hard drive is examined using >special hardware, data will be recoverable. It's not even that secure. As long as the blocks haven't been written over, you can extract the information from the raw device driver with 'dd' as root. - -- Todd Masco | "life without caution/ the only worth living / love for a man/ cactus(a)hks.net | love for a woman/ love for the facts/ protectless" - A Rich Cactus' Homepage - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMM9juyoZzwIn1bdtAQFXZAGA4HlzYVD4ORp5LecGxw16q+ELXZFChIuA kSHufPYuGQjsVDuQ0Ev4Xkroc3kVfZTQ =1vxa -----END PGP SIGNATURE-----

1 0

Re: And the standard continues to lower...
by Andrew Loewenstern 17 Dec '03

17 Dec '03

Dr. Brian L. Crissey includes in his .sig, courtesy of cactus(a)hks.net [ much WRT YetAnotherSecureInternetCreditCardPaymentSystem(*tm) deleted ] > ***Dr. Brian L. Crissey, Chair CS Dpt, Linfield Col., McMinnville, OR 97128 > (503)-434-2426 brianc(a)linfield.edu > Professionals built the Titanic, amateurs built the Ark... However, the Ark was *designed* by GOD (if you believe the story). Can Dr. Brian L. Crissey say the same thing about his payment system? andrew

1 0

Timing Attack Paper
by gibo＠ripco.com 17 Dec '03

17 Dec '03

I went to http://www.cryptography.com/timingattack.html and found the whole thing to be totally incomprehensible from a layman's point of view. I apologize for having not read "Applied Cryptography", which might have made the abstract a simpler read - but even if I had I'd have been baffled by a lot of the terminology and equations in this paper. Can anyone post a brief summary which explains the essential workings of the attack? I'd be very grateful. --giles ===========================>>>http://pages.ripco.com/~gibo as long as I shall stay alive I never want a nine to five -----BEGIN PBP SIGNATURE----- Version: 1.0.0, Copyright 1995, Pretty Bad Privacy Giles Bowkett gibo(a)ripco.com I am who I am because I say so. So there. -----END PBP SIGNATURE-------

2 1

Mike Godwin Re: Is there a lawyer in the house?
by John Gilmore 17 Dec '03

17 Dec '03

From: Mike Godwin <mnemonic(a)well.com> Subject: Re: [Black Unicorn: Re: Is there a lawyer in the house?] Date: Mon, 11 Dec 1995 13:27:34 -0800 (PST) > The question is whether the government can legally compel production > of your encryption key(s) if you give them to another person, such as > an escrow agent of your choice, your lawyer, your wife, your bank, > your web site provider, or whoever. Compelling the key from the person you gave it to is easy. (That is, the answer there is yes, assuming no independent claim of non-Fifth Amendment-derived privilege.) Whether you have given it to another person does not automatically make it easier to compel the key from you. But under certain circumstances (and in certain jurisdictions) it might -- such as if, for example, you were relying on a "last link" rule to bar your disclosure of the key. If you were arguing that the disclosure of the key would be a "last link" in a chain of inculpatory causation, and it could be shown independently that you had already disclosed the key to someone else, thereby proving that you possessed the key at one time, your having done so might undermine your "last link" argument. Feel free to forward this. --Mike

1 0

Re[2]: Timing Cryptanalysis Attack
by Martin Diehl 17 Dec '03

17 Dec '03

OTOH, maybe we _should_ try for constant computation time and then try for *random* delay time. Remember that _we_ will spend a lot of real time arguing whether the *random* delay is really _random_ Martin G. Diehl _______________________ Reply Separator __________________________ Subject: Re: Timing Cryptanalysis Attack Author: Nathaniel Borenstein <nsb+limbo(a)nsb.fv.com> at Internet-usa Date: 12/11/95 2:41 PM Hey, don't go for constant time, that's too hard to get perfect. Add a *random* delay. This particular crypto-flaw is pretty easy to fix. (See, I'm not *always* arguing the downside of cryptography!) It is worth noting, however, the extent to which "secure" cryptographic protocols keep needing to get fixed one last time.... -- Nathaniel -------- Nathaniel Borenstein <nsb(a)fv.com> | (Tense Hot Alien In Barn) Chief Scientist, First Virtual Holdings | VIRTUAL YELLOW RIBBON: FAQ & PGP key: nsb+faq(a)nsb.fv.com | http://www.netresponse.com/zldf

1 0

Re: Timing Attacks
by droelke＠rdxsunhost.aud.alcatel.com 17 Dec '03

17 Dec '03

> From: "Rev. Ben" <samman-ben(a)CS.YALE.EDU> > > I'm not so sure I see the great usefulness of this attack. > > I've taken a cursory glance at Mr. Kocher's paper on-line and what it > comes down to essentially, if I undestand it correctly, is that you need > to be as sure of the timing as you can be. > > Now, on a distributed system, you can't measure those timings, because > any latency could come from the originating computer, the links in the > middle or any combination of them. But, what if one of the computers is connected on a "hostile" lan. For example - your typical student PC running in a grad-student office or on the network in the dorms. Sniffing packets from it shouldn't be too hard (yes, good ethernet concentrators make it harder - but not impossible). These packets will give you the necessary timing information. > Also precise timings can be limited by fluctuating load averages amongst > other things in a time-sharing computing environment. While this might > work in a lab, with the current advances in computing speed, the > differences between a fast and a slow calculation can easily be opaqued > by network lag. > > Am I missing something, or does this attack only work in a lab? What if that is a PC running Windoze or single-user Linux? Then there aren't likely to be fluctuating load averages. The advesary is close to the one end, and away you go...... Of course, targeting a server is much more pratical in terms of what you may gain access to. Several congested network hops will generate lots of delays, BUT what about the 4:00am hit from the dialup terminal servers that happen to be on the same ethernet as the secure server. This would be a normal situation for many ISPs. All of that said - I think that this is more pratical in the "lab" than on the net. But, it is a very clever approach to the problem of cracking a crypto system. It serves us all a good example that we need to leave NO stone unturned when examining a system. Dan ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX

1 0