December 2003 - cypherpunks-legacy

Authenication and CIRC
by ljanke＠direct.ca 17 Dec '03

17 Dec '03

Does anyone know of versions of CIRC which support authenication? The version I pulled off csua does not even for the initial 3DES key exchange.

1 0

Re: Timing RSA and Certificates worth ??
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:50 PM 12/13/95 +1100, lyalc(a)mail.mpx.com.au (lyal collins) wrote: >I meant that on-line certificate issuing, notary and similar services where >data is submitted to a system for processing/RSA encryption are subject to >this for of attack. >Parts of the SEPP/STT protocols appear to require this of merchants and >customers. >I retract my comments about ecash/echeques - I'm not sure of the >implications there yet. >As for SEPP/STT - another nail in the coffin, me thinks. For large environments like this, it's possible to work around the attack by methods like queueing up all the signature jobs and doing them serially; this makes it difficult for the Bad Guy to know whether the server is taking time doing his multiplications or Alice's or N other customers', so he can't control timing very well by picking otherwise-informative numbers. On the other hand, your smartcard or PC is still at risk, since it's _not_ doing a lot of them, unless it's doing them just sort of at random when it's got nothing better to do and throws the real work in the middle. #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

1 0

Question about the Timing Attack
by James Black 17 Dec '03

17 Dec '03

Hello, I have looked over the paper, but I will look more closely this weekend (finals going on right now). The main question I have, since my programs run over a network with dumb terminals is this: If someone can get the timing information why would they need it, since they can read the message. So how can this attacker get the timing info without being able to read the message (unencrypted)? Thanx. ========================================================================== James Black (Comp Sci/Comp Eng sophomore) e-mail: black(a)eng.usf.edu http://www.eng.usf.edu/~black/index.html **************************************************************************

1 0

ADDRESS DATABASE?
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Something of privacy interest happened to me yesterday. I phoned a company to ask for a copy of their catalog. The phone clerk asked for my last name and zip code. After receiving that info, the clerk asked me, "Is this your full name and address?" and then gave them both correctly. I was taken aback. I have been at my new address for only a couple of months. Prior to that, I have been couch surfing for a year and a half. Though I called an 800 number, ANI had nothing to do with it since I was calling from work. It may have been from a database associated with a credit reporting agency, a bank or a utility company, but I am not aware of any of these being available on-line for something as mundane as requesting a consumer catalog. The clerk had no idea where the info came from (or so he said). Does anyone know how this trick was done? S a n d y P.S. If anyone is interested in helping to make an adult film, drop me a note. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

Re: Attacking Clipper with timing info?
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

> Without having the details of the algorithm, I suspect > the answer is 'remotely possible, at best'. > > However, to extend what I suspect you were getting at: > > It would be very interesting to determine if the NSA knew > about this crypto-design problem... > That was indeed what I was wondering. I expect we wont have to wait too long before we hear whether Clipper chips require the same or a different amount of time to encrypt/decrypt. Should be interesting. Jim_Miller(a)suite.com

2 1

Kocher's Paper
by Connie Sadler 17 Dec '03

17 Dec '03

Hi... Can someone tell me where I can get a copy of Kocher's paper? I haven't read it yet. Thanks! Connie

1 0

Re: Timing Cryptanalysis Attack
by hoz＠univel.telescan.com 17 Dec '03

17 Dec '03

At 03:42 PM 12/14/95 +0100, Lars Johansson wrote: >>Does the attack work for existing smartcards? >At first glance, smart cards would seem to be the most critical target >to Kocher's timing attack since they usually operate in on-line >environments. Not just on-line, they also operate in untrusted (hostile?) environments. >...the terminal could get a (noisy) measure of the time by > repeatingly use this command to see when the result is available. Might a terminal also be able to monitor power consumption or electromagnetic emissions to obtain a more precise time estimate? >Most smart cards does nevertheless require that the user must first >specify a PIN code before the RSA algorithms are operationable. If I used my RSA card every day, (at a toll booth, for instance), and the "bad guys" pilfered an "exact" timing upon each use, how long before they could forge a signature? >This implies that even if the card gets stolen can't it be attacked >with Kocher's method. That is useful, but if I know my card is stolen, I can presumably limit my liability by reporting it. If I still have my card, but my secret key is stolen, then damage might be greater. On another note, timing attacks would not seem to work against most DES implementations, hardware or software. The time to execute each round does not seem to depend on the plaintext or the key. It could be made to, of course, but unless I'm missing something, the "natural" way to code it, or to construct hardware for it, is not time dependent. Rick F. Hoselton (who doesn't claim to present opinions for others)

2 1

PGP Interoperability?
by marina kats 17 Dec '03

17 Dec '03

Can anyone out there vouch for the interoperability of PGP 2.6 ui with versions of PGP available in USA from MIT & Viacrypt. What about the legal issue ? Is it legal for a US citizen to encrypt or check signatures with a 2.6ui public key ? Would sending a public key out of the US be reagarded as export by ITAR? Thanks Geoff Klein.

2 1

Digital Sigs and the Bar Committee
by William McVey 17 Dec '03

17 Dec '03

This was found on Netwatchers (http://www.ionet.net/~mdyer/front.shtml) and I figured there would be people on this list willing to comment. -- William McVey BAR COMMITTEE PROPOSES DIGITAL SIGNATURE GUIDELINES The Information Security Committee of the Science and Technology Section of the American Bar Association has promulgated proposed Digital Signature Guidelines, and is inviting comment through January 15, 1996. You can download the compressed ASCII file at the NetWatchers site, subject to the copyright notice below, or you can download the text in various formats from the ECL site at http://www.intermarket.com/ecl/.

1 0

Re: ADDRESS DATABASE?
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Sandy Sandfort 7:51 AM 12/14/95 (not completely in this order): >Something of privacy interest happened to me yesterday. I phoned >a company to ask for a copy of their catalog. The phone clerk >asked for my last name and zip code. After receiving that info, >the clerk asked me, "Is this your full name and address?" and >then gave them both correctly. I was taken aback. That is the correct response. >Does anyone know how this trick was done? What trick? For ~$150, you can buy a CD-ROM-set DB with every listed phone number in the U.S. on it, faxes too; the info's rife with typos and has a lag of ~6-7 months, but what do you want? If you're willing to pay more, you'll get more -- more accurate, more timely, more aggressively correlated, more thorough info. >I have been at my new address for only a couple of months. Prior Where's your new address, under a rock? ;) >to that, I have been couch surfing for a year and a half. Though Ironically, NFA status will get you on some very aggressive lists. >I called an 800 number, ANI had nothing to do with it since I was >calling from work. It may have been from a database associated >with a credit reporting agency, a bank or a utility company, but [x] all of the above >I am not aware of any of these being available on-line for They are. >something as mundane as requesting a consumer catalog. The clerk ^^^^^^^ Are you being serious? Ever heard of "information markets"? What, are you a libertarian just because you don't like taxes? There are other reasons for being one... :) >had no idea where the info came from (or so he said). Detweiler L Detweiler L S Detweiler Larry 8525 E Hampden Ave 3704 S 2nd St 2884 Ww Ave Denver CO Austin TX Parnell IA 80231-4826 78704-7073 52325-8825 303-695-0497 512-448-1750 319-628-4461 Detweiler Lynn Detweiler Lynn Detweiler Lynn Teenline 1724 N Alabama St 1045 W Forevergreen Rd North Liberty IA Silver City NM North Liberty IA 52317 88061-4302 52317-9717 319-626-6272 505-538-2776 319-626-8216 <etc.> PS. Unless your postscript (in the classical sense) about getting help making an adult film was a pickup line, maybe you could talk to one of Detweiler's neighbors about it... Allen Michael L 8525 E Hampden Ave Denver, CO 80231-4826 303-750-6855 Allerheiligen Shane & Robin 8525 E Hampden Ave Denver, CO 80231-4826 303-338-5250 Ambrosino Greg 8525 E Hampden Ave Denver, CO 80231-4826 303-338-5723 Anderson Michael W 8525 E Hampden Ave Denver, CO 80231-4826 303-696-1057 Armour Lyles 8525 E Hampden Ave Denver, CO 80231-4826 303-743-0933 Auslen James 8525 E Hampden Ave Denver, CO 80231-4826 303-671-5129 Baker Barbara 8525 E Hampden Ave Denver, CO 80231-4826 303-751-4451 Banks Mark 8525 E Hampden Ave Denver, CO 80231-4826 303-671-9228 Banner K 8525 E Hampden Ave Denver, CO 80231-4826 303-750-4587 Barison Joseph 8525 E Hampden Ave Denver, CO 80231-4826 303-743-9661 Becker Michelle 8525 E Hampden Ave Denver, CO 80231-4826 303-745-0320 Beckler Barbara 8525 E Hampden Ave Denver, CO 80231-4826 303-745-8793 Belloni Beecky 8525 E Hampden Ave Denver, CO 80231-4826 303-671-5114 Bennett Tim 8525 E Hampden Ave Denver, CO 80231-4826 303-337-2903 Berlin T A 8525 E Hampden Ave Denver, CO 80231-4826 303-745-0541 Berthonnaud Jon 8525 E Hampden Ave Denver, CO 80231-4826 303-751-7496 Biery Timothy 8525 E Hampden Ave Denver, CO 80231-4826 303-755-5589 Bond H M 8525 E Hampden Ave Denver, CO 80231-4826 303-369-5513 Bosworth Lisa 8525 E Hampden Ave Denver, CO 80231-4826 303-743-8447 Budd Edward K 8525 E Hampden Ave Denver, CO 80231-4826 303-752-9749 Chlopek Joanna 8525 E Hampden Ave Denver, CO 80231-4826 303-752-4647 Coleman Warren 8525 E Hampden Ave Denver, CO 80231-4826 303-695-4761 Cormier Keith 8525 E Hampden Ave Denver, CO 80231-4826 303-750-1783 Cox R 8525 E Hampden Ave Denver, CO 80231-4826 303-337-5744 Dayton C 8525 E Hampden Ave Denver, CO 80231-4826 303-750-5281 Dietz Scott 8525 E Hampden Ave Denver, CO 80231-4826 303-750-6657 Dillon C 8525 E Hampden Ave Denver, CO 80231-4826 303-338-5495 Donaldson Jennifer 8525 E Hampden Ave Denver, CO 80231-4826 303-750-7681 Dooley Patricia F 8525 E Hampden Ave Denver, CO 80231-4826 303-750-5443 Duke Alison 8525 E Hampden Ave Denver, CO 80231-4826 303-671-7286 Elizondo Arthuro 8525 E Hampden Ave Denver, CO 80231-4826 303-338-0348 Erfman Jeff 8525 E Hampden Ave Denver, CO 80231-4826 303-755-7570 Farris J 8525 E Hampden Ave Denver, CO 80231-4826 303-696-1283 Faulkner Theresa 8525 E Hampden Ave Denver, CO 80231-4826 303-750-6341 Fernandes Roland C 8525 E Hampden Ave Denver, CO 80231-4826 303-750-1650 Fouse Sue 8525 E Hampden Ave Denver, CO 80231-4826 303-750-0015 Fox J 8525 E Hampden Ave Denver, CO 80231-4826 303-337-5960 Gaffney Walter R 8525 E Hampden Ave 1513 Denver, CO 80231 303-368-9245 Goodell Brooke 8525 E Hampden Ave Denver, CO 80231-4826 303-755-5765 Graham Calvin 8525 E Hampden Ave Denver, CO 80231-4826 303-750-5853 Grant Dallas 8525 E Hampden Ave Denver, CO 80231-4826 303-671-7792 Grosskreutz Vicki 8525 E Hampden Ave Denver, CO 80231-4826 303-745-1905 Hewett Vern 8525 E Hampden Ave Denver, CO 80231-4826 303-751-5786 Higgins Scott 8525 E Hampden Ave Denver, CO 80231-4826 303-696-8126 Howard W 8525 E Hampden Ave Denver, CO 80231-4826 303-745-9591 Howe Josh 8525 E Hampden Ave Denver, CO 80231-4826 303-337-6322 Huggins Scott 8525 E Hampden Ave Denver, CO 80231-4826 303-745-6627 Hunt Derek 8525 E Hampden Ave Denver, CO 80231-4826 303-755-7306 Hunter Lisa 8525 E Hampden Ave Denver, CO 80231-4826 303-338-5505 Jackson J C 8525 E Hampden Ave Denver, CO 80231-4826 303-750-2418 Jensen J A 8525 E Hampden Ave Denver, CO 80231-4826 303-750-1906 Kiolbasa Mike 8525 E Hampden Ave Denver, CO 80231-4826 303-338-9216 Klein Misty 8525 E Hampden Ave Denver, CO 80231-4826 303-745-3986 Leiker Ron 8525 E Hampden Ave Denver, CO 80231-4826 303-671-9558 Lenard P 8525 E Hampden Ave Denver, CO 80231-4826 303-751-3253 Lopez Jennifer 8525 E Hampden Ave Denver, CO 80231-4826 303-337-1765 Marinella Michelle D 8525 E Hampden Ave Denver, CO 80231-4826 303-751-3645 Mclane William T 8525 E Hampden Ave Denver, CO 80231-4826 303-337-6035 Mcqueen Mike 8525 E Hampden Ave Denver, CO 80231-4826 303-750-7483 Milbrath Jeff 8525 E Hampden Ave Denver, CO 80231-4826 303-750-7925 Moffit S L 8525 E Hampden Ave Denver, CO 80231-4826 303-369-2964 Murchison Rob 8525 E Hampden Ave Denver, CO 80231-4826 303-368-1260 Nash Jesse H 8525 E Hampden Ave Denver, CO 80231-4826 303-752-1141 Nichols Keith 8525 E Hampden Ave Denver, CO 80231-4826 303-337-0062 Palesch Mindi 8525 E Hampden Ave Denver, CO 80231-4826 303-671-5177 Parker L 8525 E Hampden Ave Denver, CO 80231-4826 303-750-4587 Peterson N C 8525 E Hampden Ave 720 Denver, CO 80231 303-752-4807 Plunkett Lisa A 8525 E Hampden Ave Denver, CO 80231-4826 303-338-5986 Plybon Jonathan 8525 E Hampden Ave Denver, CO 80231-4826 303-671-0681 Reynolds Robert 8525 E Hampden Ave Denver, CO 80231-4826 303-337-3489 Richey Robert 8525 E Hampden Ave Denver, CO 80231-4826 303-338-9074 Sabourin William & Tasha 8525 E Hampden Ave Denver, CO 80231-4826 303-745-6005 Sanborn Bruce E 8525 E Hampden Ave Denver, CO 80231-4826 303-752-1838 Schroeder Paul 8525 E Hampden Ave Denver, CO 80231-4826 303-671-5231 Sears Marc & Denise 8525 E Hampden Ave Denver, CO 80231-4826 303-745-2958 Shaw R 8525 E Hampden Ave Denver, CO 80231-4826 303-696-7014 Short Maynard P 8525 E Hampden Ave Denver, CO 80231-4826 303-671-5647 Shriner Christopher S 8525 E Hampden Ave Denver, CO 80231-4826 303-695-0806 Sicles T A 8525 E Hampden Ave Denver, CO 80231-4826 303-750-5744 Sinks Curt E 8525 E Hampden Ave Denver, CO 80231-4826 303-671-8118 Smith J H 8525 E Hampden Ave Denver, CO 80231-4826 303-338-5438 Smith Marc G 8525 E Hampden Ave Denver, CO 80231-4826 303-750-8531 Sorrell Larry W 8525 E Hampden Ave Denver, CO 80231-4826 303-695-4778 States Michael W 8525 E Hampden Ave Denver, CO 80231-4826 303-750-7416 Steward E C 8525 E Hampden Ave Denver, CO 80231-4826 303-337-3259 Sullivan K 8525 E Hampden Ave Denver, CO 80231-4826 303-755-9989 Sunburst Apartments 8525 E Hampden Ave Denver, CO 80231-4826 303-750-0124 Terry Robert D 8525 E Hampden Ave Denver, CO 80231-4826 303-745-4287 Triplette J 8525 E Hampden Ave Denver, CO 80231-4826 303-369-7795 Vestal Patrick J 8525 E Hampden Ave Denver, CO 80231-4826 303-671-0245 Whaley Leigh 8525 E Hampden Ave Denver, CO 80231-4826 303-755-1915 White Epsie 8525 E Hampden Ave Denver, CO 80231-4826 303-337-1368 Williams Myrtle M 8525 E Hampden Ave Denver, CO 80231-4826 303-695-1074 Winfield Kurt 8525 E Hampden Ave Denver, CO 80231-4826 303-755-4306 Zullo Marie J 8525 E Hampden Ave 117 Denver, CO 80231 303-368-1057 - ------------- That took about 15 seconds, but I'm a fast typer. YMMV. Hieronymous (*not* one of LD's neighbors) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMNBgWr3g0mNE55u1AQEugwH8DKWGsVXd9tfK97RICTeddGJUuQFFwrP3 WoQXrrxNcvGRQ8bzZ3ANH1FPAAiCt7WB+8OF3MA20H/Ma1XuiU8ljw== =QTb4 -----END PGP SIGNATURE-----

1 0