December 2003 - cypherpunks-legacy

Re: Hack Lotus?
by daw＠beijing.CS.Berkeley.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <2.2.32.19960118195838.008a4944(a)mail.teleport.com>, Alan Olsen <alano(a)teleport.com> wrote: > I am certain that comparisons between the export and non-export (with > softice and other debugger-type software) will show some interesting things. Hack Lotus? Please do. I would love to see the internals of how Lotus Notes does the escrow. Every conceivable way I can see to do it seems very vulnerable to attack. If the receiving Lotus Notes program doesn't check whether the high 24 bits have been escrowed correctly in the LEEF-like field, then a simple hack to the sending Lotus Notes program to not send the LEEF field should give foreigners true 64 bit encryption. [LEEF = Law-enforcement / Espionage Exploitation Field = the RSA-encrypted high 24 bits of the key] If the receiving Lotus Notes program does verify that the high 24 bits are escrowed correctly, then anyone can verify that, so in 2^24 trials, I can recover the high 24 bits, and with 2^40 more trials, I can recover the high 40 bits. Therefore 2^40 + 2^24 trials should suffice to hack Lotus if this is how it works. Or maybe it works in some other crazy manner. Waiting to hear the technical details of how it works, - -- Dave Wagner - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMP751yoZzwIn1bdtAQGvzgF/RPhioKYfwXcqHoDCwyyVHZFgyR26KQCz swwAnSDPydO5jKFjFNK5XaM9XRh2Vi3a =HLSf -----END PGP SIGNATURE-----

2 1

Blacknet & Lotus Notes
by Adam Shostack 17 Dec '03

17 Dec '03

Espionage Enabling in Action, or "How much is that escrow key in the window?" We all know how cheaply spies sell out. The Falcon and the Snowman got a few tens of thousands for years of crypto keys and satelite data. Pollard got 50,000 for cubic yards of documents on all sorts of subject. The Walkers gave the Soviets a volume purchase discount, and Ames got 2 million for running the CIA's counter-espionage program on behalf of the KGB. This little key to handle 24 bits of data is nothing. It can easily be smuggled out on a floppy, in an encrypted email message, or even printed out and sent through the mail. Assuming many federal employees will all have access to the same key, its not much of a secret. So, lets buy the espionage enabling secret key. Its an obvious target, not just for cypherpunks, but for the KGB, Mossad, Toshiba, IBM, and anyone else who wants to read their competitors correspondance. Lets face it, this key will get out there, and be available to all the big players; lets make it available to everyone! This is a job for ... Blacknet! This is exactly the kind of information thats easy to resell. Its small; no smuggling DATs full of B2 bomber plans out, just a small file on a floppy disk. Its easily checked, if the Lotus message formats are public, slightly less so if they're not. Who would buy? Pick an intelligence agency. Pick any large company whose compitition uses Notes. Heck, I'd bet there are US government agencies (FBI, BATF, LAPD) who would buy it once we made it available. Its a near perfect demonstration of the foolishness of the government's position. Once this key, like the clipper keys, becomes easily available, the foolishness of the idea of GAK becomes magnified. Its ANOTHER government program that can't be run properly, thats opposed by 80% of Americans, and that doesn't even sell overseas. The persons responsible might even get to claim to be whistleblowers, demonstrating how easy it is to subvert this foolish plan that will continue to cost American business 60 billion a year in lost sales overseas. So...Is Notes V4 shipping yet? Do we know how many bits of key we're after? (NB: I'm assuming that (some part of) the US government has an RSA private key which is used to encrypt the 24 bits of GAK'd key.) Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

Junk Notes
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

New York (AP) -- For the first time in years, there were no major trouble spots in IBM's vast product line. Both personal computers and large systems sold well and Lotus Development Corp., which IBM acquired last summer, shipped an astounding 1.2 million copies of its Notes program. "Our fundamental strategies are working," IBM chief executive Louis V. Gerstner Jr. said in a statement. ... Changes in the general export laws seemed unlikely so Lotus negotiated an interim solution. "This protects corporate information from malicious crackers but permits the government to retain their current access," Ozzie said. Simson Garfinkel, author and computer security expert, said he's not sure international buyers of Notes will like the solution. "Foreign companies don't want the U.S. government to spy on their data any more than the U.S. government wants foreign companies to be able to spy on theirs," Garfinkel said. ... But IBM said nothing about the future, causing some nervousness among the investors who have seen other technology companies project a flat performance in the next few months. "It was a good quarter but the bad news is we've got to go and find out what's going to happen in 1996," said David Wu, analyst at Chicago Corp. Questions have been raised about the timing of IBM's June acquisition of Lotus -- a $3.5 billion deal that was the software industry's largest ever -- because World Wide Web-related programs seemed to be eclipsing the need for Lotus' Notes, a communications and database program.

1 0

Re: Microsoft's CAPI
by jim bell 17 Dec '03

17 Dec '03

At 10:14 AM 1/17/96 -0800, Alan Bostick wrote: >> The OS will not load just any old CSP. CSPs have to be signed by >> Microsoft. The kernel contains a (hardcoded?) 1024 RSA public key >> that it uses to check the signature when the user tries to load a CSP. >> If the signature check fails, the CSP won't load. Microsoft says it >> will sign any CSP from anyone AS LONG AS THEY CERTIFY THAT THEY WILL >> FOLLOW THE EXPORT RULES. So you can get your CSP signed if you use >> exportable cryptography or if you agree not to send it outside the US >> and Canada, etc. But an end user can't just compile crypto code and >> use it as a CSP, even for his or her own use, without getting it >> signed by Microsoft first (actually, the CSP development kit does >> allow this, but it uses a special version of the OS). > >The next obvious question is: Will Microsoft sign strong-crypto CSPs >developed by foreign developers for out-of-USA use? And, as well, for in-USA-use. Currently, it is only the export of cryptographic devices and programs which is restricted. Are they going to prohibit the export of digital signatures which enable the use of foreign-developed software?!?

1 0

Elitism on Cypherpunks
by Alan Olsen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have seen a number of posts on "Cypherpunk Elitism". I have seen more examples of it here on the list. I think that this attitude will be more destructive to the list than noise in the long run. It has been said that "Cypherpunks write code". They must do more than that. Cypherpunks need to teach. All the cryptotools in the world are of no use if no one knows how to use them. (Or know how to use them correctly.) All of the protocols are of no use if no one knows how to impliment them correctly or WHY they need them in the first place. There are alot of bogus security methods. Many of them exist because people do not know better. Without someone to instruct them in the ways of these things, they will continue to go on with bad crypto, not knowing any better. Not all of the non-cypherpunks are beyond hope. Many of them are teachable. If we leave them to flounder on their own, cryptography will be something used only by an elite. It will be of little or no threat to the powers that be because only a small amount of people will have the ability to use it. The TLAs will have less encrypted trafic to sort through. They will have won a big battle, not through force of arms but force of egos. What can be done? Alot. Teach people how to use PGP. Help them generate keys. Help them get them signed. Show them how to use remailers. Teach them the secret of nyms. Friends teach friends how to use crypto. Adopt a BBS. They may be young, but they may also become the cypherpunks of tommorow. Upload current versions of programs. Keep them current. Organize keysignings on the board. Host crypto discussions. Help stamp out the misinformation that breeds on such systems. Instilling the interest in the field and teaching will do more for the cause than all of the "this is noise" postings in the world. Helping those who have questions will help the newbies no longer be newbies. There are some on the list who have already taken this tact and must be commended. There are others who have taken the "fuck you" attitude to anyone they do not find worthy opon first contact. Bad attitudes are counter productive. To prevent the fall of a new dark ages, we must make sure that the information is spread far and wide. I think the statement that descibes it best is: "UN-altered REPRODUCTION and DISSEMINATION of this IMPORTANT information is ENCOURAGED." There is alot that cypherpunks can do to encourage the use of cryptography by "the common man". Elitism is not one of them. In the long run it will be counterproductive. And maybe in the short run as well... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMP8jQeQCP3v30CeZAQHtjAf9FfJWRAe0ZDLNOLsFDMBGQvi9kXKZR3sw WDmOb3K/y8syCdADqqC4UjqoZ0pQ/XHEt6qKd8A7qx6D1FVQauTocEp1vqwE645h zGirsApDjiCYFmV/+Lbpor5Uf9F2rFbjya64lOTbiKW+XEGukpI3ghgbGxGPqPGF fIIT2QxqMl1MDd1sSGIXzvpniOsHI6HoVbPwUx8S2tbMR0dqh5AQObOKdna0D4x4 beAxEVyNd6atqdkZPEZy2XaSO6Y4hmRZx3I4CuqCM2wqbsboETQLpELBSn/dnxet 0Fe82xHHZQSuh0gMXEP+znaKYOq/38mijwjF3zpX+5RRHIVrjMu2+w== =ojHr -----END PGP SIGNATURE----- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Is the operating system half NT or half full?"

1 0

What's a good math text?
by phorgan＠broadvision.com 17 Dec '03

17 Dec '03

I'm not on the list just now, my work won't allow me the time to follow it. I'm still just as interested in cryptography though, and would like y'all to email me recommendations on good math books that will give me the background to understand the papers in the field. I'm sure that will include a good numbers theory text. If a beginner at number theory would have a hard time understanding it, please recommend background texts as well:) What else would I need? My computer science texts explain complexity theory well, what would I need in information theory. What would I have to read to understand factoring complexity? Are there any new texts that cover the recent breakthroughs in factoring? Thanks:) Patrick Patrick J. Horgan Broadvision Inc. phorgan(a)broadvision.com 333 Distel Circle Have horse Phone : (415)943-3677 Los Altos, CA 94022-1404 will ride. FAX : (415)934-3701 Opinions mine, not my employers except by coincidence.

1 0

Re: remarkable recent stories
by James M. Cobb 17 Dec '03

17 Dec '03

Vladimir, On 01 16 96 you wrote: I haven't seen much dialogue on...key things that have popped up recently.... Among those key things: the absolute biggest blockbuster of them all: the NSA... did a study about how crypto regulations affect US com- petitiveness in the international marketplace.... And you ask: why would they release *this* one? meaning the NSA study on how crypto regulations affect US competitiveness abroad. On 01 13 96 I wrote a message to the list headed "ITAR Re-write?" In it I attempt to answer your question. I include it below for your convenience. Cordially, Jim INCLOSURE: Date: Sat, 13 Jan 1996 05:04:52 -0500 (EST) From: "James M. Cobb" <jcobb(a)ahcbsd1.ovnet.com> To: cypherpunks(a)toad.com Subject: ITAR Re-write ? Friend, Bloomberg, the business news agency, reports 01 12 96: The U.S. Commerce Department will recommend easing export controls on encryption software after a study by the department and the National Security Agency found that American firms are being hurt.... The report's release came on the same day federal pro- secutors dropped a three-year investigation...of...Philip Zimmerman.... The government study comes a week after [the Computer Systems Policy Project] released [its] own study showing ...American companies will lose [maybe $60 billion] in U.S. computer system sales expected in 2000.... The 13-member Project ...includes International Business Machines...and AT&T.... Perhaps the let-go of Zimmerman is less a triumph of right than of might? But economic might is not the only kind of might: [Easing export controls] may pit Brown's department a- gainst U.S. defense and spy agencies.... So... [Commerce Secretary] Brown said his department will pre- pare recommendations for easing [ITAR] controls that should be forwarded to the president "within a few months." Meaning: the 13 Project members should be prepared to pay through the nose in the runup to the '96 gala. And just so they get the big picture: It's unclear if the NSA, the super-secret eavesdropping agency, endorsed the Commerce Department's conclusions in the report it jointly prepared. The newsstory reports ...federal prosecutors dropped [the Zimmerman] investiga- tion without explanation.... No explanation's required. One hostage was released. 13 others were taken. But the one release does afford the new hostages, who have deep pockets, some hope... Cordially, Jim NOTE. The newsstory's headline? COMMERCE'S BROWN PROPOSES REWRITE OF ENCRYPTION EXPORT CONTROLS. Its dateline? WASHINGTON (Jan 12, 1996 5:34 p.m. EST). Its Nando News online filename? biz6_1893.html

1 0

WSJ: IBM Corp. Compromises On Encryption Keys (fwd)
by mixmaster＠obscura.com 17 Dec '03

17 Dec '03

You might want to disregard the paranoid, irrelevant head and tail, but the included article is very good, especially considering the establishment source. Nice headline, for the WSJ. Forwarded message: > Have you heard of problems with the equations that Excel 95 generates when > using the trendline analysis function in a chart? I haven't seen this, but because of all the math stuff on my web, I'm getting both phone calls and a lot of odd math feed back. We think we do have a real carry bit error between the Win 3.x and Win95. Some of the data I've reviewed is pretty scarry. Microsoft lost a lot of their older programmers over the past 3 years. It was literally an Exodis out. Now they have a lot of people that can't read the old code and this is a real mess. They also can't get anyone with much experience to work there. Here in Redmond good people just stay away. I saw this article today in Dow Jones and thought it might shed some light on the security issues. I know what MS's 10 year strategy was from 1990. Steve Ballmer is the one making all the decisions on international markets. It's his baby. When I read this about IBM and Lotus all I could think of was Steve ordering the guys to make something exceptable for their license by the FED so they could gain market share over their competitors. This is just who he is. He doesn't understand the techincal issues and hasn't listened to Gates in years. MS is pretty thick with DC and must pay off lots of people there. That is what they were doing when I worked for their government group. It's weird working with the FED. They are all into their power groups. AND they are very low tech. I swear the FED is scrapping the bottom of the technical pool. The FBI is the worse. ------------------------------------ 1/18/96 IBM Corp. Compromises On Encryption Keys By Thomas E. Weber Staff Reporter of The Wall Street Journal NEW YORK -- International Business Machines Corp., caving in to intense government pressure, agreed to include a special key that helps investigators tap into data messages in return for permission to export a more-secure version of its Lotus Notes software. The U.S. has prevented software makers from exporting sophisticated encryption technology for fear that terrorists and other criminals would gain access to a snoop-proof communications system. Industry observers said IBM's move marked the first time a supplier agreed to give the government special access to its software's security code. But other companies also are negotiating with the government to find ways around export restrictions. Microsoft Corp., for example, has been seeking industry support for a new scheme that separates encryption technology from application programs so that those products don't need export licenses. Encryption keys have stirred the concern of privacy experts in the past. While IBM's Lotus Development Corp. software unit defended the move as a stopgap compromise until a broader agreement on data security can be reached, Notes creator Ray Ozzie clearly found the controversial plan somewhat distasteful. "We were desperate enough to try to negotiate a short-term, pragmatic solution," Mr. Ozzie said. "But we do not believe this is the right long-term solution." One privacy advocate would agree. "The irreducible fact is that foreign customers are reluctant to rely on security products that have been compromised in some way" by federal intelligence agencies, said Mike Godwin, staff counsel for the Electronic Frontier Foundation. Several years ago the government proposed the "Clipper" computer chip that was programmed to let investigators tap into phone calls and data messages transmitted digitally. While that plan died after privacy advocates accused the government of trying to spy on users, the idea of leaving a back door open for government agents has remained alive. Under the Lotus plan, government investigators would still need to employ sophisticated code breaking to read messages sent via Notes software, which lets users at different computers collaborate. Security software encrypts information by using a unique key of software code. The length of a key is measured in computer bits, and longer keys are better -- they're more complex and more difficult for wouldbe spies, not to mention government agents, to unravel. Until now, to obtain an export license for Notes, Lotus has been restricted to an encryption system of 40 bits in its international version. Domestic users have been permitted to use a higher-level, more-secure 64-bit system. The new overseas version of Notes, tagged Release 4, will give foreign users 64-bit security. But to get permission to export the software, Lotus agreed to give the government access to 24 of those bits by using a special 24-bit key supplied by the National Security Agency. (END) DOW JONES NEWS 01-18-96 6 02 A ---------------------------- Gates is the kind of person who will do just what they want if he gets dicked with. He'll have a ranting fit (Gates is a functional autist) about how stupid it is and then he will just get eccentric and say, give them what they want with a grin. He is still a hacker at the core. You understand the problem here. The FED is making them use lower security and then patting them on the back and buying their products for our own government and militery. Gates use to brag that he would crash the fed. I really believe he is still trying. NO ONE hates the FED more than GATES! He was a page in DC at 17 and got a good taste of our government. I've had it with these people too. DC is so discusting. All these attorneys who don't know shit about anything but words and lying... Hey, I updated my web... : ) To day I filed an appearance in court and fired my attorney. I'm still being dicked with here. If I don't look both way when I cross the street, I get busted. This week it was an unwanted touch. I touched someone's shopping bag getting into my car. Next week its an non-contact order by my daughter's guidence counselor. She considers a phone call from me about my daughter's possible college programs a threat! When I got the complaint it was totally nuts. Everything she knows about me is based on gossip. It reads like total hysteria. The way Microsoft has attempted to play me locally is really amazing. I was 40 when this started. Never had a problem before that. So when I say, 'Watch your back!' I mean it. : ) J~ http://www.halcyon.com/redrose/

1 0

Re: Hack Lotus?
by daw＠quito.CS.Berkeley.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199601190610.RAA17232(a)sweeney.cs.monash.edu.au>, Jiri Baum <jirib(a)sweeney.cs.monash.edu.au> wrote: > > Hack Lotus? Please do. > > I have no idea how Lotus actually does this, but: > > How about a salt determined by the forty bit part? > > Ie if the key is s.g (s=secret, g=gaked), the BARF (="Big-brother Access > Required Field") could contain Encrypt(Hash(s).g,BigBrother). > > The receiving end, knowing both s and g, could re-calculate the > BARF and only function when it's correct. Unless it's been hacked too, > in which case it could barf when the BARF is correct :-) Looks good to me -- I think that should work. I guess that goes to show my lack of creativity. :-) I was talking to Avi Rubin from Bellcore last night, and he speculated that maybe the 64 bit key was a fixed one, generated once at installation time and escrowed with the government then. With a fixed pre-escrowed key, the receiver wouldn't have to do any checking; and it would obviate the need for a LEEF/BARF/... field. On the other hand, it seems to me like one should be able to disable this fixed pre-escrowed key mechanism with a little binary patch. I guess we need hard technical details. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMQAXySoZzwIn1bdtAQFQxgF/d72pj3qiRVIxCBPvhBEsLwWtTiO9tibv HEa8VbFTwMWoWY70XAMd8meFG5ktMRob =8JMW -----END PGP SIGNATURE-----

3 2

Re: Keyboard emulation
by Martin Diehl 17 Dec '03

17 Dec '03

Steve, Yes, it's called PC Anywhere by Symantic MGD ______________________________ Reply Separator _________________________________ Subject: Keyboard emulation Author: "Steve Makrecky" <Steve_Makrecky(a)msn.com> at Internet-USA Date: 1/18/96 7:21 PM Looking for a design of a keyboard & mouse emulator. What I would like to do is control a main computer's keyboard and mouse functions by a second RS232 remote IBM PC. Has anybody tried this? Do you foresee any problems?

1 0