December 2003 - cypherpunks-legacy

Today's Baltimore Sun on the NSA...
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

As I mentioned on Sunday, the Baltimore Sun is running a long series on the NSA. Today, the published an article that described how the NSA routinely listens into the phone calls of Americans. This happens in two ways. First, if the conversation leaves the country then the NSA can intercept it. Second, the NSA is also allowed to grab local phone calls for "training" purposes. The funniest part of the article mentioned that Henry Kissenger got both ends of the stick. He relied on NSA to pass him sensitive information about his rivals. But the head of the Department of Defense, who got to appoint the head of the NSA, made sure that the NSA told him what Kissenger was up to. The strangest anecdote involved a Baltimore Sun reporter who called Cuban diplomats from overseas. This was picked up by NSA and the evesdropper openly chatted about it a civilian cocktail party. The details got back to the reporter. The parties in the Baltimore suburbs are from the pages of Fleming not from the pages of Cheever. There is some debate about the whole issue of snooping on American citizens. Everyone quoted on the record says it's all pretty upstanding and good. The paper also gives a fair amount of ink to the argument that American citizens could be involved in terrorism too. This seems to be logical to me. The deepest point made was that NSA could never really assume greater law enforcement practices because this would involve disseminating their information to a much larger audience. Since using secret information often reveals that you can get it, there is little doubt that people would stop using the phone system and the other information sponges. So much for absolute power. -Peter Wayner -=-=-= On Friday, the last article in the series is promised to report, "The next war will be fought with computers. NSA is getting ready." You will be able to buy a reprint of the NSA stories from SunSource. $3.95. Call 410-332-6962.

1 0

[NOISE] Re: Pornographic stories
by pjm＠ionia.engr.sgi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Scott Binkley writes: > Stop posting this type of crap on the Internet. I'd be pleased if people would refrain from posting to inappropriate groups. There a number of acceptable venues for pornography on the Net. > People like you are the ones to get everyone censored. If we censor ourselves, the bluenoses win. > Hopefully everyone else will flame you a thousand times over A polite note suggesting that one remember to log out when leaving one's terminal unattended should suffice. Regards, Patrick May -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMMy/qu5Yg08fDKehAQG8nAQAlJZjWwGPfkCgM3+umOFlfNd0wYZBCKiw M3JktEPpBpviMmiiH6WgKI0BHpvWhLmEcwVQ7Bs56pRtLma/gp66ljOC+eP2m78f KxN8Ao9o/MDDdX7LHUHC7IeliMikBcdkCBttrHdKXpY6xTFAygwVH2qC+rmam0Xp Gz0USqvzDc0= =2V4I -----END PGP SIGNATURE-----

1 0

Re: More elveator problem
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

On Sat, 9 Dec 1995 00:23:41 -0800, Jerry Whiting wrote: >More on The Elevator Problem: >I'll confess that we're working on a new private key encryption product. Free >and clear of existing claims on intellectual property, I'd like a protocol >that answers the elevator problem: how can Alice and Bob agree on a private >key via a compromised channel? I don't want them to meet under a street lamp >and whisper in each other's ears _before_ trying to establish a secret on a >crowded elevator. [..] >Something that I neglected to mention before is that Alice and Bob do have a >unique ID within this system, not that they necessarily know each others. If >one assumes that they do, they then share a secret: the knowledge of each >other's unique ID. [..] Wait... are unique IDs secret from others? Can they share theirs with ea. other without compromising something? Maybe using a hash of their combined secret ideas (adding them, or mixing the bits... how long is the unique ID?) can be used to generate a "key" to exchange other information.... >Jerry Whiting >jwhiting(a)azalea.com

2 1

MD4 weaknesses (Was: Windows .PWL cracker implemented as a Word Basic virus)
by Bill Stewart 17 Dec '03

17 Dec '03

At 06:20 PM 12/10/95 -0500, daw(a)quito.CS.Berkeley.EDU (David A Wagner) wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >In article <95Dec10.175318edt.1732(a)cannon.ecf.toronto.edu>, >SINCLAIR DOUGLAS N <sinclai(a)ecf.toronto.edu> wrote: >> My understanding was that MD4 had been broken once, at the cost of >> much computer time. >Not *that* much computer time... >In my copy of Hans Dobbertin's paper, the abstract says > >``An implementation of our >attack allows to find collisions for MD4 in less than a minute on a PC.'' > >As far as I know, the difficulty of inverting MD4 is still an open >problem -- but why would you want to use a broken algorithm like MD4 >when you can use MD2, MD5, or SHA? Do you have a reference to Dobbertin's paper? Schneier's discussion of MD4 says that DeBoor and Bosselaers cryptanalyzed the last two of the three rounds of MD4 in 1991, Merkle did the first two, and Biham discussed a differential attack on the first two, but nobody had done the whole thing. Does Dobbertin's attack take one of these and use it to feed an otherwise-brute-force search? #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

1 0

Re: Timing Cryptanalysis Attack
by Peter Trei 17 Dec '03

17 Dec '03

> > People employing systems like PGP are already advised to use them > > on private machines, with only one user, and untampered-with > > binaries. > > Timings like the ones listed are trivial to take in establishing > things like SSL sessions, or Photuris sessions. The danger is to > online protocols, not to PGP. > Perry Loathe as I am to disagree with Perry :-), is it really 'trivial' to take these timings in an online protocol? Paul writes on the DH example: ------------------------- A preliminary implementation of the attack using the RSAREF toolkit[8] has been written. RSAREF scans across the exponent from MSB to LSB and does two exponent bits at a time, so corresponding adjustments to the attack were made. Using a 120-MHz PentiumTM computer running MSDOSTM, a 512-bit modulus, and a 256-bit secret exponent, processing times ranged from 392411 microseconds to 393612 microseconds and closely approximated a normal distribution with a mean of 393017 microseconds and a standard deviation of 188 microseconds. -------------------------- Note that the range is 1201 microseconds and for RSA: -------------------------- RSAREF's modular reduction function with a 512-bit modulus on the same 120-MHz PentiumTM computer takes an average of approximately 17 microseconds less time if c is slightly smaller than p, as opposed to slightly larger than p. Timing measurements of many ciphertexts can be combined to detect whether the chosen ciphertexts are larger or smaller than p. ------------------------- The range here is 17 microseconds. Paul notes: --------------------------- Random delays added to the processing time may increase the number of ciphertexts required, but do not completely solve the problem since attackers can compensate for the delay by collecting more measurements. (If enough random noise is added, the attack can become infeasible.) -------------------------- In a 'real' system, there is a lot of unpredictable variation in the timing of the signal. Sources of such noise include routers, and other sessions on the server (any decent server these days is multi-tasking, and can handle multiple connections simultaneously). On top of that, real protocols have a lot of processing overhead, looking up certificates and keys, generating MAC hash values, etc, many of which are difficult to predict. I tried pinging some machines to look at the slop in the roundtrip times. I have not checked traceroute, but for what it's worth, I'm in central Massachusetts. elnath (local to my lan) <10 ms rtfm.mit.edu (20 miles) 10-21 ms iii1.iii.net (FreeBSD on a 120MHz P5, 35 miles) 100-200 ms utopia.hacktic.nl (Netherlands) 190-781 ms Maybe Paul can give us some figures as to how *much* random noise is enough to make his (very elegant!) attack unfeasible. Note that the range of the random slop I'm getting is hundreds to thousands of times the range of the signal he needs to detect. Statistical techniques, averaging the return times for the same text over many trials may be useful, but the number required to detect a less than 1% variation is going to be high. The attack might be feasible of it can be mounted on a quiet server from a point 'close' (in network terms) to the timing system, and the intervening network segments are also fairly quiet. I don't think random users are going to crack the Dilbert Store, however. Speaking for myself.... Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

1 0

Voluntary Key Escrow is Freedom, Surveillance is Privacy
by tcmay＠got.net 17 Dec '03

17 Dec '03

Citizen-unit jim bell wrote: >Pardon me, but since this "key escrow" system was always claimed to be >"voluntary," then how can there be any kind of legal penalties associated >with "failure to release" those keys? > > >Which raises another question: Let's suppose I owned a product based on >CKE, and I went to the escrow agent and said, "This escrow is voluntary, >right? If so, erase my key in your possession." > >Not that I'd trust them to do so, but how "voluntary" can a system be if >people can't volunteer out of it? In much the same sense the income tax system is "voluntary." For further details, consult the definition of "newspeak" in Orwell's novel. Remember, saying that Voluntary Key Escrow is neither "voluntary" nor "escrow" is thoughtcrime. Freedom is Slavery, Surveillance is Privacy, Censorship is Decency --Citizen-Unit May227-80-5992 Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

ViaCrypt supports CKE in PGP
by Robichaux, Paul E 17 Dec '03

17 Dec '03

In today's mailbox I got a pack of marketing slicks from ViaCrypt. They're about to release ViaCrypt PGP 4.0 in two editions: Personal and Business. The 4.0 release adds some nice new features: - recipient groups for sending to several addresses at once - a Search dialog for finding keys - encryption-only & decryption-only keys - signature-only keys - key expiration dates - a Windows DLL that third-party developers can use (!!) The biggie, though, are these: "Encryption automatically includes Corporate Access Key as additional recipient (option)" and "Key selection/display dialogs show only keys certified by Corporate Access Key (option)" So, real CKE will soon be available from an unexpected source. I'm not sure whether to be excited or dismayed. On the one hand, any movement towards CKE seems dangerously close to the slippery slope of GAK. On the other hand, I know a large corp like Intergraph is much more likely to license PGP for internal use if it has CKE features-- especially since they can hold the keys internally. The DLL is an awfully nice feature, too. -Paul -- Paul Robichaux, KD4JZG | perobich(a)ingr.com Intergraph Corporation | http://www.intergraph.com Be a cryptography user. | Not speaking for Intergraph Co-author, "Building Internet Appls With Visual C++", Que Books (0-7897-0213-4)

1 0

Re: NIST GAK meeting writeup, LONG part 3 of 3
by Andrew Loewenstern 17 Dec '03

17 Dec '03

Pat Farrell writes in his report on thi NIST GAK meeting: >>Geoff said that they may want legislation support for >>protecting against illegal release of keys, failure to release, etc. Jim Bell Responds: > Pardon me, but since this "key escrow" system was always claimed > to be "voluntary," then how can there be any kind of legal penalties > associated with "failure to release" those keys? well, since the subject at hand is Escrow Agent Criteria, "Geoff" is probably talking about the failure of an escrow agent to release a key upon production of "lawful authorization" .... andrew

1 0

DES Cryptanalysis
by Kevin L Prigge 17 Dec '03

17 Dec '03

I'm looking for pointers, or perhaps an explanation of the statement I found in Applied Cryptography (section 9.6) where it implies that if the IV is not unique in CFB mode, the cryptanalyst can recover the plaintext. The reason that this interests me is that I have a file, encrypted with DES in CFB mode. I believe I know the first 8 bytes of plaintext and I also know the IV used. While it'd be nice to decrypt this file, I don't know that it'd be worth brute forcing the key, even if the spare cycles to do it were available. Any pointers to any pertinant information would be appreciated. Thanks. -- Kevin L. Prigge |"A computer lets you make more mistakes faster UofM Central Computing | than any invention in human history--with the email: klp(a)umn.edu | possible exceptions of handguns and tequila." 01001001110101100110001| - Mitch Ratcliffe

2 1

Re: NIST GAK meeting writeup, LONG part 3 of 3
by jim bell 17 Dec '03

17 Dec '03

At 11:04 AM 12/10/95 -0800, you wrote: > >NIST Key Export meeting, December 5, 1995 Long version >Part 3 of 3. > >This covers the notes on agent criteria, and the >industry presentations. > [stuff deleted] > >Geoff said that they may want legislation support for >protecting against illegal release of keys, failure to release, etc. Pardon me, but since this "key escrow" system was always claimed to be "voluntary," then how can there be any kind of legal penalties associated with "failure to release" those keys? Which raises another question: Let's suppose I owned a product based on CKE, and I went to the escrow agent and said, "This escrow is voluntary, right? If so, erase my key in your possession." Not that I'd trust them to do so, but how "voluntary" can a system be if people can't volunteer out of it?

1 0