December 2003 - cypherpunks-legacy

Re: Blinding against Kocher's timing attacks
by jim bell 17 Dec '03

17 Dec '03

At 01:27 PM 12/12/95 -0800, you wrote: >From: ljo(a)ausys.se (Johansson Lars) >> Does anyone know whether David Chaum's patent on >> blind digital signatures extends to this application? > >I don't think it would. Chaum's blinding protocol has one major >difference: the blinding factor is applied by a different person than >the one doing the signing. The purpose of the blinding is different, >too; in Chaum's case the idea is to end up with a signature which is >unknown to the signer, while with Kocher's "defensive blinding" the >signature (or decryption) is an ordinary RSA one, and the blinding is >just done internally by the signer to randomize the timing. One thing I haven't heard mentioned would be the possibility of using TWO blinding factors, by two different people, to blind the unsigned cash. As you may know, I'm interested in payee-anonymous systems as well as payer-anonymous ones, and such a feature might assist in this.

1 0

(U)
by Francisco Encarnacao 17 Dec '03

17 Dec '03

SUBSCRIBRE Regards, Francisco Encarnacao - Equipment Maintenance Technician Internet E-mail address:Francis@e-mail.com

1 0

Re: IDEA encryption
by cactus＠hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <Pine.LNX.3.91.951212212447.94B-100000@localhost>, Mark M. <markm(a)omni.voicenet.com> wrote: >> Last thing -- how secure is unix "rm"? If something is rm'd, is it >> really really gone? >> > >Not very secure. I have heard that there is a Linux undelete and there might >be a similar program for other Unices. If the hard drive is examined using >special hardware, data will be recoverable. It's not even that secure. As long as the blocks haven't been written over, you can extract the information from the raw device driver with 'dd' as root. - -- Todd Masco | "life without caution/ the only worth living / love for a man/ cactus(a)hks.net | love for a woman/ love for the facts/ protectless" - A Rich Cactus' Homepage - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMM9juyoZzwIn1bdtAQFXZAGA4HlzYVD4ORp5LecGxw16q+ELXZFChIuA kSHufPYuGQjsVDuQ0Ev4Xkroc3kVfZTQ =1vxa -----END PGP SIGNATURE-----

1 0

Re: And the standard continues to lower...
by Andrew Loewenstern 17 Dec '03

17 Dec '03

Dr. Brian L. Crissey includes in his .sig, courtesy of cactus(a)hks.net [ much WRT YetAnotherSecureInternetCreditCardPaymentSystem(*tm) deleted ] > ***Dr. Brian L. Crissey, Chair CS Dpt, Linfield Col., McMinnville, OR 97128 > (503)-434-2426 brianc(a)linfield.edu > Professionals built the Titanic, amateurs built the Ark... However, the Ark was *designed* by GOD (if you believe the story). Can Dr. Brian L. Crissey say the same thing about his payment system? andrew

1 0

Attacking Clipper with timing info?
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

Could this timing attack be used to obtain the various keys used by Clipper devices? Jim_Miller(a)suite.com

3 2

Mike Godwin Re: Is there a lawyer in the house?
by John Gilmore 17 Dec '03

17 Dec '03

From: Mike Godwin <mnemonic(a)well.com> Subject: Re: [Black Unicorn: Re: Is there a lawyer in the house?] Date: Mon, 11 Dec 1995 13:27:34 -0800 (PST) > The question is whether the government can legally compel production > of your encryption key(s) if you give them to another person, such as > an escrow agent of your choice, your lawyer, your wife, your bank, > your web site provider, or whoever. Compelling the key from the person you gave it to is easy. (That is, the answer there is yes, assuming no independent claim of non-Fifth Amendment-derived privilege.) Whether you have given it to another person does not automatically make it easier to compel the key from you. But under certain circumstances (and in certain jurisdictions) it might -- such as if, for example, you were relying on a "last link" rule to bar your disclosure of the key. If you were arguing that the disclosure of the key would be a "last link" in a chain of inculpatory causation, and it could be shown independently that you had already disclosed the key to someone else, thereby proving that you possessed the key at one time, your having done so might undermine your "last link" argument. Feel free to forward this. --Mike

1 0

Re[2]: Timing Cryptanalysis Attack
by Martin Diehl 17 Dec '03

17 Dec '03

OTOH, maybe we _should_ try for constant computation time and then try for *random* delay time. Remember that _we_ will spend a lot of real time arguing whether the *random* delay is really _random_ Martin G. Diehl _______________________ Reply Separator __________________________ Subject: Re: Timing Cryptanalysis Attack Author: Nathaniel Borenstein <nsb+limbo(a)nsb.fv.com> at Internet-usa Date: 12/11/95 2:41 PM Hey, don't go for constant time, that's too hard to get perfect. Add a *random* delay. This particular crypto-flaw is pretty easy to fix. (See, I'm not *always* arguing the downside of cryptography!) It is worth noting, however, the extent to which "secure" cryptographic protocols keep needing to get fixed one last time.... -- Nathaniel -------- Nathaniel Borenstein <nsb(a)fv.com> | (Tense Hot Alien In Barn) Chief Scientist, First Virtual Holdings | VIRTUAL YELLOW RIBBON: FAQ & PGP key: nsb+faq(a)nsb.fv.com | http://www.netresponse.com/zldf

1 0

Re: Timing Cryptanalysis Attack
by Peter Monta 17 Dec '03

17 Dec '03

Kocher says this about padding to constant time: > ... If a timer is used to delay returning results until a pre-specified > time, attackers may be able to monitor other aspects of the system > performance to determine when the cryptographic computation completes. Perhaps, but an attack would be much more difficult if the monitoring must be done outside the host doing the computation (viewing a router from the outside, say, as Eric Young alludes to), since the scope for covert channels is much reduced. Peter Monta

2 1

Re: Timing Attacks
by droelke＠rdxsunhost.aud.alcatel.com 17 Dec '03

17 Dec '03

> From: "Rev. Ben" <samman-ben(a)CS.YALE.EDU> > > I'm not so sure I see the great usefulness of this attack. > > I've taken a cursory glance at Mr. Kocher's paper on-line and what it > comes down to essentially, if I undestand it correctly, is that you need > to be as sure of the timing as you can be. > > Now, on a distributed system, you can't measure those timings, because > any latency could come from the originating computer, the links in the > middle or any combination of them. But, what if one of the computers is connected on a "hostile" lan. For example - your typical student PC running in a grad-student office or on the network in the dorms. Sniffing packets from it shouldn't be too hard (yes, good ethernet concentrators make it harder - but not impossible). These packets will give you the necessary timing information. > Also precise timings can be limited by fluctuating load averages amongst > other things in a time-sharing computing environment. While this might > work in a lab, with the current advances in computing speed, the > differences between a fast and a slow calculation can easily be opaqued > by network lag. > > Am I missing something, or does this attack only work in a lab? What if that is a PC running Windoze or single-user Linux? Then there aren't likely to be fluctuating load averages. The advesary is close to the one end, and away you go...... Of course, targeting a server is much more pratical in terms of what you may gain access to. Several congested network hops will generate lots of delays, BUT what about the 4:00am hit from the dialup terminal servers that happen to be on the same ethernet as the secure server. This would be a normal situation for many ISPs. All of that said - I think that this is more pratical in the "lab" than on the net. But, it is a very clever approach to the problem of cracking a crypto system. It serves us all a good example that we need to leave NO stone unturned when examining a system. Dan ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX

1 0

Re: e-mail forwarding, for-pay remailers
by Greg Broiles 17 Dec '03

17 Dec '03

E. Allen Smith writes (quoting me): >>netbox.com ( http://www.netbox.com ) provides web pages and E-mail storage >>or forwarding for people; they let you sign up for a trial month for free. >>They ask for name/address/phone (which could easily be a Mailboxes Etc >>address and a voicemail from Mailboxes Etc or whatever) and accept payment >>by check or credit card. >-------------------- > There's one problem with this in regards to the "no necessary >connection," and that 's the governmental requirement for mail forwarding. >MBE and any legal other one will want to see at least two forms of ID >including one photo, and have a form that they fill out using that and >send to the local post office. Anyone have a way around this problem? I spent last summer in San Diego - it took me a couple of weeks to find a place to stay. The first day I was in town I went to an MBE and signed up for a box - showed them my Oregon ID and said "I don't have a local phone # or address because I've been in town only 12 hours. That's what I need you folks for." They cheerfully wrote down the information from the front of my drivers' license (which is 5 years out of date) and gave me a box. They also asked if there would be anyone else who'd be getting mail at my box - I could have specified a business or some roommates. They didn't need to see ID for those - so you're free to name some real or imagined roommates/friends, who might coincidentally sign up for E-mail forwarding. (Or you can just say that "Greg is my real name but John Doe is my trade name, I get mail under that name too." "Trade names" aren't so unusual for people in show business or authors or, I read recently, bill collectors. Apparently they don't want people calling them up at home hassling them. Imagine that. :) ) The folks at the San Diego MBE have been cheerfully forwarding my paper mail back here to Oregon as long as I want to keep paying the postage (plus some sum that they're adding on that's not big enough to pay attention to). It's not the kind of untraceability I'd rely on vis-a-vis a TLA, but it ought to be good enough to keep your posts to alt.sex.forbidden from showing up on your boss' desk via DejaNews, or to allow you to go ahead and piss off part-time fascists who don't have the energy to chase down the paper trail. -- "The anchored mind screwed into me by the psycho- Greg Broiles lubricious thrust of heaven is the one that thinks every temptation, every desire, every inhibition." greg(a)goldenbear.com -- Antonin Artaud gbroiles(a)darkwing.uoregon.edu

1 0