December 2003 - cypherpunks-legacy

Re: Netscape announces position against GAK
by amp 17 Dec '03

17 Dec '03

-- [ From: amp * EMC.Ver #2.3 ] -- -----BEGIN PGP SIGNED MESSAGE----- TM> I for one am satisfied--and even pleased--with the Netscape TM> position on GAK. TM> It remains to be seen how steadfast Netscape, as the major player in TM> the Web browser business, remains in the face of (likely) pressure TM> from the government. i'm not entirely satisfied with netscape's response, but then, i didn't expect to be. i _expect_ weasling from corporations that have made the 'big time'. this is the way life is i suppose. what i'd like to see would be more companies that have an interest in the security of net-based transations in their best interest, (which would be any company that intends to do any business on the net) come out _forcefully_ for strong crypto. the ability of hackers to penetrate the computers of the net would be greatly curtailed by universal crypto. is there not a strong national interest in the integrity of the net in general and financial interactions in particular? looking forward, which politicians and bureaucrats are loathe to do, commerce and corporate dealings across the net will only increase. what we need to do is get large corporations to recognise that privacy is important to _them_. of course, many already know that privacy is important to them. why else would we have a body of law concerning "trade secrets"? i work for a fairly large corporation. this makes finding who to talk to about this difficult. i'm working on it though. perhaps some of you out there can consider ways to convince those in positions of authority in your company to realize that crypto technology works toward their own best interest. they _must_ speak to this because it is business that runs this world of ours. TM> It seems to me that we have have been quick to criticize TM> Netscape--which is good, the quickness part--and thus we should be TM> equally quick to praise them. To be sure, various of us might've TM> written the Netscape position statement slightly differently, but TM> this does not change the basic point: that Netscape has come out TM> against the Administration's position on GAK. TM> For this they deserve our praise. indeed. netscape deserves praise for including 128-bit encryption in their products in the first place. while i'd like to see them stand up and tell big brother to fuck off and die, i am appreciative of what they've done so far. i'd like to see a representative of netscape on nightline or the noghtly news hold up a floppy and say "this floppy contains an encryption program that the u.s. government will not let us export. it was downloaded from the internet for free by an executive of a multinational corporation based in germany who wanted to know why i couldn't sell him a program that was as cryptologically secure as it is. my answer was that the u.s. government will not let me." similar demonstrations of the lunacy of itar are left to your imagination. ============================ these views are my own. no one else in their right mind would hold them. amp <0003701548(a)mcimail.com> (since 10/31/88) <alan.pugh(a)internetmci.com> Current PGP Key = 57957C9D December 13, 1995 18:51 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMM9nH4dTfgZXlXydAQGeKgf/XV2sAD7aklD+QfmcSUWReaH5jviADbMV /wIv6JW4iSOytOa36K5VEXCuep6AUQTIiEflZ4OPU4IXAOKkF3UAxJWoSFY/zT9w Kgb16I7tjDHohbc3tFikZ3z1Do3vLScxG7ll3CQOfTIr2KIxyN2/XOYkP1fsdvHr TyBAO4S/ERq1v3BKZJQ1+LskBvPhjtivWs3xU+TBxT9Fc8Op6GmvFyRgjmwMoRfQ orloUJuLbWWolnFvJMqyAK6pT5+QXZ3eH9ZguGmaLSHS8549Ts+LCirnBxI3HqZ4 sfD9jNRb3HiIG0gowXKU4lWTD4hiV+Se63NKfQYtj+qRfZ1wK+vd5A== =6FyB -----END PGP SIGNATURE-----

1 0

Re: Timing Cryptanalysis Attack
by ljo＠ausys.se 17 Dec '03

17 Dec '03

Armadillo Remailer (remailer(a)armadillo.com) wrote: >Simon Spero <ses(a)tipper.oit.unc.edu> writes: > >>My gut & scribble-on-the-back-of-a-napkin feeling about this class of >>attack is that it could be a problem for smartcards (almost certainly) > >Is it a problem to create smartcards that do their calculations in >fixed time? I'd guess it should be easier than on multi-purpose >hardware. > >Does the attack work for existing smartcards? At first glance, smart cards would seem to be the most critical target to Kocher's timing attack since they usually operate in on-line environments. However, all RSA smart cards I'm aware of stores the result of the RSA computation (be it decryption, signing or authentication) internally and it can only be read using a Get_Response command. Of course this may not be satisfying since the terminal could get a (noisy) measure of the time by repeatingly use this command to see when the result is available. Most smart cards does nevertheless require that the user must first specify a PIN code before the RSA algorithms are operationable. This implies that even if the card gets stolen can't it be attacked with Kocher's method. /Lars Johansson ljo(a)ausys.se

1 0

Kocher's RSA attack
by rschlafly＠attmail.com 17 Dec '03

17 Dec '03

I read Kocher's paper, but I question its applicability. One of his premises is that the time of a modular multiplication varies with the data. I've checked my code for modular multiplication, and the clock cycles to execute don't depend on the data at all. The same instructions get executed, and assuming the processor has a hardware multiply, they take the same time. When I timed the modular multiplication, I was able to detect some slight variation, but I attribute this to cache misses, as the variance with the same data was the same as the variance with different data. Apparently RSAREF has modular multiplies which vary significantly with the data, but I maintain this is not necessary. A good test case for his analysis might be to pull a secret key from a smart card. If, say, the Capstone chip modular multiplication has some timing anomalies, this might be a good way to defeat the Fortezza card. Roger Schlafly

3 2

Authenication and CIRC
by ljanke＠direct.ca 17 Dec '03

17 Dec '03

Does anyone know of versions of CIRC which support authenication? The version I pulled off csua does not even for the initial 3DES key exchange.

1 0

Re: Timing RSA and Certificates worth ??
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:50 PM 12/13/95 +1100, lyalc(a)mail.mpx.com.au (lyal collins) wrote: >I meant that on-line certificate issuing, notary and similar services where >data is submitted to a system for processing/RSA encryption are subject to >this for of attack. >Parts of the SEPP/STT protocols appear to require this of merchants and >customers. >I retract my comments about ecash/echeques - I'm not sure of the >implications there yet. >As for SEPP/STT - another nail in the coffin, me thinks. For large environments like this, it's possible to work around the attack by methods like queueing up all the signature jobs and doing them serially; this makes it difficult for the Bad Guy to know whether the server is taking time doing his multiplications or Alice's or N other customers', so he can't control timing very well by picking otherwise-informative numbers. On the other hand, your smartcard or PC is still at risk, since it's _not_ doing a lot of them, unless it's doing them just sort of at random when it's got nothing better to do and throws the real work in the middle. #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

1 0

Question about the Timing Attack
by James Black 17 Dec '03

17 Dec '03

Hello, I have looked over the paper, but I will look more closely this weekend (finals going on right now). The main question I have, since my programs run over a network with dumb terminals is this: If someone can get the timing information why would they need it, since they can read the message. So how can this attacker get the timing info without being able to read the message (unencrypted)? Thanx. ========================================================================== James Black (Comp Sci/Comp Eng sophomore) e-mail: black(a)eng.usf.edu http://www.eng.usf.edu/~black/index.html **************************************************************************

1 0

ADDRESS DATABASE?
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Something of privacy interest happened to me yesterday. I phoned a company to ask for a copy of their catalog. The phone clerk asked for my last name and zip code. After receiving that info, the clerk asked me, "Is this your full name and address?" and then gave them both correctly. I was taken aback. I have been at my new address for only a couple of months. Prior to that, I have been couch surfing for a year and a half. Though I called an 800 number, ANI had nothing to do with it since I was calling from work. It may have been from a database associated with a credit reporting agency, a bank or a utility company, but I am not aware of any of these being available on-line for something as mundane as requesting a consumer catalog. The clerk had no idea where the info came from (or so he said). Does anyone know how this trick was done? S a n d y P.S. If anyone is interested in helping to make an adult film, drop me a note. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

Re: Attacking Clipper with timing info?
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

> Without having the details of the algorithm, I suspect > the answer is 'remotely possible, at best'. > > However, to extend what I suspect you were getting at: > > It would be very interesting to determine if the NSA knew > about this crypto-design problem... > That was indeed what I was wondering. I expect we wont have to wait too long before we hear whether Clipper chips require the same or a different amount of time to encrypt/decrypt. Should be interesting. Jim_Miller(a)suite.com

2 1

Kocher's Paper
by Connie Sadler 17 Dec '03

17 Dec '03

Hi... Can someone tell me where I can get a copy of Kocher's paper? I haven't read it yet. Thanks! Connie

1 0

Re: Timing Cryptanalysis Attack
by hoz＠univel.telescan.com 17 Dec '03

17 Dec '03

At 03:42 PM 12/14/95 +0100, Lars Johansson wrote: >>Does the attack work for existing smartcards? >At first glance, smart cards would seem to be the most critical target >to Kocher's timing attack since they usually operate in on-line >environments. Not just on-line, they also operate in untrusted (hostile?) environments. >...the terminal could get a (noisy) measure of the time by > repeatingly use this command to see when the result is available. Might a terminal also be able to monitor power consumption or electromagnetic emissions to obtain a more precise time estimate? >Most smart cards does nevertheless require that the user must first >specify a PIN code before the RSA algorithms are operationable. If I used my RSA card every day, (at a toll booth, for instance), and the "bad guys" pilfered an "exact" timing upon each use, how long before they could forge a signature? >This implies that even if the card gets stolen can't it be attacked >with Kocher's method. That is useful, but if I know my card is stolen, I can presumably limit my liability by reporting it. If I still have my card, but my secret key is stolen, then damage might be greater. On another note, timing attacks would not seem to work against most DES implementations, hardware or software. The time to execute each round does not seem to depend on the plaintext or the key. It could be made to, of course, but unless I'm missing something, the "natural" way to code it, or to construct hardware for it, is not time dependent. Rick F. Hoselton (who doesn't claim to present opinions for others)

2 1