December 2003 - cypherpunks-legacy

Re: Java and timing info - second attempt
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 22:31 12/18/95 -0800, Jeff Weinstein wrote: > In Netscape Navigator 2.0 Java and JavaScript do not have access >to crypto routines. At some point in the future this will probably >change, but only after we understand the implications much better >than we do today. More importantly for covert channel analysis, do they have access to good clocks? Access to a good clock could make a Java applet a good candidate for the receiver in a generalized covert channel attack. Access to both process time and real-world time can give a good indication of load on the processor, and might be needed for animation. A transmitter could send by using or not using the CPU. (Installing the transmitter is left as an excersize for the student. ;-) ) Who said that life was safe? ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

1 0

Re: King Kong Does e$
by Rich Salz 17 Dec '03

17 Dec '03

>Speaking of micropayments, Mark Manasse, Ron Rivest, Adi Shamir, and >Silvio Micali did another talk on Friday which touched on several cool >micropayment schemes, and a much more cost-effective way to do key >revocation. Though I got there exactly 6 minutes late, I missed one >presentation, and didn't take any notes for the rest. Hope someone else >here did. I saw lots of DCSB/Cypherpunks there... Any takers? A reference for Mark's paper on Millicent is <a href="http://www.w3.org/pub/Conferences/WWW4/Papers/246/">The Millicent Protocol for Inexpensive Electronic Commerce</a> Of all the various payment protocols I've seen, this was one of the few that studied the available protocol bandwidth before designing a protocol. Folks with an engineering slant should appreciate the work here. I would be VERY interested in URL's and summaries of Micali's talk. (I really wanted to go but after spending most of the week at the WWW4 conference I had to commit serious time to being anchored to the office.) /r$

1 0

Re: E-cash coin questions (Mark Twain / Digicash)
by Hal 17 Dec '03

17 Dec '03

From: "David Klur" <dklur(a)dttus.com> > > 1. How many different coins (serial numbers) can the current Mark > Twain/Digicash protocol support? I don't know this offhand, but I assume it is at least 2^64. > 2. Does Mark Twain bank maintain 2 lists: 1 of all the ecash serial > numbers for all coins ever produced, and 1 of all the ecash serial > numbers for all coins that have been spent before? Or just 1 list of > the spent coins (assuming that any coin that is signed w/MT's private > key and does not appear on the "spent" list is still valid and is not > counterfeit)? It is not possible for the bank to have a list of the serial numbers on coins produced, since it doesn't know this information. Each coin is created by a user's client software, which chooses the serial number at random. When it is sent to the bank to be signed, the serial number is blinded by being multiplied by a random number, which is divided off after the client gets it back from the bank. So the bank never sees a coin's serial number until it is deposited. > 3. The Digicash scheme allows each coin to be used only once and then > destroyed. How many coins will it take before all possible coins are > minted, used and destroyed thereby requiring banks to issue new coins > with "recycled" serial numbers? Remember, each time a "transaction" > takes place, an existing coin is destroyed and a new coin is minted. > and a transaction can simply be Alice giving her friend Bob a dollar > (not necessarily using the ecash for a purchase) It is easy to make this number so large that it will take longer than the age of the universe for this to happen. It just takes a dozen or so bytes per coin. > 4. What is the probability of guessing a valid serial number, > assuming there are 1 million, 1 billion or 1 trillion coins in > circulation? Assuming the serial numbers are of the sizes I suggest above, this chance is so close to zero that your chances of being named King of the Earth next year (along with the assumption that we switch to a World Government and it is a monarchy) are much greater. > 5. Suppose you have a very large number of ecash coins signed by the > same bank (say, Mark Twain) and you know the record layout of each > coin (easy enough since you can decrypt it with the bank's public > key), and for each coin the "bank name" field is the same (because > it's the same bank!) -- then, would it be possible to hack the RSA > encryption and recreate the bank's private key? I don't fully understand what you are getting at, but there are several false assumptions here. The "coin" has several parts, one of which is an RSA signed portion with a number in it, for which I am accepting your terminology of it being a "serial number". This terminology is not quite right, as the coins are not numbered serially (that is, sequentially, 1, 2, 3, etc.), rather the numbers are random. But it does capture the essential idea that each coin's number is unique. You do know the record layout of each coin, but that is because it is documented and because your client creates coins, not because you could decrypt it with the bank's public key. The coin does not have the bank name field within the RSA signed part. There is other information which goes along with the coin, including an identifier for the bank, outside the RSA signed portion. For the general question of whether inspection of a lot of RSA-signed coins would allow you to deduce the private key, the answer is no, as far as is known. Actually the attack you can mount is stronger than this; you can get the bank to RSA sign any number. You could ask it to sign "1", for example, and you will get "1" back (so that's not very useful). I have tried to think of a way of getting some useful information from getting it to sign "2", since that is such a simple number. But it is raised to a very large power, and as far as I can see what you will get back is just a random looking number, with all hints about the exponent gone. Again, as far as anyone knows, there is no way to break RSA using these kinds of attacks, at least not any more cheaply than factoring the modulus. Hal

1 0

(fwd) Junk email address collection (from a junk emailer)
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Personally, I think anyone who uses dejanews as a way to grep Usenet is an idiot, but since this idiot actually did spend several hours doing so, and then sent unsolicited commercial email to several thousand people, it's worth listening to him. Of course he's wrong about DejaNews having anything to do with Stanford. Anyone know anyone there? This guy is obviously afraid of me. It's a pretty funny story, actually. Too bad I can't tell it to anyone. - -rich - ---------- Forwarded message ---------- From: Name Witheld by Request To: Rich Graves <llurch(a)networking.stanford.edu> Subject: Important info for you Rich, There is one more point I would like to make to you. Since you have recently responded in a sincere way regarding everything I have asked you about, I would like to return the favor and suggest some things that might be of help to you and your cause. If you want to put a damper on some of the random unsolicited emailings to newsgroups members, I would like to tell you how. I have done extensive marketing research online, and I am very involved with Internet commerce and everthing that affects it. Just like you have your "circles" of associates, so do online business people. I have met a lot of business users online, and have learned the ins and outs of things related to Internet commerce and marketing. Anyway, in these "circles" of discussions, and seeing information and posts from some of these business people, I have learned many things that your group is most likely not exposed to. For example, there is a major resource where the majority of email names are stripped from, and I would like to reveal it to you, and give you the solution to putting an end to it. But only because I truly want to help, and show you that I am not your enemy. You may already know some of this. The "Deja News" Web service (at Stanford) is one of the major resources that some of these mailers use to get names. They attempt to do target marketing by doing searches for keywords related to their customers, or their own, advertising material that they wish to send. They simply do a search for several words like "resumes" if they have something to do with a resume service, etc. I'm sure you get the idea. After they do their search, they merely dump screen after screen of the search engine's findings and then strip the addresses using a FIND-CONTAINS "@" command in any database program. This is how they strip the names to create a mass email list. There is ONE way that could really screw over these mailers from using this resource. This is inside information that has been revealed to me (I have also seen references to it somewhere else). Don't ask who it was that was telling everyone about it, because I honestly couldn't tell you - I just know it is going around. Since you are there at Stanford, I am sure that you may be able to bring this information to someone working on this project so they can make some necessary changes. Here it is: When one of these mailers goes to do a search (and from what I hear, many of them do it on regular intervals to get new names) they cannot do a TERSE search. Why? Because it cuts off the email addresses if you notice the output. They cannot obtain addresses from this data. So what do they do? They do a VERBOSE search and this way the email addresses are completely listed. Make a change to this VERBOSE search option so that it will only list the partial email address, and you will eliminate THOUSANDS, if not millions of unwanted email messages on the Net. I guarantee if they made this change to the site it would make a HUGE difference. From what I hear, most newsreaders only list news post lists by "author" and not by email address, so these companies cannot easily strip names through regular newsgroup programs, and must use a service (like Deja News) to compile large email lists. Also, you and your buddies may want to look into a guy selling a software program called "Floodgate." Apparently this person is selling a program for about $300 that is designed to strip names from text files that are created from copying the output of other sources. Just thought I would donate some helpful information to make up for my offense. I don't mind if you should share this info with your contacts and if you tell them that it came from me, however, I would prefer if you would not post this information or statement publicly. I do not wish to get involved with a MAJOR uprising of business people that would murder me for revealing stuff like this. If I come across some other stuff which may be of interest to you, I will let you know. I think it is much better for us to work together instead of against one another. Let me know what you think, -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMNeZ3Y3DXUbM57SdAQE/5QP/cwqEiY7eX8fR/9JEPmSdhE63Ax+H+NCw Uac9VXlKKSH3e+JfI7c/+sWhYafLvWVFlz7Ikj1/uMilAmNJjJTUZfTHqdlYKN/+ kkmc+cCWfGAkl6PFcFqcvSdPKJvyVMsnUFufFBsl629Ot7Pb8yZJTXEq0vr8+BcG QOdMuhEZiXk= =Hq1v -----END PGP SIGNATURE-----

3 2

Re: Campaign Finance Reform
by tcmay＠got.net 17 Dec '03

17 Dec '03

Sorry that I haven't been following this "Campaign finance reform" thread, but I did stop to read what Brian Davis said, and his point actually raises an important game-theoretic issue which we haven't talked about in a while (maybe because everyone has so internalized it as part of their gestalt that they see no need to mention it...which I doubt). At 7:55 PM 12/18/95, Brian Davis wrote: >On Mon, 18 Dec 1995, jim bell wrote: >> All of which raises numerous opportunities for sting operations against >> politicians, done by individuals by procedures provided for under law. >> Escrow (Okay, I know that's a dirty word around here, but...) an encrypted >> statement of how you intend to run the sting, to be opened by the escrow >> agent at some point in the future, explaining who you're going after and >> how. Make the contribution, keep evidence, and if you're successfull the >> congressman goes to jail for a few years. > > >The problem with the private investigation is that law enforcement may >not believe you were an "innocent" citizen conducting an investigation. >Remember the ABSCAM Congressman who contended he was conducting his own >investigation ... The "game-theoretic issue" is that of the "brilliant penny scam," well-known to grifters and con artists and cryptographers (and all good cryptographers should be aware of cons and scams, as cryptography protocols bear close resemblances to confidence games, or at least must cope with them). I claim that I have a "magic penny," or "brilliant penny," which can predict which way the price of Netscape stock will move on the next day. I deposit a sealed prediction of what my brilliant penny told me would happen, with a reputable escrow agent. I invite investors to cast their lot with me. On each day, I retrieve the sealed prediction and, voila!, it is confirmed to be the truth. Obviously, what I have done is to record predictions covering both outcomes--Netscape going up and going down--but have conveniently only retrieved the one I know matches the actual outcome. (Sure, it's possible to think of some ways to get around this. Left as an exercise for the student.) The connection with Jim Bell's idea is obvious. Anyone planning a crime, say, buying drugs (not a crime in my book, but that's another story), cooks up a strategy to claim he was "investigating how easily drugs may be bought on the streets of Minneapolis." He seals a letter to himself detailing how his "expose" is to be run. If caught, he smugly says, "But I'm just doing a story on how drugs may be bought. You'll find my description of my plans sealed in an envelope with my lawyer." Not very convincing. (The reason this is a variant of the brilliant penny scam is that the costs of making the claim are low, and the ability to selectively reveal forces the outcomes to match. Not convincing.) >Escrowing what you intend to do could be seen as blackmail ammunition if >the Congressman fails to produce. > >Unfortunately for the Cryptoanarchists (tm -- in more ways than one), >absent law enforcement running the "sting" you are taking a risk of being >stung yourself. "Escrowing" where the access key is controlled by the party intending to do something illegal--blackmail, drugs, etc.--falls into the category I just described. Though I'm not a lawyer, I rather suspect courts have looked askance at such "covers of convenience" intended to be used as protection. By the way, dramatically better protection is gotten--so I understand--if a "legitimate" reporting assignment is involved. Thus, if a reporter is assigned by her editor to try to buy a dime bag on the corner of 8th and Artesia, and she somewhow gets caught, adequate proof can be produced to ensure no prosecution occurs (this obviously depends on a lot of factors). On the issue of bribing officials, there are of course all sorts of ways to do this. Outright bribes will always be handled more carefully than "mere" campaign contributions, which are only quasi-bribes. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

(Fwd) SECURITY ALERT: Password protection bug in Netscape 2.0b
by Peter Trei 17 Dec '03

17 Dec '03

Haven't had time to test this myself. Peter Trei ------- Forwarded Message Follows ------- Date: Mon, 18 Dec 95 17:18:28 From: <lstein(a)genome.wi.mit.edu> Subject: SECURITY ALERT: Password protection bug in Netscape 2.0b3 To: www-security(a)ns2.rutgers.edu, jcarroll(a)redman.canada.dg.com Cc: tara(a)linkage.cpmc.columbia.edu A potentially serious bug has just come to my attention concerning the handling of password-protected pages accessed via Netscape 2.0b3. Apparently when you type in the password to access a protected document Netscape stores the password in a local hidden file (in one of the .db files created in the .netscape directory on UNIX systems, and in the Netscape Preferences file on Macintoshes). This password is then used for accessing the document during subsequent accesses. The problem is that Netscape does not delete the stored password when the program quits. The problem has been reproduced on Unix and Macintosh platforms. I haven't tried the Windows implementation yet, but I suspect the same problem exists. This leads to the following behavior: 1) Open up Netscape and access a password-protected document. 2) Quit Netscape 3) Start Netscape again and try to retrieve the document. When the password-entry dialog comes up, click "Cancel". 4) Try to access the document a second time. Now Netscape lets you in without asking for the password! On Unix systems, this means that if you go over to a associate's machine to show him a protected document, Netscape will record your typed in password for posterity. Your associate now has full access to this page. The situation is particularly dangerous on PCs in a shared "computer lab" environment. Everybody who uses Netscape unwittingly makes his passwords available to all other users. Please let me know if anyone finds out more about this problem. I'm going to add it to the WWW security FAQ. Lincoln ======================================================================== Lincoln Stein, M.D.,Ph.D. lstein(a)genome.wi.mit.edu Director: Informatics Core MIT Genome Center (617) 252-1916 Whitehead Institute for Biomedical Research (617) 252-1902 FAX One Kendall Square Cambridge, MA 02139 =================http://www-genome.wi.mit.edu/~lstein====================

3 2

Update on Microsoft .PWL and SMB Spin Control
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I was thinking about copying this to Yves and Yusuf, but I figure it will get to them anyway. The WinNews #22 mass mailing (by the way, there seems to have been no #21) has this to say about the .PWL bug: NEW POSTINGS TO WINDOWS 95 WEB SITE AND FORUMS * Under "WINDOWS 95 SOFTWARE LIBRARY" * In "Windows 95 Updates" - "Enhanced Password Cache Security Update" - an enhanced security component that substantially strengthens the encryption used for the Microsoft Windows 95 password cache. The update comes with no ReadMe -- it's a self-contained installer only. No details on how it works appear to be available anywhere. There seems to be no way to ensure that you have received a patch without viruses or other modifications. I will not recommend or distribute this archive to anyone until these problems are fixed. I also just noticed how WinNews #19 was censored: Free Software "Updated Drivers for Windows 95 File and Printer Sharing" - has a single readme. The files are self-extracting executables located at: FreeSoftware|Windows 95 Updates The correct name for this page and patch is "Updated Drivers for Windows 95 File and Printer Sharing Security Issue." WinNews gave no indication what this patch did. A "WinNews Special Issue" with some details on the SMB bug (including incorrect information that has been quietly corrected, but not retracted on WinNews or elsewhere) was sent to at least some WinNews subscribers in late October. This "Special Issue" is not archived on Microsoft's Web site, however -- it's the only issue that isn't. One month, ten days after the Windows 95 Product Manager assured me that they would be made available "within two weeks," there are still no international versions of the SMB or C$ security patches available on Microsoft's Web site. All non-English copies of Win95 are still vulnerable. Most of the major PC magazines are going to carry something on the SMB and .PWL bugs next month. Windows Magazine's story is going to be unambiguously positive: In response to a posting on the Internet questioning the security of Windows 95's optional password caching feature, Microsoft immediately recommended that concerned users turn off password caching. Microsoft has now released a free update to Windows 95 that substantially increases security. - -rich -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMNeLII3DXUbM57SdAQErKQQA3WuAAnphzOt8zZQP/wwMoUL2qt9ZocDd 9ozHfKW8FBwnLktQXMGfCIXpNPFqWlM2NtPeci7pcN4DdcyR463aTeKSEEe60fJD tpnBJBztlGYSTOlMyxJiI+nFCBodkAG0NRA9GkHi6gAW9Rds3tZW9VTozvQq+2Ba 2F9BrVbwass= =co1m -----END PGP SIGNATURE-----

1 0

New additions (12/18) for Karn vs State Dept
by Phil Karn 17 Dec '03

17 Dec '03

I've just received, HTMLized and added two new documents to the web page concerning my case against the State Dept. They are: http://www.qualcomm.com/people/pkarn/export/karnsf.html (Joint Statement of Facts Not In Dispute, 12/18/95) and http://www.qualcomm.com/people/pkarn/export/repmem.html (Reply Memorandum In Further Support of Defendants' Motion to Dismiss, Or In the Alternative, For Summary Judgment 12/18/95) As before, the base URL for the case is http://www.qualcomm.com/people/pkarn/export I'd like to thank the government's attorneys at the Department of Justice for this time providing an electronic copy of their filing to my attorneys. This made it easier for me to bring it to you on the web. Last time I scanned in the government's documents on an OCR system, the same one I used to scan in the 3DES code in Applied Cryptography to demonstrate the process as part of my declaration. However, I still had to convert the text files from WordPerfect to ASCII and then HTMLize them by hand. If you find any formatting errors, please let me know so I can fix them. --Phil

1 0

Re: revised time quantization package (Unix & WIN32) available
by cpunk＠remail.ecafe.org 17 Dec '03

17 Dec '03

AT&T Spokesman Matt Blaze writes: blah blah >There are (basically) no restrictions on the use or distribution >of the (very simple) code. This is simply untrue. Read the fine print in the file. Use this code and you owe them big. They'll "reach out and touch" you big time. If they were serious, they'd gpl it. >Get it from: > ftp://research.att.com/dist/mab/quantize.shar > >The quantize package is also part of Jack Lacy's cryptolib package >(watch this space for details). I don't understand why this group continues to tolerate these blatently commercial messages from att (and netscape.) (The message is really just an ad for the cryptolib product, as it says). I've also said this b4 but I'll say it again: why would anyone in their right mind trust binary code from att after the clipper fiasco. And why do we tolerate Jeff Weinstein and Mat Blaze calling themselves cypherpunks, when they are so clearly just working us for their corporate interests? I wonder how much they get paid to monitor this list?

7 7

Re: revised time quantization package (Unix & WIN32) available
by jim＠SmallWorks.COM 17 Dec '03

17 Dec '03

>AT&T Spokesman Matt Blaze writes: >blah blah >>There are (basically) no restrictions on the use or distribution >>of the (very simple) code. > >This is simply untrue. Read the fine print in the file. Use this code >and you owe them big. They'll "reach out and touch" you big time. You're wrong. Direct from the shar file: X/* X * Simple Unix time quantization package X * {mab,lacy}(a)research.att.com X * v1.0 - 12/95 X * X * WIN32 port v0.1 fod(a)brd.ie 12/95 X * X * TESTED ONLY UNDER SUNOS 4.x and BSDI 2.0. X * X * WIN32 port TESTED ONLY UNDER WINDOWS '95 X * (further testing recommended) X * Requires Winmm.lib X * X * This is unsupported software. Use at own risk. X * Test carefully on new platforms. X */ X/* X * The authors of this software are Matt Blaze and Jack Lacy X * Copyright (c) 1995 by AT&T Bell Laboratories. X * X * WIN32 port by Frank O'Dwyer X * Copyright (c) 1995 by Rainbow Diamond Limited X * X * Permission to use, copy, and modify this software without fee is X * hereby granted, provided that this entire notice is included in all X * copies of any software which is or includes a copy or modification X * of this software and in all copies of the supporting documentation X * for such software. X * X * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR X * IMPLIED WARRANTY. IN PARTICULAR, NEITHER THE AUTHORS NOR AT&T X * NOR RAINBOW DIAMOND LIMITED MAKE ANY REPRESENTATION OR WARRANTY X * OF ANY KIND CONCERNING THE MERCHANTABILITY OF THIS SOFTWARE OR X * ITS FITNESS FOR ANY PARTICULAR PURPOSE. X */ Nothing, but nothing in there restricts you from doing anything you like with the software, as long as you provide attributation. >If they were serious, they'd gpl it. Maybe they don't like the terms of the gpl? Maybe they don't want to restrict *you* to having to give it away? (And before you jump my ass for being anti-gnu, go check the various GNU sources for work I've submitted in the past.) >I don't understand why this group continues to tolerate these blatently >commercial messages from att (and netscape.) (The message is >really just an ad for the cryptolib product, as it says). I've also said >this b4 but I'll say it again: why would anyone in their right mind trust >binary code from att after the clipper fiasco. Is this where we point out that it was Young Master Blaze who pointed out the technical failure in Clipper? >And why do we tolerate Jeff Weinstein and Mat Blaze calling themselves >cypherpunks, when they are so clearly just working us for their >corporate interests? I wonder how much they get paid to monitor this >list? "Cypherpunks write code." (Where is yours?) Jim

1 0