December 2003 - cypherpunks-legacy

Re: Timing Cryptanalysis Attack
by Peter Trei 17 Dec '03

17 Dec '03

> > People employing systems like PGP are already advised to use them > > on private machines, with only one user, and untampered-with > > binaries. > > Timings like the ones listed are trivial to take in establishing > things like SSL sessions, or Photuris sessions. The danger is to > online protocols, not to PGP. > Perry Loathe as I am to disagree with Perry :-), is it really 'trivial' to take these timings in an online protocol? Paul writes on the DH example: ------------------------- A preliminary implementation of the attack using the RSAREF toolkit[8] has been written. RSAREF scans across the exponent from MSB to LSB and does two exponent bits at a time, so corresponding adjustments to the attack were made. Using a 120-MHz PentiumTM computer running MSDOSTM, a 512-bit modulus, and a 256-bit secret exponent, processing times ranged from 392411 microseconds to 393612 microseconds and closely approximated a normal distribution with a mean of 393017 microseconds and a standard deviation of 188 microseconds. -------------------------- Note that the range is 1201 microseconds and for RSA: -------------------------- RSAREF's modular reduction function with a 512-bit modulus on the same 120-MHz PentiumTM computer takes an average of approximately 17 microseconds less time if c is slightly smaller than p, as opposed to slightly larger than p. Timing measurements of many ciphertexts can be combined to detect whether the chosen ciphertexts are larger or smaller than p. ------------------------- The range here is 17 microseconds. Paul notes: --------------------------- Random delays added to the processing time may increase the number of ciphertexts required, but do not completely solve the problem since attackers can compensate for the delay by collecting more measurements. (If enough random noise is added, the attack can become infeasible.) -------------------------- In a 'real' system, there is a lot of unpredictable variation in the timing of the signal. Sources of such noise include routers, and other sessions on the server (any decent server these days is multi-tasking, and can handle multiple connections simultaneously). On top of that, real protocols have a lot of processing overhead, looking up certificates and keys, generating MAC hash values, etc, many of which are difficult to predict. I tried pinging some machines to look at the slop in the roundtrip times. I have not checked traceroute, but for what it's worth, I'm in central Massachusetts. elnath (local to my lan) <10 ms rtfm.mit.edu (20 miles) 10-21 ms iii1.iii.net (FreeBSD on a 120MHz P5, 35 miles) 100-200 ms utopia.hacktic.nl (Netherlands) 190-781 ms Maybe Paul can give us some figures as to how *much* random noise is enough to make his (very elegant!) attack unfeasible. Note that the range of the random slop I'm getting is hundreds to thousands of times the range of the signal he needs to detect. Statistical techniques, averaging the return times for the same text over many trials may be useful, but the number required to detect a less than 1% variation is going to be high. The attack might be feasible of it can be mounted on a quiet server from a point 'close' (in network terms) to the timing system, and the intervening network segments are also fairly quiet. I don't think random users are going to crack the Dilbert Store, however. Speaking for myself.... Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

1 0

Re: Timing Attacks
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:15 PM 12/11/95 -0500, "Rev. Ben" <samman-ben(a)CS.YALE.EDU> wrote: >I'm not so sure I see the great usefulness of this attack. > >I've taken a cursory glance at Mr. Kocher's paper on-line and what it >comes down to essentially, if I undestand it correctly, is that you need >to be as sure of the timing as you can be. > >Now, on a distributed system, you can't measure those timings, because >any latency could come from the originating computer, the links in the >middle or any combination of them. ... >Am I missing something, or does this attack only work in a lab? It works much better in relatively controlled environments - smart cards, for example, are usually both slow and not busy doing other things, plus you can get a bunch of them and analyze the variance in performance across cards. The Usual Suspects say this does appear to affect Fortezza, plus things like digital wallets are obvious targets. If you're clever, you can design smart-card readers that do the measurements for you, and convince people to use them. The attack also works better if you can try it multiple times with the same numbers to work around random latency; the lowest number is closest to real. Running on time-shared machines increases randomness a lot (though if the Bad Guys have an account there, they can watch the machine's performance more closely.) On the other hand, running on shared machines has its own set of security risks, though they're better places for Diffie-Hellman systems than secret keys - but Diffie-Hellman needs authentication to be safe against MITM, and therefore there's still a secret key for that. Interesting times.... We've all been discussing whether there'd be some major theoretical-mathematics breakthrough, and along comes an engineering attack. #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

2 1

Voluntary Key Escrow is Freedom, Surveillance is Privacy
by tcmay＠got.net 17 Dec '03

17 Dec '03

Citizen-unit jim bell wrote: >Pardon me, but since this "key escrow" system was always claimed to be >"voluntary," then how can there be any kind of legal penalties associated >with "failure to release" those keys? > > >Which raises another question: Let's suppose I owned a product based on >CKE, and I went to the escrow agent and said, "This escrow is voluntary, >right? If so, erase my key in your possession." > >Not that I'd trust them to do so, but how "voluntary" can a system be if >people can't volunteer out of it? In much the same sense the income tax system is "voluntary." For further details, consult the definition of "newspeak" in Orwell's novel. Remember, saying that Voluntary Key Escrow is neither "voluntary" nor "escrow" is thoughtcrime. Freedom is Slavery, Surveillance is Privacy, Censorship is Decency --Citizen-Unit May227-80-5992 Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

ViaCrypt supports CKE in PGP
by Robichaux, Paul E 17 Dec '03

17 Dec '03

In today's mailbox I got a pack of marketing slicks from ViaCrypt. They're about to release ViaCrypt PGP 4.0 in two editions: Personal and Business. The 4.0 release adds some nice new features: - recipient groups for sending to several addresses at once - a Search dialog for finding keys - encryption-only & decryption-only keys - signature-only keys - key expiration dates - a Windows DLL that third-party developers can use (!!) The biggie, though, are these: "Encryption automatically includes Corporate Access Key as additional recipient (option)" and "Key selection/display dialogs show only keys certified by Corporate Access Key (option)" So, real CKE will soon be available from an unexpected source. I'm not sure whether to be excited or dismayed. On the one hand, any movement towards CKE seems dangerously close to the slippery slope of GAK. On the other hand, I know a large corp like Intergraph is much more likely to license PGP for internal use if it has CKE features-- especially since they can hold the keys internally. The DLL is an awfully nice feature, too. -Paul -- Paul Robichaux, KD4JZG | perobich(a)ingr.com Intergraph Corporation | http://www.intergraph.com Be a cryptography user. | Not speaking for Intergraph Co-author, "Building Internet Appls With Visual C++", Que Books (0-7897-0213-4)

1 0

Re: NIST GAK meeting writeup, LONG part 3 of 3
by Andrew Loewenstern 17 Dec '03

17 Dec '03

Pat Farrell writes in his report on thi NIST GAK meeting: >>Geoff said that they may want legislation support for >>protecting against illegal release of keys, failure to release, etc. Jim Bell Responds: > Pardon me, but since this "key escrow" system was always claimed > to be "voluntary," then how can there be any kind of legal penalties > associated with "failure to release" those keys? well, since the subject at hand is Escrow Agent Criteria, "Geoff" is probably talking about the failure of an escrow agent to release a key upon production of "lawful authorization" .... andrew

1 0

Re: NIST GAK meeting writeup, LONG part 3 of 3
by jim bell 17 Dec '03

17 Dec '03

At 11:04 AM 12/10/95 -0800, you wrote: > >NIST Key Export meeting, December 5, 1995 Long version >Part 3 of 3. > >This covers the notes on agent criteria, and the >industry presentations. > [stuff deleted] > >Geoff said that they may want legislation support for >protecting against illegal release of keys, failure to release, etc. Pardon me, but since this "key escrow" system was always claimed to be "voluntary," then how can there be any kind of legal penalties associated with "failure to release" those keys? Which raises another question: Let's suppose I owned a product based on CKE, and I went to the escrow agent and said, "This escrow is voluntary, right? If so, erase my key in your possession." Not that I'd trust them to do so, but how "voluntary" can a system be if people can't volunteer out of it?

1 0

Re: Timing Attacks
by eli+＠GS160.SP.CS.CMU.EDU 17 Dec '03

17 Dec '03

samman-ben(a)CS.YALE.EDU writes: >I'm not so sure I see the great usefulness of this attack. It appears to be more practical than 99 percent of the "weaknesses" that get published. Not bad, I'd say. It's also a very cute attack; I'd never have guessed a priori that you could get that many key bits from timing data. >work in a lab, with the current advances in computing speed, the >differences between a fast and a slow calculation can easily be opaqued >by network lag. "Random delays added to the processing time may increase the number of ciphertexts required, but do not completely solve the problem since attackers can compensate for the delay by collecting more measurements. (If enough random noise is added, the attack can become infeasible.)" [extended abstract, p. 5] Sufficient network noise *might* make the problem go away, in some cases, but that's a weak sort of claim to make about a cryptosystem. (What if the attacker tries at six in the morning, or cracks a machine local to you, or just gets lucky?) You might put your server behind a time-quantizing firewall... Also, it's not just networked machines. Smart cards may have a hard time defending themselves against hostile card readers. They're slow already; the user may not appreciate the extra time spent for obfuscation. (This depends critically on the numbers, of course.) -- Eli Brandt eli+(a)cs.cmu.edu

2 1

The origin of some heavy legal terms
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:10 PM 12/11/95, Black Unicorn wrote: >The term 'pressing a defendant for a plea' came from the practice of >piling heavy weights on a defendant and 'pressing' him into the very >floor of the court. (As defendants who did not admit a plea would save >their family from being held accountable to judgment, the incentive to >remain silent was high). Often weight was piled atop the hapless >defendant until he or she expired, having refused to enter a plea. Modern courts have replaced the rocks used in earlier days with law books, of course. The need for heavy law books to press the accused is one of the main reasons electronic versions are not being adopted. This practice also gave us the term "the full weight of the law" as well as the symbol of the law as being a blind woman carrying a scale filled with rocks to place upon the guilty to convince them to confess. (This was originally done in the court's torture chamber, from which we get the term "judge's chamber.") Sometimes the "scales of justice" can be "tipped," which derives from the practice of tipping the judge to get favorable rulings. --Tim "Not a Lawyer" May

1 0

Re: [NOISE] GAK and self-incrimination?
by Ed Carp (ecarp＠netcom.com) 17 Dec '03

17 Dec '03

> Date: Mon, 11 Dec 1995 09:01:40 -0500 > To: Bill Stewart <stewarts(a)ix.netcom.com> > Subject: Re: [NOISE] GAK and self-incrimination? > From: tallpaul(a)pipeline.com (tallpaul) > Cc: cypherpunks(a)toad.com > If I'm not guilty why do I want strong crypto? Sometimes for the same > reason I want a shredder. And why do I want a shredder? Sometimes just to > keep the local gossip from going through my papers after I throw them out. Another, not-so-obvious reason to encrypt stuff, especially stuff that goes out over the net, is that folks can suck your email off the net and gather all sorts of useful information. This has all kinds of annoying implications, especially for people who gather demographics and other data for constructing email lists for sale. -- short ed

1 0

Third generation privacy
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Dec 11, 1995 13:07:22, '"Ed Carp (ecarp(a)netcom.com)" <khijol!netcom.com!ecarp>' wrote: > >Another, not-so-obvious reason to encrypt stuff, especially stuff >that goes out over the net, is that folks can suck your email off the >net and gather all sorts of useful information. This has all kinds >of annoying implications, especially for people who gather >demographics and other data for constructing email lists for sale. > >-- short ed > Another related issue is what I'll call "third generation" privacy. This exists when I want privacy not for myself or even the person with whom I'm communicating but to protect the privacy of innocent third parties. E.g.: Grandpa is getting senile and I'm communicating with a second family member on how we should handle the problem; My friend Jane was just raped and I'm communicating with a mutual friend about how we can help her. The anti-freedom forces have tried to define the parameters of the debate inside the boundaries of the "four horsemen." We need to understand that we do not have to remain within those false boundaries and, in fact, it is very good not to. --tallpaul

1 0