December 2003 - cypherpunks-legacy

Lotus Notes
by JMKELSEY＠delphi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >Date: Thu, 18 Jan 1996 20:54:33 -0500 >From: daw(a)beijing.CS.Berkeley.EDU (David A Wagner) >Subject: Re: Hack Lotus? >Hack Lotus? Please do. Perhaps in this case, c2.org could have a "patch Lotus" contest, instead. Help us patch this dumb security hole, by which we're leaking 24 bits of each session key. >I would love to see the internals of how Lotus Notes does the escrow. >Every conceivable way I can see to do it seems very vulnerable to attack. > >If the receiving Lotus Notes program doesn't check whether the high 24 >bits have been escrowed correctly in the LEEF-like field, then a simple >hack to the sending Lotus Notes program to not send the LEEF field >should give foreigners true 64 bit encryption. I think this is the case. The guy who spoke at the RSA conference made reference to the fact that this new version would interoperate with full-strength domestic versions. Getting domestic versions to check for LEAFs only from foreign users is possible, but it would seem to require that Lotus was working on this idea several versions back. Otherwise, when an old domestic version gets a message from a new foreign version, it's going to accept the message without a LEAF. Depending on how Lotus Notes does their key exchange protocol, it may be possible to graft this kind of checking on, so that the older programs will work with it, too, but this doesn't seem likely at all. >If the receiving Lotus Notes program does verify that the high 24 bits >are escrowed correctly, then anyone can verify that, so in 2^24 trials, >I can recover the high 24 bits, and with 2^40 more trials, I can recover >the high 40 bits. Therefore 2^40 + 2^24 trials should suffice to hack >Lotus if this is how it works. This problem is solvable, though I doubt they've bothered. Two ways come to mind--both using information that third parties won't have to fix the problem. 1. Put another 64 bits of random salt into the RSA key exchange blob. Use this to pad the LEAF, so that it's not feasible to dictionary search the LEAF. 2. Define the LEAF as part of the RSA key exchange blob. Pad the LEAF with random bits, unknown to the receiver. Sign the whole key exchange blob. Note that #2 can be countered by hacking the software's copy of the public key. I don't see a way of countering #1 on the sender side only. (Once you get the sender and receiver working together, key escrow seems to become really hard to do.) Now, I'm very interested in whether they thought about this as a potential problem, and thus padded their LEAF intelligently, or left themselves vulnerable to a dictionary-style attack on the LEAF. This translates, roughly, to "was someone with a basic understanding of cryptography involved in this design?" Clearly, IBM has some really good people, and I suspect Lotus did/does, as well. But were they involved enough in the implementation to ensure that this was done intelligently? - From what I heard at the conference, though, I don't think they're even checking to ensure compliance. This implies that the security patch can be pretty simple--clobber the LEAF field with a bunch of random-looking bits. Of course, this tells us nothing about the other possible weaknesses. How well does Notes generate key material? How big are the RSA keys? How well do things like the key exchange protocols work? It looks to me like there are a lot of programs with encryption out there that are lucky to manage even 40 bits of actual security, even if they're allowed 64- or 128-bit keys. >Waiting to hear the technical details of how it works, >- -- Dave Wagner Note: Please respond via e-mail as well as or instead of posting, as I get CP-LITE instead of the whole list. --John Kelsey, jmkelsey(a)delphi.com / kelsey(a)counterpane.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQUVGkHx57Ag8goBAQHaRwP/er3/94io/Aa5MQyyluVqohHGyLcP5JBr ZGZMoMydeGnWp5HJ5oGO4WuWDmmqk1NNiHNFd3z8Yxt9S73LR7PvGtoyoucMkX69 f9p4DMED+bJoMWtfukxhtWufeTKDE136eUi/V8155869nAZSHngIF3WLaQCBWFqe 01WEP/GbZtg= =IDZU -----END PGP SIGNATURE-----

1 0

Re: Crippled Notes export encryption
by iagoldbe＠calum.csclub.uwaterloo.ca 17 Dec '03

17 Dec '03

In article <9601242357.AA02688@alpha>, Mike McNally <m5(a)dev.tivoli.com> wrote: >This sounds fishy to me. I don't recall reading anything to suggest >that export of cryptographic software (or any other munition) requires >that the stuff be *used* outside the US for an offense to be >committed; why should export of a cryptographer's wetware be any >different? Either the expertise leaves the country or it doesn't, I'd >think. Here's section 120.17 of ITAR: @ 120.17 -- Export. Export means: (1) Sending or taking a defense article out of the United States in any manner, except by mere travel outside of the United States by a person whose personal knowledge includes technical data; or (2) Transferring registration, control or ownership to a foreign person of any aircraft, vessel, or satellite covered by the U.S. Munitions List, whether in the United States or abroad; or (3) Disclosing (including oral or visual disclosure) or transferring in the United States any defense article to an embassy, any agency or subdivision of a foreign government (e.g., diplomatic missions); or (4) Disclosing (including oral or visual disclosure) or transferring technical data to a foreign person, whether in the United States or abroad; or (5) Performing a defense service on behalf of, or for the benefit of, a foreign person, whether in the United States or abroad. (6) A launch vehicle or payload shall not, by reason of the launching of such vehicle, be considered an export for purposes of this subchapter. However, for certain limited purposes (see @ 126.1 of this subchapter), the controls of this subchapter may apply to any sale, transfer or proposal to sell or transfer defense articles or defense services. Item (1) allows people to travel abroad if they know crypto. It's unclear that it allows them to emigrate or return to their country of origin. Items (3),(4),(5) seem to prevent such a person from using, or even mentioning, crypto to or "on behalf of" a foreign person. (6) is cute. Launching a missle at Iraq isn't considered export... - Ian

1 0

Re: Ultimate Paranoia
by Dagmar the Surreal 17 Dec '03

17 Dec '03

At 05:35 PM 1/22/96 -0500, you wrote: >For the ultimately paranoid: > Don't forget to keep all sensitive info on your standalone >machine on an encrypted filesystem. You never know who might show up >with guns and a search warrant. But this is truly paranoid. And _what_, may I ask exactly, is worng with this sort of security? ----- "In the vacuum of cyberspace, no one can hear the pedestrians scream." -- Dagmar the Surreal (as sold on TV!)

1 0

Crypto Exports, Europe, and Conspiracy Theories
by John Young 17 Dec '03

17 Dec '03

Responding to msg by tcmay(a)got.net (Timothy C. May) on Wed, 24 Jan 4:59 PM A welcome inquiry, Tim. Is it not likely that the best crypto in many of the countries is kept off the market in the national interest, cloaked in the greatest secrecy like other crucial weapons of survival? Especially to defend it from NSA-like predators. Was this not the practice in the US before public key genie escaped? And is surely still the case for the very best US crypto -- not that which can be readily purchased or purloined. The market, and PGP, are probably condoned as a cloak for the best, in the US and elsewhere. Or bait. Or traps.

1 0

Re: SS Obergruppenfuhrer Zimmermann (NOT!)
by jim bell 17 Dec '03

17 Dec '03

At 04:21 PM 1/23/96 -0800, Simon Spero wrote: >On Tue, 23 Jan 1996, Perry E. Metzger wrote: > >> Alan Horowitz writes: >>>[...] >> Okay. I think I understand. You're a fruitcake. Easy enough. > >The official pastry of the 1996 Cypherpunks. > >One might note that Zimmerman isn't, er, a common name for yer typical >Neo-Nazi... This sort of accusation is sufficient grounds for libel in >the UK (such accusations have been found to be defamatory, and would >almost certainly be settled within a few days. > >Of course Phil (Hallam Baker) has more experience with this sort of >thing... >Simon Maybe this is common knowledge, but the name "Zimmermann" and crypto had another relationship, in World War I. If anybody knows more about this incident than my vague recollection of the famous "Zimmermann cipher" would you care to tell the story?

5 6

"PRZ a nazi" to be retracted
by Philip Zimmermann 17 Dec '03

17 Dec '03

The Sunday Telegraph of London printed a story last Sunday about neo-nazis using PGP to encrypt their communications. The story said that PGP was devised by an American neo-nazi sympathizer. As the creator of PGP, and a human rights activist, I was outraged by such a defamation from a major newspaper. I called my lawyer Phil Dubois, who seemed to look forward to having some fun with this newspaper. Not wanting to wait around till the morning, and slow lawyers, I called Robin Gedye, the reporter in Bonn who wrote the story, at 7am Monday morning Bonn time, and woke him up at home. I introduced myself and told him how I felt about it. He had never heard of me, the Clipper chip, the controversies of cryptography, and knew nothing about PGP outside of the couple of sentences in his story that mentioned PGP. He said it wasn't really so bad, because he didn't specifically identify me by name. One can imagine the effectiveness of that excuse with me. I then went into some detail with him to bring him up to speed. I also called his editor in London, who also had never heard of me or PGP. After some checking, they discovered that the Daily Telegraph, a related newspaper, had run an article about my case just a week before. They also found about 20 recent articles on me in the UK press. The editor said that my story "checks out". It was good to know that they now believed that I was not a neo-nazi after all. Anyway, Mr. Gedye says that the Sunday Telegraph will print a retraction next Sunday. Not just a little retraction, but a whole article on the subject, written by Mr. Gedye himself. I'm glad to see that this probably means that he will dig into the subject more, in order to write such an article. I guess this means maybe I'll find some other things to occupy Phil Dubois's time. -Philip Zimmermann 23 Jan 96

1 0

NSA advanced knowledge
by Rich Salz 17 Dec '03

17 Dec '03

Is there any indication that the NSA knew about public-key before it entered the open literature?

2 1

Re: Signing nyms' keys (Was: Report on Portland Cpunks...)
by Alan Olsen 17 Dec '03

17 Dec '03

At 05:12 PM 1/24/96 -0800, Bruce Baugh wrote: >At 01:42 PM 1/24/96 PST, janzen(a)idacom.hp.com wrote: > >>Furthermore, by signing a nym's key you place yourself at risk. If you >>sign the nym's key with your own key -- or sign using the key of your >>own nym, and that nym is subsequently "outed" -- then anyone wishing to >>find the individual(s) behind any nym whose key you've signed can >>attempt to coerce you into revealing this information, since you have >>claimed to know it. > >This is the real problem, one which doesn't (to me) have a ready solution. >If others can demonstrate that there [is|is not] some fairly straightforward >way around it, I'd be happy to read it. This is a problem with the web of trust in general. It is known as "Guilt by Association". Person X commits treasonable act A. All of the persons who are signed on to his key could be considered to be co-conspirators. The same applies to nyms. The difficulty with prosecuting nyms is finding the link to the real world individual. Anyone associated with him/her/it will be considered to be guilty by reason of key signage or a way of determining who the real person is... The only way I see getting around this is only signing nyms with nyms or having some sort of zero knowlege proof on a key signing authority. Something where you can issue some sort of proof to the signing authority that you are who you say you are without giving any information about your "real" identity. I know of no foolproof way of doing this... I guess we are stuck with the "Web of Guilt"... Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Is the operating system half NT or half full?"

1 0

another thought about random numbers
by Erik E. Fair 17 Dec '03

17 Dec '03

While musing over a roulette table, and noticing the preponderence of electronic games in the various Casinos in Stateline, NV, a thought occurred: does anyone know what sorts of random number generators those electronic games use, and how (if at all) they are measured and regulated by the Nevada Gaming Commission? They might have something to teach us. Erik Fair

3 2

Re: Crippled Notes export encryption
by Rich Salz 17 Dec '03

17 Dec '03

>If you properly apply for a license to export the source code >(explainig that the source code licensee might add the features >that he feels are appropriate), is it still a conspiracy? No it's not a conspiracy. But they will not normally allow you to export such source. /r$

1 0