December 2003 - cypherpunks-legacy

Re: Lotus Notes
by Charlie_Kaufman/Iris.IRIS＠iris.com 17 Dec '03

17 Dec '03

I've been on the road since the RSA conference where the Notes crypto hack was announced. Sorry to have missed the fun. To answer at least some of the speculation on "how does it work", attached is a "Lotus Backgrounder" document that was distributed at the RSA conference. Some of the speculation in this group has had uncanny accuracy. I'd also like to defend the Notes R4 approach. I hate export controls more than most people, in part because I waste a lot of my time trying to figure out how best to deal with them. While I think Notes is doing the right thing given the current constraints, I can't help but be appalled by the current constraints. I don't believe 40-bit crypto is a joke. Even if it costs NSA $.25 to break a 40-bit RC4 key, and I'd speculate it costs them more than that, it means they can't afford to do keyword searches on every encrypted message they can afford to intercept (or at least they couldn't if everyone took the trouble to encrypt). And with a separate 40 bit key on each of your mail messages, an attacker may be able to break a few if he knows they are the good ones, but it's painful to browse. That said, I would not expect anyone to get much comfort from 40 bit crypto. The Notes R4 approach gives the best of two fairly unpleasant worlds. You can export crypto if you either limit yourself to 40 bits (which means anyone can see it if they want it badly enough) or give the government the keys (through escrow - which means the government and anyone else who can "break" the escrow mechanism can see your stuff with no work at all). Notes R4 gives the government part of the key, so they still have some work to do and other attackers have a lot of work to do. This is not a good solution. It's not even an acceptable solution. But it is a better solution than 40 bit crypto. And it's enough better that I think it was worth the hassle it took to get it. Notes R4 didn't give up anything to get this. It is expensive to have the technical complexity of two different interoperable versions of the product, and we could have said... gee, this is really good enough for everybody... why don't we just sell the "International Edition" everywhere? We didn't. The "North American Edition" (euphemistically named to reflect that it's also legal in Canada) still uses real strong crypto. The only valid criticism I've heard of the approach is by making the best of a bad situation, we've reduced the incentive for fundamental reform. That may be true, but once an approach is known (and we aren't the only ones to have thought of it - Adi Shamir's Partial Key Escrow proposal has similar properties), declining to use it does not fuel the pleas for legislative relief. In fact, it supports the argument that people don't even implement the strongest crypto they are allowed... why should they be allowed more? I think it is incumbent on all of us to do the best we can, for the brave to break the law and risk going to jail, for the wimpy to squeeze every last bit out of the allowed options, and for everyone to mouth off in risk-free forums like this one

1 0

Re: KOH "Helpful" Crypto Virus
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 13:20 1/30/96, Laszlo Vecsey wrote: >I'm looking for more information on the KOH Virus, a 'helpful' virus which >kindly asks to infect your system and encrypt all of your data. It spreads >to floppies (upon request) and to other systems, encrypting all files. [...] >Please point me towards the source/binary, or further information. You can get the binary, full source, and manual on disk for $32 plus $3 for S&H from American Eagle Publications POB 1507 Show Low, AZ 85901 (800) 719-4957 (520) 367-1621 While you are at it, you might also want to pick up their famous collection CD-ROM full of virus code, live viruses, virus creation engines, etc. From their catalog: "For starters, you get a fantastic virus collection consisting of 574 families [...] about 3700 carefully tested and cataloged viruses in all...$99 + $5 S&H. A must have :-) -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

Re: Lotus Notes
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 19:19 1/30/96, Rich Salz wrote: >>I find this very interesting. RSA prohibits its licencees from using RSA >>software with truly secure keylenghts. > >Hunh? I could find no mention of keylength or keysize in the RSAREF >documents I had around. I'm at home now, but I also recall no mention >of keysize or keylength in the license OSF has, either. So from who did Lotus license RC4? -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: The FV Problem = A Press Problem
by tcmay＠got.net 17 Dec '03

17 Dec '03

Jonathan has written a very nice essay, most of which I agree with fully. However, there is one item that I have a different angle on: At 12:41 AM 1/31/96, Jonathan Rochkind wrote: >It will undermine their credibility among cypherpunks for a long time, >certainly. Maybe even among the net--but among the vast majority of the >public? It's possible that as "among the net" grows to include >increasingly more of the 'the public', things will change. But at >present, I don't think things will have changed yet. The FV propaganda >will probably net good results for FV, although not among cypherpunks. .... >Most people aren't equipped with the knowledge to tell that this was a >'fluff' piece, not meriting a full page story. In fact, most people rely >on newspapers themselves to make these sorts of determinations for >them--what topics are seriously important and newsworthy, and what topics >aren't. Which is why companies can be so succesful when they can use press >releases to influences what shows up in the news. Generally, press >releases aren't seen by the majority of the public, so they don't realize >that a story is taken directly from a press release. Most papers use >press releases to write stories--maybe not the NYT, but most local papers. >And most people either don't realize it, or don't care. Here's my different angle on this: I'm not so sure there even _is_ a "public" on stories like this. Certainly my brother won't read about this, nor my sister, nor my parents, nor most of my neighbors. As with political stories that are read mostly by people interested in politics, I'm sure that most potential readers of the "First Virtual" story either skipped right past it or skimmed it lightly. No doubt the FUD of this story, and the FUD of earlier stories about Internet weaknesses, random number attacks, etc., left a vaguely feeling in these casual readers that all is not right with Internet commerce. But, having said this, I wouldn't underestimate the effects of a group such as ours lose respect for First Virtual, Nathaniel Borenstein, and Simson Garfinkel, to the extent we have. We'll be the sorts who keep the story going, who talk to other journalists, and who make decisions for our companies on what products and strategies to use. The "public" has probably already forgotten the story; we have not. --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Authentication of crypto clients
by Raph Levien 17 Dec '03

17 Dec '03

This post contains (somewhat) technical discussion of (what I believe is) an important issue in integrating crypto with applications that do not contain their own cryptographic implementation. If that doesn't interest you, hit 'n' to resume your regularly scheduled flamefest. The issue is: how does the crypto provider authenticate the client? For example, if the crypto provider can accpet connections from any application in the user's process space, then any bogus application can easily start decrypting and signing as it likes. In this model, a precondition for security is that no bogus programs can be allowed to run. An alternative, slightly more complex model is that the client must somehow authenticate itself to the crypto provider. One simple way of doing this is to require the client request a password from the user, which is then forwarded to the crypto provider. The crypto provider will only provide service on connections which have been authenticated in this way. This model gives security even in the face of some bogus applications. Of course, as Nathaniel quietly reminded us this morning, any bogus application which can intercept keystrokes can subvert any such client authentication. Barry Jaspan (in his analysis of a security flaw in SSH 1.2.0) reminds us that access to the image of the process is also sufficient to break security. Perhaps the class of bogus programs which have enough capabilities to connect to the crypto provider, but not enough to intercept keystrokes or examine RAM is null, meaning that the two models have equivalent security. Actually, the simpler model has some security advantages, because the client never has to deal with any very sensitive material, such as the password. I'm interested in this question right now because the current version of premail implements the simpler model (in fact, it simply stores all the secrets in a file in /tmp, with permissions set to 600). I want to know whether it's worth the trouble to design and implement an approach based on per-client authentication. This issue is also relevant to the discussion of Microsoft's CAPI, which (as far as I can tell) allows only the simpler model. I'm not saying it's bad, but I do feel that the implications should be discussed. Thus, I have forwarded a copy of this post to cryptapi(a)microsoft.com in case they have any comments. If there's been a discussion of this that I missed, then apologies for brining it up again and appreciation in advance for any pointers. Raph

4 3

Kill this message too (FV NOISE NOISE NOISE)
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

The size of my killfile has increased dramatically in the last couple of days. Can we start talking about something crypto related? --MegaBozo

1 0

No Subject
by Hroller Anonymous Remailer 17 Dec '03

17 Dec '03

Farce Virtual has discovered that some persons using the Internet are not using the names they were born with. We made this discovery in the wake of criticism of our discovery of keyboard sniffing programs, a major discovery we were able to get several reporters to write about. We consider our latest discovery to signal the imminent death of Usenet as we know it. We are taking the unusual step of announcing our discovery to the world, and in a simultaneous series of articles in major newspapers, to alert the world to our discovery. Farce Virtual provides the only reliable solution to this problem. We do not use in encryption, because many of our customers say it is too hard to understand. Instead, we rely on the oldest method in the book: fear, uncertainty, and doubt. We have invented a new term for this: FUD. ``Using the FUD Factor line of products, our customers are protected from those who are not using the names that God gave them,'' said Nathaniel Boringsternlight, Farce Virtual's chief publicist. Asked about women on the Net who are using their married names, Mr. Boringsternlight added, ``It was to deal with married women that I invented Safe-Tickle.'' No further explanation of this comment was offered. There's simply no other way to keep your sanity safe on the net. The program we have demonstrated completely undermines the sanity of all known users of the Internet. -------- Nathaniel Boringsternlight <nsb(a)fvh.fud> Chief Publicist, Farce Virtual Holdings FAQ & PGP key: nsb+faq(a)fvh.fud

1 0

Re: Lotus Notes
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 8:13 PM 1/30/96 -0500, Futplex wrote: >Bill Frantz writes: >> One other small advantage I can see to using Lotus's crippled encryption. >> It disguises the fact that a message is actually (double) encrypted with >> PGP. Attackers have to break the 40 bits before they see the PGP encrypted >> data. > >I don't understand. Are you saying that there's a special benefit to doing >superencryption (GAK encryption over non-GAK encryption) when the GAK layer >is Lotus Notes ? Tim May had it exactly right in his post entitled "Silver Linings and Monkey Wrenches" (thanks Tim). The only thing I can add is that forcing them to attack a 40 bit key is better than giving them the whole key thru some LEAF scheme ala Clipper. As long as you can cut and paste, PGP (at least the Mac version) is hard to lock out and minimally usable. Bill

2 1

Re: [NOISY] Your own Zundelsite in five minutes or less
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 23:07 1/30/96, Rich Graves wrote: [...] >> We won't have won until they restore the routes to Webcom. > >Here I have trouble with the word "we," and what we're trying to >accomplish. > >Censorship has clearly lost. Germany is simply not going to block >stanford.edu, cmu.edu, mit.edu, upenn.edu, aol.com, and so on, not to >mention AFS. But they succeeded in blocking Webcom. Until the block is removed, we haven't won. Do 'we' agree that the block should be removed? >I do not believe that the battle to get people to read and care about >Zundel himself is ours. Amen. I just wished that the people who's names mark some of the milestones in the fights for our rights (i.e, Miranda, as in Miranda Rights) were people whose causes I can support. Having seen concentration camps, I can not possibly sympathize with Mr. Zündel's views. But he still has a right to free speech. If he loses it, we lose it. It all comes down to this: First they came for the Communists, and I didn't speak up, because I wasn't a Communist. Then they came for the Jews, and I didn't speak up, because I wasn't a Jew. Then they came for the Catholics, and I didn't speak up, because I was a Protestant. Then they came for me, and by that time there was no one left to speak up for me. by Rev. Martin Niemoller, 1945. [...] >I do not want to allow the Nazis to associate themselves with "us." >Please see article <DM0Fsn.5GC(a)freenet.carleton.ca> for a little on what >they're trying to claim credit for. Note they are calling for mirror >sites nearly three days after they popped up, with no involvement on >their part whatsoever. I can imagine what they wrote. "The world is supporting our cause...." No, I do not support their cause. I despise their cause. And I still support their rights. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

3 2

Re: Java Sniffer (Was: Re: FV Announces That The Sky Is Falling)
by lyalc＠ozemail.com.au 17 Dec '03

17 Dec '03

>Much more likely, IMHO, than a Java sniffer is a Java Trojan horse that pops >up an innocuous dialog box and asks you to enter some sensitive piece of >information, then sends it off somewhere. About all it takes to write that is >a modicum of skill in user interface design. You could write it in any >programming language, but in Java it may be particularly effective, since >people may come to expect to be prompted for sensitive info over the net by >Java apps. Maybe the Java folks who just left Sun decided to seize the >opportunity ;> > >Futplex <futplex(a)pseudonym.com> > A very realistic scenario - any comments or reasons it can't happen ?? second question: How can you be sure you receive the applet that you "think" you've requested ? Any illuminating comments to assit my awareness of java ? lyal

2 1