December 2003 - cypherpunks-legacy

Re: Timing Cryptanalysis Attack
by ljo＠ausys.se 17 Dec '03

17 Dec '03

Armadillo Remailer (remailer(a)armadillo.com) wrote: >Simon Spero <ses(a)tipper.oit.unc.edu> writes: > >>My gut & scribble-on-the-back-of-a-napkin feeling about this class of >>attack is that it could be a problem for smartcards (almost certainly) > >Is it a problem to create smartcards that do their calculations in >fixed time? I'd guess it should be easier than on multi-purpose >hardware. > >Does the attack work for existing smartcards? At first glance, smart cards would seem to be the most critical target to Kocher's timing attack since they usually operate in on-line environments. However, all RSA smart cards I'm aware of stores the result of the RSA computation (be it decryption, signing or authentication) internally and it can only be read using a Get_Response command. Of course this may not be satisfying since the terminal could get a (noisy) measure of the time by repeatingly use this command to see when the result is available. Most smart cards does nevertheless require that the user must first specify a PIN code before the RSA algorithms are operationable. This implies that even if the card gets stolen can't it be attacked with Kocher's method. /Lars Johansson ljo(a)ausys.se

1 0

Re: And the standard continues to lower...
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >If the misuse of "One Time Pad" wasn't enough for ya, check out this ad that >I was e-mailed. > >And the chair of a CS department, no less. > >- ------- start of forwarded message (RFC 934 encapsulation) ------- >Subject: Secure No-overhead Online Order System for Publishers >Date: Wed, 13 Dec 1995 12:24:03 -0800 (PST) > >A secure no-overhead online title-ordering system is now available. It may >be viewed in operation at the home page for Blue Water Publishing, a >publisher, software developer and distribution company, at >http://www.bluewaterp.com/~bcrissey/ >or from the online bookstore area of ISCNI, the Institute for the Study of >Contact with Non-Human Intelligence at >http://www.iscni.com > >Blue Water's innovative online ordering system is called SimplySafe. It is >a needle-in-the-haystack approach to online security. It requires no >encryption or secure servers, yet the probability that a dedicated hacker >scanning 100 internet messages a second will intercept a usable credit >card number sent via SimplySafe is less than the probability of picking >our Sun out of the Milky Way. That is less than 1 in 200 billion. Safe >enough for most folks. There are easier ways for a hacker to pick up >credit card numbers than to waste time with SimplySafe transactions. Try >it out! > >SimplySafe currently supports secure online orders from Blue Water >Publishing, Wild Flower Press, Swan-Raven & Co., and ISCNI. >Direct inquiries to >SimpleSafe(a)aol.com > >***Dr. Brian L. Crissey, Chair CS Dpt, Linfield Col., McMinnville, OR 97128 >(503)-434-2426 brianc(a)linfield.edu >Professionals built the Titanic, amateurs built the Ark... The scheme is to send 4 digits of the credit card at a time. The "explanation" follows. >In order to proceed with your SimplySafe® encryption of your credit card >number, please enter the SECOND set of (4) digits of your credit card number: > >In the 41 seconds since you sent your first packet of four digits, >approximately 2869959 packets of information have passed across the internet. >Assuming that a hacker can scan 100 packets of information per second for >credit card information, there is 1 chance in 699 that he has scanned your >first packet of digits. >He is unlikely to have found anything useful. Sigh. Wilhelm Busch -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMM9w94iUi5SQtQ3tAQENnAf6A2SdN+AZGryzJ/eCE/fj+YO71ngQXk8A 2tAomwUqAPmrCll+ucnDc/knsct2VYo4I9b+j84Ah+Gzz6rAu3LKY+joBrgDBmBY j79BOxik6tz9GCdBYDxTQ1BJpwbDAxaQHpNJYgEFryB59yxo4gi9xZbKZnnQv571 uQfuk1rAJbI+ESJK1Wlw8YrT+q8PoW8m5Y1qjBhxczRNaYAENsrVqHsz8L8bEBkW WEfi6wIQpRkB6Fo9hH2HAVamvUwJvDtPgll6U1zBgh/zEs1Jyot3XLV5UHrdL7oM 6FRPD1LW/cWGjUv2YNyv6a3vDFz9LdcCk9eX+gekODzaE+fgeQWI3g== =2n1S -----END PGP SIGNATURE-----

2 1

Authenication and CIRC
by ljanke＠direct.ca 17 Dec '03

17 Dec '03

Does anyone know of versions of CIRC which support authenication? The version I pulled off csua does not even for the initial 3DES key exchange.

1 0

Re: Timing RSA and Certificates worth ??
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:50 PM 12/13/95 +1100, lyalc(a)mail.mpx.com.au (lyal collins) wrote: >I meant that on-line certificate issuing, notary and similar services where >data is submitted to a system for processing/RSA encryption are subject to >this for of attack. >Parts of the SEPP/STT protocols appear to require this of merchants and >customers. >I retract my comments about ecash/echeques - I'm not sure of the >implications there yet. >As for SEPP/STT - another nail in the coffin, me thinks. For large environments like this, it's possible to work around the attack by methods like queueing up all the signature jobs and doing them serially; this makes it difficult for the Bad Guy to know whether the server is taking time doing his multiplications or Alice's or N other customers', so he can't control timing very well by picking otherwise-informative numbers. On the other hand, your smartcard or PC is still at risk, since it's _not_ doing a lot of them, unless it's doing them just sort of at random when it's got nothing better to do and throws the real work in the middle. #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

1 0

Question about the Timing Attack
by James Black 17 Dec '03

17 Dec '03

Hello, I have looked over the paper, but I will look more closely this weekend (finals going on right now). The main question I have, since my programs run over a network with dumb terminals is this: If someone can get the timing information why would they need it, since they can read the message. So how can this attacker get the timing info without being able to read the message (unencrypted)? Thanx. ========================================================================== James Black (Comp Sci/Comp Eng sophomore) e-mail: black(a)eng.usf.edu http://www.eng.usf.edu/~black/index.html **************************************************************************

1 0

Kocher's Paper
by Connie Sadler 17 Dec '03

17 Dec '03

Hi... Can someone tell me where I can get a copy of Kocher's paper? I haven't read it yet. Thanks! Connie

1 0

CryptoLib 1.0 now available
by Matt Blaze 17 Dec '03

17 Dec '03

[Note! This is posted for Jack Lacy; please direct responses to him at cryptolib(a)research.att.com. -matt] Announcing CryptoLib - Release 1.0 12/13/95 Jack Lacy, AT&T Bell Labs CryptoLib is a portable and efficient library of primitives for building cryptographic applications. It runs under most versions of Unix as well as DOS, Windows and Windows-NT (and 95). We are pleased to make CryptoLib source code available without charge to researchers and developers in the US and Canada. (Because of export restrictions on cryptographic software, we are only able to make the software available within the US and Canada to US and Canadian citizens and US permanent residents.) CryptoLib is intended for research and experimental use, and is distributed without warranty or support. In particular, please note the following license conditions: * Copyright (c) 1995 by AT&T. * Permission to use, copy, and modify this software without fee * is hereby granted, provided that this entire notice is included in * all copies of any software which is or includes a copy or * modification of this software and in all copies of the supporting * documentation for such software. * * This software may be subject to export controls. * * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR IMPLIED * WARRANTY. IN PARTICULAR, NEITHER THE AUTHORS NOR AT&T MAKE ANY * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE MERCHANTABILITY * OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR PURPOSE. The attached describes the library and some timing results. To obtain source code send electronic mail to: cryptolib(a)research.att.com with a statement of the following form: "I am a U.S. or Canadian citizen or a legal permanent resident of the U.S. and am aware that some parts of CryptoLib may be restricted under United States export regulations. I have read and understand the CryptoLib license." Name: Location: E-mail: Are you licensed to use the RSA patent? If yes, give name of licensed organization: =============================================================================== CryptoLib includes the following: arbitrary length bignums. bigmath package: bigAdd, bigSubtract, bigMultiply, bgiDivide, bigLeftShift, bigRightShift, bigAnd, bigOr, bigXor, bigCopy, Euclid's extended GCD, modular reduction and exponentiation crypto primitives DES and 3DES + modes Diffie-Hellman DSA (Signing and verification roughly equally efficient) El Gamal Rabin's scheme Random Number generation (PSEUDO and TRUE) MD[2,4,5] Prime generation RSA (provided only if you convince me that you have a license) SHA truerand (For Unix, NT and 95) quantization (Defense against Kocher's timing attack) quantized RSA, DSA and El Gamal private key operations. support functions asn1.c ioutils.c netIface.c Some timing information: All times assume 32X32 bit assembly of multiplication primitives. bigPow times (a^b mod c with a,b,c the same length) 512 bits 1024 bits -------- --------- bigPow 0.12s 0.72s Sparc II Brickell bigpow 0.43s 3.0s Sparc II with asm (gcc) 0.12s 0.78s Sparc 10 with asm 0.03s 0.17s Sparc 10 with asm (Brickell) 0.084s 0.45s SGI Indigo (150MHz) 0.109s 0.75s 100 MHz Pentium (gcc under DOS) Strong Prime Generation -- ProbTestAttempts = 5 100 primes generated in each test. Times below are: (total test time)/100 = avg. time per prime generated. Using Gordon's strong prime algorithm. 256 512 1024 Machine --- --- ---- ------- 2.8s 24.0s 5.11m Sparc II .45s 2.7s 77s 100 MHz pentium RSA Times (64 bit public exponent, message encrypted is full length) --------- 512 768 1024 bits machine --- --- --------- ------- encrypt 30ms 50ms 80ms sparc II decrypt 160ms 480ms 930ms encrypt 15ms 33ms 56ms 100 MHz Pentium (Under NT) decrypt 38ms 104ms 214ms DSA Times --------- 512 768 1024 bits machine --- --- --------- ------- sign 99ms 166ms 216ms sparc II (Brickell speedup) verify 156ms 316ms 416ms sign 21ms 38ms 49ms 100 MHz Pentium (Under NT) verify 27ms 43ms 71ms

2 2

Digital Sigs and the Bar Committee
by William McVey 17 Dec '03

17 Dec '03

This was found on Netwatchers (http://www.ionet.net/~mdyer/front.shtml) and I figured there would be people on this list willing to comment. -- William McVey BAR COMMITTEE PROPOSES DIGITAL SIGNATURE GUIDELINES The Information Security Committee of the Science and Technology Section of the American Bar Association has promulgated proposed Digital Signature Guidelines, and is inviting comment through January 15, 1996. You can download the compressed ASCII file at the NetWatchers site, subject to the copyright notice below, or you can download the text in various formats from the ECL site at http://www.intermarket.com/ecl/.

1 0

Re: ADDRESS DATABASE?
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Sandy Sandfort 7:51 AM 12/14/95 (not completely in this order): >Something of privacy interest happened to me yesterday. I phoned >a company to ask for a copy of their catalog. The phone clerk >asked for my last name and zip code. After receiving that info, >the clerk asked me, "Is this your full name and address?" and >then gave them both correctly. I was taken aback. That is the correct response. >Does anyone know how this trick was done? What trick? For ~$150, you can buy a CD-ROM-set DB with every listed phone number in the U.S. on it, faxes too; the info's rife with typos and has a lag of ~6-7 months, but what do you want? If you're willing to pay more, you'll get more -- more accurate, more timely, more aggressively correlated, more thorough info. >I have been at my new address for only a couple of months. Prior Where's your new address, under a rock? ;) >to that, I have been couch surfing for a year and a half. Though Ironically, NFA status will get you on some very aggressive lists. >I called an 800 number, ANI had nothing to do with it since I was >calling from work. It may have been from a database associated >with a credit reporting agency, a bank or a utility company, but [x] all of the above >I am not aware of any of these being available on-line for They are. >something as mundane as requesting a consumer catalog. The clerk ^^^^^^^ Are you being serious? Ever heard of "information markets"? What, are you a libertarian just because you don't like taxes? There are other reasons for being one... :) >had no idea where the info came from (or so he said). Detweiler L Detweiler L S Detweiler Larry 8525 E Hampden Ave 3704 S 2nd St 2884 Ww Ave Denver CO Austin TX Parnell IA 80231-4826 78704-7073 52325-8825 303-695-0497 512-448-1750 319-628-4461 Detweiler Lynn Detweiler Lynn Detweiler Lynn Teenline 1724 N Alabama St 1045 W Forevergreen Rd North Liberty IA Silver City NM North Liberty IA 52317 88061-4302 52317-9717 319-626-6272 505-538-2776 319-626-8216 <etc.> PS. Unless your postscript (in the classical sense) about getting help making an adult film was a pickup line, maybe you could talk to one of Detweiler's neighbors about it... Allen Michael L 8525 E Hampden Ave Denver, CO 80231-4826 303-750-6855 Allerheiligen Shane & Robin 8525 E Hampden Ave Denver, CO 80231-4826 303-338-5250 Ambrosino Greg 8525 E Hampden Ave Denver, CO 80231-4826 303-338-5723 Anderson Michael W 8525 E Hampden Ave Denver, CO 80231-4826 303-696-1057 Armour Lyles 8525 E Hampden Ave Denver, CO 80231-4826 303-743-0933 Auslen James 8525 E Hampden Ave Denver, CO 80231-4826 303-671-5129 Baker Barbara 8525 E Hampden Ave Denver, CO 80231-4826 303-751-4451 Banks Mark 8525 E Hampden Ave Denver, CO 80231-4826 303-671-9228 Banner K 8525 E Hampden Ave Denver, CO 80231-4826 303-750-4587 Barison Joseph 8525 E Hampden Ave Denver, CO 80231-4826 303-743-9661 Becker Michelle 8525 E Hampden Ave Denver, CO 80231-4826 303-745-0320 Beckler Barbara 8525 E Hampden Ave Denver, CO 80231-4826 303-745-8793 Belloni Beecky 8525 E Hampden Ave Denver, CO 80231-4826 303-671-5114 Bennett Tim 8525 E Hampden Ave Denver, CO 80231-4826 303-337-2903 Berlin T A 8525 E Hampden Ave Denver, CO 80231-4826 303-745-0541 Berthonnaud Jon 8525 E Hampden Ave Denver, CO 80231-4826 303-751-7496 Biery Timothy 8525 E Hampden Ave Denver, CO 80231-4826 303-755-5589 Bond H M 8525 E Hampden Ave Denver, CO 80231-4826 303-369-5513 Bosworth Lisa 8525 E Hampden Ave Denver, CO 80231-4826 303-743-8447 Budd Edward K 8525 E Hampden Ave Denver, CO 80231-4826 303-752-9749 Chlopek Joanna 8525 E Hampden Ave Denver, CO 80231-4826 303-752-4647 Coleman Warren 8525 E Hampden Ave Denver, CO 80231-4826 303-695-4761 Cormier Keith 8525 E Hampden Ave Denver, CO 80231-4826 303-750-1783 Cox R 8525 E Hampden Ave Denver, CO 80231-4826 303-337-5744 Dayton C 8525 E Hampden Ave Denver, CO 80231-4826 303-750-5281 Dietz Scott 8525 E Hampden Ave Denver, CO 80231-4826 303-750-6657 Dillon C 8525 E Hampden Ave Denver, CO 80231-4826 303-338-5495 Donaldson Jennifer 8525 E Hampden Ave Denver, CO 80231-4826 303-750-7681 Dooley Patricia F 8525 E Hampden Ave Denver, CO 80231-4826 303-750-5443 Duke Alison 8525 E Hampden Ave Denver, CO 80231-4826 303-671-7286 Elizondo Arthuro 8525 E Hampden Ave Denver, CO 80231-4826 303-338-0348 Erfman Jeff 8525 E Hampden Ave Denver, CO 80231-4826 303-755-7570 Farris J 8525 E Hampden Ave Denver, CO 80231-4826 303-696-1283 Faulkner Theresa 8525 E Hampden Ave Denver, CO 80231-4826 303-750-6341 Fernandes Roland C 8525 E Hampden Ave Denver, CO 80231-4826 303-750-1650 Fouse Sue 8525 E Hampden Ave Denver, CO 80231-4826 303-750-0015 Fox J 8525 E Hampden Ave Denver, CO 80231-4826 303-337-5960 Gaffney Walter R 8525 E Hampden Ave 1513 Denver, CO 80231 303-368-9245 Goodell Brooke 8525 E Hampden Ave Denver, CO 80231-4826 303-755-5765 Graham Calvin 8525 E Hampden Ave Denver, CO 80231-4826 303-750-5853 Grant Dallas 8525 E Hampden Ave Denver, CO 80231-4826 303-671-7792 Grosskreutz Vicki 8525 E Hampden Ave Denver, CO 80231-4826 303-745-1905 Hewett Vern 8525 E Hampden Ave Denver, CO 80231-4826 303-751-5786 Higgins Scott 8525 E Hampden Ave Denver, CO 80231-4826 303-696-8126 Howard W 8525 E Hampden Ave Denver, CO 80231-4826 303-745-9591 Howe Josh 8525 E Hampden Ave Denver, CO 80231-4826 303-337-6322 Huggins Scott 8525 E Hampden Ave Denver, CO 80231-4826 303-745-6627 Hunt Derek 8525 E Hampden Ave Denver, CO 80231-4826 303-755-7306 Hunter Lisa 8525 E Hampden Ave Denver, CO 80231-4826 303-338-5505 Jackson J C 8525 E Hampden Ave Denver, CO 80231-4826 303-750-2418 Jensen J A 8525 E Hampden Ave Denver, CO 80231-4826 303-750-1906 Kiolbasa Mike 8525 E Hampden Ave Denver, CO 80231-4826 303-338-9216 Klein Misty 8525 E Hampden Ave Denver, CO 80231-4826 303-745-3986 Leiker Ron 8525 E Hampden Ave Denver, CO 80231-4826 303-671-9558 Lenard P 8525 E Hampden Ave Denver, CO 80231-4826 303-751-3253 Lopez Jennifer 8525 E Hampden Ave Denver, CO 80231-4826 303-337-1765 Marinella Michelle D 8525 E Hampden Ave Denver, CO 80231-4826 303-751-3645 Mclane William T 8525 E Hampden Ave Denver, CO 80231-4826 303-337-6035 Mcqueen Mike 8525 E Hampden Ave Denver, CO 80231-4826 303-750-7483 Milbrath Jeff 8525 E Hampden Ave Denver, CO 80231-4826 303-750-7925 Moffit S L 8525 E Hampden Ave Denver, CO 80231-4826 303-369-2964 Murchison Rob 8525 E Hampden Ave Denver, CO 80231-4826 303-368-1260 Nash Jesse H 8525 E Hampden Ave Denver, CO 80231-4826 303-752-1141 Nichols Keith 8525 E Hampden Ave Denver, CO 80231-4826 303-337-0062 Palesch Mindi 8525 E Hampden Ave Denver, CO 80231-4826 303-671-5177 Parker L 8525 E Hampden Ave Denver, CO 80231-4826 303-750-4587 Peterson N C 8525 E Hampden Ave 720 Denver, CO 80231 303-752-4807 Plunkett Lisa A 8525 E Hampden Ave Denver, CO 80231-4826 303-338-5986 Plybon Jonathan 8525 E Hampden Ave Denver, CO 80231-4826 303-671-0681 Reynolds Robert 8525 E Hampden Ave Denver, CO 80231-4826 303-337-3489 Richey Robert 8525 E Hampden Ave Denver, CO 80231-4826 303-338-9074 Sabourin William & Tasha 8525 E Hampden Ave Denver, CO 80231-4826 303-745-6005 Sanborn Bruce E 8525 E Hampden Ave Denver, CO 80231-4826 303-752-1838 Schroeder Paul 8525 E Hampden Ave Denver, CO 80231-4826 303-671-5231 Sears Marc & Denise 8525 E Hampden Ave Denver, CO 80231-4826 303-745-2958 Shaw R 8525 E Hampden Ave Denver, CO 80231-4826 303-696-7014 Short Maynard P 8525 E Hampden Ave Denver, CO 80231-4826 303-671-5647 Shriner Christopher S 8525 E Hampden Ave Denver, CO 80231-4826 303-695-0806 Sicles T A 8525 E Hampden Ave Denver, CO 80231-4826 303-750-5744 Sinks Curt E 8525 E Hampden Ave Denver, CO 80231-4826 303-671-8118 Smith J H 8525 E Hampden Ave Denver, CO 80231-4826 303-338-5438 Smith Marc G 8525 E Hampden Ave Denver, CO 80231-4826 303-750-8531 Sorrell Larry W 8525 E Hampden Ave Denver, CO 80231-4826 303-695-4778 States Michael W 8525 E Hampden Ave Denver, CO 80231-4826 303-750-7416 Steward E C 8525 E Hampden Ave Denver, CO 80231-4826 303-337-3259 Sullivan K 8525 E Hampden Ave Denver, CO 80231-4826 303-755-9989 Sunburst Apartments 8525 E Hampden Ave Denver, CO 80231-4826 303-750-0124 Terry Robert D 8525 E Hampden Ave Denver, CO 80231-4826 303-745-4287 Triplette J 8525 E Hampden Ave Denver, CO 80231-4826 303-369-7795 Vestal Patrick J 8525 E Hampden Ave Denver, CO 80231-4826 303-671-0245 Whaley Leigh 8525 E Hampden Ave Denver, CO 80231-4826 303-755-1915 White Epsie 8525 E Hampden Ave Denver, CO 80231-4826 303-337-1368 Williams Myrtle M 8525 E Hampden Ave Denver, CO 80231-4826 303-695-1074 Winfield Kurt 8525 E Hampden Ave Denver, CO 80231-4826 303-755-4306 Zullo Marie J 8525 E Hampden Ave 117 Denver, CO 80231 303-368-1057 - ------------- That took about 15 seconds, but I'm a fast typer. YMMV. Hieronymous (*not* one of LD's neighbors) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMNBgWr3g0mNE55u1AQEugwH8DKWGsVXd9tfK97RICTeddGJUuQFFwrP3 WoQXrrxNcvGRQ8bzZ3ANH1FPAAiCt7WB+8OF3MA20H/Ma1XuiU8ljw== =QTb4 -----END PGP SIGNATURE-----

1 0

EMF loopholes and [Re: Kocher's RSA attack]
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

> >A conclusion which might be reached is that smartcards should >in future contain >contain a timer which is started at the beginnin of every cryptographic >operation and a delay loop introduced to ensure that the time taken is always >the same. The alternative of attempting to ensure that equal processing is >spent on each cycle threatens an infinite regress into second and third order >effects, eg frequency of page faults. Covert channel analysis is bad enough >as it is. > I remember the first computer I built had a neat wireless "sound card" built in. The radio waves generated by the processor could be modified by choosing the instructions executed. So you could get sound for your computer games by putting a radion next to the machine! The delay loops for the games contained multiple paths for different sounds. It was actually pretty good for the time. This leads me to believe that a delay loop might not be good enough. The leakage from the smart card could be enough to identify when the card entered the delay loop. The difference between the signal could be significant. Just a thought. -Peter

1 0