December 2003 - cypherpunks-legacy

IPG cracked with known plaintext
by cpunk＠remail.ecafe.org 17 Dec '03

17 Dec '03

This information is preliminary and is based on an attempt to understand the IPG algorithm information. That description is not clear in some areas, however, hence this analysis is tentative at this time. First let us describe the IPG system in more conventional C: a[0] to a[63] are initialized to random 8-bit values. (The description is unclear and almost makes it sound like they are initialized to a random 8-bit value anded with 0x3500, which would of course be zero. The attack below will assume that this bizarre step is not done, but will still apply even if it is.) b[0] to b[63] are initialized to random primes selected from some pool. c[0] to c[63] are also initialized to random primes selected from a different pool. d is initialized to a random 8 bit value. The algorithm is: for ( ; ; ) { for (i=0; i<63; i++) { a[i] = (a[i] + b[i]) % c[i]; d = (d + a[i]) & 255; *data++ ^= d; /* xor with data */ } } Note first that with a known plaintext attack, the value of d can be calculated for each iteration, simply by xor'ing the plaintext and ciphertext. So we can easily recover a series of d values under this assumption. Known plaintext is a plausible cryptographic assumption in many contexts. Note second that we can assume that b[i] is less than c[i]. It appears from the description that this will be true, although it is a little unclear. If b[i] is greater than c[i] then simply do b[i] = b[i] % c[i] before beginning the loop. This will produce the same results since (a + (b mod c)) mod c is equal to (a + b) mod c. Note third that when a[i] and b[i], both less than c[i], are added mod c[i], the result will be equal to one of two things: a[i]+b[i], or a[i]+b[i]-c[i]. The reason is that the sum a[i]+b[i] must be less than 2*c[i] so the "mod" operation will be at most a single subtraction of c[i]. In general, half the time it will be necessary to subtract c[i], and half the time it will not. Now, as mentioned above, with known plaintext we can deduce the series of d values. Since each d differs from its predecessor by adding a[i], this allows us to calculate the low 8 bits of a[i] simply by taking the difference between successive d's. Every 64 bytes, i repeats. We know the low byte of a[i] from the previous iteration, and we know it for this iteration. Half of the time (on average) a[i] will change simply by adding b[i], in which case the low 8 bits will change by exactly the low 8 bits of b[i]. So if we take the difference between a[i] values spaced 64 bytes apart, half of the time these values will be a constant which is equal to the low byte of b[i]. The other half the time, the low 8 bits will change by adding b[i] and subtracting c[i]. So the low 8 bits of (b[i]-c[i]) is the other possible constant value which will be seen when you take the difference of a[i] every 64 bytes. So with a few multiples of 64 bytes of known plaintext, you will quickly find all the possible b[i] and b[i]-c[i] low bytes. By itself this should significantly narrow down the possibilities for b[i] and c[i], in many cases to a single prime. Even without this the algorithm can now be run forward or backward with only two possible known changes to a[i] at each step, and the entire message can be easily deduced. So this algorithm is easily broken with known plaintext.

1 0

Re: IPG cracked with known plaintext
by John Pettitt 17 Dec '03

17 Dec '03

At 05:32 PM 3/19/96 GMT, ECafe Anonymous Remailer wrote: >This information is preliminary and is based on an attempt to >understand the IPG algorithm information. That description is not >clear in some areas, however, hence this analysis is tentative at this >time. > >First let us describe the IPG system in more conventional C: > >a[0] to a[63] are initialized to random 8-bit values. (The >description is unclear and almost makes it sound like they are >initialized to a random 8-bit value anded with 0x3500, which would of >course be zero. The attack below will assume that this bizarre step >is not done, but will still apply even if it is.) > I think they mean ADD not AND but it's still an odd thing to do IMHO. >So this algorithm is easily broken with known plaintext. > > Agreed. Given that most PC apps generate known headers on files and that only a smallish plaintext is needed it's looks rather weak. John Pettitt, jpp(a)software.net VP Engineering, CyberSource Corporation, 415 473 3065 "Technology is a way of organizing the universe so that man doesn't have to experience it." - Max Frisch PGP Key available at: http://www-swiss.ai.mit.edu/htbin/pks-extract-key.pl?op=get&search=0xB7AA37…

2 1

Microsoft's "answer" to Java
by Alan Olsen 17 Dec '03

17 Dec '03

I recieved a copy of "Microsoft Interactive Developer" today in the mail. In it, it has a preview of Microsoft Explorer 3.0. (Flux by David Boling on page 120.) Of interest to Cypherpunks is this paragraph (in the section on OLE support in web browsers): "Since OLE controls could potentially pose a security problem, Microsoft is studying how to create an infrastructure to certify them. The idea is that, once certified, an OLE control would contain an RSA security signature indicating that it has passed muster -- the OLE eqivelent if the Good Housekeeping Seal of Approval! Users of Internet Explorer 3.0 could specify whether or not noncertified OLE controls should be loaded and executed by the browser." As a web developer, I have some problems with this scheme. Giving Microsoft access to virtually every OLE control on the Web does not make me more secure. Sounds like a way to rip off ideas from the rest of the development world. If someone has a control that might compete with a Microsoft product, it could be shelved and/or delayed for "further security testing". Java has a decentralized mechanism for security. No one group controls what is a "certified" control and what is not. You write the code and compile it and that is that. Furthermore, you are not stuck with Microsoft approved platforms. (I wonder if there will ever be a version of Explorer for the Mac.) I expect the Microsoft plan to garner a bit of resistance from the Web development community over this one... I do not expect to see many OLE crypto apps for the web with this plan. --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon

2 1

The return of the IPG Unbreakable System (fwd)
by IPG Sales 17 Dec '03

17 Dec '03

Derek and others, In view of the anonymous remailer's calim to have broken the simple system, which as you and others who have had the system for a period time know, we have had some reservations about. The effect on the 5600 bit system, and the 12288 bit system, are unkown at this time. Our tests indicate that there is not any effect at all on the 12,288 bit system. The 5600 bit system, which is indentical to the system described in our release, except that the D values, are used as an index to one, or two tables of random characters, 512 characters, or 2 - 256 characters, may be effected by a known plain text attack, we do not think so but we are running a battery of tests. The anonymous remailer may be able to confirm or deny that, since that person will presumably receive this letter. The addition is trival, that is the system is identicalin all respects to that set out, which was described accurately by the remailer, except that instead of XORing the D value, the D value is used as an index into a table(s) of random characters, that is the random seed is 5600 bits instead of 1792. That was one reason for providing large random seeds in our release. Our analysis as of 3:00pm CST 3-19-96, indicates that the D values are not recoverable, but we stand to be proven wrong. This system is only fractionally slower, for obvious reasons, than the simple one directly using the D values directly, described previously. Incidentally, for those concerned, it is as you know, the one that the IPG software in your possesion uses. Note: There was one error in the description, that is 13568 ANDed to the 8 bit random seed to get starting A values, it is not a C word AND but the assembly langauge sequnce of moving successive AL values into AX, where AH is fixed at 35, thus the effect is the same as an add, (or a byte AND of the random charcter to a zero AL) - the result is a number in the range of 13,568 to 13,823. Further, with respect to the simple system described in our release, we believe that the trimming procedure, that as some of you know, we used for another purpose - to eliminate the perceived problem of more frequent close pairs, on the average more 0,0's as opposed to 0,255's, defeats the plain text attack, though it may require the jump start as we have described - running the system through a few iterations before commencing the actual encryption. The effect of this, as has been described to some of you, is that some of the D's are not used, that portion of each C value that is not an even multiple of 256, for example 14009 MOD 256 is 185. Thus, those values where A[i] > 13824 are not used to XOR against the plain text - this is easily done in ASM by simply comparing the high order 8 bits, of A[i] with the high order 8 bits of C[i], if they are equal, then the XOR does not take place - thus the 64 interval is not applicable, it is variable depending upon the randomly selected C values. Without having the known 64 interval as a constant, I believe that the system is still solid. As those of you heretofore privy to that information know, that modification to the system system takes about 10% more time, than the system that was "cracked." Maybe, we need to do both this and use the 5600 byte system. We will appreciate any input in this regard. If we must go to the 12288 byte system, the system will be slower. However, as many of you know, it is still extremly fast but not as fast as either of the other two versions. With the 12,288 bit system. Our tests indicate that nothing but random values, can be obtained by either known plain text attack or by pattern recognition methodologies, those of which we are aware, on the 12,288 bit system. Those of you who have had all of the materials will understand the foregoing. With the information provided heretofore, you can determine the effect on the other two systems. Also, those people will know my expressed fear of a premature announcement, such as that which has now been made, would have. This was the reason, that I resisted so strongly the release of the materials to the C'punks list though a few of you recommended that I do so. Perhaps we should have released everything? Who knows. However, in any case, that is water over the dam and IPG must go on from here. It is only another of the many mistakes that we will undoubtedly make along the way. Having said that though, we must go back to our prior evaluation method, a strict confidential mode. However, I believe that we have added several very good additional people who can help to analyze the system. In view of the willful violation of our confidential release, without knowing everything involved, and putting it out on the Internet, please be advised that other than those who have heretofore been evaluating the system, we will make no further releases except on a highly selective basis. The dozens of you who have requested copies of the materials,and have not yet received them, please be patient until we can get back on track. On a selected basis, we will provide then to you, after discussing it with each of you privately. Obviously, this breech occurred from yesterdays posting since no mention was made of the 5600 bit or 12,288 bit random seed systems. Therefore, we intend to be very careful from now on. Accordingly, this will be the last letter posted to the entire cypherpunks list for the time being. If any reader posts something to the entire Cypherpunks list, do not expect any response to from IPG, there will be none. Perhaps a battle has been lost, maybe even probably? But the war is not over, not by a long shot - with minor modifications this system is absolutely secure as events will prove. However, be assured that we will not sell our product to anyone until that can be definitively established. We greatly appreciate the contribution of some of those on the cypherpunks mailing list, including the anonymous remailer, have made. We hope that someway can be found for that person to continue to cooperate with us, since we are herein obviously providing information that can be evaluated. If that person will communicate with us privately, in remailer form, including a PGP public key, we will post our response to the C'Punks list in encrypted form, or suggest an alternate approach. To many of you, you will be hearing from us tomorrow - to the remaining of you, some of whom have objected to our providing you with unsolicited information, which we mistakenly thought that you would want, you will hear from us soon, depending upon the findings made by your C'punk list associates and others. Thanks kindly, Ralph

3 5

JEK_hyd
by John Young 17 Dec '03

17 Dec '03

3-20-96. TWP (privatizing the global NatSec frankenstein): "South Africa Weighs Reining In Peddlers of Mercenary Ex-Soldiers." In this once highly militarized society, the transition from white-minority rule produced unemployed commandos and spies suddenly without a cause. So, controversial military and intelligence units are selling their skills to the rest of Africa and beyond. Executive Outcomes, the best known and apparently largest of firms offering overt and covert security services, says the company's services are in great demand. It operates within a murky network of other international companies that specialize in oil drilling, diamond mining and landmine removal. The firm also has been reported to hire former commandos of Britain's SAS and the Selous Scouts of the old white-ruled Rhodesia, as well as military technicians from the former Soviet Union. JEK_hyd

1 0

Re: Would the FTC crack down on snake oil someday?
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:45 PM 3/17/96 +0000, you wrote: >Enclosed is an excerpt from Edupage. Snake-oil crypto popped into my >mind.... I wonder if the FTC (Federal Trade Commission... agency >*meant* to crack down on consumer fraud, for non-US readers here) >would ever get into act here. .... >FTC TARGETS INTERNET FRAUD >The Federal Trade Commission is conducting a "wholesale crackdown" on >perpetrators of allegedly deceptive marketing schemes that are advertised in >Internet news groups or on the World Wide Web. Sure, they'll be happy to, if we really want. The NSA will advise them on what's good crypto, and what's snake-oil. Certainly any system that didn't provide for back-up key access doesn't rate...... No, I didn't think you wanted that either.... #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissable." - US government statement on China...

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

Sandy SandFort wrote: > A CYPHERPUNK CALL TO ARMS!!! > > (Did I get the style right?) C'punks, if you feels as I do, > please take a few moments to sign up for the LIST OF SHAME? > Let's show Bill, Bruce, Matt and all the others what most > Cypherpunks really think about them and Mr/Ms Anonymous. This effectively gets the right point across, but might turn Cypherpunks into a USENET newsgroup mass posting of "me too" sentiments. As I agree with Sandy on every point, I reluctantly choose to start.... "Please add me to your list of shame, Mr. Anonymous." Brad Shantz

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

If I were the NSA, I would start threads such as the one on the IPG system. They are very valuable to them in assessing and mapping the cryptanalysis capabilities of the CPunks lurkers and regulars members. Just a thought... JFA Public Key at http://w3.citenet.net/users/jf_avon Jean-Francois Avon <jf_avon(a)citenet.net> 2048 bits key ID:C58ADD0D 1996/03/01 fingerprint=52 96 45 E8 20 5A 8A 5E F8 7C C8 6F AE FE F8 91

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

At 7:42 PM 3/20/96, Michael Froomkin wrote: >correct me if I'm wrong, but don't the federal direct mail marketing laws >say that any unsolicited merchandise sent to a person becomes their >property, regardless of any disclaimers to the contrary included in the >package? The _physical_ item, e.g., a box of soap or a free copy of "Newsweek," but presumably not the _intellectual property_, e.g, the contents of "Newsweek." (Just because I get free samples of magazines does not mean I now can do with the contents whatever I wish, such as post them on the Net; copyright law is presumably involved.) This may be more analogous to what IDG has done. Disclaimers: IANAL, I am not defending IDG or their "broken in less than one day" tub of snake oil, nor am I defending copyright and direct mail marketing laws. And I might be wrong about the intellectual property issue, though I doubt it. Copyright laws are such that rights are not waived even if free samples are given out, and so forth. IDG can hardly claim their algorithm has trade secret status when they've distributed it to many people. Which leaves them with only trying to enforce copyright protections, a la the Church of Scientology. Maybe IDG will now seek to collect the only bucks they'll ever get by suing various Cypherpunks who are distributing their so-called system? Helena Kobrin can become their lawyer. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

Since someone other than Jim Bell and THE LIST OF SHAME author thought I was being serious, I thought it wise to respond. The notion that a measure of criticism from a known enemy, Dorothy Denning, corrects the many problems with Leahy's legislation is absurd. As a case in point, remember that Rush Limbaugh, Catharine MacKinnon, and the radical religious right group American Family Association criticized the CDA. That does not make the CDA worth passing. (Of course Rush likes dirtysexycybertalk so he can pick up chicks online, and the AFA wanted not less, but _more_ liability for ISPs, but I trust my point is clear.) Speaking of the CDA, I'll be in Philadelphia tomorrow and Friday for the hearing. Any other cypherpunks planning to attend? -Declan Excerpts from internet.cypherpunks: 20-Mar-96 [NOISE] Re: Dorothy Denning.. by Alan Bostick(a)netcom.com > In article <Pine.3.89.9603192113.A23263-0100000@well>, > Declan McCullagh <declan(a)well.com> wrote: > > > I may have to adjust my position on Leahy's bill. Any legislation that > > Dorothy Denning attacks so virulently must be worth passing. > > That could be exactly what They want you to think! > > If They wanted us to overlook the actual flaws and trapdoors in Leahy's > bill, what better way than to have our knees jerk in support by arranging > for Denning's opposition?

1 0