December 2003 - cypherpunks-legacy

RISKS: Compuserve "secure" login
by stevenw＠best.com 17 Dec '03

17 Dec '03

------------------------------ Date: Thu, 04 Apr 1996 19:34:12 +0200 From: Heinz-Bernd Eggenstein <eggenste(a)noether.informatik.uni-dortmund.de> Subject: CompuServe's "secure login protocol": two steps forward, one back Summary: a new CompuServe Information Service (CIS) logon protocol was designed to prevent passive and active attacks (where the attacker impersonates a CompuServe node) but a flawed implementation in the WinCIM 2.0(.1) client software still allows active attacks. Version 2.0 of the "WinCIM" access software introduced a new logon protocol. Previous versions of the software had transmitted the user's UID AND his/her password in plaintext during logon. The risks are obvious, especially when connecting via the Internet to CompuServe (e.g. to save long distance telephone charges). The new, "secure logon protocol" is a challenge-response type protocol where the "challenge" is to compute a keyed hash-function, the key is derived from the shared secret, the user's password: 1) The client (WinCIM) generates a pseudorandom string of bits, its "nonce" (RB) 2) The client transmits the user's UID (e.g. 12345,6789) and the additional parameter "/secure:1" to request a secure login. 3) The host transmits its pseudo random nonce (RA) (The old protocol would instead prompt for the password) 4) client sends RB to the host 5) client computes UR:=MD5(S|Z|RA|RB|S) and sends it to the host (where S (128 bits) is a function of the password, "|" stands for concatenation, Z is a 128bits block of 0s and MD5 is the well known message digest function.) 6) The host performs the same calculation with it's copy of the user's password. If the results match, the host sends HR:=MD5(S|Z|RB|RA|S) (Note the symmetry in the calculation of HR and UR) 7) The client software verifies HR with it's copy of the password to make sure the host is really a CIS node (!) (See the script-files cserve.scr and seclog.scr in the subdirectory SCRIPTS of a WINCIM 2.0(.1) installation, WinCim is available via anon. ftp at ftp.compuserve.com) Weaknesses: a) The scriptfile cserve.scr (versions 3.8 & 3.8.1) has the following bug: even after requesting a secure logon, the client software will fall back into the old protocol when receiving a "Password" prompt (Client: "I want a secure logon" Host:"OK, but anyway, give me your password" Client "Well ok then, here it is ..."). It will send the password in plaintext! This makes the protection against active attacks (see step 7) obsolete. b) A timeout condition or even an invalid HR response form the host will (seclog.scr & cserve.scr version 3.8.1) restart the protocol (it won't disconnect!), using *the same* client-nonce RB again, instead of generating a new one. If a spoofing host can predict RB as in this situation, it can pick the same nonce, leading to HR=UR=MD5(S|Z|RB|RB|S), so the host can just send back UR as HR. Note that unlike a), b) does not compromise the user's password. There may be other ways to predict the client software's nonce e.g. *if* the PRNG used by WinCIM is predictable (this calls for further investigation). Note that *offline* dictionary attacks to guess the password are possible after a passive, eavesdropping attack (so you still have to pick a "good" password). It's debatable whether CIS's password recommendation (<word><non-alphanum. char.><word>, both words unrelated, e.g. apple@battery) is adequate in this context). I notified CIS about these weaknesses and I was informed that they are "fixed" now, no details were given about the fix (source: Britta Herbst, German customer support (11111.754(a)compuserve.com)) Risks? The new protocol is obviously an improvement over the old, plaintext-password-only version. It's debatable whether protection against active attacks is at all necessary for access to an online service. However, CIS itself designed it's protocol to prevent spoofing attacks. Anyway, I think this a good example how to half-ruin a good protocol by embedding it into carelessly written code. Credits: Thanks to Gary Brown (70003.1215(a)compuserve.com) for sending me information on the implementation of the new protocol). Heinz-Bernd Eggenstein [usual disclaimers] ------------------------------ ------------------------------------------------------------------------- Steven Weller | Weller's three steps to Greatness: | 1. See what others cannot | 2. Think what others cannot stevenw(a)best.com | 3. Express what others cannot

1 0

Re: why compression doesn't perfectly even out entropy
by JonWienke＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-04-08 21:04:26 EDT, Perry Metzger writes: >Jon asked why it is that I contend that a compression algorithm won't >in the general case even out the entropy of a semi-random stream. I am not talking about any "general case," I proposed compressing spinner data, which has sequences of repeating numbers interspersed with occasional quasi-random fluctuations. I am not saying that compression is a "magic wand" that will fix data streams with a lot of "fake" entropy, such as the RND() function available in many BASIC's, which I think most of us will agree blows chunks. >The answer can be obtained by simply trying to run gzip over an image, >preferably one that hasn't been compressed. The results are, in >general, very bad, even though images are highly compressable (even >losslessly). I leave the why up as an exercise to the reader. I have ZIPed the aforementioned spinner data with the built-in ZIP routines in the PC Tools for Windows file manager. Except for some very slight banding (which appears to be caused by the ZIP headers) the noise sphere plots look pretty good. All files are available upon request for independent verification. >I have said before and I will say again that the only reliable way of >dealing with a stream that has some amount of randomness mixed in with >it that you wish to distil down into pure random bits is to use solid >reasoning to figure out how many bits of entropy per unit of input you >can actually expect to see, add a large fudge factor to cover your >ass, and then distil down using a cryptographic hash. I have no disagreements with this. I merely proposed using the compression function as a means of roughly estimating entropy and preventing the seeding of the hash/PRNG with potentially "weak key" type data. >Anything else >makes me highly nervous. If you can't estimate the amount of entropy >in an input stream from first principles, then you are probably in >trouble and should seek an input stream that you have a better handle >on. Would anyone like to propose a means of measuring entropy that we can all agree on? I haven't seen anything yet that everyone likes. Jonathan Wienke

1 0

Re: questions about bits and bytes
by jim bell 17 Dec '03

17 Dec '03

At 06:29 PM 4/10/96 -0700, Simon Spero wrote: >No, bytes are no always 8 bits - some machines use(d) 9-bit bytes. I notice you gave no examples. Why is that? Jim Bell jimbell(a)pacifier.com

4 3

Re: WWW User authentication
by David E. Smith 17 Dec '03

17 Dec '03

> I just finished writing a cgi script to allow users to change their login > passwords via a webpage. I currently have the webpage being authenticated > with the basic option (uuencoded plaintext). MD5 would be nicer, but how > many browsers actually support it? A straight MD5 probably isn't supported by any of them, but then again MD5 is not necessarily going to help too much. The sort of people that need a web page to change their password aren't likely to use overly complex passwords (mixed-case, scrambled-in numbers, et al.) So if a snoop can get the MD5, her chances of getting a password aren't all that bad. > When the user changes their password, the form sends their name, old > password, and new password with it, in the clear. This is no worse than > changing your password across a telnet connection, but I'd like it to be > more secure, but useable by a large number of browsers. Your best bet is to try to implement it via SSL, but as I understand it that limits you on your server options quite a bit. Netscape and Apache have it, as I understand; I think that's about it actually. But that's far from my areas of expertise. dave

2 1

Re: Bulletin: Cypherpunks say no taxes owed by moneychanger
by Frank O. Trotter, III 17 Dec '03

17 Dec '03

I know Frankin and will see him next week. His argument, which I have around here somewhere if I could get my paper life organized, realtes to gold and silver in certain situations. If I find it I will reference it, otherwise I'll ask if he will post to this group. FOT > Date: Tue, 9 Apr 1996 21:48:17 -0400 (EDT) > From: Alan Horowitz <alanh(a)mailhost.infi.net> > To: "Frank O. Trotter, III" <fotiii(a)crl.com> > Cc: cypherpunks(a)toad.com > Subject: Re: Bulletin: Cypherpunks say no taxes owed by moneychangers! > > Date: Mon, 8 Apr 1996 22:43:55 -5 > > From: Frank O. Trotter, III <fotiii(a)crl.com> > > Aside from ecash, helping people to exchange currency is my day job > > so I see this all the time, especially this month each year. > > There is a guy in Tennessee who publishes a newsletter called _The > Moneychanger_. He is one of those Constitutionalists. He did put himself > through hell to get acquited of an IRS charge - he is a dealer in gold > and silver and claimed that he wasn't selling anything, only changing > denominations of Money, with no profits. He won the federal case; the IRS > called their buds at the Tenn Dept of Revenue and had him indicted on a > failure-to-remit-sales-tax charge. He was convicted on that by the Jury > but he is appealing; meanwhile he only deals with out-of-Tenn people. > > Which just goes to show that convictions/acquitals under a jury system > have a lot of random-walk flavor. Further reference at the OJ Simpson > newsgroups. > > Frank O. Trotter, III - fotiii(a)crl.com www.marktwain.com - Fax: +1 314 569-4906 --------------------------------------------

1 0

DC-area cypherpunks physical meeting with Saturday
by pfarrell＠netcom.com 17 Dec '03

17 Dec '03

As advertised, the next DCCP meeting will be this weekend, April 13, at 3:00 at Digex. see http://www.isse.gmu.edu/~pfarrell/dccp/ for a tiny bit more info. As usual, topics and speakers welcome. Pat Pat Farrell grad student http://www.isse.gmu.edu/students/pfarrell Infor. Systems and Software Engineering, George Mason University, Fairfax, VA PGP key available via finger or request #include standard.disclaimer

1 0

Re: Enforcing the CDA improperly may pervert Internet architecture
by Duncan Frissell 17 Dec '03

17 Dec '03

At 08:09 AM 4/9/96 -0500, Mike McNally wrote: >I sent a letter to the Economist last year pointing this out after reading >an article containing the offhand statement, "... and of course it is >entirely feasible to control Internet content" (or something like that). >I don't have those magic two letters at the front of my name though. It >seems so utterly obvious. When you connect to an ISP via PPP or SLIP, >all the ISP is doing is routing packets. Or as I said in my letter to the Economist on their article "Censoring Cyberspace:" ******************* You suggest that Internet Service Providers might be required to employ "stop lists" supplied by their national censors to block objectionable material. The current focus is on banning smut. But no doubt many nations will want to ban various political and religious views as well. Surely, you know that anyone with a direct (TCP/IP) connection to the Internet (all Windows95 owners, for example) is not dependent on service providers for anything beyond a physical connection. Everyone who has such a local dial-in account is able to link to any site in the world at no additional cost. No long distance phone calls are necessary. ********************* A lot of people who know nothing of the nets think that they can be controlled "like magzines and newspapers" in the words of a Bell Atlantic exec. Like the Bavarian prosector, they will learn. DCF

1 0

Re: So, what crypto legislation (if any) is necessary?
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 3:21 PM 4/9/96 -0800, jim bell wrote: >And the rest of us are tired of seeing those non-responses! I wish to state that Jim Bell does not speak for me. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Watch your language, Shabbir.
by jim bell 17 Dec '03

17 Dec '03

When the Leahy bill was proposed, BTW was one of the organizations that came out in favor of it. Despite later substantial criticism and direct contacts, Mr. Safdar never defended his original position on this bill against these objections. I just saw something which may explain a bit about VTW's positions: VTW BillWatch #41 VTW BillWatch: A weekly newsletter tracking US Federal legislation affecting civil liberties. BillWatch is published at the end of every week as long as Congress is in session. (Congress is in session) BillWatch is produced and published by the Voters Telecommunications Watch (vtw(a)vtw.org) (We're not the EFF :-) Issue #41, Date: Wed Apr 3 12:41:46 EST 1996 Do not remove this banner. See distribution instructions at the end. ___________________________________________________________________________ TABLE OF CONTENTS Introduction from the Editor (Steven Cherry) A tragic story about a wiretap (Shabbir J. Safdar) [stuff deleted] A TRAGIC STORY ABOUT A WIRETAP by Shabbir J. Safdar, VTW Board (New York, NY) This week most of VTW's staff attended the Computers, Freedom, and Privacy conference in Cambridge Massachusetts. I go to the conference every year to recharge my batteries, put names to faces, and enjoy the synergy that can only come with face-to-face dialogue. [stuff deleted] One, while wiretaps have probably been effective in other cases, they were not effective in this one. While we can grant law enforcement the benefit of the doubt in other cases, the existence of this one shows that a wiretap is not the "silver bullet" of law enforcement that we have been led to believe. Another observation that can be made is that this parallels the key escrow debate very closely. No reasonable person is objecting to the FBI's right to conduct a wiretap. However what is being debated is the extent to which individuals and law enforcement can go to accomplish their duties. The Clinton Administration is striving for a world where everyone is forced to speak in a form of encryption that is easily decoded by law enforcement. The public and industry is striving for a world where they continue to have private conversations. [end of quote] Look, very carefully, at the last paragraph quoted above. Mr. Safdar says, "No reasonable person is objecting to the FBI's right to conduct a wiretap." Huh? "FBI's right"???? Maybe this is a bit too basic for comprehension, but governments have no "rights" by any definition I've ever heard. "Rights" are the possessions of individuals, and occasionally individuals authorize governments to do things. But that does not mean that those governments possess a "right," especially not one on such a flimsy and transitory principles as wiretaps. Government certainly does not possess a "right" that supercedes the wishes of the public, or the Constitution. Safdar's note appears to pre-date my commentary where I pointed out that before 1968, wiretaps in America were illegal, but were done anyway simply because the cops wanted to. That doesn't sound like a "right," now, does it? If it were a "right" then it couldn't be given by law, or taken away by law. But nobody I've ever met claims that the cops aren't at least legally obligated to follow the law, whether or not they actually do. I don't like sloppy rhetoric. Even worse, claiming that "no reasonable person" would object to a non-existent "right" is truly outrageous. I know _plenty_ of people who would claim that the government, and by extension the FBI, possesses no "right" to do wiretaps (this position would be echoed by essentially every libertarian). I know many people who think that the government shouldn't be able to do wiretaps at all. VTW's header above claims "We're not the EFF," but it's hard to tell this from Mr. Safdar's propaganda. Now I understand why he didn't defend his position on the Leahy bill against criticism. VTW is sounding more and more like "EFF" all the time. Jim Bell jimbell(a)pacifier.com

3 3

CDA Court Challenge: Update #5
by Declan B. McCullagh 17 Dec '03

17 Dec '03

----------------------------------------------------------------------------- The CDA Challenge, Update #5 ----------------------------------------------------------------------------- By Declan McCullagh / declan(a)well.com / Redistribute freely ----------------------------------------------------------------------------- In this update: Yet Another CDA Lawsuit: Fred Cherry v. Janet Reno Deception and deceit from DoJ's Jason Baron URLs for the DoJ's dirty picture list The true identity of Grey Flannel Suit April 9, 1996 PITTSBURGH, PA -- Fred Cherry wants a Federal court to uphold his right to flame. Lambasting "homonazis" on USENET is his inalienable right under the First Amendment, argues the notorious netizen in his anti-CDA lawsuit filed yesterday in New York City on behalf of "Johns and Call Girls United Against Repression, Inc." Cherry's beef with the law is that under its ban on "indecency," when he gets flamed by "Australian homosexual nazis" he won't be able to flame back. His complaint charges that his "Australian opponent will have MORE freedom of speech" than he does -- unless the CDA is struck down. The self-taught amateur lawyer attached 20 pages of net.flamage as his sole exhibit. One example that was spammed all the way from soc.men to alt.christnet.second-coming.real-soon-now: "Your ass is so blocked up that you do need some therapeutic relief for your constipation -- a condition which has backlogged all the shit right back up into your head, Fred." The indefatigable Cherry replied: So, ramming a huge dick up my ass would be a therapeutic measure, would it? You homos are the chief cause of AIDS in the United States with your huge dicks being rammed up each other's asses. And then you homos go around whining that the government isn't doing enough to find a cure for AIDS. [12/22/95] Ya gotta love this guy. He sent me mail describing his legal strategy, concluding: "Can anyone deny that I am indeed the greatest amateur lawyer since Caryl Chessman?" Of course Chessman -- California's "Red Light Bandit" rapist -- was executed in 1960, his jailhouse lawyering failing him in the end. Cherry's lawsuit was easy to prepare. He grabbed the ACLU's complaint from their web site, printed it out, added a few grafs about his net.nazi adversaries, and trotted off to Federal court. When Cherry filed his suit, which he's moved from Brooklyn to Federal court in Manhattan, he wrote: I am primarily a political activist, working for the repeal of laws criminalizing adult prostitution and the patronizing of adult prostitutes. Over the past thirty years I have found that, in the United States, homosexuals are the worst enemies of the civil rights of women prostitutes and their male clients. The Cherry v. Reno case, refiled at docket number 96 Civ. 2498, most likely will be consolidated with the American Reporter case, which is also moving forward in the U.S. Second Circuit Court of Appeals. A.R. editor Joe Shea will probably fight it. Shea refused to join our lawsuit because he can't stand the ACLU and wants to do his own thing, so he'll probably try to keep Cherry's case from being joined with his. In fact, he accused the ACLU of putting Cherry up to it. +-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+ I would never have suspected the DoJ attorneys of trying to deceive Federal judges, but now I wonder. The DoJer I've had the most contact with is Jason Baron, a short, portly guy who tries to land roundhouse punches during cross-examination but instead keeps slipping up on technical terms. He also wrote the Justice Department's reply to our initial complaint. In that brief, the Civil Division lawyer uncritically cited Marty Rimm's cyberporn study -- featured last summer on the cover of TIME magazine -- as an authoritative reference on net.smut: This article describes material located primarily on USENET newsgroups, i. at 1865-76, and on adult commercial bulletin boards (BBS), i. at 1876-1905. Defendants offer this as an initial reference of the availability and nature of obscene and indecent material from some on-line sources, such as USENET and BBS. [sic] Maybe Baron thought nobody would notice. But there's no excuse for not knowing that the study was deliberately fraudulent: The New York Times printed an editorial exposing it; Rimm's connections with "family values" groups have come to light; Donna Hoffman and I run extensive web sites debunking the study; Carnegie Mellon University claims to be investigating the ethical misdeeds of their former undergraduate. Even attorneys who used to work within Baron's division of the Justice Department complain that Baron deliberately foisted this fraud off on Federal judges: I'm embarrassed... They should have mentioned that the "study" came under heavy critical fire almost immediately upon release. I trust the opposition will make hay of this omission. In this context, this "study" is not just another controversial report, but one whose provenance is well known to be in doubt among the relevant actors. That much should have been ackowledged in the quoted footnote, at least along the lines of, "While the methodology of this study has been challenged, defendants believe it to represent..." etc. [4/7/96] By citing this study and appending its complete text without informing the court that it was a hoax, Baron revealed the impoverished ethics of the Justice Department. Interestingly, the Code of Professional Responsibility and the Rules of Professional Conduct make it a disciplinable offense for a lawyer to "knowingly use perjured testimony or false evidence." Under Title 11, attorneys can be sanctioned for introducing false evidence. Perhaps we shouldn't be too surprised by all this. After all, Baron is the same attorney who confuses EFF with IETF -- not to mention his additional duties as the DoJ's courtroom-cop. Recall that when I was asking the mysterious Grey Flannel Suit a question, Baron came over and interrupted us. Now I've learned that he's threatening to report me to "higher authorities" if I talk to his witnesses again. (!) Yeah, Grey Flannel Suit is going to take the stand. He's none other than the DoJ's cybersexpert witness -- Special Agent Howard A. Schmidt from the Air Force Office of Special Investigations. Guess that explains why Baron was so desperate to keep me from talking with him the other day. Baron's authoritarian streak showed again during the March 21 hearing, when I joined some members of the press in paging through the ACLU's copy of the DoJ's dirty pictures binder. Baron charged over and snatched it away, snarling: "Not available to the public." Well, the URLs ended up in my mailbox anyway, so here they are for your amusement: http://www.pu55y.com/hotsex/join.html http://shack.bianca.com/shack/misc/terms.html http://www.intergate.net/untmi/obbs1.html http://www.whitman.edu/~burkotwt/pornpics/lady941.jpg http://www.wizard.com/~gl944vx/gifs/01_21.jpg http://www.vegaslive.com/sgguests/ginger.html news:4hrs89k%24oap@what.why.net http://monkey.hooked.net/monkey/m/grinder/nikkita/graphics/nikki36.jpg news:313F56FD.3F19@access.mountain.net news:4hb94m%24sij@asp.erinet.com http://www.sexvision.com/web2.htm news:314048f.1657746@news.netwalk.com The DoJ has full-color printouts of these images, which are sexually explicit but *not* obscene -- Baron wanted to remind the court that placing these JPEGs online publicly would not be a criminal act without the CDA. For someone who's defending a ban on smutty stuff on the Net, Baron is surprisingly embarrassed to talk about it. Vanderbilt Professor Donna Hoffman reports: [Baron] deposed me for over 7 hours, beginning on a Monday morning at 9am. The most interesting part of the deposition was when he brought out several large binders and started going through some of the material in them and looking increasingly uncomfortable. Eventually, he spoke and started to apologize saying he might have to show me some materials and his New England background made him feel uncomfortable about it. He honestly was squirming and sweating a bit and then, after a brief lunch, we resumed and he did eventually show me some materials, but they were not surprising or of the type that I would have thought would make him squirm like that. I did wonder if it was some sort of "act," but he seemed genuinely embarassed. In hindsight, I wonder if it was because I am a woman and that was really the part that made the idea of showing me sexually explicit materials uncomfortable for him. I guess that Baron is a true "gentleman" who believes that certain topics like dirty pictures are unmentionable in mixed company. Avoiding embarrassment is just another reason to censor the stuff! On April 12, Grey Flannel Suit (aka Special Agent Schmidt) will take the stand and snarf around the net for dirty pix. He'll be followed by our last witness, MIT's Albert Vezza, and then BYU/CMU's Dan Olsen. Stay tuned for more reports. ----------------------------------------------------------------------------- We're back in court on 4/12, possibly 4/15, 4/26 for rebuttal, and 6/3 for closing arguments. Mentioned in this CDA update: DoJ's brief citing Marty Rimm's cyberporn study: <http://www.law.miami.edu/~froomkin/seminar/ACLU-Reno-TRO-Justice-brief.htm> Text of complaint from Fred Cherry v. Janet Reno: <http://fight-censorship.dementia.org/fight-censorship/dl?num=2108> Flamewar attached as exhibit to Fred Cherry v. Janet Reno: <http://fight-censorship.dementia.org/fight-censorship/dl?num=2109> Fred Cherry's reasons why he filed his lawsuit: <http://fight-censorship.dementia.org/fight-censorship/dl?num=1911> Relevant excerpt from Fred Cherry's original complaint: <http://fight-censorship.dementia.org/fight-censorship/dl?num=1891> Rimm ethics critique <http://www.cs.cmu.edu/~declan/rimm/> Censorship at CMU <http://joc.mit.edu/> The American Reporter <http://www.newshare.com/Reporter/today.html> Grey Flannel Suit <howardas(a)aol.com> Previous cases DoJer Jason Baron worked on: <http://www.eff.org/pub/Legal/Cases/Armstrong_v_President/> <http://snyside.sunnyside.com/cpsr/government_info/info_access/PROFS_CASE/> Joe Shea's complaints about ACLU wanting to "stand alone in the limelight": <http://fight-censorship.dementia.org/fight-censorship/dl?num=2014> <http://fight-censorship.dementia.org/fight-censorship/dl?num=2036> <http://fight-censorship.dementia.org/fight-censorship/dl?num=2037> This report and previous CDA Updates are available at: <http://www.epic.org/free_speech/censorship/lawsuit/> <http://www.eff.org/pub/Legal/Cases/EFF_ACLU_v_DoJ/> <http://fight-censorship.dementia.org/top/> To subscribe to the fight-censorship mailing list for future CDA updates and related net.censorship discussions, send "subscribe" in the body of a message addressed to: fight-censorship-request(a)andrew.cmu.edu Other relevant web sites: <http://www.eff.org/> <http://www.aclu.org/> <http://www.cdt.org/> -----------------------------------------------------------------------------

2 1