December 2003 - cypherpunks-legacy

PGP Comments Considered Occasionally Harmful Re: Pronto making a comment
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To cypherpunks, Re: mbabcock and Jim Ray's discussion. >> How did you get Pronto to do a comment? > >I added a "comment=" in my config.txt ;) ... the old fashionned way. ... >-----BEGIN PGP SIGNATURE----- >Version: 2.6.3i >Charset: ascii >Comment: http://www.cyberbeach.net/~mbabcock/PGP/ Note that the comment makes traffic analysis much easier. Sure, you can send your mail through five different remailers, but if each layer of PGP has your home page URL or some other distinctive Comment:, it's traceable. -----BEGIN PGP SIGNATURE----- Version: 2.7.1 Comment: PGP available outside U.S.A. at ftp.ox.ac.uk iQBVAwUBMif6ZvthU5e7emAFAQHh2AH/R4KY4MPQBjF2XCeeFCY5XPVQTePvPwT6 5MAAzyTL/8RwU0Ul7G7rQgeb/08CxqetC0Ry22AhMV8uEV6DgTbcLg== =4Ttw -----END PGP SIGNATURE----- # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> Reassign Authority!

1 0

FWD: Re: Tiger?
by Bill Stewart 17 Dec '03

17 Dec '03

Bruce Schneier wrote in sci.crypt : > > In article <505bms$2m1(a)kadri.ut.ee>, sander(a)haldjas.folklore.ee (Sander > Vesik) wrote: > > > Bruce Schneier (schneier(a)counterpane.com) wrote: > > : Tiger is a one-way hash function designed by Eli Biham and Ross Anderson. > > : It is optimized for a 64-bit chip (DEC Alpha). While interesting, Tiger > > : is very new, completely unanalyzed (except by the authors), and hence > > : still suspect. On the other hand, it's lightning fast on 64-bit machines. > > > > : Wired is displaying typical uneducated hype in its mention. I recommend > > : that everyone look at Tiger, but that no one use it yet. > > > > It is round 2.3 times faster than MD5 on my Pentium - so the part about > > high speed on the 32bit chips also seems to hold. > > It is certainly fast, and it is definitely not your typical snake oil. > It's just a mistake > to start using an algorithm immediately after it is published. > > Bruce > > ************************************************************************** > * Bruce Schneier APPLIED CRYPTOGRAPHY, 2nd EDITION is > * Counterpane Systems available. For info on a 15% > * schneier(a)counterpane.com discount offer, send me e-mail. > * > * For Blowfish C code, see ftp.ox.ac.uk:/pub/crypto/misc/blowfish.c.gz > ************************************************************************** -- # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # Dispel Authority!

1 0

IDEA and timing attacks
by Bill Stewart 17 Dec '03

17 Dec '03

John Kelsey <jmkelsey(a)delphi.com> wrote in sci.crypt > > -----BEGIN PGP SIGNED MESSAGE----- > > [ To: sci.crypt ## Date: 08/24/96 03:11 am ## > Subject: IDEA and Timing Attacks ] > > I'm still kind-of recovering from this year's Crypto conference, but > I told several people I would post this. At the rump session this > year, I presented an arguably practical timing attack on many > implementations of IDEA. There are actually two attacks available, > but one requires extremely fine timing results. After I gave the > presentation, Willi Meier told me he had independently found the > same results, and had implemented the full attack (which I hadn't > yet done). > > There are two different attacks. The most practical is an > adaptive chosen-plaintext attack, which requires about 5*n*2^{16} > chosen plaintexts (read ``five n times two to the sixteenth''), > where the parameter n depends on the precision of timings available > and the timing variability of the implementation. The second attack > is ciphertext-only, but requires timing measurements precise enough > to detect the difference between a single multiply of a zero vs. > nonzero value. It requires about 5*n*2^{16} values, as well. > > The basic idea behind the attack is as follows: in many > implementations, a zero input into the multiply operation is handled > by an if statement, and so does not cause a multiply instruction to > actually be executed. The result on a 486 is that it is > significantly faster to multiply by a zero rather than a nonzero > value. This timing difference gives us a really nice way to learn > information about the internal values of the cipher. > > This presentation is necessarily not very good, since I can't embed > a diagram here. If you have a copy of _Applied Cryptography_, then > turn to the section on IDEA (page 321 in the hardback version of the > second edition). The diagram shows one round of IDEA, and then > (after the ellipses) the output transformation. > > The chosen plaintext attack works as follows: > > 1. Build a run of n*2^{16} chosen plaintexts, by choosing a > single value for X_1, and choosing n of each possible value for X_3, > with X_2 and X_4 taking on values at random. Time the encryption of > each batch of n plaintexts with the same X_3 value. > > 2. Choose a new value for X_1, and then build another run of > chosen plaintexts exactly as above. > > 3. For each of these two runs, if the value of Z_5 is not zero, > there should be a different value for X_3 that gives the lowest > encryption time. (These are the values that force the input to the > multiply with Z_5 to be zero.) Call these X_3 and X_3'. This gives > us two equations in two unknowns, and we can solve for it with a > 32-bit brute-force search. (There may be faster ways, as well.) > > (X_1 (*) Z_1) = (X_3 + Z_3) > (X_1'(*) Z_1) = (X_3'+ Z_3) > > We now have recovered Z_1 and Z_3. > > 4. Let's call the input to the multiply with Z_5 A. We can use > knowledge of Z_1 and Z_3 to force A to keep the same value. We then > choose three new runs of chosen plaintexts, each containing 2^{16} > batches of n plaintexts apiece. Each of these ensures that A and > X_2 are kept constant, so that we wind up three difference values > for A, X_2 and X_4 which correspond to zero inputs into the multiply > with Z_6. This means that we wind up with three equations in three > unknowns. > > (A (*) Z_5) + ((Z_2 + X_2 ) XOR (Z_4 (*) X_4 )) = 0 > (A' (*) Z_5) + ((Z_2 + X_2' ) XOR (Z_4 (*) X_4' )) = 0 > (A''(*) Z_5) + ((Z_2 + X_2'') XOR (Z_4 (*) X_4'')) = 0. > > This can be solved with a 48-bit brute force search (there are > probably faster ways). We now have 80 bits of IDEA's key, and can > brute-force search the remaining 48 bits. > > Note that this is actually an adaptive chosen-plaintext attack as > described. I'm pretty sure this can be turned into a proper > chosen-plaintext attack with some work, and I'll probably be hacking > on this in the next few weeks, as time allows. > > The ciphertext only attack is simpler in some ways. The first 32 > bits are extremely easy to recover--find the average time to encrypt > blocks with each value in their first and last 16 bits, and then > solve for the subkey values that would be necessary for those > multiplies to have zeros as their inputs. Next, we look for a > correlation between low encryption times and the values for Z_3 in > the output transformation that would result in zero inputs into the > previous round's MA box multiply. Finally, we attack the second > multiply in that MA box, using all four output values. The > approximate computational difficulty is 2^{48}, as before. > > There are other timing attacks on IDEA. We gave one in our paper at > Crypto this year (the one on related-key cryptanalysis of several > ciphers, by Bruce Schneier, David Wagner, and me), and the > related-key timing attack is where I got the idea to try a timing > attack on the whole cipher. > > All timing attacks are implementation-dependent to some extent. On > a Pentium, I suspect the timing attack will be considerably harder. > (One person I discussed the attack with said he thought it would > take longer to do the conditional branch for the if statement than > to do the multiply, so we might have zero multiplies taking more > rather than less time.) > > Most applications aren't really susceptible to timing attacks, > because of the way they're used. In addition, chosen-plaintext > attacks on block ciphers are pretty nicely thwarted by using CBC or > CFB modes. It is probably also possible to implement IDEA so that > it executes in constant time. I should point out that it is *NOT* > enough either to add random delays (which fall out if you add more > samples), nor to just get rid of the big timing difference with zero > inputs (though that will make timing attacks somewhat more > difficult). As long as internal (secret) information is being > leaked by timing, the cipher is probably vulnerable to some kind of > timing attack. > > --John Kelsey, jmkelsey(a)delphi.com / kelsey(a)counterpane.com > PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 > > -----BEGIN PGP SIGNATURE----- > Version: 2.6.2 > > iQCVAwUBMh7GKEHx57Ag8goBAQEqGQQApXRQUMWz3gpJIwGrLbVhcgcpSMXyrq0g > iTi2qjH7dJjmWugpLnbm18XHzOPZMKizdZ/gin1O3Rk89dXfqK4sIICwY3QmkwFR > ZQ2My4mTUn27ibjAjZTDuvxLXnqqoOFRrMUTQGIlMTCZdBooSWrif+pTLQbIsoPr > saHlDl2bWts= > =tWIq > -----END PGP SIGNATURE-----

1 0

Local Obscenity Regulations
by Sean Sutherland 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com Date: Sat Aug 31 05:05:19 1996 If the BS coming from the Observer wasn't bad enough, check this out: http://www.cnet.com/Content/News/Files/0,16,2316,00.html Seems that Oregon has a ballot up for measure which will allow each city and county to decide for itself what obscenity is. I'm really not sure if this'll hold up or not, but I can see every hick sheriff in the state trying to get his fame by busting someone or something. - --- Sean Sutherland | GCS/C d- s+:+ a--- C+++ V--- P L E- W++ N++ K- w o PGP Key ID: E43E6489 | O-(++) M-- V PS+ PE++ Y++ PGP++(+) t--- 5+++ X++ R Vote Harry Browne '96 | b++ DI+ D+ G e- h! !r y -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: For key finger me or http://www2.interconnect.net/maverick iQEVAwUBMigOYVZoKRrkPmSJAQEUIwf+O/J8Uy9ZThNnnNagwROWj6uFww8Nuktf Y1m5rV3dGEyNxGVgaNh4hubI56vUodvk2RhjDrELvc7dwwxgDzK0YNvFk7vmzVFD o8IT/FjRwCIxx2OUwV2e8jnRiP3okTRecmRpeeL0GaUqulYSsijaTnjTofapARYU 18PpKJxrgJg5a07ybdU4B5JVJ7HzAraY/w32LIGTqRNhoRcORvcox0FDLnswNk7W ALh4dhCBMyQEhey/v/RfFwjtEBTIarjA6b8zUf+dFweRsNWZAdCugpNWNv6OE65h in1x5PFttn7ldad2c0PNN7fsu5NUCIjSQNljRsyTnkO1Jctp3Z02mw== =W3Vk -----END PGP SIGNATURE-----

2 1

Building the Singapore Free Press
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

Suppose you wanted to build a free press for a country like Singapore that has a government that doesn't want one - on the net, from the inside and outside. What tools would you need? Assume a Firewall Curtain proxy that can block sites and keywords but can't really block encryption. Also assume that the ISPs inside the Firewall Curtain can't do much to help you, given government licensing and other threats. How can you help people communicate with each other without interference? The Web isn't a bad tool for it, but it's easy to block specific web sites and specific host machines, so you'd need some combination of replication and DNS-manipulation to let sites change names conveniently and frequently. Has anybody developed a good DNS mechanism for reassigning namespace conveniently (e.g. a meet-me system allowing any machine to connect up to a given name, so anybody who wants to can be foobar23.remailer.net)? There are web conferencing tools that would be a decent user interface. You'd need some mechanism for anonymous submissions; remailers and web-based forms both work. Journalists have a long history under pseudonyms in British colonies and other non-free territory :-) You'd need a mechanism for finding the news from inside SG; search engines like AltaVista can pretty much handle that except that you need a method for sending encrypted requests, so the Firewall Curtain can't block them and the government can't tell what you're searching for. Perhaps an SSL-protected form with a CGI to submit to AltaVista? Does anybody know the protocols of the Firewall Curtain well enough to slide things into the cache? (This is an httpd hacking question....) What other tools would be useful? # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> Reassign Authority!

1 0

singapore and penet
by morgan＠keilin.helsinki.fi 17 Dec '03

17 Dec '03

There is a report in a Helsinki newspaper (Helsingin Sanomat 31 Aug 1996, p A11) that the Singapore government has asked Finland to help them obtain the name of a person who posted via anon.penet.fi to usenet. Apparently the messages in question criticize the strict laws in Singapore and were signed using the name of the former prime minister Lee Kwan Yew. -- ===================================================================== Joel.Morgan(a)Helsinki.FI http://blues.helsinki.fi/~morgan =====================================================================

1 0

Re: anon.penet.fi closing down
by qut＠netcom.com 17 Dec '03

17 Dec '03

! what would be alternatives to anon.penet.fi..... ! ========================================== ! Blake Wehlage <jwilk(a)iglou.com> ! ±» RëVðLû¡ØÑ Bø+ ©ÖmP@ñ¥ «± ! Goto: http://members.iglou.com/jwilk Gee, aren't you already using an account you started with fake personal data?

1 0

WashPost report on airline security plan
by David Lesher 17 Dec '03

17 Dec '03

Today's WashPost reports that one plan the new commission is studying is a massive Big Brother database of any&everyone boarding a plane. ""Suspects"" will then be subjected to extra attention. -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

4 3

Waging War On Singapore
by qut＠netcom.com 17 Dec '03

17 Dec '03

So what is the information that the Singapore dictatorship is trying to ban? Whatever it is, the Singapore internal networks should be flooded with it. How to get an internet account in Singapore, preferably anonymous?

2 1

WARNING vIRuS!
by kickboxer 17 Dec '03

17 Dec '03

There is a new and VERY dangerous virus called the HAZ-MAT virus! it fucks up the sectors on your hd, and really messes up the partition tables. It does this once a week, picking a random time to do it. 99.9% of virus scanners and other antivirus programs will not recognize it, for it is a totally new strain, using a never before seen code.... Be warned! The HAZ-MAT virus usually resides in JPG, and GIF files... once the files are viewed, the virus takes effect. scan all images upon download!

4 4