December 2003 - cypherpunks-legacy

Re: Child Porn as Thoughtcrime
by Hallam-Baker 17 Dec '03

17 Dec '03

Declan McCullagh wrote: > Not so, says Bruce Taylor, the chief architect of the CDA and a > professional cyber-scaremonger. The former Federal porn-prosecutor > believes that "not all censorship is bad." > > "Foreign countries have an obligation to restrict obscenity and child > pornography on the Internet by the treaty of 1911," says Taylor. "It's > an agreement between the states to cooperate and to use international > laws to prosecute obscenity." And to Taylor, books and copies of > Penthouse magazine can be obscene. The status of such treaties governing internal policies is very suspect. In the first place a great many of the countries that signed the original treaty will not exist. Technically neither Germany nor France exist in that form since both have been reformed under entirely new constitutions. In addition it is always open to a soveriegn nation to abrogate a treaty. This may entail sanctions but unless the UN were involved it would be unlikely in the extreeme that any significant effect would be caused. At this stage a UN resolution would seem more relevant than a treaty from 1911 intended to entrench Victorian morality. As a European I note that the US happily gives itself the "right" to unilaterally withdraw from treaties of far more significance such as SALT-II or GATT on entirely spurious grounds. The US has also withdrawn from the World court after being found guilty of terrorist acts in Nicaragua. As such the likes of Bruce Taylor don't exactly have a strong case. If the US thinks it can pick and choose amongst its international obligations then other countries are likely to consider they have equal rights to do so. I don't think that kiddie porn is likely to be the breaking factor however. Anyone who has been following the European news will understand that recent events in Belgium makes that exceptionaly unlikely. I think it most unlikely that any President would be foolish enough to send Mr Taylor over to explain US demands. He is transparently disingenuous and conveniently ill-informed. The small town American parochialism he represents is even less popular in Europe than in California or amongst East coast intellectuals. Where I see a more likely breaking point is over cannabis which many countries are finding disproportionately expensive to control. Since the US is rapidly becomming the worlds largest supplier demands from that quarter may be treated with less than full concern. Spain and the Netherlands have both reformed their drug laws and the UK may well end up doing so in the long term, reform of the prostitution laws will probably come first however. Phill

1 0

Re: One Time Reply Blocks (was Re: strengthening remailer protocols)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:56 PM 9/11/96, Bill Frantz wrote: >Let me float one more hair-brained idea. I think Tim May is right in >saying that the most secure response technique is the one in Blacknet. >i.e. The response are posted to some public bulletin board, and then Alice >reads them at her leisure. > >I see two problems with this approach: (1) It doesn't scale well, and (2) >Alice's reading of the response may be detected. (I think of the vans in >Great Britain which listen to the local oscillator frequency of TV sets to >find what people are watching.) I agree that message pools have interesting scaling problems. If most messages are in the same large pool, and lots of people are using pools, then that pool could become very, very large. However, we are many _years_ away from this situation, and a very large number of _text_ messages (as opposed to JPEGs) can be put in a few dozen megabytes of pool space. I contend that many "scaling problems" turn out to be relatively unimportant, for various reasons. (And scaling problems should not be a reason not to deploy a simple system...odds are that other factors will enter long before the system breaks. The Xanadu people may have worried too much about hypertext database scaling problems, while the more straightforward HTML/URL hypertext scheme actually got deployed and changed the playing field completely.) There are also likely to be various kinds of pools, thus partly solving the scaling problem by hierarchies. (This could worse the traffic analysis--who is reading what--problem, though.) On the traffic analysis problem, I also think this is overrated as a risk. The likelihood that the TLAs could figure out which of the messages in "alt.anonymous.messages" I am actually interested in are small. And there are PageSat-type distribution systems, @Home-type cable distribution systems, etc. (My DSS satellite has provisions for a digital feed...it is reported to be coming soon.) Reply-blocks are a _clear_ problem, while message pools have various basic advantages. I would worry more about scaling when volume is 1000 times what it now is. (And digital postage solves a lot of scaling problems.) --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Ban CU Secrecy, Keep TLA's!
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> > Mr David Bickford, the first British intelligence lawyer > to speak publicly in the UK, said at a conference in > Cambridge, 50 miles north-east of London, that there > "appears to be no justification at all for offshore bank > secrecy other than to protect the criminal". Apart from tehe confidentiality of the customer, bank, all those they trade with and all other interested parties, well then, they can`t be that important can they > > He said "offshore bank secrecy can and must be abolished" > and "the UK should be the first to abolish this secrecy > given their control of their dependent territory offshore > centres". So because we choose to maintain a statist and totalitarian empire we had better set an example of how to do it to the rest of the world??? > > Mr Bickford, who now runs an international legal > consultancy, said "endemic corruption" is caused by > offshore secrecy, and it is "difficult to see why it is > tolerated by any other than those with an unlawful > disposition". It is also diffult to see why I don`t go round to mr. Bickfords house and kill him, his dog, and his pet hamster, but I don`t, nor do I intend to, to say that we cannot see a reason for people wanting privacy is no justification for legislation that prohibits such privacy. <for any spook agencies etc. reading the above, it is NOT a death threat, it is a sarcastic comment> > He said allowing countries to maintain offshore banking > secrecy is "a classic example of the corruptive influence > of organised crime". It is a classic example of privacy and freedom in a free society (not that I believe Britain falls into this category) Has anyone got this guys IQ, it`s probably the first ever negative IQ in the history of the world, cheer everyone, its a historic find. Mr. Bickford, I believe you to be a fuckwit, feel free to prove me wrong.. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Http://www.fatmans.demon.co.uk/crypt/ "Don`t forget to mount a scratch monkey" -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCNAjH9j+cAAAEEAMBvREiQR0ot9dFCO0TiSCSunAYLv2g1Bc6I3bz8FzKXNH53 6mieJf/W4rD+CxJpT0q9RQaaoRtkHJLwbjfK2il3D7mEahMAyqvF/xRJNqkXfhM3 sRJM0Jh43l+W0M5vwokbEbk25/bxWWGspTsLD3YHbzKnG6pOcL5OPIRbv66xAAUR tCdQYXVsIEJyYWRsZXkgPHBhdWxAZmF0bWFucy5kZW1vbi5jby51az4= =riHc -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Digital rights organisation
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:46 AM 9/11/96, Stephan Schmidt wrote: >Hi, > >thinking about what happend in Germany, >are there any 'digital rights' organisations >in Germany ? > >If not, we would like to found one. >Are there any international orgs (EFF?,...) >who can help us ? A wonderful idea, Stephan! You might try contacting EFF to see if a German branch exists (though EFF is not a strongly member-oriented organization, though people tell me this may be changing). Germans should embrace the idea that the cure for bad speech is _more_ speech. Specifically, for the current German concerns, the "cure" for speech by semi-Nazi skinheads and Holocaust deniers is free and open speech. Hard to deny the Holocaust when web sites have thousands of pictures, when archives exist. (And when speech saying the Holocaust "never happened" is outlawed, a certain fraction of the population thinks it's cool and chic to engage in this speech! Human psychology and all. This is probably what 90% of the skinheads are all about, plus some run of the mill hatred toward Turks and other immigrants who they think are taking away their jobs....) I understand that Germans have free speech in a lot of areas, and have less censorship of sexual material than the U.S. has (television, especially). But the areas where they _do_ censor, such as discussion of the Second World War and related issues, are the ones the world see. Germany needs to embrace completely free speech. This is the best way to ensure that another dictator like Hitler does not get elected to power. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Conjuring up the latest utopia for a minoritarian sect of illuminati
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:43 PM 9/11/96, Dr.Dimitri Vulis KOTM wrote: >tcmay(a)got.net (Timothy C. May) writes: >> And who might these people be? I suggest you name them, as I have not even >> mentioned your name to anyone. You don't rate a complaint from me. > >E.g. Kelly Goen is one of the people who told me that Tim May's been >complaining about my alleged "spit" posts. I've only spoken to Kelly Goen _once_ in many months, and he was calling from his cellphone and we only talked for a few minutes. I don't recall mentioning Vulis. So, who are these "various people"? >Note that Kelly's not on this mailing list (unlike at least two other >people who said to me that Tim complained to them off-list) and that >most of the posts Tim complains about are obvious forgeries. Who are these "at least two other people"? I _do_ think you're a loon. Not in the endearing sense of some net.loons, but in the peculiar kind of foaming-at-the-mouth lunacy that I've seen in several Russian and Armenian emigres. --TCM We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Child porn as thoughtcrime
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:51 PM 9/11/96, Chuck Thompson wrote: >The answer to the all the questions in the first set is yes, in this country >anyway, if they are interpreted by the legal system as intending to incite >illicit sexual acts, fantasies or obsessions about children. The fantasies >or obsessions are assumed to lead to the illegal acts. You later mention that "Intent to commit an actual crime must be proven." Saying that fantasies or obsessions are assumed to lead to crimes is the same as thoughtcrime. >>Clearly the first argument applies to many other things. Why not outlaw >pro-drug speech? > >Hold on here.. you are making an invalid comparison. To my knowledge, >there is no law against speaking in favor of child porn, any more than there >is against speaking in favor of drug usage. It against the law to *use* >either of them. Writing a pro-drug article on the joys of marijuana use, on the pleasures of opium, on the "naturalness" of various herbs, etc., would seem to me to be essentially "drug pornography" (by the standards of porn laws). To use your quote, "The fantasies or obsessions are assumed to lead to the illegal acts." (By the way, the language of pro-censorship anti-pornography crusaders is being adopted by other special interest groups. Sarah Brady has called for restrictions on what she calls "gun pornography," and there are a lot of people trying to "clean up" television and movies by controlling "the pornography of violence." By your various arguments that "fantasies and obsessions" can lead to later crimes, are they not behaving as you would wish them to? If thoughtcrime about how cool guns are can be eliminated, we can save the children from gun violence!) ... (my quote left in for context) >>The second argument, that children are actually harmed, is vitiated by the >fact that >much so-called child porn comes from countries where the actors >are of legal age. >>How can a 14-year-old Thai girl be "harmed" when what she is bing paid to >do is >>perfectly legal in Thailand? > >There you go again.. being legal does not, in any way, mitigate it's >harmfulness. There may be places on this earth where it is legal to ??? Are you saying that the legal system should punish people for perfectly legal behavior which is "harmful" (putatively, in a future or "inspiration" sense) to people? (The civil litigation community is of course in agreement with you: Sue gun manufacturers for crimes committed using their guns. Sue the makers of rock climbing equipment for the harm done to rock climbers, even though voluntary. Sue the horseback riding farms for falls suffered by riders. Sue tobacco companies for the lung cancer of smokers. Sue MacDonald's for the high cholesterol-induced heart attacks of customers. Sue the director of "Natural Born Killers" on behalf of victims murdered in "copycat" cases. Sue the author of "Lolita" for inspiring sex crimes. Sue.....) >>And the case of morphings, drawings, stories, etc., clearly involve no >actual children, >so the argument that children are harmed is empty. > >The argument is not dependent upon whether or not actual children are used, >any more than whether or not an actual gun is used in a robbery - the net >effect is the same. Children are harmed by the promotion of child porn >because it leads to the abuse/exploitation of kids. You seem to be arguing for class-based rights and wrongs. Does promotion of capitalism lead to the abuse and exploitation of workers? Perhaps we could outlaw pro-capitalist writings. Does pro-drug speech lead to drug abuse and misery? (Probably it does, of course.) As I asked earlier, should pro-drug speech be outlawed? (You earlier implied that of course it should not, that pro-drug speech is protected. But if it probably leads to consumption of drugs, as nearly everyone on both sides of the issue will likely agree, isn't it the same as your point about child porn?) .... >First, you must separate opinions from actions. In this country, opinions >are not ever illegal. Some actions are. The illegality is probably (I'm Do you mean _unspoken opinions_? If so, I agree--after all, if never spoken, the opinions are unknown to others, not even to Big Brother. If, however, you mean that "_expressed_ opinions are not ever illegal," this is clearly false. Sedition laws are still on the books, as are laws outlawing the "advocacy" (an uttered opinion, surely) of various things. (I believe it was Eugene Debs who spent time in prison for expressing the opinion that the United States should not be in the Great War, or that the draft should be abolished, or something related to this.) >which we deem to be in our best interests. And, as long as the laws which >are passed do not violate our constitution, the underlying basis for passing ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Such as the "Congress shall make no law" language in the most important items in the Bill of Rights? Just where in the Constitution is it said that speech may be limited so as to reduce "fantasies and obsessions"? I read the Constitution as saying this may not be done, and I read most later Supreme Court interpretations as saying that limitations on speech may only be implemented if there is a compelling need to protect other basic rights (a la the infamous "falsely shouting "Fire!" in a crowded theater"). >Your case is weak, because it is based on the false premise that the >illegality of child pornography equates to illegality of thought. It is >overt action which is illegal, not thought. None of the acts I described in my piece involved _actions_ against children in the United States. Drawing a picture or writing a story is _speech_ (in the accepted definition of speech, thought, expression of views, literature, etc.). Morphing an image of Raquel Welch is speech. And so on. This is not sophistry, this is a statement of what is really happening. No actual child is involved. If one argues that speech which may lead to later crimes, by other people, can and should be outlawed, then Pandora's Box is truly opened for limiting vast amounts of speech. Words _do_ have impact, tremendous impact in fact. Free speech _can_ and _does_ lead to others committing crimes, killing themselves, acting stupidly, undermining society, even having "fantasies and obsessions." Get used to it. >By the way, Tim, I found your "translation" to be offensive, crude and >deliberately provocative. I do, however, support your right to publish it. What if it inspires a young girl to think more positively about having an incestuous relationship with her father? Mightn't it inspire "fantasies and obsessions"? And under the CDA, it's probably illegal, given that various 13- and 14-year-olds are reading this list. --Tim May -- [This Bible excerpt awaiting review under the U.S. Communications Decency Act of 1996] And then Lot said, "I have some mighty fine young virgin daughters. Why don't you boys just come on in and fuck them right here in my house - I'll just watch!"....Later, up in the mountains, the younger daughter said: "Dad's getting old. I say we should fuck him before he's too old to fuck." So the two daughters got him drunk and screwed him all that night. Sure enough, Dad got them pregnant, and had an incestuous bastard son....Onan really hated the idea of doing his brother's wife and getting her pregnant while his brother got all the credit, so he pulled out before he came....Remember, it's not a good idea to have sex with your sister, your brother, your parents, your pet dog, or the farm animals, unless of course God tells you to. [excerpts from the Old Testament, Modern Vernacular Translation, TCM, 1996]

1 0

Re: Child Porn as Thoughtcrime
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 8:48 PM 9/10/96 -0700, Declan McCullagh wrote: >On Tue, 10 Sep 1996, Timothy C. May wrote: > >> Q: Is a drawing of a child engaging in a sexual act an illegal item? > >Under the original Hatch bill, yes. Certainly under the revised one. Of >course, Hatch's proposal goes even farther. There's no "sex act" requirement. >Judy Krug from the ALA testified about this, opposing Bruce Taylor. > >> Q: Is an image of Raquel Welch morphed to make her look like a 15-year-old >> illegal? > >Even under the original Hatch bill, yes. It seems to me that the logic of these answers would make the movie, "Carried Away" illegal. According to a Boston Globe review (reprinted in the local rag), "... his character cheats on his longtime girlfriend with a new student who's only 17, ..." Depending on how this is depicted in the movie (Rated R), it seems to me that this could go over Hatch's line. (BTW, the review rates the movie 3 stars out of a possible 4.) ------------------------------------------------------------------------- Bill Frantz | "Lone Star" - My personal | Periwinkle -- Consulting (408)356-8506 | choice for best movie of | 16345 Englewood Ave. frantz(a)netcom.com | 1996 | Los Gatos, CA 95032, USA

1 0

[Long] A history of Netscape/MSIE problems
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

I've been putting together a writeup on problems in web browsers, mainly the history of the Netscape RC4/40 break, random number bugs, and problems with Java, as part of a longer paper I'm doing on crypto from a non-US perspective. A lot of the information in this section of the paper has come from this list, so I thought I'd post it for comment and in case anyone found it interesting (please don't post it to web sites or anything until the paper is actually published). If anyone has anything to add, corrections to make, etc, please let me know. Peter. The Netscape SSL Break and its Implications ------------------------------------------- The Secure Socket Layer (SSL) protocol, after a somewhat shaky start (version 1 was broken within 10 minutes of being unveiled [Hallam-Baker 1996]), and an attempt by Microsoft to promote a similar but competing protocol [Benaloh 1995], has more or less edged out any other protocols to become the standard for securing HTTP sessions (an overview of SSL and various other proposed WWW security mechanisms is given in [Reif 1995a]). SSL uses a combination of RSA and, usually, a proprietary (until it was reverse-engineered, of which more later) algorithm called RC4 to provide confidentiality, data integrity, and authentication. Since it was built into what was by far the most popular web browser, and because of Netscape's policy of giving away the software, it immediately gained widespread popularity. No details on RC4 were published, but the fact that it was designed by a very good cryptographer was enough to reassure most people. RC4 is used in dozens of commercial products including Lotus Notes, a number of Microsoft products such as Windows for Workgroups, Windows 95, Windows NT, and Access, Apple's AOCE, and Oracle Secure SQL. The main criticism of SSL (apart from a few protocol flaws which were fixed in later versions) was the fact that RC4 used a key of only 40 bits, making it susceptible to a brute-force attack. The reason for the 40-bit key and (according to RSADSI, the company that developed RC4) the reason why details on it were kept secret was that these conditions were required under an agreement between the Software Publishers Association (SPA) and the US government which gave special export status to the RC4 algorithm and a companion algorithm called RC2. Implementations of RC2 and RC4 which are restricted to a 40-bit key get automatic export approval provided the implementations work correctly with a set of test vectors supplied by the NSA. Provided the results are as expected, export approval is granted within a week. The weakness of the encryption in US-exportable SSL implementations even led the French government, which normally bans all non-government-approved use of encryption (the "decret du 18 avril 1939" defines 8 categories of arms and munitions from the most dangerous (1st category) to the least dangerous (8th category), the "decret 73-364 du 12 mars 1973" specifies that encryption belongs to the second category, and the "loi 90-1170 du 29 decembre 1990" states that use of encryption equipment must be approved by the French government), to approve the use of Netscape in France [Vincent-Carrefour 1996], presumably because the French government has no problems in breaking it. The first step in attacking SSL was to find out how RC4 worked. Since it was in widespread use, it was only a matter of time before someone picked the code apart and published the algorithm. RSADSI sell a cryptographic toolkit called BSAFE [BSAFE 1994] which contains RC4, and this seems a likely source for the code (the Windows password encryption code is also a good source, and the algorithm can be extracted in an hour or two). The results were posted to mailing lists and the Internet [Anon 1994a]. Someone with a copy of BSAFE tested it against the real thing and verified that the two algorithms produced identical results [Rescorla 1994], and someone else checked with people who had seen the original RC4 code to make sure that it had been (legally) reverse-engineered rather than (illegally) copied [Anon 1994b]. The RC2 code was disclosed in a similar manner in 1996, but after problems with legal threats during the RC4 disclosure process it was handled more formally: First an RC2 implementation was reverse-engineered [Anon 1996], then a specification for the algorithm was written based on the reverse-engineered code [Gutmann 1996], and finally a new implementation based on the specification was written by someone who had never seen the reverse-engineered RC2 code [Vogelheim 1996]. No legal threats were ever issued over RC2. The RC4 code was immediately subject to intense analysis in various cryptography-related fora. RC4 has two parts, the initialization phase, and the random number generation phase used for the encryption itself. An array is initialized to be a random permutation using the user's key. The random number generator then mixes the permutation and reports values looked up pseudorandomly in that permutation. Among various RC4 problems which were discussed are that the likelihood that during the initialization phase small values will remain in small positions in the initial permutation is too high; user keys are repeated to fill 256 bytes, so 'aaaa' and 'aaaaa' produce the same permutation; results are looked up at pseudorandom positions in the array, and if some internal state causes a certain sequence of positions to be looked up, there are 255 similar internal states that will look up values in the same sequence of positions (although the values in those positions will be different), from which it can be shown that cycles come in groups of 2^n, where all cycles in a group have the same length, and all cycles are of an odd length * 256 unless they are in a group of 256; there is a bias in the results so that, for example, the pattern "a a" is too likely and the pattern "a b a" is too unlikely, which can be detected only after examining about 8 trillion bytes; the internal state is not independent of the results, so that with a given result there are two patterns in the internal state that appear 1/256 times more often than they ought to; at least two seperate methods exist for deducing the internal state from the results in around 2^900 steps; and under certain special circumstances the initial byte of the pseudo-random stream generated by RC4 is strongly correlated with only a few bytes of the key. All of these "weaknesses" except for the last one are purely theoretical in nature, and even the last one can only occur under special circumstances (it doesn't affect SSL implementations since they hash the key with MD5 rather than using it directly, which avoids the problem). Overall, the cryptographic community agreed that RC4, when used correctly, was a sound cipher. Unfortunately, due to the US export restrictions, RC4 couldn't be used correctly. Although Netscape negotiated a 128-bit key to protect each session, it sent 88 of those 128 bits in the clear so that only 40 bits of the key were actually kept secret. Now that RC4 was known, SSL became a prime target for attack. An initial attempt at breaking RC4 was made in July 1995 using encrypted data from a Microsoft Access database [Back 1995a]. This attempt involved 89 contributors and took about a week using idle computing time on workstations and PC's, with around 80% of the work being done by the top 19 contributors. Due to logistical problems, human error, and buggy software, the attempt ultimately failed, but the stage had been set for an attack on SSL. On 14 July 1995, an SSL challenge message containing an encrypted (fake) credit card order transmitted to one of Netscapes own computers was posted to mailing lists and the Internet by Hal Finney [Finney 1995a]. The challenge message was independantly broken by two groups, the first to announce success in breaking it was a French researcher using idle time on a collection of 120 computers and workstations over 8 days [Doligez 1995a] [Doligez 1995b]. The 40-bit secret part of the key was 7E F0 96 1F A6, and was found after scanning just over half the key space. The average search speed was about 850,000 keys/s, with a peak of 1,350,000 keys/s. A second group had broken it two hours earlier, but announced their success a day later [Back 1995b]. The event immediately attracted international media attention, including newspaper, radio, and television coverage (although many reports were rather garbled) in France [Munger 1995], Germany [Reif 1995b], Japan [NewsBytes 1995], the UK [Arthur 1995], and the US [Beck 1995] [Sandberg 1995]. A second challenge was posted on 19 August 1995 [Finney 1995b] and an attack by a `Brute Squad' of 201 Internet-connected volunteers began at 1800 GMT on 24 August 1995. The attack involved greatly improved software with automatic communication between client workstations attacking the encryption and a central server which doled out sections of keyspace to search [Brooks 1995]. This setup took 31.8 hours to find the key, 96 36 34 0D 46. Congestion on the server being used to coordinate the attack meant that most of the machines involved were idle for perhaps 3/4 of their available time, so in theory the attack could have been completed in only 8 hours. Both the client and server software was continually upgraded during the duration of the attack. The attacks, which used only unused processing capacity on the machines, were essentially "free", and could easily be mounted using the spare processing capacity available in companies, businesses, universities, and foreign governments. By breaking a brute-force attack into a number of independant sections, as many machines as are needed can be applied to the problem, so that each doubling of the amount of hardware applied to the problem halves the time required to find the solution. Although the total investment will have doubled, the cost per recovered key is kept constant since twice as many keys can now be found in the same time. Another possibility which has been suggested is the creation of an RC4-breaking screen saver for networked Windows machines which performs key searches during the (often prolonged) periods in which machines are left idle. One experiment in performing this kind of attack took 2 weeks using relatively slow 486/50's and Sparc 20's, with noone the wiser that the machines were being used overnight for this purpose [Young 1996]. Another attack involved a networked Windows screen saver where the client software was activated whenever a machine was otherwise idle and communicated its results to a central server on a network with around 100 PC's. By now, breaking the Netscape encryption had become a kind of processor benchmark, with one manufacturer rating the speed of their system based on how long it took to break RC4 - 8 hours on one computer [ICE 1996]. Further improvements to the attack were proposed. The most important one was to move from attacking one message at a time to attacking entire collections of messages. Instead of generating a key and testing it against a single message, it could be tested against 100 messages, so that in average one key could be found in 1/100th the time it took for a single message. Unfortunately in the case of SSL this wasn't possible, since although only 40 bits of key are kept secret, there are still a total of 128 unique key bits for each message, making it impossible to attack more than one message at a time. In effect the remaining 88 bits of key act as a `salt' in the same way the Unix password salt works. However a more simplistic implementation which uses only 40 bits of key could be attacked in this manner. The attacks on RC4 are a prime example of a publicity attack. They were carried out by volunteers using borrowed machine time, noone (apart from Netscapes stock prices) was harmed, and they achieved a great deal of publicity. The intended goal - of proving that the restricted encryption allowed by the US government could be broken - was achieved. This fuelled intense debate within the US about the need to lift the export restrictions in order to facilitate electronic commerce. Virtually every article covering the encryption debate would eventually refer to the ease with which the 40-bit keys of the form used in SSL could be broken (see for example [Ante 1996]). The fact that it was completely uneconomical to mount a criminal attack on 40-bit SSL keys was mostly ignored (except in Netscape press releases). The enthusiasm for Internet commerce, especially commerce protected by SSL, was severely dented, and companies began to adopt a more cautious attitude in deploying commercial services over the net. [Anon 1994a] `David Sterndark' (an alias), "RC4 Algorithm revealed", posting to sci.crypt newsgroup, message-ID <sternCvKL4B.Hyy(a)netcom.com>, 14 September 1994. [Anon 1994b] Anonymous, "`Alleged RC4' not real RSADSI code", posting to sci.crypt newsgroup, message-ID <9409250900.AA17035(a)ds1.wu-wien.ac.at>, 25 September 1994. [Anon 1996] Anonymous, "RC2 source code", posting to sci.crypt newsgroup, message-ID <4ehmfs$6nq(a)utopia.hacktic.nl>, 29 January 1996. [Ante 1996] Spence Ante, "Everything You Ever Wanted To Know About Cryptography Legislation. . .(But Were Too Sensible to Ask)", PC World, May 1996. [Arthur 1995] Charles Arthur, "Internet's 30bn Pound Secret Revealed", UK Indpendent, 17 August 1995. [Back 1995a] Adam Back, "Announce: Brute force of RC4, 40 bits all swept", posting to sci.crypt newsgroup, message-ID <DC08Dz.LwG(a)exeter.ac.uk>, 20 July 1995. [Back 1995b] Adam Back, "Another SSL breakage...",. posting to cypherpunks mailing list, 17 August 1995. [Beck 1995] Alan Beck, "Netscape's Export SSL Broken by 120 Workstations and One Student", HPCwire, 22 August 1995. [Benaloh 1995] Josh Benaloh, Butler Lampson, Daniel Simon, Terence Spies, and Bennet Yee, "The Private Communication Technology Protocol (PCT)", Microsoft Corporation, October 1995. [Brooks 1995] Piete Brooks, "Cypherpunks `brute' key cracking ring", http://www.brute.cl.cam.ac.uk/brute/. [BSAFE 1994] BSAFE 2.1 software, RSA Data Security Inc, 1994. [Doligez 1995a] Damien Doligez, "SSL challenge -- broken!", posting to sci.crypt newsgroup, message-ID <40sajr$sps(a)news-rocq.inria.fr>, 16 August 1995. [Doligez 1995b] Damien Doligez, "SSL challenge virtual press conference", http://pauillac.inria.fr/~doligez/ssl/press-conf.html. [Finney 1995a] Hal Finney, "SSL RC4 Challenge", posting to sci.crypt newsgroup, message-ID <3u6kmg$pm4(a)jobe.shell.portal.com>, 14 July 1995. [Finney 1995b] Hal Finney, "SSL Challenge #2", posting to cypherpunks mailing list, message-ID <199508191525.IAA16294(a)jobe.shell.portal.com>, 19 August 1995. [Gutmann 1996] Peter Gutmann, "Specification for Ron Rivests Cipher No.2", posting to sci.crypt newsgroup, message-ID <4fk39f$f70(a)net.auckland.ac.nz>, 11 February 1996. [Hallam-Baker 1996] Phill Hallam-Baker, "A problem with Navigator's cache -Reply", posting to www-security mailing list, 25 August 1996. [ICE 1996] Integrated Computing Engines, "MIT Student Uses ICE Graphics Computer To Break Netscape Security in Less Than 8 Days", 10 January 1996. [Munger 1995] Benoit Munger, "Cachez ces mots que je ne saurais lire", Le Devoir, 28 August 1995. [NewsBytes 1995] "Netscape Encrypted Data Cracked", NewsBytes, Tokyo, Japan, 18 August 1995. [Sandberg 1995] Jared Sandberg, "French Hacker Cracks Netscape Code, Shrugging Off U.S. Encryption Scheme", The Wall Street Journal, 17 August 1995, p.B3. [Reif 1995a] Holger Reif, "Netz ohne Angst: Sicherheitsrisiken des Internet", c't Magazine, September 1995, p.174. [Reif 1995b] Holger Reif, "Peinliche Panne: Netscape gibt ernsthafte Sicherheitslu"cken zu", c't Magazine, November 1995, p.26. [Rescorla 1994] Eric Rescorla, "RC4 compatibility testing", posting to cypherpunks mailing list, message-Id <9409140137.AA17743(a)eitech.eit.com>, 13 September 1994. [Trei 1995] Peter Trei, "Netscape's SSL security has been compromised", posting to comp.security.misc newsgroup, message-ID <40t4ti$b8s(a)iii1.iii.net>, 16 August 1995. [Vincent-Carrefour 1996] Jacques Vincent-Carrefour, "Autorisation de fourniture et d'utilisation generale de moyens de cryptologie No.2500", 509/DISSI dossier numero 950038, 7 November 1995. [Vogelheim 1996] Daniel Vogelheim, "RRC.2 implementation available", posting to sci.crypt newsgroup, message-ID <4g5u20$e4k(a)news.rwth-aachen.de>, 19 February 1996. [Young 1996] Eric Young, "Bank transactions on Internet", posting to cypherpunks mailing list, message-ID <Pine.SOL.3.91.960409104403.28771C-100000@orb>, 9 April 1996. (In)Secure Internet Electronic Commerce --------------------------------------- After the RC4 attacks, researchers looked for other weaknesses in Netscape. In September 1995 it was discovered that Netscape didn't check the amount of input it was fed, leading to internal buffers being overrun [Green 1995] [Neumann 1995]. This bug also existed in other browsers such as Mosaic and IBM's WebExplorer. By carefully adjusting the data fed to the browser, it was possible to force a victims PC to execute arbitrary code simply by selecting a URL. This problem has occurred in the past in a number of other programs such as fingerd (where it was exploited by the Internet worm [Spafford 1988]), the CERN and NCSA httpd's (as explained below in the section [!!!!]), and recently splitvt, syslog, and mount/umount, leading one exasperated mailing-list moderator to wonder how many more times he'd see this problem [Bloodmask 1996]. The flaw in question can be exploited by ensuring that the code to be executed is located in the URL at a point where it overflows the end of the buffer. A URL can contain almost any data value except for a few characters which have special significance and a binary zero, a restriction which can easily be bypassed by selecting alternative encodings for any instructions which cause problems. The browser stack looks as follows: [Diagram: URL buffer, other data, callers saved program counter] It is therefore possible, by making the URL long enough to overwrite the other data and saved program counter, to force a jump to an attackers code rather than returning to the calling routine, allowing an attacker to force the execution of arbitrary code on the victims machine. Although this exploit is machine and browser-specific, by targetting the most common architecture (Windows on an Intel processor) and browser (Netscape), a reasonable chance of success can be obtained. At about the same time the stack overwrite problem was discovered, a basic flaw was found in Netscape's SSL implementation which reduced the time to break the encryption from hours to minutes. Despite an existing body of literature covering the need for carefully selected random-number generation routines for cryptographic applications [Eastlake 1994] [IEEE 1995] [Robertson 1995], one of which even included ready-to-use code [Plumb 1994], Netscape used fairly simple methods which resulted in easy-to-guess encryption keys [Goldberg 1995] [Goldberg 1996]. It was found that, under Unix, Netscape used a combination of the current time in seconds and microseconds and the process ID of the current and parent process to initialise the random number generator which produced master encryption keys. The time can be determined to a reasonable degree of accuracy from the message being sent, the process ID's can be determined using standard Unix utilities (by people using the same machine that Netscape is running on), or by using other tricks such as the fact the an approximate process ID can often be obtained by observing the output of other network-related programs on the machine, and the parent process ID is often 1 (for example when Netscape is started from an X-windows menu) or close to the process ID. Under Windows the implementation was similarly flawed. The resulting number of values to search are smaller than the number of combinations in a 40-bit key, and much smaller than the number of combinations in the 128-bit key in the export-restricted version. Since Netscape never reseeds its internal random number generator, subsequent connections are relatively easy to break once the first one is broken. The researchers who discovered this problem released a program, unssl [unssl 1995] which would break Netscape's encryption (both the weak exportable version and the strong export-restricted version) in about a minute on an average workstation. Although one of the researchers classed it as "a silly bug", it received large amounts of media attention, including front-page coverage in the New York Times [Markoff 1995] and coverage in the Wall Street Journal [Sandberg 1995] and Daily Telegraph [Uhlig 1995]. Attempts to fix this problem introduced yet more problems. Under Windows the browser and server code, which appear to share the same random number code, don't close some of the file handles they use. While this has no serious effect on the client software (which doesn't run over extended periods of time), it does effect the server, which after a period of time runs out of file handles so that a number of calls related to gathering random data (some of them not apparently file-related) quietly fail, significantly weakening the random-number generation process [RingZero 1995]. The problem of insecure random number generation was not unique to Netscape, and has in the past beset XDM (which generates weak xauth keys), Netrek (a network game which generates guessable RSA private keys), an earlier version of the SecuDE security toolkit (which again generated guessable RSA keys), and Sesame (a european Kerberos clone) which uses it to generate DES keys. Significant security holes are also opened up through the use of Java, which allows arbitrary programs downloaded from the net to run in a (supposedly) controlled environment on a host PC. By breaking out of this controlled environment, Java applets can act as trojan horse programs on the PC, bypassing normal security measures. The consequences of these security problems have been widely reported and include the destruction of data [Clark 1996], the ability to access arbitrary files on the system [Felten 1996b], the ability to forward sensitive information to arbitrary machines on the net (bypassing firewalls and similar measures, since the "attack" comes from a trusted machine inside the security perimeter) [Williams 1996] [Markoff 1996], or even run arbitrary native code on the machine [Felten 1996a] [Hopwood 1996] [Kennedy 1996]. This last class of flaws are the most serious, since they allow any code to be executed on a victims machine. The problem was in the class loading code for the browser and affected all then available browsers rather than just Netscape, and could be carried out simply by a victim viewing a web page containing the hostile Java applet. Java problems can be combined with other attacks such as DNS spoofing (in which a fake address for a target machine is advertised), allowing a Java applet to connect to a normally disallowed target machine since the Java security manager thinks it is connecting to a safe system [Mueller 1996]. Other problems are less subtle, and can crash the browser (and, under some versions of Windows, the operating system as well) simply by connecting to a web page [Ref: Browser-crashing pages]. One report comes to the conclusion that "because of the wonderful power of the Java language, security problems are likely to continue" [Neumann 1996]. These problems are not unique to Java. Microsoft's ActiveX has experienced similar troubles, exemplified by a sample application which shuts down the machine, and even turns off the power on systems which support this functionality [McLain 1996]. The problems extend beyond Java and ActiveX to other kinds of embedded executable content as well. For example the ability to embed macros in documents viewed and downloaded by a browser, in combination with security holes in the browser, allows an attacker to execute arbitrary code on a victims system whenever they view the attackers web page [Felten 1996c]. Although this was subsequently fixed, the solution was to issue warnings for all local files as well as remote downloads, so that after the first dozen or so messages the user was likely to simply automatically click "OK" whenever another warning popped up [Walsh 1996]. In addition a hostile application could access the Windows registry (the system-wide database of configuration options) to quietly disable the warnings. This creates a nice niche for "espionage-enabling" viruses which disable or patch various security features in operating systems or application software to allow later attacks. At least one security organisation already uses such a program, a modified stealth virus, for this purpose. -> Mention that these are all seperate problems, not the same ref over and over. [Clark 1996] Don Clark, "Researchers Find Big Security Flaw In Java Language" The Wall Street Journal, 26 March 1996, p.B4. [Bloodmask 1996] `Bloodmask', "Vulnerability in ALL linux distributions", posting to linux-alert mailing list, 30 July 1996. [Eastlake 1994] Donald Eastlake, Stephen Crocker, Jeffrey Schiller, "Randomness Recommendations for Security", RFC 1750, December 1994. [Felten 1996a] Ed Felten, "Security Flaw in Netscape 2.02", Risks-Forum Digest Vol.18, Issue 13, 17 May 1996. [Felten 1996b] Ed Felten, "Java security update", Risks-Forum Digest, Vol.18, Issue 32, 13 August 1996. [Felten 1996c] Ed Felten "Internet Explorer Security Problem", Risks-Forum Digest, Vol.18, Issue 36, 21 August 1996. [Goldberg 1995] Ian Goldberg, "Netscape SSL implementation cracked!", posting to cypherpunks mailing list, message-ID: <199509180441.VAA16683(a)lagos.CS.Berkeley.EDU>, 18 September 1995. [Goldberg 1996] Ian Goldberg and David Wagner, "Randomness and the Netscape Browser", Dr.Dobbs Journal, January 1996, p.66. [Green 1995] Heather Green, "Netscape Says Hackers Uncover 3rd Flaw in Its Internet Software", The New York Times, 25 Sep 1995. [Hopwood 1996] David Hopwood, "Another Java security bug", posting to comp.lang.java newsgroup, message-ID <4orf1q$t6f(a)news.ox.ac.uk>, 2 June 1996. [IEEE 1995] IEEE P1363 Appendix E, "Cryptographic Random Numbers", Draft version 1.0, 11 November 1995. [Kennedy 1996] David Kennedy, "Another Netscape Bug US$1K", Risks-Forum Digest, Vol.18, Issue 1422, May 1996. [Markoff 1995] John Markoff, "Security Flaw Is Discovered In Software Used in Shopping", The New York Times, 19 September 1995, p.A1. [Markoff 1996] John Markoff, "New Netscape Software Flaw Is Discovered", The New York Times, 18 May 1996, p.31. [McLain 1996] Fred McLain, "ActiveX, or how to put nuclear bombs in web pages", http://www.halcyon.com/mclain/ActiveX/. [Mueller 1996] Marianne Mueller, "Java security", Risks-Forum Digest, Vol.17, Issue 79 23 February 1996. [Neumann 1995] Peter Neumann, "Third Netscape weakness found", Risks-Forum Digest, Vol.17, Issue 36, 27 September 1995. [Neumann 1996] Peter Neumann, "More Java, JavaScript, and Netscape problems", in "Security Risks in Computer-Communication Systems", ACM SIGSAC Review, Vol.14, No.3 (July 1996), p.22. [Plumb 1994] Colin Plumb, "Truly Random Numbers", Dr.Dobbs Journal, November 1994, p.113. [RingZero 1995] `RingZero', "NEW Netscape RNG hole", posting to cypherpunks mailing list, message-ID <9510080732.AA14015(a)anon.penet.fi>, 8 October 1995. [Robertson 1995] Richard Robertson, "Random Number Generators Draft", IEEE P1363 Random Number Generators Review Group, May 1995. [Sandberg 1995] Jared Sandberg, "Netscape's Internet Software Contains Flaw That Jeopardizes Security of Data", The Wall Street Journal, 19 September 1995. [Spafford 1988] Gene Spafford, "The Internet Worm: Crisis and Aftermath", Communications of the ACM, Vol.32, No.6 (June 1989), p.678. [Uhlig 1995] Robert Uhlig, "Security threat to Internet shopping", Daily Telegraph, Daily Telegraph (paper edition), 3 October 1995, p.12. [unssl 1995] ftp://ftp.csua.berkeley.edu/pub/cypherpunks/cryptanalysis/unssl.c. [Walsh 1996] Mike Walsh, "Microsoft's warning", Risks-Forum Digest, Vol.18, Issue 38, 26 August 1996 [Williams 1996] Eric Williams, "New Netscape 2.0/2.01 Security Issue (Java Sockets)", posting to comp.lang.java newsgroup, message-ID <4jppdt$ake(a)sky.net>, 1 April 1996. [WSJ 1996] The Wall Street Journal, "Princeton Team Finds Bug In Part Of Netscape Program", 20 May 1996.

5 4

Re: (Fnord) Edupage, 10 September 1996
by frantz＠netcom.com 17 Dec '03

17 Dec '03

I'm preaching to the choir, but I can't resist. >From Edupage, 10 September 1996: >A leading Clinton Administration official ... Michael Nelson, who adds >that organized crime members are already some of the most sophisticated >users of computer systems and strong encryption technology. In addition, >computer crackers will pose a more significant threat. The bad guys already have strong encryption. So why doesn't the Clinton administration immediately press for the widespread deployment of strong encryption to help defend us against the bad guys? ------------------------------------------------------------------------- Bill Frantz | "Lone Star" - My personal | Periwinkle -- Consulting (408)356-8506 | choice for best movie of | 16345 Englewood Ave. frantz(a)netcom.com | 1996 | Los Gatos, CA 95032, USA

2 1

Re: Child Porn as Thoughtcrime
by Rick Smith 17 Dec '03

17 Dec '03

Tim wrote: : Declan answers in the affirmative that, yes, nearly all of the examples I : cited are indeed crimes. .... : As I well knew, which is why I presented them. (The Jock Sturges case was : in SF, ... I've read in several places that the Jock Sturges case was thrown out of court by the judge. Nobody has dragged me away in shackles for owning "Radiant Images." Stores selling photo books often carry his work, and it is rarely covered with opaque plastic. So it may be nudity that set the gendarmes (sp?) in motion, but that's evidently not what's really illegal. I wonder what would happen if an "adult magazine" were to reproduce Sturges' work. The court case might be interesting... Now apply that to the Web. Imagine there's a Sturges site, and a porn site links to it. Does that make the Sturges material "child porn?" If so, is the porn site illegal or the Sturges site? I suspect the prosecutors will come down on both and let the courts sort it out. Prior restraint, eh? : ...the "little girls in leotards" case was only a few years ago, etc.) Don't know about that one. Is it illegal for little girls to be photographed in leotards now? "Nutcracker" is X rated? Move over, Bambi. Personally, I think the political posturing theory captures the essence of the legislative climate. Rick.

1 0