December 2003 - cypherpunks-legacy

Re: silly putty
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Wed, 30 Oct 1996 17:19:38 -0800 (PST), sameer wrote: > Would anyone be interested in 50 pounds of silly putty? A >friend of mine would be grateful if I could help him get rid of 50 >pounds of silly putty. It would be $500. You mean that silly putty sells for more than tri-tip? # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

1 0

Re: German Draft Digital Signature Law
by um＠c2.net 17 Dec '03

17 Dec '03

Some more crypto-related news from Germany: In Germany, online banking is a very popular application of the phone company's online service T-Online. Now Bank 24, a subsidary of Deutsche Bank, is beginning to offer online banking on the Internet (http://www.bank24.de) They use SSL to transfer Java applets that securely encrypts the financial data. Export SSL is secure enough to guarantee that the applets are authentic. So much about exporting crypto hooks... As journalist Detlev Borchers reports, the German tax consultants' association Datev (http://www.datev.de) distributes a software toolkit that allows their clients to transfer confidential data to the consultants via AOL. CompuServe or T-Online. The toolkit uses PGP to encrypt the data. At a press conference, the Datev spokesman was very surprised to learn about political problems with encryption software -- because as he said, the German tax authorities also use PGP (however, in a variant where the patented IDEA algorithm has been replaced). Last, but not least: Addison Wesley Germany has now published a German edition of Applied Cryptography. The book does contain source code. I wonder how they got the "munitions" from the US to the German printer?

1 0

On the Importance of Checking Computations
by John Young 17 Dec '03

17 Dec '03

The Bellcore report, "On the Importance of Checking Computations" on technical details of fault-based cracking reported in today's FT, is available at: http://www.bellcore.com/SMART/index.html Here's an outline: On the Importance of Checking Computations (Extended abstract) Don Boneh, Richard A. DeMillo, and Richard J. Lipton Math and Cryptography Research Group, Bellcore Abstract: We present a theoretical model for breaking various cryptographic schemes by taking advantage of random hardware faults. We show how to attack certain implementations of RSA and Rabin signatures. We also show how various authentication protocols, such as Fiat-Shamir and Schnoor, can be broken using hardware faults. 1. Introduction Transient faults Latent faults Induced faults 2. Chinese remainder based implementations 2.1 The RSA system 2.2 RSA's vulnerability to hardware faults 3. Register faults 4. The Fiat-Shamir identification scheme Theorem 4.1 4.1 A modification of the Fiat-Shamir scheme 5. Attacking Schnoor's identification scheme Theorem 5.1 6. Breaking other implementations of RSA Theorem 6.1 7. Protecting against an attack based on hardware faults 8. Summary References ----- Registration is required for access. Two formats are available: Acrobat PDF (112kb) and Postscript PS (86kb). Before registration, there is a brief "context" at: http://www.bellcore.com/SMART/secwp.html Here's the first two paragraphs: Context for "On the Importance of Checking Computations" "On the Importance of Checking Computations" describes a fault-based method for breaking various cryptographic algorithms and exposes the degree to which computing faults can compromise information security. Once the authors -- Richard DeMillo, Dan Boneh and Richard Lipton -- articulated and proved their conceptual breakthrough, they realized that it might be successful in a wide variety of application scenarios. Fault-based attacks potentially endanger many network security products and systems. The paper summarizes the proof for the basic attack. Proof for fault-based cryptanalysis builds on the premise that an adversary can observe a faulty computation that occurs during cryptographic transactions. The faults that are exploited can occur at various sublevels within the logic level of a computing device -- that is, in the switching circuitry where arithmetic operations are performed or in the register transfer area where temporary values are stored in memory. The likelihood of faults occurring is not discussed in the paper. [Snip balance of Context]

1 0

BAY GUARDIAN ITEM
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, This item appeared in the calendar section of the San Francisco Bay Guardian: INDEPENDENCE DAY The Internet's status as a censorship-free zone is a tenuous one, so a little digital activism is always in order. The San Francisco Art Institute's Center for Digital Media rises to the occasion with WEB FREEDOM DAY, a symposium addressing the implications of the Communications Decency Act and accompanying government regulation of the Net. The event inclludes a morning session with artists working in electronic media and an afternoon session with media lawyers, activists, and multimedia developers exploring administrative and legal issues. 10 a.m.--6 p.m., San Francisco Art Institute, Lecture Hall, 800 Chestnut, S.F. Free. (415) 749-4588. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: Computer Security Risk Assessment Software?
by Frank Willoughby 17 Dec '03

17 Dec '03

Methinks "Ross Wright" <rwright(a)adnetsol.com> wrote: >On or About 31 Oct 96 at 12:19, Dr.Dimitri Vulis KOTM wrote: > >> which I assume is NOT what you have in mind :-) Do you mean >> something that'll take a survey of a company's computer security > >Boom. Nail, head, one shot!!!! What's on the market now in that >area? > >> and >> assess the risk (like Stan) or something more global? > >The issues are: > >Information Risk Assessment and Management >and also Information Security Assessment. > >> AFAIK, there's >> no tool on the market to help in all aspects of risk management even >> for a small outfit, because there are so many sources of risk. There >> are many good specialized packages. > I beg to disagree. Tools, like checklists, are ok as far as a memory jogger goes (to make sure that you haven't overlooked something) but there is no way they can replace an assessment or audit by a seasoned Information Security Officer or professional. ISOs have eyes, ears, fingers, and a mind. Tools don't. Further, assessments & audits require a mindset - usually based on experience. A tool in the hands of an inexperienced person (be they consultant, or whatever) will more than likely result in major vulnerabilities being overlooked. There is no way a tool or checklist can have every possibility on it. (They don't make laptop hard drives big enough) 8^) As Murphy's Law goes, the vulnerability that isn't mentioned in the tool will be the one that a hacker will use to crack the systems and start peeling the corporation like a grape. Frequently, a reason people buy these tools are that they feel that the tools are more cost-effective than bringing in a consultant for the engagement. Their reasons for doing this are based on the fears that that the consultant's fee will be too high, and that when the consultant leaves, so does the knowledge he used to perform the assessment. In many cases, these fears are justified. (There are exceptions, however). The solutions to the above-mentioned problems are: o Shop around. Find out which consultants are qualified and what they charge. o Make sure the consultant caps his cost. You should know the maximum price tag associated with the consulting engagement BEFORE the consultant walks in the front door. This helps to avoid having the consultant camp on your doorstep at $XXX dollars per hour for days, weeks, or months on end. o Check the consultants to see if they have ever worked as an Information Security Officer. (Would you want to have eye surgery performed by someone who read a book about it, or by someone who had is experienced at the trade. IMHO, supplying textbook answers to non-textbook corporations is for the birds. o If the consultant is worth anything at all, they will walk the customer through the engagement (before the engagement is over) and TEACH them how to become self-sufficient in the areas of InfoSec which were part of the engagement. (Sounds counter-productive for business, but the word-of-mouth references are worth it. It is also more honest than milking the client as some people do. When the consultant leaves the site, the customer should know what the consultant did, and be able to follow the consultant's train-of-thought that led him to the recommend the particular solutions that he did. o Last, but not least, it also wouldn't hurt if they were professional enough to be a member of a consumer protection group (such as the Better Business Bureau, etc). This helps to keep the good guys honest and helps customers differentiate between the professionals and those who are out for a quick buck or just learned how to spell Information Security. Food for thought. Best Regards, Frank Any sufficiently advanced bug is indistinguishable from a feature. -- Rich Kulawiec <standard disclaimer> The opinions expressed above are of the author and may not necessarily be representative of Fortified Networks Inc. Fortified Networks Inc. - Information Security Consulting http://www.fortified.com Phone: (317) 573-0800 FAX: (317) 573-0817 Home of the Free Internet Firewall Evaluation Checklist

2 1

Re: "Montgolfiering" mindlessness
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 2:18 AM 10/31/96 -0600, cypher(a)cyberstation.net wrote: >Talk the talk |= Walk the walk` > >If we could bottle up all the hot air espoused by fools like you, we >could solve the worldwide energy crisis. Obviously, you are not interested >in the facts. You engage in baneful contravallation of jabberwocky since >you, and the others so predisposed, are totally clueless with regard to >how to break the algorithm.0 > >Now let us hear your plaintive wail of the lame brain excuse about >not wanting to waste your time, always the indicant of intellectual pap >and intellectual cowardice/dishonesty by super mouthers like you. I may be >mindless, but obviously you and Mr. Franz are brainless, or otherwise you >would try to prove something instead of beating off your brains and mouth >about it. As with Perry, and others your information content is: Quite a flame. And just because I said I liked the spoof of Don Woods' style too. (N.B. The slightly different version of the above that was privately forwarded to me spelled my name correctly, both in the text and the address.) ------------------------------------------------------------------------- Bill Frantz | Tired of Dole/Clinton? | Periwinkle -- Consulting (408)356-8506 | Vote 3rd party. I'm | 16345 Englewood Ave. frantz(a)netcom.com | Voting for Harry Browne | Los Gatos, CA 95032, USA

2 1

Re: "Montgolfiering" mindlessness
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 10:47 AM 10/31/96 -0500, Rabid Wombat wrote: >On Wed, 30 Oct 1996, Bill Frantz wrote: > >> Gee, I put that post in the same place I carefully keep my back issues of >> the Cypherpunks Enquirer. >> > >Bill, you must be humor-impaired. That piece was a great send-up of >Woods. I was laughing 'til tears spilled down an shorted out my keyboard. >I dunno who posted that, but I'm in awe. RW, you misunderstand me. I viewed the piece as being as worthy of preserving as back issues of the Cypherpunks Enquirer. From me, that is high praise. While I didn't short out my keyboard, it did brighten an otherwise stressful day. ------------------------------------------------------------------------- Bill Frantz | Tired of Dole/Clinton? | Periwinkle -- Consulting (408)356-8506 | Vote 3rd party. I'm | 16345 Englewood Ave. frantz(a)netcom.com | Voting for Harry Browne | Los Gatos, CA 95032, USA

1 0

Looking for post on possible Law Articles
by Matthew J. Miszewski 17 Dec '03

17 Dec '03

Sorry to take up bandwidth, but I swore I saw a post from someone outlining (for what seemed to be a class) a series of legal questions regarding the net. I was almost positive it came across my cypherpunks folder. If anyone remembers this, or better yet still has the post, could you send it or a pointer my way? Thanks in advance. Matt -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzDq+FoAAAEEANM9+JcJmUp4aCSGpdOG4Y1b6m4630XA8H41Utbvr7Tr6wEH CD6tlxZ+k+Pycj4w/f8WQa8fC50skoLjUNeP4lYsR7NYaMGRp6WkqCLMI/3Nohvk pfLDqnzZZdwVL2liB7mfTURoF6doQaVehHmMBjSaVTfD12tzNGm6VvyEc77JAAUR tClNYXR0aGV3IEouIE1pc3pld3NraSA8bWptaXNraUBleGVjcGMuY29tPg== =lkx1 -----END PGP PUBLIC KEY BLOCK-----

3 2

new center at U. Wisconsin - Milwaukee
by Matt Blaze 17 Dec '03

17 Dec '03

In case anyone is interested. ------- Forwarded Message Received: from amontillado.research.att.com (amontillado.research.att.com [135.205.42.32]) by nsa.research.att.com (8.7.3/8.7.3) with ESMTP id UAA01185 for <mab-local(a)nsa.research.att.com>; Thu, 31 Oct 1996 20:17:34 -0500 (EST) Received: from research.att.com (research.research.att.com [135.205.32.20]) by amontillado.research.att.com (8.7.5/8.7) with SMTP id UAA07551; Thu, 31 Oct 1996 20:17:02 -0500 (EST) Received: from miller.cs.uwm.edu by research; Thu Oct 31 20:14:30 EST 1996 Received: (from cccns@localhost) by miller.cs.uwm.edu (8.8.2/8.8.2) id SAA12464; Thu, 31 Oct 1996 18:17:54 -0600 (CST) Date: Thu, 31 Oct 1996 18:17:54 -0600 (CST) Message-Id: <199611010017.SAA12464(a)miller.cs.uwm.edu> From: Center for Cryptography Computer and Network Security <cccns(a)miller.cs.uwm.edu> To: desmedt(a)miller.cs.uwm.edu Subject: Invitation: Please Post OOO PPPP EEEEE N N IIIIIII N N GGGGG O O P P E NN N I NN N G G O O P P E N N N I N N N G O O PPPP EEE N N N I N N N G O O P E N N N I N N N G GGG O O P E N NN I N NN G G OOO P EEEEE N N IIIIIII N N GGGGG OF THE CENTER FOR CRYPTOGRAPHY, COMPUTER AND NETWORK SECURITY Electrical Engineering and Computer Science College of Engineering and Applied Science University of Wisconsin - Milwaukee November 21, 1996 SCHEDULE: 10:45 Welcome 11:00 Friction in Secret Sharing and Key Escrowing by G. R. BLAKLEY, Texas A&M University. co-inventor of secret sharing 11:45 Break 13:45 The State of the Art in Computational Number Theory by ERIC BACH, University of Wisconsin, Madison. co-author of "Algorithmic Number Theory, Vol. 1" 14:30 Coffee 15:15 Opening ceremony and introduction of keynote speaker. 15:30 The Importance of Cryptography to Industry by WHITFIELD DIFFIE, Sun Microsystems co-inventor of public key 16:30 Reception Related event: Friday November 22, Computer Science Seminar Series Lecture. 15:30 Robust and Efficient Sharing of RSA Functions by TAL RABIN, IBM T.J. Watson Research Center You are cordially invited to attend the opening. For upcoming information, such as the vitae of the speakers, the location of the event, the Center's faculty members, driving instructions, consult: http://www.cs.uwm.edu/~cccns Free registration requested. Please register by e-mail to cccns(a)cs.uwm.edu Indicate whether you also plan to attend the lecture of Tal Rabin on Friday November 22. Include your name and address. George Davida Yvo Desmedt Rene Peralta Professor Professor Associate Professor Director The Center's purpose will be to advance knowledge in the areas of cryptography, computer security, network security and related areas from theoretical as well as practical viewpoints. For more details see: http://www.cs.uwm.edu/~cccns ------- End of Forwarded Message

1 0

Re: slander and call for lawyers. :)
by Lurker 17 Dec '03

17 Dec '03

At 08:10 AM 10/27/96 -0400, William H. Geiger III wrote: >In <Pine.SUN.3.94.961026164648.10071G-100000@polaris>, on 10/26/96 at 04:48 PM, > Black Unicorn <unicorn(a)schloss.li> said: > >>On Fri, 25 Oct 1996, Dr.Dimitri Vulis KOTM wrote: > >>> Sandy Sandfort <sandfort(a)crl.com> writes: >>> > >>> > On Fri, 25 Oct 1996, Black Unicorn wrote to Dimitri: >>> > >>> > > If you don't watch it I'll have a pair of my staff represent >>> > > [Ray] free of charge. >>> > >>> > Now THAT would be a community service. >>> >>> Why don't you use the funds pledges for my defunct trip to California >>> for Ray's lithium bill. > >>Suggesting that a person is on a psychoactive mediciation with the purpose of >>harming that persons image or character is likely actionable. > >>I'd be careful if I were you. If said individual ever manages to >>substantiate damages you've got an interesting time ahead of you. > >Well as much as it pains me to take Dimitri's side I doubt that any damages can be >proved by his statements on this list. My reasoning for this opinion is as follows: > >A. Dimitri is a nut, kook, ...ect. Definitely suffering from dimished capacity. > >B. Everyone on the list is aware of point A. > >C. So with A & B true when Dimitri makes his nutty statements they are taken by the >list as just that, nutty statements. > >Under the above I find it hard to see any real damage caused by Dimitri's statements. >Granted Dimitri is an anoying pest, I don't think that a lawsuite will do anything to >slow him down as I don't see one as winable. I personally am getting sick of this thread of messages. I have taken the steps, as everyone should when annoyed by useless and bothersome threads and people, to filter this thread and all messages written by Dr DV to the Trash. (Maybe many of you could do the same.) I would appreciate it if everyone who has been posting messages with the above subject (actually 'slander and call for lawyers') please keep the subject, to save those of us who choose not to listen to this noise from the hassel of changing our filters. Thank you for your understanding.

1 0