December 2003 - cypherpunks-legacy

FYI - Biham/Shamir Differential Fault Analysis of DES, etc.
by Matt Blaze 17 Dec '03

17 Dec '03

------- Forwarded Message From: Shamir Adi <shamir(a)wisdom.weizmann.ac.il> Date: Fri, 18 Oct 1996 16:30:34 +0200 Message-Id: <199610181430.QAA20359(a)white.wisdom.weizmann.ac.il> To: benaloh(a)microsoft.com, brassard(a)iro.umontreal.ca, canetti(a)theory.lcs.mit.edu, crepeau(a)iro.umontreal.ca, david(a)digicash.com, daw(a)cs.berkeley.edu, mab(a)research.att.com, mihir(a)watson.ibm.com, rogaway(a)cs.ucdavis.edu, schneier(a)counterpane.com Subject: A new attack on DES Research announcement: A new cryptanalytic attack on DES Eli Biham Adi Shamir Computer Science Dept. Applied Math Dept. The Technion The Weizmann Institute Israel Israel October 18, 1996 (DRAFT) In September 96, Boneh Demillo and Lipton from Bellcore announced an ingenious new type of cryptanalytic attack which received widespread attention (see, e.g., John Markoff's 9/26/96 article in the New York Times). Their full paper had not been published so far, but Bellcore's press release and the authors' FAQ (available at http://www.bellcore.com/PRESS/ADVSRY96/medadv.html) specifically state that the attack is applicable only to public key cryptosystems such as RSA, and not to secret key algorithms such as the Data Encryption Standard (DES). According to Boneh, "The algorithm that we apply to the device's faulty computations works against the algebraic structure used in public key cryptography, and another algorithm will have to be devised to work against the nonalgebraic operations that are used in secret key techniques." In particular, the original Bellcore attack is based on specific algebraic properties of modular arithmetic, and cannot handle the complex bit manipulations which underly most secret key algorithms. In this research announcement, we describe a related attack (which we call Differential Fault Analysis, or DFA), and show that it is applicable to almost any secret key cryptosystem proposed so far in the open literature. In particular, we have actually implemented DFA in the case of DES, and demonstrated that under the same hardware fault model used by the Bellcore researchers, we can extract the full DES key from a sealed tamperproof DES encryptor by analysing fewer than 200 ciphertexts generated from unknown cleartexts. The power of Differential Fault Analysis is demonstrated by the fact that even if DES is replaced by triple DES (whose 168 bits of key were assumed to make it practically invulnerable), essentially the same attack can break it with essentially the same number of given ciphertexts. We would like to greatfully acknowledge the pioneering contribution of Boneh Demillo and Lipton, whose ideas were the starting point of our new attack. In the rest of this research announcement, we provide a short technical summary of our practical implementation of Differential Fault Analysis of DES. Similar attacks against a large number of other secret key cryptosystems will be described in the full version of our paper. TECHNICAL DETAILS OF THE ATTACK The attack follows the Bellcore fundamental assumption that by exposing a sealed tamperproof device such as a smart card to certain physical effects (e.g., ionizing or microwave radiation), one can induce with reasonable probability a fault at a random bit location in one of the registers at some random intermediate stage in the cryptographic computation. Both the bit location and the round number are unknown to the attacker. We further assume that the attacker is in physical possesion of the tamperproofdevice, so that he can repeat the experiment with the same cleartext and key but without applying the external physical effects. As a result, he obtains two ciphertexts derived from the same (unknown) cleartext and key, where one of the ciphertexts is correct and the other is the result of a computation corrupted by a single bit error during the computation. For the sake of simplicity, we assume that one bit of the right half of the data in one of the 16 rounds of DES is flipped from 0 to 1 or vice versa, and that both the bit position and the round number are uniformly distributed. In the first step of the attack we identify the round in which the fault occurred. This identification is very simple and effective: If the fault occurred in the right half of round 16, then only one bit in the right half of the ciphertext (before the final permutation) differs between the two ciphertexts. The left half of the ciphertext can differ only in output bits of the S box (or two S boxes) to which this single bit enters, and the difference must be related to non-zero entries in the difference distribution tables of these S boxes. In such a case, we can guess the six key bit of each such S box in the last round, and discard any value which disagree with the expected differences of these S boxes (e.g., differential cryptanalysis). On average, about four possible 6-bit values of the key remain for each active S box. If the faults occur in round 15, we can gain information on the key bits entering more than two S boxes in the last round: the difference of the right half of the ciphertext equals the output difference of the F function of round 15. We guess the single bit fault in round 15, and verify whether it can cause the expected output difference, and also verify whether the difference of the right half of the ciphertext can cause the expected difference in the output of the F function in the last round (e.g., the difference of the left half of the ciphertext XOR the fault). If successful, we can discard possible key values in the last round, according to the expected differences. We can also analyse the faults in the 14'th round in a similar way. We use counting methods in order to find the key. In this case, we count for each S box separately, and increase the counter by one for any pair which suggest the six-bit key value by at least one of its possible faults in either the 14'th, 15'th, or 16'th round. We have implemented this attack on a personal computer. Our analysis program found the whole last subkey given less than 200 ciphertexts, with random single-faults in all the rounds. This attack finds the last subkey. Once this subkey is known, we can proceed in two ways: We can use the fact that this subkey contains 48 out of the 56 key bits in order to guess the missing 8 bits in all the possible 2^8=256 ways. Alternatively, we can use our knowledge of the last subkey to peel up the last round (and remove faults that we already identified), and analyse the preceding rounds with the same data using the same attack. This latter approach makes it possible to attack triple DES (with 168 bit keys), or DES with independent subkeys (with 768 bit keys). This attack still works even with more general assumptions on the fault locations, such as faults inside the function F, or even faults in the key scheduling algorithm. We also expect that faults in round 13 (or even prior to round 13) might be useful for the analysis, thus reducing the number of required ciphertext for the full analysis. OTHER VULNERABLE CIPHERS Differential Fault Analysis can break many additional secret key cryptosystems, including IDEA, RC5 and Feal. Some ciphers, such as Khufu, Khafre and Blowfish compute their S boxes from the key material. In such ciphers, it may be even possible to extract the S boxes themselves, and the keys, using the techniques of Differential Fault Analysis. Differential Fault Analysis can also be applied against stream ciphers, but the implementation might differ by some technical details from the implementation described above. ------- End of Forwarded Message

1 0

news item on Atlanta bank
by P. J. Ponder 17 Dec '03

17 Dec '03

from: [http://netday.iworld.com/news1.shtml] news(a)iworld.com "CyberBank" Opens for Business [October 18] -- Atlanta Internet Bank reports its cyberdoors are open for business as the world's first Internet-only bank. Currently available to AT&T WorldNet Service subscribers, Atlanta Internet Bank's initial products include interest-bearing checking accounts, direct deposit, electronic bill payment, account transfer capability, and ATM cards. The bank has announced the launch of its "anytime- anywhere" service with special interest rates on money market accounts. For a limited time, Atlanta Internet Bank is offering 7% interest (annual percentage yield of 6.18%) on NetVantage money market accounts to WorldNet subscribers. "This is the beginning of a new era in financial services," said Atlanta Internet Bank President Don Shapleigh. "We're using bits and bytes instead of bricks and mortar and passing the savings on to our customers. This will allow us to maintain very competitive rates after the introductory rate offer expires." Future services planned by the new bank include loan products, brokerage services, IRA accounts, and credit and debit cards. "Atlanta Internet Bank has taken a giant step into the electronic commerce marketplace," said Jeffrey Feldman, AT&T's Advanced Network Solutions vice president. "AT&T's Advanced Network Solutions team firm believes that banks and other financial service providers will win customer loyalty by offering their own branded, electronic environments that deliver real value to end users--just as Atlanta Internet Bank has demonstrated." Atlanta Internet Bank's services are provided through Carolina First Bank, Greenville, S.C., a wholly owned subsidiary of Carolina First Corporation.with multiple providers to achieve our strategic goals." -- to unsubscribe from cypherpunks, send to majordomo(a)toad.com unsubscribe cypherpunks in the message body, not the Subject: line

2 1

Brock Meeks on NSA domestic codebreaking, from Muckraker
by declan＠well.com 17 Dec '03

17 Dec '03

This is Brock's unedited Muckraker that's up at HotWired today (http://www.muckraker.com) Forwarded with permission. --Declan ********** Crypto Mission Creep By Brock N. Meeks (brock(a)well.com) The Justice Department has, for the first time, publicly acknowledged using the code-breaking technologies of the National Security Agency, to help with domestic cases, a situation that strains legal boundaries of the agency. Deputy Attorney General Jamie Gorelick admitted in July, during an open hearing of the Senate's Governmental Affairs permanent subcommittee on investigations, that the Justice Department: "Where, for example, we are having trouble decrypting information in a computer, and the expertise lies at the NSA, we have asked for technical assistance under our control." That revelation should have been a bombshell. But like an Olympic diver, the revelation made hardly a ripple. By law the NSA is allowed to spy on foreign communications without warrant or congressional oversight. Indeed, it is one of the most secretive agencies of the U.S. government, whose existence wasn't even publicly acknowledged until the mid-1960s. However, it is forbidden to get involved in domestic affairs. During the hearing Sen. Sam Nunn (D-Ga.) asked Gorelick if the President had the "the constitutional authority to override statutes where the basic security of the country is at stake?" He then laid out a scenario: "Let's say a whole part of the country is, in effect, freezing to death in the middle of the winter [because a power grid has been destroyed] and you believe it's domestic source, but you can't trace it, because the FBI doesn't have the capability. What do you do?" Gorelick replied that: "Well, one thing you could do -- let me say this, one thing you could do is you could detail resources from the intelligence community to the law enforcement community. That is, if it's under -- if it's -- if you're talking about a technological capability, we have done that." And then she mentioned that the NSA had been called on to help crack some encrypted data. But no one caught the significance of Gorelick's' statements. Instead, the press focused on another proposal she outlined, the creation of what amounts to a "Manhattan Project" to help thwart the threat of information warfare. "What we need, then, is the equivalent of the 'Manhattan Project' for infrastructure protection, a cooperative venture between the government and private sector to put our best minds together to come up with workable solutions to one of our most difficult challenges,'' Gorelick told Congress. Just a day earlier, President Clinton had signed an executive order creating a blue-ribbon panel, made up of several agencies, including the Justice Department, the CIA, the Pentagon and the NSA and representatives of the private sector. Though the press missed the news that day; the intelligence agency shivered. When I began investigating Gorelick's statement, all I got were muffled grumbling. I called an NSA official at home for comments. "Oh shit," he said, and then silence. "Can you elaborate a bit on that statement?" I asked, trying to stifle a chuckle. "I think my comment says it all," he said and abruptly hung up the phone. Plumbing several sources within the FBI drew little more insight. One source did acknowledge that the Bureau had used the NSA to crack some encrypted data "in a handful of instances," but he declined to elaborate. Was the Justice Department acting illegally by pulling the NSA into domestic work? Gorelick was asked by Sen. Nunn if the FBI had the legal authority to call on the NSA to do code-breaking work. "We have authority right now to ask for assistance where we think that there might be a threat to the national security," she replied. But her answer was "soft." She continued: "If we know for certain that there is a -- that this is a non-national security criminal threat, the authority is much more questionable." Questionable, yes, but averted? No. If Gorelick's answers seem coy, maybe it's because her public statements are at odds with one another. A month or so before her congressional bombshell, she revealed the plans for the information age"Manhattan Project" in a speech. In a story for Upside magazine <http://www.upside.com/online/columns/cybersense/9607.html#one>, by old-line investigative reporter Lew Koch, where he broke the story, Gorelick whines in her speech about law enforcement going through "all that effort" to obtain warrants to search for evidence only to find a child pornography had computer files "encrypted with DES" that don't have a key held in escrow. "Dead end for us," Gorelick says. "Is this really the type of constraint we want? Unfortunately, this is not an imaginary scenario. The problem is real." All the while, Gorelick knew, as she would later admit to Congress, that the FBI had, in fact, called the NSA to help break codes. An intelligence industry insider said the NSA involvement is legal. "What makes it legal probably is that when [the NSA] does that work they're really subject to all the constraints that law enforcement is subject to." This source went on to explain that if the FBI used any evidence obtained from the NSA's code-breaking work to make it's case in court, the defense attorney could, under oath, ask the NSA to "explain fully" how it managed to crack the codes. "If I were advising NSA today I would say, there is a substantial risk that [a defense attorney] is going to make [the NSA] describe their methods," he said. "Which means it's very difficult for the NSA to do its best stuff in criminal cases because of that risk." Some 20 years ago, Sen. Frank Church, then chairman of the Senate Intelligence Committee, warned of getting the NSA involved in domestic affairs, after investigating the agency for illegal acts. He said the "potential to violate the privacy of Americans is unmatched by any other intelligence agency." If the resources of the NSA were ever used domestically, "no American would have any privacy left . . . There would be no place to hide," he said. "We must see to it that this agency and all agencies that possess this technology operate within the law and under proper supervision, so that we never cross over that abyss. That is an abyss from which there is no return," he said. And yet, the Clinton Administration has already laid the groundwork for such "mission creep" to take place, with the forming of this "Manhattan Project." But if the Justice Department can tap the NSA at will -- a position of questionable legality that hasn't been fully aired in public debate -- why play such hardball on the key escrow encryption issue? Simple answer: Key escrow is an easier route. As my intelligence community source pointed out, bringing the NSA into the mix causes problems when a case goes to court. Better to have them work in the background, unseen and without oversight, the Administration feels. With key escrow in place, there are few legal issues to hurdle. In the meantime, the Justice Department has started the NSA down the road to crypto mission creep. It could be a road of no return. Meeks out...

1 0

RE: Goodbye
by Blanc Weber 17 Dec '03

17 Dec '03

From: James A. Donald The glory days are long past, and cannot be revived by forming a new mailing list. ....................................................................... I've never thought of the cypherpunks as being of the mind to "abandon" the "worthless" masses to their own devices. Rather, I thought of them as being of the mind to associate among those who thought like themselves about privacy, who shared the values of self-reliance, who supported the ideals of individual liberty, and who were open to including on the list anyone who wanted to better understand the subjects which are discussed there. But that quote above reminds me of the patent office's statement, often recounted, of how everything which could be invented had already been invented, and there couldn't possibly be any more new ideas introduced. It all depends, as usual, on the individuals involved - on the quality they bring to the subject, to the list, to the enterprise. Interesting question: what do elite sophisticates *do*, once they've reached their pinnacle? .. Blanc >

2 1

Attention Random Nerd!!!
by WEB Tech #5 17 Dec '03

17 Dec '03

Don't worry. We haven't forgot about you. You can expect a detailed response to your inquiry on Tuesday. Thanks for your patience. Webtech5 Rollerblade Consumer Service

1 0

Re: [IMPORTANT] Firewalls
by amnesia＠chardos.connix.com 17 Dec '03

17 Dec '03

Timothy C[reep] May has been fired from Intel for stealing office supplies.

1 0

Re: IP: - Biham/Shamir Differential Fault Analysis of DES, etc
by John Gilmore 17 Dec '03

17 Dec '03

Note that this attack requires physical access to the DES chip, to stress it so it will fail. It works great against "tamper-proof" devices such as smart cards. It doesn't work against encryption happening at any distance from the attacker (e.g. across the network). It doesn't work against stored information like PGP-encrypted email messages either. However, it might be possible to use the attack by beaming disruptive energies (heat, electrons, microwaves, etc) at a computer which is doing a lot of encryption, while simultaneously monitoring that computer's activity across a network. John

1 0

Your editorial in the 10/14 PCWeek
by Marshall Clow 17 Dec '03

17 Dec '03

Geoff -- I never did finish that article for you about the Apple crypto alliance, but here's something you moght like. I will be out this weekend. If you have any questions, email; I will respond Sunday night. [ PS. This may appear in the 10/21 PC Week. ] On the other hand, it may be too esoteric for TidBITS.... ------------- Mr Gibson -- I'm afraid that I must disagree with your editorial in the October 14th issue of PC Week titled "Encryption Law Change: Good News" <http://www.pcweek.com/opinion/1014/14edit.html>. This is not a good change, but rather another attempt by the government to get it's "key escrow" (now renamed 'key recovery') agenda added to commercial software products. Let's start with the facts. A) This is not a change in the law. There is no law regarding export of encryption software. Congress has never passed any such law. These are State Department regulations, and presidential decrees. These regulations, which have the force of law to you and me, were never debated or voted upon by our elected representatives. They can be changed tomorrow the same way. In fact, they can be changed and the public need not even be notified. B) The Clinton administration agreed to allow the export of unescrowed encryption that used 56 bit keys for six months (with up to three six month renewals) on the following conditions: 1) That the companies shipping the software agree (in principle) to incorporate 'key recovery' features in their software. 2) That the companies shipping the software make status reports to the government every 6 months as to their progress towards a key recovery scheme. If they are making satisfactory progress, their export license will be renewed for another six months. 3) That after two years, they discontinue selling their 56 bit software, and only sell the 'key recovery' software. Condition #1 is what the Clinton Administration has been fighting for since 1993 when it first announced the Clipper chip, the ability to recover the plaintext of any encrypted communication. Condition #2 puts these companies at the mercy of a government panel which will decide, every six months, whether or not an internal project is proceeding 'satisfactorily'. If not, the company will be unable to sell its' encryption products abroad. This is a _big_ stick that the government can use to influence companies' actions. Condition #3 requires the companies to obsolete their products in two years, because they will no longer be able to sell the "unescrowed" software abroad, and because one of the goals of "key recovery" is that it will not interoperate with software that does not support "key recovery". B) Your editorial states: >Previous administrations have turned a deaf ear to industry pleas, as >had the Clinton administration for three and a half years. Until now, >the White House has toed the line drawn by law enforcement officials, >which equated powerful encryption technology with munitions. Now, the >administration has, under high-tech standard-bearer Vice President Al >Gore, done a complete about-face. > Even if this was, as you wrote, a "complete about face", and there were no other conditions (such as key recovery) involved, it would still be inadequate. A paper written this year by a group of noted cryptologists titled "Minimal Key Lengths for Symmetric Ciphers to Provide Adequate Commercial Security" recommends that the minimum key length for security today was at least 75 bits, and for data that needs to be secured for the next twenty years, at least 90 bit keys should be used. The entire paper is availiable at <ftp://ftp.research.att.com/dist/mab/keylength.txt> (ASCII) and <ftp://ftp.research.att.com/dist/mab/keylength.ps> (PostScript). It is fascinating reading. You also wrote: >The administration plan also calls for private companies to surrender >encryption keys should court orders demand them. > This is incomplete and misleading. The original Clipper press release, (availiable at <http://www.epic.org/crypto/clipper/white_house_statement_4_93.txt> ) states: >Q: Suppose a law enforcement agency is conducting a wiretap on > a drug smuggling ring and intercepts a conversation > encrypted using the device. What would they have to do to > decipher the message? > >A: They would have to obtain legal authorization, normally a > court order, to do the wiretap in the first place. They > would then present documentation of this authorization to > the two entities responsible for safeguarding the keys and > obtain the keys for the device being used by the drug > smugglers. The key is split into two parts, which are > stored separately in order to ensure the security of the key > escrow system. > Please note the word "normally". The Clinton Administration, even though repeatedly asked, has never explained what consitutes an abnormal case, and what they would consider authorization in that case. This was not a typo. This Q&A was part of an official White House press release. C) What exactly is "key recovery"? How does it work? No one knows. The White House press release doesn't say. The idea is that the 11 vendor coalition will work out the methodology, and the White House will "approve" it. This is, in my mind, one of the slickest moves in the whole situation. The administration has taken a problem that they have been unable to solve to the satisfaction of the computer industry (access to all encrypted communications), and suddenly, it's not the administration's problem any more! It's the computer industry's problem! >From an article in a recent ComputerWorld: (<http://www.computerworld.com/search/AT-html/9610/961014SL42crypto.html>) >And speaking of failures to communicate, take IBM, which recently teamed >with 10 companies to develop technology for a "key-recovery" system >intended to satisfy the new export criteria. > >Through some mysterious process, the scheme will allow the government to >get encryption keys when it needs them, without having to hold them "in >escrow" the Clipper approach. > >Why "mysterious? IBM's press release announcing the initiative was four >pages of self-congratulatory drivel with almost no information about >what the companies would develop or how it would work. > >Reminded of the secret Clipper algorithm, I sought details from IBM. I >asked a spokeswoman why the company hadn't just put out a nice, snappy >white paper explaining its new approach to key recovery. > >"We spent three months trying to do that, quite literally," the >spokeswoman said. "It's pretty confusing stuff, and whenever we get it >on paper, we aren't happy with it." > > Observers believe that if the 56-bit experiment proves successful, >relaxation of the restriction that still covers 128-bit key software >will follow. This could take place two years hence. > Who are these "observers"? They don't seem very observant to me. The government has stated that the export of unescrowed 56 bit encryption software is a temporary measure, and will be prohibited again (at the very latest) on Jan 1, 1999. At that time, the only (medium or) strong encryption software that will be allowed to be exported will be that which supports "key recovery". In conclusion, this is not a "refreshing change of direction" for the Clinton administration. This was "more of the same", albeit better disguised. The 11 companies who signed up for this coalition are receiving very little (56 bit export for at most two years), in exchange for giving up control of their encryption technologies to the government forever. -------------- -- Marshall Marshall Clow Aladdin Systems <mailto:mclow@mailhost2.csusm.edu> "It is not the function of our Government to keep the citizen from falling into error; it is the function of the citizen to keep the Government from falling into error." --Justice Robert Jackson, _American Communication Association v Douds_, 343 U.S. 306, 325 [1952] [via ed.nelson(a)SYSLINK.MCS.COM]

1 0

Re: Blinded Identities [was Re: exporting signatures only/CAPI]
by whgiii＠amaranth.com 17 Dec '03

17 Dec '03

In <Pine.SUN.3.94.961015211026.16787C-100000@polaris>, on 10/15/96 at 09:20 PM, Black Unicorn <unicorn(a)schloss.li> said: >On Mon, 14 Oct 1996, William H. Geiger III wrote: >> In <Pine.SUN.3.94.961014035114.28315K-100000@polaris>, on 10/14/96 at 04:01 AM, >> Black Unicorn <unicorn(a)schloss.li> said: >> >Banking is as much about confidence as any business can be. Anonymous or not, the >> >presence of funds which >> >infringe on regulations in one area or another are frightening to normal banking >> >customers. >> >> BULL!!!! >> >> There are only two things the banking customers care about: >> >> 1. Will my money be there in the morning? >> >> 2. What is my rate of return? >Both of these are affected by large scandals at banks. scandals=unwarranted media hype. True scandals of interest to the investment & banking community are along the lines of fraud, theft, embezzlement, poor or risky investment. Items that directly relate to 1 & 2. The S&L debacle in the US during the 80's is a good example. The rest is just crap to either: A: Sell more newspapers, and/or B: Increase government power. >In the case of the first example, runs on banks are hardly unheard of in relation to >major and even somewhat minor revelations about the source of deposit funds where >that source is criminal. (Again, I cite Union Bank of Switzerland which saw a three >day run of almost $200 million after >disclosures about UBS accounts which were used for kidnapping randsom. >DeBeers was one depositor which explicitly attributed their account >closures to the news). >The rate of return is directly affected by costs to the bank. Legal costs (even in >Switzerland) of defending against government and private party discovery and >compelled disclosure are severe. Need I even discuss the cost to the "legitimate" >BCCI account holder? What about the cost to Switzerland's banking industry due to the fact that they nolonger uphold their investors anonyminity?? Their industry has lost Billions due to their cow-towing to US and other governments snooping into investors accounts. What "cost" does that have to the account holders of their banks?? >And if customers are unconcerned about elements ther than #1 and #2, >why are such pains taken to invest in offshore institutions where the >costs (in sweat alone) can be higher? Because it is justified by avoiding government interference in their financial activities which in the long run increases their rate of return well above the added cost of doing so. >> The rest of it is a bunch of Govenment & Media hype & bull shit!! >The above incidents are easily found with a quick trip to the library. <sigh> Why so I can re-read the unwarranted media & government attacks on banking institutions because, god forbid, they actually took someone's money without running them over the coals first. Dam those nasty banks all to hell, they don't report every transaction of their investors to every government that may be interested. >The bottom line is that until anonyminity is not seen as some kind of >invariably criminal act with respect to banking, legitimate and >illegitimate money will be as like charged particles. No the bottom line is money is money. Their is no such thing as "legitimate" or "illegitimate" money. Banks should not be forced to play policemen, their job is processing money. Next time, get a CLUE. >Next time, stick to web consulting. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Who died an made you god of the banking industry?? Last time I looked Walter Wriston was still alive and well. :) (Incase you are too clueless to know who that is I am sure a trip to your local library should help.) -- ----------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting WebExplorer & Java Enhanced!!! Cooking With Warp 4.0 Author of PGPMR2 - PGP Front End for MR/2 Ice Look for MR/2 Tips & Rexx Scripts Get Work Place Shell for Windows!! PGP & MR/2 the only way for secure e-mail. Finger whgiii(a)amaranth.com for PGP Key and other info ----------------------------------------------------------- *MR/2 ICE: What I like about MS is its loyalty to customers!

1 0

NYT on DFA
by John Young 17 Dec '03

17 Dec '03

The New York Times, October 19, 1996, p. 37. 2 Israelis Outline New Risk To Electronic Data Security Hints That 'Smart Cards' Aren't So Smart By John Markoff San Francisco, Oct. 18 -- Two of Israel's leading computer scientists say they have found a way to more easily decode and then counterfeit the electronic cash "smart cards" that are now widely used in Europe and are being tested in the United States. The researchers have begun circulating the draft of a paper that points out higher security risks than those discovered last month by scientists at Bell Communications Research. The Bell communications researchers had reported that it might be possible to counterfeit many types of the "smart cards" that are being tested by banks and credit card companies, including Visa and Mastercard. The two Israeli scientists, Adi Shamir, a professor at the applied mathematics department at the Weizmann Institute, and Eli Biham, a member of the faculty of the computer science department at the Technion, reported that in addition to the so-called public key coding systems that were found vulnerable by the Bellcore team, private key data coding systems such as the American Data Encryption Standard, or DES, can be successfully attacked if a computer processor can be made to produce an error. The two Israeli's made a draft of their research available via the Internet on Thursday. In their paper the two wrote, "We can extract the full DES key from a sealed tamperproof DES encryptor" by analyzing fewer than 200 encoded messages. Both public key and private key data scrambling methods are based on the difficulty involved in factoring large numbers. A public key system permits two parties who have never met to exchange secret information. A private key system requires that a secret key be exchanged beforehand. Data coding experts said that the new Israeli method might be a more practical system than the previously announced Bellcore method, because unlike public keys, which are frequently used only once per message, a private secret key may be used repeatedly to scramble electronic transactions. "This seems a lot closer to something that might actually be used," said Matt Blaze, a computer researcher at AT&T Laboratories. Smart cards have been promoted as tamper proof, which is why computer scientists at Bellcore, one of the nation's leading information-technology laboratories, sounded the alarm last month, saying that a savvy criminal might be able to tweak a smart-card chip to make a counterfeit copy of the monetary value on a legitimate card. Executives at smart card companies said at the time that the attack was theoretical and that it would be impossible to make a smart card generate an error without actually destroying the card. However, Mr. Biham responded that he believed such hardware attacks were possible. The cards are generally damaged using heat or radiation, which causes the computer chip in the card to generate an error, which the Israeli scientists used to obtain the code key and copy the card. "I have ample evidence that hardware faults can be generated without too much difficulty," he said in an electronic mail message. "As a consultant to some high-tech companies, I had numerous opportunities to witness successful attacks by commercial pirates on pay-TV systems based on smart cards. I know for a fact that some of these attacks were based on intentional clock and power supply glitches, which can often cause the execution of incorrect instructions by the smart card." Other researchers said that the class of attacks demonstrated by the Bellcore team and the Israelis had been known by some members of the tightly knit community of cryptographers for several years, but the results had not been published. "Some of the smart card manufacturers are well aware of this flaw," said Paul Kocher, an independent Silicon Valley data security consultant. "But it doesn't mean that they have fixed it." [End]

1 0