December 2003 - cypherpunks-legacy

LC-1
by Toly Tcymbal 17 Dec '03

17 Dec '03

Did anyone hear about a device called LC-1? It is a voice encryption hardware that uses IDEA. I've found info about it on a Germany server. Tried to contact two guys that developed the thing and got no answer. One of the guys' names is Kurt (khuwig(a)cs.uni-sb.de) and the other one is Marko (maba(a)stud.uni-sb.de) Any comments would be appreciated. TIA. TT.

2 1

A new attack to RSA on tamperproof devices
by deng＠iss.nus.sg 17 Dec '03

17 Dec '03

A New Attack to RSA on Tamperproof Devices Feng Bao (baofeng(a)iss.nus.sg) Robert Deng (deng(a)iss.nus.sg) Yongfei Han (yfhan(a)iss.nus.sg) Albert Jeng (jeng(a)iss.nus.sg) Teow Hin Nagir (teowhin(a)iss.nus.sg) Desai Narasimhalu (desai(a)iss.nus.sg) Information Security Group Institute of Systems Science National University of Singapore 23rd October 1996 In September 96, Boneh Demillo and Lipton from Bellcore announced a new type of cryptanalytic attack against RSA-like public key cryptosystems on tamperproof devices such as smart card (see, e.g., http://www.bellcore.com/PRESS/ADVSRY96/ medadv.html). However, due to the sketchiness of the Bellcore attack, it is impossible to perform a meaningful assessment of this attack until more detailed information becomes available. On October 18, Eli Biham and Adi Shamir published their new attack, called Differential Fault Analysis (DFA), to secret key cryptosystems, such as DES. Some concrete ideas on how this attack works were revealed in their announcement (see, e.g., http://jya.com/dfa.htm) Our work here was motivated first by the Bellcore announcement and then by the DFA announcement. We present an attack to RSA on tamperproof devices. At the time of writing, we have no idea whether our attack is similar to the Bellcore attack. We make the following assumption as in the Bellcore and DFA announcements. Assumption: By exposing a sealed tamperproof device such as a smart card to certain physical effects (e.g., ionizing or microwave radiation), one can induce with reasonable probability a fault at a random bit location in one of the registers at some random intermediate stage in the cryptographic computation. (We will explain later that our attack also works against multiple bit faults). Without loss of generality, assume that n=pq in RSA is a 512 bit number. Let e be the public exponent which is publicly known and d be the secret exponent which is stored inside the tamperproof device. Let P be a plaintext, then the corresponding ciphertext is C = P^e (1) (In the following, only residues modulo n are shown, e.g., we use P^e instead of P^e mod n). We denote the binary representation of the secret exponent as d = d511|d510| ...|di|...|d1|d0 (2) where di, takes value 1 or 0, is the ith bit and where x|y denotes concatenation of x and y. Further, we denote C0=C, C1=C^2, C2=C^{2^2}, ..., C511=C^{2^511} (3) Given C and d, we can express the corresponding plaintext P as P=(C511^d511)(C510^d510)...(Ci^di) ...(C1^d1)(C0^d0) (4) We assume that the attacker is in physical possession of the tamperproof device and that he can repeat the experiment with the same key by applying external physical effects to obtain outputs due to single bit errors. To simplify the description, we illustrate our attack by two examples. EXAMPLE 1: Suppose that one bit in the binary representation of d in equation (2) is changed from 1 to 0 or vice versa, and that the fault bit position is randomly located. An attacker arbitrarily chooses a plaintext P and computes the ciphertext C using (1). He then applies external physical effects to the tamperproof device and at the same time asks the device to decrypt C. Assuming that di in (2) is changed to its complement di', then the output of the device will be P'=(C511^d511)(C510^d510)...(Ci^di') ...(C1^d1)(C0^d0) (5) Since the attacker possesses P, he can compute P'/P = Ci^di'/Ci^di (6) Obviously, if P'/P = 1/Ci, then di = 1, and if P'/P = Ci, then di = 0. The attacker can re-compute Ci and 1/Ci for i = 0, 1, ..., 511, and compares (6) to these values in order to determine one bit of d. The attacker can repeat the above process using either the same plaintext/ciphertext pair or using different plaintext/ ciphertext pairs until he obtains enough information to uncover the binary representation of the secret exponent d. EXAMPLE 2: For the sake of simplicity, here we assume that in decrypting a ciphertext, the tamperproof device first computes the data sequence in (3) and then computes (4). We also assume that the attacker applies external physical effects to the tamperproof device to induce an one bit error in Ci, i = 0, 1, ..., 511. Suppose that the one bit error is in Ci, we denote the corrupted value as Ci'. Then the output from the tamperproof device is P'=(C511^d511)(C510^d510)...(Ci'^di) ...(C1^d1)(C0^d0) (7) The attacker can then compute P'/P = Ci'^di/Ci^di = Ci'/Ci (8) (Note that di in (8) must be 1.) Suppose that the attacker has computed all the possible Ci'/Ci values in advance (there are a total of 512x512 such values) and stored them somewhere. Now the attacker can compare all these values with P'/P. Once a match is found, the attacker knows i then knows that di is 1. The attacker repeats the above process until he has enough information to determine d. The above examples are just meant to illustrate the basic ideas of our attack. Anyway, by the two examples we showed that: One bit fault at certain location and time can cause fatal leakage of the secret key. Such leakage gradually increases as the above procedures are repeated using one or multiple pairs of P and C. It should be noted that our attack also works for multiple bit errors. Assuming two bit faults and consider the scenario of EXAMPLE 2. The possible Ci'/Ci values now increases from 512 x 512 to 512 x 512 x 512. In this case, matching P'/P requires more time, while with large possibility you obtain 2 di's once a match is obtained. To conclude this research note, we would like to say a few words on how to resist this kind of attacks. 1. The attack may be avoided by calculating values 2 times and checking the two results. However, this approach doubles the computational time. As pointed out by Bellcore, this double computation method also avoids their attack. 2. In many cases, the encryption key e is usually small. So we can verify the result by checking P^e= C ? This approach is much more efficient than the double computation approach if e is small. 3. In some protocols for digital signature, a random string is chosen by the smart card and concatenated to a message m which is to be signed by the smart card. For example, m is a 412 binary string given to the smart card. The smart card randomly chooses a 100 bit number r and the output is (C|r)^d. Since r is different each time, the attack does not work in such case.

1 0

GET ME OUT OF HERE - TOO!
by crumrig＠us-state.gov 17 Dec '03

17 Dec '03

UNSUBSCIBE

3 2

cypherpunks ftp site
by Norman Hardy 17 Dec '03

17 Dec '03

I am trying to get some code from <ftp.csua.berkeley.edu:pub/cypherpunks>. I get: ftp> get README.MIRRORS 200 PORT command successful. 425 Can't create data socket (128.32.43.51,20): Address already in use. ftp> Any suggestions to how to get eliptic.src and elliptic.doc reported to be at <ftp.csua.berkeley.edu:pub/cypherpunks/ciphers>? I searched AltaVista.

3 2

Re: Finally -- A crypto question from me...HD encryption
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

>On Tue, 22 Oct 1996, Michael B Amoruso wrote: >> Are there any good programs out there that can encrypt my HD?? Since >> there probably are, please mention some and where I can get them. Also, >> no one mention PGP. PGP works on files, not disks, and it's been talked about here pretty often :-) The Secure Drive and Secure Device programs (secdrv and secdev) do disk encryption. Some of the commercial products use single-DES, so they're marginally useful if they don't implement things carelessly, some use "Our really fast proprietary encryption" and are thus worthless. Others just try to encrypt the FAT or other headers and therefore don't stop Bad Guys from grepping through your disk for real data. Your Macintosh mileage may vary. For Unix-like systems there's CFS, Matt Blaze's Crypto File System. At 04:36 PM 10/22/96 -0700, Perry Farrell <pneyz(a)armory.com> wrote: >Yes, the KOH disk encryption system. It is a small little thing that >encrypts the FAT (I believe) and nothing will work unless you know the Don't bother. The KOH folks once talked about using virus techniques to spread encryption that was good for you, and can therefore be presumed to be terminally clueless. If your description of KOH's disk encryption strategy is correct, it's not really useful against professionals. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

2 1

Re: Stopping the buying of candidates
by jim bell 17 Dec '03

17 Dec '03

At 08:13 PM 10/22/96 -0700, Declan McCullagh wrote: >There would seem to be serious First Amendment problems with this scheme. As there is with political donation restrictions generally. I suppose the fig leaf they wrap around this is to buy the cooperation of the candidates by matching funds for those candidates who agree to restrictions. Do the laws really prohibit the giving of more than a certain amount of money, or just the act of receiving it? >If you wanted to give or withhold support, you should able to say that >you did or didn't donate money. Besides, interest groups would always be >able to telegraph the news of the donation -- while the public remains >in the dark. It may be better for the public to have full disclosure. >-Declan Sure, you can't keep people from talking. However, one way to sabotage the usefulness of telling is to allow everybody else as well to make the same claim, with essentially no way for the candidates to tell who is REALLY giving the money. Make the lie just as credible as the truth, and the value of knowing the truth is destroyed. If nobody can trust anyone else's word, then no candidate could know who REALLY ought to be rewarded for a campaign contribution, breaking the circle of quid-pro-quo. The candidate still gets the money, of course, and the contributor is still free to both donate and speak...separately. The thing that's been cut off is the association between the money and the speech...which is exactly what the problem is, isn't it? I haven't thought this through well enough to know just how possible such a system might be, but this is exactly the kind of goal that cryptography and data-blinding functions can accomplish. Frankly, I'd prefer a more effective (and more lethal) solution, but for all those who object to AP, here's my alternative plan. >On Mon, 21 Oct 1996, jim bell wrote: > >> At 09:24 AM 10/17/96 -0800, Timothy C. May wrote: >> > >> >There are several swirling threads about the development of crypto systems >> >(e.g., "binding cryptography," "key recovery," "one-way traceable e-cash") >> >that are designed to allow law enforcement some ability to track illegal >> >transactions, catch some criminals, etc. >> >> One of the other items on my wish-list (short of a more, uh, "permanent" >> solution to politics) is a system to actually enforce the anonymity of >> political donations. What I mean is this: As bad as a large political >> contribution is, what's worse is that the candidate who receives it knows >> who it is from, and how large it is, etc. Given the recent flap over the >> Indonesian donations to the DNC, it seems to me that it would actually clean >> up politics if there were a mechanism to collect donations, blind them and >> send them to the proper candidate, but hide the actual source of that money. >> Hide it from the candidates, not necessarily the anyone else. > >// declan(a)eff.org // I do not represent the EFF // declan(a)well.com // > > > > Jim Bell jimbell(a)pacifier.com

1 0

Stopping the buying of candidates
by jim bell 17 Dec '03

17 Dec '03

At 09:24 AM 10/17/96 -0800, Timothy C. May wrote: > >There are several swirling threads about the development of crypto systems >(e.g., "binding cryptography," "key recovery," "one-way traceable e-cash") >that are designed to allow law enforcement some ability to track illegal >transactions, catch some criminals, etc. One of the other items on my wish-list (short of a more, uh, "permanent" solution to politics) is a system to actually enforce the anonymity of political donations. What I mean is this: As bad as a large political contribution is, what's worse is that the candidate who receives it knows who it is from, and how large it is, etc. Given the recent flap over the Indonesian donations to the DNC, it seems to me that it would actually clean up politics if there were a mechanism to collect donations, blind them and send them to the proper candidate, but hide the actual source of that money. Hide it from the candidates, not necessarily the anyone else. This may sound difficult. After all, it will be argued that a given contributor will want to take credit for a donation and tell those who receive it; one way to help avoid this is the assess huge penalities (say, 10 times the value of the contribution claimed) to the party or candidate who is told of the source of a contribution but does not report the breach of security. The system could be set up to actually encourage people to test it and report fraud, and perhaps be awarded anonymously for providing evidence of misbehavior; and people should be able to (falsely) claim credit for donations, at least to the candidates themselves. Any donation reported to a candidate must be declared by the candidate and is then lost; their motivation for reporting it is that it'll be lost 10x if they don't. The result should be that the candidates should have no idea where the money is actually coming from, only that they are getting it. The contributors should be able to verify (via some sort of encrypted-open-books system) that the money they donate is actually being credited to the candidates, but they should not be able to use this system to prove to the candidate they made the contribution. I really wish those people who are developing that "binding cryptography" proposal would change their minds and decide to work on a proposal such as this, one that might actually help fix the political money problem. Jim Bell jimbell(a)pacifier.com

3 2

Re: Timmy May is a jerk
by c62op27＠ibx.com 17 Dec '03

17 Dec '03

Ok, I'm a new subscriber. I take it as a given that Timmy May is a jerk, but who is he?

2 1

Re: PIS_son
by jim bell 17 Dec '03

17 Dec '03

At 04:11 PM 10/22/96 -0700, Jeff Weinstein wrote: >John Young wrote: >> 10-17-96, BuWi: >> "Apple, IBM, JavaSoft, Motorola, Netscape, Nortel, Novell, >> RSA, and Silicon Graphics Announce PICA Crypto-Alliance" >> The PICA specification will also be designed to make the >> task of developing differing domestic and exportable >> security requirements much easier. [GAK alliance 2.] > > John, I think you are misreading the intent here. By making >it easier to develop separate domestic and exportable >versions of a product, we foil the government's attempt to >force weak domestic encryption because it is too much work to >maintain two different versions. What about making it easier to interconvert the domestic and exportable versions of the program? Okay, I understand that given your position you might not want to come out on the record on this issue, but it seems to me that it would serve your interests to make it as easy as possible for a foreign buyer to convert a legally-exported copy of Netscape into an export-restricted one. The default way for foreign buyers: Buy Netscape from your Co., put it on the shelf, download illegally-exported version and use it. Doable, obviously. However, a more subtle way would be to add (or, for that matter, subtract) a portion of the program that controls whether or not export-quality encryption would "go." True, the "erase a file to enable good crypto" might not fly, but the opposite might. I'm not talking about conventional "crypto with a hole," but simply a program which always contains crypto whose functioning is limited by an external program. Jim Bell jimbell(a)pacifier.com

1 0

Norton Your Eyes Only
by inssdl＠dstn21.dct.ac.uk 17 Dec '03

17 Dec '03

I've just managed to get hold of a copy of this program. Does anyone know what algorithms are used within the encryption/decryption parts of the program or is it just an overgrown version of Norton's DISKREET? ++ Please note new e-mail address and new web page location ++ ********************************************************************** David Lucas PGDip Software Engineering @@ BEng(Hons) Civil Engineering Postgraduate Software Engineer, University of Abertay Dundee, SCOTLAND @ E-mail: inssdl(a)dstn21.dct.ac.uk @ 2+2 = 5 for large values of two @ If you're not living on the edge, then you're taking up too much space Organisations can't have opinions, only people can and these are mine. Dave's Doorstep is back!!!! - http://river.tay.ac.uk/~i95dl/index.html **********************************************************************

1 0