December 2003 - cypherpunks-legacy

Re: PGP3.0 & ElGamal
by Steve Reid 17 Dec '03

17 Dec '03

>> Yes, but I believe 3DES has an effective key length of only 112 bits. >> Of course, even this is more than sufficient for a long time to come. > 3DES can have an effective key length of 168 bits if 3 keys are used > instead of two. There are no security problems that I know of from > using 3 keys. The Meet In The Middle attack (MITM, not to be confused with Man In The Middle) is a time-memory tradeoff that works against any multiple encryption. Triple encryption: ciphertext = encrypt(k3, decrypt(k2, encrypt(k1, plaintext))) plaintext = decrypt(k3, encrypt(k2, decrypt(k1, ciphertext))) An MITM attack, as I understand it, works by decrypting from one end and encrypting from the other... Step 1- decrypt(x3, ciphertext) for every possible x3, and store all the results. This requires 2^56 operations and 2^56*8 bytes (550 petabytes?) of memory when done against 3DES. Quite a lot, but it might be doable. Step 2- decrypt(x2, encrypt(x1, plaintext)) for every possible x1,x2. This require 2^112 steps with 3DES. If the result you get can be found in the table built by step 1 then you've figured all three keys.

1 0

Exploring hooks in MSIE
by Dietrich J. Kappe 17 Dec '03

17 Dec '03

A little bird told me that MSIE has Javascript hooks that allow a site to check whether all Microsoft products on a client machine are properly licensed. Has anyone investigated the Javascript (err, Jscript) implementation in MSIE to see if this is true? The same little bird told me that MS is building some use of this "feature" into their Websites. Can any MS consultants corroborate on this issue? This is just a rumor. The names of the birds have been changed to protect the innocent. DJK

2 1

Re: NT insecurity
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Sat, 16 Nov 1996 17:00:56 -0500 (EST), Michael H. Warfield wrote: > Hooo Hummm... Another one... >> Given the recent comments about insecure machines, I thought it was >> interesting to note that you can clear *every* password on an NT box by using >> a diskeditor to corrupt the password file (Boot off of a floppy and use >> NTFSDOS if you have to). It'll reboot several times and then you'll be >> allowed to login. > Much as I absolutely detest NT, lets reitterate what everyone else >on this list has already heard too TOO many times... If you have physical >access to the machine, it ain't secure. It doesn't matter what operating True. However, as has been reiterated many times, NT is being marketed as a secure platform. Unix people tend to know that you need to work to secure it. MS hype might lead some of the non-cypherpunk admin types to believe it's secure. Trust me. I hear from these people all the time! # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

2 1

RFC: A UNIX crypt(3) replacement
by Joshua E. Hill 17 Dec '03

17 Dec '03

I'm trying to think of a function to replace UNIX's crypt(3). My design criteria are as follows: 1) I want it to be secure. 2) I would like to use a cryptographic hash. 3) I would like to use well understood cryptographic primitives. 4) I would like to use a salt, and I would like the salt to be considerably larger than the current salt. 5) I would like the process to be able to be more computationally intensive than crypt(3). 6) The ability to use the algorithm in any setting domestic (US) and abroad is a concern, but not a primary one. #1 is important for the obvious reasons. #2 is important because a one way hash allows for a secure way of checking the original password against the entered password. No password should be able to be recovered by simply reading a file, or finding an internal key. #3 is basicly a result of #1 #4 and 5 makes the password system more resistant to a dictionary- type attack. Several of the more popular password guessers (ie: Crack) get a significant speed increase from the fact that they only have to hash each of the words once per salt. I would like it to be possible for each user to have an independent salt (for any reasonable system size). I would also like this function to be able to be scaled to that it can be slower than crypt(3). This will also hinder a dictionary attack. #6 is a byproduct of silly legal concerns. The algorithm that I developed was heavily influenced by RFCs 1852 [1] and 1828 [2] (IP Authentication using SHA and MD5, respectively), and "Keying Hash Functions for Message Authentication" by Mihir Bellare, Ran Canetti, and Hugo Krawczyk [3] This algorithm borrows several concepts from [3]: The idea of the keyed hash, where the key is used as the hash's IV, or Initial Value. Its security is completely based on the choice of the key, and the strength of the underlying hash function. The concept of the NMAC (Nested MAC), and security analysis of it. The Algorithm: Given that: . = the concatenation operator P = the user pass phrase H(m) = the hash of the message m l = length of the hash returned by H(m) H(k,m) = the keyed hash of message m, using key k (as the IV) N = salt, length l = (n1 . n2) where n1 and n2 are sub-salts i = the iteration number E = a temporary value = (e1 . e2) K = key = (k1,k2), where k1 and k2 are the sub-keys used in the NMAC NMAC(k, m) = H(k1, H(k2, m)) In several cases a value is said to be equal to the concatenation of two other values (we'll take N as an example); ie N = (n1 . n2) This means that N is divided into two equal sized chunks, n1 and n2. (n1 . n2) = N initially: (1) E = H (P) (2) k1 = (e1 . n1), k2 = (e2 . n2) (3) T0 = NMAC(K, n) And then: (4) T(i) = NMAC(K, T(i-1) . n . T(i-1)) (repeat (4) a number of times) In (1) the user pass phrase is hashed using the non keyed hash, and the resulting value is kept in E. In (2) k1 is formed by concatenating the first half of E and the first half of the salt. k2 is formed by concatenating the second half of the key with the second half of the salt. Now each sub-key is of length l. In (3) the NMAC of n is assigned to T0 and then in (4) T(i) is calculated by doing the NMAC of the value of the previous hash concatenated with n concatenated with the value the previous hash. Step (4) is repeated a known number of iterations. "Keying Hash Functions..." [3] seems to imply that the security of this hash would be based on the length of l and the underlying hash function, H. Because of the way that K is used, the security granted is a function of l/2, not l. (For further explanation see [3]) I was thinking of implementing this using SHA-1. This would lead to a 160 bit value for l, hence the security would be based on an 80 bit key. Some modifications that I have considered, and would like feedback on are: I was thinking of making the keys used for the hash come from the previous hashes, and then hash a constant string. ie: T(i) = NMAC(T(i-2) . T(i-1), P . n . P) instead of having a more-or-less constant key, and constantly changing what is being hashed. I also am not sure that the string that I'm hashing is ideal. Would (n . P . n ) be better? - ------------------------------------------------------------------------- [1] Metzger, P. and Simpson, W. "Request for Comments: 1852, IP Authentication using Keyed SHA" [2] Metzger, P. and Simpson, W. "Request for Comments: 1828, IP Authentication using Keyed MD5" [3] Bellare, Mihir and Canetti, Ran and Krawczyk, Hugo. "Keying Hash Functions for Message Authentication" I very much appreciate comments on any portion of this, or on my general approach. Thanks, Joshua -----------------------------Joshua E. Hill----------------------------- | If you not part of the solution, you're part of the precipitate | -------jehill@<gauss.elee|galaxy.csc|w6bhz|tuba.aix>.calpoly.edu--------

4 9

Re: ideal secure personal computer system
by azur＠netcom.com 17 Dec '03

17 Dec '03

>A friend of mine just got back from a kerberos conferance at MIT, at >dinner one night they were talking about fun-n-easy ways to extract >data from a machine. One of them mentioned that after a while, a "on" >Of course, no computer is "secure" without a thermite charge above the >hard drive, and a tamper-resistant case. >"Well, Billy, the Sevret Service is here, they want to take away your > computer (and telephone, and cassette tapes ,and etc.)" >"Okay, mom. It's right over here, Mr. Scarry Secret Service dude." ><lift> "Ffffffts" >"Hey, Billy, what's that smoke coming out of your computer?" > I discussed this seriously with an engineering acquaintence who has done drive design for a number of major companies. He thought this could be easily achieved technically but might present some significant hurdles for getting UL approval :-) Seriously though, there might be a market for an Mission Impossible drive retrofit kits which could be triggered by SW or HW. --Steve PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Steve Schear | Internet: azur(a)netcom.com Lamarr Labs | Voice: 1-702-658-2654 7075 West Gowan Road | Fax: 1-702-658-2673 Suite 2148 | Las Vegas, NV 89129 | --------------------------------------------------------------------- Internet and Wireless Development Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne, Libertarian, for President. http://www.harrybrowne96.org

2 1

Re: One Big Telecoms Company
by Duncan Frissell 17 Dec '03

17 Dec '03

At 09:23 PM 11/15/96 -0800, Dale Thorn wrote: >Progress? Most major cities (when I was a kid) had *several* competing >newspapers, Few realize that NYC today has circa 20 daily newspapers (circa 5 in English and circa 15 in other languages). In addition, I can read a hundred daily newspapers (or more) on the nets. DCF

2 1

Don't Feed the Animals!
by Timothy C. May 17 Dec '03

17 Dec '03

Fact is, I now have more people in my Eudora filter file that at any time in the four years this list has existed. Also a fact, there are more people on this list that at any time in history (despite what some of the New Wave journalists are writing about "the death of the Cypherpunks list"). Fact is, the attention being given to Vulis, Aga, Stathis, Boursy, and other list disruptors (or clueless cross-posters) is _exactly_ what they thrive on: controversy. Being the center of so much attention strokes their egos. I suspect John Gilmore made a tactical error in kicking Vulis off the list, as there are so _many_ workarounds. Vulis is clearly posting more messages, of even greater vitriol, than ever before. Dozens of messages just so far today. And his supporters and detractors are chiming in with equally juvenile taunts. This "aga" personna, for example, seems dead-set on doing whatever he can to get himself added to the "Unwelcome on Cypherpunks" list. A predictable effect, I'm afraid. Not that I question John's right to do as he pleases with his machines. This list is, after all, operated at his expense on his hardware. [A minor note, though. I disagree with the abstract notion that John "created" the list, and now "owns" the list. Eric Hughes, Hugh Daniel, and I proposed a mailing list after the first Cypherpunks meeting, and Hugh set it up. John volunteered his machine, toad, as he has volunteered it for so many other projects in the past. While John is in an important sense free to discontinue his hosting of the list, it is also true that traditional notions of "ownership" are not the full story. For example, if the San Francisco Marriot Hotel plays host to the CFP Conference, in any sense is it proper to say they "own" the conference? If a church volunteers space for a club meeting, do they "own" the club? However, in both cases the host may kick out an especially uncouth or disruptive attendee, modulo specific contract language agreed to by the parties, and this is, I think, all John has claimed to be doing with Vulis. Perhaps a mistake, but certainly within reason. I think John has taken a hands-off attitude toward the list, and has never imposed restrictions on topic, membership, etc. This one case involving Vulis was well-described by John: he asked Vulis to stop sending 50K byte rants about the Armenians and Turks to the list--consider that 50KB x 1500 destinations = 75 MB of outgoing traffic, modulo corrections for aliases, compression, etc. Vulis responded with more insults, basically saying "Make me!!!!" Gilmore said, "OK."] And the issue is not just killfiles and filters. It's a matter of not giving the juvenile disruptors the results they crave. Yes, this message is itself likely to trigger at least a couple of "More lies from Timmy [fart] May" spews from Vulis, and a couple of incoherent rants from newcomers Stathis and Aga. I've been saying little on this issue, compared to dozens of Vulis rants every day (ironic that he calls _me_ the main ranter!), but it's time to remind folks of a basic Net maxim: DON'T FEED THE ANIMALS. --Tim May "The government announcement is disastrous," said Jim Bidzos,.."We warned IBM that the National Security Agency would try to twist their technology." [NYT, 1996-10-02] We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

6 5

It Used to Be Eric's Inscrutable Deficiency
by blanc 17 Dec '03

17 Dec '03

In glancing through and deleting so many messages about how blasphemous and perverted John Gilmore is for having "censored" one list afficionado (more symbolically than in actual fact), I am amused to recall that it used to be Eric Hughes who was the bad guy identified as the Egotistical Slave Master who abused his ownership privileges. Now he's left the list, it is JG who gets the drift & drivel about list management. Strange, too, that those who clamor for freedom of speech are accusing JG of being contrary to his principles. They expect that just because individuals should be at liberty to speak, everyone must therefore be prepared to tolerate all manner and kind of insults against themselves (or be a passive witness to it). In that case, it would mean that because individuals are to be free "to do" as they will, therefore that courtesy and manners are no longer valid, that high standards of personal behavior are not important, that self-command is not required, that exercising one's best judgement is of no practical value for life in the real world. It would mean that in the environment of liberty, it would be incorrect for individuals to prevent assaults against themselves or their morals, against their personal preferences, or against their choice of topics for a discussion list which they started. This would mean that, for instance, it wouldn't be right for free individuals to prevent from being sexually molested, because it would be "censorship" against the perpetrator. These complaintants against censorship must not understand the purpose for freedom of action, of expression, etc.; that they do not understand the need for being "free": it is so that one may, without interferance from uninvited participants, engage in arranging the elements of one's existence for the greatest benefit to oneself. Tolerating insulting drivel does not fall into that category. The environment of liberty to express oneself also permits the exercise of the highest logic possible to an unfettered intelligence. Filling up the mailing list with irrelevant accusations about bizarre sexual practices is not of any logical benefit towards enlightenment on the subjects of encryption or privacy. .. Blanc

3 2

Re: Members of Parliament Problem
by Hal Finney 17 Dec '03

17 Dec '03

From: "Michael Froomkin - U.Miami School of Law" <froomkin(a)law.miami.edu> > [Discussion of blind signatures] > > Brands has a better scheme that I don't understand exactly. He recently > attempted to explain it to me thusly: > > [Brands quote elided] > > Can anyone tell me more? We had quite a bit of discussion of Brands' technology on the list a couple of years ago. Take a look at <URL: http://chaos.taylored.com:1000/0Z/Digital-Cash/Protocols/Brands/Brands-Cash… > which has several pages discussing discrete logs and some of the ideas behind Brands' protocols. Unfortunately I am getting cut-off versions of these pages tonight, along with occasional failures to find a route to this server, so hopefully it is just the net acting up again. Hal

1 0

Re: Remailer Abuse Solutions
by Hal Finney 17 Dec '03

17 Dec '03

From: ph(a)netcom.com (Peter Hendrickson) > Another way to have anonymous posting but not be subjected to spam > and the like is to dispense tokens every week to the subscribers. > They can be signed blindly so that anonymity is preserved, just > like e-cash. I had proposed a similar idea to this a few years ago. You would dispense tokens, each of which needed to be included in an anonymous message. So this prevents spam. But it can also deal with abuse. After sending the message, if it was not abusive, a new blinded token would be broadcast which could only be decrypted by the sender of the original message. But if it was abusive, no new token would be sent. Remailer users would watch these token broadcasts and get their new tokens each time they sent a message. The remailer might have to delay issuing the replacement tokens for a day or two to give the recipient time to complain. If you gave everyone in the world an initial supply of a few tokens, then every time they abused, they'd lose one. But as long as they use the remailer reasonably they can continue to use it forever because they get a new token for each one they use. Messages still remain completely unlinkable and the remailer has no way of learning anything from the tokens it sees since they were all issued in blinded form. Hal

1 0