December 2003 - cypherpunks-legacy

WebWorld 5-6
by Bubba Rom Dos 17 Dec '03

17 Dec '03

1 0

PGP Security
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

I am passing along the following message, not because of my belief in the accuracy or veracity of its contents, but merely because of the fact that it seems to have kept getting eaten up by various email systems in the attempts to send it to its original destination. The first time it was sent via a remailer, it was bounced for ill- defined reasons. The second time it was sent, the remailer was shut down, and remains shut down. Efforts to send it through a second remailer also failed, with no notice from the server of any problems being received. Other email sent through the remailer at the same time encountered no difficulties. I am only noting the facts, here, not proferring any personal judge- ments on the matter, although I have formed my own opinion as to the meaning of these facts, particularly since I, myself, came by this post during the process of email interception. > X-Anon-Password: XXXXXXXXXX > X-Anon-To: XXXXXXXXXXX > X-Anon-Name: XXXXXXXXXXXX XXXXXXXXX, I thought I would reply privately to you, since you seem to at least have a willingness to allow the possibility of compromises to the security of the encryption methodologies behind PGP programs, among others. To begin with, I'm not sure whether you realize it, or not, but the Navy's spook tenacles run deeper, and extend further, than those of any of the more notable or visibly involved agencies who lurk in the background of security and privacy issues. One of the reasons for this is that their physical existence could be said to mirror the Internet in many respects. The very nature of their 'global' home (the sea), has always permitted them access to people and regions which are denied to others. Also, they are often in the position to be involved in what looks to be merely the 'transporting' of people and information. Whether providing escort services or getting drunk in foreign bars, the expertise of naval intelligence has always lain in the area of observation, first and foremost. By far the greatest tool of intelligence agencies on the Internet, has been traffic analysis. Their techniques are sufficiently sophist- icated that I would not be surprised to find out that they can tell more about us from our Internet activity than can be learned from the satellites capable of reading the newspaper over our shoulder as we sit in the park. Traffic analysis involves all measurable quantum of information, the chief concerns being the patterns and timing of data transfer, from which everything ranging from content and motivation can be deduced. If you wish to think in terms of back-doors, then you would be well advised to go beyond the concepts of 'passwords' and 'holes' and try to think in terms of patterns and timing, and other such 'structures' which are peripheral to concerns regarding 'code' and 'mathematics.' i.e. As well as considering the 'content' of what a program returned, you must also consider 'when' the program returned the result, and the patterns in the timing, as well as the content. An analogy could be made to a person who, being interrogated, answers all questions with a predictable rhythm and then 'pauses,' however slightly, in answering a certain question. You can see that what is revealed by the 'content' of the answer can be greatly insignificant compared to what is revealed by the 'delay' in answering. To expand your concept of 'back-doors' and 'holes,' you have to ask questions such as: "Does it take a program or hardware longer to return a result of '0', than to return a result of '1'?" "What factors can be introduced into the hardware and/or software that can influence the patterns and/or timing of various processes and the results they return?" "Can key searches be made more efficient by analyzing such things as rhythm, syntax, etc? What 'details' or 'qualities' of an individual, group, or 'arena of concern' can be analyzed for the purpose of being able to group them into structures which can be searched for?" "How can 'assigning' a value to certain sequences of numbers be used as a pattern to 'filter' the input data into a form which is easier to analyze?" You are aware of 'tricks and techniques' that apply to mathematics and are widely known. i.e. The process of shifting and adding numbers when multiplying by the number '11'. However, what about those quantum of information which are of no consequence to those seeking for the 'final result' of that multi- plication? Can the peripheral effects of mathematic calculations be used to analyze what has taken place, to narrow the scope of inquiry? My nephew describes numbers as getting 'wider' as they get larger, and he does quick checks of his result through his 'feel' for how much 'wider' a number should be when he is done, even in complicated equations which he ill-understands. (He reminds me of Steven Wright, who claims that someone told him that his socks didn't match, and he replied, "Sure, they do. I go by thickness.") I am currently working on a project which involves merging chaos theory with traffic analysis and other processes to analyze the effects that algorithms display when processed through the filters of varying hardware and software structures and methodologies. The RSA algorithm and accompanying RSAREF subroutines were our first focus, for the very reason that there were certain factions behind the scenes of the Zimmerman/RSA agreement who seemed to have an inordinate amount of interest in the subroutines being chained to the algorithm (for reasons that have nothing to do with patent protection). Those whose expertise goes far beyond my own in this area look at the initial results of the analysis as confirming that their is a 'relationship' between the RSA algorithm and the RSAREF subroutines which will enable them to break the system down into workable units for fairly quick analysis. What is interesting is that the results from small probes into other encryption systems show the same potential for exploitation using varying analysis methodologies and processes. (One fairly well-known encryption routine is almost lame enough to reveal its secrets to anyone with a pencil and a stopwatch, as well as the file size and time it takes to encrypt.) While I would rather you didn't publicize the preceding information, as a general rule, I think that is something that should be shared with anyone who is seriously focusing their efforts on better methods of encryption and analysis of encryption methodologies. I am aware of two other groups who are working along the same lines, although with a narrower range of variables than ourselves, and I am certain that there must be more than a few other entities out there who are also pursuing this line of research. I would appreciate any comments you may have on the above, as well as any suggestions you may have. (Despite having a post-graduate degree in an area which required a thorough grounding in mathematics I may have to refer any highly technical suggestions to those in the group who dream in numbers, sunset to sunrise.)

6 7

Cell Phone Code Cracked
by John Young 17 Dec '03

17 Dec '03

For details of the crack see the cryptographers' press release at: http://www.counterpane.com/cmea.html The New York Times, March 20, 1997, pp. A1, D2. Code Set Up to Shield Privacy Of Cellular Calls Is Breached By John Markoff San Francisco, March 19 -- A team of well-known computer security experts will announce on Thursday that they have cracked a key part of the electronic code meant to protect the privacy of calls made with the new, digital generation of cellular telephones. The announcement, intended as a public warning, means that -- despite their greater potential for privacy protection -- the new cellular telephones, which transmit streams of digital information in code similar to computer data, may in practice be little more secure from eavesdropping than the analog cellular phones, which send voice as electronic patterns mimicking sound waves, that have been in use the last 15 years. It was such eavesdropping, for example, that caused trouble for Newt Gingrich when a Florida couple listened to his cellular phone conversation in December about the Congressional ethics inquiry. Now that digital wireless networks are coming into use around the nation, the breaking of the digital code by the team of two computer security consultants and a university researcher confirms fears about privacy that were raised five years ago when the communications industry agreed under Government pressure to adopt a watered-down privacy technology. Several telecommunications industry officials said the pressure came from the National Security Agency, which feared that stronger encryption technology might allow criminals or terrorists to conspire with impunity by cellular phones. But independent security experts now say that the code is easy enough to crack that anyone with sufficient technical skills could make and sell a monitoring device that would be as easy to use as a police scanner is. Such a device would enable a listener to scan hundreds of wireless channels to listen in randomly on any digital call within a radius ranging from 1,000 feet to a number of miles. Or, as with current cellular technology, if a specific person was the target of an eavesdropper, the device could be programmed to listen for any nearby digital call to that person's telephone number. Other possible transgressions would include using the device to automatically harvest all calling card or credit-card data transmitted with nearby digital wireless phones. And, because of a loophole in the Communications Act of 1934, making and selling such devices would not be illegal, though actually using one would technically be against the law. These monitoring devices are not yet available, but security experts said that a thriving gray market was certain to develop. And with technical details of the security system already circulating on the Internet instructions for cracking it will almost certainly make their way into the computer underground, where code breaking and eavesdropping are pursued for fun and profit. Technical details of the security system were supposed to be a closely guarded secret, known only to a tight circle of industry engineers. But the researchers performed their work based on technical documents that were leaked from within the communications industry and disseminated over the Internet late last year. "The industry design process is at fault," said David Wagner, a University of California at Berkeley researcher who was a member of the team that broke the code. "We can use this as a lesson, and save ourselves from more serious vulnerabilities in the future." Communications industry technical experts, made aware of the security flaw earlier this year, have been meeting to determine whether it is too late to improve the system's privacy protections. Already the digital technology is in use in metropolitan areas, including New York and Washington, where either the local cellular networks have been modified to support digital technology or where new so called wireless personal communications services are being offered. "We're already in the process of correcting this flaw," said Chris Carroll, an engineer at GTE Laboratories, who is chairman of the industry committee that oversees privacy standards for cellular phones. But Greg Rose, a software designer for the Qualcomm Inc. a leader in digital cellular systems said that fixing the flaw would be "a nightmare." Tightening the security system, Mr. Rose said, would involve modifying software already used in the computerized network switching equipment that routes wireless digital telephone calls, as well as the software within individual phones. Currently, about 45 million Americans have cellular phones, though most of them so far are based on an older analog standard that offers no communications privacy. But cellular companies are gradually converting their networks to the new digital standard, and the new personal communications services networks going into operation around the country also employ the digital encryption system. Nearly a million P.C.S. phones have been sold in the United States, according to cellular industry figures. Besides Mr. Wagner, the other researchers who cracked the code were Bruce Schneier and John Kelsey of Counterpane Systems, a Minneapolis consulting firm. Mr. Schneier is the author of a standard textbook on cryptography. The new digital wireless security system, which was designed by cellular telephone industry engineers was never intended to stop the most determined wiretappers. But because digital calls are transmitted in a format corresponding to the one's and zero's of computer language, they are more difficult to eavesdrop on than conventional analog calls, which are transmitted in electronic patterns. And digital calls protected with encryption technology -- basically a mathematical formula in the software that scrambles the signal -- would be all the harder for a third party to listen to surreptitiously. Because the encryption system that the industry adopted in 1992 was deliberately made less secure than many experts had recommended at the time, privacy rights advocates have been warning since that the code could be broken too easily. An announcement Thursday that the code has indeed been cracked would seem to bear out those concerns. "This should serve as a wake-up call," said James X. Dempsey, senior staff counsel for the Center for Democracy and Technology, a public interest group. "This shows that Government's effort to control encryption technology is now hindering the voice communications industry as well as the data and electronic communication realm." Industry executives acknowledged that steps must be taken to address the problem. "We need strict laws that say it is illegal to manufacture or to modify a device which is designed to perpetrate the illegal interception of P.C.S. telephone calls," said Thomas E. Wheeler, president of the Cellular Telephone Industry Association, a Washington-based trade group. Mr. Wheeler said the weaker privacy technology had been adopted not just to appease the Government but because makers of wireless communications hardware and software wanted to embrace a technical standard that would meet export regulations. Those rules, based on national security considerations, sharply curtail the potency of American-made encryption technology. The three computer researchers who broke the code belong to an informal group of technologists who believe strongly that powerful data-scrambling technologies are essential to protect individual privacy in the information age. These technologists, who planned to release their findings in a news release on Thursday, argue that the best way to insure that the strongest security codes are developed is to conduct the work in a public forum. And so they are sharply critical of the current industry standard setting process which has made a trade secret of the underlying mathematical formulas used to create the security codes. "Our work shows clearly why you don't do this behind closed doors," Mr. Schneier said. "I'm angry at the cell phone industry because when they changed to the new technology, they had a chance to protect privacy and they failed." Mr. Carroll, head of the industry's privacy committee, said it planned to revise the process for reviewing proposed technical standards. [End]

1 0

WebWorld 7-8
by Bubba 17 Dec '03

17 Dec '03

1 0

FBI Wiretap Payments
by John Young 17 Dec '03

17 Dec '03

The FBI has published in the Federal Register today: Implementation of Section 109 of the Communications Assistance for Law Enforcement Act AGENCY: Federal Bureau of Investigation, DOJ. ACTION: Final rule. ----------------------------------------------------------------------- SUMMARY: This rule implements section 109 of the Communications Assistance for Law Enforcement Act (CALEA), which requires the Attorney General to establish regulations which set forth the procedures that telecommunications carriers must follow in order to receive reimbursement under Sections 109 and 104 of CALEA. CALEA requires that this rule enable carriers to receive payments in a timely and cost- efficient manner while minimizing the cost to the Federal Government. Specifically, this rule sets forth the means of determining allowable costs, reasonable costs, and disallowed costs. Furthermore, it establishes the requirements carriers must meet in their submission of cost estimates and requests for payment to the Federal Government for the disbursement of CALEA funds. In addition, this rule protects the confidentiality of trade secrets and proprietary information from unnecessary disclosure. Finally, it sets forth the means for alternative dispute resolution. ----- http://jya.com/fbi032097.txt (177K)

1 0

Re: U.S Mint Electronic Cash Study
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: e$(a)thumper.vmeng.com Reply-To: jmuller(a)brobeck.com (John D. Muller) Mime-Version: 1.0 Precedence: Bulk Date: Thu, 20 Mar 1997 08:38:05 -0800 From: jmuller(a)brobeck.com (John D. Muller) To: Multiple recipients of <e$(a)thumper.vmeng.com> Subject: Re: U.S Mint Electronic Cash Study Federal Reserve Governor Kelley and New York Fed President McDonough have both stated that the Fed has no plans to issue electronic money. See: http://www.bog.frb.fed.us/BOARDDOCS/SPEECHES/19960618.htm http://www.ny.frb.org/pihome/news/speeches/sp961008.html ---------- The e$ lists are brought to you by: Intertrader Ltd - Commerce Solutions in the UK Visit <http://www.intertrader.com/> for details ... Where people, networks and money come together: Consult Hyperion http://www.hyperion.co.uk info(a)hyperion.co.uk Like e$? Help pay for it! See <http://www.shipwright.com/rah.html> Or, for e$/e$pam sponsorship, see <http://www.shipwright.com/rah/> Thanks to the e$ e$lves: Of Counsel: Vinnie Moscaritolo <mailto:vinnie@webstuff.apple.com> (Majordomo)^2: Rachel Willmer<mailto:rachel@intertrader.com> Commermeister: Anthony Templer <mailto:anthony@atanda.com> Interturge: Rodney Thayer <mailto:rodney@sabletech.com> --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/

1 0

ONK?: SANS Network Security Digest?
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: ploshin(a)pop.tiac.net Date: Thu, 20 Mar 1997 11:39:22 -0500 To: Robert Hettinga <rah(a)shipwright.com> From: Pete Loshin <pete(a)loshin.com> Subject: Re: DCSB: Stewart Baker on Clinton Administration Crypto Policy and Digital Commerce Mime-Version: 1.0 Bob, just a quick question, have you heard/seen anything on this: | The SANS Network Security Digest | | Contributing Editors: | | Michele Crabb, Matt Bishop, Steve Bellovin, Rob Kolstad | | Gene Spaford, Marcus Ranum, Gene Schultz, Dorothy Denning | ----A Resource for Computer and Network Security Professionals--- It's an $80/yr e-mail newsletter; there are a lot of recognizable names there, but the thing isn't digitally signed. Also, isn't it "Spafford"? Anyway, anything you know would be appreciated, and if you don't know anything, could you ask around (e.g., some of the likelier mailing lists which I no longer subscribe to.) <snip> Thanks, -pl /-------------------------\ | Pete Loshin | | BYTE | | 24 Hartwell Ave | | Lexington, MA 02173 | | vox +1 617/860-6830 | | fax +1 617/860-6522 | | pete(a)loshin.com | \-------------------------/ --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/

3 2

Isn't this like a bad idea?
by Lile Elam 17 Dec '03

17 Dec '03

Hi folks, Selling email addresses seems to me to be a bad idea. Wouldn't it be better to have people sign up instead of this? I mean, it looks like this is for spammers. Who can I contact about this abuse? thanks, -lile >From mick3(a)concentric.net Wed Mar 19 21:18:24 1997 Date: Thu, 20 Mar 1997 00:17:18 -0500 (EST) Comments: Authenticated sender is <mick3(a)pop3.concentric.net> From: "mick3(a)concentric.net" <mick3(a)concentric.net> To: you(a)concentric.net Subject: 1 MIO e-mail addresses for sale Hello, and sorry to bug you... If you are not a business owner, we apologize. For Sale: 1 MILLION E-MAIL ADDRESSES FOR $95.00 or 2million for $ 155.00 - or 3 million for $ 195.00 Available on 3.5" disk or e-mail download. These are fresh lists, no BS...plain ASCI format, one per line. This is a one time mailing, you will not be contacted again. Send check or money order to: YMR - ADDRESS LIST P.O. Box 654 Marysville, Ca 95901 ( please specify, if you want 3.5" disk or have it sent via e-mail as *.zip file) Questions? call Mick at (916) 741-2622 TO BE PROMTLY REMOVED, TYPE "REMOVE"

2 1

PGP on AOL
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi there, I want to help a friend of mine to set up PGP. She's using Win 95 and is on AOL. Can anybody recommend some good shells, that would make make it easier for her? Thanks already in advance... Ciao Harka -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMzJqzTltEBIEF0MBAQHIqwf/R5pOkHW87Nvjk2zSiVk9NRTbzrrPLaaG lOsGmY5m6t0A5wLLaIAYiVYG0ygF00Zau8YvUUkEB8dBw2ufItMWAcSMeYQnkKTU m3koJo6miy0EH3wyaaL2I44IM9q77b0jpZPxX+8kfYry2tLTYoCCyHdC/BGDdYTd M0jwM+VXPmrw+xnX3TUr2y5ggweR0zIBCuD+V0JodHiXg8x5GYsQ/uXKhtd9a4rJ QkIm9MU6gf0lPvzXFA6mjk6DDz7YqM4hoywn+4Dc4wJ/DaO6ZU5EXhkg2Q1vYBSN Jp7k6ZAoBPl8rsPem0C5t7Q7V3YRp3qeD6jV/K3YuMW6VgYJynDs6Q== =B09F -----END PGP SIGNATURE-----

4 3

NSA responds to criticism over weakening cellular crypto
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Thu, 20 Mar 1997 15:50:40 -0800 (PST) From: Declan McCullagh <declan(a)well.com> To: fight-censorship-announce(a)vorlon.mit.edu Subject: NSA responds to criticism over weakening cellular crypto John Markoff writes in today's NYT: Several telecommunications industry officials said the pressure came from the National Security Agency, which feared that stronger encryption technology might allow criminals or terrorists to conspire with impunity by cellular phones. But independent security experts now say that the code is easy enough to crack that anyone with sufficient technical skills could make and sell a monitoring device that would be as easy to use as a police scanner is. Below the NSA's Clint Brooks responds to Dave Banisar. -Declan ---------- Forwarded message ---------- Date: Thu, 20 Mar 1997 18:08:28 -0500 From: Dave Banisar <Banisar(a)epic.org> >Date: Thu, 20 Mar 1997 17:35:44 -0500 >From: Clinton Brooks <cbrooks(a)romulus.ncsc.mil> >Reply-To: cbrooks(a)romulus.ncsc.mil >MIME-Version: 1.0 >To: banisar(a)epic.org >CC: "Brooks, Clinton" <cbrooks(a)romulus.ncsc.mil> >Subject: Cellular Phone Flaw > >Dave, > > Re your comments on the flaw apparently found in cellular phones: > > We have released the following statement: > > "NSA had no role in the design or selection of the encryption >algorithm chosen by the Telecommunications Industry Association (TIA). >NSA also had no role in the design or manufacture of the telephones >themselves. As we understand the researchers' claim, it appears that >the algorithm selected and the way it was implemented in the system has >led to the stated flaws. > >NSA provided the TIA with technical advice on the exportability of these >devices under U.S. export regulations and processes." > > > Clint > ========================================================================= David Banisar (Banisar(a)epic.org) * 202-544-9240 (tel) Electronic Privacy Information Center * 202-547-5482 (fax) 666 Pennsylvania Ave, SE, Suite 301 * HTTP://www.epic.org Washington, DC 20003 PGP Key: http://www.epic.org/staff/banisar/key.html =========================================================================

1 0