December 2003 - cypherpunks-legacy

Information on key handling with Microsoft products (fwd)
by Ray Arachelian 17 Dec '03

17 Dec '03

> There's been some discussion recently on this news alias about how > Microsoft > handles key management (and some related topics) in CryptoAPI (more > specifically, the Microsoft base CSPs). Below is a document we've put > together to help answer these questions. > > Thanks, > -JasonG > > Product Manager, Windows NT Security > Microsoft Corporation > > > > Microsoft's Response to Recent Questions on the Recovery > of Private Keys from various Microsoft Products > > Recently, there has been discussion on some Internet forums about the > methods Microsoft uses to store private keys in some of its products, as > well as about CryptoAPI's role in key management. These discussions > included > some inaccurate information about the PFX and PKCS-12 formats, as well as > how Microsoft implements these formats in its products. > > This paper was prepared by the Microsoft Public Key Infrastructure team to > provide some additional insight and clarification on these issues, and in > some cases, identify long-term plans that Microsoft has to continue the > improvement of security in our products. > > CryptoAPI > One area to clarify at the outset is the role of CryptoAPI. Implications > that any key management problem on Microsoft's Internet products would be > an > example of fundamental problems with CryptoAPI are absolutely inaccurate. > CryptoAPI is a set of cryptographic technologies that are provided for use > by other software--sort of a cryptographic toolbox. The actual > cryptographic > functions are provided through Cryptographic Service Providers (CSPs), > which > are implemented as DLLs. With the exception of the details about a > possible > PKCS-12 attack, all the issues raised in the recent discussions are > specifically aimed at Microsoft's base CSPs, not at CryptoAPI. The base > CSPs are the royalty-free, software-based CSPs provided with Windows NT > 4.0, > Windows 95, and Internet Explorer. These attacks do not apply in general > to > other CryptoAPI CSPs and do not indicate any fundamental concerns with the > security of the CryptoAPI architecture or applications built upon it. > > PFX/PKCS-12 > Microsoft products do not "store" private key material using PKCS-12, > contrary to recent descriptions on the Internet. For clarification, > PKCS-12 > is a standard format, used for export/import of Public Key Certificates > and > related key material. At present, the only Microsoft product that > supports > use of this format is Microsoft Internet Explorer 4.x. Internet Explorer > uses PKCS-12 solely as a means of migrating a user's Certificate and > public-private key pair between multiple Internet Explorer installations > or > between Internet Explorer and other products, such as Netscape > Communicator. > > > Some background might help. Microsoft originally developed the draft > specification for an encrypted export/import format, referred to as PFX, > but > the PFX specification was never implemented by Microsoft. Instead, the > PFX > specification was handed over to RSA Labs and it became the draft PKCS-12 > specification. The design was then reviewed, and contributed to, by a > number of other companies to arrive at the current PKCS-12 standard. > Microsoft and Netscape have both implemented PKCS-12 with 40-bit > encryption. > This was done to provide a common, exportable solution that was completely > interoperable. > > The example of breaking a PKCS-12 data blob, which was given in discussion > on the Internet, is not an attack on the "weak" cryptography of PKCS-12. > Rather, it is simply a dictionary attack (long known and well understood > in > cryptography), which works well if people use poorly-chosen passwords to > protect the PKCS-12 data blob. Examples of such bad passwords include > words > in the English dictionary. In our implementation of PKCS-12, we could > possibly do some things to make brute-force attack against an exported > PKCS-12 data blob more difficult. For example, performing a dictionary > check > on the password before accepting it for encrypting the data blob would > reduce the use of weak passwords. Alternatively, we could iterate the > setup > function to increase "diversity" making it much more expensive for an > attacker to search. However, neither of these methods are required for > protection of the data blob. Good security is always a combination of > technology and policy. As part of a strong security policy, strong > passwords > should be used on all resources. The Microsoft Security Advisor website > (http://www.microsoft.com/security) has some guidelines for choosing > strong > passwords. > > One statement by the original poster argues that Microsoft managed to > design > a security format that actually makes it easier to break into the > protected > data. As stated above, a number of well respected companies were involved > extensively in the design and review of PKCS-12 before it became a > standard. > An iteration count, which would make the type of attack described above > more > difficult (in terms of time), was added late in the PKCS-12 evolution. It > was, however, too late to make it into the Internet Explorer 4 product > release. Future versions of Internet Explorer will include support for the > an iteration count, further strengthening the security of exported key > material. > > Of course, in general the PKCS-12 data objects will not be available on a > user's machine, since they are only used by Internet Explorer 4.x when > exporting key material to, or importing key material from another system. > As > with any sensitive data, users should take care when working PKCS-12 data > blobs and not leave them on their hard drives. > > Exploiting Internet Explorer > One of the fundamental requirements to perform any possible cryptographic > attack discussed in the recent postings is the assumption that a malicious > entity could somehow access to data on a user's computer system, without > the > permission or knowledge of the user. This is a large leap of faith. > Users > that are using Public Key Certificates today are generally sophisticated > and > savvy users, or part of a larger corporate infrastructure with > knowledgeable > administrators. This class of users will certainly keep abreast of current > security issues and install security-related patches and updates as they > become available. Microsoft has been extremely responsive in dealing with > all known Internet Explorer security attacks and has posted patches for > all > currently known attacks. And, of course, security issues are certainly not > limited to Microsoft software. > > Information on security-related issues with Microsoft products is > available > on the Microsoft Security Advisor website at > http://www.microsoft.com/security. > > Attacks against Authenticode signing keys > Another concern identified was that if a malicious hacker could steal a > user's or company's Authenticode signing key, that hacker could sign > objects > with that key and distribute them. Then when other users tried to download > the signed object, they would think the key's owner really signed the > object, which might contain malicious code. The Authenticode program has > been designed to ensure that only trusted programs are allowed to run on a > users machine. As stated earlier Microsoft has been very responsive is > addressing security issues with IE. > > However, it is extremely unlikely anyone could be successful with a > simplistic strategy for stealing Authenticode signing keys and then using > them. As noted above, there are security patches already released for > known > Internet Explorer bugs that could possibly allow a key blob to be stolen > off > a user's hard disk (assuming a user left an Authenticode 'key' file on > their > hard disk). Second, anyone signing code using Authenticode technology is > extremely unlikely to leave their key material sitting on an end user > machine routinely used for browsing the Internet. > > Microsoft recommends storing key material, such as that used in > Authenticode, in hardware tokens. Such tokens prevent any of these attacks > from getting started as the keys are not stored in the PC and are not > exportable. The Authenticode signing keys that Microsoft uses for all our > software, for instance, are stored in such a physical hardware key storage > mechanism. > > Attacks on Encrypted Key material > There is some confusion over the algorithms and methods that Microsoft > uses > to provide protection of encrypted key material in Internet Explorer when > using the standard Microsoft base CSPs. There were changes between > Internet > Explorer 3.0x and Internet Explorer 4.x specifically to address any > possible > concern. Note, this concern is unlikely to be valid for any third-party > software CSP and is not relevant to hardware CSPs. > > Microsoft is constantly working to improve the security of our products. > We > determined that there were better suited methods for storing keys than > using > the RSA RC4 stream cipher algorithm used in Internet Explorer 3.0x. In > particular, a stream cipher, such as RC4, is not ideally suited for this > particular use because it can be susceptible to a "known-keystream > attack". > In a known-keystream attack, if you know the plain text, which you > arguably > might be able to determine given the number of standard PKCS-8 fields, you > can recover the keystream. If you recover the keystream, then a XOR > function will indeed decrypt anything else encrypted with the same key. > However, Microsoft only used this RC4-based implementation in the base > CSPs > that shipped with Internet Explorer 3.0x. The CSPs that shipped in > Internet > Explorer 4.x protect private key material in a form that is encrypted > using > DES, which is a block cipher and is not susceptible to the known-keystream > attack that can be used against RC4. > > Again, note that this kind of attack assumes some degree of security > breach > on the user's system such that the keystream could be obtained. > > Key export attacks > The original Internet posting raises concern about the CryptoAPI interface > CryptExportKey(). This function is fully documented and does indeed > export > private key material in an encrypted format. The presence of the > CryptExportKey() function is to support functionality such as migrating > key > material between machines for a user or creating a backup copy of a key. > It > should be noted however, that many CSPs, including most hardware based > CSPs, > do not allow exportable private keys and will return and error in response > to a CryptExportKey() request. > > Also, Microsoft's base software CSPs provide a means to mark keys as > non-exportable when they are generated. An additional security protection > is provided if the flag CRYPT_USER_PROTECTED is set, in which case each > use > of the private key, including export, requires the user to supply a > password > to access the key. Some commercial CAs are not currently setting this > flag > and do not provide the user a way to request it during Certificate > enrollment. We recognize this as a problem. We will continue working > with > CAs to assist them in supporting these security features. However, we > will > also make available a utility to allow setting this flag after key > generation for users concerned with this type of attack. > > The posting also asserts that an ActiveX control could be downloaded from > a > web page, simply ask for the current users key, ship the key off for > collection by an unscrupulous person, and then delete itself without a > trace. > > If users run unsigned code, or code from an unknown origin, a number of > unpleasant things can happen. This could indeed occur if the key as been > marked exportable and the CRYPT_USER_PROTECTED flag is not set. However, > such a scenario assumes that the user follows few or no policies with > regard > to good security, such as running code from unknown sources. Similarly, if > the user were running software from unknown/untrusted sources, that > software > could reformat their hard drive, or manipulate other user data. This > concept > is certainly not new. > > There was also discussion of 16 dialog boxes appearing to the user for > their > password if the CRYPT_USER_PROTECTED flag is set. Certainly asking the > user > too many times would be better than too few times, however in our tests, > under extreme (and uncommon cases), a user might be asked for their > password > at most four times when a key is used with the Microsoft base CSPs. > Perhaps > the claim came from an early beta release. > > ---------------------------------------------------------------- > Users Guide http://www.microsoft.com/sitebuilder/resource/mailfaq.asp > contains important info including how to unsubscribe. Save time, search > the archives at http://microsoft.ease.lsoft.com/archives/index.html

1 0

Sweedish police weed out hackers
by Ray Arachelian 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Mon, 26 Jan 1998 14:05:57 -0500 From: Salvatore DeNaro <Salvatore_DeNaro(a)usccmail.lehman.com> To: Ray Arachelian <sunder(a)brainlink.com> Subject: Forward this to the list? *** Swedish police weed out hackers 2 young Swedish hackers who turned a Swedish county's home page into an advertisement for pornography and marijuana and broke into the U.S. space agency's computer system have been tracked down, local media reported. After a yearlong hunt, police in Umea in northern Sweden finally traced the 2 youths, aged 18 and 15, and seized their computers, the newspaper Vasterbottens Folkblad said Wednesday. Police were quoted as saying no charges would be laid because no economic crime had been committed. See http://www.infobeat.com/stories/cgi/story.cgi?id=7065918-55d

1 0

update.350 (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: >From physnews(a)aip.org Wed Dec 10 16:59:59 1997 Date: Wed, 10 Dec 97 14:35:44 EST From: physnews(a)aip.org (AIP listserver) Message-Id: <9712101935.AA25024(a)aip.org> To: physnews-mailing(a)aip.org Subject: update.350 PHYSICS NEWS UPDATE The American Institute of Physics Bulletin of Physics News Number 350 December 10, 1997 by Phillip F. Schewe and Ben Stein QUANTUM TELEPORTATION has been experimentally demonstrated by physicists at the University of Innsbruck (Anton Zeilinger, 011-43-676-305-8608, anton.zeilinger@ uibk.ac.at; Dik Bouwmeester, Dik.Bouwmeester(a)uibk.ac.at) First proposed in 1993 by Charles Bennett of IBM (914-945-3118), quantum teleportation allow physicists to take a photon (or any other quantum-scale particle, such as an atom), and transfer its properties (such as its polarization) to another photon--even if the two photons are on opposite sides of the galaxy. Note that this scheme transports the particle's properties to the remote location and not the particle itself. And as with Star Trek's Captain Kirk, whose body is destroyed at the teleporter and reconstructed at his destination, the state of the original photon must be destroyed to create an exact reconstruction at the other end. In the Innsbruck experiment, the researchers create a pair of photons A and B that are quantum mechanically "entangled": the polarization of each photon is in a fuzzy, undetermined state, yet the two photons have a precisely defined interrelationship. If one photon is later measured to have, say, a horizontal polarization, then the other photon must "collapse" into the complementary state of vertical polarization. In the experiment, one of the entangled photons A arrives at an optical device at the exact time as a "message" photon M whose polarization state is to be teleported. These two photons enter a device where they become indistinguishable, thus effacing our knowledge of M's polarization (the equivalent of destroying Kirk).What the researchers have verified is that by ensuring that M's polarization is complementary to A's, then B's polarization would now have to assume the same value as M's. In other words, although M and B have never been in contact, B has been imprinted with M's polarization value, across the whole galaxy, instantaneously. This does not mean that faster-than-light information transfer has occurred. The people at the sending station must still convey the fact that teleportation had been successful by making a phone call or using some other light-speed or sub-light-speed means of communication. While physicists don't foresee the possibility of teleporting large-scale objects like humans, this scheme will have uses in quantum computing and cryptography. (D. Bouwmeester et al., Nature, 11 Dec 1997; see also www.aip.org/physnews/graphics) DO EARTHQUAKES HAVE ELECTRICAL PRECURSORS? The elastic waves measured by seismometers are transmitted by the flexing crust while an earthquake is doing its worst. But some scientists believe that flexing also goes on in the hours and even weeks before a quake. Too small to be detected seismically, the flexing might well be sensed electrically. As underground strata rearrange themselves before a quake, the thinking goes, pockets of water are squeezed into new configurations, changing local conduction properties, which can be monitored with buried electrodes. On this basis Panayiotis Varotsos at the University of Athens (011-30-1-894-9849, pvaro(a)leon.nrcps.ariadne-t.gr) has reportedly predicted certain quakes in Greece weeks ahead of time by triangulating voltage differentials at the level of 10 millivolts/km over distances of 100 km. (Some skeptics dispute this assertion.) In new research, Varotsos buttresses his claims with laboratory studies of another system under pressure which puts out transient electrical signals before it fractures, namely a crystal containing a variety of dislocations and defects. Conductivity patterns in the crystal convince Varotsos that analogous patterns (although on a much bigger distance scale) observed in the buried electrode arrays constitute a true earthquake precursor. (Varotsos et al., Journal of Applied Physics, 1 Jan, 1998; journalists can obtain the paper from physnews(a)aip.org.)

1 0

RE: Latest Clinton dodge?
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

David Honig <honig(a)otc.net> writes: > At 07:11 PM 1/26/98 EST, you wrote: > >"Roger J Jones" <cyber(a)ibpinc.com> writes: > > > >> > >> Thanks for the info - while I am at it - has anyone ever disclosed the > >> "distinguishing characteristic" that Paula Jones claims will prove its > Bubba > >> Bill? > >> > >Can you spell "curvature"? > > So you *do* have intimate knowledge of the president.... > but I won't tell :-) What is the difference between Bill Clinton and the Titanic? Only 1700 people went down on the Titanic. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

No Subject
by Mix 17 Dec '03

17 Dec '03

The only `culture' Timothy `C' Maypole possesses is that cultivated from his foreskin scrapings. ,/ \, ((__,-,,,-,__)), Timothy `C' Maypole `--)~ ~(--` .-'( )`-, `~~`d\ /b`~~` | | (6___6) `---`

2 3

sat survailience
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Tue, 27 Jan 1998 14:55:09 -0500 From: Somebody Subject: sat survailience To: rah <rah(a)shipwright.com> MIME-version: 1.0 Bob - something else to be paranoid about! <somebody's .sig> <snip> When Is a Satellite Photo An Unreasonable Search? By <some reporter> Staff Reporter of <A big newspaper> Over the years, satellite photos have plotted the course of Soviet warships and tracked the movements of Iraqi troops. Last year, they also nailed Floyd Dunn for growing cotton on his Arizona farm allegedly without an irrigation permit. Mr. Dunn contends that he did have the required permits but paid the $4,000 fine to maintain good relations with the Arizona Department of Water Resources. "You can't argue with a satellite," he says. "Being caught like I was caught is kind of unfair." As state and local agencies make more use of satellite imagery -- for everything from surveying illicit crops to detecting unauthorized building -- they're raising questions about the propriety of spying on American civilians from the sky. "It certainly has a 'Big Brother Is Watching You' flavor to it," says Larry Griggers, a director at the Georgia Department of Revenue. "But it prevents us from having to spend money for other types of enforcement." The state tax authority plans to use National Aeronautic and Space Administration satellites to check all 58,910 squares miles of the state for unreported timber cutting. It also plans to share the photos with any state agency that asks, which could lead to a wide variety of enforcement actions. Does taking satellite photos of private citizens and their property -- generally without their knowledge -- violate the Constitution's Fourth Amendment protections against unreasonable searches? The American Bar Association has organized a task force to explore that question, as well as such issues as how long photos can be kept on file and how freely they can be shared with police. Because U.S. Justice Department officials are on the task force, the recommendations are expected to influence how law-enforcement authorities and civil agencies use the new images and at what point they require warrants. Use of satellite images has increased markedly since the early 1990s, when the Russian space agency, Sovinformsputnik, began selling spy-quality photos to raise cash. The U.S. lifted its own restrictions on sale of high-resolution satellite photos in 1994, which encouraged entrepreneurs to launch satellites of their own that could compete with the Russian imagery. Those efforts may soon pay off. This year a joint venture of Lockheed Martin Corp. and Raytheon Co. hopes to launch a satellite that will yield imagery detailed enough to distinguish sedans from minivans. Another firm, Earthwatch Inc. of Longmont, Colo., says it is proceeding with plans to launch a similar satellite in 1999 -- despite the recent loss of radio contact with a less-advanced model the firm launched in December. Both enterprises decline to discuss their public-sector clients. Some state and local agencies have been purchasing photos from French, Indian and U.S. government satellites since the 1980s, and increasingly powerful computer software is allowing them to make better use of the imagery. The Arizona Department of Water Resources spotted Mr. Dunn's cotton crop, for example, because it routinely obtains photographs from the French government's SPOT satellites of 750,000 acres of central Arizona farmland. State officials then compare the images with a database of water-use permits to determine which farmers might be exceeding water-use rules. "A week doesn't go by where somebody doesn't propose a new use," says John Hoffman, whose Raleigh, N.C., business, Aerial Images Inc., has become the main reseller of images taken by Russian intelligence satellites. Much of what Mr. Hoffman has available is old imagery of Western cities. But he says he can also take orders for new photos on upcoming missions. Price: $6,500 to photograph 10 square kilometers with resolution of about six feet, which he says is sharp enough to distinguish cars from pickup trucks. In North Carolina several counties are using Mr. Hoffman's photos to find unreported building activities, agricultural development and other property improvements that would raise property-tax assessments. Demand from state and local agencies in his region is so strong, he says, that Sovinformsputnik, the Russian space agency, has scheduled a Feb. 17 launch of a satellite that will concentrate mainly on photographing the Southeastern U.S. Pictures taken from airplanes at lower altitudes are often more revealing, but satellite imagery can be much more cost-effective. Photographing an area the size of a small town, for example, can cost tens of thousands of dollars by airplane, approximately twice the cost by satellite. Some satellite imagery is faster as well. Although the satellites Mr. Hoffman works with use conventional film that is developed after the satellite returns to earth, newer camera platforms can transmit images digitally just minutes after they are taken. To date, there have been few legal challenges to the use of satellite imagery. But the technology of overhead photography is evolving faster than the law. Courts have allowed government officials to take detailed pictures from airplanes flying as low as 1,200 feet. And in 1986, the U.S. Supreme Court ruled that the U.S. Environmental Protection Agency was permitted to photograph a Dow Chemical facility in Midland, Mich., because the EPA used relatively conventional airplane-camera equipment. But the high court raised a red flag in that case: "It may well be ... that surveillance of private property by using highly sophisticated surveillance equipment not generally available to the public, such as satellite technology, might be constitutionally proscribed absent a warrant." The ABA task force is exploring just these questions. Sheldon Krantz, chair of the task force and a partner at Piper & Marbury LLP in Washington, says that it will propose in April that law-enforcement agencies be required to obtain warrants to use "satellite cameras [that] can focus on images of a few feet across." That standard would probably include most advanced satellite images, although the task force has yet to agree on more specific definitions. "We need to make some big value judgments about these practices before they become so widespread," says Mr. Krantz. Some businesses say they welcome oversight from space. Georgia-Pacific Corp. and other big timber concerns support the Georgia Department of Revenue's forest survey, saying it will help to disprove accusations that they have secretly cut trees without paying taxes. Several small timber owners already have been fined a total of $2,000 in a test of the statewide program that took place in Wayne County, near Savannah. And as sharper-resolution photos become available, some Georgia officials suggest the program could be used to look for objects as small as backyard porches, to check if homeowners have their construction permits in order. <snip> --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

1 0

RE: Latest Clinton dodge?
by J-Dog 17 Dec '03

17 Dec '03

At 01:15 PM 1/27/98 EST, Dr.Dimitri Vulis KOTM wrote: >David Honig <honig(a)otc.net> writes: > >> At 07:11 PM 1/26/98 EST, you wrote: >> >"Roger J Jones" <cyber(a)ibpinc.com> writes: >> > >> >> >> >> Thanks for the info - while I am at it - has anyone ever disclosed the >> >> "distinguishing characteristic" that Paula Jones claims will prove its >> Bubba >> >> Bill? >> >> >> >Can you spell "curvature"? >> >> So you *do* have intimate knowledge of the president.... >> but I won't tell :-) > >What is the difference between Bill Clinton and the Titanic? >Only 1700 people went down on the Titanic. > >--- > >Dr.Dimitri Vulis KOTM >Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps > most people get Aids from sex clinton gets sex from Aids lates J-Dog

1 0

Privacy and presidential philandering, from the Netly News
by Declan McCullagh 17 Dec '03

17 Dec '03

******** http://cgi.pathfinder.com/netly/opinion/0,1042,1714,00.html The Netly News (http://netlynews.com/) January 27, 1998 Private Parts by Declan McCullagh (declan(a)well.com) Already you can hear the plaintive sound of President Clinton's partisans whining about privacy. The allegations about Will's wandering willy are too intimate, too sensitive and (if the truth be told) too embarrassing to be discussed publicly, they claim. Yesterday the wire services were busy recycling Hillary Clinton's plea for a "zone of privacy"; a Clinton defender wrote in USA Today that nobody should be "inflicting the details of his sex life on the public"; a piece in the New York Times complained about a "fishing expedition into the President's sexual history." On NBC's Today show, Hillary groused about living in "a time where people are malicious and evil-minded." On many electronic mailing lists, the talk nowadays seems to be of little else. "The current pursuit of Clinton -- whatever the facts turn out to be -- strikes me, itself, as an obscenity," griped Edward Kent on a First Amendment list. "We need more protections of privacy in this country." Michael Troy replied, "I don't think there is a constitutional right to privacy for an employer (who is also a public figure) having sex with an employee in the workplace." He's right. The call for greater "privacy protections" is a call for censorship in disguise. [...]

1 0

Re: Latest Clinton dodge?
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

> > Next thing you know, he'll say "She gave me a blow job, but didn't > swallow, so it's not sex." :) Is that like "if you don't get pregnant," it's not intercourse??? Gotta be a lot of virgins out there then.

1 0

New Plan for America!!!!!
by bubbabill＠whitehouse.gov 17 Dec '03

17 Dec '03

Tonight at the State of the Union I will announce my new plan for America - "Swallow the Leader"

1 0