March 2003 - cypherpunks-legacy

Re: Brumley & Boneh timing attack on OpenSSL
by pgut001＠cs.auckland.ac.nz 24 Mar '03

24 Mar '03

Bill Stewart <bill.stewart(a)pobox.com> writes: >Schmoo Group response on cryptonomicon.net >http://www.cryptonomicon.net/modules.php?name=News&file=article&sid=263&mod… >Apparently OpenSSL has code to prevent the timing attack, >but it's often not compiled in (I'm not sure how much that's for >performance reasons as opposed to general ignorance?) I had blinding code included in my crypto code for about 3 years, when not a single person used it in all that time I removed it again (actually I think it's probably still there, but disconnected). I'm leaning strongly towards "general ignorance" here... Peter. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

(no subject)
by rick 18 Mar '03

18 Mar '03

http://www.outwar.com/page.php?x=513854 CRACK HERE

1 0

Journalists, Diplomats, Others Urged to Evacuate City
by Tim May 18 Mar '03

18 Mar '03

Journalists, diplomats, inspectors, and civil servants are being urged to evacuate the capital. A timetable of 48 hours has been given. "The Evil Doers will be rooted out and the Evil Ones punished," said one spokesman. However, as of midnight, Eastern Standard Time, there is no evidence that Washington residents are taking these warnings seriously. Needless to say, this is not a threat. I am 3000 miles away, relatively safe on my hilltop. Being the survivalist that I have been for much of the past 30 years, I have a pantry closet filled with canned goods, rice, cereal. And I have a generator, which I expect not to use much. And solar battery rechargers (sufficient to recharge AAs and Ds for my various small radios, even recharge my laptop...this in case my 24-packs of AAs and Ds run out, or my several lead cell battery packs, etc.). And I have my perimeter alarms, my solar-powered intrusion alarms, my rifles, my handguns, my shotguns, my other weapons, my water filters, my colleagues. I don't expect to need this stuff, but I am, as always, happy to be able to just stay at home on my hill and watch the chaos unfold. About the threat to Washington: I think it's relatively high. A nerve gas attack on buildings or the Metro seems likely. (The Japanese AUM cult had Sarin, but was inept. A more capable, military-trained operative has had many months to get into D.C. and wait for the obvious time to attack. And he need not even be a suicide bomber. A cannister of VX with a reliable timer is child's play. If I were Declan, I'd get out of Dodge. --Tim May

1 0

Brumley & Boneh timing attack on OpenSSL
by Bill Stewart 14 Mar '03

14 Mar '03

From Slashdot: http://slashdot.org/article.pl?sid=03/03/14/0012214&mode=thread&tid=172 David Brumley and Dan Boneh write: "Timing attacks are usually used to attack weak computing devices such as smartcards. We show that timing attacks apply to general software systems. Specifically, we devise a timing attack against OpenSSL. Our experiments show that we can extract private keys from a OpenSSL-based server such as Apache with mod_SSL and stunnel running on a machine in the local network. Our results demonstrate that timing attacks against widely deployed network servers are practical. Subsequently, software should implement defenses against timing attacks. Our paper can be found at Stanford's Applied Crypto Group. http://crypto.stanford.edu/~dabo/abstracts/ssl-timing.html " Schmoo Group response on cryptonomicon.net http://www.cryptonomicon.net/modules.php?name=News&file=article&sid=263&mod… Apparently OpenSSL has code to prevent the timing attack, but it's often not compiled in (I'm not sure how much that's for performance reasons as opposed to general ignorance?) They also comment (as did somebody on Slashdot) that "this is distinct from the timing attack described in the paper by Canvel, Hiltgen, Vaudenay, and Vuagnoux last month." That one's an implementation problem and hard to exploit. http://lasecwww.epfl.ch/memo_ssl.shtml http://slashdot.org/article.pl?sid=03/02/20/1956229 --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Re: Brinwear at Benetton.
by Neil Johnson 13 Mar '03

13 Mar '03

RFID technology for libraries ... http://www.demco.com/CGI-BIN/LANSAWEB?PROCFUN+LWDCWEB+LWDC025+PRD+ENG+FUNCP… So the man can now know what books you taking on the flight (Hopefully not the flight training manual for the aircraft). -- Neil Johnson http://www.njohnsn.com PGP key available on request.

1 0

2nd announcement for ECC 2003
by R. A. Hettinga 12 Mar '03

12 Mar '03

--- begin forwarded text

1 0

Groove shills for the DoD: Kapor quits board
by Steve Schear 11 Mar '03

11 Mar '03

Software Pioneer Quits Board of Groove By JOHN MARKOFF SAN FRANCISCO, March 10 Mitchell D. Kapor, a personal computer industry software pioneer and a civil liberties activist, has resigned from the board of Groove Networks after learning that the company's software was being used by the Pentagon as part of its development of a domestic surveillance system. http://www.nytimes.com/2003/03/11/business/11PRIV.html --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

New release of Invisible IRC available
by Steve Schear 11 Mar '03

11 Mar '03

IIP 1.1.0 (stable) is released. (2003-03-10) Invisible IRC Project is a three-tier, peer distributed network designed to be a secure and private transport medium for high speed, low volume, dynamic content. Features: * Perfect Forward Security using Diffie-Hellman Key Exchange Protocol * Constant session key rotation * 128 bit Blowfish node-to-node encryption * 160 bit Blowfish end-to-end encryption * Chaffed traffic to thwart traffic analysis * Secure dynamic routing using cryptographically signed namespaces for node identification * Node level flood control * Seamless use of standard IRC clients * Gui interface * Peer distributed topology for protecting the identity of users * Completely modular in design, all protocols are plug-in capable The IIP software is released under the GPL license and is available for Windows 98/ME/NT/2000/XP, *nix/BSD and Mac OSX. http://invisiblenet.net/ --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Re: Wiretap Act Does Not Cover Message 'in Storage' For Short Period (was Re: BNA's Internet Law News (ILN) - 2/27/03)
by R. A. Hettinga 05 Mar '03

05 Mar '03

--- begin forwarded text

3 2

Re: Roger Needham Died - from The Register
by Matt Blaze 05 Mar '03

05 Mar '03

Sad, sad news. Roger's pioneering contributions to our art speak (volumes) for themselves, and our field is diminished by the loss of his future insights. But I will miss him most for his enormous generosity, his sharp wit, and his personal integrity. -matt > -------------------- > Obit: Roger Needham > By Guy Kewney, Newswireless.net > Posted: 02/03/2003 at 12:13 GMT > > Sadly, we record the death of Roger Needham, computer pioneer... > > There isn't much more to say, except that the man who was the reason > Microsoft set up its research centre in Cambridge, England, has had to lay > down his life's work. Cancer ended a legend. > > He once told me that it was his idea that Microsoft stopped spending money > on patenting its research ideas, and instead, to make the results available > to other researchers. I wish I'd known him long enough to have some other > stories to pass on myself; he left a long legacy of people who attributed > their inspiration to having worked with him. > > Here's what his CV at Microsoft Research says: > > Roger M Needham, born 1935, was in computing at Cambridge since 1956. His > 1961 PhD thesis was on the application of digital computers to problems of > classification and grouping. In 1962 he joined the Computer Laboratory, > then called the Mathematical Laboratory, and has been on the faculty since > 1963. He took a leading role in Cambridge projects in operating systems, > time sharing systems, memory protection, local area networks, and > distributed systems over the next twenty years. > > Roger worked at intervals on a variety of topics in security, (his main > research interest while with Microsoft) being particularly known for work > with Schroeder on authentication protocols (1978) and with Burrows and > Abadi on formalism for reasoning about them (1989). > > Roger graduated from the University of Cambridge in Mathematics and > Philosophy in 1956, and then took the Diploma in Numerical Analysis and > Automatic Computing in 1957. He had been in computing at Cambridge ever > since. He succeeded Maurice Wilkes as Head of the Computer Laboratory from > 1980 to 1995, was promoted Professor in 1981, elected to the Royal Society > in 1985 and the Royal Academy of Engineering in 1993. He was appointed > Pro-Vice-Chancellor in 1996. > > I only met him a couple of times, both times when Microsoft was doing > corporate hospitality to publicise the work it was doing in the Cambridge > research facility. He was as knowledgeable as any rumour could have > suggested; and as tolerant of an ignorant journalist as any academic could > ever be. And I shall never get to know him, now. > > Guy Kewney is the editor/publisher of Newswireless.Net > > ----------------------------------------------- > > > --------------------------------------------------------------------- > The Cryptography Mailing List > Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0