April 2004 - cypherpunks-legacy

Blind signatures with DSA/ECDSA?
by An Metet 24 Apr '04

24 Apr '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Here is the blind DSA signature based on MacKenzie and Reiter, http://www.ece.cmu.edu/~reiter/papers/2001/CRYPTO.pdf, in graphical form. Recall that a DSA public key is p, q, g, y; private key x; signature on hash h is: Choose k < q r = g^k mod p mod q s = rx/k + h/k mod q Output (r,s) Here is the blind signature protocol, with Alice, the recipient, on the left and Bob, the signer, on the right: Alice (recipient) Bob (signer) - ------------------------------------------------ Choose k2 < q z2 = 1/k2 mod q Send r2 = g^k2 mod p <--------------------------- Choose k1 < q r = r2^k1 mod p mod q Send a=E(r/k1 mod q) and b = E(h/k1 mod q) and ZKP --------------------------> Check ZKP Choose d < q^5 Send c = a '*' x*z2 '+' b '*' z2 '+' E(d*q) <--------------------------- s = D(c) mod q Output (r,s) Here, E() and D() represent encryption and decryption in a homomorphic encryption system like the Paillier encryption. Only Alice knows the private key, but Bob is able to multiply encrypted values by scalars (indicated by '*' above) and to add encrypted values (indicated by '+' above). ZKP sent by Alice in the 2nd step is a zero knowledge proof that the two encrypted values are known and are < q^3. (Actually the values are less than q but the standard ZKP for this has some slop in it, which is OK for this purpose.) Bob operates on the two homomorphic encryptions of r/k1 and h/k1. He multiplies the first by x/k2 and the second by 1/k2 and adds them to get rx/k + h/k mod q (where k = k1*k2), exactly as required for the signature. Then he adds the large multiple of q to fully hide his secret x value. One interesting thing about this protocol is that it may escape the Chaum blind signature patent, US 4759063, for two reasons. First, the Chaum patent covers three step blinding, while this is a four step process. In the regular Chaum blind signature there is no need for the initial step where the signer sends an initial r2 value. That step is crucial here; k2 must be fresh for every signature or the signer's key is leaked. Second, the Chaum patent describes the signer's operation as performing a public key digital signature operation. This is in fact how the Chaum blind signature works; the signer does do an ordinary RSA signature operation. But in this case, the signer performs a completely different transformation, working with two homomorphically encrypted values in an unusual way. This is not a conventional digital signature operation. Therefore this type of blind signature should escape the patent. Of course the patent expires in a little over a year so it is largely moot now anyway. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.0 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQFAirIcHIAd9K7kkjIRAk/nAJ0cIxTYSudiKd0rrXv/T1kUuMHbjQCfSaya NmVhsnuT/jBeqf5eVIx2FaI= =x3ps -----END PGP SIGNATURE-----

1 0

RE: [IP] One Internet provider's view of FBI's CALEA wiretap push
by Steve Schear 24 Apr '04

24 Apr '04

At 07:43 AM 4/23/2004, Trei, Peter wrote: >If you're dealing with a state-level attacker, any >scheme involving explosives or incendiaries would get >the attackee in as much or more trouble than the >original data would. > >This is a hard problem. I suspect any solution will >involve tamper-resistant hardware, which zeroizes >itself if not used in the expected mode. Right, there are at least two workable solutions- Hard drives with user alterable firmware. I surprised that none of the major drive manufacturers seems to have thought about offering a version of their controllers, for substantially more money, that offers this. A retrofit device that screws into the side of the hard drive and is set to inject a corrosive that almost instantly destroys the drive surfaces. The device can be triggered by any number of intrusion detectors or a voice-activated system keyed to the operators voice print. steve

3 3

Re: [IP] One Internet provider's view of FBI's CALEA wiretap push
by Major Variola (ret) 24 Apr '04

24 Apr '04

At 08:51 PM 4/23/04 +0200, Thomas Shaddack wrote: >On Fri, 23 Apr 2004, John Kelsey wrote: > >> The obvious problem with multiple levels of passwords and data is: When >> does the guy with the rubber hose stop beating passwords out of you? > >This serves a purpose as well. > >Why would you ever cooperate if you can't expect much from the deal >anyway? Since passphrases are in persons' minds, and minds and wills can be broken, one has to consider the security implications of this. Mil orgs don't assume that prisoners are able to keep secrets under arbitrary duress. Duress layering buys time for your colleages and family in all cases, whether they kill you or not. If they're not killing you, then maybe they'll buy one of the deeper levels of duress layers. If you physically destroy the keys or the data, there is little to gain by torturing you or your family. That is superior to gambling that your deeper duress levels are convincing to the man with the electrodes. An iButton that you could crunch in your teeth to destroy it would be nice...

3 2

Re: [IP] One Internet provider's view of FBI's CALEA wiretap push
by Tyler Durden 23 Apr '04

23 Apr '04

"As for finance itself, there's a reason that I say that financial cryptography is the only cryptography that matters. Since the time of Mesopotamian bullae and grain banks, cryptography has been essential to finance. You can't do one without the other. The more cryptography you do, the more finance you can do, the better off everyone is. It's a virtuous circle." I don't agree, though I'm tempted to. What have nominally been called religious and/or race wars throughout history have almost always had at their core economics, or at least in the western world. It's easy to see how finance might be the underlying reason for lots of nominally non-crypto communications. Your statement is arguably true as t-->infinity. However, I'd bet there are short-term applications for crypto that really matter and yet have no real relationship to $$$ (for instance, what if there was widespread communications and crypto in Nazi Germany...would the holocaust have happened?) -TD >From: "R. A. Hettinga" <rah(a)shipwright.com> >To: <cypherpunks(a)al-qaeda.net> >Subject: Re: [IP] One Internet provider's view of FBI's CALEA wiretap >push >Date: Thu, 22 Apr 2004 12:43:51 -0400 > >At 4:32 PM +0100 4/22/04, Dave Howe wrote: > >There isn't a worldwide ban on breaking CSS - doesn't stop the film > >industry trying to enforce it in the US courts. > >Carl Ellison tells the story about how, with the advent of the longbow, all >these peasants had to get absolution from their local priests for killing >knights. Kill a noble on Wednesday, confess on Sunday, lather, rinse, >repeat. > >Needless to say, the impedance mismatch between reality and dogma resolved >itself. > >The economics of networks outweighs the economics of intellectual property >law. That, too, will resolve itself, just like Clipper did. > > >As for finance itself, there's a reason that I say that financial >cryptography is the only cryptography that matters. Since the time of >Mesopotamian bullae and grain banks, cryptography has been essential to >finance. You can't do one without the other. The more cryptography you do, >the more finance you can do, the better off everyone is. It's a virtuous >circle. > >The internet and Moore's law accelerates cryptographic, and thus financial, >progress. More stuff cheaper. > >Cheers, >RAH > >-- >----------------- >R. A. Hettinga <mailto: rah(a)ibuc.com> >The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> >44 Farquhar Street, Boston, MA 02131 USA >"... however it may deserve respect for its usefulness and antiquity, >[predicting the end of the world] has not been found agreeable to >experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' > _________________________________________________________________ Lose those love handles! MSN Fitness shows you two moves to slim your waist. http://fitness.msn.com/articles/feeds/article.aspx?dept=exercise&article=et…

3 2

Duress, Watermarking, a simple design
by Major Variola (ret) 23 Apr '04

23 Apr '04

Specificiation For A Duress File System. Disguised as a Watermark Annotation Management System Maj. Variola (ret), the OsamaSoft Corporation --------------------------------------------------- Background: To deter torture, physically *destroy* your data. If you can't destroy it, you need a *duress* system. It will at least buy some time. Specs for a duress system: Adversary can't know if there's more data You can reveal multiple passphrases to satisfy the Adversary (incl. false data) The former requires stego, otherwise the Adversary could tell that there's more data. The latter requires that your stego'd info doesn't interfere with other stego'd data. Simple Multiple-Use Implementation: Treat the cover media as a block-sized filesystem. The user must specify (and keep track of) the index of the block to embed the payload. To extract data, only a passphrase (not index) is needed if a checksum accompanies data in each occupied block. Multiple blocks can be embedded using the same passphrase, they are all decoded when that passphrase is supplied. (I don't think its possible to store allocation info *in* the file without giving away the presence of more occupied blocks!) Usage: As a watermarking system, anyone can embed any type of watermark in a "block" so long as block occupations are tracked globally. eBay could stego-watermark images in the upper left quadrant, individuals get to use the upper right. Each could use their own watermarking tools. As a collaborative tool, if the annotations are all plaintext this could be like writing comments on the back of a JPG. With the convenience of keeping them with the image. As a duress file system, the watermarks are secret data. They are compressed, encrypted, then embedded in the given block of the cover media. It would be smart to use boring annotations in some blocks so that its not unusual to use the tool with the cover media. (One should also use layers of increasingly sensitive info to give up gradually, as well as plausible fakes.)

1 0

Re: [IP] One Internet provider's view of FBI's CALEA wiretap push
by Major Variola (ret) 23 Apr '04

23 Apr '04

At 09:23 PM 4/22/04 +0200, Thomas Shaddack wrote: >Innocents could be a good "cannon fodder" that can bring a lot of >backslash and alienation aganst the goons, stripping them from public >support. Yes, this has been discussed before, in addition to using it retributionally --finger some deserving civil servant's offspring. But eventually they'll come back to you wanting names that turn out to be legit, and reveal yet more names. Which is not to say that such countermeasures aren't valuable for the *warning time* your colleages get as a result. >> filesystems (etc) with layers of deniable stego. >Are there any decent implementations for Linux/BSD/NT? I haven't looked recently. One property that such a FS or app should have is that it is useful for something *else* besides stego & duress layers. Maybe a watermark :-) management tool that can embed multiple watermarks that don't interfere. Hmm... a meaty problem... tasty, with heavy theory sauce.. >> I wonder how quickly one could incinerate a memory card in the field >> with high success rate? Destroy the data and the passphrases don't >> help. > >There are magnesium rods on the camping market, sold as firestarters for >very bad weather. One can also buy mag ribbon which is more convenient than the mini-ingots you are referring to. I know that pyrotechs coat Mg curls and the like with blackpowder paste (apply wet then dry). A coil of coated ribbon and a rocket-igniter would make a neat little daughterboard :-) Just don't take it on an airplane. There are patents on similar, of course. Testing might get expensive unless you can get destructive-test dongles cheaply, and how much effort do you expend trying to read the data?

2 1

Smartcard patents
by Steve Schear 23 Apr '04

23 Apr '04

http://www.financialcryptography.com/mt/archives/000121.html ------------------------------------------------------------------------ Cryptography Research, the California company that announced the discovery of differential power analysis around late 1997, have picked up a swag of patents covering defences against DPA. One can't read too much into the event itself, as presumably they filed all these a long time ago, way back when, and once filed you just have to stay the distance. It's what companies do, over that side, and if you didn't predict it, you were naive (I didn't, and I was). What is more significant is the changed market place for smart cards. The Europeans dominated this field due to their institutional structure. Big contracts from large telcos and banks lead to lots of support, all things that were lacking in the fragmented market in the US. Yet the Europeans kept their secrets too close to the chest, and now they are paying for the vulnerability. CR managed to discover and publish a lot of the stuff that the Europeans thought they had secretly to themselves. Now CR has patented it. What a spectacular transfer of rights - even if the European labs can prove they invented it first (I've seen some confidential stuff on this from my smart card days) because they kept it secret, they lose it. Secrets don't enjoy any special protection. Security by obscurity loses in more ways than one. What's more, royalties and damages may be due, just like in the Polaroid film case. When both sides had the secret, it didn't matter who invented it, it was who patented it first that won. We will probably see the switch of a lot more smart card work across to CR's labs, and a commensurate rush by the European labs to patent everything they have left. Just a speculative guess, mind. With those patents in hand, CR's future looks bright, although whether this will prove to be drain or a boon to the smart card world remains to be seen.

1 0

Re: [IP] One Internet provider's view of FBI's CALEA wiretap push
by Major Variola (ret) 23 Apr '04

23 Apr '04

t 10:09 AM 4/23/04 -0400, Tyler Durden wrote: >"I wonder how quickly one could incinerate a memory card in the field >with high success rate? Destroy the data and the passphrases don't >help." > >Well, what if there were 3 passwords: > >1) One for Fake data, for amatuers (very few of the MwG will actually be >smart enough to look beyond this...that's why they have guns) >2)One for real data...this is what you're hiding >3) One for plausible real data, BUT when this one's used, it also destroys >the real data as it opens the plausible real data. The first thing cops do is make backups of the harddrives. So you can't destroy the "real data". You would need a tamper-"proof" card (ie trusted security region) to implement this. None of the commercial memory gizmos, from USB dongles to stamp-sized memory cards, do this. None of the smart cards are user programmable and none include secure wipe, AFAIK. Do PDA apps? How do they store data between battery changes? Is it enough to hold a tiny memory card for a minute over a lighter? Merely snapping the card into pieces? Does one need to make a scene with fireworks? (I'm remembering that spammer who tried to eat a small memory card.)

1 0

Re: [IP] One Internet provider's view of FBI's CALEA wiretap push
by Major Variola (ret) 23 Apr '04

23 Apr '04

At 11:33 PM 4/22/04 +0200, Eugen Leitl wrote: > This will produce a loud bang, obviously. > >Thermite is a good choice to turn your fileserver into lava, but that thing >better be outside, or mounted in chamotte- or asbestos-lined metal closet. >Will produce smoke, and take some time, too. Thanks, I hadn't thought about the sensory impact of various methods. Varying amounts of bang vs. heat vs smoke vs lava. Obviously they affect usage environment. >If your keyring's been securely wiped, rubberhosing the passphrase out of you >to unlock it will give the attacker very little. Assuming the device is >powered on, and easily triggerable, that would be quickest. Yes, particularly if USB flash memory has no persistance. But there is no "clear" button on a USB dongle. "Secure clear" would require a small amount of logic. >Assuming the knuckle-draggers will know a CFS from a corrupted FS or a dead >drive, that is. You know the rules of the game, you have to assume that.

1 0

Re: [IP] One Internet provider's view of FBI's CALEA wiretap push
by John Kelsey 23 Apr '04

23 Apr '04

>From: Tyler Durden <camera_lumina(a)hotmail.com> >Sent: Apr 23, 2004 10:09 AM >To: cypherpunks(a)al-qaeda.net >Subject: Re: [IP] One Internet provider's view of FBI's CALEA wiretap push ... >Well, what if there were 3 passwords: >1) One for Fake data, for amatuers (very few of the MwG will actually >be smart enough to look beyond this...that's why they have guns) >2)One for real data...this is what you're hiding >3) One for plausible real data, BUT when this one's used, it also >destroys the real data as it opens the plausible real data. The obvious problem with multiple levels of passwords and data is: When does the guy with the rubber hose stop beating passwords out of you? After he gets one? Yeah, that's plausible, if he's convinced there's only one. But once he's seen a second hidden level, why will he ever believe there's not a third, fourth, etc.? The same calculation applies to a judge or district attorney. He *knows* (even if he's wrong) that there's evidence of kiddie-porn, drug dealing, etc., in there somewhere. He knows you've given up two passwords. Why is he ever going to let you out of jail, or ever going to reduce the charges down to something a normal human might live long enough to serve out the time for? >-TD --John

2 1