May 2004 - cypherpunks-legacy

Sierra Wireless Embeds Certicom's movian VPN Client in new Voq Professional Phone
by R. A. Hettinga 11 May '04

11 May '04

<http://biz.yahoo.com/prnews/040511/to295_1.html> Yahoo! Press Release Source: Certicom Corp. Sierra Wireless Embeds Certicom's movianVPN Client in new Voq Professional Phone(TM) Tuesday May 11, 7:02 am ET New smart phone to provide business users with secure e-mail capabilities while leveraging existing security infrastructure MISSISSAUGA, ON, May 11 /PRNewswire-FirstCall/ - Certicom Corp. (TSX: CIC - News), the authority for strong, efficient cryptography, today announced that Sierra Wireless (NASDAQ: SWIR - TSX: SW) has embedded movianVPN(TM) by Certicom into its VoqMail(TM) Professional Edition (VoqMail Pro) wireless e-mail solution, offered for the new Voq Professional Phone(TM). As an embedded feature that supports multiple VPN gateways, the solution is designed to offer IT managers minimal administration and a better return on their existing security infrastructure investment. Based on the Microsoft Windows Mobile(TM) software for Smartphones, the Voq Professional Phone was developed specifically for enterprise users and mobile professionals. The product is designed to offer vital business applications, such as e-mail, and strong security for sensitive and confidential information. A key feature of the Voq Professional Phone is the ease with which the movianVPN client can be integrated into an enterprise's existing security infrastructure and its minimal impact on performance and battery life of the phone. By making security an integral part of VoqMail Pro and its VoqManager desktop IT provisioning tool, and not a separate add-on, Sierra Wireless has created a turn-key enterprise and business data access solution that saves time and effort by eliminating the need for IT managers to work with third parties to buy and configure software and policies for each device. "Voq was developed specifically for the needs of the business professional, and the IT Managers that support them. During development we recognized that a key requirement of the enterprise was the ability to integrate a VPN client without comprising the end user experience or increasing the burden on IT administrators," said Andrew Harries, senior vice president of marketing for Sierra Wireless. "Working with our partners, we believe we have succeeded in building a powerful product that provides a strong, user- and IT-friendly solution." For over 15 years, Certicom has focused on developing and providing security for constrained environments. This expertise has resulted in a wireless VPN client that is one-tenth the size of desktop versions but with equivalent functionality. It provides strong security, including confidentiality, integrity and authentication from handheld devices to the corporate network. movianVPN, an award-winning wireless VPN client, meets the IPSec standard to provide secure access to the corporate network via wireless handhelds. movianVPN fits with existing infrastructure by supporting more than a dozen gateways, including those from Cisco, Netscreen and Nortel and the three leading operating systems - Microsoft Windows Mobile, Palm OS and Symbian OS - including the various versions of the platforms. "The combination of Sierra Wireless' deep experience in the wireless market and their diligence in developing the Voq Professional Phone to meet specific end user requirements has resulted in a Smartphone that addresses today's needs of the enterprise. They have optimized the user experience while focusing on process, security, and power management," said Roy Pereira, vice-president of marketing and product management at Certicom. "We believe the Voq Professional Phone will become a real success story in the mobile market." Sierra Wireless announced the VoqMail Personal and Professional Edition software on February 11, 2004, introducing an always-there(TM) e-mail experience and providing easy-to-use, cost-efficient, and secure access to corporate e-mail. For more information, visit http://www.voq.net/site/news_events/news_20040211.voq About Sierra Wireless Sierra Wireless is a leader in delivering highly differentiated wireless solutions that enable our customers to improve their productivity and lifestyle. Sierra Wireless develops and markets the AirCard, the industry-leading wireless PC card line for portable computers; embedded modules for OEM wireless applications; the MP line of rugged vehicle-mounted connectivity solutions; and Voq, a line of mobile phones with easy-to-use, secure software solutions for mobile professionals. For more information about Sierra Wireless please visit www.sierrawireless.com. About Voq The Voq Professional Phone(TM) is a new class of mobile phone that offers a flip-open QWERTY thumbpad and easy-to-use software solutions for business users, including secure, serverless, always-there e-mail. Based on the Microsoft Windows Mobile(TM) 2003 software for Smartphone, the Voq Professional Phone incorporates the best features of your current mobile phone, a messaging device, and a PDA - in one. For more information about Voq Professional Phone or VoqMail email solutions, please visit www.voq.com About Certicom Certicom Corp. (TSX:CIC - News) is the authority for strong, efficient cryptography required by software vendors and device manufacturers to embed security in their products. Adopted by the US Government's National Security Agency (NSA), Certicom technologies for Elliptic Curve Cryptography (ECC) provide the most security per bit of any known public key scheme, making it ideal for constrained environments. Certicom products and services are currently licensed to more than 300 customers including Motorola, Oracle, Research In Motion, Terayon, Texas Instruments and XM Radio. Founded in 1985, Certicom is headquartered in Mississauga, ON, Canada, with offices in Ottawa, ON; Reston, VA; San Mateo, CA; and London, England. Visit www.certicom.com. Certicom, Security Builder, Security Builder Crypto, Security Builder SSL, Security Builder PKI, Security Builder GSE, movianVPN, movianCrypt and movianMail are trademarks or registered trademarks of Certicom Corp. All other companies and products listed herein are trademarks or registered trademarks of their respective holders. Except for historical information contained herein, this news release contains forward-looking statements that involve risks and uncertainties. Actual results may differ materially. Factors that might cause a difference include, but are not limited to, those relating to the acceptance of mobile and wireless devices and the continued growth of e-commerce and m-commerce, the increase of the demand for mutual authentication in m-commerce transactions, the acceptance of Elliptic Curve Cryptography (ECC) technology as an industry standard, the market acceptance of our principal products and sales of our customer's products, the impact of competitive products and technologies, the possibility of our products infringing patents and other intellectual property of fourth parties, and costs of product development. Certicom will not update these forward-looking statements to reflect events or circumstances after the date hereof. More detailed information about potential factors that could affect Certicom's financial results is included in the documents Certicom files from time to time with the Canadian securities regulatory authorities. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[linux-elitists] Two on RFID from Politech: Hack the tech, & Gilmore's dystopia (fwd from kmself@ix.netcom.com)
by Eugen Leitl 11 May '04

11 May '04

----- Forwarded message from "Karsten M. Self" <kmself(a)ix.netcom.com> -----

1 0

Re: Brands' private credentials
by Adam Back 11 May '04

11 May '04

[copied to cpunks as cryptography seems to have a multi-week lag these days]. OK, now having read: > http://isrl.cs.byu.edu/HiddenCredentials.html > http://isrl.cs.byu.edu/pubs/wpes03.pdf and seeing that it is a completely different proposal essentially being an application of IBE, and extension of the idea that one has multiple "identities" encoding attributes. (The usual attribute this approach is used for is time-period of receipt .. eg month of receipt so the sender knows which key to encrypt with). On Wed, Apr 28, 2004 at 07:54:50PM +0000, Jason Holt wrote: > properties to Brands', and even does some things that his doesn't. so here is one major problem with using IBE: everyone in the system has to trust the IBE server! > I feel a little presumptuous mentioning it in the context of the > other systems, which have a much more esteemed set of authors and > are much more developed, but I'm also pretty confident in its > simplicity. One claim is that the system should hide sensitive attributes from disclosure during a showing protocol. So the example given an AIDs patient could authenticate to an AIDS db server without revealing to an outside observer whether he is an AIDs patient or an authorised doctor. However can't one achieve the same thing with encryption: eg an SSL connection and conventional authentication? Outside of this, the usual approach to this is to authenticate the server first, then authenticate the client so the client's privacy is preserved. Further more there seems to be no blinding at issue time. So to obtain a credential you would have to identify yourself to the CA / IBE identity server, show paper credentials, typically involving True Name credentials, and come away with a private key. So it is proposed in the paper the credential would be issued with a pseudonym. However the CA can maintain a mapping between True Name and pseudonym. However whenever you show the credential the event is traceable back to you by collision with the CA. > Note that most anonymous credential systems are encumbered by > patents. I would not say your Hidden Credential system _is_ an anonymous credential system. There is no blinding in the system period. All is gated via a "trust-me" CA that in this case happens to be an IBE server, so providing the communication pattern advantages of an IBE system. What it enables is essentially an offline server assisted oblivious encryption where you can send someone a message they can only decrypt if they happen to have an attribute. You could call this a credential system kind of where the showing protcool is the verifier sends you a challenge, and the shower decrypts the challenge and sends the result back. In particular I don't see any way to implement an anonymous epayment system using Hidden Credentials. As I understand it is simply not possible as the system has no inherent cryptographic anonymity? Adam

3 7

blinding & BF IBE CA assisted credential system (Re: chaum's patent expiry?)
by Adam Back 10 May '04

10 May '04

On Mon, May 10, 2004 at 03:03:56AM +0000, Jason Holt wrote: > [...] Actually, now that you mention Chaum, I'll have to look into > blind signatures with the B&F IBE (issuing is just a scalar*point > multiply on a curve). I think you mean so that the CA/IBE server even though he learns pseudonyms private key, does not learn the linkage between true name and pseudonym. (At any time during a show protocol whether the private key issuing protocol is blinded or not the IBE server can compute the pseudonyms private key). Seems like an incremental improvement yes. > That could be a way to get CA anonymity for hidden credentials - > just do vanilla cut and choose on blinded pseudonymous credential > strings, then use a client/server protocol with perfect forward > secrecy so he can't listen in. Note PFS does not make end-2-end secure against an adversary who can compute the correspondents private keys, as vulnerable to MITM. Could say invulnerable to passive eavesdropper. However you might have an opening here for a new security model combining features of Hidden Credentials with a kind of MITM resistance via anonymity. What I mean is HC allows 2 parties to communicate, and they know who they are communicating with. The CA colluding MITM however we'll say does not apriori, so he has to brute force try all psuedonym, attribute combinations until he gets the right one. Well still not desirable security margin, but some extra difficulty for the MITM. Adam

2 2

Accoustic Cryptoanalysis for RSA?
by Dave Howe 10 May '04

10 May '04

opinions? http://www.wisdom.weizmann.ac.il/~tromer/acoustic/

1 0

Re: anonymous IRC project needs new home...
by Poindexter＠SAFe-mail.net 09 May '04

09 May '04

At 07:07 AM 5/9/2004 -0400, Adam Back wrote: >The anonymous IRC project (IIP -- http://www.invisiblenet.net/iip/) provides encrypted anonymous IRC chat. > >Haven't looked in the protocol in detail to see how they get their anonymity, but the guy seemed aware of Chaum etc and they have crypto protocols document up there. > >They have resource problems in continuing to run it, and so have announced end-of-life for the project, but source etc is available, and they are calling for interest in taking over the project. > >Anyone with a bit of bandwidth and interest in preserving anonymity of IRC want to help them out? Despite supposedly being an "open source" project, "nop", the lead developers/project manager, has kept some of the source/procedures necessary to run iip rather closed (e.g., the server configuration and the source code for the public relay 'harvester'). There were quite a few iip users who expressed interest in helping out or taking over when iip's problems first became painful about six-nine months ago. Now many iip users may have left, and a non-public project with much grander ambitions and truly open source is well along in development (spurred on in good part because of nop's lack of communication with the iip community). This call for help may be a bit too late.

1 0

anonymous IRC project needs new home...
by Adam Back 09 May '04

09 May '04

The anonymous IRC project (IIP -- http://www.invisiblenet.net/iip/) provides encrypted anonymous IRC chat. Haven't looked in the protocol in detail to see how they get their anonymity, but the guy seemed aware of Chaum etc and they have crypto protocols document up there. They have resource problems in continuing to run it, and so have announced end-of-life for the project, but source etc is available, and they are calling for interest in taking over the project. Anyone with a bit of bandwidth and interest in preserving anonymity of IRC want to help them out? (The way I first heard about the project is that they use hashcash to throttle nym registration abuse -- before that people were creating 1000s of handles through it.) Adam

1 0

No stinkin' constitution here
by Major Variola (ret) 09 May '04

09 May '04

"Material-witness warrants are used by the government to hold people suspected of having direct knowledge about a crime or to give agents more time to investigate." http://www.latimes.com/news/nationworld/world/la-na-madrid7may07,1,303922.s… ALOHA, Ore. A Portland lawyer was detained Thursday by the FBI after federal officials linked his fingerprint to bomb-related evidence associated with the Madrid railway attacks that killed 191 people in March, a federal law enforcement official said. The arrest of Brandon Mayfield, 37, raises the possibility of a U.S. connection to the March 11 bombings, which Spanish authorities have blamed on Islamic extremists. The former Army officer, a Muslim convert, was held on a material-witness warrant after the FBI searched his home in the Portland suburb of Aloha. Mayfield's arrest was first reported Thursday on Newsweek magazine's website. He has not been charged with any crime, and the federal official stressed that the investigation was continuing and is in many ways preliminary. Spanish officials cautioned earlier this week that they did not consider the fingerprint evidence to be conclusive. Material-witness warrants are used by the government to hold people suspected of having direct knowledge about a crime or to give agents more time to investigate. <snip>

2 1

iTunes 4.5: "24 hours after I downloaded it... I've broken it"
by R. A. Hettinga 08 May '04

08 May '04

<http://craz.net/programs/itunes/> crazney.net - iTunes stuff Welcome to my iTunes stuff website, here you will find various things relating to iTunes hacking that I have written. Last updated:April 29, 2004 iTunes 4.5: iTunes 4.5 uses a new authentication algorithm. However, not even 24 hours after I downloaded it, and that includes a little sleep and lots of uni time, I've broken it. Hah. Anyhow, libopendaap 0.2.0 and tunesbrowser 0.1.4 are now available. <crazney> brb have to shut chooks in. <Fryboy> "I have just deconstructed the encryption protocol designed by Apple's finest enginee..ah fuck the chicken has escaped" Pages here: * libopendaap: A library for connecting to iTunes shares and streaming audio files. * tunesbrowser: An application, built on top of libopendaap in GTK for browsing and playing the songs in various iTunes shares. * authentication: A page describing the authentication procedure used by the latest iTunes programs in order to lock out third party applications. * iTunes Music Store authentication: A page describing the authentication packets used by the iTMS. This complements Jason Rohrers iTMS-4-ALL project. Say no to the AUS-FTA! Contact info: See the front page for contact details. Please let me know if you use and enjoy (or hate) this software! Apple and iTunes are registered trademarks of Apple Computer, Inc. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0

When It Comes to Selling Virtual Property, PayPal Isn't Always Your Pal
by R. A. Hettinga 07 May '04

07 May '04

<http://www.pbs.org/cringely/pulpit/pulpit20040506.html> PBS: I, Cringely -- The Pulpit MAY 6, 2004 PayAcquaintance When It Comes to Selling Virtual Property, PayPal Isn't Always Your Pal By Robert X. Cringely Games are make believe, their rules have to be only internally consistent, not consistent with any laws of man or nature. And that is probably the reason we like them, because in the game, whether played in my garden or in your computer, we can be warriors or wizards, men or mice, we can carry on our belts the scalps of our enemies and nobody is really hurt, no laws are broken. But games are also big business, which means they inevitably intersect with the real world. And when that point of intersection is through PayPal, some game players believe they are being robbed. This story was brought to my attention by players of EverQuest, Sony's incredibly successful and incredibly complex fantasy role-playing game, but I am sure it applies to similar games. Understand, I am not a gamer, and have not a chromosome of gamer DNA in me, so if you are a gamer and feel that I am mischaracterizing an activity that occupies, say, a third of your waking hours, just pity me and hold the complaints, okay? EverQuest and most other multiplayer online games like it are subscription-based. You pay Sony a monthly fee to be allowed to be a character in the game. Some of your character attributes are personal choices made when you set up the account, but many are earned, given, or even just discovered as you make your way through the many levels of the game, gaining powers and weapons and even money. Yes, money. The currency in EverQuest is platinum, and it can be used to buy many things, including sometimes buying your way out of trouble. Sony's view of its game is that everything takes place in the server and nothing in the real world. Characters can give things or sell things to each other in the game (weapons, magical abilities, platinum, etc.), but in Sony's view, it is all supposed to take place in the game. Avid gamers, however, came to see a real market in these things, selling them primarily to players who wanted to buy their way higher in the game. So there developed a secondary market in virtual goods, first on eBay, then on specialized game auction sites, and there are online stores where you can buy this stuff outright. Sony doesn't specifically allow it, but Sony also doesn't do much to prevent it, so the practice is widespread. The arbitrage opportunity here is based on skill and knowledge of the game. If I am some kind of EverQuest god having made it the old fashion way to the top of the game, it is much easier for me to acquire these goodies than it might be for a beginner. Or maybe I have found a bug in the program that allows me to exploit over and over again some action that yields platinum, for example. Once I have enough valuable stuff worth selling, I would typically give it to a second character (not my most powerful performer -- I need to keep him/her/it apparently untainted by commercialism). Then I find a buyer through an auction site, or I just sell the stuff to a wholesaler like Internet Gaming Entertainment, the Big Kahuna in the buying and selling of this stuff. How the actual transfer of goods takes place is very interesting. Once a deal is struck, the characters of the buyer and seller have to meet at an agreed place in the game where the hand over (no hands are actually involved of course) takes place. Either one character just gives this big load of platinum to the other or they give it in exchange for some game item of much less value. This latter technique is the pure play because it complies best with Sony rules that allow bad bargaining and character stupidity. "Manhattan for $24 in beads? Sure!" Meanwhile, back in the real world, real money is changing hands, typically through PayPal transfers. The transfer is done first, then the property is exchanged. Only it doesn't always work that way. Sometimes the buyer retracts the payment saying that a transfer never took place at all. After all, there is no receipt. Sounds a bit like the Diebold e-voting scandal, eh? PayPal yanks the money back out of the seller's account EVEN IF IT HAS ALREADY BEEN TRANSFERRED TO A BANK ACCOUNT. One minute the money is there, the next minute it isn't, and the seller has almost no recourse at all. The specific event that led to this column was the failed sale of $2,300 in platinum by a group of EverQuest fanatics who wanted to use the money to pay their way to a big EverQuest convention. It is their contention (not mine, I'm just the reporter here, remember) that the bad guy in this deal is either Jonathan Yantis or an associate of his. Jonathan Yantis runs Yantis Enterprises, which was until recently the big competitor to IGE for the buying and selling of this stuff that isn't real. Yantis is in San Diego, IGE is in Florida, and earlier this year they merged with IGE buying Yantis, though the web sites (they are both in this week's links) remain separate. The players who came to me sold their platinum through a game-specific auction site. The deal went forward exactly as described above, and they suddenly had no platinum and no money. Wily hackers that they are, they tracked the mail records of the only trail that did exist, the e-mails arranging the exchange, and claim to have found that the buyer's IP address was from the same range used by Yantis Enterprises. Further, they explored the qualifications of the "PayPal Verified" buyer and claim that most of the positive feedback came from Jonathan Yantis. Finally, they claim that the day after the transaction, the Yantis price to sell platinum on their EverQuest server suddenly dropped as though there was suddenly a larger supply acquired at little or no cost. These players are fervent and angry and they have some real data so what happens now? Not much, and that is probably the real topic of this column. Yantis Enterprises has no telephone number and doesn't respond to e-mail from me. IGE also has no telephone number but they do have a PR firm that doesn't call me back. These are companies apparently doing millions per year in business, yet they effectively don't have a physical existence. PayPal certainly has a physical existence and they DO return my calls and tried hard to be helpful, but the story there isn't very encouraging, either. For one thing, PayPal can't figure out how to handle payments for such virtual goods, so they rely on the good will of the buyers and sellers involved. If a buyer backs out, PayPal has no recourse but to reverse the charge (called a chargeback) or take the loss itself, which it is unwilling to do. This applies to game goods, but it also applies to ANY virtual goods, so if you are planning to sell software or music or video this way, you might have to think a bit harder. PayPal is not built to reliably support a peer-to-peer economy. What about feedback? Isn't the great enforcement mechanism of eBay and PayPal supposed to be feedback from other users? Here is where it gets REALLY interesting. The essence of feedback is that you can run, but you can't hide, and PayPal enforces that by limiting each user to a single account. But how do they make that stick? They don't. PayPal asked ME to help them find Jonathan Yantis, for example. Here is a guy who has participated in more than 10,000 PayPal transfers and they don't know how to reach him. That 10,000 plus PayPal number is a big part of his marketing. But PayPal also told me that part of their difficulty finding him is that they have DOZENS of accounts under the name Jonathan Yantis. Their assumption is that these are all different people. So I went to the People Search section of Yahoo and looked for everyone in America named J, Jonathan, John, or Jack Yantis and found 35 people. Say there are another 35 with unlisted numbers, that's 70 people, tops. If there are 300 million Americans and PayPal has 40 million users then no more than 14 of those users ought to be named J, Jonathan, John, or Jack Yantis. So it is easy to have multiple PayPal accounts and if you have multiple accounts you can give yourself lots of positive feedback, so the system can be played. I am not saying that Jonathan Yantis or IGE did any of this. I'm just reporting what I was told and what I discovered. I can't understand why someone would threaten a 10,000 plus PayPal score by trying to corner the EverQuest platinum market. I'm also quite concerned over the lack of safety measures PayPal has in place to protect buyers and sellers. I DO see here a wonderful business opportunity, though, for someone to come up with a reliable way to handle payments for virtual goods. That would be worth its weight in gold, 'er platinum. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0