September 2004 - cypherpunks-legacy

Saluting the data encryption legacy
by R. A. Hettinga 27 Sep '04

27 Sep '04

<http://news.com.com/2102-1029_3-5381232.html?tag=st.util.print> CNET News http://www.news.com/ Saluting the data encryption legacy By Bruce Schneier http://news.com.com/Saluting+the+data+encryption+legacy/2010-1029_3-5381232… Story last modified September 27, 2004, 9:00 AM PDT The Data Encryption Standard, or DES, was a mid-'70s brainchild of the National Bureau of Standards: the first modern, public, freely available encryption algorithm. For over two decades, DES was the workhorse of commercial cryptography. Over the decades, DES has been used to protect everything from databases in mainframe computers, to the communications links between ATMs and banks, to data transmissions between police cars and police stations. Whoever you are, I can guarantee that many times in your life, the security of your data was protected by DES. Just last month, the former National Bureau of Standards--the agency is now called the National Institute of Standards and Technology, or NIST--proposed withdrawing DES as an encryption standard, signifying the end of the federal government's most important technology standard, one more important than ASCII, I would argue. Today, cryptography is one of the most basic tools of computer security, but 30 years ago it barely existed as an academic discipline. In the days when the Internet was little more than a curiosity, cryptography wasn't even a recognized branch of mathematics. Secret codes were always fascinating, but they were pencil-and-paper codes based on alphabets. In the secret government labs during World War II, cryptography entered the computer era and became mathematics. But with no professors teaching it, and no conferences discussing it, all the cryptographic research in the United States was conducted at the National Security Agency. In the days when the Internet was little more than a curiosity, cryptography wasn't even a recognized branch of mathematics. And then came DES. Back in the early 1970s, it was a radical idea. The National Bureau of Standards decided that there should be a free encryption standard. Because the agency wanted it to be non-military, they solicited encryption algorithms from the public. They got only one serious response--the Data Encryption Standard--from the labs of IBM. In 1976, DES became the government's standard encryption algorithm for "sensitive but unclassified" traffic. This included things like personal, financial and logistical information. And simply because there was nothing else, companies began using DES whenever they needed an encryption algorithm. Of course, not everyone believed DES was secure. When IBM submitted DES as a standard, no one outside the National Security Agency had any expertise to analyze it. The NSA made two changes to DES: It tweaked the algorithm, and it cut the key size by more than half. The strength of an algorithm is based on two things: how good the mathematics is, and how long the key is. A sure way of breaking an algorithm is to try every possible key. Modern algorithms have a key so long that this is impossible; even if you built a computer out of all the silicon atoms on the planet and ran it for millions of years, you couldn't do it. So cryptographers look for shortcuts. If the mathematics are weak, maybe there's a way to find the key faster: "breaking" the algorithm. The NSA's changes caused outcry among the few who paid attention, both regarding the "invisible hand" of the NSA--the tweaks were not made public, and no rationale was given for the final design--and the short key length. But with the outcry came research. It's not an exaggeration to say that the publication of DES created the modern academic discipline of cryptography. The first academic cryptographers began their careers by trying to break DES, or at least trying to understand the NSA's tweak. And almost all of the encryption algorithms--public-key cryptography, in particular--can trace their roots back to DES. Papers analyzing different aspects of DES are still being published today. By the mid-1990s, it became widely believed that the NSA was able to break DES by trying every possible key. This ability was demonstrated in 1998, when a $220,000 machine was built that could brute-force a DES key in a few days. In 1985, the academic community proposed a DES variant with the same mathematics but a longer key, called triple-DES. This variant had been used in more secure applications in place of DES for years, but it was time for a new standard. In 1997, NIST solicited an algorithm to replace DES. The process illustrates the complete transformation of cryptography from a secretive NSA technology to a worldwide public technology. NIST once again solicited algorithms from the public, but this time the agency got 15 submissions from 10 countries. My own algorithm, Twofish, was one of them. And after two years of analysis and debate, NIST chose a Belgian algorithm, Rijndael, to become the Advanced Encryption Standard. It's a different world in cryptography now than it was 30 years ago. We know more about cryptography, and have more algorithms to choose among. AES won't become a ubiquitous standard in the same way that DES did. But it is finding its way into banking security products, Internet security protocols, even computerized voting machines. A NIST standard is an imprimatur of quality and security, and vendors recognize that. So, how good is the NSA at cryptography? They're certainly better than the academic world. They have more mathematicians working on the problems, they've been working on them longer, and they have access to everything published in the academic world, while they don't have to make their own results public. But are they a year ahead of the state of the art? Five years? A decade? No one knows. It took the academic community two decades to figure out that the NSA "tweaks" actually improved the security of DES. This means that back in the '70s, the National Security Agency was two decades ahead of the state of the art. Today, the NSA is still smarter, but the rest of us are catching up quickly. In 1999, the academic community discovered a weakness in another NSA algorithm, SHA, that the NSA claimed to have discovered only four years previously. And just last week there was a published analysis of the NSA's SHA-1 that demonstrated weaknesses that we believe the NSA didn't know about at all. Maybe now we're just a couple of years behind. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Under the hood of FIPS 140-2 Validations
by R. A. Hettinga 27 Sep '04

27 Sep '04

<http://www.cr80news.com/library/2004/09/26/under-the-hood-of-fips-1402-vali…> : CR80 News Under the hood of FIPS 140-2 Validations Sunday, September 26 2004 by John Morris, president and co-founder of Corsec Security, Inc. In our last article (SecureIDNews, August 2004) we covered what FIPS 140-2 and Common Criteria are at a high level. We introduced you to what these standards are, why we need them, who the players are, what the process is, as well as some of the common terms that you will need to know along the way. Now let's delve into what's actually involved in getting FIPS 140-2. In the next article, we'll do the same for Common Criteria. What is FIPS 140-2 again? As we learned last time, FIPS 140-2 dictates that the cryptographic parts of a product are designed, documented, and can be operated in a secure manner to the government's satisfaction. So FIPS 140-2 is a standard mandated for US federal government purchases, strictly enforced in Canada, and followed in various forms by many other governments worldwide. Widely adopted among financial institutions, the standard is becoming an international mark for cryptographic quality. But who sets the rules and who measures results? FIPS 140-2 is short for "Federal Information Processing Standards Publication." The documents are published by the National Institutes of Standards and Technologies (NIST) in the US. In particular FIPS 140-2 was published by NIST with the cooperation of the Communications Security Establishment (CSE) in Canada. NIST and CSE created a joint effort called the Cryptographic Module Validation Program (CMVP) to specifically manage the FIPS 140-2 process. What is the purpose of this program? CMVP, issues validation certificates that let purchasers know if products (cryptographic modules) actually meet the FIPS 140-2 requirements. It is important to understand that this program focuses only on the parts of the product that utilize cryptography. These are the "cryptographic engines" that power the security in all types of products. It's often difficult or impossible for an end consumer to lift the product's hood and examine the cryptographic engine and ensure it truly works the way it is supposed to. Therefore, the CMVP program ensures that detailed testing an analysis is performed, and only those products that meet the claims are listed on the validation lists. How does CMVP do this? CMVP accredits independent labs (commercial companies) to run a specific set of tests and report to the government on the output of those tests. The body that accredits the testing labs is called the National Voluntary Laboratory Accreditation Program, or NVLAP. Initially NVLAP accredited three laboratories to ensure commercial competition (one of which I managed). However, as industry demand and international interest has grown, so to has the number of labs. Currently, CMVP oversees nine testing labs across the US, Canada, and United Kingdom. How do the testing labs work? Testing labs are independent, for-profit organizations, so they compete for the vendors' business. They are all governed by the same sets of rules and regulations and hopefully produce the same end result in judging cryptographic engines. However, the process and procedures they use to achieve the results and how they evaluate documentation, design, and products vary. This is part of the reason that CMVP provides multiple laboratories to satisfy the needs of the competitive commercial marketplace, allowing vendors to compare laboratories on location, prices, responsiveness, resources, etc. But to ensure consistent quality testing the CMVP periodically monitors laboratory quality and prohibits testing labs from consulting on product design or creating documents for products they test. While laboratories can offer some guidance as to what the standard requires, they may not advise a vendor on how to relate that guidance to their specific product. There are separate consultants (such as my company, Corsec) that specialize in helping vendors in these areas. Vendors complain FIPS 140-2 is too hard - is it necessarily? A FIPS 140-2 validation entails significant effort for a vendor before, during and after the vendor chooses the lab. They must verify that their product design is compliant to the requirements in the standard. If not, then design changes will have to be made before the product goes through testing. Next, the vendor has to produce a large body of documentation that explains how the product meets cryptographic security requirements, how its design complies with them, and how it will behave in specific situations. The CMVP program requires very specific documents be submitted in particular formats. This means the vendors or their consultants must spend significant efforts producing documentation for FIPS 140-2 that they would not otherwise produce. Most vendors are not practiced in producing FIPS 140-2 Security Policies, Finite State Machines, or Vendor Evidence documents and may either spend more effort than laboratories require under FIPS 140-2, or include the wrong information. However, with the right focus in the documents, a vendor's product can be quickly evaluated by a laboratory, and efforts significantly reduced. The documents have been submitted, the testing has been done - so now what? Once the commercial testing has been performed, the CMVP reviews the test report and Security Policy as part of their quality control. Assuming the vendor responds promptly and correctly to government questions, CMVP will sign a validation certificate for the tested version of the product, and post it on their web site. In the past, lack of staffing and funding, and sharp growth in FIPS 140-2 testing has caused delays in the government's ability to process test reports - another source of vendor complaints. Although still woefully under-funded despite the recent focus on communications security, the CMVP has avoided the huge delays folks like INS have suffered, and continues to streamline the process. What does this mean to the purchaser? Government or Financial Services industry purchasers who are required to purchase only FIPS 140-2 validated products have begun using validated lists as shopping lists. They help narrow the playing field when comparing similar types of products. If one has been validated and another has not, the purchaser must choose the one with the FIPS 140-2 certificate. Thus, the validated products lists show which products have proven they meet FIPS 140-2 requirements for cryptographic security. It tells you that qualified, independent cryptographic "mechanics" have looked under the hood of the product and ensured the engine is soundly designed, well implemented, and running smoothly. More and more, this assurance is becoming a basic requirement of purchasers inside and outside the government. Vendors have noted this, and the list of validated vendors reads like a who's who of serious players in the market. These days, gaining a FIPS 140-2 validation also tells purchasers that a vendor is committed to security, as validations are typically far from cheap, fast, or easy. Next month, we will cover the testing process for Common Criteria and how it relates to FIPS 140-2 validation. In the meantime, you can read more about FIPS 140-2 requirements at www.corsec.com/fips_center.php, or contact me at jmorris at Corsec dot com. About the author John Morris is president and co-founder of Corsec Security, which offers consulting services for Common Criteria and FIPS 140-2 product validations. Mr. Morris is the former manager of a NVLAP-accredited testing laboratory, and has worked for the last decade in cryptography, public key infrastructure and security engineering with a focus on government security validations. You can read a Q/A by Mr. Morris in Corsec's monthly e-newsletter by visiting www.corsec.com/news.php. Questions can be submitted to info(a)corsec.com. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0

Now we are 8 (and this token proves it)
by R. A. Hettinga 27 Sep '04

27 Sep '04

<http://www.theregister.co.uk/2004/09/24/verisign_age_verification_token/pri…> The Register Biting the hand that feeds IT The Register » Security » Identity » Original URL: http://www.theregister.co.uk/2004/09/24/verisign_age_verification_token/ Now we are 8 (and this token proves it) By Thomas C Greene (thomas.greene at theregister.co.uk) Published Friday 24th September 2004 14:02 GMT VeriSign announced a new USB token that verifies the ages and sexes of children using a computer, and claimed that this will make it easier for innocent sprouts to avoid online predators, Reuters reports. "Chatroom lurkers who can't prove their age will stick out like sore thumbs as more kids adopt the tokens," the wire service explained. The so-called i-Stik USB token will provide verification of a child's age and sex. School administrators will provide lists of students, with their dates of birth and sexes, and VeriSign will encode that information onto the i-Stick tokens. The scheme will begin with a handful of schools for testing this Fall, and, if all goes according to plan, be extended to thousands of schools starting next Spring. That is, assuming its glaring flaws don't become painfully evident by that time. Most obviously, the token will not verify age or sex of the person using it, but only of the person to whom it was issued. Anyone might be using it, and no doubt paedos will be scrambling to get their hands on one of their own, either through loss, theft, or bribery. Once the tokens become popular and widely available, one can expect a brisk trade in them on paedo bulletin boards. (Naturally, the Feds will have to be supplied with plenty of these gizmos, so that they can spend their days hanging out in kids' chatrooms with better cover.) Meanwhile, parents will be lulled further into foolish notions that an Internet-connected PC makes for an adequate electronic babysitter. The Internet is adult space, and there is no substitute for parental supervision. If this scheme does anything to produce a false sense of security among parents, then it's worse than nothing; it's actually dangerous. One thing that the tokens will be good for is online marketing to children. Marketers will be able to get a more accurate sense of the ages and sexes of young visitors to various online venues, and target them more precisely. It will also make for decent PR and corporate image-making for VeriSign, suggesting that the company takes the safety of children seriously. Most importantly, it will produce a nice revenue stream from a basically worthless product that school districts will purchase with tax dollars. In all, it's a win/win gimmick and publicity stunt, so long as child safety is not a criterion for judging its success. ® Thomas C Greene is the author of Computer Security for the Home and Small Office (http://basicsec.org) a comprehensive guide to system hardening, malware protection, online anonymity, encryption, and data hygiene for Windows and Linux. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0

Passports: al-Qaeda's terror weapons
by R. A. Hettinga 27 Sep '04

27 Sep '04

<http://www.abs-cbnnews.com/NewsStory.aspx?section=Focus&oid=56434> ABS-CBNNEWS.COM Sunday, August 1, 2004 11:31 PM Passports: al-Qaeda's terror weapons Vienna, Austria - They're just little embossed rectangles in burgundy, forest green or navy blue, but they can lay a nation bare to a terrorist plot. Passports, not box cutters or even jetliners, may be al-Qaeda's most powerful weapons. Stolen and legitimate, doctored and untouched, they have enabled Osama bin Laden's network and other terror groups to plan and carry out attacks worldwide. In its final report, the US commission investigating the Sept.11 attacks touts high-tech biometric passports, still in the developmental stage, and better border guard training as key ways to tighten the United States' defenses. But antiterrorism experts, mindful of the ingenuity demonstrated by Islamic militants, told The Associated Press they feel humbled and helpless. "One of the hidden criticisms [in the report] is that not only were we not prepared on Sept. 11, but the measures we've taken from Sept. 11 to today have not improved the matter that much," said Michael Greenberger, who was a Justice Department official during the Clinton administration. "Our databases are a mess. Change a person's middle initial and he doesn't show up," said Greenberger, who now directs the University of Maryland's Center for Health and Homeland Security. "By and large, we've not been terribly successful." The commission offers no argument. "No one can hide his or her debt by acquiring a credit card with a slightly different name," said its report, released last week. "Yet today, a terrorist can defeat the link to electronic records by tossing away an old passport and slightly altering the name in the new one." Conceding it has only "fragmentary" evidence of the travels of the Sept. 11 organizers and hijackers, the commission's 567-page report nonetheless is packed with detailed accounts of how the terrorists obtained and modified the passports that got them into the United States. A key panel recommendation points up the seriousness of the threat: "Targeting travel is at least as powerful a weapon against terrorists as targeting their money. The United States should combine terrorist travel intelligence, operations, and law enforcement in a strategy to intercept terrorists, find terrorist travel facilitators, and constrain terrorist mobility." That, experts say, is far easier said than done. "If you have someone who is determined to evade immigration controls, they'll do it -- or at least they'll have a good chance," said Alex Standish, editor of Jane's Intelligence Digest. "I don't see any evidence to suggest that we've had any success in making [al-Qaeda] any less of a threat." Al-Qaeda once brazenly operated its own passport office at the airport in Kandahar, Afghanistan, where the group "altered papers, including passports, visas and identification cards" before the Sept. 11 attacks on the World Trade Center and the Pentagon, the commission notes. Although the US-led war in Afghanistan ended such Taliban-protected operations, there are plenty of terrorists worldwide who are skilled in doctoring documents, the panel warns. It says al-Qaeda and others have refined half a dozen simple yet highly effective techniques. Among the most popular is obtaining stolen passports, which authorities say are available on a lucrative black market that stretches from Eastern Europe to Southeast Asia and South Africa. There are up to 10 million lost or stolen passports in circulation worldwide, according to Interpol estimates. "You can find all sorts of fake passports in the Balkans, including stolen or fake American documents, a former high-ranking police official in Serbia told AP on condition of anonymity.Experts say they're being sold for as little as US$75, although US passports can fetch US$3,000 or more. Al-Qaeda militants and other terrorists intercepted in Europe had obtained South African passports they apparently got from crime syndicates operating within the government agency that issues the documents, officials disclosed to AP last week. Another commonly used technique involves adding or removing visa cachets and entry and exit stamps. By doing so, experts say, terrorists can delete any evidence of their travel to suspicious destinations such as Afghanistan or Pakistan. They also can create false trails to throw authorities off track. Two of the Sept. 11 hijackers, Nawaf al Hazmi and Khalid al Mihdhar, apparently flew to Bangkok because "they thought it would enhance their cover as tourists to have passport stamps from a popular tourist destination such as Thailand," the commission says. Some simply would turn in passports filled with suspicion-arousing visas and stamps from countries where al-Qaeda operated -- even if the documents were still valid for another year -- and get new, clean ones. Fourteen of the 19 suicide hijackers, exhorted by Sept. 11 mastermind Khalid Sheikh Mohammed, obtained new passports. Others work to acquire as many passports as possible, reasoning that a Canadian or Belgian passport is less likely to prompt scrutiny from US border guards than one from Saudi Arabia. In one case cited by the commission, convicted terrorist Ahmed Ressam obtained a blank baptismal certificate that a document vendor had stolen from a Roman Catholic Church in Montreal, and used it to get a genuine Canadian passport. Saudi hijackers had a problem: If they traveled to Afghanistan via Pakistan, and the Pakistanis stamped their passports, they risked having them confiscated back in Saudi Arabia. "So operatives either erased the Pakistani visas from their passports or traveled through Iran, which did not stamp visas directly into passports," the commission says. Tehran has angrily denied any complicity in the Sept. 11 attacks, even though the panel contends up to 10 of the hijackers passed through Iran en route to the United States. Al-Qaeda operative Tawfiq bin Attash indicated that Malaysia repeatedly was used as a place to plot attacks "because its government did not require citizens of Saudi Arabia or other Gulf states to have a visa." Bin Attash, better known as Khallad, helped bomb the USS Cole in Yemen in October 2000, killing 17 American sailors. Greenberger is among many pushing for the swift consolidation of travel databases "so these names start popping up." He and others also are pressing for the introduction of supposedly tamper-proof biometric passports that will contain digital photographs and fingerprints. The European Union agreed in March to fast track the inclusion of biometric data in passports by the end of 2006. Belgium has vowed to be among the first by introducing its new travel documents next year, and Austria, Denmark and Slovenia have developed working prototypes. "We've got to adopt the technology and get away from purely paper documents," Greenberger said. "Nothing is going to be foolproof, but by altering the technology, I think it's possible to raise our defenses," he said. "The harder we make it to forge documents, the greater our gains in protecting the borders. You're really upping the ante." But Standish, of Janes' Intelligence Digest, is skeptical. "The basic problem is that if a document of any kind can be produced, it can be falsified or forged," he said. "As an IRA terrorist once famously said to the authorities: `You have to be lucky all the time. I only have to be lucky once."' -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0

AOL to Sell Secure ID Tags to Fight Hackers
by R. A. Hettinga 27 Sep '04

27 Sep '04

<http://www.reuters.com/newsArticle.jhtml?type=internetNews&storyID=6284760> Reuters AOL to Sell Secure ID Tags to Fight Hackers Mon Sep 20, 2004 06:18 PM ET NEW YORK (Reuters) - America Online will begin offering to sell members a security device and service that has been used to safeguard business computer networks, the world's largest Internet service provider said on Monday. AOL, a unit of Time Warner Inc. (TWX.N: Quote, Profile, Research) , signed a deal with Internet security company RSA Security Inc. (RSAS.O: Quote, Profile, Research) , to launch its new AOL PassCode, designed to add an additional layer of protection to member accounts. PassCode users will be provided with a small handheld six-digit numeric code key. To log onto an AOL account equipped with the service, users will have to type in the six-digits, which refresh on the device every 60 seconds, on top of using the regular password. The code-key device will cost $9.95. Monthly service costs range from $1.95 to $4.95. "AOL PassCode is like adding a deadbolt to your AOL account by automatically creating a new secondary password every 60 seconds," said Ned Brody, senior vice president of AOL Premium Services. Hackers coined the term "phishing" in 1996 to refer to the act of swindling unsuspecting AOL customers into giving up their passwords through phony e-mails or instant messages. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

Hack Attack Gums Up Authorize.Net
by R. A. Hettinga 27 Sep '04

27 Sep '04

<http://www.wired.com/news/print/0,1294,65039,00.html> Wired News Hack Attack Gums Up Authorize.Net By Noah Shachtman Story location: http://www.wired.com/news/infostructure/0,1377,65039,00.html 01:56 PM Sep. 21, 2004 PT Hackers have crippled one of the internet's biggest credit card processors, and tens of thousands of online merchants are losing business while the company struggles to recover. Since last Wednesday, Authorize.Net has been relentlessly pounded by distributed denial of service, or DDoS, attacks. The massive, coordinated waves of internet traffic have repeatedly overwhelmed the company's servers. Authorize.Net's customers have had to improvise: Some are confirming their credit card orders over the phone, others have gone with little or no sales for nearly a week. "I'm losing four grand a day in revenue," said David Hoekje, president of PartsGuy.com, an online heating and air conditioning parts dealer. "My year is a bell curve, and we're on the upwards slope now. This is 5 percent of my year, gone." As of Tuesday afternoon, there still seemed to be no end in sight to the hacker strikes against Authorize.Net. Security experts say that there's little a company can do to defend itself against these kinds of attacks. But company officials insist they're trying. "We're actively trying to deal with it. And we're working hard to minimize the disruptions to our merchants," Authorize.Net marketing director David Schwartz said. The company has turned to the FBI, as well as outside consultants, for help, he added. With about 90,000 customers, Authorize.Net is one of the internet's best-known, most widely used credit card processing services, focusing mostly on smaller merchants. Earlier this year, the firm was bought by the Burlington, Massachusetts, online payment and fraud-detection firm Lightbridge for $82 million. But since the sale, Lightbridge has been hit by a series of body blows. In August, CEO Pamela Reeve resigned; last week, the company announced it was laying off 65 people -- a 12 percent cut in its workforce. And now, "these unforeseen and malicious DDoS attacks," as a company message called them. "We know how hard it is," said Michael Adberg, co-founder of WeaKnees.com. The site, which sells TiVo upgrades and DirecTV installations, was itself the target of a DDoS attack last October. "But we're surprised that such a large company wasn't better prepared than we were." He added, "They have really let us down." For the moment, Adberg and his associates have been phoning customers who place orders over the website, confirming their information and only later processing their payments with Authorize.Net. "But there will be a few customers who we'll ship their orders, and we won't charge them," Adberg said. "Maybe 10 percent will slip through the cracks." The lost revenue is only part of the problem, however. Even if sales are saved, the company image can be scuffed by such a move. "Imagine placing an order with Amazon, but not being able to pay online, and then having to call a customer support person so they can charge you," said a network chief at one of Authorize.Net's customers. The payment processor has been able to take care of some transactions, through slight modifications to its domain name. But these tactics have only been partially effective. And, in the long run, wholesale changes to web addresses are bad for business, explains Drew Copley, a senior research engineer at eEye Digital Security. "You can lose money, lose customers, because they can't find you." Information from attacking PCs can be slowed down; internet protocol addresses of other offending computers can be blocked. But, in the face of a large-scale strike, there's little that can be done, observed Copley, who built one of the first DDoS tools for Windows. "When you get 10,000, 50,000 computers all firing at once, for attacks like that, there is no simple solution," he added. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0

RE: Mystification of Identity: You Say Yusuf, I Say Youssouf...
by Tyler Durden 27 Sep '04

27 Sep '04

Many Cypherpunks view the need to take up crypto arms to stem off an Orwellian, hyper-evil and hyper-competent dictatorship. I'm thinking a more likely (and no less threatening) scenario is one like "Brazil" (ie, the movie). Don't forget, the World Trade Center management was on the Intercom trying to tell everyone to "Remain inside the Building...It's safest Inside the Building". Fuck. Here on Wall Street I'm a dead man. -TD >From: "Roy M. Silvernail" <roy(a)rant-central.com> >Reply-To: roy(a)rant-central.com >To: Tyler Durden <camera_lumina(a)hotmail.com> >CC: "cypherpunks(a)al-qaeda.net" <cypherpunks(a)al-qaeda.net> >Subject: RE: Mystification of Identity: You Say Yusuf, I Say Youssouf... >Date: Sun, 26 Sep 2004 19:35:38 -0400 > >On Sun, 2004-09-26 at 18:55, Tyler Durden wrote: > > Holy shit. So it really boiled down to mere spelling? > > > > So if there's a single "Mohammed Ali" who is a terrorist in the whole >world, > > then no single Mohammed Ali will be able to fly into and out of the US? >How > > many Mohammed Ali's are there in the world? How many Yousef Islam's? > >Or Yusef Islam? Or Yousuf Islam? It's not just spelling, its >Anglo-English interpretation of the phonetic names. Remember a few >years back when the Associated Press made a (not big, but noticable) >deal out of changing the sanctioned spelling of Qadaffi's name? > >Now we have an entire bureaucracy working on the assumption that "names" >are both is-a-person credentials and immutably tranliterable to the >Anglo-English alphabet. > >The mind just *boggles*! >-- >Roy M. Silvernail is roy(a)rant-central.com, and you're not >"Progress, like reality, is not optional." - R. A. Hettinga >SpamAssassin->procmail->/dev/null->bliss >http://www.rant-central.com _________________________________________________________________ Dont just search. Find. Check out the new MSN Search! http://search.msn.click-url.com/go/onm00200636ave/direct/01/

1 0

locustworld + padlock
by Eugen Leitl 27 Sep '04

27 Sep '04

http://www.viatech.com/en/resources/pressroom/2004_archive/pr040923lw_secur… esh.jsp VIA and LocustWorld Secure Wireless Mesh Networks with VIA PadLock High-Speed Encryption On-die security features in the latest VIA processors enable AES Encryption at blistering speeds from LocustWorld.s MeshAP-Pro Taipei, Taiwan, September 23rd 2004 - VIA Technologies, Inc, a leading innovator and developer of silicon chip technologies and PC platform solutions, today announced that the MeshAP-Pro from LocustWorld is the first commercial product to support the hardware-based VIA PadLock ACE (Advanced Cryptography Engine), allowing it to encrypt and decrypt data traveling through the mesh at very high speeds. .Security is a vital part of any wireless network and is an increasingly important issue as adoption of last mile technologies, such as mesh networking, mature and become more widespread,. commented Wai Sing Lee, a security consultant at Frost & Sullivan. .Strong cryptography and certification can be used to build a highly secure wireless network.. The LocustWorld MeshAP-Pro application is used by commercial wireless network operators around the world to provide widespread wireless broadband Internet services over wide areas where each node in the mesh network automatically interconnects with its neighbors to form a large scale, self organizing network. Traffic over the network is encrypted using digital certificates and dynamically generated private keys, making the mesh extremely secure, so as traffic increases, gateways become loaded with the overhead of handling multiple simultaneous cryptographic connections. By utilizing the VIA PadLock ACE, LocustWorld MeshAP-Pro enables meshbox gateways to deliver additional performance in extremely heavily loaded networks while maintaining uncompromisingly high-level certificated security throughout the mesh. .Using the on-die AES encryption from the latest VIA processors we can achieve an encryption layer with hardly any overhead on the CPU,. said Richard Lander, CEO of LocustWorld. .Network performance using the VIA PadLock ACE is close to the speed of un-encrypted communications, achieving high-strength encryption without the associated performance impact, even on large networks with high traffic. The result is virtually transparent encryption.. .The MeshAP-Pro is a great example of how compact power efficient devices based on VIA processors can enable industry leading security without affecting normal system performance,. said Steven S. Lee, Head of the VIA Embedded Platform Division, VIA Technologies, Inc. .Together with innovators like LocustWorld, we are taking the lead in the move to ubiquitous security where security operations can be carried out natively by every system in a network.. Inter-operation between VIA PadLock ACE enabled nodes and other nodes that execute their encryption through software is ensured by the use of industry standard AES encryption, so. mesh administrators can utilize VIA PadLock ACE enabled systems for heavily used nodes to interconnect and make certificated encrypted connections with older or peripheral nodes with lower data throughput capacity. "The VIA PadLock ACE is a great tool, enabling us to extend the power, speed and scale of our wireless mesh networks further, without losing out on performance,. added Jon Anderson, CTO of LocustWorld. .The VIA PadLock ACE-assisted Wireless Mesh gives high speed, secure, wireless networking a very significant performance boost." The LocustWorld MeshAP-Pro has been certified through the VIA PadLock Certification Program that is designed to assist independent software developers in optimizing their products for the VIA PadLock Hardware Security Suite. More information on the VIA PadLock ACE is available from the VIA PadLock Hardware Security Suite website. About the VIA PadLock Security Initiative Comprising the VIA PadLock Hardware Security Suite and VIA PadLock Software Security Suite, the VIA PadLock Security Initiative is focused on providing key hardware and application level security building blocks that can be easily integrated into any computing and communications infrastructure. The VIA PadLock Hardware Security Suite is integrated into VIA C5P Nehemiah core processors and features the VIA PadLock RNG for high quality key generation and the VIA PadLock ACE (Advanced Cryptography Engine) for high speed performance of the US government approved Advanced Encryption Standard (AES). The VIA PadLock Software Security Suite consists of the VIA PadLock SDK, the VIA PadLock ZIP utility and source code and the VIA PadLock Tru-Delete utility and source code. More information on the VIA PadLock Security Initiative may be found at the VIA website http://www.via.com.tw/en/padlock/padlock_initiative.jsp. About LocustWorld LocustWorld produces the MeshAP-Pro, providing hardware, software and services that allow customers to build complete mesh networking solutions. Based in the UK, LocustWorld addresses the demand for mesh networking using their own resources assisted by a network of regional service providers. LocustWorld has gained world-wide recognition as leaders in wireless mesh networking, with live installations and public references and many happy customers. More information about LocustWorld and reference installations can be found at www.locustworld.com -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

ADV: Announcement To All Staff
by Admin 21 Sep '04

21 Sep '04

Attention All Nonprofit Organizations: Members, Staff and Associates: You Must Respond By 5 P.M. Wednesday, September 22, 2004. Through a special arrangement, Avtech Direct is offering a limited allotment of BRAND NEW, top of-the-line, name-brand desktop computers at more than 50% off MSRP to all Nonprofit Members and Staff, who respond to this message before 5 P.M., Wednesday, September 22, 2004. All desktop are brand-new, packed in their original boxes, and come with a full manufacturer's warranty plus a 100% satisfaction guarantee. These professional grade Desktops are fully equipped with 2004 next generation technology, making these the best performing computers money can buy. Avtech Direct is offering these feature rich, top performing Desktop Computers with the latest Intel technology at an amazing price to all who call: 1-800-884-9510 by 5 P.M. Wednesday, September 22, 2004 The fast and powerful AT-2400 series Desktop features: * Intel 2.0Ghz Processor for amazing speed and performance * 128MB DDR RAM, --- Upgradeable to 1024 * 20 GB UDMA Hard Drive, --- Upgradeable to 80 GB * 52X CD-Rom Drive, --- Upgradeable to DVD/CDRW * 1.44 Floppy disk drive * Next Generation Technology * ATI Premium video and sound * Full Connectivity with Fax modem/Lan/IEE 1394/USB 2.0 * Soft Touch Keyboard and scroll mouse * Internet Ready * Network Ready * 1 Year parts and labor warranty * Priority customer service and tech support MSRP $699 ........................................ Your Cost $297 How to qualify: 1. You must be a Member, Staff or Associate of a Nonprofit. 2. All desktop computers will be available on a first come first serve basis. 3. You must call 1-800-884-9510 by 5 P.M. Wednesday, September 22, 2004 and we will hold the desktops you request on will call. 4. You are not obligated in any way. 5. 100% Satisfaction Guaranteed. Call Avtech Direct 1-800-884-9510 before 5 P.M. Wednesday, September 22, 2004 Visit our website at http://www.avtechdirectcomputers.com If you wish to unsubscribe from this list, please go to: http://www.computeradvice.org/unsubscribe.asp Avtech Direct 22647 Ventura Blvd., Suite 374 Woodland Hills, CA 91364

1 0

Re: Geopolitical Darwin Awards
by Major Variola (ret) 21 Sep '04

21 Sep '04

At 11:42 AM 9/20/04 -0500, J.A. Terranson wrote: >On Sun, 19 Sep 2004, Major Variola (ret) wrote: > >> (Remember the >> Hiroshima bomb was *not* tested, so sure were the scientists. Trinity > >My understanding (and I am *positive* someone will correct me if I'm >wrong) was that there was a shortage of both fissionable materials and >appropriate [altimeter] fuse mechanisms, making testing a outside of enemy >territory a losing proposition. Fissiles were expensive, still are, but the design of U-gun is better (if you can afford the enrichment) because of U's lower spontaneous fission rate, ie fewer spare neutrons to spoil the fun. Even pure Pu-239, the result of short irradiation, has a problem with premature ejaculation.

2 1