March 2005 - cypherpunks-legacy

HAQ Env.
by morse＠maryland.com 12 Mar '05

12 Mar '05

1 0

Virtual JX Net.
by miller＠essex.com 12 Mar '05

12 Mar '05

1 0

FW: Managed Security Services Webinar from Light Reading
by Tyler Durden 11 Mar '05

11 Mar '05

>Dear Colleague, > >As an industry professional, you may be interested to know about a coming >online event being presented by Light Reading (www.lightreading.com) This >free Web seminar - "Managed Security Services: Hidden Promise" - will >evaluate recent changes in this critical market. > >This Webinar will discuss ways for carriers to optimize profits when >offering managed security services. It will examine ways of maximizing >revenues while minimizing capital and operating costs. It will also >identify key customer requirements and show how they can be addressed. > >The following topics will be discussed: > >- How combinations of services can be offered to enterprise and high-end >customers >- How this can be done cost effectively >- How managed security service providers can offer advanced functionality >and features >- How they can simplify reporting processes for customers >- How they can create less time-consuming operating environments >- How the market for managed security services is evolving > >Join us on Tuesday, March 22, at 12:00 p.m. New York / 5:00 p.m. London >time, for this live Webinar moderated by Jeff Wilson, Principal Analyst at >Infonetics Research, and sponsored by Fortinet and Radware. > >You can sign up for this event via this link: > >http://metacast.agora.com/link.asp?m=24277&s=4936527&l=0 > >We hope to see you there! > >Light Reading > > > > > > > >============================================ >If you wish to be taken off this list, simply reply to this message and >include the word "unsubscribe" in the subject field - or visit the link >provided below. You will be taken off automatically. > > > > >Light Reading Inc. >23 Leonard St. >New York, NY 10013

1 0

[p2p-hackers] good-bye, Mnet, and good luck. I'm going commercial! plus my last design doc (fwd from zooko@zooko.com)
by Eugen Leitl 11 Mar '05

11 Mar '05

----- Forwarded message from Zooko O'Whielacronx <zooko(a)zooko.com> -----

5 8

MD5 collision method published
by Anonymous 11 Mar '05

11 Mar '05

At last, the secret of how to make MD5 collisions is out! See http://cryptography.hyperlink.cz/MD5_collisions.html. This includes the Wang report, probably the one which will be presented at Eurocrypt: http://www.infosec.sdu.edu.cn/paper/md5-attack.pdf. As a bonus, it includes an independent reconstruction of the attack by Vlastimil Klima, http://cryptography.hyperlink.cz/md5/MD5_collisions.pdf. The attack has two parts: finding a first block which almost collides, then finding a second block which eliminates the differences left after the first block. Klima claims that his method is much faster for the first part, taking only 2 minutes compared to an hour for the Wang method. However he was not able to match the Wang performance for the second part; his method is 80 times slower for that. He predicts: "It may be expected that after publishing the Chinese method the overall time for finding a complete collision can fall down to as less as 2 minutes on a PC notebook." Well, now Wang has published her method, linked there on Klima's web site, and so it should be possible in principle to put them both together. No source code is published, but we can create it from the papers. I guess I know what I'll be hacking on this weekend!

1 0

MI Com.
by albright＠illinois.com 11 Mar '05

11 Mar '05

1 0

American Service PKM Ven.
by ham＠montana.com 10 Mar '05

10 Mar '05

1 0

Re: SHA1 broken?
by Major Variola (ret) 09 Mar '05

09 Mar '05

At 09:23 PM 2/19/05 +0000, Dave Howe wrote: > I am unaware of any massive improvement (certainly to the scale of >the comparable improvement in CPUs) in FPGAs, and the ones I looked at a >a few days ago while researching this question seemed to have pretty FPGAs scale with tech the same as CPUs, however CPUs contain a lot more design info (complexity). But FPGAs since '98 have gotten denser (Moore's observation), pioneering Cu wiring, smaller features, etc.

4 7

Credit card fraud hits new high despite chip and PIN
by R.A. Hettinga 08 Mar '05

08 Mar '05

<http://www.timesonline.co.uk/printFriendly/0,,1-2-1516072-2,00.html> The Times of London March 08, 2005 Credit card fraud hits new high despite chip and PIN By Helen Nugent CREDIT and debit card fraud has soared to a record #500 million despite the introduction of new chip-and-PIN technology, it emerged today. Banks, credit card companies and shop owners hoped that the new technology would reduce fraud because a four-digit personal identification number is harder to reproduce than a signature. But far from deterring fraudsters, the new measures have encouraged criminals to steal more cards. Figures from Apacs (the Association for Payment Clearing Services) show that losses to thieves rose by 20 per cent last year, equivalent to #10 for every adult in Britain. An average of 100,000 credit and debit cards were posted to consumers every day last year. Many were intercepted by criminals, resulting in a 62 per cent rise - to #73 million - in "mail non-receipt" fraud. The sheer volume of cards sent out every day provided rich pickings for fraudsters who operate by getting their hands on plastic before it is received by the genuine customers. The banking industry says that it is working with Royal Mail to monitor card losses, identify fraud hot spots and take preventive action such as asking cardholders to collect new cards from their branch. But customers seem reluctant to pick up new cards in person. Card analysts claim that fraudsters doubled their efforts last year in the belief that chip and PIN would eventually act as an effective deterrent. Malcolm Bushell, managing director of Ingenico, Northern Europe, the world's biggest developer and supplier of chip-and-PIN technology, said: "The banks knew that 2004 would be a difficult year because fraudsters would want to fill their boots while they still could." But retailers and banks seem powerless to clamp down on credit card fraud. The theft of card details, which are then used to buy products over the phone, via mail order or over the internet - known as "card-not-present fraud" - continues to top the table of losses, soaring by 24 per cent to #150 million last year. Consumers duped by counterfeiters who illegally clone or skim cards lost nearly #130 million last year, a rise of 17 per cent. Fraud at cash machines, a favourite resort of thieves, grew at an alarming rate, up by 81 per cent to nearly #75 million Chip and PIN claims to be a sophisticated anti-fraud measure, yet there is no deadline for its implementation. Cards without the new technology are still being issued and of 141 million credit and debit cards in circulation, one in three are still the old signature-only type. Furthermore, 15 per cent of retailers have yet to install tills that accept PINs, even though retailers without chip and PIN in-store have been liable for fraudulent transactions since January 1 this year. The British Retail Consortium said: "This time next year, we should be in more of a position to see the impact that chip and PIN has had on card fraud." Many shops that have up-to-date tills still do not insist that customers use PINs to authorise transactions. "Fraudsters can disable the chip, for instance by smacking it with a hammer, and pay for goods using a signature," Mr Bushell said. "There is a case for saying that a signature should not be accepted." Apacs estimates that, without chip and PIN, losses would reach #800 million by the end of this year. But it accepts that the battle against fraudsters is still to be won. Sandra Quinn, its director of corporate communications, said: "The more of us use a PIN, the harder a criminal's life becomes. But clearly they will keep targeting cards. Many people have made predictions on where the fraudsters will attack next, but we have long foreseen that we need to keep cards secure in all environments." Card identity fraud rose by 22 per cent during 2004, according to Apacs. Credit reference agencies say that this alternative type of fraud is likely to grow even more if chip and PIN does prove successful. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: I'll show you mine if you show me, er, mine
by James A. Donald 08 Mar '05

08 Mar '05

-- > > However, techniques that establish that the parties share a > > weak secret without leaking that secret have been around > > for years -- Bellovin and Merritt's DH-EKE, David Jablon's > > SPEKE. And they don't require either party to send the > > password itself at the end. > They are heavily patent laden, although untested last time I > looked. This has been discouraging to implementers. There seem to be a shitload of protocols, in addition to SPEKE and DH-EKE A password protocol should have the following properties: 1. It should identify both parties to each other, that is to say, be secure against replay and man in the middle attacks, in particular, strong against phishing.. It should be secure against replay and dictionary attacks by an evesdropper or man-in-the-middle. Such an attacker should be able to no better than someone who just tries repeatedly to log on to the server with a guessed password 2. It should be as strong as practical against offline attacks by the server itself. The server operators, or someone who has stolen information from them, should not know the users password, and dictionary attacks should be sufficiently expensive that a strong password (not your ordinary password) is secure. Can anyone suggest a well reviewed, unpatented, protocol that has the desired properties? --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG A8bCmCXDTAX2Syg907T7uRpajs77l9CqLEii+ezP 42zQDcP3xJXtcLPSgCVa55kew+ALkrQ/I50PFm9lC

2 1