- cypherpunks-legacy - lists.cpunks.org

Re: Security Flaw Is Discovered In Software Used in Shopping
by rah＠shipwright.com 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Wed, 20 Sep 1995 10:47:24 -0400 (EDT) From: Nathaniel Borenstein <nsb(a)nsb.fv.com> To: www-buyinfo(a)allegra.att.com Subject: Re: Security Flaw Is Discovered In Software Used in Shopping Without belaboring the point too much, I think there are a few conclusions that really ought to be drawn: -- The world has never seen unbreakable encryption software, and almost certainly never will. Nothing that human beings ever build is perfect. -- Any encryption-based scheme is only as strong as its weakest link. Generally, you don't know what the weakest link will turn out to be. -- Basing a global financial infrastructure on the unbreakability of a certain algorithm or program is at best imprudent. Bear in mind that people as well respected as Dr. Adelman -- the "A" in RSA -- are hard at work trying to figure out how, for example, to use massive parallelism to break the basic algorithms of public key cryptography. -- Keeping sensitive financial information completely off the net is always best, whether or not you are using encryption. For information on a safe, non-cryptographic alternative that has been fully operational for nearly a year, with over 30,000 paying customers, a growth rate featuring a six week doubling period, and NO break-ins to date, check out http://www.fv.com. -- Nathaniel -------- Nathaniel S. Borenstein <nsb(a)fv.com> | When privacy is outlawed, Chief Scientist, First Virtual Holdings | only outlaws will have privacy! FAQ & PGP key: nsb+faq(a)nsb.fv.com | SUPPORT THE ZIMMERMANN DEFENSE FUND! ---VIRTUAL YELLOW RIBBON-->> zldf(a)clark.net <http://www.netresponse.com/zldf> --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

4 4

drand48() bug
by Arve Kjoelen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- jws(a)neon.netscape.com writes: > Most of the unix machines do the same thing. On SGI machines > that have the hardware cycle counter, its value is used in place of the > srand48(usec), lrand48() sequence. BSDI the code used srandom and random. Kun Luo, one of our grad students here recently found a bug in Sun's implemen- tation of the drand48() function. We reported it to Sun, and they acknowledged the bug exists - it seemed to be the first time they had heard of it, though. The bug affects Sun's ANSI C compiler shipped with SPARCWorks3.0 and consists of the following: If you're compiling using the - -Xc flag (strict ANSI C, no SUN C compatibility extensions), the function drand48() is BROKEN. It ALWAYS returns the number 9.000000, no matter what you seeded it with using srand48(). to reproduce, compile the following program under Solaris 2.x using their C compiler AND the -Xc flag: #include <stdio.h> #include <stdlib.h> #include <sys/types.h> #include <time.h> void main(){ double number; int num = 1000; srand48((int)time(NULL)); while(num --){ number = drand48(); printf("%lf\n", number); } } By the way, Cyphepunks mail seems to indicate that Netscape uses lrand48() instead of drand48(). lrand48() is NOT broken. The potential for disaster is high, though, for anyone blindly trusting vendor-provided pseudo- random number generators. How many products are out there using drand48() as part of their random number generation scheme? - -Arve - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzAvqdwAAAEEAKRdBFn7O/h+wz3tOQwHWvaFKS6gi+UezzCXli/QnuCrJcUE agvlVVZ/PzKG5i23VdbghyHsVElvKzRW/D1pYor6xSluCftXzSxbCuiEIe2SXUsH 65AqFN688upXzRKHcq3bU/eKB7xUOGqCDot8AzModnwE+XWCgdqn8CTZCNGhAAUR tCJBcnZlIEtqb2VsZW4gPGFram9lbGVAZWUuc2l1ZS5lZHU+ =csFb - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCUAwUBMGAusNqn8CTZCNGhAQEYdQP4+UGvLJKoQPWPLFMENDIPY1QSIuQdQxdt fTzWRNXsPadE4N40bHgucqZQG8Ze55JsKIrrhL9RZFIVx+ygxsmsSHsocu/kFbSW E7RNWMvoaoRAmB4KkWF+ofqRWl9Qo+r00CvgX1brsOdpjySVIkxml8/L7R/RBuQL aFNV5OBz2w== =saUT -----END PGP SIGNATURE-----

1 0

Munitions shirt (again)
by Ian Goldberg 17 Dec '03

17 Dec '03

So, Dave and I got free munitions shirts (they're different, though; the font is smaller and they have a bunch of X'd out Constitutional Amendments on the back; I think they ere designed by Joel Furr) for our bug find. So I'm wearing it today. The thing is, I live in International House, a residence that has 50% non-Americans. So, any consensus as to whether it's actually illegal to do so? I remember some disagreement a few weeks ago that AFAIK wasn't resolved. As far as I can tell, it's _technically_ illegal, but any LEO would be out of his mind to try to enforce it (it would have to be a Fed, too, wouldn't it? Or can regular city cops get you for violating export restrictions?). - Ian

3 2

Majordomo results
by Anonymous 17 Dec '03

17 Dec '03

>>>> who cypherpunks

1 0

Majordomo results
by Anonymous 17 Dec '03

17 Dec '03

>>>> who cypherpunks

1 0

Silly NetScape RND tricks...
by Deranged Mutant 17 Dec '03

17 Dec '03

I've only been skimming the NetScape-related posts lately, but I've yet to see anyone mention using a keyboard-timing sampler as a source for some random bits... I believe this is still a workable solution even in Windows, though probably not as 'precise' as if it were run from DOS. Any comments?

1 0

Re: Cybercensor in Singapore
by James A. Donald 17 Dec '03

17 Dec '03

At 06:15 PM 11/8/95 +0100, Anonymous wrote: > The Government has blunted an uncensored > Internet forum on Singapore political life by assembling > a group of users who make sure the Government's views are > represented. That is censorship? I visited the Singapore forum a few months ago -- When I visited Cuba (physically) everyone was visibly afraid. When I visited the Singapore electronically, they were not afraid. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: Please send me SSL problems...
by Rich Salz 17 Dec '03

17 Dec '03

> Jeff, the SSL specification has a severe *architectural* problem - it > assumes that Internet Protocols are APIs ... > The IETF quite explicitly doesn't care about APIs With one exception so important that it might blow away your whole complaint... ...GSSAPI. /r$

1 0

Re: NYT on Netscape Crack
by Rich Salz 17 Dec '03

17 Dec '03

> You could do that, but thats not how C does things. C allocates these > things on the stack. Nope. Just because almost all machines anyone is every going to use in their lifetimes are stack-based doesn't mean C is stack-based. The C compiler I once used on a LispMachine had no stack. /r$

2 1

No Subject
by thad＠hammerhead.com 17 Dec '03

17 Dec '03

I talked to somebody from RSA yesterday, and she said that they issued a press release yesterday that she expected to see in the papers today (I didn't see it) and would be on their web site "soon" that would explain their position. They say that the arbitration agreemment maintains the status quo pretty much, and while it doesn't limit what RSA can do, it severly limits what Cylink can do. I think that what RSA needs to do is hire Cylink's PR agency... thad -- Thaddeus Beier email: thad(a)hammerhead.com Technology Development vox: 408) 286-3376 Hammerhead Productions fax: 408) 292-8624

1 0