- cypherpunks-legacy - lists.cpunks.org

Re: 64 bit keys breakable by the NSA or just some random key length?
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <Pine.LNX.3.91.950819123758.27374A-100000(a)zifi.genetics.utah.edu>, zinc(a)zifi.genetics.utah.edu (zinc) wrote: >why did the govt pick 64 bits? is this length still within the range >of the NSA if they really wanted to read something but didn't feel the >need or want the exposure of obtaining a key from escrow? > >i'm curious if anyone thinks this gives us a little more info on the >capabilities of the NSA regarding brute forcing a key. additionally, >since this *is* an escrow system, why didn't the gov't just go with >the unbreakable 128 bit key length? I think the obvious conclusion would be because 64bits is crackable if need be and if you have the resources the goverment has. Not for routine monitoring of undesirables, but for those special cases where they don't want to expose their activities by requesting a warrant. - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMDY3jSoZzwIn1bdtAQGV3gGA26/BZOnXiuMuO8IDgGCnnONVhVtL4/o1 5HVVD3Mqfjp3Sr7QJMQMrfD4JRWRphTL =evHi -----END PGP SIGNATURE-----

1 0

Re: 64 bit keys breakable by the NSA or just some random key length?
by Chris Claborne 17 Dec '03

17 Dec '03

At 12:51 PM 8/19/95 -0600, zinc wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >cpunks, > >i was thinking about the recent Clinton/LEA proposal regarding exportable >crypto. the new rules would allow 64 bit keys to be exported, as long >as the master key was made available through some key escrow service. [good stuff deleted] >since this *is* an escrow system, why didn't the gov't just go with >the unbreakable 128 bit key length? This is the kicker! If what I heard is true, anyone can escrow the keys under this new plan. We know that the govt has no problem breaking it's one rules by saying the magic words "matter of national security", so why don't they require the keys be held by the govt? ... You know they can break it. ... I guess they assume the middle american will buy it! Just kills me. ... __o .. -\<, Chris.Claborne(a)SanDiegoCA.ATTGIS.Com ...(*)/(*). CI$: 76340.2422 http://bordeaux.sandiegoca.attgis.com/ PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server. PGP-encrypted e-mail welcome!

1 0

Re: Certificates/Anonymity/Policy/True Names
by Richard.Johnson＠Colorado.EDU 17 Dec '03

17 Dec '03

The certificate gets their messages into systems that demand a certification, whether for transport or display. >But this is precisely the issue: what does the *certificate* get any of >these people that a simple digital signature does not provide? > >On Sat, 19 Aug 1995, Rich Salz wrote: > >> I think there are many people who might be willing to use an >> "anon CA" should it exist: >> Whistleblowers, perhaps Deep Throat would have used email >> People writing letters to the editor who don't want to trust >> the editor to withhold their info >> People who desire anonymyity yet don't want to trust the gov't >> to certify their communications as authentic/forged >> (Unabomber, Om Shin-rkyo) >> Any number of writers who have used psuedonyms and now want to >> get paid in ecash; Mark Twain? >>

1 0

Re: Spooks and Hackers, etc.
by Alex de Joode 17 Dec '03

17 Dec '03

Brad Dolan sez: : ---------- Forwarded message ---------- : Subject: Internet Police : According to an AP story, Wisconsin Attorney General James Doyle says that : police must monitor the Internet to stop child porn, drug trafficking, and : fraud. : "We need to see that police are surfing the Internet just as other people : are," Doyle said. "This is a good example of where the law is slower than : technology." "Stop Wisconsin Internet Police" "Your'e speeding" "Get Lost" "Get Real" -- Alex de Joode Fear Uncertainty Confusion and Kaos, Inc.

1 0

Re: Economic Model for Key Cracking
by Bill Stewart 17 Dec '03

17 Dec '03

At 04:29 PM 8/18/95 -0600, howard(a)cs.ualberta.ca wrote: > Distribute work when a request is received. > When the final results come back, pay the worker e-cash. > >We need to make sure that someone did do the work honestly, but I don't know >how to check this (other than doing the work yourself to confirm the results, >but this defeats the whole point of the system). For the usual NP-hard problems, including keycracking, checking the answer once you have it is easy - the hard part is finding the answer. Another way to look at it is that most of the work is throwing away the 2**N-1 keys that aren't correct, and if you've got one correct key you don't need to know about the rest (except in special cases where there are multiple keys that work, but usually you don't care about that.) Most people are honest, except Bad Guys. The honesty problem is more serious for negative results - if somebody says "Range N1-N2 doesn't have the key", they could be honest, or they could be a Bad Guy who knows that the key really _is_ in that range and wants to prevent you from searching it, or they could be a scammer who wants to get paid for searching but didn't actually do the work. If people are willing to be paid in lottery-mode (only the person who finds they key gets paid), then honesty's not a problem. Otherwise, only hire honest people (plus Bad Guys), and if they don't find the key after the first sweep, try again (switching off ranges so one Bad Guy doesn't get to lie about the same range twice.) Alternatively, you could do a model where everybody gets paid, but only after the answer is found, which discourages scammers (since they don't get paid if they lie about searching the range that has the real key.) If a Bad Guy lies about the key not being in his range, people do have an incentive to look for it if the first pass fails, and have an incentive to finger him if they do find the key on a later pass. #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- "The fat man rocks out Hinges fall off Heaven's door "Come on in," says Bill" Wavy Gravy's haiku for Jerry

2 1

MSN hackers heaven (fwd)
by Brad Dolan 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Subject: The MSN is Hacker Heavan As most of us are aware, the commercial online services, such as AOL, Compuserve and Prodigy, represent certain risk to the unsophisticated user. Unfortunately, the Microsoft Network (MSN) raises the vulnerability of such users to unprecedented heights. Key to this vulnerability is the richness and complexity of the MSN/Windows 95 environment. What is most dangerous is the ability for the author of an e-mail or (certain) BBS documents to embed "objects" in that document. These objects can be readily disquised to appear totally benign to the casual user and be nothing more than MSN navigational aids. Once double-clicked by the recipient, these objects can readily infect the recipient's PC with a virus. Worse, what this object could do is only limited by one's imagination. It is worthwhile noting that MSN appears to be migrating to an open architecture, with the MSN user connecting through the Internet. If this is true, there is nothing which prevents an object, once activated, from transmitting information stored on the user's PC to any other location on the Internet. In theory, embedded objects can be interrogated to ensure their validity. Unfortunately, this interrogation process is not likely to be carried out by the average user. Even if it is, the user is not likely to understand what they are looking at. It is like warning automobile drivers to look under the hood of their car before starting it to make sure there is not a bomb inside. Most drivers would assume that the odds were with them. Those that did check would have no idea what they were looking at. (At least that's my feeling when I look under the hood of my car :-). Microsoft's position appears to be that the MSN user is no more vulnerable than one who uses a competing system. I would maintain that this position is just not true. With system complexity comes excessive vulnerability. MSN rates a 9 in complexity. The other services a 4. The bottom line: Users of MSN are placing themselves at significant risk. If one must use MSN, avoid at all cost activating (double-clicking) objects in e-mail messages and BBS posts. Sophisticated users may think they know what they are doing, but it probably won't be long before they are outwitted by someone who figures out how to totally disguise an object's true purpose.

1 0

MSN hackers heaven (fwd)
by John Young 17 Dec '03

17 Dec '03

This is a variation on Brad's forward of the MSN security hole: Information Week, August 28, 1995, p. 24. Risk Looms On Microsoft Network. E-mail icons can hide viruses. A feature designed to make electronic mail easy to use on the Microsoft Network online service may also make it easier for hackers to trick users into running destructive software programs on their PCs. When a Microsoft Network user sends a binary file embedded in an E-mail message, the file appears as an icon on the recipient's screen. The recipient can double-click on the icon to automatically download the embedded file and execute it. To download the file without executing it, the recipient must use the mouse's right button, which has been rarely needed until now. Though other online services offer automatic downloading of files, Microsoft's goes one step further in allowing the file's automatic execution. That file could be a virus or other malicious program that could erase files or reformat a hard disk, according to Mike Wyman, VP and chief technical offficer of Interactive Data Corp., an investment information firm in Lexington, Mass., and a Microsoft Network beta user. "On the Microsoft Network, I can disguise an icon so that it looks innocuous," says Wyman. "The analogy I like to use is the Unabomber. If you get a package in the mail that's wrapped in duct tape and brown paper, you'd regard it as suspicious. But if it's a plain white envelope with Ed McMahon's picture on it, you wouldn't think twice about opening it." Microsoft says the feature is a convenience, not a security hole. "There are risks of getting [data] off the network in any form," says George Meng, group product manager for the Microsoft Network in Redmond, Wash. "People have to be aware of what the source of information is." Winn Schwartau, president of Interpact Inc., a computer security consulting firm in Seminole, Fla., disagrees. "If the ability to execute programs bypasses conventional filtering and virus controls, then you certainly have a security hole," he says "Potential 'Trojan horse' programs could be sent by anyone." By Mitch Wagner and Clinton Wilder [End]

1 0

Re: Netscape to copyright URLs?
by Lindsay Haisley 17 Dec '03

17 Dec '03

At 02:39 AM 8/20/95 -0400, you wrote: >Today's surf of Netscape's home page yielded an interesting question. Is >Netscape trying to licence links to their products? To me >http://home.netscape.com/comprod/mirror/netscape_now_program.html seems to >suggest tha you can only display certain logos and info if you are >licensed by Netscape. You could for example not put up a link to their >"Download Netscape NOW" page without prior approval by Netscape. > >This seems to be a new development on the web. Since when does one need a >license to include certain URLs in one's home page? The Netscape general info document specifically states .... >Aside from the ftp mirrors we list on our home page, we do not allow >redistribution of our software. This means that it is not legal to put >our software on your ftp server, nor to include it on disks you are >distributing, although you're more than welcome to include a pointer to >our home pages so that people can download the latest version for >themselves. They have specifically given permission here for links, at least to their home pages, possibly even to other items such as a downloadable netscape. (______) Lindsay Haisley (oo) "The bull FMP Computer Services /------\/ stops here!" fmouse(a)fmp.com / | || Austin, Texas, USA * ||---|| (512) 259-1190 ~~ ~~

1 0

Re: Where is the key cracking farming software?
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

Dan Bailey <dan(a)milliways.org> writes on cpunks: > There must be several versions of the code at this point. The > Cypherpunks release, Damien's release and whoever else wrote some code > to do the chore. If someone could pass me a pointer to the version > that's best-commented and most understandable (one man's C is another > man's crypto) I'd like to port it to Windows NT and write a simple > installation to install it as a service. Yep there's lots of versions of the brutessl software, ones I know of (in no particular order): - Damien Doligez wrote one - Andrew Roos wrote on (this is the one we're using for the challenge) - Eric Young wrote one - I wrote one More related softwares, specifications etc. - Piete Brookes, Andy Brown, and I wrote a protocol specification for a SMTP style key doler - SKSP (Simple Key Search Protocol) - draft RFC like document on brute (www url below). - Piete wrote a unix socket based key server and client for generic unix machines (in perl). - Andy Brown wrote a Windows NT client which talks the same protocol - David Byers did a MasPar port of the brutessl code > Perhaps a general-purpose OO bruteforcing library (addition to > Crypto++?) would be a good idea. Just pass a pointers to the > encrypt() and decrypt() functions to use for this session to the > Cracker object, which in turn takes a number of bits and starts > cracking.:) The socket based key distributer allows you to write clients which interact with the key server. Take a look at Andy's code. > The problem with this is the disparity among out-of-the-box encrypt > and decrypt functions. But I suppose it's nothing that couldn't be > overcome with wrapper functions. Just thinking out loud. :) Not sure how Andy addresses this in the NT code (I don't have NT), but for the unix client you'd just get another brute force program, compile it and update the client. Piete has a WWW URL for the software (the protocol spec is there too) at: http://www.brute.cl.cam.ac.uk/brute/ (Brute is a subsubdomain he set up for the purpose). Also this: ftp://ftp.brute.cl.cam.ac.uk/pub/brute/ should work. And the socket server runs on: sksp.brute.cl.cam.ac.uk (port 19957). I think we're ready to start another challenge, this one a collaborative project like the brute rc4 one. Just need some challenges now (asked Hal about this). Adam

4 3

Legality of suverting computational cycles via Microsoft
by solman＠MIT.EDU 17 Dec '03

17 Dec '03

Does anybody here know if it is illegal to get unwiting users to download benign viruses via MSN? Doesn't this sort of hole, by its very nature, make it trivial for people to violate Europes future electronic privacy laws? (despite Microsoft's guarantee that MSN would follow those rules.) JWS

1 0