- cypherpunks-legacy - lists.cpunks.org

No Subject
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

Yes, Netscape caches passwords. --- begin forwarded text From: support(a)sfnb.com Date: Fri, 29 Mar 96 17:27:02 -0500 Sender: <support(a)sfnb.com> Apparently-To: bankusers(a)sfnb.com Dear Security First customer: With the release of Netscape Navigator 2.0, Netscape enhanced their caching mechanism to improve the browser's performance. As a result of this enhancement, the Navigator was storing Security First username and password information when entered in cleartext on a customer's local hard drive in a file called fat.db. Therefore, if a knowledgeable and malicious person had access to a Security First customer's computer, they could have potentially stolen that customer's username and password. To our knowledge, this vulnerability was NOT exploited by anyone. We were made aware of this fact in an e-mail to the bank from Lucky Green, a frequent contributor to the cypherpunks mailing list. Immediately upon learning of this situation, Five Paces engineers worked closely with Netscape engineers and fixed the problem. To prevent caching of the username and password, we changed the login script to include "pragma: no-cache" in the http header. This command instructs the browser not to cache any information from this page on the local hard drive. Please note this was not specific to Security First. Any Web site that requests a username and password in an onscreen form is potentially vulnerable to this cleartext caching if the "pragma: no-cache" header is not used. In order to ensure that your username and password have been cleared from your cache, bank customers should go to the Options dropdown menu in the Navigator, and select Network, then Cache, and then click on the "Clear Disk Cache Now" button. We know that software involving Internet commerce is changing at a rapid pace, and we will continue to monitor all changes that might affect our customers. We would like to thank Lucky and also Jeff Weinstein of Netscape for bringing this to our attention. The Internet community benefits when we all work together to make it a better network. If you have any questions, please do not hesitate to e-mail me at karlin(a)sfnb.com, or our customer service staff at support(a)sfnb.com. Sincerely, Michael Karlin President & COO Security First Network Bank ================================================================ Michael S. Karlin Security First Network Bank 2957 Clairmont Road 404.679.3201 Suite 280 404.679.3210 Fax Atlanta, GA 30329 karlin(a)sfnb.com --- end forwarded text -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

3 2

[ITAR/POLITICS] rsa-in-3-lines-of-perl just shrunk!!
by Adam Back 17 Dec '03

17 Dec '03

Sorry to contribute to the simply awesome noise to signal ratio here lately (hopefully the subject tag should help those not interested in politics), but... [if you don't know what I'm talking about, see http://www.dcs.ex.ac.uk/~aba/rsa/ for a combined perl hack and ITAR violation] Due mainly to a couple of insights donated by someone who was introduced to the code via a friends `munition' T-shirt... he started the ball rolling again... it shrunk from: #!/bin/perl -s-- -export-a-crypto-system-sig -RSA-3-lines-PERL $m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2%Sa 2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*',$_)while read(STDIN,$m,($w=2*$d-1+length($n)&~1)/2) to: #!/bin/perl -sp0777i<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<j]dsj $/=unpack('H*',$_);$_=`echo 16dio\U$k"SK$/SM$n\EsN0p[lN*1 lK[d2%Sa2/d0$^Ixp"|dc`;s/\W//g;$_=pack('H*',/((..)*)$/) (Actually it's not quite as impressive as it might look at first glance because the old version included the comment "-export-a- crypto-system-sig -RSA-3-lines-PERL", so the new one should really be compared against: #!/bin/perl -s $m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2%Sa 2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*',$_)while read(STDIN,$m,($w=2*$d-1+length($n)&~1)/2) ) but it's still a whole 31 bytes shorter, and it now really is in 3 lines of perl rather than cheating and not counting the #!/bin/perl line. (Several people took me to task on that one). I won't consume list bandwidth describing exactly how the new one works, and the arcane perl and dc hackery that went into it, as I have described it all in excruciating detail on: http://www.dcs.ex.ac.uk/~aba/rsa/story.html I really wasn't expecting to see it shortened any further. There goes all those T-shirts, outdated, my sincere apologies to Richard White also, whose tattoo was featured in the April issue of Wired (at least the UK edition, the US one too?), Oh yeah, and if you can see any ways to shorten it, please tell me! (Perl5 specifics not allowed, there is already a shorter p5 specific version but it's got to be as portable as possible). Adam ps I now have a reasonable stock of T-shirts again after the prolonged hiatus of my printer, who finally delivered the 2nd batch. -- #!/bin/perl -sp0777i<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<j]dsj $/=unpack('H*',$_);$_=`echo 16dio\U$k"SK$/SM$n\EsN0p[lN*1 lK[d2%Sa2/d0$^Ixp"|dc`;s/\W//g;$_=pack('H*',/((..)*)$/)

1 0

Re: Witch Hunts
by tcmay＠got.net 17 Dec '03

17 Dec '03

Bruce Zambini wrote: >It is also worth noting that the original Detweiller, in a sense, played >De Sade to Tim May's Rousseau, in that he used an unorthodox, but >effective, critical technique. (This is, in fact, one reading of De I don't buy this. If you consult the archives, circa the fall of 1993, you'll find that while Detweiler/S.Boxx/etc. repeatedly begged me to engage him in debate, I declined. So, what was the "effective" part? I thought his insults, rants, forgeries, screams, shouts, and general gibbering detracted from his real points, such as they were. I'm beginning to think there must be a personality type or behavioral pattern at work here. Others in recent months have also had their ideas buried in a stream of insults, rants, and CAPITAL LETTERS! The pattern seems to be the same, though I doubt any of them are Detweiler. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: SQUID's (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > > > Apparently you are grossly unfamiliar with the > > characteristics and capabilities of SQUID's. To help you > > catch up... > > Actually, I am quite familiar with Superconducting Quantum > Interference Devices and the one existing commercial application > of the technology, a magnetometer probe containing a liquid > nitrogen cooled SQUID chip at its tip. There are several commercial probes available, not a single source as you claim. The Air Force has used them in experimental fighter programs for several years allowing hands-off flying (in a simulator) with quite good results. Quite a few neurophysiologists use them along with NMR to map the neuronal activity of the human brain on a neuron by neuron basis. The folks who make the various flavors of super-conducting wire use them to test for imperfections in the product. I sugest that your familiarity with the SQUID technology might be a little dated. Take the time to contact Conductus. > > [Biography of Mr. Squid deleted] > > I will still laugh at suggestions that Mr. Squid can remotely > read the EEPROM in my smart card, however. I didn't make that assertion. I clearly offered it as a source of education and entertainment. I even went so far as to specificaly predicate my recital with this caveat. While Mr. SQUID might be able to do it, the other commercial probes out there would have no problem from reading your smart card on a transistor by transistor state if that is what were required.

1 0

Re: [NOISE] Cable-TV-Piracy-Punks (fwd)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:54 PM 3/31/96, Jim Choate wrote: >Forwarded message: > >> > Presumedly the state of the EEPROM cannot be deduced by any >> > external examination of the card, and any attempt to >> > incrementally abrade the card down to the relevent circuit >> > elements should completely obliterate the minute charge >> > differences which represent the data. >> >> They aren't immune to the laws of physics. If it can be put together, >> it can be taken apart. I can even surmise HOW it can be taken apart. > >You wouldn't even have to take it apart. Just subject it to analysis using >SQUID's. Using this technology you would not even have to physicaly touch >the card, let alone remove any parts of it. Well, I worked on SQUIDs (Superconducting quantum-interferometric devices) in 1972-3, and also worked on electron-beam analysis of microprocessors and memory device in 1980-84, and I can assure you that SQUIDs cannot do what you want them to do. I'll be happy to supply additional details if there's sufficient interest. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: [NOISE] Nasty-Quibble-Punks
by jim bell 17 Dec '03

17 Dec '03

At 04:06 PM 3/31/96 -0800, Mike Duvos wrote: >"Perry E. Metzger" <perry(a)piermont.com> writes: >Uh huh. > > > Incidently, EEPROMs don't work by simply charging a > > capacitor or something silly like that. No insulator is > > perfect, no dielectric is perfect, and charge would > > eventually leak away were that the case. However, if it > > were, it would be fairly easy to determine the state of a > > cell without having to get particularly close to it. Beyond > > that, there is this insane notion you seem to have that a > > charged object will lose its charge if the "insulator" is > > "stripped off" -- I wasn't under the impression a vacuum, > > for instance, was a particularly good charge carrier. > >Uh huh. Turns out Perry is wrong about this. I believe that UV EPROMs and probably EEPROMs do indeed work by storing charge on a buried, totally-isolated capacitor. The capacitor is charged with a system called "Fowler-Nordheim tunneling," which involves placing a relatively high voltage on a nearby electrode and causing the thin interface to temporarily conduct. (It's odd. That's why it's called "tunnelling.") The charge, surprisingly enough, is stable for years, in fact decades, and probably (statistically) centuries at room temperature. The reason the charge stays around so long is that the insulator, silicon dioxide, is extremely good. It has to be. If the capacitor were, say, 1 picofarad, and the resistance was 10E18 ohms (a billion gigohms) the resulting time constant would be 1E6 seconds, or about 12 days. Since EPROMs obviously hold data far longer than this (well over 100 times longer, or else our computers wouldn't work!), and since the capacitance is probably not nearly 1 pf, that tells you that the effective resistance is far above 1E20 ohms. UVEPROMS are erased, naturally enough, by exposing them to UV light, which is usually produced by a mercury vapor lamp. This UV causes enough electrons to be excited into upper electron shells in the insulator to temporarily turn it into a slight conductor, and the charge dissipates. I think EEPROMs are erased by, more or less, reversing the voltage on the charging electrode. As for keeping the charge when that insulator is stripped off, that would be a problem. It isn't that a vacuum isn't a good enough insulator; it is, but it would be hard to imagine a technique to strip off an SiO2 insulator that doesn't also allow a substantial amount of charge to flow. You could strip it off with HF (hydrofluoric acid) but that's electrically conductive. Even a gas-phase process would probably result in enough conductive products to discharge the capacitor. Ion-beam milling would also remove SiO2, but as the name implies that's applying a current to the system. Fortunately, all this is moot: Since the floating gate is inherently part of a transistor, it isn't necessary to expose it to detect its charge state: Just activate the transistor in-circuit BTW, some PLD's have a so-called "security bit" which (when set) is designed to prevent reading of the state of the rest of the programmed bits. Years ago it occurred to me that if you knew where this particular bit was stored, you could expose this bit location alone to a UV source through a tiny mask to discharge it. Finding that location wouldn't be all that hard: Just expose the chip with a series of exposures, moving a linear mask slightly, and eventually the security bit will erase. Note the location of the mask, and rotate the mask 90 degrees and repeat the process. At that point, you've located the bit (this may require a few iterations), so you expose the target part through a tiny pinhole (Edmund Scientific sells them in many different sizes, exposing only that security bit location. Jim "Mr. Bell talks about one field" Bell (Let's see, I covered solid, liquid, and vapor phase chemistry, a bit of particle physics (ion-beam milling), semiconductor physics, minor optics, electronics, some trivial math, and maybe even some detective work!) jimbell(a)pacifier.com

2 1

NYT on CFP
by John Young 17 Dec '03

17 Dec '03

The New York Times, April 1, 1996, p. A14. Pioneers of Cyberspace Move Into Wider Arena By Peter H. Lewis Cambridge, Mass., March 30 -- Cyberspace is dead, many of its electronic pioneers said at a conference here this week. As the Internet population has grown into the millions, what was once a small, self-regulating society of academics and computer wizards has been engulfed by mainstream culture. But in their efforts to preserve the libertarian spirit of the electronic frontier, the original members of the cyberspace community have emerged as a political and social force. "Last year, it was still possible for people to say cyberspace is a different place, subject to different laws and different rules and that there is a Net culture," said Hal Abelson, a professor of computer science and engineering at the Massachusetts Institute of Technology here. "Now you have such a large percentage of the population on the Net, it just is not sensible to talk about this as some other place anymore. What you are really talking about now is the communications fabric of the country." In what was seen as a clear sign of Internet users new power, several members of Congress announced, by telephone and through the Internet, new legislation and initiatives at the gathering here, the annual Computers, Freedom and Privacy Conference. The proposals include the formation of an Internet Caucus in Congress and a Senate blll to relax the Government's laws restricting the transmission of secrets over the global information network. "Washington is coming to thls conference in droves," said Daniel J. Weltzner, deputy dlrector of the Center for Democracy and Technology, one of several public-interest groups that seek to influence Government policy related to cyberspace, "and I think it's very exciting and promising. It's the coming of age of this community." The members of Congress were wooing more than 500 of the Internet's most prominent champions, who had gathered to discuss issues that were once esoteric but are now affecting millions of people worldwide: questions of privacy, electronic copyrights, computer crime, the nature of free speech, digital pornography, electronic cash and grassroots electronic democracy. The Computers, Freedom and Privacy crowd included its usual assortment of computer hackers, academics and self- described crypto-anarchists, and even one man wearing video goggles with an antenna apparently sprouting from his head. But it also included others who wanted to assess the fusion of cyberspace and real space: Federal judges, lawmakers, White House policy experts, corporate executives and law-enforcement agents. Senator Conrad Burns, a Republican from the real frontier state of Montana, chose the conference to announce, by telephone, new legislation that would remove nearly all current Government restrictions on the export of mass-market encryption software, which is used to send secret messages over computer and telephone networks. Senator Burns's legislation would also block the Administration from imposing as a Government standard any form of data encryption that would give law-enforcement agencies the ability to decode messages. The Senator's bill places him squarely at odds with the Clinton Administration and the Justice Department. But Mr. Burns said the use of robust data encryption would foster the rise of electronic commerce, distance education and digital communicatlons, which his large, rural state desperately needs in the 21st century. While the bill might have little chance of passage this year, conference participants were heartened by what appears to be growing support in Congress for a relaxation of the Government's cryptography policy. The proposal drew some opposition. "I think we'll regret it down the road," said Dorothy E. Denning, a professor of computer sciences at Georgetown University and a computer security consultant to the military. Dr. Denning and others have argued that the use of unrestricted encryption would thwart the ability of law-enforcement and intelligence agencies to conduct wiretaps on messages sent by foreign spies, terrorists, child pornographers and other criminals. On Friday, a bipartisan group of wired lawmakers addressed the conference by telephone and Internet to announce the formation of a Congressional Internet Caucus. Fewer than half of all members of Congress are now on line. Representative Rick White, Republican of Washington, said, "The idea behind the Internet Caucus is to do two things: increase members understanding of the Internet and get more members on-line so that people can contact their elected representatives on the Internet." [End]

1 0

Cylink gives away encryption kit
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

Cylink to offer free SDK for embedding encryption security By Jessica Davis InfoWorld Electric Posted at 1:21 PM PT, Mar 29, 1996 Lobbing the latest bomb in a patent war over public key/private key encryption technology, Cylink Corp. will offer a Software Developers Kit (SDK) free-of-charge so that software companies can embed security and encryption technologies in their products. Cylink's move to offer Passport Gold for free follows a failed attempt in federal court to stop another company, RSA Data Security Inc., from selling a similar kit allegedly based on Cylink patents. The two companies have been engaged in a public relations feud, as well as a federal court patent dispute and IS mind share war over public key/private key/certificate authority encryption technology. Cylink lost the latest round in federal court in early March. Cylink and RSA both participated in the creation of public key/private key technologies through their partnership, Public Key Partners. PKP was formed in 1990 to establish security standards to license to software vendors. The partnership fell apart over the patent dispute. Cylink's PassportGold modules and APIs allow software developers to enable their applications to access national certificate authority electronic commerce and correspondence services that are planned by the U.S. Postal Service's ECS system and other commercial certificate authority facilities. Cylink expects its revenue stream to come from a series of products, existing and planned, that enhance the speed and effectiveness of such encryption technologies. Cylink has also announced SecureFrame, one of those products that provides a high-speed data encryption and security system for frame relay-based Wide Area Network environments. Working in conjunction with any public or private frame relay network, Secure Frame dynamically encrypts data while authenticating its source and destination, delivering throughput of up to 2.048 Mbps. SecureFrame is priced at $5,995 and will ship in April. Cylink also introduced SecureNode, an SNMP and TCP/IP-based data security hardware and software card for secure end-to-end data transfer and communication. The PC card is available now and provides network independent security management at the desktop level without hitting users with crippled CPU performance by acting as an "encryption and authentication accelerator." SecureNode cards for ISA or for PCI are priced at $595 and $695 respectively. The standalone software product is priced at $199. Sunnyvale, Calif.-based Cylink can be reached at (800) 533-3958 or http://www.cylink.com/. Please direct your comments to InfoWorld Electric News Editor Dana Gardner. Copyright © 1996 InfoWorld Publishing Company

1 0

gnutar + pgp filter mode
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The gnu tar archiver allows to use an arbitrary compression program (option --use-compress-program=PROG). This works well with pgp if a small wrapper is used: #!/bin/csh -fb if ("$1" == "-d") then exec pgp -d -f else exec pgp -e -f endif The only problem is that this doesn't work well for larger amounts of data, because pgp reads in all data before starting with its work. Perhaps a future release of pgp will have a real filter mode. Hadmut BTW: Does this "crypto-hook" cause export restrictions to apply on gtar ? -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMV/0tmc1jG5vDiNxAQFtAAP/TMuYeYf5q7k1Y8DrBjb6XFKYYFANH3RH FvThWq1BUgI+unH97EZkNkCzZJYT5qmLGk3+JLufCAw/o9YR7jKcldm2LNYJ96t2 BDcSGDF3qx/IUzQBa5NV+gUerNRVSwA3LzkTbXufOxYH0cB3KNcsx3B0bE1rEDa/ GCcJ1L6T+2s= =FMiZ -----END PGP SIGNATURE-----

2 1

PsychicCash IPO
by M. Thomlinson 17 Dec '03

17 Dec '03

PsychicCash(TM) Announces Initial Public Offering PsychicCash, a leading developer of electronic commerce systems, today announced that it will sell 4.5 Million shares of common stock at a price of $25 a share. "This IPO will make me very rich" said co-founder Dan Thompson, "but of course you already knew that." PsychicCash pushes secure, thought-driven commerce into the modern world. PsychicCash is the holder of a number of crucial psychic commerce patents, including those on psychic blinding, psychic key-exchange, and psychic anonymity. The PsychicCash technology is based on the idea that there is no need for paper bills or plastic cards. Instead, a user simply thinks to exchange money. PsychicCash requires no hardware, and little knowledge of cryptography, however, it does require doing 1024-bit modular exponentiation in your head. "This is the logical progression of things," said PsychicCash supporter Dionne Warwick. "The use of PsychicCash(TM) to secure transactions should completely remove consumers' concerns about the safety of psychic commerce." Through the use of their patented technology, PsychicCash allows users to transmit value to any vendor, in any denomination, in any currency. With a future release of the protocol, a few additional multiplications will allow PsychicCash users to anonymize either party. The release is currently on hold due to problems in accidentally revealing (thinking) blinding factors. "Psychic debit" technology allows secure transmission of value across time as well as space. That is, one can deduct amounts from payee's bank accounts before the idea to purchase has even been conceived. (A similar use of this technique overcomes prior art claims on PsychicCash patents by shifting the date of filing back as far as needed.) As with all cryptographic solutions, PsychicCash must first get export approval from the US government for each of its' products. However, an ingenious system, called telepathic key escrow (TKE), should allow the company expedited commodities jurisdiction approval. Using TKE, a user simply thinks his key to the National TKE Center, which will then allow access to the key only with a court order. Whether or not other countries will allow the NTKEC to escrow their citizens' keys is still unclear. For more information: Tel: 206-936-0123 Within the US and Canada, phone: 1-212-888-8879 fax: 1-212-935-3882 e-mail: sales(a)psychiccash.mil for customer and technical support: think Matt Thomlinson University of Washington, Seattle, Washington. Check my home page -- http://weber.u.washington.edu/~phantom

1 0