- cypherpunks-legacy - lists.cpunks.org

RSA-160
by Jens Franke 01 Apr '03

01 Apr '03

We have factored RSA160 by gnfs. The prime factors are: p=45427892858481394071686190649738831\ 656137145778469793250959984709250004157335359 q=47388090603832016196633832303788951\ 973268922921040957944741354648812028493909367 The prime factors of p-1 are 2 37 41 43 61 541 13951723 7268655850686072522262146377121494569334513 and 104046987091804241291 . The prime factors of p+1 are 2^8 5 3 3 13 98104939 25019146414499357 3837489523921 and 128817892337379461014736577801538358843 . The prime factors of q-1 are 2 9973 165833 11356507337369007109137638293561 369456908150299181 and 3414553020359960488907 . The prime factors of q+1 are 2^3 3 3 13 82811 31715129 7996901997270235141 and 2410555174495514785843863322472689176530759197. The computations for the factorization of RSA160 took place at the Bundesamt f|r Sicherheit in der Informationstechnik (BSI) in Bonn. Lattice sieving took place between Dec. 20, 2002 and Jan. 6, 2003, using 32 R12000 and 72 Alpha EV67. The total yield of lattice sieving was 323778082. Uniqueness checks reduced the number of sieve reports to 289145711. After the filtering step, we obtained an almost square matrix of size with 5037191 columns. Block Lanczos for this matrix took 148 hours on 25 R12000 CPUs. The square root steps took an average of 1.5 hours on a 1.8 GHz P4 CPU, giving the factors of RSA160 after processing the 6-th lanczos solution. F. Bahr J. Franke T. Kleinjung M. Lochter M. Bvh

1 0

Re: art can make a difference, and traffic routing games
by Bill Stewart 31 Mar '03

31 Mar '03

At 09:42 AM 03/31/2003 -0800, Major Variola (ret) wrote: >PS Bill: How did management like the news >channels calling the Baghdad CO an "AT&T Building" :-) I didn't catch that one, but as the token phone company guy here, the fact that they started off Desert Scam by blowing up the phone company building with a cruise missile did piss me off... What our management _does_ need to clue into is the recent Michigan law banning VPNs/NAT/routers/etc. - the similar laws proposed in a number of other states only applied in cases of fraud or theft of service, but the Michigan one was badly worded.

1 0

GPS phones confiscated from reporters in Iraq
by R. A. Hettinga 31 Mar '03

31 Mar '03

http://www.newscientist.com/news/print.jsp?id=ns99993567 New Scientist GPS phones confiscated from reporters in Iraq 15:26 31 March 03 Will Knight Satellite phones with built-in Global Positioning System (GPS) capabilities have been confiscated from journalists travelling with US troops inside Iraq, due to fears that they could inadvertently reveal their positions. Reporters "embedded" with the troops have been asked to hand over satellite telephones operated by Thuraya Satellite Telecommunications, a communications company based in Abu Dhabi. The restriction is limited to units near the war's front-line and is expected to be temporary, a spokesman for US central command in Qatar told New Scientist . A spokeswoman for the US Department of Defense added that reporters with unaffected satellite phones would be asked to share them and that military communications equipment would be made available when possible. Replacement phones could also be sent to the front line. Richard Langley, a GPS expert at the University of New Brunswick, Canada, says US military commanders may be concerned that positioning information embedded in signals sent by the Thuraya phones could be intercepted and used by Iraqi forces to locate and attack US troops. "It's not impossible, although it would be rather difficult," Langley told New Scientist . "The signals are line-of-sight [from handset to satellite] so very little would leak out and be interceptable on the ground." Ground station intercept It would be easier to intercept the signal as it arrives from the satellite at the network operator's ground station, he says. But even in this case, any interceptor would still have to crack the encryption protecting the signal. An alternative concern is that the US military are worried that computers used to store call information are vulnerable to cyber attack. "Perhaps the concern was that there would be a log of these positions kept on a computer somewhere," Langley says. Positional information captured by any means would only be useful for as long as the caller remained in the same place, he notes: "Anyone wanting to use the information would have to work quickly." Thuraya telephones can connect to GSM mobile phone networks when they are available, and a satellite network when in more remote areas. The phones can also be used as a GPS receiver, determining its position by communicating with satellites in the GPS constellation. If the GPS functionality is switched on, the caller's co-ordinates are automatically embedded in the voice signal sent to the communications satellites. -- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Re: Brumley & Boneh timing attack on OpenSSL (fwd)
by Eugen Leitl 24 Mar '03

24 Mar '03

Some clarification by Peter Gutmann <pgut001(a)cs.auckland.ac.nz> on why cryptlib doesn't do timing attack resistance default: Peter Gutmann <pgut001(a)cs.auckland.ac.nz>: cryptlib was never intended to be a high-performance SSL server (the docs are fairly clear on this), and I don't think anyone is using it to replace Apache or IIS. OTOH it is used in a number of specialised environments such as closed environments, embedded systems and mainframes. For example two real-world uses of the cryptlib SSL server are in embedded environment A and mainframe environment B. In A, the processing is handled by a low-power embedded processor. It takes 10-15s to perform an SSL handshake, and that's after the code has been optimised to death to squeeze every possible bit of performance out of it. Performing the necessary 1.5M queries at 15s each would take approximately 8 1/2 months at 100% CPU load (meaning that the device is unable to perform any other operations in that entire time). This is unlikely to go unnoticed, given that it's polled from other devices for status updates. In B, CPU resources are so scarce that the implementation uses null cipher suites because it can't afford the overhead of even RC4 for encryption (admittedly this required a custom code hack, cryptlib doesn't normally support null encryption suites). After about 100 or so attempts at a full SSL handshake, klaxons would sound and blue-suited troops would deploy onto the raised flooring to determine where all the CPU time is going. In neither of these environments (and various similar ones) would a side- channel attack requiring 1M or so queries (e.g. this one, or the Bleichenbacher attack, or the Klima-Pokorny-Rosa attack, which cryptlib shouldn't be vulnerable to since I'm paranoid about error reporting) be terribly feasible. OTOH blinding does produce a noticeable slowdown for a process that's already regarded by its users as unacceptably slow and/or CPU-intensive (I have some users who've hacked the key-exchange process to use fixed shared keys because they just can't spare the CPU time to do a real handshake, e.g. by injecting the shared key into the SSL session cache so you just do a pseudo-resume for each new connection). For this reason, cryptlib makes the use of sidechannel- attack-protection an optional item, which must be selected by the user (via use of the blinding code, now admittedly I should probably make this a bit easier to do in future releases than having to hack the source :-). This is not to downplay the seriousness of the attack, merely to say that in some cases the slowdown/CPU consumption vs.attack risk doesn't make it worthwhile to defend against. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Re: Brumley & Boneh timing attack on OpenSSL (fwd)
by Bill Stewart 24 Mar '03

24 Mar '03

At 09:51 AM 03/22/2003 +0100, Eugen Leitl wrote: >Some clarification by Peter Gutmann <pgut001(a)cs.auckland.ac.nz> on why >cryptlib doesn't do timing attack resistance default: > >Peter Gutmann <pgut001(a)cs.auckland.ac.nz>: >cryptlib was never intended to be a high-performance SSL server (the docs are >fairly clear on this), and I don't think anyone is using it to replace Apache >or IIS. OTOH it is used in a number of specialised environments such as >closed ... > For this reason, cryptlib makes the use of sidechannel- >attack-protection an optional item, which must be selected by the user >(via use >of the blinding code, now admittedly I should probably make this a bit easier >to do in future releases than having to hack the source :-). This is not to >downplay the seriousness of the attack, merely to say that in some cases the >slowdown/CPU consumption vs.attack risk doesn't make it worthwhile to defend >against. If it's not meant to be a high-performance server, then slowing it down another 20% by doing RSA timing things is probably fine for most uses, and either using compiler flags or (better) friendlier options of some sort to turn off the timing resistance is probably the better choice. I'm not sure how flexible things need to be - real applications of the openssl code include non-server things like certificate generation, and probably some reasonable fraction of the RSA or DH calculations don't need to be timing-protected, but many of them are also things that aren't CPU-consumption-critical either. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Keysigning @ CFP2003
by Douglas F. Calvert 24 Mar '03

24 Mar '03

GPG/PGP Keysigning @ Computers, Freedom and Privacy 2003 April 2nd, 9:45pm (First BoF Session) I will be organizing a keysigning session for CFP2003. Please submit your keys to cfp-keys(a)anize.org and I will print out sheets with key information in order to speed up the process. Bring a photo ID and a copy of your key information so that you can verify what is on the printout. A list of submitted keys and a keyring will be available on: http://anize.org/cfp2003/ Thank you... -- + Douglas Calvert dfc(a)anize.org http://anize.org/dfc/ + | Key Id 0xC9541FB2 http://anize.org/dfc-keys.asc | | [X] User wants to receive encrypted mail | +| 0817 30D4 82B6 BB8D 5E66 06F6 B796 073D C954 1FB2 |+

1 0

Re: Spammers Would Be Made To Pay Under IBM Research Proposal
by Steve Schear 24 Mar '03

24 Mar '03

>Spammers Would Be Made To Pay Under IBM Research Proposal > >By Tony Kontzer, InformationWeek, InternetWeek >Mar 20, 2003 (8:45 PM) >URL: http://www.internetweek.com/story/showArticle.jhtml?articleID=7900141 > >Companies and consumers alike have been looking to two primary aids in the >battle to stem the flood of spam. On the practical side, they're turning >to a seemingly endless parade of filters and other software products >designed to slow the tide of unwanted E-mail by doing things such as >checking messages against known spam, using textual clues to glean whether >a message is spam, or blocking the IP addresses of known spammers. On the >more hopeful side, they're pressuring legislators for federal laws banning >spam. > >IBM researchers say both approaches miss the target--that the software >approach amounts to a constant game of trying to stay one step ahead of >spammers, while legislation, if and when it comes, won't be able to >address spam coming from outside U.S. borders. As a result, they've come >up with another approach: Make spammers pay to send messages. It sounds >absurdly simple, and Scott Fahlman, a research staff member at IBM's >Watson Research Center, says it is. Fahlman is trying to build momentum >behind a concept he's calling the "charity stamp" approach, which would >force anyone sending unsolicited messages to pay to reach recipients >participating in the program unless they had an authenticated code. >Of course none of this is news to many readers on this list. A number of >people in the crypto/cypherpunk community (e.g, Adam Back, Eric S. >Johansson and Ben Laurie) have worked for some time to develop the >mathematics and code to launch proof-of-concept e-stamp systems based on >either Proof-of-Work algorithims or real value. Recently Microsoft also >unveiled a similar project PennyBlack >http://research.microsoft.com/research/sv/PennyBlack/ steve --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Re: Brumley & Boneh timing attack on OpenSSL
by pgut001＠cs.auckland.ac.nz 24 Mar '03

24 Mar '03

Bill Stewart <bill.stewart(a)pobox.com> writes: >Schmoo Group response on cryptonomicon.net >http://www.cryptonomicon.net/modules.php?name=News&file=article&sid=263&mod… >Apparently OpenSSL has code to prevent the timing attack, >but it's often not compiled in (I'm not sure how much that's for >performance reasons as opposed to general ignorance?) I had blinding code included in my crypto code for about 3 years, when not a single person used it in all that time I removed it again (actually I think it's probably still there, but disconnected). I'm leaning strongly towards "general ignorance" here... Peter. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

(no subject)
by rick 18 Mar '03

18 Mar '03

http://www.outwar.com/page.php?x=513854 CRACK HERE

1 0

Journalists, Diplomats, Others Urged to Evacuate City
by Tim May 18 Mar '03

18 Mar '03

Journalists, diplomats, inspectors, and civil servants are being urged to evacuate the capital. A timetable of 48 hours has been given. "The Evil Doers will be rooted out and the Evil Ones punished," said one spokesman. However, as of midnight, Eastern Standard Time, there is no evidence that Washington residents are taking these warnings seriously. Needless to say, this is not a threat. I am 3000 miles away, relatively safe on my hilltop. Being the survivalist that I have been for much of the past 30 years, I have a pantry closet filled with canned goods, rice, cereal. And I have a generator, which I expect not to use much. And solar battery rechargers (sufficient to recharge AAs and Ds for my various small radios, even recharge my laptop...this in case my 24-packs of AAs and Ds run out, or my several lead cell battery packs, etc.). And I have my perimeter alarms, my solar-powered intrusion alarms, my rifles, my handguns, my shotguns, my other weapons, my water filters, my colleagues. I don't expect to need this stuff, but I am, as always, happy to be able to just stay at home on my hill and watch the chaos unfold. About the threat to Washington: I think it's relatively high. A nerve gas attack on buildings or the Metro seems likely. (The Japanese AUM cult had Sarin, but was inept. A more capable, military-trained operative has had many months to get into D.C. and wait for the obvious time to attack. And he need not even be a suicide bomber. A cannister of VX with a reliable timer is child's play. If I were Declan, I'd get out of Dodge. --Tim May

1 0