- cypherpunks-legacy - lists.cpunks.org

Brumley & Boneh timing attack on OpenSSL
by Bill Stewart 14 Mar '03

14 Mar '03

From Slashdot: http://slashdot.org/article.pl?sid=03/03/14/0012214&mode=thread&tid=172 David Brumley and Dan Boneh write: "Timing attacks are usually used to attack weak computing devices such as smartcards. We show that timing attacks apply to general software systems. Specifically, we devise a timing attack against OpenSSL. Our experiments show that we can extract private keys from a OpenSSL-based server such as Apache with mod_SSL and stunnel running on a machine in the local network. Our results demonstrate that timing attacks against widely deployed network servers are practical. Subsequently, software should implement defenses against timing attacks. Our paper can be found at Stanford's Applied Crypto Group. http://crypto.stanford.edu/~dabo/abstracts/ssl-timing.html " Schmoo Group response on cryptonomicon.net http://www.cryptonomicon.net/modules.php?name=News&file=article&sid=263&mod… Apparently OpenSSL has code to prevent the timing attack, but it's often not compiled in (I'm not sure how much that's for performance reasons as opposed to general ignorance?) They also comment (as did somebody on Slashdot) that "this is distinct from the timing attack described in the paper by Canvel, Hiltgen, Vaudenay, and Vuagnoux last month." That one's an implementation problem and hard to exploit. http://lasecwww.epfl.ch/memo_ssl.shtml http://slashdot.org/article.pl?sid=03/02/20/1956229 --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Re: Brinwear at Benetton.
by Neil Johnson 13 Mar '03

13 Mar '03

RFID technology for libraries ... http://www.demco.com/CGI-BIN/LANSAWEB?PROCFUN+LWDCWEB+LWDC025+PRD+ENG+FUNCP… So the man can now know what books you taking on the flight (Hopefully not the flight training manual for the aircraft). -- Neil Johnson http://www.njohnsn.com PGP key available on request.

1 0

2nd announcement for ECC 2003
by R. A. Hettinga 12 Mar '03

12 Mar '03

--- begin forwarded text

1 0

Groove shills for the DoD: Kapor quits board
by Steve Schear 11 Mar '03

11 Mar '03

Software Pioneer Quits Board of Groove By JOHN MARKOFF SAN FRANCISCO, March 10 Mitchell D. Kapor, a personal computer industry software pioneer and a civil liberties activist, has resigned from the board of Groove Networks after learning that the company's software was being used by the Pentagon as part of its development of a domestic surveillance system. http://www.nytimes.com/2003/03/11/business/11PRIV.html --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

New release of Invisible IRC available
by Steve Schear 11 Mar '03

11 Mar '03

IIP 1.1.0 (stable) is released. (2003-03-10) Invisible IRC Project is a three-tier, peer distributed network designed to be a secure and private transport medium for high speed, low volume, dynamic content. Features: * Perfect Forward Security using Diffie-Hellman Key Exchange Protocol * Constant session key rotation * 128 bit Blowfish node-to-node encryption * 160 bit Blowfish end-to-end encryption * Chaffed traffic to thwart traffic analysis * Secure dynamic routing using cryptographically signed namespaces for node identification * Node level flood control * Seamless use of standard IRC clients * Gui interface * Peer distributed topology for protecting the identity of users * Completely modular in design, all protocols are plug-in capable The IIP software is released under the GPL license and is available for Windows 98/ME/NT/2000/XP, *nix/BSD and Mac OSX. http://invisiblenet.net/ --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Re: Wiretap Act Does Not Cover Message 'in Storage' For Short Period (was Re: BNA's Internet Law News (ILN) - 2/27/03)
by R. A. Hettinga 05 Mar '03

05 Mar '03

--- begin forwarded text

3 2

Re: Roger Needham Died - from The Register
by Matt Blaze 05 Mar '03

05 Mar '03

Sad, sad news. Roger's pioneering contributions to our art speak (volumes) for themselves, and our field is diminished by the loss of his future insights. But I will miss him most for his enormous generosity, his sharp wit, and his personal integrity. -matt > -------------------- > Obit: Roger Needham > By Guy Kewney, Newswireless.net > Posted: 02/03/2003 at 12:13 GMT > > Sadly, we record the death of Roger Needham, computer pioneer... > > There isn't much more to say, except that the man who was the reason > Microsoft set up its research centre in Cambridge, England, has had to lay > down his life's work. Cancer ended a legend. > > He once told me that it was his idea that Microsoft stopped spending money > on patenting its research ideas, and instead, to make the results available > to other researchers. I wish I'd known him long enough to have some other > stories to pass on myself; he left a long legacy of people who attributed > their inspiration to having worked with him. > > Here's what his CV at Microsoft Research says: > > Roger M Needham, born 1935, was in computing at Cambridge since 1956. His > 1961 PhD thesis was on the application of digital computers to problems of > classification and grouping. In 1962 he joined the Computer Laboratory, > then called the Mathematical Laboratory, and has been on the faculty since > 1963. He took a leading role in Cambridge projects in operating systems, > time sharing systems, memory protection, local area networks, and > distributed systems over the next twenty years. > > Roger worked at intervals on a variety of topics in security, (his main > research interest while with Microsoft) being particularly known for work > with Schroeder on authentication protocols (1978) and with Burrows and > Abadi on formalism for reasoning about them (1989). > > Roger graduated from the University of Cambridge in Mathematics and > Philosophy in 1956, and then took the Diploma in Numerical Analysis and > Automatic Computing in 1957. He had been in computing at Cambridge ever > since. He succeeded Maurice Wilkes as Head of the Computer Laboratory from > 1980 to 1995, was promoted Professor in 1981, elected to the Royal Society > in 1985 and the Royal Academy of Engineering in 1993. He was appointed > Pro-Vice-Chancellor in 1996. > > I only met him a couple of times, both times when Microsoft was doing > corporate hospitality to publicise the work it was doing in the Cambridge > research facility. He was as knowledgeable as any rumour could have > suggested; and as tolerant of an ignorant journalist as any academic could > ever be. And I shall never get to know him, now. > > Guy Kewney is the editor/publisher of Newswireless.Net > > ----------------------------------------------- > > > --------------------------------------------------------------------- > The Cryptography Mailing List > Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Re: Rogue Vally Cypherpunks Physical Meeting Mar 13
by Major Variola (ret) 04 Mar '03

04 Mar '03

At 08:55 AM 3/4/03 -0800, cypherpunk-vin(a)vmeng.com wrote: >What are Cypherpunks? A group of thinkers, programmers and >researchers dedicated to preserve everyone's freedom of speech >through action. > * believers in crypto-anarchy, > * leaning towards libertarianism, > * most importantly, cypherpunks write code! To pick a nit, and clarify something for lurkers, feds, reporters, grand juries and the like: IMHO "believers in crypto anarchy" sounds like a religion. The phrase even parses ambiguously, which may be a feature to the already clued but isn't to those trying to suss you out. I'm not a "believer" but an observer and analyzer. And BTW I don't like all the effects of crypto tech but I have been forced to recognize and consider some of them on this list. "Students of cryptos effect on society" might work. I'm not sure how to fit "anarchy" into there without starting to sound like a rant. "Crypto" might even be too specific as things like interception technology and commerce-systems are also of interest. "Students of crypto's anarchy-tending effect.."? But when some tech is convincingly shown to be anarchy-minimizing or fascist-promoting, I think the rational CP does not lose interest. Drop the "anarchy"; "effects on society" should be enough. Just my $.02. Its your shindig.

1 0

Re: CAPSII protest...
by Michael Motyka 04 Mar '03

04 Mar '03

Yes Tyler, there is something nasty you can do that will not get you nabbed. It requires the following equipment : airline ticket ( aisle seat ) large pizza with the works quart of yogurt one dozen raw oysters one package of M&Ms ipecac syrup ( or a wafer-thin mint ) Just imagine the effect if almost every flight had one (:or more:) passengers barfing buckets of primordial goo soon after takeoff. Works just as well for trains and buses. It requires massive participation and a large, but not necessarily strong, stomach. I think it expresses quite well how recent events affect us all. This may be a new form of civil disobedience. I hereby place it in the public domain for the benfit of all mankind. I wonder if there's a lab test for ipecac? (: --

1 0

Roger Needham Died - from The Register
by Bill Stewart 02 Mar '03

02 Mar '03

-------------------- Obit: Roger Needham By Guy Kewney, Newswireless.net Posted: 02/03/2003 at 12:13 GMT Sadly, we record the death of Roger Needham, computer pioneer... There isn't much more to say, except that the man who was the reason Microsoft set up its research centre in Cambridge, England, has had to lay down his life's work. Cancer ended a legend. He once told me that it was his idea that Microsoft stopped spending money on patenting its research ideas, and instead, to make the results available to other researchers. I wish I'd known him long enough to have some other stories to pass on myself; he left a long legacy of people who attributed their inspiration to having worked with him. Here's what his CV at Microsoft Research says: Roger M Needham, born 1935, was in computing at Cambridge since 1956. His 1961 PhD thesis was on the application of digital computers to problems of classification and grouping. In 1962 he joined the Computer Laboratory, then called the Mathematical Laboratory, and has been on the faculty since 1963. He took a leading role in Cambridge projects in operating systems, time sharing systems, memory protection, local area networks, and distributed systems over the next twenty years. Roger worked at intervals on a variety of topics in security, (his main research interest while with Microsoft) being particularly known for work with Schroeder on authentication protocols (1978) and with Burrows and Abadi on formalism for reasoning about them (1989). Roger graduated from the University of Cambridge in Mathematics and Philosophy in 1956, and then took the Diploma in Numerical Analysis and Automatic Computing in 1957. He had been in computing at Cambridge ever since. He succeeded Maurice Wilkes as Head of the Computer Laboratory from 1980 to 1995, was promoted Professor in 1981, elected to the Royal Society in 1985 and the Royal Academy of Engineering in 1993. He was appointed Pro-Vice-Chancellor in 1996. I only met him a couple of times, both times when Microsoft was doing corporate hospitality to publicise the work it was doing in the Cambridge research facility. He was as knowledgeable as any rumour could have suggested; and as tolerant of an ignorant journalist as any academic could ever be. And I shall never get to know him, now. Guy Kewney is the editor/publisher of Newswireless.Net ----------------------------------------------- --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0