- cypherpunks-legacy - lists.cpunks.org

"patent free(?) anonymous credential system pre-print" - a simple attack and other problems
by Stefan Brands 05 Nov '02

05 Nov '02

The paper shows some promise but, apart from being insecure, has other drawbacks that should be addressed: - The system is subject to a simple attack. The problem lies with the multiplication of the hashes. Let's take the Chaum blinding as an example, something similar work for the "Laurie" protocol. The simple idea is to take X1 = [ \prod hash(bogus_att, salt_i) ] \times [hash(correct_att, salt)]^{-n/2} modulo pq X2 = X3 = ... = Xn = hash(correct_att, salt) Submit the blinded Xi's. Assuming X1 will not have to be opened (prob = 1/2 or 1, depending on whether or not protocol is interactive), one obains X1^d modulo pq from the signer, which contains consistently all the bogus attributes. Here is a suggestion for a "fix" to repair this total break. Make sure to that the signer, in additional to the consistency check for the opened blinded candidates, also checks that the opened blinded candidates have _different_ values. Of course, serious analysis needs to be done to ensure that this is enough to guarantee security. I do not have the time to look into this, but my gut feeling is that variations of the attack based on the same principle will still work, but with lower success probability; this will have to be compensated for by making n bigger, which makes the protocol even more inefficient. My advice is to the author is to analyze the proposed fix, and explore other possible fixes, before distributing an updated version. - My work certainly does provide for "revocable anonymity" and "pooling" prevention. For pooling protection, see paragraph 2 on page 193, section 5.11 page 210 paragraph 2, and section 5.5.2 on page 211. For not needing separate signing exponents for each attribute, see page 266 last paragraph on the page. For recovable anonymity, see the e-cash references on page 264/5. - The proposed hashing technique for selective disclosure was introduced by myself in 1999. Quoting from page 27 of my MIT Press book titled "Rethinking Public Key Infrastructures": "Another attempt to protect privacy is for the CA to digitally sign (salted) oneway hashes of attributes, instead of (the concatenation of) the attributes themselves. When transacting or communicating with a verifier, the certificate holder can selectively disclose only those attributes needed.22 {22 Lamport [244] proposed this hashing construct in the context of one-time signatures. When there are many attributes, they can be organized in a hash tree to improve efficiency, following Merkle [267].} This generalizes the dual signature technique applied in SET [257]." Since this technique is merely at the level of an observation, and because it is a simple generalization of the SET technique, I in fact decided at the time to put the entire paragraph under section header 1.2.2 of my book, titled "Previous privacy-protection efforts and their shortcomings". - More seriously, the simple hash technique has numerous drawbacks, as I explain on page page 27 of my MIT Press book, in the very same paragraph: "Although certificate holders now have some control over which attributes they reveal to verifiers, they are forced to leave behind digital signatures. Furthermore, they are seriously restricted in the properties they can demonstrate about their attributes; Boolean formulae, for instance, are out of the question. Worse, nothing prevents the CA and others from tracing and linking all the communications and transactions of each certificate holder." Other techniques, such as lending prevention and limited-show, do not work either. It was for these and other reasons that I was motivated to work on the more sophisticated selective disclosure in the first place. - In addition to various other drawbacks pointed out by of Dr. Adam Back (see www.mail-archive.com/cypherpunks-moderated@minder.net/msg02752.html) the proposal does not offer a wallet-with-observer mode, discarding protection, anonymous recertification / updating, multi-application certificates, etcetera. Hope this helps, Stefan Brands

1 0

Re: What email encryption is actually in use?
by David Howe 05 Nov '02

05 Nov '02

On Sun, Nov 03, 2002 at 11:23:36AM -0800, Tim May wrote: > - -- treat text as text, to be sent via whichever mail program one > uses, or whichever chatroom software (not that encrypted chat rooms > are likely...but who knows?), or whichever news reader software Hmm. I know of at least one irc server (and nntp server, as it happens, on the same box) that only allows access by ssh tunnel...

1 0

ScanMail Message: To Sender, virus found and action taken.
by System Attendant 05 Nov '02

05 Nov '02

ScanMail for Microsoft Exchange has blocked a file attachment(s). Place = garmstrong(a)carecredit.com Sender = cypherpunks Subject = If you would like to apply online from the Delivery Time = November 04, 2002 (Monday) 23:05:38 Action on file attachment(s): Message from recipient's administrator: Warning to sender. ScanMail detected a virus in an email attachment you sent.

1 0

Get paid for your opinions
by Earn 150 an hour 05 Nov '02

05 Nov '02

=============================================== ** Get Paid For Your Opinions! ** =============================================== ====> Earn up to $150 For an Hour of Work! http://www.ab4000.com/cgi-bin/redir.pl?rd_target=23&code=gpraz1104 <a href="http://www.ab4000.com/cgi-bin/redir.pl?rd_target=23&code=gpraz1104"> AOL Users Click Here</a> Find out how your ideas and insight can work for you! http://www.ab4000.com/cgi-bin/redir.pl?rd_target=23&code=gpraz1104 <a href="http://www.ab4000.com/cgi-bin/redir.pl?rd_target=23&code=gpraz1104"> AOL Users Click Here</a> Click Here Now! Start Earning Today! http://www.ab4000.com/cgi-bin/redir.pl?rd_target=23&code=gpraz1104 <a href="http://www.ab4000.com/cgi-bin/redir.pl?rd_target=23&code=gpraz1104"> AOL Users Click Here</a> ============================================= Now Showing: PickYourFlick! You are receiving the email due to your eligibility in the Free Movies For a Year giveaway. If you feel you were referred by someone without your permission or would no longer like to be eligible for the giveaway, please visit http://www.PickYourFlick.com to remove yourself from the giveaway and these mailings. c&y&p&h&e&r&p&u&n&k&s&%m&i&n&d&e&r&~n&e&t&

1 0

Cointel is back: meet any new arabic-speaking guys in shiny shoes?
by Nomen Nescio 04 Nov '02

04 Nov '02

mv(a)cdc.gov (Major Variola ret) writes: > http://www.washtimes.com/national/20021104-81830128.htm > Officials attempt to get inside cells of al Qaeda in U.S. > > By Richard Sale > UNITED PRESS INTERNATIONAL > > Local and federal law-enforcement agencies are attempting to > infiltrate al Qaeda sleeper cells operating in the United States > and are using disinformation campaigns to expose and neutralize the > terror groups that continue to communicate with one another, U.S. > intelligence officials say. FBI officials say recent electronic > intercepts of communications between some al Qaeda groups show that > they are "talking to each other." "The cells are up and active," an > FBI official said of the groups believed to be embedded in most U.S. > cities with sizable Islamic communities, such as New York, Detroit > and Los Angeles. In a review of ongoing U.S. operations, United Press > International was briefed on the al Qaeda investigations by several > current and former intelligence officers, all of whom asked not to > be identified by name. Former CIA and Defense Intelligence Agency > officials say the terrorists choose run-down neighborhoods because > "in a place like that, you are invisible. People don't care about > you; they don't want to look at you and don't look at you," as one > put it. A former senior U.S. intelligence official explained: "The > members of cells don't think of themselves as raiding parties but as > the front end of an invasion." "If they can attack, blow things up and > disrupt society, they believe there will be mass defections to Islam > and society will collapse. They can then set up an Islamic state." > The cells, these sources said, are made up of U.S.-born Muslims and > immigrants from Pakistan, Saudi Arabia and the Persian Gulf states, > and number in the thousands. Most are thought to have entered the > country some time ago and are deeply entrenched in their communities. > To root them out, the FBI has been busy developing a network of > informers in Muslim neighborhoods, including nightclub owners, > waiters and merchants, a federal law-enforcement official said. > Intelligence is the chief tool in the war on terror, a senior former > Pentagon intelligence official said. "Intelligence is really just > a giant research operation where you rely on huge archival files," > he said. "It's the most effective weapon you've got." The next and > best weapon in the war against the cells is infiltration. A longtime > covert operations specialist said law enforcement is using agents who > are Arabs and fluent in Arabic, who then look for ways to get inside > the community where the cell members worship. Their next goal is "to > find out about the social structure: Where do they worship, where do > they entertain, what do they talk about?" he said. If it is known > where they socialize and there is probable cause, local police might > be able to place eavesdropping devices on the premises, he said. The > goal is to identify and eliminate leaders, a former CIA official said. > As the FBI and other law-enforcement agencies gain knowledge, any > rivalries among group members can be exploited, using disinformation > to convince some cell members that others are informers or traitors. > One FBI official explained that the purpose is to "disrupt" hostile > organizations, and that FBI tactics go back to 1956, when the FBI > established its Cointelpro (counterintelligence program.) This > official said the program pitted one group or even members of a single > group against another "like gladiators in ancient Rome." The program > has been used successfully against such groups as the Black Panthers > and the Ku Klux Klan, he said

1 0

Cointel is back: meet any new arabic-speaking guys in shiny shoes?
by Major Variola (ret) 04 Nov '02

04 Nov '02

http://www.washtimes.com/national/20021104-81830128.htm Officials attempt to get inside cells of al Qaeda in U.S. By Richard Sale UNITED PRESS INTERNATIONAL Local and federal law-enforcement agencies are attempting to infiltrate al Qaeda sleeper cells operating in the United States and are using disinformation campaigns to expose and neutralize the terror groups that continue to communicate with one another, U.S. intelligence officials say. FBI officials say recent electronic intercepts of communications between some al Qaeda groups show that they are "talking to each other." "The cells are up and active," an FBI official said of the groups believed to be embedded in most U.S. cities with sizable Islamic communities, such as New York, Detroit and Los Angeles. In a review of ongoing U.S. operations, United Press International was briefed on the al Qaeda investigations by several current and former intelligence officers, all of whom asked not to be identified by name. Former CIA and Defense Intelligence Agency officials say the terrorists choose run-down neighborhoods because "in a place like that, you are invisible. People don't care about you; they don't want to look at you and don't look at you," as one put it. A former senior U.S. intelligence official explained: "The members of cells don't think of themselves as raiding parties but as the front end of an invasion." "If they can attack, blow things up and disrupt society, they believe there will be mass defections to Islam and society will collapse. They can then set up an Islamic state." The cells, these sources said, are made up of U.S.-born Muslims and immigrants from Pakistan, Saudi Arabia and the Persian Gulf states, and number in the thousands. Most are thought to have entered the country some time ago and are deeply entrenched in their communities. To root them out, the FBI has been busy developing a network of informers in Muslim neighborhoods, including nightclub owners, waiters and merchants, a federal law-enforcement official said. Intelligence is the chief tool in the war on terror, a senior former Pentagon intelligence official said. "Intelligence is really just a giant research operation where you rely on huge archival files," he said. "It's the most effective weapon you've got." The next and best weapon in the war against the cells is infiltration. A longtime covert operations specialist said law enforcement is using agents who are Arabs and fluent in Arabic, who then look for ways to get inside the community where the cell members worship. Their next goal is "to find out about the social structure: Where do they worship, where do they entertain, what do they talk about?" he said. If it is known where they socialize and there is probable cause, local police might be able to place eavesdropping devices on the premises, he said. The goal is to identify and eliminate leaders, a former CIA official said. As the FBI and other law-enforcement agencies gain knowledge, any rivalries among group members can be exploited, using disinformation to convince some cell members that others are informers or traitors. One FBI official explained that the purpose is to "disrupt" hostile organizations, and that FBI tactics go back to 1956, when the FBI established its Cointelpro (counterintelligence program.) This official said the program pitted one group or even members of a single group against another "like gladiators in ancient Rome." The program has been used successfully against such groups as the Black Panthers and the Ku Klux Klan, he said

1 0

中国教育网：吉林特产高等专科学校正在招生！
by owner-cypherpunks＠minder.net 04 Nov '02

04 Nov '02

1 0

RE: Sending bricks through the mail
by Lisa 04 Nov '02

04 Nov '02

I think this is what you're looking for: http://www.improb.com/airchives/paperair/volume6/v6i4/postal-6-4.html At 11:17 PM 11/3/02 +0100, Thoenen, Peter Mr. EPS wrote: >Tried emailing direct but bounced so apologize to the list for the OT >content :) > >You don't happen to have the url do you? Think it would make an amusing >read.

1 0

RE: What email encryption is actually in use?
by Tyler Durden 04 Nov '02

04 Nov '02

Peter Trei wrote... "Durden's question was whether a snooper on an IPSEC VPN can tell (for example) an encrypted email packet from an encrypted HTTP request. The answer is no. All Eve can tell is the FW1 sent FW2 a packet of a certain size. The protocol of the encapsulated IP packet, it's true source behind FW1, it's true destination behind FW2, and the true destination port are all hidden." Yes, this was indeed the gist of my question. I was aware that there are actually hard and soft switches that are aware all the way up to the application layer, apparently (I also know that some softswiches have actually been deployed in RBOC/Baby Bell territory.) But from your previous email, you indicated that the secure IPSEC tunnel is created by taking the packets, encrypting S/A, D/A, payload and protocol fields (ie, pretty much everything) and then dumping them into the payload of another packet, and setting the Protocol field of the parent-packet to "IPSEC". All that is now visible are the firewall addresses. That's a lot, methinks! In other words, there's practically a bright red flag sticking up saying "I'm encrypted! Look over here!"...it's child's play (well, if you consider making an ASIC child's play!) to then look at the S/A and D/a to see if they are interesting. If they belong to the IP spaces of two large companies, for instance, then look elsewhere (though I hear rumors that the NSAs of the world are branching out into industrial eavesdropping for their parent companies, ehr, for their parent countries). If a secure VPN tunnel forms between al-Jazeera's firewall and, say, some ISP near Atlantic Avenue in Brooklyn (heavy Arab community), then all sorts of spyglasses could pop up. Thus, I suspect a lot can be gleaned (and is) from communiques without actually de-encrypting...the philosohpy probably is, "why violate civil rights unless we really, really have to? Extract as much as we can without actually de-encrypting, and if the probably of something being "interesting" is high enough, then we'll send it downstairs to be opened" (and even then, determining how hard it is to open the communique might also be of interest...is it legal to open somebody else's email but not read it?) Here's a little quote for ya, since it seems to be the in-thing to do... "The revolution is right where we want it: out of our control." (Royal Family and the Poor) >From: "Trei, Peter" <ptrei(a)rsasecurity.com> >To: cypherpunks(a)lne.com, "'Major Variola (ret)'" <mv(a)cdc.gov> >Subject: RE: What email encryption is actually in use? >Date: Mon, 4 Nov 2002 12:58:55 -0500 > > > Major Variola (ret)[SMTP:mv@cdc.gov] > > > > > > At 10:13 AM 11/4/02 -0500, Tyler Durden wrote: > > >This is an interesting issue...how much information can be gleaned from > > > > >encrypted "payloads"? > > > > Traffic analysis (who, how frequently, temporal patterns) > > Size of payload > > > > Is it possible for a switch or whatever that has > > >visibility up to layers 4/5/6 to determine (at least) what type of file > > is > > >being sent? > > > > Yes. > > > > Modern network equiptment can examine all the way up to "layer 7". > > Can tell that you're sending an .mp3 and will cut your QoS, if that's > > the policy. > > >Durden's question was whether a snooper on an IPSEC VPN can >tell (for example) an encrypted email packet from an encrypted >HTTP request. > >The answer is no. > >All Eve can tell is the FW1 sent FW2 a packet of a certain size. >The protocol of the encapsulated IP packet, it's true source >behind FW1, it's true destination behind FW2, and the true >destination port are all hidden. > >Peter _________________________________________________________________ Unlimited Internet access -- and 2 months free! Try MSN. http://resourcecenter.msn.com/access/plans/2monthsfree.asp

1 0

RE: What email encryption is actually in use?
by Trei, Peter 04 Nov '02

04 Nov '02

> Tyler Durden[SMTP:camera_lumina@hotmail.com] writes: > > > "Most the ones I've seen are IPSEC over IPv4. You might be able to glean > some info from packet size, timing, and ordering, but not much. IPSEC > takes a plaintext IP packet and treats the whole thing as a data block > to be encrypted." > > SO this would indicate that IPSEC creates a sort of blockage from seeing > up > to Layers 4/5/6. Now when you say it takes the IP packet, is this just the > > datagram or is it also he procotol bytes? (I'm assuming the layer-2 > information remains intact.) If the protocol bytes are unencrypted, then > there's a LOT that can probably be determined about any IP session. If the > > protocol bytes are encrypted, then this will ot be a very flexible > session, > no? (More of a secure pipe I guess.) > > And then, does IPSEC include specification for MPLS? I would assume that > the > MPLS header information is not encrypted, simply because the headers have > no > global significance... > It's a pipe. The whole plaintext IP packet, from start to finish, including headers and checksum, gets treated as data, and encrypted. The encrypted packet is the data for a new packet, which goes from one firewall to another (and has only the firewall IP addresses exposed). The packets visible on the outside only tell Eve that firewall A sent firewall B an IPSEC packet of a certain size, with a particular Security Association. (ie, the protocol field says 'this is an IPSEC packet'). A single SA can be used for many, many, internal connections. Check the IPSEC RFCs for more info. Peter Trei

1 0