- cypherpunks-legacy - lists.cpunks.org

Re: When encryption is also authentication...
by Ian Grigg 30 May '02

30 May '02

> SSL for commerce is readily in place without batting an eyelid these days. Costs are still way too high. This won't change until browsers are shipped that treat self-signed certs as being valid. Unfortunately, browser manufacturers believe in cert-ware for a variety of non-security reasons. Hopefully, one day the independant browser manufacturers will ship browsers that show a different icon for self- certs, rather than annoy the user with mindless security warnings. Then, we can expect a massive increase in secure browsing as sites start defaulting to self-signed certs, and a consequent massive increase in security, as well as a follow-on massive increase in the sale of certs. Unfortunately, we probably won't see an enhanced market for CA certs until Verisign goes broke. > However, I'd be interested to know just how many users out there would enter > their card details on an unprotected site, despite the unclosed padlocks > and the > alert boxes. Huge numbers of them. You won't see it in security lists, but most of your average people out there do not understand the significance of the padlock, and when merchants request credit card numbers, they quietly forget to tell them. And, in a lot of cases, credit card details are shipped over cleartext email rather than browsers. Many of these merchants have card-holder-present agreements, the restrictions of which, they just ignore. Commerce being what commerce is, it is more important to get the sale than deal with some obscure security nonsense that doesn't make sense. > Have security fears and paranoia been abated by widespread crypto > to the point whereby users will happily transmit private data, whether > encrypted > or nay, just because they *perceive* the threat to now be minimal? Now that the > media has grown tired of yet-another-credit-card-hack story? Much of today's body of (OECD) net users don't read the news about the net and don't understand the debate, nor can they make sense of how to protect themselves from a site that is hacked... Three or four years back, much of the body of the net was still technically advanced and capable of understanding the fallacious security arguments. These days, perversely, the users are better able to evaluate the security risks, because they don't understand the arguments, so they look to the actual experience, which provides no warnings. > Pointers to any evidence/research into this much appreciated... ta. Unfortunately, real data is being kept back by the credit card majors. It is my contention that there has never been a case of sniffed-credit-card-abuse, and nobody I've ever talked to in the credit card world has ever been able to change that. On the whole, all net-related credit card fraud is to do with other factors: mass thefts from hacked databases, fraudulent merchant gatherings, fear-of- wife revocations, etc. Nothing, ever, to do with on-the-wire security. -- iang

2 1

Making Veri$ign rich(er)
by Ian Grigg 30 May '02

30 May '02

> Ian Grigg wrote: > > > Costs are still way too high. This won't change until > > browsers are shipped that treat self-signed certs as being > > valid. Unfortunately, browser manufacturers believe in > > cert-ware for a variety of non-security reasons. > [...] > > Jason Holt <jason(a)lunkwill.org> wrote: > > Self signed certs defeat the purpose of the certificate chain mechanism, which > is not just there to make Veri$ign rich. I understand that we are all working to make Veri$ign rich by pushing their cert-ware. Let me offer you a way in which we could make them richer. Believe me, they need our help. > Mallory can self-sign a cert for > bob.com, and hack Alice's DNS to point bob.com at her own site. But it's > (theoretically, anyway) much more difficult for her to convince Verisign that > she owns bob.com. If we trust Verisign to do that, then we know we're really > talking to Bob when we visit bob.com. What you describe above is an arcane theoretical attack. An MITM is an extraordinarily difficult thing to do. In practice, totally impractical in risk analysis terms. Its impracticality is because there are always easier pickings out there than conducting this attack. Consider the attack. You have to be able to so some spoofing, or some interception, or some hacking of critical infrastructures to do this. After all, you have to be able to insert yourself where Mallory needs to be in some sense, which means perverting the normal flow of packets. This is generally highly risky. It is also expensive and hard to control. Say you are attacking Amazon. If you pervert the DNS, as you suggest, you will have to be able to handle a lot of DNS requests. Also, there is a high chance that you will be noticed. Net techies and hackers and ISP people are looking at this sort of thing all the time. Now consider what you get: you can sit in the middle and manage some SSL traffic. So you'll need some capacity to sift through all the different sessions to snaffle the good data. At the end of the day, you'll be burning up a lot of CPU cycles to manage that traffic. (So you'll need access to some good sized hardware if you are attacking Amazon.) Finally, you manage to start farming those valuable CCs. Depending on how much hardware you've got that is managing the thousands of MITM sessions, you could pick up quite a bunch. But, if you do manage to get to the point of actually harvesting some CCs, you will by now have laid out such a road map that someone should be able to find you. So, you had better have a fast exit. Here's the thing: even if you get some, it wasn't worth it. Think like a crook. Any thing that you can do with SSL, you can do easier just by hacking into some poor NT box and accessing the database to read off the CCs. Then you get to walk away without leaving any tracks. Then you get the last month's takings, because the company already did the harversting for you. And, in practice this is how it goes. No thief ever bothers to do an MITM, even over *un*encrypted traffic. They simply hack into the machines and steal it all. That's why there has never been a case of CCs sniffed over the net and being used to commit a fraud (at least, no recorded ones). Change the analysis to small merchants, and it is even worse (of course Amazon will have a cert, so even its rich bounty is unavailable, you have to do this on small merchants). So, how do we make Veri$ign richer? Easy, switch browsers to accepting self-signed certs. To see this, we have to have tried or heard about small enterprises who have tried to set up their SSL certs. It's very expensive. Most don't do it. If we had the money we could ask Netcraft.com for the figures, but, last I checked, only 1% of servers have proper setups with proper certs. Why? because it is so expensive to set up. Most sites try and fail. They give up when they realise it isn't worth their time. So Veri$ign fails to sell the cert. And the site remains unencrypted, uncerted, unprotected only by the fact that nobody is watching. (Security by obscurity is indeed the greatest friend that we have, by actual saved amounts of money.) Now, if there was a halfway house, the site could at least be set up so that it is encrypted. Right there, is a big improvement in security. If we could do that, if we could encourage the browsers to accept the self-signed but encrypted web sites, that would let all the poor people in the world (the other 99% that can't afford all the hoo-haa of dealing with VeriSign and techies and ISPs and ...) have a go at setting up secure web sites. Secure by encryption that is. My guess is that it would get the number up to 10%. Why would that make Veri$ign richer? Because taking that 10% of encrypted sites would be a much more powerful target market. Veri$ign knows they care. Those sites just haven't got around to doing the work to get the cert set up. But they are encrypted. They are half way there. They want to be there! A decent, marketing approach to this user base would result in a pretty good conversion rate. We are talking 20-30% here, because we know they care. So, that expands the market for cert-ware by 2-3. Such doesn't work when you are dealing with a untargetted site base of 10 times that. All they have to do is understand that their MITM model, as learnt from the textbooks, does their market more harm than good. Sack the cryptographers, and employ some script kiddies to tell them what it is about. Should be worth a doubling of their share price. -- iang

2 1

Re: sources on steganography
by Morlock Elloi 30 May '02

30 May '02

> Why would I be interested in "fool[ing] [you]." All I asked was for some > help with sources. If you cannot be of help, at least don't be a I think that perception and sense of humour are sort of required for crypto work. ===== end (of original message) Y-a*h*o-o (yes, they scan for this) spam follows: Yahoo! - Official partner of 2002 FIFA World Cup http://fifaworldcup.yahoo.com

1 0

Relax this Summer... On a new Hammock
by Offers 30 May '02

30 May '02

1 0

[��] �� ̻� �ʰ� �־󸮰� �� ־��~ ^.*
by �� 30 May '02

30 May '02

1 0

Re: When encryption is also authentication...
by Jason Holt 30 May '02

30 May '02

Ian Grigg wrote: [...] >> SSL for commerce is readily in place without batting an eyelid these days. > > Costs are still way too high. This won't change until > browsers are shipped that treat self-signed certs as being > valid. Unfortunately, browser manufacturers believe in > cert-ware for a variety of non-security reasons. [...] Self signed certs defeat the purpose of the certificate chain mechanism, which is not just there to make Veri$ign rich. Mallory can self-sign a cert for bob.com, and hack Alice's DNS to point bob.com at her own site. But it's (theoretically, anyway) much more difficult for her to convince Verisign that she owns bob.com. If we trust Verisign to do that, then we know we're really talking to Bob when we visit bob.com. Now, the ability to add other CAs which we trust would be a nice feature, and if there were more trustworthy CAs which were added to the browsers by default, we could get the costs down closer to the actual overhead of verifying that the supplicant (er, applicant) actually owns the domain he's trying to get a cert for. But anyone can certify themselves as owning amazon.com, and it's critical that my browser tell me when some stranger makes such an assertion on their own. -J

1 0

Re: sources on steganography
by cypherpunk_reader 30 May '02

30 May '02

I AM OSAMA Good one !!! lol -----Original Message----- From: owner-cypherpunks(a)ssz.com [mailto:owner-cypherpunks@ssz.com]On Behalf Of Hector Rosario Sent: Thursday, May 30, 2002 8:42 AM To: Morlock Elloi Cc: cypherpunks(a)lne.com Subject: Re: sources on steganography Why would I be interested in "fool[ing] [you]." All I asked was for some help with sources. If you cannot be of help, at least don't be a hindrance. Besides, don't claim to speak for others. If envy is what drives you, then I suggest that you work on that. hr On Wed, 29 May 2002, Morlock Elloi wrote: > > I am writing my dissertation on steganography. Basically I'm writing a > ^^^^ ^ ^ ^ ^ ^ > > You can't fool us. > > > > ===== > end > (of original message) > > Y-a*h*o-o (yes, they scan for this) spam follows: > Yahoo! - Official partner of 2002 FIFA World Cup > http://fifaworldcup.yahoo.com

1 0

Re: Forward-secure public-key encryption eprint
by Anonymous 30 May '02

30 May '02

David Hopwood writes: > Forward-secure public-key encryption has been discussed here, on > sci.crypt, and elsewhere. To recap - the goal is that an adversary who > breaks into your computer today can't read messages sent/received > yesterday. In the interactive case, you use ephermal Diffie-Hellman. The > non-interactive case is more complicated and has had some ideas considered > by Ross Anderson, Adam Back, and David Hopwood (among others). Cypherpunks > relevance: forward security is nice for remailers. > > Anyway, there's a new eprint up which shows how to construct such a scheme > starting from an ID-based encryption scheme by Boneh + Franklin. > > "A Forward-Secure Public-Key Encryption Scheme" > Jonathan Katz > http://eprint.iacr.org/2002/060/ > > It's worth noting that the scheme this is based on has code available. > http://crypto.stanford.edu/ibe/download.html Adam Back noted several years ago that identity-based encryption systems could be converted into forward-secure PK encryption methods. At the time it did not appear that any of the identity-based encryption systems were very secure. In the past few years a number of cryptographic results have been achieved by using the Weil and Tate pairings, which are mappings among groups associated with supersingular elliptic curves. These mappings have special mathematical properties which give a new slant to a number of cryptographic problems. For example it can be shown that in the appropriate group, the Decision Diffie-Hellman problem is easy while the Diffie-Hellman problem is still thought to be hard. On coderpunks this was discussed as a possible approach to ecash. The Weil pairing can also be used to create short signatures, only 20 bytes long for the same security as a DSA sig taking 40 bytes. At Crypto 2001, Boneh and Franklin showed how to use the Weil pairing to create an identity based PK system. Unlike earlier constructions, this one seems to have a good security margin. Following Adam Back's earlier idea, this means a forward-secure PKCS can be constructed, and the new paper does so, using the Weil and Tate pairings. One concern is that these mathematical techniques are new in cryptography and so it is possible that new attacks will be found against them. While the underlying math is old, the specific application is new and so weaknesses may still be discovered. Another problem is that the math is really advanced and not many implementors or users are likely to understand it very well. Sure we've got a library but the kind of people who want forward security would like to understand the principles a little better.

2 1

Best refinance mortgage rate WI
by RUDOLF 30 May '02

30 May '02

Clarification Want to refinance? Fill out this quick form and immediately have mortgage companies compete for you business. You will be offered the, absolute, BEST refinance rates available! Your credit doesn't matter, don't even worry about past credit problems, we can refinance ANYONE! Let Us Put Our Expertise to Work for You! http://66.230.217.86 Erase http://66.230.217.86/optout.htm

1 0

[��] ��ο� ��ο�ȭ�� Ұ��մϴ�
by ��ȣ�� 30 May '02

30 May '02

1 0