- cypherpunks-legacy - lists.cpunks.org

Re: SHA1 broken?
by R.A. Hettinga 20 Feb '05

20 Feb '05

--- begin forwarded text

6 10

RSA looks ahead on RFID security
by R.A. Hettinga 20 Feb '05

20 Feb '05

<http://www.theregister.co.uk/2005/02/18/rsa_rfid/print.html> The Register Biting the hand that feeds IT The Register ; Security ; Identity ; Original URL: http://www.theregister.co.uk/2005/02/18/rsa_rfid/ RSA looks ahead on RFID security By John Leyden (john.leyden at theregister.co.uk) Published Friday 18th February 2005 21:16 GMT RSA 2005 Cryptographic researchers are working out ways to make RFID technology more palatable to consumers ahead of its expected widespread deployment over the coming years. RFID tags are small silicon microchips attached to an antenna which emit a unique serial number by radio over short distances. Miniature RFID tags can be embedded in all kinds of consumer products and scanned from between two to three metres away, revealing information about the product and (potentially) its owner. Critics say the technology could reduce or eliminate purchasing anonymity and could even threaten civil liberties. The issue becomes even more acute with plans to put RFID tags into identity cards. Burt Kaliski, director and chief scientist of RSA Laboratories, said RFID technologies promise to become the most pervasive deployment of technology ever, but little attention has been paid so far to security and privacy issues. "The level of security and privacy needs to grow in proportion with deployment," he said. RSA is concerned that information stored on RFID tags could be read by anyone with an RFID reader - data thieves, hackers - or worse. Right now, this isn't much of a threat; but once the technology becomes widely adopted readers will drop in price. Over time, readers are likely to be built into mobile phones to facilitate applications such as comparison shopping. Such an application could take 10 years to hit the streets, but security researchers need to think of the issues it raises now before standards become "baked in", according to Kaliski. "Technology can help maintain the balance between those concerned about business efficiency and those concerned about privacy," he said. Traditionally, security systems are based on the premise that a system is trustworthy and it's up to the user to establish his credentials. With the possibility of rogue RFID readers, this premise no longer holds true and a different approach is needed. One approach is to change the IDs of tags from one interaction to the next. "The authentication process needs some kind of dynamic interaction and not just the assertion of identity," Kaliski told El Reg. <pHe revealed his thoughts RFID security during a meeting at this week's RSA Conference in San Francisco. Scientists from RSA have been studying the issue for several years. Earlier this month researchers from Johns Hopkins University and RSA Laboratories announced the discovery of cryptographic vulnerabilities in the RFID technology used in high-security car keys and petrol pump payment systems. The attack against Texas Instruments DST tags used in vehicle immobilisers and ExxonMobil's SpeedPass system discovered by researchers worked because of the use of a 40-bit key in TI's technology. "The design was a good attempt, given the constraints," Kaliski told us. . -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Geekzone: IT, mobility, wireless and handheld news
by R.A. Hettinga 20 Feb '05

20 Feb '05

<http://www.geekzone.co.nz/content.asp?contentid=4099> Geekzone: IT, mobility, wireless and handheld news PGP moving to stronger SHA Algorithm News : Mobile : Security, posted 19-FEB-2005 19:37 PGP Corporation is planning to migrate to a more secure version of the Secure Hash Algorithm (SHA) in the upcoming releases of its PGP Desktop and PGP Universal encryption solutions. According to a report released this week by a team at Shandong University in China, the SHA-1 algorithm that supports the digital signatures used in popular SSL browser security and encryption can be successfully attacked. The same team helped break MD5, another commonly used cryptographic hash algorithm, in August 2004. According to the company, all PGP products are architected to allow for rapid and non-disruptive migration of all encryption, hash, compression, and signature algorithms. PGP Corporation began planning the migration to more secure hash algorithms after MD5 was compromised last year. Jon Callas, CTO & CSO of PGP Corporation addressed the company's design philosophy in a September 2004 CTO Corner article entitled "Much ado about hash functions" . At the same time, PGP engineers began implementing a shift from SHA-1 to the stronger algorithms (SHA-256 and SHA-512) while preserving interoperability with existing software. The upcoming releases of PGP Desktop and PGP Universal will allow users to select from a broader range of authentication options. "The work done by the University of Shandong team is in the finest tradition of cryptoanalytic peer review," said Callas. "The best minds continually review existing algorithms, identify issues that need to be addressed, and the entire community of vendors and users benefits. We will continue to monitor the cryptographic integrity of the algorithms used in PGP products and upgrade them as required to provide our customers with the most secure information security solutions available." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Arroyo calls for ID cards, wiretaps
by R.A. Hettinga 20 Feb '05

20 Feb '05

<http://feeds.bignewsnetwork.com/?sid=042210e5ec3539c8> Sunday 20th February, 2005 Arroyo calls for ID cards, wiretaps Big News Network.com Sunday 20th February, 2005 (UPI) The president of the Philippines has said a national identification card and a system for wiretapping is necessary in the federal antiterrorism bill. President Gloria Macapagal Arroyo believes the two components will make antiterrorism laws more effective, the Manila Times reported Saturday. Let's have that proposal go through the debate in Congress but it is important, she said. We are one of the few countries that still don't have an antiterrorism or internal security law. However, some lawmakers said the wiretapping could be used as a weapon to harass people personally or politically and the ID cards could allow the the government to compile a dossier against unsuspecting citizens. Last year's legislation to establish a National Reference Card at age 18 would have contained the name, address, blood type and next of kin of the bearer as well as a data strip containing a reference number and other confidential data. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Ink helps drive democracy in Asia
by R.A. Hettinga 19 Feb '05

19 Feb '05

<http://news.bbc.co.uk/2/low/technology/4276125.stm> The BBC Saturday, 19 February, 2005, 08:34 GMT Ink helps drive democracy in Asia By Dr David Mikosz In Kyrgyzstan The Kyrgyz Republic, a small, mountainous state of the former Soviet republic, is using invisible ink and ultraviolet readers in the country's elections as part of a drive to prevent multiple voting. This new technology is causing both worries and guarded optimism among different sectors of the population. In an effort to live up to its reputation in the 1990s as "an island of democracy", the Kyrgyz President, Askar Akaev, pushed through the law requiring the use of ink during the upcoming Parliamentary and Presidential elections. The US government agreed to fund all expenses associated with this decision. "The use of ink and readers by itself is not a panacea for election ills" The Kyrgyz Republic is seen by many experts as backsliding from the high point it reached in the mid-1990s with a hastily pushed through referendum in 2003, reducing the legislative branch to one chamber with 75 deputies. The use of ink is only one part of a general effort to show commitment towards more open elections - the German Embassy, the Soros Foundation and the Kyrgyz government have all contributed to purchase transparent ballot boxes. Not complicated The actual technology behind the ink is not that complicated. The ink is sprayed on a person's left thumb. It dries and is not visible under normal light. However, the presence of ultraviolet light (of the kind used to verify money) causes the ink to glow with a neon yellow light. At the entrance to each polling station, one election official will scan voter's fingers with UV lamp before allowing them to enter, and every voter will have his/her left thumb sprayed with ink before receiving the ballot. If the ink shows under the UV light the voter will not be allowed to enter the polling station. Likewise, any voter who refuses to be inked will not receive the ballot. These elections are assuming even greater significance because of two large factors - the upcoming parliamentary elections are a prelude to a potentially regime changing presidential election in the Autumn as well as the echo of recent elections in other former Soviet Republics, notably Ukraine and Georgia. The use of ink has been controversial - especially among groups perceived to be pro-government. Common metaphor Widely circulated articles compared the use of ink to the rural practice of marking sheep - a still common metaphor in this primarily agricultural society. The author of one such article began a petition drive against the use of the ink. The greatest part of the opposition to ink has often been sheer ignorance. Local newspapers have carried stories that the ink is harmful, radioactive or even that the ultraviolet readers may cause health problems. Others, such as the aggressively middle of the road, Coalition of Non-governmental Organizations, have lauded the move as an important step forward. This type of ink has been used in many elections in the world, in countries as varied as Serbia, South Africa, Indonesia and Turkey. The other common type of ink in elections is indelible visible ink - but as the elections in Afghanistan showed, improper use of this type of ink can cause additional problems. The use of "invisible" ink is not without its own problems. In most elections, numerous rumors have spread about it. Clear step In Serbia, for example, both Christian and Islamic leaders assured their populations that its use was not contrary to religion. Other rumours are associated with how to remove the ink - various soft drinks, solvents and cleaning products are put forward. However, in reality, the ink is very effective at getting under the cuticle of the thumb and difficult to wash off. The ink stays on the finger for at least 72 hours and for up to a week. The use of ink and readers by itself is not a panacea for election ills. The passage of the inking law is, nevertheless, a clear step forward towards free and fair elections." The country's widely watched parliamentary elections are scheduled for 27 February. David Mikosz works for the IFES, an international, non-profit organisation that supports the building of democratic societies. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

SHA-1 broken?
by James Brim 18 Feb '05

18 Feb '05

http://www.schneier.com/blog/archives/2005/02/sha1_broken.html damn chinese.

2 2

Re: Cryptographers to Hollywood: prepare to fail on DRM
by Mike Godwin 18 Feb '05

18 Feb '05

Thanks to Robert Hettinga for the link -- I got a blog entry out of it! (You can read it at <http://www.godwinslaw.org/weblog/archive/2005/02/18/beating-the-drum-on-bui…>.) --Mike -- ----- The Godwin's Law Blog can be found at http://www.godwinslaw.org . ----- Mike Godwin can be reached by phone at 202-518-0020 x 101. The new edition of his book, CYBER RIGHTS, can be ordered at http://www.panix.com/~mnemonic . ----- --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: Cryptographers to Hollywood: prepare to fail on DRM
by Mike Godwin 18 Feb '05

18 Feb '05

Thanks to Robert Hettinga for the link -- I got a blog entry out of it! (You can read it at <http://www.godwinslaw.org/weblog/archive/2005/02/18/beating-the-drum-on-bui…>.) --Mike -- ----- The Godwin's Law Blog can be found at http://www.godwinslaw.org . ----- Mike Godwin can be reached by phone at 202-518-0020 x 101. The new edition of his book, CYBER RIGHTS, can be ordered at http://www.panix.com/~mnemonic . ----- --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: Cryptographers to Hollywood: prepare to fail on DRM
by R.A. Hettinga 18 Feb '05

18 Feb '05

--- begin forwarded text

1 0

Theory of Secure Computation - Joe Killian, NEC Labs
by sunder 18 Feb '05

18 Feb '05

http://www.uwtv.org/programs/displayevent.asp?rid=2233 A bit sparse on details, but a good overview of all sorts of secure protocols. Our friends Alice and Bob are of course present in various orgies of secure protocols. :)

1 0