- cypherpunks-legacy - lists.cpunks.org

Illuminating Blacked-Out Words
by R. A. Hettinga 12 May '04

12 May '04

<http://www.nytimes.com/2004/05/10/technology/10crypto.html?pagewanted=print…> The New York Times May 10, 2004 Illuminating Blacked-Out Words By JOHN MARKOFF European researchers at a security conference in Switzerland last week demonstrated computer-based techniques that can identify blacked-out words and phrases in confidential documents. The researchers showed their software at the conference, the Eurocrypt, by analyzing a presidential briefing memorandum released in April to the commission investigating the Sept. 11 attacks. After analyzing the document, they said they had high confidence the word "Egyptian" had been blacked out in a passage describing the source of an intelligence report stating that Osama Bin Ladin was planning an attack in the United States. The researchers, David Naccache, the director of an information security lab for Gemplus S.A., a Luxembourg-based maker of banking and security cards, and Claire Whelan, a computer science graduate student at Dublin City University in Ireland, also applied the technique to a confidential Defense Department memorandum on Iraqi military use of Hughes helicopters. They said that although the name of a country had been blacked out in that memorandum, their software showed that it was highly likely the document named South Korea as having helped the Iraqis. The challenge of identifying blacked-out words came to Mr. Naccache as he watched television news on Easter weekend, he said in a telephone interview last Friday. "The pictures of the blacked-out words appeared on my screen, and it piqued my interest as a cryptographer," he said. He then discussed possible solutions to the problem with Ms. Whelan, whom he is supervising as a graduate adviser, and she quickly designed a series of software programs to use in analyzing the documents. Although Mr. Naccache is the director of Gemplus, a large information security laboratory, he said that the research was done independently from his work there. The technique he and Ms. Whelan developed involves first using a program to realign the document, which had been placed on a copying machine at a slight angle. They determined that the document had been tilted by about half a degree. By realigning the document it was possible to use another program Ms. Whelan had written to determine that it had been formatted in the Arial font. Next, they found the number of pixels that had been blacked out in the sentence: "An Egyptian Islamic Jihad (EIJ) operative told an xxxxxxxx service at the same time that Bin Ladin was planning to exploit the operative's access to the US to mount a terrorist strike." They then used a computer to determine the pixel length of words in the dictionary when written in the Arial font. The program rejected all of the words that were not within three pixels of the length of the word that was probably under the blackened-out area in the document. The software then reduced the number of possible words to just 7 from 1,530 by using semantic guidelines, including the grammatical context. The researchers selected the word "Egyptian" from the seven possible words, rejecting "Ukrainian" and "Ugandan," because those countries would be less likely to have such information. After the presentation at Eurocrypt, the researchers discussed possible measures that government agencies could take to make identifying blacked-out words more difficult, Mr. Naccache said in the phone interview. One possibility, he said, would be for agencies to use optical character recognition technology to rescan documents and alter fonts. In January, the State Department required that its documents use a more modern font, Times New Roman, instead of Courier, Mr. Naccache said. Because Courier is a monospace font, in which all letters are of the same width, it is harder to decipher with the computer technique. There is no indication that the State Department knew that. Experts on the Freedom of Information Act said they feared the computer technique might be used as an excuse by government agencies to release even more restricted versions of documents. "They have exposed a technique that may now become less and less useful as a result," said Steven Aftergood, a senior research analyst at the Federation of American Scientists, of the research project. "We care because there are all kinds of things withheld by government agencies improperly." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

RE: We're jamming, we're jamming, we hope you like jammin too
by Trei, Peter 12 May '04

12 May '04

You might want to look at the work RSA Labs is doing on 'blocker tags'. These are special tags which leverage the mechanism used to disambiguate the presence of multiple tags to make it look as if you are carrying 2^n (n usually 128) different tags at once. They propose a protocol to make them only block tags for items which have undergone sale to their final owner, but the idea could be applied to all tags. http://www.rsasecurity.com/rsalabs/rfid/index.asp Peter Trei Full Disclosure: I work for RSA > -----Original Message----- > From: owner-cypherpunks(a)minder.net > [mailto:owner-cypherpunks@minder.net]On Behalf Of Major Variola (ret) > Sent: Wednesday, May 12, 2004 1:48 PM > To: cypherpunks(a)al-qaeda.net > Subject: We're jamming, we're jamming, we hope you like jammin too > > > At 03:09 PM 5/11/04 +0200, Eugen Leitl wrote: > >The second covers a "hacking the system" concept. I'd considered > >something similar myself, though different in approach. Rather than > >finding RFID chips and "redistributing" them, why not create > >programmable RFID broadcasters which could spoof other chips, and > >distribute these. The idea being to pollute any RFID > detectors with a > >vast spew of superfluous data. > > RFID jamming should be very easy and a quite amusing DoS attack > on commercial targets. Easy because its not frequency hopping, low > power, and relatively low frequency. Particularly cute would be > transmitting sex-toy codes intermittently. > > ASK any Elmer you happen to see, > what's the best jamming, RFID.. > > (With apologies to the tuna industry and those too young to > know the jingle. Or to know the RF double meanings.)

1 0

Re: who goes 1st problem
by Jason Holt 12 May '04

12 May '04

[Adam and I are taking this discussion off-list to spare your inboxes, but this message seemed particularly relevant. Perhaps we'll come back later if we come up with anything we think will be of general interest.] -J On Tue, 11 May 2004, Adam Back wrote: > Anyway the who goes 1st problem definition has my interest piqued: I > am thinking this would be a very practically useful network protocol > for privacy, if one could find a patent-free end-2-end secure (no > server trust), efficient solution. Another desirable feature I think > is to not use too much funky crypto, people are justifiably nervous > about putting experimental crypto into standards, even if it has > security proofs until some peer review has happened. Agreed. Ninghui Li's RSA OSBEs might be the answer; they're not quite as elegant as the IBE version, but they work with blinded RSA signatures, and so should be patent-free by next year, assuming Ninghui doesn't seek any patents. Section 4 of his PODC paper describes the RSA implementation. He also has a new paper which does neat things with commitments that I haven't wrapped my mind around yet. Actually, we might also consider contacting Dan Boneh at some point; he seems to be interested in the proliferation of IBE, and might be sympathetic to the needs of the IETF to have free standards, especially considering the exposure it'd get for his system. However, we need to define just what we need to accomplish. Since my lab works in trust negotiation, we think in terms of policies a lot, whereas SSL just assumes you know what certs you want to send to whom. But let's assume the SSL model for simplicity. The second issue, now that I think of it in this context, would be how you actually get your certs to the other guy. Hidden credentials, as Ninghui pointed out, assume you have some means for creating the other guy's cert, eg., a template "(nym):Senior_Agent:(current year)" producing "Bob:Senior_Agent:2004". The OSBE paper, OTOH, assumes we're going to exchange our certificates, just without the CA signatures. Then I can send you messages you can only read if you really do have a signature on that cert. But I've always thought that was problematic, since why would honest people bother to connect then use fake certs? The attacker doesn't need to see the signature - he believes you. So honest users would need to regularly give out fake certs so they can hide their legit behavior among the fake connects. Will Winsborough also suggests this with the notion of ACK policies - you *always* give people something they ask for, so they can't tell what you have and what you don't. So maybe what we really want is some sort of fair exchange or something, where I can show you my valid certs as you show me the valid certs of your own. If one side is guessable, we've discussed this sort of thing with hidden creds: E("Hi Bob, since you're a senior agent, you can see my agent credential: 'Alice:Denver field office agent (apprentice):2004", "Bob:Senior_Agent:2004") E("Hi Bob, since you're a BYU alumnus, you can see my BYU credential: 'Alice:Senior:computer science:3.96 gpa:2004", "Bob:Senior_Agent:2004") etc. So that's an open problem. But let's assume guessable-certs, since that's the only way I know how to really keep certs and policies safe for now. The OSBE-RSA math still works. So we're good so far, except that the RSA approach is interactive. Section 4 says that in the RSA scheme, Alice sends her cert /and blinded signature/ to Bob (which may or may not be bogus), and then Bob can send back an encrypted message. (In HC and IBE-OSBEs, Bob doesn't need the blinded signature to use as a public key). But maybe Robert's improved secret sharing scheme from the new HC paper can give us some ideas: 1. Alice sends blinded signatures for each of her relevant certs, not revealing which signature goes with each cert, and not revealing the cert contents. 2. Bob generates the contents of each of Alice's certs relevant to his policy, and simply generates each possible combination of hash-of-cert-contents and blinded-signature. One from each row will be a match-up between contents and signature, and Alice will have to figure out which. Unfortunately, this requires n^2 multiplies and exponentiations. -J

2 1

Re: [linux-elitists] Two on RFID from Politech: Hack the tech, & Gilmore's dystopia (fwd from dmarti@zgp.org)
by Eugen Leitl 12 May '04

12 May '04

----- Forwarded message from Don Marti <dmarti(a)zgp.org> -----

1 0

Wikipedia project: Crypto
by R. A. Hettinga 11 May '04

11 May '04

--- begin forwarded text

1 0

Sierra Wireless Embeds Certicom's movian VPN Client in new Voq Professional Phone
by R. A. Hettinga 11 May '04

11 May '04

<http://biz.yahoo.com/prnews/040511/to295_1.html> Yahoo! Press Release Source: Certicom Corp. Sierra Wireless Embeds Certicom's movianVPN Client in new Voq Professional Phone(TM) Tuesday May 11, 7:02 am ET New smart phone to provide business users with secure e-mail capabilities while leveraging existing security infrastructure MISSISSAUGA, ON, May 11 /PRNewswire-FirstCall/ - Certicom Corp. (TSX: CIC - News), the authority for strong, efficient cryptography, today announced that Sierra Wireless (NASDAQ: SWIR - TSX: SW) has embedded movianVPN(TM) by Certicom into its VoqMail(TM) Professional Edition (VoqMail Pro) wireless e-mail solution, offered for the new Voq Professional Phone(TM). As an embedded feature that supports multiple VPN gateways, the solution is designed to offer IT managers minimal administration and a better return on their existing security infrastructure investment. Based on the Microsoft Windows Mobile(TM) software for Smartphones, the Voq Professional Phone was developed specifically for enterprise users and mobile professionals. The product is designed to offer vital business applications, such as e-mail, and strong security for sensitive and confidential information. A key feature of the Voq Professional Phone is the ease with which the movianVPN client can be integrated into an enterprise's existing security infrastructure and its minimal impact on performance and battery life of the phone. By making security an integral part of VoqMail Pro and its VoqManager desktop IT provisioning tool, and not a separate add-on, Sierra Wireless has created a turn-key enterprise and business data access solution that saves time and effort by eliminating the need for IT managers to work with third parties to buy and configure software and policies for each device. "Voq was developed specifically for the needs of the business professional, and the IT Managers that support them. During development we recognized that a key requirement of the enterprise was the ability to integrate a VPN client without comprising the end user experience or increasing the burden on IT administrators," said Andrew Harries, senior vice president of marketing for Sierra Wireless. "Working with our partners, we believe we have succeeded in building a powerful product that provides a strong, user- and IT-friendly solution." For over 15 years, Certicom has focused on developing and providing security for constrained environments. This expertise has resulted in a wireless VPN client that is one-tenth the size of desktop versions but with equivalent functionality. It provides strong security, including confidentiality, integrity and authentication from handheld devices to the corporate network. movianVPN, an award-winning wireless VPN client, meets the IPSec standard to provide secure access to the corporate network via wireless handhelds. movianVPN fits with existing infrastructure by supporting more than a dozen gateways, including those from Cisco, Netscreen and Nortel and the three leading operating systems - Microsoft Windows Mobile, Palm OS and Symbian OS - including the various versions of the platforms. "The combination of Sierra Wireless' deep experience in the wireless market and their diligence in developing the Voq Professional Phone to meet specific end user requirements has resulted in a Smartphone that addresses today's needs of the enterprise. They have optimized the user experience while focusing on process, security, and power management," said Roy Pereira, vice-president of marketing and product management at Certicom. "We believe the Voq Professional Phone will become a real success story in the mobile market." Sierra Wireless announced the VoqMail Personal and Professional Edition software on February 11, 2004, introducing an always-there(TM) e-mail experience and providing easy-to-use, cost-efficient, and secure access to corporate e-mail. For more information, visit http://www.voq.net/site/news_events/news_20040211.voq About Sierra Wireless Sierra Wireless is a leader in delivering highly differentiated wireless solutions that enable our customers to improve their productivity and lifestyle. Sierra Wireless develops and markets the AirCard, the industry-leading wireless PC card line for portable computers; embedded modules for OEM wireless applications; the MP line of rugged vehicle-mounted connectivity solutions; and Voq, a line of mobile phones with easy-to-use, secure software solutions for mobile professionals. For more information about Sierra Wireless please visit www.sierrawireless.com. About Voq The Voq Professional Phone(TM) is a new class of mobile phone that offers a flip-open QWERTY thumbpad and easy-to-use software solutions for business users, including secure, serverless, always-there e-mail. Based on the Microsoft Windows Mobile(TM) 2003 software for Smartphone, the Voq Professional Phone incorporates the best features of your current mobile phone, a messaging device, and a PDA - in one. For more information about Voq Professional Phone or VoqMail email solutions, please visit www.voq.com About Certicom Certicom Corp. (TSX:CIC - News) is the authority for strong, efficient cryptography required by software vendors and device manufacturers to embed security in their products. Adopted by the US Government's National Security Agency (NSA), Certicom technologies for Elliptic Curve Cryptography (ECC) provide the most security per bit of any known public key scheme, making it ideal for constrained environments. Certicom products and services are currently licensed to more than 300 customers including Motorola, Oracle, Research In Motion, Terayon, Texas Instruments and XM Radio. Founded in 1985, Certicom is headquartered in Mississauga, ON, Canada, with offices in Ottawa, ON; Reston, VA; San Mateo, CA; and London, England. Visit www.certicom.com. Certicom, Security Builder, Security Builder Crypto, Security Builder SSL, Security Builder PKI, Security Builder GSE, movianVPN, movianCrypt and movianMail are trademarks or registered trademarks of Certicom Corp. All other companies and products listed herein are trademarks or registered trademarks of their respective holders. Except for historical information contained herein, this news release contains forward-looking statements that involve risks and uncertainties. Actual results may differ materially. Factors that might cause a difference include, but are not limited to, those relating to the acceptance of mobile and wireless devices and the continued growth of e-commerce and m-commerce, the increase of the demand for mutual authentication in m-commerce transactions, the acceptance of Elliptic Curve Cryptography (ECC) technology as an industry standard, the market acceptance of our principal products and sales of our customer's products, the impact of competitive products and technologies, the possibility of our products infringing patents and other intellectual property of fourth parties, and costs of product development. Certicom will not update these forward-looking statements to reflect events or circumstances after the date hereof. More detailed information about potential factors that could affect Certicom's financial results is included in the documents Certicom files from time to time with the Canadian securities regulatory authorities. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[linux-elitists] Two on RFID from Politech: Hack the tech, & Gilmore's dystopia (fwd from kmself@ix.netcom.com)
by Eugen Leitl 11 May '04

11 May '04

----- Forwarded message from "Karsten M. Self" <kmself(a)ix.netcom.com> -----

1 0

Re: Brands' private credentials
by Adam Back 11 May '04

11 May '04

[copied to cpunks as cryptography seems to have a multi-week lag these days]. OK, now having read: > http://isrl.cs.byu.edu/HiddenCredentials.html > http://isrl.cs.byu.edu/pubs/wpes03.pdf and seeing that it is a completely different proposal essentially being an application of IBE, and extension of the idea that one has multiple "identities" encoding attributes. (The usual attribute this approach is used for is time-period of receipt .. eg month of receipt so the sender knows which key to encrypt with). On Wed, Apr 28, 2004 at 07:54:50PM +0000, Jason Holt wrote: > properties to Brands', and even does some things that his doesn't. so here is one major problem with using IBE: everyone in the system has to trust the IBE server! > I feel a little presumptuous mentioning it in the context of the > other systems, which have a much more esteemed set of authors and > are much more developed, but I'm also pretty confident in its > simplicity. One claim is that the system should hide sensitive attributes from disclosure during a showing protocol. So the example given an AIDs patient could authenticate to an AIDS db server without revealing to an outside observer whether he is an AIDs patient or an authorised doctor. However can't one achieve the same thing with encryption: eg an SSL connection and conventional authentication? Outside of this, the usual approach to this is to authenticate the server first, then authenticate the client so the client's privacy is preserved. Further more there seems to be no blinding at issue time. So to obtain a credential you would have to identify yourself to the CA / IBE identity server, show paper credentials, typically involving True Name credentials, and come away with a private key. So it is proposed in the paper the credential would be issued with a pseudonym. However the CA can maintain a mapping between True Name and pseudonym. However whenever you show the credential the event is traceable back to you by collision with the CA. > Note that most anonymous credential systems are encumbered by > patents. I would not say your Hidden Credential system _is_ an anonymous credential system. There is no blinding in the system period. All is gated via a "trust-me" CA that in this case happens to be an IBE server, so providing the communication pattern advantages of an IBE system. What it enables is essentially an offline server assisted oblivious encryption where you can send someone a message they can only decrypt if they happen to have an attribute. You could call this a credential system kind of where the showing protcool is the verifier sends you a challenge, and the shower decrypts the challenge and sends the result back. In particular I don't see any way to implement an anonymous epayment system using Hidden Credentials. As I understand it is simply not possible as the system has no inherent cryptographic anonymity? Adam

3 7

blinding & BF IBE CA assisted credential system (Re: chaum's patent expiry?)
by Adam Back 10 May '04

10 May '04

On Mon, May 10, 2004 at 03:03:56AM +0000, Jason Holt wrote: > [...] Actually, now that you mention Chaum, I'll have to look into > blind signatures with the B&F IBE (issuing is just a scalar*point > multiply on a curve). I think you mean so that the CA/IBE server even though he learns pseudonyms private key, does not learn the linkage between true name and pseudonym. (At any time during a show protocol whether the private key issuing protocol is blinded or not the IBE server can compute the pseudonyms private key). Seems like an incremental improvement yes. > That could be a way to get CA anonymity for hidden credentials - > just do vanilla cut and choose on blinded pseudonymous credential > strings, then use a client/server protocol with perfect forward > secrecy so he can't listen in. Note PFS does not make end-2-end secure against an adversary who can compute the correspondents private keys, as vulnerable to MITM. Could say invulnerable to passive eavesdropper. However you might have an opening here for a new security model combining features of Hidden Credentials with a kind of MITM resistance via anonymity. What I mean is HC allows 2 parties to communicate, and they know who they are communicating with. The CA colluding MITM however we'll say does not apriori, so he has to brute force try all psuedonym, attribute combinations until he gets the right one. Well still not desirable security margin, but some extra difficulty for the MITM. Adam

2 2

Accoustic Cryptoanalysis for RSA?
by Dave Howe 10 May '04

10 May '04

opinions? http://www.wisdom.weizmann.ac.il/~tromer/acoustic/

1 0