- cypherpunks-legacy - lists.cpunks.org

Re: Blind signatures with DSA/ECDSA?
by privacy.at Anonymous Remailer 23 Apr '04

23 Apr '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Often people ask about blind DSA signatures. There are many known variants on DSA signatures which allow for blinding, but blinding "plain" DSA signatures is not discussed much. Clearly, blinding DSA signatures is possible, through general purpose two party multi-party computations, such as circuit based protocols. However these would be too inefficient. I believe that the technique of Philip MacKenzie and Michael K. Reiter, Two-Party Generation of DSA Signatures, Crypto 2001, http://www.ece.cmu.edu/~reiter/papers/, can be adapted for blind DSA signatures that would be reasonably efficient. The problem they solved was different in that both parties had a share of the private key, and there was no effort to hide the message hash being signed or the (r,s) signature values. However the same basic idea should work. The scheme uses a homomorphic encryption key held by the first party, Alice, who is the one who will receive the signature. Bob is the signer. The homomorphic encryption system allows Bob to take an encrypted value and multiply it by a constant known to him; and also to add two encrypted values together. (That is, Bob can produce an output cyphertext which holds the result. He does not learn the result.) Suggested cryptosystems with the desired properties include those from Paillier; Naccache and Stern; or Okamoto and Uchiyama. Alice starts with the message hash H, and knows the public key parameters y, g, p and q. Bob knows the private key x such that y = g^x mod p, where q is the order of g. DSA signatures are computed by choosing a random value k mod q and computing r = g^k mod p mod q; z = 1/k mod q; s = x*r*z + H*z mod q; with (r,s) being the signature. For the protocol, Alice and Bob will compute k as multiplicatively shared, with Alice knowing k1 and Bob knowing k2, where k1*k2 = k mod q. We start, then, with Bob (the signer) computing r2 = g^k2 mod p and sending that to Alice. Alice computes r = r2^k1 mod p mod q = g^(k2*k1) mod p mod q = g^k mod p mod q. Alice and Bob also compute z1 = 1/k1 mod q and z2 = 1/k2 mod q respectively; then z = 1/k mod q = z1*z2 mod q. Alice uses the homomorphic encryption and produces a = E(r*z1) and b = E(H*z1). She sends these to Bob along with some ZK proofs that the values are well formed. Bob uses the homomorphic properties to multiply the plaintext of a by x*z2 and the plaintext of b by z2 and to add them, along with a large random multiple of q, q*d, where d is random mod q^5: c = a X (x*z2) + b X z2 + E(d*q). Here X means the operation to multiply the hidden encrypted value by a scalar, and + is the operation to add two encrypted values. Bob sends c back to Alice. Alice decrypts c and takes the result mod q to recover s = r*z1*x*z2 + H*z1*z2 = x*r*z + H*z mod q, the other component of the DSS signature. She can verify that Bob behaved correctly by checking that (r,s) is a valid DSS signature on H. For a quick security analysis, Alice is clearly safe as Bob never sees anything from her but some encrypted values, and his k2 share of k is uncorrelated to k itself. In the other direction, Bob has to be concerned about revealing x. He is given two encrypted values and has to multiply one by x*z2 and the other by z2 and add them. If the encrypted plaintexts are u and v, this produces (u*x + v) * z2. This value is completely uncorrelated with x, mod q, because of the multiplication by z2 which is uniformly distributed. Then adding the large multiple of q should effectively hide the value of x. For strictly provable security it may be necessary for Alice and perhaps even Bob to provide some ZK proofs that they are behaving correctly. The system is reasonably efficient, the main issue being the need to be able to PK encrypt values as large as q^6, which for DSS would be 6*160 or 960 bits. That would require a Paillier key of about 2K bits which is very manageable. The total cost is about 9 modular exponentiations of 2K bit values to 1K bit exponents, plus whatever ZK proofs are necessary. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.0 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQFAiKbxHIAd9K7kkjIRAmLEAKCUNcW3fsDysi9Mul9WlFzVMQivWgCgxdHt dq6rlO2tfSoufs9NrhX616Y= =gBz4 -----END PGP SIGNATURE-----

1 0

Did You Hear the One About the Salesman Who Traveled Better?
by R. A. Hettinga 22 Apr '04

22 Apr '04

<http://online.wsj.com/article_print/0,,SB108266481426590961,00.html> The Wall Street Journal April 23, 2004 SCIENCE JOURNAL By SHARON BEGLEY Did You Hear the One About the Salesman Who Traveled Better? April 23, 2004 Traveling salesmen star in more jokes than almost any other occupation, but William Cook doesn't let that distract him. A mathematician at Georgia Institute of Technology, Atlanta, Prof. Cook is one of hundreds of researchers who, since the 1930s, have wracked their brains over the puzzle known as the traveling-salesman problem. It asks: What's the shortest itinerary a salesman can follow to visit all the stops on his route? If our Willy Loman has to make only three or four stops, the optimal route is easy to figure out. But once he adds a few dozen, the number of possible sequences grows exponentially, and the computer time it would take to calculate every possibility grows into the decades. As a result, after three mathematicians solved the problem for 49 cities in 1954, it took until 1971 to solve it for only 15 more. But Prof. Cook and three colleagues broke the problem wide open in the 1990s, solving it for 13,509 cities in 1998 and for 24,978 a few weeks ago. That feat took 67 computer years. (You can see the optimal paths at www.math.princeton.edu/tsp/vlsi/index.html1.) While not even the busiest salesman has a route that big, the problem has become a boldface celebrity in the business world because all manner of practical problems involve the basic question, what is the best way to do something? Applications range from scheduling cable-TV service calls and routing parcel-delivery trucks to drilling holes in a circuit board, where you want to minimize how far the drill, like the salesman, must travel. Faster computers are still not fast enough for this task, because such problems have zillions of possible combinations, notes Michael Trick of Carnegie Mellon University, Pittsburgh. UPS, for one, has upward of 1,500 pick-up/delivery facilities and sorting centers. It would take millennia of computer hours to solve its routing problems using the traditional problem-solving methods. So, scientists in "operations research" (a hybrid of math, engineering and computer science) now are exploiting what Prof. Trick calls "profound insights into the mathematics of the problem." In other words, they're figuring out clever shortcuts the computers can take. These insights take the form of algorithms, a sort of mathematical recipe. "We're developing algorithms that are 10,000 times faster than the ones we used 15 years ago," says Irv Lustig, an operations researcher at ILOG Inc., Mountain View, Calif. "Now we can say, given the data, here is the probably-best answer." An algorithm he developed for ILOG, which sells algorithm-packed custom software, tackled the National Football League's 2004 schedule. He had to juggle 256 games among 32 teams, subject to multiple constraints. There had to be a nationally appealing game every Monday night and at least one must-see match-up every Sunday, for example, and he couldn't send a team on the road for weeks at a time. Dr. Lustig's algorithm created thousands of schedules that fit these constraints in a fraction of the time it took by trial-and-error computing. Even better, it can tweak a schedule in less than a day if, say, the NFL decides that a Giants-Redskins game simply won't do for Week 8 (it's Week 2). In the past, making that change would produce a domino effect taking days to fix. Many of the new algorithms emerged from advances in a relatively young field of math called linear programming. Despite its name, linear programming is not a kind of software-writing. Instead, it's a way to solve optimization problems. Among the most powerful algorithms in linear programming is one that could use some help from a branding consultant, but for now is called the "interior-point method." Imagine that every possible solution to a problem is represented as a point on the surface of a million-faceted diamond. The best solution is the one at the top. The challenge is to reach it. Traditionally, you'd do that by climbing (mathematically) from point to higher point along the outside of the diamond. The interior-point method lets you zoom up the inside. Depending on the number of facets on the diamond, that may let you find the solution more quickly. Thanks to abstruse breakthroughs like this, operations research (OR) has scored in more than the NFL. To eliminate backtracking and overlapping routes, Waste Management Inc. solved what you might call a traveling garbage-truck problem. Using an optimization algorithm to reroute its fleet, WMI eliminated 761 trucks, saved $91 million in annual operating costs and still hauled the trash on time. So-called fractional-fleet services needed a similar mathematical rescue. These companies promise customers who own, say, one-quarter of a business jet that they can depart from anywhere within four hours. The easiest way to do that is to have a plane at every airport their customers use. But that is a good way to bleed cash. With operations research, Bombardier Flexjet was able to cut crew levels by 20%, while getting 10% more daily flights out of each of its aircraft. Bombardier and WMI are among the finalists in a competition run by Informs, the professional group for operations research. The winner will be announced next week. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[IP] One Internet provider's view of FBI's CALEA wiretap push (fwd from dave@farber.net)
by Eugen Leitl 22 Apr '04

22 Apr '04

----- Forwarded message from Dave Farber <dave(a)farber.net> -----

5 9

Re: [IP] One Internet provider's view of FBI's CALEA wiretap push
by Major Variola (ret) 22 Apr '04

22 Apr '04

At 05:56 PM 4/22/04 +0200, Thomas Shaddack wrote: >On Thu, 22 Apr 2004, Major Variola (ret) wrote: > >> At 12:09 PM 4/22/04 +0200, Eugen Leitl wrote: >> > >> >Are you truly expecting a worldwide ban on encryption? How do you prove >> >somebody is using encryption on a steganographic channel? >> >> Torture, of the sender, receiver, or their families, has worked pretty >> well. >> If you're good you don't even leave marks. > >However, it's not entirely reliable. At some point, the suspect tells you >what you want to hear, whether or not it is the truth, just so you leave >him alone. It can even happen that the suspect convinces himself that what >he really did what he was supposed to do. Interrogators check out each confession. First ones won't work, bogus keys. Just noise. Second confession reveals pork recipes hidden in landscape pictures. Beneath that layer of filesystem is stego'd some porn. Beneath that, homosexual porn. But your interrogators want the address book stego'd beneath that. They know that these are stego distraction levels, uninteresting to them. You'll give it to them eventually. If you give them a believable but fake one, it will damage innocents or true members of your association. >This brings another ofren underestimated problem into the area of >cryptosystem design, the "rubberhose resistance". My comments were written with that in mind. I'm familiar with filesystems (etc) with layers of deniable stego. I wonder how quickly one could incinerate a memory card in the field with high success rate? Destroy the data and the passphrases don't help.

4 3

United States Patent: 6,721,423
by R. A. Hettinga 22 Apr '04

22 Apr '04

<http://patft.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=HITOFF&d=PALL&p=…> ( 1 of 1 ) United States Patent 6,721,423 Anderson , et al. April 13, 2004 Lost cost countermeasures against compromising electromagnetic computer emanations Abstract A set of methods is specified whereby software reduces compromising electromagnetic emanations of computers that could otherwise allow eavesdroppers to reconstruct sensitive processed data using periodic averaging techniques. Fonts for screen display of text are low-pass filtered to attenuate those spectral components that radiate most strongly, without significantly affecting the readability of the text, while the character glyphs displayed are chosen at random from sets that are visually equivalent but that radiate differently. Keyboard microcontroller scan loops are also furnished with random variations that hinder reconstruction of the signal emanated by a keyboard. Drivers for hard disks and other mass-storage devices ensure that the read head is never parked over confidential data longer than necessary. Inventors: Anderson; Ross J. (10 Water End, Wrestlingworth, Sandy, Bedfordshire, GB SG29 2HA); Kuhn; Markus Guenther (Schlehenweg 9, Uttenreuth, DE D-91080) Appl. No.: 238560 Filed: January 28, 1999 Current U.S. Class: 380/252; 380/268; 380/210; 380/54 Intern'l Class: H04L 009/00 Field of Search: 380/205,210,268,287,22,1,252,54 713/190,189 References Cited [Referenced By] U.S. Patent Documents 3770269 Nov., 1973 Elder 463/18. 4203102 May., 1980 Hydes 345/467. 4695904 Sep., 1987 Shinyagaito et al. 5379343 Jan., 1995 Grube et al. 5530390 Jun., 1996 Russell 327/164. 5726538 Mar., 1998 Jackson et al. 315/370. 5894517 Apr., 1999 Hutchison et al. 380/268. Other References van Eck, "Electromagnetic Radiation for Video Display Units: An Eavesdropping Risk?" Computers and Technology 4 (1985) 269-286. Primary Examiner: Barron; Gilberto Assistant Examiner: Gurshman; G Claims What is claimed is: 1. A method of obstructing the reconstruction of information shown on a video-display system from electromagnetic emissions generated by that system, in which the display is altered using character fonts that compose each displayed graphic character using more than two pixel amplitudes in order to reduce the electromagnetic emissions in video-signal frequencies that are radiated or conducted to potential eavesdropper receiver positions particularly well. 2. A method of obstructing the reconstruction of information shown on a video-display system from electromagnetic emissions generated by said video-display system comprising: generating several character fonts consisting of pixel images of glyphs; each of said fonts providing a glyph image for each graphic character of a supported character set, said character set being common across all generated fonts; each of said glyph images differing slightly in style, size, position and quantization noise from glyph images that represent the same character in the other generated fonts responsive to monitored emission measurements and subject to a trade-off that keeps the differences in visual appearance at a minimum and that maximizes the differences in electromagnetic emissions in video-signal frequencies that are radiated or conducted to a potential eavesdropper receiver, and a mechanism to alter said video display by randomly choosing among said fonts for each newly displayed instance of a character. 3. A method of obstructing the reconstruction of information shown on a video-display system from electromagnetic emission generated by said video-display system comprising: generating character fonts consisting of grey-level pixel images of glyphs; filtering said generated character fonts in a horizontal direction responsive to monitored emission measurements and a signal-energy to display-quality trade-off, and altering said video display by using character fonts that compose displayed characters using more than two pixel amplitudes for reducing the electromagnetic emissions in video-signal frequencies that are radiated or conducted to a potential eavesdropper receiver. Description TECHNICAL FIELD This invention is related to the protection of confidential computer data against eavesdroppers who try to reconstruct it from the electromagnetic emanations generated by computers. BACKGROUND OF THE INVENTION It has been known to military organizations since at least the early 1960s that computers generate electromagnetic radiation which not only interferes with radio reception, but which also makes information about the processed data available to a remote radio receiver (see for example Peter Wright: Spycatcher--The Candid Autobiography of a Senior Intelligence Officer. William Heinemann Australia, 1987, ISBN 0-85561-098-0). Known as compromising emanation or Tempest radiation, this electromagnetic broadcast of data has been a significant concern in security-sensitive computer applications. Compromising emanations of video display units (see for example Wim van Eck: Electromagnetic Radiation from Video Display Units: An Eavesdropping Risk? Computers & Security vol 4 (1985) 269-286; Erhard Moller, Lutz Bernstein, Ferdinand Kolberg: Schutzma.beta. nahmen gegen kompromittierende elektromagnetische Emissionen von Bildschirmsichtgeraten [Protective measures against compromising electromagnetic emissions from video display terminals]. Labor fur Nachrichtentechnik, Fachhochschule Aachen, Aachen, Germany) and serial data cables (see Peter Smulders: The Threat of Information Theft by Reception of Electromagnetic Radiation from RS-232 Cables. Computers & Security vol 9 (1990) 53-58) have been described in the open literature. One common and expensive countermeasure is to fit metallic shielding to the device, the room, or the entire building (see Electromagnetic Pulse (EMP) and Tempest Protection for Facilities. Engineer Pamphlet EP 1110-3-2, 469 pages, U.S. Army Corps of Engineers, Publications Depot, Hyattsville, Dec. 31, 1990; and Deborah Russell, G. T. Gangemi Sr.: Computer Security Basics. O'Reilly & Associates, 1991, ISBN 0-937175-71-4). Cross-correlation test methods suitable for verifying the effectiveness of such shielding have been described in Wolfgang Bitzer, Joachim Opfer: Schaltungsanordnung zum Messen der Korrelationsfunktion zwischen zwei vorgegebenen Signalen [Circuit arrangement for measuring the correlation function between two given signals]. German Patent DE.sup..about. 3911155.sup..about. C2, Deutsches Patentamt, Nov. 11, 1993, and Joachim Opfer, Reinhart Engelbart: Verfahren zum Nachweis von verzerrten und stark gestorten Digitalsignalen und Schaltungsanordnung zur Durchfuhrung des Verfahrens [Method for the detection of distorted and strongly interfered digital signals and circuit arrangement for implementing this method]. German Patent DE.sup..about. 4301701.sup..about. C1, Deutsches Patentamt, May 5, 1994. Devices that generate a correlated jamming signal in order to make eavesdropping more difficult have been described in John H. Dunlavy: System for Preventing Remote Detection of Computer Data from TEMPEST Signal Emissions. U.S. Pat. No. 5,297,201, Mar. 22, 1994, and Lars Hoivik: System for Protecting Digital Equipment Against Remote Access. U.S. Pat. No. 5,165,098, Nov. 17, 1992. The electromagnetic data-dependent signals generated by computers and emanated over the air, or via power supply and communication cables, are rather weak and distorted. In addition, if several computers are located in close proximity, their signals will be overlaid. The eavesdropper will therefore use various techniques to separate the signals of interest from the background noise before attempting further decoding (see Markus G. Kuhn, Ross J. Anderson: Soft Tempest: Hidden Data Transmission Using Electromagnetic Emanations, in David Aucsmith (Ed.): Information Hiding, Second International Workshop, IH'98, Portland, Oreg., USA, Apr. 15-17, 1998, Proceedings, LNCS 1525, Springer-Verlag, ISBN 3-540-65386-4, pp. 126-143). Periodic averaging is a very powerful noise elimination technique and can be applied to many signals of particular interest from computer systems that process confidential data. If the signal of interest s(t) has a known period T such that s(t)=s(t+T) most of the time, then the eavesdropper can reconstruct from the received noisy signal r(t)=s(t)+n(t), where n(t) is uncorrelated background noise, a noise-reduced estimate of the signal from a moving average: ##EQU1## which has a significantly better signal-to-noise ratio than s(t). Three periodic signals found in a typical computer may contain confidential information and are thus of particular interest to an eavesdropper: 1. The video display signal is generated by writing the content of the display frame buffer to the display with a period equivalent to the vertical refresh frequency of the cathode-ray tube, liquid crystal panel, or other display device. 2. A microcontroller or a specialized circuit in the keyboard applies voltages in succession to each row of a matrix circuit to which the keys are connected. Scanning the column lines for this voltage allows the microcontroller or specialized circuit to determine which key is currently pressed in order to report the appropriate key code word to the main processor (see Ed L. Sonderman, Walter Z. Davis: Scan-controlled keyboard, U.S. Pat. No. 4,277,780, Jul. 7, 1981). This scan cycle is repeated with high frequency to ensure that no key-press events are missed. The sequence of instructions executed in the scan loop often depends on which key is currently pressed. Therefore the precise shape of the emanations reveals information about key presses, and manually entered text may be reconstructed by an eavesdropper. 3. In most mass storage devices such as magnetic or magneto-optical discs, data is organized into storage tracks and a motor moves the head between them. After data has been read from or written to a track, the head usually remains located on that track until a request to access another track is received. During this time, the readout amplifier receives, amplifies and emits the data content of the storage track periodically, where the period is identical to the rotation time of the disk. SUMMARY OF THE INVENTION The present invention is a low-cost means of making it more difficult for an eavesdropper to gain knowledge about the data processed on a normal computer system that features standard components such as a video display, a keyboard and a hard disk. In its most general terms the presents invention proposes that instead of, or in addition to, physical screening of an electronic system, the system should be designed or modified to reduce (or substantially eliminate) the generation of electromagnetic signals which are periodic or otherwise predictable. Accordingly, the invention may be expressed as a method of obstructing the reconstruction of information contained in an electronic apparatus from electromagnetic emissions, by reducing the energy of certain periodic signals in electromagnetic emissions generated by the system and destroying the periodicity of residual signals or other signals. These methods may involve only software or firmware changes in the computer system and can therefore be implemented at a much lower cost than the conventional techniques described above, in which electromagnetic radiation is reabsorbed after it has been generated (i.e. physical shielding). They may also be implemented using low-cost hardware devices. Whether they are implemented in software, firmware or hardware, these techniques can also be combined with traditional physical shields in order to provide an independent layer of protection against shield failure. The general means of protection is to render signals more difficult for an attacker to recover using periodic averaging and cross-correlation techniques. Three specific methods are filtering out from periodic signals those spectral components that cause the highest levels of compromising radiation, spreading the spectrum of the residual information-bearing radiation using a sequence unknown to the attacker, and removing periodic signals directly. We will describe examples of these three techniques in turn. An example of the first method consists of displaying text on the video display device using a special font that employs a plurality of pixel luminosities in order to represent character glyphs. The use of more than two pixel luminosities to display anti-aliased characters and thus avoid staircase effects in slanted lines and italic characters has been described in Richard B. Preiss, John C. Dalrymple: System and method for smoothing the lines and edges of an image on a raster-scan display, U.S. Pat. No. 4,672,369, Jun. 9, 1987, and Bradley J. Beitel, Robert D. Gordon, Joseph B. Witherspoon III: Anti-alias font generation, U.S. Pat. No. 5,390,289, Feb. 14, 1995}. The innovation in the present invention is to use a font specially designed so that the horizontal spatial frequency spectrum of the glyphs is adapted to the emission spectrum of the video display device so as to reduce the broadcast energy and thus minimize the range within which eavesdroppers can identify the displayed characters. An example of the second method consists, firstly, of using a random number generator to select one of a number of character glyphs which are visually similar but which are generated by different video signals, in order to make it more difficult to reconstruct the signal using signal processing techniques; and secondly, introducing a variable delay into the keyboard matrix scan cycle, which makes it harder for eavesdroppers to reconstruct the compromising emissions of the keyboard. The innovation in the present invention is to randomise the inadvertently emitted signal and thus make its reconstruction by an attacker more difficult. An example of the third method is to modify the device driver software or controller firmware responsible for the control of disk drives, or in general any mass storage device that uses moveable read/write heads to access a plurality of storage tracks on the surface of a storage medium. The innovation in the present invention is to park inactive read/write heads on a storage track that does not contain confidential data. BRIEF DESCRIPTION OF THE FIGURES FIG. 1 shows a pixel field containing normal raster text. FIG. 2 shows a pixel field containing horizontally low-pass filtered raster text, illustrating the application of the second emanation protection method described in this invention. FIG. 3 shows a magnified photograph of the pixel field in FIG. 1 as it is displayed on a cathode-ray computer monitor. FIG. 4 shows a magnified photograph of the pixel field in FIG. 2 as it is displayed on a cathode-ray computer monitor. FIG. 5 shows an excerpt from the video signal generated by the pixel field shown in FIG. 1. FIG. 6 shows an excerpt from the video signal generated by the pixel field shown in FIG. 2, taken from the same pixel coordinates as those used in FIG. 5. FIG. 7 shows the video signal from FIG. 6 after it has passed a simple analog low-pass filter that has been installed on the computer video adapter output in order to attenuate the aliasing frequencies generated by the discrete nature of the video signal and by the shape of a single pixel pulse. FIG. 8 shows a photograph of the screen of a Tempest eavesdropping receiver when the computer screen under surveillance contains normal raster text fonts as shown in FIG. 1. FIG. 9 shows a photograph of the screen of a Tempest eavesdropping receiver when the computer screen under surveillance contains horizontally low-pass filtered content as shown in FIG. 2, demonstrating the protective effect of this invention. DETAILED DESCRIPTION In the case of the video display unit, we shape the spectrum of the periodic video signal by using digital filtering or by combining digital filtering and anti-aliasing techniques to generate a character font with little spectral energy in those frequency ranges in which the computer monitor radiates particularly well. The spectral characteristics of the monitor are first determined by using the graphics adapter of the computer to display test images such as a zoneplate pattern. The emanations are then measured in an electromagnetic compatibility laboratory using a spectrum analyzer or a Tempest monitoring receiver. In one test system described in Markus G. Kuhn, Ross J. Anderson "Soft Tempest: Hidden Data Transmission Using Electromagnetic Emanations" (in David Aucsmith (Ed.): Information Hiding, Second International Workshop, IH'98, Portland, Oreg., USA, Apr. 15-17, 1998, Proceedings, LNCS 1525, Springer-Verlag, ISBN 3-540-65386-4, pp. 126-143) these measurements showed that for a video mode with 95 MHz pixel frequency, most of the emitted energy came from parts of the test image with frequencies in the range 33-47.5 MHZ. The emitted energy was not only present in this frequency range but also as higher harmonics of frequencies in this band. Preferably, the present invention reduces the amount of emitted information bearing radiation by at least 10 dB, or more preferably by at least 20 dB or even 30 dB. This is because in the zoning model used by many governments to decide which classification of information may be processed on which type of apparatus in which zone of a building, a signal attenuation of 10 dB corresponds to a single zone (see Deborah Russell, G. T. Gangemi Sr.: Computer Security Basics. O'Reilly & Associates, 1991, ISBN 0-937175-71-4). Text displayed with a font in which all horizontal pixel lines have been processed with a digital filter to attenuate frequency components in this range by about 20 dB becomes practically invisible on a Tempest monitor while the display quality and readability of the text by persons in front of the authorised display device is only marginally affected. This processing can be achieved by passing the video signal through a suitable hardware filter, or more conveniently by software graphic processing. In our typical embodiment, we start out with a high-resolution version of a character font and generate grey-level pixel images of the glyphs, selecting for the background and foreground luminosity 85% and 15% of the available maximal white luminosity in order to prevent overflow or underflow during subsequent filtering. We then apply a normal subsampling filter in both horizontal and vertical directions in order to prevent aliasing by removing all frequency components that are above the Nyquist limit of the final pixel spacing. Our innovation over existing anti-aliasing technology is to apply in the horizontal direction a further filter that attenuates those frequencies at which the video display device radiates compromising RF emanations efficiently. The spectral shape of the anti-emission filter depends on the results of the monitor emission measurements and on a signal energy versus display quality tradeoff. After these filtering steps, the filtered high-resolution font is subsampled and stored for use by display routines. The resulting filtered glyphs may be significantly wider than the underlying original glyphs and thus the display routine must superpose them using addition, with the background (85%) luminosity treated as zero for the purpose of this addition. An example text that has been generated this way is shown in FIG. 2 as a pixel field and in FIG. 4 as a CRT screen photograph. FIG. 6 shows a typical video signal generated this way, from which further harmonics can be removed by an analog filter at the video adapter output, resulting in a smoother signal such as that shown in FIG. 7. For best performance, a 30 MHz low-pass hardware filter is used; if the application admits only software countermeasures, then the filters installed in monitor cables for EMC and RFI compliance purposes together with the natural inductance of the cables and the limitations of the video amplifier circuitry have a similar if less controlled effect. FIG. 9 shows the signal received by the eavesdropping receiver described in Markus G. Kuhn, Ross J. Anderson "Soft Tempest: Hidden Data Transmission Using Electromagnetic Emanations" (in David Aucsmith (Ed.): Information Hiding, Second International Workshop, IH'98, Portland, Oreg., USA, Apr. 15-17, 1998, Proceedings, LNCS 1525, Springer-Verlag, ISBN 3-540-65386-4, pp. 126-143), when the screen content has been low-pass filtered using software only as described by this invention. FIG. 1, FIG. 3, FIG. 5, and FIG. 8 illustrate the corresponding situation found with normal video display units if no protective filtering takes place; this gives a considerably better received signal as shown in FIG. 8. To further complicate automated radio frequency character recognition of displayed text using a digital eavesdropping receiver and pattern matching techniques, one typical embodiment utilizes a plurality of fonts that differ slightly in character style, size, and position and it randomly selects for every character of the displayed text one of these font variations. In the case of the keyboard scan cycle, we adapt the same idea and spread the spectrum of the emanations by adding a variation and a random delay into the scan sequence. Transforming the scan cycle into a non-periodic process spreads the harmonics of the sample cycle frequency in the spectrum such that they cannot be extracted easily by periodic averaging. The random repetition delay between the application of voltages to the rows of the keyboard matrix is accomplished both by varying the order in which rows are scanned and by using delay loops to vary slightly the time that passes between the scan of one row and the next. The choice of row order and delays depends on the output of a cryptographically strong random number generator that is periodically reseeded by combining its old internal state with keyboard input so as to make its output unpredictable to an eavesdropper. Cryptographic random number generators are described in Bruce Schneier: Applied Cryptography (John Wiley & Sons Inc, 1996, ISBN 0-471-11709-9). The emitted spectrum of the keyboard scan microcontroller and other processors in general can also be spread by slightly frequency modulating the clock signal of this processor using a random noise source, which creates an additional difficulty for eavesdropping receivers. Finally, the scan codes are encrypted for transmission along the keyboard cable to the computer in order to prevent direct eavesdropping of the serial cable emanations as described in Peter Smulders: The Threat of Information Theft by Reception of Electromagnetic Radiation from RS-232 Cables (Computers & Security vol 9 (1990) 53-58). In the case of the mass storage device, we could also reduce the readability of confidential data in the unavoidable periodic signal that the read amplifiers generate as the device turns, by moving the disk head in a random or pseudorandom manner when it is not in use. However in this case there is available a simpler and deterministic remedy which imposes less mechanical wear on the device. We simply move the read head as soon as possible away from a sensitive track if no further read requests are pending. In our preferred implementation, the head is always moved to safe tracks--tracks that contain either no data at all or non-sensitive data--during disk idle times. The disk driver maintains a list of safe tracks to which the writing of sensitive data is prevented, and where there are a number of mechanically coupled heads to access stacked or otherwise juxtaposed media, there will be allocated a number of sets of safe tracks corresponding to disk head positions at which the writing of sensitive data is similarly not permitted. Whenever the request queue for a device is empty and the last access was to a sector other than on a safe track, the driver will determine the closest safe track and either move the read head there directly or issue a read instruction to one of the sectors in this track depending on the disk interface. This way, the sensitive data content of the hard disk will only be amplified for the minimal necessary time and the probability that an eavesdropper can successfully reconstruct any of it by periodic averaging is significantly reduced. * * * * * -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: [IP] One Internet provider's view of FBI's CALEA wiretap push
by Major Variola (ret) 22 Apr '04

22 Apr '04

At 12:09 PM 4/22/04 +0200, Eugen Leitl wrote: > >Are you truly expecting a worldwide ban on encryption? How do you prove >somebody is using encryption on a steganographic channel? Torture, of the sender, receiver, or their families, has worked pretty well. If you're good you don't even leave marks.

2 1

Real-world quantum cryptography
by Steve Furlong 22 Apr '04

22 Apr '04

http://www.quantenkryptographie.at/ Click on the News: April 21 link, which goes to http://www.quantenkryptographie.at/rathaus_press.html World Premiere: Bank Transfer via Quantum Cryptography Based on Entangled Photons Press conference and demonstration of the ground-breaking experiment: 21 April 2004, 11:30, Vienna City Hall Steinsaal

2 2

Bank Transfer via Quantum Cryptography Based on Entangled Photons
by R. A. Hettinga 21 Apr '04

21 Apr '04

Sigh... The old hype-meter pegs so much the needle's bent... Cheers, RAH -------- <http://www.quantenkryptographie.at/rathaus_press.html> Quantum Cryptography "live" World Premiere: Bank Transfer via Quantum Cryptography Based on Entangled Photons Press conference and demonstration of the ground-breaking experiment: 21 April 2004, 11:30, Vienna City Hall q Steinsaal A collaboration of: group of Professor Anton Zeilinger, Vienna University; ARC Seibersdorf research GmbH; City of Vienna; Wien Kanal Abwassertechnologien GmbH and Bank Austria q Creditanstalt Downloads: Einladung (pdf-file, german) Invitation (pdf-file, english) Presse-Information (pdf-file, german) Press release (pdf-file, english) Where to get Pictures of the Event :: Fotoinformation (pdf-file) Poster 1 (pdf-file, german) Poster 2 (pdf-file, german) Poster 3 (pdf-file, german) Poster 4 (pdf-file, german) Poster 5 (pdf-file, german) For further Information please contact: Julia Petschinka ARC Seibersdorf research; Information Technologies e-mail: Julia.Petschinka(a)arcs.ac.at Phone: +43-(0)50550-4161 Fax: +43-(0)50550-4150 Mobile: +43-(0)664-8251064 or: Andrea Aglibut Institut fuer Experimentalphysik, University of Vienna e-mail: Andrea.Aglibut(a)univie.ac.at Phone: +43-(1)4277-51166 Fax: +43-(1)4277-9512 Mobile: +43-(0)664-60277-51166 -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

RE: voting
by John Kelsey 21 Apr '04

21 Apr '04

At 11:05 AM 4/9/04 -0400, Trei, Peter wrote: ... >1. The use of receipts which a voter takes from the voting place to 'verify' >that their vote was correctly included in the total opens the way for voter >coercion. I think the VoteHere scheme and David Chaum's scheme both claim to solve this problem. The voting machine gives you a receipt that convinces you (based on other information you get) that your vote was counted as cast, but which doesn't leak any information at all about who you voted for to anyone else. Anyone can take that receipt, and prove to themselves that your vote was counted (if it was) or was not counted (if it wasn't). (This is based on attending a presentation of David's scheme at George Washington a few months ago, a conversation I had with a VoteHere guy, and some conversations and documents given to me by each. I haven't tried to verify the protocols or proofs, but I'm convinced that all this is possible, modulo various assumptions. There may be a dozen other people doing similar things, that I've simply not heard of.) ... >1. How does this system prevent voter coercion, while still allowing receipt >based recounts? Or do you have some mechanism by which I can >personally verify every vote which went into the total, to make sure they >are correct? The way I understood these schemes, you can see the initial encrypted ballots (they're published), and then there are several rounds of publically verifiable shuffling and decryption by different TTPs. After the last round of shuffling and decryption, you have raw votes. So anyone can verify the count, assuming the set of initial encrypted ballots are legitimate. And anyone can produce a receipt that can be shown to be one of those encrypted ballots, if it was counted. That doesn't keep someone from stuffing the ballot box, but it does mean that anyone who throws away unfavorable votes is going to leave behind evidence, which can potentially call the whole vote into question. The way I saw these schemes described, there was no recount capability, but the count was done in a completely public way. It seems to me that this kind of scheme has a lot of potential for disruption attacks, since one compromised voting machine can be used to call any election into question. But I could be missing something, as this is really not something I've spent a lot of time on.... >2. On what basis do you think the average voter should trust this system, >seeing as it's based on mechanisms he or she cant personally verify? I see your point, but there's an awful lot of any voting system that isn't being closely observed by the voters, or that isn't really well-understood by most of them. It's not so clear to me that the average voter is going to walk away convinced that a voter-verified paper ballot, or a mark-sense ballot, or whatever other thing isn't going to somehow be subject to attack. Or that if they do walk away convinced, that this has much to do with whether they *should* walk away convinced. >3. What chain of events do I have to beleive to trust that the code which >is running in the machine is actually and correctly derived from the >source code I've audited? I refer you to Ken Thompsons classic paper >"Reflections on trusting trust", as well as the recent Diebold debacle >with uncertified patches being loaded into the machine at the >last moment. Yep, this is a big issue. Which is why I think everyone with any sense agrees that we need some kind of independent audit trail, regardless of whether we're doing voting with computers, or with pens for punching out holes. There are a bunch of ways to do this, one obvious and pretty easy-to-field choice being voter-verified paper ballots. >This last is an important point - there is no way you can eliminate the >requirement of election officials to behave legitimately. Since that >requirement can't be done away with by technology, adding technology >only adds more places the system can be compromised. Huh? Do you think the same is true of payment systems? Those also ultimately require some humans to play by the rules, but it sure seems like a well-designed payment system can remove a lot of the ambiguity about who has violated the rules, and can outright prevent other kinds of rule violations. And it seems to me that this is very similar to the situation with voting. Touch screen voting (with the audio extensions) has at least one huge advantage over pen-and-paper schemes, because blind people can vote with them. The VoteHere and Chaum schemes provide other benefits (a lot of kinds of misbehavior by the authorities are prevented by the design, though of course, not *all* possible misbehavior), at various costs in system complexity, dependence on lots of interacting systems that might not be all that reliable, ability to recover from some low level of fraud, etc. Paper ballots printed behind glass provide a different set of tradeoffs. And you could design twenty other sets of tradeoffs. I'm not at all convinced that the way we optimize for best security is to minimize technology. I agree that it's easy to get carried away by the elegance of your mathematics, or by the really spiffy blinking lights on the computer, and forget the essentials. But technology and math aren't somehow inherently bad things to introduce to voting systems. It just has to be done in a way that makes sense, right? ... >I do think electronic voting machines are coming, and a good >thing. But they should be promoted on the basis that they >are easier to use, and fairer in presentation, then are manual >methods. Promoting them on the basis that they are more >secure, and less subject to vote tampering is simply false. Less subject to vote tampering than the old machines with mechanical counters and levers? That's not too hard. Less subject to vote tampering than paper ballots marked by hand, that may be a little more of a challenge. I think it's more fair to say that the attacks and threats will be different, and that the risk of a class break (work out the details of the attack once, then change votes all over the country) is seriously scary. But it's sure not clear to me that adding computers to the mix must decrease security, or even must leave it unchanged. >Peter Trei --John Kelsey, kelsey.j(a)ix.netcom.com, who is definitely speaking only for himself. PGP: FA48 3237 9AD5 30AC EEDD BBC8 2A80 6948 4CAA F259

5 8

[ISN] Britons go 'toothing' for sex with strangers
by InfoSec News 21 Apr '04

21 Apr '04

http://www.theage.com.au/articles/2004/04/21/1082395891416.html [Who would have thought a security vulnerability would lead to wild anonymous sex? :) - WK] London April 21, 2004 British commuters take note - the respectable person sitting next to you on the train fumbling with his or her cell phone may be a "toother" looking for sex with a stranger. "Toothing" is a new craze where strangers on trains, buses, in bars and even supermarkets hook up for illicit meetings using messages sent via the latest in phone technology. "Toothing is a form of anonymous sex with strangers -- usually on some form of transport or enclosed area such as a conference or training seminar," says the Beginner's Guide To Toothing on a website dedicated to the pursuit. It is made possible by Bluetooth technology which allows users to send phone contacts, pictures and messages to other Bluetooth-enabled equipment over a range of about 10 metres. Users discovered they could send anonymous messages to people they didn't know with Bluetooth equipment, spawning a craze dubbed "bluejacking". Jon, aka "Toothy Toothing" and the guide's author, explained toothing was born after he was "bluejacked" by an unknown girl while commuting to work in London. After a few days of flirting, she suggested a brief encounter in a station lavatory. "The meeting wasn't a romantic thing - it was purely sexual. Barely anything was said," he said via e-mail. He said potential toothers begin by sending out a random greeting -- usually "Toothing?". "If the other party is interested, messages are exchanged until a suitable location is agreed -- usually a public toilet, although there are tales of more adventurous spots such as deserted carriages or staff areas," his guide adds. Jon, who's in his 20s and works in finance, estimates there could be tens of thousands of toothers from all sorts of professions and lifestyles. Certainly the website's message board is busy. "Any toothing on these trains?" asks one message about services between Cambridge and London, prompting positive responses from "Dannyboy" and "Zeke". "I'll be around London Bridge mainline station around 9.45 - 10am tomorrow if anyone's interested...," another messager called "Boi" wrote hopefully. While some happily recount their successful encounters, others suggest there are a few teething problems with toothing. "I tried toothing in Tooting (south London) last night... not a device to be found," a frustrated "Snowdog" posted sadly. Although clearly not what the industry had in mind, toothing may lead operators towards similar, more mainstream projects. Last month it was reported that a team in Boston had created a service for cell phones called Serendipity, an wireless alternative to online dating. It allows subscribers to store their personal details and what they want from a partner. When there are enough similarities between two people and they happen to be in the same area, it tells their phones to communicate with each other. Dario Betti, of the British-based consultancy Ovum, said bluejacking had really taken off, helped by the fact the service was free. "The element of the unknown, that you are connecting to someone around you that you might not know, it's a novelty factor that is helping it to start," he said. If Jon and those who use his forum are right, toothing is certainly livening up life for some bored commuters. "A lot of my day's taken up with a soul-aching commute into the city, and that just feels like dead time," Jon said. "Flirting is fun, sex is fun. We're just employing expensive, complex toys to find the most basic form of entertainment." _________________________________________ ISN mailing list Sponsored by: OSVDB.org --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0