- cypherpunks-legacy - lists.cpunks.org

Financial Cryptography '98 Preliminary Program
by Ray Hirschfeld 17 Dec '03

17 Dec '03

Financial Cryptography '98 Second International Conference February 23-25, 1998, Anguilla, BWI CONFERENCE PROGRAM General Information: Financial Cryptography '98 (FC98) is a conference on the security of digital financial transactions. Meetings alternate between the island of Anguilla in the British West Indies and other locations. This second meeting will be held in Anguilla on February 23-25, 1998. FC98 aims to bring together persons involved in both the financial and data security fields to foster cooperation and exchange of ideas. Original papers were solicited on all aspects of financial data security and digital commerce in general. Program Committee: Matt Blaze, AT&T Laboratories--Research, Florham Park, NJ, USA Antoon Bosselaers, Katholieke Universiteit Leuven, Leuven, Belgium Yves Carlier, Bank for International Settlements, Basel, Switzerland Walter Effross, Washington College of Law, American U., Washington DC, USA Matthew Franklin (Co-Chair), AT&T Laboratories--Research, Florham Park, NJ, USA Michael Froomkin, U. Miami School of Law, Coral Gables, FL, USA Rafael Hirschfeld (Chair), Unipay Technologies, Amsterdam, The Netherlands Alain Mayer, Bell Laboratories/Lucent Technologies, Murray Hill, NJ, USA Moni Naor, Weizmann Institute of Science, Rehovot, Israel Frank Trotter, Mark Twain Ecash/Mercantile Bank, St. Louis, MO, USA Doug Tygar, Carnegie Mellon University, Pittsburgh, PA, USA Moti Yung, CertCo LLC (formerly: Bankers Trust E-Commerce), New York, NY, USA Conference Program for FC98: Monday 23 February 1998 800 -- 820 Breakfast 820 -- 830 Welcome 830 -- 905 Micropayments via Efficient Coin-Flipping Richard J. Lipton (Princeton University, Princeton, NJ, USA) Rafail Ostrovsky (Bellcore, Morristown, NJ, USA) 905 -- 940 X-Cash: Executable Digital Cash Markus Jakobsson (Bell Laboratories, Murray Hill, NJ, USA) Ari Juels (RSA Laboratories, Bedford, MA, USA) 940 -- 1015 Billing Without Paper...Or Billing Without Billers? Caveat Biller: 3rd Party Concentrators Could Come Between You and Your Customers Richard K. Crone (CyberCash, Reston, VA, USA) 1015 -- 1045 Coffee Break 1045 -- 1120 A Platform for Privately Defined Currencies, Loyalty Credits, and Play Money David P. Maher (AT&T Labs--Research, Florham Park, NJ, USA) 1120 -- 1155 Assessment of Threats for Smart Card Based Electronic Cash Kazuo J. Ezawa, Gregory Napiorkowski (Mondex International, Florham Park, NJ, USA) 1155 -- 1230 Using a High-Performance, Programmable Secure Coprocessor Sean W. Smith, Elaine R. Palmer, Steve Weingart (IBM T.J. Watson Research Center, Yorktown Heights, NY, USA) 1230 -- 1330 Lunch 1800 -- 1930 Cocktail Reception (at Mariners Hotel) Tuesday 24 February 1998 800 -- 830 Breakfast 830 -- 905 Secure Group Barter: Multi-Party Fair Exchange with Semi-Trusted Neutral Parties Matt Franklin (AT&T Labs--Research, Florham Park, NJ, USA) Gene Tsudik (USC Information Sciences Institute, Marina del Rey, CA, USA) 905 -- 940 A Payment Scheme Using Vouchers Ernest Foo, Colin Boyd (Queensland University of Technology, Brisbane, Australia) 940 -- 1015 A Formal Specification of Requirements for Payment Transactions in the SET Protocol Catherine Meadows, Paul Syverson (Naval Research Laboratory, Washington, DC, USA) 1015 -- 1045 Coffee Break 1045 -- 1120 On Assurance Structures for WWW Commerce Markus Jakobsson (Bell Laboratories, Murray Hill, NJ, USA) Moti Yung (CertCo, New York, NY, USA) 1120 -- 1230 Panel Discussion Certificate Revocation: Mechanics and Meaning Barb Fox (Microsoft, Redmond, WA, USA), moderator Joan Feigenbaum (AT&T Labs--Research, Florham Park, NJ, USA) Paul Kocher (Valicert, Palo Alto, CA, USA) Michael Myers (Verisign, Mountain View, CA, USA) Ron Rivest (MIT Laboratory for Computer Science, Cambridge, MA, USA) 1230 -- 1330 Lunch 2000 -- 2200 Rump Session Wednesday 25 February 1998 800 -- 830 Breakfast 830 -- 930 Invited Speaker Private Signatures and E-commerce David Chaum (DigiCash, Palo Alto, CA, USA) 930 -- 1005 Group Blind Digital Signatures: A Scalable Solution to Electronic Cash Anna Lysyanskaya, Zulfikar Ramzan (MIT Laboratory for Computer Science, Cambridge, MA, USA) 1005 -- 1045 Coffee Break 1045 -- 1120 Curbing Junk E-Mail via Secure Classification Eran Gabber, Markus Jakobsson, Yossi Matias, Alain Mayer (Bell Laboratories, Murray Hill, NJ, USA) 1120 -- 1155 Publicly Verifiable Lotteries: Applications of Delaying Functions David M. Goldschlag (Divx, Herndon, VA, USA) Stuart G. Stubblebine (AT&T Labs--Research, Florham Park, NJ, USA) 1155 -- 1230 Security of Digital Watermarks Lesley R. Matheson, Stephen G. Mitchell, Talal G. Shamoon, Robert E. Tarjan, Francis X. Zane (STAR Lab, InterTrust Technologies, Sunnyvale, CA, USA) 1230 -- 1330 Lunch 1330 -- 1405 Security in the Java Electronic Commerce Framework Surya Koneru, Ted Goldstein (JavaSoft, Palo Alto, CA, USA) 1405 -- 1440 Beyond Identity: Warranty-Based Digital Signature Transactions Yair Frankel, David W. Kravitz, Charles T. Montgomery, Moti Yung (CertCo, New York, NY, USA) 1440 -- 1515 Compliance Checking in the PolicyMaker Trust Management System Matt Blaze, Joan Feigenbaum, Martin Strauss (AT&T Labs--Research, Florham Park, NJ, USA) 1515 -- 1545 Coffee Break 1545 -- 1620 An Efficient Fair Off-Line Electronic Cash System with Extensions to Checks and Wallets with Observers Aymeric de Solages, Jacque Traore (France Telecom--CNET, Caen, France) 1620 -- 1655 An Efficient Untraceable Electronic Money System Based on Partially Blind Signatures of the Discrete Logarithm Problem Shingo Mayazaki, Kouichi Sakurai (Kyushu University, Fukuoka, Japan) 1655 -- 1700 Closing The conference schedule and additional information is available at the URL http://www.cwi.nl/conferences/FC98/. Breakfast and lunch are provided at the conference. The conference organizers have left time open for corporate sponsored events, for networking, and for recreational activities on the resort island of Anguilla. Participants are encouraged to bring their families. Workshop: A 40-hour workshop, intended for anyone with commercial software development experience who wants hands-on familiarity with the issues and technology of financial cryptography, is planned in conjunction with FC98, to be held during the week following the conference. For more information on the workshop, please see the URL http://www.cs.berkeley.edu/~iang/fc98/workshop.html. For workshop registration, see the URL http://fc98.ai/. Special Attraction: On Thursday, February 26, 1998, there will be a total eclipse of the sun. The narrow zone of 100% totality will pass just south of Anguilla. A boat excursion to the center of the eclipse zone is planned, for an optimal view of the eclipse. The excursion is included in the conference registration; additional tickets can be purchased for accompanying persons. Venue: The Inter-Island Hotel is a small 14-room guest house with a large, comfortable 150-seat conference facility and additional space for a small 10-booth exhibition. The Inter-Island is on Road Bay, near Sandy Ground Village, in the South Hill section of Anguilla. The conference, workshop, and exhibition will have TCP/IP internet access. Shuttle service to the conference will be available. Air Transportation and Hotels: Air travel to Anguilla is typically done through San Juan for US flights, or St. Maarten/Martin for flights from Europe and the US. There are also connections via Antigua. Anguillan import duties are not imposed on hardware or software which will leave the island again. There are no other taxes--or cryptography import/export restrictions--on Anguilla. Hotels range from spartan to luxurious, and more information about hotels on Anguilla can be obtained from your travel agent, or at the URL http://fc98.ai/. A block reservation has been made at Mariners, and this is the recommended hotel except for those seeking budget accomodations. General Chairs: Robert Hettinga, Shipwright, Boston, MA, USA email: rah(a)shipwright.com Vincent Cate, Offshore Information Services, Anguilla, BWI email: vince(a)offshore.com.ai Exhibits and Sponsorship Manager: Blanc Weber, Seattle, WA, USA email: blancw(a)cnw.com Workshop Leader: Ian Goldberg, Berkeley, CA, USA email: iang(a)cs.berkeley.edu Registration: You can register and pay for conference admission via the World Wide Web at the URL http://fc98.ai/. The cost of the FC98 Conference is US$1,000. There are reduced rates of US$250 and US$100 for full-time academics and students. Booths for the exhibition start at US$5,000 and include two conference tickets. For more information about exhibit space, contact Blanc Weber, blancw(a)cnw.com. Sponsorship opportunities for FC98 are still available. The cost of the workshop is US$5000, and includes meals but not lodging. You can register for the workshop, which runs the week after the conference, at the URL http://fc98.ai/. Financial Cryptography '98 is held in cooperation with the International Association for Cryptologic Research. It is sponsored by: RSA Data Security Inc. <http://www.rsa.com> C2NET, Inc. <http://www.c2.net> Hansa Bank & Trust Company Limited, Anguilla <http://www.hansa.net/> Sicherheit und Privat- International Bank <mailto:spbank@schloss.li> Offshore Information Services <http://www.offshore.com.ai/> e$ <http://www.shipwright.com>

1 0

Re: $50 encryption policy contest
by Dr. Alan Sherman 17 Dec '03

17 Dec '03

On Tue, 20 Jan 1998, Lucky Green wrote: > Given that the majority of the serious people on the list charge upwards > of $100/hour (I charge $250/hour for even looking at a problem), $50 seems > to be insufficient to generate much interest. Your point is well taken. I should have explained that I am seeking assistance for altruism from someone who is interested in crypto policy. For example, no one is compensating me for the many hours I've volunteered to pull off this two-part lecture series (and it was quite a challenge to get anyone with government connections to go on stage with John Gilmore). See http://www.cs.umbc.edu/events/fall97/crypto.shtml I'm also trying to help students by suggesting a concrete, worthwhile, interesting project through which to learn about www programming. I am open to the idea of a prize fund: I will augment the prize with 100% of all prize donations mailed to me. If each of 200 people send me $1, the prize fund will grow to $250. (make out check to "UMBC") Dr. Alan T. Sherman Dept. of CSEE UMBC 1000 Hilltop Circle Baltimore, MD 21250

1 0

FDA bans human cloning [CNN]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > FDA: NO HUMAN CLONING WITHOUT AGENCY APPROVAL > > Cloning graphic January 19, 1998 > Web posted at: 9:18 p.m. EST (0218 GMT) > > WASHINGTON (AP) -- The Food and Drug Administration has a warning > for the Chicago physicist who wants to clone a human: The agency > will shut down anyone who tries without its permission. > > Richard Seed's cloning plans have sparked a public outcry and a race > by Congress and more than a dozen states to ban cloning. With the > FDA filling what critics had called a regulatory vacuum, scientists > say lawmakers should take more time to ensure vaguely worded > anti-cloning bills don't also ban lifesaving medical research. > > "It's been a public and media assumption that there is nothing on > the books that would even slow or stop Dr. Seed," said Carl Feldbaum > of the Biotechnology Industry Organization, which represents > biotechnologists involved in cloning research. FDA intervention > "creates at least some breathing space." > > FDA investigators plan to make clear to Seed that federal > regulations require that he file for FDA approval to attempt cloning > -- permission highly unlikely. > > "We're not only able to move, we're prepared to move," said Dr. > Michael Friedman, FDA's acting commissioner, noting the agency can > go to court to stop unauthorized cloning attempts. > [text deleted] ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Intel introduces new compression technology for surfers [CNN]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > > INTEL INTRODUCES TECHNOLOGY TO SURF THE WEB FASTER > > January 19, 1998 > Web posted at: 9:35 p.m. EST (0235 GMT) > > HILLSBORO, Oregon (AP) -- The World Wide Wait may be over. > > Computer chip giant Intel on Monday announced a way for Internet > surfers to download images twice as fast over regular phone lines > without any special equipment or software -- but it will add about > $5 to monthly access fees. > > The technology called Quick Web is installed on the computers called > servers that Internet services use to store and relay data. The > combination of Intel hardware and special software compresses all > the graphic images that are piped through the server, boosting > access speed. > > "The more pictures on the screen, the faster it is," said Dave > Preston, Internet marketing manager for Intel. > [text deleted] ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

6 7

Additional Source of Income
by B_Crawford49＠earthlink.net 17 Dec '03

17 Dec '03

<HTML><PRE> ************************************************************* Our Research Has Indicated That The Following Message Will Be Of Interest To You. ************************************************************* THE HOME WORKERS SURVIVAL GUIDE If you plan on finding legitimate work at home, you need this book! Years of experience and thousands of hours of research have gone into "The Home Workers Survival Guide". There is no better source of information on at-home income opportunities. Use our listings to contact the right companies and you can start to receive weekly checks up to $1000! Please read on so you can get started right away! Get Your First Check in as Little as a Week! Hi, my name is Brian Crawford, and I have tried just about every work- at-home opportunity out there, from stuffing envelopes to assembling miniatures. Most of them turned out to be nothing more than a waste of time and money. However, among all the scams and rip-offs, I did come across many legitimate companies willing to pay for my services. I started to think, "Why doesn't someone just keep track of all the honest companies so that no one else would need to get ripped off when trying to find a decent work-at-home job?" I decided to do just that. Throw Away That Junk Mail! See, the reason most of us encounter problems is because we usually look for these jobs by responding to junk mail. Let me ask you, when was the last time an employer sent you a job offering in the mail? Probably never! You had to look for the job yourself, and it is exactly the same with work-at-home positions. The companies are out there, but you need to look for them. That is where my book "The Home Workers Survival Guide" really comes in handy. Over 200 Companies Waiting to Hear from You! In chapter three, you will find page after page of job listings for all kinds of work. Find something you like, and then contact them at the address listed. You could be on your way to a great paying at-home job for the cost of a stamp. Never send in $20-$30 for a bogus "processing fee" again! Anyone in the U.S. can work- no one is refused. What Do You Like To Do? What kind of work are you looking for? It's all here! -Sewing baby clothing -Building doll houses -Crafts of every kind -Assembling holiday decorations -Painting -Circular Mailing -Food/game/software testers -Baking (Yes, get paid to cook!) -Health products/food/jewelery -Plus many, many more opportunities including distributorships and sales All of these opportunities are available to anyone- no experience is needed. Just contact the listing that interests you and you can get started right away. These companies offer legitimate work and will be happy to send you full information before you make a decision. Watch Out For Scams! Chapter four will let you in on some of the most common work-at home scams. Make sure you read this. If you come across something that sounds too good to be true, remember- it probably is. Here are just two quick examples of information found in this chapter. 1. "Assemble Miniatures" If a company requires a large deposit or registration fee to get started but promises great pay, be careful. Most legitimate companies will charge only a small fee for the supplies they send you, and wil pay you a reasonable amount as well. After sending in a large payment, you may find that the company will call your finished work "inferior" and refuse to pay you. They were only after your registraion fee, and probably never intended on paying you. 2. "Stuff Envelopes" Nobody is going to pay you a dollar or even 50 cents to stuff an envelope. There are machines that can stuff thousands of envelopes a day for only pennies. What these companies should really tell you is that you will be mailing junk advertisements for them. They expect you to place an ad in your local newspaper offering "Home Workers Needed". You only get the "dollar per envelope" when people actually reply to this ad! Are They All Bogus? Like I said before, there are a lot of dishonest companies out there looking to take your money, but not all of them are like that. We list over 40 companies offering assembly work, from toys to clothes to weaving rattan. Choose the kind of work you like and write to the companies who offer it. Ask them any questions you have BEFORE you send in any money or buy any supplies. There are also several companies out there that will pay you a substantial commission for mailing their advertisements, and you won't have to pay them anything to be able to do it, just contact them and ask! Need Cash Fast? 48 Hours Soon Enough? When you get the book, look over the many excellent opportunities. Each listing includes a brief description of what is offered. Write to the companies you like and request an application form. They have openings right now, and they'll be happy to get you started. You can begin to make money even faster if you choose one of the programs or plans that the book describes in detail. I'll tell you everything you need to know to get started. By taking a few simple steps, you can already be making money just 48 hours after you receive the book. How Much Is This Going To Cost Me? "The Home Workers Survival Guide" costs just $29.95 plus $3.00 pastage and handling. I'm so sure this book will help you find legitimate work that I am backing it by an unconditional guarantee. If for ANY reason you do not feel the book helped you earn enough extra income, simply return it for a full refund, including postage and tax. What's better is that this rock-solid guarantee is good for two full months, which allows you to really look it over and check out the opportunities. You deserve to feel the joy of getting huge weekly paychecks. Please complete the order form and mail it today. Everything will be rushed to you by first class mail. Sincerely, Brian Crawford P.S. I've just added some great new information to the book. Some people are already making as much as $3000 a week with a new program that lets them work in the comfort of their own home. It costs nothing to get started and anyone can do it. It's like nothing I have ever seen before, and it is sure to make people a lot of money. Details will be rushed to you along with your book order. Please Print and Mail This Order Form to: cut here ------------------------------------------------------------------------------------------------- ANP #MP11 c/o Brian Crawford P.O. Box 712102 Santee, CA 92072-2102 ( ) Yes, I would love to get started immediately. Please rush me "The Home Workers Survival Guide" under your unlimited two month guarantee. Enclosed is $29.95 plus $3.00 shipping and handling.* $32.95 total. *Checks may be made payable to ANP Name____________________________________________ Address___________________________________________ City, State, Zip_____________________________________ Internal Code [E8SB(c)120] ------------------------------------------------------------------------------------------------- cut here

1 0

Re: (eternity) Eternity as a secure filesystem/backup medium (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sun, 18 Jan 1998 22:00:24 -0800 > From: Bill Stewart <bill.stewart(a)pobox.com> > Subject: Re: (eternity) Eternity as a secure filesystem/backup medium > (fwd) > Assume the existence of a for-profit service provider. > The service provider needs to cover the costs of the service, Which in general are a flat rate. I'll try to fill in the various issues you raise with as real-world numbers as I can get. > plus enough profit to make the effort interesting. > The prices charged need to reflect the costs (or be higher) > or the service provider can't make money and goes out of business. > So what are the costs, and who can be talked into paying for them? Everyone who uses the system. The question is who do we want to define as 'using'. I believe the provider of information is not 'using' the system in the strictest sense but rather making an investment of their time and effort in somebodies elses business model and hoping that work will bring them profit. > 1) Storage of information - Storage currently costs < $1/MB for raw disk, > and getting cheaper by the minute, Assuming your 5 year plan, a 1G drive costs $100 or less. That's roughly $20/G-yr. > but sysadmins, lawyers, etc. > cost money and they're not getting cheaper as fast. Granted, but except for the sys-admin you don't need them often. In all the years I have been in business I've needed a lawyer only a couple of times. Say $1k/lawyer-year. > The costs of the equipment for permanent storage are probably about > 10-50% more than the costs for storing for 5 years; A Cyrix P200 runs about $600 for a working box (I bought one just a few weeks ago). So that gives us about $120/cpu-year. > the costs of administration (assuming inflation is limited to > some small number) can be covered by an annuity. For reliable system administartion you're looking at 5 people (3 8-hr. shifts plus weekend coverage of 2 12 hour shifts). A sys admin with the skills and maturity to work in this environment is going to run you in the neighborhood of $40-60k/yr. So this means we're looking at, on the outside, $300k/sysadmin-yr. This is the real cost of doing business. > Every technology upgrade or two you need to copy the archives to > new storage media, and data that doesn't get accessed often may > get migrated out to slower or perhaps even offline media; > storage contracts need to reflect that retrieving data that hasn't > been accessed in a while may involve some delay. Not shure what the normal ratio for online versus offline storage actualy is currently, say 10:1. > 2) Transmission of information - Roughly proportional to MB/time - This seems overly simplistic to me. The actual cost of the bandwidth is reasonably fixed for a given site. Also if we throw in the other servers this model becomes a bit more flexible. Remember, under the Eternity model we don't know *which* server is being hit for the request. This means we have to consider the actual end user costs in a much more complicated fashion. It's one of the issue I'm working on myself. It does not seem clear cut nor well researched at all. > unlike storage, this one's not predictable, unless the provider and > author agree in advance (e.g. N free accesses per year, per password.) > So the provider could charge the reader for access, I fail to see the profit in giving away plans for man portable nukes or to turn commen cooking yeast into a THC producing horde when the various groups around the world would pay so many millions (or would that be billions) for some to get it and some to keep others from getting it. The potential for a access auction hasn't been explored as far as I am aware. > or use advertising > banners to fund retrieval costs (if that remains a valid model > for financing the web over the next N years, especially if the > readers retrieve data through anonymizers.) I believe advertising would be a necessity. The question is how. Would the payoff for doing a print ad in a magazine be worth it? Should it only be advertised on the net? > 3) Legal defense - This one's harder to predict :-) If the Eternity model works the question becomes which one and where are they located? Whose legal defense? Which jurisdiction? Put up an offer for 1 weeks notice of any pending legal actions against the network and make it worth the while. Say $500M. It would of course be fully anonymous and the information would have to be testable prior to payout. Leaves two option. First, the data is verified and the source is paid. Second, the server goes down and the source isn't paid - thus ruining the reputation of a server. It isn't clear to me what the total impact would be on the network as a whole. One way to mediate this impact on a given server would be to share the cost of the payout between the various servers. It is after all in all the servers best interest to keep as many going unharrassed and as well prepared and for-warned as possible. > The current US climate is that service providers are relatively immune > as long as they cooperate with subpoenas and court orders, True, but the current model doesn't allow anonymous providers as the norm either. The users may be anonymous but the ISP isn't. > If they want their names known, they can include them in the contents > of the data that readers retrieve, independent of what the server does. Then there is no reason to use an anonymous network, simply put the data on their own webpage and sell it direct, cut out the middle-man a tried and true business tactic. > and accumulate reputation capital under those nyms. One of the assumptions is that the source, individual server, and sink are all anonymous to each other as well as Mallet. Now we're changing the rules of the game in the middle of the game. Apples and oranges. If I were actualy going to impliment something like this I wouldn't even consider it unless I had at least $500k worth of funding for each of the first 5 years. That start up cost, $2.5M, is what is going to kill it. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

[Long] How to recover private keys for various Microsoft products
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

How to recover private keys for Microsoft Internet Explorer, Internet Information Server, Outlook Express, and many others - or - Where do your encryption keys want to go today? Peter Gutmann, <pgut001(a)cs.auckland.ac.nz> Summary ------- Microsoft uses two different file formats to protect users private keys, the original (unnamed) format which was used in older versions of MSIE, IIS, and other software and which is still supported for backwards-compatibility reasons in newer versions, and the newer PFX/PKCS #12 format. Due to a number of design and implementation flaws in Microsofts software, it is possible to break the security of both of these formats and recover users private keys, often in a matter of seconds. In addition, a major security hole in Microsofts CryptoAPI means that many keys can be recovered without even needing to break the encryption. These attacks do not rely for their success on the presence of weak, US-exportable encryption, they also affect US versions. As a result of these flaws, no Microsoft internet product is capable of protecting a users keys from hostile attack. By combining the attacks described below with widely-publicised bugs in MSIE which allow hostile sites to read the contents of users hard drives or with an ActiveX control, a victim can have their private key sucked off their machine and the encryption which "protects" it broken at a remote site without their knowledge. Once an attacker has obtained a users private key in this manner, they have effectively stolen their (digitial) identity, and can use it to digitally sign contracts and agreements, to recover every encryption session key it's ever protected in the past and will ever protect in the future, to access private and confidential email, and so on and so on. The ease with which this attack can be carried out represents a critical weakness which compromises all other encryption components on web servers and browsers - once the private key is compromised, all security services which depend on it are also compromised. A really clever attacker might even do the following: - Use (say) an MSIE bug to steal someones ActiveX code signing key. - Decrypt it using one of the attacks described below. - Use it to sign an ActiveX control which steals other peoples keys. - Put it on a web page and wait. On the remote chance that the ActiveX control is discovered (which is extremely unlikely, since it runs and deletes itself almost instantly, and can't be stopped even with the highest "security" setting in MSIE), the attack will be blamed on the person the key was stolen from rather than the real attacker. This demonstrates major problems in both Microsoft's private key security (an attacker can decrypt, and therefore misuse, your private key), and ActiveX security (an attacker can create an effectively unstoppable malicious ActiveX control and, on the remote chance that it's ever discovered, ensure that someone else takes the blame). Background ---------- About a year ago I posted an article on how to break Netscape's (then) server key encryption to the cypherpunks list (Netscape corrected this problem at about the same time as I posted the article). However more than a year after the code was published, and 2 1/2 years after a similar problem with Windows .PWL file encryption was publicised, Microsoft are still using exactly the same weak, easily-broken data format to "protect" users private keys. To break this format I simply dusted off my year-old software, changed the "Netscape" strings to "Microsoft", and had an encryption-breaker which would recover most private keys "protected" with this format in a matter of seconds. In addition to the older format, newer Microsoft products also support the PKCS #12 format (which they originally called PFX), which Microsoft render as useless as the older format by employing the RC2 cipher with a 40-bit key. In a truly egalitarian manner, this same level of "security" is used worldwide, ensuring that even US users get no security whatsoever when storing their private keys. However even RC2/40 can take awhile to break (the exact definition of "a while" depends on how much computing power you have available, for most non-funded attackers it ranges from a few hours to a few days). Fortunately, there are enough design flaws in PKCS #12 and bugs in Microsofts implementation to ensure that we can ignore the encryption key size. This has the useful - to an attacker - side-effect that even if Microsoft switch to using RC2/128 or triple DES for the encryption, it doesn't make the attackers task any more difficult. By combining the code to break the PKCS #12 format with the code mentioned above which breaks the older format, we obtain a single program which, when run on either type of key file, should be able to recover the users private keys from most files in a matter of seconds. A (somewhat limited) example of this type of program is available in source code form from http://www.cs.auckland.ac.nz/~pgut001/pubs/breakms.c. Because it's meant as a proof-of-concept program it's somewhat crude, and restricted to recovering passwords which are single dictionary words. Note: This does not mean that using (say) two words as a password instead of one will protect your private key. All it means is that I haven't bothered to write anything more sophisticated - no doubt anyone who was serious about this could adapt something like cracklib's password-generation rules and routines to provide a more comprehensive and powerful type of attack. Similarly, by making trivial changes to the key file data format it's possible to fool the program until someone makes an equally trivial change to the program to track the format change - this is meant as a demonstrator only, not a do-everything encryption breaker. To use the program, compile and invoke it with: breakms <Microsoft key file> <word list file> Here's what the output should look like (some of the lines have been trimmed a bit): File is a PFX/PKCS #12 key file. Encrypted data is 1048 bytes long. The password which was used to encrypt this Microsoft PFX/PKCS #12 file is 'orthogonality'. Modulus = 00BB6FE79432CC6EA2D8F970675A5A87BFBE1AFF0BE63E879F2AFFB93644D [...] Public exponent = 010001 Private exponent = 6F05EAD2F27FFAEC84BEC360C4B928FD5F3A9865D0FCAAD291E2 [...] Prime 1 = 00F3929B9435608F8A22C208D86795271D54EBDFB09DDEF539AB083DA912D [...] Prime 2 = 00C50016F89DFF2561347ED1186A46E150E28BF2D0F539A1594BBD7FE4674 [...] Exponent 1 = 009E7D4326C924AFC1DEA40B45650134966D6F9DFA3A7F9D698CD4ABEA [...] Exponent 2 = 00BA84003BB95355AFB7C50DF140C60513D0BA51D637272E355E397779 [...] Coefficient = 30B9E4F2AFA5AC679F920FC83F1F2DF1BAF1779CF989447FABC2F5628 [...] Someone sent me a test Microsoft key they had created with MSIE 3.0 and the program took just a few seconds to recover the password used to encrypt the file. One excuse offered by Microsoft is that Windows NT has access control lists (ACL's) for files which can be used to protect against this attacks and the one described below. However this isn't notably useful: Most users will be running Windows '95 which doesn't have ACL's, of the small remainder using NT most won't bother setting the ACL's, and in any case since the attack is coming from software running as the current user (who has full access to the file), the ACL's have no effect. The ACL issue is merely a red herring, and offers no further protection. Further Attacks (information provided by Steve Henson <shenson(a)bigfoot.com>) --------------- There is a further attack possible which works because Microsoft's security products rely on the presence of the Microsoft CryptoAPI, which has a wonderful function called CryptExportKey(). This function hands over a users private key to anyone who asks for it. The key is encrypted under the current user, so any other program running under the user can obtain their private key with a single function call. For example an ActiveX control on a web page could ask for the current users key, ship it out to a remote site, and then delete itself from the system leaving no trace of what happened, a bit like the mail.exe program I wrote about 2 years ago which did the same thing for Windows passwords. If the control is signed, there's no way to stop it from running even with the highest security level selected in MSIE, and since it immediately erases all traces of its existence the code signing is worthless. Newer versions of the CryptoAPI which come with MSIE 4 allow the user to set a flag (CRYPT_USER_PROTECTED) which specifies that the key export function should be protected with no protection (the default), user notification, or password protection. However the way this is implemented makes it pretty much useless. Firstly, if the certificate request script used to generate the key doesn't set this flag, you end up with the default of "no protection" (and the majority of users will just use the default of "no protection" anyway). Although Microsoft claim that "reputable CA's won't forget to set this flag", a number of CA's tested (including Verisign) don't bother to set it (does this mean that Microsoft regard Verisign as a disreputable CA? :-). Because of this, they don't even provide the user with the option of selecting something other than "no security whatsoever". In addition at least one version of CryptoAPI would allow the "user notification" level of security to be bypassed by deleting the notification dialog resource from memory so that the call would quietly fail and the key would be exported anyway (this is fairly tricky to do and involves playing with the CPU's page protection mechanism, there are easier ways to get the key than this). Finally, the "password protection" level of security asks for the password a whopping 16 (yes, *sixteen*) times when exporting the key, even though it only needs to do this once. After about the fifth time the user will probably click on the "remember password" box, moving them back to zero security until they reboot the machine and clear the setting, since the key will be exported with no notification or password check once the box is clicked. To check which level of security you have, try exporting your key certificate. If there's no warning/password dialog, you have zero security for your key, and don't even need to use the encryption-breaking technique I describe elsewhere in this article. Any web page you browse could be stealing your key (through an embedded ActiveX control) without you ever being aware of it. Details on Breaking the Older Format ------------------------------------ The Microsoft key format is very susceptible to both a dictionary attack and to keystream recovery. It uses the PKCS #8 format for private keys, which provides a large amount of known plaintext at the start of the data, in combination with RC4 without any form of IV or other preprocessing (even though PKCS #8 recommends that PKCS #5 password-based encryption be used), which means you can recover the first 100-odd bytes of key stream with a simple XOR (the same mistake they made with their .PWL files, which was publicised 2 1/2 years earlier). Although the password is hashed with MD5 (allowing them to claim the use of a 128-bit key), the way the key is applied provides almost no security. This means two things: 1. It's very simple to write a program to perform a dictionary attack on the server key (it originally took me about half an hour using cryptlib, http://www.cs.auckland.ac.nz/~pgut001/cryptlib/, another half hour to rip the appropriate code out of cryptlib to create a standalone program, and a few minutes to retarget the program from Netscape to Microsoft). 2. The recovered key stream from the encrypted server key can be used to decrypt any other resource encrypted with the server password, *without knowing the password*. This is because there's enough known plaintext (ASN.1 objects, object identifiers, and public key components) at the start of the encrypted data to recover large quantities of key stream. This means that even if you use a million-bit encryption key, an attacker can still recover at least the first 100 bytes of anything you encrypt without needing to know your key (Frank Stevenson's glide.exe program uses this to recover passwords from Windows .PWL files in a fraction of a second). The problem here is caused by a combination of the PKCS #8 format (which is rather nonoptimal for protecting private keys) and the use of RC4 to encryt fixed, known plaintext. Since everything is constant, you don't even need to run the password-transformation process more than once - just store a dictionary of the resulting key stream for each password in a database, and you can break the encryption with a single lookup (this would be avoided by the use of PKCS #5 password-based encryption, which iterates the key setup and uses a salt to make a precomputed dictionary attack impossible. PKCS #5 states that its primary intended application is for protecting private keys, but Microsoft (and Netscape) chose not to use this and went with straight RC4 encryption instead). This is exactly the same problem which came up with Microsoft's .PWL file encryption in 1995, and yet in the 2 1/2 years since I exposed this problem they still haven't learnt from their previous mistakes. For the curious (and ASN.1-aware), here's what the data formats look like. First there's the outer encapsulation which Microsoft use to wrap up the encrypted key: MicrosoftKey ::= SEQUENCE { identifier OCTET STRING ('private-key'), encryptedPrivateKeyInfo EncryptedPrivateKeyInfo } Inside this is a PKCS #8 private key: EncryptedPrivateKeyInfo ::= SEQUENCE { encryptionAlgorithm EncryptionAlgorithmIdentifier, encryptedData EncryptedData } EncryptionAlgorithmIdentifier ::= AlgorithmIdentifier EncryptedData = OCTET STRING Now the EncryptionAlgorithmIdentifier is supposed to be something like pbeWithMD5AndDES, with an associated 64-bit salt and iteration count, but Microsoft (and Netscape) ignored this and used straight rc4 with no salt or iteration count. The EncryptedData decrypts to: PrivateKeyInfo ::= SEQUENCE { version Version privateKeyAlgorithm PrivateKeyAlgorithmIdentifier privateKey PrivateKey attributes [ 0 ] IMPLICIT Attributes OPTIONAL } Version ::= INTEGER PrivateKeyAlgorithmIdentifier ::= AlgorithmIdentifier PrivateKey ::= OCTET STRING Attributes ::= SET OF Attribute (and so on and so on, I haven't bothered going down any further). One thing worth noting is that Microsoft encode the AlgorithmIdentifier incorrectly by omitting the parameters, these should be encoded as a NULL value if there are no parameters. In this they differ from Netscape, indicating that both companies managed to independently come up with the same broken key storage format. Wow. For people picking apart the inner key, Microsoft also encode their ASN.1 INTEGERs incorrectly, so you need to be aware of this when reading out the data. Details on Breaking the PFX/PKCS #12 Format ------------------------------------------- The PFX/PKCS #12 format is vastly more complex (and braindamaged) than the older format. You can find an overview of some of the bletcherousness in this format at http://www.cs.auckland.ac.nz/~pgut001/pfx.html. After Microsoft originally designed the format (calling it PFX) and presented it to the world as a fait accompli, cleanup crews from other companies rushed in and fixed some of the worst problems and security flaws. However by this time Microsoft had already shipped implementations which were based on the earlier version with all its flaws and holes, and didn't want to change their code any more. A side-effect of this was that to be compatible, other vendors had to copy Microsofts bugs rather than produce an implementation in accordance with the standard. Newer versions of the standard have now been amended to define the implementation bugs as a part of the standard. Anyway, as a result of this it's possible to mount three independant types of attack on Microsoft's PFX/PKCS #12 keys: 1. Attack the RC2/40 encryption used in all versions, even the US-only one. 2. Attack the MAC used to protect the entire file. Since the same password is used for the MAC and the encrypted key, recovering the MAC password also recovers the password used to encrypt the private key. The cleanup crews added a MAC iteration count to make this attack harder, but Microsoft ignored it. 3. Attack the private key encryption key directly. Like the MAC's, this also has an interation count. Microsoft don't use it. Even if one of these flaws is fixed, an attacker can simply switch over and concentrate on a different flaw. I decided to see which one could be implemented the most efficiently. Obviously (1) was out (you need to perform 2^39 RC2 key schedules on average to find the key), which left (2) and (3). With the refinements I'm about to describe, it turns out that an attack on the private key encryption is significantly more efficient than an attack on the MAC. To understand how the attack works, you need to look at how PKCS #12 does its key processing. The original PFX spec included only some very vague thoughts on how to do this. In later PKCS #12 versions this evolved into a somewhat garbled offshoot of the PKCS #5 and TLS key processing methods. To decrypt data which is "protected" using the PKCS #12 key processing, you need to do the following: construct a 64-byte "diversifier" (which differs depending on whether you want to set up a key or an IV) and hash it; stretch the salt out to 64 bytes and hash it after the diversifier hash; stretch the password out to 64 bytes (using incorrect processing of the text string, this is one of Microsofts implementation bugs which has now become enshrined in the standard) and hash it after the salt hash; complete the hash and return the resulting value as either the key or the IV, depending on the diversifier setting; (it's actually rather more complex than that, this is a stripped-down version which is equivalent to what Microsoft use). This process is carried out twice, once for the key and once for the IV. The hashing is performed using SHA-1, and each of the two invocations of the process require 4 passes through the SHA-1 compression function, for a total of 8 passes through the function. Because the PKCS #12 spec conveniently requires that all data be stretched out to 64 bytes, which happens to be the data block size for SHA-1, there's no need for the input processing which is usually required for SHA-1 so we can strip this code out and feed the data directly into the compression function. Thus the compression function (along with the RC2 key setup) is the limiting factor for the speed of an attack. Obviously we want to reduce the effort required as much as possible. As it turns out, we can eliminate 6 of the 8 passes, cutting our workload by 75%. First, we observe that the the diversifier is a constant value, so instead of setting it up and hashing it, we precompute the hash and store the hash value. This eliminates the diversifier, and one pass through SHA-1. Next, we observe that the salt never changes for the file being attacked, so again instead of setting it up and hashing it, we precompute the hash and store the hash value. This eliminates the diversifier, and another pass through SHA-1. Finally, all that's left is the password. This requires two passes through the compression function, one for the password (again conveniently stretched to 64 bytes) and a second one to wrap up the hashing. In theory we'd need to repeat this process twice, once to generate the decryption key and a second time to generate the decryption IV which is used to encrypt the data in CBC mode. However the start of the decrypted plaintext is: SEQUENCE { SEQUENCE { OBJECT IDENTIFIER, ... and the SEQUENCE is encoded as 30 82 xx xx (where xx xx are the length bytes). This means the first 8 bytes will be 30 82 xx xx 30 82 xx xx, and will be followed by the object identifier. We can therefore skip the first 8 bytes and, using them as the IV, decrypt the second 8 bytes and check for the object identifier. This eliminates the second PKCS #12 key initialisation call which is normally required to generate the IV. As this analysis (and the program) shows, Microsoft managed to design a "security" format in which you can eliminate 75% of the encryption processing work while still allowing an attack on the encrypted data. To make it even easier for an attacker, they then dumbed the key down to only 40 bits, even in the US-only version of the software. In fact this doesn't really have any effect on security, even if they used 128-bit RC2 or triple DES or whatever, it would provide no extra security thanks to the broken key processing.

5 5

Intel, MS, & Compaq to boost Inet access x30 w/ new modem [CNN]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > > REPORT: VENTURE PROMISES SPEEDIER INTERNET ACCESS > > Internet graphic January 20, 1998 > Web posted at: 9:21 a.m. EST (1421 GMT) > > NEW YORK (AP) -- Lightning-quick Internet access is in the works > under a reported new venture between three titans of the computer > industry and most local telephone companies. > > Executives at Intel, Compaq Computer and Microsoft said in The New > York Times on Tuesday that they want to develop a new type of > personal computer modem that would allow access to World Wide Web > pages at speeds 30 times faster than the usual several seconds to > minutes it now takes. > > Perhaps more important, the product would plug into normal telephone > lines, which would remain connected to the outside world. > Consequently, users would not need to dial a service and could > conduct normal voice conversations over the same line, the Times > said. > [text deleted] ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

China's New Net Regs
by John Young 17 Dec '03

17 Dec '03

Thanks to MK we offer the new Chinese net regulations as published by the US Embassy in Beijing: http://jya.com/cn-netreg.htm

1 0

Re: Your local phone company (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Hi, Ooops, I needed to do some editing that I missed....sorry for the confusion. > that base 4800 baud. Faxes get the 9600 because they use dual-tones, neither > of which is above the 4800. The problem with shoving more tones is that afer I should have changed all those 4800's to 1200's. I couldn't remember which one so I had picked one distinct from the example provided by ya'll and missed changing it to the correct value per the references. I got sloppy. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0