- cypherpunks-legacy - lists.cpunks.org

Re: Ecash graphic images?
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 20:58 12/28/95, anonymous-remailer(a)shell.portal.com wrote: >Could anyone provide some pointers to a gif or jpeg file containing >good-looking ecash coins? I would like something larger and more >detailed than the "we accept ecash" you see everywhere. Thanks very >much. Try http://www.delorie.com/gif/signs/ -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: And the standard continues to lower...
by Andrew Loewenstern 17 Dec '03

17 Dec '03

Dr. Brian L. Crissey includes in his .sig, courtesy of cactus(a)hks.net [ much WRT YetAnotherSecureInternetCreditCardPaymentSystem(*tm) deleted ] > ***Dr. Brian L. Crissey, Chair CS Dpt, Linfield Col., McMinnville, OR 97128 > (503)-434-2426 brianc(a)linfield.edu > Professionals built the Titanic, amateurs built the Ark... However, the Ark was *designed* by GOD (if you believe the story). Can Dr. Brian L. Crissey say the same thing about his payment system? andrew

1 0

Re: And the standard continues to lower...
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >If the misuse of "One Time Pad" wasn't enough for ya, check out this ad that >I was e-mailed. > >And the chair of a CS department, no less. > >- ------- start of forwarded message (RFC 934 encapsulation) ------- >Subject: Secure No-overhead Online Order System for Publishers >Date: Wed, 13 Dec 1995 12:24:03 -0800 (PST) > >A secure no-overhead online title-ordering system is now available. It may >be viewed in operation at the home page for Blue Water Publishing, a >publisher, software developer and distribution company, at >http://www.bluewaterp.com/~bcrissey/ >or from the online bookstore area of ISCNI, the Institute for the Study of >Contact with Non-Human Intelligence at >http://www.iscni.com > >Blue Water's innovative online ordering system is called SimplySafe. It is >a needle-in-the-haystack approach to online security. It requires no >encryption or secure servers, yet the probability that a dedicated hacker >scanning 100 internet messages a second will intercept a usable credit >card number sent via SimplySafe is less than the probability of picking >our Sun out of the Milky Way. That is less than 1 in 200 billion. Safe >enough for most folks. There are easier ways for a hacker to pick up >credit card numbers than to waste time with SimplySafe transactions. Try >it out! > >SimplySafe currently supports secure online orders from Blue Water >Publishing, Wild Flower Press, Swan-Raven & Co., and ISCNI. >Direct inquiries to >SimpleSafe(a)aol.com > >***Dr. Brian L. Crissey, Chair CS Dpt, Linfield Col., McMinnville, OR 97128 >(503)-434-2426 brianc(a)linfield.edu >Professionals built the Titanic, amateurs built the Ark... The scheme is to send 4 digits of the credit card at a time. The "explanation" follows. >In order to proceed with your SimplySafe® encryption of your credit card >number, please enter the SECOND set of (4) digits of your credit card number: > >In the 41 seconds since you sent your first packet of four digits, >approximately 2869959 packets of information have passed across the internet. >Assuming that a hacker can scan 100 packets of information per second for >credit card information, there is 1 chance in 699 that he has scanned your >first packet of digits. >He is unlikely to have found anything useful. Sigh. Wilhelm Busch -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMM9w94iUi5SQtQ3tAQENnAf6A2SdN+AZGryzJ/eCE/fj+YO71ngQXk8A 2tAomwUqAPmrCll+ucnDc/knsct2VYo4I9b+j84Ah+Gzz6rAu3LKY+joBrgDBmBY j79BOxik6tz9GCdBYDxTQ1BJpwbDAxaQHpNJYgEFryB59yxo4gi9xZbKZnnQv571 uQfuk1rAJbI+ESJK1Wlw8YrT+q8PoW8m5Y1qjBhxczRNaYAENsrVqHsz8L8bEBkW WEfi6wIQpRkB6Fo9hH2HAVamvUwJvDtPgll6U1zBgh/zEs1Jyot3XLV5UHrdL7oM 6FRPD1LW/cWGjUv2YNyv6a3vDFz9LdcCk9eX+gekODzaE+fgeQWI3g== =2n1S -----END PGP SIGNATURE-----

2 1

CryptoLib 1.0 now available
by Matt Blaze 17 Dec '03

17 Dec '03

[Note! This is posted for Jack Lacy; please direct responses to him at cryptolib(a)research.att.com. -matt] Announcing CryptoLib - Release 1.0 12/13/95 Jack Lacy, AT&T Bell Labs CryptoLib is a portable and efficient library of primitives for building cryptographic applications. It runs under most versions of Unix as well as DOS, Windows and Windows-NT (and 95). We are pleased to make CryptoLib source code available without charge to researchers and developers in the US and Canada. (Because of export restrictions on cryptographic software, we are only able to make the software available within the US and Canada to US and Canadian citizens and US permanent residents.) CryptoLib is intended for research and experimental use, and is distributed without warranty or support. In particular, please note the following license conditions: * Copyright (c) 1995 by AT&T. * Permission to use, copy, and modify this software without fee * is hereby granted, provided that this entire notice is included in * all copies of any software which is or includes a copy or * modification of this software and in all copies of the supporting * documentation for such software. * * This software may be subject to export controls. * * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR IMPLIED * WARRANTY. IN PARTICULAR, NEITHER THE AUTHORS NOR AT&T MAKE ANY * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE MERCHANTABILITY * OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR PURPOSE. The attached describes the library and some timing results. To obtain source code send electronic mail to: cryptolib(a)research.att.com with a statement of the following form: "I am a U.S. or Canadian citizen or a legal permanent resident of the U.S. and am aware that some parts of CryptoLib may be restricted under United States export regulations. I have read and understand the CryptoLib license." Name: Location: E-mail: Are you licensed to use the RSA patent? If yes, give name of licensed organization: =============================================================================== CryptoLib includes the following: arbitrary length bignums. bigmath package: bigAdd, bigSubtract, bigMultiply, bgiDivide, bigLeftShift, bigRightShift, bigAnd, bigOr, bigXor, bigCopy, Euclid's extended GCD, modular reduction and exponentiation crypto primitives DES and 3DES + modes Diffie-Hellman DSA (Signing and verification roughly equally efficient) El Gamal Rabin's scheme Random Number generation (PSEUDO and TRUE) MD[2,4,5] Prime generation RSA (provided only if you convince me that you have a license) SHA truerand (For Unix, NT and 95) quantization (Defense against Kocher's timing attack) quantized RSA, DSA and El Gamal private key operations. support functions asn1.c ioutils.c netIface.c Some timing information: All times assume 32X32 bit assembly of multiplication primitives. bigPow times (a^b mod c with a,b,c the same length) 512 bits 1024 bits -------- --------- bigPow 0.12s 0.72s Sparc II Brickell bigpow 0.43s 3.0s Sparc II with asm (gcc) 0.12s 0.78s Sparc 10 with asm 0.03s 0.17s Sparc 10 with asm (Brickell) 0.084s 0.45s SGI Indigo (150MHz) 0.109s 0.75s 100 MHz Pentium (gcc under DOS) Strong Prime Generation -- ProbTestAttempts = 5 100 primes generated in each test. Times below are: (total test time)/100 = avg. time per prime generated. Using Gordon's strong prime algorithm. 256 512 1024 Machine --- --- ---- ------- 2.8s 24.0s 5.11m Sparc II .45s 2.7s 77s 100 MHz pentium RSA Times (64 bit public exponent, message encrypted is full length) --------- 512 768 1024 bits machine --- --- --------- ------- encrypt 30ms 50ms 80ms sparc II decrypt 160ms 480ms 930ms encrypt 15ms 33ms 56ms 100 MHz Pentium (Under NT) decrypt 38ms 104ms 214ms DSA Times --------- 512 768 1024 bits machine --- --- --------- ------- sign 99ms 166ms 216ms sparc II (Brickell speedup) verify 156ms 316ms 416ms sign 21ms 38ms 49ms 100 MHz Pentium (Under NT) verify 27ms 43ms 71ms

2 2

RE Fingerprints and EF Georgia
by WebWarrior3＠InfoWar.Com 17 Dec '03

17 Dec '03

Yup, EF-Georgia http://www.efga.org has had an ongoing project dealing with fingerprinting for DL's This is in reply to Jim Burns' post: "If your interested in this problem, I believe that the Georgia wing of the EFF is mounting a campaign against fingerprinting on driver's licenses. Can't remember the URL for it though..." EF Georgia has consistantly had some mighty fine information on their mail list, still on topic too for the most part. Scott R. Brower Electronic Frontiers Florida http://www.efflorida.org BTW...neither EFGA nor EFFlorida, or as far as I know, any other EF group... is affiliated with EFF in any way but certain principals which bind us together in a common cause.

1 0

Re: e-mail forwarding, for-pay remailers
by Greg Broiles 17 Dec '03

17 Dec '03

E. Allen Smith writes (quoting me): >>netbox.com ( http://www.netbox.com ) provides web pages and E-mail storage >>or forwarding for people; they let you sign up for a trial month for free. >>They ask for name/address/phone (which could easily be a Mailboxes Etc >>address and a voicemail from Mailboxes Etc or whatever) and accept payment >>by check or credit card. >-------------------- > There's one problem with this in regards to the "no necessary >connection," and that 's the governmental requirement for mail forwarding. >MBE and any legal other one will want to see at least two forms of ID >including one photo, and have a form that they fill out using that and >send to the local post office. Anyone have a way around this problem? I spent last summer in San Diego - it took me a couple of weeks to find a place to stay. The first day I was in town I went to an MBE and signed up for a box - showed them my Oregon ID and said "I don't have a local phone # or address because I've been in town only 12 hours. That's what I need you folks for." They cheerfully wrote down the information from the front of my drivers' license (which is 5 years out of date) and gave me a box. They also asked if there would be anyone else who'd be getting mail at my box - I could have specified a business or some roommates. They didn't need to see ID for those - so you're free to name some real or imagined roommates/friends, who might coincidentally sign up for E-mail forwarding. (Or you can just say that "Greg is my real name but John Doe is my trade name, I get mail under that name too." "Trade names" aren't so unusual for people in show business or authors or, I read recently, bill collectors. Apparently they don't want people calling them up at home hassling them. Imagine that. :) ) The folks at the San Diego MBE have been cheerfully forwarding my paper mail back here to Oregon as long as I want to keep paying the postage (plus some sum that they're adding on that's not big enough to pay attention to). It's not the kind of untraceability I'd rely on vis-a-vis a TLA, but it ought to be good enough to keep your posts to alt.sex.forbidden from showing up on your boss' desk via DejaNews, or to allow you to go ahead and piss off part-time fascists who don't have the energy to chase down the paper trail. -- "The anchored mind screwed into me by the psycho- Greg Broiles lubricious thrust of heaven is the one that thinks every temptation, every desire, every inhibition." greg(a)goldenbear.com -- Antonin Artaud gbroiles(a)darkwing.uoregon.edu

1 0

Re: Attacking Clipper with timing info?
by Herb Sutter 17 Dec '03

17 Dec '03

At 20:10 12.13.1995 CST, Loren James Rittle wrote: >If it could be shown that Clipper chips require a fixed amount >of time/current to encode/decode traffic, then we could conclude >one of the following: > >(B1) The NSA knew about the issue and compensated for it. >(B2) The NSA didn't know about the issue and got lucky. > >I discount B2 as a valid option. Actually, if the answer was B1, >my respect for the NSA would creep up a notch. :-) Remember those carefully-chosen S-box numbers for DES and how, years later, how they just happened to turn out to be optimal for defending against the newly-discovered (in non-military circles) technique of differential cryptanalysis... :-) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Herb Sutter (herbs(a)connobj.com) Connected Object Solutions 2228 Urwin - Suite 102 voice 416-618-0184 http://www.connobj.com/ Oakville ON Canada L6L 2T2 fax 905-847-6019

1 0

Timing attack against RSA
by Hal 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Here is how I gather the timing attack against RSA decryption would work. This is the chosen-ciphertext attack of Paul Kocher's. You know n, the public modulus; suppose it is 512 bits. You want to know p and q, its prime factors. You know the details of the server's implementation of RSA. The server will do a decryption of the RSA message you send it, and give you some reply shortly after it is finished. You are going to send it bogus messages. Normally, most random messages will encrypt under RSA to numbers of about 512 bits, but you will send it ciphertext which is about 256 bits long. You are going to try to figure out the value of p. The server's algorithm is to take the ciphertext c, and first do: cp = c mod p cq = c mod q It will then do two modular exponentiations, mod p and mod q, and do a few more calculations, then return some result to you. The attack is to try to choose c to be about the same size as p, with the assumption being that if c is a bit less than p then c mod p will be fast since it doesn't have to do anything, while if c is somewhat larger than p then c mod p will be a little slower, since it will have to at least subtract p from c. Paul Kocher has measured this timing difference as 17 microseconds on one particular implementation. This is not going to be an easy time difference to measure. In addition to doing the c mod p step, the algorithm also does all those other things: the c mod q, the two RSA calculations, as well as whatever overhead is involved in the server's operation and the communication link. The variations due to the RSA calculations themselves will have a standard deviation of about 250 microseconds, based on Paul's numbers (higher than his reported value because two exponentiations are done, plus some other work). So this is a minimum amount of "noise" we must try to see through even if everything else is instantaneous. This might be the situation in the case of a hardwware token which is doing RSA decryptions with a secret key. The first step will be to try to determine the length of p. For this we will send in c values which are around 256 bits long. We might start with some 250 bit values and some 260 bit values, hoping that p is in that range. We do a whole lot of these, and we take the average time for them. If p is between 250 and 260 bits long, then the 260 bit values should take at least 17 microseconds more time to calculate on the average than the 250 bit values. One interesting question is how many samples we would have to take in order to detect this difference. One way to consider it is to ask, given that the samples have a standard deviation of about 250 microseconds, how many samples do we have to take to reliably estimate the mean within an accuracy of about 10 microseconds, or 1/25 of a standard deviation? According to my limited knowledge of statistics, if we want to be right about 90% or 95% of the time, we need to have sqrt(number-of-samples) * 1/25 be > 3, or number-of-samples should be about 5000. (Take this with a large grain of salt!) So we will have to do some thousands of samples in order to average out the noise and get our mean this accurate, with good confidence. Once we have done these tests, we have determined that p is between our two values. Now we can sub-divide the interval and poll with values which are, say, 255 bits long. Again, we would have to do enough polls to determine the true mean time to within about 10 microseconds. After we repeat this three or four times, we will know the bit length of p; in effect, we know its first bit. Now we can continue the divide and bracket procedure. Each time, we must poll many times with c values whose most significant bits are halfway between the two bracketing values which we know contain p. Each such sequence of about 5000 polls yields us one more bit of p. We repeat this about 250 times, and we will have p, from which we can derive q, and we have broken the RSA key. So, taking the estimate above of 5000 or so samples to get a bit of p, we will have to do about a million tests total to find p. (BTW, in Paul's implementation it took about 1/3 second to do a decryption, so you're looking at about 100 days of solid work to do the job.) This algorithm has some self-correcting features but it is not completely so. Suppose p's first bits are actually 1011. We have determined that it is between 1000 and 1100, and we want the 3rd bit. We poll with values which start with 1010, and (since with 90% accuracy we are wrong 10% of the time) we mistakenly conclude that the mean is the higher value, hence that p is less than 1010 and must start as 100X. We continue the procedure, and we will find that our new middle values are consistently less than p, so we gradually work out our estimate as 10011111... Eventually this train of 1's might persuade us that we may have made a mistake back there, so we would go back and poll again to try to verify our earlier results. (Of course, if another mistake happens during the 1's that will confuse us further...) Doing the attack across a network will be much more difficult because there will be a lot more variation in the turnaround time. This will have the effect of increasing the standard deviation far above a quarter millisecond, up by probably at least an order of magnitude if not two or more. Now we have to estimate a mean to within not 1/25, but maybe 1/1000 of a standard deviation, or worse. This would increase the total number of samples necessary from a million up to the level of billions or trillions. One final note: two cases to which we might want to apply this would be Netscape's SSL as implemented by its secure servers, and DigiCash's bank software. (I know Lucky said that DigiCash is immune to this attack, but maybe we would want to test it to see.) In either case, since we are sending a bogus 256 bit value, the data which decrypts will not be valid. In the case of SSL we will probably get an error packet or maybe a broken connection to tell us when it has finished the decryption. In the case of DigiCash, it does not need to do anything with the value it signs other than return it, so we will probably get a return packet. However, it is not valid cash. In order to convince DigiCash to send us this packet, it has to have deducted something from our account, at least a penny. If it takes a billion connections to do the attack (which I think is an underestimate, corresponding to about a 10 millisecond standard deviation on the timing values), that will cost 10 million dollars. So you better have pretty deep pockets to think about mounting this attack in that case. For SSL, misses don't cost you anything, so maybe it would be worth trying, if you have a good, low-latency connection and a server with a light load. The full attack would take too long but just determining the length of p would be quite a coup. Actually of course you would have to do some more research before mounting this attack; specifically, you'd want to know more about the timing of the software so you could estimate the costs of the mod p operation you are trying to catch. If the number ends up being much less than 17 microseconds the attack gets that much harder. Hal -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBVAwUBMM961RnMLJtOy9MBAQFBgAH/WQTMSvRySqNXpfnI4kNXUKQPAleV4NUL ciaDg9VrY8OOJ0cYO8aZ+RnGn+BKp7WFbIkIKFDO3mSE/o9Be2uI7w== =ijGI -----END PGP SIGNATURE-----

1 0

NON_ice
by John Young 17 Dec '03

17 Dec '03

Fueling Asia-phobia of techno-insurrection, The Wash Post today offers opposing views of Singapore: "City of the Future: What American Can Learn form Post- Liberal Singapore;" and, "Big Brother's Hometown: The Country is a Model, All Right -- of Dressed-Up Dictatorship." The first sets out the virtues of paternalism, and quotes eminently powerful Lee Kuan Yew, "The ideas of individual supremacy and the right to free expression, when carried to excess, have not worked. They have made it difficult to keep American society cohesive. Asia can see it is not working. ... The top 3 to 5 percent of a society can handle this free-for-all, this clash of ideas. If you do this with the whole mass, you'll have a mess. In this vein, I say, let them have the Internet." In the second, Lee's own OCAF Agincourt Project is detailed, "I would isolate the leaders, the trouble-makers, get them exposed, cut them down to size, ridicule them, so that everybody understands that it's not such a clever thing to do. Governing does not mean just being pleasant. If you want a pleasant result, just as with children, you cannot just be pleasant and nice." Then there is "Angry, White Rebels are Homeless by Choice," a Page One jaw-dropper about "gutter punks," scion Okies of all America's families: Their appearance and their life-style seem like a nightmare to many of their parents and much of society, as if all the promise of youth in America had been turned inside out, producing these nihilistic, angry, ironic spawn all dressed in black, the end result -- perhaps a bill coming due -- of decades of family disintegration, suburban boredom and national cynicism. Filth has stitched the anarchist patch into the palm of his hand. "Crusty punks" never bathe and say the police cannot make an arrest because of body odor. "I'm a paint head," said Riff Raff, inhaling spray paint. Becca said, "People are afraid of us, but we're not the ones who are scary." Only for the beyond-Singapore, truly loving parent. NON_ice (for all)

1 0

Re: Jim Quinn interview of James Norman (edited)
by Ed Carp (ecarp＠netcom.com) 17 Dec '03

17 Dec '03

> To: ecarp(a)netcom.com > Cc: cypherpunks(a)toad.com > Subject: Re: Jim Quinn interview of James Norman (edited) > Reply-to: perry(a)piermont.com > Date: Tue, 12 Dec 1995 14:53:14 -0500 > From: "Perry E. Metzger" <perry(a)piermont.com> > > According to the headers, you, Mr. Carp, forwarded this to > Cypherpunks, when it was obviously available to those that wanted to > read it on a variety of other mailing lists. > > Please don't continue doing this. > > Jon Roland writes: > > The following is a Radio Interview between James Norman, > > formerly Senior Editor of Forbes Magazine and now with Media > > Bypass Magazine and Jim Quinn, DJ of WRRK 96.9 FM in Pittsburgh. > > In this interview from December 7th, they discuss issues of > > national importance and STUNNING IMPACT. Essentially they give > > out the reason for Vincent Foster's Death, and the fact that > > the "resignations" of the Congresspersons are NOT for policy > > reasons but because they have been caught with millions in > > corrupt funds in Swiss Banks. Read this to learn what the > > "mainstream media" doesn't ever tell you... Unfortunately, even I sometimes hit the wrong button on my mailer.

1 0