- cypherpunks-legacy - lists.cpunks.org

Re: MSIE cryptography
by Peter Trei 17 Dec '03

17 Dec '03

John Hemming - CEO MarketNet" <johnhemming(a)mkn.co.uk> writes: > Just downloaded the most recent English Version 2.1 for Windows 3.1. > This does appear to do the same in terms of no encryption at all after > the server hello. > > To be fair to Microsoft the number of cycles performed for the private key > echange is quite high. Therefore, not having any key and not doing the > RSA calculations makes the access quite a bit faster. > > The older versions (and some Win95 versions) that we have found around > seem to just crash our server. I am not really feeling like debugging that. I understand that some versions of MSIE support SSL level 3. SSL3 includes a capability to switch 'cipher suites' in mid-session, or pick one at the start of the session. One of the standard cipher suites performs authentication, but not encryption. This is consistant with your description. Please ensure that the server you are connecting to is not configured for authenticate-only. It would be a pity to raise a big ruckus over what may be just a mis-configured server. Peter Trei trei(a)process.com

2 1

Re: MSIE cryptography
by John Hemming - CEO MarketNet 17 Dec '03

17 Dec '03

>> Just downloaded the most recent English Version 2.1 for Windows 3.1. >> This does appear to do the same in terms of no encryption at all after >> the server hello. >I understand that some versions of MSIE support SSL level 3. SSL3 includes a >capability to switch 'cipher suites' in mid-session, or pick one at the start of the >session. One of the standard cipher suites performs authentication, but not >encryption. This is consistant with your description. >Please ensure that the server you are connecting to is not configured for >authenticate-only. It would be a pity to raise a big ruckus over what may be >just a mis-configured server. The server is one which interoperates correctly with Netscape and my own routines. It does strike me that this change is potentially the source of the bug. However, to have a "locked" symbol on the bottom right hand of the display would indicate to me as a user that a secure session has occurred. For SSL devotees the records sent are: 1. Client hello (from the client) 2. Server hello (from the server). 3. Plaintext data packaged up in SSL records from the client. 4. The client then accepts plaintext data packaged up in SSL records. SERVER_VERSION_MSB and SERVER_VERSION_LSB indicate version 2 of SSL. I have not changed the code in any way to deal with version 3 of SSL making I think the valid presumption that browsers using 3 and 2 should be able to cope with a server using 2. I shall reboot my system, trace a bit of a session and post that.

1 0

Re: MSIE cryptography
by John Hemming - CEO MarketNet 17 Dec '03

17 Dec '03

For the real SSL devotees here are the first three transmissions. Client Hello 16.8 1025->443 seq 00000001 ack 00000001 PSH ACK wind 4096 data 30 80 1C 01 00 02 00 03 00 00 00 10 02 00 80 69 AE 0E F0 FA 2E 01 63 BC 59 AF 0F 1C C1 B1 7B 16.8 443->1025 seq 00000001 ack 0000001F PSH ACK wind 5640 data 590 Server Hello 82 4C 04 00 01 00 02 02 2E 00 03 00 10 (cert starts) 30 82 02 2A 30 82 01 93 02 05 26 FB 85 54 3F 30 0D 06 09 big snip of server hello (of the certificate) CC 1F BC A8 9C D7 47 41 D2 33 27 (cert has ended) 02 00 80 4A E7 13 36 E4 4B F9 BF 79 D2 75 2E 23 48 18 A5 16.9 1025->443 seq 0000001F ack 0000024F PSH ACK wind 4096 data 333 Client Master Key should be here, but instead we get 81 4B 47 45 54 20 2F 20 48 54 54 50 2F 31 2E 30 G E T sp / sp H T T P / 1 . 0 0D 0A 41 63 63 65 70 74 3A 20 2A 2F 2A 2C 20 71 Server Hello 82 4C 04 00 01 00 02 02 2E 00 03 00 10 (cert starts) 30 82 02 82 4C - SSL RECORD 04 - Server Hello 00 - Session ID Hit (no prior session) 01 - Certificate Type 00 - Server Version MSB 02 - Server Verson LSB (ie server version of SSL is 2) 02 2E - Certificate length (mainly snipped) 00 03 - Cipher specs length 00 10 - Connection ID length I think the probability is that the unusual circumstance that causes what seems clear to me as an error is that the cert is signed by a CA other than Verisign. Essentially, however, I do not think it is right for a program to display a locked key regardless of any other issues if the data being transferred is not encrypted.

1 0

Re: MSIE cryptography
by John Hemming - CEO MarketNet 17 Dec '03

17 Dec '03

Eric Murray writes: >Peter Trei writes: >> >> John Hemming - CEO MarketNet" <johnhemming(a)mkn.co.uk> writes: > >> > Just downloaded the most recent English Version 2.1 for Windows 3.1. >> > This does appear to do the same in terms of no encryption at all after >> > the server hello. >> Please ensure that the server you are connecting to is not configured for >> authenticate-only. It would be a pity to raise a big ruckus over what may be >> just a mis-configured server. >In addition, encryption isn't performed until after the ClientFinished >and ServerFinished messages, no matter which CipherSuites are negotiated. Actually the server verify message should be encrypted (to verify the key negotiation). Also the server and client finished should be encrypted. I don't actually get the client finished record or client master key record. However, I don't get those all I get is the cleartext data in packets of SSL record format. I have done a little more experimentation and it does appear quite clear that this happens with a non standard (ie not Verisign and a few others) X509 Certificate. In the trace that I have posted it is clear that cypher 02 00 80 has in theory been negotiated.

1 0

the anonymizer
by bf578＠scn.org 17 Dec '03

17 Dec '03

Does anybody know if there are any other services like the one at http://www.anonymizer.com That anonymize your surfing? -- ------------------------------------------ There are no facts, only interpretations. I always wanted to be somebody,

1 0

Re: Whistleblowing on the Internet
by Bill Stewart 17 Dec '03

17 Dec '03

At 04:02 PM 9/2/96 EDT, "E. ALLEN SMITH" <EALLENSMITH(a)ocelot.Rutgers.EDU> wrote: >There's also the point that some whistleblowing isn't exactly >what some political groups would want to occur. For instance, opponents >to unions such as myself aren't going to want a whistleblower to be able >conveniently to report their exclusion from a job due to union membership. While some unions are clearly run by and for thugs, some employers have also hired thugs to attack union organizers, and both unions and employers have convinced government thugs to attack their opponents, though unions generally have convinced governments to write laws with fines attached, while employers have often had actual Federal troops shooting union strikers, and have had police refrain from defending strikers from attack. In a free market, there wouldn't be laws requiring or forbidding union membership, and some unions would prosper by providing good service to their members and to the employers that hire them, while others wouldn't. I'd be happy to see union members able to anonymously blow the whistle on employers that blacklist union members, though it's harder to be credible with the public if you're anonymous, and particularly hard to get people to believe "Employer MegaFooBar refused to hire [name deleted for privacy], a member of the IBCPARO, because of his union membership" without revealing enough about the union member's identity that the employer knows, and therefore telling all other employers to know that the guy is not only a union member, but also a troublemaker. In this case, the technology is more strongly useful for maintaining blacklists than for detecting or outing blacklist users. Unfortunately, that's especially true because government taxation and anti-immigrant policies require that employees provide employers with a [mostly] unique ID number and papers to prove who they are, so you can't just show up at a construction-workers' hiring hall, call yourself Joe, and get your pay in cash at the end of the day. (Unless you're already an illegal immigrant, in which case it works fine, but then it's tough to be a union member.) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0

Re: Whistleblowing on the Internet
by Bill Stewart 17 Dec '03

17 Dec '03

Geoffrey Gussis wrote: >| Overall, I am quite surprised that there isn't a whistleblowing >| clearinghouse on the Internet; a site sponsored by a non-profit that lists >| email addresses and secure forms for sending anonymized email to those >| areas of the public and private sector that deal with whistleblowing. Alt.whistleblowing was started a while ago, and was probably pretty quiet (not that I've read it in years.) Of the 5 articles there today, one is from Geoffrey Gussis, one is a reply, one has an EPA phone number, one is test, and one is spam. The reply said #> See www.taf.org on the net. #> See www.whistleblowers.com on the net #> In a few weeks, our site will be up, and we are also #> involved in bringing false claims act or whistleblower #> lawsuits. We have one under seal, and three more pending. > Such a clearinghouse is what we call a fat target; something >likely to attract attention since wiretapping it could be very useful >to an organization that worried about having a whistleblower. That kind of wiretapping we can deal with. Forging Usenet headers was easy enough even without anonymous remailers, and chaining encrypted messages through remailers should be adequate, even without the huge mix volume of anon.penet.fi. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0

Re: "Security risks" vs. "credit risks"
by Jean-Francois Avon 17 Dec '03

17 Dec '03

On 31 Aug 96 at 20:53, Igor Chudov @ home wrote: > Airlines, for example, are under tight and rather > arbitrary control of the FAA. Most CPunks have no idea how true this is. Try reading about the Bob Hoover case if you want to learn about FAA's finest actions... jfa

1 0

Re: Los Angeles Times article on Helsingius and anon.penet.fi
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 10:09 PM 9/2/96, Stanton McCandlish wrote: >Also questionably relevant for an issue like this (more relevant perhaps >to intellectual property issues, etc.) The political axis most relevant >here is civil libertarian v. authoritarian. I don't think you'll find >any authoritarians on the EFF board or staff. A civil libertarian would not be speaking about limiting forms of speech to those that are traceable. Anonymous messages are consistent with the First Amendment. Calls for restrictions on anonymity are not consistent with a civil liberties orientation. (As I described in a much longer message earlier today, I can only hope Esther Dyson simply hasn't thought enough about this issue, and about the implications of her calls for "responsible freedom.") --Tim May -- [This Bible excerpt awaiting review under the U.S. Communications Decency Act of 1996] And then Lot said, "I have some mighty fine young virgin daughters. Why don't you boys just come on in and fuck them right here in my house - I'll just watch!"....Later, up in the mountains, the younger daughter said: "Dad's getting old. I say we should fuck him before he's too old to fuck." So the two daughters got him drunk and screwed him all that night. Sure enough, Dad got them pregnant, and had an incestuous bastard son....Onan really hated the idea of doing his brother's wife and getting her pregnant while his brother got all the credit, so he pulled out before he came....Remember, it's not a good idea to have sex with your sister, your brother, your parents, your pet dog, or the farm animals, unless of course God tells you to. [excerpts from the Old Testament, Modern Vernacular Translation, TCM, 1996]

1 0

Re: Los Angeles Times article on Helsingius and anon.penet.fi
by Bill Stewart 17 Dec '03

17 Dec '03

At 08:39 PM 9/2/96 -0800, Jim Bell (who else:-) wrote: >At the risk of sounding like a broken record (a phrase that will get ever >more obscure now that we're in the CD era...) that's why I pushing AP >(Assassination Politics.) In case anybody wonders why there _are_ relatively reasonable people like Esther Dyson who aren't happy with anonymity in spite of not liking the alternative of government control, this sort of thing _is_ one of the reasons :-) You CAN freak ALL the mundanes all the time, but it's not necessarily a good idea..... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0