- cypherpunks-legacy - lists.cpunks.org

Re: MSIE cryptography
by Peter Trei 17 Dec '03

17 Dec '03

John Hemming - CEO MarketNet" <johnhemming(a)mkn.co.uk> writes: > Just downloaded the most recent English Version 2.1 for Windows 3.1. > This does appear to do the same in terms of no encryption at all after > the server hello. > > To be fair to Microsoft the number of cycles performed for the private key > echange is quite high. Therefore, not having any key and not doing the > RSA calculations makes the access quite a bit faster. > > The older versions (and some Win95 versions) that we have found around > seem to just crash our server. I am not really feeling like debugging that. I understand that some versions of MSIE support SSL level 3. SSL3 includes a capability to switch 'cipher suites' in mid-session, or pick one at the start of the session. One of the standard cipher suites performs authentication, but not encryption. This is consistant with your description. Please ensure that the server you are connecting to is not configured for authenticate-only. It would be a pity to raise a big ruckus over what may be just a mis-configured server. Peter Trei trei(a)process.com

2 1

Re: MSIE cryptography
by John Hemming - CEO MarketNet 17 Dec '03

17 Dec '03

>> Just downloaded the most recent English Version 2.1 for Windows 3.1. >> This does appear to do the same in terms of no encryption at all after >> the server hello. >I understand that some versions of MSIE support SSL level 3. SSL3 includes a >capability to switch 'cipher suites' in mid-session, or pick one at the start of the >session. One of the standard cipher suites performs authentication, but not >encryption. This is consistant with your description. >Please ensure that the server you are connecting to is not configured for >authenticate-only. It would be a pity to raise a big ruckus over what may be >just a mis-configured server. The server is one which interoperates correctly with Netscape and my own routines. It does strike me that this change is potentially the source of the bug. However, to have a "locked" symbol on the bottom right hand of the display would indicate to me as a user that a secure session has occurred. For SSL devotees the records sent are: 1. Client hello (from the client) 2. Server hello (from the server). 3. Plaintext data packaged up in SSL records from the client. 4. The client then accepts plaintext data packaged up in SSL records. SERVER_VERSION_MSB and SERVER_VERSION_LSB indicate version 2 of SSL. I have not changed the code in any way to deal with version 3 of SSL making I think the valid presumption that browsers using 3 and 2 should be able to cope with a server using 2. I shall reboot my system, trace a bit of a session and post that.

1 0

Re: MSIE cryptography
by John Hemming - CEO MarketNet 17 Dec '03

17 Dec '03

For the real SSL devotees here are the first three transmissions. Client Hello 16.8 1025->443 seq 00000001 ack 00000001 PSH ACK wind 4096 data 30 80 1C 01 00 02 00 03 00 00 00 10 02 00 80 69 AE 0E F0 FA 2E 01 63 BC 59 AF 0F 1C C1 B1 7B 16.8 443->1025 seq 00000001 ack 0000001F PSH ACK wind 5640 data 590 Server Hello 82 4C 04 00 01 00 02 02 2E 00 03 00 10 (cert starts) 30 82 02 2A 30 82 01 93 02 05 26 FB 85 54 3F 30 0D 06 09 big snip of server hello (of the certificate) CC 1F BC A8 9C D7 47 41 D2 33 27 (cert has ended) 02 00 80 4A E7 13 36 E4 4B F9 BF 79 D2 75 2E 23 48 18 A5 16.9 1025->443 seq 0000001F ack 0000024F PSH ACK wind 4096 data 333 Client Master Key should be here, but instead we get 81 4B 47 45 54 20 2F 20 48 54 54 50 2F 31 2E 30 G E T sp / sp H T T P / 1 . 0 0D 0A 41 63 63 65 70 74 3A 20 2A 2F 2A 2C 20 71 Server Hello 82 4C 04 00 01 00 02 02 2E 00 03 00 10 (cert starts) 30 82 02 82 4C - SSL RECORD 04 - Server Hello 00 - Session ID Hit (no prior session) 01 - Certificate Type 00 - Server Version MSB 02 - Server Verson LSB (ie server version of SSL is 2) 02 2E - Certificate length (mainly snipped) 00 03 - Cipher specs length 00 10 - Connection ID length I think the probability is that the unusual circumstance that causes what seems clear to me as an error is that the cert is signed by a CA other than Verisign. Essentially, however, I do not think it is right for a program to display a locked key regardless of any other issues if the data being transferred is not encrypted.

1 0

Re: MSIE cryptography
by John Hemming - CEO MarketNet 17 Dec '03

17 Dec '03

Eric Murray writes: >Peter Trei writes: >> >> John Hemming - CEO MarketNet" <johnhemming(a)mkn.co.uk> writes: > >> > Just downloaded the most recent English Version 2.1 for Windows 3.1. >> > This does appear to do the same in terms of no encryption at all after >> > the server hello. >> Please ensure that the server you are connecting to is not configured for >> authenticate-only. It would be a pity to raise a big ruckus over what may be >> just a mis-configured server. >In addition, encryption isn't performed until after the ClientFinished >and ServerFinished messages, no matter which CipherSuites are negotiated. Actually the server verify message should be encrypted (to verify the key negotiation). Also the server and client finished should be encrypted. I don't actually get the client finished record or client master key record. However, I don't get those all I get is the cleartext data in packets of SSL record format. I have done a little more experimentation and it does appear quite clear that this happens with a non standard (ie not Verisign and a few others) X509 Certificate. In the trace that I have posted it is clear that cypher 02 00 80 has in theory been negotiated.

1 0

the anonymizer
by bf578＠scn.org 17 Dec '03

17 Dec '03

Does anybody know if there are any other services like the one at http://www.anonymizer.com That anonymize your surfing? -- ------------------------------------------ There are no facts, only interpretations. I always wanted to be somebody,

1 0

Re: (fwd) Email Robot draws fire from CypherPunkz
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Fri, 13 Sep 1996 09:02:19 -0700 (PDT), Declan McCullagh wrote: >The Cypherpunks gang has apparently attacked a San Francisco artist's ^^^^ No wonder the Feds want to close us down. Look at all the dangerous things we've done this week: 1. Shot the bull 2. (see #1) 3. (see #1) et cetra # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # cadams(a)acucobol.com | V.M. (619)515-4894 "I have never been able to figure out why anyone would want to play games on a computer in any case when the whole system is a game. Word processing, spreadsheets, telecoms -- it's all a game. And they pay you to play it." -- Duncan Frissell

1 0

Re: 56 kbps modems
by Bill Stewart 17 Dec '03

17 Dec '03

>On Mon, 16 Sep 1996, Jay Gairson wrote: >> Speaking of ISDN, how many people, can afford to have a personal ISDN >> line in there house? And then afford to connect to something/someone >> else on a next to permanent basis monthly? It's Phone Company Dependent. Here in Pac Bell territory, an ISDN phone line costs about 2.5 analog phone lines, and gets you two phone lines plus some signalling. Connection costs are free at night, and 1 cent/minute daytime. That may change - the phone company is appalled that all these computer people interpret the phrase "free at night" as meaning "it's _free_ at night", so their holding time predictions were bogus :-) Night is defined as 7pm-7am for ISDN. ISDN-equipped ISPs start at about $30/month; don't know if that's unlimited connect time or not. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

2 1

Re: J'accuse!: Whitehouse and NSA vs. Panix and VTW
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Fri, 13 Sep 1996 11:33:09 -0700, stewarts(a)ix.netcom.com wrote: >Anybody for an Internet Driver's License? *Surfer's* license. The newsies love to refer to "net surfing", because to the highly unknowledgable reader it makes it sound as if they have a clue about what they're writing on. # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # cadams(a)acucobol.com | V.M. (619)515-4894 "I have never been able to figure out why anyone would want to play games on a computer in any case when the whole system is a game. Word processing, spreadsheets, telecoms -- it's all a game. And they pay you to play it." -- Duncan Frissell

1 0

Re: SPL -- Suspicious Persons List
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Sat, 14 Sep 96 17:36:49 EDT, Dr.Dimitri Vulis KOTM wrote: >> unjust if the company was bought out and the new owner decided to sack >> all black people and people called "Perry". You were the one who brought >> up the issue of fairness. >The owner should be able to do that without interference from any gubment. Yes. If they manage to survive economically while snubbing a productive chunk of the general population in addition to a loon, good for them. If their product still sells, inspite of negative publicity it's probably the market leader. OTOH, I think there should be some basic safeguards against the formation of 'company towns' or similar constructs. A free market is rarely a given. # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # cadams(a)acucobol.com | V.M. (619)515-4894 "I have never been able to figure out why anyone would want to play games on a computer in any case when the whole system is a game. Word processing, spreadsheets, telecoms -- it's all a game. And they pay you to play it." -- Duncan Frissell

1 0

Electronic cash, not letter boxes, stupid (darkside) hackers
by Declan McCullagh 17 Dec '03

17 Dec '03

9/16/96 HAMBURG, Germany (Reuter) - A German student who used the Internet for long-distance theft of computer data from a U.S. company was arrested and charged with extortion for demanding ransom for the return of the data, police said Monday. The student, from the city of Muenster in northern Germany, sent the ransom letter through electronic mail (e-mail), demanding that the firm pay $30,000 to a letter box in a Hamburg post office. Police declined to identify the company. A police spokesman said the student and two accomplices had illegally logged into its computers and stolen the data. Police said they were waiting at the letter box and detained a 19-year-old, who later led them to the 26-year-old ringleader.

1 0