- cypherpunks-legacy - lists.cpunks.org

next article?
by bill payne 17 Dec '03

17 Dec '03

False Security William H. Payne Abstract Why 130 million Wiegand cards are in use throughout the world . The most secure of all access card technologies. HID Wiegand cards are virtually impossible to counterfeit... any attempt to alter them destroys them! ... Since no direct contact with the card is required, they are totally enclosed, making them absolutely immune to the elements and a frustration of vandals. ... The secrets to the security of an HID Wiegand card are those little enclosed wire strips. Once corrupted, they won't work. Access Control & SECURITY SYSTEMS INTEGRATION, September 1998 www.prox.com http/www.securitysolutions.com http://www.securitysolutions.com/ Bullshit. Fumble, Bumble and Inept Funds Electronic Lock Breaking at Sandia National Laboratories. Zola http://zolatimes.com/ Would this be worth some bucks? Want another FUN article? http://www.zolatimes.com/v2.29/bw1.html http://www.aci.net/kalliste/bw1 I would need a BRILLIANT EDITOR to help polish the ms. http://www.aci.net/kalliste/ On the other hand, we POSSSIBLY could get this UNFORTUNATE MATTER SETTLED before it gets WORSE. biru copyright bill payne 9/30/98 7:27 PM Counterfeiting Wiegand Wire Access Credentials Bill Payne October 16,1996 Abstract Wiegand wire access credentials are easy and inexpensive to counterfeit. Access Control & Security Systems Integration magazine, October 1996 [http://www/securitysolutions.com] published the article, Wiegand technology stands the test of time by PAUL J. BODELL, page 12 Many card and reader manufacturers offer Wiegand (pronounced wee-gand) output. However, only three companies in the world make Wiegand readers. Sensor Engineering of Hamden Conn., holds the patent for Wiegand, and Sensor has licensed Cardkey of Simi Valley, Calif., and Doduco of Pforzheim, Germany, to manufacture Wiegand cards and readers. ... A Wiegand output reader is not the same thing as a Wiegand reader, and it is important to understand the differences. In brief, Wiegand reader use the Wiegand effect to translate card information around the patented Wiegand effect in which a segment of a specially treated wire generates an electronic pulse when subjected to a specific magnetic field. If the pulse is generated when the wire is near a pick-up coil, the pulse can be detected by a circuit. Lining up several rows of wires and passing them by a cold would generate a series of pulses. Lining up two rows of wires - calling on row "zero bits" and the other "one bits" - and passing them by two different coils would generate two series of pulses, or data bits. These data bits can then be interpreted as binary data and used to control other devices. If you seal the coils in a rugged housing with properly placed magnets, and LED and some simple circuitry, you have a Wiegand reader. Carefully laminate the special wires in vinyl, and artwork, and hot-stamp a number on the vinyl, and you have a Wiegand card. IN THE BEGINNING Wiegand was first to introduce to the access control market in the late 1970s. It was immediately successful because it filled the need for durable, secure card and reader technology. Embedded in the cards, Wiegand wires cannot be altered or duplicated. ... Bodell's Last statement is incorrect. Tasks for EASILY counterfeiting Wiegand wire cards are 1 Locate the wires inside the card to read the 0s and 1s. 2 Build an ACCEPTABLE copy of the card. Bodell's clear explanation of the working of a Wiegand card can be visualized zero row | | | one row | | binary 0 1 0 0 1 representation Solutions to Task 1 A X-ray the card B MAGNI VIEW FILM, Mylar film reads magnetic fields ... Edmunds Scientific Company, catalog 16N1, page 205, C33,447 $11.75 is placed over the top of the Wiegand card. COW MAGNET, Cow magnetics allow farmers to trap metal in the stomachs of their cows. Edmunds, page 204, C31,101 $10.75 is placed under the card. Location of the wires is easily seen on the green film. Mark the position of the wires with a pen. Next chop the card vertically using a shear into about 80/1000s paper-match-sized strips. Don't worry about cutting a wire or two. Note that a 0 has the pen mark to the top. A 1 has the pen mark at the bottom. Take a business card and layout the "paper match"-like strips to counterfeit the card number desired. Don't worry about spacing. Wiegand output is self-clocking! Tape the "paper-match - like" strips to the business card. Only the FUNCTION of the card needs to be reproduced! History Breaking electronic locks was done as "work for others" at Sandia National Laboratories beginning in 1992 funded by the Federal Bureau of Investigation/Engineering Research Facility, Quantico, VA. The FBI opined that this work was SECRET/NATIONAL SECURITY INFORMATION. Details of the consequences of this work are covered in Fired Worker File Lawsuit Against Sandia Specialist Says He Balked When Lab Sought Electronic Picklock Software, Albuquer Journal, Sunday April 25, 1993 State-sanctioned paranoia, EE Times, January 22, 1996 One man's battle, EE Times, March 22, 1994 Damn the torpedoes, EE Times, June 6, 1994 Protecting properly classified info, EE Times, April 11, 1994 DOE to scrutinize fairness in old whistle-blower cases, Albuquerque Tribune, Nov 7 1995 DOE boss accelerates whistle-blower protection, Albuquerque Tribune, March 27, 1996 DOE doesn't plan to compensate 'old' whistle-blowers with money, Albuquerque Tribune September 27, 199

1 0

Re: NSA rigs Crypto machines according to Balto Sun
by Ulf_Moeller＠public.uni-hamburg.de 17 Dec '03

17 Dec '03

pcw(a)access.digex.net (Peter Wayner) writes: >So, is this what happened at Crypto AG? Is this what happened at Netscape? What happened to Crypto AG is that they are -- at least partly -- *owned* by the German secret service BND. I'll try to give a rough translation of a section from a book by Erich Schmidt-Eenboom: "The BND would like to put a Clipper chip of their own, an exclusive federal German back-door, into the encryption devices delivered abroad. Rumors are persistent that this already happens -- illegally, of course. For that purpuse, camouflage companies such as the Crypto AG in the Swiss Steinhausen am Zuger are preferredly used. A former Crypto financial manager confirmed to FOCUS magazine: The company's owner is the Federal Republic of Germany. Crypto AG has been delivering crypto devices to armies, polices and secret services in about 120 countries for over 40 years. The enterprise got into the headlines when Crypto employee Hans Buehler was arrested in March 1992 in Iran for threadbare espionage accusations and was released only 9 1/2 months later on bail of one million dollars. The true reasons for the arrest can only be guessed. According to the records of the Bern police, Buehler was classified as a security risk after his release by the west German ministry of defense and then was fired by Crypto AG. The Zuerich lawyer office assigned with indemnification claims, Gloor & Sieger, draws the conclusion that "Iran has been suspecting for some longer time that the crypto deviced delivered by Crypto AG had never or no more conformed with Iranian security needs". Further they state: "It is a fact (...) that for several years, articles kept appearing in the international press reporting decryption of classified messages encrypted with Crypto devices". Some signs indicate that the suspection that Crypto devices have been manipulated on purpuse is not at all out of place. During his arrest in Iran, Buehler has been interrogated about reports in news articles of the above kind for months. Crypto devices have been tested and certified by the BND central office for encryption affairs and later by the BSI. In addition to that: After the murder of exile politician Bachtiar by an Iranian death commando in Paris, the BND decrypted an encrypted radio message by the Iranian secret service VEVAK at no effort." German original: From: frank(a)artcom.de (Frank Rieger) Newsgroups: de.org.ccc Subject: Crypto AG (Behördenverschlüsselung) Date: Wed, 28 Jun 1995 15:13:31 +0200 Organization: ART + COM Lines: 26 Distribution: world Message-ID: <frank-2806951513310001(a)penny.artcom.de> In der Liste der Firmen die Verschlüsselungsgeräte für Behörden anbieten war auch die Crypto AG in der Schweiz. Zu dieser Firma fand ich gerade eine interessante Textstelle in (1): "Den eigenen Clipper-Chip, das exklusive bundesdeutsche Hintertuerchen, wuerde der BND gerne in Verschluesselungsgeraete einbauen die ins Ausland geliefert werden. Hartnaekig haelt sich das Geruecht, dass dies manchmall bereits geschieht - illegalerweise, versteht sich. Dabei bedient man sieh hevorzugt Tarnfirmen wie etwa der Crypto AG im schweizerischen Steinhausen am Zuger . Eine Firma, von der ein Ex-Crypto-Finanzmanager gegenueber der Zeitschrift FOCUS bestaetigte: Besitzer der Firma ist die Bundesrepu blik. Die Crypto AG ruestet seit Ueber 40 Jahren Armeen, Polizei und Geheimdienste in rund 120 Laendern mit Verschluesselungsgeraeten aus. In die Schlagzeilen geriet das Unternehmen, als der Crypto-Mitarbeiter Hans Buehler unter fadenscheinigem Spionagevorwurf im Maerz 1992 im lran verhaftet wurde und erst neuneinhalb Monate spaeter gegen Zahlung einer Kaution von einer Million Dollar freikam. Ueber den wahren Grund der Verhaftung lassen sich nur Vermutungen anstellen. Laut Akten der Berner Polizei wurde Buehler nach seiner Haftentlassung vom westdeutschen Verteidigungsministerium als Sicherheitsrisiko eingestuft und daraufhin von der Crypto AG entlassen. Das mit Schadenersatzfarderungen betraute Zuericher Anwaltsbuero Gloor & Sieger kommt in einem Schriftsatz zu dem Schluss, "dass der Iran schon seit laengerer Zeit den Verdacht hegte, dass die von der Crypto AG gelieferten Chiffriergeraete den iranischen Sieherheitsbeduerfnissen nicht oder nicht mehr entspraechen". Weiter heisst es :"Tatsache ist (. . .), dass ueber mehrere Jahre hinweg immer wieder Artikel in der internationalen Presse erschienen sind, welche von der angehliehen Dekryptierung von klassitizierten Meldungen, welche mit Crypto-Geraeten chiffriert worden sind, berichten." Einige Indizien deuten darauf hin dass der Verdacht, Crypto-Geraete seien mit Absicht manipuliert worden, keineswegs abwegig ist. Ueber Berichte in Zeitungsartikeln der erwaehnten Art wurde Buehler waehrend seiner Haft im Iran ueber Monate weg verhoert. Crypto-Geraete sind von der BND-Zentralstelle fuer Chiffrierwesen und spaeter vom BSl geprueft und abgenommen worden. Hinzu kommt noch folgendes: Nach der Ermordung des Exilpolitikers Bachtiar durch ein iranisches Todeskommando in Paris war es dem BND ein l eichtes, einen verschluesselten Funkspruch des iranischen Geheimdienstes VEVAK zu dechiffrieren." (1): Schmidt-Eenboom, Erich: Die schmutzigen Geschäfte der Wirtschaftsspione; ECON Verlag 1994, S. 230f. (OCR-&Konvertierungsfehler vorbehalten)

1 0

Re: Warning about Pegasus Mail and PGP (fwd)
by Siberia 17 Dec '03

17 Dec '03

ftp://ftp.aimnet.com/users/jnavas/winpmail/ On 10 Dec 95 at 4:07, Adam Hupp wrote: > Where can you get the Open Encryptor PGP interface? Namaste' Kimberly Long klong(a)phoenix.net What is life? It is the flash of a firefly in the night. It is the breath of a buffalo in the wintertime. It is the little shadow which runs across the grass and loses itself in the sunset. ~Crowfoot 1821-1890 )O(

1 0

Paul Kocher's timing attack
by Matt Blaze 17 Dec '03

17 Dec '03

Paul Kocher's brutally clever timing attack against on-line implementations of RSA, DSA and fixed-exponent Diffie-Hellman is reported on page A1 of Monday's New York Times ("Secure Digital Transactions Just Got a Little Less Secure" by John Markoff). The attack requires only a few thousand ciphertext samples and works against most implementations of public-key cryptosystems in which the attacker can measure accurately the target's computation time for each sample. I think Kocher's paper is online somewhere; I'll post the URL when I find it. -matt

4 3

Announce: Timing cryptanalysis of RSA, DH, DSS
by pck＠netcom.com 17 Dec '03

17 Dec '03

I've just released details of an attack many of you will find interesting since quite a few existing cryptography products and systems are potentially at risk. The general idea of the attack is that secret keys can be found by measuring the amount of time used to to process messages. The paper describes attacks against RSA, fixed- exponent Diffie-Hellman, and DSS, and the techniques can work with many other systems as well. My research on the subject is still in progress and the current paper does not include many of my findings. I will eventually publish a full paper, but am releasing a preliminary draft now to alert the community as quickly as possible. A copy of the abstract is attached at the end of this message and the full text can be downloaded in PostScript format from: ftp://ftp.cryptography.com/pub/kocher_timing_attack.ps ftp://ftp.cryptography.com/pub/kocher_timing_attack.ps.gz I've also made an HTML version which is accessible at: http://www.cryptography.com (The HTML uses subscripts and superscripts which aren't supported in older web browsers. The PostScript version is the "official" one and looks nicer.) The results have already been seen by Matt Blaze, Martin Hellman, Ron Rivest, Bruce Schneier, and many others. While the full significance of the attack is not yet known, I think everyone who has seen it considers it important (including Netscape who awarded me a $1000 bugs bounty prize). ABSTRACT. Cryptosystems often take slightly different amounts of time to process different messages. With network- based cryptosystems, cryptographic tokens, and many other applications, attackers can measure the amount of time used to complete cryptographic operations. This abstract shows that timing channels can, and often do, leak key material. The attacks are particularly alarming because they often require only known ciphertext, work even if timing measurements are somewhat inaccurate, are computationally easy, and are difficult to detect. This preliminary draft outlines attacks that can find secret exponents in Diffie- Hellman key exchange, factor RSA keys, and find DSS secret parameters. Other symmetric and asymmetric cryptographic functions are also at risk. A complete description of the attack will be presented in a full paper, to be released later. I conclude by noting that closing timing channels is often more difficult than might be expected. Cheers, Paul Kocher ********************************************************************* VERY IMPORTANT: If you send me e-mail, please understand that I probably won't have time to respond to all who write. Please keep messages SHORT and send them to pck(a)cryptography.com (**not** my netcom address -- misdirected messages will be ignored). PGP when used for e-mail is not vulnerable to the attack. Please state in your note whether you would like a reply. ******************************************************************** __________________________________________________________________________ Paul C. Kocher Independent cryptography/data security consultant E-mail: pck(a)cryptography.com (please see above before replying)

1 0

*fnord* Addition info *fnord*
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

From: pck(a)netcom.com (Paul C. Kocher) Subject: Announce: Timing cryptanalysis of RSA, DH, DSS Message-ID: <pckDJEEzH.DJ3(a)netcom.com> Organization: NETCOM On-line Communication Services (408 261-4700 guest) Date: Mon, 11 Dec 1995 01:33:17 GMT Lines: 67 Sender: pck(a)netcom20.netcom.com I've just released details of an attack many of you will find interesting since quite a few existing cryptography products and systems are potentially at risk. The general idea of the attack is that secret keys can be found by measuring the amount of time used to to process messages. The paper describes attacks against RSA, fixed- exponent Diffie-Hellman, and DSS, and the techniques can work with many other systems as well. My research on the subject is still in progress and the current paper does not include many of my findings. I will eventually publish a full paper, but am releasing a preliminary draft now to alert the community as quickly as possible. A copy of the abstract is attached at the end of this message and the full text can be downloaded in PostScript format from: ftp://ftp.cryptography.com/pub/kocher_timing_attack.ps ftp://ftp.cryptography.com/pub/kocher_timing_attack.ps.gz I've also made an HTML version which is accessible at: http://www.cryptography.com (The HTML uses subscripts and superscripts which aren't supported in older web browsers. The PostScript version is the "official" one and looks nicer.) The results have already been seen by Matt Blaze, Martin Hellman, Ron Rivest, Bruce Schneier, and many others. While the full significance of the attack is not yet known, I think everyone who has seen it considers it important (including Netscape who awarded me a $1000 bugs bounty prize). ABSTRACT. Cryptosystems often take slightly different amounts of time to process different messages. With network- based cryptosystems, cryptographic tokens, and many other applications, attackers can measure the amount of time used to complete cryptographic operations. This abstract shows that timing channels can, and often do, leak key material. The attacks are particularly alarming because they often require only known ciphertext, work even if timing measurements are somewhat inaccurate, are computationally easy, and are difficult to detect. This preliminary draft outlines attacks that can find secret exponents in Diffie- Hellman key exchange, factor RSA keys, and find DSS secret parameters. Other symmetric and asymmetric cryptographic functions are also at risk. A complete description of the attack will be presented in a full paper, to be released later. I conclude by noting that closing timing channels is often more difficult than might be expected. Cheers, Paul Kocher ********************************************************************* VERY IMPORTANT: If you send me e-mail, please understand that I probably won't have time to respond to all who write. Please keep messages SHORT and send them to pck(a)cryptography.com (**not** my netcom address -- misdirected messages will be ignored). PGP when used for e-mail is not vulnerable to the attack. Please state in your note whether you would like a reply. ******************************************************************** __________________________________________________________________________ Paul C. Kocher Independent cryptography/data security consultant E-mail: pck(a)cryptography.com (please see above before replying) ======== Xref: news2.new-york.net sci.crypt:5320 Path: news2.new-york.net!spcuna!uunet!in1.uu.net!newsfeed.internetmci.com!howland.reston.ans.net!ix.netcom.com!netnews From: jmrubin(a)ix.netcom.com (Joel M. Rubin) Newsgroups: sci.crypt Subject: Re: Announce: Timing cryptanalysis of RSA, DH, DSS Date: 11 Dec 1995 04:35:47 GMT Organization: Union of anti-organizationalists Lines: 11 Message-ID: <4agcf3$enr(a)ixnews2.ix.netcom.com> References: <pckDJEEzH.DJ3(a)netcom.com> NNTP-Posting-Host: ix-sf17-18.ix.netcom.com X-NETCOM-Date: Sun Dec 10 8:35:47 PM PST 1995 X-Newsreader: WinVN 0.99.7 I just saw a small article with your name on page 1 of the N.Y. Times Fax 8-page Internet Edition. (Monday, December 11, 1995) They change the edition at about 10:30-11 P.M. Eastern Standard Time (0330-0400 the next GMT day) so if you read this before then, you might want to download http://nytimesfax.com/times.pdf. It is in Adobe Acrobat format. Of course, there is probably a larger article in the paper edition. ======== From: jmrubin(a)ix.netcom.com (Joel M. Rubin) Newsgroups: sci.crypt Subject: Re: Announce: Timing cryptanalysis of RSA, DH, DSS Date: 11 Dec 1995 04:38:58 GMT Organization: Union of anti-organizationalists Lines: 7 Message-ID: <4agcl2$enr(a)ixnews2.ix.netcom.com> References: <pckDJEEzH.DJ3(a)netcom.com> NNTP-Posting-Host: ix-sf17-18.ix.netcom.com X-NETCOM-Date: Sun Dec 10 8:38:58 PM PST 1995 X-Newsreader: WinVN 0.99.7 In case you don't already know, there is an article about your work in Monday's N.Y. Times. I just read a very small version of it in http://nytimesfax.com/times.pdf. (Adobe Acrobat-format 8-page edition) The N.Y. Times Fax on the web changes edition about 10:30 or 11 P.M. New York time so if you want it, get it before then.

1 0

Time-based cryptanalysis: How to defeat it?
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Assuming Alice is decrypting a secret message sent to her by Bob (on her very slow C64 ;), and Mallet is watching with a stopwatch in hand, hoping to determine Alice's secret key... It would be good to place inside the decryption routines a timer (WELL PLACED!) that waits a random-number of cycles (based on key-strokes, mouse position, etc.) to defeat this type of cryptanalysis?

1 0

OGY, chaotic scrambling
by Laurent Den-Hollander 17 Dec '03

17 Dec '03

A few years back i ran thru a paper emanating from a navy labs researcher (i think the name was Peccora) about using synchronised chaotic signal generators as a signal scrambling/encrytpion scheme. Has there been any kind of progress in this line of work, practical applications ? Answer on C4i-pro or directly email to Denholl(a)ceram.fr L. Den-Hollander. OIT engineer.

1 0

Re: More elveator problem
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

On Sat, 9 Dec 1995 00:23:41 -0800, Jerry Whiting wrote: >More on The Elevator Problem: >I'll confess that we're working on a new private key encryption product. Free >and clear of existing claims on intellectual property, I'd like a protocol >that answers the elevator problem: how can Alice and Bob agree on a private >key via a compromised channel? I don't want them to meet under a street lamp >and whisper in each other's ears _before_ trying to establish a secret on a >crowded elevator. [..] >Something that I neglected to mention before is that Alice and Bob do have a >unique ID within this system, not that they necessarily know each others. If >one assumes that they do, they then share a secret: the knowledge of each >other's unique ID. [..] Wait... are unique IDs secret from others? Can they share theirs with ea. other without compromising something? Maybe using a hash of their combined secret ideas (adding them, or mixing the bits... how long is the unique ID?) can be used to generate a "key" to exchange other information.... >Jerry Whiting >jwhiting(a)azalea.com

2 1

[Noise] A vaguely humorous post
by Don M. Kitchen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I saw some fool posting to alt.security among other places trying to get his basic program to do OTP's. On the off chance that anybody thinks this is funny, here's my response: In-reply-to: spy(a)vs.spy's message of 10 Dec 1995 05:02:17 GMT Newsgroups: alt.2600,alt.2600.programz,alt.security Followup-To: alt.2600 Subject: Re: HELP....This will not work; I am perplexed. Reply-to: don(a)cs.byu.edu References: <4adpkp$3id(a)mercury.initco.net> - --text follows this line-- > 60 INPUT "HOW MANY ONE TIME PADS DO YOU WANT?";NUMB [snip] > 160 RANDOMIZE E > 170 X=INT(RND(0)*90)+1 This isn't sci.crypt so I won't flame, but I feel I should point out that "One Time Pad" is a registered trademark of Cypherpunks, Ltd, and that any inferrence that anything coming out of a basic randomizer is "One", "Time", or "Pad" is a blatent trademark violation. As a courtesy to the public, Cypherpunks, Ltd, makes freely available it's patented One Time Pad technology. Using PGP, you may enter the top-secret activation code thusly: "pgp +makerandom=[size] [filename]" where [size] is the size, in bytes, of your Cypherpunk[tm]-generated, super-cryptographically- secure, ultimate One Time Pad[tm], and [filename] is where you want it stored. You can rest assured that with your cypherpunk[tm] One-Time-Pad[tm], not even a Cypherpunk[tm] can break your code without breaking your bones. > **Have you been compromised? If the answer is no, > you had better think again. With security ideas like that, I'm not surprised. MD5 man, MD5. PS, try to zip a large output from pgp makerandom. Now try a large output from basic. Hmmmm. Which one Just Wont Compress[tm]? Happy Monday everyone. PS: got mail crypt working, it's awesome. It's quite seamless, up to the point where my home box doesn't have incoming mail service and EMACS doesn't have built in POP or IMAP. (Yet). But great for nntp and PGP. Don -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMMwBmcLa+QKZS485AQHKLAL6Ah4881dbMan91wNL2TJjvGMHe75Xwzrw YI0x5/XsmuoYv7M6qn4O+MZ9vEF51ES1sJaW5bOQ5Gq0vJn2bmGVIV+kmbn2p3TZ ZHxkv51NW7zxwRgyvnezwyYwBrY10bQ2 =eoAc -----END PGP SIGNATURE----- -- <don(a)cs.byu.edu> fRee cRyPTo! jOin the hUnt or BE tHe PrEY PGP key - http://students.cs.byu.edu/~don or PubKey servers (0x994b8f39) June 7&14, 1995: 1st amendment repealed. Junk mail to root(a)127.0.0.1 * This user insured by the Smith, Wesson, & Zimmermann insurance company *

1 0