- cypherpunks-legacy - lists.cpunks.org

Re: Java and timing info - second attempt
by Andrew Loewenstern 17 Dec '03

17 Dec '03

Jim Miller (jim_miller(a)bilbo.suite.com) writes: > Would it be possible to create a Java applet that causes the client > machine to sign or encrypt something with their private key, and > then send back timing info? Since access to a private key should always be strictly mediated by the user any Java implementation would probably pop up a panel asking permission for every single private-key encryption operation requested by the applet. The timing attacks require many timed encryptions to get enough information about the key. Even if the user was completely clueless and had no idea what the applet was trying to do I would imagine that they would get tired of clicking "OK" long before sufficient key information was leaked ..... Of course it would be a lot easier for the applet to just try to read the secret key file, encrypt it with an embedded public key, and post it to alt.anonymous.messages. Depending on how security was setup there might be only one or two panels that the user has to dismiss. It would probably get past the same number of clueless users that a more complicated timing attack would fool. andrew

1 0

RSA Data v. Cylink hearing
by rschlafly＠attmail.com 17 Dec '03

17 Dec '03

Another hearing in the public-key patent saga. Cylink/CKC is going for a preliminary injunction against RSA Data for contributory infringement of the Stanford patents. RSA Data has a license to the Stanford patents, but has no sublicensing authority. It has been selling RSA & Diffie-Hellman toolkits and telling customers that they don't need PKP or Stanford patent licenses, and even indemnifying those customers against a patent infringement claim. An arbiter has already ruled that RSA Data's license does not cover customers shipping products. Of course I take the position that these patents are invalid, and now that Bidzos has lost control of them, he suddenly agrees with me. (Sorry, no ruling yet in my case. Stay tuned.) But RSA Data lawyers will have to stand up in court and say that after enforcing the Stanford patent against all public-key users for 5 years, RSA Data suddenly had a revelation that the Stanford patents are invalid after all. It should be amusing. 2:00 pm, Thurs., Jan. 4, 1996 RSA Data v. Cylink/CKC, Case C-95-03256 WHO SF Federal Bldg, court #7, Judge Orrick 450 Golden Gate Ave Directions: Take 9th up from Market -- it turns into Larkin and the federal bldg is on the corner with Golden Gate Ave. docket clerk: 415-522-2060 Roger Schlafly phone: 408-476-3550 CompuServe: 76646,323 US Mail: PO Box 1680, Soquel, CA 95073 USA Internet: rschlafly(a)attmail.com

1 0

No Subject
by cpunk＠remail.ecafe.org 17 Dec '03

17 Dec '03

Submitted for your approval... The recent CryptoLib, offered by the nice folks at AT&T (Written by Jack Lacy and Don Mitchell), has a small problem: folks without RSA licenses are given a crippled version without functional RSA code. It sucks, but they must cover their collective asses. That small problem has now been rectified. Is CryptoLib available overseas yet? ================================CUT HERE=================================== *** - Sun Dec 17 20:05:50 1995 --- rsa.c Sun Dec 17 20:05:36 1995 *************** *** 411,421 **** #endif { BigInt result; ! fprintf(stderr, "RSA encryption not supported without license.\n"); ! result = bigInit(0); return result; } - #ifdef K_AND_R _TYPE( BigInt ) RSADecrypt(message, key) --- 411,420 ---- #endif { BigInt result; ! result = bigInit(0); ! bigPow(message, key->publicExponent, key->modulus, result); return result; } #ifdef K_AND_R _TYPE( BigInt ) RSADecrypt(message, key) *************** *** 427,434 **** #endif { BigInt result; ! fprintf(stderr, "RSA decryption not supported without license.\n"); ! result = bigInit(0); return result; } --- 426,433 ---- #endif { BigInt result; ! result = bigInit(0); ! chineseRemTheorem(message, key, result); return result; }

1 0

Antiterrorism Bill Dead
by Duncan Frissell 17 Dec '03

17 Dec '03

At last some good news from the Hill. The House Judiciary Committee has announced that they are unable to vote on Chukie Schumer's Antiterrorism bill at this time. It is "dead for now." That means that the $500 million for the telecoms companies to carry out the Digital telphony Initiative is also dead for now. Thanks to an heroic coalition of leftist civil liberties types and right wing nuts (including the Fundies) for squashing it for now. Now if we could only convince the Fundies that the Klinton Admin was going to use the Exxon amendment to outlaw religious speech on the nets on the grounds of political indecency. But maybe the Telecoms bill will die too. It did last time. DCF

2 1

RE: Political Cleanup program
by Kurt Buff (Volt Comp) 17 Dec '03

17 Dec '03

Ya won't have complete equity amongst lobbyists, until ya remove the power of bureaucrats to control people's lives. When laws can be used to deprive people of their livelihood, via either taxation or regulation, you will create situations where people can make money from it, and therefore unscrupulous people will take advantage. The only defensible argument for government at all is to protect people from depredation, either from fellow citizens or from external threats. When you prevent people from engaging in peaceful commerce, you open the floodgates to tyranny. Thus, the solution is less government, not to try to legislate human nature. Kurt [speaking for myself, of course] ---------- From: Richard Huddleston[SMTP:reh@wam.umd.edu] Sent: Monday, December 18, 1995 6:12 To: jimbell(a)pacifier.com; vznuri(a)netcom.com Cc: cypherpunks(a)toad.com Subject: Re: Political Cleanup program Detweiler wrote: * >JB: * >>Politics is traditionally corrupt, it appears, because donors to politicians * >>and political campaigns expect a quid pro quo for their donations. Various * >>unsatisfactory solutions include campaign spending limits, etc. * > * >I have an unusual view that I've never seen elsewhere: the problem with * >our government is not that money or PACs are involved, but that the system * >does not handle or resolve the conflicts between them very well. in other * >words, in contrary to the current view that all PACs are evil, I think the * >problem is not that we have PACs, but that our current system does not * >balance their demands in some sensible manner. the system is * >susceptible to corruption. it is conceivable however that there would be * >a system that involves money and politics but still avoids corruption. Not to sound like a dupe or anything, but every time I get discouraged at the rampant mealyism of our political system I go read the first couple of paragraphs of a text from GOVT 101. There, I get reminded that the way most political debate is handled elsewhere is with bullets. Personally, I welcome a complete equity between all lobbyists seeking to obtain a politico's ear. Take the money out of the equation, and let the merits of their causes, if any, stand on their own. Happy holidays, Richard

1 0

Applescripts for monitoring Netscape Activity
by Bill.Humphries＠msn.fullfeed.com 17 Dec '03

17 Dec '03

The recent Netscape beta bug mentioned here raised a technical question? Anyone here have a pointer to an applescript, frontier or macperl script for monitoring what programs do to your system folder and desktop? Otherwise, I'd better write one. It'd be a good way to learn more about the behavior of apps. Thanks and happy holidays, Bill Humphries Call your Representative and Senators and demand an end to attempts to censor the Internet. More info at http://www.vtw.org/ *** The answer to porn speech is free speech -- via Molly Ivins ***

1 0

wish list for Crypto++?
by Wei Dai 17 Dec '03

17 Dec '03

I am looking for suggestions for features to include in the next version of Crypto++ (current version is 1.1, you can find it at http://www.eskimo.com/~weidai/cryptlib.html) Major additions already planned/implemented include speed improvements, Safer (all the variations), and elliptic curve cryptosystems (over prime fields as well as fields of characteristic 2). There is also a good chance that RSA will be added back, but I'm still waiting for the final word from the RSADSI lawyer. What else do people want to see? Wei Dai

1 0

Java and timing info - second attempt
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

I asked about using Java scripts to capture remote timing info before and got no response. I assume everyone thought it was a stupid question. Therefore, I'll ask it again. The thing that makes Java a big deal is that you execute other people's code on your machine. You browse a Java-enhanced Web page, click on something interesting, suck across an applet, and execute it on your machine. This setup enables a bunch of nifty interactive Web stuff. Turn the picture around: You setup a Java-enhanced Web page, include some interesting buttons to click, write some clever applet, and people around the world suck your applet onto their machine and execute it. Combine this with some a standard crypto API for doing Web-based digital signatures or authentication or encryption and you may begin to see some possibilities. Would it be possible to create a Java applet that causes the client machine to sign or encrypt something with their private key, and then send back timing info? For the answer to be YES a few things need to be true. There needs to be some sort of standard crypto API in use that can be accessed by a Java script, and Java scripts need to be able to capture and send back timing info. Does anyone on this list know enough about Java to know if it can do any of these things? Jim_Miller(a)suite.com

3 2

Re: Java and timing info - second attempt
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 22:31 12/18/95 -0800, Jeff Weinstein wrote: > In Netscape Navigator 2.0 Java and JavaScript do not have access >to crypto routines. At some point in the future this will probably >change, but only after we understand the implications much better >than we do today. More importantly for covert channel analysis, do they have access to good clocks? Access to a good clock could make a Java applet a good candidate for the receiver in a generalized covert channel attack. Access to both process time and real-world time can give a good indication of load on the processor, and might be needed for animation. A transmitter could send by using or not using the CPU. (Installing the transmitter is left as an excersize for the student. ;-) ) Who said that life was safe? ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

1 0

(fwd) Junk email address collection (from a junk emailer)
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Personally, I think anyone who uses dejanews as a way to grep Usenet is an idiot, but since this idiot actually did spend several hours doing so, and then sent unsolicited commercial email to several thousand people, it's worth listening to him. Of course he's wrong about DejaNews having anything to do with Stanford. Anyone know anyone there? This guy is obviously afraid of me. It's a pretty funny story, actually. Too bad I can't tell it to anyone. - -rich - ---------- Forwarded message ---------- From: Name Witheld by Request To: Rich Graves <llurch(a)networking.stanford.edu> Subject: Important info for you Rich, There is one more point I would like to make to you. Since you have recently responded in a sincere way regarding everything I have asked you about, I would like to return the favor and suggest some things that might be of help to you and your cause. If you want to put a damper on some of the random unsolicited emailings to newsgroups members, I would like to tell you how. I have done extensive marketing research online, and I am very involved with Internet commerce and everthing that affects it. Just like you have your "circles" of associates, so do online business people. I have met a lot of business users online, and have learned the ins and outs of things related to Internet commerce and marketing. Anyway, in these "circles" of discussions, and seeing information and posts from some of these business people, I have learned many things that your group is most likely not exposed to. For example, there is a major resource where the majority of email names are stripped from, and I would like to reveal it to you, and give you the solution to putting an end to it. But only because I truly want to help, and show you that I am not your enemy. You may already know some of this. The "Deja News" Web service (at Stanford) is one of the major resources that some of these mailers use to get names. They attempt to do target marketing by doing searches for keywords related to their customers, or their own, advertising material that they wish to send. They simply do a search for several words like "resumes" if they have something to do with a resume service, etc. I'm sure you get the idea. After they do their search, they merely dump screen after screen of the search engine's findings and then strip the addresses using a FIND-CONTAINS "@" command in any database program. This is how they strip the names to create a mass email list. There is ONE way that could really screw over these mailers from using this resource. This is inside information that has been revealed to me (I have also seen references to it somewhere else). Don't ask who it was that was telling everyone about it, because I honestly couldn't tell you - I just know it is going around. Since you are there at Stanford, I am sure that you may be able to bring this information to someone working on this project so they can make some necessary changes. Here it is: When one of these mailers goes to do a search (and from what I hear, many of them do it on regular intervals to get new names) they cannot do a TERSE search. Why? Because it cuts off the email addresses if you notice the output. They cannot obtain addresses from this data. So what do they do? They do a VERBOSE search and this way the email addresses are completely listed. Make a change to this VERBOSE search option so that it will only list the partial email address, and you will eliminate THOUSANDS, if not millions of unwanted email messages on the Net. I guarantee if they made this change to the site it would make a HUGE difference. From what I hear, most newsreaders only list news post lists by "author" and not by email address, so these companies cannot easily strip names through regular newsgroup programs, and must use a service (like Deja News) to compile large email lists. Also, you and your buddies may want to look into a guy selling a software program called "Floodgate." Apparently this person is selling a program for about $300 that is designed to strip names from text files that are created from copying the output of other sources. Just thought I would donate some helpful information to make up for my offense. I don't mind if you should share this info with your contacts and if you tell them that it came from me, however, I would prefer if you would not post this information or statement publicly. I do not wish to get involved with a MAJOR uprising of business people that would murder me for revealing stuff like this. If I come across some other stuff which may be of interest to you, I will let you know. I think it is much better for us to work together instead of against one another. Let me know what you think, -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMNeZ3Y3DXUbM57SdAQE/5QP/cwqEiY7eX8fR/9JEPmSdhE63Ax+H+NCw Uac9VXlKKSH3e+JfI7c/+sWhYafLvWVFlz7Ikj1/uMilAmNJjJTUZfTHqdlYKN/+ kkmc+cCWfGAkl6PFcFqcvSdPKJvyVMsnUFufFBsl629Ot7Pb8yZJTXEq0vr8+BcG QOdMuhEZiXk= =Hq1v -----END PGP SIGNATURE-----

3 2