- cypherpunks-legacy - lists.cpunks.org

On the Importance of Checking Computations
by John Young 17 Dec '03

17 Dec '03

The Bellcore report, "On the Importance of Checking Computations" on technical details of fault-based cracking reported in today's FT, is available at: http://www.bellcore.com/SMART/index.html Here's an outline: On the Importance of Checking Computations (Extended abstract) Don Boneh, Richard A. DeMillo, and Richard J. Lipton Math and Cryptography Research Group, Bellcore Abstract: We present a theoretical model for breaking various cryptographic schemes by taking advantage of random hardware faults. We show how to attack certain implementations of RSA and Rabin signatures. We also show how various authentication protocols, such as Fiat-Shamir and Schnoor, can be broken using hardware faults. 1. Introduction Transient faults Latent faults Induced faults 2. Chinese remainder based implementations 2.1 The RSA system 2.2 RSA's vulnerability to hardware faults 3. Register faults 4. The Fiat-Shamir identification scheme Theorem 4.1 4.1 A modification of the Fiat-Shamir scheme 5. Attacking Schnoor's identification scheme Theorem 5.1 6. Breaking other implementations of RSA Theorem 6.1 7. Protecting against an attack based on hardware faults 8. Summary References ----- Registration is required for access. Two formats are available: Acrobat PDF (112kb) and Postscript PS (86kb). Before registration, there is a brief "context" at: http://www.bellcore.com/SMART/secwp.html Here's the first two paragraphs: Context for "On the Importance of Checking Computations" "On the Importance of Checking Computations" describes a fault-based method for breaking various cryptographic algorithms and exposes the degree to which computing faults can compromise information security. Once the authors -- Richard DeMillo, Dan Boneh and Richard Lipton -- articulated and proved their conceptual breakthrough, they realized that it might be successful in a wide variety of application scenarios. Fault-based attacks potentially endanger many network security products and systems. The paper summarizes the proof for the basic attack. Proof for fault-based cryptanalysis builds on the premise that an adversary can observe a faulty computation that occurs during cryptographic transactions. The faults that are exploited can occur at various sublevels within the logic level of a computing device -- that is, in the switching circuitry where arithmetic operations are performed or in the register transfer area where temporary values are stored in memory. The likelihood of faults occurring is not discussed in the paper. [Snip balance of Context]

1 0

Bernstein hearing, Nov 8, 10:30AM: injunction against export controls
by John Gilmore 17 Dec '03

17 Dec '03

Watch the noose tighten around the scrawny neck of the vile crypto export controls! Be part of reclaiming your freedom to teach cryptography and to share your crypto expressions worldwide! Garb yourself in a ritual costume used by powerful and famous people! See the smooth Justice Department minion who lost the Communications Decency Act case once again fail to suppress free speech! Meet renowned East Coast lawyer Robert Corn-Revere, who helped Phil Zimmermann face down ITAR prosecution! Next Friday, 8 November 1996, at 10:30AM we will join forces at Yet Another Hearing in the case of Dan Bernstein v. Large Government Agencies. Convene at the Federal Building in San Francisco, 450 Golden Gate Avenue, in the courtroom of Judge Marilyn Hall Patel. We'll recognize each other because we'll all be dressed like lawyers. We will follow the formal proceedings with a group lunch at Max's Opera Plaza, a block away at Van Ness Avenue and Golden Gate Avenue. Or come prepared to suggest a walkable alternative eatery more to your liking, and we can go there instead. Dan would like to teach a class in cryptography in the upcoming winter semester, but is afraid that teaching it in the ordinary way (posting his class materials on the Web, etc) would violate the ITAR. He thinks that the ITAR is unconstitutional, and that altering his ordinary teaching because of a threat of ITAR prosecution is a "chilling effect" on his constitutional rights of free expression and academic freedom. Because it's not clear whether the earlier, broader, motions that we argued in September will be decided by the time of his class, he has asked the judge for a "preliminary injunction", a court order in the following form: 2. Defendants are ENJOINED from investigating or prosecuting under the Arms Export Control Act (AECA) 22 U.S.C. 2778 et seq., and the International Traffic in Arms Regulations (ITAR), 22 C.F.R. 120 et seq., or any export control statute or regulation which would require prepublication licensing of any teaching or scientific exchange activities, the following persons: a. Plaintiff, and b. Plaintiff's students, and c. Any person who receives technical data, cryptography software or defense services from Plaintiff or his students; when such technical data, cryptography software or defense services were given or received as part of teaching or scientific exchanges during or in preparation for the cryptography course to be taught by Plaintiff during the Spring, 1997 semester at the University of Illinois at Chicago. 3. Defendants are further ENJOINED from requiring licensure, approval, registration, reporting or the fulfillment of any requirements of the AECA, ITAR or any export control statute or regulation which would require prepublication licensing of any teaching or scientific exchange activities, the [same] persons... We tried to get the Government to agree to this without getting the judge involved, but despite their protests that they don't control academic activities, they would not agree. So here we go with another "Cypherpunks Dress-Up Day" on a Friday morning in San Francisco. Robert Corn-Revere <rcr(a)dc1.hhlaw.com> has recently joined the Bernstein legal team. He wrote the excellent arguments for this motion, and will attend the hearing. Here's a sample of his prose. Despite repeated denials that the Government is restricting academic freedom, Defendants display a striking enthusiasm for defining the limits of "appropriate" academic inquiry and communication. Without directly disputing the fact that computer software and source code *is* speech, or that access to such software is essential to Prof. Bernstein's course on cryptography, or that consultation with other researchers in the field (generally via the Internet) is part of the normal academic process, or that posting such materials for students on the World Wide Web is standard academic practice, Defendants baldly assert that such activities have "nothing to do with teaching a class in Chicago." PI Opp at 1. Indeed Defendants state categorically that "the principle of 'academic freedom' does not authorize Plaintiff to transmit abroad [cryptographic software], *even if his own purpose is merely to convey some theory implicit in the software*." Id. at 22-23 (emphasis added). ... ...The Government's argument essentially collapses to the proposition that if it is not restricting speech in *all* cases, it is not engaging in censorship in *some* cases. Yet in every case with which the Plaintiff is familiar in which cryptographers have consulted the Government (or otherwise been brought to the Government's attention), the officials who administer the ITAR scheme have counseled caution, have initiated investigations and have subjected publications to the CJ process. In this respect, Defendants have instituted a kind of "don't ask/don't tell" policy for cryptography. ... If anything, such an informal approach causes greater concern, since the law is clear that sporadic or discretionary enforcement of a policy that restricts speech creates a more significant First Amendment problem than does uniform enforcement. ... The Government's Opposition borders on the schizophrenic. Defendants repeatedly assert that teaching a class on cryptography or making software available to students are not "regulated by the Government", PI Opp at 1, yet just as repeatedly describe the conditions under which the very same activities are regulated by the ITAR. The Government maintains that it "is not threatening to prosecute Plaintiff or anyone for teaching cryptography," Id. at 2, yet continues to argue that the course plan Prof. Bernstein is proposing would violate the export controls. As background, Dan Bernstein, ex-grad-student from UC Berkeley, is suing the State Department, NSA, and other agencies, with help from the EFF. These agencies restrained Dan's ability to publish a paper, as well as source code, for the crypto algorithm that he invented. We claim that their procedures, regulations, and laws are not only unconstitutional as applied to Dan, but in general. Full background and details on the case, including all of our legal papers (and most of the government's as well), are in the EFF Web archives at: http://www.eff.org/pub/Privacy/ITAR_export/Bernstein_case. [Actually, not all the paperwork for this Preliminary Injunction is online yet, but we hope it will be by the time you read this...] Like Phil Karn's and Peter Junger's cases, this lawsuit really has the potential to outlaw the whole NSA crypto export scam. We intend to make your right to publish and export crypto software as well- protected by the courts as your right to publish and export books. It will probably take more years, and an eventual Supreme Court decision, to make it stick. But perhaps at this hearing we can make it legal for one teacher to teach crypto using the Web this winter. Please make a positive impression on the judge. Show her -- by showing up -- that this case matters to lots of people. Most court cases have nobody in the audience. Demonstrate that her decision will make a difference to society. That the public and the press are watching, and really do care that she handles the issue well. We'll have to be quiet and orderly while we're in the courthouse. There will be no questions from the audience (that's us), and no photography, but the session will be tape-recorded and transcribed. You can take notes if you like. So, here's your excuse to put on a nice costume, take the morning off, and pay a call on the inner sanctum of our civil rights. See you there! John Gilmore PS: If you can't come, you can still contribute. Become an EFF member; see http://www.eff.org/join.

1 0

ITAR restricts Financial Cryptography
by frantz＠netcom.com 17 Dec '03

17 Dec '03

Just in case anyone still thinks that the ITAR doesn't interfere with the use of cryptography to protect financial systems from fraud, here is a data point. >From Robert Hettinga's e$pam list quoting the set-discuss list: ----------------------------------------------------------------------- From: "Lewis, Tony" <tlewis(a)visa.com> To: "'set-announce'" <set-announce(a)commerce.net>, "'set-discuss'" <set-discuss(a)commerce.net> Subject: Reference code availability update Date: Thu, 31 Oct 1996 21:06:34 -0800 Encoding: 14 TEXT Sender: owner-set-talk(a)commerce.NET Precedence: bulk +----------------------------------------------------+ Addressed to: set-discuss(a)commerce.net +----------------------------------------------------+ At the SET Open Vendor Meeting, MasterCard and Visa announced that a SET reference implementation would be made available. Unfortunately, producing the reference code has taken longer than we planned. Our current plan is to have it ready by the end of November, 1996. Because of U.S. export regulations, it will not be possible for us to post the reference code for download. Individuals and companies that want a copy of the reference code will need to request it. The procedures for making such a request will be announced here in approximately one week. _________________________________________________________________ Tony Lewis (tlewis(a)visa.com) Chief Systems Architect, Internet Commerce Visa International Service Association ------------------------------------------------------------------------ This message was sent by set-discuss(a)commerce.net. For a complete listing of available commands, please send mail to 'majordomo(a)commerce.net' with 'help' (no quotations) contained within the body of your message. ------------------------------------------------------------------------- Bill Frantz | Tired of Dole/Clinton? | Periwinkle -- Consulting (408)356-8506 | Vote 3rd party. I'm | 16345 Englewood Ave. frantz(a)netcom.com | Voting for Harry Browne | Los Gatos, CA 95032, USA

1 0

Moneychangers and Shylocks
by Timothy C. May 17 Dec '03

17 Dec '03

There've been a couple of "you must be trolling us" responses to my point about the First World spending money in the Third World not being exploitation ("and we give them worthless trinkets like penicillin, schools, and roads"). I happen to believe economic development is a positive good. Were I living in a shantytown or favelo on the outskirts of some Third World town, I would want at least the _chance_ of eventually having running water, electricity, health care, and opportunity for me and my family, Arguing that native peoples were better off before the arrival of Europeans is fatuous nonsense--you can't go home again. Further, many of the leftist critiques of "moneylending as exploitation" are similar to past (and current) demonizations of moneychangers, moneylenders, shylocks, and other assorted stereotypes. I don't favor nationalistic lending and borrowing policies, which, for example, involve some central government borrowing money, sending the borrowed funds to personal Swiss bank accounts, and then sticking the nominal taxpayers with the debt. Nothing I have said here endorses this. But much lending is useful. It's the way factories get built, the way things get done. Much of the criticism of "moneylenders" is closely related, if you think about it, to criticism of "money launderers." Cypherpunks should relish the rise of new mechanisms for money laundering, moneylending, tax evasion, etc. I took the "Wired" quote about Walter Wriston "sounding like a cypherpunk" to represent this new view, in explicit contrast to his earlier views when he headed Citibank and they had a more statist approach. Your mileage may vary, but tired homilies about lending being exploitation are not very useful in this day and age. --Tim May "The government announcement is disastrous," said Jim Bidzos,.."We warned IBM that the National Security Agency would try to twist their technology." [NYT, 1996-10-02] We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: White House crypto proposal -- too little, too late
by azur＠netcom.com 17 Dec '03

17 Dec '03

>Are there any current import restrictions for products on can legally >manufacture, sell, and use in the United States? > >Thanks. Yes, all products which may create RF radiation (e.g., personal computers) are required to pass FCC certifications (e.g., Part 15). Also, telephone equipment (e.g., modems) must pass other Part 15 provisions before they may be sold in the U.S. to interconnect with our public switched network. PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Steve Schear | Internet: azur(a)netcom.com Lamarr Labs | Voice: 1-702-658-2654 7075 West Gowan Road | Fax: 1-702-658-2673 Suite 2148 | Las Vegas, NV 89129 | --------------------------------------------------------------------- Internet and Wireless Development Vote Liberatrian!

1 0

Re: Sliderules, Logs, and Prodigies
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 10:30 AM 11/1/96 -0800, you wrote: >Seriously, only a very few of us had and used sliderules...mine was a big >synthetic K & E (Keuffel and Esser, as I recall). The raging "DOS vs. Mac" >or "RISC vs. CISC" debate of that age was "aluminum" (the yellow Dietzgens) >vs. the old standby, "bamboo." Plus some oddball circular sliderules. I used plastic ones, myself; they were good enough for any work I was doing, even after the occasional rebuild when the [whatever you call the clear slider with the line on it] fell off. Started with the basic model, and later a wider log-log-trig model. I also had a few circular ones, including a big car-rally model that let you get an extra digit or so of precision (remember when precision was measured in digits rather than bits? :-) There were also a variety of nomographs and other weird slide-rules and graphical tools that were simple analog computers. We used some of them in electrical engineering classes for complex calculations that didn't need to be highly precise, which most of them didn't in a world where the extra-fancy resistors had 5% tolerances and you achieved accuracy by adding various tweakers instead. ObCrypto: Secret Decoder Rings are more or less circular slide rules, but there really isn't much crypto you can do in analog. :-) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

1 0

Unix User Password File Encryption
by Erp 17 Dec '03

17 Dec '03

Ok, I realize that you cannot reverse the encryption process for a Unix password.. But -- Explain to me why the following wouldn't work. And if it could work, I am willing to do the algorithms and math for this... I'm no good at coding and such.. But I can do algorithms and a lot of math easily enough *shrug*.... And if anybody uses this idea --- Please give me credit for the idea.. If it has already been tried -- Can someone please refer me to where it was tried, adn if there are any texts on it.. I would like to read them.. Thanks ok here it is: Normal Programs for Cracking a Unix password file, such as CrackerJack take a word, use the salt in the password file for that password, encrypt the word using that salt, and then compare what it comes out as. If it isn't the same, it moves on to the next word. My idea is similar to this, but is a bit different. Basically it would take a beginning word and encrypt it with the same salt as used on the password in the passwd file. So let us say that for an example our salt is aa, our outcome encrypted password is X8mfjs53D ... Ok now let us say that we take this salt of aa and run through the following into it and getting these patterns from it (these aren't the true patterns etc, I'm just making htese things up, but would it be possible?) salt aa -- inputed password 0001 -- outcome encryption Zkdrj234S salt aa -- inputed password 0002 -- outcome encryption Rksjr342s salt aa -- inputed password 0003 -- outcome encryption 25Svj43zY (For the following process we'd obviously use mor ethan three, we would probalby use a thousand at least, nad have them be all sizes of passwords and combiantions.. like aaaab or abababababab and so on...) Compare the outcomed encryptions -- And find a pattern in them.. Now in the above I'm just going to say like it comes out as 8x + 4/y - SQ(2z) + 4a = encrypted password.. Where xyza are each of the characters respectively such as 0000 xyza based on a 255 or however many ascii char system.. I know this is completely wrong for what I've done here, but I'm not doing the math or anything right now, I'm just making it up as I go for an example... Now say that since we have found the pattern... We take the outcome -- Do the algebra to figure out what the xyza would be.. And ther eya go woopity doo there is the password.. Not as simple as I've said here of course.. It would be a lot more complex.. But that is the basic idea... What is wrong with this idea? -- If it is something I have thought of, and havent' mentioned -- I'll inform you when you point it out.. But please do point it out.. Or I'll grasp at straws and say a lot of buts *laugh*... Anyways, What is wrong with this idea? How could it work? Would someone mind explaining for me, is much appreciated... Erp --------------------------- E'gads, ideas can be hell at time..

2 2

Re: Dr. Vulis is not on cypherpunks any more
by Rich Burroughs 17 Dec '03

17 Dec '03

At 02:13 AM 11/2/96 -0800, John Gilmore <gnu(a)toad.com> wrote: >As stated by Dr. Vulis, he is no longer on the cypherpunks mailing >list, and indeed majordomo(a)toad.com HAS been instructed to ignore his >requests to resubscribe. > >I removed him, on my own initiative. I got tired of asking him to >stop stirring up flames. When he posted a message saying that we'd >have to use technical means to stop him from flaming the list, I said, >"OK". [snip] This all seems really silly to me. Are people on this list not sophisticated enough to be capable of filtering his posts if they don't like to read them? What's to stop him from using reailers or nymservers? Are you going to block them, too? By doing something like this you give him far more attention and encouragement than he deserves. It's a big mistake, IMHO. Rich

4 3

Re: Telling quote from Bernstein hearing
by Rich Burroughs 17 Dec '03

17 Dec '03

At 09:31 AM 11/3/96 -0800, Dale Thorn <dthorn(a)gte.net> wrote: >Lucky Green wrote: >> In the recent hearing of the Bernstein case, Anthony Coppolino for the >> Justice Department said: >> "We don't care about the theory; we don't care about >> the idea Mr. Bernstein has, which was to take a particular type >> of algorithm and use it to allow for an encrypted interactive >> conversation. That's his idea. >> We don't care about his idea; we care about the >> result of what it can do." > >[snip] > >Could I suggest a translation? "We're going to trust Professional Government Consultant >Organization XYZ to tell us about Mr. Bernstein's idea, since we obviously won't >understand Mr. Bernstein's own explanation." (And we do care about his idea, but we >can't admit that, because it would make us look stupid) Heh :) I think that Lucky hit on a choice quote from Coppolino -- it was really at the heart of his arguments. Since Judge Patell ruled that source code is speech, the ground has really shifted from just limiting crypto to limiting Bernstein's freedom of speech, and this is much to the government's disadvantage. Coppolino tried to avoid the issue by claiming that the government is not interested in restraining Bernstein's ideas (claiming several times that the government does not interfere with academic discussion of crypto), but that they want to impede the specific functionality of Snuffle. Bernstein's attorney, Cindy Cohn, aptly replied that the ideas behind the crypto _dictate_ the functionality, and that you can't restrain one without affecting the other (or words to that effect). I don't think that Coppolino meant that they do not understand Bernstein's ideas :) (though perhaps he does not...) Rich ______________________________________________________________________ Rich Burroughs richieb(a)teleport.com http://www.teleport.com/~richieb See my Blue Ribbon Page at http://www.teleport.com/~richieb/blueribbon U.S. State Censorship Page at - http://www.teleport.com/~richieb/state New EF zine "cause for alarm" - http://www.teleport.com/~richieb/cause

1 0

Re: [NOISE]Re: Dr. Vulis
by Ross Wright 17 Dec '03

17 Dec '03

On or About 3 Nov 96 at 15:44, Sandy Sandfort wrote: > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > SANDY SANDFORT > . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . > > C'punks, > > > Just want to add my 2 cents. I am also unhappy with the fact that > > he was removed. My personal correspondence with Vulis has been > > friendly and he has been very helpful. > > Then I suggest that Ross not remove Dimitri from his private > e-mail correspondence. On this list, however, Dimitri was NOT > friendly NOR helpful. > > Wha do Ross' or anyone else's private interactions have to do > with the decisions of those who pay for this list's existance? In fact, nothing. I just wanted to show that this coin has 2 sides. Ross =-=-=-=-=-=- Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: 415-206-9906

1 0