Cryptography-Digest Digest #50, Volume #9 Sun, 7 Feb 99 13:13:04 EST
Contents:
Intel's description of the Pentium III serial number (Anthony Naggs)
Re: SFS & Iomega (Sorcerer)
Re: *** Where Does The Randomness Come From ?!? *** ("PAC")
Re: hardRandNumbGen (Herman Rubin)
Re: SCOTT COMPRESSION ("Eric W Braeden")
----------------------------------------------------------------------------
From: Anthony Naggs <[EMAIL PROTECTED]>
Crossposted-To: comp.sys.intel
Subject: Intel's description of the Pentium III serial number
Date: Sun, 7 Feb 1999 17:08:13 +0000
I visited Intel's website again, to see if the manuals for the P III
have appeared yet. No such luck, but there are several pages describing
the serial number stuff in various levels of detail. (Nothing about the
random number generator that I could see.)
I think it is appropriate to post the 'tech' information here, to
enlighten the current discussions. (Reproduced without permission.)
----<Begin: Pentium III 'tech.html' from http://www.intel.com/>----
Pentium(R) III Processors
Processor serial number technical notes
Overview
The Intel(R) processor serial number is a new feature supported in Intel
Pentium(R) III processors. Processor serial number is a persistent,
non-modifiable, identifier which applications can use to provide stronger
identification of the processor and, with similar identification factors
such as username and password, the system and user. The number
embedded in the processor core can be read by software but cannot be
modified. The ability for software to read the processor serial number
can also be disabled if a user does not want to make his/her processor
serial number available to software applications. To make this choice
more conveniently available to the user, Intel will provide a software
utility for controlling the processor serial number.
Processor Serial Number
The processor serial number is a 96-bit number programmed into the
processor core at manufacturing time. The number is programmed into
the silicon of the processor core and cannot be modified. The upper 32
bits of the processor serial number are the existing CPUID information
while the lower 64 bits are different for each processor. The 32-bit
CPUID contains coded information about the processor, including
whether it is a genuine Intel processor, which family the processor
belongs to (Pentium processor, Pentium II processor, etc.), and the
manufacturing version or "stepping" of the processor. More information
about CPUID can be found on the developer's site. The lower 64 bits
are different for each processor and have no independent meaning.
Processor Serial Number Instructions
There are two new instructions associated with the processor serial
number -- a read instruction and a disable instruction. The read
instruction is an extension of the existing CPUID read instruction. When
the processor serial number read instruction is executed, the processor
returns the 96-bit processor serial number. The disable instruction
involves a Model Specific Register (MSR) bit that controls when the
processor serial number can be read. When the MSR bit is set to '0', the
processor serial number can be read by software. When the MSR bit is
set to '1', the ability for software to read the processor serial number is
disabled. The processor serial number disable instruction sets the MSR
bit to '1', disabling the ability for software to read it. When the MSR bit
is set to '1' and the ability to read the processor serial number is
disabled, it is still possible to read the 32-bit CPUID by executing the
existing CPUID instruction, however the bottom 64 bits of the
processor serial number are not defined.
Reading Processor Serial Number
A software application can read the processor serial number if it
executes the processor serial number read instruction and the processor
serial number is enabled (MSR bit set to a '0'). The processor serial
number is not an "active" element of the system - it does not broadcast
itself to the operating system, applications, or across the Internet. The
processor serial number is "passive" - available only if the operating
system or application executes the processor serial number read
instruction. This means that websites on the Internet cannot directly
read a system's processor serial number. A website has to send the
system a separate piece of software in order to read and return it's
processor serial number. The following steps summarize this process:
1. User visits a website
2. Website wants to access the processor serial number of the
user's system
3. Website typically asks user permission to access personal
information, including processor serial number
4. User grants permission
5. Website sends a piece of software ("applet") to the system to
read the processor serial number, such as an Active-X control, a
signed Java applet, or stand-alone program
6. The applet first has to pass through the security protocols of the
user's browser, allowing the user to decide whether or not the
applet has permission run on the system
7. The applet runs on the user's system, executing the processor
serial number read instruction. The processor serial number is
read only if the ability to read the number is enabled (MSR bit set
to '0')
8. The applet sends the processor serial number back to the website
Step 6 is very important - the user decides whether a website can
access the system's processor serial number. The default security
settings of most browsers allow websites to run applets on the system
only if the user gives explicit permission through a dialog box. A website
cannot access a user's processor serial number unless the user actively
gives permission to do so.
This method of controlling access to the processor serial number is
consistent with safe behavior when accessing the Internet - never grant
an Internet site permission to download software to your system unless
you trust the source of the software. Trusting means that you believe it
is both safe to run the software on your system and the website will use
any information gathered in a appropriate manner, often outlined in the
website's privacy policy or legal notice. For an example, see Intel's own
privacy policy.
Disabling Processor Serial Number
When the processor serial number is disabled by the processor serial
number disable instruction, the ability to read the processor serial
number can only be re-enabled by a hardware reset of the processor.
The processor serial number was designed this way to protect user
privacy - when the processor serial number is disabled, it cannot be read
by any software program until the processor is reset. When the MSR bit
is changed from '0' to '1' it latches or sticks in the '1' state, unable to be
changed back to a '0' by a software instruction. The only way to change
the MSR bit from a '0' to a '1' is via a hardware reset of the processor.
Enabling Processor Serial Number
When the processor serial number feature is disabled, it can only be
re-enabled by executing a hardware reset. The hardware reset is
executed by triggering the RESET# pin of the processor. Triggering the
RESET# signal can be done in three ways:
Turning the system power from off to on
Hitting the reset button on the front panel of most systems
Resuming from deep sleep in mobile systems is often done by
activating the RESET# signal The exact means for triggering the
RESET# signal of the processor are often specific to a given
system and manufacturer.
Controlling Processor Serial Number
There are two main ways for users to control the state of the processor
serial number, whether it is enabled or disabled. The first is the Intel
processor serial number control utility. The processor serial number
control utility is a Windows* program developed by Intel to give users
direct control and choice over whether processor serial number is
enabled or disabled on their system. The second way is through the
system BIOS.
Processor Serial Number Control Utility
The processor serial number control utility enables users to:
* Determine whether the processor serial number is enabled or
disabled
* Enable or disable processor serial number
* Read the value of the processor serial number
The processor serial number control utility installs itself in the
Windows* registry, so that it executes each time Windows* boots. It
places an icon in the Windows* system tray, providing a visible means
for users to regularly and easily determine whether the processor serial
number is enabled or disabled.
When the processor serial number control utility is installed, it is set to
disable the processor serial number of the system. To enable the
processor serial number, the user must select the enable option in the
dialog box of the control utility. After doing so, the control utility asks
the user to turn the system off and on to enable the processor serial
number. To disable the processor serial number, the user selects the
disable option in the dialog box of the control utility. By doing so, the
processor serial number is instantly disabled. When disabled, software
applications will not be able to access the processor serial number
feature unless and until the user uses the control utility to re-enable the
processor serial number by resetting the processor. Because the control
utility installs itself in the Windows* registry, the control utility sets the
processor serial number to the state last selected by the user each time
the system is turned on or rebooted. Here's an example:
* Processor serial number is currently enabled
* User uses control utility to disable processor serial number -
processor serial number is disabled
* User turns off system
* Sometime later, user turns system on - processor serial number
is momentarily enabled in hardware as the system boots
* As Windows* boots, control utility executes and disables
processor serial number - processor serial number is disabled
The Intel processor serial number control utility can be obtained from
Intel's website after the introduction of the Pentium III processor. Many
PC manufacturers will also include the control utility with their systems
or make the utility available via their web sites.
BIOS Control
User control over the state of the processor serial number may also be
provided by the system BIOS. Since the BIOS is the first software
element that executes on the computer, it is also the first opportunity for
enabling or disabling the processor serial number feature. Intel has been
working with PC manufacturers and BIOS developers to help them
provide an end-user setup option that allows the state of the feature to
be controlled directly by the user. Such a BIOS would require the user
to enter some type of BIOS setup program to set the enabled/disabled
state of processor serial number, which would be activated when the
PC is rebooted. Intel recommends that the processor serial number
control utility be the primary means for the user to control the state of
the processor serial number. The BIOS control utility is useful for users
who are using operating systems other than Windows*, like Linux*, as
well for users who desire additional assurance that their processor serial
number is disabled. For most users, the Intel processor serial number
control utility provides users with an easy to use, consistent interface to
control the state of their processor serial number.
Default State of the Processor Serial Number
Intel is recommending that PC manufacturers use the processor serial
number control utility to configure systems so that the default state of
the processor serial number is OFF. This provides the greatest privacy
protection for users: they have to actively enable the processor serial
number via the control utility before an application or website can
access the number.
Using the control utility to set the default state of the processor serial
number to OFF is important because it is necessary for the default state
of the processor serial number in the processor to be on. It may be
counterintuitive, but it is necessary for the default state of the processor
serial number in the processor to be ON to provide the user with the
greatest privacy protection. The reason for this is the "stick OFF"
implementation of the MSR disable bit. The disable bit has to stick in the
OFF position to protect user privacy, so a program cannot re-enable the
processor serial number without the user's knowledge. Since the MSR
bit sticks in the OFF position, it cannot default to OFF after a processor
reset since there would be no way to re-enable the processor serial
number. Therefore Intel configured the processor so the default for the
processor serial number is ON, but implemented the processor serial
number control utility to default OFF so that the final state of processor
serial number once the user gains access to Windows* is defaulted to
OFF.
To summarize, this is the process of setting the initial default state of the
processor serial number when using the control utility as the primary
control mechanism:
* ON when the processor first resets (hardware requirement)
* ON when the BIOS executes (BIOS switch default is "enabled")
* OFF when the control utility executes (control utility default
turns processor serial number feature "OFF")
This default protocol ensures that the first time a user operates his/her
system, the processor serial number is disabled. The processor serial
number feature will then stay disabled until the user uses the control
utility to enable it.
Summary
The Intel processor serial number is a new feature, which will enable a
variety of new and better applications. We have designed the ability to
disable the feature in software, and we're making a control utility
available for the user to control the processor serial number. Consumers
have the choice whether to enable the processor serial number or disable
it.
----<End: Pentium III 'tech.html' from http://www.intel.com/>----
--
Anthony Naggs
Software & Electronics Engineer
------------------------------
Date: 7 Feb 1999 17:30:52 -0000
From: [EMAIL PROTECTED] (Sorcerer)
Subject: Re: SFS & Iomega
Crossposted-To: alt.security.pgp
On Sun, 07 Feb 1999 09:47:19 +0100 [EMAIL PROTECTED]
(Michael Hortmann) wrote:
>I've been using Peter Gutmann's SFS (Secure File System)
>for several years under DOS/Windows3.x/Windows95 to encrypt
>a partition of my hard disks or diskettes. I'd really like
>to use it for my Iomega ZIP and JAZ media, too.
>
>Does anyone know of a way to do this?
>
>Or is there another good cryptographic file system for
>Windows95 which can be used instead?
SFS was designed for DOS, and doesn't seem to be supported anymore.
Try Scramdisk or PGPDisk instead.
See http://www.geocities.com/CapeCanaveral/3969/crypto.html#Disk
------------------------------
From: "PAC" <[EMAIL PROTECTED]>
Crossposted-To: sci.philosophy.meta,sci.physics,sci.skeptic
Subject: Re: *** Where Does The Randomness Come From ?!? ***
Date: Sun, 7 Feb 1999 08:39:16 -0800
R. Knauer wrote in message <[EMAIL PROTECTED]>...
>On Sun, 07 Feb 1999 03:05:38 +0000, Colin Day <[EMAIL PROTECTED]>
>wrote:
>
>>Math is a closed system? I think that Godel would dispute that (if he
weren't
>>dead)
>
>You left out Turing, who is also dead. But Greg Chaitin is alive, and
>he disputes that quite vigorously:
>
Well then I'll take a back seat here (>;
But this argument is just based on the idea of Spinoza that math and the
universe // each other, which then would explain the predictability of math
due to that // of both being closed systems.
It’s pretty obvious that math wouldn’t be as perfect a closed system in
all the ways that it could be defined, but enough for the comparison. Also
math’s unique consistency and predictability might be altered, as we talked
earlier in an identity thread, by the use of logical symbols that open math
up to more directly represent certain physical situations, in that, because
math is closed it can’t see beyond itself except in a // mode, not able to
directly grasp the data and escape beyond itself being that it’s a closed
system. Therefore open systems might have a greater chance in uniting the
fabric of reality to explain certain realities, singularities for example,
able to link to other systems better , being more open ALA logic etc.
And added, because I'm not sure on the addition of SQR(-n) imaginary
numbers as
indeterminants:
That imaginary numbers in terms of neg square roots might not be
imaginary at all. This is commonly understood given the considered
difference between the multiplicand and multiplier. Therefore -3 * 3 = -3
+ -3 + -3, i.e. the multiplier can always be considered a positive
umber. -3 * -3 as no meaning as a negative entity, relatively speaking a
negative number dealing with negatives only is the same as a positive
number, just a viewpoint change, only when there is a combination -/+ has a
differentiation necessary.
SO when we have SQR(9) we have 3 * 3 * 3 as the fundamental then 3 * the
multiplier 3, in other words an automatic imbalanced situation because the
multiplier and the multiplicand can be considered separate entities. The
root of a square root in the representation of SQR() function is looking for
the multiplicand, not the multiplier.
SQR(-9) is then = -3 + -3 + -3, so it is -3 times the positive
multiplicand of 3. NO contradiction for the root of the multiplicand
remains consistent while the multiplier remains positive in any -/+
calculation. TO transverse a number line it’s not necessary to make the
multiplier negative, just have the direction altered by -/+ multiplicand.
On or the other might have to be chosen as negative so might as well be
consistent.
You could say vice-versa regarding multiplicand/multiplier, but as long
as there is an implication that they are weighted differently in
mathematical calculations then SQR(-n) numbers are no longer imaginary but
the roots are just given different functions ALA multiplier/multiplicand.
And other such daftness,
Phil C.
------------------------------
From: [EMAIL PROTECTED] (Herman Rubin)
Subject: Re: hardRandNumbGen
Date: 7 Feb 1999 09:35:58 -0500
In article <[EMAIL PROTECTED]>,
R. Knauer <[EMAIL PROTECTED]> wrote:
>On 4 Feb 1999 14:36:11 -0500, [EMAIL PROTECTED] (Herman Rubin)
>wrote:
>>If one can assume independence between generated sets, one can make
>>both of these errors quite small, if the point null is not assumed.
>>That is, the user must specify the inaccuracy allowed, which cannot
>>be zero.
>Please elaborate on how this is done.
>I am interested in seeing how much testing is involved for a given
>level of confidence, and how that testing effort increases with
>decreasing levels of confidence.
The number of items to be tested for a given level of confidence
and a given accuracy goes up as the square of the accuracy wanted.
If one had guaranteed independent observations with a probability
p of success, and wanted to get assured probabilities of acceptance
if p=.5, and also of rejection if |p-.5|>d, the sample size needed
would increase as 1/d^2, for d small, which is the situation of
interest here. Not much changes qualitatively if one wants to
accept for p closer to .5 than some multiple of d, such as d/10,
except for a factor.
The same results hold if there are a fixed number of tests; there
would be a factor depending on how many and which tests are to be
used. So a 10 megabyte file could be easily tested in such a way
that one could be fairly sure that the deviation from randomness
was at most 1%, and have good chance of acceptance if it was .1%.
Now if we XOR independent files, say run on different days, the
deviations from randomness multiply. So if we XOR 8 files, and
accept if 5 pass, we can be quite confident about the results.
To do this by testing a single file would require a file of size
more than 10^20.
--
This address is for information only. I do not claim that these views
are those of the Statistics Department or of Purdue University.
Herman Rubin, Dept. of Statistics, Purdue Univ., West Lafayette IN47907-1399
[EMAIL PROTECTED] Phone: (765)494-6054 FAX: (765)494-0558
------------------------------
From: "Eric W Braeden" <[EMAIL PROTECTED]>
Subject: Re: SCOTT COMPRESSION
Date: Sun, 7 Feb 1999 10:27:36 -0500
fungus wrote in message <[EMAIL PROTECTED]>...
>
>
>Eric W Braeden wrote:
>> If the source file is compressible, you have
>> increased the "density" of the entropy fed to the
>> hash function, but what does this get you?
>>
>
>More entropy in a fixed space.
>
>Most crypto keys have a fixed size, eg. 128 bits. The more
>entropy you can cram into that space, the better.
>
Assuming you have enough entropy to start with, again, why
compress. Assume a 1k file. Hash it. Then compress that
1k file down to 512 bytes and hash it. In both cases the
same amount of entropy is fed to the hash function. Shouldn't
the hash of the first be as "good" as the hash of the second?
In both case the hash function destroys the same amount of
entropy to build the final hash value.
Eric
------------------------------
** FOR YOUR REFERENCE **
The service address, to which questions about the list itself and requests
to be added to or deleted from it should be directed, is:
Internet: [EMAIL PROTECTED]
You can send mail to the entire list (and sci.crypt) via:
Internet: [EMAIL PROTECTED]
End of Cryptography-Digest Digest
******************************
