Challenge: Hack Elementrix!

["Dana W. Albrecht" <dwa@corsair.com>]

Everyone,

I think that with all the recent attention to Netscape and Microsoft that
another target has been altogether overlooked:  Elementrix POTP <spit>.
 
> New encryption method announced
> 
> Sept. 29 -- Elementrix Technologies has announced a breakthrough in data
> encryption that does away with the need for passwords and public/private
> keys, instead working transparently at either an application or hardware
> level. Using the One Time Pad method of encryption -- acknowledged for a
> long time as being a superior encryption method -- Elementrix has released
> both an FTP and E-Mail package that makes sending secure messages as easy
> as just clicking a button. Its Power One Time Pad (POTP) technology
> promises to ensure that in the very near future, the entire Internet can
> become a fundamentally secure place.

Elementrix is on the Web.  http://www.elementrix.co.il/

Reposted from sci.crypt:

In article <30803C0E.2781E494@unix.ka9q.ampr.org>, Phil Karn <karn@unix.ka9q.ampr.org> writes:
> This announcement pegs my bogometer (a device for measuring bogons,
> the elementary particle of bogosity).
> 
> Readers of the Skeptical Inquirer and other similar publications will
> recognize all the classic signs of a scam, either deliberate or
> self-delusionary:
> 
> 1. Breathless, overhyped language ("revolutionary", "breakthrough", etc)
> 
> 2. Clear misstatements of well-established theoretical principles
> (the discussion of the one-time pad)
> 
> 3. Reluctance to get specific, usually by citing proprietary concerns.
> When this is combined with a claim that a patent application has been
> filed, this is a clear sign of bogosity -- one's patent
> rights can be compromised only by publishing *before* filing, not after.
> 
> Unless, of course, the claim is rejected by the patent office,
> which is almost unheard of these days even for clearly bogus and/or
> trivial "inventions".
> 
> Phil

While Elementrix has failed to provide any detailed technical information
(specifications, source code, etc.) this is not entirely out of reach.

You can obtain an evaluation copy of their "secure" FTP client from
ftp://ftp.elementrix.co.il/pub/secftp/

This appears to be a binary for Microsoft Windoze.

The server at ftp.elementrix.co.il is a "secure" server.  Note:

    ftp> open ftp.elementrix.co.il
    Connected to ftp.elementrix.co.il.
    220 sunex FTP server [Elementrix POTP(1.51) Secure FTP(1.5-3)] ready.
    Name (ftp.elementrix.co.il:dwa): anonymous
    331 Guest login ok, send your complete e-mail address as password.
    Password:
    230 Guest login ok, access restrictions apply.
    ftp> close
    221 Goodbye.
    ftp>

So there you go.

Sure, commented source code with accompanying specifications for an
implementation are nice, but did Ian and David have such luxuries for
their Netscape hack?

I will confess that I have not actually tried running their software,
let alone reverse-engineering it, as I am Windoze-challenged (running
on SunOS 4.1.x as we speak).  However, I'm sure there are probably many
people on this list with suitable Windoze platforms complete with the
necessary reverse engineering tools.

In many ways, Elementrix is a more enjoyable target.  Their claims of
security reek of more marketing hype than even Microsoft would stoop to,
and their use of the term "One Time Pad" is disgusting.  At least Netscape
is trying to use respectable crypto algorithms and is being open about
their code.  These people deserve to flamed far more than Netscape (and
even Microsoft) ever did.

Perhaps someone could even convince Sameer to do T-shirts.  I'll even
agree to cover the cost of one for the first exploit.  How about it,
Sameer? :)


Dana W. Albrecht
dwa@corsair.com