December 2003 - cypherpunks-legacy

Forwarded mail...
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: >From INFO-RUSS-request(a)smarty.ece.jhu.edu Fri Dec 5 18:35:23 1997 From: INFO-RUSS-request(a)smarty.ece.jhu.edu Date: Fri, 5 Dec 97 14:33:28 -0500 Message-Id: <9712051933.AA02486(a)smarty.ece.jhu.edu> To: info-russ(a)smarty.ece.jhu.edu >From INFO-RUSS-request(a)smarty.ece.jhu.edu Fri Dec 5 14:04:00 EST 1997 Errors-To: INFO-RUSS-request(a)smarty.ece.jhu.edu Sender: INFO-RUSS-request(a)smarty.ece.jhu.edu Precedence: bulk Date: Sat, Dec 5 97 14:15:59 EST From: info-russ(a)smarty.ece.jhu.edu To: info-russ(a)smarty.ece.jhu.edu Subject: INFO-RUSS: Chem-to schelkal, v chem byl spryatan infrakrasnyi ob'ektiv... --------------------------------------------------------------------- This is INFO-RUSS broadcast (1200+ subscribers). Home page, information, and archives: http://psi.ece.jhu.edu/~kaplan/IRUSS/inforuss.html To post, subscribe, or unsubscribe mail to info-russ(a)smarty.ece.jhu.edu ======================================================================== Folks, this is to follow up our previous story on arrested "spy" in Rostov, Russia. Looks like the old Sov-Russ-paranoia about spies is back. BTW, note a correction to the previous info: Mr. Bliss is not New Zealander, he is our fellow American who works for a New Zealand company. Alex Kaplan, info-russ owner/coordinator sasha(a)super.ece.jhu.edu http://psi.ece.jhu.edu/~kaplan ======================================================================== Reuters, Friday December 5 9:06 AM EST American Charged In Rare Russian Spy Case By Adam Tanner MOSCOW (Reuters) - A 29-year-old U.S. telephone technician was charged with espionage against Russia Friday in what officials say is the first such case involving an American since the end of the Cold War. A spokesman for the Russian Federal Security Service (FSB) said Richard Bliss, who was arrested in the southern city of Rostov-on-Don Nov. 25, had been formally charged with spying. The text of the criminal charges was to be read to Bliss in English translation as he does not speak Russian, Russian television reported. But the exact wording of the charges was not made public as it was a state security matter, the report said. Bliss had been in Rostov for two months working to install a wireless telephone system when he was detained. He worked for San Diego-based telecommunications company Qualcomm. The U.S. Embassy has said Bliss was not a spy and Qualcomm also denied he was involved in espionage, saying he was performing routine tests to help install a wireless telephone system. U.S. officials earlier said they were continuing to press for his release and expected Vice-President Al Gore to telephone Russian Prime Minister Viktor Chernomyrdin later in the day to appeal for his release. "At the highest levels of government exchanges of information are flowing back and forth quite rapidly," said Qualcomm's head of government relations, Bill Bold. The FSB earlier said Bliss had carried out long-distance topographical surveys with what it called illegally-imported satellite receivers and obtained secret information about unspecified "restricted" buildings in the Rostov area. Dan Pegg, a Qualcomm senior vice-president, said Bliss was using global positioning system (GPS) equipment to measure the strength of radio signals from a central communications transmitter. Asked if Bliss could have worked as a spy without Qualcomm's knowledge, Pegg said: "They say never say never, but I'd say absolutely not." A resident of San Diego, Bliss had been in Russia about two months when he was detained, Pegg said. A high-school graduate who never went to college, Bliss worked for several communications companies before Qualcomm hired him six months ago to help install telephone systems worldwide. REUTERS@ ----------------------------------------------------------------------------

1 0

Ron Brown Died From A .45 In The Head
by Jonathan Wienke 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I heard an interview with Chris Ruddy (of Vincent Foster fame) on KSFO 560 AM in San Francisco. In the interview, Chris disclosed that an Army pathologist, LtCol Steve Cogswell, was one of the doctors who processed the bodies from the plane crash which supposedly killed fromer Commerce secretary Ron Brown. LtCol Cogswell took an X-ray of Ron Brown's skull, and found a circular hole .45 inches in diameter in the skull, as well as some metal fragments inside the cranial cavity, consistent with a gunshot wound. The original X-rays were destroyed, and no autopsy was performed to determine the cause of death; but a photographer took some pictures of the x-rays while they were on display, and these pictures were NOT destroyed. LtCol Cogswell provided copies of the photos of the x-rays to Ruddy, and they were printed in a newspaper out east somewhere (I missed a few minutes of the interview). Today, I heard that LtCol Cogswell has been placed under a gag order and his his house was searched by MP's. Something is rotten in Denmark... -----BEGIN PGP SIGNATURE----- Version: PGP for Business Security 5.5 iQA/AwUBNIjCvcJF0kXqpw3MEQIaWwCglmjV6vIPR8w/lnwdgxRRdbzskVoAn0eE cQ3mGJYckbJ06DXqF1dmNozJ =VbVp -----END PGP SIGNATURE----- Jonathan Wienke PGP Key Fingerprints: 7484 2FB7 7588 ACD1 3A8F 778A 7407 2928 3312 6597 8258 9A9E D9FA 4878 C245 D245 EAA7 0DCC "If ye love wealth greater than liberty, the tranquility of servitude greater than the animating contest for freedom, go home from us in peace. We seek not your counsel, nor your arms. Crouch down and lick the hand that feeds you. May your chains set lightly upon you; and may posterity forget that ye were our countrymen." -- Samuel Adams "Stupidity is the one arena of of human achievement where most people fulfill their potential." -- Jonathan Wienke Never sign a contract that contains the phrase "first-born child." RSA export-o-matic: print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

1 0

Re: Singapore & Freedom
by Blanc 17 Dec '03

17 Dec '03

SingMonger wrote: >Don't forget the other good points, no guns or bullets, color >copiers are (were?) restricted, all media controlled by the >government (even Time magazine was banned), mandatory savings >program (CPF), National Service, and the government attitude of >those that are not with us are against us. Also, don't forget >that the Singaporean government has brought the Big Brother >concept to reality. .............................................................. Sounds like the kind of place suitable for people who don't have a Mind of Their Own, nor a personal vision of, or mission in, life (besides maintaining an active DNA pool). .. Blanc

2 1

Re: IP: U.N. Hate-Radio Jamming Would Send Wrong Signal
by William Reichenbach 17 Dec '03

17 Dec '03

Notice the Double Speak in the LA Times article below? What is taking place in Bosnia is Exactly the same thing (Censorship) as the writer of the article is expressing concern about. It is exactly the same conduct that the two NWO Stooges Metzl and Rep Royce so enthusiastically endorse. It is only a question of whose ox is being gored. William "Indeed, the United States and its allies are conducting a somewhat similar operation in Bosnia. Two months ago, NATO troops seized and effectively shut down a station run by hard-line Bosnian Serb forces after the station broadcast inflammatory attacks on NATO forces trying to keep the peace there. But it's a long step to go from these situations to the creation of a permanent, formal unit run by the United Nations and scouring the world in search of radio broadcasts to jam. " believer(a)telepath.com wrote: > >From the Los Angeles Times: > > Wednesday, December 3, 1997 > > INTERNATIONAL OUTLOOK > U.N. Hate-Radio Jamming Would Send Wrong Signal > By JIM MANN > > WASHINGTON--In foreign policy, sometimes the noblest of intentions > leads to > lousy ideas. > > That's certainly the case with the recent curious proposal for a > special > United Nations "jam squad"--a special U.N. team that could be > hurriedly > dispatched to crisis points around the world carrying equipment to > jam, or > block, harmful radio and TV broadcasts. > > Writing in the current issue of "Foreign Affairs" magazine, Jamie M. > Metzl, > a former United Nations human rights officer, proposes the creation of > what > would officially be called an "independent information intervention > unit" at > the U.N. > > Its goal, he writes, would be "countering dangerous messages that > incite > people to violence." A U.N. unit could monitor local news media to see > where > crises might erupt, air its own messages of peace and, where > necessary, > prevent other radio or TV broadcasts from being heard. > > The idea for the U.N. jam squad originated in the genocidal horrors of > > Rwanda. In 1994, the country's main radio station, the > Radio-Television > Libre des Milles Collines, then controlled by Hutu extremists, began > broadcasting hate messages targeting members of the rival tribe, the > Tutsis, > and moderate Hutus. > > The Rwanda station even broadcast lists of enemies to be hunted down. > "Take > your spears, clubs, guns, swords, stones, everything, sharpen them, > jack > them, those enemies, those cockroaches," the station urged listeners. > The > result was one of the world's worst blood baths, in which more than > 500,000 > unarmed Tutsis and moderate Hutus were slaughtered. > > This was, certainly, as compelling a case for jamming as you can get. > And > Metzl has one cogent argument on behalf of his proposal: When there's > an > ethnic conflict in a place like Rwanda, sending in a United Nations > jamming > team would be considerably easier and less costly than sending in > troops. > > "I think it's a worthy idea," says Rep. Edward R. Royce (R-Fullerton), > > chairman of the House International Relations subcommittee on Africa. > "I'm > sure we would try to go out and jam [in Rwanda] if those circumstances > came > up again." > > Indeed, the United States and its allies are conducting a somewhat > similar > operation in Bosnia. Two months ago, NATO troops seized and > effectively shut > down a station run by hard-line Bosnian Serb forces after the station > broadcast inflammatory attacks on NATO forces trying to keep the peace > there. > > But it's a long step to go from these situations to the creation of a > permanent, formal unit run by the United Nations and scouring the > world in > search of radio broadcasts to jam. > > Who would determine exactly what kinds of radio programs should be > blocked > and which programs could be aired? What would ensure that the jamming > decisions were not motivated by politics? Wouldn't the creation of > such a > United Nations operation strengthen the hand of governments that want > to jam > radio transmissions for much less noble reasons? > > "This opens up a Pandora's box, really," says Richard Richter, the > director > of Radio Free Asia, the federally funded station that broadcasts into > Asian > countries with repressive governments. "You'd have China claiming that > we > [American broadcasts] should be jammed by the United Nations." > > Ultimately, a U.N. jamming squad would give official sanction to > restrictions on the free flow of information. Metzl's article has a > response > to this problem, but it's a weak one. > > "During the Cold War, when the United States faced a Soviet adversary > intent > on jamming the Voice of America and Radio Free Europe . . . , it made > sense > for the United States to promote an absolute standard for the free > flow of > information," he wrote. "Now, a more nuanced view should be possible." > > But that's precisely backward: The free flow of information wasn't > merely a > temporary means to winning the Cold War, but one of the goals of the > endeavor. > > Although the problem of hate-filled radio broadcasts is a serious one, > there > are ways of dealing with it that don't involve creating some huge, > supranational censorship unit. > > One alternative is simply to provide other, competing radio > broadcasts. In > Rwanda, for example, the United Nations set up its own radio stations, > both > in the capital of Kigali and in radio camps. > > Royce's subcommittee has been exploring the possibility of creating a > Radio > Free Africa, similar to Radio Free Europe, Radio Free Asia and Radio > Marti, > which broadcasts to Cuba. > > There are serious questions about whether such a new organization is > necessary, when VOA, the official U.S. government station, already > broadcasts intensively into Africa. But the underlying idea makes > sense: to > transmit better, more accurate information to Africa, rather than > focusing > on jamming or censorship. > > There are other ways of combating hate radio too. Those who directly > incite > violence over the airwaves can be brought to justice. At the moment, a > > war-crimes tribunal, set up under U.N. auspices, is prosecuting those > responsible for the massacres in Rwanda. Among the suspects in custody > are > some of those responsible for the Milles Collines radio broadcasts. > > But a worldwide, U.N.-run jamming team? As a Hollywood script, maybe > the > idea has possibilities. As foreign policy, it's a loser. > > Jim Mann's column appears in this space every Wednesday. > > Copyright Los Angeles Times > > > > ********************************************** > To subscribe or unsubscribe, email: > majordomo(a)majordomo.pobox.com > with the message: > subscribe ignition-point email@address > or > unsubscribe ignition-point email@address > ********************************************** > http://www.telepath.com/believer > **********************************************

1 0

FW: GSM hack -- operator flunks the challenge
by Stewart_William_C＠bns.att.com 17 Dec '03

17 Dec '03

Forwarded from RISKS ______________________ Date: Wed, 26 Nov 1997 17:36:36 +0000 From: Ross Anderson <Ross.Anderson(a)cl.cam.ac.uk> Subject: GSM hack -- operator flunks the challenge On Friday 13th September 1996, I read in comp.risks that: > MobilCom, a subsidiary of German TeleKom (since 100 years monopolist on > telephone communication in Germany, with its monopoly ending in 1998) > publicly offers 100,000 DM to a telephone hacker who is able to communicate > at the expense of the (national) number 0171-3289966. The related chipcard > is said to be safely stored in lawyer`s office. In an attempt to paint this > dubious offer somewhat "politically correct", the successful hacker will > have to donate his earnings to a social institution of his(her) choice. This caught our attention - Cambridge University, being a registered charity, surely qualifies as a `social institution', and 100,000 DM would buy us a state-of-the-art triple-wavelength laser microprobe workstation for chipcard breaking. So we had a look at GSM and found a way to hack it. We worked out what equipment we'd need and where we could borrow it, assembled the team, checked that the attack would work in principle, and then started trying to find the right person in Deutsche Telekom to speak to. We needed to know the IMSI (international mobile subscriber identification) and get written confirmation of the challenge; otherwise the attack might have been interpreted as an offence under Britain's Wireless Telegraphy Act. After some chasing around, unanswered e-mails and so on, we went to a mobile phone fraud conference in June and made contacts there which suggested some names, leading to further unanswered correspondence, and finally a faxed reply. Here is a translation of the original German, online at <<http://www.cl.cam.ac.uk/ftp/users/rja14/roesner.gif>http://www.cl.cam. ac. uk/ftp/users/rja14/roesner.gif>: Dear Dr Anderson Many thanks for your fax of the 6th October 1997. Please excuse the late reply to your fax. The matter that you mentioned did not originate from T-Mobil but from one of our service providers, the firm Mobilcom in Schleswig. We understand that the offer has since also been withdrawn by them. Yours etc. How does our attack work? Well, when a GSM phone is turned on, its identity (the IMSI) is relayed to the authentication centre of the company that issued it, and this centre sends back to the base station a set of five `triples'. Each triple consists of a random challenge, a response that the handset must return to authenticate itself, and a content key for encrypting subsequent traffic between the mobile and the base station. The base station then relays the random challenge to the handset. The SIMcard which personalises the handset holds a secret issued by the authentication centre, and it computes both the response and the content key from the random challenge using this secret. The vulnerability we planned to exploit is that, although there is provision in the standard for encrypting the traffic between the base station and the authentication centre, in practice operators leave the transmissions in clear. This is supposedly `for simplicity' (but see below). To break GSM, we transmit the target IMSI from a handset and intercept the five triples as they come back on the microwave link to the base station. Now we can give the correct response to the authentication challenge, and encrypt the traffic with the correct key. We can do this online with a smartcard emulator hooked up through a PC to a microwave protocol analyser; in a less sophisticated implementation, you could load the handset offline with the responses and content keys corresponding to challenges 2 through 5 which will be used on the next four occasions that you call. The necessary microwave test set costs about $20,000 to buy, but could be home built: it's more than an undergraduate project but much less than a PhD, and any 23cm radio ham should be able to put one together. We would have borrowed this, and reckoned on at most 3 person months for SIM-handset protocol implementation, system integration, debugging and operational testing. Given such an apparatus, you can charge calls to essentially any GSM phone whose IMSI you know. IMSIs can be harvested by eavesdropping, both passive and active; `IMSI-catchers' are commercially available. The fix for our attack is to turn on traffic encryption between the GSM base stations. But that will not be politically acceptable, since the spooks listen to GSM traffic by monitoring the microwave links between base stations: these links contain not only clear keys but also clear telephony traffic. Such monitoring was reported in the UK press last year, and now the necessary equipment is advertised openly on the net. See for example <http://www.gcomtech.com/>. The RISK for intelligence agencies? Making systems like GSM give government access to keys can have horrendous side effects (especially where this access is via channels that aren't properly documented and evaluated). These side effects can get you into serious conflict with powerful commercial interests. The RISKS for phone companies? Firstly, letting spook agencies bully you into a bad security design with the assurance that it will only compromise your customers' privacy, has as a likely side-effect the compromise of your signalling and thus your revenue. (David Wagner, Bruce Schneier and John Kelsey made this point for the US cellular system: see <http://www.counterpane.com/cmea.html>.) Secondly, most phone companies have no crypto expertise. Their security managers are largely ex-policemen or accountants, and so are unable to evaluate the security claims made by equipment manufacturers and intelligence agency representatives. Thirdly, by restricting parts of the security specification to people who signed a non-disclosure agreement, the GSM consortium deprived itself of the benefit of open scrutiny by the research community. It is this scrutiny that has led to protocols such as SSL and SET having their holes found and fixed. However, the global deployment of GSM ensured that many people would be cleared to know the design, most of which can be got anyway by observing traffic or by reverse engineering unprotected equipment. So public scrutiny was inevitable - but only after billions of dollars' worth of equipment had been deployed and the system could not changed. So the GSM security-by-obscurity strategy gave them the worst of all possible worlds. The consumer electronics industry should take note. The specific RISK for Deutsche Telekom: responding to cynicism about GSM security claims by putting up a reckless challenge and thus motivating an attack. The RISK for GSM users: that crooks running a call-sell operation will book a very expensive phone call on your account. An established modus operandi is to set up a conference call which their clients and counterparties join in succession. As the bill isn't forwarded to the service provider until the phone goes on-hook, you can end up with a five-figure bill for a call that lasted several days and involved hundreds of overseas telephone numbers. Some GSM operators (such as Vodafone) limit this exposure by terminating all calls after six hours; but your IMSI can be used on a network that doesn't do this. And of course, as with `phantom withdrawals' from cash machines, the use of cryptography will `prove' that you're liable for the bill. Ross Anderson, Cambridge University Computer Laboratory <www.cl.cam.ac.uk/users/rja14> Acknowledgement: our research students Stefan Hild, Abida Khattak, Markus Kuhn and Frank Stajano contributed in various ways to researching and planning this attack. An academic paper on the subject will appear in due course. +==============================================

1 0

Earn up to $1000 per day with tiny classified ads!!!
by advantag＠simplyads.com 17 Dec '03

17 Dec '03

Have you ever wondered if those tiny ads in the classified sections of magazines make any money? Well some do!!! And Some, MAKE A LOT OF MONEY!!! Like everything there is a formula for success. Click here or send an email to siybr(a)simplyads.com and we'll send you back some incredible money making information instantly via auto-responder. What have you got to lose? If you would like to be removed from our mailing list simply type "remove" in the subject line and hit reply. We are sorry for the intrusion. Have a wonderful day! The Advantage Press

1 0

Gifts for the Holidays
by UFy5Pi7z6＠top1story.net 17 Dec '03

17 Dec '03

Great bargains and discounts on Christmas gifts. Online since 1991 and voted Best of the Web by CNET, we offer the world of Swiss Army knives, watches and gift sets, and the world of sunglasses (including Ray-Ban). Enjoy discounts of up to 50%. Visit Sunglass World and Swiss Army World at http://www.tiac.net/users/sunworld

1 0

Re: Anonymous Thread
by Charlie Comsec 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Monty Cantsin wrote: > Something that I have found irritating about the posts by > non-persistent identities is that it isn't possible to support a > meaningful discussion as previous statements can always be repudiated, > or maybe even weren't made by the particular poster. I compared this > to sound bites. How is that fundamentally different from non-anonymous posts, though? You can always disavow (or attempt to) a previous post by claiming it was forged, that someone stole your password, hacked your account, or posted it when you accidentally left your terminal logged on while you were at lunch. In addition, there's nothing to stop someone from obtaining multiple e-mail accounts. So why should ten anonymous posts be an more irritating than ten posts from hotmail.com, juno.com, etc. accounts? They could be from ten different people, just one, or any number in between. > On second thought, however, there is an easy way to solve this. If > the anonymous poster accepts the context of previous messages, the > discussion can continue. There's no reason why the person behind the > virtual thread has to be the same, but the context itself is important > if we want to have interesting discussions. Agreed. It's the ideas that are important, not the identity of the person[a] expressing them. The only exception I can think of is if the person expressing the ideas is asking that they be accepted because of some unique qualification or expertise he claims to possess. > So, if you don't want to sign your messages, just acknowledge the > message ID of the relevant previous messages whose context you wish to > use. Unless that's coupled with a PGP signature, there's nothing to keep one anonymous person from impersonating another and agreeing to something. For example, if "A" is debating "B", there's nothing to stop "B" from posting as "C", claiming to be an anonymous KKK, NAMBLA, etc. member, then posting again, impersonating "A", and pretending to agree with "C" (by, as you say, "acknowledging C's message id"). Nor is it much better if "A", "B", and "C" are non-anonymous. "B" can open a throwaway account as "C", and then forge a follow-up from "A". Unless it's done among a group of people skilled at interpreting headers, it may well succeed, or at least arouse a lot of F.U.D. about "A". - --- Finger <comsec(a)nym.alias.net> for PGP public key (Key ID=19BE8B0D) -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBNIhcnwbp0h8ZvosNAQHsHwf9G2qBkAmpgR4+mTnsb4IHZeEDQZ8rWP7P TVQ8Z0lnfoZW6OOlXUZi2y42LRI7+j5OvCTRW4P/Yndiuiaqz0Bi7cWGt9FfLDMz gDg7g3doNMe9xDDEUsAHaAYdkPEgHub+Udd+YUKEMJMcn/o/7soPHfBQFMSK2ZqI s08+mdd0EPyM7ZN9EfIxaU7sBFpWLKhLjA6pCwqihIyBLrCVnxZd28jcOowXTCL/ +2E6eLqy4JBv8Wh00YMFjb9aw3GfXw/LImEYCVoA6OUum5uvA5eyENlGOtdDQx8/ aBmPW6cKoLAnBb2MkcxmU9rrO4lxkQNk9tHW+HBs7WfEr6u8RwWtSA== =KWVK -----END PGP SIGNATURE-----

1 0

Re: Censorial leftists (Was: Interesting article)
by Jonathan Wienke 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 At 11:44 PM 12/4/97 -0500, Steve Thompson wrote: >Abstinance is murder. > >Letting just _one_ egg miss fertilization denies that egg the chance to become >a human being. I think that the felony charge should be manslaughter for this >crime as it's not quite as bad as: > >Birth control > >Birth control is nothing more than premeditated murder, though >I think that a plea-bargain in most cases should be offered: Drop the charge >to manslaughter if the perp agrees to artificial insemination with the eggs of >some woman who is unable to get pregnant due to some medical condition. This, of course is the position of the Mormon Church, and was originally used to justify the polygamous practices of the early Mormons. Somehow this concept (as well as polygamy) was phased out by "new revelations" just like the "skin of blackness" curse on all non-whites was during the sixties. -----BEGIN PGP SIGNATURE----- Version: PGP for Business Security 5.5 iQA/AwUBNIjXGcJF0kXqpw3MEQKYVgCg/JSiBQbEt5cH14HNUMO8oYjimfAAn0OM ZmvqXW1G1EGJKWLimP6Lfmwe =QZ6P -----END PGP SIGNATURE----- Jonathan Wienke PGP Key Fingerprints: 7484 2FB7 7588 ACD1 3A8F 778A 7407 2928 3312 6597 8258 9A9E D9FA 4878 C245 D245 EAA7 0DCC "If ye love wealth greater than liberty, the tranquility of servitude greater than the animating contest for freedom, go home from us in peace. We seek not your counsel, nor your arms. Crouch down and lick the hand that feeds you. May your chains set lightly upon you; and may posterity forget that ye were our countrymen." -- Samuel Adams "Stupidity is the one arena of of human achievement where most people fulfill their potential." -- Jonathan Wienke Never sign a contract that contains the phrase "first-born child." RSA export-o-matic: print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

1 0

Rubber-hose proof (cryptographically deniable) file-systems.
by Julian Assange 17 Dec '03

17 Dec '03

Here's a copy of some correspondence in relation to my implementation of a `rubber hose proof' (cryptographically deniable) file system (actually implimented as a block device on which you can mount any file system). I'm happy with the cryptographic strength of the system (but feel free to comment anyway). That said, I'm not convinced that my avoidance of media (i.e disk surface) analysis attacks (which could potentially show the pre-sense or otherwise of cryptographic file systems other than the "duress" ones) is entirely effective. I'd like some comment from gauss-ridden declassification guru's here :) [...] Here's how I'm implementing `aspects' in Rubberhose/marutukku; `aspect' is the term I'm using to refer to the cryptographically-deniable (i.e rubber-hose-proofed) "portion", of a maru extent i.e it's a different _aspect_ (view) of the same underlying physical block extent. I decided that random split lengths don't add to the security of the scheme - only 2x from my calculations - which isn't enough to warrant the increase in memory use and complexity involved. The extent is simply divided up into n splits (say 1024 or one every 256k, whichever is smaller). Each aspect has an encrypted 32bit block remap list (which is simply a linear array because of the fixed split size). A split avoidance bit-map is created from these per-aspect remap lists on instantiation of the aspects. An individual aspect looks like so (when saved): typedef struct { m_u32 keySum; /* key checksum */ u_char masterKey[MAX_KEY]; u_char latticeCipherType, blockCipherType; u_char pad[MAX_BLOCK - (4 + MAX_KEY + 1 + 1) % MAX_BLOCK]; /* block align */ } maruCycle; typedef struct { maruCycle cycle; u_char keySalt[MAX_PASSPHRASE]; maruLatticeKey latticeKeySalt[2]; u_char blockIV[MAX_FS_BLOCK_SIZE]; u_char latticeSalt[2*MAX_LATTICE_DEPTH*MAX_BLOCK_KEY]; /* must be 64 aligned */ m_u32 remap[MAX_SPLITS]; m_u32 iterations; maruCipher keyCipherType; } maruHeaderAspect; There are an array of (8 by default) of these constructs in a maruHeader. The smap accessor macros are simple: #define SMAP_SET(p, n) (((p))[(n)/(sizeof(maruSmap)*8)] |= (1 << ((n) % (sizeof(maruSmap)*8)))) #define SMAP_CLR(p, n) (((p))[(n)/(sizeof(maruSmap)*8)] &= ~ (1 << ((n) % (sizeof(maruSmap)*8)))) #define SMAP_ISSET(p, n) (((p))[(n)/(sizeof(maruSmap)*8)] & (1 << ((n) % (sizeof(maruSmap)*8)))) By default, each unused maruHeaderAspect struct contains random noise (except for keyCipherType, which defaults to being the same for all aspects) and is of course indistinguishable from a valid maruAspect without the associated key. Instantiation example: Say you have three valid aspects, a1, a2 and a3. Arbitrarily, you have chosen a1 to be the simple duress aspect (i.e ``you expect us to believe you have solitary letter of donation to the Polit Bureau Ball in your entire encrypted file system?! Do you know what this is Nikov? <opens trench coat>. THIS is the finest cryptanalytic device known to man. THIS is a RUBBERHOSE! *thwap* *thwunk* *boink*. Now... what's the *real* key Nikov... or should we call you... Nikolay Bukharin?''), a2 to be the limited disclosure aspect ("Dear diary. Nikita, Ivan, Boris and <some more guys I feel like selling down the Lenningrad sewage system> came over today and smoked a *shit load* of hash. Not wanting to offend, I had a toke, but like that capitalist dog ^H^H^H^H^H^H^H^H^H^H^H^H^H illustious leader of the freeworld, was careful not to inhale.") and a3 has your ice-9 formula nicely tucked away. You decide one fine morning that you want to add an ATP pre-cursor as a catalyst to your ice-9 recipe of destruction (ostensibly, you plan to generate this stuff from cultures of genetically modified mouse liver cell mitochondria), and provide the a1, a2 and a3 pass-phrases. a1, a2 and a3 are decrypted. the aspect remap is parsed and used to create the physical block "avoidance" map (checking for conflicts along the way). Joyous about the frozen seas to come, you copy the ATP pre-cursor catalyst into a3 and the file system tries to write a new block - e.g b28 - to a3. b28 is translated through the a3 remap table to b-1 (unallocated). A random block remap number is generated e.g b595 and tested against the avoidance smap. If free, it is marked and chosen to be the new a3 mapping, otherwise the algorithm simply does a circular hunt for the next free entry in the avoidance smap. Naturally, reading only requires the key of the aspect you are interested in (divulging). Writing to one aspect without the keys to the other aspects will randomly trash them as new splits are assigned. Timer remaps, reads and re-writes: This would be the simple end of it, were it not but for magnetic domain leakage/disk surface wear analysis attacks. Theoretically, this sort of attack could used to demonstrate access patterns by the drive head in regions outside those used by the duress aspect blocks. What we want to do here is to make sure the non-data carrying magnetic/other properties of the disk substrate are as close to a Jackson Pollock painting as is possible. i.e totally random :) Three methods are used: 1) every few seconds, we read a random number of blocks within a split in a random location and write it back to that same location with a m-1/m (e.g 9/10) (recursive) chance of an additional write. 2) every-time there is a conventional write, there is a m-1/m chance of a full remap of the split concerned. 3) every n seconds a random full split remap. (maybe not needed given the statistical properties of the above - I need to think about this a lot more. its not simple) All aspects are defined to take up 100% of the marutukku extent from the file-system perspective - this is essential to our deniability scheme. This works fine with most file-systems - e.g UFS, because they only write to a small fraction of their addressable blocks when formatted - i.a few super-blocks and inode, rather than zeroing every block, and so split usage for a given aspect reflects population of the file system that pertains to it. Cheers, Julian. -- Prof. Julian Assange |If you want to build a ship, don't drum up people |together to collect wood and don't assign them tasks proff(a)iq.org |and work, but rather teach them to long for the endless proff(a)gnu.ai.mit.edu |immensity of the sea. -- Antoine de Saint Exupery

1 0