March 2004 - cypherpunks-legacy

Idea: opportunistic TCP-level crypto
by Thomas Shaddack 02 Mar '04

02 Mar '04

There is plenty of space available in the form of (normally unused) payload of TCP SYN, SYN/ACK, and ACK packets. Could they be used to announce the intention/capabilities for an encrypted connection, eventually serve for authenticating the connection? This way there would be virtually no overheads in the connection in the case one of the sides doesn't offer opportunistic crypto; the packet payload data would get ignored in that case. For UDP connections, handshake using ICMP packets in a ping-like scenario could be possible; send ICMP_ECHO_REQUEST to the server with the payload containing a handshake request. If the ICMP_ECHO_REPLY returned contains the handshake acknowledge, proceed, otherwise assume the server doesn't speak our dialect of OE. Opinions, comments? Why this wouldn't work?

1 0

RE: Gentlemen reading mail part II
by Tyler Durden 02 Mar '04

02 Mar '04

Interesting. I guess my basic question is, is there a subset of counter-surveillance actions that can be taken that, while not ensuring secure communications, forces eavesdropping parties to take 'radical' measures in order to obtain the desired information? In other words, if they have to deploy a black-bag operation every few weeks, then that makes the odds of them being 'outed' sooner rather than later much greater. It might even deter survelliance except "when it really counts". But then again, if the walls really have ears, then there's not much that can be done. Perhaps Koffi Annan was completely aware of this but counted on normal diplomatic protocol to prevent embarrasing and public exposures...(and that may be all that's really needed at the UN after all...) -TD >From: "Major Variola (ret.)" <mv(a)cdc.gov> >Reply-To: cypherpunks(a)lne.com >To: "cypherpunks(a)al-qaeda.net" <cypherpunks(a)al-qaeda.net> >Subject: Gentlemen reading mail part II >Date: Sun, 29 Feb 2004 14:19:13 -0800 > >Blix says US spied on him over Iraq > >Reuters London Feb 28: Former chief United Nations weapons inspector Mr >Hans Blix said today he suspected the United States bugged his office >and home in the run-up to the Iraq war, but had no hard evidence. > >Describing such behaviour as disgusting, Mr Blix told Britains >Guardian newspaper in an interview: It feels like an intrusion into >your integrity in a situation when you are actually on the same side. > >His allegation came on top of a diplomatic row sparked this week when >former British minister Ms Clare Short said Britain bugged UN Secretary >General Mr Kofi Annans office as London and Washington tried but failed >to win UN backing to invade Iraq. > >Mr Blix said his suspicions were raised when he had trouble with a >telephone connection at home. > >It might have been something trivial or it might have been something >installed somewhere, I dont know, he said. > >The Swede said he asked UN counter-surveillance teams to check his >office and home for listening devices. > >If you had something sensitive to talk about you would go out into the >restaurant or out into the streets, said Mr Blix. > >He said US state department envoy Mr John Wolf visited him two weeks >before the Iraq war with pictures of an Iraqi drone and a cluster bomb >that the former inspector believed could have been secured only from >within the UN weapons office. > >He should not have had them. I asked him how he got them and he would >not tell me, Mr Blix said. > >It could have been some staff belonging to us that handed them to the >Americans... It could also be that they managed to break into the secure >fax and got it that way, he said. > >Ms Short, in government before and during the Iraq war, said on Thursday >she had seen transcripts of what she said were bugged accounts of Mr >Annans conversations. She resigned after the war. > >The British Prime Minister, Mr Tony Blair accused her of being >irresponsible and of undermining intelligence services at a time when >Britain faced a threat of attack from Islamic militants. > >Blair said British security services acted within domestic and >international law. > >But UN spokesman Mr Fred Eckhard said Mr Annan would seek a fuller >explanation from Britain on the allegations, saying any attempt to >eavesdrop on the Secretary General was illegal and should stop as it >would violate three international treaties. > >Mr Blair warned critics like Ms Short that unless they buried >differences they risked ousting his Labour Party from power as it >prepares to fight a general election expected in 2005. > >Former UN secretary-general Mr Boutros Boutros-Ghali and another former >chief UN weapons inspector, Mr Richard Butler, said yesterday they >believed they had been spied on. > >From the first day I entered my office they told me: beware, your >office is bugged, your residence is bugged, Mr Boutros-Ghali told the >BBC. > >It is a tradition that member states that have the technical capacity >to bug will do it without hesitation, he said. > >http://www.navhindtimes.com/stories.php?part=news&Story_ID=022910 > _________________________________________________________________ Stay informed on Election 2004 and the race to Super Tuesday. http://special.msn.com/msn/election2004.armx

4 3

Re: Gentlemen reading mail part II (opsec review)
by Major Variola (ret) 01 Mar '04

01 Mar '04

At 09:46 AM 3/1/04 -0500, Tyler Durden wrote: >I guess my basic question is, is there a subset of counter-surveillance >actions that can be taken that, while not ensuring secure communications, >forces eavesdropping parties to take 'radical' measures in order to obtain >the desired information? Sunder's suggestion of introducing information and watching for their response is good, though the Adversary will not respond if they're smart and they're watching you for something more important. (What was that Brit town sacrificed so the Germans wouldn't know the codes were broken? Starts with "C"...) In order to avoid places with ears (and "homeless" people with directional mics, see _Enemy of the State_) go to a park that you haven't been to before. And perform the usual CI driving maneuvres (see that Tomlinson book _The Big Breach_ for a description.. lets just say that a few sudden right turns can be useful) on the way. Or perhaps given GPS gizmos, take a bus. Leave your cell phone at home, or better, send it through the mail (left on) to yourself :-) ------ Only amateurs attack machines; professionals target people. Bruce Schneier The ultimate in paranoia is not when everyone is against you but when everything is against you. P.K.Dick

4 3

Re: Gentlemen reading mail part II (opsec review)
by Major Variola (ret) 01 Mar '04

01 Mar '04

At 12:10 AM 3/2/04 +0100, Nomen Nescio wrote: > That's when you strap on the C-4 vest. Or implement other dead-man switch type plans. Gonna fly the week the feds announce they've caught Osama? :-)

1 0

Re: Gentlemen reading mail part II (opsec review)
by Major Variola (ret) 01 Mar '04

01 Mar '04

At 09:19 PM 3/1/04 +0000, Justin wrote: >Major Variola (ret) (2004-03-01 18:01Z) wrote: > >> In order to avoid places with ears (and "homeless" people with >> directional mics, see _Enemy of the State_) go to a park that you >> haven't been to before. And perform the usual CI driving maneuvres >> (see that Tomlinson book _The Big Breach_ for a description.. lets >> just say that a few sudden right turns can be useful) on the way. >> >> Or perhaps given GPS gizmos, take a bus. Leave your cell phone at >> home, >> >> or better, send it through the mail (left on) to yourself :-) > >If they know you're trying to shake them, that alerts them and >eliminates any opportunity you might have otherwise had to feed them >misinformation in the future. Excellent point. My advice re parks and CI driving is for Annan. Who knows he's watched and doesn't worry about the Hole. Its not for someone who is wondering whether they're watched, and has reason to, and doesn't want to tip their suspicions yet.

1 0

[Users] Announce: FreeS/WAN Project Ending
by Claudia Schmeing 01 Mar '04

01 Mar '04

<users(a)lists.freeswan.org> List-Archive: <https://mj2.freeswan.org/archives> Sender: users-owner(a)mj2.freeswan.org -----BEGIN PGP SIGNED MESSAGE----- Dear FreeS/WAN community, After more than five years of active development, the FreeS/WAN project will be coming to an end. The initial goal of the project was ambitious -- to secure the Internet using opportunisitically negotiated encryption, invisible and convenient to the user. (for more, see http://www.freeswan.org/history.html) A secondary goal was to challenge then-current US export regulations, which prohibited the export of strong cryptography (such as triple DES encryption) of US origin or authorship. Since the project's inception, there has been limited success on the political front. After the watershed Bernstein case (see http://www.eff.org/Privacy/Crypto_export/Bernstein_case/ ) US export regulations were relaxed. Since then, many US companies have exported strong cryptography, without seeming restriction other than having to notify the Bureau of Export Administration for tracking purposes. This comfortable situation has perhaps created a false sense of security. The catch? Export regulations are not laws. The US government still reserves the right to change its export regulations on short notice, and there is no facility to challenge them directly in a court of law. This leaves the US crypto community and US Linux distributions in a position which seems safe, but is not legally protected -- where the US government might at any time *retroactively* regulate previously released code, by prohibiting its future export. This is why FreeS/WAN has always been developed outside the US (in Canada and in Greece), and why it has never (to the best of our knowledge) accepted US patches. If FreeS/WAN has neither secured the Internet, nor secured the right of US citizens to export software that could do so, it has still had positive benefit. With version 1.x, the FreeS/WAN team created a mature, well-tested IPsec VPN (Virtual Private Network) product for Linux. The Linux community has relied on it for some time, and it (or a patched variant) has shipped with several Linux distributions. With version 2.x, FreeS/WAN development efforts focussed on increasing the usability of Opportunistic Encryption (OE), IPSec encryption without prearrangement. Configuration was simplified, FreeS/WAN's cryptographic offerings were streamlined, and the team promoted OE through talks and outreach. However, nine months after the release of FreeS/WAN 2.00, OE has not caught on as we'd hoped. The Linux user community demands feature-rich VPNs for corporate clients, and while folks genuinely enjoy FreeS/WAN and its derivatives, the ways they use FreeS/WAN don't seem to be getting us any closer to the project's goal: widespread deployment of OE. For its part, OE requires more testing and community feedback before it is ready to be used without second thought. The project's funders have therefore chosen to withdraw their funding. Anywhere you stop, a little of the road ahead is visible. FreeS/WAN 2.x might have developed further, for example to include ipv6 support. Before the project stops, the team plans to do at least one more release. Release 2.06 will see FreeS/WAN making a late step toward its goal of being a simple, secure OE product with the removal of Transport Mode. This in keeping with one of Neils Fergusson's and Bruce Schneier's security recommendations, in _A Cryptographic Evaluation of IPsec_ (http://www.counterpane.com/ipsec.pdf) 2.06 will also feature KLIPS (FreeS/WAN's Kernel Layer IPsec machinery) changes to faciliate use with the 2.6 kernel series. After Release 2.06, FreeS/WAN code will continue to be available for public use and tinkering. Our website will stay up, and our mailing lists at lists.freeswan.org will continue to provide a forum for users to support one another. We expect that FreeS/WAN and its derivatives will be widely deployed for some time to come. It is our hope that the public will one day be ready for, and demand, transparent, opportunistic encryption. Perhaps then some adventurous folks pick up FreeS/WAN 2.x and continue its development, making the project's original goal a reality. Many thanks to the wonderful folks who've been part of the lists.freeswan.org community over the last few years. Thanks to the developers who've created patches and written HOWTOs. Thanks to the volunteers who've donated Web space and time as system administrators. Thanks to the distributors who've puzzled out the fine points of integrating our software with others'. Finally, thanks to the users who've tested our software, shared interoperation success stories, and given others a helping hand. We couldn't have done it without you. Best Regards, Claudia Schmeing for the Linux FreeS/WAN Project -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: noconv iQCVAwUBQEOI23DIYXPDEHodAQG1VAP/cy4kK4oRV73YzIokEhElnbg841v/fKN5 v6s//gi/1zfJWVrG2uX9X4ZMi0ebQGFN0J5zr/rhsy2fYcdlDJyaiQvFqyFzzrk9 XUAIYjI+tdB/Fu8StfdutPf29ZdT6igOHI54uH4kYOXtIpj1b/H21SsZEPR+dni3 eZSNoxgDQNo= =iLJC -----END PGP SIGNATURE----- _______________________________________________ FreeS/WAN Users mailing list users(a)lists.freeswan.org https://mj2.freeswan.org/cgi-bin/mj_wwwusr --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[Users] Announce: FreeS/WAN Project Ending
by Claudia Schmeing 01 Mar '04

01 Mar '04

<users(a)lists.freeswan.org> List-Archive: <https://mj2.freeswan.org/archives> Sender: users-owner(a)mj2.freeswan.org -----BEGIN PGP SIGNED MESSAGE----- Dear FreeS/WAN community, After more than five years of active development, the FreeS/WAN project will be coming to an end. The initial goal of the project was ambitious -- to secure the Internet using opportunisitically negotiated encryption, invisible and convenient to the user. (for more, see http://www.freeswan.org/history.html) A secondary goal was to challenge then-current US export regulations, which prohibited the export of strong cryptography (such as triple DES encryption) of US origin or authorship. Since the project's inception, there has been limited success on the political front. After the watershed Bernstein case (see http://www.eff.org/Privacy/Crypto_export/Bernstein_case/ ) US export regulations were relaxed. Since then, many US companies have exported strong cryptography, without seeming restriction other than having to notify the Bureau of Export Administration for tracking purposes. This comfortable situation has perhaps created a false sense of security. The catch? Export regulations are not laws. The US government still reserves the right to change its export regulations on short notice, and there is no facility to challenge them directly in a court of law. This leaves the US crypto community and US Linux distributions in a position which seems safe, but is not legally protected -- where the US government might at any time *retroactively* regulate previously released code, by prohibiting its future export. This is why FreeS/WAN has always been developed outside the US (in Canada and in Greece), and why it has never (to the best of our knowledge) accepted US patches. If FreeS/WAN has neither secured the Internet, nor secured the right of US citizens to export software that could do so, it has still had positive benefit. With version 1.x, the FreeS/WAN team created a mature, well-tested IPsec VPN (Virtual Private Network) product for Linux. The Linux community has relied on it for some time, and it (or a patched variant) has shipped with several Linux distributions. With version 2.x, FreeS/WAN development efforts focussed on increasing the usability of Opportunistic Encryption (OE), IPSec encryption without prearrangement. Configuration was simplified, FreeS/WAN's cryptographic offerings were streamlined, and the team promoted OE through talks and outreach. However, nine months after the release of FreeS/WAN 2.00, OE has not caught on as we'd hoped. The Linux user community demands feature-rich VPNs for corporate clients, and while folks genuinely enjoy FreeS/WAN and its derivatives, the ways they use FreeS/WAN don't seem to be getting us any closer to the project's goal: widespread deployment of OE. For its part, OE requires more testing and community feedback before it is ready to be used without second thought. The project's funders have therefore chosen to withdraw their funding. Anywhere you stop, a little of the road ahead is visible. FreeS/WAN 2.x might have developed further, for example to include ipv6 support. Before the project stops, the team plans to do at least one more release. Release 2.06 will see FreeS/WAN making a late step toward its goal of being a simple, secure OE product with the removal of Transport Mode. This in keeping with one of Neils Fergusson's and Bruce Schneier's security recommendations, in _A Cryptographic Evaluation of IPsec_ (http://www.counterpane.com/ipsec.pdf) 2.06 will also feature KLIPS (FreeS/WAN's Kernel Layer IPsec machinery) changes to faciliate use with the 2.6 kernel series. After Release 2.06, FreeS/WAN code will continue to be available for public use and tinkering. Our website will stay up, and our mailing lists at lists.freeswan.org will continue to provide a forum for users to support one another. We expect that FreeS/WAN and its derivatives will be widely deployed for some time to come. It is our hope that the public will one day be ready for, and demand, transparent, opportunistic encryption. Perhaps then some adventurous folks pick up FreeS/WAN 2.x and continue its development, making the project's original goal a reality. Many thanks to the wonderful folks who've been part of the lists.freeswan.org community over the last few years. Thanks to the developers who've created patches and written HOWTOs. Thanks to the volunteers who've donated Web space and time as system administrators. Thanks to the distributors who've puzzled out the fine points of integrating our software with others'. Finally, thanks to the users who've tested our software, shared interoperation success stories, and given others a helping hand. We couldn't have done it without you. Best Regards, Claudia Schmeing for the Linux FreeS/WAN Project -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: noconv iQCVAwUBQEOI23DIYXPDEHodAQG1VAP/cy4kK4oRV73YzIokEhElnbg841v/fKN5 v6s//gi/1zfJWVrG2uX9X4ZMi0ebQGFN0J5zr/rhsy2fYcdlDJyaiQvFqyFzzrk9 XUAIYjI+tdB/Fu8StfdutPf29ZdT6igOHI54uH4kYOXtIpj1b/H21SsZEPR+dni3 eZSNoxgDQNo= =iLJC -----END PGP SIGNATURE----- _______________________________________________ FreeS/WAN Users mailing list users(a)lists.freeswan.org https://mj2.freeswan.org/cgi-bin/mj_wwwusr --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Brinworld: cellphone as cuecat [privacy, orwell]
by Major Variola (ret.) 01 Mar '04

01 Mar '04

A benign use of G3 cell-cams: as UPC scanners + Priceline. A bit of a privacy concern unless you use prepaid phones. How many years until folks can snap pictures of kids, or arabs, and send them to some Kidnap / FatherlandSecurity site for review? The location of the cellphone camera, of course, will be automatically sent. ........ New camera phone software is mobile shopping guide Comparison shopping online has become a consumer pastime. And people love taking pictures with camera phones. Charles Fritz wants to combine the activities. His idea: Let people use their camera phones to scan bar codes and immediately get price or other product information wherever they are. http://www.sptimes.com/2004/03/01/Technology/New_camera_phone_soft.shtml

1 0

Re: Gentlemen reading mail part II (opsec review)
by Nomen Nescio 01 Mar '04

01 Mar '04

Justin says: > If they know you're trying to shake them, that alerts them and > eliminates any opportunity you might have otherwise had to feed them > misinformation in the future. That's when you strap on the C-4 vest. Zombie Monger

1 0

Re: Gentlemen reading mail part II (opsec review)
by Tyler Durden 01 Mar '04

01 Mar '04

Actually, I believe there was also a town in Poland with lots of odd letter combinations so that the Allies could help break German codes! (ie, by listening to Encrypted German communications about the bombing and it's location...) That's some interesting crap about playing Beavis and Butthead...at the very least, leaving the CD player in 'perpetual' mode can force some heavy human investment in time and energy. -TD >From: "R. A. Hettinga" <rah(a)shipwright.com> >To: "Major Variola (ret)" <mv(a)cdc.gov>, "cypherpunks(a)al-qaeda.net" ><cypherpunks(a)al-qaeda.net> >Subject: Re: Gentlemen reading mail part II (opsec review) >Date: Mon, 1 Mar 2004 13:09:09 -0500 > >At 10:01 AM -0800 3/1/04, Major Variola (ret) wrote: > >(What was that Brit town sacrificed so the Germans wouldn't know > >the codes were broken? Starts with "C"...) > >Coventry... > >Ancient cathedral, etc... > >Cheers, >RAH > >-- >----------------- >R. A. Hettinga <mailto: rah(a)ibuc.com> >The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> >44 Farquhar Street, Boston, MA 02131 USA >"... however it may deserve respect for its usefulness and antiquity, >[predicting the end of the world] has not been found agreeable to >experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' > _________________________________________________________________ Take off on a romantic weekend or a family adventure to these great U.S. locations. http://special.msn.com/local/hotdestinations.armx

1 0