November 2005 - cypherpunks-legacy

Re: avoiding replay attack resistance w/o seq nos or challenge response
by Major Variola (ret) 29 Nov '05

29 Nov '05

At 01:28 AM 11/29/05 -0800, Morlock Elloi wrote: >Put a real-timestamp inside encrypted payload and decide how tolerant you >should be. Thanks. That's a good way of using a single piece of state, instead of one per source, or per session. It does provide the adversary with a known plaintext however, which a random nonce doesn't, for large values of length(nonce). I'm thinking the requirement for random state is *fundamental* in a *deep sense* to replay attack prevention. I am of course aware of the Netscape-sequence-no break of ancient times, as Schneier says in _Secrets and Lies_, the work of "attackers" performing a "publicity" attack. Aside: was told unabashedly by a suit at work that when the local (unregulated, out of control) WiFi cxns are down, folks use some other net, which is suspected to belong to some other corp sharing the building. LMAO. Be seeing you -No 6 I got you babe --a senator who thought a tree would yield. ---- Impeach or frag.

1 0

[zooko@zooko.com: [p2p-hackers] darknet ~= (blacknet, f2f net)]
by Eugen Leitl 29 Nov '05

29 Nov '05

----- Forwarded message from zooko(a)zooko.com -----

3 2

we have the best deals on rolex cartier and so many more
by Cecil Crabtree 29 Nov '05

29 Nov '05

on atlantis but academic in tech not joseph it's embouchure try blaine it's hungary not culture or elute ! smuggle on cowherd be blaspheme try spinoff some tracy and diethylstilbestrol on backorder in emphysema not taos try sly.

1 0

[goodell@eecs.harvard.edu: Re: use of routing information in anti-fraud mechanisms]
by Eugen Leitl 29 Nov '05

29 Nov '05

----- Forwarded message from Geoffrey Goodell <goodell(a)eecs.harvard.edu> -----

1 0

avoiding replay attack resistance w/o seq nos or challenge response
by Major Variola (ret) 29 Nov '05

29 Nov '05

I'm interested in avoiding replay attacks on a protocol that uses UDP. Assume a secret key is shared. As far as I can tell, it is *fundamental* that you use either sequence numbers for a series of packets, or perform a challenge-response handshake for each packet. (The latter is essentially a "sequence" of length 1 re-established for each packet) Both methods require the maintenance of some state, essentially creating a "session", although that state is just the active sequence number (and a window given UDPs un-ordering), not a whole moby IPSEC security association. Yes, I'm aware that if you use UDP you end up reinventing TCP... My question is, are there less well known methods, or is this statefulness fundamentally *imposed* by replay attack resistance, by virtue of what it means to "re-play"? (Which is my suspicion)

2 1

Jim Sanborn's Critical Mass
by Major Variola (ret) 29 Nov '05

29 Nov '05

The photo of the critical mass assembly that was pulled for "security" reasons is at http://kryptos.yak.net/22.sizes@CriticalMassDetail.jpg?size1=O&size=S The sculptor is the same Sanborn who did the NSA sculpture..

1 0

My Friend, You are in Trouble
by Marlon Blackman 29 Nov '05

29 Nov '05

1 0

/. [Cybercrime More Lucrative Than Drugs]
by Eugen Leitl 28 Nov '05

28 Nov '05

Link: http://slashdot.org/article.pl?sid=05/11/28/2239217 Posted by: ScuttleMonkey, on 2005-11-28 23:11:00 [1]prostoalex writes "Yahoo is reporting that global [2]cybercrime overtook global drug trafficking in terms of revenue this past year. In related news, only 4% of Internet users can [3]flag 100% of phishing e-mails as fraudulent, and Americans filed 207,000 [4]reports on cybercrime to FBI." References 1. http://www.moskalyuk.com/blog/ 2. http://labs.news.yahoo.com/s/nm/20051128/wr_nm/cybercrime_dc 3. http://www.internetnews.com/security/article.php/3566071 4. http://blogs.zdnet.com/ITFacts/index.php?cat=33 ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

/. [Exception Expands Domestic Surveillance]
by Eugen Leitl 28 Nov '05

28 Nov '05

Link: http://slashdot.org/article.pl?sid=05/11/28/1731235 Posted by: ScuttleMonkey, on 2005-11-28 20:23:00 drDugan writes "The Washington Post is reporting the next phase of American progress authorizing intelligence agencies to spy on law-abiding citizens without oversight. Primarily, new legislation allows an '[1]intelligence exception' to the [2]privacy act 'allowing the FBI and others to share information gathered about U.S. citizens with the Pentagon, CIA and other intelligence agencies, as long as the data is deemed to be related to foreign intelligence. Backers say the measure is needed to strengthen investigations into terrorism or weapons of mass destruction.'" References 1. http://www.washingtonpost.com/wp-dyn/content/article/2005/11/26/AR200511260… 57.html 2. http://www.usdoj.gov/04foia/privstat.htm ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[Clips] Bush Antiterror Plans Irk Big Business
by R. A. Hettinga 28 Nov '05

28 Nov '05

--- begin forwarded text Delivered-To: clips(a)philodox.com Date: Mon, 28 Nov 2005 14:54:40 -0500 To: Philodox Clips List <clips(a)philodox.com> From: "R. A. Hettinga" <rah(a)shipwright.com> Subject: [Clips] Bush Antiterror Plans Irk Big Business Reply-To: rah(a)philodox.com Sender: clips-bounces(a)philodox.com <http://online.wsj.com/article_print/SB113313690613407756.html> The Wall Street Journal November 28, 2005 Bush Antiterror Plans Irk Big Business Corporate Groups Join ACLU in Demanding Changes to Patriot Act's Data-Access Rules By ROBERT BLOCK Staff Reporter of THE WALL STREET JOURNAL November 28, 2005; Page A4 WASHINGTON -- As President Bush and Republican leaders in Congress scramble to renew the USA Patriot Act before it expires on Dec. 31, they are meeting surprising resistance from a group they usually consider an ally: big business. Joining the American Civil Liberties Union, organizations such as the U.S. Chamber of Commerce, the National Association of Manufacturers, the National Association of Realtors and the Financial Services Roundtable are demanding changes in the antiterror law's rules on government access to confidential business records. Corporate objections played a major role in blocking final legislative action on a new Patriot Act before the Thanksgiving break. Now, with pressure mounting to get the law passed by year end, business lobbyists say they see signs that key lawmakers are open to altering some provisions, offering companies clearer legal protections and avenues for appeal. In particular, business groups want to inject new checks on law-enforcement requests for records on customers, suppliers and employees. Companies want government officials to shoulder a greater burden of proof in showing a connection between the documents demanded and a specific terror investigation, and they want greater power to challenge the record orders. Corporate lobbyists also want to prevent the renewed Patriot Act from toughening the law in ways they dislike. One proposed change would make it a felony for a company to disclose a secret subpoena. "The business community stands with all Americans in the war on terror, and we remain prepared to do our part to keep the nation safe," reads a recent letter from six business groups to lawmakers trying to craft a final bill. "That said, we are concerned that the rights of businesses to confidential files -- records about our customers or our employees, as well as our trade secrets and other proprietary information -- can too easily be obtained and disseminated under investigative powers expanded by the Patriot Act." The business backlash to the Patriot Act -- which was passed in a rush, just weeks after the Sept. 11, 2001, attacks -- is part of the new opposition to post-9/11 security policies from normally loyal friends of the Bush administration. Senate Republicans are pushing for new limits on the administration's treatment of prisoners detained as suspected terrorists and are demanding more accountability on the war in Iraq. Taking on the role of accidental civil libertarian hasn't been easy for business, which had rarely challenged the Bush administration over the past four years. After Sept. 11, the U.S. government often asked companies to act as the eyes and ears of federal law enforcement. Business was initially receptive, in part because companies wanted to prevent the disruption and bad publicity that would come from terrorists using their systems. Cooperation between businesses and federal law-enforcement agencies wasn't generally advertised, and customers were seldom aware of it. But corporate executives have since grown wary of Bush administration law-enforcement efforts -- and not just those designed to fight terrorism. Laws aimed at white-collar crime have put other compliance burdens on business. Now lobbyists and business groups say that Patriot Act compliance is proving costly. They say that their members each year are getting tens of thousands of National Security Letters, or NSLs -- a form of subpoena used to demand basic information contained in credit reports, Internet-service-provider records and financial records. Justice Department officials deny that NSL demands have reached those levels but won't provide details because the number and identify of the recipients are classified. Financial institutions also complain about the existing Patriot Act requirement that they verify customer identities and notify regulators if their customers appear on terrorist watch lists. Micki Carruthers, senior vice president and chief financial officer at Regal Financial Bank in Seattle, says that her two-year-old, 31-employee bank spends between $100,000 and $150,000 -- or 10% to 15% of its annual operating expenses -- on Patriot Act compliance. "You can talk to any bank and they will say the same thing about how these demands ruffle our feathers and are a costly burden," she says. Beyond costs, businesses fear that the Patriot Act puts at risk trade secrets and confidential financial data, according to Susan Hackett, senior vice president and general counsel for the Association of Corporate Counsel, a trade group representing the legal departments of major U.S. corporations. Multinationals are afraid that, by complying with government demands for financial records of overseas operations, they will violate more stringent privacy laws in other countries -- particularly in Europe. For much of the past year, efforts on Capitol Hill to renew the Patriot Act had attracted the more predictable opposition of civil-rights groups, privacy advocates and libertarians. Brushing aside those protests, both the House and Senate passed separate versions of bills to renew expiring provisions. They then faced what seemed a fairly routine effort to reconcile the two bills into a consensus conference committee report for final approval by Congress. But in October, business groups jumped into the debate and began coordinating strategies and communicating with the ACLU, according to both Ms. Hackett of the corporate counsel group and Lisa Graves of the ACLU. "We were very, very surprised by the business community's position and some of their concerns so late in the process," said Justice Department spokesman Brian Roehrkasse. It was business intervention, Ms. Hackett said, that has changed the course of the debate. "People from the business community are saying to people they are normally allied with, 'get out of my file drawer.' That's what's making the difference." Justice officials have responded by trying to assure business groups that the administration wouldn't abuse the powers. But business lobbyists say the tone of conversations with the administration turned nasty earlier this month[nov.], when it became clear that congressional negotiators didn't yet have an acceptable consensus version of a new law. Angry, White House officials called members of the business groups to remind them of all that the administration has done -- from tax cuts to sympathetic regulatory policies -- for America's manufacturers, retailers, bankers and service industries. A senior Justice Department official denied that business groups have come under any pressure from the administration and dismissed the significance of their opposition to the counterterror law. But with time running out to renew the act, some lawmakers are reportedly telling business groups they will get more of what they want. That includes language that would explicitly give companies the right to consult an attorney when protesting government record requests; the current law is silent on the question. The new law also looks likely to include language giving companies the ability to challenge Patriot Act secret court orders on the grounds that the information requested is proprietary or privileged or the request overly burdensome, similar to rights they have when receiving a grand-jury subpoena. Also on the table, according to Ms. Hackett, is a concession that would make inadvertent disclosure about receiving Patriot Act orders no longer a crime. "I think everybody is pretty satisfied," says Bob Shepler of the National Association of Manufacturers. Still, Ms. Hackett says some issues remain outstanding, especially the lack of a hard requirement for investigators to show how a request for records is connected to a specific terrorism investigation. "We're keeping our powder dry for the return to the issue in December and following closely the continuing efforts of our coalition partners at the ACLU," she said. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' _______________________________________________ Clips mailing list Clips(a)philodox.com http://www.philodox.com/mailman/listinfo/clips --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0