December 2011 - cypherpunks-legacy

10 Free Viagra for all orders with 90 ED Pills, ED Trial Pack for all orders with 120 ED Pills, Free Shipping, Free Airmail for all orders with sum $200. We accept VISA & MasterCard!
by StacyDeloris 21 Dec '11

21 Dec '11

Viagra 100 mg x 80 pills = $115.20 ONLY. BONUS PILLS 10 Free Viagra for all orders with 90 ED Pills, ED Trial Pack for all orders with 120 ED Pills, Free Shipping, Free Airmail for all orders with sum $200. We accept VISA & MasterCard! No prescriptions, Low prices and 30-day money back guarantee! http://rxdrugsmagic.ru

1 0

Re: [liberationtech] Twitter has released the source code to TextSecure under the GPL
by Eugen Leitl 21 Dec '11

21 Dec '11

----- Forwarded message from Ale Fernandez <skoria(a)gmail.com> -----

1 0

Seeing Terror Risk, U.S. Asks Journals to Cut Flu Study Facts
by Eugen Leitl 21 Dec '11

21 Dec '11

http://www.nytimes.com/2011/12/21/health/fearing-terrorism-us-asks-journals… Seeing Terror Risk, U.S. Asks Journals to Cut Flu Study Facts By DENISE GRADY and WILLIAM J. BROAD Published: December 20, 2011 For the first time ever, a government advisory board is asking scientific journals not to publish details of certain biomedical experiments, for fear that the information could be used by terrorists to create deadly viruses and touch off epidemics. National Institute for Biological Standards and Control/Photo Researchers The A(H5N1) virus largely affects birds and rarely infects people, but it is highly deadly when it does. Kin Cheung/Associated Press Health workers in Hong Kong killed chickens at a poultry market in 2008. In the experiments, conducted in the United States and the Netherlands, scientists created a highly transmissible form of a deadly flu virus that does not normally spread from person to person. It was an ominous step, because easy transmission can lead the virus to spread all over the world. The work was done in ferrets, which are considered a good model for predicting what flu viruses will do in people. The virus, A(H5N1), causes bird flu, which rarely infects people but has an extraordinarily high death rate when it does. Since the virus was first detected in 1997, about 600 people have contracted it, and more than half have died. Nearly all have caught it from birds, and most cases have been in Asia. Scientists have watched the virus, worrying that if it developed the ability to spread easily from person to person, it could create one of the deadliest pandemics ever. A government advisory panel, the National Science Advisory Board for Biosecurity, overseen by the National Institutes of Health, has asked two journals, Science and Nature, to keep certain details out of reports that they intend to publish on the research. The panel said conclusions should be published, but not b experimental details and mutation data that would enable replication of the experiments.b The panel cannot force the journals to censor their articles, but the editor of Science, Bruce Alberts, said the journal was taking the recommendations seriously and would probably withhold some information b but only if the government creates a system to provide the missing information to legitimate scientists worldwide who need it. The journals, the panel, researchers and government officials have been grappling with the findings for several months. The Dutch researchers presented their work at a virology conference in Malta in September. Scientists and journal editors are generally adamant about protecting the free flow of ideas and information, and ready to fight anything that hints at censorship. b I wouldnbt call this censorship,b Dr. Alberts said. b This is trying to avoid inappropriate censorship. Itbs the scientific community trying to step out front and be responsible.b He said there was legitimate cause for the concern about the researchersb techniques falling into the wrong hands. b This finding shows itbs much easier to evolve this virus to an extremely dangerous state where it can be transmitted in aerosols than anybody had recognized,b he said. Transmission by aerosols means the virus can be spread through the air via coughing or sneezing. Ever since the tightening of security after the terrorist attacks on Sept. 11, 2001, scientists have worried that a scientific development would pit the need for safety against the need to share information. Now, it seems, that day has come. b Itbs a precedent-setting moment, and we need to be careful about the precedent we set,b Dr. Alberts said. Both studies of the virus b one at the Erasmus Medical Center in Rotterdam, in the Netherlands, and the other at the University of Wisconsin-Madison b were paid for by the National Institutes of Health. The idea behind the research was to try to find out what genetic changes might make the virus easier to transmit. That way, scientists would know how to identify changes in the naturally occurring virus that might be warning signals that it was developing pandemic potential. It was also hoped that the research might lead to better treatments. Dr. Anthony Fauci, head of the National Institute of Allergy and Infectious Diseases, said the research addressed important public health questions, but added, b Ibm sure there will be some people who say these experiments never should have been done.b Dr. Fauci said staff members at the institutes followed the results of the research and flagged it as something that the biosecurity panel should evaluate. The lead researcher at the Erasmus center, Ron Fouchier, did not respond to requests for an interview. The center issued a statement saying that researchers there had reservations about the panelbs recommendation, but would observe it. The Wisconsin researcher, Yoshihiro Kawaoka, was out of the country and b not responding to queries,b according to a spokesman for the university. But the school said its researchers would b respectb the panelbs recommendations. David R. Franz, a biologist who formerly headed the Army defensive biological lab at Fort Detrick, Md., is on the board and said its decision to intervene, made in the fall, was quite reasonable. b My concern is that we donbt give amateurs b or terrorists b information that might let them do something that could really cause a lot a harm,b he said in an interview. b Itbs a wake-up call,b Dr. Franz added. b We need to make sure that our best and most responsible scientists have the information they need to prepare us for whatever we might face.b Amy Patterson, director of the office of biotechnology activities at the National Institutes of Health, in Bethesda, Md., said the recommendations were a first. b The board in the past has reviewed manuscripts but never before concluded that communications should be restricted in any way,b she said in a telephone interview. b These two bodies of work stress the importance of public health preparedness to monitor this virus.b Ronald M. Atlas, a microbiologist at the University of Louisville and past president of the American Society for Microbiology, who has advised the federal government on issues of germ terrorism, said the hard part of the recommendations would be creating a way to move forward in the research with a restricted set of responsible scientists. He said that if researchers had a better understanding of how the virus works, they could develop better ways to treat and prevent illness. b Thatbs why the research is done,b he said. The government, Dr. Atlas added, b is going to struggle with how to get the information out to the right people and still have a barrierb to wide sharing and inadvertently aiding a terrorist. b Thatbs going to be hard.b Given that some of the information has already been presented openly at scientific meetings, and that articles about it have been sent out to other researchers for review, experts acknowledged that it may not be possible to keep a lid on the potentially dangerous details. b But I think there will be a culture of responsibility here,b Dr. Fauci said. b At least I hope there will.b The establishment of the board grew out of widespread fears stemming from the 2001 terrorist attacks on the United States and the ensuing strikes with deadly anthrax germs that killed or sickened 22 Americans. The Bush administration called for wide controls on biological information that could potentially help terrorists. And the scientific community firmly resisted, arguing that the best defenses came with the open flow of information. In 2002, Dr. Atlas, then the president-elect of the American Society for Microbiology, objected publicly to b anything that smacked of censorship.b The federal board was established in 2004 as a compromise and is strictly advisory. It has 25 voting members appointed by the secretary of health and human services, and has 18 ex officio members from other federal agencies. Federal officials said Tuesday that the board has discussed information controls on only three or four occasions. The first centered on the genetic sequencing of the H1N1 virus that caused the 1918 flu pandemic, in which up to 100 million people died, making it one of the deadliest natural disasters in human history. b We chose to recommend publication without any modifications,b Dr. Franz, the former head of the Army lab, recalled. b The more our good scientists know about problems, the better prepared they are to fix them.b This fall, federal officials said, the board wrestled with the content of H5N1 papers to Science and Nature, and in late November contacted the journals about its recommendation to restrict information on the methods that the scientists used to modify the deadly virus. b The ability of this virus to cross species lines in this manner has not previously been appreciated,b said Dr. Patterson of the National Institutes of Health. b Everyone involved in this matter wants to do the proper thing.b

1 0

(no subject)
by ��q ��R�I 21 Dec '11

21 Dec '11

　│* ┏━━━━━━━━━━━━━━━━━━━━━━┓* │ ＿人＿┃　　一晩限りの関係で一日平均５万円GET!!　　 ┃＿人＿　Ｙ　┗━━━━━━━━━━━━━━━━━━━━━━┛　Ｙ　│　　貴方の都合に合わせて自由にお仕事が出来る！！　　│ 詳細はコチラ⇒ http://aiko20.me/sx2/ ※入会金、使用料など一切かからないので安心下さい。 ────────────────────────────── :*NEWオープンにつき男性スタッフを緊急募集*:. ============================================================ 【日　給】　一晩平均５万円〜(会員平均、月収１５０万) 【勤務地】　貴方のご近所【時間】　夜(女性によっては昼も可能) 【期間】　完全自由出勤【仕事内容】　　　　　　訳有りの人妻や刺激が欲しいセレブ女性などの一晩の　　　　　　お相手をしてもらいます。報酬は全額お仕事前に女性　　　　　　から直接手渡しで受け取れます！！【費用】　　　　　　男性は登録、利用ともに完全無料　　　　　　(※女性は男性に支払う報酬が必要です) http://aiko20.me/sx2/ このメルマガは懸賞サイト会員様に配信されています。 ------------------------------------------------------------ ●メールマガジンの解除はこちらから！ sup_ado_123(a)yahoo.co.jp

1 0

[liberationtech] Twitter has released the source code to TextSecure under the GPL
by Eugen Leitl 21 Dec '11

21 Dec '11

----- Forwarded message from Nick Merrill <nick(a)calyx.com> -----

1 0

2012г. страховые взносы и бухгалтерский учет
by Бухгалтеру в 2012 году 20 Dec '11

20 Dec '11

23 декабря 2011 г. НАЛОГИ, СТРАХОВЫЕ ВЗНОСЫ И БУХГАЛТЕРСКИЙ УЧЕТ В 2012 ГОДУ: ВСЕ, ЧТО НУЖНО ЗНАТЬ БУХГАЛТЕРУ код (499) - 445\Ч095 ; +7 (499) - 4Ч5_39-68 Программа: 1. Налоги в 2012 году * Трансфертное ценообразование: чего ждать от нового закона (Федеральный закон ╧ 227-ФЗ) КАЖДОМУ налогоплательщику. * НДС (Федеральный закон ╧ 245-ФЗ и др.): * Новый вид счетов-фактур √ корректировочные. * Скорректированы правила определения места реализации отдельных работ (услуг). * Новый порядок учета суммовых разниц в части НДС. * Новые случаи восстановления НДС, установленные НК РФ, и новые важные решения ВАС в этой области. * Новый порядок и возможности электронного документооборота счетами-фактурами. * Уточнен порядок вычетов по НДС при ликвидации объектов недвижимости, их модернизации (реконструкции). * Важнейшие решения ВАС. * Другие важные новшества. * Налог на прибыль (Федеральные законы ╧ 249-ФЗ, ╧ 245-ФЗ, ╧ 239-ФЗ, ╧ 235-ФЗ, ╧ 227-ФЗ, ╧ 215-ФЗ, ╧ 200-ФЗ, от 07.06.2011 ╧ 132-ФЗ, ╧ 321-ФЗ, ╧ 320-ФЗ): * Новое в оценке доходов и расходов в целях налога на прибыль в 2012 г. * Консолидированная группа налогоплательщиков √ новый институт налогового права. Совместная уплата налога на прибыль участниками КГН. * Совершенствование амортизационной политики. * Новый подход к учету расходов на реконструкцию и капитальный ремонт в налоговом и бухгалтерском учете. * Уточнение порядка признания расходов на НИОКР. * Новый порядок списания расходов по лицензионным договорам на программы для ЭВМ и базы данных. * Ставка 0 % для образовательных и медицинских организаций все же может быть применена с 2011 г.: что надо предпринять? * Другие важные новшества. * Изменения по НДФЛ в 2011 и 2012 г. (Федеральный закон ╧ 330-ФЗ): * Отмена стандартного вычета 400 руб. * Изменение вычетов на детей с 2011 года "задним числом": делаем перерасчет, зачитываем переплату. * Вычеты на детей в 2012 году. * Новый порядок налогообложения выходных пособий в 2012 г. * Специальные налоговые режимы в 2012 г.: * Изменения в УСН. * Подготовка к отмене ЕНВД (отмена ЕНВД с 2012 г. в г. Москве). 2. Социальные страховые взносы и пособия * Новое в уплате страховых социальных взносов в 2012 г. (с учетом закона, принятого Госдумой 23 ноября 2011 г.): * Изменение тарифов страховых взносов, введение регрессивной шкалы. * Новый принцип определения облагаемой базы. * Новый порядок уплаты взносов за иностранных работников. * Новый порядок применения тарифных льгот с 2012 года. * Новое в уплате взносов "на травматизм" в 2012 году. * Новое в процедурах проведения Фондами проверок. * Новые штрафные санкции. * Новое в отчетности перед Фондами: * Формы отчетности по персонифицированному учету за 2011 год. * Важные новшества в технологии электронной отчетности, о которых необходимо знать бухгалтеру. * Новое в выплате пособий по социальному страхованию: новшества в 2012 году, новое в оплате больничных "упрощенцами", новые бланки больничных листков и порядок их заполнения: типичные ошибки; программа реформирования пособий до 2014 года: чего ожидать. * Индексация "детских" пособий в 2012 году. 3. Бухгалтерский учет в 2012 году и отчетность за 2011 год * Новый закон "О бухгалтерском учете", принятый Госдумой 22 ноября 2011 г.: готовимся к его вступлению в силу. Внедрение МСФО: кто и когда будет применять эти стандарты. * Первая годовая отчетность по новым формам. Изменения в бухучете в 2011 году, которые надо отразить в отчетности. * Новшества первичной документации: * Новая форма транспортной накладной √ обязательно ли ее применять? * Новый порядок хранения бухгалтерской документации все же вступил в силу: на что обратить внимание. 4. Новое в трудовом законодательстве * Новые требования аттестации рабочих мест по условиям труда: информация для бухгалтера (с учетом Федерального закона ╧ 300-ФЗ). Новый подход к обоснованию расходов на обеспечение нормальных условий труда, спецодежду, медосмотры, аптечки и т.д. * Новые требования к обработке персональных данных работников. * Новое в порядке предоставления отпусков с сентября 2011 г. * Новый минимум оплаты труда в регионах с 2012 года. Стоимость участия: 8 000 рублей За более подробной информацuей обpащайтеcь по тел: 8 (499) Ч45.З9-68 и код (495) - 7-Ч2*91\98

1 0

Could Domestic Surveillance Drones Spur Tougher Privacy Laws?
by Eugen Leitl 20 Dec '11

20 Dec '11

http://spectrum.ieee.org/automaton/robotics/military-robots/could-domestic-… Could Domestic Surveillance Drones Spur Tougher Privacy Laws? POSTED BY: Evan Ackerman / Mon, December 19, 2011 Have you ever been spied on by a surveillance drone? No? Are you sure? Maybe it looked like a hummingbird. Or an insect. Or maybe it was just really high up. Maybe there's one looking in your window right now, and if so, there's no law that says it shouldn't. In a recent article in the Stanford Law Review, Ryan Calo discusses how domestic surveillance drones would fit into the current legal definitions of privacy (and violations thereof), and how these issues could inform the future of privacy policy. The nutshell? Surveillance robots have the potential to fundamentally degrade privacy to such an extent that they could serve as a catalyst for reform. Domestic surveillance robots aren't as much of an issue now as they could be, thanks mostly to the stick-in-the-muddedness of the FAA that keeps unmanned aircraft from doing anything exciting. But eventually, that's going to change, and there are already precedents (legal ones) for how domestic agencies might (read: will) start using robots. Basically, there seems to be essentially no legal restrictions which would prevent the police from having drones flying around all the time, watching people. Clearly, this is something that we as a society should discuss, and we may decide this kind of surveillance should be illegal, or at least restricted to some extent, especially since it's getting easier and easier to build or buy camera-capable flying robots. In the near future, celebrities (like me) will be constantly surrounded by a swarm of face-reading, photo-snapping autonomous robots that will necessitate the development of anti-surveillance drone drones, loaded up with little miniature air-to-air missiles, which themselves are little flying robots. Of course, all this goes beyond surveillance and drones. We've got these same sorts of legal issues popping up all over the place with regard to to robotics, as technology fast outpaces the limited amount of foresight that was employed when coming up with policies meant to manage current technological issues as opposed to future ones. And as we've mentioned before, there's a risk that reactionary (as opposed to proactive) policies could seriously undermine the robotics industry, which is why forethought is so important. You can read the rest of Ryan Calo's article, "The Drone as Privacy Catalyst," at the link below. [ Stanford Law Review ] http://www.stanfordlawreview.org/online/drone-privacy-catalyst The Drone as Privacy Catalyst December 12, 2011 64 Stan. L. Rev. Online 29 Essays by M. Ryan Calo Director for Privacy and Robotics, Center for Internet & Society Associated today with the theatre of war, the widespread domestic use of drones for surveillance seems inevitable. Existing privacy law will not stand in its way. It may be tempting to conclude on this basis that drones will further erode our individual and collective privacy. Yet the opposite may happen. Drones may help restore our mental model of a privacy violation. They could be just the visceral jolt society needs to drag privacy law into the twenty-first century. Samuel Warren and Louis Brandeis knew what a privacy violation looked like: yellow journalists armed with newly developed b instantaneous photographsb splashing pictures of a respectable wedding on the pages of every newspaper.[1] Their influential 1890 article The Right To Privacy crystallized an image of technology-fueled excess, which the authors leveraged to jump-start privacy law in the United States. But what do privacy violations look like today? They tend to be hard to visualize. Maybe somewhere, in some distant server farm, the government correlates two pieces of disparate information. Maybe one online advertiser you have never heard of merges with another to share email lists. Perhaps a shopperbs purchase of an organic product increases the likelihood she is a Democrat just enough to cause her identity to be sold to a campaign. At most one can picture the occasional harmful outcome; its mechanism remains obscure. It is hard to know exactly what role the inscrutability of privacy has played in the development of contemporary privacy law. But the law has clearly stalled. Tort recovery founders on the question of damages. Privacy statutes tend to respond to specific incidences or abuses: for instance, no provider of videos (broadly defined) may release costumer rental history because journalists once managed to procure a list of the videos enjoyed by a Supreme Court nominee. And it must be possible for officers practically to glimpse the proverbial b lady in her saunab before the Fourth Amendment places serious limits on the deployment of surveillance technology.[2] The development of American privacy law has been slow and uneven; the advancement of information technology has not. The result is a widening chasm between our collective and individual capacity to observe one another and the protections available to consumers and citizens under the law. We are only now, in 2011, revisiting The Electronic Communications Privacy Act, which controls the circumstances under which the government can intercept or access electronic communications such as emails. The Act was passed in 1986. At the time, lawmakersb kids were trading in their Walkman for a Discman. Al Gore had only just invented the Internet.[3] Recent shifts in technology and attendant changes to business practices have not led to similar shifts in privacy law, at least not on the order of 1890. Computers, the Internet, RFID, GPS, biometrics, facial recognitionbnone of these developments has created the same sea change in privacy thinking. One might reasonably wonder whether we will ever have another Warren and Brandeis moment, whether any technology will dramatize the need to rethink the very nature of privacy law. One good candidate is the drone. In routine use by todaybs military, these unmanned aircraft systems threaten to perfect the art of surveillance. Drones are capable of finding or following a specific person. They can fly patterns in search of suspicious activities or hover over a location in wait. Some are as small as birds or insects, others as big as blimps. In addition to high-resolution cameras and microphones, drones can be equipped with thermal imaging and the capacity to intercept wireless communications. That drones will see widespread domestic use seems inevitable. They represent an efficient and cost-effective alternative to helicopters and airplanes. Police, firefighters, and geologists willband dobuse drones for surveillance and research. But drones will not be limited to government or scientific uses. The private sector has incentives to use drones as well. The media, in particular, could make widespread use of drones to cover unfolding police activity or traffic stories. Imagine what drones would do for the lucrative paparazzi industry, especially coupled with commercially available facial recognition technology. You might think drones would already be ubiquitous. There are, however, Federal Aviation Administration restrictions on the use of unmanned aircraft systems, restrictions that date back several years. Some public agencies have petitioned for waiver. Customs and Border Protection uses drones to police our borders. Recently the state of Oklahoma asked the FAA for a blanket waiver of eighty miles of airspace. Going forward, waiver may not be necessary. The FAA faces increasing pressure to relax its restrictions and is considering rulemaking to reexamine drone use in domestic airspace.[4] Agency rules impede the use of drones for now; United States privacy law does not. There is very little in our privacy law that would prohibit the use of drones within our borders. Citizens do not generally enjoy a reasonable expectation of privacy in public, nor even in the portions of their property visible from a public vantage. In 1986, the Supreme Court found no search where local police flew over the defendantbs backyard with a private plane.[5] A few years later, the Court admitted evidence spotted by an officer in a helicopter looking through two missing roof panels in a greenhouse.[6] Neither the Constitution nor common law appears to prohibit police or the media from routinely operating surveillance drones in urban and other environments.[7] If anything, observations by drones may occasion less scrutiny than manned aerial vehicles. Several prominent cases, and a significant body of scholarship, reflect the view that no privacy violation has occurred unless and until a human observes a person, object, or attribute.[8] Just as a dog might sniff packages and alert an officer only in the presence of contraband, so might a drone scan for various chemicals or heat signatures and alert an officer only upon spotting the telltale signs of drug production.[9] In short, drones like those in widespread military use today will tomorrow be used by police, scientists, newspapers, hobbyists, and others here at home. And privacy law will not have much to say about it. Privacy advocates will. As with previous emerging technologies, advocates will argue that drones threaten our dwindling individual and collective privacy. But unlike the debates of recent decades, I think these arguments will gain serious traction among courts, regulators, and the general public. I have in mind the effect on citizens of drones flying around United States cities. These machines are disquieting. Virtually any robot can engender a certain amount of discomfort, let alone one associated in the mind of the average American with spy operations or targeted killing. If you will pardon the inevitable reference to 1984, George Orwell specifically describes small flying devices that roam neighborhoods and peer into windows. Yet one need not travel to Orwellbs Oceaniabor the offices of our own Defense Advanced Research Projects Agencybto encounter one of these machines. You could travel to one of several counties where American police officers are presently putting this technology through its paces. The parallels to The Right to Privacy are also acute. Once journalists needed to convince high society to pose for a photograph. New technologies made it possible for a journalist automatically to b snapb a picture, which in turn led to salacious news coverage. Americans in 1890 could just picture that tweedy journalist in the bushes of a posh wedding, hear the slap of the newspaper the next day, and see the mortified look of the bridal party in the cover art. Todaybs police have to follow hunches, cultivate informants, subpoena ATM camera footage; journalists must ghost about the restaurant or party of the moment. Tomorrowbs police and journalists might sit in an office or vehicle as their metal agents methodically search for interesting behavior to record and relay. Americans can visualize and experience this activity as a physical violation of their privacy. There are ways that drones might be introduced without this effect. Previous military technology has found its way into domestic use through an acclimation process: it is used in large events requiring heightened security, for instance, and then simply left in place.[10] We could delay public awareness of drones by limiting use to those that are capable of observing the ground without detection. But these efforts would take a knowing, coordinated effort by the government. The more likely scenario, as suggested by Oklahomabs plan, is one in which FAA restrictions relax and private and public drones quickly fill the sky. Daniel Solove has argued that the proper metaphor for contemporary privacy violations is not the Big Brother of Orwellbs 1984, but the inscrutable courts of Franz Kafkabs The Trial.[11] I agree, and believe that the lack of a coherent mental model of privacy harm helps account for the lag between the advancement of technology and privacy law. There is no story, no vivid and specific instance of a paradigmatic privacy violation in a digital universe, upon which citizens and lawmakers can premise their concern. Drones and other robots have the potential to restore that mental model. They represent the cold, technological embodiment of observation. Unlike, say, NSA network surveillance or commercial data brokerage, government or industry surveillance of the populace with drones would be visible and highly salient. People would feel observed, regardless of how or whether the information was actually used. The resulting backlash could force us to reexamine not merely the use of drones to observe, but the doctrines that today permit this use. Samuel D. Warren & Louis D. Brandeis, The Right to Privacy, 4 Harv. L. Rev. 193, 195 (1890).

1 0

An MIT Magic Trick: Computing On Encrypted Databases Without Ever Decrypting Them
by Eugen Leitl 20 Dec '11

20 Dec '11

http://www.forbes.com/sites/andygreenberg/2011/12/19/an-mit-magic-trick-com… An MIT Magic Trick: Computing On Encrypted Databases Without Ever Decrypting Them CryptDB can perform the digital equivalent of pulling the desired file out of a locked filing cabinet without ever unlocking it. For the last three decades or so, the big problem in using encryption hasnbt been whether strongly encrypted files can be cracked. The problem remains that to actually do anything with encrypted databsearch it, sort it, or perform computations with itbthat data must be decrypted and exposed to prying eyes. Now the Google- and Citigroup-funded work of three MIT scientists holds the promise of solving that long-nagging issue in some of the computing worldbs most common applications. CryptDB, a piece of database software the researchers presented in a paper (PDF here) at the Symposium on Operating System Principles in October, allows users to send queries to an encrypted set of data and get almost any answer they need from it without ever decrypting the stored information, a trick that keeps the info safe from hackers, accidental loss and even snooping administrators. And while itbs not the first system to offer that kind of magically flexible cryptography, it may be the first practical one, taking a fraction of a second to produce an answer where other systems that perform the same encrypted functions would require thousands of years. Cryptographers have long sought to implement a system they call b fully homomorphic encryption,b in which a user can encrypt data into indecipherable strings of numbers, do math with those strings, and then decrypt the results to get the same answer he or she would have if the data hadnbt been encrypted at all. Thatbs a useful trick if you need to perform operations on health care or financial data in a situation like cloud computing, where the computer (or the IT administrator) doing the calculations canbt always be trusted to access the private numbers being crunched. IBM cryptographer Craig Gentry compares the idea to b one of those boxes with the gloves that are used to handle toxic chemicals,b as he once put it. b All the manipulation happens inside the box, and the chemicals are never exposed to the outside world.b In fact, Gentry solved that problem of fully homomorphic encryption with a brilliant new system in 2009. But his theoretical solution had a practical problem: It multiplied the time to perform the calculation by around a trillion. CryptDB, on the other hand, manages to emulate fully homomorphic encryption for most of the functions of the SQL databases used in many applications, computing only with encrypted data and adding just 15% to 26% to those applicationsb computing time. The MIT researchersb approach was to avoid fancy new cryptography schemes, and instead piece together existing ones that get the job done. The RSA scheme, for instance, lets you multiply encrypted numbers, and another called the Paillier scheme lets you add them. For the simpler task of looking for matches in data, plenty of schemes allow you to compare encrypted information and see whether the scrambled codes are equal, and thus determine if the unencrypted data points were also the same. b The insight we had, the cool idea, is that SQL queries in a database are composed of relatively few types of operations: equal to, less than, summing up, sorting,b says MIT professor of software technology Nickolai Zeldovich. b For each operation, we were able to find an encryption scheme that is quite efficient at computing on encrypted data.b The cleverest part of CryptDB, however, is that itbs able to switch between crypto systems on the fly depending on the operation. The data in the database is encrypted in multiple layers of different encryption, what the researchers call an b onionb of encryption. Every layer allows different kinds of computation and has a different key. b You just strip off the levels of the onion until you reach the level that allows a certain operation,b says MIT researcher Raluca Ada Popa. The most secure schemes are used on the outside of that onion and the least secure are used on the inside. CryptDB manages to perform all its functions of a database without ever removing that last layer of the onion, so that the data always remains secure. CryptDB has its limits, the MIT researchers warnbno square roots, for one example. And while the data is never completely decrypted, it does b leakb information about the underlying data when enough outer layers of encryption are removed, revealing attributes like which data points are equal to each other. But in their paper they sampled operations from several real databases like one used by a Web forum and another by a grade-calculating application, and found that their encrypted system would allow the same calculations as an unencrypted database in 99.5% of those operations, and that data the researchers deemed b sensitiveb is never leaked in those test cases. The limitations of CryptDB arenbt insignificant, says Butler Lampson, a security-focused Microsoft Research fellow. bIt might not be easy to get customers to understand the subset of queries this can and canbt handle,b he points out. But Lampson still argues that CryptDB is remarkably practical compared to other attempts at solving the problem of computing with encrypted data. b I donbt think webll see anyone using Gentrybs solution in our lifetimes,b he says. b But itbs very likely webll actually see this applied in practice. I donbt see any real barrier.b At least two companies already seem interested: Google and Citigroup funded the research, along with the National Science Foundation. The Pentagonbs Defense Advanced Research Projects Agency (DARPA) has shown it wants in on fully homomorphic cryptography, too. The agency is putting up $20 million for anyone who can create a scheme that takes only 100,000 times as long as unencrypted calculationsba tough task, compared to Craig Gentrybs system from 2009. But given that in many cases CryptDB performs 80,000 faster than DARPAbs goal, the MIT researchers shouldnbt be surprised to see the military come calling soon. The full paper on CryptDB is available here. http://people.csail.mit.edu/nickolai/papers/raluca-cryptdb.pdf

1 0

Re: [liberationtech] MIT Software Allows Queries On Encrypted Databases
by Eugen Leitl 20 Dec '11

20 Dec '11

----- Forwarded message from Michael Rogers <m--(a)gmx.com> -----

1 0

Re: [tor-talk] "If you have access to certain tools, you can completely ignore Tor."
by Eugen Leitl 20 Dec '11

20 Dec '11

----- Forwarded message from Jacob Appelbaum <jacob(a)appelbaum.net> -----

1 0