July 2018 - cypherpunks-legacy

CDR: Re: Internet Hoax Articles Considered Harmful=20
by Declan McCullagh 05 Jul '18

05 Jul '18

On Sun, Oct 07, 2001 at 11:54:50PM -0700, Tim May wrote: > PHILADELPHIA, Pennyslvania (AP) - Homeland Defense Secretary Tom Ridge = > said Sunday that the U.S. faces a serious and expanding threat from=20 > fraudulent Internet articles, or hoaxes. Almost. The most obvious sign that this is a hoax is your inclusion of the state in the dateline. For major cities, it's usually not = included. -Declan ------------------ I knew it was a hoax because I read the original article, which read: Ridge stressed that the U.S moves to limit false news articles will be=20 done with input from civil liberties groups, saying the moves are=20 ``against info-terrorists, info-terrorism, their sanctuaries and their=20 supporters, those who harbor them, those who give sanctuary to those=20 who harbor them, those who support those who give sanctuary to those who harbor them, those who associate with those who give them support, sanctuary, or harbor them, those we suspect of being associated with=20 those who are associated with those who give them support, sanctuary, or harbor them, those who are suspected of voting for the rulers of any country which has given them support, sanctuary, or harbored them, those who may associate in the future with someone who might consider giving them support, sanctuary, or harboring them...'' I cut it short, because the original is 378 GB... Suffice it to say that the ParaMeters for who is TargetAble as a = Certified BadGuy=20 has recently gotten Wider...and can be expected to MushRoom(BOOM!) at an expoential rate in the near future, now that THEY [TM] have seen the = Ease with which THEY [TM] can SMEAR just about anyone THEY [TM] please by=20 Painting a Wider Swath via GuiltByAssociation... (Can eWe Say "I Only Sent A Single eMail To Jim Bell In My Whole Life?") ((Sure, eWe Can...)) Sincerely, SomeOne Who Didn't Actually *Write* This eMail, But Who Knows An Uncle Of The Person Who Did ------=_NextPart_000_0077_01C14FD9.C2F024A0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META http-equiv=3DContent-Type content=3D"text/html; = charset=3Diso-8859-1"> <META content=3D"MSHTML 6.00.2600.0" name=3DGENERATOR> <STYLE></STYLE> </HEAD> <BODY bgColor=3D#ffffff><FONT face=3DArial> <DIV><EM>Subject</EM>: CDR: Re: Internet Hoax Articles Considered = Harmful </DIV> <DIV><EM>From</EM>: Declan McCullagh <<A=20 href=3D"mailto:declan@well.com">declan(a)well.com</A>> = </DIV><PRE>On Sun, Oct = 07, 2001 at 11:54:50PM -0700, Tim May wrote: > PHILADELPHIA, Pennyslvania (AP) - Homeland Defense Secretary Tom = Ridge=20 > said Sunday that the U.S. faces a serious and expanding threat from = > fraudulent Internet articles, or hoaxes. Almost. The most obvious sign that this is a hoax is your inclusion of the state in the dateline. For major cities, it's usually not = included. -Declan ------------------</PRE><PRE>I knew it was a hoax because I read the = original article, which read:</PRE> <DIV><FONT size=3D2>Ridge stressed that the U.S moves to limit false = news articles=20 will be <BR>done with input from civil liberties groups, saying the = moves are=20 <BR>``against info-terrorists, info-terrorism, their sanctuaries and = their=20 <BR>supporters, those who harbor them, those who give sanctuary to those = </FONT></DIV> <DIV><FONT size=3D2>who harbor them, those who support those who give = sanctuary to=20 those</FONT></DIV> <DIV><FONT size=3D2>who harbor them, those who associate with those who = give them=20 support,</FONT></DIV> <DIV><FONT size=3D2>sanctuary, or harbor them, those we suspect of being = associated with </FONT></DIV> <DIV><FONT size=3D2>those who are associated with those who give them = support,=20 sanctuary,</FONT></DIV> <DIV><FONT size=3D2>or harbor them, those who are suspected of voting = for the=20 rulers of any</FONT></DIV> <DIV><FONT size=3D2>country which has given them support, sanctuary, or = harbored=20 them,</FONT></DIV> <DIV><FONT size=3D2>those who may associate in the future with someone = who might=20 consider</FONT></DIV> <DIV><FONT size=3D2>giving them support, sanctuary, or harboring=20 them...''</FONT></DIV> <DIV><FONT size=3D2></FONT> </DIV> <DIV><FONT size=3D2>I cut it short, because the original is 378 = GB...</FONT></DIV> <DIV><FONT size=3D2>Suffice it to say that the ParaMeters for who is = TargetAble as=20 a Certified BadGuy </FONT></DIV> <DIV><FONT size=3D2>has </FONT><FONT size=3D2>recently gotten = Wider...and can be=20 expected to MushRoom(BOOM!) at an</FONT></DIV> <DIV><FONT size=3D2>expoential rate in the near future, now that THEY = [TM] have=20 seen the Ease with</FONT></DIV> <DIV><FONT size=3D2>which THEY [TM] can SMEAR just about anyone THEY = [TM] please=20 by </FONT></DIV> <DIV><FONT size=3D2>Painting a Wider Swath via = GuiltByAssociation...</FONT></DIV> <DIV><FONT size=3D2>(Can eWe Say "I Only Sent A Single eMail To Jim Bell = In My=20 Whole Life?")</FONT></DIV> <DIV><FONT size=3D2>((Sure, eWe Can...))</FONT></DIV> <DIV><FONT size=3D2></FONT> </DIV> <DIV><FONT size=3D2>Sincerely,</FONT></DIV> <DIV><FONT size=3D2>SomeOne Who Didn't Actually *Write* This = eMail,</FONT></DIV> <DIV><FONT size=3D2>But Who Knows An Uncle Of The Person Who = Did</FONT></DIV> <DIV><FONT size=3D2><BR> </DIV></FONT></FONT></BODY></HTML> ------=_NextPart_000_0077_01C14FD9.C2F024A0-- _________________________________________________________ Do You Yahoo!? Get your free @yahoo.com address at http://mail.yahoo.com

1 0

CDR: Re: Internet Hoax Articles Considered Harmful=20
by Declan McCullagh 05 Jul '18

05 Jul '18

On Sun, Oct 07, 2001 at 11:54:50PM -0700, Tim May wrote: > PHILADELPHIA, Pennyslvania (AP) - Homeland Defense Secretary Tom Ridge = > said Sunday that the U.S. faces a serious and expanding threat from=20 > fraudulent Internet articles, or hoaxes. Almost. The most obvious sign that this is a hoax is your inclusion of the state in the dateline. For major cities, it's usually not = included. -Declan ------------------ I knew it was a hoax because I read the original article, which read: Ridge stressed that the U.S moves to limit false news articles will be=20 done with input from civil liberties groups, saying the moves are=20 ``against info-terrorists, info-terrorism, their sanctuaries and their=20 supporters, those who harbor them, those who give sanctuary to those=20 who harbor them, those who support those who give sanctuary to those who harbor them, those who associate with those who give them support, sanctuary, or harbor them, those we suspect of being associated with=20 those who are associated with those who give them support, sanctuary, or harbor them, those who are suspected of voting for the rulers of any country which has given them support, sanctuary, or harbored them, those who may associate in the future with someone who might consider giving them support, sanctuary, or harboring them...'' I cut it short, because the original is 378 GB... Suffice it to say that the ParaMeters for who is TargetAble as a = Certified BadGuy=20 has recently gotten Wider...and can be expected to MushRoom(BOOM!) at an expoential rate in the near future, now that THEY [TM] have seen the = Ease with which THEY [TM] can SMEAR just about anyone THEY [TM] please by=20 Painting a Wider Swath via GuiltByAssociation... (Can eWe Say "I Only Sent A Single eMail To Jim Bell In My Whole Life?") ((Sure, eWe Can...)) Sincerely, SomeOne Who Didn't Actually *Write* This eMail, But Who Knows An Uncle Of The Person Who Did ------=_NextPart_000_0077_01C14FD9.C2F024A0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META http-equiv=3DContent-Type content=3D"text/html; = charset=3Diso-8859-1"> <META content=3D"MSHTML 6.00.2600.0" name=3DGENERATOR> <STYLE></STYLE> </HEAD> <BODY bgColor=3D#ffffff><FONT face=3DArial> <DIV><EM>Subject</EM>: CDR: Re: Internet Hoax Articles Considered = Harmful </DIV> <DIV><EM>From</EM>: Declan McCullagh <<A=20 href=3D"mailto:declan@well.com">declan(a)well.com</A>> = </DIV><PRE>On Sun, Oct = 07, 2001 at 11:54:50PM -0700, Tim May wrote: > PHILADELPHIA, Pennyslvania (AP) - Homeland Defense Secretary Tom = Ridge=20 > said Sunday that the U.S. faces a serious and expanding threat from = > fraudulent Internet articles, or hoaxes. Almost. The most obvious sign that this is a hoax is your inclusion of the state in the dateline. For major cities, it's usually not = included. -Declan ------------------</PRE><PRE>I knew it was a hoax because I read the = original article, which read:</PRE> <DIV><FONT size=3D2>Ridge stressed that the U.S moves to limit false = news articles=20 will be <BR>done with input from civil liberties groups, saying the = moves are=20 <BR>``against info-terrorists, info-terrorism, their sanctuaries and = their=20 <BR>supporters, those who harbor them, those who give sanctuary to those = </FONT></DIV> <DIV><FONT size=3D2>who harbor them, those who support those who give = sanctuary to=20 those</FONT></DIV> <DIV><FONT size=3D2>who harbor them, those who associate with those who = give them=20 support,</FONT></DIV> <DIV><FONT size=3D2>sanctuary, or harbor them, those we suspect of being = associated with </FONT></DIV> <DIV><FONT size=3D2>those who are associated with those who give them = support,=20 sanctuary,</FONT></DIV> <DIV><FONT size=3D2>or harbor them, those who are suspected of voting = for the=20 rulers of any</FONT></DIV> <DIV><FONT size=3D2>country which has given them support, sanctuary, or = harbored=20 them,</FONT></DIV> <DIV><FONT size=3D2>those who may associate in the future with someone = who might=20 consider</FONT></DIV> <DIV><FONT size=3D2>giving them support, sanctuary, or harboring=20 them...''</FONT></DIV> <DIV><FONT size=3D2></FONT> </DIV> <DIV><FONT size=3D2>I cut it short, because the original is 378 = GB...</FONT></DIV> <DIV><FONT size=3D2>Suffice it to say that the ParaMeters for who is = TargetAble as=20 a Certified BadGuy </FONT></DIV> <DIV><FONT size=3D2>has </FONT><FONT size=3D2>recently gotten = Wider...and can be=20 expected to MushRoom(BOOM!) at an</FONT></DIV> <DIV><FONT size=3D2>expoential rate in the near future, now that THEY = [TM] have=20 seen the Ease with</FONT></DIV> <DIV><FONT size=3D2>which THEY [TM] can SMEAR just about anyone THEY = [TM] please=20 by </FONT></DIV> <DIV><FONT size=3D2>Painting a Wider Swath via = GuiltByAssociation...</FONT></DIV> <DIV><FONT size=3D2>(Can eWe Say "I Only Sent A Single eMail To Jim Bell = In My=20 Whole Life?")</FONT></DIV> <DIV><FONT size=3D2>((Sure, eWe Can...))</FONT></DIV> <DIV><FONT size=3D2></FONT> </DIV> <DIV><FONT size=3D2>Sincerely,</FONT></DIV> <DIV><FONT size=3D2>SomeOne Who Didn't Actually *Write* This = eMail,</FONT></DIV> <DIV><FONT size=3D2>But Who Knows An Uncle Of The Person Who = Did</FONT></DIV> <DIV><FONT size=3D2><BR> </DIV></FONT></FONT></BODY></HTML> ------=_NextPart_000_0077_01C14FD9.C2F024A0-- _________________________________________________________ Do You Yahoo!? Get your free @yahoo.com address at http://mail.yahoo.com

1 0

None
by mmotyka＠lsil.com 05 Jul '18

05 Jul '18

A writer for the Voice ( if I heard it correctly ) talked about a computer captured in Manila that was supposedly used by Ramzi Yousef. He said that there were documents that described hijacking planes and flying them into prominent buildings. This information was turned over to the FBI in 1995 or 1996. I hope with expanded powers for surveillance and searches that they can gather better information and shorten the analysis period. ----------- Let's see... THEY [TM] use ECHELON to listen to every electronic message in the history of the world... THEY [TM] have apparently already had advance information about all of the UnForSeen Tragedies that have occurred lately... THEY [TM] have failed to protect US&OR&U.S. from known threats, known enemies, known terrorist plans, yet they are using Their failure to do so as an excuse for needing to exercise even more intrusion into our privacy and constitutional rights... Next thing you know, THEY [TM] will be telling us they need to raise taxes, because they wasted the money we already gave them...or has this already happened? (I've been...uuhhh..away...) CJ Parker <sonofgomez709(a)yahoo.com> http://profiles.yahoo.com/sonofgomez709 http://www.technopagan.org/politics/xenix/ http://members.w-link.net/~sog/INDEX.HTM

1 0

State refuses to approve Diebold voting machines
by EEkid＠aol.com 05 Jul '18

05 Jul '18

State refuses to approve Diebold voting machines By Edwin Garcia Mercury News Sacramento Bureau SACRAMENTO - Suggesting the ``security and integrity'' of electronic voting could be at risk, Secretary of State Bruce McPherson on Tuesday refused to approve the use of thousands of electronic voting machines pending a federal evaluation. The touch-screen and optical-scan machines, made by Diebold Election Systems and used in 17 counties, including Alameda, were found to have ``unresolved significant security concerns'' with a memory card that stores votes in each machine, McPherson's elections chief, Caren Daniels-Meade, said in a letter to the company's vice president, David Byrd. At issue is whether the removable cards, which are used to program and configure the machines, will keep data secure. The Secretary of State's office is asking Diebold to submit the machine's source code for review by the federal Independent Testing Authorities before resubmitting the company's application for certification in California. Byrd, Diebold's vice president of business operations, is eager to comply. ``Diebold Election Systems is always willing to participate in responsible testing to show that our voting systems are up to the task of giving more Californians an accessible and reliable way to vote,'' Byrd said. ``This has always been our goal: to provide a more accurate, secure and accessible voting process for all Californians.'' http://www.mercurynews.com/mld/mercurynews/13452214.htm ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] State refuses to approve Diebold voting machines
by David Farber 05 Jul '18

05 Jul '18

Begin forwarded message:

1 0

hedging our bets -- in case SHA-256 turns out to be insecure
by Zooko Wilcox-O'Hearn 05 Jul '18

05 Jul '18

Folks: We're going to be deploying a new crypto scheme in Tahoe-LAFS next year -- the year 2010. Tahoe-LAFS is used for long-term storage, and I won't be surprised if people store files on Tahoe-LAFS in 2010 and then rely on the confidentiality and integrity of those files for many years or even decades to come. (People started storing files on Tahoe-LAFS in 2008 and so far they show no signs of losing interest in the integrity and confidentiality of those files.) This long-term focus makes Tahoe-LAFS's job harder than the job of protecting transient network packets. If someone figures out in 2020 or 2030 how to spoof a network transaction that you sent in 2010 (see [1]), it'll be far too late to do you any harm, but if they figure out in 2030 how to alter a file that you uploaded to a Tahoe-LAFS grid in 2010, that might harm you. Therefore I've been thinking about how to make Tahoe-LAFS robust against the possibility that SHA-256 will turn out to be insecure. A very good way to do this is to design Tahoe-LAFS so that it relies as little as possible on SHA-256's security properties. The property that seems to be the hardest for a secure hash function to provide is collision-resistance. We are analyzing new crypto schemes to see how many security properties of Tahoe-LAFS we can continue to guarantee even if the collision-resistance of the underlying secure hash function fails, and similarly for the other properties of the secure hash function which might fail [2]. This note is not about that design process, though, but about how to maximize the chance that the underlying hash function does provide the desired security properties. We could use a different hash function than SHA-256 -- there are many alternatives. SHA-512 would probably be safer, but it is extremely expensive on the cheap, low-power 32-bit ARM CPUs that are one of our design targets [3], and the output size of 512 bits is too large to fit into Tahoe-LAFS capabilities. There are fourteen candidates left in the SHA-3 contest at the moment. Several of them have conservative designs and good performance, but there is always the risk that they will be found to have catastrophic design flaws or that a great advance in hash function cryptanalysis will suddenly show how to crack them. Of course, a similar risk applies to SHA-256! So I turn to the question of how to combine multiple hash functions to build a hash function which is secure even if one or more of the underlying hash functions turns out to be weak. I've read several interesting papers on the subject -- such as [4, 5] and especially "Robust Multi-Property Combiners for Hash Functions Revisited" by Marc Fischlin, Anja Lehmann, and Krzysztof Pietrzak [6]. The good news is that it turns out to be doable! The latter two papers show nice strong theoretical results -- ways to combine hash functions so that the resulting combination is as strong or stronger than the two underlying hash functions. The bad news is that the proposal in [6] builds a combined function whose output is twice the size of the output of a single hash function. There is a good theoretical reason for this [4], but it won't work for our practical engineering requirements -- we need hash function outputs as small as possible (partially due to usability issues) The other bad news is that the construction proposed in [6] is complicated, underspecified, and for the strongest version of it, it imposes a limit on the length of the inputs that you can feed to your hash function. It grows to such complexity and incurs such limitations because it is, if I may call it this, "too theoretical". It is designed to guarantee certain output properties predicated on minimal theoretical assumptions about the properties of the underlying hash functions. This is a fine goal, but in practice we don't want to pay such a high cost in complexity and performance in order to gain such abstract improvement. We should be able to "hedge our bets" and achieve a comfortable margin of safety with a very simple and efficient scheme by making stronger, less formal, but very plausible assumptions about the underlying hash functions. Read on. I propose the following combined hash function C, built out of two hash functions H1 and H2: C(x) = H1(H1(x) || H2(x)) The first observation is that if H1 is collision-resistant then so is C. In practice I would expect to use SHA-256 for H1, so the resulting combiner C[SHA-256, H2] will be at least as strong as SHA-256. (One could even think of this combiner C as just being a tricky way to strengthen SHA-256 by using the output of H2(x) as a randomized salt -- see [7].) The next observation is that finding a pair of inputs x1, x2 which collide in *both* H1 and in H2 is likely to be much harder than finding a pair of inputs that collide in H1 and finding a pair of inputs that collide in H2 (see [5]). Now the reason that a combiner like this one is not published in theoretical crypto literature is that it obviously could fail if the outer hash function H1 fails. For example, even if H2 is collision- resistant, if H1 turns out to be susceptible to collisions, then theoretically speaking C[H1, H2] might be susceptible to collisions. However, in real life C[H1, H2] would most likely still be collision resistant! All practical attacks on real hash functions so far (if I understand correctly) are multi-block attacks in which the attacker is able to feed a sufficiently long and unconstrained input to the hash functions that the effects of the later parts of his inputs are able to manipulate the state generated by the earlier parts of his inputs. My combiner C uses H1 in its outer invocation on a single- block-sized input, which means no such multi-block attacks are possible on the outer invocation. In addition, the inputs that the attacker gets to feed to the outer invocation of H1 are highly constrained. Basically, he would already have to be very good at manipulating the inner invocations H1 and H2 in ways that he isn't supposed to before he can even begin to manipulate the outer invocation of H1. A measure of the practical security of a combiner like this one would be "how safe would it be if it were instantiated using broken practical hash functions such as MD5 and SHA1?". It appears to me (from an admittedly cursory analysis) that there is no realistic way to find collisions in C[MD5, SHA1] even though there are realistic ways to find collisions in MD5 and in SHA1. Of course, I'm not proposing to use C[MD5, SHA1]! I'm proposing to use C[SHA-256, _] where _ is some other hash function which is believed to be strong. The example of instantiating C with MD5 and SHA1 just goes to show that C is a hash function which is stronger than either of its two underlying hash functions. The other desirable security properties such as second-preimage resistance and pre-image resistance seem to follow the same pattern as collision-resistance -- C[H1, H2] seems to be much stronger than H1 or H2 alone. Regards, Zooko [1] http://extendedsubset.com/Renegotiating_TLS.pdf [2] http://allmydata.org/trac/tahoe/wiki/NewCaps/WhatCouldGoWrong [3] http://bench.cr.yp.to/results-hash.html#arm-apollo [4] Krzysztof Pietrzak: "Non-Trivial Black-Box Combiners for Collision-Resistant Hash-Functions don't Exist" [5] Jonathan J. Hoch, Adi Shamir: "On the Strength of the Concatenated Hash Combiner when All the Hash Functions are Weak" [6] Marc Fischlin, Anja Lehmann, Krzysztof Pietrzak: "Robust Multi- Property Combiners for Hash Functions Revisited" [7] http://webee.technion.ac.il/~hugo/rhash/rhash.pdf --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

hedging our bets -- in case SHA-256 turns out to be insecure
by Zooko Wilcox-O'Hearn 05 Jul '18

05 Jul '18

Folks: We're going to be deploying a new crypto scheme in Tahoe-LAFS next year -- the year 2010. Tahoe-LAFS is used for long-term storage, and I won't be surprised if people store files on Tahoe-LAFS in 2010 and then rely on the confidentiality and integrity of those files for many years or even decades to come. (People started storing files on Tahoe-LAFS in 2008 and so far they show no signs of losing interest in the integrity and confidentiality of those files.) This long-term focus makes Tahoe-LAFS's job harder than the job of protecting transient network packets. If someone figures out in 2020 or 2030 how to spoof a network transaction that you sent in 2010 (see [1]), it'll be far too late to do you any harm, but if they figure out in 2030 how to alter a file that you uploaded to a Tahoe-LAFS grid in 2010, that might harm you. Therefore I've been thinking about how to make Tahoe-LAFS robust against the possibility that SHA-256 will turn out to be insecure. A very good way to do this is to design Tahoe-LAFS so that it relies as little as possible on SHA-256's security properties. The property that seems to be the hardest for a secure hash function to provide is collision-resistance. We are analyzing new crypto schemes to see how many security properties of Tahoe-LAFS we can continue to guarantee even if the collision-resistance of the underlying secure hash function fails, and similarly for the other properties of the secure hash function which might fail [2]. This note is not about that design process, though, but about how to maximize the chance that the underlying hash function does provide the desired security properties. We could use a different hash function than SHA-256 -- there are many alternatives. SHA-512 would probably be safer, but it is extremely expensive on the cheap, low-power 32-bit ARM CPUs that are one of our design targets [3], and the output size of 512 bits is too large to fit into Tahoe-LAFS capabilities. There are fourteen candidates left in the SHA-3 contest at the moment. Several of them have conservative designs and good performance, but there is always the risk that they will be found to have catastrophic design flaws or that a great advance in hash function cryptanalysis will suddenly show how to crack them. Of course, a similar risk applies to SHA-256! So I turn to the question of how to combine multiple hash functions to build a hash function which is secure even if one or more of the underlying hash functions turns out to be weak. I've read several interesting papers on the subject -- such as [4, 5] and especially "Robust Multi-Property Combiners for Hash Functions Revisited" by Marc Fischlin, Anja Lehmann, and Krzysztof Pietrzak [6]. The good news is that it turns out to be doable! The latter two papers show nice strong theoretical results -- ways to combine hash functions so that the resulting combination is as strong or stronger than the two underlying hash functions. The bad news is that the proposal in [6] builds a combined function whose output is twice the size of the output of a single hash function. There is a good theoretical reason for this [4], but it won't work for our practical engineering requirements -- we need hash function outputs as small as possible (partially due to usability issues) The other bad news is that the construction proposed in [6] is complicated, underspecified, and for the strongest version of it, it imposes a limit on the length of the inputs that you can feed to your hash function. It grows to such complexity and incurs such limitations because it is, if I may call it this, "too theoretical". It is designed to guarantee certain output properties predicated on minimal theoretical assumptions about the properties of the underlying hash functions. This is a fine goal, but in practice we don't want to pay such a high cost in complexity and performance in order to gain such abstract improvement. We should be able to "hedge our bets" and achieve a comfortable margin of safety with a very simple and efficient scheme by making stronger, less formal, but very plausible assumptions about the underlying hash functions. Read on. I propose the following combined hash function C, built out of two hash functions H1 and H2: C(x) = H1(H1(x) || H2(x)) The first observation is that if H1 is collision-resistant then so is C. In practice I would expect to use SHA-256 for H1, so the resulting combiner C[SHA-256, H2] will be at least as strong as SHA-256. (One could even think of this combiner C as just being a tricky way to strengthen SHA-256 by using the output of H2(x) as a randomized salt -- see [7].) The next observation is that finding a pair of inputs x1, x2 which collide in *both* H1 and in H2 is likely to be much harder than finding a pair of inputs that collide in H1 and finding a pair of inputs that collide in H2 (see [5]). Now the reason that a combiner like this one is not published in theoretical crypto literature is that it obviously could fail if the outer hash function H1 fails. For example, even if H2 is collision- resistant, if H1 turns out to be susceptible to collisions, then theoretically speaking C[H1, H2] might be susceptible to collisions. However, in real life C[H1, H2] would most likely still be collision resistant! All practical attacks on real hash functions so far (if I understand correctly) are multi-block attacks in which the attacker is able to feed a sufficiently long and unconstrained input to the hash functions that the effects of the later parts of his inputs are able to manipulate the state generated by the earlier parts of his inputs. My combiner C uses H1 in its outer invocation on a single- block-sized input, which means no such multi-block attacks are possible on the outer invocation. In addition, the inputs that the attacker gets to feed to the outer invocation of H1 are highly constrained. Basically, he would already have to be very good at manipulating the inner invocations H1 and H2 in ways that he isn't supposed to before he can even begin to manipulate the outer invocation of H1. A measure of the practical security of a combiner like this one would be "how safe would it be if it were instantiated using broken practical hash functions such as MD5 and SHA1?". It appears to me (from an admittedly cursory analysis) that there is no realistic way to find collisions in C[MD5, SHA1] even though there are realistic ways to find collisions in MD5 and in SHA1. Of course, I'm not proposing to use C[MD5, SHA1]! I'm proposing to use C[SHA-256, _] where _ is some other hash function which is believed to be strong. The example of instantiating C with MD5 and SHA1 just goes to show that C is a hash function which is stronger than either of its two underlying hash functions. The other desirable security properties such as second-preimage resistance and pre-image resistance seem to follow the same pattern as collision-resistance -- C[H1, H2] seems to be much stronger than H1 or H2 alone. Regards, Zooko [1] http://extendedsubset.com/Renegotiating_TLS.pdf [2] http://allmydata.org/trac/tahoe/wiki/NewCaps/WhatCouldGoWrong [3] http://bench.cr.yp.to/results-hash.html#arm-apollo [4] Krzysztof Pietrzak: "Non-Trivial Black-Box Combiners for Collision-Resistant Hash-Functions don't Exist" [5] Jonathan J. Hoch, Adi Shamir: "On the Strength of the Concatenated Hash Combiner when All the Hash Functions are Weak" [6] Marc Fischlin, Anja Lehmann, Krzysztof Pietrzak: "Robust Multi- Property Combiners for Hash Functions Revisited" [7] http://webee.technion.ac.il/~hugo/rhash/rhash.pdf --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[silk] Stochastic Terrorism
by Udhay Shankar N 05 Jul '18

05 Jul '18

Fascinating idea. A logical extension of dead drops (or even multi-part crypto keys, if you think about it). Or even Psychohistory. <g> On a related note, I'd recommend John Robb's [1] thoughts on "Open Source Warfare" [2]. Udhay [1] http://globalguerrillas.typepad.com/ [2] http://www.boingboing.net/2010/06/15/john-robb-interview.html http://www.dailykos.com/story/2011/1/10/934890/-Stochastic-Terrorism:-Trigg… Stochastic Terrorism: Triggering the shooters. by G2geek Mon Jan 10, 2011 at 05:37:39 PM PST Stochastic terrorism is the use of mass communications to stir up random lone wolves to carry out violent or terrorist acts that are statistically predictable but individually unpredictable. This is what occurs when Bin Laden releases a video that stirs random extremists halfway around the globe to commit a bombing or shooting. This is also the term for what Beck, O'Reilly, Hannity, and others do. And this is what led directly and predictably to a number of cases of ideologically-motivated murder similar to the Tucson shootings. Update: the mechanism spelled out. (This update is to resolve some ambiguity.) The person who actually plants the bomb or assassinates the public official is not the stochastic terrorist, they are the "missile" set in motion by the stochastic terrorist. The stochastic terrorist is the person who uses mass media as their means of setting those "missiles" in motion. Here's the mechanism spelled out concisely: The stochastic terrorist is the person who uses mass media to broadcast memes that incite unstable people to commit violent acts. One or more unstable people responds to the incitement by becoming a lone wolf and committing a violent act. While their action may have been statistically predictable (e.g. "given the provocation, someone will probably do such-and-such"), the specific person and the specific act are not predictable (yet). The stochastic terrorist then has plausible deniability: "Oh, it was just a lone nut, nobody could have predicted he would do that, and I'm not responsible for what people in my audience do." The lone wolf who was the "missile" gets captured and sentenced to life in prison, while the stochastic terrorist keeps his prime time slot and goes on to incite more lone wolves. Further, the stochastic terrorist may be acting either negligently or deliberately, or may be in complete denial of their impact, just like a drunk driver who runs over a pedestrian without even realizing it. Finally, there is no conspiracy here: merely the twisted acts of individuals who are promoting extremism, who get access to national media in which to do it, and the rest follows naturally just as an increase in violent storms follows from an increase in average global temperature. And now we return to the rest of the original diary... <SNIP> -- ((Udhay Shankar N)) ((udhay @ pobox.com)) ((www.digeratus.com)) ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[silk] Stochastic Terrorism
by Udhay Shankar N 05 Jul '18

05 Jul '18

Fascinating idea. A logical extension of dead drops (or even multi-part crypto keys, if you think about it). Or even Psychohistory. <g> On a related note, I'd recommend John Robb's [1] thoughts on "Open Source Warfare" [2]. Udhay [1] http://globalguerrillas.typepad.com/ [2] http://www.boingboing.net/2010/06/15/john-robb-interview.html http://www.dailykos.com/story/2011/1/10/934890/-Stochastic-Terrorism:-Trigg… Stochastic Terrorism: Triggering the shooters. by G2geek Mon Jan 10, 2011 at 05:37:39 PM PST Stochastic terrorism is the use of mass communications to stir up random lone wolves to carry out violent or terrorist acts that are statistically predictable but individually unpredictable. This is what occurs when Bin Laden releases a video that stirs random extremists halfway around the globe to commit a bombing or shooting. This is also the term for what Beck, O'Reilly, Hannity, and others do. And this is what led directly and predictably to a number of cases of ideologically-motivated murder similar to the Tucson shootings. Update: the mechanism spelled out. (This update is to resolve some ambiguity.) The person who actually plants the bomb or assassinates the public official is not the stochastic terrorist, they are the "missile" set in motion by the stochastic terrorist. The stochastic terrorist is the person who uses mass media as their means of setting those "missiles" in motion. Here's the mechanism spelled out concisely: The stochastic terrorist is the person who uses mass media to broadcast memes that incite unstable people to commit violent acts. One or more unstable people responds to the incitement by becoming a lone wolf and committing a violent act. While their action may have been statistically predictable (e.g. "given the provocation, someone will probably do such-and-such"), the specific person and the specific act are not predictable (yet). The stochastic terrorist then has plausible deniability: "Oh, it was just a lone nut, nobody could have predicted he would do that, and I'm not responsible for what people in my audience do." The lone wolf who was the "missile" gets captured and sentenced to life in prison, while the stochastic terrorist keeps his prime time slot and goes on to incite more lone wolves. Further, the stochastic terrorist may be acting either negligently or deliberately, or may be in complete denial of their impact, just like a drunk driver who runs over a pedestrian without even realizing it. Finally, there is no conspiracy here: merely the twisted acts of individuals who are promoting extremism, who get access to national media in which to do it, and the rest follows naturally just as an increase in violent storms follows from an increase in average global temperature. And now we return to the rest of the original diary... <SNIP> -- ((Udhay Shankar N)) ((udhay @ pobox.com)) ((www.digeratus.com)) ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

CDR: Re: Internet Hoax Articles Considered Harmful=20
by Declan McCullagh 05 Jul '18

05 Jul '18

On Sun, Oct 07, 2001 at 11:54:50PM -0700, Tim May wrote: > PHILADELPHIA, Pennyslvania (AP) - Homeland Defense Secretary Tom Ridge = > said Sunday that the U.S. faces a serious and expanding threat from=20 > fraudulent Internet articles, or hoaxes. Almost. The most obvious sign that this is a hoax is your inclusion of the state in the dateline. For major cities, it's usually not = included. -Declan ------------------ I knew it was a hoax because I read the original article, which read: Ridge stressed that the U.S moves to limit false news articles will be=20 done with input from civil liberties groups, saying the moves are=20 ``against info-terrorists, info-terrorism, their sanctuaries and their=20 supporters, those who harbor them, those who give sanctuary to those=20 who harbor them, those who support those who give sanctuary to those who harbor them, those who associate with those who give them support, sanctuary, or harbor them, those we suspect of being associated with=20 those who are associated with those who give them support, sanctuary, or harbor them, those who are suspected of voting for the rulers of any country which has given them support, sanctuary, or harbored them, those who may associate in the future with someone who might consider giving them support, sanctuary, or harboring them...'' I cut it short, because the original is 378 GB... Suffice it to say that the ParaMeters for who is TargetAble as a = Certified BadGuy=20 has recently gotten Wider...and can be expected to MushRoom(BOOM!) at an expoential rate in the near future, now that THEY [TM] have seen the = Ease with which THEY [TM] can SMEAR just about anyone THEY [TM] please by=20 Painting a Wider Swath via GuiltByAssociation... (Can eWe Say "I Only Sent A Single eMail To Jim Bell In My Whole Life?") ((Sure, eWe Can...)) Sincerely, SomeOne Who Didn't Actually *Write* This eMail, But Who Knows An Uncle Of The Person Who Did ------=_NextPart_000_0077_01C14FD9.C2F024A0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META http-equiv=3DContent-Type content=3D"text/html; = charset=3Diso-8859-1"> <META content=3D"MSHTML 6.00.2600.0" name=3DGENERATOR> <STYLE></STYLE> </HEAD> <BODY bgColor=3D#ffffff><FONT face=3DArial> <DIV><EM>Subject</EM>: CDR: Re: Internet Hoax Articles Considered = Harmful </DIV> <DIV><EM>From</EM>: Declan McCullagh <<A=20 href=3D"mailto:declan@well.com">declan(a)well.com</A>> = </DIV><PRE>On Sun, Oct = 07, 2001 at 11:54:50PM -0700, Tim May wrote: > PHILADELPHIA, Pennyslvania (AP) - Homeland Defense Secretary Tom = Ridge=20 > said Sunday that the U.S. faces a serious and expanding threat from = > fraudulent Internet articles, or hoaxes. Almost. The most obvious sign that this is a hoax is your inclusion of the state in the dateline. For major cities, it's usually not = included. -Declan ------------------</PRE><PRE>I knew it was a hoax because I read the = original article, which read:</PRE> <DIV><FONT size=3D2>Ridge stressed that the U.S moves to limit false = news articles=20 will be <BR>done with input from civil liberties groups, saying the = moves are=20 <BR>``against info-terrorists, info-terrorism, their sanctuaries and = their=20 <BR>supporters, those who harbor them, those who give sanctuary to those = </FONT></DIV> <DIV><FONT size=3D2>who harbor them, those who support those who give = sanctuary to=20 those</FONT></DIV> <DIV><FONT size=3D2>who harbor them, those who associate with those who = give them=20 support,</FONT></DIV> <DIV><FONT size=3D2>sanctuary, or harbor them, those we suspect of being = associated with </FONT></DIV> <DIV><FONT size=3D2>those who are associated with those who give them = support,=20 sanctuary,</FONT></DIV> <DIV><FONT size=3D2>or harbor them, those who are suspected of voting = for the=20 rulers of any</FONT></DIV> <DIV><FONT size=3D2>country which has given them support, sanctuary, or = harbored=20 them,</FONT></DIV> <DIV><FONT size=3D2>those who may associate in the future with someone = who might=20 consider</FONT></DIV> <DIV><FONT size=3D2>giving them support, sanctuary, or harboring=20 them...''</FONT></DIV> <DIV><FONT size=3D2></FONT> </DIV> <DIV><FONT size=3D2>I cut it short, because the original is 378 = GB...</FONT></DIV> <DIV><FONT size=3D2>Suffice it to say that the ParaMeters for who is = TargetAble as=20 a Certified BadGuy </FONT></DIV> <DIV><FONT size=3D2>has </FONT><FONT size=3D2>recently gotten = Wider...and can be=20 expected to MushRoom(BOOM!) at an</FONT></DIV> <DIV><FONT size=3D2>expoential rate in the near future, now that THEY = [TM] have=20 seen the Ease with</FONT></DIV> <DIV><FONT size=3D2>which THEY [TM] can SMEAR just about anyone THEY = [TM] please=20 by </FONT></DIV> <DIV><FONT size=3D2>Painting a Wider Swath via = GuiltByAssociation...</FONT></DIV> <DIV><FONT size=3D2>(Can eWe Say "I Only Sent A Single eMail To Jim Bell = In My=20 Whole Life?")</FONT></DIV> <DIV><FONT size=3D2>((Sure, eWe Can...))</FONT></DIV> <DIV><FONT size=3D2></FONT> </DIV> <DIV><FONT size=3D2>Sincerely,</FONT></DIV> <DIV><FONT size=3D2>SomeOne Who Didn't Actually *Write* This = eMail,</FONT></DIV> <DIV><FONT size=3D2>But Who Knows An Uncle Of The Person Who = Did</FONT></DIV> <DIV><FONT size=3D2><BR> </DIV></FONT></FONT></BODY></HTML> ------=_NextPart_000_0077_01C14FD9.C2F024A0-- _________________________________________________________ Do You Yahoo!? Get your free @yahoo.com address at http://mail.yahoo.com

1 0