July 2018 - cypherpunks-legacy

[cryptography] Another signature-scheme blunder
by Peter Gutmann 06 Jul '18

06 Jul '18

Looks like Motorola made a similar mistake to Sony in their digital signatures: http://nenolod.net/~nenolod/sholes-keyleak-explained.html The description is a bit confusing (did they really use Elgamal signatures rather than, say, DSA?), but it's basically the same thing Sony did. If they used actual Elgamal sigs though they went even further than Sony, along with rolling their own broken crypto implementation they also decided to go their own way with the signature scheme they used. As I've said a number of times before: In practice you don.t need to know all the gory details of encryption modes and IVs and other cryptoplumbing, you just need to make sure that you apply the right tool for the job. The right tool for fixing a blocked drain is a plumber, and the right tool for dealing with problems requiring cryptography is a security library written by someone who knows what they.re doing. Or to quote Bruce: "anyone who creates his or her own cryptographic primitives is either a genius or a fool. Given the genius/fool ratio for out species, the odds aren't very good". Peter. _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[cryptography] Another signature-scheme blunder
by Peter Gutmann 06 Jul '18

06 Jul '18

Looks like Motorola made a similar mistake to Sony in their digital signatures: http://nenolod.net/~nenolod/sholes-keyleak-explained.html The description is a bit confusing (did they really use Elgamal signatures rather than, say, DSA?), but it's basically the same thing Sony did. If they used actual Elgamal sigs though they went even further than Sony, along with rolling their own broken crypto implementation they also decided to go their own way with the signature scheme they used. As I've said a number of times before: In practice you don.t need to know all the gory details of encryption modes and IVs and other cryptoplumbing, you just need to make sure that you apply the right tool for the job. The right tool for fixing a blocked drain is a plumber, and the right tool for dealing with problems requiring cryptography is a security library written by someone who knows what they.re doing. Or to quote Bruce: "anyone who creates his or her own cryptographic primitives is either a genius or a fool. Given the genius/fool ratio for out species, the odds aren't very good". Peter. _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[tor-talk] anyone in SF want to talk on TOR at BAHA this Sunday, 2pm?
by travis+ml-tor-talk＠subspacefield.org 06 Jul '18

06 Jul '18

http://baha.bitrot.info/ We're meeting Sunday at 2pm to give a talk on VPNs and Darknets, and I'd like to cover TOR too but I could use an expert to assist :-) Would anyone in the Bay Area like to show up to speak briefly on TOR, or simply to answer questions? If you've got a full preso on TOR, contact me, we can arrange something. Cheers, T -- http://www.subspacefield.org/~travis/ | 0800... in the morning, sir? You - are my test pilots. You're gonna kiss the sun, and taste the m-f rainbow! If you are a spammer, please email john(a)subspacefield.org to get blacklisted. _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

<nettime> Worldbs First Flying File-Sharing Drones in Action
by nettime's avid reader 06 Jul '18

06 Jul '18

TorrentFreak Worldbs First Flying File-Sharing Drones in Action March 20, 2012 https://torrentfreak.com/worlds-first-flying-file-sharing-drones-in-action-… A few days ago The Pirate Bay announced that in future parts of its site could be hosted on GPS controlled drones. To many this may have sounded like a joke, but in fact these pirate drones already exist. Project b Electronic Countermeasuresb has built a swarm of five fully operational drones which prove that an b aerial Napsterb or an b airborne Pirate Bayb is not as futuristic as it sounds. In an ever-continuing effort to thwart censorship, The Pirate Bay plans to turn flying drones into mobile hosting locations. b Everyone knows WHAT TPB is. Now theybre going to have to think about WHERE TPB is,b The Pirate Bay team told TorrentFreak last Sunday, announcing their drone project. Liam Young, co-founder of Tomorrowbs Thoughts Today, was amazed to read the announcement, not so much because of the technology, because his group has already built a swarm of file-sharing drones. b I thought hold on, we are already doing that,b Young told TorrentFreak. Their starting point for project b Electronic Countermeasuresb was to create something akin to an baerial Napsterb or bairborne Pirate Bayb, but it became much more than that. b Part nomadic infrastructure and part robotic swarm, we have rebuilt and programmed the drones to broadcast their own local Wi-Fi network as a form of aerial Napster. They swarm into formation, broadcasting their pirate network, and then disperse, escaping detection, only to reform elsewhere,b says the group describing their creation. File-Sharing Drone in Action (photo by Claus Langer) picture of a sharing drone In short the system allows the public to share data with the help of flying drones. Much like the Pirate Box, but one that flies autonomously over the city. b The public can upload files, photos and share data with one another as the drones float above the significant public spaces of the city. The swarm becomes a pirate broadcast network, a mobile infrastructure that passers-by can interact with,b the creators explain. One major difference compared to more traditional file-sharing hubs is that it requires a hefty investment. Each of the drones costs 1500 euros to build. Not a big surprise, considering the hardware thatbs needed to keep these pirate hubs in the air. b Each one is powered by 2x 2200mAh LiPo batteries. The lift is provided by 4x Roxxy Brushless Motors that run off a GPS flight control board. Also on deck are altitude sensors and gyros that keep the flight stable. They all talk to a master control system through XBee wireless modules,b Young told TorrentFreak. b These all sit on a 10mm x 10mm aluminum frame and are wrapped in a vacuum formed aerodynamic cowling. The network is broadcast using various different hardware setups ranging from Linux gumstick modules, wireless routers and USB sticks for file storage.b For Young and his crew this is just the beginning. With proper financial support they hope to build more drones and increase the range they can cover. b We are planning on scaling up the system by increasing broadcast range and building more drones for the flock. We are also building in other systems like autonomous battery change bases. We are looking for funding and backers to assist us in scaling up the system,b he told us. Those who see the drones in action (video below) will notice that theybre not just practical. The creative and artistic background of the group shines through, with the choreography performed by the drones perhaps even more stunning than the sharing component. b When the audience interacts with the drones they glow with vibrant colors, they break formation, they are called over and their flight pattern becomes more dramatic and expressive,b the group explains. Besides the artistic value, the drones can also have other use cases than being a b pirate hub.b For example, they can serve as peer-to-peer communications support for protesters and activists in regions where Internet access is censored. Either way, whether itbs Hollywood or a dictator, there will always be groups that have a reason to shoot the machines down. But letbs be honest, who would dare to destroy such a beautiful piece of art? Worlds First File-Sharing Drone -> http://vimeo.com/36267881 # distributed via <nettime>: no commercial use without permission # <nettime> is a moderated mailing list for net criticism, # collaborative text filtering and cultural politics of the nets # more info: http://mx.kein.org/mailman/listinfo/nettime-l # archive: http://www.nettime.org contact: nettime(a)kein.org ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[tor-talk] anyone in SF want to talk on TOR at BAHA this Sunday, 2pm?
by travis+ml-tor-talk＠subspacefield.org 06 Jul '18

06 Jul '18

http://baha.bitrot.info/ We're meeting Sunday at 2pm to give a talk on VPNs and Darknets, and I'd like to cover TOR too but I could use an expert to assist :-) Would anyone in the Bay Area like to show up to speak briefly on TOR, or simply to answer questions? If you've got a full preso on TOR, contact me, we can arrange something. Cheers, T -- http://www.subspacefield.org/~travis/ | 0800... in the morning, sir? You - are my test pilots. You're gonna kiss the sun, and taste the m-f rainbow! If you are a spammer, please email john(a)subspacefield.org to get blacklisted. _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

<nettime> Worldbs First Flying File-Sharing Drones in Action
by nettime's avid reader 06 Jul '18

06 Jul '18

TorrentFreak Worldbs First Flying File-Sharing Drones in Action March 20, 2012 https://torrentfreak.com/worlds-first-flying-file-sharing-drones-in-action-… A few days ago The Pirate Bay announced that in future parts of its site could be hosted on GPS controlled drones. To many this may have sounded like a joke, but in fact these pirate drones already exist. Project b Electronic Countermeasuresb has built a swarm of five fully operational drones which prove that an b aerial Napsterb or an b airborne Pirate Bayb is not as futuristic as it sounds. In an ever-continuing effort to thwart censorship, The Pirate Bay plans to turn flying drones into mobile hosting locations. b Everyone knows WHAT TPB is. Now theybre going to have to think about WHERE TPB is,b The Pirate Bay team told TorrentFreak last Sunday, announcing their drone project. Liam Young, co-founder of Tomorrowbs Thoughts Today, was amazed to read the announcement, not so much because of the technology, because his group has already built a swarm of file-sharing drones. b I thought hold on, we are already doing that,b Young told TorrentFreak. Their starting point for project b Electronic Countermeasuresb was to create something akin to an baerial Napsterb or bairborne Pirate Bayb, but it became much more than that. b Part nomadic infrastructure and part robotic swarm, we have rebuilt and programmed the drones to broadcast their own local Wi-Fi network as a form of aerial Napster. They swarm into formation, broadcasting their pirate network, and then disperse, escaping detection, only to reform elsewhere,b says the group describing their creation. File-Sharing Drone in Action (photo by Claus Langer) picture of a sharing drone In short the system allows the public to share data with the help of flying drones. Much like the Pirate Box, but one that flies autonomously over the city. b The public can upload files, photos and share data with one another as the drones float above the significant public spaces of the city. The swarm becomes a pirate broadcast network, a mobile infrastructure that passers-by can interact with,b the creators explain. One major difference compared to more traditional file-sharing hubs is that it requires a hefty investment. Each of the drones costs 1500 euros to build. Not a big surprise, considering the hardware thatbs needed to keep these pirate hubs in the air. b Each one is powered by 2x 2200mAh LiPo batteries. The lift is provided by 4x Roxxy Brushless Motors that run off a GPS flight control board. Also on deck are altitude sensors and gyros that keep the flight stable. They all talk to a master control system through XBee wireless modules,b Young told TorrentFreak. b These all sit on a 10mm x 10mm aluminum frame and are wrapped in a vacuum formed aerodynamic cowling. The network is broadcast using various different hardware setups ranging from Linux gumstick modules, wireless routers and USB sticks for file storage.b For Young and his crew this is just the beginning. With proper financial support they hope to build more drones and increase the range they can cover. b We are planning on scaling up the system by increasing broadcast range and building more drones for the flock. We are also building in other systems like autonomous battery change bases. We are looking for funding and backers to assist us in scaling up the system,b he told us. Those who see the drones in action (video below) will notice that theybre not just practical. The creative and artistic background of the group shines through, with the choreography performed by the drones perhaps even more stunning than the sharing component. b When the audience interacts with the drones they glow with vibrant colors, they break formation, they are called over and their flight pattern becomes more dramatic and expressive,b the group explains. Besides the artistic value, the drones can also have other use cases than being a b pirate hub.b For example, they can serve as peer-to-peer communications support for protesters and activists in regions where Internet access is censored. Either way, whether itbs Hollywood or a dictator, there will always be groups that have a reason to shoot the machines down. But letbs be honest, who would dare to destroy such a beautiful piece of art? Worlds First File-Sharing Drone -> http://vimeo.com/36267881 # distributed via <nettime>: no commercial use without permission # <nettime> is a moderated mailing list for net criticism, # collaborative text filtering and cultural politics of the nets # more info: http://mx.kein.org/mailman/listinfo/nettime-l # archive: http://www.nettime.org contact: nettime(a)kein.org ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[liberationtech] Backdoors are Forever: hacking team and the targeting of dissent
by Ronald Deibert 06 Jul '18

06 Jul '18

Dear Lib Tech Citizen Lab is publishing a new report this morning, "Backdoors are Forever: Hacking Team and the Targeting of Dissent?" In this report, Citizen Lab Security Researcher Morgan Marquis-Boire describes analysis performed on malicious software used to compromise a high profile dissident residing in the United Arab Emirates. The findings indicate that the software is a commercial surveillance backdoor distributed by an Italian company known as Hacking Team. The report also describes the potential involvement of vulnerabilities sold by the French company, VUPEN. Our report is here: https://citizenlab.org/2012/10/backdoors-are-forever-hacking-team-and-the-t… Bloomberg has a detailed news article about the findings and context here: http://www.bloomberg.com/news/2012-10-10/spyware-leaves-trail-to-beaten-act… Regards Ron Ronald Deibert Director, the Citizen Lab and the Canada Centre for Global Security Studies Munk School of Global Affairs University of Toronto (416) 946-8916 PGP: http://deibert.citizenlab.org/pubkey.txt http://deibert.citizenlab.org/ twitter.com/citizenlab r.deibert(a)utoronto.ca -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [ZS] Re: Money transfers, due process, and freedom
by Bryce Lynch 06 Jul '18

06 Jul '18

On Fri, Feb 8, 2013 at 3:06 AM, Michael Hrenka <metahorse(a)gmail.com> wrote: > Sooner or later the financial system will have to adapt to use Bitcoin > anyway. The question is when and how that will happen. > >> Word has it that the Canadian government is trying to by reinventing it a) in a centralized fashion so they can control it, and b) only for low value transactions. Whether or not it'll stand up to any real scrutiny remains to be seen. http://www.wired.com/threatlevel/2012/05/mintchip/ http://bits.blogs.nytimes.com/2012/04/12/canada-seeks-to-turn-coins-into-di… http://www.fastcompany.com/1829662/canada-launch-its-own-version-bitcoin-ca… -- The Doctor [412/724/301/703] [ZS|Media] https://drwho.virtadpt.net/ "I am everywhere." -- -- Zero State mailing list: http://groups.google.com/group/DoctrineZero --- You received this message because you are subscribed to the Google Groups "Doctrine Zero" group. To unsubscribe from this group and stop receiving emails from it, send an email to DoctrineZero+unsubscribe(a)googlegroups.com. For more options, visit https://groups.google.com/groups/opt_out. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [IP] more on Police Blotter: Laptop border searches OK'd
by Roger Weeks 06 Jul '18

06 Jul '18

Dave - For IP on the laptop border searches: I'm suprised that no one else has mentioned this so far, but this type of situation is one of the many excellent reasons to use an encrypted filesystem on your laptop hard disk, and to set up other types of security. For example, my PowerBook G4 is set up to use the built-in feature of OS X called FileVault, which encrypts the user's home directory. The home directory on OS X contains the browser cache for Safari, Firefox, and Camino, and I have to assume, any other browser cache for Opera and other browsers. I have also set an Open Firmware boot password. See http://www.apple.com/downloads/macosx/apple/openfirmwarepassword.html for details. When I travel I never put my laptop to sleep, but rather I shut it all the way down. This is marginally less convenient, but it means that if my laptop is stolen or confiscated, the Open Firmware password will be the first thing that the attacker sees. Supposing that is broken, they will then have to deal with logging into my laptop. My root account is disabled, like all OS X installs. I have my login preferences set to not show the usernames on the computer, so the attacker will have to guess both a login name and password. If the attacker were to take the hard disk out of my laptop and make an image of it with forensic software, they would find an encrypted partition. I'm sure the NSA probably has the horsepower to throw at cracking AES-128 encryption, but chances are my laptop will never get to them if we're talking about local law enforcement. For those in the Windows or Linux world, you can set a BIOS password on your laptop which is very similar to the Open Firmware boot password for Apple Hardware. Windows XP and Windows 2003 both include support for encrypting filesystems using DESX or 3DES, via the Encrypted File System. PGP Corp sells a product called "PGP Whole Disk Encryption" for Windows 2000 & XP that uses AES-256 encryption. Linux users can make a loopback encrypted filesystem for storing anything they wish to be encrypted. See http://www.tldp.org/HOWTO/ Cryptoloop-HOWTO/ for details. I don't believe it is a crime in any US Federal or State law, or in Canadian law, to set passwords and use encryption. In the US, I believe that a warrant would be necessary for law enforcement to ask for your password, but I don't know if you have to comply. IANAL. -- Roger J. Weeks Systems & Network Administrator Mendocino Community Network Now offering DSL across California ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] more on Police Blotter: Laptop border searches OK'd
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0