July 2018 - cypherpunks-legacy

None
by Thomas Harold 06 Jul '18

06 Jul '18

Gecko/20040616 To: cryptography(a)metzdowd.com Subject: Re: MD5 collisions? Sender: owner-cryptography(a)metzdowd.com Eric Rescorla wrote: > Check out this ePrint paper, which claims to have collisions in > MD5, MD4, HAVAL, and full RIPEMD. > > http://eprint.iacr.org/2004/199.pdf > > The authors claim that the MD5 attack took an hour for the first > collision and 15 seconds to 5 minutes for subsequent attacks > with the same first 512 bits. I'll play the newbie and ask the question... how would this be used in a practical attack against MD5 (or the other hashing algorithms)? From my limited understanding, MD5 is usually used as a hash to detect tampering in a particular bitstream. In which case, the attacker's goal would be to calculate how to change bits in the bitstream without changing the MD5 output. (And hopefully without making the bitstream a different size.) Is this where collisions come into play? Alternatively, hash functions can be used to store passwords (salt + plain text password => hash function => password file). But I don't see where the attacker could use collisions for that. [Moderator's note: You might want to read up on hash functions and their uses -- "detecting tampering" in the sense you mean isn't the main use of hash functions these days though they are certainly employed in such applications. Hash functions are a primitive used in all sorts of places as part of MACs, as ways of enabling signature systems, as elements of commitment protocols etc. The use in commitment protocols is totally blown by the current results, btw. For purposes of things like x.509 certificates, as message integrity codes, etc., the current attacks don't provide an immediate way to attack the system, but they make one worried about the health of the algorithms -- probably sufficiently much to motivate quickly abandoning them for ones that are not vulnerable to these attacks. --Perry] --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: [liberationtech] The Art of Digital Surveillance and Things to Come in Pakistan
by Enrique Piraces 06 Jul '18

06 Jul '18

Do you have more info on what are the things to come in Pakistan? Any info on the current state of surveillance technology there? Spending trends? Privacy Int'l has some info on who has attended ISS: https://www.privacyinternational.org/big-brother-incorporated/countries/Pak… Best, @epiraces From: liberationtech-bounces(a)lists.stanford.edu [mailto:liberationtech-bounces@lists.stanford.edu] On Behalf Of Arzak Khan Sent: Thursday, February 16, 2012 1:25 AM To: Liberationtech Subject: [liberationtech] The Art of Digital Surveillance and Things to Come in Pakistan The Art of Digital Surveillance and Things to Come in Pakistan By Arzak Khan http://telecologist.blogspot.com/2011/11/art-of-digital-surveillance-and-th… http://www.diplointernetgovernance.org/profiles/blogs/the-art-of-digital-su… [X] _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

None
by Thomas Harold 06 Jul '18

06 Jul '18

Gecko/20040616 To: cryptography(a)metzdowd.com Subject: Re: MD5 collisions? Sender: owner-cryptography(a)metzdowd.com Eric Rescorla wrote: > Check out this ePrint paper, which claims to have collisions in > MD5, MD4, HAVAL, and full RIPEMD. > > http://eprint.iacr.org/2004/199.pdf > > The authors claim that the MD5 attack took an hour for the first > collision and 15 seconds to 5 minutes for subsequent attacks > with the same first 512 bits. I'll play the newbie and ask the question... how would this be used in a practical attack against MD5 (or the other hashing algorithms)? From my limited understanding, MD5 is usually used as a hash to detect tampering in a particular bitstream. In which case, the attacker's goal would be to calculate how to change bits in the bitstream without changing the MD5 output. (And hopefully without making the bitstream a different size.) Is this where collisions come into play? Alternatively, hash functions can be used to store passwords (salt + plain text password => hash function => password file). But I don't see where the attacker could use collisions for that. [Moderator's note: You might want to read up on hash functions and their uses -- "detecting tampering" in the sense you mean isn't the main use of hash functions these days though they are certainly employed in such applications. Hash functions are a primitive used in all sorts of places as part of MACs, as ways of enabling signature systems, as elements of commitment protocols etc. The use in commitment protocols is totally blown by the current results, btw. For purposes of things like x.509 certificates, as message integrity codes, etc., the current attacks don't provide an immediate way to attack the system, but they make one worried about the health of the algorithms -- probably sufficiently much to motivate quickly abandoning them for ones that are not vulnerable to these attacks. --Perry] --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: [liberationtech] The Art of Digital Surveillance and Things to Come in Pakistan
by Enrique Piraces 06 Jul '18

06 Jul '18

Do you have more info on what are the things to come in Pakistan? Any info on the current state of surveillance technology there? Spending trends? Privacy Int'l has some info on who has attended ISS: https://www.privacyinternational.org/big-brother-incorporated/countries/Pak… Best, @epiraces From: liberationtech-bounces(a)lists.stanford.edu [mailto:liberationtech-bounces@lists.stanford.edu] On Behalf Of Arzak Khan Sent: Thursday, February 16, 2012 1:25 AM To: Liberationtech Subject: [liberationtech] The Art of Digital Surveillance and Things to Come in Pakistan The Art of Digital Surveillance and Things to Come in Pakistan By Arzak Khan http://telecologist.blogspot.com/2011/11/art-of-digital-surveillance-and-th… http://www.diplointernetgovernance.org/profiles/blogs/the-art-of-digital-su… [X] _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [tor-talk] TOR Fone - p2p secure and anonymous VoIP tool
by Fabio Pietrosanti (naif) 06 Jul '18

06 Jul '18

On 2/3/13 9:23 PM, coderman wrote: > "push-to-talk" with procedure words over zrtp would be applicable. use > FEC to accommodate reasonable loss over datagram Tor. > > both Whisper Systems and Guardian Project are working on PTT > capabilities, iirc. > > last but not least, the codec makes no difference until larger issues > are worked out, for those arguing about OPUS vs. G729a/729.1 vs Speex, > etc. in practice the G729 implementations in cSipSimple (over ZRTP) > seem to be best, but this is most likely the other implementations > sucking. i have high hopes for a better OPUS codec... For my daily-for-profit-job i made in past stuff for secure telephony over GPRS that: - can have variable latencies on CS1 between 800ms-2200ms - is a reliable transport (the low level of the OS does retransmissions at GSM RLP level) To work over high latency (and tipically also low-bandwidth) with reliable transport (like TCP/Tor) you need to use those multimedia strategy: - setup a large static jitter buffer (you define the added artificial latency of the call to compensate variable latency) - reduce transport protocol overhead by setting a large "packetization time" - detect retransmission behaviours, in that case apply small TX cutting (transmission) With such approach you can avoid "PTT" and even if the communication will sounds like an old analog satellite connection, it works. Fabio _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

What happened to the Cryptography list...?
by ghicks＠cadence.com 06 Jul '18

06 Jul '18

Kind sir: As the subject says... All of a sudden mail just stopped. Figuring that I had, somehow, become unsubscribed from the list, I tried to re-subscribe. This resulted in an "Unknown list" message from majordomo@wasabisystems... Any ideas? could assist please? I know that you are not the list owner, but you, at one time, seemed to be active on the list. Regards, Gregory Hicks --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: [roy@rant-central.com: Re: [arma@mit.edu: Re: Wikipedia & Tor]]
by David Benfell 06 Jul '18

06 Jul '18

On Thu, 29 Sep 2005 00:17:07 -0400, Nick Mathewson wrote: > > I assume that you're not just ignoring everybody else and replying > only to what Jimmy says, right? There have been other posts here > explaining why pseudonymity and Tor are not at odds, so long as > pseudonymity is user selected. Pseudonyms are a separate problem from Tor. As someone posted, Tor does not prevent people from using pseudonyms. If pseudonyms will solve Wikipedia's problem, then fine; a good portion of this argument has been about Wikipedia's need for authentication. See my comments following your footnote. > Wikipedia has user accounts and IP-based blocking. That's a kind of > authentication. Wikipedia does not require you to use a user account > to edit pages, and does not do much to ensure that user accounts > belong to real people. That's a lack of authentication. > Now why couldn't *he* say that? The man's involved with an encyclopedia project; he should be able to write. The way this particular aspect of our disagreement arose is that I accused him of wanting Tor to do his authentication for him. He claimed that Wikipedia does do its own authentication. Now you explain that Wikipedia does not *require* authentication. Which undermines the usefulness of offering authentication. > It's like how Tor blocks some highly-abusable services, like SMTP on > port 25, but doesn't do content filtering to try to hunt for abusive > behavior on exiting streams. We filter out some abuse, but we can't > filter out all abuse without turning off the network. An anti-Tor > rhetorician could say, "You filter abuse, but you don't filter abuse!" > But what would that prove? You are attempting to compare Tor's security policy to Wikipedia's security policy. Tor has a security policy. Tor's security policy is to protect originating IP addresses which might be connected to persons. We hope, in combination with Privoxy, it protects anonymity reasonably well. On the reasonable (I think) premise that other sites are primarily responsible for their own security, it only limits some abuse. Now, what is Wikipedia's security policy? With no authentication requirement, and a policy that allows anyone to edit (unless they're connecting from a blacklisted IP address), I might as well ask, "What is truth?" > {1} This case is more commonly known, in the literature, as > pseudonymous communication than anonymous communication. Then > again, if you're going to invoke dictionaries in a technical > discussion, anonymity becomes a very broad term. But Tor is about anonymity. Not about pseudonymity. Not about other forms of authentication. As it should be. >From a communication perspective, anonymity has a very specific meaning. It means we cannot identify a person. Note that the failure to identify a person makes no reference to kind of identification. There need be no preference for "real life" names versus pseudonyms versus IP addresses versus whatever else you can think of. Anything that identifies a person contradicts the concept that this person is anonymous. This has practical implications. For instance, as someone pointed out, when the Chinese police raid a dissident's apartment, and search his hard drive, they are able to tie the pseudonym to a "real life" identity. If the police can also connect the pseudonym to what they consider "crime," the distinction between a pseudonym and a "real life" name loses much of its value; hopefully, the pseudonym permitted the dissident to continue his activities for longer. Now, I will certainly agree, as someone else pointed out, that Tor should permit the use of pseudonyms or other forms of authentication. But the fact remains that any identification--as implied by authentication--contradicts anonymity; it is therefore something which Tor should not involve itself with. Simply put, it is not and cannot be Tor's problem. -- David Benfell, LCP benfell(a)parts-unknown.org --- Resume available at http://www.parts-unknown.org/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: tor and p2p
by Mike Perry 06 Jul '18

06 Jul '18

Thus spake Robert Hogan (robert(a)roberthogan.net) > > There's lots of work left before Tor is in a position for most users > > to be servers. > > > > http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#EverybodyAServer > > > > Hope that helps, > > --Roger > > My hosting provider blackholed my mail for a 24 hour period so I've had to > read all the replies on the archive. > > Thanks for the links and input, though I did get one or two responses which > misinterpreted me as suggesting the current tor network be used for anon p2p. > Perish the thought! Yeah, I'm going to say that I2P is much better suited to this than Tor, especially when you're talking about creating a new network anyway. For as much bashing as poor jrandom takes on this list and the wiki, I think he deserves a bit of praise for the fabulous job of software engineering he has done with I2P. The code is clean, flexible, and elegant bordering on sexy. It also exports Java Socket compatible interfaces that Java apps can readily use to be ported over (and there are python and I think C bindings as well). This has enabled the pretty straight-forward port of the Phex gnutella client, the Azureus plugin, and a native I2P bittorrent client I2PSnark. Not to mention the vast bulk of I2P performance tuning and development effort is focused on making their hidden service-like features work well, where as Tor only devotes minimal effort to this component, focusing instead on relaying to the external Internet. Plus I2P has configurable path lengths built into the GUI allowing you to sacrifice anonymity in certain applications to boost performance (either as a client or server). However, as was pointed out by enigma, any P2P mix network is going to suffer a lot more at the lack of residential upstream than normal P2P. In fact, if you use the standard pathlen of 3, any hidden service-style system is going to only have 1/6 of the total bandwidth a normal P2P system would have :( (I fear that this residential limit will likely continue to the point where the ratio is only sufficient to get ACKS back for the downstream channel... Doesn't anyone ever have to email/upload large files to work or email vids to friends? Maybe there will eventually be demand for this not to take aeons...) > One final dumb question. The torify-ing wiki says: > > "BitTorrent is already using a mechanism similiar to Tor to communicate with > other peers. " > > Is this referring to DHT? Is it really that similar? Yes, this is absolutely correct... In the degenerate case where there is only 1 tor network per torrent, and you were sufficiently inebriated enough to handwave cells into the same abstract concept as file segments, they are the same! Oh, and also sometimes bittorrent encrypts traffic. Plus they both use the Internets to communicate between peers! So really there is no difference. (Who wrote this garbage? ;) -- Mike Perry Mad Computer Scientist fscked.org evil labs ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

What happened to the Cryptography list...?
by ghicks＠cadence.com 06 Jul '18

06 Jul '18

Kind sir: As the subject says... All of a sudden mail just stopped. Figuring that I had, somehow, become unsubscribed from the list, I tried to re-subscribe. This resulted in an "Unknown list" message from majordomo@wasabisystems... Any ideas? could assist please? I know that you are not the list owner, but you, at one time, seemed to be active on the list. Regards, Gregory Hicks --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: [roy@rant-central.com: Re: [arma@mit.edu: Re: Wikipedia & Tor]]
by David Benfell 06 Jul '18

06 Jul '18

On Thu, 29 Sep 2005 00:17:07 -0400, Nick Mathewson wrote: > > I assume that you're not just ignoring everybody else and replying > only to what Jimmy says, right? There have been other posts here > explaining why pseudonymity and Tor are not at odds, so long as > pseudonymity is user selected. Pseudonyms are a separate problem from Tor. As someone posted, Tor does not prevent people from using pseudonyms. If pseudonyms will solve Wikipedia's problem, then fine; a good portion of this argument has been about Wikipedia's need for authentication. See my comments following your footnote. > Wikipedia has user accounts and IP-based blocking. That's a kind of > authentication. Wikipedia does not require you to use a user account > to edit pages, and does not do much to ensure that user accounts > belong to real people. That's a lack of authentication. > Now why couldn't *he* say that? The man's involved with an encyclopedia project; he should be able to write. The way this particular aspect of our disagreement arose is that I accused him of wanting Tor to do his authentication for him. He claimed that Wikipedia does do its own authentication. Now you explain that Wikipedia does not *require* authentication. Which undermines the usefulness of offering authentication. > It's like how Tor blocks some highly-abusable services, like SMTP on > port 25, but doesn't do content filtering to try to hunt for abusive > behavior on exiting streams. We filter out some abuse, but we can't > filter out all abuse without turning off the network. An anti-Tor > rhetorician could say, "You filter abuse, but you don't filter abuse!" > But what would that prove? You are attempting to compare Tor's security policy to Wikipedia's security policy. Tor has a security policy. Tor's security policy is to protect originating IP addresses which might be connected to persons. We hope, in combination with Privoxy, it protects anonymity reasonably well. On the reasonable (I think) premise that other sites are primarily responsible for their own security, it only limits some abuse. Now, what is Wikipedia's security policy? With no authentication requirement, and a policy that allows anyone to edit (unless they're connecting from a blacklisted IP address), I might as well ask, "What is truth?" > {1} This case is more commonly known, in the literature, as > pseudonymous communication than anonymous communication. Then > again, if you're going to invoke dictionaries in a technical > discussion, anonymity becomes a very broad term. But Tor is about anonymity. Not about pseudonymity. Not about other forms of authentication. As it should be. >From a communication perspective, anonymity has a very specific meaning. It means we cannot identify a person. Note that the failure to identify a person makes no reference to kind of identification. There need be no preference for "real life" names versus pseudonyms versus IP addresses versus whatever else you can think of. Anything that identifies a person contradicts the concept that this person is anonymous. This has practical implications. For instance, as someone pointed out, when the Chinese police raid a dissident's apartment, and search his hard drive, they are able to tie the pseudonym to a "real life" identity. If the police can also connect the pseudonym to what they consider "crime," the distinction between a pseudonym and a "real life" name loses much of its value; hopefully, the pseudonym permitted the dissident to continue his activities for longer. Now, I will certainly agree, as someone else pointed out, that Tor should permit the use of pseudonyms or other forms of authentication. But the fact remains that any identification--as implied by authentication--contradicts anonymity; it is therefore something which Tor should not involve itself with. Simply put, it is not and cannot be Tor's problem. -- David Benfell, LCP benfell(a)parts-unknown.org --- Resume available at http://www.parts-unknown.org/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0