July 2018 - cypherpunks-legacy

None
by Graeme Burnett 06 Jul '18

06 Jul '18

Gecko/20040316 To: cryptography(a)metzdowd.com Subject: The future of security Sender: owner-cryptography(a)metzdowd.com Hello folks, I am doing a presentation on the future of security, which of course includes a component on cryptography. That will be given at this conference on payments systems and security: http://www.enhyper.com/paysec/ Would anyone there have any good predictions on how cryptography is going to unfold in the next few years or so? I have my own ideas, but I would love to see what others see in the crystal ball. Graeme --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[p2p-hackers] MixMinion vs. onion routing & GNUnet question
by fis＠wiwi.hu-berlin.de 06 Jul '18

06 Jul '18

seberino(a)spawar.navy.mil writes: > From: seberino(a)spawar.navy.mil > Date: Fri, 5 Nov 2004 21:24:14 -0800 > Subject: [p2p-hackers] MixMinion vs. onion routing & GNUnet question > [...] > GNUnet seems like a very good project. Probably the > best I've seen. It is a modular framework so pieces can be > borrowed and built upon at many levels. These may be naive questions (I don't know GNUnet too well), but hopefully I am about to learn something: GNUnet tries to achieve at least three goals at the same time that are not perfectly understood and should rather be treated individually: - anonymity - censor resistance - high-performance document distribution What makes you believe the GNUnet-solution for any of these aims can be factored out and used somewhere else? Also, don't the shortcomings of mix networks also apply to Freenet- / GNUnet-style anonymization schemes? In Freenet (at least in some ancient version that I once had a closer look at), I know security is even worse (though still not too bad in my eyes), because the packets don't all travel well-specified mix paths but take shortcuts. To put it more clearly: A network has "perfect anonymity" if any peer in that network can send and receive (variants: a - send only; b - receive only) packets without the contents of the packets being associated with its IP address by the adversary, and it has "high anonymity" if it has perfect anonymity in every transaction with high probability. Then I suspect that no matter what (existing) adversary model you pick, plugging a good mix network into your design on the transport layer gives you the highest anonymity possible. (And at a very good price, too: You can throw more resources at other design requirements, you get more mature anonymity technology, and you can profit from improvements in the field without changing your design at all.) Of course I'd need to define "good mix network" now. But perhaps somebody can already counter or confirm this as is? -matthias _______________________________________________ p2p-hackers mailing list p2p-hackers(a)zgp.org http://zgp.org/mailman/listinfo/p2p-hackers _______________________________________________ Here is a web page listing P2P Conferences: http://www.neurogrid.net/twiki/bin/view/Main/PeerToPeerConferences ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

Re: [IP] worth reading -- loophole in FISA?
by David P. Reed 06 Jul '18

06 Jul '18

Well, Dave, here's a couple of relevant personal thoughts regarding vacuum-cleaner-like data gathering... 1) there's a saying I heard recently that the NSA's approach to intelligence is like trying to find a needle in the haystack by sending tractors in the field to gather more hay. Based on my understanding of the reliability of inference-making I suspect the problem is that and worse. So these so-called vacuum-cleaner technologies probably won't improve the ability to predict terrorism that much, but the elimination of checks and balances will almost certainly result in lots of "false positives" that can be used as presumptive reasons to harass both US citizens and foreigners for "inferences" that are little more than wild-ass intuitions about what kind of activity might be correlated with bad actors. Of course there are lots of technology companies who sell stuff to the intelligence community who are full of hyperbolic claims about the wonders of mass data collection and analysis, but if they were so good, why don't they predict the stock market instead and make money the old fashioned way? Predicting the stock market is a trivial problem compared to predicting and preventing terrorism, but in the market there is actually a measure of success, whereas the measure of success in the beltway intelligence technology business is getting another, bigger contract. (that's what comes from outsourcing to a military-industrial complex that is so big it can buy members of Congress, lock stock and barrel, as we saw with Duke Cunningham). 2) what the NSA does outside the US may be legal under US law, but by no means is it either legal or a source of pride when viewed in other countries or in international law. The grand glorious endeavor of spying is fundamentally anti-social and anti-humanity. Apparently, part of the standard CIA induction briefing is being reminded that humint is just another word for fraud, deception, burglary, and other things that we do not tolerate in civilized societies. If agents carrying out such acts are discovered in our country they can be executed, and by symmetry most countries can and will execute our spies if caught. (this may be cruel and unusual, because theft of information inside a country is usually punished by more lenient methods). Sigint (though the hands *seem* cleaner) is legally and morally just wire fraud and peeping-tomism etc. by another name, and again, agents who listen in on radio or wire conversations in other countries are violating their laws, just as agents doing that in the US would be guilty of espionage and subject to execution or harsh penalties. So by any "golden rule" standard of justice we should be careful. One can argue that, just as war is sometimes thought to be necessary to deal with threats to the citizens of our nation, intelligence gathering, however illegal, might also be sometimes necessary. But it's not a "good" at any level, and hardly something we should be proud of. However, the thrill of hanging out with the codebreakers shouldn't be used to glamorize what is, at its core, just a government-sanctioned form of antisocial behavior. It's practitioners cannot be trusted to decide what is appropriate, because they are by definition able to carry out acts that are antisocial and illegal. ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

RE: worth reading -- loophole in FISA?
by Ridgely Evers 06 Jul '18

06 Jul '18

Dave, David Reed is right on the money in terms of the false positive issue. Actually, the "more hay" methodology has been shown to be ineffective in other, related fields, and even worse has been shown to be an effective tool for _evading_ detection. Simply put, it is relatively easy for an attacker to determine the kinds of things that trigger alerts, and to flood the detection system with those types of events. Intrustion detection systems on networks are classic cases in point: they are so overwhelmeed by false positives that in very short order the people monitoring the systems stop paying attention. A "boy who cried wolf" problem, exacerbated by the fact that the marginal cost of creating a false positive is many orders of magnitude less than the cost of responsing to one. Ultimately, the IDS systems end up being used either (a) to show uninformed management that "we're doing something", and/or (b) as part of the forensic process _after_ a breach has occurred to try to see if the attacker left any useful footprints (hint: the answer is "no"). There's a trend to watch for, as well. The follow-on technology to IDS, optimistically referred to as Intrusion Prevention Systems, has been touted as a tool to actually stop attacks in progress. Essentially, it's a combination of detection capability coupled with 'drop the connection' capability. It came into existence because security people thought it would be cool, and because customers were complaining about the overload on human resources that the IDS technologies imposed. The theory was that technology could operate with sufficient speed to prevent bad things from happening. The real world response (as noted in a recent Network World review of IPS) has been that the systems are getting deployed, but without the 'P' feature enabled. It seems that users are not willing to take the risk of shutting off a good connection (the 99.9999% case) in order to prevent an attack (the 0.0001% case). But I expect that the next layer of proposals out of the NSA data mining mess will be to create and deploy some magic system that can operate at the speed of the technology being monitored. <Insert massive (unsuccessful) budget here.> "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." - Ben Franklin, ~1784 --Ridge -----Original Message----- From: David Farber [mailto:dave@farber.net] Sent: Thursday, December 22, 2005 3:40 PM To: Ip Ip Subject: worth reading -- loophole in FISA? Begin forwarded message:

1 0

[IP] worth reading -- loophole in FISA?
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

[tahoe-dev] Announcing RentaNode.nl: Tahoe-LAFS storage nodes for rent
by Guido Witmond 06 Jul '18

06 Jul '18

Hello Everyone, Some people might have guessed it from my activity on this list: As of today I announce my Tahoe-LAFS rental service. I'll offer private Tahoe-LAFS storage grids on geographically spread servers. Each customer gets their 'own' grid so they will have full control over access control, n-of-k encoding, data retention (garbage collection) and even introducer-rekeying. An introducer node is included for free to help those behind NAT-routers. Or bring your own. Although the Tahoe-protocol can do much more, the initial focus of the offering is on: 1) long term cloud backup of data and; 2) closed user group collaborative sharing. For now it will be a subscription service over the Internet to technocrats that can handle self-configuration. Later I'll add a hands-on service at customer sites and when the there is demand, preconfigured hardware, ready to deploy as a private grid for when the customer has more data to store than is viable with their network connection. I'll open the business soon, in the mean time feel free to have a look at my advertising: https://www.rentanode.nl/ With gratitude to the people that have made Tahoe-LAFS possible. /Me tips his hat to all of you! With regards, Guido Witmond. _______________________________________________ tahoe-dev mailing list tahoe-dev(a)tahoe-lafs.org https://tahoe-lafs.org/cgi-bin/mailman/listinfo/tahoe-dev ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Lucrative update
by Patrick 06 Jul '18

06 Jul '18

Lucrative release 4 is out. I know many people are used to seeing releases numbered like "0.000001", "0.000002", "2.0.3.0.14.657" etc. but release numbering systems are essentially arbitrary in nature so don't get excited as Lucrative goes toward version 50+. This release is a fairly minor one, but included some changes such as the client name that I wanted to get out as soon as possible. There is also a new development weblog at http://lucrative.thirdhost.com/weblog/. I went through an install with someone over IRC last night and made a blog entry summarizing the install notes. I recommend reading the notes before attempting an install. I am glad to help with an install, drop me a note at patrick(a)lfcgate.com if you have trouble. Some documentation on the various entities in the Lucrative system is now available on the website, http://lucrative.thirdhost.com/documentation.php but more is needed and coming. If Lucrative is interesting to you, please consider helping in any way you can: Feedback Installation reports Suggestions Comments Criticism Feature requests Source code patches Donations Are all very much welcomed. And criticism is more useful to me than praise. My sincere thanks to everyone who has participated so far by installing, testing, providing feedback, spreading the word, and donating. And finally I just received word from SourceForge that the project registration for Lucrative has been approved. Regards, Patrick -----BEGIN PGP PUBLIC KEY BLOCK----- Version: PGPfreeware 6.5.3 for non-commercial use <http://www.pgp.com> mQGiBD5ECKcRBADUvjXHwLtxIyS4AyjBs/dFtN6rdeP18Fhzh1hD5fJwkFevqY9Z I1ASROTh6eXYF7pU5sEvbcPshHyTB41ZtTqZvQvpwWN0fUzOuutuI0mtC5UPp9Rz j47SdWLdEXNHjwnHDCYSyqtqZu8GujGRQybR0eP3NIh/NwbSDUKdgz7IjwCg//Jo UtjP3zUFobm/0UYA+CJ5krED/091x9Js0gwNwvjbzM8DqO+r8qNz0kXI13FkrPRk QNd37lxt6m2m8HZD1WYM2wKwtMzHSwJcWzaDZ/tNc+ppYjzpw0EQCh9FqjGs8Vau guF6PA1M8lJTCcLKaL4e7ynic+PAw5Xa/tdOYgFCG+eLMU5RLvzRCYoOLIjgMJLJ yG98BACAMlDmFVYgC/UKvzZmHfZ5CtCKd8sPfCXrYLu5NeFRE0LR6D6zjzmhi1xX okfreR5o3T/y78VBM98js+m2/+7Z0AElqydeW/RnV1zqwDGjDr9z2MgARf3yLAbs n3BU8Fz61RwvHy6cRkT+2dR2f69QQUSpkupvLwZIGX/iwm4uKLQdUGF0cmljayA8 cGF0cmlja0BsZmNnYXRlLmNvbT6JAE4EEBECAA4FAj5ECKcECwMCAQIZAQAKCRBb mvb9yuOVfaA2AKDAu5tDj9F2KI8cJMrKKkQRAcUyxACg6/bei7lUJH+E5igJqGRx SjKrRA65BA0EPkQIpxAQAPkYoH5aBmF6Q5CV3AVsh4bsYezNRR8O2OCjecbJ3HoL rOQ/40aUtjBKU9d8AhZIgLUV5SmZqZ8HdNP/46HFliBOmGW42A3uEF2rthccUdhQ yiJXQym+lehWKzh4XAvb+ExN1eOqRsz7zhfoKp0UYeOEqU/Rg4Soebbvj6dDRgjG zB13VyQ4SuLE8OiOE2eXTpITYfbb6yUOF/32mPfIfHmwch04dfv2wXPEgxEmK0Ng w+Po1gr9oSgmC66prrNlD6IAUwGgfNaroxIe+g8qzh90hE/K8xfzpEDp19J3tkIt AjbBJstoXp18mAkKjX4t7eRdefXUkk+bGI78KqdLfDL2Qle3CH8IF3KiutapQvMF 6PlTETlPtvFuuUs4INoBp1ajFOmPQFXz0AfGy0OplK33TGSGSfgMg71l6RfUodNQ +PVZX9x2Uk89PY3bzpnhV5JZzf24rnRPxfx2vIPFRzBhznzJZv8V+bv9kV7HAarT W56NoKVyOtQa8L9GAFgr5fSI/VhOSdvNILSd5JEHNmszbDgNRR0PfIizHHxbLY72 88kjwEPwpVsYjY67VYy4XTjTNP18F1dDox0YbN4zISy1Kv884bEpQBgRjXyEpwpy 1obEAxnIByl6ypUM2Zafq9AKUJsCRtMIPWakXUGfnHy9iUsiGSa6q6Jew1XrPdYX AAICD/wKwtF7Y4NKBe8PQ6jDbjWziiTv9Ac/EnRTJDQEoqgLa2LyE+6Ahw/VPGvp mfxkD2MKxC9E7kYVmasn6sHnSpvAv3e7O1Bqbo/qLzzCcJQ5VCurZ+elRM1GZ4Oc fM19FPKutb0/JFEv0nrqS4BGkF7WFBbu5dKYl/GIO7Co1mAerFIb719dOwMPVEIz OT08u8uB9jyR8gEElf+CVuNfOUkrUGg4HS4SbmTTrCSz3/8n5PkquSuAyjCB/dwM ZsZwA0/TTR8sDYlmlf9xPj5PGpGnV9OUwfig6eE0eWtRFeasmz0uiX+yp45ABtNh 6EXP/PFaBgXi9omXXjeeFYfpDvmfA6izvTIQfXTV6V9ZWrBfXarM+GQ+6guXWVbd 9fXvmCr982LkzuKQrK1OpRXBMUapXL+tOy/LYzz91InqKKhgPNGa12fvotZ4LzlM iqoM+Hpz5L9B5We1Ph0lD6RBVXDCqd+P8extnY/7AaDy7tC0UghaAaUuEZXJQPIc oQ3QGbpjM0nGe/VZN5EZhljau0NNENFaU56cOpvOhcO04gLGNNc2NS+rIpTMsaHh o1CG90c5zZZJuUbyx0mIHriNQXDgEwunSZPQorKK9KSppyyjeuOyi5F/mBBPXeyT weLhLqLvAr9se/+Z3aQvMADJi8zUZtGggLTw+N9R5XSwtSh2R4kARgQYEQIABgUC PkQIpwAKCRBbmvb9yuOVfWayAKC+mBhHdn1XZ5uH0RocAyJ32hx2kgCePyhB+IqM TjWLDLarQxcPYhbkFi4= =nx1M -----END PGP PUBLIC KEY BLOCK----- --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

None
by Graeme Burnett 06 Jul '18

06 Jul '18

Gecko/20040316 To: cryptography(a)metzdowd.com Subject: The future of security Sender: owner-cryptography(a)metzdowd.com Hello folks, I am doing a presentation on the future of security, which of course includes a component on cryptography. That will be given at this conference on payments systems and security: http://www.enhyper.com/paysec/ Would anyone there have any good predictions on how cryptography is going to unfold in the next few years or so? I have my own ideas, but I would love to see what others see in the crystal ball. Graeme --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[p2p-hackers] MixMinion vs. onion routing & GNUnet question
by fis＠wiwi.hu-berlin.de 06 Jul '18

06 Jul '18

seberino(a)spawar.navy.mil writes: > From: seberino(a)spawar.navy.mil > Date: Fri, 5 Nov 2004 21:24:14 -0800 > Subject: [p2p-hackers] MixMinion vs. onion routing & GNUnet question > [...] > GNUnet seems like a very good project. Probably the > best I've seen. It is a modular framework so pieces can be > borrowed and built upon at many levels. These may be naive questions (I don't know GNUnet too well), but hopefully I am about to learn something: GNUnet tries to achieve at least three goals at the same time that are not perfectly understood and should rather be treated individually: - anonymity - censor resistance - high-performance document distribution What makes you believe the GNUnet-solution for any of these aims can be factored out and used somewhere else? Also, don't the shortcomings of mix networks also apply to Freenet- / GNUnet-style anonymization schemes? In Freenet (at least in some ancient version that I once had a closer look at), I know security is even worse (though still not too bad in my eyes), because the packets don't all travel well-specified mix paths but take shortcuts. To put it more clearly: A network has "perfect anonymity" if any peer in that network can send and receive (variants: a - send only; b - receive only) packets without the contents of the packets being associated with its IP address by the adversary, and it has "high anonymity" if it has perfect anonymity in every transaction with high probability. Then I suspect that no matter what (existing) adversary model you pick, plugging a good mix network into your design on the transport layer gives you the highest anonymity possible. (And at a very good price, too: You can throw more resources at other design requirements, you get more mature anonymity technology, and you can profit from improvements in the field without changing your design at all.) Of course I'd need to define "good mix network" now. But perhaps somebody can already counter or confirm this as is? -matthias _______________________________________________ p2p-hackers mailing list p2p-hackers(a)zgp.org http://zgp.org/mailman/listinfo/p2p-hackers _______________________________________________ Here is a web page listing P2P Conferences: http://www.neurogrid.net/twiki/bin/view/Main/PeerToPeerConferences ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

Re: [IP] worth reading -- loophole in FISA?
by David P. Reed 06 Jul '18

06 Jul '18

Well, Dave, here's a couple of relevant personal thoughts regarding vacuum-cleaner-like data gathering... 1) there's a saying I heard recently that the NSA's approach to intelligence is like trying to find a needle in the haystack by sending tractors in the field to gather more hay. Based on my understanding of the reliability of inference-making I suspect the problem is that and worse. So these so-called vacuum-cleaner technologies probably won't improve the ability to predict terrorism that much, but the elimination of checks and balances will almost certainly result in lots of "false positives" that can be used as presumptive reasons to harass both US citizens and foreigners for "inferences" that are little more than wild-ass intuitions about what kind of activity might be correlated with bad actors. Of course there are lots of technology companies who sell stuff to the intelligence community who are full of hyperbolic claims about the wonders of mass data collection and analysis, but if they were so good, why don't they predict the stock market instead and make money the old fashioned way? Predicting the stock market is a trivial problem compared to predicting and preventing terrorism, but in the market there is actually a measure of success, whereas the measure of success in the beltway intelligence technology business is getting another, bigger contract. (that's what comes from outsourcing to a military-industrial complex that is so big it can buy members of Congress, lock stock and barrel, as we saw with Duke Cunningham). 2) what the NSA does outside the US may be legal under US law, but by no means is it either legal or a source of pride when viewed in other countries or in international law. The grand glorious endeavor of spying is fundamentally anti-social and anti-humanity. Apparently, part of the standard CIA induction briefing is being reminded that humint is just another word for fraud, deception, burglary, and other things that we do not tolerate in civilized societies. If agents carrying out such acts are discovered in our country they can be executed, and by symmetry most countries can and will execute our spies if caught. (this may be cruel and unusual, because theft of information inside a country is usually punished by more lenient methods). Sigint (though the hands *seem* cleaner) is legally and morally just wire fraud and peeping-tomism etc. by another name, and again, agents who listen in on radio or wire conversations in other countries are violating their laws, just as agents doing that in the US would be guilty of espionage and subject to execution or harsh penalties. So by any "golden rule" standard of justice we should be careful. One can argue that, just as war is sometimes thought to be necessary to deal with threats to the citizens of our nation, intelligence gathering, however illegal, might also be sometimes necessary. But it's not a "good" at any level, and hardly something we should be proud of. However, the thrill of hanging out with the codebreakers shouldn't be used to glamorize what is, at its core, just a government-sanctioned form of antisocial behavior. It's practitioners cannot be trusted to decide what is appropriate, because they are by definition able to carry out acts that are antisocial and illegal. ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0