July 2018 - cypherpunks-legacy

Some legal trouble with TOR in France
by Olivier Barbut 06 Jul '18

06 Jul '18

Hello dear tor talkers, I'm running the tor router "mini", located in paris, france, and I believe I have to share with you what happened to me last wednesday,the 10th of May. My router was an outside gateway, doing request for tor anonymous users. Last wednesday morning, at 7:45, three cops did knock at my door. They suspected me to have downloaded some child porn videos. As I was waking up, I understood it was tor-related. I did explain them I was a TOR outside gateway, but they didn't knew about it. They searched everywhere in my small home and took every support they could find: hard drives they removed from computers, cds, disks, and then they took me to the police station, at the child protection service, jailing me the whole day while they was searching my hard drives and cds for traces of the video they was looking for. They did asked me if they was a way to trace back to the criminal who downloaded this child abuse video, but I told them "not in my knowledge" and "the tor network is designed to make this impossible, keeping no log of traffic". At 19:00, having not found these video, having learned more about tor and confirmated I was running it, they freed me, giving me back my cds and hard drives. It's sad the way some people use their freedom, e.g. participating in child abuse, but I'm still a strong believer in the necessity of anonymity on the internet. As I asked them, they did assure me they accessed my hard drives read-only, using hardware write disabler, but I still prefer not to run it straight from the hard drive they had in hand for the whole day as I know cops are not that trustable. The "mini" router will be back in a few days. Not getting paranoid, but using paranooa to make sane decisions ! Do you know if similar things did happenned to other routers ? If you wants some more details, or have advice for me please ask and /or give. Thanks everyone for making this possible ! Olivier Barbut ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

what a scream - answers.google.com - anon ps
by Ian Grigg 06 Jul '18

06 Jul '18

One of the things that was interesting about writing my '97 paper on task markets was that this was an obviously fertile field for real new markets for information. In the event, I didn't pursue that idea beyond writing the code, due to the absence of a real digital money that was suitably stable. It was always possible using credit cards, but they tended to pour sand in the machine, so it required a real effort to get such an info-market up and going. Many tried and failed. Now there is a market, run by our fave search engine, at http://answers.google.com/ where you can post a question for some cash. This has been tried before, but not to my knowledge by such a large and sustained player as google. A little searching around reveals a lack of sections, but the following prominent question: https://answers.google.com/answers/main?cmd=threadview&id=5025 "Anonymous Electronic Cash Payment System Sought" for the princely sum of $10 :-) -- iang --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

what a scream - answers.google.com - anon ps
by Ian Grigg 06 Jul '18

06 Jul '18

One of the things that was interesting about writing my '97 paper on task markets was that this was an obviously fertile field for real new markets for information. In the event, I didn't pursue that idea beyond writing the code, due to the absence of a real digital money that was suitably stable. It was always possible using credit cards, but they tended to pour sand in the machine, so it required a real effort to get such an info-market up and going. Many tried and failed. Now there is a market, run by our fave search engine, at http://answers.google.com/ where you can post a question for some cash. This has been tried before, but not to my knowledge by such a large and sustained player as google. A little searching around reveals a lack of sections, but the following prominent question: https://answers.google.com/answers/main?cmd=threadview&id=5025 "Anonymous Electronic Cash Payment System Sought" for the princely sum of $10 :-) -- iang --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[drone-list] Israel allegedly assassinates alleged militant within Egypt's borders via drone
by Gregory Foster 06 Jul '18

06 Jul '18

If true, this is the first mention I hear of a nationstate following the example of drone-based assassinations established by the United States. Tikun Olam (Aug 26) - "Israel's First Drone Strike Inside Egyptian Territory Kills Sinai Bedouin" [1]http://www.richardsilverstein.com/tikun_olam/2012/08/26/israels-firs t-drone-strike-inside-egyptian-territory-kills-sinai-bedouin/ CNN is also reporting (Aug 27) and mentions an allegation that the mobile phone network in the area was shutdown just prior to the incident: [2]http://edition.cnn.com/2012/08/26/world/meast/egypt-bedouin-killed/i ndex.html gf -- Gregory Foster || [3]gfoster(a)entersection.org @gregoryfoster <> [4]http://entersection.com/ References 1. http://www.richardsilverstein.com/tikun_olam/2012/08/26/israels-first-drone… 2. http://edition.cnn.com/2012/08/26/world/meast/egypt-bedouin-killed/index.ht… 3. mailto:gfoster@entersection.org 4. http://entersection.com/ _______________________________________________ drone-list mailing list drone-list(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/drone-list If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: No data retention in germany for donated services
by Seth David Schoen 06 Jul '18

06 Jul '18

Sven Anderson writes: > Hi, > > Karsten N. just sent to the German exitnodes list a link to an article, > which is very convincing and legally well-founded (see below). It > explains that any service that is being donated to the public, that is, > without taking money or any other return service (like advertisements) > for it, is _not_ obliged to retain any connection data! Furthermore, > since there is no gray area, who isn't obliged to retain data is not > _allowed_ to retain data, and can be charged with a fee up to 10.000 EUR > for doing so! I'm not a lawyer in Germany or any jurisdiction and I don't have any knowledge or opinion of the convincingness or legal well-foundedness of this article. I encourage anyone who might want to rely on it to seek the expert opinion of a German lawyer. But I do read German, so I've translated Karsten's note and (most of) the text of the article below for the benefit of anyone interested in this material who doesn't read German. >> [translated] >> From: "Karsten N." <tor-admin(a)privacyfoundation.de> >> Date: 24. November 2008 10:26:02 CET >> To: exitnodes(a)lists.ccc.de >> Subject: no data retention for free of charge services >> >> Hello Tor admins, >> >> there's an interesting commentary on datenspeicherung.de concerning the >> retention obligations in B'113a of the TKG law. >> >> http://www.daten-speicherung.de/index.php/keine-vorratsdatenspeicherung-fue… >> >> According to this, Tor nodes (specifically mentioned!) may not retain *any* >> data. >> >> Karsten N. NO DATA RETENTION FOR FREE-OF-CHARGE SERVICES Original German text of this article "Keine Vorratsdatenspeicherung fC<r unentgeltliche Dienste" is available at http://www.daten-speicherung.de/index.php/keine-vorratsdatenspeicherung-fue… Copyright 2008 Patrick Breyer; licensed under Creative Commons BY-2.0 (Germany) license. http://creativecommons.org/licenses/by/2.0/de/ Translation by Seth Schoen. This text version omits hyperlinks to the German text of laws, treaties, and court decisions which appear in-line in the original German version. Beginning on January 1, 2009 at the latest, those offering certain publicly-accessible telecommunications services must store their users' traffic data (B' 113a TKG). This applies to providers of land line telephone services, mobile telephone services, Internet telephone services, e-mail, Internet access, and anonymizing services. However, it has thus far remained unnoticed that the obligation to store this data applies only to compensated or commercial services. Free-of-charge services do not have to store data. Indeed, data retention is forbidden to them under penalty of a fine. * Legal situation The obligation to retain data in Germany arises from B' 113a TKG. This rule is only applicable to "telecommunications services" [Telekommunikationsdienste]. According to B' 3 no. 24 TKG, "telecommunications services" are only "services normally provided for remuneration" [in der Regel gegen Entgelt erbrachte Dienste]. For clarification of this distinguishing criterion, we find in the explanatory statement of the corresponding bill: "This definition is in accordance with art. 2 letter c sec. 1 RRL". This refers to the EU Directive 2002/21/EC on on a common regulatory framework for electronic communications networks and services. This Directive defines as an "electronic communications service" [quotation from official English version] only "a service normally provided for remuneration" [quotation from official English version; German 'gewC6hnlich gegen Entgelt erbrachte Dienste']. The Commission had originally even wanted to include only "a service provided for remuneration" [gegen Entgelt erbrachte Dienste]. This was in accordance with the then-effective German telecommunications law of 1996, which was largely applicable only to "the commercial provision of telecommunication" [das gewerbliche Angebot von Telekommunikation]. The European Parliament asked, however, for a broadening of the framework directive to all services that are rendered "on a commercial basis" [quotation from official English version; German 'auf kommerzieller Basis']. For explanation it argued that "electronic communications services may be offered on an unremunerated, yet commercial basis" [quotation from official English version]. The Council finally decided on the current formulation, according to which all "services normally provided for remuneration" [gewC6hnlich gegen Entgelt erbrachte[n] Dienste] are included. The Council did not offer an explanation for this formulation. However, it is clear that as a compromise the definition of service provision fom the EC Treaty was adopted in full (EC Treaty article 50). The EC Treaty defines service provision in article 50 as follows: "Services shall be considered to be 'services' within the meaning of this Treaty where they are normally provided for remuneration, in so far as they are not governed by the provisions relating to freedom of movement for goods, capital and persons. 'Services' shall in particular include: (a) activities of an industrial character; (b) activities of a commercial character; (c) activities of craftsmen; (d) activities of the professions." [quotation from official English version] The distinguishing criterion "normally provided for remuneration" [in der Regel gegen Entgelt erbracht] was thus adopted word-for-word in the telecommunications Framework Directive, which is also evident from the other translations of the Directive. This imitation of the EC Treaty was meaningful because the Framework Directive is founded upon the basis of the European Single Market powers of the EC. The EC may not regulate the provision of services other than those that are the subject of the Single Market. The definition of electronic communications services in the Framework Directive applies to data retention as well according to article 2, paragraph 1 of Directive 2006/24/EC. The data retention directive applies according to its article 3 only to "electronic communications services" [elektronische Kommunikationsdienste] in this sense. The Directive on data retention could not include other services because in any case it is founded on the basis of the Single Market powers (EC Treaty article 95) and may thereby only regulate the Single Market. The scope of B' 113a TKG is, in the end, consequently identical to the scope of EC Treaty article 50. The German legislature did not merely intend to take the definition of "telecommunications service" [Telekommunikationsdienst] in B' 3 TKG from EC law (see explanation). In this regard it also intended to implement data retention itself only in accordance with European legal requirements. This is clear from the title of the implementing legislation, but also from the rationale for the law (pages 30 and 69). The Bundestag wanted to require only those services (with the exception of anonymizing services) to retain data which it had to require to do so according to the EC Directive on data retention. The German Constitutional Court has ruled with regard to European arrest warrants that European legal requirements must be implemented as narrowly and compatibly with basic rights as possible. In the application of implementing laws, a construction compatible with basic rights should also be taken. A constitutionally compatible construction of B' 113a TKG requires that data retention b to avoid breaching German basic rights and the rule of proportionality b not be expanded beyond what is necessary as a matter of European law. * Precedent on the defining criterion "normally [provided] for remuneration" [in der Regel gegen Entgelt] Many decisions of the German court have been issued on the question of when a service is "normally provided for remuneration" [in der Regel gegen Entgelt erbracht]. In the leading decision "Humbel" from 1988, the Court decided: "According to article 60, para. 1 of the EEC Treaty, only 'services that are normally provided for remuneration' [quotation from official English version; German 'Leistungen, die in der Regel gegen Entgelt erbracht werden'] fall under the chapter on services. Even if the term 'remuneration' [Entgelt] has not been expressly defined in articles 59 and following of the EEC Treaty, its meaning can be inferred from article 60, para. 2 of the EEC Treaty, according to which, in particular, industrial, commercial, craft and professional activities count as services. The essential feature of remuneration [Entgelt] is thus that it shows the service provided in return for the service concerned, in which the service provided in return is normally agreed between the service provider and the recipient of the service." In subsequent decisions, the court has clarified that such a service in return can also be deemed to occur if it is paid for by a person other than the recipient. Thus private television broadcasting is regarded as a service provided for remuneration [gegen Entgelt erbrachte Leistung], because it is paid for through advertising. Indeed, one can regard private television broadcasting as a commercial service [entgeltliche Leistung] for the advertising purchasers, which serves to draw viewers for the commercials. The court has also considered the services of hospitals as furnished for remuneration [gegen Entgelt erbracht], since the hospitals are financed by health insurance companies b although in the form of standard flat rates. Now it is important that the court takes particular services into account. The criterion "normally" [in der Regel] thus does not go so far as to make a single category dispositive of all services. Rather, the court determined with regard to universities, for instance, that the freedom of services had no application to public, tax-supported universities, but that it did apply to private colleges. It is thus critical whether the particular provider offers his service "normally for remuneration" [in der Regel gegen Entgelt] or not. The service must be assigned according to EC Treaty article 2 to "economic activities" [quotation from original English version; German 'Wirtschaftsleben']. In the case of public schools, the court established that their public funding still did not establish a remunerated service [entgeltliche Leistung]. The public financing did not constitute a service directly provided in return for a service rendered. Even a mandatory levied tuition fee does not constitute a remunerated service [entgeltliche Leistung], so long as the institution is funded substantially by public means. That a service (necessarily) must be funded in one way or another, then, still does not make it a remunerated service [entgeltliche Leistung]. The funding must rather be able to be regarded as provided directly in return for the service [gerade als Gegenleistung fC<r den Dienst]. * Application to data retention obligations For telecommunication services and the obligation to retain data the following thus apply: Services that are financed essentially by something provided in exchange [Gegenleistungen] by the user are in any event normally provided for remuneration [in der Regel gegen Entgelt erbracht]. Such services must thus retain data. Those services that are financed essentially by accepting advertising b such as banner ads b and that are run for profit are also normally provided for remuneration [in der Regel gegen Entgelt erbracht]. Thus, for example, the commercial free e-mail services must store data, even if their users don't have to pay a subscription fee [Entgelt]. On the other hand, services that are provided for nothing substantial in exchange [keine wesentliche Gegenleistung], either by their users or by their parties, are normally provided for no remuneration [in der Regel unentgeltlich erbracht]. For instance, a private party may provide a free e-mail service, an open wireless network providing Internet access, or a Tor server for no compensation [unentgeltlich] and financed with his own means, and then no telecommunications service normally provided for remuneration [in der Regel gegen Entgelt erbrachter Telekommunikationsdienst] exists and the data retention obligation according to B' 113a TKG does not apply. Government services are also normally not provided for compensation [in der Regel unentgeltlich erbracht]. Many local authorities, for example, provide free Internet access or e-mail accounts. These essential tax-financed services are exempt from data retention. This is even true if a service charge is levied on the user, but the charge only defrays a small part of the costs. This situation should not be considered as different from the imposition of tuition fees or charges, concerning which the European court has already ruled. Correspondingly, even a private noncommercial service [unentgeltlicher Dienst] does not always lose its noncommercial character [unentgeltlichen Charakter] by collecting a service charge or showing commercial advertising, as long as accepting these makes up only a trivial share of the cost of the service. Whoever wants to be confident in being exempt from the obligation to retain data should, however, forego such sources of funding entirely. Services that are offered by noncommercial providers (for example, by individuals or organizations) without a profit motive, but that recoup their costs essentially by payments from users or advertising customers, will be regarded as "normally provided for remuneration" [in der Regel gegen Entgelt erbracht]. After all, the requirement "for remuneration" [gegen Entgelt] does not require any profit motive. Accordingly, the European court has regarded private schools or hospitals as commercial providers [entgeltliche Anbieter], even though they have no profit motive. Thus even noncommercial services fall under the data retention requirement if they are provided for remuneration [gegen Entgelt erbracht]. The treatment of services whose costs are actually essentially borne by private individual means, but which are offered as "additional" services by commercial providers, is unclear. For example, some firms offer, in addition to their paid services, a free public webmail service. The question is whether the self-promotion, that is to say the publicity for a commercial offering of the same firm, should be seen as a form of compensation for the ostensibly free service [ein Entgelt fC<r den an sich kostenlosen Dienst]. EC Treaty article 50 particularly includes industrial services, and a commercial firm always has a profit movie. In this connection, the court has decided with regard to tobacco advertising that commercial advertising falls within the scope of the Single Market. Uncompensated services [unentgeltliche Dienste] of a commercial firm are thus to be viewed as "normally provided for remuneration" [in der Regel gegen Entgelt erbracht] if they serve as advertising for compensated products [entgeltliche Angebote] of the firm. With regard to commercial firms, a certain appearance argues that their services in the end promote their own profit motive. Nonetheless an individual service of a commercial firm need not serve as advertising for the firm's own compensated products [entgeltlichen Angebote]. For instance a noncommercial offering [unentgeltliche Angbot] may be clearly separate from the commercial operation [gewerblichen TC$tigkeit] of its provider, in that it for example is delivered through a separate portal without any self-promotional materials; then a product normally provided without remuneration [in der Regel ein unentgeltliches Angebot] will exist, which does not fall under data retention requirements. If, on the other hand, the uncompensated service is embedded in the commercial appearance of the firm, normally a publicity interest and thereby a compensated product will be presumed. In summary, we should note that those services that are essentially funded by private means and that also do not serve as advertising for paid services are exempted from the obligation to retain data. For instance, when an individual person offers an e-mail service, a public wireless LAN with Internet access, or a Tor server without being paid for it, and he essentially funds from his own resources and not by receipts from its users or advertising customers, the data retention obligation according to B' 113a TKG does not apply. * Prohibition on data retention by non-commercial services Uncompensated services are not only excepted from the obligation to retain data. Their providers may also not "voluntarily" retain data. This results from B' 96 para. 2 TKG, according to which traffic data must be erased immediately after the end of the connection, if they are not "necessary for the purposes established through [...] legal requirements" [fC<r die durch [...] gesetzliche Vorschriften begrC<ndeten Zwecke erforderlich]. This obligation to erase data applies to all businesslike providers of telecommunications services [geschC$ftsmC$Cigen Anbieter von Telekommunikationsdiensten]. According to B' 3 TKG, these are all providers of telecommunications, even if their offering is uncompensated [unentgeltlich]. That "voluntary" data retention, as some Internet service providers currently practice it, may also not be done on "security grounds" according to B' 100 TKG has already been explained in more detail elsewhere. Whoever violates the prohibition on data retention in B' 96 TKG is acting illegally and can be punished with a fine up to ten thousand Euro by the Federal Network Agency (B' 149 para. 1 no. 17 TKG). Anyone may file a complaint. However, someone who is required to retain data and does not do so is also acting illegally. Each provider of telephone service, e-mail, Internet access, or anonymizing service should thus make sure that he acts correctly. In case of doubt, he should ask the Federal Network Agency. * Non-public services Data retention applies only to services that are publicly available (B' 113a TKG). This is an independent restriction in addition to the commercialness discussed above. The data retention obligation thus applies only if a service is both normally provided for remuneration and also publicly accessible. If either of these two criteria is not met, data retention is not applicable and is forbidden. A service is publicly available if anyone b and not just specified groups of users b can use it. The availability of a service only to members of an organization doesn't affect the public availability of that service if anyone can become a member of the organization. Non-publicly-accessible services, by contrast, are those offered, for instance, by employers or universities, since these can be accessed only by a limited group of people. These providers are neither required nor authorized to retain data. [Final section ("AusweichmC6glichkeiten fC<r entgeltliche Dienste") omitted from this translation; it describes a procedure for commercial services to try to obtain a financial indemnity or exemption from the government while the constitutional challenge to the data retention law is pending, by writing a letter to the Federal Network Agency. This letter would demand that that agency temporarily exempt commercial service providers from implementing data retention or else promise to reimburse the service providers for their implementation costs in case the German constitutional court rules data retention unconstitutional or in case it rules that the government must pay implementation costs.] -- Seth Schoen Staff Technologist schoen(a)eff.org Electronic Frontier Foundation http://www.eff.org/ 454 Shotwell Street, San Francisco, CA 94110 1 415 436 9333 x107 ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: No data retention in germany for donated services
by Seth David Schoen 06 Jul '18

06 Jul '18

Sven Anderson writes: > Hi, > > Karsten N. just sent to the German exitnodes list a link to an article, > which is very convincing and legally well-founded (see below). It > explains that any service that is being donated to the public, that is, > without taking money or any other return service (like advertisements) > for it, is _not_ obliged to retain any connection data! Furthermore, > since there is no gray area, who isn't obliged to retain data is not > _allowed_ to retain data, and can be charged with a fee up to 10.000 EUR > for doing so! I'm not a lawyer in Germany or any jurisdiction and I don't have any knowledge or opinion of the convincingness or legal well-foundedness of this article. I encourage anyone who might want to rely on it to seek the expert opinion of a German lawyer. But I do read German, so I've translated Karsten's note and (most of) the text of the article below for the benefit of anyone interested in this material who doesn't read German. >> [translated] >> From: "Karsten N." <tor-admin(a)privacyfoundation.de> >> Date: 24. November 2008 10:26:02 CET >> To: exitnodes(a)lists.ccc.de >> Subject: no data retention for free of charge services >> >> Hello Tor admins, >> >> there's an interesting commentary on datenspeicherung.de concerning the >> retention obligations in B'113a of the TKG law. >> >> http://www.daten-speicherung.de/index.php/keine-vorratsdatenspeicherung-fue… >> >> According to this, Tor nodes (specifically mentioned!) may not retain *any* >> data. >> >> Karsten N. NO DATA RETENTION FOR FREE-OF-CHARGE SERVICES Original German text of this article "Keine Vorratsdatenspeicherung fC<r unentgeltliche Dienste" is available at http://www.daten-speicherung.de/index.php/keine-vorratsdatenspeicherung-fue… Copyright 2008 Patrick Breyer; licensed under Creative Commons BY-2.0 (Germany) license. http://creativecommons.org/licenses/by/2.0/de/ Translation by Seth Schoen. This text version omits hyperlinks to the German text of laws, treaties, and court decisions which appear in-line in the original German version. Beginning on January 1, 2009 at the latest, those offering certain publicly-accessible telecommunications services must store their users' traffic data (B' 113a TKG). This applies to providers of land line telephone services, mobile telephone services, Internet telephone services, e-mail, Internet access, and anonymizing services. However, it has thus far remained unnoticed that the obligation to store this data applies only to compensated or commercial services. Free-of-charge services do not have to store data. Indeed, data retention is forbidden to them under penalty of a fine. * Legal situation The obligation to retain data in Germany arises from B' 113a TKG. This rule is only applicable to "telecommunications services" [Telekommunikationsdienste]. According to B' 3 no. 24 TKG, "telecommunications services" are only "services normally provided for remuneration" [in der Regel gegen Entgelt erbrachte Dienste]. For clarification of this distinguishing criterion, we find in the explanatory statement of the corresponding bill: "This definition is in accordance with art. 2 letter c sec. 1 RRL". This refers to the EU Directive 2002/21/EC on on a common regulatory framework for electronic communications networks and services. This Directive defines as an "electronic communications service" [quotation from official English version] only "a service normally provided for remuneration" [quotation from official English version; German 'gewC6hnlich gegen Entgelt erbrachte Dienste']. The Commission had originally even wanted to include only "a service provided for remuneration" [gegen Entgelt erbrachte Dienste]. This was in accordance with the then-effective German telecommunications law of 1996, which was largely applicable only to "the commercial provision of telecommunication" [das gewerbliche Angebot von Telekommunikation]. The European Parliament asked, however, for a broadening of the framework directive to all services that are rendered "on a commercial basis" [quotation from official English version; German 'auf kommerzieller Basis']. For explanation it argued that "electronic communications services may be offered on an unremunerated, yet commercial basis" [quotation from official English version]. The Council finally decided on the current formulation, according to which all "services normally provided for remuneration" [gewC6hnlich gegen Entgelt erbrachte[n] Dienste] are included. The Council did not offer an explanation for this formulation. However, it is clear that as a compromise the definition of service provision fom the EC Treaty was adopted in full (EC Treaty article 50). The EC Treaty defines service provision in article 50 as follows: "Services shall be considered to be 'services' within the meaning of this Treaty where they are normally provided for remuneration, in so far as they are not governed by the provisions relating to freedom of movement for goods, capital and persons. 'Services' shall in particular include: (a) activities of an industrial character; (b) activities of a commercial character; (c) activities of craftsmen; (d) activities of the professions." [quotation from official English version] The distinguishing criterion "normally provided for remuneration" [in der Regel gegen Entgelt erbracht] was thus adopted word-for-word in the telecommunications Framework Directive, which is also evident from the other translations of the Directive. This imitation of the EC Treaty was meaningful because the Framework Directive is founded upon the basis of the European Single Market powers of the EC. The EC may not regulate the provision of services other than those that are the subject of the Single Market. The definition of electronic communications services in the Framework Directive applies to data retention as well according to article 2, paragraph 1 of Directive 2006/24/EC. The data retention directive applies according to its article 3 only to "electronic communications services" [elektronische Kommunikationsdienste] in this sense. The Directive on data retention could not include other services because in any case it is founded on the basis of the Single Market powers (EC Treaty article 95) and may thereby only regulate the Single Market. The scope of B' 113a TKG is, in the end, consequently identical to the scope of EC Treaty article 50. The German legislature did not merely intend to take the definition of "telecommunications service" [Telekommunikationsdienst] in B' 3 TKG from EC law (see explanation). In this regard it also intended to implement data retention itself only in accordance with European legal requirements. This is clear from the title of the implementing legislation, but also from the rationale for the law (pages 30 and 69). The Bundestag wanted to require only those services (with the exception of anonymizing services) to retain data which it had to require to do so according to the EC Directive on data retention. The German Constitutional Court has ruled with regard to European arrest warrants that European legal requirements must be implemented as narrowly and compatibly with basic rights as possible. In the application of implementing laws, a construction compatible with basic rights should also be taken. A constitutionally compatible construction of B' 113a TKG requires that data retention b to avoid breaching German basic rights and the rule of proportionality b not be expanded beyond what is necessary as a matter of European law. * Precedent on the defining criterion "normally [provided] for remuneration" [in der Regel gegen Entgelt] Many decisions of the German court have been issued on the question of when a service is "normally provided for remuneration" [in der Regel gegen Entgelt erbracht]. In the leading decision "Humbel" from 1988, the Court decided: "According to article 60, para. 1 of the EEC Treaty, only 'services that are normally provided for remuneration' [quotation from official English version; German 'Leistungen, die in der Regel gegen Entgelt erbracht werden'] fall under the chapter on services. Even if the term 'remuneration' [Entgelt] has not been expressly defined in articles 59 and following of the EEC Treaty, its meaning can be inferred from article 60, para. 2 of the EEC Treaty, according to which, in particular, industrial, commercial, craft and professional activities count as services. The essential feature of remuneration [Entgelt] is thus that it shows the service provided in return for the service concerned, in which the service provided in return is normally agreed between the service provider and the recipient of the service." In subsequent decisions, the court has clarified that such a service in return can also be deemed to occur if it is paid for by a person other than the recipient. Thus private television broadcasting is regarded as a service provided for remuneration [gegen Entgelt erbrachte Leistung], because it is paid for through advertising. Indeed, one can regard private television broadcasting as a commercial service [entgeltliche Leistung] for the advertising purchasers, which serves to draw viewers for the commercials. The court has also considered the services of hospitals as furnished for remuneration [gegen Entgelt erbracht], since the hospitals are financed by health insurance companies b although in the form of standard flat rates. Now it is important that the court takes particular services into account. The criterion "normally" [in der Regel] thus does not go so far as to make a single category dispositive of all services. Rather, the court determined with regard to universities, for instance, that the freedom of services had no application to public, tax-supported universities, but that it did apply to private colleges. It is thus critical whether the particular provider offers his service "normally for remuneration" [in der Regel gegen Entgelt] or not. The service must be assigned according to EC Treaty article 2 to "economic activities" [quotation from original English version; German 'Wirtschaftsleben']. In the case of public schools, the court established that their public funding still did not establish a remunerated service [entgeltliche Leistung]. The public financing did not constitute a service directly provided in return for a service rendered. Even a mandatory levied tuition fee does not constitute a remunerated service [entgeltliche Leistung], so long as the institution is funded substantially by public means. That a service (necessarily) must be funded in one way or another, then, still does not make it a remunerated service [entgeltliche Leistung]. The funding must rather be able to be regarded as provided directly in return for the service [gerade als Gegenleistung fC<r den Dienst]. * Application to data retention obligations For telecommunication services and the obligation to retain data the following thus apply: Services that are financed essentially by something provided in exchange [Gegenleistungen] by the user are in any event normally provided for remuneration [in der Regel gegen Entgelt erbracht]. Such services must thus retain data. Those services that are financed essentially by accepting advertising b such as banner ads b and that are run for profit are also normally provided for remuneration [in der Regel gegen Entgelt erbracht]. Thus, for example, the commercial free e-mail services must store data, even if their users don't have to pay a subscription fee [Entgelt]. On the other hand, services that are provided for nothing substantial in exchange [keine wesentliche Gegenleistung], either by their users or by their parties, are normally provided for no remuneration [in der Regel unentgeltlich erbracht]. For instance, a private party may provide a free e-mail service, an open wireless network providing Internet access, or a Tor server for no compensation [unentgeltlich] and financed with his own means, and then no telecommunications service normally provided for remuneration [in der Regel gegen Entgelt erbrachter Telekommunikationsdienst] exists and the data retention obligation according to B' 113a TKG does not apply. Government services are also normally not provided for compensation [in der Regel unentgeltlich erbracht]. Many local authorities, for example, provide free Internet access or e-mail accounts. These essential tax-financed services are exempt from data retention. This is even true if a service charge is levied on the user, but the charge only defrays a small part of the costs. This situation should not be considered as different from the imposition of tuition fees or charges, concerning which the European court has already ruled. Correspondingly, even a private noncommercial service [unentgeltlicher Dienst] does not always lose its noncommercial character [unentgeltlichen Charakter] by collecting a service charge or showing commercial advertising, as long as accepting these makes up only a trivial share of the cost of the service. Whoever wants to be confident in being exempt from the obligation to retain data should, however, forego such sources of funding entirely. Services that are offered by noncommercial providers (for example, by individuals or organizations) without a profit motive, but that recoup their costs essentially by payments from users or advertising customers, will be regarded as "normally provided for remuneration" [in der Regel gegen Entgelt erbracht]. After all, the requirement "for remuneration" [gegen Entgelt] does not require any profit motive. Accordingly, the European court has regarded private schools or hospitals as commercial providers [entgeltliche Anbieter], even though they have no profit motive. Thus even noncommercial services fall under the data retention requirement if they are provided for remuneration [gegen Entgelt erbracht]. The treatment of services whose costs are actually essentially borne by private individual means, but which are offered as "additional" services by commercial providers, is unclear. For example, some firms offer, in addition to their paid services, a free public webmail service. The question is whether the self-promotion, that is to say the publicity for a commercial offering of the same firm, should be seen as a form of compensation for the ostensibly free service [ein Entgelt fC<r den an sich kostenlosen Dienst]. EC Treaty article 50 particularly includes industrial services, and a commercial firm always has a profit movie. In this connection, the court has decided with regard to tobacco advertising that commercial advertising falls within the scope of the Single Market. Uncompensated services [unentgeltliche Dienste] of a commercial firm are thus to be viewed as "normally provided for remuneration" [in der Regel gegen Entgelt erbracht] if they serve as advertising for compensated products [entgeltliche Angebote] of the firm. With regard to commercial firms, a certain appearance argues that their services in the end promote their own profit motive. Nonetheless an individual service of a commercial firm need not serve as advertising for the firm's own compensated products [entgeltlichen Angebote]. For instance a noncommercial offering [unentgeltliche Angbot] may be clearly separate from the commercial operation [gewerblichen TC$tigkeit] of its provider, in that it for example is delivered through a separate portal without any self-promotional materials; then a product normally provided without remuneration [in der Regel ein unentgeltliches Angebot] will exist, which does not fall under data retention requirements. If, on the other hand, the uncompensated service is embedded in the commercial appearance of the firm, normally a publicity interest and thereby a compensated product will be presumed. In summary, we should note that those services that are essentially funded by private means and that also do not serve as advertising for paid services are exempted from the obligation to retain data. For instance, when an individual person offers an e-mail service, a public wireless LAN with Internet access, or a Tor server without being paid for it, and he essentially funds from his own resources and not by receipts from its users or advertising customers, the data retention obligation according to B' 113a TKG does not apply. * Prohibition on data retention by non-commercial services Uncompensated services are not only excepted from the obligation to retain data. Their providers may also not "voluntarily" retain data. This results from B' 96 para. 2 TKG, according to which traffic data must be erased immediately after the end of the connection, if they are not "necessary for the purposes established through [...] legal requirements" [fC<r die durch [...] gesetzliche Vorschriften begrC<ndeten Zwecke erforderlich]. This obligation to erase data applies to all businesslike providers of telecommunications services [geschC$ftsmC$Cigen Anbieter von Telekommunikationsdiensten]. According to B' 3 TKG, these are all providers of telecommunications, even if their offering is uncompensated [unentgeltlich]. That "voluntary" data retention, as some Internet service providers currently practice it, may also not be done on "security grounds" according to B' 100 TKG has already been explained in more detail elsewhere. Whoever violates the prohibition on data retention in B' 96 TKG is acting illegally and can be punished with a fine up to ten thousand Euro by the Federal Network Agency (B' 149 para. 1 no. 17 TKG). Anyone may file a complaint. However, someone who is required to retain data and does not do so is also acting illegally. Each provider of telephone service, e-mail, Internet access, or anonymizing service should thus make sure that he acts correctly. In case of doubt, he should ask the Federal Network Agency. * Non-public services Data retention applies only to services that are publicly available (B' 113a TKG). This is an independent restriction in addition to the commercialness discussed above. The data retention obligation thus applies only if a service is both normally provided for remuneration and also publicly accessible. If either of these two criteria is not met, data retention is not applicable and is forbidden. A service is publicly available if anyone b and not just specified groups of users b can use it. The availability of a service only to members of an organization doesn't affect the public availability of that service if anyone can become a member of the organization. Non-publicly-accessible services, by contrast, are those offered, for instance, by employers or universities, since these can be accessed only by a limited group of people. These providers are neither required nor authorized to retain data. [Final section ("AusweichmC6glichkeiten fC<r entgeltliche Dienste") omitted from this translation; it describes a procedure for commercial services to try to obtain a financial indemnity or exemption from the government while the constitutional challenge to the data retention law is pending, by writing a letter to the Federal Network Agency. This letter would demand that that agency temporarily exempt commercial service providers from implementing data retention or else promise to reimburse the service providers for their implementation costs in case the German constitutional court rules data retention unconstitutional or in case it rules that the government must pay implementation costs.] -- Seth Schoen Staff Technologist schoen(a)eff.org Electronic Frontier Foundation http://www.eff.org/ 454 Shotwell Street, San Francisco, CA 94110 1 415 436 9333 x107 ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [cryptography] Key extraction from tokens (RSA SecurID, etc) via padding attacks on PKCS#1v1.5
by Michael Nelson 06 Jul '18

06 Jul '18

There seems to be a bit of uncertainty about this attack. B I'm hearing a lot of misunderstanding from customers. Here is my summary. B I'll first give a concrete example explaining key wrap and unwrap. B Skip this post if you know all this stuff. B Then I'll generalize a bit, and finally comment on RSA's response. Suppose that you have a symmetric key (eg a KEK) in one HSM that you want to transport to another HSM. B The target HSM generates an RSA private key, and you send the cert off to the first HSM, where you wrap (encrypt) the symmetric key under that cert. B You take this wrapped key across to the target HSM. B There, you "unwrap" it, which means that you send the encrypted blob into the target HSM, which internally decrypts the symmetric key and stores it, but does not give you back the plain symmetric key. If the target HSM notices that the encrypted blob is corrupted, then it will give you an error message. B This is a leak of information, but that's life. B Normally such a covert channel would at most help you to mount a brute force attack, which is impractical owing to the size of the key space and other things. However, if the target HSM allows you to ask it to unwrap (decrypt) the key under the assumption that pkcs v1.5 padding has been used, then by careful manipulation of the encrypted blob, you can use the failed decryptions to deduce the plain key, after only a few thousand submissions. It does not matter whether the symmetric key was encrypted using the pkcs1 v1.5 padding. (Matthew Green mentioned this in his post.) B The flaw in the HSM is that it will attempt to use the deprecated padding during the decryption. B Loosely, it looks for certain bytes and tells you whether it found them. It also does not matter whether you are using pkcs11 APIs, and whether you are doing key wrap/unwrap, and whether the data is a key. B Any secret piece of data encrypted under an RSA cert can be potentially extracted, via any kind of crypto module, as long as the module will use the deprecated padding mechanism. It also does not matter whether the device is actually a device. B An SSL server that will decrypt things assuming pkcs1 v1.5 padding, and give failure messages, is potentially vulnerable (this has been known for a decade). Various USB tokens have played the role of the HSM in the recent research. B How have RSA Corp. personned up? B The RSA blog said: "The vulnerability outlined by the researchers makes it possible (however unlikely) that an attacker with access to the userbs smartcard device and the userbs smartcard PIN could gain access to a symmetric key or other encrypted data sent to the smartcard."B This is a fairish statement. B Though I think "unlikely" needs clarifying. B It's not that common for end users to do the importation onto such a device that leads to the attack, so in that sense it's unlikely. B However, if you do do such an import, the attack is likely. B I can certainly imagine provisioning scenarios that are vulnerable, though I can't say if people are actually doing them. B So I'd say that anyone using the tokens for this sort of thing should be warned immediately. B Also, the RSA blogger should have been a little more candid and conceded that they have been remiss, and said what they will do to fix it. B Later, they quote the token team: "This is not a useful attack. The researchers engaged in an academic exercise to point out a specific vulnerability in the protocol, but an attack requires access to the RSA SecurID 800 smartcard (for example, inserted into a compromised machine) and the userbs smartcard PIN. If the attacker has the smart card and PIN, there is no need to perform any attack, so this research adds little additional value as a security finding." This is quite false. B The legitimate owner of the token, or a security officer provisioning the token, can get information (marked unextractable) he is not supposed to get, PIN or no PIN. B There are definite real world scenarios in which this attack is a serious break. _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [cryptography] Key extraction from tokens (RSA SecurID, etc) via padding attacks on PKCS#1v1.5
by Michael Nelson 06 Jul '18

06 Jul '18

There seems to be a bit of uncertainty about this attack. B I'm hearing a lot of misunderstanding from customers. Here is my summary. B I'll first give a concrete example explaining key wrap and unwrap. B Skip this post if you know all this stuff. B Then I'll generalize a bit, and finally comment on RSA's response. Suppose that you have a symmetric key (eg a KEK) in one HSM that you want to transport to another HSM. B The target HSM generates an RSA private key, and you send the cert off to the first HSM, where you wrap (encrypt) the symmetric key under that cert. B You take this wrapped key across to the target HSM. B There, you "unwrap" it, which means that you send the encrypted blob into the target HSM, which internally decrypts the symmetric key and stores it, but does not give you back the plain symmetric key. If the target HSM notices that the encrypted blob is corrupted, then it will give you an error message. B This is a leak of information, but that's life. B Normally such a covert channel would at most help you to mount a brute force attack, which is impractical owing to the size of the key space and other things. However, if the target HSM allows you to ask it to unwrap (decrypt) the key under the assumption that pkcs v1.5 padding has been used, then by careful manipulation of the encrypted blob, you can use the failed decryptions to deduce the plain key, after only a few thousand submissions. It does not matter whether the symmetric key was encrypted using the pkcs1 v1.5 padding. (Matthew Green mentioned this in his post.) B The flaw in the HSM is that it will attempt to use the deprecated padding during the decryption. B Loosely, it looks for certain bytes and tells you whether it found them. It also does not matter whether you are using pkcs11 APIs, and whether you are doing key wrap/unwrap, and whether the data is a key. B Any secret piece of data encrypted under an RSA cert can be potentially extracted, via any kind of crypto module, as long as the module will use the deprecated padding mechanism. It also does not matter whether the device is actually a device. B An SSL server that will decrypt things assuming pkcs1 v1.5 padding, and give failure messages, is potentially vulnerable (this has been known for a decade). Various USB tokens have played the role of the HSM in the recent research. B How have RSA Corp. personned up? B The RSA blog said: "The vulnerability outlined by the researchers makes it possible (however unlikely) that an attacker with access to the userbs smartcard device and the userbs smartcard PIN could gain access to a symmetric key or other encrypted data sent to the smartcard."B This is a fairish statement. B Though I think "unlikely" needs clarifying. B It's not that common for end users to do the importation onto such a device that leads to the attack, so in that sense it's unlikely. B However, if you do do such an import, the attack is likely. B I can certainly imagine provisioning scenarios that are vulnerable, though I can't say if people are actually doing them. B So I'd say that anyone using the tokens for this sort of thing should be warned immediately. B Also, the RSA blogger should have been a little more candid and conceded that they have been remiss, and said what they will do to fix it. B Later, they quote the token team: "This is not a useful attack. The researchers engaged in an academic exercise to point out a specific vulnerability in the protocol, but an attack requires access to the RSA SecurID 800 smartcard (for example, inserted into a compromised machine) and the userbs smartcard PIN. If the attacker has the smart card and PIN, there is no need to perform any attack, so this research adds little additional value as a security finding." This is quite false. B The legitimate owner of the token, or a security officer provisioning the token, can get information (marked unextractable) he is not supposed to get, PIN or no PIN. B There are definite real world scenarios in which this attack is a serious break. _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

NYT: "Pentagon Plans New Arm to Wage Wars in Cyberspace"
by Perry E. Metzger 06 Jul '18

06 Jul '18

Full article: http://www.nytimes.com/2009/05/29/us/politics/29cyber.html -- Perry E. Metzger perry(a)piermont.com --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Dept. of Defense IPv6 Interoperabilty Test Begins
by brian-slashdotnews＠hyperreal.org 06 Jul '18

06 Jul '18

Link: http://slashdot.org/article.pl?sid=03/10/22/1755258 Posted by: CowboyNeal, on 2003-10-22 20:01:00 Topic: internet, 259 comments from the let's-get-it-on dept. [1]securitas writes "The [2]Department of Defense has launched Phase I of its delayed IPv6 interoperability test ([3]mirror) in a six-month project dubbed [4]Moonv6. It is the [5]largest North American IPv6 test ever and its goal is to evaluate IPv6 for 'network-centric military operations.' Phase II was originally scheduled to begin in January 2004 but may be delayed due to the late start of the current test. 'IPv4 addresses are 32 bits long, enough for around 4 billion unique addresses.' In contrast, the IPv6 address length is '128 bits, or 340 billion billion billion billion unique addresses.' Experts hope this will solve a predicted IP address shortage as more devices are created to use the Internet." [6]Click Here References 1. http://geartest.com/ 2. http://www.computerworld.com/governmenttopics/government/story/0,10801,86243, 00.html 3. http://www.linuxworld.com.au/index.php?id=1854687864&fp=2&fpid=1 4. http://www.moonv6.org/ 5. http://dc.internet.com/news/article.php/3095951 6. http://ads.osdn.com/?ad_id=78&alloc_id=1118&site_id=1&request_id=168131&op=… ick&page=%2farticle%2epl ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 0.97c removed an attachment of type application/pgp-signature]

1 0