July 2018 - cypherpunks-legacy

Update on NIST crypto standards
by Jim Foti 06 Jul '18

06 Jul '18

Hello- Here is a brief update on NIST's crypto standards efforts: 1. On January 5, 2001, we announced a Draft FIPS for HMAC (Keyed-Hash Message Authentication Code) that is a generalization of HMAC as specified in Internet RFC 2104 and ANSI X9.71. A 90-day public comment period ends April 5, 2001. Details are available at <http://www.nist.gov/hmac>. 2. On January 2, 2001, we posted a white paper that discusses our plans for developing standards and recommendations for public key-based key management. This will be a two-part process, involving the development of 1) a scheme definition document, and 2) a key management guideline. This paper is available at <http://www.nist.gov/kms>. 3. The Draft FIPS for the AES is anticipated for release for public review in the very near future. Final approvals for the release of this document are pending. When an announcement is made, information on the draft and for providing public comments will be available at <http://www.nist.gov/aes>. Best regards and Happy New Year, Jim [This note is being sent to those people who have attended any of NIST's AES conferences, the Key Management Standard (KMS) workshop in February 2000, the Modes of Operation workshop in October 2000, or who have expressed other interest in our efforts. If you would not like to receive similar notices in the future (which should be infrequent), please let me know, and we will remove you from our email distribution list.] ******************************************************************* Jim Foti Computer Security Division Information Technology Laboratory National Institute of Standards and Technology (NIST) 100 Bureau Drive, Mail Stop 8930 Gaithersburg, MD 20899-8930 USA TEL: (301) 975-5237 FAX: (301) 948-1233 jfoti(a)nist.gov ******************************************************************* ------- End of Forwarded Message --Steve Bellovin

1 0

Lucrative update
by Patrick 06 Jul '18

06 Jul '18

Lucrative release 4 is out. I know many people are used to seeing releases numbered like "0.000001", "0.000002", "2.0.3.0.14.657" etc. but release numbering systems are essentially arbitrary in nature so don't get excited as Lucrative goes toward version 50+. This release is a fairly minor one, but included some changes such as the client name that I wanted to get out as soon as possible. There is also a new development weblog at http://lucrative.thirdhost.com/weblog/. I went through an install with someone over IRC last night and made a blog entry summarizing the install notes. I recommend reading the notes before attempting an install. I am glad to help with an install, drop me a note at patrick(a)lfcgate.com if you have trouble. Some documentation on the various entities in the Lucrative system is now available on the website, http://lucrative.thirdhost.com/documentation.php but more is needed and coming. If Lucrative is interesting to you, please consider helping in any way you can: Feedback Installation reports Suggestions Comments Criticism Feature requests Source code patches Donations Are all very much welcomed. And criticism is more useful to me than praise. My sincere thanks to everyone who has participated so far by installing, testing, providing feedback, spreading the word, and donating. And finally I just received word from SourceForge that the project registration for Lucrative has been approved. Regards, Patrick -----BEGIN PGP PUBLIC KEY BLOCK----- Version: PGPfreeware 6.5.3 for non-commercial use <http://www.pgp.com> mQGiBD5ECKcRBADUvjXHwLtxIyS4AyjBs/dFtN6rdeP18Fhzh1hD5fJwkFevqY9Z I1ASROTh6eXYF7pU5sEvbcPshHyTB41ZtTqZvQvpwWN0fUzOuutuI0mtC5UPp9Rz j47SdWLdEXNHjwnHDCYSyqtqZu8GujGRQybR0eP3NIh/NwbSDUKdgz7IjwCg//Jo UtjP3zUFobm/0UYA+CJ5krED/091x9Js0gwNwvjbzM8DqO+r8qNz0kXI13FkrPRk QNd37lxt6m2m8HZD1WYM2wKwtMzHSwJcWzaDZ/tNc+ppYjzpw0EQCh9FqjGs8Vau guF6PA1M8lJTCcLKaL4e7ynic+PAw5Xa/tdOYgFCG+eLMU5RLvzRCYoOLIjgMJLJ yG98BACAMlDmFVYgC/UKvzZmHfZ5CtCKd8sPfCXrYLu5NeFRE0LR6D6zjzmhi1xX okfreR5o3T/y78VBM98js+m2/+7Z0AElqydeW/RnV1zqwDGjDr9z2MgARf3yLAbs n3BU8Fz61RwvHy6cRkT+2dR2f69QQUSpkupvLwZIGX/iwm4uKLQdUGF0cmljayA8 cGF0cmlja0BsZmNnYXRlLmNvbT6JAE4EEBECAA4FAj5ECKcECwMCAQIZAQAKCRBb mvb9yuOVfaA2AKDAu5tDj9F2KI8cJMrKKkQRAcUyxACg6/bei7lUJH+E5igJqGRx SjKrRA65BA0EPkQIpxAQAPkYoH5aBmF6Q5CV3AVsh4bsYezNRR8O2OCjecbJ3HoL rOQ/40aUtjBKU9d8AhZIgLUV5SmZqZ8HdNP/46HFliBOmGW42A3uEF2rthccUdhQ yiJXQym+lehWKzh4XAvb+ExN1eOqRsz7zhfoKp0UYeOEqU/Rg4Soebbvj6dDRgjG zB13VyQ4SuLE8OiOE2eXTpITYfbb6yUOF/32mPfIfHmwch04dfv2wXPEgxEmK0Ng w+Po1gr9oSgmC66prrNlD6IAUwGgfNaroxIe+g8qzh90hE/K8xfzpEDp19J3tkIt AjbBJstoXp18mAkKjX4t7eRdefXUkk+bGI78KqdLfDL2Qle3CH8IF3KiutapQvMF 6PlTETlPtvFuuUs4INoBp1ajFOmPQFXz0AfGy0OplK33TGSGSfgMg71l6RfUodNQ +PVZX9x2Uk89PY3bzpnhV5JZzf24rnRPxfx2vIPFRzBhznzJZv8V+bv9kV7HAarT W56NoKVyOtQa8L9GAFgr5fSI/VhOSdvNILSd5JEHNmszbDgNRR0PfIizHHxbLY72 88kjwEPwpVsYjY67VYy4XTjTNP18F1dDox0YbN4zISy1Kv884bEpQBgRjXyEpwpy 1obEAxnIByl6ypUM2Zafq9AKUJsCRtMIPWakXUGfnHy9iUsiGSa6q6Jew1XrPdYX AAICD/wKwtF7Y4NKBe8PQ6jDbjWziiTv9Ac/EnRTJDQEoqgLa2LyE+6Ahw/VPGvp mfxkD2MKxC9E7kYVmasn6sHnSpvAv3e7O1Bqbo/qLzzCcJQ5VCurZ+elRM1GZ4Oc fM19FPKutb0/JFEv0nrqS4BGkF7WFBbu5dKYl/GIO7Co1mAerFIb719dOwMPVEIz OT08u8uB9jyR8gEElf+CVuNfOUkrUGg4HS4SbmTTrCSz3/8n5PkquSuAyjCB/dwM ZsZwA0/TTR8sDYlmlf9xPj5PGpGnV9OUwfig6eE0eWtRFeasmz0uiX+yp45ABtNh 6EXP/PFaBgXi9omXXjeeFYfpDvmfA6izvTIQfXTV6V9ZWrBfXarM+GQ+6guXWVbd 9fXvmCr982LkzuKQrK1OpRXBMUapXL+tOy/LYzz91InqKKhgPNGa12fvotZ4LzlM iqoM+Hpz5L9B5We1Ph0lD6RBVXDCqd+P8extnY/7AaDy7tC0UghaAaUuEZXJQPIc oQ3QGbpjM0nGe/VZN5EZhljau0NNENFaU56cOpvOhcO04gLGNNc2NS+rIpTMsaHh o1CG90c5zZZJuUbyx0mIHriNQXDgEwunSZPQorKK9KSppyyjeuOyi5F/mBBPXeyT weLhLqLvAr9se/+Z3aQvMADJi8zUZtGggLTw+N9R5XSwtSh2R4kARgQYEQIABgUC PkQIpwAKCRBbmvb9yuOVfWayAKC+mBhHdn1XZ5uH0RocAyJ32hx2kgCePyhB+IqM TjWLDLarQxcPYhbkFi4= =nx1M -----END PGP PUBLIC KEY BLOCK----- --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Re: [Mac_crypto] MacOS X (Panther) FileVault
by Ralf-P. Weinmann 06 Jul '18

06 Jul '18

On Thu, Nov 13, 2003 at 01:15:03PM +0000, Nicko van Someren wrote: > This is basically correct. FileVault uses an auto-mounting version of > the encrypted disk image facility that was in 10.2, tweaked to allow > the image to be opened even before your main key chain is available > (since the key chain is stored inside your home directory). The > standard encrypted image format uses a random key stored on your key > chain, which is itself encrypted with a salted and hashed copy of the > keychain pass phrase, which defaults to your login password. My > suspicion is that for the FileVault there is some other key chain file > in the system folder which stores the key for decrypting your home > directory disk image and that the pass phrase for that is just your > login password. Ahhhh... So FileVault actually is just a marketing term for the encrypted disk images! Thanks for the explanation! I just hope my login password can be longer than 8 characters then. > > > File Vault will automatically expand or contract the disk image at > > certain points. It creates a new image, copies everything over, and > > deletes the old image. > > Yup, it essentially does an "hdiutil compact" command when you log out. Do you know whether the source code to hdiutil and hdid respectively its 10.3 kernel equivalent is available? I can't seem to find it in the Darwin 7.0 public source. > > I don't know what mode of AES-128 it uses. > > I believe that it uses counter mode, since it's efficient when doing > random access to the encrypted data. Of course counter mode would be ideally suited for this application. The question is whether the people at Apple implementing this feature knew this :) I believe in peer-reviewed source code for crypto apps/features. Cheers, Ralf -- Ralf-P. Weinmann <weinmann(a)cdc.informatik.tu-darmstadt.de> PGP fingerprint: 1024D/EF114FC02F150EB9D4F275B6159CEBEAEFCD9B06 --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Government using call records to go after reporter's sources.
by Perry E. Metzger 06 Jul '18

06 Jul '18

One of ABC News' reporters says that he's been warned that call records, possibly even the ones that the major telecom companies are now routinely turning over to the NSA, are being used to track down the sources for reporters at several major news services. http://blogs.abcnews.com/theblotter/2006/05/federal_source_.html I realize many people might disagree with me, but from my point of view, the use of such heavy-handed counterintelligence tactics against the press is a substantial threat to freedom in this country. John Gilmore long ago warned us that once we'd built the total surveillance state, all that would be needed to build a new totalitarianism would be a change of attitude on the part of the governors. Well, we've built CALEA into everything, and we've built computerized systems for siphoning all call data in existence, and now we have an administration with, to say the least, a serious change in attitude about the law and morality. We have crossed a rubicon. It can be argued by some who do not agree with me that the reporters in question are somehow "helping the terrorists" by revealing things like the fact that the US Government has SigInt operations, but in fact anyone who isn't an idiot already knows we have SigInt operations. What the reporters have done -- heroically, I might add -- is reveal that the government has far exceeded the bounds of legality in performing such operations, even when legal methods existed to gain the same information. Some may call said reporters traitors, but it has become increasingly clear to me that the real traitors are those who do not respect the principles this country was founded on and who would sell our hard won freedom and mortgage the rule of law, not for security but for political gain. The surveillance against reporters is being used not to save lives but to save the administration political embarrassment, and there will be no end to the political uses of surveyance if it is not stopped now. I implore everyone who agrees with me not to be silent. If you do not call your representatives to complain about this, it will eventually be too late to complain. Tell them you want hearings with teeth, tell them that you want a special prosecutor, tell them that you do not want to see them rubber stamp universal surveillance with legal fig leaves, and that you will work to see someone else elected, no matter how much you like them otherwise, if they refuse to do anything about this issue. Tell your friends and family to make those calls as well. I do not know that screaming loudly about this will work, but I know what silence will bring. Perry --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[liberationtech] The zeta radio network
by liberationech＠lewman.us 06 Jul '18

06 Jul '18

Apropos to other discussions here, all technology is dual-use. The AP wrote up some more details about the radio/cell/mesh network used by the Mexican drug cartels, http://news.yahoo.com/mexicos-cartels-build-own-national-radio-system-20025…. I find the word choice of this article more interesting. When activists do this sort of thing, the network is cobbled together from bits and pieces and spare parts. When a drug cartel does the exact same thing, it's a sophisticated, advanced technological engineering exercise. -- Andrew http://tpo.is/contact pgp 0x74ED336B _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [cryptography] US Appeals Court upholds right not to decrypt a drive
by Benjamin Kreuter 06 Jul '18

06 Jul '18

On Sat, 25 Feb 2012 05:30:57 +1000 "James A. Donald" <jamesd(a)echeque.com> wrote: > So: Don't talk to police about the contents of your drive, or indeed > anything of which they might potentially disapprove. I believe that you meant to say, "Don't talk to the police at all," which should be standard policy for anyone who finds themselves under arrest. There is no advantage in talking to the police once you have been arrested, nothing you say will help in your defense and you are not going to talk your way out of an arrest. The odds are stacked against you during a police interview -- you are talking to people who have been trained to extract confessions, who are being paid to sit there interrogating you, and who will pick through what you say to find incriminating statements. Stay quiet, speak only to your attorney, and let your attorney speak on your behalf; you cannot be penalized for exercising your rights, nor can the fact that you refused to speak be introduced as evidence against you (at least in the United States). -- Ben -- Benjamin R Kreuter UVA Computer Science brk7bx(a)virginia.edu KK4FJZ -- "If large numbers of people are interested in freedom of speech, there will be freedom of speech, even if the law forbids it; if public opinion is sluggish, inconvenient minorities will be persecuted, even if laws exist to protect them." - George Orwell _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Update on NIST crypto standards
by Jim Foti 06 Jul '18

06 Jul '18

Hello- Here is a brief update on NIST's crypto standards efforts: 1. On January 5, 2001, we announced a Draft FIPS for HMAC (Keyed-Hash Message Authentication Code) that is a generalization of HMAC as specified in Internet RFC 2104 and ANSI X9.71. A 90-day public comment period ends April 5, 2001. Details are available at <http://www.nist.gov/hmac>. 2. On January 2, 2001, we posted a white paper that discusses our plans for developing standards and recommendations for public key-based key management. This will be a two-part process, involving the development of 1) a scheme definition document, and 2) a key management guideline. This paper is available at <http://www.nist.gov/kms>. 3. The Draft FIPS for the AES is anticipated for release for public review in the very near future. Final approvals for the release of this document are pending. When an announcement is made, information on the draft and for providing public comments will be available at <http://www.nist.gov/aes>. Best regards and Happy New Year, Jim [This note is being sent to those people who have attended any of NIST's AES conferences, the Key Management Standard (KMS) workshop in February 2000, the Modes of Operation workshop in October 2000, or who have expressed other interest in our efforts. If you would not like to receive similar notices in the future (which should be infrequent), please let me know, and we will remove you from our email distribution list.] ******************************************************************* Jim Foti Computer Security Division Information Technology Laboratory National Institute of Standards and Technology (NIST) 100 Bureau Drive, Mail Stop 8930 Gaithersburg, MD 20899-8930 USA TEL: (301) 975-5237 FAX: (301) 948-1233 jfoti(a)nist.gov ******************************************************************* ------- End of Forwarded Message --Steve Bellovin

1 0

Lucrative update
by Patrick 06 Jul '18

06 Jul '18

Lucrative release 4 is out. I know many people are used to seeing releases numbered like "0.000001", "0.000002", "2.0.3.0.14.657" etc. but release numbering systems are essentially arbitrary in nature so don't get excited as Lucrative goes toward version 50+. This release is a fairly minor one, but included some changes such as the client name that I wanted to get out as soon as possible. There is also a new development weblog at http://lucrative.thirdhost.com/weblog/. I went through an install with someone over IRC last night and made a blog entry summarizing the install notes. I recommend reading the notes before attempting an install. I am glad to help with an install, drop me a note at patrick(a)lfcgate.com if you have trouble. Some documentation on the various entities in the Lucrative system is now available on the website, http://lucrative.thirdhost.com/documentation.php but more is needed and coming. If Lucrative is interesting to you, please consider helping in any way you can: Feedback Installation reports Suggestions Comments Criticism Feature requests Source code patches Donations Are all very much welcomed. And criticism is more useful to me than praise. My sincere thanks to everyone who has participated so far by installing, testing, providing feedback, spreading the word, and donating. And finally I just received word from SourceForge that the project registration for Lucrative has been approved. Regards, Patrick -----BEGIN PGP PUBLIC KEY BLOCK----- Version: PGPfreeware 6.5.3 for non-commercial use <http://www.pgp.com> mQGiBD5ECKcRBADUvjXHwLtxIyS4AyjBs/dFtN6rdeP18Fhzh1hD5fJwkFevqY9Z I1ASROTh6eXYF7pU5sEvbcPshHyTB41ZtTqZvQvpwWN0fUzOuutuI0mtC5UPp9Rz j47SdWLdEXNHjwnHDCYSyqtqZu8GujGRQybR0eP3NIh/NwbSDUKdgz7IjwCg//Jo UtjP3zUFobm/0UYA+CJ5krED/091x9Js0gwNwvjbzM8DqO+r8qNz0kXI13FkrPRk QNd37lxt6m2m8HZD1WYM2wKwtMzHSwJcWzaDZ/tNc+ppYjzpw0EQCh9FqjGs8Vau guF6PA1M8lJTCcLKaL4e7ynic+PAw5Xa/tdOYgFCG+eLMU5RLvzRCYoOLIjgMJLJ yG98BACAMlDmFVYgC/UKvzZmHfZ5CtCKd8sPfCXrYLu5NeFRE0LR6D6zjzmhi1xX okfreR5o3T/y78VBM98js+m2/+7Z0AElqydeW/RnV1zqwDGjDr9z2MgARf3yLAbs n3BU8Fz61RwvHy6cRkT+2dR2f69QQUSpkupvLwZIGX/iwm4uKLQdUGF0cmljayA8 cGF0cmlja0BsZmNnYXRlLmNvbT6JAE4EEBECAA4FAj5ECKcECwMCAQIZAQAKCRBb mvb9yuOVfaA2AKDAu5tDj9F2KI8cJMrKKkQRAcUyxACg6/bei7lUJH+E5igJqGRx SjKrRA65BA0EPkQIpxAQAPkYoH5aBmF6Q5CV3AVsh4bsYezNRR8O2OCjecbJ3HoL rOQ/40aUtjBKU9d8AhZIgLUV5SmZqZ8HdNP/46HFliBOmGW42A3uEF2rthccUdhQ yiJXQym+lehWKzh4XAvb+ExN1eOqRsz7zhfoKp0UYeOEqU/Rg4Soebbvj6dDRgjG zB13VyQ4SuLE8OiOE2eXTpITYfbb6yUOF/32mPfIfHmwch04dfv2wXPEgxEmK0Ng w+Po1gr9oSgmC66prrNlD6IAUwGgfNaroxIe+g8qzh90hE/K8xfzpEDp19J3tkIt AjbBJstoXp18mAkKjX4t7eRdefXUkk+bGI78KqdLfDL2Qle3CH8IF3KiutapQvMF 6PlTETlPtvFuuUs4INoBp1ajFOmPQFXz0AfGy0OplK33TGSGSfgMg71l6RfUodNQ +PVZX9x2Uk89PY3bzpnhV5JZzf24rnRPxfx2vIPFRzBhznzJZv8V+bv9kV7HAarT W56NoKVyOtQa8L9GAFgr5fSI/VhOSdvNILSd5JEHNmszbDgNRR0PfIizHHxbLY72 88kjwEPwpVsYjY67VYy4XTjTNP18F1dDox0YbN4zISy1Kv884bEpQBgRjXyEpwpy 1obEAxnIByl6ypUM2Zafq9AKUJsCRtMIPWakXUGfnHy9iUsiGSa6q6Jew1XrPdYX AAICD/wKwtF7Y4NKBe8PQ6jDbjWziiTv9Ac/EnRTJDQEoqgLa2LyE+6Ahw/VPGvp mfxkD2MKxC9E7kYVmasn6sHnSpvAv3e7O1Bqbo/qLzzCcJQ5VCurZ+elRM1GZ4Oc fM19FPKutb0/JFEv0nrqS4BGkF7WFBbu5dKYl/GIO7Co1mAerFIb719dOwMPVEIz OT08u8uB9jyR8gEElf+CVuNfOUkrUGg4HS4SbmTTrCSz3/8n5PkquSuAyjCB/dwM ZsZwA0/TTR8sDYlmlf9xPj5PGpGnV9OUwfig6eE0eWtRFeasmz0uiX+yp45ABtNh 6EXP/PFaBgXi9omXXjeeFYfpDvmfA6izvTIQfXTV6V9ZWrBfXarM+GQ+6guXWVbd 9fXvmCr982LkzuKQrK1OpRXBMUapXL+tOy/LYzz91InqKKhgPNGa12fvotZ4LzlM iqoM+Hpz5L9B5We1Ph0lD6RBVXDCqd+P8extnY/7AaDy7tC0UghaAaUuEZXJQPIc oQ3QGbpjM0nGe/VZN5EZhljau0NNENFaU56cOpvOhcO04gLGNNc2NS+rIpTMsaHh o1CG90c5zZZJuUbyx0mIHriNQXDgEwunSZPQorKK9KSppyyjeuOyi5F/mBBPXeyT weLhLqLvAr9se/+Z3aQvMADJi8zUZtGggLTw+N9R5XSwtSh2R4kARgQYEQIABgUC PkQIpwAKCRBbmvb9yuOVfWayAKC+mBhHdn1XZ5uH0RocAyJ32hx2kgCePyhB+IqM TjWLDLarQxcPYhbkFi4= =nx1M -----END PGP PUBLIC KEY BLOCK----- --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Re: [Mac_crypto] MacOS X (Panther) FileVault
by Ralf-P. Weinmann 06 Jul '18

06 Jul '18

On Thu, Nov 13, 2003 at 01:15:03PM +0000, Nicko van Someren wrote: > This is basically correct. FileVault uses an auto-mounting version of > the encrypted disk image facility that was in 10.2, tweaked to allow > the image to be opened even before your main key chain is available > (since the key chain is stored inside your home directory). The > standard encrypted image format uses a random key stored on your key > chain, which is itself encrypted with a salted and hashed copy of the > keychain pass phrase, which defaults to your login password. My > suspicion is that for the FileVault there is some other key chain file > in the system folder which stores the key for decrypting your home > directory disk image and that the pass phrase for that is just your > login password. Ahhhh... So FileVault actually is just a marketing term for the encrypted disk images! Thanks for the explanation! I just hope my login password can be longer than 8 characters then. > > > File Vault will automatically expand or contract the disk image at > > certain points. It creates a new image, copies everything over, and > > deletes the old image. > > Yup, it essentially does an "hdiutil compact" command when you log out. Do you know whether the source code to hdiutil and hdid respectively its 10.3 kernel equivalent is available? I can't seem to find it in the Darwin 7.0 public source. > > I don't know what mode of AES-128 it uses. > > I believe that it uses counter mode, since it's efficient when doing > random access to the encrypted data. Of course counter mode would be ideally suited for this application. The question is whether the people at Apple implementing this feature knew this :) I believe in peer-reviewed source code for crypto apps/features. Cheers, Ralf -- Ralf-P. Weinmann <weinmann(a)cdc.informatik.tu-darmstadt.de> PGP fingerprint: 1024D/EF114FC02F150EB9D4F275B6159CEBEAEFCD9B06 --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Government using call records to go after reporter's sources.
by Perry E. Metzger 06 Jul '18

06 Jul '18

One of ABC News' reporters says that he's been warned that call records, possibly even the ones that the major telecom companies are now routinely turning over to the NSA, are being used to track down the sources for reporters at several major news services. http://blogs.abcnews.com/theblotter/2006/05/federal_source_.html I realize many people might disagree with me, but from my point of view, the use of such heavy-handed counterintelligence tactics against the press is a substantial threat to freedom in this country. John Gilmore long ago warned us that once we'd built the total surveillance state, all that would be needed to build a new totalitarianism would be a change of attitude on the part of the governors. Well, we've built CALEA into everything, and we've built computerized systems for siphoning all call data in existence, and now we have an administration with, to say the least, a serious change in attitude about the law and morality. We have crossed a rubicon. It can be argued by some who do not agree with me that the reporters in question are somehow "helping the terrorists" by revealing things like the fact that the US Government has SigInt operations, but in fact anyone who isn't an idiot already knows we have SigInt operations. What the reporters have done -- heroically, I might add -- is reveal that the government has far exceeded the bounds of legality in performing such operations, even when legal methods existed to gain the same information. Some may call said reporters traitors, but it has become increasingly clear to me that the real traitors are those who do not respect the principles this country was founded on and who would sell our hard won freedom and mortgage the rule of law, not for security but for political gain. The surveillance against reporters is being used not to save lives but to save the administration political embarrassment, and there will be no end to the political uses of surveyance if it is not stopped now. I implore everyone who agrees with me not to be silent. If you do not call your representatives to complain about this, it will eventually be too late to complain. Tell them you want hearings with teeth, tell them that you want a special prosecutor, tell them that you do not want to see them rubber stamp universal surveillance with legal fig leaves, and that you will work to see someone else elected, no matter how much you like them otherwise, if they refuse to do anything about this issue. Tell your friends and family to make those calls as well. I do not know that screaming loudly about this will work, but I know what silence will bring. Perry --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0