July 2018 - cypherpunks-legacy

Microsoft Press Release On Digital Signatures
by None 06 Jul '18

06 Jul '18

Microsoft announced today that all future press releases will be signed with PGP digital signatures so that readers can verify that they're reading genuine Microsoft press releases, not forgeries from hackers trying to manipulate the stock price. Microsoft's corporate PGP key 0xB9C8B513 is on the Network Associates keyservers, and you can verify the signatures there. Microsoft's public relations department also announced that plans for World Domination 2.0 are ahead of schedule, and declined to comment on Bill Gates's muttered reference to the antitrust prosecutors as a major-league %^%*&@. -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com> iQA/AwUBObaOltwjGL65yLUTEQIfNACgrmbcIwqX+u3wWmDRAShF+ydjpiYAoLwS WZoHfvvlHEd2/0rCVSrXL60G =g+G7 -----END PGP SIGNATURE-----

1 0

Microsoft Press Release On Digital Signatures
by None 06 Jul '18

06 Jul '18

Microsoft announced today that all future press releases will be signed with PGP digital signatures so that readers can verify that they're reading genuine Microsoft press releases, not forgeries from hackers trying to manipulate the stock price. Microsoft's corporate PGP key 0xB9C8B513 is on the Network Associates keyservers, and you can verify the signatures there. Microsoft's public relations department also announced that plans for World Domination 2.0 are ahead of schedule, and declined to comment on Bill Gates's muttered reference to the antitrust prosecutors as a major-league %^%*&@. -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com> iQA/AwUBObaOltwjGL65yLUTEQIfNACgrmbcIwqX+u3wWmDRAShF+ydjpiYAoLwS WZoHfvvlHEd2/0rCVSrXL60G =g+G7 -----END PGP SIGNATURE-----

1 0

Microsoft Press Release On Digital Signatures
by None 06 Jul '18

06 Jul '18

Microsoft announced today that all future press releases will be signed with PGP digital signatures so that readers can verify that they're reading genuine Microsoft press releases, not forgeries from hackers trying to manipulate the stock price. Microsoft's corporate PGP key 0xB9C8B513 is on the Network Associates keyservers, and you can verify the signatures there. Microsoft's public relations department also announced that plans for World Domination 2.0 are ahead of schedule, and declined to comment on Bill Gates's muttered reference to the antitrust prosecutors as a major-league %^%*&@. -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com> iQA/AwUBObaOltwjGL65yLUTEQIfNACgrmbcIwqX+u3wWmDRAShF+ydjpiYAoLwS WZoHfvvlHEd2/0rCVSrXL60G =g+G7 -----END PGP SIGNATURE-----

1 0

Microsoft Press Release On Digital Signatures
by None 06 Jul '18

06 Jul '18

Microsoft announced today that all future press releases will be signed with PGP digital signatures so that readers can verify that they're reading genuine Microsoft press releases, not forgeries from hackers trying to manipulate the stock price. Microsoft's corporate PGP key 0xB9C8B513 is on the Network Associates keyservers, and you can verify the signatures there. Microsoft's public relations department also announced that plans for World Domination 2.0 are ahead of schedule, and declined to comment on Bill Gates's muttered reference to the antitrust prosecutors as a major-league %^%*&@. -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com> iQA/AwUBObaOltwjGL65yLUTEQIfNACgrmbcIwqX+u3wWmDRAShF+ydjpiYAoLwS WZoHfvvlHEd2/0rCVSrXL60G =g+G7 -----END PGP SIGNATURE-----

1 0

Microsoft Press Release On Digital Signatures
by None 06 Jul '18

06 Jul '18

Microsoft announced today that all future press releases will be signed with PGP digital signatures so that readers can verify that they're reading genuine Microsoft press releases, not forgeries from hackers trying to manipulate the stock price. Microsoft's corporate PGP key 0xB9C8B513 is on the Network Associates keyservers, and you can verify the signatures there. Microsoft's public relations department also announced that plans for World Domination 2.0 are ahead of schedule, and declined to comment on Bill Gates's muttered reference to the antitrust prosecutors as a major-league %^%*&@. -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com> iQA/AwUBObaOltwjGL65yLUTEQIfNACgrmbcIwqX+u3wWmDRAShF+ydjpiYAoLwS WZoHfvvlHEd2/0rCVSrXL60G =g+G7 -----END PGP SIGNATURE-----

1 0

Microsoft Press Release On Digital Signatures
by None 06 Jul '18

06 Jul '18

Microsoft announced today that all future press releases will be signed with PGP digital signatures so that readers can verify that they're reading genuine Microsoft press releases, not forgeries from hackers trying to manipulate the stock price. Microsoft's corporate PGP key 0xB9C8B513 is on the Network Associates keyservers, and you can verify the signatures there. Microsoft's public relations department also announced that plans for World Domination 2.0 are ahead of schedule, and declined to comment on Bill Gates's muttered reference to the antitrust prosecutors as a major-league %^%*&@. -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com> iQA/AwUBObaOltwjGL65yLUTEQIfNACgrmbcIwqX+u3wWmDRAShF+ydjpiYAoLwS WZoHfvvlHEd2/0rCVSrXL60G =g+G7 -----END PGP SIGNATURE-----

1 0

[i2p] weekly status notes [mar 29]
by jrandom 06 Jul '18

06 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi y'all, time for the weekly status notes * Index 1) 0.5.0.5 2) UDP (SSU) 3) Q 4) ??? * 1) 0.5.0.5 Since y'all did such a great job at upgrading to 0.5.0.4 so quickly, we're going to have the new 0.5.0.5 release come out after the meeting. As discussed last week, the big change is the inclusion of the batching code, bundling multiple small messages together, rather than giving them each their own full 1KB tunnel message. While this alone won't be revolutionary, it should substantially reduce the number of messages passed, as well as the bandwidth used, especially for services like IRC. There will be more info in the release announcement, but two other important things come up with the 0.5.0.5 rev. First, we're dropping support for users before 0.5.0.4 - there are well over 100 users on 0.5.0.4, and there are substantial problems with earlier releases. Second, there's an important anonymity fix in the new build, that while it'd require some development effort to mount, its not implausible. The bulk of the change is to how we manage the netDb - rather than play it fast and loose and cache entries all over the place, we will only respond to netDb requests for elements that have been explicitly given to us, regardless of whether or not we have the data in question. As always, there are bugfixes and some new features, but more info will be forthcoming in the release announcement. * 2) UDP (SSU) As discussed off and on for the last 6-12 months, we're going to be moving over to UDP for our interrouter communication once the 0.6 release is out. To get us further down that path, we've got a first draft of the transport protocol up in CVS @ http://dev.i2p.net/cgi-bin/cvsweb.cgi/i2p/router/doc/udp.html?rev=HEAD Its a fairly simple protocol with the goals outlined in the doc, and exploits I2P's capabilities to both authenticate and secure data, as well as expose as little external information as possible. Not even the first part of a connection handshake is identifiable to someone that isn't running I2P. The behavior of the protocol is not fully defined in the spec yet, such as how the timers fire or how the three different semireliable status indicators are used, but it does cover the basics of the encryption, packetization, and NAT hole punching. None of it has been implemented yet, but will be soon, so feedback would be greatly appreciated! * 3) Q Aum has been churning away on Q(uartermaster), a distributed store, and the first pass of the docs are up [1]. One of the interesting ideas in there seems to be a move away from a straight DHT towards a memcached [2] style system, with each user doing any searches entirely *locally*, and requesting the actual data from the Q server "directly" (well, through I2P). Anyway, some neat stuff, perhaps if Aum is awake [3] we can wressle an update out of him? [1] http://aum.i2p/q/ [2] http://www.danga.com/memcached/ [3] damn those timezones! * 4) ??? Lots more going on, and if there were more than just a few minutes until the meeting I could go on, but c'est la vie. Swing on by #i2p in a few to chat. =jr -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFCSbNjWYfZ3rPnHH0RAi5qAKCNE+jorT/F1QPif4a1EPaTKg1DwwCggVy9 Kk+3I6WgqDjqaNKSc5xnoQA= =iXNV -----END PGP SIGNATURE----- _______________________________________________ i2p mailing list i2p(a)i2p.net http://i2p.dnsalias.net/mailman/listinfo/i2p ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

Re: [tor-talk] Tor and HTTPS graphic
by Paul Syverson 06 Jul '18

06 Jul '18

On Tue, Mar 06, 2012 at 08:15:58PM -0500, Mansour Moufid wrote: > On Tue, Mar 6, 2012 at 4:04 PM, Paul Syverson <syverson(a)itd.nrl.navy.mil> wrote: > > I'm a mere four years behind in putting my work up on the web, and > > this one wasn't co-authored so nobody else did either. I'll try to do > > something about that in my copious free time this week and send a > > link. > > Please do, this attack you mention is one I've been very interested > in. I'm sure many others would also love to read more about it. > I'll try to get to it soon. > It's time the myth of the GPA was challenged. I don't think active > correlation attacks can be defended against, but I think they can at > least be detected. Actually there are many papers over the last several years (e.g., at ACM CCS and Info Hiding) showing that one can place undetectable timing channels on flows (for some schemes provably undetectable for others practically undetectable). But passive correlation is adequate anyway, even at very low sampling rates (cf. Murdoch and Zielinski, PETS 2007). This is long known and well understood. It's why we have always said that onion routing resists traffic analysis not traffic confirmation. -Paul _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [cryptography] [info] The NSA Is Building the Country's Biggest Spy Center (Watch What You Say)
by Peter Maxwell 06 Jul '18

06 Jul '18

On 22 March 2012 17:02, Marsh Ray <marsh(a)extendedsubset.com> wrote: > On 03/22/2012 09:57 AM, Peter Maxwell wrote: > >> >> From >> >> http://blogs.computerworld.com/19917/shocker_nsa_chief_denies_total_informa… >> >> "Remember," former intelligence official Binney stated, "a lot of >>> foreign government stuff we've never been able to break is 128 or >>> less. Break all that and you'll find out a lot more of what you >>> didn't know-stuff we've already stored-so there's an enormous >>> amount of information still in there." >>> >> > In other words, they've accumulated a backlog of ciphertext. Encryption > working as designed. Depends on what you mean by "as designed" really. Personally, I'd presume as designed is to slow down or hinder an adversary, which would probably fit in this scenario. > > > Binney added the NSA is "on the verge of breaking a key encryption >>> algorithm." >>> >> > This sounds like budget boondoggle baloney to me. > > How can you be "on the verge" of something like that? > > You might have some ideas on how to attack it, but until they're proven > they're just guesses and likely to be dead ends. Not something you > should justify reworking your computing systems around. > > But once they're proven, you're not "on the verge". Meh, strictly speaking, yes, but if we're talking in practical terms it may be the case that they've figured out how to break some cryptographic primitive in significantly less time than the original design specifications but it would still take more computing oomph than they currently have. Fairly sure there was similar considerations about 64-bit RC5 in the late 90s - people knew it could be cracked by brute force, but took a distributed effort to prove as much (may have details slightly wrong as was long time ago and I can't be bothered looking it up). The scenario is not particularly likely though. > > > That sounds far more plausible than the previous explanations. I'd >> also suspect the "key encryption algorithm" may be RC4 and not AES >> at the moment. >> > > Or it could just be all the 40- and 56- bit stuff that was captured by > wiretapping Americans and not decrypted way back when the NSA felt > constrained by laws. > Hehe... "NSA constrained by laws", erm, yeah, I suppose there's a first for everything ;-) > > Or it could be everything using 512-bit RSA key exchange. > > Or it could be everything for which the security of the encryption > ultimately depends on a user-chosen password. E.g., MS-PPTP/MPPE (but > there's nothing really new about this). > > Or it could be a common protocol using a cipher weakly. For example, I > noticed this the other day about RDP "standard, non-FIPS" mode: > http://msdn.microsoft.com/en-us/library/cc240771%28v=prot.10%29.aspx > If the endpoints do actually manage to negotiate the use of 128 bit (as > opposed to 40 or 56 bit) security, it uses the output of RC4 without > discarding any initial bytes. Those initial bytes have some > correlations, some of which can expose the whole key. Just to make sure > the 1684 bit state size of RC4 doesn't get stale, the protocol refreshes > the key every 4096 packets. (Actually better than MPPE which seems to > rekey every 1 or 256 packets depending on negotiated options). > > Or it could be complete BS. In reality, they've probably got a lot of uses for more computing power and the chances of us ever finding out in our lifetime are slim. _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Microsoft Press Release On Digital Signatures
by None 06 Jul '18

06 Jul '18

Microsoft announced today that all future press releases will be signed with PGP digital signatures so that readers can verify that they're reading genuine Microsoft press releases, not forgeries from hackers trying to manipulate the stock price. Microsoft's corporate PGP key 0xB9C8B513 is on the Network Associates keyservers, and you can verify the signatures there. Microsoft's public relations department also announced that plans for World Domination 2.0 are ahead of schedule, and declined to comment on Bill Gates's muttered reference to the antitrust prosecutors as a major-league %^%*&@. -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com> iQA/AwUBObaOltwjGL65yLUTEQIfNACgrmbcIwqX+u3wWmDRAShF+ydjpiYAoLwS WZoHfvvlHEd2/0rCVSrXL60G =g+G7 -----END PGP SIGNATURE-----

1 0