- cypherpunks-legacy - lists.cpunks.org

Re: [liberationtech] /. ITU Approves Deep Packet Inspection
by Eugen Leitl 05 Dec '12

05 Dec '12

----- Forwarded message from Christian Fuchs <christian.fuchs(a)uti.at> -----

1 0

Re: [liberationtech] /. ITU Approves Deep Packet Inspection
by Eugen Leitl 05 Dec '12

05 Dec '12

----- Forwarded message from Nicholas Judd <nick(a)nclarkjudd.com> -----

1 0

Re: Six Strike Rule (Was: William was raided...)
by Eugen Leitl 05 Dec '12

05 Dec '12

----- Forwarded message from Barry Shein <bzs(a)world.std.com> -----

1 0

Lesley Pitts sent you a message
by Lesley Pitts 05 Dec '12

05 Dec '12

1 0

Patriot Act can "obtain" data in Europe, researchers say
by Eugen Leitl 05 Dec '12

05 Dec '12

(Ya think?) http://www.cbsnews.com/8301-205_162-57556674/patriot-act-can-obtain-data-in… Patriot Act can "obtain" data in Europe, researchers say AP file LONDON European data stored in the "cloud" could be acquired and inspected by U.S. law enforcement and intelligence agencies, despite Europe's strong data protection laws, university researchers have suggested. The research paper, titled "Cloud Computing in Higher Education and Research Institutions and the USA Patriot Act," written by legal experts at the University of Amsterdam's Institute for Information Law, support previous reports that the anti-terror Patriot Act could be theoretically used by U.S. law enforcement to bypass strict European privacy laws to acquire citizen data within the European Union. The Patriot Act, signed into law in 2001, granted some new powers to U.S. authorities, but it was mainly a "framework law" that amended and strengthened a variety of older laws, such as the Foreign Intelligence Services Act (FISA) and the Electronic Communications Privacy Act (ECPA). "Most cloud providers, and certainly the market leaders, fall within the U.S. jurisdiction either because they are U.S. companies or conduct systematic business in the U.S.," Axel Arnbak, one of the authors of the research paper, told CBS News. Obama signs extension of Patriot Act "In particular, the Foreign Intelligence Surveillance Amendments (FISA) Act makes it easy for U.S. authorities to circumvent local government institutions and mandate direct and easy access to cloud data belonging to non-Americans living outside the U.S., with little or no transparency obligations for such practices -- not even the number of actual requests." This holds true for requests targeted at non-U.S. individuals and for entire business records, he added. Dutch vice-chair of the European Parliament's civil liberties committee Sophie in 't Veld welcomed the research, adding that it "provided further evidence" to support the theory. She told CBS News, however, that the European Commission's proposals for new data protection rules will not solve the potential conflicts posed by third country law and the lengthy period of time in which EU laws become ratified, "would not be a reason to let the situation be for several years to come." Information security, privacy and data protection lawyer Bryan Cunningham, who worked under both democratic and republican administrations, most recently as deputy legal advisor to former U.S. National Security Advisor Condoleezza Rice under President George W. Bush, told CBS News that this "important report" should "help correct a widespread post-9/11 misconception," that the Patriot Act and related legislation, "provided vast new powers for the U.S. government to gain access to sensitive communications and data of non-U.S. persons." The research resurfaces questions about the security and sovereignty of citizen and government data in an ever-connected global and borderless online world. It also supports a ZDNET report that European data protection rules do not protect EU citizens' data against extra-territorial third country law, such as that of the United States. Months after the research was published, Microsoft U.K. managing director Gordon Frazer was the first to publicly admit that the software giant could not guarantee that European citizen data stored in EU-based data centers would not leave the European Union under any circumstances, including under a Patriot Act request. "Neither can any other company," Frazer noted. Frazer's disclosure triggered outrage among politicians in the European Parliament. Subsequently a number of European member state governments began to question their own cloud service provisions, and in some cases banned U.S. providers from offering IT and computing services in their countries. U.K.-based defense giant BAE Systems in the past year reneged on plans to adopt Microsoft's cloud-based services, citing fears that critical national defense secrets could land in U.S. hands. The Dutch government is also investigating a potential conflict with third country law in regards to personal citizen passport data. Dutch social-liberal party D66 raised questions in the country's parliament after suspicions arose that U.S. authorities could potentially access Dutch fingerprint and facial scans for passports because the North Holland-based company Morpho is owned by parent company Safran, which conducts systematic business in the U.S." U.S. jurisdiction "extends to companies" Cloud computing is the storing of documents, photos, music and files online. Governments, in possession of citizen data along with their own national security secrets, are increasingly utilizing cloud services for internal government communications, hosting documents and enabling the sharing of vast amounts of data between government departments. Companies, schools and universities that wish to keep their data in their home jurisdiction -- governments, most of all -- the cloud poses a new set of risks. Because most major cloud providers, such as Apple, Amazon, Google and Microsoft, are based in the U.S., the study was focused on the provisions under U.S. law, particularly in reference to the Patriot Act, signed in 2001, and the Foreign Surveillance Intelligence Act (FISA), originally signed into law in 1978 and last amended in 2008 by Congress. Facebook is, basically, a giant cloud-based service, that can store your photos, videos, and other content, which is available from almost any device in the world. / AP PHOTO/TOBY TALBOT The researchers explain that businesses, schools and universities located outside the United States -- including foreign governments -- which use cloud services offered by a company that conducts business in the U.S., could be forced by U.S. law enforcement to transfer data to U.S. territory for inspection by law enforcement agencies. "In the U.S. legal framework, there is a legal doctrine called 'extra-territorial jurisdiction'. This implies that cloud providers operating anywhere in the EU, or anywhere in the world for that matter, have to comply with data requests from U.S. authorities as soon as they fall under U.S. laws," said Arnbak. "These laws, including the Patriot Act, apply as soon as a cloud service conducts systematic business in the United States. It's a widely held misconception that data actually has to be stored on servers physically located in the U.S." If they are forced to hand over EU-stored data back to the U.S., the company could be found in breach of EU law, even if is covered by both EU and U.S. legal jurisdictions. "The key criterion in this respect is whether the cloud provider conducts systematic business in the United States, for example because it is based there or is a subsidiary of a U.S.-based company that controls the data in question," the researchers write. Because non-U.S. residents are not protected from unwarranted searches under the Fourth Amendment, the researchers warn that this "gives the U.S. government entities concerned the statutory power to gather data on a large scale about non-U.S. citizens located abroad. And, legal protection under specific U.S. laws applies primarily to U.S. citizens and residents." However, under FISA -- amended by the Patriot Act in October 2001, just a month after the September 11 terrorist attacks -- foreigners were not the only group immune to unwarranted searches, the Fourth Amendment notwithstanding. "The Bush administration had intercepted the communications of Americans without obtaining a judicial warrant. The New York Times had carried reports on this from late 2005," the researchers write. The Patriot Act also added powers to FISA which, "enables the FBI to request access to business records for an investigation into espionage and terrorism involving both U.S. and non-U.S. persons." However, while the researchers warn that U.S. law extends beyond the reach of its borders, figures relating to requests do not exist in the public domain. CNET: Patriot Act renewed despite warnings of 'secret' law This Internet provider pledges to put your privacy first. Always The common misconception, according to the researchers, is that FISA gives the U.S. "unrestricted" or "unprecedented" access to data outside the country. FISA warrants do go through a "special court known as the Foreign Intelligence Surveillance Court (FISC)." The role of the court is to, "review the acquisition of intelligence information in this way if U.S. government entities require the assistance of electronic communication service providers for this purpose." This keeps highly sensitive requests for foreign data, under the premise of keeping terrorism-scale investigations secret, out of the public eye. Because FISA courts hold national security secrets and details of ongoing terrorism investigations, the researchers say the data can't and shouldn't be published. "Given the nature of intelligence work, it is not possible to gain insight into actual requests for information by the U.S. authorities, other than a description of the general legal framework," the researchers write. EU citizens "at risk" from FISA, Patriot Act While most Americans are aware of the Patriot Act and its wide-ranging provisions for domestic security, its role outside the U.S. border remains widely unknown. While the researchers focused their efforts on the data protection of cloud users in higher education in the Netherlands, in speaking to CBS News, Arnbak warned that the concern over the ability of third countries accessing data stored in the European Union was not limited to the Netherlands, but that it "certainly" extends to the 27 member state bloc, and even outside the European Union. "The risk of data access by U.S. authorities to cloud data is realistic, and should form an integral part in any decision making process to move data into the cloud," he said. Because the Netherlands is a member of the European Union, the country's data protection laws originally stemmed from a wider directive from the European Commission. Ratified in 1995, the EU Data Protection Directive must have been subsequently implemented into the legal systems of all member states by 1998. Therefore, every EU member state has the same foundation framework for data protection and privacy as each other, giving member state governments to expand upon the base principles and allowing data to freely flow across member states' borders, just as EU citizens have the right to do. Play Video Audit Raps FBI On Privacy "This concerns anyone with an interest in autonomy and control over access to data -- governments, businesses, non-profits and consumers alike. That's why the current debate on electronic heath records in The Netherlands is both fascinating and very serious. It appears that nobody has looked into this risk, before investing millions of taxpayers money to build these systems," Arnbak said. He noted that businesses and governments alike, despite the additional costs, should consider in-house solutions instead of moving to the cloud. "If data is processed in-house, institutions will at the very least know of such investigations at an early stage." Cunningham says, "There remains no credible way -- short, perhaps, of end-to-end encryption with the data provider holding the only key -- to assure confidentiality and security for cloud-stored data, whether stored in the United States or elsewhere." "Governments and institutions seeking such privacy and security protections should, at least for now, stick to storing their own data or, perhaps, implementing national cloud solutions with robust privacy and security protections." Because the U.S. government has "ample possibilities to request data from foreign (in this case Dutch) users of the cloud," the researchers claim, "it grants [authorities] to retrieve information on a large scale, including access to complete data sets." "In other words, these agencies may obtain information not only about a student who could pose a threat to U.S. national security but also about a student who makes an appointment in good faith through email with a person suspected by U.S. authorities of drug trafficking," the researchers assert. But this also extends outside the Netherlands to countries both in and outside the European Union. "From the U.S. legal perspective, Dutch users of cloud-based computing services therefore enjoy the same degree of [U.S.] constitutional protection as North Koreans," the study says. However, the U.S. is not alone with laws reminiscent of FISA or the Patriot Act. The researchers note that such wide-ranging provisions able to access cloud-stored data outside of their respective jurisdictions are not limited to the U.S. And continue to say, "Other nation states, including the Netherlands, have comparable provisions in place for access to data in the context of law enforcement and national security." For instance, the report notes the Dutch Intelligence and Security Services Act, which give the Dutch security and intelligence services, "the power to process the personal data of a wide range of persons." One of the sections of the law specifically carries FISA-like provisions in the Netherlands, which, "authorizes them to carry out, using a technical aid, targeted tapping, reception, recording and interception of any form of conversation, telecommunication or data transfer by means of an automated activity, irrespective of where this takes place." Similarly, the Canadian Anti-Terrorism Act "replicates" much of the provisions in the U.S.' Patriot Act. Ontario's Information and Privacy Commissioner Ann Cavoukian said in a recent report that the Act's provisions are part of the normal data-sharing process between governments. "You can outsource services, but you cannot outsource accountability," Cavoukian says. "Legal provisions regulating data access for intelligence and law enforcement purposes will exist in all democracies," Arnbak says. Cunningham warns that large, multinational, private cloud companies could pose a greater risk to private and sensitive citizen data than governments. "Many intelligence services around the world, particularly in non-democratic countries, have no effective legal restrictions whatsoever, and are aggressively collecting massive amounts of sensitive personal, government, and commercially valuable information around the world," Cunningham says. "Particularly with the rise of large, lightly-regulated cloud data storage providers, private, multinational companies actually may have more access to sensitive, personal data than national governments." Cunningham continues to say, such firms "assert far more authority to combine and data-mine such data for their own purposes than would the government be permitted under U.S. law." "And, whether or not such companies would intend to misuse such data, they are far from immune from ill-motivated insiders and external hacking activities, by individuals, criminal groups, and foreign governments."

1 0

New 25 GPU Monster Devours Passwords In Seconds
by Eugen Leitl 05 Dec '12

05 Dec '12

(if these BitCoin ASICs land they'll probably even more SHA-256 based password hashing schemes) http://securityledger.com/new-25-gpu-monster-devours-passwords-in-seconds/ New 25 GPU Monster Devours Passwords In Seconds December 4, 2012 7:12 pm 7 comments Author: ledgeditor Tags: conferences critical infrastructure Government hacking password There needs to be some kind of Moorebs law analog to capture the tremendous advances in the speed of password cracking operations. Just within the last five years, therebs been an explosion in innovation in this ancient art, as researchers have realized that they can harness specialized silicon and cloud based computing pools to quickly and efficiently break passwords. Password Cracking HPC Gosneybs set-up uses a pool of 25 virtual AMD GPUs to brute force even very strong passwords. A presentation at the Passwords^12 Conference in Oslo, Norway (slides available here - PDF), has moved the goalposts, again. Speaking on Monday, researcher Jeremi Gosney (a.k.a epixoip) demonstrated a rig that leveraged the Open Computing Language (OpenCL) framework and a technology known as Virtual Open Cluster (VCL) to run the HashCat password cracking program across a cluster of five, 4U servers equipped with 25 AMD Radeon GPUs and communicating at 10 Gbps and 20 Gbps over Infiniband switched fabric. Gosneybs system elevates password cracking to the next level, and effectively renders even the strongest passwords protected with weaker encryption algorithms, like Microsoftbs LM and NTLM, obsolete. In a test, the researcherbs system was able to churn through 348 billion NTLM password hashes per second. That renders even the most secure password vulnerable to compute-intensive brute force and wordlist (or dictionary) attacks. A 14 character Windows XP password hashed using NTLM (NT Lan Manager), for example, would fall in just six minutes, said Per Thorsheim, organizer of the Passwords^12 Conference. b Passwords on Windows XP? Not good enough anymore,b Thorsheim said. Tools like Gosneybs GPU cluster arenbt suited for an b onlineb attack scenario against a live system. Rather, theybre used in b offlineb attacks against collections of leaked or stolen passwords that were stored in encrypted form, Thorsheim said. In that situation, attackers arenbt limited to a set number of password attempts b hardware and software limitations are all that matter. The clustered GPUs clocked impressive speeds against more sturdy hashing algorithms as well, including MD5 (180 billion attempts per second, 63 billion/second for SHA1 and 20 billion/second for passwords hashed using the LM algorithm. So called b slow hashb algorithms fared better. The bcrypt (05) and sha512crypt permitted 71,000 and 364,000 per second, respectively. Benchmarks - Fast Hash Cracking Published benchmarks against common hashing algorithms using the 25 GPU HPC cluster In an IRC chat with Security Ledger, Gosney said he has been developing the new platform since April, after trying his hand at pooling traditional CPUs for password cracking. b I was extremely disappointed that setting up a clustered VMware instance wouldnbt allow me to create a VM that spanned all the hosts in the cluster. E.g. if i had five VMware ESX hosts with 8 processor cores, I wanted to be able to create a single vm with 40 cores and use all nodes in the cluster,b he wrote. Then he came across VCL, or Virtual Open Cluster, a small and heretofore little recognized project from the scientists who manage the MOSIX distributed operating system first released in the 1970s. b It did just what I wanted, not with an entire OS per se, but with an entire OpenCL application. and thatbs good enough for me.b After playing around with VCL for a while, Gosney approached Prof. Amnon Barak, one of Mosixbs creators. Gosney was interested in adding features to VCL that would allow it to run the HashCat password cracking tool. b Once we convinced Amnon that we did not aspire to turn the world into one giant botnet, he was very cooperative in working with (us) to resolve issues with VCL that was preventing it from working 100% with hashcat,b he said. VCL makes load balancing across the cluster b once an arduous task that required months of custom scripting b a trivial matter. As a result, Gosney said that his team is at a point where their implementation of Hashcat on VCL could be scaled up far above the 25GPU rig he has created b supporting b at least 128 AMD GPUs.b b It really is the marriage of two absolutely fantastic programs, which allows us to do unprecedented things,b he wrote. Gosney is no stranger to password cracking. After 6.4 million Linkedin password hashes were leaked online, Gosney was one of the first researchers to decrypt them and analyze the findings. He and a partner were ultimately able to crack between 90% and 95% of the password values. Gosneybs GPU cluster is just the latest leap forward in password cracking in a year that has already seen prominent encryption algorithms deemed compromised by an onslaught of cheap compute power. In June, Poul-Henning Kamp, creator of the md5crypt() function used by FreeBSD and other Linux-based operating systems was forced to acknowledge that the hashing function is no longer suitable for production use - a victim of GPU powered systems that could perform b close to 1 million checks per second on COTS (commercial off the shelf) GPU hardware,b he wrote. Gosneybs cluster cranked out more than 70 times that number - 77 million brute force attempts per second against MD5crypt. Recent years have also seen the launch of services like Moxie Marlinspikebs WPACracker and then CloudCracker, a cloud-based platform for penetration testers that can do lookups of password hashes and other encrypted content against a dictionary of over hundreds of millions b or even billions b of potential matches b all for under $200. And if that price is too rich, a team of U.S. based researchers have shown how you can do the same thing b on the cheap - by leveraging Googlebs MapReduce and cloud based browsers. Then, in 2011, researcher Thomas Roth, who developed the Cloud Cracking Suite (CCS) b a tool that leveraged eight Amazon EC2-based Nvidia GPU instances to crack the SHA1 encryption algorithm and dispense with tens of thousands of passwords per second. Gosney said he plans to b make a bit of moneyb off his invention, either by renting out time on it or by offering it as a paid password recovery and domain auditing service. b I have way too much invested in this to not get some kind of return out of it,b he wrote.

1 0

Re: Custom Chips Could Be the Shovels in a Bitcoin Gold Rush
by Peter Gutmann 05 Dec '12

05 Dec '12

Eugen Leitl <eugen(a)leitl.org> forwards: >http://www.technologyreview.com/news/508061/custom-chips-could-be-the-shove… > >Custom Chips Could Be the Shovels in a Bitcoin Gold Rush I guess the main lesson from this (well, the second lesson after the fact that Extraordinary Popular Delusions needs a new chapter) is that if you're doing password hashing, use anything but SHA-256. Peter.

1 0

Re: [liberationtech] /. ITU Approves Deep Packet Inspection
by Eugen Leitl 05 Dec '12

05 Dec '12

----- Forwarded message from Asher Wolf <asherwolf(a)cryptoparty.org> -----

1 0

Bitcoin Not Bombs
by Eugen Leitl 05 Dec '12

05 Dec '12

http://dailyanarchist.com/2012/12/04/bitcoin-not-bombs/ Bitcoin Not Bombs December 4th, 2012 Submitted by Davi Barker A handful of articles have entered my head this week, and as we speak they are mixing together like volatile chemicals about to explode. Ibve been on the Bitcoin bandwagon for less than a year, but I am constantly blown away by the innovations made possible by what is fundamentally a very simple idea. In the beginning I pretty much only used it to buy baklava. Now Ibm buying gold and silver bullion with Bitcoin, and accepting it as payment for the various things that I sell. So, I have a pretty good sense of how the system works and Ibm just starting to really get the economic ramifications of a digital peer-to-peer currency. I theoretically understand the impact it could have politically, at least domestically, but Ibm just starting to get the first inkling of what the international political ramifications of Bitcoin might be. This rabbit hole begins with US sanctions against Iran. The people who argue in favor of sanctions against Iran usually strike me as economic buffoons. The same person who tells me the US needs to prevent Iran from engaging in international trade to weaken their economy will usually also tell me the US needs to stop engaging in international trade to strengthen its own economy. So this is where our journey begins. Last month Turkeybs Deputy Prime Minister and top economic policy maker Ali Babacan confirmed that Turkey was circumventing sanctions by trading Iranian crude oil for Turkish gold instead of dollars. In fact, in the last nine months Turkey, ostensibly a strong ally of the US, has tripled its pre-sanctions exports to Iran. Itbs essentially a thumb in the eye to US legitimacy, and the global banking system. Good for them, I thought. Itbs a powerful proof of concept for the efficacy of alternative currency. But then I remembered another recent story about gold in Iran. In October hundreds of currency protesters gathered in Tehranbs historic Grand Bazaar outraged over the plunging Iranian rial. In response hundreds of riot police stormed Tehranbs currency exchange district arresting b illegal money changers.b Imagine that. It is a crime for honest merchants to exchange one baseless paper note for another baseless paper note because the sociocrats that issue those notes donbt get along. Whatbs interesting is that the 80% drop in the rialbs value was largely blamed on sanctions, but the head of the national police said that people holding stashes of gold was b perturbing the currency market.b So, itbs perfectly fine for States to use gold to protect themselves from economic sanctions, but not for the lowly civilians. But more importantly, holding stashes of precious metals may be an adequate protection against foreign sanctions, but not against your own State. Well, what are the Iranian people to do? I found the answer. Iranian Musician Mohammad Rafigh has translated some Bitcoin software into Farsi and is talking up Bitcoin in Iran. Rafigh accepted Bitcoin for his latest album. He wrote b I wish the culture of using digital money spreads all over the world, because it does not have any dependency on anything like politics.b Using Bitcoin Iranians living abroad can send money to their families, or exchange them for rials or dollars. It allows them to store their wealth digitally where the currency police canbt seize it, and most importantly it allows the people of Iran, at the individual level, to skirt US sanctions and maintain an economic connection to the outside world. When US sanction against Iraq killed an estimated 1 million innocent civilians in the 90s itbs easy to see how important that is. All the pieces came together when I read that AntiWar.com now accepts Bitcoin donations. PayPal and many credit card companies block access in over 60 countries for largely political reasons. Bitcoin offers what no other currency can. Access to everyone, everywhere. AntiWar.com was launched in 1995, to oppose the Bosnian war under the Clinton administration, but as wars have escalated so has apposition to war. Today the site is the leading hub of anti-war news and activism in the liberty movement, devoted not only to opposing war, but also the assaults on freedom that result from it. Bitcoin was created in 2009 by an infamous programmer names Satoshi Nakamoto, but it is unlike any other currency in the world in that it is not issued by any central bank or ruling State. In fact, itbs incredibly difficult if not impossible to track, regulate or block. What this means is that right now, in the world we live in, it is possible for civilians living in Iran to donate to the anti-war movement in the US, and it is possible for civilians in the US to donate to the relief efforts in the countries the US bombs. People can now cooperate across national boundaries, and there is virtually nothing that States can do to prevent it. Bitcoin has already changed the world, and it will continue to do so in fantastic and unpredictable ways. Given that wars must be funded by taxes, national debt or currency debasement, all of which can be protected against with Bitcoin, itbs going to be increasingly difficult for imperial powers to fund their military budgets. French economist Frederic Bastiat once said, b If goods don t cross borders, armies will.b I suggest that when States can no longer prevent goods from crossing borders, armies wonbt. The AntiWar.com donation address is: 1M87hiTAa49enJKVeT9gzLjYmJoYh9V98 Tags: AntiWar.com, Bitcoin, Iran, Iran Sanctions, Mohammad Rafigh

1 0

Custom Chips Could Be the Shovels in a Bitcoin Gold Rush
by Eugen Leitl 05 Dec '12

05 Dec '12

http://www.technologyreview.com/news/508061/custom-chips-could-be-the-shove… Custom Chips Could Be the Shovels in a Bitcoin Gold Rush Devotees of the digital currency are ratcheting up their technology in a race to generate new coins. By Tom Simonite on December 5, 2012 Why It Matters Though Bitcoin has fallen from the public eye, the emergence of chips designed specifically to b mineb the virtual currency suggests it may have some staying power. The digital b crypto-currencyb Bitcoin surged into the public eye last year, tantalizing enthusiasts with the promise of money unfettered by any government before falling victim to digital heists (see b Crypto-currency Security under Scrutinyb) and short media attention spans. But $130 million worth of bitcoins are still out there, tended by a dedicated community working to expand their use. More are still being b minedb in a process that rewards digital gold-diggers when their software solves mathematical puzzles involved in verifying transactions and regulating how the currency is used (see b What Bitcoin Is, and Why It Mattersb). Now some in that community are taking the expensive step of creating custom silicon chips dedicated to running the software that carries out that process. b Itbs a business opportunity, and also because we believe in Bitcoin and what it can do,b says Josh Zerlan, COO of Butterfly Labs, a Kansas City company that is waiting for its first batch of custom chips to come back from an Asian manufacturer. These chips will be resold to Bitcoin enthusiasts in a line of products that plug into a computer via USB and supercharge its efforts to mine the currency. They range in price from $149 to $29,899, and in early 2013 they will start shipping to over a thousand customers who placed advance orders. Butterfly has competition from several other companies working on application-specific integrated circuits, or ASICsbthe industry term for such specialized chips. The stiffest competition seems likely to come from another U.S. company, New Yorkbbased BTCFPGA, and two based in China, Avalon and ASICMiner. All three promise to send out products based on their custom chips early next year. Having an ASIC fabricated is a highly technical and expensive proposition, typically beginning at the low hundreds of thousands of dollars. Thatbs primarily because contractorsbalmost always overseasbcharge high prices to operate facilities containing the complex equipment needed to carve chips out of silicon wafers. ASICs are etched from blocks of silicon with microscopic precision. Butterfly Labs says it has paid for chips with features as small as 65 nanometers; BTCFPGA and some others say they have opted for a cheaper 90-nanometer production process. Butterfly Labs occupies a large facility in Overland Park, Kansas, where it has bought equipment to manufacture products based on its chip, says Zerlan. That includes a pick-and-place machine to solder the 7.5-millimeter-square chips onto circuit boards and three production lines to assemble the final products. Zerlan wonbt say how much it all cost, but he says the company paid for the project with profits from previous products and funds from unnamed venture capitalists. The public voice of ASICMiner, who goes by the name Friedcat online, says that no leading-edge technology is required to speed up the mining process significantly, making the challenge b affordableb for relatively small teams. b Most people consider ASICs to be a highly capital-intensive industry,b he wrote in a message. b It is not for Bitcoin-mining devices, because even [chip] technology 10 years old is much better than current mining devices.b Engineers who worked on the ASICMiner design have experience creating significantly more complex chips at national labs and startups, says Friedcat. The emergence of bitcoin-mining ASICs is part of a computational arms race rooted in the complex cryptographic scheme designed by Bitcoinbs anonymous inventor, known only by the online name Satoshi Nakamoto. Under Nakamotobs rules, which are what allow the currency to function without control by a central bank, miners run free software that communicates over the Internet to maintain a distributed global log of all Bitcoin transactions. That process is also a competition, with the miner whose software completes the next section of the logbknown as a blockbbeing rewarded with newly minted bitcoins. The reward is now 25 bitcoins, currently worth $316. Completing a block requires solving a cryptographic puzzle through brute force, so the faster the software can run, the more likely the miner is to win rewards. Nakamotobs rules also state that only 21 million bitcoins will ever be released, and at an ever-decreasing rate. That schedule is enforced by making the work of mining bitcoins harder and periodically halving the reward for completing a new block. As Bitcoin gained popularity, some people began spending thousands on heavily customized b mining rigsb capable of performing mining calculations faster than ordinary PCs. Initially relying on high-powered processors, they soon began making use of GPUs, speedy graphics processors that are also popular with the builders of supercomputers. Small businesses popped up to sell mining rigs and the latest GPUs to other miners. This spring, that arms race took a more serious turn when Butterfly Labs and some other suppliers moved on to FPGAs, chips with a reconfigurable design. Programming FPGAs to perform mining calculations resulted in significant speed increases. But ASICs, with their fixed design, promise to be at least 100 times faster than FPGAs, and thousands of times faster than GPU-based mining rigs. b ASICs run faster, consume lower power, and offer better area efficiency over FPGAs,b says Simha Sethumadhavan, an assistant professor of computer science at Columbia University, who challenged students in his hardware class to design their own mining chips. One reason ASICs run so fast is that the same circuits can be fitted into smaller spaces than is possible with an FPGA, he says. Sethumadhavan notes that the profitability of mining is also determined by Bitcoin exchange rates, electricity costs, and the up-front cost of hardware. However, using ballpark figures makes it possible to illustrate how much more a miner could make using an ASIC. An FPGA-based product that Butterfly Labs sells for $599 could pull in $1.50 worth of Bitcoins a day based on todaybs exchange rate, excluding electricity costs. A product with one of its new ASICs inside, priced at $649, is expected to work fast enough to earn $55 a day based on the same criteria. When ASICs do arrive, they could force many bitcoin miners to give up. Since Nakamotobs system adjusts the difficulty of mining to keep the rate of production constant, it will become significantly more difficult once the new chips go online. Many small-time miners will find that their outmoded equipment will no longer be able to pay for its own electricity bills. b It will become more of a business,b says Butterfly Labsb Zerlan. He believes that will help strengthen the Bitcoin economy and enable it to be taken more seriously. But none of that can happen until Zerlan and his competitors deliver their chips. All the most credible-looking ASIC projects have experienced delays and retreated from initial promises that their products would ship in late 2012, citing technical difficulties. If the products do make it to customers, the competitors may find themselves caught up in a race to release newer, faster versions. Columbiabs Sethumadhavan says custom ASICs may soon face a challenge from chips for mobile devices with circuits dedicated to performing encryption operations. These chips, expected next year, will probably be designed to a standard higher than the miners can reach and could be used to build powerful mining rigs without ASICs. Meanwhile, the Bitcoin economy is still based more on speculation than on actual business transactions. Blog host Wordpress became the closest thing to a major brand that accepts bitcoins this month, but although anything from alpaca socks to e-mail hosting can be bought using the currency, most such products are offered by enthusiasts inside the Bitcoin community. Unlike real gold, the bitcoins pursued by those building ASICs may not always glitter.

1 0