- cypherpunks-legacy - lists.cpunks.org

Re: [serval-project-dev] Implementing a different routing protocol
by Jeremy Lakeman 06 Jul '18

06 Jul '18

On Wed, Nov 28, 2012 at 6:30 AM, Fraser Cadger <cadge01(a)googlemail.com> wrote: > Hi all, > > > First of all, let me start by stating that I am very impressed with the work > of the Serval Project and the Serval app. I appreciate that it is still > under development, but having experimented on several Android phones I have > found it really easy to use and effective. > > > My name is Fraser Cadger and I am a third year PhD student at the University > of Ulster in Northern Ireland. My project is concerned with developing a > framework to allow the streaming of multimedia content both live (i.e. video > call) and on-demand (recorded videos) in disaster recovery scenarios using a > mesh network of WiFi-enabled devices (currently this entails a testbed of > six Android phones). As I am working with Android devices this obviously > adds a layer of difficult when trying to implement ad-hoc networking. After > doing some searching I came across several different implementations of > ad-hoc routing on Android, and after some experimentation the two I was most > interested in were Serval and Commotion (who I believe the Serval Project > collaborates with). In the end I decided to work with the Serval app because > I felt that was the closest to what I was doing, and I also liked how it > worked on the phones. > > > Currently what I am interested in doing is implementing my own routing > protocol (which is still under development) on the phones using Serval as a > base. That is to say, that I want to replace the modified BATMAN code Serval > uses for routing with the current version of my routing algorithm > (originally written in C++ for ns-2 but re-writing in C should not be a huge > problem). Obviously I realise this will not be a simple as copying and > pasting my code in and that is why I am sending this message. From reading > various comments in the code I understand that one of the main modifications > to Serval is to restrict broadcasting to link-local nodes (i.e. not > network-wide broadcasting), if I have understand the code correctly that is. > The protocol I am developing is a variation of the greedy routing protocol > GPSR http://www0.cs.ucl.ac.uk/staff/b.karp/gpsr/gpsr.html . Both the > original GPSR and my own protocol use limited broadcasting as well; beacon > (regular hello messages) are broadcast as far as one hop and nodes maintain > tables of neighbours who can be reached directly only. There is no > conventional collection of routes; instead each node forwards a packet to > their neighbour who best meets the criterion/criteria (generally geographic > location, i.e. located closest to the destination) one hop at a time. So > packets are effectively passed from node to node without a formal route > existing. This version of geographic routing is not perfect, and that is why > we are working on several modifications, but for now I am content to have > some form of working geographic routing up and running. > > > I have been reading through the code and trying to determine what parts I > need to change and where to add my code. What I am looking for is the point > at which a node determines where to send a packet. I realise that this will > vary depending on the packet's origin, that is to say that when a node > generates a new packet it will usually be treated differently from when an > intermediate node receives a packet from another node. Now, if I understand > correctly Serval's version of BATMAN does not use an explicit routing table > structure. I have came across a struct called subscriber defined in > overlay_address.h, and from what I have read this seems to act as a record > of different nodes (destinations). Within the subscriber struct there is an > integer variable called reachable and this determines whether a node is > reachable directly via unicast, broadcast, or must be reached indirectly. If > a node must be reached indirectly then there is a field called next_hop > which if I understand correctly is a pointer to another struct (the > intermediate node between ourselves and the destination). Is this correct? > Now, what I have noticed in the code is that sometimes next_hop contains a > pointer to another next_hop (i.e. next_hop->next_hop). What I'm guessing > this means is that if there are multiple intermediate nodes (i.e. to send a > packet to node D node A needs to send it via B and C), then this is a way of > linking them as a route. So in essence, the subscriber struct contains the > route to a destination (by way of the next_hop attribute). Close, next_hop always points to our immediate neighbour that we should forward the payload to. The payloads themselves are almost always sent in broadcast packets which may contain multiple payloads addressed to multiple neighbours. Including payloads that should be flooded across the entire network. > For the actual routing, from reading the code I'm guessing that the > 'overlay_route_recalc_node_metrics' function is used to determine whether a > destination can be reached directly or indirectly, and if indirectly it will > then assign the appropriate intermediate nodes as next_hop's. Therefore, to > create or change a route this function is called. Is this correct? > > > In my case, I would like to do things slightly differently. As I am not > doing end-to-end routing I do not need a list of destinations, instead all I > want is a list of 1-hop neighbours who can be accessed directly. Then from > that list I would determine which of these is the most suitable as the next > hop (obviously in my case this will require other stuff, for instance adding > GPS coordinates to the packet header and storing this in the subscriber > field) and forward the packet to that node, and so on until the packet has > been delivered (or has to be dropped). > > > The main questions I have are: > > > Exactly where is a packet received and the node to which it should be sent > decided? See overlay_queue.c / overlay_stuff_packet() where we pull payloads from our QOS queues and make a final decision about where the payload should go next. overlay_payload.c / overlay_frame_append_payload() is where the header format is written into the packet. overlay_packetformats.c / packetOkOverlay() is where those payloads are parsed out of an incoming packet and processed or queued if they are addressed to this node. > i.e. if I want to decide which node to forward a packet to where should I > decide this? > > I came across a method called 'overlay_mdp_receive' in mdp_client.c, is this > maybe what I'm looking for? That's for connected client applications to send and receive messages. If you want to pass some extra messages between daemons, the process is a little different. You can schedule an alarm to periodically queue a message, or you can hook into every outgoing packet and write your payload just before it's sent. eg overlay_tick_interface() is called for each interface periodically to force an outgoing packet. You can add a case to process the message in overlay_mdp.c / overlay_saw_mdp_frame(). > Concerning the subscriber entity, is there an actual table/list/array of > these b as I can't seem to find one? There's a tree in memory, built in overlay_address.c as each node is discovered. > i.e. a list of neighbours/known nodes/destinations? > > > I apologise if my questions and this email aren't very well-worded. > Essentially what I'm looking for is some advice/guidance on exactly how > routing (determining intermediate nodes for nodes which cannot be reached > directly) and forwarding (looking at a received/originated packet and > determining which node to send it to) is done. As I indicated earlier in > this message, there are a few functions/structs I have stumbled across that > I think are relevant and I have made some guesses at what they are doing, so > I would appreciate if someone could correct/expand on my guesses. Yes, basically overlay_route.c is currently responsible for path discovery. These decisions are written into the subscriber structure so that none of the rest of the code needs to know the internal details of how these routes were calculated. I also have plans to implement a different routing protocol. I've been trying to tease apart our current spaghetti code to separate the different layers of the implementation as much as possible. This should enable us to drop in a different path discovery process without needing to change much of the rest of the daemon. I've been doing some more work in that direction recently in a currently private branch. Mainly to tweak the packet format, reducing header overheads, so we can lock in the network byte format for forward compatibility. I've still got a couple more changes to implement though. Neighbour discovery & link state detection need to be split out from overlay_route.c and redesigned. But I'm not quite ready to start that task yet. We don't have any bandwidth throttling yet. If you're planning to send large volumes of data, any excessive latency added from buffer bloat can cause havoc with route statistics. The list of things I'd like to get done before I start replacing the routing layer never seems to get any shorter. You should also check out our testing framework, specifically tests/routing. While the setup process for these tests is a little verbose, and the file based network simulation is a bit different to an actual adhoc mesh. It gives you a quick way to tell if you're on the right track without needing to wander around with phones all the time. > > Any help/guidance I have would be greatly appreciated. It goes without > saying that any code I develop myself I will happily share, and any > issues/bugs I come across with Serval will be reported. > > > Thank you for taking the time to read this message, I'm sorry it's a bit on > the long side but hopefully I've made myself clear. > > > Regards, > > > Fraser > > > Ps. I realise this topic has been covered before, but I think some of the > questions I am asking in this message are new. > > -- > You received this message because you are subscribed to the Google Groups > "Serval Project Developers" group. > To view this discussion on the web visit > https://groups.google.com/d/msg/serval-project-developers/-/MgHT2-tr_dcJ. > To post to this group, send email to > serval-project-developers(a)googlegroups.com. > To unsubscribe from this group, send email to > serval-project-developers+unsubscribe(a)googlegroups.com. > For more options, visit this group at > http://groups.google.com/group/serval-project-developers?hl=en. -- You received this message because you are subscribed to the Google Groups "Serval Project Developers" group. To post to this group, send email to serval-project-developers(a)googlegroups.com. To unsubscribe from this group, send email to serval-project-developers+unsubscribe(a)googlegroups.com. For more options, visit this group at http://groups.google.com/group/serval-project-developers?hl=en. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Where John Ashcroft stands on technology: A mixed bag
by Declan McCullagh 06 Jul '18

06 Jul '18

http://www.wired.com/news/politics/0,1283,41008,00.html Top Cop Arrives With Mixed Bag by Declan McCullagh (declan(a)wired.com) 2:00 a.m. Jan. 5, 2001 PST For liberal Democrats, John Ashcroft is a maddening symbol of everything wrong with a George W. Bush presidency -- from the former senator's staunch opposition to abortion to his alleged insensitivity regarding race. To conservatives, Bush's nominee for attorney general represents precisely the opposite extreme: A respected leader who will restore integrity to a Justice Department brought low by the Clinton administration. Ashcroft opposes background checks at gun shows, supports increased penalties for drug offenses and would not prohibit discrimination based on sexual orientation. On technology issues, Ashcroft's record as a Missouri governor and senator is mixed. He seems genuinely to believe in privacy rights and economic liberty, and has taken a moderate position on intellectual property and fair-use rights. But free-speech groups already are girding themselves for the legal equivalent of trench warfare, predicting that newly emboldened Department of Justice prosecutors will launch an assault on sexually explicit material online. And Microsoft foes fret that the antitrust division's commitment to the high-profile antitrust case may wane. On one point everyone can agree: More than any other Cabinet member, the next attorney general will be in a position to make crucial decisions with far-reaching effects on antitrust enforcement, privacy protections and free speech rights. "An Ashcroft DOJ could be a decidedly mixed bag for the high-tech sector since he will be engaged in a constant balancing act on most industry issues," says Adam Thierer, an analyst at the free-market Cato Institute who's well connected in Republican technology circles. "While Ashcroft has a very strong record of support for loosening encryption controls, he may be faced with pressure from GOP law-and-order types to moderate his views on this and also be willing to continue, or even expand FBI efforts like Carnivore," Thierer said. Make that a near certainty. It's a fair bet that pro-law enforcement conservatives in the mold of wiretap-happy Rep. Bill McCollum of Florida, who unsuccessfully ran for the state's open Senate seat, will view a Republican DOJ as an opportunity to expand government surveillance and wiretapping powers. Liberal Democrats have vowed opposition to Ashcroft's nomination -- People for the American Way even assembled a detailed criticism of the nominee -- but privately confide that they don't expect to successfully block his confirmation by the Senate. Wiretapping and Carnivore: Under Attorney General Janet Reno, a DOJ panel has reviewed the FBI's controversial Carnivore surveillance system and extended a tentative blessing. But critics panned the review board as uniformly pro-government, as first reported by Wired News, and independent researchers refused to participate in the process. Ashcroft is the former two-term attorney general and two-term governor of Missouri. During his time there, he cemented his reputation as a solid conservative eager to lower taxes and build new prisons. [...] ----- End forwarded message -----

1 0

RE: Phil Zimmerman and voice encryption; a Skype problem?
by Adler, Joseph 06 Jul '18

06 Jul '18

Hi Paul, You left out one option: that Tony Rutkowski was misquoted by the Times. I checked with Tony, and this is, in fact, what happened. Here is his full response: ------------------------------------------------------------------------ ------------ Since the external security lists seem to be buzzing with discourse about Phil Zimmerman's VoIP encryption product as covered by John Markoff in the NY times on Monday, and my quote about German capabilities to decrypt, let me explain the context and what was actually said. John (who I've known for several decades) called my cellphone Sunday morning and said he was writing an article on Zimmerman's software and his making it available, and asked from a CALEA standpoint, whether this was covered. I explained that the recent FCC CALEA orders on VoIP presently exempted P2P VoIP, so that Zimmerman's product was outside the requirements. In multiple roles, including formal filings and legal forums, I deal with this subject all the time. I also mentioned, however, that CALEA requirements exist worldwide, and that German officials at a recent Cyprus standards conference on lawful interception had stated that they "have a Skype solution." I explained to John that most other countries have far more extensive CALEA like requirements, and that Germany among others were likely to impose their "solutions." In the article that was published, my domestic coverage explanation was attributed to someone else, and my "German solution" explanation was morphed into a statement that they can decrypt Skype content. The context of the actual discussion, however, was regulatory requirements. Whether the German government can or cannot decrypt Skype content is not known, and indeed the details of their regulatory requirements are also unknown. --tony -----Original Message----- From: owner-cryptography(a)metzdowd.com [mailto:owner-cryptography@metzdowd.com] On Behalf Of Paul Hoffman Sent: Monday, May 22, 2006 8:19 AM To: Steven M. Bellovin; cryptography(a)metzdowd.com Subject: Re: Phil Zimmerman and voice encryption; a Skype problem? At 10:19 AM -0400 5/22/06, Steven M. Bellovin wrote: >There's an article in today's NY Times (for subscribers, it's at >http://www.nytimes.com/2006/05/22/technology/22privacy.html?_r=1&oref=s >login ) on whether Phil Zimmerman's Zfone -- an encrypted VoIP package >-- will invite government scrutiny. There doesn't seem to be any >imminent threat in the U.S.; the one concrete example mentioned -- the >British plan to give police the power to compel individuals to disclose >keys -- doesn't threaten Zfone, because it uses Diffie-Hellman for >(among other things) perfect forward secrecy and doesn't even have any >long-term keys. (See draft-zimmermann-avt-zrtp-01.txt for protocol >details.) > >The fascinating thing, though, was this sentence near the end of the >article: > > But at a conference last week in Cyprus, German officials said > they had technology for intercepting and decrypting Skype phone > calls, according to Anthony M. Rutkowski, vice president for > regulatory affairs and standards for VeriSign, a company that > offers security for Internet and phone operations. > >The Berson report says that Skype uses AES-256. NSA rates that as >suitable for Top Secret traffic, so it's presumably not the cipher. >Berson analyzed a number of other possible attack scenarios; the only >one that seems to be possible is an active attack plus forged certificates. >If Berson's analysis was correct -- and we all know how hard it is to >verify cryptographic protocols -- that leaves open the possibility of a >protocol change that implemented some sort of Clipper-like functionality. Please don't forget that the VeriSign spokesperson may be mistaken, or purposely lying (possibly in order to drum up business for the company). Neither would be a first for VeriSign. --Paul Hoffman, Director --VPN Consortium --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

None
by Richard Forno 06 Jul '18

06 Jul '18

<dave(a)farber.net> Subject: Will Bioterror Fears Spawn Science Censorship? Will Bioterror Fears Spawn Science Censorship? 04.25.07 | 2:00 AM http://www.wired.com/print/politics/onlinerights/commentary/ circuitcourt/200 7/04/circuitcourt_0425 Since September 11th, people have been increasingly worried about the misuse of legitimate scientific research to create dangerous weapons or to bypass security measures. Now a federal advisory board is about to recommend new guidelines to limit publication of life-sciences research that could be misused by terrorists. I think it's treading on dangerous ground. Last Thursday, a draft of the rules was formally adopted by the National Science Advisory Board for Biosecurity, or NSABB, at a meeting in Bethesda, Maryland. The draft proposes voluntary compliance by scientists, universities and journals, but leaves open the possibility of federal legislation to turn the guidelines into law. Indeed, it almost invites that result by supporting application of the NSABB recommendations to researchers that do not receive federal funds -- a result that can only be achieved through regulation. As a lawyer for computer security researchers, it is impossible to regard this prospect with anything but dread. For example, the proposal (.pdf) broadly defines "dual use research of concern" as any "research that, based on current understanding, can be reasonably anticipated to provide knowledge, products, or technologies that could be directly misapplied by others to pose a threat to public health and safety, agriculture, plants, animals, the environment, or materiel." That's a perfectly reasonable description of an article or paper worth a closer look before publication. But if this language becomes a statute that prohibits publication under some circumstances, the author risks criminal prosecution if law enforcement disagrees with a scientist, university or peer-review publication's decision that the research should be published. And, legally, I'd find it extremely difficult to advise the author with any certainty whether publishing the research is lawful or not. Whose "current understanding" applies? What does "reasonably anticipated" mean? When is research "directly" misapplied, or merely indirectly used? How much of a risk "poses a threat"? The NSABB draft also sets out a procedure to follow once a scientist has identified research of concern. Instead of outright suppression in every case, the proposal suggests a risk/benefit analysis, which can result in a variety of options for communicating the research to the public. This seems flexible and case-specific, which again, is great in a guideline, but terrible when you are trying to advise a client how to avoid the risk of jail. We know that reasonable scientists can and do disagree about these things. What do prosecutors, judges and juries think? Rejecting new regulation doesn't mean we have to be subject to the whims of bioterrorists. Voluntary self-regulation, ethical training, peer review and additional practices currently followed by recombinant DNA researchers, microbiologists and other scientists all have a track record of success. And smart federal laws can control access to pathogens -- and prohibit dangerous practices -- while steering clear of restricting scientific publications. Until recently, U.S. policy has been to allow the publication of information, with only narrow controls on classified information. Then, in 2002, the president signed the National Security Act, which requires federal agencies to create procedures to protect "sensitive but unclassified" knowledge. The statute is unclear about whether these procedures should take the form of voluntary guidelines, or regulations with the force of law, and whether they'll apply outside of federal agencies. But the NSABB report appears to be part of the effort to craft such procedures. The scientists on the board have good reasons for wanting to be involved in crafting the guidelines. They want to stop terrorists, and they take the dangers from dual-use research seriously. They also want to protect the scientific process, and they believe correctly that if regulation is going to happen, it would be much, much better if scientists were involved. Once such scientist is NSABB board member David A. Relman, M.D., associate professor of medicine, microbiology and immunology at Stanford University School of Medicine. He told me about a 2004 addition to federal law which criminalizes possession of the smallpox virus. Unfortunately, the statute defines the pathogen as any virus that contains 85 percent or greater sequence similarity to smallpox, effectively outlawing a whole range of pox viruses, including the smallpox vaccine. The maximum penalty for violating the law is a fine of $2 million dollars and 25 years in prison. Doctor Relman views his role on the NSABB as helping the government avoid a similar kind of mistake in the future. He and his colleagues are doing us a service by participating, but they have to be extremely careful that their work is not used to legitimize regulation. Any guidelines should be crystal clear that they are good only as that -- guidelines. If the NSABB is not careful, its well-balanced recommendations may become a precursor for abandoning voluntary self-regulation in favor of federal regulation of scientists. Once we have regulations, we will also have penalties for non-compliance. At that point, the only question left will be how much scientific self-determination remains. - - - Jennifer Granick is executive director of the Stanford Law School Center for Internet and Society and teaches the Cyberlaw Clinic. ------------------------------------------- Archives: http://v2.listbox.com/member/archive/247/=now RSS Feed: http://v2.listbox.com/member/archive/rss/247/ Powered by Listbox: http://www.listbox.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[IP] Will Bioterror Fears Spawn Science Censorship?
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

Where John Ashcroft stands on technology: A mixed bag
by Declan McCullagh 06 Jul '18

06 Jul '18

http://www.wired.com/news/politics/0,1283,41008,00.html Top Cop Arrives With Mixed Bag by Declan McCullagh (declan(a)wired.com) 2:00 a.m. Jan. 5, 2001 PST For liberal Democrats, John Ashcroft is a maddening symbol of everything wrong with a George W. Bush presidency -- from the former senator's staunch opposition to abortion to his alleged insensitivity regarding race. To conservatives, Bush's nominee for attorney general represents precisely the opposite extreme: A respected leader who will restore integrity to a Justice Department brought low by the Clinton administration. Ashcroft opposes background checks at gun shows, supports increased penalties for drug offenses and would not prohibit discrimination based on sexual orientation. On technology issues, Ashcroft's record as a Missouri governor and senator is mixed. He seems genuinely to believe in privacy rights and economic liberty, and has taken a moderate position on intellectual property and fair-use rights. But free-speech groups already are girding themselves for the legal equivalent of trench warfare, predicting that newly emboldened Department of Justice prosecutors will launch an assault on sexually explicit material online. And Microsoft foes fret that the antitrust division's commitment to the high-profile antitrust case may wane. On one point everyone can agree: More than any other Cabinet member, the next attorney general will be in a position to make crucial decisions with far-reaching effects on antitrust enforcement, privacy protections and free speech rights. "An Ashcroft DOJ could be a decidedly mixed bag for the high-tech sector since he will be engaged in a constant balancing act on most industry issues," says Adam Thierer, an analyst at the free-market Cato Institute who's well connected in Republican technology circles. "While Ashcroft has a very strong record of support for loosening encryption controls, he may be faced with pressure from GOP law-and-order types to moderate his views on this and also be willing to continue, or even expand FBI efforts like Carnivore," Thierer said. Make that a near certainty. It's a fair bet that pro-law enforcement conservatives in the mold of wiretap-happy Rep. Bill McCollum of Florida, who unsuccessfully ran for the state's open Senate seat, will view a Republican DOJ as an opportunity to expand government surveillance and wiretapping powers. Liberal Democrats have vowed opposition to Ashcroft's nomination -- People for the American Way even assembled a detailed criticism of the nominee -- but privately confide that they don't expect to successfully block his confirmation by the Senate. Wiretapping and Carnivore: Under Attorney General Janet Reno, a DOJ panel has reviewed the FBI's controversial Carnivore surveillance system and extended a tentative blessing. But critics panned the review board as uniformly pro-government, as first reported by Wired News, and independent researchers refused to participate in the process. Ashcroft is the former two-term attorney general and two-term governor of Missouri. During his time there, he cemented his reputation as a solid conservative eager to lower taxes and build new prisons. [...] ----- End forwarded message -----

1 0

RE: Phil Zimmerman and voice encryption; a Skype problem?
by Adler, Joseph 06 Jul '18

06 Jul '18

Hi Paul, You left out one option: that Tony Rutkowski was misquoted by the Times. I checked with Tony, and this is, in fact, what happened. Here is his full response: ------------------------------------------------------------------------ ------------ Since the external security lists seem to be buzzing with discourse about Phil Zimmerman's VoIP encryption product as covered by John Markoff in the NY times on Monday, and my quote about German capabilities to decrypt, let me explain the context and what was actually said. John (who I've known for several decades) called my cellphone Sunday morning and said he was writing an article on Zimmerman's software and his making it available, and asked from a CALEA standpoint, whether this was covered. I explained that the recent FCC CALEA orders on VoIP presently exempted P2P VoIP, so that Zimmerman's product was outside the requirements. In multiple roles, including formal filings and legal forums, I deal with this subject all the time. I also mentioned, however, that CALEA requirements exist worldwide, and that German officials at a recent Cyprus standards conference on lawful interception had stated that they "have a Skype solution." I explained to John that most other countries have far more extensive CALEA like requirements, and that Germany among others were likely to impose their "solutions." In the article that was published, my domestic coverage explanation was attributed to someone else, and my "German solution" explanation was morphed into a statement that they can decrypt Skype content. The context of the actual discussion, however, was regulatory requirements. Whether the German government can or cannot decrypt Skype content is not known, and indeed the details of their regulatory requirements are also unknown. --tony -----Original Message----- From: owner-cryptography(a)metzdowd.com [mailto:owner-cryptography@metzdowd.com] On Behalf Of Paul Hoffman Sent: Monday, May 22, 2006 8:19 AM To: Steven M. Bellovin; cryptography(a)metzdowd.com Subject: Re: Phil Zimmerman and voice encryption; a Skype problem? At 10:19 AM -0400 5/22/06, Steven M. Bellovin wrote: >There's an article in today's NY Times (for subscribers, it's at >http://www.nytimes.com/2006/05/22/technology/22privacy.html?_r=1&oref=s >login ) on whether Phil Zimmerman's Zfone -- an encrypted VoIP package >-- will invite government scrutiny. There doesn't seem to be any >imminent threat in the U.S.; the one concrete example mentioned -- the >British plan to give police the power to compel individuals to disclose >keys -- doesn't threaten Zfone, because it uses Diffie-Hellman for >(among other things) perfect forward secrecy and doesn't even have any >long-term keys. (See draft-zimmermann-avt-zrtp-01.txt for protocol >details.) > >The fascinating thing, though, was this sentence near the end of the >article: > > But at a conference last week in Cyprus, German officials said > they had technology for intercepting and decrypting Skype phone > calls, according to Anthony M. Rutkowski, vice president for > regulatory affairs and standards for VeriSign, a company that > offers security for Internet and phone operations. > >The Berson report says that Skype uses AES-256. NSA rates that as >suitable for Top Secret traffic, so it's presumably not the cipher. >Berson analyzed a number of other possible attack scenarios; the only >one that seems to be possible is an active attack plus forged certificates. >If Berson's analysis was correct -- and we all know how hard it is to >verify cryptographic protocols -- that leaves open the possibility of a >protocol change that implemented some sort of Clipper-like functionality. Please don't forget that the VeriSign spokesperson may be mistaken, or purposely lying (possibly in order to drum up business for the company). Neither would be a first for VeriSign. --Paul Hoffman, Director --VPN Consortium --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

None
by Richard Forno 06 Jul '18

06 Jul '18

<dave(a)farber.net> Subject: Will Bioterror Fears Spawn Science Censorship? Will Bioterror Fears Spawn Science Censorship? 04.25.07 | 2:00 AM http://www.wired.com/print/politics/onlinerights/commentary/ circuitcourt/200 7/04/circuitcourt_0425 Since September 11th, people have been increasingly worried about the misuse of legitimate scientific research to create dangerous weapons or to bypass security measures. Now a federal advisory board is about to recommend new guidelines to limit publication of life-sciences research that could be misused by terrorists. I think it's treading on dangerous ground. Last Thursday, a draft of the rules was formally adopted by the National Science Advisory Board for Biosecurity, or NSABB, at a meeting in Bethesda, Maryland. The draft proposes voluntary compliance by scientists, universities and journals, but leaves open the possibility of federal legislation to turn the guidelines into law. Indeed, it almost invites that result by supporting application of the NSABB recommendations to researchers that do not receive federal funds -- a result that can only be achieved through regulation. As a lawyer for computer security researchers, it is impossible to regard this prospect with anything but dread. For example, the proposal (.pdf) broadly defines "dual use research of concern" as any "research that, based on current understanding, can be reasonably anticipated to provide knowledge, products, or technologies that could be directly misapplied by others to pose a threat to public health and safety, agriculture, plants, animals, the environment, or materiel." That's a perfectly reasonable description of an article or paper worth a closer look before publication. But if this language becomes a statute that prohibits publication under some circumstances, the author risks criminal prosecution if law enforcement disagrees with a scientist, university or peer-review publication's decision that the research should be published. And, legally, I'd find it extremely difficult to advise the author with any certainty whether publishing the research is lawful or not. Whose "current understanding" applies? What does "reasonably anticipated" mean? When is research "directly" misapplied, or merely indirectly used? How much of a risk "poses a threat"? The NSABB draft also sets out a procedure to follow once a scientist has identified research of concern. Instead of outright suppression in every case, the proposal suggests a risk/benefit analysis, which can result in a variety of options for communicating the research to the public. This seems flexible and case-specific, which again, is great in a guideline, but terrible when you are trying to advise a client how to avoid the risk of jail. We know that reasonable scientists can and do disagree about these things. What do prosecutors, judges and juries think? Rejecting new regulation doesn't mean we have to be subject to the whims of bioterrorists. Voluntary self-regulation, ethical training, peer review and additional practices currently followed by recombinant DNA researchers, microbiologists and other scientists all have a track record of success. And smart federal laws can control access to pathogens -- and prohibit dangerous practices -- while steering clear of restricting scientific publications. Until recently, U.S. policy has been to allow the publication of information, with only narrow controls on classified information. Then, in 2002, the president signed the National Security Act, which requires federal agencies to create procedures to protect "sensitive but unclassified" knowledge. The statute is unclear about whether these procedures should take the form of voluntary guidelines, or regulations with the force of law, and whether they'll apply outside of federal agencies. But the NSABB report appears to be part of the effort to craft such procedures. The scientists on the board have good reasons for wanting to be involved in crafting the guidelines. They want to stop terrorists, and they take the dangers from dual-use research seriously. They also want to protect the scientific process, and they believe correctly that if regulation is going to happen, it would be much, much better if scientists were involved. Once such scientist is NSABB board member David A. Relman, M.D., associate professor of medicine, microbiology and immunology at Stanford University School of Medicine. He told me about a 2004 addition to federal law which criminalizes possession of the smallpox virus. Unfortunately, the statute defines the pathogen as any virus that contains 85 percent or greater sequence similarity to smallpox, effectively outlawing a whole range of pox viruses, including the smallpox vaccine. The maximum penalty for violating the law is a fine of $2 million dollars and 25 years in prison. Doctor Relman views his role on the NSABB as helping the government avoid a similar kind of mistake in the future. He and his colleagues are doing us a service by participating, but they have to be extremely careful that their work is not used to legitimize regulation. Any guidelines should be crystal clear that they are good only as that -- guidelines. If the NSABB is not careful, its well-balanced recommendations may become a precursor for abandoning voluntary self-regulation in favor of federal regulation of scientists. Once we have regulations, we will also have penalties for non-compliance. At that point, the only question left will be how much scientific self-determination remains. - - - Jennifer Granick is executive director of the Stanford Law School Center for Internet and Society and teaches the Cyberlaw Clinic. ------------------------------------------- Archives: http://v2.listbox.com/member/archive/247/=now RSS Feed: http://v2.listbox.com/member/archive/rss/247/ Powered by Listbox: http://www.listbox.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[IP] Will Bioterror Fears Spawn Science Censorship?
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

Re: [ZS] Re: Quantified Prestige (was Two Criticisms)
by Bryce Lynch 06 Jul '18

06 Jul '18

A little searching of my mail queue didn't show that this link was posted recently. There was a TED talk on reputation economics that might be of interest to a few people in this thread: http://www.ted.com/talks/rachel_botsman_the_currency_of_the_new_economy_is_… Also, openhatch.org and coderwall.com. -- The Doctor [412/724/301/703] [ZS|Media] https://drwho.virtadpt.net/ "I am everywhere." -- -- Zero State mailing list: http://groups.google.com/group/DoctrineZero ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0