- cypherpunks-legacy - lists.cpunks.org

[btns] RFC 5660 on IPsec Channels: Connection Latching
by rfc-editor＠rfc-editor.org 06 Jul '18

06 Jul '18

A new Request for Comments is now available in online RFC libraries. RFC 5660 Title: IPsec Channels: Connection Latching Author: N. Williams Status: Standards Track Date: October 2009 Mailbox: Nicolas.Williams(a)sun.com Pages: 31 Characters: 74209 Updates/Obsoletes/SeeAlso: None I-D Tag: draft-ietf-btns-connection-latching-11.txt URL: http://www.rfc-editor.org/rfc/rfc5660.txt This document specifies, abstractly, how to interface applications and transport protocols with IPsec so as to create "channels" by latching "connections" (packet flows) to certain IPsec Security Association (SA) parameters for the lifetime of the connections. Connection latching is layered on top of IPsec and does not modify the underlying IPsec architecture. Connection latching can be used to protect applications against accidentally exposing live packet flows to unintended peers, whether as the result of a reconfiguration of IPsec or as the result of using weak peer identity to peer address associations. Weak association of peer ID and peer addresses is at the core of Better Than Nothing Security (BTNS); thus, connection latching can add a significant measure of protection to BTNS IPsec nodes. Finally, the availability of IPsec channels will make it possible to use channel binding to IPsec channels. [STANDARDS TRACK] This document is a product of the Better-Than-Nothing Security Working Group of the IETF. This is now a Proposed Standard Protocol. STANDARDS TRACK: This document specifies an Internet standards track protocol for the Internet community,and requests discussion and suggestions for improvements. Please refer to the current edition of the Internet Official Protocol Standards (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited. This announcement is sent to the IETF-Announce and rfc-dist lists. To subscribe or unsubscribe, see http://www.ietf.org/mailman/listinfo/ietf-announce http://mailman.rfc-editor.org/mailman/listinfo/rfc-dist For searching the RFC series, see http://www.rfc-editor.org/rfcsearch.html. For downloading RFCs, see http://www.rfc-editor.org/rfc.html. Requests for special distribution should be addressed to either the author of the RFC in question, or to rfc-editor(a)rfc-editor.org. Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution. The RFC Editor Team USC/Information Sciences Institute _______________________________________________ btns mailing list btns(a)ietf.org https://www.ietf.org/mailman/listinfo/btns ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[Politech] Replies to Hiawatha Bray's response, and whether the law is really the law after all [fs]
by Declan McCullagh 06 Jul '18

06 Jul '18

Previous Politech messages: http://www.politechbot.com/2006/05/22/hiawatha-brays-response/ http://www.politechbot.com/2006/05/22/perry-metzgers-call/ -------- Original Message -------- Subject: Re: [Politech] Hiawatha Bray's response on wiretapping of journalists: the law's the law [fs] Date: Mon, 22 May 2006 23:31:36 -0500 From: Andy Ringsmuth <andyring(a)inebraska.com> To: Declan McCullagh <declan(a)well.com> References: <447282E6.3060804(a)well.com> >From the original article: It can be argued by some who do not agree with me that the reporters in question are somehow "helping the terrorists" by revealing things like the fact that the US Government has SigInt operations, but in fact anyone who isn't an idiot already knows we have SigInt operations. What the reporters have done -- heroically, I might add -- is reveal that the government has far exceeded the bounds of legality in performing such operations, even when legal methods existed to gain the same information. Declan, One thing that routinely irks me about the media today is the increasing trend towards editorializing in the news, particularly when what is said is false. Perry Metzger says that "the government has far exceeded the bounds of legality in performing such operations" and says it as if it were fact. I don't know if Metzger is a journalist or not, I will admit. In truth, however, while there are some cases pending in various courts and maybe a Senate investigation in the works, at this juncture any claim as to whether or not the government has broken the law is just that - a claim, and thus not fact. It may well be Metzger's opinion that the government broke the law, but until that has been proven or disproven in a court of law, it is merely an allegation and nothing more. I routinely see politicians and even the media referring to this stuff in terms like "the illegal wiretapping issue" or "the illegal NSA wiretapping," etc. Whether or not a law has been broken is for a COURT to decide, not a politician or a journalist. It seems to me that as journalists word things like they do, it is a subtle but gross indication of their political bias, and thus a terrible disservice as they mislead (intentional or otherwise) their readers/ viewers. Brian Ross and Richard Esposito get it right in their blog, as they don't state allegations as fact. Hiawatha Bray is correct in stating that " it's illegal for journalists to knowingly publish classified information" as that is a statement of fact. But if Bray were to say that "Scooter Libby illegally leaked Valerie Plame's identity" it would be false. An accurate statement would be "Scooter Libby allegedly leaked...." There is a big difference there. Similarly, if Metzger had said "it is alleged that the government has far exceeded the bounds of legality in performing such operations" or "Some say the government has far exceeded..." that would be legit. But to consider one's self to be judge and jury just isn't right. Respectfully, -Andy Ringsmuth andyring(a)inebraska.com (OK to display my e-mail address if this makes it to your Politech list) -------- Original Message -------- Subject: Re: [Politech] Hiawatha Bray's response on wiretapping of journalists: the law's the law [fs] Date: Mon, 22 May 2006 21:35:25 -0700 (MST) From: terry(a)terrybressi.org To: declan(a)well.com Rubbish. Exactly what part of the First Amendment phrase, "Congress shall make no law..." does Mr. Bray not fully grasp? While Congress may have the legitimate authority to prohibit government employees from leaking classified information, it most certainly doesn't have the legitimate authority to make it a crime for the press to publish or report on classified information. Indeed, if Congress could pass such a law, there would be little to stop the federal government from unconstitutionally spying on the American people and making evidence of such an act classified in order to cover-up the government's malfeasance. Perhaps Mr. Bray should avail himself of a remedial class in Civics 101 so as to better understand the checks and balances that exist within a Constitutional Republic such as ours. Terry Bressi -------- Original Message -------- Subject: Hiawatha Bray's Javertism Date: Tue, 23 May 2006 00:40:50 -0500 From: Jim Davidson <davidson(a)net1.net> Reply-To: davidson(a)net1.net To: Declan McCullagh <declan(a)well.com> CC: watha2020(a)fusemail.com References: <447282E6.3060804(a)well.com> Dear Declan, It is a bit surprising to see the despicable words of Inspector Javert from _Les Miserables_ repeated by a reporter such as Hiawatha Bray. "The law's the law!" Yes, sure, and the camp guards were only doing their jobs, the train drivers weren't told where their human cargo was going, and nobody said what the fork lifts were for. After all, the nationalist socialist workers party of Germany members were only following orders. In fact the law, whether it is from 1917 or 1950 is a law that Congress had no authority to pass. The superceding text is very clear, even to that arch-fool Alberto: "Congress shall make no law ... abridging the freedom of speech, or of the press...." from the Bill of Rights, Article One. The Supreme Court has repeatedly ruled that any law passed by Congress which is unconstitutional is null on its face and void. Therefore, there is no law against publishing anything, including secrets of the government, including the embarrassing fact that White House officials have blabbed to reporters all kinds of national secrets. Mr. Alberto Gonzales is a traitor to the constitution he swore an oath to defend. He knows that no law abridging the freedom of the press is valid, and he ought to be ashamed of himself. He also ought to be impeached, convicted of treason by a court of competent jurisdiction, and executed. Even pretending he has the authority to enforce a law abridging freedom of the press makes the man a menace to American values, an oath breaker, and, as a result of his willful oath breaking, a traitor. Chilling freedom of the press by threatening to enforce an invalid and unconstitutional law gives aid and comfort to the enemies of the United States and the enemies of freedom. Violating the First Amendment is a high crime. Treason ought not to be excused lightly. Treason against our fundamental values, against the tradition of a free press which made this country possible, is so disgusting that no lesser sentence than death could be appropriate. Regards, Jim -------- Original Message -------- Subject: Re: [Politech] Hiawatha Bray's response on wiretapping of journalists: the law's the law [fs] Date: Tue, 23 May 2006 00:36:38 -0400 From: Chris Beck <cbeck(a)pacanukeha.net> Organization: None At All To: Declan McCullagh <declan(a)well.com>, Hiawatha Bray <watha2020(a)fusemail.com> References: <447282E6.3060804(a)well.com> They say Declan McCullagh, on or about 22.May.2006 23:35, whispered: > reporters. Still, the law's the law, and reporters are bound to it like > everybody else. Until the law is found to be unconstitutional or in conflict with another law. Besides, the implication is that the tracking is being done by the NSA. I would have thought it was the FBI's responsibility to investigate criminal leaks. My own personal feeling is that it should not be possible for criminal actions to be deemed classified. Cheers, Chris -- Chris Beck - http://pacanukeha.wordpress.com The sad fact is that "national security" has become the root password to the Constitution. -- Phil Karn -------- Original Message -------- Subject: Re: [Politech] Perry Metzger's call to action on Feds' lawlessness, tapping [priv] Date: Mon, 22 May 2006 23:37:04 -0600 From: Daniel Webb <daniel(a)danielwebb.us> To: Declan McCullagh <declan(a)well.com> References: <447282E6.3060804(a)well.com> <20060522174208.C1628(a)baltwash.com> > Nonsense. As a journalist, I don't much like the idea. But anybody who's > leaking classified data to reporters is in violation of the law. And it's > perfectly legal for the government to tap the phones of suspected > lawbreakers inside the intelligence community. In addition, it's illegal > for journalists to knowingly publish classified information, according to a > law passed back in 1950. I hope that provision is never enforced; I don't > think the administration wants to enforce it. After all, they need only > nail the leakers and thus avoid opening a huge can of worms by arresting > reporters. Still, the law's the law, and reporters are bound to it like > everybody else. Two points: 1) The government should simply make a law that revealing government lawbreaking is itself a serious crime, perhaps appending it to the treason statute. I am quite confident that within my lifetime this will happen. I assume you will not support such a law, but will you violate it? Will you still say "the law's the law, and everybody has to follow it?" 2) Reading his message as a whole, I think the fear being described by Mr. Metzger is not so much legitimate phone tapping and warrants, but the wholesale and illegal surveillance going on now. For example, assume a reporter can now be identified any time after the fact because the NSA is keeping phone logs of every phone call made in the United States. Once identified, "legitimate" warrants can be used to gain information used against them in court. This is the fear I have: that we will create a system where Constitutional protections still exist on paper, but are meaningless in practice. I believe that will be the result of the fourth amendment if the current administration gets away with breaking the law. Bush broke the law and is still breaking the law. Everyone involved with that operation should be prosecuted, yet they are boldly defiant and calling for the heads of those brave enough to out them breaking the law. So pardon me if I don't see blind devotion to the law as the highest ideal in this case, especially when the law is only applied to those who criticise the government and not the government itself. Daniel Webb -------- Original Message -------- Subject: Re: [Politech] Hiawatha Bray's response on wiretapping of journalists: the law's the law [fs] Date: Mon, 22 May 2006 22:41:50 -0700 From: Thomas Leavitt <thomas(a)thomasleavitt.org> Organization: Godmoma's Forge, LLC To: Declan McCullagh <declan(a)well.com> References: <447282E6.3060804(a)well.com> Declan, The law is owed respect exactly to the point at which it becomes immoral and dangerous to do so - the world is full of bad and immoral laws which deserve nothing but contempt. A bad law is a bad law. Period. It is a hoary example, but there were plenty of "laws" in the South that journalists (and others) were "bound" to observe, that people knowingly and deliberately broke because they were unjust and unwise. There's a reason why there are laws that attempt to protect whistle blowers, and there's a reason why, traditionally, journalists enjoy a certain amount of immunity from revealing their sources - even the ones who are engaged in illegal acts: the benefit to the public of having access to the truth, in this case, of having a counter-balance to an arrogant and over-reaching executive, exceeds the costs to the society associated with failure to prosecute those revealing the secrets. Really, does the idea of a government that is *successfully* able to seal all leaks, to track down and prosecute and punish any and all individuals who reveal information that such a government prefers to not have revealed, does this make anyone happy? Would you feel safer in your bed at night, if you knew the rulers of this country were pretty much free to proceed at will with whatever plans they cared to execute? Absolute power corrupts absolutely. A governmental administration effectively able to act without fear of exposure by those who disagree with policies as laid out and implemented, especially in the case of secrecy, is inevitably going to over-reach and threaten the liberty of the citizens it governs. It is inherent in human nature, individually, and collectively. We already have a huge and growing and more or less truly secret and almost completely unaccountable government... $40 billion dollars a year (that we know of), the entire budget of a small nation... more than all but a few countries combined spend on national defense... don't we, as citizens, deserve to have at least a theoretical opportunity to learn when and if improprieties of any sort, however embarassing, and even if potentially threatening to national security in some fashion, are being engaged in? Is the nation better off for having Abu Gharib exposed? One could argue that our national security has been undermined by that event... but how much greater the threat, if that cancer had grown on, unabated, only to be revealed at a later point... or to infect the forces of law and order in our own country? ... setting aside the moral stain that settles on all of us, a citizens of a country that engages in torture. I would argue that, in point of fact, we have a moral obligation to conscientiously violate and disrespect and disempower immoral, unjust and unwise laws, and to express our contempt for them and our strong desire to see them invalidated or erased from the books. A whistle blower passing along secret and classified information that implicates any element of our government in immoral or illegal or just plain unwise acts is a hero, not a criminal. To put it in stark terms: if the CIA were to be engaged in a plot, authorized by the President himself and senior members of Congress, to explode a small tactical nuclear weapon in Tehran, designed to take out a large chunk of that government's ruling powers, and a whistle blower were to supply Seymour Hersh with all the details and they went up on the web minutes later, and such a publication "blew" the operation and lead to the deaths of several of the operatives and the virtual destruction of our intelligence network in Tehran and surrounding areas, there would be absolutely no doubt that, in a very real sense, our national security had been severely compromised. At the same time, one could (and I would, personally) argue that revealing this information would be an act of public service of the highest merit and the leaker to be a hero, and that in the long run, our national security had been vastly enhanced, rather than degraded. But, perhaps I'm too much of a cynic, perhaps I've been watching too much Star Trek, find the proposition that our government could over reach its bounds or be corrupted from within or that elements of it could put their own interests ahead of the nations far more realistic a proposition than is justified. But again, I ask: if the government was able to act without the slightest fear of "leaks", if each and every "leak" were instantly and ruthlessly hunted down and crushed, and any publication or forwarding of such information was suppressed and severely punished... would any of us fell safer in our beds at night? Regards, Thomas Leavitt -------- Original Message -------- Subject: Re: [Politech] Hiawatha Bray's response on wiretapping of journalists: the law's the law [fs] Date: Tue, 23 May 2006 01:52:48 -0400 (EDT) From: Dean Anderson <dean(a)av8.com> To: Declan McCullagh <declan(a)well.com> On Mon, 22 May 2006, Declan McCullagh wrote: > Previous Politech message: > Nonsense. As a journalist, I don't much like the idea. But anybody who's > leaking classified data to reporters is in violation of the law. And it's > perfectly legal for the government to tap the phones of suspected > lawbreakers inside the intelligence community. In addition, it's illegal > for journalists to knowingly publish classified information, according to a > law passed back in 1950. I hope that provision is never enforced; I don't > think the administration wants to enforce it. After all, they need only > nail the leakers and thus avoid opening a huge can of worms by arresting > reporters. Still, the law's the law, and reporters are bound to it like > everybody else. I'm not a trained journalist. But I am a consumer of the products of journalism. The public doesn't have the CIA to find out facts. But we need information to make decisions. The collective "free press" provides that information: Like the CIA, they have to engage in a few "covert ops" to obtain information. As someone just recently pointed out on a TV talk show (didn't get their name), nearly everything the CIA does abroad is a violation of the host countries' laws. Spying is illegal in nearly every country. The public needs to know the truth, and needs to have access to facts in order to make decisions that are essential to Democracy. I agree that the law is the law. I rather identify with John Adams, who was greatly disturbed the by the French Revolution because it seemed to be anarchy, a destruction of the rule of law. In contrast, though Adams was a revolutionary, he was not an anarchist. I think the law in this case is meant to protect against harms to national security. The rub is what is "national security"? I argue that making newsworthy information public does not harm the national security. The publishing of the Pentagon Papers did no harm to the national security. Rather, this act greatly helped the national security. The exposure of Watergate brought down the President, but it did not harm the national security. Nor did the exposure harm the Presidency. The harm was caused by Nixon and his aides. The exposure was in the interest of national security. Likewise, I've seen nothing revealed so far that has been harmful to the national security, and I read the New York Times every day, frequently read the Boston Globe, and more occasionally the Wall Street Journal. The "National Security" is not "that which makes Bush and Company look good". It is that which makes the public actually secure in their liberties, and protects Democracy, which is public control of the government. I was greatly moved by Moussaoui's response to the families of the victims. After the families testified what pain he had caused, he took the stand to respond about the pain and death the US had caused abroad. I've just read "Rogue State" by William Blum. Engaging in secret wars for the benefit of US corporate profits is a terrible vulture that will come home to rest. In today's New York Times, Ted Koppel argues for (or perhaps alerts us to) the possibility that Corporations should be allowed to hire their own mercenaries to fight their battles and protect their foreign interests. I suspect that in fact, Corporations already do operate mercenary armies, and have for a long time. Last year, Margaret Thatcher's son was arrested in Zimbabwe for leading a mercenary army to overthrow the Central African Republic. Why? Oil seems likely. [There is a new oil pipeline in Chad, and there is Oil in Darfur, which also puts the "genocide" in a different light. Just look at the map and follow the Oil.] Exposing these misdeeds is in the national interest, and promotes national security and democratic public control of government. The acts of reporters have not been to sell secrets to the Chinese, or to terrorists for that matter. The acts have been to make relevant facts public. Facts which are relevant to the public discourse, and to the right of the public to have the information it needs to make decisions. Anything else is not a Democracy. The goal of national security is to preserve the Democracy, not the Presidency. Or even the President. Just as the Secret Service should take a bullet to protect the President, the President (and everyone below him) may need to put their own life and future at risk to protect the Democracy. That is what they swore an oath to protect: To protect and defend the Constition, not their own butts. Any classified information that essentially puts their "butts to the fire" probably better serves the national security by publication than by secrecy. I am a strong proponent of rule by law. But I think the lawfulness of this publication of classified information is rather similar to the notion of justifiable homicide, or perhaps trespass in public necessity. In tort law there is a defense against trespass called "Privileged Invasion of Another's Land or Chattels as a Public Necessity". Essentially, it means there are circumstances when trespass is necessary to avert a disaster, or because a highway is obstructed. Of course, the media is generally excluded in this, so perhaps it isn't a good example. But I think the lack of relevent information could create a public disaster. Indeed, I think the Iraq War (and perhaps the Vietnam War), was a public disaster caused by lack of public information. In Vietnam, the government repeatedly told the public that "we know things, and we're doing the right thing". We now know what it was they knew, and they didn't know anything then that would have made their decisions correct. National security would plainly have been better served by having that information made public. Sometimes there are good and just reasons to break the law. I absolutely see that its a hard call in a gray area. A call that, correctly made, distinguishes the professionals from the amateurs. But that's why we have professional journalists, and that's why we have judges and juries, and not robots. Freedom isn't risk free. For anyone, journalists included. --Dean -- Av8 Internet Prepared to pay a premium for better service? www.av8.net faster, more reliable, better service 617 344 9000 _______________________________________________ Politech mailing list Archived at http://www.politechbot.com/ Moderated by Declan McCullagh (http://www.mccullagh.org/) ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[bitcoin-list] Bitcoin 0.3.14 is released
by theymos 06 Jul '18

06 Jul '18

http://www.bitcoin.org/smf/index.php?topic=1528.0 Version 0.3.14 is now available http://sourceforge.net/projects/bitcoin/files/Bitcoin/bitcoin-0.3.14/ Changes: - Key pool feature for safer wallet backup Gavin Andresen: - TEST network mode with switch -testnet - Option to use SSL for JSON-RPC connections on unix/osx - validateaddress RPC command eurekafag: - Russian translation --- More info about the key pool feature: http://www.bitcoin.org/smf/index.php?topic=1414.0 Now you only have to back up after every 100 sends, new addresses, generations, or transactions received by IP address. More info about RPC SSL: http://www.bitcoin.org/wiki/doku.php?id=rpcssl ------------------------------------------------------------------------------ Nokia and AT&T present the 2010 Calling All Innovators-North America contest Create new apps & games for the Nokia N8 for consumers in U.S. and Canada $10 million total in prizes - $4M cash, 500 devices, nearly $6M in marketing Develop with Nokia Qt SDK, Web Runtime, or Java and Publish to Ovi Store http://p.sf.net/sfu/nokia-dev2dev _______________________________________________ bitcoin-list mailing list bitcoin-list(a)lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/bitcoin-list ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[btns] RFC 5660 on IPsec Channels: Connection Latching
by rfc-editor＠rfc-editor.org 06 Jul '18

06 Jul '18

A new Request for Comments is now available in online RFC libraries. RFC 5660 Title: IPsec Channels: Connection Latching Author: N. Williams Status: Standards Track Date: October 2009 Mailbox: Nicolas.Williams(a)sun.com Pages: 31 Characters: 74209 Updates/Obsoletes/SeeAlso: None I-D Tag: draft-ietf-btns-connection-latching-11.txt URL: http://www.rfc-editor.org/rfc/rfc5660.txt This document specifies, abstractly, how to interface applications and transport protocols with IPsec so as to create "channels" by latching "connections" (packet flows) to certain IPsec Security Association (SA) parameters for the lifetime of the connections. Connection latching is layered on top of IPsec and does not modify the underlying IPsec architecture. Connection latching can be used to protect applications against accidentally exposing live packet flows to unintended peers, whether as the result of a reconfiguration of IPsec or as the result of using weak peer identity to peer address associations. Weak association of peer ID and peer addresses is at the core of Better Than Nothing Security (BTNS); thus, connection latching can add a significant measure of protection to BTNS IPsec nodes. Finally, the availability of IPsec channels will make it possible to use channel binding to IPsec channels. [STANDARDS TRACK] This document is a product of the Better-Than-Nothing Security Working Group of the IETF. This is now a Proposed Standard Protocol. STANDARDS TRACK: This document specifies an Internet standards track protocol for the Internet community,and requests discussion and suggestions for improvements. Please refer to the current edition of the Internet Official Protocol Standards (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited. This announcement is sent to the IETF-Announce and rfc-dist lists. To subscribe or unsubscribe, see http://www.ietf.org/mailman/listinfo/ietf-announce http://mailman.rfc-editor.org/mailman/listinfo/rfc-dist For searching the RFC series, see http://www.rfc-editor.org/rfcsearch.html. For downloading RFCs, see http://www.rfc-editor.org/rfc.html. Requests for special distribution should be addressed to either the author of the RFC in question, or to rfc-editor(a)rfc-editor.org. Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution. The RFC Editor Team USC/Information Sciences Institute _______________________________________________ btns mailing list btns(a)ietf.org https://www.ietf.org/mailman/listinfo/btns ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[bitcoin-list] Bitcoin 0.3.14 is released
by theymos 06 Jul '18

06 Jul '18

http://www.bitcoin.org/smf/index.php?topic=1528.0 Version 0.3.14 is now available http://sourceforge.net/projects/bitcoin/files/Bitcoin/bitcoin-0.3.14/ Changes: - Key pool feature for safer wallet backup Gavin Andresen: - TEST network mode with switch -testnet - Option to use SSL for JSON-RPC connections on unix/osx - validateaddress RPC command eurekafag: - Russian translation --- More info about the key pool feature: http://www.bitcoin.org/smf/index.php?topic=1414.0 Now you only have to back up after every 100 sends, new addresses, generations, or transactions received by IP address. More info about RPC SSL: http://www.bitcoin.org/wiki/doku.php?id=rpcssl ------------------------------------------------------------------------------ Nokia and AT&T present the 2010 Calling All Innovators-North America contest Create new apps & games for the Nokia N8 for consumers in U.S. and Canada $10 million total in prizes - $4M cash, 500 devices, nearly $6M in marketing Develop with Nokia Qt SDK, Web Runtime, or Java and Publish to Ovi Store http://p.sf.net/sfu/nokia-dev2dev _______________________________________________ bitcoin-list mailing list bitcoin-list(a)lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/bitcoin-list ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [cryptography] OTR and deniability
by Ian G 06 Jul '18

06 Jul '18

On 14/07/11 12:37 PM, Ai Weiwei wrote: > Hello list, > > Recently, Wired published material on their website which are claimed to be logs of instant message conversations between Bradley Manning and Adrian Lamo in that infamous case. [1] I have only casually skimmed them, but did notice the following two lines: > > (12:24:15 PM) bradass87 has not been authenticated yet. You should authenticate this buddy. > (12:24:15 PM) Unverified conversation with bradass87 started. > > I'm sure most of you will be familiar; this is evidence that a technology known as Off-the-Record Messaging (OTR) [2] was used in the course of these alleged conversations. > > I apologize if this is off topic or seems trivial, but I think a public discussion of the merits (or lack thereof) of these alleged "logs" from a technical perspective would be interesting. I believe it is germane to anyone designing crypto protocols to understand how they actually impact in user-land. This particular one is a running sore for me because of its outrageous claim of deniability. > The exact implications of the technology may not be very well known beyond this list. I have carbon copied this message to the defense in the case accordingly. > > If I understand correctly, OTR provides deniability, which means that these alleged "logs" cannot be proven authentic. The *claim made by OTR is to provide technological deniability* as opposed to any non-technological status. Its non-technical deniability is zilch. Unfortunately, outside the technology, it is trivial to prove the logs as authentic. This is confusing for the technologists as they are trying to create a perfect security product, and they believe that technology rules. What they've failed to realise is that real life provides some trivial bypasses, and in this situation, they may very well be creating more harm -- by sucking people into a false sense of security. Design of security systems is tough, it is essential to include the human elements in the protocol, elsewise we end up with elegant but useless features. Sometimes we enter into danger, as is seen with OTR or BitCoin, where a technological elegance causes people to lose their common sense and grasp of reality. > In fact, the OTR software is distributed with program code which makes falsifying such "logs" trivial. Is this correct? Dunno. Could be. Evidence of a false sense of security, to me. > What do you think? .... On the specific legal case: well, nothing we see in open press will really be reliable. You're looking at the USG going for broke against a couple of lonely mixed up people who USG mistakenly let near a TS site. It will be a total mess. Mincemeat, fubar, throw away the key. The case will see all sorts of mud thrown up, with both sides trying their darndest to muddy the waters. >From the external pov, there will be no clarity. Nothing really to say or think, except, ... don't make that mistake? Relying on crypto blahblah promises like OTR or PGP when you're about to release a wikileaks treasure trove doesn't sound like rational thinking to me. iang _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [tor-talk] on the topic of tor's weaknesses
by Paul Syverson 06 Jul '18

06 Jul '18

On Wed, Feb 29, 2012 at 05:17:34AM -0500, grarpamp wrote: > > The main problem, besides the overhead, is that padding doesn't work > > if an adversary can do something as trivial as very briefly delaying > > It is too easy for an adversary to put a traffic signature on a > > circuit in one place, and look for it elsewhere. If he owns, e.g., the > > first node and any of the last node, the link to the destination, or > > the destination it won't matter what kind of padding is done. There's > > lots of published work showing this in various ways. Some already > > alluded to in this thread. If nothing else the adversary can just kill > > the connection at the first node and see which connection exiting the > > network dies. > > Doesn't this mean bad news for users of hidden services, Maybe. The important thing is to understand what security is provided and what is not. Then you can make an informed decision about whether or not it's bad news. > and to a > lesser extent clearnet services (since they're not as 'illegal' and thus > maybe lesser hot targets for snagging users). IE: > > Sting runs a HS and an entry. Thus Sting has full packets, timing, > cleartext and logs of anyone that builds: clientA <> entry <---> HS > > There may even be these additional structures to the left of clientA's > entry, for which the role of entry may switch to relay or exit, but for > which entry may be still able to discriminate among on its left... > clientB > clientC <> relay > clientD [...] <> relay <> relay [...] > > It may take a while for a clientA to use said entry but when they do it seems > it would be quite easy to time/count correlate or munge the HS traffic of > clientA. And only require two nodes (hs, entry) and no GPA taps to do so. > > Can such an entry know when it's being used as an entry by > whatever appears to it's left? I think that is what I describe > relies on. The short but incomplete answer is yes. Generally, what you are describing we experimentally verified on the live Tor network back in 2005. See "Locating Hidden Servers" by Lasse Overlier and myself. Available at http://freehaven.net/anonbib/ or http://www.onion-router.net/Publications.html These sorts of attacks are what motivated us to introduce guard nodes, also described in that paper. We all knew, and had seen analyzed in earlier work by Wright et al., that onion routing circuits were subject to predecessor attacks, and that what Wright et al. had called helper nodes would, well help. What Lasse and I showed was that the public Tor network as of 2005 was subject to such attacks working very quickly (minutes) using very limited resources. You could generally find a hidden server within minutes using just a single hostile Tor relay (no cooperation from evil web server required). We wanted to show what you could do with a single relay, which limited us to hidden server circuits. If you owned at least two relays, you could attack arbitrary Tor circuits. This was confirmed in simulation on PlanetLab shortly after by Bauer et al. ("Low-Resource Routing Attacks Against Tor", also available at anonbib). Entry guards don't change the asymptotic threat of such attacks, they just move it around. Since you could be screwed so quickly and easily by building random circuits, Tor was changed so that you pick just a few relays as your entry guards. If one of them is evil, it will see the entry side of (a large fraction of) your circuits and will be able to associate you with your destination whenever you go to a hostile destination or use a hostile exit. What Lasse and I showed was that you weren't really much worse off from this than when choosing circuits with random entry relays. And if none of your guards is evil, an adversary can never de-anonymize you in this way. (Never say "never". ;>) Cf. the experiments and discussion of layered guards in "Locating Hidden Servers", and our subsequent research on building trust into path selection.) aloha, Paul _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[Politech] Replies to Hiawatha Bray's response, and whether the law is really the law after all [fs]
by Declan McCullagh 06 Jul '18

06 Jul '18

Previous Politech messages: http://www.politechbot.com/2006/05/22/hiawatha-brays-response/ http://www.politechbot.com/2006/05/22/perry-metzgers-call/ -------- Original Message -------- Subject: Re: [Politech] Hiawatha Bray's response on wiretapping of journalists: the law's the law [fs] Date: Mon, 22 May 2006 23:31:36 -0500 From: Andy Ringsmuth <andyring(a)inebraska.com> To: Declan McCullagh <declan(a)well.com> References: <447282E6.3060804(a)well.com> >From the original article: It can be argued by some who do not agree with me that the reporters in question are somehow "helping the terrorists" by revealing things like the fact that the US Government has SigInt operations, but in fact anyone who isn't an idiot already knows we have SigInt operations. What the reporters have done -- heroically, I might add -- is reveal that the government has far exceeded the bounds of legality in performing such operations, even when legal methods existed to gain the same information. Declan, One thing that routinely irks me about the media today is the increasing trend towards editorializing in the news, particularly when what is said is false. Perry Metzger says that "the government has far exceeded the bounds of legality in performing such operations" and says it as if it were fact. I don't know if Metzger is a journalist or not, I will admit. In truth, however, while there are some cases pending in various courts and maybe a Senate investigation in the works, at this juncture any claim as to whether or not the government has broken the law is just that - a claim, and thus not fact. It may well be Metzger's opinion that the government broke the law, but until that has been proven or disproven in a court of law, it is merely an allegation and nothing more. I routinely see politicians and even the media referring to this stuff in terms like "the illegal wiretapping issue" or "the illegal NSA wiretapping," etc. Whether or not a law has been broken is for a COURT to decide, not a politician or a journalist. It seems to me that as journalists word things like they do, it is a subtle but gross indication of their political bias, and thus a terrible disservice as they mislead (intentional or otherwise) their readers/ viewers. Brian Ross and Richard Esposito get it right in their blog, as they don't state allegations as fact. Hiawatha Bray is correct in stating that " it's illegal for journalists to knowingly publish classified information" as that is a statement of fact. But if Bray were to say that "Scooter Libby illegally leaked Valerie Plame's identity" it would be false. An accurate statement would be "Scooter Libby allegedly leaked...." There is a big difference there. Similarly, if Metzger had said "it is alleged that the government has far exceeded the bounds of legality in performing such operations" or "Some say the government has far exceeded..." that would be legit. But to consider one's self to be judge and jury just isn't right. Respectfully, -Andy Ringsmuth andyring(a)inebraska.com (OK to display my e-mail address if this makes it to your Politech list) -------- Original Message -------- Subject: Re: [Politech] Hiawatha Bray's response on wiretapping of journalists: the law's the law [fs] Date: Mon, 22 May 2006 21:35:25 -0700 (MST) From: terry(a)terrybressi.org To: declan(a)well.com Rubbish. Exactly what part of the First Amendment phrase, "Congress shall make no law..." does Mr. Bray not fully grasp? While Congress may have the legitimate authority to prohibit government employees from leaking classified information, it most certainly doesn't have the legitimate authority to make it a crime for the press to publish or report on classified information. Indeed, if Congress could pass such a law, there would be little to stop the federal government from unconstitutionally spying on the American people and making evidence of such an act classified in order to cover-up the government's malfeasance. Perhaps Mr. Bray should avail himself of a remedial class in Civics 101 so as to better understand the checks and balances that exist within a Constitutional Republic such as ours. Terry Bressi -------- Original Message -------- Subject: Hiawatha Bray's Javertism Date: Tue, 23 May 2006 00:40:50 -0500 From: Jim Davidson <davidson(a)net1.net> Reply-To: davidson(a)net1.net To: Declan McCullagh <declan(a)well.com> CC: watha2020(a)fusemail.com References: <447282E6.3060804(a)well.com> Dear Declan, It is a bit surprising to see the despicable words of Inspector Javert from _Les Miserables_ repeated by a reporter such as Hiawatha Bray. "The law's the law!" Yes, sure, and the camp guards were only doing their jobs, the train drivers weren't told where their human cargo was going, and nobody said what the fork lifts were for. After all, the nationalist socialist workers party of Germany members were only following orders. In fact the law, whether it is from 1917 or 1950 is a law that Congress had no authority to pass. The superceding text is very clear, even to that arch-fool Alberto: "Congress shall make no law ... abridging the freedom of speech, or of the press...." from the Bill of Rights, Article One. The Supreme Court has repeatedly ruled that any law passed by Congress which is unconstitutional is null on its face and void. Therefore, there is no law against publishing anything, including secrets of the government, including the embarrassing fact that White House officials have blabbed to reporters all kinds of national secrets. Mr. Alberto Gonzales is a traitor to the constitution he swore an oath to defend. He knows that no law abridging the freedom of the press is valid, and he ought to be ashamed of himself. He also ought to be impeached, convicted of treason by a court of competent jurisdiction, and executed. Even pretending he has the authority to enforce a law abridging freedom of the press makes the man a menace to American values, an oath breaker, and, as a result of his willful oath breaking, a traitor. Chilling freedom of the press by threatening to enforce an invalid and unconstitutional law gives aid and comfort to the enemies of the United States and the enemies of freedom. Violating the First Amendment is a high crime. Treason ought not to be excused lightly. Treason against our fundamental values, against the tradition of a free press which made this country possible, is so disgusting that no lesser sentence than death could be appropriate. Regards, Jim -------- Original Message -------- Subject: Re: [Politech] Hiawatha Bray's response on wiretapping of journalists: the law's the law [fs] Date: Tue, 23 May 2006 00:36:38 -0400 From: Chris Beck <cbeck(a)pacanukeha.net> Organization: None At All To: Declan McCullagh <declan(a)well.com>, Hiawatha Bray <watha2020(a)fusemail.com> References: <447282E6.3060804(a)well.com> They say Declan McCullagh, on or about 22.May.2006 23:35, whispered: > reporters. Still, the law's the law, and reporters are bound to it like > everybody else. Until the law is found to be unconstitutional or in conflict with another law. Besides, the implication is that the tracking is being done by the NSA. I would have thought it was the FBI's responsibility to investigate criminal leaks. My own personal feeling is that it should not be possible for criminal actions to be deemed classified. Cheers, Chris -- Chris Beck - http://pacanukeha.wordpress.com The sad fact is that "national security" has become the root password to the Constitution. -- Phil Karn -------- Original Message -------- Subject: Re: [Politech] Perry Metzger's call to action on Feds' lawlessness, tapping [priv] Date: Mon, 22 May 2006 23:37:04 -0600 From: Daniel Webb <daniel(a)danielwebb.us> To: Declan McCullagh <declan(a)well.com> References: <447282E6.3060804(a)well.com> <20060522174208.C1628(a)baltwash.com> > Nonsense. As a journalist, I don't much like the idea. But anybody who's > leaking classified data to reporters is in violation of the law. And it's > perfectly legal for the government to tap the phones of suspected > lawbreakers inside the intelligence community. In addition, it's illegal > for journalists to knowingly publish classified information, according to a > law passed back in 1950. I hope that provision is never enforced; I don't > think the administration wants to enforce it. After all, they need only > nail the leakers and thus avoid opening a huge can of worms by arresting > reporters. Still, the law's the law, and reporters are bound to it like > everybody else. Two points: 1) The government should simply make a law that revealing government lawbreaking is itself a serious crime, perhaps appending it to the treason statute. I am quite confident that within my lifetime this will happen. I assume you will not support such a law, but will you violate it? Will you still say "the law's the law, and everybody has to follow it?" 2) Reading his message as a whole, I think the fear being described by Mr. Metzger is not so much legitimate phone tapping and warrants, but the wholesale and illegal surveillance going on now. For example, assume a reporter can now be identified any time after the fact because the NSA is keeping phone logs of every phone call made in the United States. Once identified, "legitimate" warrants can be used to gain information used against them in court. This is the fear I have: that we will create a system where Constitutional protections still exist on paper, but are meaningless in practice. I believe that will be the result of the fourth amendment if the current administration gets away with breaking the law. Bush broke the law and is still breaking the law. Everyone involved with that operation should be prosecuted, yet they are boldly defiant and calling for the heads of those brave enough to out them breaking the law. So pardon me if I don't see blind devotion to the law as the highest ideal in this case, especially when the law is only applied to those who criticise the government and not the government itself. Daniel Webb -------- Original Message -------- Subject: Re: [Politech] Hiawatha Bray's response on wiretapping of journalists: the law's the law [fs] Date: Mon, 22 May 2006 22:41:50 -0700 From: Thomas Leavitt <thomas(a)thomasleavitt.org> Organization: Godmoma's Forge, LLC To: Declan McCullagh <declan(a)well.com> References: <447282E6.3060804(a)well.com> Declan, The law is owed respect exactly to the point at which it becomes immoral and dangerous to do so - the world is full of bad and immoral laws which deserve nothing but contempt. A bad law is a bad law. Period. It is a hoary example, but there were plenty of "laws" in the South that journalists (and others) were "bound" to observe, that people knowingly and deliberately broke because they were unjust and unwise. There's a reason why there are laws that attempt to protect whistle blowers, and there's a reason why, traditionally, journalists enjoy a certain amount of immunity from revealing their sources - even the ones who are engaged in illegal acts: the benefit to the public of having access to the truth, in this case, of having a counter-balance to an arrogant and over-reaching executive, exceeds the costs to the society associated with failure to prosecute those revealing the secrets. Really, does the idea of a government that is *successfully* able to seal all leaks, to track down and prosecute and punish any and all individuals who reveal information that such a government prefers to not have revealed, does this make anyone happy? Would you feel safer in your bed at night, if you knew the rulers of this country were pretty much free to proceed at will with whatever plans they cared to execute? Absolute power corrupts absolutely. A governmental administration effectively able to act without fear of exposure by those who disagree with policies as laid out and implemented, especially in the case of secrecy, is inevitably going to over-reach and threaten the liberty of the citizens it governs. It is inherent in human nature, individually, and collectively. We already have a huge and growing and more or less truly secret and almost completely unaccountable government... $40 billion dollars a year (that we know of), the entire budget of a small nation... more than all but a few countries combined spend on national defense... don't we, as citizens, deserve to have at least a theoretical opportunity to learn when and if improprieties of any sort, however embarassing, and even if potentially threatening to national security in some fashion, are being engaged in? Is the nation better off for having Abu Gharib exposed? One could argue that our national security has been undermined by that event... but how much greater the threat, if that cancer had grown on, unabated, only to be revealed at a later point... or to infect the forces of law and order in our own country? ... setting aside the moral stain that settles on all of us, a citizens of a country that engages in torture. I would argue that, in point of fact, we have a moral obligation to conscientiously violate and disrespect and disempower immoral, unjust and unwise laws, and to express our contempt for them and our strong desire to see them invalidated or erased from the books. A whistle blower passing along secret and classified information that implicates any element of our government in immoral or illegal or just plain unwise acts is a hero, not a criminal. To put it in stark terms: if the CIA were to be engaged in a plot, authorized by the President himself and senior members of Congress, to explode a small tactical nuclear weapon in Tehran, designed to take out a large chunk of that government's ruling powers, and a whistle blower were to supply Seymour Hersh with all the details and they went up on the web minutes later, and such a publication "blew" the operation and lead to the deaths of several of the operatives and the virtual destruction of our intelligence network in Tehran and surrounding areas, there would be absolutely no doubt that, in a very real sense, our national security had been severely compromised. At the same time, one could (and I would, personally) argue that revealing this information would be an act of public service of the highest merit and the leaker to be a hero, and that in the long run, our national security had been vastly enhanced, rather than degraded. But, perhaps I'm too much of a cynic, perhaps I've been watching too much Star Trek, find the proposition that our government could over reach its bounds or be corrupted from within or that elements of it could put their own interests ahead of the nations far more realistic a proposition than is justified. But again, I ask: if the government was able to act without the slightest fear of "leaks", if each and every "leak" were instantly and ruthlessly hunted down and crushed, and any publication or forwarding of such information was suppressed and severely punished... would any of us fell safer in our beds at night? Regards, Thomas Leavitt -------- Original Message -------- Subject: Re: [Politech] Hiawatha Bray's response on wiretapping of journalists: the law's the law [fs] Date: Tue, 23 May 2006 01:52:48 -0400 (EDT) From: Dean Anderson <dean(a)av8.com> To: Declan McCullagh <declan(a)well.com> On Mon, 22 May 2006, Declan McCullagh wrote: > Previous Politech message: > Nonsense. As a journalist, I don't much like the idea. But anybody who's > leaking classified data to reporters is in violation of the law. And it's > perfectly legal for the government to tap the phones of suspected > lawbreakers inside the intelligence community. In addition, it's illegal > for journalists to knowingly publish classified information, according to a > law passed back in 1950. I hope that provision is never enforced; I don't > think the administration wants to enforce it. After all, they need only > nail the leakers and thus avoid opening a huge can of worms by arresting > reporters. Still, the law's the law, and reporters are bound to it like > everybody else. I'm not a trained journalist. But I am a consumer of the products of journalism. The public doesn't have the CIA to find out facts. But we need information to make decisions. The collective "free press" provides that information: Like the CIA, they have to engage in a few "covert ops" to obtain information. As someone just recently pointed out on a TV talk show (didn't get their name), nearly everything the CIA does abroad is a violation of the host countries' laws. Spying is illegal in nearly every country. The public needs to know the truth, and needs to have access to facts in order to make decisions that are essential to Democracy. I agree that the law is the law. I rather identify with John Adams, who was greatly disturbed the by the French Revolution because it seemed to be anarchy, a destruction of the rule of law. In contrast, though Adams was a revolutionary, he was not an anarchist. I think the law in this case is meant to protect against harms to national security. The rub is what is "national security"? I argue that making newsworthy information public does not harm the national security. The publishing of the Pentagon Papers did no harm to the national security. Rather, this act greatly helped the national security. The exposure of Watergate brought down the President, but it did not harm the national security. Nor did the exposure harm the Presidency. The harm was caused by Nixon and his aides. The exposure was in the interest of national security. Likewise, I've seen nothing revealed so far that has been harmful to the national security, and I read the New York Times every day, frequently read the Boston Globe, and more occasionally the Wall Street Journal. The "National Security" is not "that which makes Bush and Company look good". It is that which makes the public actually secure in their liberties, and protects Democracy, which is public control of the government. I was greatly moved by Moussaoui's response to the families of the victims. After the families testified what pain he had caused, he took the stand to respond about the pain and death the US had caused abroad. I've just read "Rogue State" by William Blum. Engaging in secret wars for the benefit of US corporate profits is a terrible vulture that will come home to rest. In today's New York Times, Ted Koppel argues for (or perhaps alerts us to) the possibility that Corporations should be allowed to hire their own mercenaries to fight their battles and protect their foreign interests. I suspect that in fact, Corporations already do operate mercenary armies, and have for a long time. Last year, Margaret Thatcher's son was arrested in Zimbabwe for leading a mercenary army to overthrow the Central African Republic. Why? Oil seems likely. [There is a new oil pipeline in Chad, and there is Oil in Darfur, which also puts the "genocide" in a different light. Just look at the map and follow the Oil.] Exposing these misdeeds is in the national interest, and promotes national security and democratic public control of government. The acts of reporters have not been to sell secrets to the Chinese, or to terrorists for that matter. The acts have been to make relevant facts public. Facts which are relevant to the public discourse, and to the right of the public to have the information it needs to make decisions. Anything else is not a Democracy. The goal of national security is to preserve the Democracy, not the Presidency. Or even the President. Just as the Secret Service should take a bullet to protect the President, the President (and everyone below him) may need to put their own life and future at risk to protect the Democracy. That is what they swore an oath to protect: To protect and defend the Constition, not their own butts. Any classified information that essentially puts their "butts to the fire" probably better serves the national security by publication than by secrecy. I am a strong proponent of rule by law. But I think the lawfulness of this publication of classified information is rather similar to the notion of justifiable homicide, or perhaps trespass in public necessity. In tort law there is a defense against trespass called "Privileged Invasion of Another's Land or Chattels as a Public Necessity". Essentially, it means there are circumstances when trespass is necessary to avert a disaster, or because a highway is obstructed. Of course, the media is generally excluded in this, so perhaps it isn't a good example. But I think the lack of relevent information could create a public disaster. Indeed, I think the Iraq War (and perhaps the Vietnam War), was a public disaster caused by lack of public information. In Vietnam, the government repeatedly told the public that "we know things, and we're doing the right thing". We now know what it was they knew, and they didn't know anything then that would have made their decisions correct. National security would plainly have been better served by having that information made public. Sometimes there are good and just reasons to break the law. I absolutely see that its a hard call in a gray area. A call that, correctly made, distinguishes the professionals from the amateurs. But that's why we have professional journalists, and that's why we have judges and juries, and not robots. Freedom isn't risk free. For anyone, journalists included. --Dean -- Av8 Internet Prepared to pay a premium for better service? www.av8.net faster, more reliable, better service 617 344 9000 _______________________________________________ Politech mailing list Archived at http://www.politechbot.com/ Moderated by Declan McCullagh (http://www.mccullagh.org/) ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: [cryptography] OTR and deniability
by Ian G 06 Jul '18

06 Jul '18

On 14/07/11 12:37 PM, Ai Weiwei wrote: > Hello list, > > Recently, Wired published material on their website which are claimed to be logs of instant message conversations between Bradley Manning and Adrian Lamo in that infamous case. [1] I have only casually skimmed them, but did notice the following two lines: > > (12:24:15 PM) bradass87 has not been authenticated yet. You should authenticate this buddy. > (12:24:15 PM) Unverified conversation with bradass87 started. > > I'm sure most of you will be familiar; this is evidence that a technology known as Off-the-Record Messaging (OTR) [2] was used in the course of these alleged conversations. > > I apologize if this is off topic or seems trivial, but I think a public discussion of the merits (or lack thereof) of these alleged "logs" from a technical perspective would be interesting. I believe it is germane to anyone designing crypto protocols to understand how they actually impact in user-land. This particular one is a running sore for me because of its outrageous claim of deniability. > The exact implications of the technology may not be very well known beyond this list. I have carbon copied this message to the defense in the case accordingly. > > If I understand correctly, OTR provides deniability, which means that these alleged "logs" cannot be proven authentic. The *claim made by OTR is to provide technological deniability* as opposed to any non-technological status. Its non-technical deniability is zilch. Unfortunately, outside the technology, it is trivial to prove the logs as authentic. This is confusing for the technologists as they are trying to create a perfect security product, and they believe that technology rules. What they've failed to realise is that real life provides some trivial bypasses, and in this situation, they may very well be creating more harm -- by sucking people into a false sense of security. Design of security systems is tough, it is essential to include the human elements in the protocol, elsewise we end up with elegant but useless features. Sometimes we enter into danger, as is seen with OTR or BitCoin, where a technological elegance causes people to lose their common sense and grasp of reality. > In fact, the OTR software is distributed with program code which makes falsifying such "logs" trivial. Is this correct? Dunno. Could be. Evidence of a false sense of security, to me. > What do you think? .... On the specific legal case: well, nothing we see in open press will really be reliable. You're looking at the USG going for broke against a couple of lonely mixed up people who USG mistakenly let near a TS site. It will be a total mess. Mincemeat, fubar, throw away the key. The case will see all sorts of mud thrown up, with both sides trying their darndest to muddy the waters. >From the external pov, there will be no clarity. Nothing really to say or think, except, ... don't make that mistake? Relying on crypto blahblah promises like OTR or PGP when you're about to release a wikileaks treasure trove doesn't sound like rational thinking to me. iang _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [tor-talk] on the topic of tor's weaknesses
by Paul Syverson 06 Jul '18

06 Jul '18

On Wed, Feb 29, 2012 at 05:17:34AM -0500, grarpamp wrote: > > The main problem, besides the overhead, is that padding doesn't work > > if an adversary can do something as trivial as very briefly delaying > > It is too easy for an adversary to put a traffic signature on a > > circuit in one place, and look for it elsewhere. If he owns, e.g., the > > first node and any of the last node, the link to the destination, or > > the destination it won't matter what kind of padding is done. There's > > lots of published work showing this in various ways. Some already > > alluded to in this thread. If nothing else the adversary can just kill > > the connection at the first node and see which connection exiting the > > network dies. > > Doesn't this mean bad news for users of hidden services, Maybe. The important thing is to understand what security is provided and what is not. Then you can make an informed decision about whether or not it's bad news. > and to a > lesser extent clearnet services (since they're not as 'illegal' and thus > maybe lesser hot targets for snagging users). IE: > > Sting runs a HS and an entry. Thus Sting has full packets, timing, > cleartext and logs of anyone that builds: clientA <> entry <---> HS > > There may even be these additional structures to the left of clientA's > entry, for which the role of entry may switch to relay or exit, but for > which entry may be still able to discriminate among on its left... > clientB > clientC <> relay > clientD [...] <> relay <> relay [...] > > It may take a while for a clientA to use said entry but when they do it seems > it would be quite easy to time/count correlate or munge the HS traffic of > clientA. And only require two nodes (hs, entry) and no GPA taps to do so. > > Can such an entry know when it's being used as an entry by > whatever appears to it's left? I think that is what I describe > relies on. The short but incomplete answer is yes. Generally, what you are describing we experimentally verified on the live Tor network back in 2005. See "Locating Hidden Servers" by Lasse Overlier and myself. Available at http://freehaven.net/anonbib/ or http://www.onion-router.net/Publications.html These sorts of attacks are what motivated us to introduce guard nodes, also described in that paper. We all knew, and had seen analyzed in earlier work by Wright et al., that onion routing circuits were subject to predecessor attacks, and that what Wright et al. had called helper nodes would, well help. What Lasse and I showed was that the public Tor network as of 2005 was subject to such attacks working very quickly (minutes) using very limited resources. You could generally find a hidden server within minutes using just a single hostile Tor relay (no cooperation from evil web server required). We wanted to show what you could do with a single relay, which limited us to hidden server circuits. If you owned at least two relays, you could attack arbitrary Tor circuits. This was confirmed in simulation on PlanetLab shortly after by Bauer et al. ("Low-Resource Routing Attacks Against Tor", also available at anonbib). Entry guards don't change the asymptotic threat of such attacks, they just move it around. Since you could be screwed so quickly and easily by building random circuits, Tor was changed so that you pick just a few relays as your entry guards. If one of them is evil, it will see the entry side of (a large fraction of) your circuits and will be able to associate you with your destination whenever you go to a hostile destination or use a hostile exit. What Lasse and I showed was that you weren't really much worse off from this than when choosing circuits with random entry relays. And if none of your guards is evil, an adversary can never de-anonymize you in this way. (Never say "never". ;>) Cf. the experiments and discussion of layered guards in "Locating Hidden Servers", and our subsequent research on building trust into path selection.) aloha, Paul _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0