- cypherpunks-legacy - lists.cpunks.org

Re: [cryptography] kernel.org hack and kernel integrity
by Tim Shepard 06 Jul '18

06 Jul '18

> Could anyone explain git's security assurances to a non-git layman? > Git internally uses the SHA-1 hash of a small header and the object contents (file, directory, or commit message) as the internal name for each object, and claims to check that the hash of the data still matches the name every time it fetches the object from the underlying file system, or pulls it over the net from another repository. (I think the small object header is included so that the null directory and null source file will have different hash values.) This is supposed to make it difficult to corrupt the content and history stored in a git repository, because if you change anything, the SHA-1 hash will no longer match the name. And if you are pulling updates from an upstream repository, there's no way to slip something by you that won't be detectable as something changing when your downstream repository receives it. The locally computed summary and difference of an update really is what has changed. And any attempt to rewrite any part of the history that you already had a copy of (from previous updates pulled) will not go unnoticed. And with many developers pulling updates, there are many distributed copies, and many people watching. The commit IDs are displayed as the SHA-1 hash values, and developers refer to particular commits by these SHA-1 hash values. For example, the latest commit I have from the mainline linux kernel tree that Linus maintains is: 9e79e3e9dd9672b37ac9412e9a926714306551fe And anyone else who has a sufficiently-recently updated remote in their repository can reference this commit by using this SHA-1 hash value. (For example, "git log 9e79e3e9dd9672b37ac9412e9a926714306551fe" would show the history of commits going backwards in time starting from this particular commit.) What this does is provide some technical assurance that when we talk (communicate out-of-band) about particular versions of the linux source tree, we can be sure that we really are talking about the same bits. (Unless someone has managed to make use of a SHA-1 hash collision, and AFAIK no one has yet published a SHA-1 hash collision. Or unless someone has corrupted the git software that one or both of us is using.) One thing I've been curious about is what would have to happen in the world of git when (a) someone shows how to construct SHA-1 hash collisions, or (b) someone shows how to consturct SHA-1 second preimages. There is a "repositoryformatversion = 0" in the on-disk format. I'm not sure if there are any other mechanisms in git storage or communication formats for crypto hash agility. (I expect there is no code in git that anticipates needing crypto hash agility.) Anyway, I hope this helps. When I was learning git, I found the paper _Git from the bottom up_ by John Wiegley very helpful for understanding what is going on inside git: http://newartisans.com/2008/04/git-from-the-bottom-up/ -Tim Shepard shep(a)alum.mit.edu _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [liberationtech] /. ITU Approves Deep Packet Inspection
by Nicholas Judd 06 Jul '18

06 Jul '18

Hi list, Nick from techPresident here. If I could tap into your hive-mind intelligence for a moment to help me be more precise about explaining why this is an issue, I would appreciate it ... Governments, intelligence organizations and assorted nogoodniks already use deep-packet inspection, so the declaration of a standard for DPI comes off as vaguely Orwellian but not news. I'm searching for a way to explain the privacy-advocate position on this is both accurately and concisely. The sense I get from CDT's blog post is that there are three reasons why this is more than just creepy in principle: 1. The standard outlines ways that, in the ITU's view, ISPs should structure their operations so that highly invasive surveillance can function; 2. Under current governance, this standard could be as widely ignored as the <blink> tag, but ISPs could be forced to comply if the ITU becomes a must-follow standards-making body for the Internet b meaning all traffic in every ITU member state, in this extreme example, would be vulnerable by design; 3. On principle, IETF and W3C don't address standards for surveillance, highlighting another way the ITU is ideologically removed from the way the Internet is now governed. Am I on target here? On Dec 5, 2012, at 12:41 PM, Cynthia Wong wrote: > The final version of the standard should show up here... eventually: > > http://www.itu.int/en/ITU-T/publications/Pages/latest.aspx > > http://www.itu.int/dms_pages/itu-t/rec/T-REC-RSS.xml > > > > -----Original Message----- > From: liberationtech-bounces(a)lists.stanford.edu [mailto:liberationtech-bounces@lists.stanford.edu] On Behalf Of Asher Wolf > Sent: Wednesday, December 05, 2012 7:38 AM > To: liberationtech(a)lists.stanford.edu > Subject: Re: [liberationtech] /. ITU Approves Deep Packet Inspection > > From http://committee.tta.or.kr : > Revision of Y.2770 Requirements for #DPI in Next Generation Networks http://bit.ly/Yx0Sya (via @BetweenMyths) > > On 5/12/12 9:25 PM, Andre Rebentisch wrote: >> Am 05.12.2012 10:27, schrieb Eugen Leitl: >>> http://yro.slashdot.org/story/12/12/05/0115214/itu-approves-deep-pack >>> et-inspection >>> >>> >>> ITU Approves Deep Packet Inspection >>> >>> Posted by Soulskill on Tuesday December 04, @08:19PM >>> >>> from the inspect-my-encryption-all-you'd-like dept. >>> >>> dsinc sends this quote from Techdirt about the International >>> Telecommunications Union's ongoing conference in Dubai that will have >>> an effect on the internet everywhere: >> The WCIT is a "diplomatic conference" for the rules governing the ITU, >> the ITRs. It seems wrong to mix that with ongoing specific >> standardisation work of the ITU. >> >> Anyway, interesting discussions over at circleid.com: >> http://www.circleid.com/posts/20121203_wcit_off_to_a_flying_start/ >> Apparently ITU fellows are disgruntled that they cannot control the >> media coverage and complain about all the "misinformation". >> >> Best, >> AndrC) >> >> >> -- >> Unsubscribe, change to digest, or change password at: >> https://mailman.stanford.edu/mailman/listinfo/liberationtech > > -- > Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech > -- > Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

None
by Trei, Peter 06 Jul '18

06 Jul '18

> Imagine if the software business were like this - that the programmers > of the late 40's had formed an American Programmers Association, > and it was unlawful for anyone without APA certification to write > code for money. Some people are trying to do this. See for example http://www.colosseumbuilders.com/american.htm [I especially find the "no foreign competition" (aka "no H1-B") disgusting. Tim May notwithstanding, we DO compete with the americans - and a lot of us are better.] Mark

1 0

None
by Trei, Peter 06 Jul '18

06 Jul '18

> Imagine if the software business were like this - that the programmers > of the late 40's had formed an American Programmers Association, > and it was unlawful for anyone without APA certification to write > code for money. Some people are trying to do this. See for example http://www.colosseumbuilders.com/american.htm [I especially find the "no foreign competition" (aka "no H1-B") disgusting. Tim May notwithstanding, we DO compete with the americans - and a lot of us are better.] Mark

1 0

None
by Trei, Peter 06 Jul '18

06 Jul '18

> Imagine if the software business were like this - that the programmers > of the late 40's had formed an American Programmers Association, > and it was unlawful for anyone without APA certification to write > code for money. Some people are trying to do this. See for example http://www.colosseumbuilders.com/american.htm [I especially find the "no foreign competition" (aka "no H1-B") disgusting. Tim May notwithstanding, we DO compete with the americans - and a lot of us are better.] Mark

1 0

None
by Trei, Peter 06 Jul '18

06 Jul '18

> Imagine if the software business were like this - that the programmers > of the late 40's had formed an American Programmers Association, > and it was unlawful for anyone without APA certification to write > code for money. Some people are trying to do this. See for example http://www.colosseumbuilders.com/american.htm [I especially find the "no foreign competition" (aka "no H1-B") disgusting. Tim May notwithstanding, we DO compete with the americans - and a lot of us are better.] Mark

1 0

None
by Trei, Peter 06 Jul '18

06 Jul '18

> Imagine if the software business were like this - that the programmers > of the late 40's had formed an American Programmers Association, > and it was unlawful for anyone without APA certification to write > code for money. Some people are trying to do this. See for example http://www.colosseumbuilders.com/american.htm [I especially find the "no foreign competition" (aka "no H1-B") disgusting. Tim May notwithstanding, we DO compete with the americans - and a lot of us are better.] Mark

1 0

None
by Trei, Peter 06 Jul '18

06 Jul '18

> Imagine if the software business were like this - that the programmers > of the late 40's had formed an American Programmers Association, > and it was unlawful for anyone without APA certification to write > code for money. Some people are trying to do this. See for example http://www.colosseumbuilders.com/american.htm [I especially find the "no foreign competition" (aka "no H1-B") disgusting. Tim May notwithstanding, we DO compete with the americans - and a lot of us are better.] Mark

1 0

None
by Trei, Peter 06 Jul '18

06 Jul '18

> Imagine if the software business were like this - that the programmers > of the late 40's had formed an American Programmers Association, > and it was unlawful for anyone without APA certification to write > code for money. Some people are trying to do this. See for example http://www.colosseumbuilders.com/american.htm [I especially find the "no foreign competition" (aka "no H1-B") disgusting. Tim May notwithstanding, we DO compete with the americans - and a lot of us are better.] Mark

1 0

None
by Trei, Peter 06 Jul '18

06 Jul '18

> Imagine if the software business were like this - that the programmers > of the late 40's had formed an American Programmers Association, > and it was unlawful for anyone without APA certification to write > code for money. Some people are trying to do this. See for example http://www.colosseumbuilders.com/american.htm [I especially find the "no foreign competition" (aka "no H1-B") disgusting. Tim May notwithstanding, we DO compete with the americans - and a lot of us are better.] Mark

1 0