December 2013 - cypherpunks - lists.cpunks.org

Re: cognitive dissonance in threat modelling?
by coderman 14 Dec '13

14 Dec '13

On Sat, Dec 14, 2013 at 5:57 AM, ianG <iang(a)iang.org> wrote: > ... the way in to a sector attack such as is now NSA's mission > is often by picking the weaker player and perverting them. Then, leapfrog > (with extortion & bribery) through other players. > > Also disturbing is that if the it is Intel, this would mark an intervention > into the competitive marketplace of industrial policy proportions: it would > be promoting Intel over the competitors, which would basically undo decades > of work to open markets to competition. > > Knowing what the NSA are up to is on the verge of becoming a global > competitive priority. From an economics / world trade pov, this is seismic. i hope it was worth it for them! 'cause this is going to be expensive... Matthew Green posted insights on how one might implement backdoors in chips: http://blog.cryptographyengineering.com/p/some-thoughts-on-suborning-encryp… as well as the "Weak random number generators" attacks: http://blog.cryptographyengineering.com/2013/12/how-does-nsa-break-ssl.html regarding the unredaction automation: the typographic interpolation trick discussed on the list, matching type face with justified spacing with candidate word(s), is a really annoying idea and won't get out of my head. (i tried to distract and forget with a Tor patch - https://trac.torproject.org/projects/tor/ticket/10402 - to no avail ;) currently playing with scipy, skimage to: - obtain from human initial document image - obtain from human seed words / dictionary for matching - misc. contrast / levels / etc conditioning for text optimized monochrome - mask document image into text and non-text areas - edge detect, align to horoz (for selections by x/y) - broad region detect text rows into individual row images - region detect individual chars per row image then assign char value via OCR - insert human in loop to confirm / correct OCR row by row - insert human to select redact line + redact area - interpolate justified components: character spacing, word spacing, etc. - iterate over known text with candidate fonts until best match. - iterate over candidate words in best font until best match. - success? what confidence? (GOTO 10) (the extra work for char by char and whole doc dis-assembly is in case a "re-assemble scanned chars into candidate" rather than "match font and re-produce text candidate" mode is needed.) something better, Beuller? ... Beuller? ... this won't be the last time i find this code useful! current working set, including known wrong (please add suggestions :) FeliCa and AMD Nortel Networks Apple and ARM Array Networks Cisco and Atmel Philips and VIA HiFn and Atmel Cisco and ARM Cisco and HiFn Intel Ivy Bridge Intel RDRAND Atmel and IBM Atmel and VIA Apple and VIA Intel and AMD Intel and ARM Forum Systems VIA XSTORE Cavium Nitrox CAI Networks A10 Networks Cisco Systems Citrix Systems Sun SCA6000

1 0

Re: [cryptography] Which encryption chips are compromised?
by Jan-Frode Myklebust 13 Dec '13

13 Dec '13

On Thu, Dec 12, 2013 at 08:04:00AM -0800, Steve Weis wrote: > > The document is talking about FY2013. IVB already shipped in 2012. I'd > guess it was fabricated for testing in 2009-2010 and designed for a few > years prior. > > What enablement would be "complete" in 2013 for something that has been on > the market a year and is already being phased out? A microcode update ? -jf

1 0

Multiple Plots by US, UK to Kidnap Edward Snowden
by coderman 13 Dec '13

13 Dec '13

ah FSB; you crack me up! '''A senior officer of Russian counter-intelligence said: "Although the Federal Security Bureau does not do anything about human rights activist Snowden, the service has been active in counterintelligence. I am pretty sure that kidnaping the former NSA employee will be dramatically challenging." He also thanked "former NSA employees and journalists for publishing such information...''' --- http://english.pravda.ru/russia/politics/10-12-2013/126347-edward_snowden_r… """ Edward Snowden can be kidnapped from Russia? 10.12.2013 14:57 Edward Snowden, the whistleblower of NSA's total control systems can be kidnapped from Russia. This is a priority for the British MI-6 and the British Embassy, former NSA agent Wayne Madsen said, referring to his colleagues. Of course, nothing is known whether the CIA received the task, and whether the U.S. Embassy is going to be involved in the activities to try to kidnap Snowden. However, the British Embassy has already tracked calls and letters of Snowden's "inner circle" and begun to "dig up" their contacts in Moscow. According to The Guardian, Snowden has the information, the disclosure of which could become a nightmare for the U.S., even though the fugitive NSA specialist decided not to disclose some of his data. In addition, The Guardianadmitted that the media have so far published "only 1%" of available information about NSA's total control over billions of people in different countries. Nevertheless, even this one percent has already made the UK authorities introduce outright censorship against those who reveal secrets of "global surveillance." In particular, Wayne Madsen said that his girlfriend, who previously worked for the National Security Agency as an expert on the Russian language, tried to contact Snowden's acquaintances. Afterwards, she was invited to come to the British Embassy and undergo special training. She was also asked to report of FSB's interest in her persons and communications. The press quoted a former NSA expert, who said that the job to find Snowden was of the highest priority for the embassy. Moreover, it was said that the future operation to kidnap him involved number one MI-6 officer at the embassy, who worked under diplomatic cover as the director for regional security. The Center for the Study of Globalization has previously reported that should the operation be successful, Snowden would be delivered to the UK or the U.S. For the time being, the flywheel of total wiretapping that Snowden launched was working against him to the utmost. "MI-6 intelligence agencies have begun to analyze the information they were able to obtain through intelligence," the statement from the center said. A senior officer of Russian counter-intelligence, whom Politonline.ru confidentially managed to talk to, said: "Although the Federal Security Bureau does not do anything about human rights activist Snowden, the service has been active in counterintelligence. I am pretty sure that kidnaping the former NSA employee will be dramatically challenging." He also thanked "former NSA employees and journalists for publishing such information, but added that operational, technical and other measures to counter intelligence and other illegal activities of foreign secret services on the territory of Russia were constantly maintained. It only remains to add that the CIA has recently created a special section in Russian on its official website, in which the department offered Russian citizens (!) to join American intelligence. To choose from, for example, the CIA offers engineering and technical directions, a linguistic job, a secret agent with the knowledge of Russian language and experts in business and analysts. The CIA reportedly hopes to obtain classified information from newcomers in the above areas to establish a new database of agents. """

1 0

Re: How long does it take to design and release a chip?
by coderman 13 Dec '13

13 Dec '13

On Thu, Dec 12, 2013 at 5:17 PM, coderman <coderman(a)gmail.com> wrote: > ... if Intel were to decide to include RDRAW in next > CPU line design, how long would it be to retail channels? >3yrs? using Sandy Bridge as a reference: 4 years design to demo, 1-2 years demo to available. design began 2005 demo'd in 2009 shipping in 2011

1 0

Re: [cryptography] Which encryption chips are compromised?
by Andy Isaacson 13 Dec '13

13 Dec '13

On Thu, Dec 12, 2013 at 08:04:00AM -0800, Steve Weis wrote: > On Dec 12, 2013 6:08 AM, "coderman" <coderman(a)gmail.com> wrote: > > i see your skepticism, and i raise you a retort! ;) > > > > i even have a list of candidates you can experiment with to confirm > > Intel Ivy Bridge as best fit. [0] > > I think this is a weak guess. In reply to Declan tweeting about this discussion (shame on you, Declan, if you're reading this and trying to take the discussion to the public), Kevin Poulsen points out https://twitter.com/kpoulsen/status/411226939547222016 that the Times' comment on this redaction appears to imply that the redacted text names two chips: http://www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campa… Large Internet companies use dedicated hardware to scramble traffic before it is sent. In 2013, the agency planned to be able to decode traffic that was encoded by one of these two encryption chips, either by working with the manufacturers of the chips to insert back doors or by exploiting a security flaw in the chips' design. > The document is talking about FY2013. IVB already shipped in 2012. I'd > guess it was fabricated for testing in 2009-2010 and designed for a few > years prior. > > What enablement would be "complete" in 2013 for something that has been on > the market a year and is already being phased out? VPN gear lasts in the field for 2-5 years post roll-out. Design wins into large provider's hardware will often see the same chip being manufactured for 2-5 years after it ceases being available at retail. (ark.intel.com has an "embedded option available?" field to denote the chips they support this for.) "Complete Enablement" is jargon with a specific meaning. I'm not certain I understand it, but I *think* it means "we have plaintext access on any targeted session". I don't think it means "we can get plaintext for an arbitrary previously recorded session" and I don't think it means "we automatically get plaintext for every session we can hear". Suppose a NSA chip backdoor receives its triggering command by a specific sequence of TCP retransmits (dropped packets) and after being triggered, leaks the key by varying the timing or ordering of outbound packets. By my reading, this would count as "complete enablement" even though a session which was not triggered would not be eavesdroppable. To specifically respond to your point, "Complete enablement" is also time dependent. Productionizing a timing side channel attack could result in complete enablement only for new flows and would still be complete even though there was no enablement before the attack was available. > By 2013, Intel had already started shipping Haswell. They did launch new > IVB E5v2 Xeon server processors this fall, but future CPUs will be Haswell > and Broadwell. > > Intel already has the next, next generation Skylake with SGX fabricated for > testing. > > I still think the document is talking about a dedicated crypto chip for VPN > and SSL acceleration devices, just like it says. Especially taking the NYT commentary into account, I'm even more convinced you're right. "Intel and AMD" is about the right length... -andy

2 2

Fwd: [liberationtech] PrivateSky Takedown
by coderman 12 Dec '13

12 Dec '13

---------- Forwarded message ---------- From: Yosem Companys <companys(a)stanford.edu> Date: Thu, Dec 12, 2013 at 9:07 AM Subject: [liberationtech] PrivateSky Takedown Certivox Asked That We Share Their Side of the Story on the PrivateSky Takedown. YC http://www.certivox.com/blog/bid/359788/The-real-story-on-the-PrivateSky-ta… The real story on the PrivateSky takedown. Posted by Brian Spector on Thu, Dec 12, 2013 With the story about our PrivateSky takedown now public, I want to take the opportunity to clarify a few points in various articles that have appeared since yesterday covering the story. Some headlines strongly infer our friends at GCHQ "forced" us to take PrivateSky down. That's not the case. Secondly, a very important point wasn't printed. GCHQ couldn't, by law, request a blanket back door on the system. There are a very rigid set of controls that mean only specific individuals can come under surveillance. The legal request for such surveillance has a due process that must be stridently followed. At no time did I or anyone at CertiVox talk about CertiVox in relation to any RIPA warrant, only the generic process by which these warrants are served. By saying "our friends at GCHQ", there is no facetiousness intended. The team at CertiVox have the upmost respect for the folks we interacted with at GCHQ. They took the due process I outlined in the previous point very seriously. We found that as an organisation, and every individual involved there, were as worried about a breach of public trust as much as we are. Finally, I believe very strongly the following should be a larger part of the public discourse of these subjects. What everyone needs to understand is that every developed democracy in the world, even where privacy rights are enshrined to the maximum efficacy by statute, has laws on the books that mandate that Internet Service Providers have facilities to work with law enforcement for the purposes of legal intercept, to enforce public safety and security. Being L.I. capable is a very important set features and functions that must be in place for any credible, commercial service on the Internet. In endeavouring to make PrivateSky as secure as possible, we overlooked this critical requirement when we built PrivateSky. When CertiVox positioned PrivateSky as the easiest to use and most secure encrypted messaging service, we really had two significant points of differentiation. First, even though we held the root encryption keys to the system, it was architected in such as way that it would have been all but impossible for our internal staff to snoop on our customer's communications, or for the service to leak any of our customer¹s data. Secondly, our possession of the root keys, and our use of identity based encryption, made the system incredibly easy to use. For the user, there were no private or public keys to manage, every workflow was handled for the user in an easy to grasp pure HTML5 interface, no hardware or software required, just an HTML5 browser. We boxed ourselves into a feature set and market position that when called upon to comply with legal statues, we simply had no alternative but to shut the service down. We built it, but we couldn't host it. Why? Because as you can probably surmise, there is an inherent impedance mismatch between being able to host a commercial communications service that gives the upmost in privacy to its users, against any breach, whilst at the same time being able to operate safely within the confines of the law as it is on the books in most countries on the planet. In summary, it's the abuse of the communications interception in the Snowden revelations that has everyone up in arms, as so it should. But that¹s not what happened with PrivateSky. What is our next move? Watch this space. -- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu.

1 0

Re: [cryptography] Which encryption chips are compromised?
by coderman 12 Dec '13

12 Dec '13

On Thu, Dec 12, 2013 at 8:04 AM, Steve Weis <steveweis(a)gmail.com> wrote: > ... > The document is talking about FY2013. IVB already shipped in 2012. I'd > guess it was fabricated for testing in 2009-2010 and designed for a few > years prior. > > What enablement would be "complete" in 2013 for something that has been on > the market a year and is already being phased out? the bulk of 2012 was consume user hardware. the endpoint is a totally solved problem (read: trivial to exploit in many ways, all day, every day, per the docs) only server Ivy Bridge: Xeon E3 in mid-2012. the cores pushed in the SDN initiatives above came out not so many months ago... high capacity crypto aggregation points like this are an ideal target, with backdoor keying of VPN/SSL the ideal (passive) attack with their view of target's long haul fiber. > By 2013, Intel had already started shipping Haswell. They did launch new IVB > E5v2 Xeon server processors this fall, but future CPUs will be Haswell and > Broadwell. > > Intel already has the next, next generation Skylake with SGX fabricated for > testing. but not released, and "enabling" means tied into X-KEYSCORE, TRAFFICTHIEF, whatever else gets draped off UPSTREAM... > I still think the document is talking about a dedicated crypto chip for VPN > and SSL acceleration devices, just like it says. the backdoors for all the other vendor hardware happened in years prior. HSMs and crypto accelerator gear is not exactly a vibrant or competitive market. in fact, these companies never seem to die, just carry on with decent margins riding on incremental design upgrades until they're bought out by a larger/growing competitor. ;) of course, this could be because companies like Sun charge $9,999 for an HSM/accelerator that is at best a reasonable cost at $1,499...

1 1

Re: [cryptography] Which encryption chips are compromised?
by John Young 12 Dec '13

12 Dec '13

Please stop this suicidal, treacherous discussion. You're undermining the global industry of weak crypto and comsec. That counts as economic terrorism in all the countries who abide arms control, export control, copyright, capitalism, heirarchical rule, suppression of dissent, lawful spying, breaking and entering black jobs, ubiquitous spying on each other and everybody else, in particular what NRO terms "unobservable and unknown phenomena," and a lot of other secret stuff which can only be revealed by low-ranked knobheads sure to be burned at the stake by their cowardly protectors for the irresistable allure of IPO millions based on government contracts to keep this shit among us. Got that? This is a place to share fudging how it should work, and does now and then. You think this is bullshit, dontcha? Well, it aint. Why look at the rising use of Tor, PFS, TLS, those rat-infested private keyservers and millions of eaters of Symantec back-doored dookie-pie. You seen any US producers of comsec go under yet? No, and you wont, for they are locked into surefire global success when failure is built into their products. Screwing customers and citizens with faulty comsec, what's wrong with that, where you been, that's patriotic, and damn profitable. Sure, call for outraged dissent, fine, great, if that moves the ponzi, balloons those bitcoins. At 09:08 AM 12/12/2013, coderman wrote: >i see your skepticism, and i raise you a retort! ;) > >also, this year by end of year, in 2013 you expect to: >- Make gains in enabling decryption and Computer Network Exploitation >(CNE) access to fourth generation/Long Term Evolution (4GL/LTE) >networks by inserting vulnerabilities. >- Complete enabling for [well recognized name] encryption chips used >in Virtual Private Network and Web encryption devices. >and last but not least, >- Shape the worldwide commercial cryptography marketplace to make it >more tractable to advanced cryptanalytic capabilities being developed >by NSA/CSS. > >Ok, given those requirements. Who fits the bill?

2 1

Re: [cryptography] Which encryption chips are compromised?
by Andy Isaacson 12 Dec '13

12 Dec '13

On Wed, Dec 11, 2013 at 06:28:31PM -0800, Steve Weis wrote: > On Wed, Dec 11, 2013 at 6:00 PM, coderman <coderman(a)gmail.com> wrote: > > unredacted: > > https://peertech.org/dist/nsa-cpp-goals-FY2013-unredact.png > > > > "Intel Ivy Bridge" > > Is this a guess because "Intel Ivy Bridge" fits into the redacted space or > is there some other evidence? I believe it's just a guess based on fit. > Ivy Bridge processors are general purpose x86 CPUs. It doesn't make sense > to me to refer to it as an "encryption chip" for "web encryption devices". > Do you know of products using IVB processors for SSL offloading or in VPN > appliances? Suppose I'm the manager writing this document, reporting the expected accomplishments of my group. We do cryptanalysis. If we're projecting success against FooBarCo chips' encryption sub-core, and everybody knows FooBarCo chips are used in both encryption and non-encryption products, it makes sense to cite the specific applications where FooBarCo chips are used. So "for FooBarCo chips used in VPN and SSL" makes sense, even if FooBarCo chips are not *solely* VPN and SSL. However, in "for FooBarCo encryption chips used in VPN", the "encryption" seems to me to denote a special purpose chip, rather than a general purpose chip with an encryption sub-core. I've seen worse manglings of language in similar documents, though, so I would not put it past said middle manager to write "for Intel Ivy Bridge encryption chips used in VPN and SSL", even though that's a bit of word salad to anyone who knows the technology. > To me, the redacted document sounds like it's referring to a security > processor used for SSL offloading. For example, something like a Cavium > Nitrox (which I'm not implying is the subject of the document). "Cavium Networks" or "Cavium Nitrox" are approximately the right length to fit. Other vendors that might be interesting include F5, Barracuda, Riverbed, Cisco SCA 11000, Radware (an Israeli/American company), and everybody listed on http://en.wikipedia.org/wiki/SSL_Acceleration The document looks like Word and appears to be fully justified; anyone with that software want to match the fonts and try out various substitutions to see what fits best? Note that http://s3.documentcloud.org/documents/784159/sigintenabling-clean-1.pdf seems to have been digitally processed and redacted; the font baselines are perfectly aligned, to the sub-pixel antialiasing limit; while http://s3.documentcloud.org/documents/784280/sigint-enabling-project.pdf appears to have gone out to paper and then been scanned in on a non-flatbed scanner; there is significant vertical slew across the line of text in question. Since the source document appears to be the same for both, an enterprising DTP jockey could use -clean-1.pdf to tune the document settings precisely, and then use -project.pdf to search for better unredaction matches. -andy

2 3

IndependenceKey?
by Matej Kovacic 12 Dec '13

12 Dec '13

Hi, just a quick question - anyone familiar with this: http://www.independencekey.com/ or with the Swiss company Quantec, whis developed this product? Regards, M.

1 0