December 2013 - cypherpunks - lists.cpunks.org

Re: [cryptography] The next gen P2P secure email solution
by grarpamp 24 Dec '13

24 Dec '13

On Tue, Dec 24, 2013 at 5:03 AM, Natanael <natanael.l(a)gmail.com> wrote: > Somebody in there mentioned allowing IPv6 addressing on top of I2P/Tor. That > would be Garlicat/Onioncat. It creates a local virtual IPv6 network > interface for your software to use, so that you can map key based addresses > to routable local addresses. > > https://www.onioncat.org/about-onioncat/ It is worth noting that Phantom does this natively without needing an overlay on top of another net. It may also use disk to cache some network information, at least their whitepaper says they are 'for' making that choice. Perhaps it can be scaled? https://code.google.com/p/phantom

1 0

Re: [p2p-hackers] [Cryptography] Size of the PGP userbase?
by grarpamp 24 Dec '13

24 Dec '13

Send things to the list, not me. On Mon, Dec 23, 2013 at 5:50 PM, Bill Broadley <bill(a)broadley.org> wrote: > On 12/16/2013 12:01 AM, grarpamp wrote: >>> You may have a look of "I2P Bote" it is severless, encrypted mail >>> system, address is the public key, P2P based... nice tool. >> >> As in another post of mine, I'll be looking at that again. >> My first take was that it stores the messages in the DHT, >> which didn't seem scalable or reliable at all. I may be >> wrong as I read more later. > > I feel like I walking in halfway into a conversation, I'm guessing this > started on the cryptography list that I'm not on. > > Your DHT comment caught my attention though. What in particular about > DHTs don't seem scalable or reliable? > > Seems like DHTs are regularly in the 5-10M range and I don't see any > reason that DHTs couldn't be 10 times that. > > Any reasonable churn rate and reliability could be handled with > replication. The bit-torrent DHT for instance claims that 45% of users > that bootstrap from a central node are reachable 15 minutes later. So > typical setups involve 8 nodes per bin, and 20 bins. So every 15 > minutes you ping 160 hosts, only reach 45%, and do some work to > repopulate the missing slots. > > Given the simplicity of the bit-torrent DHT I think there's plenty of > room for improvement. Larger routing tables are obvious (at the cost of > more network bandwidth to track peers). > > The most promising idea for DHT improvements I've seen is to divide > peers into 3 latency groups. High, medium, and low. Much like L1 > cache, L2 cache, and main memory. That way common queries are very > fast, yet all queries still to find keys globally.

1 0

Re: [Cryptography] HSBC's Password Approach: Impressive
by grarpamp 23 Dec '13

23 Dec '13

> They are being pretty clever to make up for terribly endpoint security. Yeah, all that might work for non brick and mortar stuff you maybe care about, say email [1], and your fave pornsite. But really... you need to be able to demand a hardware OTP token from your bank and brokerage... plenty of cheap open hw exists for that, not RSA, ahem. Any B&M's that don't offer hw are just using 'clever' obfuscation or cost reduction around the issue of real security. But since they already cost reduced that nice 4-7% interest they used to pay you, don't expect this anytime soon. Unless they figure with real security they could then twist responsibility for that account wiping transaction to uganda... on you. [1] Outlook.com uses that stupid 'no cut/paste' thing, worthless and annoying as fuck for those of us who use real password safes with real random unmemorizable passwords.

1 0

re: stu-iii type4 included; Key Gen Servers; TEMPEST; CMW.....
by Joseph Tag 23 Dec '13

23 Dec '13

I am reminded that Gretag AG ( Swiss ) now Gretacode/Omnisec made type 4 STU-3 ; partner of U.S. company Datotek ( Farmers Branch / Realty Rd; Dallas TX ) : modified the CSD-4100 phone. Now see http://www.tccsecure.comWest Concord MA USA. TCC and Datotek were arch rivals and Datotek buckled. Datotek founded by ex Texas Instruments folks. Also be aware of Motorola Sectel 9600. It is wild how Govt influences others! IBM , DEC-Digital Equipment Corp, HP, Data General, SUN ( now Oracle ) , Wang Labs all made TEMPEST terminals and other equipment. Best wishes to all. End. -- Sent from Gmail Mobile

1 0

Alan Turing Pardoned by Queen Elizabeth II
by John Young 23 Dec '13

23 Dec '13

<http://cryptome.org/2013/12/turing-pardon.pdf>http://cryptome.org/2013/12/turing-pardon.pdf

1 0

Acoustic Cryptanalysis: Extracting RSA Key From GnuPG by capturing Computer Sound
by Jelle De Taeye 23 Dec '13

23 Dec '13

Thought this could be interesting: http://thehackernews.com/2013/12/acoustic-cryptanalysis-extracting-rsa.html Paper: http://www.tau.ac.il/~tromer/papers/acoustic-20131218.pdf

1 0

Re: FYI
by John Young 23 Dec '13

23 Dec '13

At 12:39 PM 12/22/2013, you wrote: >i was accessing this site for months, based on >frontpage cryptome recommendation. is it spoofed? > >https://secure.netsolhost.com/cryptome.org/index.html No, it's legit. We don't promote it to avoid entrapping believers in https. Go there are your peril same as the quicksand quagmire. Just to confess, we don't have control of our ISP servers, thus warn of what is happening behind impossible security promises from us to others. Warning seldom heeded so powerful is the PR for online protection fantasies. Few people have control of what their sites are used for. Thus the cosmetic policy privacies which conceal abuse bruises. Not as bad as 24x7x365 top security staff outfoxed by Snowdens, similars and betters not doing what Ed did, or is said to do, or misunderstood to do, or is doing now under the noses of the explainers, investigators, spoofers, black marketers, the usual stabbers, slashees, hackes, punks, investors and angels. This is not limited to Windows, applies to all software and hardware and networks and whatchagot there air-gapped, padlocked, SCIFed, totally secure, as the Snowden hoarders brag, believing wierdly that what Snowden did will never happen to them, or has already happened, or happened on 0-day.

2 1

Re: request for transcript: Bruce Schneier and Eben Moglen discuss a post-Snowden Internet
by Juan Garofalo 23 Dec '13

23 Dec '13

more schneier's transcriptions "there are legitimate secrets in there that you actually don't want released - there are - there really are" "a wikileaks style data dump would not be fun for anybody - so that's good" So, this is the guy who says that tor works. Lol.

1 0

Exclusive: Secret contract tied NSA and security industry pioneer
by Jim Bell 23 Dec '13

23 Dec '13

http://news.yahoo.com/exclusive-secret-contract-tied-nsa-security-industry-… By Joseph Menn SAN FRANCISCO (Reuters) - As a key part of a campaign to embed encryption software that it could crack into widely used computer products, the U.S. National Security Agency arranged a secret $10 million contract with RSA, one of the most influential firms in the computer security industry, Reuters has learned. Documents leaked by former NSA contractor Edward Snowden show that the NSA created and promulgated a flawed formula for generating random numbers to create a "back door" in encryption products, the New York Times reported in September. Reuters later reported that RSA became the most important distributor of that formula by rolling it into a software tool called Bsafe that is used to enhance security in personal computers and many other products. Undisclosed until now was that RSA received $10 million in a deal that set the NSA formula as the preferred, or default, method for number generation in the BSafe software, according to two sources familiar with the contract. Although that sum might seem paltry, it represented more than a third of the revenue that the relevant division at RSA had taken in during the entire previous year, securities filings show. The earlier disclosures of RSA's entanglement with the NSA already had shocked some in the close-knit world of computer security experts. The company had a long history of championing privacy and security, and it played a leading role in blocking a 1990s effort by the NSA to require a special chip to enable spying on a wide range of computer and communications products. RSA, now a subsidiary of computer storage giant EMC Corp, urged customers to stop using the NSA formula after the Snowden disclosures revealed its weakness. RSA and EMC declined to answer questions for this story, but RSA said in a statement: "RSA always acts in the best interest of its customers and under no circumstances does RSA design or enable any back doors in our products. Decisions about the features and functionality of RSA products are our own." The NSA declined to comment. The RSA deal shows one way the NSA carried out what Snowden's documents describe as a key strategy for enhancing surveillance: the systematic erosion of security tools. NSA documents released in recent months called for using "commercial relationships" to advance that goal, but did not name any security companies as collaborators. The NSA came under attack this week in a landmark report from a White House panel appointed to review U.S. surveillance policy. The panel noted that "encryption is an essential basis for trust on the Internet," and called for a halt to any NSA efforts to undermine it. Most of the dozen current and former RSA employees interviewed said that the company erred in agreeing to such a contract, and many cited RSA's corporate evolution away from pure cryptography products as one of the reasons it occurred. But several said that RSA also was misled by government officials, who portrayed the formula as a secure technological advance. "They did not show their true hand," one person briefed on the deal said of the NSA, asserting that government officials did not let on that they knew how to break the encryption. STORIED HISTORY View gallery A National Security Agency (NSA) data gathering facility is seen in Bluffdale, about 25 miles (40 km … Started by MIT professors in the 1970s and led for years by ex-Marine Jim Bidzos, RSA and its core algorithm were both named for the last initials of the three founders, who revolutionized cryptography. Little known to the public, RSA's encryption tools have been licensed by most large technology companies, which in turn use them to protect computers used by hundreds of millions of people. At the core of RSA's products was a technology known as public key cryptography. Instead of using the same key for encoding and then decoding a message, there are two keys related to each other mathematically. The first, publicly available key is used to encode a message for someone, who then uses a second, private key to reveal it. From RSA's earliest days, the U.S. intelligence establishment worried it would not be able to crack well-engineered public key cryptography. Martin Hellman, a former Stanford researcher who led the team that first invented the technique, said NSA experts tried to talk him and others into believing that the keys did not have to be as large as they planned. The stakes rose when more technology companies adopted RSA's methods and Internet use began to soar. The Clinton administration embraced the Clipper Chip, envisioned as a mandatory component in phones and computers to enable officials to overcome encryption with a warrant. RSA led a fierce public campaign against the effort, distributing posters with a foundering sailing ship and the words "Sink Clipper!" A key argument against the chip was that overseas buyers would shun U.S. technology products if they were ready-made for spying. Some companies say that is just what has happened in the wake of the Snowden disclosures. The White House abandoned the Clipper Chip and instead relied on export controls to prevent the best cryptography from crossing U.S. borders. RSA once again rallied the industry, and it set up an Australian division that could ship what it wanted. "We became the tip of the spear, so to speak, in this fight against government efforts," Bidzos recalled in an oral history. RSA EVOLVES RSA and others claimed victory when export restrictions relaxed. But the NSA was determined to read what it wanted, and the quest gained urgency after the September 11, 2001 attacks. RSA, meanwhile, was changing. Bidzos stepped down as CEO in 1999 to concentrate on VeriSign, a security certificate company that had been spun out of RSA. The elite lab Bidzos had founded in Silicon Valley moved east to Massachusetts, and many top engineers left the company, several former employees said. And the BSafe toolkit was becoming a much smaller part of the company. By 2005, BSafe and other tools for developers brought in just $27.5 million of RSA's revenue, less than 9% of the $310 million total. "When I joined there were 10 people in the labs, and we were fighting the NSA," said Victor Chan, who rose to lead engineering and the Australian operation before he left in 2005. "It became a very different company later on." By the first half of 2006, RSA was among the many technology companies seeing the U.S. government as a partner against overseas hackers. New RSA Chief Executive Art Coviello and his team still wanted to be seen as part of the technological vanguard, former employees say, and the NSA had just the right pitch. Coviello declined an interview request. An algorithm called Dual Elliptic Curve, developed inside the agency, was on the road to approval by the National Institutes of Standards and Technology as one of four acceptable methods for generating random numbers. NIST's blessing is required for many products sold to the government and often sets a broader de facto standard. RSA adopted the algorithm even before NIST approved it. The NSA then cited the early use of Dual Elliptic Curve inside the government to argue successfully for NIST approval, according to an official familiar with the proceedings. RSA's contract made Dual Elliptic Curve the default option for producing random numbers in the RSA toolkit. No alarms were raised, former employees said, because the deal was handled by business leaders rather than pure technologists. "The labs group had played a very intricate role at BSafe, and they were basically gone," said labs veteran Michael Wenocur, who left in 1999. Within a year, major questions were raised about Dual Elliptic Curve. Cryptography authority Bruce Schneier wrote that the weaknesses in the formula "can only be described as a back door." After reports of the back door in September, RSA urged its customers to stop using the Dual Elliptic Curve number generator. But unlike the Clipper Chip fight two decades ago, the company is saying little in public, and it declined to discuss how the NSA entanglements have affected its relationships with customers. The White House, meanwhile, says it will consider this week's panel recommendation that any efforts to subvert cryptography be abandoned. (Reporting by Joseph Menn; Editing by Jonathan Weber and Grant McCool)

4 3

private sector privacy enhancing technology transition for disillusioned IC employees
by coderman 23 Dec '13

23 Dec '13

if DEA finds meaningful work in legal marijuana[0], will IC community find meaningful work red teaming and supporting privacy enhancing technologies and usable open source crypto? knowing how to break things useful in building systems that are harder to break... 0. "DEA agents finding greener jobs in lucrative legal marijuana industry" http://blog.oregonlive.com/portland_impact/print.html?entry=/2013/12/dea_ag…

2 1