September 2021 - cypherpunks - lists.cpunks.org

Cryptocurrency: Privacy Tech Considered Essential
by grarpamp 16 Sep '21

16 Sep '21

Bitcoin Privacy - A Survey on Mixing Techniques Simin Ghesmati and Walid Fdhila and Edgar Weippl https://eprint.iacr.org/2021/629 Abstract: Blockchain is a disruptive technology that promises a multitude of benefits such as transparency, traceability, and immutability. However, this unique bundle of key characteristics rapidly proved to be a double-edged sword that can put user privacy at risk. Unlike traditional systems, Bitcoin transactions are publicly and permanently recorded, and anyone can access the full history of the records. Despite using pseudonymous identities, an adversary can undermine the financial privacy of users and reveal their actual identities using advanced heuristics and techniques to identify eventual links between transactions, senders, receivers, and consumed services (e.g., online purchases). In this regard, a multitude of approaches has been proposed in an attempt to overcome financial transparency and enhance user anonymity. These techniques range from using mixing services to off-chain transactions and address different privacy issues. In this survey, we particularly focus on comparing and evaluating mixing techniques in the Bitcoin blockchain, present their limitations, and highlight the new challenges. Category / Keywords: applications / blockchain anonymity Mixing Date: received 13 May 2021, last revised 20 Aug 2021 Contact author: ghesmti at icloud com Version: 20210820:155838 Studying Bitcoin privacy attacks and their Impact on Bitcoin-based Identity Methods Simin Ghesmati and Walid Fdhila and Edgar Weippl https://eprint.iacr.org/2021/1088 Abstract: The Bitcoin blockchain was the first publicly verifiable, and distributed ledger, where it is possible for everyone to download and check the full history of all data records from the genesis block. These properties lead to the emergence of new types of applications and the redesign of traditional systems that no longer respond to current business needs (e.g., transparency, protection against censorship, decentralization). One particular application is the use of blockchain technology to enable decentralized and self-sovereign identities including new mechanisms for creating, resolving, and revoking them. The public availability of data records has, in turn, paved the way for new kinds of attacks that combine sophisticated heuristics with auxiliary information to compromise users' privacy and deanonymize their identities. In this paper, we review and categorize Bitcoin privacy attacks, investigate their impact on one of the Bitcoin-based identity methods namely did:btcr, and analyze and discuss its privacy properties. Original Publication (with minor differences): Springer Date: received 24 Aug 2021 Contact author: ghesmti at icloud com Version: 20210825:064031 WabiSabi: Centrally Coordinated CoinJoins with Variable Amounts Ádám Ficsór and Yuval Kogman and Lucas Ontivero and István András Seres https://eprint.iacr.org/2021/206 Abstract: Bitcoin transfers value on a public ledger of transactions anyone can verify. Coin ownership is defined in terms of public keys. Despite potential use for private transfers, research has shown that users’ activity can often be traced in practice. Businesses have been built on dragnet surveillance of Bitcoin users because of this lack of strong privacy, which harms its fungibility, a basic property of functional money. Although the public nature of this design lacks strong guarantees for privacy, it does not rule it out. A number of methods have been proposed to strengthen privacy. Among these is CoinJoin, an approach based on multiparty transactions that can introduce ambiguity and break common assumptions that underlie heuristics used for deanonymization. Existing implementations of CoinJoin have several limitations which may partly explain the lack of their widespread adoption. This work introduces WabiSabi, a new protocol for centrally coordinated CoinJoin implementations utilizing keyed verification anonymous credentials and homomorphic value commitments. This improves earlier approaches which utilize blind signatures in both privacy and flexibility, enabling novel use cases and reduced overhead. Category / Keywords: cryptographic protocols / Bitcoin, anonymity, privacy, financial privacy Date: received 24 Feb 2021 Contact author: adam ficsor73 at gmail com, nothingmuch at woobling org, lucasontivero at gmail com, istvanseres at caesar elte hu Version: 20210301:171314 Sword: An Opaque Blockchain Protocol Farid Elwailly https://eprint.iacr.org/2020/1289 Abstract: I describe a blockchain design that hides the transaction graph from Blockchain Analyzers. The design is based on the realization that today the miner creating a block needs enough information to verify the validity of transactions, which makes details about the transactions public and thus allows blockchain analysis. Some protocols, such as Mimblewimble, obscure the transaction amounts but not the source of the funds which is enough to allow for analysis. The insight in this technical note is that the block creator can be restricted to the task of ensuring no double spends. The task of actually verifying transaction balances really belongs to the receiver. The receiver is the one motivated to verify that she is receiving a valid transaction output since she has to convince the next receiver that the balances are valid, otherwise no one will accept her spending transaction. The bulk of the transaction can thus be encrypted in such a manner that only the receiver can decrypt and examine it. Opening this transaction allows the receiver to also open previous transactions to allow her to work her way backward in a chain until she arrives at the coin generation blocks and completely verify the validity of the transaction. Since transactions are encrypted on the blockchain a blockchain analyzer cannot create a transaction graph until he is the receiver of a transaction that allows backward tracing through to some target transaction. Category / Keywords: applications / cryptocurrency, Bitcoin, confidential transaction, blockchain analyzer, stealth address, privacy, Mimblewimble, Sword Date: received 15 Oct 2020 Contact author: sword at elwailly com Version: 20201016:064939 Zerojoin: Combining Zerocoin and CoinJoin Alexander Chepurnoy and Amitabh Saxena https://eprint.iacr.org/2020/560 Abstract: We present Zerojoin, a privacy-enhancing protocol for UTXO blockchains. Like Zerocoin, our protocol uses zero-knowledge proofs and a pool of participants. However, unlike Zerocoin, our pool size is not monotonically increasing. Thus, our protocol overcomes the major drawback of Zerocoin. Our approach can also be considered a non-interactive variant of CoinJoin, where the interaction is replaced by a public transaction on the blockchain. The security of Zerojoin relies on the Decisional-Diffie-Hellman (DDH) assumption. We also present ErgoMix, a practical implementation of Zerojoin on top of Ergo, a smart contract platform based on Sigma protocols. While Zerojoin contains the key ideas, it leaves open the practical issue of handling fees. The key contribution of ErgoMix is a novel approach to handle fees in Zerojoin. Category / Keywords: cryptographic protocols / cryptocurrency, privacy, DDH, zero knowledge Original Publication (with minor differences): Data Privacy Management, Cryptocurrencies and Blockchain Technology. DPM 2020, CBT 2020. Date: received 13 May 2020, last revised 29 Aug 2021 Contact author: kushti at protonmail ch Version: 20210829:211748 Mimblewimble Non-Interactive Transaction Scheme Gary Yu https://eprint.iacr.org/2020/1064 Abstract: I describe a non-interactive transaction scheme for Mimblewimble protocol, so as to overcome the usability issue of the Mimblewimble wallet. With the Diffie–Hellman, we can use an Ephemeral Key shared between the sender and the receiver, a public nonce R is added to the output for that, removing the interactive cooperation procedure. And an additional one-time public key P' is used to lock the output to make it only spendable for the receiver, i.e. the owner of P'. Furtherly, to keep Mimblewimble privacy character, the Stealth Address is used in this new transaction scheme. Category / Keywords: public-key cryptography / Mimblewimble, Stealth address, Bitcoin, Grin, Confidential transaction, Privacy Date: received 2 Sep 2020, last revised 21 Dec 2020 Contact author: gary yu at gotts tech Note: A major updating on the scheme, and analysis on replay attack and rogue-key attack, etc., to substitute the unsafe previous version. Version: 20201221:130713

1 1

Hacks: iTimed - Cache Attacks on the Apple A10 Fusion SoC
by grarpamp 16 Sep '21

16 Sep '21

https://eprint.iacr.org/2021/464 Cryptology ePrint Archive: Report 2021/464 iTimed: Cache Attacks on the Apple A10 Fusion SoC Gregor Haas and Seetal Potluri and Aydin Aysu Abstract: This paper proposes the first cache timing side-channel attack on one of Apple’s mobile devices. Utilizing a recent, permanent exploit named checkm8, we reverse-engineered Apple’s BootROM and created a powerful toolkit for running arbitrary hardware security experiments on Apple’s in-house designed ARM systems-on-a-chip (SoC). Using this toolkit, we then implement an access-driven cache timing attack (in the style of PRIME+PROBE) as a proof-of-concept illustrator. The advanced hardware control enabled by our toolkit allowed us to reverse-engineer key microarchitectural details of the Apple A10 Fusion’s memory hierarchy. We find that the SoC employs a randomized cache-line replacement policy as well as a hardware-based L1 prefetcher. We propose statistical innovations which specifically account for these hardware structures and thus further the state-of-the-art in cache timing attacks. We find that our access-driven attack, at best, can reduce the security of OpenSSL AES-128 by 50 more bits than a straightforward adaptation of PRIME+PROBE, while requiring only half as many side channel measurement traces. Category / Keywords: implementation / SCA, cache attacks, iPhone Original Publication (in the same form): IEEE HOST Date: received 9 Apr 2021, last revised 14 Aug 2021 Contact author: ghaas at ncsu edu Version: 20210814:150739

1 1

SpyVeillance: All Your Phone Data Bought and Sold
by grarpamp 16 Sep '21

16 Sep '21

https://www.wsj.com/articles/law-enforcements-use-of-commercial-phone-data-…

1 0

We could tell you - but then we'd have to kill you, Dept
by professor rat 16 Sep '21

16 Sep '21

" They're concerned about the constitutionality of your Gestapo tactics - AND FRANKLY SO AM I! " https://twitter.com/gabrielmalor/status/1438252347742883845/photo/1 gabrielmalor ·5h 4th Cir. says the state secrets privilege requires the termination of a lawsuit from Wikimedia seeking a declaration that NSA's alleged collection of communications on the internet backbone violates the First and Fourth Amendments. https://ca4.uscourts.gov/opinions/201191.P.pdf All bad jokes, like the US constitution aside, my understanding of routine NSA/CIA/ FBI/etc lawbreaking is that its done through Hawaii Five Eye. Aussies, Kiwi's, Pommies and Canucks can backdoor hapless yankee's as much as they want. Of course we apply a liberal amount of social-lubricant first - so stop whining about it.

1 0

US NUMBER ONE - most corrupt 'science' on the planet, of course.
by Punk-BatSoup-Stasi 2.0 16 Sep '21

16 Sep '21

http://virusmyth.com/aids/hiv/kmdancing.htm "A segment of our society was experimenting with a lifestyle, and it didn't work. They got sick. Another segment of our pluralistic society, call them doctor/scientist refugees from the failed War on Cancer, or just call them professional jackals, discovered that it did work. It worked for them. They are still making payments on their new BMWs out of your pocket." OK, so that's a pretty interesting piece of information, a 'war on cancer'! The US nazis have been parodying themselves since forever. So yeah, https://en.wikipedia.org/wiki/War_on_Cancer "progress in reducing the overall cancer mortality rate has been disappointing." go figure. But of course as mullis points out, the 10,000 of millions of dollars that the US nazi turds looted from the whole planet through dollar 'inflation' have created millions of corrupt 'scientists', aka thieves.

1 0

Kyle Torpey lies about cypherpunks
by professor rat 15 Sep '21

15 Sep '21

Cypherpunk digital ( or 'electronic' post 2008 ) cash was always part of a bigger idea than any projected or desired cryptocurrency. #Anarchism https://protos.com/bitcoin-what-is-cryptocurrency-cypherpunk-digital-cash-g… To elide that idea is to lie about cypherpunks - and worse - insult listeners intelligence. Its the crypto-ANARCHIST economy, stupid.

1 0

Black Prince of the Emirates
by professor rat 15 Sep '21

15 Sep '21

https://en.wikipedia.org/wiki/Erik_Prince#Private_security_for_the_United_A…

1 0

Ex-U.S. Intelligence Officers Admit to Hacking Crimes in Work for Emiratis
by coderman 15 Sep '21

15 Sep '21

https://www.nytimes.com/2021/09/14/us/politics/darkmatter-uae-hacks.html Ex-U.S. Intelligence Officers Admit to Hacking Crimes in Work for Emiratis They were among a trend of Americans working for foreign governments trying to build their cyberoperation abilities. WASHINGTON — Three former American intelligence officers hired by the United Arab Emirates to carry out sophisticated cyberoperations admitted to hacking crimes and to violating U.S. export laws that restrict the transfer of military technology to foreign governments, according to [court documents made public on Tuesday](https://int.nyt.com/data/documenttools/uae-darkmatter-hackers-char…. The documents detail a conspiracy by the three men to furnish the Emirates with advanced technology and to assist Emirati intelligence operatives in breaches aimed at damaging the perceived enemies of the small but powerful Persian Gulf nation. The men helped the Emirates, a close American ally, gain unauthorized access to “acquire data from computers, electronic devices and servers around the world, including on computers and servers in the United States,” prosecutors said. The three men worked for DarkMatter, a company that is effectively an arm of the Emirati government. They are [part of a trend](https://www.nytimes.com/2019/03/21/us/politics/government-hackers-ns… of former American intelligence officers accepting lucrative jobs from foreign governments hoping to bolster their abilities to mount cyberoperations. Legal experts have said the rules governing this new age of digital mercenaries are murky, and the charges made public on Tuesday could be something of an opening salvo by the government in a battle to deter former American spies from becoming guns for hire overseas. The three men, Marc Baier, Ryan Adams and Daniel Gericke, [admitted violating U.S. laws as part of a three-year deferred prosecution agreement](https://www.justice.gov/opa/pr/three-former-us-intelligence-comm…. If the men comply with the agreement, the Justice Department will drop the criminal prosecution. Each man will also pay hundreds of thousands of dollars in fines. The men will also never be able to receive a U.S. government security clearance. Mr. Baier worked for the National Security Agency unit that carries out advanced offensive cyberoperations. Mr. Adams and Mr. Gericke served in the military and in the intelligence community. DarkMatter had its origins in another company, an American firm called CyberPoint that originally won contracts from the Emirates to help protect the country from computer attacks. CyberPoint obtained approval from the American government to work for the Emiratis, a necessary step intended to regulate the export of military and intelligence services. Many of the company’s employees had worked on highly classified projects for the N.S.A. and other American intelligence agencies. But the Emiratis had larger ambitions and repeatedly pressed CyberPoint employees to exceed the boundaries of the company’s American license, according to former employees. CyberPoint rebuffed requests by Emirati intelligence operatives to try to crack encryption codes and to hack websites housed on American servers — operations that would have run afoul of American law. So in 2015 the Emiratis founded DarkMatter — forming a company not bound by U.S. law — and lured numerous American employees of CyberPoint to join, including the three defendants. DarkMatter employed several other former N.S.A. and C.I.A. officers, according to a roster of employees obtained by The New York Times, some making salaries of hundreds of thousands of dollars a year. The investigation into the American employees of DarkMatter has continued for years, and it had been unclear whether prosecutors would bring charges. Experts cited potential diplomatic concerns about jeopardizing the United States’ relationship with the Emirates — a country that has cultivated close ties to the past several American administrations — as well as worries about whether pursuing the case might expose embarrassing details about the extent of the cooperation between DarkMatter and American intelligence agencies. There is also the reality that American laws have been slow to adapt to the technological changes that have provided lucrative work for former spies once trained to conduct offensive cyberoperations against America’s adversaries. Specifically, the rules that govern what American intelligence and military personnel can and cannot provide to foreign governments were devised for 20th-century warfare — for instance, training foreign armies on American military tactics or selling defense equipment like guns or missiles. They have not addressed the hacking skills honed in some of America’s most advanced intelligence units and sold to the highest bidder. This year, the C.I.A. sent a [blunt letter](https://www.nytimes.com/2021/01/26/us/politics/intelligence-officer… to former officers warning them against going to work for foreign governments. The letter, written by the spy agency’s head of counterintelligence, said it was seeing a “detrimental trend” of “foreign governments, either directly or indirectly, hiring former intelligence officials to build up their spying capabilities.” “I can’t mince words — former C.I.A. officers who pursue this type of employment are engaging in activity that may undermine the agency’s mission to the benefit of U.S. competitors and foreign adversaries,” wrote Sheetal T. Patel, the C.I.A.’s assistant director for counterintelligence. Prosecutors said that the Emirates gradually transitioned its contracts from CyberPoint to DarkMatter, but that at no time did the three men obtain the necessary approvals to provide defense services to DarkMatter. The court documents said that the three men and others worked in DarkMatter’s “Cyber Intelligence Operations,” which gained access to “information and data from thousands of targets around the world.” In interviews, former DarkMatter employees said that Emirati officials were particularly focused on hacking the computer systems of the country’s main rival, Qatar, but that operations were also carried out against Emirati dissidents and journalists. They even [hacked the emails](https://www.nytimes.com/2021/02/06/technology/cyber-hackers-usa.htm… of a Qatari minister communicating with the former first lady Michelle Obama about a planned trip to Qatar. Mr. Baier and his group purchased computer tools from U.S. companies for use in hacking operations, according to prosecutors. In two instances, DarkMatter paid about $750,000 and $1.3 million — illustrating how much American companies stand to gain from selling those dangerous tools to foreign countries and businesses. Prosecutors said the men “expanded the breadth and increased the sophistication” of the operations that DarkMatter was providing to the Emirati government. The efforts took aim at “individual, corporate and government targets by compromising computers and accounts belonging to associates, employees or relatives of the primary targets,” according to court documents. Prosecutors said CyberPoint warned the Americans that it could not support DarkMatter’s intended computer exploitation operations without obtaining the proper U.S. authorization. Two former employees, Lori Stroud and Jonathan Cole, left the company after growing troubled about DarkMatter’s hacking and targeting of American citizens. When the pair, who are married, raised the issue with their superiors, they were sidelined, they said. They left the company in 2017 and began cooperating extensively with the F.B.I.’s investigation. “This is a huge win,” Mr. Cole said in an interview on Tuesday. “This will send a message to former U.S. intelligence operatives working overseas. They should not share U.S. tradecraft with foreign governments.”

2 1

The TIME magazine view of the world died by 1981!
by professor rat 15 Sep '21

15 Sep '21

Arsenic and Old Luce. Walking corpse media doesn't get much deader than this. https://www.coindesk.com/tech/2021/09/15/ethereum-founder-vitalik-buterin-n… Buttface on the cover a fitting end to a shoddy empire

1 0

Batshit crazies fucking big dog now
by professor rat 15 Sep '21

15 Sep '21

https://decrypt.co/80971/far-right-conspiracist-sent-60000-bitcoin-fund-leg… I blame John Young - and his BFF Israel Shamir

1 0