- cypherpunks - lists.cpunks.org

Women as the next wave of growth in US wealth management
by professor rat 05 Jul '22

05 Jul '22

This is probably key to the success of Cypherpunk 2027 - and will certainly assist in the APstering of all known sex-assault merchants and rapists. ACID, Amnesty and Abortion - hallowed be thy names. And DEATH to the Patriarchy! Viva la revolution.

1 0

The Entrapment Controversy
by Gunnar Larson 05 Jul '22

05 Jul '22

Title: The Entrapment Controversy Source: Minnesota Law Review Citation: 60 Minn. L. Rev. 163 (1976). 212 Highlights: https://drive.google.com/file/d/1rhPWgd_OniZVLeJIlieDBx5VNC2chenn/view?usp=… Originally published in MINNESOTA LAW REVIEW. This article is reprinted with permission from MINNESOTA LAW REVIEW and University of Minnesota Law School.

1 0

Fwd: [pqc-forum] Announcement: The End of the 3rd Round - the First PQC Algorithms to be Standardized
by zeynep＠keemail.me 05 Jul '22

05 Jul '22

> > > ---------- Forwarded message --------- > Gönderen: > 'Moody, Dustin (Fed)' via pqc-forum> > <> pqc-forum(a)list.nist.gov> > > Date: 5 Tem 2022 Sal 18:32 > Subject: [pqc-forum] Announcement: The End of the 3rd Round - the First PQC Algorithms to be Standardized > To: pqc-forum <> pqc-forum(a)list.nist.gov> > > > > > Announcement > > > > > > After careful consideration during the 3> rd> Round of the NIST PQC Standardization Process, NIST has identified four candidate algorithms for standardization. > The primary algorithms NIST recommends be implemented for most use cases are> > CRYSTALS-KYBER (key-establishment) and CRYSTALS-Dilithium (digital signatures).> > In addition, the signature schemes Falcon and SPHINCS+ will also be standardized. > > > > > > Algorithms to be Standardized > > > > > > > Public-Key Encryption/KEMs > > > CRYSTALS-KYBER > > > > > > Digital Signatures > > > CRYSTALS-Dilithium > > > Falcon > > > SPHINCS+ > > > > > > > > > > CRYSTALS-KYBER > (key-establishment)> and CRYSTALS-Dilithium > (digital signatures) > were both selected for their strong security and excellent performance, and NIST expects them to work well in most applications. Falcon will also be standardized by NIST since there may be use cases for which CRYSTALS-Dilithium signatures are too large. Additionally, SPHINCS+ will be standardized to avoid only relying on the security of lattices for signatures. NIST asks for public feedback on a version of SPHINCS+ with a lower number of maximum signatures. > > > > > > Additionally, the following candidate KEM algorithms will advance to the fourth round: > > > > > > 4> th> Round Candidates > > > > > > > Public-Key Encryption/KEMs > > > BIKE > > > Classic McEliece > > > HQC > > > SIKE > > > > > > > > > > Both BIKE and HQC are based on structured codes, and > either > would be suitable as a general-purpose KEM that is not based on lattices.> > NIST expects to select at most one of these two candidates for standardization at the conclusion of the> > fourth round. SIKE remains an attractive candidate for standardization because of its small> > key and ciphertext sizes and will continue to study it in the fourth round. Classic> > McEliece was a finalist but is not being standardized by NIST at this time. Although Classic> > McEliece is widely regarded as secure, NIST does not anticipate> > it being widely used due to its large public key size. NIST may choose to standardize Classic McEliece at the end of the fourth round. > > > > > > For the algorithms moving on to the fourth round, NIST will allow the submission teams to provide updated specifications and implementations (“tweaks”). The deadline for these tweaks will be > October 1, 2022> . Any submission team that feels that they may not meet the deadline should contact NIST as soon as possible. NIST will review the proposed modifications and publish the accepted submissions shortly afterwards. As a general guideline, NIST expects any modifications to be relatively minor. The fourth round will proceed similarly to the previous rounds. More detailed information and guidance will be provided in another message. > > > > > > A detailed description of the decision process and rationale for selection will be included in NIST Interagency or Internal Report (NISTIR) 8413, > Status Report on the Third Round of the NIST Post-Quantum Cryptography Standardization Process, > which will soon be available at > https://csrc.nist.gov/publications> and on the NIST post-quantum webpage > https://nist.gov/pqcrypto> . Questions may be directed to > pqc-comments(a)nist.gov> . > > > > > > NIST will create new draft standards for the algorithms to be standardized and will coordinate with the submission teams to ensure that the standards comply with the specifications. As part of the drafting process, NIST will seek input on specific parameter sets to include, particularly for security category 1. When finished, the standards will be posted for public comment. After the close of the comment period, NIST will revise the draft standards as appropriate based on the feedback received. A final review, approval, and promulgation process will then follow. > > > > > > NIST will hold a 4th NIST PQC Standardization Conference on November 29 – December 1, 2022. The conference details have not yet been finalized. The preliminary Call for Papers will be posted, both on the pqc-forum and the NIST PQC webpage > http://nist.gov/pqcrypto> . > > > NIST also plans to issue a new Call for Proposals for public-key (quantum-resistant) digital signature algorithms by the end of summer 2022. NIST is primarily looking to diversify its signature portfolio, so signature schemes that are not based on structured lattices are of greatest interest. NIST would like submissions for signature schemes that have short signatures and fast verification (e.g., UOV). Submissions in response to this call will be due by June 1, 2023. Submitters are encouraged to communicate with NIST ahead of time. NIST will decide which (if any) of the submitted signature algorithms to accept and will initiate a new process for evaluation. NIST expects this process to be much smaller in scope than the current PQC process. The signature schemes accepted to this process will need to be thoroughly analyzed, which will similarly take several years. > > > > > > NIST would like to thank the community and all of the submission teams for their efforts in this standardization process and hopes that the teams whose schemes were not selected to advance will continue to participate by evaluating and analyzing the remaining cryptosystems alongside the cryptographic community at large. These combined efforts are crucial to the development of NIST’s future post-quantum public-key standards. > > > > > > > > > The NIST PQC team > > > > > > > > -- > You received this message because you are subscribed to the Google Groups "pqc-forum" group. > To unsubscribe from this group and stop receiving emails from it, send an email to > pqc-forum+unsubscribe(a)list.nist.gov> . > To view this discussion on the web visit > https://groups.google.com/a/list.nist.gov/d/msgid/pqc-forum/SA1PR09MB866933… <https://groups.google.com/a/list.nist.gov/d/msgid/pqc-forum/SA1PR09MB866933…>> . >

1 0

Women as the next wave of growth in US wealth management
by Gunnar Larson 05 Jul '22

05 Jul '22

An unprecedented amount of assets will shift into the hands of US women over the next three to five years, representing a $30 trillion opportunity by the end of the decade. https://www.mckinsey.com/industries/financial-services/our-insights/women-a…

1 0

United States: Don't Say Daubert – Reviving Rule 702
by Gunnar Larson 05 Jul '22

05 Jul '22

Expert testimony is often decisive. The standard governing its admissibility is therefore critically important. For years, federal practitioners have referred to that standard as the " *Daubert*" standard, for the Supreme Court's seminal decision in *Daubert v. Merrill Dow Pharmaceuticals*, 509U.S. 579 (1993). https://www.mondaq.com/unitedstates/trials-appeals-compensation/1207626/don…

1 0

Capstone Spacecraft on Moon Mission Loses Contact, NASA Says
by Gunnar Larson 05 Jul '22

05 Jul '22

Capstone Spacecraft on Moon Mission Loses Contact, NASA Says https://www.bloomberg.com/news/articles/2022-07-05/capstone-spacecraft-on-m…

1 0

Globalism: MINDSPACE - From 9/11 to The Great Reset Matrix
by grarpamp 05 Jul '22

05 Jul '22

https://asiatimes.com/2020/09/from-9-11-to-the-great-reset/ https://sustainabledevelopment.un.org/content/documents/21252030%20Agenda%2… https://www.bi.team/publications/mindspace/ " Something’s gotta give. And then, out of the blue, it did. A drive by design towards ironclad concentration of power and geoeconomic diktats was first conceptualized – under the deceptive cover of “sustainable development” – already in 2015 at the UN (here it is, in detail). Now, this new operating system – or technocratic digital dystopia – is finally being codified, packaged and “sold” since mid summer via a lavish, concerted propaganda campaign. The whole Planet Lockdown hysteria that elevated Covid-19 to post-modern Black Plague proportions has been consistently debunked, for instance here and here, drawing from the highly respected, original Cambridge source. The de facto controlled demolition of large swathes of the global economy allowed corporate and vulture capitalism, world wide, to rake untold profits out of the destruction of collapsed businesses. And all that proceeded with widespread public acceptance – an astonishing process of voluntary servitude. None of it is accidental. As an example, over ten years ago, even before setting up a – privatized – Behavioral Insights Team, the British government was very much interested in “influencing” behavior, in collaboration with the London School of Economics and Imperial College. The end result was the MINDSPACE report. That was all about behavioral science influencing policymaking and most of all, imposing neo-Orwellian population control. MINDSPACE, crucially, featured close collaboration between Imperial College and the Santa Monica-based RAND corporation. Translation: the authors of the absurdly flawed computer models that fed the Planet Lockdown paranoia working in conjunction with the top Pentagon-linked think tank. https://www.weforum.org/focus/the-great-reset https://intelligence.weforum.org/ https://www.weforum.org/agenda/2020/04/strategic-intelligence-widget-artifi… https://www.weforum.org/agenda/2020/06/now-is-the-time-for-a-great-reset/ https://www.weforum.org/agenda/2020/07/covid19-this-is-how-to-get-the-great… And that is more than enough to beautifully set up “the cure”: The Great Reset. The beating heart The Great Reset was officially launched in early June by the World Economic Forum (WEF) – the natural habitat of Davos Man. Its conceptual base is something the WEF describes as Strategic Intelligence Platform: “a dynamic system of contextual intelligence that enables users to trace relationships and interdependencies between issues, supporting more informed decision-making”. The Great Reset is immensely ambitious, spanning over 50 fields of knowledge and practice. It interconnects everything from economy recovery recommendations to “sustainable business models”, from restoration of the environment to the redesign of social contracts. The beating heart of this matrix is – what else – the Strategic Intelligence Platform, encompassing, literally, everything: “sustainable development”, “global governance”, capital markets, climate change, biodiversity, human rights, gender parity, LGBTI, systemic racism, international trade and investment, the – wobbly – future of the travel and tourism industries, food, air pollution, digital identity, blockchain, 5G, robotics, artificial intelligence (AI). The Great Reset presupposes that all stakeholders – as in the whole planet – must toe the line. Otherwise, as Schwab stresses, we will have “more polarization, nationalism, racism, increased social unrest and conflicts”. In the end, only an all-in-one Plan A applies for making these systems interact seamlessly: the Great Reset – shorthand for a New World Order that has always been glowingly evoked, but never implemented. There is no Plan B. Whether Covid-19’s ultimate “window of opportunity” presented itself as a mere coincidence or by design, will always remain a very juicy question. Already three months ago, Schwab’s book hinted that the more everyone is mired in the global paralysis, the more it’s clear that things will never be allowed (italics mine) to return to what we considered normal. What has been imposed as an ironclad consensus is that without a Covid-19 vaccine there’s no possibility of anything resembling normality. https://www.strategic-culture.org/news/2020/05/15/how-biosecurity-is-enabli… What matters above all is the “window of opportunity” offered by Covid-19, boosting, among other issues, the expansion of what I previously described as Digital Neo-Feudalism – or Algorithm gobbling up Politics. No wonder politico-economic institutions from the WTO to the EU as well as the Trilateral Commission are already investing in “rejuvenation” processes, code for even more concentration of power. "

1 2

Cryptocurrency: BAPESCLAN Hijacks BritArmy's Social Media
by grarpamp 05 Jul '22

05 Jul '22

British Army's YouTube & Twitter Accounts Briefly Spammed With Crypto Video And Elon Musk Photos https://www.theepochtimes.com/british-armys-youtube-and-twitter-accounts-br… https://www.theepochtimes.com/cyber-insurance-costs-spike-113-percent-in-a-… An investigation is underway after the British Army’s social media accounts were briefly hijacked on Sunday. The army’s YouTube channel was renamed “Ark Invest” - a global investment management firm - and featured a number a videos on cyptocurrency with images of billionaire entrepreneur Elon Musk. The Epoch Times has contacted Ark Invest for comment. Its Twitter account was briefly renamed Bapesclan, with a clownish profile photo that appears to be a cartoon ape figure donning an outfit inspired by the main character in the 2019 “Joker” film. Screengrab of the British Army Twitter page after it was hacked on July 3, 2022. (PA Media) The account made several posts about non-fungible tokens - a distinct cryptographic token that cannot be replicated, which acts as a certificate of ownership for virtual items - before being restored to normal. The Ministry of Defense (MoD) said it was aware of a breach of the accounts in a Twitter post at 7:10 p.m. Two hours later, the British Army apologised on Twitter for “the temporary interruption” and said that “normal service will now resume.” “We will conduct a full investigation and learn from this incident,” the message reads. The MoD later confirmed that the breach had been resolved and an investigation is underway. “The Army takes information security extremely seriously and until their investigation is complete it would be inappropriate to comment further,” the MoD said on Twitter. Tobias Ellwood, the Conservative MP for Bournemouth East and chair of the House of Commons Defence Select Committee, said the incident looked “serious.” “I hope the results of the investigation and actions taken will be shared appropriately,” Ellwood said on Twitter. Cybersecurity has become a pervasive issue as the world becomes more interconnected. Earlier this year, cybersecurity agencies from the United States, United Kingdom, Australia, New Zealand, and Canada said hackers were targeting public and private sectors and warned organisations to implement mitigation strategies. The Five Eyes state agencies recommended regular updates of software, implementing a centralised patching system, implementing multi-factor authentication, ensuring remote employees had strong passwords, protecting controls and architecture, and encrypting network traffic. However, the cost of monitoring and protecting against cyber threats has also ballooned. A February report found that the average cost of insurance to cover cybersecurity breaches spiked 113 percent in Australia from 2020 to 2021.

1 0

Dark Markets: Ukraine's Weapons Bunkers Being Sold On Darknets
by grarpamp 05 Jul '22

05 Jul '22

Journos spend BTC on people selling pictures of weapons and lolcats... Are US Weapons Supplied To Ukraine Ending Up On DarkNet Marketplaces? https://www.rt.com/news/558263-ukraine-western-weapons-darknet/ The lack of oversight for billions of dollars in US weapons pumped into Ukraine has concerned the Pentagon. They're worried about anti-tank missiles and explosive drones ending up in the "wrong hands." A new investigation allegedly found some of these weapons are being sold on the dark web. RT journalists pretended to be weapons buyers and claimed to have come in contact with Ukrainian arms smugglers offering machine guns, body armor, and some of the US/West's most advanced weapons, such as Javelin and NLAW anti-tank systems or Phoenix Ghost and Switchblade explosive drones. The journalist said one darknet marketplace had a Phoenix Ghost loitering munition listed for $4,000. Another Ukrainian arms smuggler offered US-made body armor sets for $1,500 and M4 carbines with suppressors and hundreds of 5.56×45mm NATO rounds for $2,400 per set. Besides US weapons, Ukrainian arms smugglers were selling British-made NLAW anti-tank systems for $15,000. Acquiring the anti-tank weapon legally would cost between $30,000 to $40,000. Since the journalist never completed transactions with the sellers, RT said, "it's not possible to completely rule out that the sellers actually did not have the said weapons in stock, as the RT investigators did not complete the purchase. Scamming schemes are common for dark web marketplaces." As early as April, US officials began admitting that once Javelin anti-tank weapons cross into Ukraine, they have no idea where they go from there. One intelligence source told CNN: "We have fidelity for a short time, but when it enters the fog of war, we have almost zero. It drops into a big black hole, and you have almost no sense of it after a short time." The European police agency Europol has also warned about the massive amount of weapons being pumped from the West into Ukraine. Once the weapons hit the ground, there's no tracking the weapons from there, and some end up in criminal gangs' hands. "The weapons from this war are still being used by criminal groups today," Europol Director Catherine De Bolle told the German newspaper Welt am Sonntag in June. Last Thursday, the Pentagon's Defense Security Cooperation Agency (DSCA) issued a statement urging US military leaders to send weapons inspectors into the war-torn country to monitor where the billions of dollars in arms are being handed out. RT's investigation sheds important light on the Pentagon's worst fears of high-tech weapons ending up in the wrong hands and some of the weapons for sale on the darknet. There may never be oversight and accountability of the weapons on the ground because, as the NYTimes recently said, the CIA has had a presence on the battlefield since the start of the invasion. When it comes to the CIA's covert arms programs, they usually like to keep where the weapons are being sent a secret.

1 0

Intel SGX deprecation review
by coderman 05 Jul '22

05 Jul '22

https://hardenedvault.net/blog/2022-01-15-sgx-deprecated/ Intel SGX deprecation review The rumors about Intel SGX deprecated in new processors has been [confirmed](https://www.bleepingcomputer.com/news/security/new-intel-chips-w…, 12th generation processors (Workstation/Desktop/Laptop/embedded platforms) will deprecate SGX and the SGX will continue to support only in high-end Xeon CPU for server: [alter-text] Intel’s official explanation is that final decision is made due to market reasons. Intel SGX (software guard extension) has been shipped with the release of the 6th generation processor Skylake in 2015. Its main purpose is to better solve the trust issue in cloud environments between CSPs (cloud service provider) and tenants. SGX proposes a solution called enclave where OS isn’t able to access to. The technical details of SGX has a lot of controversy since the beginning. This article will explore a bit about SGX: Root problem: complexity Intel SGX is the most sophisticated implementation among the enclave solutions. Intel did a lot of work at multiple levels to leverage the support: - Hardware, e.g: [MEE](https://eprint.iacr.org/2016/086.pdf) - Ucode, for special instructions - Firmware, Intel CSME infrastructure upgrade and multiple CSME modules getting involved SGX basics - SGX hands over paging (EPC) to an untrusted OS, which is similar to [BASTION](http://palms.ee.princeton.edu/node/367), where the host OS can evict. - SGX uses Intel EPID to implement attestation, which is too complex for microcode to implement. - In addition to EPID, SGX also uses other CSME code modules such as iclsClient using CLS (Capability Licensing Services) [alter-text] Attestation process - Seal Secret and Prospering Secret are stored in e-fuses, Provisioning Secret is generated by Intel Key Generation Facility and burned to the CPU and saved in Intel xx service, Seal secret is generated inside the CPU, theoretically unknowable to Intel. - EGETKEY uses certificate-based identify (MRSIGNER, ISVPRODID, ISVSVN) and SGX implementation version (CPUSVN) to get the Provisioning key, which allows the Intel provisioning service to verify that Provisioning Enclave is signed by Intel. The provisioning service can also refuse communication based on CPUSVN to determine if there is a vulnerability. - When Provisioning Enclave obtains the Provisioning Key and communicates with the Intel Provisioning service and authenticates itself, the service generates an Attestation key to provision the Enclave, which encrypts the AK using the Prospering Seal key and saves it. - AK uses the EPID cryptography, EPID as a group signature scheme to provide some anonymity for the signer, Intel key provisioning service is the issuer, it will publish the Group Public Key and will save the Master Issuing Key itself, after the provisioning enclave verifies itself to the service, The service generates an EPID member private key as an AK and then executes the EPID Join protocol to join the signature group, after which Quoting Enclave uses the EPID MPK to generate an attestation signature. Risk： Issued SIGSTRUCT was leaked, and attackers could use the SGX debugging feature to build debugging provisioning or Quoting enclave to modify the code, or get a 128-bit provisioning key to communicate with the Intel service. [Key* of SGX](https://patents.google.com/patent/US20140093074) According to Intel’s patent, the implementation of SGX relies on the complex KDF process inside the CPU circuit for the global secret keys and stored in the eFUSE, Chipworks offers $50-250k to fully extract the eFUSE of one Intel i5 processor, so the eFUSE content is encrypted by a master key (called “global wrapping logic key” in the patent). GWK is used to encrypt a 256-bit message for regenerating the EPID key of the CPU and a handful of 128-bit pre-seed key 0, eFUSE also contains a plaintext copy of 128-bit pre-seed key 1 and a 32-bit EPID group ID, GWK is hard-coded into the chip circuit, all chip manufacturers share the mask set, such a process increases the cost of the attack, But there is also the possibility of being reversed. SGX also uses PUF to generate symmetric keys for the device during the provisioning phase, the PUF key is encrypted by GWK and transmitted to the key generation server, after which the key generation server encrypts the fuse key of the chip with the PUF key and then transmits it to the chip, the PUF key increases the cost of obtaining the chip fuse key. The attacker must compromise provisioning stage simultaneously. CSME also has an eFUSE for saving the EPID key for fTPM. The first scheme is that Provision enclave uses the provisioning seal key to encrypt the DAK, which assumes that CSME is an untrusted flash memeory, so fTPM cannot be used. Another option is to use the key agreement protocol to establish a secure communication channel between DMI buses, which ME fw can be used to store DAKs or to implement fTPM. Wrong threat model in the very beginning Intel SGX puts the owner of on-premise (cloud service vendors, system administrators, etc) into the threat model in the 1st place. Technically, SGX doesn’t trust the operating system and the entire stacks of firmware (except CSME), but Intel might have missed an important common sense: OS kernel may no longer the “CORE” but it’s still the entrance to the “underworld”, as the 0ldsk00l hacker was joking about “don’t make jokes about the underworld”. Most of the attacks targeting SGX are based on having kernel privilege. A [proper threat model](https://blog.invisiblethings.org/papers/2015/state_harmful.pdf) won’t guarantee a comprehensive solution for security but it could be the starting point at least. [alter-text] [Wrong threat model](https://github.com/hardenedlinux/firmware-anatomy/blob/master/hack_M… isn’t the only issue in SGX： - Over-design and implementation leads to out-of-control complexity. - Lack of transparency, Intel SGX implementation is closed-source in terms of dependencies on the underlying firmware, which means it can’t be audited properly with acceptable cost. While SGX is highly dependent on Intel CSME, yet another issue about “god” mode in CSME can be referred to HardenedVault’s [Intel CSME Risk Assessment](https://hardenedvault.net/blog/2021-07-16-ciso-seceng_csme/). - SGX can be used to [protect malware](https://arxiv.org/abs/2107.09470), which malware detection become an impossible mission. - Intel didn’t open up SGX-based third-party attestation services to SME client until December 2018, a decision that may have been a little late from a market and ecological perspective. - SGX’s Linux kernel mainline process is slow. in April 2016, Intel submitted the first version of the SGX patch to the Linux kernel community, the Linux kernel community believes that there are many unresolved basic issues, including ABI compatibility issues and SGX as the core of enclave computing assumptions: if the Linux kernel is compromised, SGX can guarantee that the application is not interfered with by attackers. Even if this premise is correct, the kernel developer’s question is: If there is a malicious enclave application, who will protect the kernel? Moreover, the first premise has been denied by the industry after [L1TF](https://hardenedlinux.github.io/system-security/2018/08/16/meltdown_spectre_l1tf.html) was exposed (although there were also relevant studies exposed before but the media did not report on a large scale), the exposure of L1TF and cryptocurrency bubble crashed in 2018 broke many people’s silver bullet expectations for SGX. A series of issues delayed the upstreaming until Linux kernel v5.11 merged SGX into mainline in Feb 2021. - Launch [low cost of side-channel attacks](https://github.com/jovanbulck/sgx-step) with Linux kernel privileges. - Over-hype in the market, this problem may be more prominent in China. The megacorp continues to advocate that SGX can become the “next generation” silver bullet level program, but the reality is that the general principle in infosec is that there is no silver bullet. Is SGX still an effective security feature? Yes, SGX is still an effective security mechanism to protect your digital assets. Intel has adjusted its expectation for SGX and it’s targeting server-only markets. From the perspective of the production environment, SGX is still a very effective security mechanism that can be utilized to build your own defense-in-depth “Cyber Bunker”.

3 2