- cypherpunks - lists.cpunks.org

Open Technology Fund's Classified Audit
by Rachael Tackett 27 Feb '17

27 Feb '17

1 0

Fwd: [Cryptography] SHA1 collisions make Git vulnerable to attakcs by third-parties, not just repo maintainers
by grarpamp 27 Feb '17

27 Feb '17

> Joan Ioannidas For additional hilarity, look at the mitigation: they just ban the offending hash! ---------- Forwarded message ---------- From: John Gilmore <gnu(a)toad.com> Date: Sun, Feb 26, 2017 at 1:36 AM Subject: Re: [Cryptography] SHA1 collisions make Git vulnerable to attakcs by third-parties, not just repo maintainers To: Peter Todd <pete(a)petertodd.org> Cc: bitcoin-dev(a)lists.linuxfoundation.org, cryptography(a)metzdowd.com I tried to fix this when git was young, when it would've been easy. Linus rejected the suggestion and didn't seem to understand the threat. He wired assumptions about SHA1 deeply into git. In the next few years, nasty people will teach him the threat model, with ungentle manipulations of his and many other peoples' source trees. John To: torvalds(a)osdl.org, gnu(a)toad.com Subject: SHA1 is broken; be sure to parameterize your hash function Date: Sat, 23 Apr 2005 15:21:07 -0700 From: John Gilmore <gnu(a)new.toad.com> It's interesting watching git evolve. I have one comment, which is that the code and the contributors are throwing around the term "SHA1 hash" a lot. They shouldn't. SHA1 has been broken; it's possible to generate two different blobs that hash to the same SHA1 hash. (MD5 has totally failed; there's a one-machine one-day crack. SHA1 is still *hard* to crack.) But as Jon Callas and Bruce Schneier said: "Attacks always get better; they never get worse. It's time to walk, but not run, to the fire exits. You don't see smoke, but the fire alarms have gone off. It's time for us all to migrate away from SHA-1." See the summary with bibliography at: http://www.schneier.com/crypto-gram-0503.html Since we don't have a reliable long-term hash function today, you'll have to change hash functions a few years out. Some foresight now will save much later pain in keeping big trees like the kernel secure. Either that, or you'll want to re-examine git's security assumptions now: what are the implications if multiple different blobs can be intentionally generated that have the same hash? My initial guess is that changing hash functions will be easier than making git work in the presence of unreliable hashing. In the git sources, you'll need to install a better hash function when one is invented. For now, just make sure the code and the repositories are modular -- they don't care what hash function is in use. Whether that means making a single git repository able to use several hash functions, or merely making it possible to have one repository that uses SHA1 and another that uses some future WonderHash, is a system design decision for you and the git contributors to make. The simplest case -- copying a repository with one hash function into a new repository using a different hash function -- will change not only all the hashes, but also the contents of objects that use hash values to point to other objects. If any of those objects are signed (e.g. by PGP keys) then those signatures will not be valid in the new copy. Adding support now for SHA256 as well as SHA1 would make it likely that at least git has no wired-in dependencies on the *names* or *lengths* of hashes, and let you explore the system level issues. (I wouldn't build in the assumption that each different hash function produces a different length output, either, though these two happen to.) Enjoy, John Gilmore Date: Mon, 25 Apr 2005 13:38:40 -0700 (PDT) From: Linus Torvalds <torvalds(a)osdl.org> To: Seth David Schoen <schoen(a)eff.org> cc: John Gilmore <gnu(a)toad.com>, Kees Cook <kees(a)osdl.org> Subject: Re: John Gilmore on SHA-1 [gnu(a)toad.com: Pls forward to Linus: SHA1 is broken] In-Reply-To: <20050425192520.GS14282(a)zork.net> ... As to your SHA1 concerns: > It's interesting watching git evolve. I have one comment, which is > that the code and the contributors are throwing around the term "SHA1 > hash" a lot. They shouldn't. SHA1 has been broken; it's possible to > generate two different blobs that hash to the same SHA1 hash. Actually, even the theoretical breaking has not been proven for a pre-existing SHA1 hash (ie you need to control both the starting point for it), and more importantly, git really uses the SHA1 has a _hash_, not necessarily as a cryptographically secure one. IOW, security doesn't actually depend on the hash being cryptographic, and all git really wants is to avoid collisions, ie it wants it to hash the contents well. That, sha1 definitely does, and even an md5sum would suffice (but having 160 bits instead of "just" 128 obviously adds to the space, so that's always a bonus). Of course, the fact that sha1 is also very expensive to try to fool is a big bonus, since it means that it's just another layer on the real security model. But the _real_ security comes from the fact that git is distributed, which means that a developer should never actually use a public tree for his development. For example, I've got two separate firewall layers (and a NAT) in between me and the internet, and my personal tree is on that machine. I never actually trust or use the external trees - I just push the result to them. This is something you cannot do with a centralized SCM server like SVN or other traditional crud. A centralized one obviously has to be accessible to all the developers, which means that it's forced to be open enough to be much more easily attackable, and also means that there is a single point of failure also from a security standpoint. In contrast, even if somebody were to compromise my machine, that does _not_ automatically compromise the trees of other developers. They'd still have all the pristine objects, and never even fetch an object from me that has the same name (ie sha1 hash) as one they already have. In other words, to really break a git archive, you need to - be able to replace an existing SHA1 hash'ed object with one that hashes to the same thing (_not_ the breakage that has been shown to be possible already) - the replacement has to still honor all the other git consistency checks (even "blob" objects have them: they need to have a valid header with a valid length, so it's not sufficient to just find another object that hashes to the right thing, you have to find an object with a valid header that hashes to the right thing) - you have to break in to _all_ archives that already have that object and replace it quietly enough that nobody notices. Quite frankly, it's not worth worrying about. It's a hell of a lot easier to just break a source archive with other means (ie pay a developer ten million dollars to just insert the back door you want inserted). Linus To: David Wagner <daw(a)cs.berkeley.edu> Subject: Re: Linus Torvalds: Re: SHA1 is broken Date: Fri, 29 Apr 2005 01:20:21 -0700 From: John Gilmore <gnu(a)toad.com> > SHA1 isn't totally broken yet. The attack still requires at least > 2^60 work to find a collision. Knew that -- but "Attacks never get harder, only easier." > No one has publicly reported finding a collision in SHA1 yet. I thought the Chinese team had reported four pairs of colliding plaintexts -- they just hadn't revealed exactly how they generated them. Or are you distinguishing "finding" from "generating" a collision? > One question I would have is what is the impact of a SHA1 collision on > his system? In other words, what harm can you do if you can find SHA1 > collisions efficiently? I'm not familiar with his source mgmt system, > but if there is little harm one can do with a collision, then maybe it > just doesn't matter very much. Here's the mailing list for git: http://kerneltrap.org/mailarchive/15/overview/browse/month Somewhere in there it told me where to find the sources, which include a design document about how it works. Ah, there it is: http://www.kernel.org/pub/software/scm/cogito/ http://www.kernel.org/pub/software/scm/cogito/README Basically, it assumes, deeply embedded, that if two blobs have the same hash, they ARE THE SAME BLOB. You can destroy its integrity by feeding it various blobs which happen to hash to the same values. He seems to think that the only possible attack is that someone would go in and modify the database by hand -- rather than feeding it new input that confuses it. John PS (added 25 Feb 2017): If you assume NSA is six months or a year ahead of the open academic/industrial sector in attacking SHA1, what would they have already subverted using a similar attack? Hmm, check the "cmp" and "diff" sources! If you don't trust the SHA1 hashes that say two trees are the same, the second step is comparing the trees of files directly. Making an input pattern that causes cmp and diff to always say, "yup, no differences here!" would allow any fraudulently inserted modifications to spread much further. _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

1 0

#pizzagate - South Carolina ancient history
by Zenaan Harkness 27 Feb '17

27 Feb '17

No front page link for this sorry, perhaps google cache if cloudfront is your deal breaker, either way, DailyStormer.com is as good a place as any to break news: http://bbs.dailystormer.com/t/charles-hamel-the-kike-who-pizza-cucked-the-s…

1 3

The "60 Year War"
by Razer 26 Feb '17

26 Feb '17

"For 60 years Robots have been systematically destroying us in clandestine economy based war started when Eniac was turned on" https://twitter.com/JoseCanseco/status/833745605470023680

4 4

Fwd: RE: SHA1 collision found
by Mirimir 26 Feb '17

26 Feb '17

FYI -------- Forwarded Message -------- Subject: RE: SHA1 collision found Date: Thu, 23 Feb 2017 15:00:05 -0500 From: Robert J. Hansen <rjh(a)sixdemonbag.org> To: gnupg-users(a)gnupg.org (I originally sent this off-list by mistake. Peter was kind enough to respond off-list and to suggest we take it back on-list. This email is a distillation of three different emails: my original, Peter's response, and a response to Peter.) ===== > I already answered that here[1]. The use of SHA-1 in fingerprints is > not susceptible to a collision attack, so it's still safe. SHA-1 in > fingerprints is only susceptible to a second-preimage attack which is > much harder than a collision attack and unheard of for SHA-1. To which I said, "Create two keys with the same fingerprint. Sign a contract with one, then renege on the deal. When you get called into court, say "I never signed that, Your Honor!" and present the second key. This collision pretty much shatters the nonrepudiability of SHA-1 signatures." To which Peter quite reasonably answered that the other person has a copy of the public key which was used to sign the document originally. Why should the fraudster's denial be believed? The answer is that to enforce a contract (at least here in the United States) you must be able to prove, based on a preponderance of the evidence, that the other person entered into a contract with you. So imagine this conversation: PLAINTIFF: "Your Honor, the defendant reneged on a $10,000 contract. Make him pay up." DEFENDANT: "I never signed anything, Your Honor." PLAINTIFF: "I have his key, it's right here." DEFENDANT: "That's not my key. This is my key." PLAINTIFF: "Of course that's what he claims! They have the same SHA-1 fingerprint! He did that in order to deny his signature!" JUDGE: "So these keys are uniquely identified by the fingerprint?" (both parties agree) JUDGE: "And you have two keys that are identified by the same fingerprint?" (both parties agree) JUDGE: "And there's no way to tell which key is real?" (both parties agree) JUDGE: "Then we're stuck. There's no reason to prefer one key over another. Plaintiff, you have failed your burden of proof in establishing the defendant signed the contract." Now, you could establish proof some other way: let's say you made a videotape of the defendant signing the document. If you could introduce other supporting evidence (which might include other signatures on keys) you might be able to convince the judge the signature is enforceable. But there's nothing intrinsic to the signature itself which could convince the judge. So Peter is completely right to say "but there's no reason to believe one person over the other." Completely, absolutely right. But the person asking the court to enforce a contract must present a reason to believe them over the defendant. I hope this clarifies my answer! (Peter also rightly remarked that he thought nonrepudiability in OpenPGP was kind of iffy anyway. He and I are in complete agreement on this. OpenPGP has always had very iffy nonrepudiability. With this SHA-1 attack, I feel the threshold has been crossed and we need to consider it repudiable.) _______________________________________________ Gnupg-users mailing list Gnupg-users(a)gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users

6 5

[RUS] Saker - "General Reshetnikov: Return to the Empire (superbly controversial interview)"
by Zenaan Harkness 26 Feb '17

26 Feb '17

The original Tzar was voted in, creating a hereditary "benevolent dictatorship" (perhaps not always so benevolent, but bringing great stability to the Russian empire, it seems. General Reshetnikov: Return to the Empire (superbly controversial interview) February 13, 2017 http://thesaker.is/general-reshetnikov-return-to-the-empire-superbly-contro…

1 0

Garmin Engineer Shot And Killed By Man Yelling 'Get Out Of My Country!'
by Razer 26 Feb '17

26 Feb '17

If he had been brown, and yelling "Allu Akbar" it would be all over the news and Donald Trump would be locking down the borders. Maybe we need them locked down. To keep our nutjob racist gunnuts in. A white guy was wounded attempting to assist the two victims from INDIA. There's a fundraiser online to help his medical expenses: > > Garmin engineer Srinivas Kuchibhotla was shot and killed at a local > bar in Olathe, Kansas, the U.S. headquarters of Garmin. Co-worker Alok > Madasani was also injured along with bystander Ian Grillot, who > attempted to help the men. "The suspect in the shooting, Adam > Purinton, was drinking at the bar in Olathe, Kansas, at about 7:15 > p.m. that night," reports The Verge. "A witness said he yelled 'get > out of my country' to two of the victims, reportedly saying the men, > believed to originally be from India, were 'Middle Eastern.'" In 2015, > Garmin employed 2,700 workers in Olathe and has plans to double this > number, which the article notes has led to "increasing diversity" in > the community. > https://news.slashdot.org/story/17/02/25/2028233/garmin-engineer-shot-and-k… http://www.theverge.com/2017/2/23/14717506/garmin-engineer-shooting-kansas

1 0

Google are f'ing hypocrites
by Zenaan Harkness 25 Feb '17

25 Feb '17

First they de-associate PewDiePie, then de-monetize Alex Jones, then shadow ban Natural News from all search results after its founder refuses to discredit Alex Jones, and finally they re-monetize PewDiePie! Google - effing hypocritical money grubbing deceptive sluts, ignoring their purported "ethics" except to maximise profit and grease the MSM wheels! It's time to DEMAND that google kick-ban PewDiePie now! Messed up, Rr. > Butthurt SJW PewDiePie Attempts to Stop Heroic WSJ Jew Burners > http://www.dailystormer.com/butthurt-sjw-pewdiepie-attempts-to-stop-heroic-… > > https://www.youtube.com/watch?v=sTCDfE_sKnM >

1 0

Blacks violently protest against Nigerian immigration, Get Attacked by Cops [WAR]
by Zenaan Harkness 25 Feb '17

25 Feb '17

This factual counter-narrative is really rather funny: What happens when blacks in South Africa protest immigration by other blacks and then black cops arrest them? Well, one thing that doesn't happen is that the Western media does not give it a bunch of coverage and call the protesters evil racists for protesting immigration, as they would do to whites in America. They also interestingly do not call them victims of police brutality when they get shot with rubber bullets, tear-gassed and arrested for protesting, as they would do to blacks in America. This really just does not fit into the narrative at all, does it? > Police fired stun grenades, rubber bullets and water cannon Friday as > the latest wave of anti-immigrant protests broke out in South Africa's > capital, while President Jacob Zuma condemned the violence but said > his country's migrant burden is bigger than Europe's. > > A petition the protesters handed to the foreign ministry, seen by The > Associated Press, suggested that the government teach foreigners to > speak properly. "They are arrogant and they don't know how to talk to > people especially Nigerians," it said. > > Resentment against foreigners has sometimes turned deadly in South > Africa amid accusations that they take jobs from locals in a country > where unemployment is above 25 percent. Others are blamed for > drug-dealing and other crimes https://www.yahoo.com/news/south-africa-urges-restraint-amid-anti-foreigner… ... [snip a lot more quotes and narrative] It's actually identical to what white countries have going on. It would be very uncomfortable for the Jewish media to address this situation, so they just ignore it. Of course, there are reports here and there, but it isn't made into a giant top news story. South Africa is a rich country because it was built by whites. The blacks who live there don't want to give that wealth away to a bunch of drug-dealing foreigners who steal their jobs. It's extremely relevant. https://www.youtube.com/watch?v=26LC7T9QPRA (Orig article: http://www.dailystormer.com/black-south-africans-protest-immigration-get-at… )

2 1

Did you ever change your political/social views after trolling in a cpunks thread?
by Georgi Guninski 25 Feb '17

25 Feb '17

Did you ever change your political/social views after trolling in a cpunks thread? Strengthening your beliefs doesn't count since it happens all the time. lol

3 2