- cypherpunks - lists.cpunks.org

Re: [cryptome] acoustic side channel attacks against TEMPEST shielded equipment
by John Young 18 Dec '13

18 Dec '13

Excellent pointer. Full paper published today, 18 Dec 2013: RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis, by Genkin, Shamir, Tromer: http://www.cs.tau.ac.il/~tromer/papers/acoustic-20131218.pdf At 11:29 AM 12/18/2013, you wrote: >http://www.cs.tau.ac.il/~tromer/acoustic/

1 0

acoustic side channel attacks against TEMPEST shielded equipment
by coderman 18 Dec '13

18 Dec '13

On Sat, Dec 7, 2013 at 3:24 AM, John Young <jya(a)pipeline.com> wrote: > Contact mics for acquiring vibration and resonance emanations > are among the still classified TEMPEST offensive and defensive > activities, interesting work on using poor quality sound (like from a phone) for chosen cipher text attacks with key recovery for GPG. also note that they use frequencies >10kHz. as discussed in the high frequency audio covert channel, this range is fairly contention free and easily accessible to microphones in consumer electronics of various types. http://www.cs.tau.ac.il/~tromer/acoustic/ """ Here, we describe a new acoustic cryptanalysis key extraction attack, applicable to GnuPG's current implementation of RSA. The attack can extract full 4096-bit RSA decryption keys from laptop computers (of various models), within an hour, using the sound generated by the computer during the decryption of some chosen ciphertexts. We experimentally demonstrate that such attacks can be carried out, using either a plain mobile phone placed next to the computer, or a more sensitive microphone placed 4 meters away. Beyond acoustics, we demonstrate that a similar low-bandwidth attack can be performed by measuring the electric potential of a computer chassis. A suitably-equipped attacker need merely touch the target computer with his bare hand, or get the required leakage information from the ground wires at the remote end of VGA, USB or Ethernet cables. """

1 0

Tor funding [was: ranting at Juan's hatebait rapaciously [before that, something about: request for transcript: Bruce Schneier and Eben Moglen discuss a post-Snowden Internet]]
by coderman 18 Dec '13

18 Dec '13

On Mon, Dec 16, 2013 at 12:27 AM, coderman <coderman(a)gmail.com> wrote: > ... > b) you insist Tor's origins and funding sources are proof of > malfeasance; they've responded by diversifying funding. even more today :) https://blog.torproject.org/blog/announcement-tor-project-now-accepting-bit… """ Over the past year, we have received many requests for us to accept bitcoin donations. After careful consideration and research, we are thrilled to announce that effective today The Tor Project is accepting bitcoin donations. In partnership with Bitpay, bitcoins can easily and directly be donated to support Tor’s ongoing mission of being the global resource for privacy technology advocacy, research and education in the ongoing pursuit of freedom of speech, privacy rights online, and censorship circumvention. Check out ourdonations page now. Bitcoin donations received by The Tor Project will be converted directly to US Dollars. Our decision to accept bitcoins has been well thought out and researched from a financial accounting perspective with an eye on passing our required annual A-133 audit. We believe we are the first US 501(c)3 non-profit organization to test acceptance of bitcoins and attempt to pass the US Government A-133 Audit Standard. Our 2013 audit results, along with our past financial documents, will be made available on our website once complete in 2014. The Tor Project is also proud to be in the company of other visible non-profit organizations accepting bitcoins including EFF and Wordpress. Why is this important? The Tor Project needs your donations to continue our mission and to keep the Tor suite of technologies ahead with the growing threats to privacy and anonymity around the world. Your donation made TODAY, through bitcoin, Paypal, Amazon Payments, Givv.org, checks, money orders or bank transfers, will provide greater security and privacy for millions around the world who use Tor every day. Help us continue our mission! """

3 3

corektion (re:c4-r3kN.txt (urls))
by brian carroll 17 Dec '13

17 Dec '13

additional correction/repair of perspective anomalies and errors... > ../correction_regarding; = "last {urls} list", a needed clarification > about applied concrete, its also massive and important role in > reconceptualization. bridges, hi-ways, skyscrapers along with steel, > office parks via CMUs. innovative material- and form-based aesthetics > (its own language or dialect, syntax, grammar, etc). medium for ideas, > shapes ideas, opens up new areas for development & interpretation. > (note: basis for approach of Le Corbusier (aka 'the crow'), > structure/order- 'organizational logic' as parti; and FLlW use of > concrete masonry units and precast concrete as vital to new ideas). > yet architecture is still much more than these things, it remains a > detail, sometimes of major significance other times not in the 'ideas' > involved. sometimes innovative, etc. yet in a larger context or > situation, larger goals and functioning than just concrete itself, > alone, as the variable. in other words 'the ideas of architecture' are > not containable just within concrete, though it can and does have > major influence at certain stages and within specific approaches. its > conceptual innovation feeds into architecture and vice-versa, > symbiotic, including conceptual stagnation due to loss of larger > vision (ideas) and greater purpose at scales involved due to > narrowed_focus(), etc(etc). ###################################################################### .// further CORRECTION: once again clarification is needed regarding a previous statement. this is both due to my own limits in conceptualization and writing and also problems of language, when it is extremely difficult to encompass all possible cases in a general view without having contradictions. in my latest errored statement, the mistaken view is quite large and so must be countered with more information. i do not have the particular language nor have i developed the understanding or framework for these dynamics as of yet, so wrote into a realm or beyond a structure already developed and thus encountering significant failures in approach. i.e. stating that 'concrete is only a detail' in architecture. the problem is that this is not true in some situations, and also the word/concept 'detail' is not the correct word for what i am trying to describe though i am not sure what a better word would be, feature or substructure or element or component or structure yet none of these likewise fit either. though of course there are many who could better state the same ideas within an improved POV with more accuracy and much more insight and more knowledge of the issues involved. so my approach is limited. the language also. and i equate it to is the following mistaken viewpoint about concrete in architecture, in special cases: it is to assume that the sand is only a detail of the beach. and this is largely false. it _is the beach, or a major or significant element along with sky and water and wind and waves. it is a major component, not minor. and yet in most architecture the concrete involved does not take center stage, it is another component, so it tends towards a larger assemblage of components functioning together and is not the main event. many times concrete is dressed by other facing materials, skins, that shield it from the weather and provide a different facade than CMU or precast panels and yet there are also buildings that are just CMUs and precast walls and-or floors/ceilings. though their significance in terms of the total building may still remain that of a quasi-detail or more minor component or insignificant beyond just being a barrier or boundary, such that the language may not be explored or developed or insightful and may have inert presence, such that it is more about 'nothing' than 'being'. say an industrial warehouse with no windows and a simple door on an exterior that is otherwise all concrete, with a company logo as sign. perhaps this is not just a detail though it is also not going beyond certain dimensionality in its functioning, it is basic and not necessarily interwoven into other themes beyond utility, such that it provides structure or boundary, security, enclosure, perhaps texture, color, scale. it may be unwise to compare it straight away with a CPU enclosure, as it relates to what is inside the box, though to some extent this can be a disconnection or simple boundary that is already defined in its functioning in many ways, by default, unless explored further. and thus building is often differentiated from architecture as it does not have this additional layer or level of investigation, inquiry, innovation, questioning of parameters, function, beyond this. so in some sense it is a big SIN to not have remembered epic examples to the contrary where concrete cannot be said to be just another element or, again wrong-worded, only a detail, as this warps its contribution and conceptual potential that has been explored (most notably by Le Corbusier and others). a few examples to provide counterpoint... Notre Dame du Haut http://en.wikipedia.org/wiki/Notre_Dame_du_Haut [images] https://www.google.com/search?q=Notre+Dame+du+Haut&client=firefox-a&hs=cqz&… this chapel by Le Corbusier located in Ronchamp, France, is singularly in concrete, it defied the existing conceptualization of how the material could be used and likely still does. it is the determiner of many architectural dimensions, space, massing, light, enclosure, walls/ceiling, roof, and if memory serves the massive roof appears to float when inside, even though made of massive concrete. thus the gravity of the material has been reverse or inverted. this is the height of aesthetic mastery, the language of architecture through the medium of concrete. and more, the use of a ship analogy and metaphor, its significance in architecture, rendered in concrete as the roof. it is assumed also medieval fortifications which used to have walls of several feet thick were related to concrete thickness, when such walls were once foundation and required to be this thick, which continued into tall buildings such as skyscrapers when supporting several floors above them, prior to steel and concrete construction. so perhaps those (correctly stated) details of windows refer to that earlier language or pattern. further, there was innovation with formwork such that textures on the formwork would transfer onto the set concrete forms, thus revealing wood on its surface, as part of a new technique that was developed by Le Corbusier. and so this refutes any notion of concrete only as detail. it is the defining feature across many dimensions and structures, it almost singularly defines the building beyond its stained glass and wooden pews. completely captivating in its essence, and this essence is concrete. and it is a deep connection, deep awareness, grounding within the material as it is made into form and functions within a myriad of different parameters. (also, this built organic form (1954) in relation to sculpture...) Brancusi sculpture Bird in Space (1930-40) or other http://www.guggenheim.org/new-york/collections/collection-online/artwork/669 consider then another structure... Sydney Opera House http://en.wikipedia.org/wiki/Sydney_Opera_House it is iconic for its form, resembling billowing sails made of precast concrete. having visited neither of these structures, it appears likewise a majority of the building exterior consists of precast concrete panels. thus another example that 'concrete is not just a detail', which in these cases is an absurd and ignorant viewpoint, when universalized. it is the major or prime structural component though also the basis for conceptualization, the medium that is relied upon and explored to express or develop such a unique language of form, based upon the specific and unique properties of concrete in its various techniques and approaches, many of which are invented by architects for buildings and have never been built before. thus this is a realm of large-scale experimentation, the limits of construction, and daring work even. it should be noted that recently i encountered a reference to this building which said how beautiful it was on the outside as a concert hall, yet the acoustics on the inside are or were horrible, and thus the building aesthetics and its interior programmatic functionality were not matched- though this is also why acoustic engineering exists, which can often optimize a space in such scenarios. the difference here is that buildings in the past, when having a main function like 'music hall' or 'opera house' were designed around acoustic properties firstly, if not mistaken. and this is not about chance, how sound exists in a given space in terms of its size, shape, proportion, materiality, etc. and thus the outside-in approach, versus inside-out approach, and how this can conflict perhaps most especially in terms of the present day where 'image-based' buildings have their external form as the main development or feature and functionality is presumed to default to a usable correlated equivalency, yet can also be hollowed out of meaning, superficial, merely about the surface and not insightful in other realms or other substructures or components. a bit like a building that is masquerading, and appears one way yet under the mask is another way. like fancy aesthetic structures that are miserable to be inside or just mediocre, yet praised for their looks or drama, yet less livable or even dysfunctional or needy, requiring high-maintenance, concessions by its occupants, which is its own type of lost economy or friction that indicates peculiar approaches, values. -- it is hard to convey how central aesthetics are to knowledge yet when removed of its role as a grounding of philosophy, of shared belief and truth, values, knowledge, as materialized, it then can become detached and move into a realm of relativistic babble, greater accounting does not take place, and images can be deceiving, illusion or manipulations of the senses. another realm of 'concrete is more than detail' it is conceptualization itself is within the realm of Brutalism, a particular movement or style in architecture... Brutalist architecture http://en.wikipedia.org/wiki/Brutalist_architecture as should be obvious, my observations are only limited and there are people with vast understanding who have researched these issues and who have expertise, though some of this also is intuitive, from living in civilization and environments where such buildings exist and define a space, within given parameters. and I have a fondness for a local example, at least in its appearance, which tends towards fortification though has also been evaluated as a response to student unrest on college campuses, an embodiment of the fortification of the educational system against students and populations, visible in aesthetics of built form. Boston City Hall http://en.wikipedia.org/wiki/Boston_City_Hall so in the history books i read that defined a particular shared consciosuness, this building is one of the main examples. and it is implicitly 'concrete' in more than detail, it is seemingly in its conceptual entirety, in that it melds what is material also with the mental awareness of concrete as metaphor or analogy, as if anchoring something into the ground, making an idea it into a tangible truth, via securing of spatial-order vis a vis security or fortress, or whatever. in that an underlying realm of hostility and unrest or a different mapping of experience may better be realized or understood in these more stark forms and encounters, as if the realm of ubiquitous surveillence maps more readily into these aesthetics even, then those buildings of high gloss, shiny distracting objects. in other words, you could probably use this building for military purposes even, or some such structures, because of their more fortified nature than all-glass facades, and a more primal or primitive relation could be established, more natural perhaps with the social Darwinist/Spencerian survival of the fittest dynamics, if not even towards a Planet of the Apes retro-futurism of some kind. again, concrete here is more than the material, it is a larger connected essence and its language is developed in depth. Rarig Center for performing arts at U of Minnesota (local example) https://www.google.com/search?q=rarig+center&client=firefox-a&hs=Ixf&rls=or… so there is a difference in how a medium develops, in what terms and parameters, what ideas are explored and what conceptualization is involved. it can be contained, and thus a material could exist only as a detail in some or many circumstances, yet in others it could become a major or main event and take on a primary role, and become a realm of peak inquiry and innovation. this both in terms of language and geometry/mathematics, of structures and aesthetics, as it relates to concepts, patterns. or it could be unquestioned and an issue of utility, relied upon to do once again what has been provably done before within given parameters. yet to describe all of this dynamic range within linear strings is impossible and arbitrary, because it is far more involved, and requires clarification for each and every error or misconception and thus words words words to seek to repair faulty frameworks and reasoning that is limited, bounded, to particular constraints or points of views, etc. and thus this condition of language could itself be the gap or mismatch with the issues of existence, the impossibility of accurately relating to what is going on in its ubiquity and depth within the parameters it exists within, without being trapped in warped, distorted, and biased if not untrue or only partially-true statements that then function as communication, frameworks. there appears no way to fix this within linear language itself. this as it relates to code and to programming likewise. it is a trap, ideas and concepts cannot be empirically developed within words to a degree of fidelity required to attain 1:1 conceptual models. thus, also, software ever disconnected from what it seeks to represent in these same scenarios. it is the artificial and misleading, false 'nature of things', this language-based communication about events and seeking to model events within signs that are linearly described, looped, versus within molecular dimensional structures - circuits - that can actually account for all components, elements, details and events in whatever degree and fidelity they may exist. one stray example arises repeatedly in my mind about the nature of architecture as it has become detached from a larger accounting and as this relates to core principles. it used to be a goal to have a structure last, to endure over time, as part of the goal. today instead planned obsolence has taken hold so buildings may stand for only 30 years before being demolished. consider this in terms of how it influences design, what issues are addressed and ignored, and how much material is wasted to continue such an inefficent process that also stands-in for development as an engine, process, or flow of activity that circulates money around. in that it is a circuit, how this functions. no doubt there is aesthetic beauty in many buildings though what it often hides is that other issues are being ignored (such as environment, planning, social relations) and architecture can just be about the image. perhaps like those apps that can be easily created by putting various parts together, throwing an interface on a given structure, yet that is not innovating beyond a particular level of inquiry or set of relations, which then become bounded, limiting. the following observation is not to question the legitimacy of approach for the building in its functioning, which is built like others by star architects all around the globe. so it is not to single it out as an example, though it provides a case in point regarding certain values that are taught of in school that in practice are seemingly no longer of significant importance... consider the birds nest stadium built for the 2008 Summer Olympics... Beijing National Stadium http://en.wikipedia.org/wiki/Beijing_National_Stadium while of great beauty, there is also great dismay at the material design involved due to issues of economy. in school they teach you of surface area, how this relates to heating and cooling of a structure, and how each and every joint or connection is a potential weakness, whether for water or rust or expansion/contraction failures from stress and strain, including between different or particular materials. how a building is put together and funcdtions over time. that this is part of its success or failure. and my immediate thought or reaction really upon seeing this 'visual structure' was the known extreme maintenance it would require over time, in having to maintain/upkeep the 'visual structure' via presumably paint and-or rust protection, for each angled connection and joint and surface. perhaps it will not rust, perhaps it requires no painting. yet if it does it is certainly non-trivial as to the way the building functions over time. unless like most stadiums these days, it is destroyed after 30 years time. (in some way the detachment from larger considerations allows this narrow 'design development' to take place in architecture, it is in some significant way a form of luxury, yet detached from responsibility, afforded by ignoring other vital aspects, decadent or based in excess, disregard for economy beyond economics, as if architecture is financialization writ large even. the embodiment of a business philosophy detached from the surface of the earth in its actual truthful accounting and functioning instead within parameters of a fairy tale that is never spoken against, to sustain the illusion or delusion that aesthetics can be primary without also securing their foundation, connecting it with deeper truth. instead it can be shallow, hollow, or unsteady, and may not withstand the momentums of culture as it continues to advance or stall out over time. there is something of a treachery involved in 'image-analysis' that lacks a larger framework for its evaluation, and yet this has become the guiding 'philosophy' of architecture likewise, to which students must kneel down before such ideas as if of superior nature and awareness versus cutting corners and in effect, cheating the discipline of its integrity and substituting it with a lesser set of goals and ideals that tend towards the profane instead.) in some ways it seems that code can be like this also. that there can be structures that are difficult to maintain or upkeep yet are developed in a way that there is no way to sustain them over time. tens of millions of lines of code say, that cannot simply be renovated or simply tweaked or fixed up. it appears almost as if a prevailing ethos of development both online and offline, in software, hardware, and material development, processes and procedures as this maps to business, social relations, and how knowledge exists and moves into a particular direction, as if a kind of momentum or flow within a given circuit whose parameters best or most optimally function in this way, yet may not add up to more over time, and more require a limited or bounded relation or condition for their existence. in that this interaction or limited engagement is the nature of the material so conceived, considered and that another system or material approach may be required to develop other options that are not preconceived or pre-wired into the existing approaches and "economical" methods that can lack the foundation needed to develop cohension in other areas, shared realms of inquiry, larger modeling or conceptualization beyond the finite, separate, iconic isolation that becomes based and reliant upon principles that may function against larger, longer goals, simply by using existing approaches that have ideological functioning built-in. ###################################################################### niner double exo

1 0

Re: Aqua - a high bandwidth anonymity system that resists traffic analysis
by Stevens 17 Dec '13

17 Dec '13

Hi all, As the project lead, allow me to clarify. Aqua is not led by Microsoft Research but by the Max Planck Institute, a publicly funded German institute for basic research*. The only author affiliated with Microsoft is Hitesh Ballani, whose expertise on IP anycast has been useful when we considered using IP spoofing among the mixes (this mechanism is currently not part of Aqua's design). All the best, Stevens * http://www.mpi-sws.org/index.php On Tue, Dec 17, 2013 at 4:39 AM, Andy Isaacson <adi(a)hexapodia.org> wrote: > On Mon, Dec 16, 2013 at 07:30:50PM -0800, coderman wrote: >> On Mon, Dec 16, 2013 at 5:30 PM, rysiek <rysiek(a)hackerspace.pl> wrote: >> > WUT? Microsoft doing such research? And sharing info on it?.. >> >> i had this same reaction when i found their Link Quality Source >> Routing mesh protocol research[0]. crazy times! ;) >> >> 0. "Self Organizing Wireless Mesh Networks" >> http://research.microsoft.com/en-us/projects/mesh/ > > MS Research is trying fairly hard to be a Real Research Lab in the vein > of DEC SRC, Xerox PARC, IBM Almaden. They released a NetBSD kernel for > their experimental CPU a few years back. > > http://research.microsoft.com/en-us/downloads/754fee75-c5a0-4542-bf9b-47f23… > > Strange days we live in. > > -andy

1 0

Re: [Cryptography] Fwd: [IP] 'We cannot trust' Intel and Via's chip-based crypto, FreeBSD developers say
by grarpamp 17 Dec '13

17 Dec '13

> They want this, if it can be made to work, and they'll try > it if they don't know. That's what they said in the goals revelations, and > I believe them. This probably can't be mentioned enough. Millions to billions of gates on a die, lots of room there. Multiplied out to the millions to billions of computers in service. That's a huge opportunity no one in their right mind wouldn't try to exploit. And RNG's are an easy place to do it. RNG is not a box you can input 2+2 test vector from the outside and get 4 back out. The RNG may even look random, pass diehard, etc. But if there's a secret seed buried in the RNG somewhere, you're screwed. And when was the last time anyone ever publicly decapped and validated a current Intel RNG CPU? <silence> Sure, mix it in with at least one other source, or shutdown, and use that. But don't ever use it raw. Embedded RNG's help make the market for external discrete logic RNG dongles.

1 0

Aqua - a high bandwidth anonymity system that resists traffic analysis
by coderman 17 Dec '13

17 Dec '13

this seemed to get lost in the hubub over the summer, --- http://research.microsoft.com/apps/pubs/?id=199302 Towards Efficient Traffic-analysis Resistant Anonymity Networks Stevens LeBlond, David Choffnes, Wenxuan Zhou, Peter Druschel, Hitesh Ballani, and Paul Francis August 2013 Existing IP anonymity systems tend to sacrifice one of low latency, high bandwidth, or resistance to traffic-analysis. High-latency mix-nets like Mixminion batch messages to resist traffic-analysis at the expense of low latency. Onion routing schemes like Tor deliver low latency and high bandwidth, but are not designed to withstand traffic analysis. Designs based on DC-nets or broadcast channels resist traffic analysis and provide low latency, but are limited to low bandwidth communication. In this paper, we present the design, implementation, and evaluation of Aqua, a high bandwidth anonymity system that resists traffic analysis. We focus on providing strong anonymity for BitTorrent, and evaluate the performance of Aqua using traces from hundreds of thousands of actual Bit-Torrent users. We show that Aqua achieves latency low enough for efficient bulk TCP flows, bandwidth sufficient to carry BitTorrent traffic with reasonable efficiency, and resistance to traffic analysis within anonymity sets of hundreds of clients. We conclude that Aqua represents an interesting new point in the space of anonymity network designs.

3 3

Gmail's receiving mostly authenticated email
by Bill Stewart 16 Dec '13

16 Dec '13

Saw an interesting article from Gmail on their inbound email statistics. Over 91% is authenticated with either DKIM or SPF. 75% is both, the rest is one or the other. That doesn't indicate how much is encrypted, but anything that has the framework to do that authentication could fetch a key as well. (Doesn't stop the feds from collecting the mail after Gmail receives it, of course, but it's an indication of how much email could relatively easily add some encryption to reduce in-transit eavesdropping.)

5 5

Re: Bruce Schneier to leave BT
by John Young 16 Dec '13

16 Dec '13

Would be great for the other dual-hats to follow Schneier's example, with fuller accounts of what has been going on behind NDAs and clearances. A dripped released is hardly sufficient, maybe justifiably suspicious. Remains to be seen if all spy ties are severed or just go darker and deeper, as usual, into the repurposed Black Chamber to hide with celebrity and outrage what is blatantly devious -- in the crypto legacy manner. Isn't that what this unfettered open forum dumpster is urging duplicitously from DoB of cryptoanarchy? Whither cryptoanarchy's billionaire, if not TLAs, Soros, Sim, Murdoch, Gates, Ellison, Bezos, Omidyar, Kochs, Saudis, Russians, Windsors, China, Kuwait, Oman, Ford, Rockefeller, so many, so sneaky. As Assange said to early charges of CIA/Soros funding, "we should be so lucky, all donations welcomed." Word. At 11:29 AM 12/16/2013, you wrote: >retaliation for helping expose intelligence community excesses and >illegalities?

2 2

Bruce Schneier to leave BT
by coderman 16 Dec '13

16 Dec '13

retaliation for helping expose intelligence community excesses and illegalities?

2 1