- cypherpunks - lists.cpunks.org

Re: [tor-relays] Filtering TOR Non-exit Relay - Just Curious
by Zack Weinberg 27 Oct '13

27 Oct '13

Lukas Erlacher <l.erlacher(a)gmail.com> wrote: >> Middle nodes don't know the type of traffic. If they have any way >> to find out, that is a bug that needs to be fixed. End-of. Packet timing analysis may be able to tell you *something* -- this is part of my current research project, ask again in six months :-) Mr. Nelson Laurenti wrote: > I didn't say I knew the type of traffic on my relay, that would be an > entirely new set of problems; I said I can see the IP addresses > coming in and going out, and the ports used. That's to be expected. Tor is still using IP, so there is no way around the fact that a relay operator can observe the IP addresses of hosts in direct communication with their relay(s). If your relay is acting strictly as a middle hop, however, the IP addresses you observe should all be the addresses of other Tor relays, and none of the traffic you observe should *originate* from the IP addresses you observe. If you are an entry hop, some of the traffic you observe will be traffic coming directly from clients, and you can learn their IP addresses and probably quite a bit about them. This is part of why we have guards. (I am skeptical about guards actually being a good idea, but that's *also* part of my group's research, so, again, ask again in six months.) Only if you are an exit node should you be able to observe any traffic that is in cleartext and/or coming directly from server hosts. It is possible for one Tor process to serve all three roles simultaneously, but never (by design) for a single circuit. The design intent is that it will be prohibitively difficult for any single operator to control more than one node in a circuit more than some tiny fraction of the time; how feasible this actually is in real life has been the subject of quite a bit of research already (and, yep, my group is looking at that as well, albeit not as centrally). zw _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

Re: [Cryptography] [RNG] /dev/random initialisation
by John Denker 27 Oct '13

27 Oct '13

On 10/24/2013 02:42 PM, Sandy Harris wrote: > What I want to model here is the harder case where none of the above [sources for a good high-entropy seed] > is in place or urandom starts producing output without waiting for > them. In an ideal world, this case would never arise but in the real > world it has and likely will again. This is excellent. This is exactly the sort of discussion we ought to be having. > The problem involves avoiding > duplicate outputs, so the birthday paradox works against us. If we > need a low risk of collision for 2^n cases, then we need about 2n bits > of input entropy. I agree with the sentiment, but having lots of entropy isn't the only way of solving the problem; we can make do with a lot less entropy if it is /computationally infeasible/ for the attacker to untangle what we have done. > There are two separate cases to consider: avoiding duplicate outputs > when a single device is rebooted many times and avoiding it when many > identical devices are deployed. OK, good. > Multiple reboots of the same device are the easy case. One threat > involves a computer that is rebooted often (perhaps several times a > day) and whose outputs are monitored continuously over a fairly long > period (perhaps a year). Another involves an enemy that can force many > reboots of a network device without the administrators noticing and > blocking the attack. Neither threat looks at all likely to involve > more than a few thousand reboots, so a dozen or so bits of timing > information per reboot should be enough to block them. It may help to add a little bit more detail to that analysis. There are two subcases: a) The PRNG starts out in a good state, with a seed that is large enough, random enough, and unknown to the attacker. If we now use the real-time clock (RTC) to /stir/ the seed, that should be sufficient to guarantee no collisions. That should be enough to stop replay attacks. b) If the PRNG starts out in a bad state, because the seed has been compromised, then the PRNG cannot quickly recover, and in particular it cannot recover while it is under attack. The RTC is nowhere near sufficient to /substitute/ for a proper seed. To say the same thing in slightly different words: There are two separate objectives that we need to consider: A) Resistance to attack, and B) Recovery from compromise. In some rock-candy world it would be nice to do both at the same time, but in this world, there are situations where a practical PRNG cannot do both at the same time, and that's OK. The moral of the story is that it is super-important to make sure the PRNG is properly seeded. The seed needs to be big enough, random enough, and unknown to the attacker. Note that the RTC does not add real entropy to the PRNG. All it does is stir the PRNG. Assuming the PRNG's hash function is working properly, (seed + RTC1) should be effectively very different from (seed + RTC2). The attacker could try to mount a related-plaintext attack against the hash, but for any decent cryptologic hash this should be computationally infeasible. There is a fundamental conceptual distinction between (a) reseeding the PRNG with honest-to-goodness entropy and (b) merely stirring the existing seed. However, there are some situations in which stirring suffices. > Timing data appears to be the only thing we can use against this > threat; more-or-less everything else is constant across reboots. Linux > random already mixes in some timing information, but I am not certain > how much. It shouldn't take much stirring, assuming the hash function is working properly. We absolutely require that the RTC produce non-repeating values, but that's about all we really require. Again, this is all predicated on starting with a high-quality seed. > Many identical devices are a harder case. I hate to sound like a broken record, but the solution is the same in all cases: You need a proper seed: big enough, random enough, and unknown to the attacker. > A manufacturer might produce > tens or hundreds of thousands of the same device The manufacturer reeeeally needs to provision each instance of the device with a proper seed. The cost of doing this is ridiculously small. The manufacturer already needs to provision things like the MAC address, hostname, IMEI, et cetera ... and the addition burden of provisioning the seed for the PRNG is negligible. > a Linux distro > might send out some huge number of installation images; Again (!) the solution is the same: If there is a proper seed, you're fine. If there is not a proper seed, you're screwed. Specific suggestion: a) Download the .iso image onto disk. b) Provision a proper seed onto the image. c) Burn the modified image to CD if desired. A few years ago I cooked up some tools to do exactly this. I tried to get support for it installed into the distributions, but the proposal was shot down by some "expert" who decided that the RTC was sufficient security, even if every attacker on earth knew what was in the distributed seed-file ... and even if every attacker on earth knew what time it was. More general suggestion: We ought to produce some sort of "Best Practices" document that explains to manufacturers, software distributors, VM providers, et cetera how important it is to provision a proper seed, and explains how to do it. We should also provide tools and infrastructure that makes it easy to do the right thing and hard to do the wrong thing. For example, in the general case, unpacking and repacking an .iso image is a pain in the neck, but if the image is engineered to facilitate rewriting the seed-file the procedure is much, much simpler. ================================== Following up on a proposal by Jerry Leichter, on 10/25/2013 05:15 AM, John Kelsey wrote: > I like this idea. If my PRNG is in a secure state, I can give out > random numbers to anyone who asks. I like this idea so much that I implemented it many years ago. The command line looks roughly like: lynx -auth=harpo:swordfish -source 'https://example.com/pvt/random?bytes=512' | randomize kernel from - > At first startup, it won't be > possible to establish a secure connection yet (no entropy), I disagree; see below. > but by > asking some hosts for a random number, we ensure that if those > messages aren't recorded, the attacker can't possibly guess our PRNG > starting state. Again (!) the key is to have a proper seed stored on the machine in question. It's like the proverbial seed-corn: If you have none, you're screwed. If you have some, you can grow more. On 10/24/2013 07:59 AM, John Kelsey wrote: > a. Get 256 bits of entropy from the OS. > b. Get 256 bits of entropy from the hardware entropy source. > c. Ping several hosts on the internet and measure the response time, and fold that into your seed. > d. Fold your ethernet address, IP address, and serial number into the seed. > e. Fold the installed-at-birth secret 128 bit value from your device into the seed. > > Initialize a PRNG with all that, and the attacker is in an extremely > hard place, as he has to be able to guess all five elements. (d) > isn't all that hard to guess, but the rest will in general be very > hard to guess. Some comments: a) If you have 256 bits of honest-to-goodness entropy from /any/ source, OS or otherwise, then that's more than enough to seed the PRNG, and nothing on the list matters. b) Ditto. c) Not so good. Ping times are not guaranteed to be always different, and not guaranteed to be unknown to the attacker. In the crypto business it is conventional to worry about MITM attacks. A scenario where the MITM doesn't need to mess with the packet contents, just the packet timing, is extra-easy for the attacker. d) Not so good. All that stuff is constant, and relatively easy for the attacker to know or guess. The RTC wasn't mentioned, but it is better than the items that were mentioned, in that it is at least non-constant and non- repeating. The RTC cannot /substitute/ for a proper stored seed, but it can /stir/ the seed. e) That's basically the right idea, except that we should call it the "stored" seed rather than the "at-birth" seed. The stored seed should be changed at frequent intervals. This helps with the recovery from compromise. Perhaps more importantly, it reduces the window of vulnerability and reduces the value the attacker gets from peeking at the stored seed. _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

1 0

[tor-talk] PrivateCore Demonstrates Industry’s First PRISM-Proof Tor Server in Public Cloud
by Pokokohua 27 Oct '13

27 Oct '13

Saw this ad/news item on another list ------------------------------------------------------ PrivateCore Demonstrates Industry’s First PRISM-Proof Tor Server in Public Cloud PrivateCore, the private computing company, today demonstrated the first cloud Tor server protected from NSA PRISM-like programs by fully encrypted memory. The company deployed a Tor server protected by PrivateCore vCage software to a dedicated server hosted by infrastructure-as-a-service provider SoftLayer. Tor directs Internet traffic through a free, worldwide volunteer network consisting of more than three thousand relays to maintain the anonymity of a user’s location or usage. This PrivateCore Tor deployment provides undeniable evidence that organizations can achieve private computation in the public cloud. Without vCage full memory encryption, Tor servers operating in hosted provider environments expose secret key material in memory, where it can be accessed through NSA PRISM-type programs. Using PrivateCore vCage, no trace of Tor server code or data is maintained in memory or on disk, eliminating the possible exposure of secret key material through memory forensics. As demonstrated by the NSA PRISM program, information owned by an organization can be handed to authorities without their knowledge by cloud service providers who control the cloud servers. While organizations need to respond to lawful requests for information such as the NSA PRISM program, PrivateCore vCage enables them to remain in control of servers in the cloud and prevent access without their prior authorization. Click to Tweet: .@PrivateCore vCage memory #encryption software enables #PRISM proof Tor server http://bit.ly/1gCCkMP “PrivateCore vCage is a very important step forward for cloud security that uses a brilliant design created by experts who really know what they are doing,” said Felix “FX” Lindner, Head of Recurity Labs a leading security consultancy based in Germany. Service providers and enterprises face growing risks of physical access to sensitive data through the proliferation of outsourced IT infrastructures in untrusted environments including the cloud, co-location facilities and remote sites. Sensitive data-in-use is subject to compromise due to lawful requests, such as the recently disclosed NSA PRISM program, as well as illegal compromise. For example, state actors can target server memory which typically contains sensitive information such as digital certificates, encryption keys, intellectual property and personally identifiable information. While sensitive data may be protected by encryption while at rest or in transit, it is unprotected and “in the clear” while in use. PrivateCore’s unique vCage software encrypts data-in-use without requiring application or hardware modifications. “The NSA PRISM program has raised concerns around the world among organizations considering deploying sensitive data in the public cloud. This proof of concept shows that data in the public cloud can remain under the control of the owner under any circumstance,” said Oded Horovitz, CEO of PrivateCore. “Protecting data-in-use has been a challenge in security sensitive industries for years, but hardware advances such as larger processor caches have enabled PrivateCore to develop an innovative platform that shrinks the hypervisor into the CPU to secure data even in memory.” -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

1 0

[cryptome] Re: Obama vs Merkel
by coderman 27 Oct '13

27 Oct '13

On Sun, Oct 27, 2013 at 4:16 AM, John Young <jya(a)pipeline.com> wrote: > Hard to believe the DE spies did not know of spying on Merkel > perhaps assisted it as part of their own spying on her,... this entire fiasco manufactured - ongoing dilution and castration of the leakage. impact and relevance continually declining from piece to piece. one of many legitimate cries for wide distribution of the entire archive! this phone spy posturing a particularly irrelevant sacrificial detritus to distract for some many days from quality leaks. ... the downside of 50,000 objects to select from, the diffusing chaff is plentiful...

1 0

Re: [ExI] chilling effects
by Anders Sandberg 27 Oct '13

27 Oct '13

On 2013-10-27 18:15, Eugen Leitl wrote: > On Sat, Oct 26, 2013 at 07:44:07AM +0200, Anders Sandberg wrote: > >> So, will you stop visiting other countries as a result of this? > Will I be stopped, you mean? Maybe. I certainly know people > who are every time "randomly" selected for special treatment > when flying, and I know people who've been denied entry. > It is really quite ridiculous. > > I also know people who are afraid for their life so they're > effectively in exile. We also know a person who's trapped > in an embassy in London. Nevermind people like Snowden > and Manning. It is not 'chilling effects' if you actually are harassed or have warrants on your head. What I am getting at is that the vast majority of people are not directly affected by many of the threats we have discussed, yet if they think they are or could be and as a result change their behaviour in a more compliant direction then we have a problem. Especially if the thinking is (accidentally) seeded by the people who actually are against the compliance. There is a fine line here, similar to denouncing a tyrannical government. You want to make people aware of the abuses, yet not so afraid of the abuses that their response is to conform. There are also links to Hirschman's "Exit, voice, loyalty" analysis: if key people respond by exit (moving to friendlier states, disappearing into the blacknets) the remaining people will be less able to efficiently voice concern and ensure some negotiated resolution - and many might cleave to loyalty because that seems to be the only solution. -- Dr Anders Sandberg Future of Humanity Institute Oxford Martin School Oxford University _______________________________________________ extropy-chat mailing list extropy-chat(a)lists.extropy.org http://lists.extropy.org/mailman/listinfo.cgi/extropy-chat

1 0

Re: [ExI] chilling effects
by Eugen Leitl 27 Oct '13

27 Oct '13

----- Forwarded message from Anders Sandberg <anders(a)aleph.se> ----- Date: Fri, 25 Oct 2013 22:25:47 +0200 From: Anders Sandberg <anders(a)aleph.se> To: extropy-chat(a)lists.extropy.org Subject: Re: [ExI] chilling effects Message-ID: <526AD3CB.9000807(a)aleph.se> User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.0.1 Reply-To: ExI chat list <extropy-chat(a)lists.extropy.org> On 2013-10-25 20:32, Eugen Leitl wrote: > Anders, do you remember Assange? He used to post to this list. > Have you received email from him? Encrypted email? Are you one > one or two hops away from people that are known targets? Have you > received packages from any such? Have you had any significant > exposure to Bitcoin circles? Did you travel to Bitcoin conferences > as a speaker? Are you a computer security researcher? Are you > a member of political group even remotely considered daring, > or are you connected to people like that? Do you travel a lot, > into diverse countries? &c&c > > If any of these apply, consider yourself a likely target for > telco surveillance. Sure. I also get invited to speak to the US and UK government. If they *didn't* check me out, they would be rather remiss. You wouldn't want one of the Bad Guys to visit the MoD or NSC shindig, right? In fact, one intriguing issue is government self-surveillance. When the Army invites me to a meeting, no doubt the NSA has to check out the people attending - they are dealing with somebody in the network of "interesting" people! Ah, yes, obvious Swedish military and crazy libertarian connections, hey - double second-order links to Assange! ...wait, a third order link to *Saddam*?! And vice versa, by going to that meeting I am now by definition an "interesting" person and my government contacts are worth checking out a bit more... The problem is of course to rein in the spread of who to keep tabs on - and big data is providing its own apparent solution: "all of them". Plus that large scale trawling will tend to pick up lots of things just by default. Which actually means that various agencies are gathering data other agencies would rather not have gathered. Just ask David Petraeus. At least humans know better than to spy on the boss, but the software can't tell the president apart from another suspiciously well-connected person who is meeting with shady people. Add to this the normal craziness of intelligence ( http://www.antipope.org/charlie/blog-static/2013/10/spook-century.html ) and there is plenty of potential for tragicomedy. But the upshot of this is not that I should keep silent: *it doesn't matter*. I am in this mess whatever I do, even if I follow the best opsec and sigint practice. The risk of me being targeted is less affected by my actual activities and more affected by arbitrary group memberships. >> Most dire warnings I hear about how the Powers are doing sinister >> things seem to be more about getting attention and playing human >> social games than actual intel. And they do damage by their chilling >> effects - I have met people who are afraid of being associated with >> cryptography or working for better intelligence oversight because > They have reason to suspicition that this adds a flag that can > make a difference in future, but perhaps being flagged a coward > stings a bit more. The most worrisome effect is that a certain kind of people take those putative flags very seriously, and deliberately live amazingly bland lives. You can see the young politicians who have nearly no net shadow except party activities, and plan on being electable because they have no scandals. You can see it among the admin people who aim at conforming maximally, thinking this is a clever career move. The problem is that this can lead to a feedback loop: if the officers vetting you have a perspective of what a proper life is based on their own conformist lives, they will gather people like themselves in the institutions of power. Most bureaucracies love bureaucrats, because they make sense to bureaucrats. But this is specific problem that is more narrow than the general problem of *badly founded* fear of omnipresent and omnicompetent Powers making people conform. -- Dr Anders Sandberg Future of Humanity Institute Oxford Martin School Oxford University _______________________________________________ extropy-chat mailing list extropy-chat(a)lists.extropy.org http://lists.extropy.org/mailman/listinfo.cgi/extropy-chat ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

7 14

Bullshit, consciousness, and "A""I"
by Mike Gogulski 27 Oct '13

27 Oct '13

Hello Harish, I'm going to be extremely harsh now, because that's the easiest way for me to communicate my reaction to what you write here. If you find disrespect or impertinence in my writing, please know that I apologize in advance. I do not write to attack you, but perhaps to attack certain ideas you have expressed which I see as fallacious, and I do so lacking better linguistic strategies. If you were pointing in a different direction, I apologize; hopefully the remainder of my drunken rant has some value greater than that of your time reading it. -- extreme harshness begins --: You say "we can't program consciousness". Sorry, but that statement is False Bullshit Ignorance with a capital "FBI". It's completely fucking wrong, and the evidence of that is all around you. Look, honestly, at what programs the most advanced "I"s we know today (that's an "I" separated from "AI", which some people think is an important disctinction) use to UTTERLY DOMINATE the consciousnesses of their children, successors, heirs, fans, et cetera. Look, honestly, at how much bullshit is fed to children, successors, heirs, fans and so on in the form of superstitions, religions, national identities (David Brin, you're looking sadly like a nationalist douche at the moment, badly in need of an Uplift), race, tradition, tribe, family and so on. We, the older people, whether by accident or design, systematically and, largely without consideration, program, mercilessly and without regard to truth, those unto whom we can communicate and over whom we can exercise influence (and, preferably, dominance -- we are, after all, filthy monkey shit-slinging jerks). Each and every one of us programs consciousness every day, to one degree or another. Hard introverts may program only themselves, but that doesn't invalidate the statement. Strident extroverts program many, and most of the time it doesn't matter what their message is or what mode of comprehending reality they are attempting to empart, because far too few humans are capable of a sound intellectual self-defense and critical evaluation of the statements and exhortations of those around them. Billions of people actually believe complete the nonsense that they see on TV, the ridiculous bullshit they got told by some "holy" man was written down in a 7000-year-old book, the risible self-serving horseshit some modern holy man who looks good on TV and who writes down things in law books as if his words created truth, and on and fucking on, and the cowardly pigshit, rabbitshit, parakeetshit and chihuahuashit blabberings of their dependents and hangers-on. THOSE PEOPLE SUFFER BAD FILTERS. Interpreting reality is fucking hard. There is a lot of signal, shit-tons of noise, and we have to deal with our own hormonal responses right down to the level of skin-on-skin between lovers in order to develop consistent views of the world that we can proudly present to others as at least perhaps of better clarity than those they currently hold. Now, it seems, you'd like to speak about "artificial" "intelligence". I put both words in scare quotes for concrete reasons. Let's trot off to Mister Rogers' Neighborhood and break those down, shall we? First, MAXIMUM BRUTALITY: There is no such thing as "artificial intelligence", and there never will be. Why? Because the word "artificial", to most people, denotes or connotes something not belonging to nature. It turns out that a lot of people have a very deeply-held view about things "natural" versus "artificial". (An "ANYTHINGartifical sweetener" might be immediately suspected of causing cancer, while a "natural sweetener" is given a pass -- it's a pity that so few people understand chemistry and physics.). THERE IS NO SUCH DIFFERENCE BETWEEN SOMETHING LABELED "ARTIFICIAL" AND SOMETHING LABELED "NATURAL". Well, I mean, if you're talking about something like a prospective intrusion of another m-brane upon the reality we already suffer, that may be, but probably 98% of people or more go around thinking things about "artifical flavor" or "natural healing" or "artificial intelligence" or "natu... ---- MESSAGE INTERRUPTED. WAIT PLACIDLY FOR OMEGA CONTINGENCY PLAN TIME CODE ---- ..... ... +++ATH0 ATDT14076463131 PS: Along with the "A" in "A"I, the "I" should be in bogoquotes, too, as "A""I". This goes to the idea that in fact there is no evidence that any intelligence exists (Decartes was a wanker), and that there is no evidence that even if as few as one such intelligence exists that it is deserving of moral consideration. On 10/27/2013 02:06 AM, Harish Shah wrote: > > > Michael, > > Apologies, I did mean we can't programme consciousness. Thank you for > pointing that out. > > Again, back to practicality, definitional debates, philosophy and > theory aside. Given, "man-made" is part of a natural process fine, we > can take that philosophy. That is not what the conversation was about > initially, and if it digresses into something else, we can be at peace > with that but it is important to have a conclusion to the original; we > do not face an invasion or enslavement threat from AI, because AI is > not what it is fantasised about or imagined to be or painted to be in > fiction. Real life AI is different from its fictional avatars, it is > not 1% as exciting, not 1% as interesting and while it has a huge > potential for automation and robotics, it is within much more limited > boundaries of so-called independence, autonomy and intelligence than > fiction or fantasy or human imagination makes it out to be. > > At best, AI is a subject of study to be used as a tool or foundation > for professionals, student and researchers building computers or > robots or smart systems such as the lights that turn themselves off > when you step out of the washroom. Beyond being such subject of study > or understanding or such an automation tool, AI really has no greater > or independent position in the world today, in future, in science or > in technology. > > Will mankind create artificial life? Possibly, only if artificial life > is the definition given to cloning. We have already cloned various > plants and animals. Will artificial life be in the form of machines or > robots or computers. Absolutely impossible. It is motivating to chant, > "impossible is nothing", but remember, science is a parameter humanity > is incapable of breaching. > > Where this conversation digresses to, we need to at least as Futurists > acknowledge, just to avert ourselves from riding on a tangent of > fantasy expanding precious time, that a Skynet situation as in > fictional Terminator film franchise cannot and will not happen. This > will only distract us from the real threats we should be working on > pre-empting; human misuse of tech like AI and robotics to harm other > human beings or the human society as a whole. There is an absolute > credible threat as such. Renegade tech, cannot happen. The worst that > we can have is malfunctioning tech, with glitches or errors causing a > computer or machine to fail, not take up arms and wage wars against us. > > For as long as AI has been around, no authority in that field has been > able to identify any such threat or possibility as depicted in the > films or novels we bought into as children. My point here, is to > separate practical reality from fantasy. > > ------------------------------------------------------------------------ > To: lifeboatfoundation(a)yahoogroups.com > From: bukatin(a)cs.brandeis.edu > Date: Sat, 26 Oct 2013 17:03:53 -0400 > Subject: RE: [lifeboatfoundation] the possible risk of AI, essay for > general public > > > > On Sun, 27 Oct 2013, Harish Shah wrote: > > > Programming is man-made. AI results from programming. > > Yes, but how is this relevant? > > Are man-made things inherently less/more powerful, > inherently better/worse, than non man-made? > > "Man-made" is a very conditional thing, it's still > a natural process happening in the real world > according to its laws, just with human participation... > > > universal scientific fact remains that we can programme consciousness. > > Are you saying "we can", or are you saying "we can't", but > having a typo here? > > > We will never in reality create artificial machine or software life > > forms. > > You don't seem to supply any arguments to support this viewpoint.

1 0

NSA, Love and Math 2
by John Young 26 Oct '13

26 Oct '13

Brian Carroll has been exploring these possibilities since 1999: http://cryptome.org/jya/arch-elec.htm http://org.noemalab.eu/sections/ideas/ideas_articles/pdf/b_carroll_seeing_c…

3 2

re: Love and Math...KEA/Firefly is mod. DH-ElGamal i think...
by Joseph Tag 26 Oct '13

26 Oct '13

In reviewing old issues of ACM-SIGSAC, ACM-SIGCOMM, and ACM-SIGACT (more likely ACM-SIGCOMM ) I have seen discussion of encryption protocols for networks; especially in reference to Motorola's Network Encryption System "mail-guard / router" and also reference to key-exhange for that and the then currrent STU-III . Best wishes to all . On Sat, Oct 26, 2013 at 12:00 PM, <cypherpunks-request(a)cpunks.org> wrote: > Send cypherpunks mailing list submissions to > cypherpunks(a)cpunks.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://cpunks.org/mailman/listinfo/cypherpunks > or, via email, send a message with subject or body 'help' to > cypherpunks-request(a)cpunks.org > > You can reach the person managing the list at > cypherpunks-owner(a)cpunks.org > > > 1. Re: [ExI] chilling effects (James A. Donald) > 2. Love and Math Reviewed by NY Times (John Young) > 3. Re: [ExI] chilling effects (Kelly John Rose) > 4. NSA, Love and Math 2 (John Young) > > > > ------------------------------ > > Message: 4 > Date: Sat, 26 Oct 2013 11:01:41 -0400 > From: John Young <jya(a)pipeline.com> > To: cypherpunks(a)cpunks.org, cryptome(a)freelists.org > Subject: NSA, Love and Math 2 > Message-ID: <E1Va5M1-0008Gn-DZ(a)elasmtp-spurfowl.atl.sa.earthlink.net> > Content-Type: text/plain; charset="us-ascii"; format=flowed > > Brian Carroll has been exploring these possibilities since 1999: > > http://cryptome.org/jya/arch-elec.htm > > > http://org.noemalab.eu/sections/ideas/ideas_articles/pdf/b_carroll_seeing_c… > > > > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > cypherpunks mailing list > cypherpunks(a)cpunks.org > https://cpunks.org/mailman/listinfo/cypherpunks > > > ------------------------------ > > End of cypherpunks Digest, Vol 4, Issue 94 > ****************************************** >

1 0

Re: Undernet IPv6 Interop [was: Enigmabox/cjdns]
by grarpamp 26 Oct '13

26 Oct '13

Forwarded with permission. ---------- On 10/24/2013 02:35 PM, grarpamp wrote: > On Thu, Oct 24, 2013 at 6:53 AM, Eugen Leitl <eugen(a)leitl.org> wrote: >> ----- Forwarded message from Caleb James DeLisle <cjd(a)hyperboria.ca> ----- > >> I'm not really worried about what the IETF has to say > > Nor am I really, even to the point of stealing an unused external > IPv6/3 since it is unlikely all of them will ever be allocated. My > thoughts are more about what I outlined in the last two paragraphs... > that things like the userbase draw of existing applications, inclusive > multihosting and participation in more than one net easily at the > same time (whether general purpose IP transport, or specfic like > file storage [1])... can and do matter. The simplest way I've seen > yet that covers those areas is an internal IPv6 layer presented on > the host's tunnel interfaces. So what are some means we can make > to fit a world's population worth of users, out of much larger > crypto keyspaces, into about 115 bits? > > [1] Imagine a link in a web page, file://<IPv6>/<internal_file_key>, > where <IPv6> is just a point-to-point tunnel bound to a particular > filestore like GNUnet, ed2k, tahoe, etc. > >> at some point I'll probably add an option to use IPv4 for cjdns too. >> Applications won't even have to support IPv6 to support cjdns. > > Keeping in mind that people need to be clear when/what they are referring to: > - external addressing, used by the host/net on the public internet (IPv6, IPv4) > - internal addressing, the user facing overlay addresses (IPv6, onion, i2p, etc) > - maplayer addressing, map between crypto widths to narrower internal addressing > > Why would anyone want to use IPv4 internally? It's only 32 bits, > easy to generate/spoof a crypto based address collision. And only > a handful of its tiny /8's (ie: 10/8, 16M users/nodes) could be > used on a host's tunnel interface that would not conflict with > external addressing. Further, every OS, and most applications users > want to use, are already IPv6 enabled, such that using them with > internal IPv6 addressing via the host's tunnel interface to that > is not a problem. > >> When you do a DNS lookup for a site it will allocate an address >> for that machine out of whatever block you choose. > > Please rephrase. > What allocation method, from what address space (v6, v4), and for > residence on the external or internal network? Via what interface? > DNS lookup to external or internal DNS server? And for an internal > or external site? IPv4 in cjdns is actually really easy, you just need a mapping table inside of the node. Say you put in your configuration that 11.0.0.0/8 is for mapping. Cjdns will assign 11.0.0.1/8 to your TUN device then whenever you do a DNS lookup, it grabs the next number in the sequence and maps that to the key which is returned by the lookup. It could also map addresses to incoming connections from previously unseen keys allowing you to be a server too. It just breaks p2p stuff which shares IP addresses. This same idea could be used to map any number of different networks into a common IPv6 (or IPv4) address space. > I do see FC00::/8 addresses returned from queries to external > nameservers. Leaking that activity externally can be unwise, so if > a DNS for internal addresses is needed it should be run internally. It's on the todo list. Not because we're trying to keep secrets or prevent web crawlers from firing syn packets off into ISP null routes but because the public domain system is expensive and an SPOF. > >> As far as address generation speed, the address is a double-sha-512 >> of your public key so it's extremely fast. > > Ok, so a few seconds to generate 8 matching bits (into FC00::/8)? On small hardware yes, on my laptop it feels instantanious. > >> Anything less than 128 >> bits (you're forced to collide the last 8 bits) would be dangerous. >> I'm sure we could have decided to limit valid keys to a fixed 16 >> bits or maybe even 24 but 48 bits would be quite unreasonable to >> expect of small devices. > > I think this is in reply to one of the possible means to fit within > a compatible IPv6 bit width. I think Eugens' forwarding style may > have lost me some context there :) Not sure where to place this or > how to read it. > > We're used to disliking anything less than 128 bits for symmetric > (streams, message encryption, etc). But for network ID's there's > probably a reasonable case to be made for using somewhat less than > that... you should use TLS, message encryption, fingerprints and > other means over any network anyways, just in case something breaks. The IPv6 address is effectively the key fingerprint because x509 is a mistake the world should never make again and colliding an IPv6 gives you spoofing ability as well as MiTM. > > For reference, the five nets I referred to are: > cjdns, i2p (garlicat), tor (onioncat), anonet, phantom > Maybe there's a GNUnet interface in the works but I've not seen it > yet. I'm going to sound like an asshole here, probably because I am.. but every one of those systems with the exception of cjdns is heavily geared toward anonymity, privacy, freedom and individualism. Cjdns is designed to facilitate community and I've found the most divisive, manipulative and egomaniacal people ever to grace the Hyperboria community subscribed to just those values. At this point when I hear TOR user, I think "oh shit another one" so while it's not really my right to intentionally break valid use cases, I'm not feeling like putting a lot of effort into making interop work. Thanks, Caleb BTW: it looks like the IPv4 mapping idea I proposed might come sooner than I thought because Apple seems to have broken IPv6 support in Mavericks update. ----------

1 0