- cypherpunks - lists.cpunks.org

Eccentricity: How Hard to Crack a Cryptosystem
by John Young 02 Sep '13

02 Sep '13

One of the many eccentricities of crypto is speculating on how long and how much computing power would be needed to crack a particular cryptosystem, its algorithm or "implementation." A favorite of popular writing on the topic, it is likely these claims are pure fiction fabricated to satisfy headlines and deadlines -- and, as always, to market or rididule a competitor's piece of shit. No Wikipedia entry on the phrase "crypto implementation," the all-time favorite excuse for the shit's absolute certain failure. Some examples among hundreds: No. 1 http://www.digicert.com/TimeTravel/math.htm [No date] DigiCert's base standard is to use 2048-bit keys in secure SSL certificates - that is enormously stronger than anything Lenstra et al attempted, in fact, it would require factoring a 617-digit number. RSA Labs claim (see: http://www.rsa.com/rsalabs/node.asp?id=2004) that 2048-bit keys are 2^32 (2 to the power of 32) times harder to break using NFS, than 1024-bit keys. 2^32 = 4,294,967,296 or almost 4.3 billion, therefore breaking a DigiCert 2048-bit SSL certificate would take about 4.3 billion times longer (using the same standard desktop processing) than doing it for a 1024-bit key. It is therefore estimated, that standard desktop computing power would take 4,294,967,296 x 1.5 million years to break a DigiCert 2048-bit SSL certificate. Or, in other words, a little over 6.4 quadrillion years. In putting together our video, we estimated the age of the Universe to be 13,751,783,021 years or a little over 13.75 billion years, therefore if you tried to break a DigiCert 2048-bit SSL certificate using a standard modern desktop computer, and you started at the beginning of time, you would have expended 13 billion years of processing by the time you got back to today, and you would still have to repeat that entire process 468,481 times one after the other into our far far distant future before there was a good probability of breaking the certificate. In fact the Universe itself would grow dark before you even got close. ----- No. 2 http://www.eetimes.com/document.asp?doc_id=1279619 How secure is AES against brute force attacks? Mohit Arora, Sr. Systems Engineer & Security Architect, Freescale Semiconductor 5/7/2012 05:29 PM EDT Even with a supercomputer, it would take 1 billion billion years to crack the 128-bit AES key using brute force attack. This is more than the age of the universe (13.75 billion years). If one were to assume that a computing system existed that could recover a DES key in a second, it would still take that same machine approximately 149 trillion years to crack a 128-bit AES key. ----- No. 3 http://www.computerworld.com/s/article/354997/The_Clock_Is_Ticking_for_Encr… The clock is ticking for encryption The tidy world of cryptography may be upended by the arrival of quantum computers. By Lamont Wood March 21, 2011 06:00 AM ET Today's encryption algorithms can be broken. Their security derives from the wildly impractical lengths of time it can take to do so. Let's say you're using a 128-bit AES cipher. The number of possible keys with 128 bits is 2 raised to the power of 128, or 3.4x1038, or 340 undecillion. Assuming no information on the nature of the key is available (such as the fact that the owner likes to use his or her children's birthdays), a code-breaking attempt would require testing each possible key until one was found that worked. Assuming that enough computing power was amassed to test 1 trillion keys per second, testing all possible keys would take 10.79 quintillion years. This is about 785 million times the age of the visible universe (13.75 billion years). On the other hand, you might get lucky in the first 10 minutes. But using quantum technology with the same throughput, exhausting the possibilities of a 128-bit AES key would take about six months. If a quantum system had to crack a 256-bit key, it would take about as much time as a conventional computer needs to crack a 128-bit key. A quantum computer could crack a cipher that uses the RSA or EC algorithms almost immediately. ----- No. 4 https://xkcd.com/538/ Thanks, XKCD

1 0

Lavabit and End-point Security
by Sean Alexandre 02 Sep '13

02 Sep '13

I find some comfort in the fact that they had to serve papers to Lavabit to get the information they wanted. To me this says Lavabit's security was so good they couldn't back door his machines. Or, maybe it was cover-up, to get the information "legally." But I'm guessing they really couldn't get what they wanted. I'd love to see some kind of write-up by Ladar about how he did this...maybe even a book. I expect he was just doing all the standard things any sys-admin should be doing. It would be great to see it all written down in one place, though, as a case study with details. Even better: Edward Swowden as a co-author.

12 23

WaPo releases details on US offensive cyber-ops
by Gregory Foster 02 Sep '13

02 Sep '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Washington Post (Aug 30) - "U.S. spy agencies mounted 231 offensive cyber-operations in 2011, documents show" by @BartonGellman & @nakashimae: http://www.washingtonpost.com/world/national-security/us-spy-agencies-mount… > under an extensive effort code-named GENIE, U.S. computer > specialists break into foreign networks so that they can be put > under surreptitious U.S. control. Budget documents say the $652 > million project has placed “covert implants,” sophisticated > malware transmitted from far away, in computers, routers and > firewalls on tens of thousands of machines every year, with plans > to expand those numbers into the millions. ... > The NSA designs most of its own implants, but it devoted $25.1 > million this year to “additional covert purchases of software > vulnerabilities” from private malware vendors, a growing > gray-market industry based largely in Europe. gf - -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.19 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBCgAGBQJSJM5iAAoJEMaAACmjGtgjdbIP/12OFrDd3Hjp8vnmT8gj39Ke BuNqryCsN1yrJtDmDfUjjXoQ5L/Hkd5wxavmEOLd+ujJHle3hYhzaOcbYhCJxXmO Yh/8T1VRxjthxCloZhF4o+y3cd9/Hroq98wN+i6lNQMSfWgJcOnOmTxukkjE+W5+ dz/BuFuwyKH+A7nCdFLyvsBThq9vciIstEAY4aBgFODD7is373qWaJ/rbCTg4Q0R ySkaW1jSiyds8fbro4y8MLJDktRuDoG6Y8iimwiiab0nBl/2Emhrjl59Bgr1kZEw C6zn1yD8ZCdR4asAGyObLOByu2wcSycTAeVRwVMI0Jd9jAE3jh2XZpk7KJ8hV3+7 iNblmunYi3JbmYqzuByRqGNEr/Dr1lNqKJYEPh1wk7xtb5Tidta+m4yfc2zToHX6 evlHkhxDNuDzS9SulZ0/a7X7cFFDhnsg649H1HLCzSq85SvwsRDs50OFD4IO8sw3 UaIz4Mxa+HHBuTaOUtYgPl8OEtB+TiVRgsSWvp5H0IOAFS3hfWF8Qa+fim3X0aXu Iboh8NxX0tbx95mvVo98IZfor++cXY3PvIDRZFHHvFphoYWjp7o2LZTEWzb+zVub 6Ph4iSZ3xQCqxDsKCxU51DwQZXf5UpCGGq3BbmmSCj3XSAP0KPLmrs/qrt/3W9qe C7PeIi/toTCeJPMRdCN0 =ihTp -----END PGP SIGNATURE-----

2 1

Wikileaked Stratfor admin talks crypto. Nonsense?
by Sylvia Ganush 02 Sep '13

02 Sep '13

'Any encryption based on an algorithm can be decrypted with the resources available to a government.' These are words of Michael Mooney, the hapless system administrator of Stratfor, a private intelligence agency that got hacked, doxed, and wikileaked in 2011-2012: http://search.wikileaks.org/gifiles/?viewemailid=3424010 Is Mr Mooney correct? On the one hand he's proven his incompetence by storing clients' credit card numbers in the clear. On the other hand, Stratfor sell themselves as spooks well-versed in security questions and hence could know better. What do cypherpunks think of Mr Mooney's statement? Does it really take a government only one month to crack a 2048-bit key? Sylvia

2 2

New breakthrough could bring quantum encryption to smartphones
by Gutem 02 Sep '13

02 Sep '13

http://www.extremetech.com/extreme/165281-new-breakthrough-could-bring-quan… - Gutem

2 1

Re: [Cryptography] NSA and cryptanalysis
by Eugen Leitl 02 Sep '13

02 Sep '13

----- Forwarded message from Jerry Leichter <leichter(a)lrw.com> ----- Date: Sun, 1 Sep 2013 07:11:06 -0400 From: Jerry Leichter <leichter(a)lrw.com> To: Peter Gutmann <pgut001(a)cs.auckland.ac.nz> Cc: crypto.jmk(a)gmail.com, die(a)dieconsulting.com, "cryptography(a)metzdowd.com List" <cryptography(a)metzdowd.com> Subject: Re: [Cryptography] NSA and cryptanalysis X-Mailer: Apple Mail (2.1283) On Sep 1, 2013, at 2:36 AM, Peter Gutmann wrote: > John Kelsey <crypto.jmk(a)gmail.com> writes: > >> If I had to bet, I'd bet on bad rngs as the most likely source of a >> breakthrough in decrypting lots of encrypted traffic from different sources. > > If I had to bet, I'd bet on anything but the crypto. Why attack when you can > bypass [1]. Well, sure. But ... I find it hard to be quite so confident. In practical terms, the vast majority of encrypted data in the world, whether in motion or at rest, is protected by one of two algorithms: RSA and AES. In some cases, RSA is used to encrypt AES keys, so an RSA break amounts to a bypass of AES. If you want to consider signatures and authentication, you come back to RSA again, and add SHA-1. This is not to say there aren't other techniques out there, or that new ones aren't being developed. But to NSA it's clearly a game of numbers - and any kind of wedge into either of just two algorithms would expose huge amounts of traffic to interception. Meanwhile, on the authentication side, Stuxnet provided evidence that the secret community *does* have capabilities (to conduct a collision attacks) beyond those known to the public - capabilities sufficient to produce fake Windows updates. And recent evidence elsewhere (e.g., using a bug in the version of Firefox in the Tor Browser Bundle) has shown an interest and ability to actively attack systems. (Of course, being able to decrypt information without an active attack is always the ideal, as it leaves no traces.) I keep seeing statements that "modern cryptographic algorithms are secure, don't worry" - but if you step back a bit, it's really hard to justify such statements. We *know*, in a sense, that RSA is *not* secure: Advances in factoring have come faster than expected, so recommended key sizes have also been increasing faster than expected. Most of the world's sites will always be well behind the recommended sizes. Yes, we have alternatives like ECC, but they don't help the large number of sites that don't use them. Meanwhile, just what evidence do we really have that AES is secure? It's survived all known attacks. Good to know - but consider that until the publication of differential cryptanalysis, the public state of knowledge contained essentially *no* generic attacks newer than the WW II era attacks on Enigma. DC, and to a lesser degree linear cryptanalysis not long after, rendered every existing block cipher (other than DES, which was designed with secret knowledge of DC) obsolete in one stroke. There's been incremental progress since, but no breakthrough of a similar magnitude - in public. Is there really anything we know about AES that precludes the possibility of such a breakthrough? There's a fundamental question one should ask in designing a system: Do you want to protect against targeted attacks, or do you want to protect against broad "fishing" attacks? If the former, the general view is that if an organization with the resources of the NSA wants to get in, they will - generally by various kinds of bypass mechanisms. Of the latter, the cryptographic monoculture *that the best practices insist on* - use standard protocols, algorithms and codes; don't try to invent or even implement your own crypto; design according to Kirchoff's principle that only the key is secret - are exactly the *wrong* advice: You're allowing the attacker to amortize his attacks on you with attacks on everyone else. If I were really concerned about my conversations with a small group of others being intercepted as part of dragnet operations, I'd design my own small variations on existing protocols. Mix pre-shared secrets into a DH exchange to pick keys. Use simple steganography to hide a signal in anything being signed - if something shows up signed without that signal, I'll know (a) it's not valid; (b) someone has broken in. Modify AES in some way - e.g., insert an XOR with a separate key between two rounds. A directed attack would eventually break all this, but generic attacks would fail. (You could argue that the failure of generic attacks would cause my connections to stand out and thus draw attention. This is, perhaps, true - it depends on the success rate of the generic attacks, and on how many others are playing the same games I am. There's no free lunch.) It's interesting that what what little evidence we have about NSA procedures - from the design of Clipper to Suite B - hints that they deploy multiple cryptosystems tuned to particular needs. They don't seem to believe in a monoculture - at least for themselves. -- Jerry _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

[liberationtech] Snowden masks for Holloween?
by Eugen Leitl 02 Sep '13

02 Sep '13

----- Forwarded message from Paul Elliott <pelliott(a)blackpatchpanel.com> ----- Date: Mon, 2 Sep 2013 03:59:50 -0500 From: Paul Elliott <pelliott(a)blackpatchpanel.com> To: Liberation Technologies <liberationtech(a)lists.stanford.edu> Subject: [liberationtech] Snowden masks for Holloween? User-Agent: Mutt/1.5.21 (2010-09-15) Reply-To: liberationtech <liberationtech(a)lists.stanford.edu> Is it not funny, no one seems to be commercially oftering Snowden masks for this Holloween. I looked on Amazon and google and nothing on the first page of a cursory search. You would think it would be a top seller. Is presure being applied? Please tell me if you are aware of a source. Thank You. -- Paul Elliott 1(512)837-1096 pelliott(a)BlackPatchPanel.com PMB 181, 11900 Metric Blvd Suite J http://www.free.blackpatchpanel.com/pme/ Austin TX 78758-3117 --- "Encryption works. Properly implemented strong crypto systems are one of the few things that you can rely on. Unfortunately, endpoint security is so terrifically weak that NSA can frequently find ways around it." Edward Snowden -- Liberationtech is a public list whose archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Re: [tor-talk] New paper : Users Get Routed: Traffic Correlation on Tor by Realistic Adversaries
by Eugen Leitl 02 Sep '13

02 Sep '13

----- Forwarded message from Roger Dingledine <arma(a)mit.edu> ----- Date: Sun, 1 Sep 2013 22:10:56 -0400 From: Roger Dingledine <arma(a)mit.edu> To: tor-talk(a)lists.torproject.org Subject: Re: [tor-talk] New paper : Users Get Routed: Traffic Correlation on Tor by Realistic Adversaries User-Agent: Mutt/1.5.20 (2009-06-14) Reply-To: tor-talk(a)lists.torproject.org On Mon, Sep 02, 2013 at 11:35:22AM +1000, Erik de Castro Lopo wrote: > Hi all, > > Heads up on a new paper suggesting that its possible to unmask > Tor users using traffic correlation: > > http://www.ohmygodel.com/publications/usersrouted-ccs13.pdf > > Code here: > > http://torps.github.io/ > > Would be interested in hearing the opinions of the core Tor > develpoment team on this stuff. Yep. They're part of the Tor research community. I have plans for writing a blog post about the paper, to explain what it means, what it doesn't mean, what we should do about it, and what research questions remain open. Stuff keeps catching fire with bigger flames though. The extremely short answer is "Yes, a big enough adversary can screw Tor users. But we knew that. I think it's great that the paper presents the dual risks of relay adversaries and link adversaries, since most of the time when people are freaking out about one of them they're forgetting the other one. And we really should raise the guard rotation period. If you do their compromise graphs again with guards rotated every nine months, they look way different." https://trac.torproject.org/projects/tor/ticket/8240 https://trac.torproject.org/projects/tor/ticket/9321 --Roger -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

[tor-talk] New paper : Users Get Routed: Traffic Correlation on Tor by Realistic Adversaries
by Eugen Leitl 02 Sep '13

02 Sep '13

----- Forwarded message from Erik de Castro Lopo <mle+tools(a)mega-nerd.com> ----- Date: Mon, 2 Sep 2013 11:35:22 +1000 From: Erik de Castro Lopo <mle+tools(a)mega-nerd.com> To: tor-talk(a)lists.torproject.org Subject: [tor-talk] New paper : Users Get Routed: Traffic Correlation on Tor by Realistic Adversaries Organization: Erik Conspiracy Secret Labs X-Mailer: Sylpheed 3.4.0beta4 (GTK+ 2.24.10; x86_64-pc-linux-gnu) Reply-To: tor-talk(a)lists.torproject.org Hi all, Heads up on a new paper suggesting that its possible to unmask Tor users using traffic correlation: http://www.ohmygodel.com/publications/usersrouted-ccs13.pdf Code here: http://torps.github.io/ Would be interested in hearing the opinions of the core Tor develpoment team on this stuff. Cheers, Erik -- ---------------------------------------------------------------------- Erik de Castro Lopo http://www.mega-nerd.com/ -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Who bought off Zimmermann?
by StealthMonger 01 Sep '13

01 Sep '13

How ironic and sad it is that Phil Zimmermann, the author of PGP, has become so imbued with the enterprise culture that he's now so blind to the original peer-to-peer spirit of PGP that he would say things like There is no way to do encrypted e-mail where the content is protected. [1] This is simply false. If sender and receiver exchange keys out-of-band and nobody else knows the keys, the content can have cryptographically strong protection. Why would Zimmermann allow himself to be bought off? What kind of pressure is being brought to bear? Is this protracted world-class human engineering in action? [1] http://www.forbes.com/sites/parmyolson/2013/08/09/e-mails-big-privacy-probl… -- -- StealthMonger <StealthMonger(a)nym.mixmin.net> Long, random latency is part of the price of Internet anonymity. anonget: Is this anonymous browsing, or what? http://groups.google.ws/group/alt.privacy.anon-server/msg/073f34abb668df33?… stealthmail: Hide whether you're doing email, or when, or with whom. mailto:stealthsuite@nym.mixmin.net?subject=send%20index.html Key: mailto:stealthsuite@nym.mixmin.net?subject=send%20stealthmonger-key

9 11