- cypherpunks - lists.cpunks.org

[drone-list] WH OLC memo re: targeted killings released
by Gregory Foster 23 Jun '14

23 Jun '14

Ars Technica (Jun 23) - '"Civilian casualties" authorized under secret US drone-strike memo': http://arstechnica.com/tech-policy/2014/06/civilian-casualties-authorized-u… > A secret Obama administration memo disclosed Monday outlines the legal justification for the government's drone-targeted killing program, a lethal strategy that authorizes the killing of innocents as collateral damage. US Court of Appeals for the Second Circuit (Jun 23) - "NYT v. United States": http://pdfserver.amlaw.com/nlj/usca2-olc-memo-6232014.pdf OLC memo begins on page 67. gf -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/ -- Want to unsubscribe? Want to receive a weekly digest instead of daily emails? Change your preferences: https://mailman.stanford.edu/mailman/listinfo/drone-list or email companys(a)stanford.edu

1 0

Stealthy Dopant-Level Hardware Trojans
by Eugen Leitl 23 Jun '14

23 Jun '14

http://people.umass.edu/gbecker/BeckerChes13.pdf Stealthy Dopant-Level Hardware Trojans ? Georg T. Becker1 , Francesco Regazzoni2 , Christof Paar1,3 , and Wayne P. Burleson1 1University of Massachusetts Amherst, USA 2TU Delft, The Netherlands and ALaRI - University of Lugano, Switzerland 3Horst ortz Institut for IT-Security, Ruhr-Universiat Bochum, Germany Abstract. In recent years, hardware Trojans have drawn the attention of governments and industry as well as the scientific community. One of the main concerns is that integrated circuits, e.g., for military or critical infrastructure applications, could be maliciously manipulated during the manufacturing process, which often takes place abroad. However, since there have been no reported hardware Trojans in practice yet, little is known about how such a Trojan would look like, and how dicult it would be in practice to implement one. In this paper we propose an extremely stealthy approach for implementing hardware Trojans below the gate level, and we evaluate their impact on the security of the target device. Instead of adding additional circuitry to the target design, we insert our hardware Trojans by changing the dopant polarity of existing transistors. Since the modified circuit appears legitimate on all wiring layers (including all metal and polysilicon), our family of Trojans is resistant to most detection techniques, including fine-grain optical inspection and checking against "golden chips". We demonstrate the ectiveness of our approach by inserting Trojans into two designs | a digital post-processing derived from Intel's cryptographically secure RNG design used in the Ivy Bridge processors and a side-channel resistant SBox implementation and by exploring their detectability and their ects on security. Keywords: Hardware Trojans, malicious hardware, layout modifications, Trojan side-channel

5 4

Re: Cryptome down
by John Young 23 Jun '14

23 Jun '14

NetSol discovered a single corrupt file, which has been removed. Should be active soon. At 01:06 PM 6/23/2014, you wrote: >Cryptome and the mirror down again. > > >On Wed, Jun 11, 2014 at 11:46 PM, Christian Mayer ><<mailto:thefox21at@gmail.com>thefox21at(a)gmail.com> wrote: >Why was it down? > > >On Thu, Jun 12, 2014 at 12:29 AM, coderman ><<mailto:coderman@gmail.com>coderman(a)gmail.com> wrote: >On Tue, Jun 10, 2014 at 1:52 PM, grarpamp ><<mailto:grarpamp@gmail.com>grarpamp(a)gmail.com> wrote: > > 403: Forbidden > > >it's back now. > >... and for future reference, you may check: ><https://twitter.com/Cryptomeorg>https://twitter.com/Cryptomeorg >http://cryptomeorg.siteprotect.net/ > >

1 0

Cryptome down
by grarpamp 23 Jun '14

23 Jun '14

403: Forbidden This error message is generated when the web server is trying to access a file that does not exist or has been configured incorrectly Troubleshooting suggestions: Ensure that you have a valid home page defined in your website directory (example: /htdocs/index.html, /htdocs/index.php). On Unix, this is case sensitive and must be all lower case. In your Account Manager, under Hosting Tools, click to .Reset File Permissions..

4 4

dm-crypt+LUKS
by Jose Damico 21 Jun '14

21 Jun '14

Hey people, Could you give me your impressions about the use (only in Linux) of dm-crypt + LUKS instead of truecrypt? For me there is no need to use my encrypted disks with OSX or Windows, so, due the last movements of truecrypt, I am planning to move my encrypted disks from truecrypt to dm-crypt + LUKS. Did you see is as a bad decision, in terms of possible flaws in dm-crypt? Best Regards yap

5 4

Hackers reverse-engineer NSA spy kit using off-the-shelf parts
by Georgi Guninski 21 Jun '14

21 Jun '14

http://www.theregister.co.uk/2014/06/19/hackers_reverseengineer_nsa_spying_… Hackers reverse-engineer NSA spy kit using off-the-shelf parts Link to http://www.nsaplayset.org/

3 2

Re: [cryptography] How big a speedup through storage?
by grarpamp 21 Jun '14

21 Jun '14

On Fri, Jun 20, 2014 at 6:35 PM, Jeffrey Goldberg <jeffrey(a)goldmark.org> wrote: > (I hope it is clear that I do not think of this as anything like a practical > threat to AES. Of course, 8 rounds at 2^unreachable is not practical. > I had just remembered this paper, with its enormous data > requirements when I saw original question.) >>> Any (reliable) estimates on how big? > >> $10M in drives at consumer pricing will get you a raw 177PB, or 236PB at >> double the space and power. Or $1B for 17EB. Budget is an issue. > > As always, let’s go with the high estimate in the hands of the attacker. We > are still far far short of the storage requirements for this particular attack > (and all for less than a 2-bit gain). > > So I think that it is safe to say that all that data storage is not an attempt > to use the particular attack I cited. I meant as answer 'estimates on how big' question. Take what we know about storage, figure in some good efficiencies for the 'storage only' case. And figure what can be bought and operated year on year per foot. You could hide/support $1B + $1B/year but $10B/yr would be hard given entire intel budget is $80B, or $50+B if you drop mil. So... 1) How big can you get within budget? 2) What can you do with it re: a) crypto, or b) otherwise? https://en.wikipedia.org/wiki/United_States_intelligence_budget https://en.wikipedia.org/wiki/United_States_Intelligence_Community http://www.martingrandjean.ch/data-visualization-top-secret-us-intelligence…

1 0

Fwd: [cryptography] [Cryptography] encrypting hard drives (was Re: Shredding a file on a flash-based file system?)
by coderman 21 Jun '14

21 Jun '14

---------- Forwarded message ---------- From: grarpamp <grarpamp(a)gmail.com> Date: Thu, Jun 19, 2014 at 2:27 PM Subject: Re: [cryptography] [Cryptography] encrypting hard drives (was Re: Shredding a file on a flash-based file system?) On Thu, Jun 19, 2014 at 4:18 PM, Dan McDonald <danmcd(a)kebe.com> wrote: > ZFS crypto, closed-source thanks to Oracle, was supposed to address this > problem. Its design was to apply crypto in the "ZIO" path, like it does for > checksums. I've not used Oracle Solaris, but apparently ZFS crypto is in > there and it supposedly works. And as in the design papers/blogs, Oracle ZFS seems to have some data that is not encrypted that arguably should be. https://blogs.oracle.com/darren/entry/zfs_encryption_what_is_on > And let me state for people wondering, "Why isn't it in OpenZFS already?" In the OpenZFS world, you deploy each OS's FDE underneath ZFS. OpenZFS will likely add native encryption feature flag someday to satiate those who want per dataset keying, etc... but, thanks to Oracle, anything post zfs28/zpool5 might not end up interoperating. https://en.wikipedia.org/wiki/ZFS http://www.open-zfs.org/

1 0

Re: Assange
by John Young 20 Jun '14

20 Jun '14

Virtually nobody is not exploiting Assange for their own purposes. Kristinn Hrafnsson is among the media monsters, pro and con, creating and feeding a market for their derivative shallowness of Assange's fame. Our latest derivative exploitation over eight years: http://cryptome.org/2014/06/saluations-assange.htm To be sure, Assange has derivatively exploited Cypherpunks since about 1995, naming a book, articles, talks, brags, after this collective as if his own. That ownership, to be certain, is a given of this list as it should be everywhere to combat the thieves and spies of content, branded, marked up and marketed by way of centralizing media monstrosities. Combat between cryptoarchists of centralized control and cryptoanarchists of distributed uncontrol wll go on forever. Assange's fame and infame are being fought over by centralizers and decentralzers. Which way he will tip is his secret of controlling the tusslers as well as what he whispers to those he is fucking.

3 4

Re: [cryptography] How big a speedup through storage?
by grarpamp 20 Jun '14

20 Jun '14

On Fri, Jun 20, 2014 at 3:23 PM, Jeffrey Goldberg <jeffrey(a)goldmark.org> wrote: > On 2014-06-19, at 10:42 PM, Lodewijk andré de la porte <l(a)odewijk.nl> wrote: > >> With common algorithms, how much would a LOT of storage help? > > Well, with an unimaginable amount of storage it is possible to shave a few bits off of AES. > > As {Bogdanov, Andrey and Khovratovich, Dmitry and Rechberger, Christian} say in Biclique Cryptanalysis of the Full AES (ASIACRYPT 2011) [PDF at http://research.microsoft.com/en-us/projects/cryptanalysis/aesbc.pdf ] > > "This approach for 8-round AES-128 yields a key recovery with computational complexity about 2^125.34, data complexity 2^88, memory complexity 2^8, and success probability 1.” > > It’s that 2^88 that requires a LOT of storage. I’m not sure if that 2^88) is in bits or AES blocks, but let’s assume bits. Facebook is said to store about 2^62 bits, so we are looking at something 2^26 times larger than Facebook’s data storage. 8 rounds, lot more to go. >> I know this one organization that seems to be building an omnious observation storage facility, > > Any (reliable) estimates on how big? I believe the square footage is public, if not guesstimate by parking spaces etc in JYA's sat photos. Then fill it to the brim with nothing but 6TB drives, less some space for racks, aisles, power, network at say 50% better density than industry best [1]. That's your physical upper bound. $10M in drives at consumer pricing will get you a raw 177PB, or 236PB at double the space and power. Or $1B for 17EB. Budget is an issue. Give it a shot on paper, best estimate wins... [1] If all you care about is storage, you plug drives into tiny custom storage fabric asics and present giant block devices at the end of each row or room, not into bulky servers. Commodity CPU's have 64bit address space, ZFS covers that. Or go custom access/compute on your data as well. http://en.wikipedia.org/wiki/ZFS#Capacity

1 0