- cypherpunks - lists.cpunks.org

[tor-dev] augmenting RSA identities/signatures with ECC and beyond
by Eugen Leitl 04 Aug '13

04 Aug '13

----- Forwarded message from Jacob Appelbaum <jacob(a)appelbaum.net> ----- Date: Sun, 04 Aug 2013 01:29:45 +0000 From: Jacob Appelbaum <jacob(a)appelbaum.net> To: tor-dev(a)lists.torproject.org Subject: [tor-dev] augmenting RSA identities/signatures with ECC and beyond Reply-To: tor-dev(a)lists.torproject.org Hi, Linus and I had an interesting discussion at IETF 87 this past week in Berlin. We're both concerned about long term Directory Authority identity keys as well consensus signing with RSA keys. We've agreed that we're interested in writing a proposal whereby we add additional identity keys for authorities. Thus, we'll have whatever security may be provided by RSA and the security that should be provided by ECC signatures. The work on ntor should directly assist us in having almost all the required crypto we'll need for such augmentation. I tend to think that every directory authority should generate an additional and new long term ECC identity key. This will require that tor-gencert is extended to understand both ECC and RSA. We'll want to add these fingerprints to src/or/config.c for each respective DA. We'll want each directory authority to sign with both RSA and ECC. We'll also want to extend the consensus format to handle publication of such signatures. Older clients should be able to parse the consensus without worry and they will check RSA signatures as always. Newer clients should check both and report a mismatch into the logs at a high level. When combined with ntor, I believe that we will have significantly improved the cryptography in Tor. It would be nice to be able to add other signature schemes - specifically for pq crypto related undertakings. In an ideal world, I'd like to be able to sign the consensus from my directory authority with RSA, ECC and some kind of djb approved, tanja tested post-quantum computer signature construct. What do you think we should consider as we draft this proposal? All the best, Jacob _______________________________________________ tor-dev mailing list tor-dev(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

[tor-dev] Damian's Status Report - July 2013
by Eugen Leitl 04 Aug '13

04 Aug '13

----- Forwarded message from Damian Johnson <atagar(a)torproject.org> ----- Date: Sat, 3 Aug 2013 16:16:31 -0700 From: Damian Johnson <atagar(a)torproject.org> To: tor-dev(a)lists.torproject.org, tor-reports(a)lists.torproject.org Subject: [tor-dev] Damian's Status Report - July 2013 Reply-To: tor-dev(a)lists.torproject.org Hi all. This month was mostly spent on non-tor work including a server migration, bad service outage at work, and a full week of cleaning my apartment. Still, plenty of spiffy news in stem land... ====================================================================== Remote Descriptor Fetching ====================================================================== Major feature for this month was the addition of a module to remotely fetch tor descriptors... https://stem.torproject.org/api/descriptor/remote.html https://lists.torproject.org/pipermail/tor-dev/2013-July/005156.html This works much like tor itself does, downloading descriptor content from directory authorities and mirrors. With it we can now easily script against the present state of the tor network without piggybacking on a live tor instance. Curious what you can use it for? See our present monitors for some ideas... https://lists.torproject.org/pipermail/tor-dev/2013-July/005209.html https://gitweb.torproject.org/atagar/tor-utils.git/tree This also included a little work with Nick on the spec and tor side... * Dropped the unimplemented microdescriptor query from the spec. (#9271) * Noting the max queryable fingerprints/hashes in spec. (#9282) * We're getting a high failure rate on the downloads we make. A little more investigation is needed on my part to help narrow this down. (#9379) ====================================================================== Other news includes... * Revised the appearance of stem's frontpage. The blue buttons were pretty jarring, so switched to something that matches the rest of the page... http://www.atagar.com/transfer/stem_frontpage/before.png http://www.atagar.com/transfer/stem_frontpage/after.png * Added Slackware to our download page. Many thanks to Markus for adding us to SlackBuilds! http://slackbuilds.org/repository/14.0/python/stem/ * Worked with Sreenatha to port Tor Weather to stem. Unfortunately Weather does not presently have an active maintainer so I'm not sure how we will proceed on this front. (#8264) https://lists.torproject.org/pipermail/tor-dev/2013-July/005111.html * The Munich dev meeting has attracted quite a few potential volunteers. After discussing prospective projects with seros I tidied up our volunteer page. Changes included... * Added Christian's Globe project https://lists.torproject.org/pipermail/tor-commits/2013-August/060124.html * Dropped Thandy https://lists.torproject.org/pipermail/tor-commits/2013-July/059830.html * Merged TorStatus into the entry for Atlas https://lists.torproject.org/pipermail/tor-commits/2013-July/060003.html * General page corrections https://lists.torproject.org/pipermail/tor-commits/2013-August/060125.html * Our automated Jenkins test runs ran into another regression in tor that caused it to segfault. (#9298) * STREAM events mishandled IPv6 addresses. (caught and patched by soult, #9181) * Thread with Pierre about TorPylle which turned into a discussion with Nick regarding future language direction for the tor codebase. I'm looking forward to seeing where it goes! https://lists.torproject.org/pipermail/tor-dev/2013-July/005161.html * We just finished with midterms for Google Summer of Code. Chang unfortunately did not pass, but the other projects are going well. * Sorted out travel arrangements for the GSoC mentor summit. Nick and I will be going, and Moritz is presently on the waitlist. * Code reviewed ra's rttprober. He provided some great feedback for which I still owe him a reply. https://lists.torproject.org/pipermail/tor-dev/2013-July/005183.html Cheers! -Damian _______________________________________________ tor-dev mailing list tor-dev(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Re: [liberationtech] LeastAuthority.com announces a Spy-Proof Storage Service
by Eugen Leitl 04 Aug '13

04 Aug '13

----- Forwarded message from Zooko Wilcox-O'Hearn <zookozot(a)gmail.com> ----- Date: Sun, 4 Aug 2013 00:44:58 -0700 From: Zooko Wilcox-O'Hearn <zookozot(a)gmail.com> To: liberationtech(a)lists.stanford.edu Subject: Re: [liberationtech] LeastAuthority.com announces a Spy-Proof Storage Service Reply-To: liberationtech <liberationtech(a)lists.stanford.edu> Hello again, people of liberationtech. Nobody replied to my missive. Perhaps it was Too Long; Didn't Read! But I wanted to mention to you that I subsequently talked to some young programmers at DefCon. I told them that my claim is that LeastAuthority.com's S4 is proof against PRISM-style indiscriminate surveillance, but not proof against targeted surveillance. They suggested: why not call it “PRISM-proof” then? Good idea! I might do that. Regards, Zooko Wilcox-O'Hearn Founder, CEO, and Customer Support Representative https://LeastAuthority.com -- Liberationtech list is public and archives are searchable on Google. Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Re: [tor-talk] HS drop
by Eugen Leitl 04 Aug '13

04 Aug '13

----- Forwarded message from Trigger Happy <triggerhappy(a)openmail.cc> ----- Date: Sun, 04 Aug 2013 07:30:34 +0200 From: Trigger Happy <triggerhappy(a)openmail.cc> To: tor-talk(a)lists.torproject.org Subject: Re: [tor-talk] HS drop User-Agent: Mozilla/5.0 (X11; Linux i686; rv:17.0) Gecko/20130625 Thunderbird/17.0.7 Reply-To: tor-talk(a)lists.torproject.org -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 W dniu 04.08.2013 06:42, grarpamp pisze: > Noting what is apparently a very large drop in the number of > onions online. Still checking... > http://www.reddit.com/r/onions/comments/1jmrta/founder_of_the_freedom_hosti… - -- Pzdr Trigger Happy jabber: triggerhappy(a)jabber.ccc.de -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJR/ebsAAoJEEtm9wC9fGLFZ+8P/i/gN0qwGMspdpChK8Nqhzo/ rdQesEzZNwIaG9h6RvkSSbRBtEBEYbfcijVsLBC5IsoxiIKPAIwLRQDM/v7Ztzzp aMnFCLwWBjmOFwW2VUcKYoeP+2Q6d9IqLI7FHlsbKbCBHLmRMQouMyAuu65r/rwb XMjy9D6e/evT+Rx+tvfkgOO7LQoIHj29uKTVDeLbghLKlnZqgFMKYx9NxnDCqbvj TXllMkO8AjIfh4QIYTzOimC5oEKDRNHw9ci+WSrmUhO5AWBGX2rZn009x0MVO2sg 7X8UuecQ+tFGq/8/W+WGjG9neGrirDeKfesQdNlTiuGqR2K+aa2bR/D6BRLo6vEZ 4T0gZAZcM64xCWEm8GrmGiFWGKW7L71LzIC+gaBSG2qwsCdB0supPE+4uOKQ7WA9 dBKWPQg9R3x0epYwg/9L2mHxaV0oUa0EtQPGvflhpv37Oc/07Xdfml7dZyuYayzY 9lkLX0UGNwIq+CNf3GtHWf2LIBemjGOQx14H5i4vSDLZF09MPERBK4HMRz6ZTnaY oxK6UAV0CZrOoQMAXZEDm7ywBTi3KK2nlKZvjNvtagtNqmJYx9X17U86HNSh36z6 hDouLDVZQIzZcpI1c2dsmrC+kDKZD5642daXCduyIboZAAjPud07cVI+j4yoGUHx lQ8IbKX2L4e1iAmFjcsf =HeQf -----END PGP SIGNATURE----- -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Bruce Sterling on the moment
by Gregory Foster 03 Aug '13

03 Aug '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Medium (Aug 3) - "The Ecuadorian Library: or, The Blast Shack After Three Years" by @bruces: https://medium.com/geek-empire-1/a1ebd2b4a0e5 HT @maupuia, https://twitter.com/maupuia/status/363499310043774976 gf - -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.19 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBCgAGBQJR/K1UAAoJEMaAACmjGtgj3agQAIv8XI/+8fnvHopFDbllx5zS 8OxYuTVOGoNnSNxDC77kIH3ZLlYmXWVtG5QzxVwK76pFngxUALmNj1kBEXf0ki7n 9PZ8s88XM9MHBmH15Oh4LA9Rd48Gt9kxw8CmH4NnCUc3Lf42IhhTYUamsdpDyfSp 6z6gyRBhXrUaoHmTfPLWKc65C7endLRqS8r1jVe8uUCsYSWZuK62Ie8zFUhAgZ4C xVaa8ckc9YWMHlUe9M9nzN28GtRHs9G53P9YRwfVqA7zIX3MxDdY1WpBa+aVLcSD C0d1hKC+dOkOgWHWHCOgqn6FBdKDa2FPPTjmQWYmsier5iHcheCXDMccyQKrVRMu Np+4ja7Q1Q65kvNVvzqb82HdfL73d5xxSI1MfNzPx/wDD7ezUYZfVadp40H9QDxb RQF8xrj16Y9Tc0kci4XNhIaOyyxpDjd63pSgVNk022oNk5NAQ0i157CB705izWxn FwgEfQzRK8HEHcvNa5bqTa0pb4CTw3/MqmQvpR0U9tQrHC56MkKRxYR+1awq2Oxx JG5V/cLf/5h7qLMTE2u6eugWEEakx578yW5+do6APXDGs9WEcUOx3DTV0lR0k2YP J4MVgsfNnkaybK1RaNAHXkzREgBq2tyzuRWvUKBJlK3H0xQX6CChlRek9ySz3Rc7 Po+54S4szz6n8F2/zvJd =dpfA -----END PGP SIGNATURE-----

1 0

Re: XKeyscore: NSA tool collects 'nearly everything a user does, on the internet
by Faraz 02 Aug '13

02 Aug '13

What's are peoples take on slide 17? "Show me all VPN startups in country X, and give me data so I can decrypt and discover user" http://www.theguardian.com/world/interactive/2013/jul/31/nsa-xkeyscore-prog…

4 6

Radiation Emission Controls
by John Young 02 Aug '13

02 Aug '13

An engineer formerly working at the National Radio Astronomy Observatory (http://www.gb.nrao.edu/nrqz/) lists its radiation emissions controls: http://cryptome.org/2013/07/radiated-emissions-control.htm Among them is the banning of vehicles which use spark plugs, thus diesel-fueled are required. Which suggests a question about radiation emissions at NSA Utah Data Center's 32 large generators. Since nearly all government and commercial data centers have generator back-ups, how are emissions from generators controlled? NRAO also "banned digital cameras down range after they proved quite noisy." Are noisy digital camera emissions more privacy threatening than phone signals? Is NSA harvesting those emissions?

4 4

Re: [cryptography] Radiation Emission Controls
by John Young 02 Aug '13

02 Aug '13

Inquiry about emissions at NSA UDC and other data centers was not for external capture but about internal protection from its own emanating equipment. In particular EM interference by the big generators at most of the facilities, electrical sub-stations, processing racks, cabling, switches, personal devices, whatever is used to run the operation and whatever might be deployed by those hoping to capture inadvertent emissions by land, air, sat, mobile. If you will, what does NSA do to capture such emissions from data centers to data gathering and for unique signatures? This is not likely overlooked by NSA and maybe at the other burgeoning worldwide data centers, but what that protection might involve, ie, Large-scale TEMPEST countermeasures, somewhat larger than a nuclear submarine, maybe closer to large-scale array used to snoop on global EM and radio signals, mundane and heavenly. as with the NRAO. We have an interest in snooping on the emissions and protection against snooping of large buildings and infrastructure, from electrical grids to telecom hubs to internetworks to scientific networks to intellinks to satellites to space probes. The usual spy sci-fi beloved of hams.

1 0

XKeyscore produced by SAIC, runs on RHEL
by Rich Jones 02 Aug '13

02 Aug '13

http://jobs.saic.com/job/Columbia-XKEYSCORE-Systems-Engineer-Job-MD-21044/2… *Date:* Jul 19, 2013 *Location:* Columbia, MD, US XKEYSCORE Systems Engineer (Job Number:328432) *Description:* The Integrated Systems Group of SAIC has a career opening for a Tier 2 XKEYSCORE Systems Engineer, for the Mission Programs Division (MPD), located in Columbia, Maryland. JOB SUMMARY: The Systems Engineer will provide support for the compartment systems that encompass the SKIDROWE systems. The successful candidate will be a self-starter, work well in a dynamic team environment, and be very organized and detailed oriented. PRIMARY RESPONSIBILITIES: •Design and develop large-scale systems, containing multiple subsystems and requiring integration with external systems and focus on all aspects of acquisition, requirements definition, system design, development, and training. •This candidate will need to have experience in basic SIGINT technology as well as integrating, installing, configuring, changing, and optimizing HW & SW solutions into an overall system architecture. •Support SIGINT systems by performing custom configurations of fielded mission systems. •Assist the dataflow team to verify the formats of input and output data and the flow of data from front end sources and to back end destinations. •Provide Tier 2 cross function support. •Troubleshoot network and system problems and a become knowledge expert in two other components. Portions of SAIC to be renamed Leidos, Inc., subject to stockholder approval and consummation of a separation transaction if approved by SAIC board of directors. SAIC is pursuing a plan to separate into two independently traded companies;one that provides technical, engineering and enterprise information technology services primarily to the U.S. government (new SAIC), and one that delivers technical solutions in national security, engineering and health (Leidos, Inc) *Qualifications:* BASIC QUALIFICATIONS: •High School diploma or equivalent with 3- 4+ years of related experience installing, configuring, integrating, and testing software which run on Red Hat Enterprise Linux (RHEL). •Software Integration experience with scripting languages (Java, C and Bourne shell). •Familiar with VMware ESXi 3.5, 4.1, and 5.0. •Currently possess an active TS/SCI with Polygraph security clearance. ADDITIONAL PREFERRED QUALIFICATIONS: •Bachelor's degree in a relevent technical disciplne. •Ability to be mobile, work, and travel independently. •Excellent interpersonal, verbal, and written communication skills with the ability to successfully interact with internal and external customers. ===== SKIDROWE?

4 3

Re: Max Blumenthal on Security Forum (Eugen Leitl)
by OTR 01 Aug '13

01 Aug '13

First, glad to be here. Missed the cypherpunks the first time around. I'm going to want to get to know you folks for my ongoing coverage of -- and book project on -- Snowden, NSA and the surveillance-industrial revolution. Second, while it's nice (and rather unexpected) to get a shout-out from Alternet, I wouldn't agree that every other journalist at Aspen was an acolyte. Michael Isikoff did a good job of pushing his panel, especially U.S. Attorney Neil MacBride, who is Snowden's designated prosecutor (and is trying to jail James Risen to force testimony in the Sterling leak case). Pete Williams is also a terrific reporter. He met charm with charm but gently walked Keith Alexander into a corner, eliciting unambiguous statements that the NSA will have to defend as time goes on. Plus, he called on people he knew would ask tough questions. Oh, and yes, Aspen covered my travel costs. I assume it did the same for others. No speaker fee was offered or requested. On 7/30/13 12:00 PM, Eugen Leitl <eugen(a)leitl.org> wrote: Subject: Max Blumenthal on Security Forum (it's Alternet, so caveat lector) http://www.alternet.org/tea-party-and-right/shocking-extermination-fantasie… [...] With perhaps one notable exception, none of the high-flying reporters junketed to Aspen to act as interlocutors seemed terribly interested in interrogating the logic of the war on terror. The spectacle was a perfect window into the world of access journalism, with media professionals brown-nosing national security elites committed to secrecy and surveillance, avoiding overly adversarial questions but making sure to ask the requisite question about how much Snowden has caused terrorists to change their behavior. Jeff Harris, the communications director for the Aspen Institute, did not respond to questions I submitted about whether the journalists who participated in the Security Forum accepted fees. (It is likely that all relied on Aspen to at least cover lodging and travel costs). [...] "You have to do [domestic surveillance] within a closed bubble in order to do it effectively," Dennis Blair, the director of National Intelligence conceded under sustained grilling from the Washington Post's Barton Gellman, one of the reporters who broke Snowden's leaks and perhaps the only journalist at the Security Forum who subjected participants to tough scrutiny. When Gellman reminded Alexander that none of the oversight mechanisms currently in place could determine if the NSA had improperly targeted American citizens with no involvement in terror-related activity, the general declared, "we self-report those mistakes."

3 2