- cypherpunks - lists.cpunks.org

Microsoft claims to fight back against NSA
by Jim Bell 25 Jan '14

25 Jan '14

From: http://news.yahoo.com/microsoft-bold-plan-beat-nsa-053014453.html "Microsoft is tired of waiting for the United States government to rein in the National Security Agency so it’s taking matters into its own hands. The Financial Times reports that Microsoft “will allow foreign customers to have their personal data stored on servers outside the U.S.,” a move that other tech companies such as Google have so far resisted due to cost concerns. However, Microsoft’s general counsel Brad Smith tells The Financial Times that “people should have the ability to know whether their data are being subjected to the laws and access of governments in some other country and should have the ability to make an informed choice of where their data resides.” That Microsoft is willing to go this far shows how much the NSA spying scandal has damaged trust between American tech companies and their international customers. Microsoft even took the unusual step late last year of classifying the United States government as “advanced persistent threat” to its customers’ security, a designation that the company normally uses only cyber terrorists sponsored by foreign governments." --------------------------quote ends------------------------------------------------------- Jim Bell's comment begins: Well, I suppose it's desirable that such big companies talk like they're fighting back against USG/NSA, but their final 'bite' had better be far more serious and definitive than their current 'bark'. Jim Bell

2 1

request for leaks: standards for secret (not published) true hardware random number generator requirements used by NSA
by coderman 25 Jan '14

25 Jan '14

on an unrelated tangent, also curious about the secret encryption suites (better than AES/ECDSA/ECDH/SHA? or just undisclosed different?[0]) perhaps the only individual who designed and implemented thought he was working on coding for radios lugged by grunts out in fields of adventure, now long retired into obscurity forever more... been trying to buy me some blackers with bitcoin; coming up empty not even a mucked boot for my fishing function. is it so much to ask??? best regards, except to earthhumans 0. that is to say, could this be true by tweaking constants and growing key bits? AES ~= MEDLEY ECDSA ~= SHILLELAGH ECDH ~= BATON SHA ~= SAVILLE ADH ~= WALBURN TRNG ~= JOSEKI-1 bonus points for leaking to https://en.wikipedia.org/wiki/NSA_Suite_A_Cryptography via the NSA TAO Covert Network!

1 3

Re: RFP: FOIA with privacy waivers[0] for oversight
by coderman 25 Jan '14

25 Jan '14

On Thu, Nov 28, 2013 at 12:25 PM, coderman <coderman(a)gmail.com> wrote: > Request for participants > > FOIA with privacy waivers[0] ... it is in my best interest not to pursue this effort any further. the donations received for this have gone to Cryptome instead for their FOIA efforts. if you would like to pursue your own requests please do so: "Citizen's Guide on Using the Freedom of Information Act" https://www.fas.org/sgp/foia/citizen.html and DOJ_361_revised_2-certification_of_identity.pdf if making requests on behalf other individuals. freedom of information laws are important and should be supported! perhaps i can do more at a later date...

1 0

dear Eve,
by coderman 25 Jan '14

25 Jan '14

it was fun! i assume we have come to an understanding - security, like anonymity, is best as public good that floats all boats UPSTREAM (even if current reality far from vision of ideal). hopefully a good arrangement not needlessly obstructed... best regards, except to the surreptitious surveillance-ers; you're the outlier here! love, codermange --- many of the best detections for advanced attacks involved not-quite consumer hardware and customized systems for distributed storage, observation, and processing. this is way beyond the budget, skill, and time afforded even modestly technical users for most intents and purposes. however, sometimes simple measures to thwart attacks combined with a keen situational awareness can identify sophisticated attacks with less technical means. anomalies signal to attempt counter measures and initiate in depth scrutiny. --- consider the following, - baseband attack against mobile target: + cannot "hot patch" running image, as some changes take effect during initialization. force push results in restart. anomaly #0. + battery longevity one third what expected, distinct transition post-baseband-push for longevity of full charge - power consumption doesn't lie. anomaly #1. + abnormal signal power level for well known location for cell link. anomaly #2. + outbound dial attempts cannot put cell radio into lower bitrate audio call mode - outbound dial attempts fail - serious anomaly #3. (workaround of making call immediately on boot appears effective, and keeping a call in voice mode appears to thwart data exfiltation when no wifi uplink avail. + (technical but possible) pushed baseband needs to pass authentication of image; signature valid, revision same as prior mtd partition archive version, however sha digests do NOT match! this is not expected for the same build version. anomaly #4. --- consider the following, - BIOS attack with post-boot re-infection vector triggered once graphics mode transitions from console to graphical display: + target hardware is a match and supported, however, root file system is XFS, ZFS, or other unsupported *nix variant. attempt to persist by injection on file system using kernel fs funcs and data structures (this gets around FDE by interacting before luks/mdcrypt/loopaes/cryptoloop layer) thus causes kernel panic. anomaly #0. [note: A for effort++ by setting a not-again flag after first attempt. this prevents the kernel panic from becoming a persistent DoS as the next boot attempt will complete normally into graphical desktop. Subsequent reactivation follows similar fail safe of next boot succeeding after post boot persistent hook failure and kernel panic.] --- consider the following, - SMS MitM attack against Android mobile target: + normal delivery of SMS using a client such as TextSecure that checks for delivery confirmation on SMS, (do NOT use fire-and-forget like majority of text clients). attack introduces latency on confirmation due to radio mode switching between high rate exfiltation mode and low rate SMS with additional MitM proxy processing latency added as well. this results in messages initially showing "Message delivery failed" before shortly then confirming successful transmisssion. anomaly #0. + abnormal signal power level for well known location for cell link. anomaly #1.

2 2

An Open Letter from US Researchers in Cryptography and Information Security
by Alex J. Martin 25 Jan '14

25 Jan '14

# Posted to http://masssurveillance.info/ January 24, 2014 Media reports since last June have revealed that the US government conducts domestic and international surveillance on a massive scale, that it engages in deliberate and covert weakening of Internet security standards, and that it pressures US technology companies to deploy backdoors and other data-collection features. As leading members of the US cryptography and information-security research communities, we deplore these practices and urge that they be changed. Indiscriminate collection, storage, and processing of unprecedented amounts of personal information chill free speech and invite many types of abuse, ranging from mission creep to identity theft. These are not hypothetical problems; they have occurred many times in the past. Inserting backdoors, sabotaging standards, and tapping commercial data-center links provide bad actors, foreign and domestic, opportunities to exploit the resulting vulnerabilities. The value of society-wide surveillance in preventing terrorism is unclear, but the threat that such surveillance poses to privacy, democracy, and the US technology sector is readily apparent. Because transparency and public consent are at the core of our democracy, we call upon the US government to subject all mass-surveillance activities to public scrutiny and to resist the deployment of mass-surveillance programs in advance of sound technical and social controls. In finding a way forward, the five principles promulgated at http://reformgovernmentsurveillance.com/ provide a good starting point. The choice is not whether to allow the NSA to spy. The choice is between a communications infrastructure that is vulnerable to attack at its core and one that, by default, is intrinsically secure for its users. Every country, including our own, must give intelligence and law-enforcement authorities the means to pursue terrorists and criminals, but we can do so without fundamentally undermining the security that enables commerce, entertainment, personal communication, and other aspects of 21^st -century life. We urge the US government to reject society-wide surveillance and the subversion of security technology, to adopt state-of-the-art, privacy-preserving technology, and to ensure that new policies, guided by enunciated principles, support human rights, trustworthy commerce, and technical innovation. /Martín Abadi / Professor Emeritus, University of California, Santa Cruz /Hal Abelson / Professor, Massachusetts Institute of Technology /Alessandro Acquisti / Associate Professor, Carnegie Mellon University /Boaz Barak / Editorial-board member, /Journal of the ACM/^1 /Mihir Bellare / Professor, University of California, San Diego /Steven Bellovin / Professor, Columbia University /Matt Blaze/ Associate Professor, University of Pennsylvania /L. Jean Camp / Professor, Indiana University /Ran Canetti / Professor, Boston University and Tel Aviv University /Lorrie Faith Cranor / Associate Professor, Carnegie Mellon University /Cynthia Dwork / Member, US National Academy of Engineering /Joan Feigenbaum / Professor, Yale University /Edward Felten / Professor, Princeton University /Niels Ferguson / Author, /Cryptography Engineering: Design Principles and Practical Applications/ /Michael Fischer / Professor, Yale University /Bryan Ford / Assistant Professor, Yale University /Matthew Franklin / Professor, University of California, Davis /Juan Garay / Program Committee Co-Chair, CRYPTO^2 2014 /Matthew Green/ Assistant Research Professor, Johns Hopkins University /Shai Halevi / Director, International Association for Cryptologic Research /Somesh Jha / Professor, University of Wisconsin -- Madison /Ari Juels / Program Committee Co-Chair, 2013 ACM Cloud-Computing Security Workshop^1 /M. Frans Kaashoek / Professor, Massachusetts Institute of Technology /Hugo Krawczyk / Fellow, International Association for Cryptologic Research /Susan Landau / Author, /Surveillance or Security? The Risks Posed by New Wiretapping Technologies/ /Wenke Lee / Professor, Georgia Institute of Technology /Anna Lysyanskaya / Professor, Brown University /Tal Malkin / Associate Professor, Columbia University /David Mazières / Associate Professor, Stanford University /Kevin McCurley / Fellow, International Association for Cryptologic Research /Patrick McDaniel / Professor, The Pennsylvania State University /Daniele Micciancio / Professor, University of California, San Diego /Andrew Myers / Professor, Cornell University /Rafael Pass/ Associate Professor, Cornell University /Vern Paxson / Professor, University of California, Berkeley /Jon Peha / Professor, Carnegie Mellon University /Thomas Ristenpart / Assistant Professor, University of Wisconsin -- Madison /Ronald Rivest / Professor, Massachusetts Institute of Technology /Phillip Rogaway / Professor, University of California, Davis /Greg Rose / Officer, International Association for Cryptologic Research /Amit Sahai / Professor, University of California, Los Angeles /Bruce Schneier / Fellow, Berkman Center for Internet and Society, Harvard Law School /Hovav Shacham / Associate Professor, University of California, San Diego /Abhi Shelat / Associate Professor, University of Virginia /Thomas Shrimpton / Associate Professor, Portland State University /Avi Silberschatz / Professor, Yale University /Adam Smith / Associate Professor, The Pennsylvania State University /Dawn Song / Associate Professor, University of California, Berkeley /Gene Tsudik / Professor, University of California, Irvine /Salil Vadhan / Professor, Harvard University /Rebecca Wright / Professor, Rutgers University /Moti Yung / Fellow, Association for Computing Machinery^1 /Nickolai Zeldovich / Associate Professor, Massachusetts Institute of Technology ------------------------------------------------------------------------ This letter can be found at: http://MassSurveillance.info Institutional affiliations for identification purposes only. This letter represents the views of the signatories, not necessarily those of their employers or other organizations with which they are affiliated. ^1 The Association for Computing Machinery (ACM) is the premier organization of computing professionals. ^2 CRYPTO is an annual research conference sponsored by the International Association for Cryptologic Research.

1 0

BurnerPhone
by Rich Jones 25 Jan '14

25 Jan '14

https://www.burnerphone.us/ Anonymous burners for 75$ in BTC. Sweet. http://blog.burnerphone.us/ "Right now, we sell a single item: a Burner Kit, which: - Comes with a new quality disposable GSM cell phone. - Comes with a pre-installed 30 day SIM card that provides you with unlimited US calling and unlimited international SMS. - Comes with a pre-charged phone battery ready for usage when it arrives. - Comes with on demand 2-minute activation. You can *activate* your Burner when you *need* it — this way you can hold onto it until necessary, then activate it and start your 30 days of usage. - Comes with nationwide coverage in the USA — no matter where you are on our nationwide GSM network, you’ll have service. - Can be bought with Bitcoin or Bank Card for 75$. - Can be thrown away (or recycled) when you’re finished with it — making it *extremely difficult* for third parties monitoring your communications to figure out *who you are* or *where you are*." Run by the wonderful @rdegges <https://github.com/rdegges>. Could be old news, but I just found out about it and thought I'd share.. R

3 3

SO... APPARENTLY THEY DECIDED TO TAKE THE INTERNET
by Cari Machet 24 Jan '14

24 Jan '14

https://www.ourinternet.org/#commission -- Cari Machet NYC 646-436-7795 carimachet(a)gmail.com AIM carismachet Syria +963-099 277 3243 Amman +962 077 636 9407 Berlin +49 152 11779219 Twitter: @carimachet <https://twitter.com/carimachet> Ruh-roh, this is now necessary: This email is intended only for the addressee(s) and may contain confidential information. If you are not the intended recipient, you are hereby notified that any use of this information, dissemination, distribution, or copying of this email without permission is strictly prohibited.

2 2

Re: [dsfjdssdfsd] Any plans for drafts or discussions on here? (fwd)
by J.A. Terranson 24 Jan '14

24 Jan '14

Interesting thread going on at dsfjdssdfsd(a)ietf.org. Forwarded for our collective interest and amusement. //Alif -- Those who make peaceful change impossible, make violent revolution inevitable. An American Spring is coming: one way or another. ---------- Forwarded message ---------- Date: Thu, 23 Jan 2014 23:38:07 +0100 From: Krisztián Pintér <pinterkr(a)gmail.com> To: Michael Hammer <michael.hammer(a)yaanatech.com> Cc: "dsfjdssdfsd(a)ietf.org" <dsfjdssdfsd(a)ietf.org>, "ietf(a)hosed.org" <ietf(a)hosed.org> Subject: Re: [dsfjdssdfsd] Any plans for drafts or discussions on here? Michael Hammer (at Thursday, January 23, 2014, 9:49:32 PM): > This may get off-topic, but are there good software tools for testing > entropy, > that could help applications determine if the underlying system is giving > them good input? disclaimer: i'm no expert, it is just what i gathered. (i'm pretty much interested in randomness.) short answer: no long answer: in some situations yes. if you are handed a bunch of data, all you can do is to try different techniques to put an upper limit on the entropy. for example you can calculate the shannon entropy assuming independent bits. then you can hypothesize some interdependence, and see if you can compress the data. you can apply different lossless compression methods. the better compression you find puts an upper limit on the entropy. but never a lower limit. you can only do better if you have an idea about the process that created the data. for example you might assume that it is mostly thermal noise. you can assume that thermal noise has some frequency distribution, or energy or whatever, etc. within this assumption, you can determine the entropy content by measurements. but at this point, you are pretty much prone to two errors: 1, what if your assumption is wrong and 2, what if your physical model overestimates the unpredictability of the given system. example for the former: the signal might be largely controllable by an external EM interference, and then you measure not noise, but attacker controlled data. example for the latter: a smartass scientist might come up with a better physical model for thermal noise. it is also important to note that entropy is observer dependent. we actually talk about the entropy as seen by the attacker. but it is not straightforward to assess what is actually visible to an attacker and what is not. observation methods improve with time. _______________________________________________ dsfjdssdfsd mailing list dsfjdssdfsd(a)ietf.org https://www.ietf.org/mailman/listinfo/dsfjdssdfsd

3 2

Re: [dsfjdssdfsd] software tools for testing entropy (was: Any plans for drafts or discussions on here?) (fwd)
by J.A. Terranson 24 Jan '14

24 Jan '14

The thread continues... //Alif -- Those who make peaceful change impossible, make violent revolution inevitable. An American Spring is coming: one way or another. ---------- Forwarded message ---------- Date: Thu, 23 Jan 2014 16:32:25 -0800 From: =JeffH <Jeff.Hodges(a)KingsMountain.com> To: IETF Pseudorandom Number Generator PRNG discussion list <dsfjdssdfsd(a)ietf.org> Subject: Re: [dsfjdssdfsd] software tools for testing entropy (was: Any plans for drafts or discussions on here?) > are there good software tools for testing entropy, that could help > applications determine if the underlying system is giving them good > input? well, from.. [0] Akram, Raja Naeem, Konstantinos Markantonakis, and Keith Mayes. "Pseudorandom Number Generation in Smart Cards: An Implementation, Performance and Randomness Analysis." New Technologies, Mobility and Security (NTMS), 2012 5th International Conference on. IEEE, 2012. http://digirep.rhul.ac.uk/file/315c7a7e-4963-4a62-189f-4ad198a79f30/5/Paper… ..there's the sections reproduced at [1] below which may (or may not) be helpful. also, NIST has these resources.. NIST SP 800-22: A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Application. http://csrc.nist.gov/publications/nistpubs/800-22-rev1a/SP800-22rev1a.pdf Random Number Generators (RNG) Testing Requirements: http://csrc.nist.gov/groups/STM/cavp/index.html#04 RNG Test Vectors http://csrc.nist.gov/groups/STM/cavp/documents/rng/rngtestvectors.zip One could also ask the authors of [0] if they might share their impl. hth, =JeffH [1] E. Experimental Proof To provide experimental proof, the NIST statistical test suite was applied. Each algorithm was provided with a common seed file, and generated sequences from it were saved in a binary file. This binary file was used as input to the statistical test. Point to note here is that seed files given to all algorithms were the same. The reason for doing so was to analyse differences in the quality of output while using the same entropy source. For statistical analysis, each algorithm was executed to generate 1,048,578 pseudorandom sequences of 128 bits. Concatenating the outputs into a binary file that was then used for NIST SP 800-22 statistical analysis. The results of each algorithm are listed in Appendix A. Taking into account the Common Criteria AIS 20 [18], our implementation fulfils the requirements for the K4 DRNG. Below is the discussion on how our implementation satisfies these requirements. 1) K1 DRNG: Its a simple requirement that states that if the generated values is of set C =f c1, c2, c3, .., cm g then all members of the set should be distinct regardless of the statistical properties. 2) K2 DRNG: Requires that the implementation should satisfy the statistical properties such as monobit test, poker test and tests on runs. Our implementations were subjected to the NIST SP 800-22 test suite. 3) K3 DRNG: This requires that the entropy of the PRNG is at least 80. All SHA based algorithms has 440 bits seed and block cipher based algorithms has 128 bits seed. All of the seed values were chosen from an external high entropy source that is carefully tested. 4) K4 DRNG: This level requires that the PRNG should be forward-secure. A PRNG is forward-secure if after n iteration of the PRNG, a malicious user is unable to guess the internal state of the generator. The implemented PRNG feed back to the internal seed that is changing in each of the iterations. Furthermore, block cipher based implementation of the PRNG use different key in each of the iterations. Even retrieving a cryptographic key would not help a malicious user to successfully know the entire state of the seed file. In our implementations we tested SHA and block cipher based algorithms for the PRNGs. In general block cipher based algorithms, only a single key is used for the entire lifetime of the generator. However, we have tested that a PRNG could be modified to use a new key on each execution of the generator. The internal key generation mechanism of the block cipher based PRNG implementations are light weight and they do not hamper the overall performance of the generator. Therefore, it could be argued that it provides a more secure block cipher based PRNG then an PRNG that only uses a single key for entire lifetime. Table IV details the percentage of passing sequences pro duced by individual algorithms. As it is evident from table III and IV, there is not a big difference between the implemented algorithms both in terms of performance and percentage of sequence passing the NIST statistical tests. Of particular note, if we take the accumulated average of the passing sequences percentage in the table IV an interesting result emerges. The SHA-1 performs comparative better than other algorithms and AES based PRNG has the least accumulated average of passing sequence as illustrated in figure 4. This measure represents the randomness of the generated sequences - not the security of the algorithm. If we also account for the performance, SHA based algorithms perform better than the encryption based algorithms (e.g. DES and AES). V. CONCLUSION AND FUTURE RESEARCH DIRECTIONS ... Our research into the possibility of using a test suite like NIST SP 800-SP to check pseudorandom number generators in smart cards has showed that it is a workable concept. The tests listed in the NIST SP 800-22 are substantially more then the one recommended for the smart card pseudorandom number generators in AIS20 [18] and AIS31 [13]. This research has demonstrated that even with limited resources and an entropy constrained environment like a smart card, good quality pseudorandom sequences can be generated that can satisfy all the requirements for a PRNG even the ones that are used for general purpose computers. ... --- end _______________________________________________ dsfjdssdfsd mailing list dsfjdssdfsd(a)ietf.org https://www.ietf.org/mailman/listinfo/dsfjdssdfsd

1 0

Internet/cell phones blocked in Eastern Ukraine?
by rysiek 24 Jan '14

24 Jan '14

Hi there, I just got wind that Internet and cell phones are being blocked/disabled in Eastern Ukraine. Can anybody confirm this in any way? -- Pozdr rysiek

7 9