- cypherpunks - lists.cpunks.org

trends in cybersecurity
by dan＠geer.org 03 Dec '13

03 Dec '13

Given last month as keynote to the National Reconnaissance Office's planning conference. Trends in Cyber Security http://geer.tinho.net/geer.nro.6xi13.txt Respectfully, --dan

2 1

ntru-crypto - Open Source NTRU Public Key Cryptography Algorithm and Reference Code
by coderman 03 Dec '13

03 Dec '13

https://github.com/NTRUOpenSourceProject/ntru-crypto """ Security Innovation, Inc., the owner of the NTRU public key cryptography system, made the intellectual property and a sample implementation available under the Gnu Public License (GPL) in 2013 with the goal of enabling more widespread adoption of this superior cryptographic technology. The system is also available for commercial use under the terms of the Security Innovation Commercial License. NTRU represents a significant improvement in the Public Key cryptography world—it’s faster, stronger and smaller than virtually any other system in use and it’s quantum computer resistant, making it the best choice for current projects with lifetimes that extend into the post quantum computer age.... NTRU is a lattice-based public key cryptosystem from Security Innovation and the leading alternative to RSA and Elliptic Curve Cryptography (ECC) due to its higher performance and resistance to attacks from quantum computers. NTRU was developed in 1996 as a visionary solution to cyber security challenges for the twenty-first century. NTRU is based on a mathematical problem called the “Approximate close lattice vector problem” and comprises three algorithms: NTRUEncrypt, NTRUSign, and PASSSign. It has been reviewed and published in scholarly journals and presented at Crypto, Eurocrypt, and RSA, and has been adopted in IEEE and X9 standards Because it is based on different math from RSA and ECC, the NTRU algorithm has different cryptographic properties. At comparable cryptographic strength, NTRU performs costly private key operations much faster than RSA or ECC. In addition, NTRU's comparative performance increases with the level of security required. As key sizes increase by a factor of n, RSA's operations/second decrease by about n3 whereas NTRU's decrease at n2. """

4 4

Re: bitcoin as a global medium of exchange (was Re: Interesting take on Sanjuro's Assassination Market)
by Bill Stewart 03 Dec '13

03 Dec '13

At 05:43 PM 11/25/2013, David Vorick wrote: >Bitcoin has a lot of problems. >Andy, the problem isn't the denomination, the problem is that >Satioshi has 5% of all the currency, and the Winklevoss twins have >another 0.5%. If bitcoin becomes worth 100 trillion dollars, they've >got a solid 500 billion for being nobody and doing nothing. That's a >problem to me. Satoshi gave us the technology and got people to start using it. If he gets fabulously wealthy by owning 5% of it, I'm not jealous (well, ok, a bit jealous, but I'm not going to contend that he shouldn't have it just because of jealously.) The Winklevossen are just speculators; I don't particularly like using a currency whose value is mostly from speculation, but experimentation is a critical part of rolling out something like a new type of currency, so whatever. At least they pumped some cash into the system early on. And that guy in Norway who was an early experimenter, then kind of forgot about his bitcoins until he suddenly noticed they were worth $800K? Cool, good for him! It wouldn't be surprising if the first people to do GPU-based mining also got a large pile of bitcoins compared to the CPU-based miners. >I'm working on one right now. It's not built but the idea is to use >proof-of-contribution instead of proof-of-work, where contribution >is disk storage contributed to a distributed network. I think "proof of useful contribution" is a much better thing than "proof of wasted electricity"; good luck getting it off the ground. I'd recommend reading all of Zooko's Tahoe-LAFS work for getting some ideas about privacy and reliability issues, both of which are harder than they look. The other catch is that storage costs do keep decreasing, and storage in a cloud is always a lot slower than local storage, so you'll have to think hard about business models. One of the cool things Bitcoin did was created a way to have the proof-of-work turn into currency without needing a banker in the middle; that means that users and miners don't have to worry (much) about the creator absconding with the value or being shut down, and there's built-in protection against hyperinflation, unlike some of the dotcom silly currencies like Beenz and Flooz that appeared and vanished along with the dogfood-on-line dotcoms. It's been interesting to watch Bitcoin's value surviving after the loss of the Silk Road site (which got around the "Nothing To Buy With It" hurdle that helped kill the original Chaumian Digicash.)

11 20

NSA: The Game
by Peter Gutmann 02 Dec '13

02 Dec '13

For those of you familiar with the game Werewolf (also known as Mafia), here's an updated version, NSA. Peter. -- Snip -- NSA === Peter Gutmann, 11 November 2013. Adapted from a Werewolf writeup found on Zarfhome. http://www.cs.auckland.ac.nz/~pgut001/pubs/nsa_werewolf.txt NSA is a simple game for a largeish group of people, ten or more is best. It requires no equipment apart from some playing cards, or even just bits of paper. You can play it by simply sitting in a circle, but sitting around a table works better (there's room for drinks and snacks). Setting Up Make up a set of cards, one for each player, with a role on each one: Two NSA agents (Werewolves in the original) One Edward Snowden (Seer in the original) One EFF member (Healer in the original) All the rest are Internet users (Villagers in the original) The cards can be anything from fancy custom ones with the NSA logo and other graphics representing the players' roles, through to a convenient pack of Dora the Explorer cards with N, S, and E scrawled on a few of them. In addition to the players there's a moderator who runs things. The moderator shuffles the cards and hands them out, face down. Each player should look at their card without revealing it to anyone else. If there are more than about 15 players then the number of NSA agents, Snowdens, and EFF members can be increased. Two players are secretly NSA agents. They are trying to apply extraordinary rendition to all of the Internet users. Everyone else is an innocent Internet user, but one of the Internet users, Snowden, secretly has inside access to classified information and can detect the presence of NSA agents. In addition another Internet user is an EFF member and can protect one player per turn from the NSA's extraordinary rendition. The Game: Night and Day The game begins with each player introducing themselves. The standard formula for this is "Hi, my name is <insert name here> and I'm an innocent Internet user". This can be embellished as required with additional comments. Once everyone has been introduced, the game proceeds in alternating night and day phases, beginning with night. At night, the moderator tells all of the players "Night has fallen, close your eyes". The moderator then says "NSA, open your eyes". The two NSA agents do so, and look around to recognize each other. The moderator should also note who the NSA agents are. The moderator says "NSA agents, pick someone to render". The two NSA agents silently agree on one Internet user to subject to extraordinary rendition. It's important that they remain silent while doing this, pointing at the victim works best. When the NSA have agreed on a victim and the moderator understands who they picked, the moderator says "NSA agents, close your eyes". The moderator says "Snowden, open your eyes. Snowden, pick someone to check". Snowden opens his eyes and points at another player (as for the NSA agents, this has to be silent). The moderator signs thumbs-up (or some similar yes- gesture) if Snowden pointed at an NSA agent, and shakes their head (or some similar no-gesture) if the Snowden pointed at an innocent Internet user. The moderator then says "Snowden, close your eyes". Finally, the moderator says "EFF member, open your eyes. EFF member, pick someone to protect". The EFF member opens his/her eyes and, as with the others, points at another player. The moderator then says "EFF member, close your eyes". In the initial rounds its best if the EFF member protects themselves. If and when Snowden identifies himself, the EFF member should protect Snowden in order to prevent him from being subject to extraordinary rendition by the NSA. The moderator says "Everybody open your eyes. It's daytime, and <insert victim name> has been subject to extraordinary rendition". The named person is immediately out of the game, and typically leaves the table or circle so that only active players remain. He or she can't say anything involving the game beyond this point, but would typically sit at the periphery and watch the game continue. Now it's daytime. All of the remaining players decide who to lynch as a suspected NSA agent. Anyone can say anything they want. NSA agents can claim to be Edward Snowden and "unmask" NSA agents who are actually innocent Internet users. Players can privately whisper things to other players (for example claiming to be Snowden, or the EFF member), or secretly pass notes. Any excuse to lynch someone is valid, for example because they have a beard, because they're Australian, or because they took the last potato chip. The real Edward Snowden should remain silent until they've identified at least one NSA agent, since they'll be an immediate target for extraordinary rendition if they reveal themselves too early. Similarly, the EFF member shouldn't reveal their identity unless absolutely necessary, since they need to protect Snowden without being themselves rendered by the NSA. Once a majority of players vote for a particular player to die (the player can be allowed to defend themselves, for example by claiming that "we, too, are Internet users", leading to further votes), the moderator says "<insert-name> has been lynched as a suspected NSA agent and is now dead". The player leaves the game in the same way as those subject to extraordinary rendition. If the players take too long to decide, the moderator can hint that night is about to fall, and if they still dither, night will fall without anyone being lynched. At this point the cycle repeats. Everyone closes their eyes, the NSA agent(s) select another person to subject to extraordinary rendition, Snowden (if alive) learns another player's identity, and the EFF member (if alive) protects another player. The sun rises, one player is rendered (unless protected by the EFF member), and the remaining players discuss another lynching. Repeat until one side wins. Winning The Internet users win if they kill all of the NSA agents. The NSA agents win if they render enough Internet users that the numbers of Internet users and NSA agents are even. In other words they win if the NSA agents constitute a large enough voting bloc that they can't be lynched any more. At that point the NSA can unmask and openly subject the remaining Internet users to extraordinary rendition. Notes When everyone closes their eyes at night, it's best for people to make some sort of noise, typically tapping the table. This will cover up any accidental sounds that are made by the NSA agents, Snowden, the EFF member, or the moderator. Once a player is lynched or rendered, there are two options on what to do with their cards, show or no-show. The show option is easiest, particularly for the initial games. With this option the player reveals their card, so that the other players know what sort of person has been eliminated. The no-show option is harder but a lot more fun. With this option the player doesn't reveal their card, so that the other players have no idea who's still left in the game.

3 2

Re: NSA: The Game
by Pokokohua 02 Dec '13

02 Dec '13

Would it work swapping renditions for drone strikes as an option? > For those of you familiar with the game Werewolf (also known as Mafia), > here's an updated version, NSA. > Peter.

2 1

DEF CON cell network attacks
by coderman 02 Dec '13

02 Dec '13

On Sat, Nov 30, 2013 at 10:18 AM, Dan Staples <danstaples(a)disman.tl> wrote: > I would be interested to see the details of the exploits you > witnessed/were subject to (especially since I was at DC20). of course; the complete details will be slow to arrive, not least because detailed description requires a demonstration in a reproduction test setup, rather than reporting of actual traffic. :/ that said, useful aspects i'll certainly provide on whim or request. the defining characteristics of the two types of attacks: DC19 with DRT: - "high power on-site", less descriminant attacks. target by and limited to location. - MitM for system, application, and protocol level attacks. Evilgrade, MasterKey vulns, etc. mostly known and a few 0day escalated attacks. - favorite attack: "Google Voice Search" always-on eavesdropper payload; Speex voice from all audible participants. DC20 with Alexander's toys: - "in the towers", highly targeted to specific devices, active over wide metro area. - baseband exploit vector for device key retrieval, memory and storage forensics, exfiltration. - PDoS attacks (bricked secondary devices used as fall back once identified by call graph; ~20 hours) - favorite attack: baseband pwn in airplane mode, with ex-filtration over custom channel. DC21: no appearance (observed). speculation ongoing... > How exactly > did you determine how the exploits occurred, and who was responsible for > them? reversing attacker capabilities, toolkits, TTPs, humanpower/hours, a much longer tangent. but this assertion is based on correlation of the observed power, capacity, and protocols in specific bands implemented by the attacker with the capabilities of the DRT system. multiple locations, terabytes of captured spectrum, patience and tuning... as for who was operating it - unknown beyond the usual suspects, which is a small set due to the restricted distribution of both the hardware platform and the exploit kit atop it :) --- i'll send more details once available. the details and distribution to be part of a separate FOIPA effort for US citizen security enthusiasts that might be of interest to those following this thread. best regards,

1 0

Interesting take on Sanjuro's Assassination Market
by Jim Bell 30 Nov '13

30 Nov '13

http://www.phibetaiota.net/2013/11/owl-assassination-market-website-are-the… Disclaimer: I am not associated with 'Sanjuro's "Assassination Market" in any way.

22 55

Youtube item on "Assassination market"
by Jim Bell 30 Nov '13

30 Nov '13

I found this on Youtube.com. http://www.youtube.com/watch?v=xbGypiDik2E (Disclaimer: I am not associated with 'Sanjuro's "Assassination Market" in any way. I do not know who he is.) Jim Bell

3 3

Re: DEF CON 19 - hackers get hacked!
by coderman 30 Nov '13

30 Nov '13

On Thu, Aug 11, 2011 at 4:14 AM, coderman <coderman(a)gmail.com> wrote: > ... > seriously EOM this time. well, what do you know, sunlight prevails! ;) http://electrospaces.blogspot.com/2013/11/drtbox-and-drt-surveillance-syste… ... this is but a feeling; one aspect of the whole.[0] 0. "Blind men and an elephant" https://en.wikipedia.org/wiki/Blind_men_and_an_elephant

4 5

Re: Interesting take on Sanjuro's Assassination Market
by brian carroll 30 Nov '13

30 Nov '13

On Fri, Nov 29, 2013 at 7:55 PM, Bill St. Clair wrote: > I'd like 50% of MY taxes to be paid to me. And 50% of the remaining half, etc. yeah. the problem with calculation as reasoning is if the equations are not accurate or correct the 'answers' obtained via processing can be too easy or simple for the actual situation involved. this is the problem of language itself, seemingly, absence of connection with logic, accountability for actual versus perceived truth, shared and unshared observations, competing relativism in the literal, whereby local calculation-like determinist viewpoints compete without all variables taken into account to get "answers". societal-wide, civilizational pandemic. for instance, assuming *taxes* are a yearly issue taken out of payroll only, and not a national debt burden (is this $500,000 per citizen, when will everyone be a millionaire in reverse, via debt owed?) the economy is not sane in terms of "economics" and yet taxes are viewed locally as if a pure action that indebted to the absolute fucked-up-ness of things, then used against individuals who pay less or whatever, to justify a certain viewpoint when its not this simple, yet entire groups view it this way as an ideology which is self-beneficial to share values or functioning. instead, it is normal for the tax pious to take vengeance against others immoral for not carrying their own weight, when the entire system is leveraging a certain class against others, forcing lives into ruin, to sustain the given economy, then moralizing on top of this as a conceit, of superior virtue, for those fictionally supporting others in conditions and circumstances of privilege if not duplicity and criminality, social darwinism survival-of-the-fittest the masturbatory fantasia of those fat-brained and ill-conceived, nannied by television sets, sporting events, and retirement pension plans, for their better-than-thou thinking, not noticing their boots on the necks of many below, living off their structural misery, last of a generation of assholes able to do this unless extending this fiction into the present, those able to have sustainable living temporarily within a completely corrupt and bankrupt system and society, and acting as if this is normal, on the level, and not based entirely on bullshit and lies. it is to assume the monetary system and taxes are something pure, as if the gold standard today is not based in SHIT itself, junk economy and throwaway culture and planned obsolescence, ripping people off normalized, and then complaining because people need money for shelter and food to just keep breathing, versus someone having five television sets and three cars and two homes or just alot of stuff while others cannot even get past a state of continual debt and are forced out of the economy for the good of these bastard others who then look down on those they are standing on, spitting at, and viewing as a lower form of life- because money. really, people actually think the monetary system and tax system is going to be altered via a change in policy and a new system enacted, and that is how a new way of taxes will be transitioned. that this current fiction is going to peacibly be transformed into something else, everyone holding hands singing kumbaya around a campfire, -or- will it include the beginning of armageddon, separation of peoples into those who are friends and enemies, and then within the friendly-set, making these changes while 9/10th of the population is liquidated via war, for starters. what if the more realistic tax-improvement scenario. what the more accurate scenario, modifying the existing system or starting over, when taking everything that needs to be taken into account into account to actually be able to deal with the involved issues. it seems this very language prevents that modeling from occurring, it is to be trapped within a realm of words divisible, perspective unto perspective, never able to integrate all views into a single correct viewpoint, removed of error, and thus every warp and skew exchanged as normal and legitimate when it is not a default condition, absolute correspondence between belief and conveyance and yet this communication medium makes it appear so as an illusion, as if saying (signs) is truth itself versus its being referenced from this condition. and the truth of taxation is far more than a dollar number or how it is allocated individual to individual, yet this is commonplace and typical of its politics, as if people can vet out "justice" via monetary-based ideology as a value and moral system, 'truth itself', objective (A=A) because it is number-based, and yet it is monopoly money, game money, a fiction at the level of its purpose and the concept of economy itself. at the very least is incredibly dirty money, filthy, and thus to rationalize a moral superiority based upon it as a perspective, which many do as if highest truth, is a realm of the base for those who believe this, and only this, as their value system. it really captures the situation perfectly also in terms of the state subsidizing itself, basically it is at the point where the state is taxing itself, which is totally insane. people on welfare are being blamed for being so poor as to not have enough to pay taxes, and looked at as cheaters alone. taxing welfare that is not even enough for subsistence in the existing quasi ~political-economy. such issues are detached from a larger, more grounded reality that involves structural issues relied upon for bullshit viewpoints and too-simple frameworks, using inaccurate ideas as if a cudgel to attack others in these situations. in this way, ignorance is a way for 'might makes right' when a large group believes this ideology and then acts against others, as if a moral police, yet at its core it serves first and foremost a state of shit. rationalization and extension of bad ideas and inaccurate thinking, like the economy itself, allowed to inflate and granted power. it is a bubble alright. including the fat in peoples heads bubbling over as if insight when making and repeating idiotic calculations born of ideology, mantra, dogma of oppressors. they cannot be reasoned with either. which is perhaps why weapons were invented. hell, the state itself is being run by these same people today. all they care about is money, minus the truth it was to represent as shared value, now devoid within currency, the basis for the extortative ripoff via currency, the expropriation of work (via labor transmuted into currency) then siphoned and hoarded via onesided exchange, where most value flows uphill and is stored or used for corporate citizens in their corporate democracy (yes, democracy exists, just for corporate citizens not humans who are basically slaves). the very use of money is an unequal exchange, it is A=B exchange, it is not a shared truth that is being transferred, it is an institutionalized ripoff that has become standardized, normalized, yet made beyond contestation due to enforced illiteracy, the TAXATION moralizers the holier-than-thou choir, though fundamentally, foundationally basing these views in utter and absolute bullshit of the state.

1 1