- cypherpunks - lists.cpunks.org

Fwd: [Cryptography] GCHQ's plan to backdoor encrypted phone calls
by Ben Mezger 20 Jan '16

20 Jan '16

-------- Forwarded Message -------- Subject: [Cryptography] GCHQ's plan to backdoor encrypted phone calls Date: Tue, 19 Jan 2016 19:03:25 -0800 From: Henry Baker <hbaker1(a)pipeline.com> To: cryptography(a)metzdowd.com FYI -- The whole article is too long to reproduce here; follow the link to read the whole article. https://www.benthamsgaze.org/2016/01/19/insecure-by-design-protocols-for-en… Insecure by design: protocols for encrypted phone calls The MIKEY-SAKKE protocol is being promoted by the UK government as a better way to secure phone calls. The reality is that MIKEY-SAKKE is designed to offer minimal security while allowing undetectable mass surveillance, through the introduction a backdoor based around mandatory key-escrow. This weakness has implications which go further than just the security of phone calls. The current state of security for phone calls leaves a lot to be desired. Land-line calls are almost entirely unencrypted, and cellphone calls are also unencrypted except for the radio link between the handset and the phone network. While the latest cryptography standards for cellphones (3G and 4G) are reasonably strong it is possible to force a phone to fall back to older standards with easy-to-break cryptography, if any. The vast majority of phones will not reveal to their user whether such an attack is under way. The only reason that eavesdropping on land-line calls is not commonplace is that getting access to the closed phone networks is not as easy compared to the more open Internet, and cellphone cryptography designers relied on the equipment necessary to intercept the radio link being only affordable by well-funded government intelligence agencies, and not by criminals or for corporate espionage. That might have been true in the past but it certainly no longer the case with the necessary equipment now available for $1,500. Governments, companies and individuals are increasingly looking for better security. A second driver for better phone call encryption is the convergence of Internet and phone networks. The LTE (Long-Term Evolution) 4G cellphone standard carries voice calls over IP packets, and desktop phones in companies are increasingly carrying voice over IP (VoIP) too. Because voice calls may travel over the Internet, whatever security was offered by the closed phone networks is gone and so other security mechanisms are needed. Like Internet data encryption, voice encryption can broadly be categorised as either link encryption, where each intermediary may encrypt data before passing it onto the next, or end-to-end encryption, where communications are encrypted such that only the legitimate end-points can have access to the unencrypted communication. End-to-end encryption is preferable for security because it avoids intermediaries being able to eavesdrop on communications and gives the end-points assurance that communications will indeed be encrypted all the way to their other communication partner. Current cellphone encryption standards are link encryption: the phone encrypts calls between it and the phone network using cryptographic keys stored on the Subscriber Identity Module (SIM). Within the phone network, encryption may also be present but the network provider still has access to unencrypted data, so even ignoring the vulnerability to fall-back attacks on the radio link, the network providers and their suppliers are weak points that are tempting for attackers to compromise. Recent examples of such attacks include the compromise of the phone networks of Vodafone in Greece (2004) and Belgacom in Belgium (2012), and the SIM card supplier Gemalto in France (2010). The identity of the Vodafone Greece hacker remains unknown (though the NSA is suspected) but the attacks against Belgacom and Gemalto were carried out by the UK signals intelligence agency -- GCHQ -- and only publicly revealed from the Snowden leaks, so it is quite possible there are others attacks which remain h idden. Email is typically only secured by link encryption, if at all, with HTTPS encrypting access to most webmail and Transport Layer Security (TLS) sometimes encrypting other communication protocols that carry email (SMTP, IMAP and POP). Again, the fact that intermediaries have access to plaintext creates a vulnerability, as demonstrated by the 2009 hack of Google's Gmail likely originating from China. End-to-end email encryption is possible using the OpenPGP or S/MIME protocols but their use is not common, primarily due to their poor usability, which in turn is at least partially a result of having to stay compatible with older insecure email standards. In contrast, instant messaging applications had more opportunity to start with a clean-slate and so this is where much innovation in terms of end-to-end security has taken place. Secure voice communication however has had less attention than instant messaging so in the remainder of the article we shall examine what should be expected of a secure voice communication system, and in particular see how one of the latest and up-coming protocols, MIKEY-SAKKE, which comes with UK government backing, meets these criteria. MIKEY-SAKKE and Secure Chorus MIKEY-SAKKE is the security protocol behind the Secure Chorus voice (and also video) encryption standard, commissioned and designed by GCHQ through their information security arm, CESG. GCHQ have announced that they will only certify voice encryption products through their Commercial Product Assurance (CPA) security evaluation scheme if the product implements MIKEY-SAKKE and Secure Chorus. As a result, MIKEY-SAKKE has a monopoly over the vast majority of classified UK government voice communication and so companies developing secure voice communication systems must implement it in order to gain access to this market. GCHQ can also set requirements of what products are used in the public sector and as well as for companies operating critical national infrastructure. ............. Conclusions and future work The design of MIKEY-SAKKE is motivated by the desire to allow undetectable and unauditable mass surveillance, which may be a requirement in exceptional scenarios such as within government departments processing classified information. However, in the vast majority of cases the properties that MIKEY-SAKKE offers are actively harmful for security. It creates a vulnerable single point of failure, which would require huge effort, skill and cost to secure -- requiring resource beyond the capability of most companies. Better options for voice encryption exist today, though they are not perfect either. In particular, more work is needed on providing scalable and usable protection against man-in-the-middle attacks, and protection of metadata for contact discovery and calls. More broadly, designers of protocols and systems need to appreciate the ethical consequences of their actions in terms of the political and power structures which naturally follow from their use. MIKEY-SAKKE is the lat est example to raise questions over the policy of many governments, including the UK, to put intelligence agencies in charge of protecting companies and individuals from spying, given the conflict of interest it creates. Update 2016-01-19: Fix broken links to GCHQ website, note that master key must be permanently available though not necessarily directly connected to the Internet, and mention suspicions that the NSA were involved in the Vodafone Greece compromise. The photograph above this article is of a AT&T TSD-3600E Telephone Security Device based around the Clipper key-escrow chip (© Matt Blaze). An edited version of this article will appear in the March 2016 special edition of IEEE Computer Magazine: Communications and Privacy under Surveillance. CC BY-ND 4.0 Insecure by design: protocols for encrypted phone calls by Steven J. Murdoch is licensed under a Creative Commons Attribution-NoDerivatives 4.0 International License. Published by Steven J. Murdoch Dr Steven J. Murdoch is a Royal Society University Research Fellow in the Information Security Research Group of University College London, working on developing metrics for security and privacy. His research interests include authentication/passwords, banking security, anonymous communications, censorship resistance and covert channels. He has worked with the OpenNet Initiative, investigating Internet censorship, and for the Tor Project, on improving the security and usability of the Tor anonymity system. His current research on developing methods to understand complex system security is supported by the Royal Society. He is also working on analysing the security of banking systems, especially Chip & PIN/EMV, and is Innovation Security Architect of Cronto, an online authentication technology provider and part of the VASCO group. _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

1 0

effective and fully decentralized means we're all Fort Knox [was: Cryptsy theft->bankruptcy]
by coderman 20 Jan '16

20 Jan '16

On 1/19/16, dan(a)geer.org <dan(a)geer.org> wrote: > ... > Bitcoin Heist Steals Millions from Exchange full decentralization a double edged sword, for sure. if we're all sovreign bankers and multi-national producers, perhaps Snowden threat model not so outlandish? first disable passive Eve, then deny Mallory her middle, finally defend the edges from Black Burglary... sounds trivial! ;) best regards,

1 0

Fwd: [Cryptography] A possible alternative to TOR and PrivaTegrity without backdoors
by grarpamp 20 Jan '16

20 Jan '16

---------- Forwarded message ---------- From: Bill Cox <waywardgeek(a)gmail.com> Date: Sun, Jan 10, 2016 at 9:38 AM Subject: [Cryptography] A possible alternative to TOR and PrivaTegrity without backdoors To: "cryptography(a)metzdowd.com" <cryptography(a)metzdowd.com> This is an old idea, but perhaps now there might be more reason to consider it. I currently call this idea Alias. Here's my dumb data-dump on it. Thoughts? Alias is a concept for a TOR-like Internet protocol supporting free speech and user privacy, but without encouraging the worst evil behaviors. Exit Nodes are replaced with Public Gateways, which sponsor users. The definition of evil behavior is defined by the Public Gateways and operators of routing nodes. Users would be encouraged to use good behavior, as their public alias would develop a reputation over time. Anonymity would be protected, but a user's Public Gateway and any routing node could refuse to route data for aliases with poor reputations. TOR was created with a lofty goal: to support free speech. Unfortunately, TOR has drawn attention from governments and law enforcement, as it could be used to protect some of the worst activities, such as contract killing, and the slave trade. TOR Exit Node operators generally follow a strict policy of never looking at traffic, because simply observing this traffic would require Exit Node operators in most countries to regularly contact law enforcement to report crimes. PrivaTegrity is an alternative protocol to TOR, which aims to find a balance between protecting free speech and protecting the world from the worst behavior. Unfortunately, the PrivaTegrity inserts encryption backdoors. Alias Design: This is very much a dumb idea in the half-baked stage. Feedback and ideas are welcome. Alias would be a fork of TOR, and route Internet traffic from a user's machine through a couple of Routing Nodes, to a Public Gateway, which replaces the Exit Node. The Public Gateway would have an account for the user, under a pseudonym used on Alias network by the user, called his alias. The Public Gateway should keep an email contact address for the user, similar to regular accounts on various web sites. In Alias, user aliases would have trackable reputations, and the reputations of user aliases would be combined into a reputation for a Public Gateway. At a minimum, incident reports would be used to compute user reputations. Exactly how this works is TBD, but the goal is to cause gateways with very poor reputations to be effectively blacklisted by routing nodes, and for users with poor reputations to be dropped by reputable gateways. Users could move their alias from one gateway to another when needed, but they could not erase what their previous gateway knows about there identity. The Gateway would not know a user's location, and in many cases will know nothing other than the user's reputation and email address. When requested by a government authority, at a minimum, a gateway can drop support for a user alias, causing that alias to try to find a new gateway that will agree to sponsor it. Participants who act as routing nodes in Alias would be able to select what sort of reputations they require from aliases and Gateways to allow traffic to be routed through them to those gateways. They could, for example, choose to not route data for any gateway with a high reputation for routing to pornography sites. I compare the TOR, PrivaTegrity, and Alias concepts in several "threat cases" below: Threat Case: Governments Overreact to Terrorism In this case, we assume all the governments involved have decided to share all user network traffic in a mass surveillance program. The user Alice has something to say, such as wanting to tell the world that the mass surveillance program exists. TOR: Alice succeeds in using TOR to log into various blogging sites and publishes her knowledge about the surveillance program. Unfortunately, TOR provides limited defense against the Men in Black (MiB), and Alice may be arrested. The MiB is assumed to compromise TOR in various ways, such as operating many Exit Nodes and monitoring meta-data such as packet timing and size between nodes. PrivaTegrity: With the assumption that all governments involved are colluding, Alice is revealed directly, without having to subvert the protocol. Alias: Alice needs a Public Gateway to sponsor her. She can choose a gateway with a reputation of sponsoring free speech, such various newspapers, in a country that is not participating in the mass surveillance program. When Alice posts what she knows to various blogs, the Public Gateway (newspaper in this case) will be the the one defending her anonymity. In any case, even if the newspaper is forced to reveal what they know about Alice, they never knew her location. Conclusion: Alias seems to provide better protection of free speech in this case. Threat Case: A Single Government Blackmails the Rest Suppose one of the governments involved decides to use it’s influence in the protocol to blackmail one or more of the other governments involved into agreeing to some political agenda. TOR: If the government were the USA, it might have unique powers to track users through the TOR network. If true, the USA could refuse to reveal a French suspected terrorist unless the French government share mass surveillance data collected on it’s citizens. Is this sort of thinking too paranoid? PrivaTegrity: With nine separate governments who must collude to expose a user, it is possible for any one of the nine to blackmail the rest. For example, if tracking down a particular user is of critical importance to one government, another could demand certain trade policies be agreed to before allowing that user to be revealed. Alias: A country containing the Public Gateway sponsoring a user might make political demands from another country before agreeing to force the Public Gateway to reveal a user’s email address. However, this coercion is weaker than weaker than the TOR case because there is no country with majority control, and weaker than the PrivaTegrity case because a government can coerce cooperation only from Public Gateways in its country. Conclusion: While none are immune to this threat, Alias seems to perform better in this case. Threat Case: Hackers Compromise the Network In this case, a group of hackers wants to reveal the identity of a particular user. TOR: There is little chance that the attacker can hack all the nodes from the user to the Exit Node, and since the Exit Node has no information about the user, there seems to be little chance that the hacker can reveal the user’s identity, short of bugs in the protocol. PrivaTegrity: While hackers might hack one or more of the nine governments, it would be a considerable task for the hacker to hack them all. However, it is possible, and this is a weakness vs TOR. Alias: The hacker need only hack the user’s chosen Public Gateway, which is a considerably simpler task than with PrivaTegrity. Conclusion: Hackability of Public Gateways is a significant weakness for Alias compared to the other two. Threat Case: Evil Users Secretly Collude In this case, suppose there is strong evidence that several evil users wants to collude to do something terrible, and they want to communicate anonymously. For example, they could be running a contract-killing business or enslaving people and selling them on the Dark Web. TOR: Unfortunately, evil behaviors have been enabled in some cases over TOR. PrivaTegrity: The users involved in such evil activities can have their communication secretly wiretapped. This is a strong capability for law enforcement in this case. Alias: Assuming reputable Public Gateways are used, most of the users’ emails would be revealed to law enforcement. This is weaker than a wiretap. Conclusion: In the case of severe evil, PrivaTegrity performs the best, Alias next best, and TOR the worst. Threat Case: Somewhat Evil Users Secretly Collude What is evil vs good is highly subjective, and getting people to agree can be difficult. In this case, the users are engaged in what most reasonable people consider evil. For example, consider illegal trade in ivory, which could lead to the extinction of wild elephants. TOR: Users trading in ivory likely would benefit from using TOR. PrivaTegrity: Having to get cooperation from nine governments may be too painful when tracking down a single ivory trader, and the ivory trader likely could use PrivaTegrity to their advantage. If, on the other hand, the nine governments put in place a rapid rubber-stamp process to enable going after small-time criminals, then this capability can be highly abused. Alias: Ivory traders would avoid using Alias through reputable Public Gateways, since their identities could easily be revealed¸ and the sites the traders visit to buy/sell ivory would not likely be very reputable, lowering their alias' reputation. Conclusion: Alias seems to perform better at determine somewhat evil behaviors. Bill _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

4 7

Re: freedom is a gentle SeppuKuma
by coderman 19 Jan '16

19 Jan '16

SeppuKuma also offers 23 very different methods one can choose to end their life, including Everlasting Sleep (lethal injection), Pillow Kisses (suffocation), Peaceful Breath (helium asphyxia) and Sleepy time Hug which is where the robotic bear strangles its partner until their pulse stops for 15 minutes. All of these attributes enable the SeppuKuma to give it’s patient the power to choose how they get to end their own life. - http://www.iflscience.org/japan-engineers-design-robotic-bear-to-aid-in-ass…

3 5

Avoid beta testing medical drugs, you can die
by Georgi Guninski 19 Jan '16

19 Jan '16

http://www.bloomberg.com/news/articles/2016-01-15/french-drug-trial-leaves-… ---- Six people participating in a clinical trial for an experimental drug have been hospitalized after a “serious accident,” France’s Health Ministry said. One of the people is on life support and is considered brain dead, the ministry said in an e-mailed statement on Friday. ----- Drugs reach software quality.

3 3

US Pres Cand's Clinton, Sanders, O'Malley... All For Crypto Backdoors, Secret Negotiations
by grarpamp 19 Jan '16

19 Jan '16

http://it.slashdot.org/story/16/01/18/1659205/clinton-hints-at-tech-industr… https://www.youtube.com/watch?v=ti2Nokoq1J4&t=2h27m08s http://www.huffingtonpost.co.uk/2016/01/18/hillary-clinton-hints-at-apple-f… At the Democratic presidential debate last night, Marques Brownlee asked the candidates a pointed question about whether the government should require tech companies to implement backdoors in their encryption, and how we should balance privacy with security. The responses were not ideal for those who recognize the problems with backdoors. Martin O'Malley said the government should have to get a warrant, but skirted the rest of the issue. Bernie Sanders said government must "have Silicon Valley help us" to discover information transmitted across the internet by ISIS and other terrorist organizations. He thinks we can do that without violating privacy, but didn't say how. But the most interesting comment came from Hillary Clinton. After mentioning that Obama Administration officials had "started the conversation" with tech companies on the encryption issue, one of the moderators noted that the government "got nowhere" with its requests. Clinton replied, "That is not what I've heard. Let me leave it at that." The implications of that small comment are troubling.

2 1

Tracking GLOMAR
by Michael Best 19 Jan '16

19 Jan '16

Does anyone know about any projects that are collecting or tracking GLOMAR responses? A quick Google search didn't turn anything up, but it could be worthwhile.

2 1

FOIPA adventures
by Michael Best 19 Jan '16

19 Jan '16

It's outside the realm of your usual FOIA requests, but since I'm out of requests for the month (and already bought more than a few extra...) I figured I'd mention it. While posting docs related to the MLK assassination trial <http://that1archive.neocities.org/subfolder1/MLK-assassination-trial.html>, I realized that Loyd Jowers <https://en.wikipedia.org/wiki/Loyd_Jowers>, who confessed to playing a part in the MLK assassination a few months before his death, surely has an FBI file. The DOJ did a follow-up investigation and their report concluded he and the other witnesses were lying, but it'd be interesting to see what the FBI had on him and what materials the DOJ/FBI referenced beyond the trial transcript. Let me know if you file anything on it, otherwise I'll try to get to it next month (unless I get distracted by other shiny FOIAs/projects/IRL (what do I mean, this listserv isn't real?!?) stuffs). --Mike *coderman* coderman(a)gmail.com <coderman%40gmail.com?Subject=Re%3A%20FOIPA%20adventures&In-Reply-To=%3CCAJVRA1SEFzByw4wA9o0u%3D64QHWJmdLmMtbX_debnhBFPOBSxBw%40mail.gmail.com%3E> *Sun Jan 17 07:47:47 EST 2016* > still have one FOIA left for January; trying to pick a topic... it must > beat this one, in terms of poking bear caliber: > ''' > Records of any communication, agreements, transcripts, memorandum of > understanding, contracts, or other responsive materials relating to > Ibragim Todashev as an Undercover Employee, Informant, or Cooperating > Witness with the Bureau before his death on May 22, 2013 at age 27 in > Florida while being interviewed about his possible connection to a > triple murder in Waltham, Mass., on Sept. 11, 2011. Note that while > the content of conversation may be withheld for privacy and other > reasons, the existence of these conversations or other law > enforcements records may not be concealed. Please search > cross-references for Ibragim Todashev that may reveal such > communication, in addition to primary indexes. Thank you! > ''' > - > https://www.muckrock.com/foi/united-states-of-america-10/inducedbytrap-2348… > best regards,

3 2

TheCthulhu (CthulhuSec)'s Insurance File
by Michael Best 19 Jan '16

19 Jan '16

https://insurance.thecthulhu.com/ > I would like to ask the public for help. My freedom may soon be > compromised, and therefore I require assistance to see out a final stage. I cannot comment on the contents of the container below other than it > contains pdfs, word documents, powerpoints, images and a few sql dumps. > Every person who downloads this for the record is doing a service for > democracy, and should hold people accountable for their atrocities. > When the time comes, I will ensure the passphrase for the container is > published either through myself or by proxy. I am not the only person with > it either. > To my friends out there, here is something to consider: > https://www.intelexit.org > I will not be intimidated. I am not afraid. I know the consequences, and I > accept them. > With the power of democracy, comes the responsibility of defending it from > any threat. SHA1: 2300 C680 5A95 D14A 75C0 9136 D28A 6459 42A6 1027 SHA256: 39D4 3376 8682 0821 36DF BF75 83B5 F6C0 7619 ADF5 8039 403F 9995 > C8FE 0245 DC75 Download links on TheCthuhu's page: https://insurance.thecthulhu.com/

2 2

Chaum Fathers Bastard Child To RubberHose ... PrivaTegrity cMix
by grarpamp 19 Jan '16

19 Jan '16

http://www.wired.com/2016/01/david-chaum-father-of-online-anonymity-plan-to… Now Chaum has returned with his first online privacy invention in more than a decade. And with it, he wants to bring those crypto wars to an end... a new encryption scheme he calls PrivaTegrity ... based on cMix. Chaum wouldn't comment on whether the project... would be commercialized or run as a non-profit. Chaum is also building into PrivaTegrity another feature... a backdoor that allows anyone doing something "generally recognized as evil" to have their anonymity and privacy stripped altogether. Nine server council... a hoseablitly focus point similar to Tor dirauths. In any case... interesting. https://www.scribd.com/doc/294737065/cMix-Anonymization-by-High-Performance…

11 17