- cypherpunks - lists.cpunks.org

handling hot potatohhhs [was: Re: The Intercept steps up after catching a reporter faking data and sources]
by coderman 04 Feb '16

04 Feb '16

On 2/4/16, Cari Machet <carimachet(a)gmail.com> wrote: > ... > she stated at ccc that they get a lot of complaints about the slowness of > the information coming to the public regarding the snowden docs and glenn > said they have asked eff to take on some of the task but eff declined so > maybe they are doing better at at least trying to get others to work on it > still there is a reason that wikileaks is open ... i mean that decision > wasnt just out of nothing remember when media thought Cryptome was about to drop the cache? :P if you consider disseminating this collection trivial i think you underestimate the friction involved... best regards,

2 1

Fwd: New High School Principal's speech to students.
by Zenaan Harkness 03 Feb '16

03 Feb '16

My kinda speech, Zenaan --- New high school principal A Speech Every Australian High School Principal Should Give. To the students and faculty of our high school: I am your new principal, and honored to be so. There is no greater calling than to teach young people. I would like to apprise you of some important changes coming to our school. I am making these changes because I am convinced that most of the ideas that have dominated public education in Australia have worked against you, against your teachers and against our country. First, this school will no longer honour race or ethnicity. I could not care less if your racial makeup is black, brown, red, yellow or white. I could not care less if your origins are African, Latin American, Asian or European, or if your ancestors arrived here on the Endeavour or on slave ships. The only identity I care about, the only one this school will recognize, is your individual identity -- your character, your scholarship, your humanity. And the only national identity this school will care about is Australia. This is an Australian public school, and Australian public schools were created to make better Australians. If you wish to affirm an ethnic, racial or religious identity through school, you will have to go elsewhere. We will end all ethnicity, race and non-Australian nationality-based celebrations. They undermine the motto of Australia, one of its three central values -- epluribus Unum, "from many, one." And this school will be guided by Australia's values. This includes all after-school clubs. I will not authorize clubs that divide students based on any identities. This includes race, language, religion, sexual orientation or whatever else may become in vogue in a society divided by political correctness. Your clubs will be based on interests and passions, not blood, ethnic, racial or other physically defined ties. Those clubs just cultivate narcissism -- an unhealthy preoccupation with the self -- while the purpose of education is to get you to think beyond yourself. So we will have clubs that transport you to the wonders and glories of art, music, astronomy, languages you do not already speak, carpentry and more. If the only extracurricular activities you can imagine being interested in are those based on ethnic, racial or sexual identity, that means that little outside of yourself really interests you. Second, I am uninterested in whether English is your native language. My only interest in terms of language is that you leave this school speaking and writing English as fluently as possible. The English language has united Australia's citizens for over 200 years, and it will unite us at this school. It is one of the indispensable reasons this country of immigrants has always come to be one country. And if you leave this school without excellent English language skills, I would be remiss in my duty to ensure that you will be prepared to successfully compete in the Australian job market. We will learn other languages here -- it is deplorable that most Australians only speak English -- but if you want classes taught in your native language rather than in English,this is not your school. Third, because I regard learning as a sacred endeavour, everything in this school will reflect learning's elevated status. This means, among other things, that you and your teachers will dress accordingly. Many people in our society dress more formally for Horse Racing events than for church or school. These people have their priorities backward. Therefore, there will be a formal dress code at this school. Fourth, no obscene language will be tolerated anywhere on this school's property -- whether in class, in the hallways or at athletic events. If you can't speak without using the f -word, you can't speak. By obscene language I mean the words banned by the Federal Communications Commission, plus epithets such as "Abbo," even when used by one black student to address another black, or "bitch," even when addressed by a girl to a girlfriend. It is my intent that by the time you leave this school, you will be among the few your age to instinctively distinguish between the elevated and the degraded, the holy and the obscene. Fifth, we will end all self-esteem programs. In this school, self-esteem will be attained in only one way -- the way people attained it until decided otherwise a generation ago -- by earning it. One immediate consequence is that there will be one valedictorian, not eight. Sixth, and last, I am reorienting the school toward academics and away from politics and propaganda. No more time will be devoted to scaring you about smoking and caffeine, or terrifying you about sexual harassment or global warming. No more semesters will be devoted to condom wearing and teaching you to regard sexual relations as only or primarily a health issue.. There will be no more attempts to convince you that you are a victim because you are not white, or not male, or not heterosexual or not Christian. We will have failed if any one of you graduates this school and does not consider him or herself inordinately fortunate -- to be alive and to be an Australian. Now, please stand and join me in the Pledge of Allegiance to the flag of our country. As many of you do not know the words, your teachers will hand them out to you.

11 12

"all that nasty thing"
by coderman 03 Feb '16

03 Feb '16

https://theintercept.com/2016/02/02/barrett-brown-the-rule-of-law-enforceme… The Barrett Brown Review of Arts and Letters and Prison The Rule of Law Enforcement Barrett Brown Feb. 2 2016, 3:02 p.m. AFTER HAVING SPENT the prior six months in a fruitless cycle of retaliation and counter-retaliation and counter-counter-retaliation with the administration of the Federal Correctional Institution at Fort Worth, where I managed to do about half of my time in the hole before finally getting kicked out altogether, I was delighted to arrive here at FCI Three Rivers, a medium security prison subject to occasional outbreaks of gang warfare that also happens to be quite a lot of fun. And though one’s first few days at a new prison are always given over largely to errands and social obligations, I did manage to get in some much-needed reading time when someone lent me a copy of Five Families, a history of the American mafia by the veteran New York Times crime reporter Selwyn Raab. I’ve never had much interest in organized crime of the non-governmental sort, but ever since 2009 when I read through the bulk of Thomas Friedman’s past columns in the course of researching a book on the subject of incompetence, I’ve been fascinated by the extent to which a fellow can be a bit of a dummy, with questionable writing abilities and a penchant for making demonstrably erroneous attacks on others, and still find regular employment with the nation’s most prestigious newspaper (though in fairness to the Times, they did eventually get rid of William Kristol). I’m afraid I gave up on reading Five Families straight through after about the halfway mark, by which point it had become clear that Raab, contrary to all decency, was going to continue using the phrase “law-enforcement” thusly, with the unwarranted hyphen, something that would have been more tolerable did the term not necessarily appear every few pages due to the nature of the subject matter, often in the company of such other improprieties as “civil-rights,” “public-relations,” “stolen-car rings,” or “loan-shark,” and to such an extent that one could be forgiven for suspecting that Raab himself, for all his tough talk on crime, is in fact some sort of illicit hyphen smuggler. Luckily, this is the sort of book from which one can extract the most telling instances of Gray Lady-caliber foolishness just by skimming around. At some point Raab seems to decide that the writers of The Sopranos must be punished for humanizing the mafia in the course of writing a drama about human beings who are in the mafia. And so, more in sadness than in anger, but more in confusion than either, he set out to debunk the show’s fictional plotline by way of his own fictional journalistic expertise: “Genuine capos and wiseguys would never emulate Tony’s behavior. … No top-tier mobster would last long if he behaved like Tony Soprano, who defies basic Mafioso caution by exposing himself as a ripe target, to be easily mowed down by rivals. He drives without a bodyguard; sips espresso in daylight at a sidewalk café.” This comes just a few chapters after we’re told the following about a real-life top-tier mobster: “Shunning bodyguards and bullet-proof limousines, the sixty-six-year-old godfather met with his Mafia associates in restaurants and travelled about Manhattan in taxis like any ordinary businessman.” To his credit, Raab did manage to refrain from rendering this last bit as “ordinary-businessman,” which is just extraordinary, so we’ll give him another try: “Sex and psychiatry are prominent in The Sopranos’ story line. Confiding in a psychiatrist, however, would be a radioactive mistake for a boss or capo, who can never display symptoms of weakness or mental instability.” Naturally Raab has already forgotten having written the following about mafia boss Frank Costello: “Striving for inner peace while hovering between criminal affiliates and respected society, Costello tried psychoanalysis.” Even had the author not been so sporting as to provide us with comically perfect counterexamples by which to disprove his various inane objections, one could have also pointed out that Tony Soprano’s decision to see a psychiatrist does in fact prove to be a “mistake” insomuch as that it directly leads to a rupture in his organization culminating in a botched assassination attempt in the very first season, so this objection wouldn’t have made any sense even had it gotten past that crucial directly-contradicted-by-your-own-fucking-book hurdle that seems to be giving Raab so much trouble. Now take a moment to reflect on the fact that this is the guy the New York Times assigned to report on one of the nation’s most complex and insidious criminal conspiracies — this plodding hyphen addict who cannot seem to follow a television show or even his own manuscript. One supposes that there is some alternate universe in which this might be considered a problem and where Ross Douthat manages a furniture store and everyone knows his place. barrettbrown-11 BUT THERE’S MORE to prison life than just sitting around despising the New York Times. A week after arrival at Three Rivers, we new inmates were summoned to an “Admissions and Orientation” seminar in which the various department heads each speak for a few minutes about institutional policy. I’d attended one of these back at Fort Worth; usually the highlight is a short video clip of Bureau of Prisons Director Charles Samuels, who gives a little talk. No one knows what the talk is about, as whoever’s nephew was put in charge of producing the video has talked Samuels into pausing every couple of sentences to shift position and look into the other camera, just like the newscasters, something that the fellow can manage only with the most hilarious awkwardness, and so it proves impossible to follow what he’s actually saying — which is a shame, as it’s almost certainly something very non-formulaic and true. Today, however, the chief attraction was to be our warden, Norbal Vazquez, a longtime BOP functionary from Puerto Rico who is proverbial for his deranged monologues as well as for being regarded with great contempt by staff and inmates alike. Here are some actual quotes from his exquisitely demented half-hour orientation talk, during which he waddled back and forth, wagging his finger in admonishment when appropriate and sometimes when not: On his own qualifications for the job: “I am here because I earned it!” On the assistant wardens upon whom lesser wardens depend: “I do not need them!” On his inspiring biography: “I was a case manager before, and I was an OUTSTANDING one!” [wags finger] On the status of we benighted inmates, sitting in darkness: “You are all my children!” On who controls the prison: “Probably in some of your minds, is inmates! But you are wrong!” On, er, violators: “I have no mercy for violators!” On medical care: “You have a bullet in your leg and you want the bureau to heal you! Ha! Ha ha!” On the insufficiency of our meals: “Don’t come complain to me about your meals. Because there are children with nothing!” On gang warfare: “If you show force, I am going to show force!” On homemade alcohol: “If you are drinking all that nasty thing, shame on you! When your liver fails, I don’t care!” On inmates who are placed in the SHU and transferred to violent maximum security prisons because they’ve been caught with harmless contraband like synthetic marijuana: “They cry like babies! I have no mercy!” The only disappointing thing about the presentation was that he didn’t end by exhibiting his medals and declaring himself President for Life; indeed, I almost cried when someone told me he was retiring a few weeks hence. And “all that nasty thing” is my new favorite hooch-related meme, edging out “PRISON MADE INTHOXICANT” from a few columns back. All in all, it was an informative speech in spite of itself, even aside from the fellow’s suspicious insistence on his own competence and self-reliance and entirely meritocratic ascension to the top spot. There was quite a bit of talk, for instance, about how the gangs aren’t in control of the prison, something that obviously wouldn’t need so much triumphant emphasis were such a state of affairs not at least a possibility. barrettbrown-21 IN FACT, THE GANGS really don’t have control over the prison. But then neither does the administration, if by “control” we mean the ability to make uncontested decisions over what happens within a given space, in which case control is always a matter of degree. The federal and state governments of the United States, for instance, exercise some degree of overlapping control over their territory, but not to such an extent that the various law-enforcement agencies — er, law enforcement agencies — arrest any but a small minority of residents who violate the law. This is just as well, since the law requires that the tens of millions of Americans who use drugs or gamble or involve themselves in prostitution be imprisoned — and that’s not even counting federal law, which, as convincingly estimated by civil liberties attorney Harvey Silvergate in his book Three Felonies a Day, the average American unwittingly violates every day. And thus it is that the U.S. can continue to exist above the level of an unprecedented gulag state only to the extent that its laws are not actually enforced — an extraordinary and fundamental fact of American life that one might hope in vain to see rise to the level of an election issue, but which is at least worth keeping in mind when it comes to the debate over whether or not we should keep granting the state ever more powerful methods of surveillance until it becomes the All-Seeing God Against Whose Laws We All Have Sinned. (Personally I’d vote “no,” but then I’m a felon and can’t vote anyway.) As is the case with the country at large, the rules within each federal prison are such that a large portion of everyday activity actually violates those rules — and in both cases, 99 percent of the violations go unpunished, while anyone who proves inconvenient to the powers that be can be singled out for retaliation. Technically it’s against the rules to give anything to another inmate, for instance, or to sell or trade or lend for that matter, but of course this is done all day without a second thought, often in plain view of the guards, not a single one of whom would consider objecting. There are other rules that are almost universally disregarded but can be invoked at whim; there is also a catch-all violation, “Anything Unauthorized,” on hand as a last resort. But rabble-rousers can usually be dispensed with via more specific regulations such as those barring the signing of petitions or holding of demonstrations. (I myself was thrown in the hole for months due to my supposed leadership role in one such demonstration against an abusive guard who’d just threatened an elderly man.) Part of the justification behind those two regulations in particular is that there exists a means by which inmates can have their grievances addressed: the administrative remedy process. Naturally the BOP routinely conspires to prevent inmates from completing that process; the surreal lengths to which it’s gone to keep me from pursuing my own retaliation complaint, a process I’ve documented in this column over the course of the last nine months, are actually quite commonly deployed against inmates deemed to have a good chance of winning in court. Presumably this is why the Freedom of Information Act request that The Intercept filed with the BOP some months ago to obtain records of the administrative remedy process at FCI Fort Worth was denied with no explanation, even though the documents in question are specifically designated as being FOIA accessible. Any comprehensive examination of those records would reveal a systematic and highly effective effort by BOP officials to prevent inmates from bringing instances of major policy violations and even outright criminal activity by the bureau to the attention of the courts. The American people do not control their own prisons. The reality is that control is shared by way of a sort of makeshift federalism that varies in particulars from prison to prison but in which real power is always divided among the various gangs, the staff, and local and regional administrators in an arrangement that’s best described as a cross between the old Swiss canton system and China during the Warring States period, which I’ll be the first to acknowledge is not especially helpful. Suffice to say that it will take me the remainder of my sentence to provide a real sense of this remarkable state-within-a-state and its inimitable politics — the politics of the literally disenfranchised, who live their lives in the very guts of government without being able to rely on its protections, and so are forced to provide their own. Really, it’s a state-within-a-state-within-a-state. Complicating matters further is the great extent to which prisons can differ, with the most pronounced of these divisions being that between the state and federal systems. Broadly, we federals tend to look down upon our regional cousins as “not quite our sort, old boy,” although I’m probably the only one who puts it in exactly those terms. The state prisons tend to house the small-time dealers, whereas the feds are more often home to the guys who supplied them. The state is halfway filled with such actual criminals as thieves, rapists, and murderers, whereas the feds are made up largely of illegal immigrants and drug entrepreneurs — people who have neither hurt anyone nor deprived them of their property, but instead made the mistake of taking all of this “free market” talk seriously. The character of the federal prisons, then, will usually differ from those of the states. But then they’ll also differ among themselves, sometimes quite a bit, and not just along other readily obvious divisions such as those between minimum, low, medium, and maximum security designations, either. A few years ago the medium at Beaumont, Texas, to which I just narrowly avoided being sent myself, was considerably more violent than many of the maximums (also known as pens or, more technically, USPs). Back at the FCI Fort Worth, there was a marked degree of difference in how certain things were done even between the several 300-man units into which inmates were divided. And since the local administrators can disregard national policy more or less at will, as has been documented in this column repeatedly for two years, de facto policy will naturally vary from institution to institution as well. The result of all of this is that each prison is its own unique snowflake, fluttering about on gusts of cultural drift and BOP lawlessness. barrettbrown-31 THE VITAL STATISTICS of my stomping grounds here at Three Rivers, then, are as follows. The prison is home to a bit more than 1,000 inmates, of whom about 60 percent are Mexican nationals, another 20 percent are U.S. Hispanics, 10 percent are black, 5 percent are Latin American, and 5 percent are white (the ofay percentage of 15 percent I cited last time appears to have been out of date). About half of the Mexicans “run with” (institutional slang for “are affiliated with”) the Paisas, a relatively amorphous prison gang that draws its ranks almost exclusively from Mexican nationals; a smaller percentage of U.S. Hispanics run with Tango Blast, a more organized gang with a much cooler name; while blacks and whites for purposes of prison riots and dining arrangements both act mostly as race-based units. As usual, there are all manner of qualifiers and exceptions plus a smattering of smaller groupings: The Muslims will usually constitute their own little umma, there are a couple of whites who run with Tango, and so on. The most amusing of these aberrations involved the fellow with whom I shared a cell before he transferred to a low a few weeks back. Aaron LeBaron was born into an ultra-fundamentalist Mormon cult led by his father, who had moved the wives and kids to Mexico after some members of his congregation started to question whether or not all of the voices he was hearing were actually from God. Aaron eventually inherited the family theocracy as well as the family hit list and the family international stolen car ring. In the end he was captured and sentenced to 45 years. Today Aaron is an agnostic and longtime Skeptic Magazine subscriber who was very excited to learn that I’d written for that magazine as well as for Skeptical Inquirer. (Come to think of it, he was the only person I’ve ever met who found either one the least bit impressive, and I’ve been working them into introductory conversations for years.) At any rate, having been raised in Mexico and speaking perfect Spanish, this gangly, bespectacled, white, Mormon-looking fellow had been accepted as one of the Paisas, with whom he sat every day to eat and watch television. Scientists cannot measure the extent to which I’m going to dominate every dinner party conversation for the rest of my life. For a medium, Three Rivers isn’t particularly violent. The last major gang war, between the Tangos and the Paisas, was nearly a year ago; afterward the compound went on lockdown for about two weeks, itself a fairly typical gang intelligence investigation/cool-down period. In the three months since I’ve arrived, I’ve only had to “take a knee” once (inmates here are supposed to put at least one knee to the ground when officers run by screaming “Get the fuck down!” or some variation thereof as they proceed to the location of a conflict). And we’ve only been locked down in the aftermath of a fight on one occasion, for just a few hours. This is just as well, as I’m thereby able to concentrate on the trickle of information coming in from the wicked world beyond the fence. Lately I’ve been getting garbled reports of hoverboards, as well as some sort of new fascist movement that could conceivably take control of the White House this year, though I find it difficult to believe that the boards actually float like the ones from the movie. Meanwhile, I’m halfway through the newish first volume of Niall Ferguson’s biography of Henry Kissinger, which we shall examine in some detail next time. For now I will simply leave off with the following actual sentences from Ferguson’s introduction: “In this context, it is a strange irony of the Kissinger literature that so many of the critiques of Kissinger’s mode of operation have a subtle undertone of anti-Semitism. … This prompts the question: might the ferocity of the criticism that Kissinger has attracted perhaps have something to do with the fact that he, like the Rothschilds, is Jewish? This is not to imply that his critics are anti-Semites.” Well, the hyphens are all in their proper places, anyway. Quote of the Day “When the mob gains the day it ceases to be any longer the mob. It is then called the nation.” — Napoleon

2 1

the complex social construction of trust in cryptographic systems
by coderman 03 Feb '16

03 Feb '16

Conspicuous Chatter Traffic analysis, anonymous and covert communications, and other magic. https://conspicuouschatter.wordpress.com/2016/02/03/the-social-construction… The Social Construction of Trust in Cryptographic Systems 3 February 2016 (This is an extract from my contribution to Harper, Richard. “Introduction and Overview”, Trust, Computing, and Society. Ed. Richard H. R. Harper. 1st ed. New York: Cambridge University Press, 2014. pp. 3-14. Cambridge Books Online. Web. 03 February 2016. http://dx.doi.org/10.1017/CBO9781139828567.003) Cryptography has been used for centuries to secure military, diplomatic, and commercial communications that may fall into the hands of enemies and competitors (Kahn 1996). Traditional cryptography concerns itself with a simple problem: Alice wants to send a message to Bob over some communication channel that may be observed by Eve, but without Eve being able to read the content of the message. To do this, Alice and Bob share a short key, say a passphrase or a poem. Alice then uses this key to scramble (or encrypt) the message, using a cipher, and sends the message to Bob. Bob is able to use the shared key to invert the scrambling (or “decrypt”) and recover the message. The hope is that Eve, without the knowledge of the key, will not be able to unscramble the message, thus preserving its confidentiality. It is important to note that in this traditional setting we have not removed the need for a secure channel. The shared key needs to be exchanged securely, because its compromise would allow Eve to read messages. Yet, the hope is that the key is much shorter than the messages subsequently exchanged, and thus easier to transport securely once (by memorizing it or by better physical security). What about the cipher? Should the method by which the key and the message are combined not be kept secret? In “La Cryptographie Militaire” in 1883, Auguste Kerckhoffs stated a number of principles, including that only the key should be considered secret, not the cipher method itself (Kerckhoffs 1883). Both the reliance on a small key and the fact that other aspects of the system are public is an application of the minimization principle we have already seen in secure system engineering. It is by minimizing what has to be trusted for the security policy to hold that one can build and verify secure systems – in the context of traditional cryptography, in principle, this is just a short key. Kerckhoffs argues that only the key, not the secrecy of the cipher is in the trusted computing base. But a key property of the cipher is relied on: Eve must not be able to use an encrypted message and knowledge of the cipher to recover the message without access to the secret key. This is very different from previous security assumptions or components of the TCB. It is not about the physical restrictions on Eve, and it is not about the logical operations of the computer software and hardware that could be verified by careful inspection. It comes down to an assumption that Eve cannot solve a somehow difficult mathematical problem. Thus, how can you trust a cipher? How can you trust that the adversary cannot solve a mathematical problem? To speak the truth, this was not a major concern until relatively recently, compared with the long history of cryptography. Before computers, encoding and decoding had to be performed by hand or using electromechanical machines. Concerns such as usability, speed, cost of the equipment, and lack of decoding errors were the main concerns in choosing a cipher. When it comes to security, it was assumed that if a “clever person” proposes a cipher, then it would take someone much cleverer than them to decode it. It was even sometimes assumed that ciphers were of such complexity that there was “no way” to decode messages without the key. The assumption that other nations may not have a supply of “clever” people may have to do with a colonial ideology of nineteenth and early twentieth centuries. Events leading to the 1950s clearly contradict this: ciphers used by major military powers were often broken by their opponents. In 1949, Claude Shannon set out to define what a perfect cipher would be. He wanted it to be “impossible” to solve the mathematical problem underlying the cipher (Shannon 1949). The results of this seminal work are mixed. On the positive side, there is a perfect cipher that, no matter how clever an adversary is, cannot be solved – the one-time pad. On the down side, the key of the cipher is as long as the message, must be absolutely random, and can only be used once. Therefore the advantage of short keys, in terms of minimizing their exposure, is lost and the cost of generating keys is high (avoiding bias in generating random keys is harder than expected). Furthermore, Shannon proves that any cipher with smaller keys cannot be perfectly secure. Because the one-time pad is not practical in many cases, how can one trust a cipher with short keys, knowing that its security depends on the complexity of finding a solution? For about thirty years, the United States and the UK followed a very pragmatic approach to this: they kept the cryptological advances of World War II under wraps; they limited the export of cryptographic equipment and know-how through export regulations; and their signal intelligence agencies – the NSA and GCHQ, respectively – became the largest worldwide employers of mathematicians and the largest customers of supercomputers. Additionally, in their roles in eavesdropping on their enemies’ communications, they evaluated the security of the systems used to protect government communications. The assurance in cryptography came at the cost of being the largest organizations that know about cryptography in the world. The problem with this arrangement is that it relies on a monopoly of knowledge around cryptology. Yet, as we have seen with the advent of commercial telecommunications, cryptography becomes important for nongovernment uses. Even the simplest secure remote authentication mechanism requires some cryptography if it is to be used over insecure channels. Therefore, keeping cryptography under wraps is not an option: in 1977, the NSA approved the IBM design for a public cipher, the Data Encryption Standard (DES), for public use. It was standardized in 1979 by the US National Institute for Standards and Technology (NIST). The publication of DES launched a wide interest in cryptography in the public academic community. Many people wanted to understand how it works and why it is secure. Yet, the fact that the NSA tweaked its design, for undisclosed reasons, created widespread suspicion in the cipher. The fear was that a subtle flaw was introduced to make decryption easy for intelligence agencies. It is fair to say that many academic cryptographers did not trust DES! Another important innovation in 1976 was presented by Whitfield Diffie and Martin Hellman in their work “New Directions in Cryptography” (Diffie & Hellman 1976). They show that it is possible to preserve the confidentiality of a conversation over a public channel, without sharing a secret key! This is today known as “Public Key Cryptography,” because it relies on Alice knowing a public key for Bob, shared with anyone in the world, and using it to encrypt a message. Bob has the corresponding private part of the key, and is the only one that can decode messages used with the public key. In 1977, Ron Rivest, Adi Shamir, and Leonard Adleman proposed a further system, the RSA, that also allowed for the equivalent of “digital signatures” (Rivest et al. 1978). What is different in terms of trusting public key cryptography versus traditional ciphers? Both the Diffie-Hellman system and the RSA system base their security on number theoretic problems. For example, RSA relies on the difficulty of factoring integers with two very large factors (hundreds of digits). Unlike traditional ciphers – such as DES – that rely on many layers of complex problems, public key algorithms base their security on a handful of elegant number theoretic problems. Number theory, a discipline that G.H. Hardy argued at the beginning of the twentieth century was very pure in terms of its lack of any practical application (Hardy & Snow 1967), quickly became the deciding factor on whether one can trust the most significant innovation in the history of cryptology! As a result, a lot of interest and funding directed academic mathematicians to study whether the mathematical problems underpinning public key cryptography were in fact difficult and how difficult the problems were. Interestingly, public key cryptography does not eliminate the need to totally trust the keys. Unlike traditional cryptography, there is no need for Bob to share a secret key with Alice to receive confidential communications. Instead, Bob needs to keep the private key secret and not share it with anyone else. Maintaining the confidentiality of private keys is simpler than sharing secret keys safely, but it is far from trivial given their long-term nature. What needs to be shared is Bob’s public key. Furthermore, Alice need to be sure she is using the public key associated with the Bob’s private key; if Eve convinces Alice to use an arbitrary public key to encrypt a message to Bob, then Eve could decrypt all messages. The need to securely associate public keys with entities has been recognized early on. Diffie and Hellman proposed to publish a book, a bit like the phone register, associating public keys with people. In practice, a public key infrastructure is used to do this: trusted authorities, like Verisign, issue digital certificates to attest that a particular key corresponds to a particular Internet address. These authorities are in charge of ensuring that the identity, the keys, and their association are correct. The digital certificates are “signed” using the signature key of the authorities that anyone can verify. The use of certificate authorities is not a natural architecture in many cases. If Alice and Bob know each other, they can presumably use another way to ensure Alice knows the correct public key for Bob. Similarly, if a software vendor wants to sign updates for their own software, they can presumably embed the correct public key into it, instead of relying on public key authorities to link their own key with their own identity. The use of public key infrastructures (PKI) is necessary in case Alice wants to communicate with Bob without them having any previous relationship. In that case Alice, given only a valid name for Bob, can establish a private channel to Bob (as long as it trusts the PKI). This is often confused: the PKI ensures that Alice talks to Bob, but not that Bob is “trustworthy” in any other way. For example, a Web browser can establish a secure channel to a Web service that is compromised or simply belong to the mafia. The secrecy provided by the channel does not, in that case, provide any guarantees as to the operation of the Web service. Recently, PKI services and browsers have tried to augment their services by only issuing certificates to entities that are verified as somehow legitimate. Deferring the link between identities and public keys to trusted third parties places this third party in a system’s TCB. Can certification authorities be trusted to support your security policy? In some ways, no. As implemented in current browsers, any certification authority (CA) can sign a digital certificate for any site on the Internet (Ellison & Schneier 2000). This means that a rogue national CA (say, from Turkey) can sign certificates for the U.S. State Department, that browsers will believe. In 2011, the Dutch certificate authority Diginotar was hacked, and their secret signature key was stolen (Fox-IT 2012). As a result, fake certificates were issued for a number of sensitive sites. Do CAs have incentives to protect their key? Do they have enough incentives to check the identity of the people or entities behind the certificates they sign? Cryptographic primitives like ciphers and digital signatures have been combined in a variety of protocols. One of the most famous is the Secure Socket Layer SSL or TLS, which provides encryption to access encrypted Web sites on the Internet (all sites following the https:// protocol). Interestingly, once secure primitives are combined into larger protocols, their composition is not guaranteed to be secure. For example a number of problems have been identified against SSL and TLS that are not related to the weaknesses of the basic ciphers used (Vaudenay 2002). The observation that cryptographic schemes are brittle and could be insecure even if they rely on secure primitives (as did many deployed protocols) led to a crisis within cryptologic research circles. The school of “provable security” proposes that rigorous proofs of security should accompany any cryptographic protocol to ensure it is secure. In fact “provable security” is a bit of a misnomer: the basic building blocks of cryptography, namely public key schemes and ciphers cannot be proved secure, as Shannon argued. So a security proof is merely a reduction proof: it shows that any weakness in the complex cryptographic scheme can be reduced to a weakness in one of the primitives, or a well-recognized cryptographic hardness assumption. It effectively proves that a complex cryptographic scheme reduces to the security of a small set of cryptographic components, not unlike arguments about a small Trusted Computing Base. Yet, even those proofs of security often work at a certain level of abstraction and often do not include all details of the protocol. Furthermore, not all properties can be described in the logic used to perform the proofs. As a result, even provably secure protocols have been found to have weaknesses (Pfitzmann & Waidner 1992). So, the question of “How much can you trust cryptography?” has in part itself been reduced to “How much can you trust the correctness of a mathematical proof on a model of the world?” and “How much can one trust that a correct proof in a model applies to the real world?” These are deep epistemological questions, and it is somehow ironic that national, corporate, and personal security depends on them. In addition to these, one may have to trust certificate authorities and assumptions on the hardness of deep mathematical problems. Therefore, it is fair to say that trust in cryptographic mechanisms is an extremely complex social process.

1 0

Check the various legal authorities which allow NSA to collect data
by Michael Best 03 Feb '16

03 Feb '16

http://electrospaces.blogspot.com/2015/09/nsas-legal-authorities.html Sent from my iPhone

1 0

What you can hear at Davos... With RTL-SDR
by grarpamp 03 Feb '16

03 Feb '16

http://hardware.slashdot.org/story/16/01/27/1654246/collecting-private-flig… http://qz.com/600590/we-brought-an-antenna-to-davos-to-track-private-air-tr… https://en.wikipedia.org/wiki/Automatic_dependent_surveillance_%E2%80%93_br… http://bit.do/RTL-SDR-and-GNU-Radio-with-Realtek-RTL2832U Every year politicians and business men meet at the World Economic Forum in the small mountain town of Davos, Switzerland to discuss various topics and create business deals. This year Quartz, an online newspaper/magazine sent a journalist to the forum tasked with writing a unconventional story about the forum: he was asked to monitor the private helicopter traffic coming in and out of Davos from transponder broadcast of ADS-B data. Using an $20 RTL-SDR dongle, Raspberry Pi and ADS-B collinear antenna they monitored the flights over Davos. From the data they were able to determine the flight paths that many helicopters took, the types of helicopters used and the most popular flight times.

3 2

https://www.youtube.com/watch?v=RpwOmwysqJ8
by juan 02 Feb '16

02 Feb '16

2 1

National Archives API
by Michael Best 02 Feb '16

02 Feb '16

So apparently there's an API. Not sure if it's just for data mining or actually accessing information or not. https://github.com/usnationalarchives/Catalog-API If anyone figures out how to make it do useful things, and feels like walking me through it....

2 1

Publishing CIA's Declassified Vault
by Michael Best 02 Feb '16

02 Feb '16

I like how you put "digital hero" in quotes, as if someone had said that in the article or the Kickstarter. I'm sorry I don't make sense to you, Georgi. Nevertheless, I am and I do. BTW, what is it that confuses you about someone being a geek over national security issues, and feeling that the public records he geeks out over should be available? It seems pretty straightforward to me. Then again, I **am** part of the CIA-Illuminati cabal of doom . https://www.youtube.com/watch?v=hLH8F2xDU90 ;-) *Georgi Guninski* guninski(a)guninski.com <guninski%40guninski.com?Subject=Re%3A%20Publishing%20CIA%27s%20Declassified%20Vault&In-Reply-To=%3C20160202140842.GF2441%40sivokote.iziade.m%24%3E> *Tue Feb 2 09:08:42 EST 2016* On Mon, Feb 01, 2016 at 05:45:39PM -0500, Michael Best wrote: >* historians,” Michael Best, analyst and freedom of information activist told * Is this ``digital hero'' "Michael Best" the same twitter user as "natsecguy". natsecguy==National Securtiy Guy (or Girl)? "national security" and "freedom of information activist" doesn't make _any sense_ in the U$A.

1 0

Publishing CIA's Declassified Vault
by Michael Best 02 Feb '16

02 Feb '16

https://motherboard.vice.com/read/11-million-pages-of-cia-files-may-soon-be… Millions of pages of CIA documents are stored in Room 3000. The CIA Records Search Tool (CREST), the agency's database of declassified intelligence files, is only accessible via four computers in the National Archives Building in College Park, MD, and contains everything from Cold War intelligence, research and development files, to images. Now one activist is aiming to get those documents more readily available to anyone who is interested in them, by methodically printing, scanning, and then archiving them on the internet. “It boils down to freeing information and getting as much of it as possible into the hands of the public, not to mention journalists, researchers and historians,” Michael Best, analyst and freedom of information activist told Motherboard in an online chat. Read the rest: https://motherboard.vice.com/read/11-million-pages-of-cia-files-may-soon-be… https://www.kickstarter.com/projects/285662323/publishing-cias-declassified… Negativity will be ignored, as will predictions of failure. It might not work, but at least I'm trying. =)

2 1