- cypherpunks - lists.cpunks.org

Fwd: Waking up
by Zenaan Harkness 19 Sep '15

19 Sep '15

Here's the full (20min, 60MB interview) youtube link from the bottom of the article below, which is kind of needed since then you can hear the full interview (the questioner and the other side): https://www.youtube.com/watch?v=KmQw6CryE9M USAGov/CIA lies - back then (August 2013) as we see in this interview team USA was saying 'We don't want regime change - we just want a limited (100 frigate-based missiles) strike against key Syria targets to send a message that chemical warfare is not ok', whilst: a) the leaked emails from a few days before the interview already showed that it was not Assad government, but 'terrorist' chemical warfare actions (not Assad govt) which also were a false flag done by CIA, and b) today we see team USA saying 'Assad must go, regime change is required to protect human rights' So team USA says what it wants, when it wants, in order to fuel more war, which in turn funds Lockheed, Raytheon etc. See here: http://www.usatoday.com/story/money/business/2013/03/10/10-companies-profit… "The business of war is profitable. In 2011, the 100 largest contractors sold $410 billion in arms and military services. Just 10 of those companies sold over $208 billion... These companies have benefited tremendously from the growth in military spending in the U.S., ... in 2000 $312 billion ... 2011 $712 billion ... #1 Lockheed Martin notched $36.3 billion in sales in 2011 " Them missiles are expensive, highly profitable. Zenaan ---------- Forwarded message ---------- Date: Thu, 17 Sep 2015 11:53:46 +0000 Subject: Fwd: Waking up Subject: Waking up http://beforeitsnews.com/alternative/2015/09/must-watch-ex-marine-goes-craz… "Ken O’ Keefe is a former US Marine turned anti-war campaigner who appeared on a Press TV debate called Syria: War of Deception, and absolutely owned his opponent in such an awesome way that you’ll be cheering at his every comment. Recorded in August 2013, this interview is now two years old, but in light of the current European refugee crisis it’s more relevant today than ever before. Passionate, articulate and knowledgeable about the subject matter, O’Keefe is the perfect guy to step up and tell these home truths...

4 4

How much/what hardware does the rowhammer DRAM bug affects?
by Georgi Guninski 19 Sep '15

19 Sep '15

This is old, but haven't seen it here. https://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bu… --- Rowhammer” is a problem with some recent DRAM devices in which repeatedly accessing a row of memory can cause bit flips in adjacent rows. It was able to use this to gain write access to its own page table, and hence gain read-write access to all of physical memory. --- There is POC. Variant via javascript: https://github.com/IAIK/rowhammerjs How much/what hardware does this bug affect?

6 22

Re: Microsoft has developed its own Linux. Repeat. Microsoft has developed its own Linux • The Register
by Zenaan Harkness 19 Sep '15

19 Sep '15

On 9/18/15, Robin wrote: > On 18 September 2015 at 16:02, Dave wrote: >> It must be getting a bit chilly down in Hell right now... >> >> http://www.theregister.co.uk/2015/09/18/microsoft_has_developed_its_own_lin… >> >> ...And I see some porcine figures out on the tarmac... > > Oh, and there's Jesus on a pogo stick ... Lucifer just rang his broker demanding a massive short position in Fujitsu Air conditioning, but the picosecond high frequency "liquidity" traders saw the bid and pre-seized all options causing St Peter to chuckle from the perly gates which manifested as a thunderstorm never seen before and lightening from New Zealand all the way to Hades. Lucifer of course figured "well, it might not be molten sodium but a little back to the future is better than nothing I guess," but just then she realised that the news article prompting all these escapades had caused exactly six-nines of all humans to laugh at exactly the same moment and with that the lightning didn't stop before Lucifer's throne, instead slicing her clean in two. As the two Lucifer halves started an eternal fist fight over which would get to mount the other half first, at that moment even God chuckled and the universe accidentally en...

1 0

Re: Fwd: Do ethnic Germans have the right to racial and cultural strength? - was Re: At a Berlin church, Muslim refugees converting in droves.
by Zenaan Harkness 19 Sep '15

19 Sep '15

On 9/10/15, C wrote: > In the face of genetics, which reveals that inter-german variability far > outstrips the genetic basis of what we define as "race", I'd like to see > you define "Ethnicity" meaningfully. What does that matter to the essence of the question? The fundamental question is the same, whatever words we use. A rose is a rose by any other name. Perhaps we could ask "currently franchised (those who may vote) Germans" - the point is, do those who are presently gathered in a current physical 'locality' have the right to protect their current racial/ genetic/ demographic/ cultural/ political/ religious "mix", whatever it is, against dilution from immigration, asylum, "democratic" coup (e.g. Ukraine today) or religious missionaries of any faith? The opium wars in China suggest that trying to infiltrate ones religion into a 'foreign' nation may not be altogether appreciated by the locals - and Islamic Muslims are pretty vehement about this too from what I hear - why shouldn't predominantly Christian (or atheistic, or ...) nations be similarly intolerant to a diluting influx of those of different think? > This is equally topical to the Conch Republic; as others visit and > settle on their soil, how do they defend their innate Conch-ness > ethnicity from outside dilution? I demand answers. Well yes, about a day after the email starting this thread, I sent a similar one modified appropriately for Australians as an on-topic reply to another email about Australia's increase in "Syrian refugees" now also to occur here - but I figured for the purposes of this list that one version of essentially the same email was probably enough :) --- So do we citizens of [pick your nation] have the right to protect the status quo within our nation, to protect it against dilution from immigration or asylum, or must we allow the attractions that our nation presents to would be immigrants (whatever arises in their mind in this regard) to be enough of a test for immigration/ asylum? I.e., do the current locals of Germany/Australia/Hungary/Italy/Greece/Conch Replubic, have a "valid right" to object to their politicians "throwing the doors wide open", as Austria and Germany have recently done? You don't have to be Nazi, to want your racial and cultural strength, however you define that thank you you're welcome. Regards Zenaan

4 5

Fwd: [Cryptography] WashPo: Leaked NSC Memo on Encryption
by grarpamp 18 Sep '15

18 Sep '15

---------- Forwarded message ---------- From: Henry Baker <hbaker1(a)pipeline.com> Date: Wed, Sep 16, 2015 at 8:38 PM Subject: [Cryptography] WashPo: Leaked NSC Memo on Encryption To: cryptography(a)metzdowd.com FYI -- This is my OCR'd version of the National Security Council memo leaked to the Washington Post and available at the link below. The pdf of the original looks like it was typed on a *manual* typewriter -- the NSC clearly following the lead of Russia to avoid being intercepted electronically! [The irony of the NSC using a manual typewriter for a memo on encryption is truly delicious!] http://www.theguardian.com/world/2013/jul/11/russia-reverts-paper-nsa-leaks The most distressing part of this memo is its obscene disregard for the Constitution. The only "stakeholders" -- according to this NSC memo -- in favor of "civil liberties" and "human rights" seem to be organizations -- e.g., the EFF and the ACLU; ordinary citizens are apparently not "stakeholders", and have no "stake" in this discussion. Of course, every time someone uses the term "stakeholder", the only images that come to mind are those scenes from black-and-white horror movies in which the townspeople are chasing a vampire with wooden stakes that they intend to drive through his heart! http://apps.washingtonpost.com/g/documents/national/read-the-nsc-draft-opti… REVIEW OF STRATEGIC APPROACHES Option 1: Disavow Legislation and Other Compulsory Actions Engagement Strategy and timeline Z September: Outreach to foreign allies to signal our strong resistance to efforts to compel access; outreach to U.S. industry, the technology community, and civil society to coordinate messaging; attempt to convince other allies to come out with a similar statement at the same time. Z October: The President issues a statement strongly disavowing legislation or other efforts to compel access and calling on U.S. industry to resist efforts by other nations to compel access; coordinated industry and civil society statements of support; coordinated foreign partner statements of agreement. Z November: Outreach to other governments to bring more allies in alignment with our position; outreach to U.S. industry to build voluntary cooperation in the absence of compulsion; host public discussions and debates on encryption policy with U.S. industry and foreign allies. Top Line Message Z The problem of criminals using strong encryption to frustrate law enforcement's information gathering is a real and growing problem but we have not found a secure, practical solution. Z People around the world rely on the security of U.S. products and services in their daily lives. Mandating the design of those systems to include known vulnerabilities makes all of us less safe and undermines trust in these digital services. Z It is critical that law enforcement be able to access the information that it needs to protect public safety and national security. We will continue to use all of the tools available to us lawfully to keep American citizens safe. Z Overall, the benefits to privacy, civil libertine, and cybersecurity gained from encryption outweigh the broader risks that would have been created by weakening encryption. Z Accordingly, the Administration will not seek legislation that compels providers to design their products to enable government access to encrypted information, even pursuant to lawful process. Z We expect that foreign governments will also take a hard look at this difficult issue, and hope that they will come to the same conclusion. We call on U.S. industry to resist efforts by other governments to mandate such access. Impact on Policy Equities Public Safety and National Security. In the near term, this approach would not provide any relief to law enforcement efforts to counter the increasing use of encryption by criminals, including terrorists. As a result, the public safety drawbacks would be significant, though the precise extent of the drawback versus other proposals is unclear because bad actors will increasingly be able to frustrate law enforcement efforts to access their communications through lawful process. This approach would remove technology companies' most consistent grievance with the Administration, which could improve cooperation across a range of important priorities on technology issues including, but not limited to, encryption. It may also foster better cooperation on information that is not encrypted and will not fracture the Internet products and services market which may also preserve better access to unencrypted information, thus aiding public safety/national security. Cybersecurity. Pro-encryption statements from the government could also encourage broader use of encryption, which would also benefit global cybersecurity. Further, because any new access point to encrypted data increases risk, eschewing mandated technical changes ensures the greatest technical security. At the same time, the increased use of encryption could stymie law enforcement's ability to investigate and prosecute cybercriminals, though the extent of this threat over any other option is unclear as sophisticated criminals will use inaccessible encryption. Economic Competitiveness. This approach could help undercut foreign competitors' criticisms that U.S. companies' products are instruments of U.S. mass surveillance, and would clearly differentiate U.S. policy from moves by China and others to mandate decryption. However, if other markets do not follow our lead, and instead demand access, it is more difficult to assess the impact of this approach. On the one hand, U.S. companies could be forced to avoid those markets or develop access solutions. On the other, the failure of some nations to follow the U.S. lead could bolster the reputation of the United States as a leading source of technically secure products and. services. Civil Liberties and Human Rights. Domestically, many privacy and civil liberties advocates would regard this approach as a significant step in defense of privacy and free expression around the world. If other nations follow our lead or companies successfully resist country demands, this approach could limit repressive regimes' willingness to demand access to encrypted information, which likely would help protect dissidents and other communities in danger of human rights violations. Likely Reaction of Key Stakeholders Industry and Civil Society. This sector would strongly support this approach. Other Governments. Likely to be divided. This position would contradict the stated policy of some allies (e.g., the United Kingdom, France, and the Netherlands) who argue that governments should not allow “safe spaces” for extremists. As a result, those allies could criticize the U.S. position as endangering the safety of their citizens. Other foreign partners that are strong advocates for free expression online and have not argued for government access to encrypted information (e.g., Germany and Estonia) are more likely to support this approach. Pros Z Some in industry have indicated that a strong statement disavowing legislation is a precondition to voluntary cooperation with the United States Government. Since the prospects of legislation are dim, this approach could help build cooperation without limiting broader policy options. Z Counters the narrative that the United States is seeking to expand its surveillance capability at the expense of cybersecurity, and could help repair trust in the United States Government and U.S. companies overseas. Z A strong statement from the United States could make it more difficult for authoritarian regimes to seek compulsory legislation, although working group participants are divided on whether adopting this approach would actually stop such calls. Z May weaken future calls for data localization since it will be harder for other countries to claim they are “protecting” their citizens' data from the United States. Z Could provide some positive benefit for U.S. negotiations on the U.S.-EU Data Protection and Privacy Agreement, Safe Harbor, and Transatlantic Trade and Investment Partnership. Z Is the strongest option for cybersecurity, economic competitiveness and civil liberties and human rights. Cons Z This approach provides no immediate solution to the challenges that the expanding use of encryption poses to law enforcement and national security today and is the weakest option from that perspective. Z Some working group participants argue this approach would remove a key point of leverage -- the threat of legislation in our negotiations with industry (although few, if any, in industry likely find this threat to be credible). Z U.S. providers have not indicated they would be willing to voluntarily modify their systems to enable law enforcement access to encrypted information, even if the government were to eschew legislation, and could result in the United States being isolated in its position. Option 2: Defer on Legislation and Other Compulsory Actions This option could be pursued with two distinct goals in mind. Under option 2(a), the Administration would seek industry's voluntary assistance to modify their technology to address law enforcement's concerns. Under option 2(b), the Administration would accept the current status quo and not seek technical modifications, but would still ask providers to assist law enforcement in any way that they can within their current technological framework. In either case, these calls for assistance could be done publicly or privately, depending on the preferred engagement framework. Engagement Strategy and Timeline Z September: Outreach to foreign allies to assess their positions; signal to allies that the United States does not think legislation is the right way forward at this time; work with other governments to identify voluntary action by industry that would help to mitigate their concerns; outreach to U.S. industry to coordinate messaging. Z October: The President issues a statement disavowing legislation, but acknowledges the serious challenges posed by encryption for public safety and national security; secure coordinated statements of support or agreement from industry, civil society, and partner nations. Z October-November: Outreach to foreign allies in the wake of the statement to bring more allies in alignment with our position; outreach to U.S. industry to build voluntary cooperation in the absence of compulsion; if some allies persist in demanding access, consider whether the United States Government should highlight the difference in positions and the U.S. emphasis on privacy-protections. Z Post-November: Host public discussions on encryption policy with U.S. industry and foreign allies; should foreign allies demand and secure access, consider whether to call upon U.S. industry to provide the same access to the United States Government. Top Line Message Z The United States is not seeking legislation at this time to compel providers to change their products to enable government access to encrypted information pursuant to lawful process. Z At this point, legislation appears neither feasible or easily draftable. We need considerable public discussion before we would be in position to contemplate a legislative solution. Z However, we also cannot ignore the barriers that inaccessible encryption can create to law enforcement's critical need to investigate and prosecute criminals, including terrorists -- and the threat these barriers create for public safety. Impact on Policy Equities Public Safety and National Security. Does not reverse the long- term trend of increasing use of encrypted technologies by criminals, but could open potential avenues for cooperation with industry, without removing all law enforcement leverage (although working group participants disagree on whether calling for legislation will provide meaningful leverage). Some working group participants, however, have indicated they think it unlikely that industry will be willing to voluntarily modify their technology -- even if the threat of legislation is removed. This suggests that Option 2(a), in which the Administration would seek such technical modifications, is unlikely to succeed. However, unlike option 1, it retains flexibility on the approach should the public safety picture deteriorate to overtake competing equities. This approach would also make compromise with foreign governments not currently seeking legislation easier, but would still provide some help in resisting attempts by governments like China to use encryption policies to skew markets or oppress citizens by retaining strong public statements (e.g., “will not seek legislation”). Cybersecurity. Could encourage the use of more encryption, which would likely be good for cybersecurity. If a statement under this approach is perceived as positive but not sufficiently strong, however, this could be less successful in forestalling other nations from pursuing encryption-weakening measures. Also, because any access point to encrypted data increases risk, if government efforts to secure access are successful, this approach would reduce cybersecurity. However, the degree of impact on cybersecurity would vary significantly, and could be great or small, depending on the specific policy and technical decisions. Economic Competitiveness. Could have a positive, though incomplete, effect in removing barriers to Administration engagement with the tech sector on this issue. Removing the prospect of United States Government calls for legislation would likely have positive effects on international competitiveness. If long-term successful in gaining government access, this option would significantly harm economic competitiveness though the harm might be somewhat mitigated if there was broad international success in getting government access. Civil Liberties and Human Rights. Some will be dissatisfied with lack of outright disavowal, but may appreciate the pragmatic recognition of the practical limitations of a mandated approach. However, others almost certainly will continue to have concerns about government access to encrypted information being used to suppress dissident populations. Should some companies cooperate voluntarily and enable government access, the United States Government will need to accept that other nations -- including some repressive ones -- will use this access as well. Likely Reaction of Key Stakeholders Industry and Civil Society. Although industry and civil society may be less positive to this approach than a hardline disavowal, those communities would likely see this outcome as a solid win. However, further government pressure on industry to build access into their products would likely generate negative reactions. Therefore, it is likely that Industry and Civil Society would have a much better reaction to Option 2(b), which does not seek technical modifications, than to Option 2(a), which does. Other Governments. Allied governments that prefer an access regime may push back on the core U.S. message. However, those governments likely would react more positively to this approach than a complete disavowal of government access to encrypted information. Pros Z Responds to a key ask from industry, although industry might prefer a stronger statement. To the extent that industry is satisfied with the strength of the statement, this approach could help build cooperation without limiting broader policy options. Z Could help counter the narrative that the United States is seeking to expand its surveillance capability, and help repair trust in the United States and U.S. companies overseas. Z Could allow the United States to serve as a broker between pro-access allies (e.g., United Kingdom, France, and the Netherlands), and U.S. industry, which could mitigate some demands from foreign partners and ensure U.S. companies do not have to build multiple access regimes. Z If long-term successful in gaining government access, this option would help public safety and national security. Cons Z Could lead to disparate approaches by governments to the encryption issue, leading to more or different compliance regimes that U.S. companies will need to comply with, which could have a negative effect on their economic competitiveness. Z Does not provide an immediate solution to the challenges that the expanding use of encryption poses to law enforcement. Without a disavowal of legislation, many U.S. technology companies in the long term likely will not pursue voluntary design changes in products and services to enable access for law enforcement. Z If long-term successful in gaining government access, this option would harm cybersecurity, economic competitiveness and civil liberties and human rights. Option 3: Remain Undecided on Legislation or Other Compulsory Actions Engagement Strategy and Timeline Z September: Outreach to foreign allies to assess their positions; Private outreach to key industry leaders to argue that we need a more fulsome policy discussion before we decide how to proceed. Z October: Organize or participate in closed-door, small group discussions with U.S. industry to facilitate a more in-depth policy discussion. At the same time, organize bilateral and multilateral conversations with foreign partners to discuss the challenges and how to proceed. Z November: High-level Administration statement highlights initial discussions, outlines key challenges, distills a few key questions and principals, and announces a meeting or series of meetings (potentially both domestic and international) to discuss and debate these key questions. Z December: After the discussions, reassess our position and determine whether to take a position on encryption legislation or to continue to call for discussion. Top Line Message Z The President has said that there is no situation in which you wouldn't want strong encryption. Z At the same time, there are situations in which the government cannot obtain information related to a specific potential national security threat. If there is not a way of accessing that information and protecting the American public, then the Administration believes need to have a public debate. Z Having a broad discussion about this is essential -- over the next several months, [we or several entities] will host discussions on the challenges posed by encryption and how we can best address them. I would urge everyone to participate. Impact on Policy Equities Public Safety and National Security. This approach has, to date, failed to incentivize cooperation with law enforcement. It could in the long-term sway public opinion to create greater responsiveness -- particularly while the government retains the leverage resulting from the threat of legislation. On the other hand, silence on our part could encourage foreign governments to control the agenda. They might pressure U.S. industry to provide lawful access, which, if successful, would make it easier for us to require similar accommodations. This approach could also encourage companies to continue to aggressively pursue developing inaccessible encrypted services, and could make future cooperation significantly more challenging. Therefore, it is hard to predict the impact that this approach would have on public safety. Cybersecurity. Although it would not actively conflict with our message on the importance of encryption to cybersecurity, the uncertainty of public perceptions about the government's position could perpetuate distrust in encryption technologies related to the United States Government, and could undermine the effectiveness of the National Institute of Standards and Technology and other entities at a time when our cybersecurity agenda is already at risk. If long-term successful in gaining government access, this option would harm cybersecurity. - Economic Competitiveness. This approach does little to counter current distrust of the government by industry or foreign competitors. Further, by not taking a position on legislation in either direction, this approach does little to shape the reactions of other governments, increasing the risk that they will splinter into multiple camps, presenting U.S. industry with fractured markets. Therefore, this approach is likely harmful for economic competitiveness. Civil Liberties and Human Rights. Because this approach would likely not stop -- and could encourage -- other nations from demanding access, it is likely harmful for the Administration's efforts on civil liberties. Likely Reaction of Key Stakeholders Industry/Civil Society. Will likely continue to strongly object until the United States Government explicitly eschews compulsory legislation. As time passes, if we continue to fail to take a position, industry and civil society positions will likely harden as people perceive our silence as an implicit endorsement of legislation. As a result, the United States Government risks losing credibility if it fails to participate robustly in a public debate and with a unified voice. There is also a risk that industry chooses not to participate in meetings on the subject and escalates lobbying and public relations efforts. Other Governments. Allied governments that seek access will prefer this approach to either of the approaches that come out against compulsory legislation, and will likely see this as an opportunity for them to press for legislation themselves. Pros Z Provides flexibility to course correct and negotiate with U.S. industry and our foreign allies. Z Retains a key negotiating chip (the threat of legislation) in our engagement with industry (although few, if any, in industry find this threat credible). Z If other governments call for legislation and/or compel companies to change their encryption solutions to enable better access in the meantime, this could provide us with cover to use that same access. Cons Z Delays establishing a coherent Administration position, which could result in: (1) the United States being portrayed as increasingly ineffective/unable to resolve this challenge; (2) disputes among departments and agencies bleeding out into public discussion; (3) U.S. industry continuing to have challenges operating overseas (although it is unclear that a pro-encryption statement would by itself address this challenge); and (4) public and foreign government positions may harden in the absence of an affirmative U.S. position, limiting our ability to influence the global debate. Z Does not provide an immediate solution to the challenges that the expanding use of encryption poses to law enforcement. Moreover, this approach does not resolve the current policy debate. The United States Government likely will be faced with this same discussion again in several months' time. _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

2 1

key management is the crux
by coderman 18 Sep '15

18 Sep '15

On 9/17/15, Robert Hettinga <hettinga(a)gmail.com> wrote: > ... > Key management is hard. just get straight to it, and study the key management. tells you all you need to know about a product! ;P best regards,

2 1

Fwd: [tor-talk] victory at kilton library (grarpamp)
by Chris Magistrado 18 Sep '15

18 Sep '15

Very happy to have read this in this mailing list. This is a great with for Kilton, and I hope to get Tor Relays in SF Library. Though DPR being caught there might make it a bit more difficult... But I can't keep up with all these articles on mailing lists as efficiently as I'd like to. Does anyone know of a tool that makes reading mailing lists easier?

2 1

Fwd: [Cryptography] FBI: Weaker Encryption Is a Worthwhile Tradeoff for Law Enforcement Access to Data
by grarpamp 17 Sep '15

17 Sep '15

---------- Forwarded message ---------- From: Henry Baker <hbaker1(a)pipeline.com> Date: Thu, Sep 17, 2015 at 1:15 PM Subject: [Cryptography] FBI: Weaker Encryption Is a Worthwhile Tradeoff for Law Enforcement Access to Data To: cryptography(a)metzdowd.com FYI -- Easy for the FBI to say; they're not on the hook for potentially billions in damages from any breach. (Leaving aside the egregious Constitutional violations.) http://www.nationaljournal.com/s/72407/fbi-weaker-encryption-is-worthwhile-… FBI: Weaker Encryption Is a Worthwhile Tradeoff for Law Enforcement Access to Data Government officials sparred with privacy advocates over encryption, but acknowledged that “back doors” come with risks of intrusion. Kaveh Waddell @kavehewaddell September 15, 2015 The Justice Department and the FBI are continuing their campaign to convince the tech community and the public that weakening encryption to allow law enforcement to access encrypted communications and data has its risks, but that the drawbacks are outweighed by the security advantages. Amy Hess, the executive assistant director of FBI’s science and technology branch, said at a Christian Science Monitor discussion that allowing access to encrypted messages to anyone other than the sender or the receiver comes with “some risk” of intrusion. But because law enforcement must be able to read encrypted data and communication to do its job, the risk of third-party access is acceptable, Hess said, as long as it is minimized. The Justice Department—-and especially the FBI—-has clashed with the technology community over the agency’s demands that online platforms stay away from encryption practices that keep data private even from the platforms themselves. If the communications service cannot access the data sent across its servers, it cannot turn the data over to law enforcement. Law enforcement has called on tech companies to take the lead in developing an encryption standard that is both secure and accessible to authorities upon request. Last week, FBI Director James Comey said technology experts just need to “try harder” to find a solution. But experts maintain that such a standard is impossible to achieve, because any third-party key for unlocking encrypted data—-even if reserved for extreme circumstances—-will be vulnerable to hackers. A company that builds vulnerabilities into its encryption becomes an attractive target of attack to foreign governments, criminal hackers, and “drooling teenagers in basements,” said Matt Blaze, a noted cryptography expert and professor at the University of Pennsylvania. Because companies are increasingly turning to stronger encryption, the FBI is running out of tools to fight crime, Hess said Tuesday. A request for a wiretap—-one of the most powerful surveillance tools available to the FBI—-is a long and complicated process that requires an agent to supply an extensive affidavit stating that every less-intrusive method of surveillance had already been considered or applied, according to Kiran Raj, Senior Counsel to the Deputy Attorney General. But Hess said FBI agents will not apply for wiretaps if they think a suspect is using encrypted communication, because they are not willing to expend the time and cost of crafting the request if the odds of its success are slim. The FBI’s claim was largely met with a shrug from privacy advocates. “A warrant is not a right that the government has to get data,” said Jon Callas, CEO of Silent Circle, a company that builds encrypted communications platforms. “It is a right to perform a search, to attempt to get the data, and there may be a lot of reasons why it can’t get to it.” But even as privacy advocates clashed with law enforcement officials onstage over the form encryption should take in the tech community, the groups said they both have the same objective—security—in mind. “The polarization of this debate is really harmful,” Blaze said. “I think that in terms of the end goals, there’s a lot more common ground here than maybe the debate lets on.” _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

1 0

Linux Foundation' Linux workstation security checklist
by Georgi Guninski 17 Sep '15

17 Sep '15

>From the reg: http://www.theregister.co.uk/2015/08/31/harden_like_linux_foundation/ with journo title: Linux Foundation releases PARANOID internal infosec guide The document appears to be: https://github.com/lfit/itpol/blob/master/linux-workstation-security.md Linux workstation security checklist Troll-friendly appears this claim: UEFI boot mode is used (not legacy BIOS) (CRITICAL) UEFI and SecureBoot (ask RMS ;-) )

8 15

Fwd: [Cryptography] An Open Source Analysis of NSA Cryptologic Capabilities
by grarpamp 17 Sep '15

17 Sep '15

---------- Forwarded message ---------- From: Ryan Carboni <ryacko(a)gmail.com> Date: Wed, Sep 16, 2015 at 5:27 PM Subject: [Cryptography] An Open Source Analysis of NSA Cryptologic Capabilities To: cryptography(a)metzdowd.com Timeline of Events of Note 1992 - DES is broken cryptanalytically, although with an attack greater than the birthday bound 1993 - SHA released, based on MD4/MD5 1995 - SHA-1 revised, original SHA now called SHA-0 1998 - Skipjack Released 1999 - Impossible Differential Analysis breaks 31 of 32 rounds 2001 - SHA-2 released, by Threefish's standards, a 256-round hash function 2005 - SHA-1 is broken by a non-practical attack, spurs SHA-3 competition 2010 - Xie and Feng announce a one block collision on MD5, which they cannot release for _security reasons._ The occasional cryptanalytic success implies that the NSA is generally more advanced, but not always. Cryptanalytic success seems to be a random process, but it requires previous successes to exist. The NSA seems to be more advanced than the Chinese, and the Chinese vaguely more advanced than the remaining cryptographic community. This can probably be attributed to the fact that the NSA has more money, has the support of other SIGINT agencies in cryptanalysis, and thus probably have half the world's mathematicians. Thus perhaps the NSA has a 42% chance of getting a genuinely new cryptanalytic success, the Chinese a 33%, and the rest of the world a 25% chance. The evidence to support such a claim is that impossible differential analysis nearly broke Skipjack, although maybe the NSA was aware of it and had less concerns about security margins than we think. Further attacks on SHA-1 and SHA-2 spurred the SHA-3 competition. While it was reasonable for the civilian cryptographic community to be concerned, the fact that the NSA was concerned is telling. It was a result they did not predict, and they possibly thought further cryptanalysis could break those two hash functions. Fortunately there is a large body of research on the cost efficiency of research programs. While one may conclude that the NSA must perpetually be making leaps and bounds ahead of everyone through the virtues of compound interest, the answer is pleasanter. There is a diseconomy of scale when it comes to research. For instance, the Moon program or the Manhattan project could have been cheaper if more time was allotted for its completion. Given that the nature of research changes over time as the easiest results are exhausted, and that large organizations do have waste, it is safe to say that any gap between NSA and civilian cryptography will shrink by a small extent, year over year. _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

1 0