- cypherpunks - lists.cpunks.org

Re: [Cryptography] Opening Discussion: Speculation on "BULLRUN"
by Eugen Leitl 06 Sep '13

06 Sep '13

----- Forwarded message from Benjamin Kreuter <brk7bx(a)virginia.edu> ----- Date: Fri, 6 Sep 2013 11:28:22 -0400 From: Benjamin Kreuter <brk7bx(a)virginia.edu> To: John Kelsey <crypto.jmk(a)gmail.com> Cc: Jerry Leichter <leichter(a)lrw.com>, "cryptography(a)metzdowd.com List" <cryptography(a)metzdowd.com>, Jon Callas <jon(a)callas.org>, Peter Gutmann <pgut001(a)cs.auckland.ac.nz> Subject: Re: [Cryptography] Opening Discussion: Speculation on "BULLRUN" X-Mailer: Claws Mail 3.9.0 (GTK+ 2.18.9; i686-redhat-linux-gnu) On Fri, 6 Sep 2013 01:19:10 -0400 John Kelsey <crypto.jmk(a)gmail.com> wrote: > I don't see what problem would actually be solved by dropping public > key crypto in favor of symmetric only designs. I mean, if the > problem is that all public key systems are broken, then yeah, we will > have to do something else. But if the problem is bad key generation > or bad implementations, those will be with us even after we abandon > all the public key stuff. Not necessarily. A bad implementation of a block cipher will be probably spotted quickly if you need it to interoperate with a good implementation; a bad implementation of a public key cipher might interoperate just fine with good implementations. Public key systems often have parameters or requirements that affect security without affecting the correctness of encryption or decryption. ElGamal encryption might appear to work even though you are using a group where the DDH assumption does not hold. Elliptic curve systems have even more parameters that need to be set correctly for security. I am not saying that we should abandon public key cryptography, I am just saying that there a number of ways for public key systems to go wrong that do not apply to symmetric ciphers. Just my 2 cents, Ben -- Benjamin R Kreuter UVA Computer Science brk7bx(a)virginia.edu KK4FJZ -- "If large numbers of people are interested in freedom of speech, there will be freedom of speech, even if the law forbids it; if public opinion is sluggish, inconvenient minorities will be persecuted, even if laws exist to protect them." - George Orwell _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Re: [Cryptography] Opening Discussion: Speculation on "BULLRUN"
by Eugen Leitl 06 Sep '13

06 Sep '13

----- Forwarded message from arxlight <arxlight(a)arx.li> ----- Date: Fri, 06 Sep 2013 00:46:15 +0200 From: arxlight <arxlight(a)arx.li> To: cryptography(a)metzdowd.com Subject: Re: [Cryptography] Opening Discussion: Speculation on "BULLRUN" User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:17.0) Gecko/20130620 Thunderbird/17.0.7 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 What surprises me is that anyone is surprised. If you believed OpenBSD's Theo de Raadt and Gregory Perry back in late 2010, various government agencies (in this specific case the FBI- though one wonders if they were the originating agency) have been looking to introduce weaknesses wholesale into closed AND open source software and OS infrastructures for some time. Over a decade in his example. (See: http://marc.info/?l=openbsd-tech&m=129236621626462&w=2) Those of us old enough might marvel at the fact that going back to the late 1980s a huge dust up was caused by the allegations that Swiss firm "Crypto AG" introduced backdoors into their products at the behest of Western (read: United States and the BND) intelligence agencies, products that, at the time, were in widespread use by foreign governments who, one presumes, could not afford to field their own national cryptology centers to protect their own infrastructure (or were just lazy and seduced by a Swiss flag on the corporate domicile of Crypto AG). For the unwashed on the list, Wikipedia (and Der Spiegel) relate the story of (probably) hapless Crypto AG salesman Hans Buehler's 1992 arrest by the Iranian authorities after those allegations came to light, and the fact that Crypto AG paid a $1m ransom for him (but then later billed him for the $1m--you stay classy, Crypto AG). (See: http://en.wikipedia.org/wiki/Crypto_AG) But fear not. Governments and NGOs around the world will be pleased to know that Crypto AG lives on and continues to provide superior crypto and security solutions to foreign institutions of all kinds, including: "National security councils, national competence centres, e-government authorities, encryption authorities, national banks, ministries of defence, combined/joint commands, cyber commands, air forces, land forces, naval forces, special forces, military intelligence services, defence encryption authorities, ministries of foreign affairs and numerous international organisations, ministries of the interior, presidential guards, critical infrastructure authorities, homeland security authorities, intelligence services, police forces, and cyber forces." (See: http://www.crypto.ch/ - The inclusion of a shot of the Patrouille Suisse is an especially nice touch. I often drive by their offices in Steinhausen and was stunned to realize a few years ago that they are thriving- I can only imagine what the mortgage on that place costs). I expect that today many of us feel quite naive at being shocked by those penetration revelations (sorry, allegations) given that it seems highly probable now that anyone using any sort of Microsoft, Cisco, Google, Facebook, Yahoo, YouTube, Skype, AOL or Apple product has now been elevated to a collection priority that seemed confined to the Irans of the world in the 1990s and early 2000s. Perry wondered after the "unpardonable carelessness" of the NSA in giving 50,000 Snowden's access to a Powerpoint with all the Prism partners. I would argue that the NSA had good cause to think no one would notice or care given how many people who should know MUCH MUCH better still send Crypto AG scads of money. And going back to the days of toad.com hasn't this always been the story? Security is expensive. Most people (and some governments) are cheap. There's something about the present political climate in the United States that really interests me. Mere mention of the word "fascism" in any context other than sarcasm seems to brand one quite instantly as a tin-foil nutjob. Granted, I think the world "fascism" is as overused as the word "communism," but it bears mentioning that the usurpation of corporate entities and industry by the state to its own purposes is one of the classic tenants of fascism. I'm sure the list's readers sense where I'm going with this by now. It is hard to escape noticing that the NSA and its sister and orbital agencies have long since broken the traditional firewall and morphed themselves into domestic surveillance agencies. But the United States is late to the party here. In the world of finance it was long understood that certain state-dominated Russian firms were front-running a number of U.S. economic indicators prior to release. The rumor at the time was that this activity stopped cold after a security audit at the offending U.S. agencies. It's possible that the story was apocryphal, but I sort of doubt it. The economic intelligence apparatus of foreign intelligence services was the place to be if you wanted to find yourself in the good graces of your nation-state. (It's not an accident that Nikolay Patolichev, once the Soviet Union's Foreign Trade Minister, led the pack having been awarded the Order of Lenin twelve times). Of course, drafting otherwise independent-appearing private enterprises to the purposes of the state was popular then (the CIA would routinely interview U.S. businessmen and businesswomen after trips to jurisdictions of interest, and leverage their presence in foreign lands to their own advantage), and appears even more popular now. I won't belabor the point (made long ago and loudly by Kate Martin, only to fall upon decidedly deaf ears) that U.S. Courts generally refuse to examine the legality of collection of inculpatory evidence that is dropped into their lap- but it is important to at least acknowledge. Again, those of us shocked by those revelations (that evidence of domestic crimes "accidentally" collected by intelligence agencies would not necessarily be inadmissible) might feel awfully stupid now that it seems that the NSA expressly retains or passes on evidence of crimes unrelated to foreign intelligence activities or terrorism, and that the DEA (presumably among others) routinely engages what could fairly be called wholesale perjury to conceal the source of such evidence from courts and defense counsel when it is presented in support of criminal prosecutions. Finally returning to the original topic (please forgive the diversion) I think what is the most important element to understand is that what was once opportunistic synergy between national intelligence agencies and law enforcement agencies (here the War on Drugs was clearly the camel's nose) has become Fusion Center level integration- and bilateral information flow. Don't take my word for it, just read some of the Fusion Center testimony to various congressional committees- this is their bread and butter. Whichever asshole it was who first blamed 911 on a lack of cooperation between law enforcement and intelligence did a great deal of damage to the United States, but the trend was already pressing forward. What seems even more daunting is the new path of information from the bottom up. Now that you have local law enforcement humming around in cars collecting position and "metadata" on every license plate within 20m of a cop car prowling around on its beat, federal agencies are just a "Fusion Center query" away from access to... well... nearly everything. Look at this model (local collection at local expense re-purposed to federal exploitation), basic "exception processing," and the impact of the last decade and a half of "crony capitalism" and it is suddenly pretty hard not to credit BULLRUN with far more access than is public even given the latest revelations. Certainly, I don't run the NSA, but it doesn't take much more than a middling operations professional to tell you that exception processing is the key. Attacking this stuff is a question of priorities. Though experiment: What order of difficulty would you assign: Catch it in the clear. Compromising a vendor (including keys and users passwords- which might be reused). Injecting poor RNG (with vendor cooperation). Stealing a master key. Stealing a session key. Stealing a password to master or session key. Dictionary-attacking a password. Brute-forceing a weak password. Compromising an endpoint. Compromising a physical machine. Rubber-hoseing a password. Brute-forceing a strong password. Brute-forceing a weak key. Brute-forceing a strong key. Include in your analysis the cost of bending (or breaking) constitutional protections in the post-911 era (if any). Just look at the leverage an unwieldy, all-encompassing central government has on large US based firms (See e.g. Qwest post-cooperation refusal) and reflect on the bi-lateral Fusion Center model and then try to speculate that BULLRUN is overstated. I don't think you need a major factoring breakthrough to have FANTASTIC success in accessing the vast majority of (for example) SSL "protected" internet traffic. Anyone know what the market penetration of Microsoft IIS is? No, quite the contrary. I'll be amazed to find that the NYT piece isn't UNDERstated. To coin a phrase with reference to large and medium sized Western IT firms: They're all Crypto AG now. - - uni -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (Darwin) iQIcBAEBAgAGBQJSKQm3AAoJEAWtgNHk7T8QJOEQALI381nUcAHtALvqw/ac/k84 Tdn+Zd2+T54stDJPwJvOQXkeIJJKAURyhPgG+oGkXHbzjLnwTp6zpB9+et4pM5n7 PRc8X/9fAF8+X8EzDwQA90wYEZaAaSmnnaXi034faw0kKw0T0EDenDBgJ6J9fHGa DtsQECUlYenj2Evm0cY60Uz52/zJcXryWS5vRS4IU+i4ELCC3CbY6cX3MAT6Y6jc reh1B8Wf1fbmaXYR5Ws+Dd5VE4+9T2VkB2MZQN9T+/NbS9abe+lFVZkqjNx28RT4 OHC9VVqG0rGgn3a7tiLY2StmPSIxyV08LRmoz89CU0smdjb8pZDc+08V29anIH+Q E6xo+pJdc+SF34wHurCBRYqeH4TLowB2Bl/pLQ05FUFCcj6bIGO1lwf5sHaPpsKU 3mAC4HnQwlgd61epbLVbNcltp40nz5Soz/tfyyRM2T2VNdkxcriJUezKQRwu+t6d pCbQow9KEpcrdL3TlaQgcvNH0btU5HRnz7EJSrctL+FfZBKUj4jcRCUgASt6gRBd cnrzFcFAYoSgBBR/wJBxUATpzxMl+xZ74zPKJPdaIiA0XPd1F9ZIUe+mzDL+IxHT b08+gUgME9OMpjwToSkoopYL02AkK/GRirC14C2cXieC8JwjrevIoBQmCLUutNK6 XC4sOGrFZ7Z37sXL+1jT =4NbV -----END PGP SIGNATURE----- _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

<nettime> Report of Tangible Gifts Furnished by the Central Intelligence Agency
by Eugen Leitl 06 Sep '13

06 Sep '13

----- Forwarded message from nettime's avid gift giver <nettime(a)kein.org> ----- Date: Thu, 05 Sep 2013 23:36:35 +0200 From: nettime's avid gift giver <nettime(a)kein.org> To: nettime-l(a)mx.kein.org Subject: <nettime> Report of Tangible Gifts Furnished by the Central Intelligence Agency User-Agent: Mozilla/5.0 (X11; Linux i686; rv:17.0) Gecko/20130803 Thunderbird/17.0.8 Reply-To: a moderated mailing list for net criticism <nettime-l(a)mail.kein.org> Gifts to Federal Employees from Foreign Government Sources Reported to Employing Agencies in Calendar Year 2012 https://www.federalregister.gov/articles/2013/08/30/2013-21264/office- of-the-chief-of-protocol-gifts-to-federal-employees-from-foreign-gover nment-sources-reported#t-5 Agency: Central Intelligence Agency Revolving desk clock barometer/thermometer. Rec'd—1/8/2012. Est. Value—$500.00. Disposition—Pending Transfer to General Services Administration Silver double-spouted presentation teapot. Rec'd—1/19/2012. Est. Value—$500.00. Disposition—Pending Transfer to General Services Administration Bronzed composition of a soldier. Rec'd—1/20/2012. Est. Value—$500.00. Disposition—Pending Transfer to General Services Administration Bronze dagger blade, circa 930-586 BCE, with a silver wreath mount. Rec'd—1/26/2012. Est. Value—$500.00. Disposition—Pending Transfer to General Services Administration Steel kilij-style blade saber with copper mounted leather scabbard. Rec'd—2/2/2012. Est. Value—$700.00. Disposition—Pending Transfer to General Services Administration White Fendi wristwatch. Rec'd—2/10/2012. Est. Value—$1,000.00. Disposition—Pending Transfer to General Services Administration Large check Burberry cashmere scarf. Rec'd—2/10/2012. Est. Value—$395.00. Disposition—Pending Transfer to General Services Administration Silver Valentino wristwatch. Rec'd—2/10/2012. Est. Value—$500.00. Disposition—Pending Transfer to General Services Administration Large, framed lithograph of a seated figure, unsigned. Rec'd—2/10/2012. Est. Value—$500.00. Disposition—Pending Transfer to General Services Administration Maple Walnut two-string lahuta in a fitted walnut case. Rec'd—2/13/2012. Est. Value—$500.00. Disposition—Pending Transfer to General Services Administration Gold overlaid opaque white glass vase. Rec'd—3/12/2012. Est. Value—$500.00. Disposition—Pending Transfer to General Services Administration Coral studded filigree silver single-edge dagger. Rec'd—3/13/2012. Est. Value—$1,500.00. Disposition—Pending Transfer to General Services Administration Coral-studded filigree silver model of a four-masted ship. Rec'd—3/14/2012. Est. Value—$3,500.00. Disposition—Pending Transfer to General Services Administration Three Roman-Byzantine pottery vessels, circa 1st Century A.D.—5th Century B.C. Rec'd—3/19/2012. Est. Value—$750.00. Disposition—Pending Transfer to General Services Administration Silver model of a two-masted ship. Rec'd—4/16/2012. Est. Value—$1,500.00. Disposition—Pending Transfer to General Services Administration 6′ x 4′ silk rug, red ground with a red and navy blue border. Rec'd—4/23/2012. Est. Value—$1,200.00. Disposition—Pending Transfer to General Services Administration Bronze commemorative monument. Rec'd—5/9/2012. Est. Value—$500.00. Disposition—Pending Transfer to General Services Administration Single-edged steel saber in a brass mounted scabbard. Rec'd—6/5/2012. Est. Value—$500.00. Disposition—Pending Transfer to General Services Administration Silver and pink glazed coffee set. Rec'd—6/5/2012. Est. Value—$400.00. Disposition—Pending Transfer to General Services Administration Gilt metal hilted commemorative replica of Khan Kubrat's sword. Rec'd—6/6/2012. Est. Value—$500.00. Disposition—Pending Transfer to General Services Administration Silver mounted black leather scabbard and steel blade saber. Rec'd—6/7/2012. Est. Value—$1,500.00. Disposition—Pending Transfer to General Services Administration Silver presentation bowl. Rec'd—6/12/2012. Est. Value—$700.00. Disposition—Pending Transfer to General Services Administration Large golden falcon with a clock insert. Rec'd—7/9/2012. Est. Value—$1,500.00. Disposition—Pending Transfer to General Services Administration Small golden falcon with a clock insert. Rec'd—7/9/2012. Est. Value—$500.00. Disposition—Pending Transfer to General Services Administration Petrus Pomerol Grand Vin, 2001. Rec'd—7/9/2012. Est. Value—$1,700.00. Disposition—Pending Transfer to General Services Administration 6.8′ x 4.4′ silk rug, ivory with a light blue and beige background. Rec'd—7/10/2012. Est. Value—$8,000.00. Disposition—Pending Transfer to General Services Administration Rolex gentleman's stainless steel automatic chronometer wristwatch. Rec'd—7/10/2012. Est. Value—$6,500.00. Disposition—Pending Transfer to General Services Administration 5′ x 3′ silk rug, ivory background with beige and rose accents. Rec'd—8/2/2012. Est. Value—$700.00. Disposition—Pending Transfer to General Services Administration 6.6′ x 4.1′ silk rug, red background with a beige ground guard border. Rec'd—9/3/2012. Est. Value—$5,000.00. Disposition—Pending Transfer to General Services Administration Filigree silver scabbard with short sword. Rec'd—9/7/2012. Est. Value—$2,500.00. Disposition—Pending Transfer to General Services Administration Sheep's horn bow and arrow. Rec'd—11/11/2012. Est. Value—$500.00. Disposition—Pending Transfer to General Services Administration Woven fabric in a commemorative metal mounted red stained wood stand. Rec'd—2/21/2012. Est. Value—$500.00. Disposition—On Display in the Deputy Director's Suite for Official Use Only Cartier silver men's watch. Rec'd—2/21/2012. Est. Value—$9,000.00. Disposition—Pending Transfer to General Services Administration Black steel barrel and walnut stock shotgun. Rec'd—3/4/2012. Est. Value—$700.00. Disposition—Pending Transfer to General Services Administration Filigree silver double-edged short sword and scabbard. Rec'd—3/4/2012. Est. Value—$2,500.00. Disposition—Pending Transfer to General Services Administration One medium plate with semi-precious stones inlaid and one matching small plate. Rec'd—4/25/2012. Est. Value—$500.00. Disposition—On Display in the Deputy Director's Suite for Official Use Only Six silver commemorative medallions. Rec'd—6/17/2012. Est. Value—$500.00. Disposition—Pending Transfer to General Services Administration 8′ x 5′ silk rug, navy blue ground with three vertical rows of stylized flowers. Rec'd—6/19/2012. Est. Value—$2,000.00. Disposition—On Display in the Deputy Director's Suite for Official Use Only Hamilton Jazzmaster watch. Rec'd—7/9/2012. Est. Value—$1,500.00. Disposition—Pending Transfer to General Services Administration Filigree silver double-edged dagger. Rec'd—9/28/2012. Est. Value—$1,500.00. Disposition—On Display in the Deputy Director's Suite for Official Use Only Gold bullion presentation coin. Rec'd—2/1/2008. Est. Value—$2,000.00. Disposition—Pending Transfer to General Services Administration Two silk rugs, one brown and one yellow. Rec'd—6/1/2010. Est. Value—$800.00. Disposition—Pending Transfer to General Services Administration Cartier Roadster fountain pen. Rec'd—1/5/2012. Est. Value—$750.00. Disposition—Pending Transfer to General Services Administration 18″ brown wood grain M1 rifle. Rec'd—1/18/2012. Est. Value—$699.00. Disposition—Pending Transfer to General Services Administration Chess set and a silk rug. Rec'd—4/16/2012. Est. Value—$1,080.00. Disposition—Pending Transfer to General Services Administration Cartier ink pen. Rec'd—4/30/2012. Est. Value—$395.00. Disposition—Pending Transfer to General Services Administration Sterling silver cufflinks and silver fountain pen. Rec'd—5/25/2012. Est. Value—$800.00. Disposition—Pending Transfer to General Services Administration Baum and Mercier quartz watch. Rec'd—5/25/2012. Est. Value—$1,190.00. Disposition—Pending Transfer to General Services Administration Romanson Trofish edition Swiss wristwatch. Rec'd—6/15/2012. Est. Value—$1,000.00. Disposition—Pending Transfer to General Services Administration Romanson Trofish edition Swiss wristwatch. Rec'd—6/15/2012. Est. Value—$1,000.00. Disposition—Pending Transfer to General Services Administration Romanson Trofish edition Swiss wristwatch. Rec'd—6/15/2012. Est. Value—$1,000.00. Disposition—Pending Transfer to General Services Administration Romanson Trofish edition Swiss wristwatch. Rec'd—6/15/2012. Est. Value—$1,000.00. Disposition—Pending Transfer to General Services Administration Femini-T Tissot lady's watch. Rec'd—6/28/2012. Est. Value—$850.00. Disposition—Pending Transfer to General Services Administration Cartier ink pen. Rec'd—7/7/2012. Est. Value—$395.00. Disposition—Pending Transfer to General Services Administration Hamilton Jazzmaster Watch. Rec'd—7/9/2012. Est. Value—$1,500.00. Disposition—Pending Transfer to General Services Administration Hamilton stainless steel wristwatch with brown leather band. Rec'd—7/10/2012. Est. Value—$1,500.00. Disposition—Pending Transfer to General Services Administration Pierre Balmain Swiss quartz men's watch. Rec'd—7/16/2012. Est. Value—$700.00. Disposition—Pending Transfer to General Services Administration Raymond Weil watch. Rec'd—7/18/2012. Est. Value—$750.00. Disposition—Pending Transfer to General Services Administration EOS 60D SLR camera with 18-135MM lens. Rec'd—7/27/2012. Est. Value—$1,150.00. Disposition—Pending Transfer to General Services Administration Rolex gold and stainless steel wristwatch. Rec'd—7/30/2012. Est. Value—$14,000.00. Disposition—Pending Transfer to General Services Administration Silk rug. Rec'd—9/16/2012. Est. Value—$500.00. Disposition—Pending Transfer to General Services Administration Rado Centrix men's wristwatch. Rec'd—10/18/2012. Est. Value—$1,250.00. Disposition—Pending Transfer to General Services Administration Six encased displays with various historical items including rare stamps, currencies, and prayer books. Rec'd—11/6/2012. Est. Value—$6,000.00. Disposition—Pending Transfer to General Services Administration 3′ x 5′ silk rug. Two bottles of cologne. An iPhone 5. Rec'd—12/20/2012. Est. Value—$3,375.00. Disposition—Pending Transfer to General Services Administration Chopard cufflinks. Chopard ballpoint pen. Chopard money clip. Rec'd—12/29/2012. Est. Value—$1,000.00. Disposition—Pending Transfer to General Services Administration # distributed via <nettime>: no commercial use without permission # <nettime> is a moderated mailing list for net criticism, # collaborative text filtering and cultural politics of the nets # more info: http://mx.kein.org/mailman/listinfo/nettime-l # archive: http://www.nettime.org contact: nettime(a)kein.org ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

FBI OpenBSD Backdoors and RSA Cipher Vulnerability
by John Young 06 Sep '13

06 Sep '13

12 January 2012. FBI OpenBSD Backdoors and RSA Cipher Vulnerability: <http://cryptome.org/2012/01/0032.htm>http://cryptome.org/2012/01/0032.htm

1 0

Re: [Cryptography] Opening Discussion: Speculation on "BULLRUN"
by Eugen Leitl 06 Sep '13

06 Sep '13

----- Forwarded message from Phillip Hallam-Baker <hallam(a)gmail.com> ----- Date: Thu, 5 Sep 2013 16:58:07 -0400 From: Phillip Hallam-Baker <hallam(a)gmail.com> To: "Perry E. Metzger" <perry(a)piermont.com> Cc: "cryptography(a)metzdowd.com" <cryptography(a)metzdowd.com> Subject: Re: [Cryptography] Opening Discussion: Speculation on "BULLRUN" On Thu, Sep 5, 2013 at 4:41 PM, Perry E. Metzger <perry(a)piermont.com> wrote: > On Thu, 5 Sep 2013 15:58:04 -0400 "Perry E. Metzger" > <perry(a)piermont.com> wrote: > > I would like to open the floor to *informed speculation* about > > BULLRUN. > > Here are a few guesses from me: > > 1) I would not be surprised if it turned out that some people working > for some vendors have made code and hardware changes at the NSA's > behest without the knowledge of their managers or their firm. If I > were running such a program, paying off a couple of key people here > and there would seem only rational, doubly so if the disclosure of > their involvement could be made into a crime by giving them a > clearance or some such. > Or they contacted the NSA alumni working in the industry. > 2) I would not be surprised if some of the slow speed at which > improved/fixed hashes, algorithms, protocols, etc. have been adopted > might be because of pressure or people who had been paid off. > > At the very least, anyone whining at a standards meeting from now on > that they don't want to implement a security fix because "it isn't > important to the user experience" or adds minuscule delays to an > initial connection or whatever should be viewed with enormous > suspicion. Whether I am correct or not, such behavior clearly serves > the interest of those who would do bad things. > I think it is subtler that that. Trying to block a strong cipher is too obvious. Much better to push for something that is overly complicated or too difficult for end users to make use of. * The bizare complexity of IPSEC. * Allowing deployment of DNSSEC to be blocked in 2002 by blocking a technical change that made it possible to deploy in .com. * Proposals to deploy security policy information (always send me data encrypted) have been consistently filibustered by people making nonsensical objections. 3) I would not be surprised if random number generator problems in a > variety of equipment and software were not a very obvious target, > whether those problems were intentionally added or not. > Agreed, the PRNG is the easiest thing to futz with. It would not surprise me if we discovered kleptography at work as well. > 4) Choices not to use things like Diffie-Hellman in TLS connections > on the basis that it damages user experience and the like should be > viewed with enormous suspicion. > > 5) Choices not to make add-ons available in things like chat clients > or mail programs that could be used for cryptography should be viewed > with suspicion. I think the thing that discouraged all that was the decision to make end user certificates hard to obtain (still no automatic spec) and expire after a year. -- Website: http://hallambaker.com/ _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Re: [Cryptography] Opening Discussion: Speculation on "BULLRUN"
by Eugen Leitl 06 Sep '13

06 Sep '13

----- Forwarded message from "Perry E. Metzger" <perry(a)piermont.com> ----- Date: Thu, 5 Sep 2013 16:41:18 -0400 From: "Perry E. Metzger" <perry(a)piermont.com> To: cryptography(a)metzdowd.com Subject: Re: [Cryptography] Opening Discussion: Speculation on "BULLRUN" X-Mailer: Claws Mail 3.9.0 (GTK+ 2.24.20; x86_64-apple-darwin12.4.0) On Thu, 5 Sep 2013 15:58:04 -0400 "Perry E. Metzger" <perry(a)piermont.com> wrote: > I would like to open the floor to *informed speculation* about > BULLRUN. Here are a few guesses from me: 1) I would not be surprised if it turned out that some people working for some vendors have made code and hardware changes at the NSA's behest without the knowledge of their managers or their firm. If I were running such a program, paying off a couple of key people here and there would seem only rational, doubly so if the disclosure of their involvement could be made into a crime by giving them a clearance or some such. 2) I would not be surprised if some of the slow speed at which improved/fixed hashes, algorithms, protocols, etc. have been adopted might be because of pressure or people who had been paid off. At the very least, anyone whining at a standards meeting from now on that they don't want to implement a security fix because "it isn't important to the user experience" or adds minuscule delays to an initial connection or whatever should be viewed with enormous suspicion. Whether I am correct or not, such behavior clearly serves the interest of those who would do bad things. 3) I would not be surprised if random number generator problems in a variety of equipment and software were not a very obvious target, whether those problems were intentionally added or not. 4) Choices not to use things like Diffie-Hellman in TLS connections on the basis that it damages user experience and the like should be viewed with enormous suspicion. 5) Choices not to make add-ons available in things like chat clients or mail programs that could be used for cryptography should be viewed with suspicion. Perry -- Perry E. Metzger perry(a)piermont.com _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

[Cryptography] Sabotaged hardware (was Re: Opening Discussion: Speculation on "BULLRUN")
by Eugen Leitl 06 Sep '13

06 Sep '13

----- Forwarded message from "Perry E. Metzger" <perry(a)piermont.com> ----- Date: Fri, 6 Sep 2013 10:25:17 -0400 From: "Perry E. Metzger" <perry(a)piermont.com> To: Jerry Leichter <leichter(a)lrw.com> Cc: cryptography(a)metzdowd.com Subject: [Cryptography] Sabotaged hardware (was Re: Opening Discussion: Speculation on "BULLRUN") X-Mailer: Claws Mail 3.9.0 (GTK+ 2.24.20; x86_64-apple-darwin12.4.0) On Thu, 5 Sep 2013 22:31:50 -0400 Jerry Leichter <leichter(a)lrw.com> wrote: > For example, at > http://www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campa…, > the following goal appears for FY 2013 appears: "Complete enabling > for [redacted] encryption chips used in Virtual Public Network and > Web encryption devices". The Times adds the following note: > "Large Internet companies use dedicated hardware to scramble > traffic before it is sent. In 2013, the agency planned to be able > to decode traffic that was encoded by one of these two encryption > chips, either by working with the manufacturers of the chips to > insert back doors or by exploiting a security flaw in the chips' > design." This is troubling. It implies that there are widely used crypto accelerators in use at large organizations that intentionally harm the security of users. Random number generator flaws would seem like an obvious possibility here. This is especially disturbing because other actors can now start doing teardowns on a wide variety of such devices looking to find the flaws so they can themselves attack the traffic in question. Perry -- Perry E. Metzger perry(a)piermont.com _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Re: [pfSense] [liberationtech] NSA Laughs at PCs, Prefers Hacking Routers and Switches
by Eugen Leitl 06 Sep '13

06 Sep '13

----- Forwarded message from Jim Thompson <jim(a)netgate.com> ----- Date: Thu, 5 Sep 2013 15:07:00 -0500 From: Jim Thompson <jim(a)netgate.com> To: pfSense support and discussion <list(a)lists.pfsense.org> Subject: Re: [pfSense] [liberationtech] NSA Laughs at PCs, Prefers Hacking Routers and Switches X-Mailer: Apple Mail (2.1786.1) Reply-To: pfSense support and discussion <list(a)lists.pfsense.org> Read ‘em and weep: http://www.nytimes.com/2013/09/06/us/nsa-foils-much-internet-encryption.htm… My take is that most places don’t enable PFS (because it’s “hard”) in IPSec. In theory, Transport Layer Security (TLS) can choose appropriate ciphers since SSLv3, but in everyday practice many implementations have refused to offer PFS or only provide it with very low encryption grade. http://www.ietf.org/mail-archive/web/tls/current/msg02134.html I don’t know the situation on pfSense (I’ve not gone to look, as I’m elbows deep in an IPv6 IPsec issue atm.) In theory, OpenSSL supports perfect forward secrecy using elliptic curve Diffie–Hellman since version 1.0. Do we set "enable-ec_nistp_64_gcc_128” on pfSense? Do we enable the DHE-RSA-AES128-SHA cipher suite? How about ECDHE-RSA-AES128-SHA? Do we build the 64-bit optimized version for 64-bit images? http://vincent.bernat.im/en/blog/2011-ssl-perfect-forward-secrecy.html Anyway, the ‘evidence’ is that there is some fundamental weakness in DH, since the NSA itself recommends EC crypto rather than DH in their “Suite B” offering. http://www.nsa.gov/ia/programs/suiteb_cryptography/ One would think that pfSense would follow suit. _______________________________________________ List mailing list List(a)lists.pfsense.org http://lists.pfsense.org/mailman/listinfo/list ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Re: [liberationtech] NYTimes and Guardian on NSA
by Eugen Leitl 06 Sep '13

06 Sep '13

----- Forwarded message from Daniel Colascione <dancol(a)dancol.org> ----- Date: Thu, 05 Sep 2013 12:48:53 -0700 From: Daniel Colascione <dancol(a)dancol.org> To: liberationtech <liberationtech(a)lists.stanford.edu> Cc: Richard Brooks <rrb(a)acm.org> Subject: Re: [liberationtech] NYTimes and Guardian on NSA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:17.0) Gecko/20130801 Thunderbird/17.0.8 Reply-To: liberationtech <liberationtech(a)lists.stanford.edu> On 9/5/13 12:32 PM, Richard Brooks wrote: > Latest articles: > > http://www.nytimes.com/2013/09/06/us/nsa-foils-much-internet-encryption.htm… > > http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-secu… > > > I find most of this (if not all) silly. They seem shocked that the > NSA does cryptanalysis. It would be nice if the newspapers had > people with some knowledge of the domain writing articles. > There is a massive difference between cryptanalysis and decade-long, well-funded, and top-secret program to subtly weaken international cryptographic protocols and sabotage industry implementations. -- Liberationtech is a public list whose archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Spy Files: New WikiLeaks docs expose secretive, unruly surveillance industry
by Eugen Leitl 06 Sep '13

06 Sep '13

http://rt.com/news/wikileaks-spy-files-release-402/ Spy Files: New WikiLeaks docs expose secretive, unruly surveillance industry Published time: September 04, 2013 16:06 Edited time: September 05, 2013 10:00 Get short URL Screenshot from a leaked documentScreenshot from a leaked document Tags Central Asia, Information Technology, Intelligence, Internet, Middle East, WikiLeaks The growing surveillance industry complex is providing governments with increasingly sophisticated spying software to track and control their citizens, the latest documents obtained by the pro-transparency group, WikiLeaks reveal. A trove of documents, outlining the activities of dozens of companies operating in the ever-expanding electronic snooping industry, were made available by the pro-transparency group on Wednesday. ‘Lawful interception’, mass monitoring, network recording, signals and communication intelligence, and tactical interception devices were among the services and products provided by a litany of Western based firms, as outlined in hundreds of pages of documents covering trade brochures, internal memos, and invoices. "WikiLeaks' Spy Files #3 is part of our ongoing commitment to shining a light on the secretive mass surveillance industry. This publication doubles the WikiLeaks Spy Files database,” the accompanying press release cites Julian Assange. “The WikiLeaks Spy Files form a valuable resource for journalists and citizens alike, detailing and explaining how secretive state intelligence agencies are merging with the corporate world in their bid to harvest all human electronic communication." One 2011 document showed how companies such as UK-based Gamma Group, German-based Desoma and Swiss-based Dreamlab are working in concert to “create Telecommunications Intelligence Systems for different telecommunications networks to fulfill the customers’ needs” regarding “massive data interception and retention.” In March, Gamma International, which is a subsidiary of Gamma group, made Reporters Without Borders 'Corporate Enemies of the Internet' list for 2013, which singled out five “digital mercenaries” who sell their surveillance technology to authoritarian regimes. The firm’s FinFisher Suite (which includes Trojans to infect PCs, mobile phones, other consumer electronics and servers, as well as technical consulting), is considered to be one of the most sophisticated in the world. During the search of an Egyptian intelligence agency office in 2011, human rights activists found a contract proposal from Gamma International to sell FinFisher to Egypt. Bill Marczak, a computer science doctoral candidate at the University of California, helped investigate the use of FinFisher spyware against activists and journalists in Bahrain in 2012, as well as in other states. “We don’t have any sort of contracts, so that we could see financial dealings between companies and these governments. The only indications that we have as to where the spyware has been used are based on the research. In cases that we’ve seen the spyware has been targeted against activists and journalists in a particular country. We’ve been scanning the internet looking for this technology. So we found, as I said, spywares in Bahrain. We saw it being targeted against Bahraini journalists and activists last year. We’ve also found servers for the spyware in a number of other countries, such as Turkmenistan, Qatar, Ethiopia,” Marczak told RT. RT was the only Russian broadcaster that collaborated with WikiLeaks in this investigation, which also brought into the spotlight other companies including Cobham, Amees, Digital Barriers, ETL group, UTIMACO, Telesoft Technologies and Trovicor. Trovicor, incidentally, also features among Reporters Without Borders “digital mercenaries.” The firm, whose monitoring centers are capable of intercepting phone calls, text messages, voice over IP calls (like Skype) and Internet traffic, has also been accused by of helping Bahrain imprison and torture activists and journalists. Screenshot from a leaked documentScreenshot from a leaked document While a smoking gun in the form of government contracts or invoices was not forthcoming, internal documents discovered by WikiLeaks do confirm that the firm’s dealings with autocratic states. In a December 2010 correspondence between Nicolas Mayencourt, the CEO of Dreamlab Technologies AG, and Thomas Fischer from Gamma Group’s Germany-based branch Gamma International GmbH, a “quotation concerning the Monitoring system for iproxy (infection proxy)-project” is provided for an unspecified end customer in Oman. One concern involved keeping the client [Oman] aware of any changes made to the proxy [intermediary] server infected with their software for the sake of culling information from select targets. “During the integration tests in Oman in September 2010 the end customer figured out that not all of the components of the iproxy infrastructure are under their full control. It is, for example possible that changes of the Oman-network may occur without their knowledge. Thus, it might occur that ISPs [Internet service providers] may modify some of the current configuration. Therefore, the question arose whether it is possible to identify such a modification in the network setup by monitoring the whole iproxy infrastructure. >From this point of view, a request for an efficient and user-friendly monitoring of the iproxy infrastructure including all components of the systems was derived. This requirement is discussed and a proposal for solution is described in this offer.” The infection process as was conducted on-site in Oman in 2010 can be conducted in two different variants, as described in a separate document, ‘System Manual Project O’, prepared for the Gulf client. The first is described as a binary infection, whereby binaries (non-text computer files) are infected after being downloaded by the configured target. “In order to do this, the software analyzes the data streams on the NDPs [network data processors] at both of the Internet exchanges (IX). As soon as a matching type of binary is downloaded, the infection mechanism is initiated, then it attaches loader and payload (trojan) to the binary.” Screenshot from a leaked documentScreenshot from a leaked document The second method is described as update infection, which “works by sending counterfeit server responses to predefined applications (for example iTunes, Winamp, OpenOffice and SimpleLite), when they are searching for updates.” Data can be captured both through traditional public switch telephone networks (PSTN), mobile providers and internet protocol suites across a range of devices. The user’s information, including his or her IP address, user name, [cell] phone number, the date time and identity of the person being communicated with, and the method or protocol (mail, WWW, Skype, chat, voice, fax, and SMS) are all up for grabs. Upon being captured, the data is stored in a ‘Data Warehouse’ and “retrieved on command.” Quotations for the project, enumerated in Swiss francs (CHF), are broken down in multiple categories: Monitoring and alarming 83,355.00 Services provided by Dreamlab 34,400.00 Training 5,400.00 Annual solution maintenance 24,000.00 Redundant monitoring implementation 57,955.00 Services provided by Dreamlab for redundancy 5,760.00 Annual solution maintenance for redundant system 12,000.00 Note: 1 CHF = 1.06720 USD Although such software does have legitimate applications for law enforcement, it can easily be used to stifle civil society, as Marczak argues was the case in Bahrain. Apart from journalists and activists, he noted that in the Malaysia and Ethiopia, members of the political opposition were apparently being targeted as well. One piece of FinFisher spyware discovered, for example, contained details relating to the upcoming Malaysian elections. “You couldn’t say exactly who was targeted against, but the use of election-related content suggests politically motivated targeting. We also found a sample of this spyware that appeared to be targeted at activists in Ethiopia. The spyware contained a picture of Ethiopian opposition leaders that was displayed when the user opened it. By opening the picture the user copied the spyware,” he said.

5 5