- cypherpunks - lists.cpunks.org

RC4 Forevar! [was: RC4 is dangerous in ways not yet known - heads up on near injection WPA2 downgrade to TKIP RC4]
by coderman 13 Oct '14

13 Oct '14

On 9/22/14, coderman <coderman(a)gmail.com> wrote: > ... >> Please elaborate. TKIP has not been identified as a ‘active attack’ >> vector. hi nymble, it appears no one cares about downgrade attacks, like no one cares about MitM (see mobile apps and software update mechanisms). [0] > to be specific about the problems, in case not concise enough above: > 0. lack of a way to enforce TKIP disable. > 1. lack of visual signal of TKIP downgraded security in WPA2 to users. > 2. insult to injury with "unspecified" bozofail TKIP transition to ON > flaws in some hw. i would like to clarify that #0 is a driver domain behavior, your "suggestions" from userspace via wpa-supplicant are meaningless against the motivated. also, the definitive paper at http://www.isg.rhul.ac.uk/tls/ still insists, "For WPA/TKIP, the only reasonable countermeasure is to upgrade to WPA2." which is either incompetently incorrect, or intentional indirection. best regards, 0. "no one cares" - this is not strictly true; people care a bit more if you have done significant and detailed analysis of the sort that eats lives by the quarter-year. i have long since quit giving freebies freely, and instead pick my disclosures carefully with significant limitations. perhaps i should re-state: "no one working in the public interest cares". there is a roaring business for silence and proprietary development, and these people care quite a bit.

1 1

Re: caring harder requires solving once for the most demanding threat model, to the benefit of all lesser models
by coderman 13 Oct '14

13 Oct '14

On 10/13/14, ianG <iang(a)iang.org> wrote: > ... > your welcome ;-) a considered and insightful response to my saber rattling diatribe. i owe you a beer, sir! > Ah well, there is another rule we should always bring remember: > > Do not use known-crap crypto. > > Dual_EC_DRBG is an example of a crap RNG. For which we have data going > back to 2006 showing it is a bad design. let's try another example: Intel RDRAND or RDSEED. depend on it as the sole source of entropy? in theory, the only attacks that would allow to manipulate the output are outside scope. (e.g. the data shows them as nation state level hypothetical) is "depending on a single entropy source" the "known-crap" part? or is it the un-verifiable output of this specific source that is "known-crap"? (or am i overreaching, and you advocate direct and sole use of RDRAND everywhere? :) > Others in this category include: RC4, DES, MD5, various wifi junk > protocols, etc. if RC4 is known-crap, then how is a downgrade to known-crap not a problem? >> Q: 'Should I switch away from 1024 bit strength RSA keys?' > > I agree with that, and I'm on record for it in the print media. I am > not part of the NIST lemmings craze. > > So, assuming you think I'm crazy, let's postulate that the NSA has a box > that can crunch a 1024 key in a day. What's the risk? > ... > WYTM? The world that is concerned about the NSA is terrified of open > surveillance. RSA1024 kills open surveillance dead. consider a service provider that i use, like Google, with a hypothetical 1024 bit RSA key to secure TLS. they don't use forward secrecy, so recovery of their private key can recover content. what is the risk that a Google-like provider key could be attacked? i have no idea. but certainly more than my risk as a single individual. regarding open surveillance, this is a potential mechanism for it despite the appearance of privacy. at what point does an insufficient key length become "known-crap" vs. needless lemming craziness? said another way, "the data" is only useful if you or those you trust is not an outlier. in addition, "the data" is only retrospective; by definition class breaks and novel attacks are not worth considering until they become known and used. does the difficulty in migrating away from a new-known-crap mistake factor into how you draw the line? > Actually, I thought there was data on this which shows that auto-update > keeps devices more secure, suffer less problems. I think Microsoft have > published on this, anyone care to comment? microsoft updates are not the standard upon which to measure all application updates. the vast majority don't check certificates or secure digests at all, hence the hundreds of vectors in evilgrade that provide a seamless path from MitM at coffee shop to administrator on your laptop. is the "not using crypto" or "not using crypto right" parts the "known-crap" piece of this equation? is the MitM or DNS poison dependency "low risk" enough per the data that the "known crap" of the update itself no longer matters? --- thank you taking the time to address these points in depth so that i can better understand your reasoning. this is an interesting discussion because i arrived at the opposite conclusion: given the reasonableness of long keys and secure designs, and in view of ever improving attacks, the best course of action is to solve _once_ for the hardest threat model, so that you don't rely on past indicators to predict future security and all lesser threat models can benefit from the protection provided. i dream of a future where the sudden development of very many qubit computers does not cause a panic to replace key infrastructure or generate new keys. where the protocols have only one mode, and it is secure. where applications don't need to be updated frequently for security reasons. where entire classes of vulnerabilities don't exist. in short, i dream of a future where the cooperative solution to the most demanding threat models is pervasive, to the benefit of all lesser models, now and into the future. best regards, P.S. part of the context for this bias is my perspective as developer of fully decentralized systems. any peer in such a system is potentially the highest profile target; the threat model for any peer the most demanding threat model any one peer may operate under. the usual "client vs. server", or "casual vs. professional" distinctions in threat models no longer apply...

1 0

Activism questions, please reply to thread by e-mail or if you prefer by bitmessage [included]
by Odinn Cyberguerrilla 13 Oct '14

13 Oct '14

Hello, Recent events have led me to seriously consider a fast. In protest culture there has been a difference between how hunger strikes and fasts are looked at. The difference is explained well enough here: http://wagingnonviolence.org/feature/rules-hunger-striking-radicals/ I would like to get your opinions pro or con. Please feel free to tell me just how important it is that I should consider it or just how ridiculous it is that I am even bringing it up. I value your opinion. However, I would greatly appreciate receiving your opinion, no matter how much or how little you have to say, within a day's time from when I am sending this message. See also: http://www.wikihow.com/Go-on-a-Hunger-Strike-Safely Causes that most interest me are related to the interest of the USA police state to militarize and surveill at home while attempting to engage in war after war overseas without end, The coercive and violent methods that the US government and governments like it (e.g. Russia, China, and many others) around the globe use in order to forcibly extract through taxation from residents so that they can wage war profitably, The social problems inherent in unquestioning compliance with nationality and laws attached to such notions, and the alternatives which could be presented through decentralization of giving systems which are more similar to those found in nature. I realize that if I do this I'm going to have to distill a cause and make it palatable and reduce it basically to one so that it's clear and to the point (in addition to have clear and obvious targets for who is the person or persons who I mean to draw attention to by way of the fast, etc.) If you'd rather not reply by e-mail, here's a public bitmessage address associated with this issue that any of you can reply to: BM-2cWLvGzKgX9jdQ5u43D6JEDgfnFhUzrj33 Details of bitmessage installation regardless of whatever operating system you have are here: https://bitmessage.org (or) https://bitmessage.org/wiki/Main_Page I look forward to your advice. Respectfully, Odinn

3 2

Re: caring requires data
by coderman 13 Oct '14

13 Oct '14

On 10/13/14, ianG <iang(a)iang.org> wrote: > ... > No, and I argue that nobody should care about MITM nor downgrade attacks > nor any other theoretical laboratory thing. I also argue that people > shouldn't worry about shark attacks, lightning or wearing body armour > when shopping. > ... > What distinguishes what we should care about and what we shouldn't is > data. And analysis of that data. indeed. thanks for showing me the light, ian! Q: 'Should I disable Dual_EC_DRBG?' A: "The data shows zero risk of an attacker compromising the known vulnerability of a specially seed random number generator. Do not change; keep using Dual_EC_DRBG!" Q: 'Should I switch away from 1024 bit strength RSA keys?' A: "The data shows zero risk of an attacker compromising the known vulnerability of a insufficiently large RSA key as the cost is prohibitive and no publicly demonstrated device exists. Do not change to larger keys; keep using 1024 bit RSA!" Q: 'Should I worry about the auto-update behavior of my devices or computers?' A: "The data shows minimal risk of an attacker compromising your systems via this method. Don't bother changing your vulnerable auto update any where any time any how; you're probably safe!" it's all so easy now... :)

1 0

Insecurity Forevar! [was: Mu [prior to that: How worse is the Shellshock bash bug than Heartbleed?]]
by coderman 13 Oct '14

13 Oct '14

On 10/5/14, Georgi Guninski <guninski(a)guninski.com> wrote: > ... > ok, i won't argue :) one last beating of this dead horse: "The recommended practice of blowing away the environment before calling a shell goes back to Garfinkel & Spafford's 1991 seminal Practical Unix Security (or at least the 1996 2nd ed., Practical Unix & Internet Security). It's in there TWICE it is so basic." - https://docstrange.livejournal.com/95142.html also relevant, "Dear clueless assholes: stop bashing bash and GNU... You people are pieces of shit. I am disgusted..." - https://weev.livejournal.com/409835.html "These bugs that happen, these mistakes in software that lead to vulnerabilities, they aren’t one-off problems. They’re systemic. There are patterns to them and patterns to how people take advantage of them. But it isn’t in any one particular company’s interest to dump a pile of their own resources into fixing even one of the problems, much less dump a pile of resources into an engineering effort to fight the pattern... They’ve got even less incentive to fix entire classes of vulnerabilities across the board. Same goes for everybody else in the game... it’s worse than a tragedy of the commons, it’s a race to the bottom." - https://medium.com/message/how-i-explained-heartbleed-to-my-therapist-4c1db…

2 1

Re: [Cryptography] Cryptography, backdoors and the Second Amendment
by Lodewijk andré de la porte 12 Oct '14

12 Oct '14

On Oct 12, 2014 6:04 PM, "Benjamin Kreuter" <brk7bx(a)virginia.edu> wrote: > > On Sun, 2014-10-12 at 04:28 +0200, Lodewijk andré de la porte wrote: > > > > I never understood this though! Doesn't it significantly weaken the second > > amendment? What could weigh up to constitutional values, and who is > > authorized to judge? Please don't say politicians... > > Interpretation is an important component of any law, including the > constitution. Laws are not software, courts are not computers, and > nobody would want to live in a society where the law is completely > inflexible. Laws tend to be written non-precisely, and even the bill of > rights is not so precisely as to require no interpretation at all. Yes and no, precision of language can be greater and smaller. It's much overlooked. I find especially computer-related law lacks precision. I also find that precise law is essential, lest it is not law at all. We also see that the "intention of the lawmaker" is an important factor. Finally, we even see laws that depend upon interpretation yet to be given by judges that may oppose directly. Often we see "fundamental law", eg human rights, opposing more readily changed law. And the readily changed law wins easily if polticians interpreted laws in ways that make it simple. > As for the authority to judge, the answer is that "judges" have that > authority. Courts exist to settle disputes about the meaning of the law > and whether or not it is being followed. I would say that some kind of > court system is necessary for the rule of law. Ah, but that wasn't the question. A judge must always give precedence to constitutional laws. How could a judge explain the second amendment such that machine guns could be illegal? I suspect that ruling should be exceedingly controversial and dangerous.

1 0

Re: [Cryptography] Cryptography, backdoors and the Second Amendment
by Lodewijk andré de la porte 12 Oct '14

12 Oct '14

On Oct 11, 2014 7:55 PM, "Benjamin Kreuter" <brk7bx(a)virginia.edu> wrote: > > On Fri, 2014-10-10 at 00:36 +0100, Alfie John wrote: > > > As the US State Department classifies cryptography as a munition, > > shouldn't the use of cryptography be protected under the 2nd Amendment? > > 1. The second amendment is not without limits. You cannot possess a > machine gun without a license, for example. The second amendment is not > a free pass to possess or distribute arms. I never understood this though! Doesn't it significantly weaken the second amendment? What could weigh up to constitutional values, and who is authorized to judge? Please don't say politicians... > 2. The classification is only relevant for exporting a product from the > USA. Nothing stops you from possessing or distributing cryptography > within the US. Which is probably the only reason for the classification anyway (that and how useful it is!). > Really though, that classification is an anachronism that predates PCs > and the Internet. Instead of invoking it (which is a kind of > endorsement), we should be trying to get rid of it entirely. We need to > make the case that cryptography is not some kind of military device, but > a necessity in a computerized society as a low-cost safeguard against > various abuses and crimes. Calling cryptography "munitions" is as > absurd as calling combination locks "munitions," and that point needs to > be driven home. It makes little difference. This is about current law. I'm sure the world would be a better place if we left it to the right people, but who could the right people be? > > If so, as the NSA continues its concerted effort to cripple encryption > > by providers [3] [4], shouldn't this be seen as the equivalent of the > > Department of Justice colluding with Smith & Wesson to manufacture guns > > that don't shoot straight and bullets that don't fire? > > What makes you think that laws matter when it comes to the NSA? So, is there an accuracy difference in military and non military S&M weapons? > They openly ignored a court order, and nothing happened. Their leadership > lied to Congress, and nothing happened. They have conspired with > federal, state, and even local police forces and prosecutors to break > the law, and nothing happened. Lawsuits are shut down in the name of > secrecy. It's probable they had a very serious internal discussion about these things. I also suspect many others wanted to affect change but that they found things became very hard for them from that point forward. (Please, someone get this reference!) > We are past the point of legal arguments. We should think of the NSA as > we would think of the Chinese government: big, scary, actively working > to subvert computer security, and beyond the reach of the law. For me it's both foreign superpowers with nukes and a lot of people beleving in very self-justified governments. Although, that's the US and China, not the NSA seperately. Thing is, the NSA is just another program on USGOV payroll. Theoretically democratic parts of the government can indeed shut it down. I just think the NSA is too influential and self-serving to let that happen. Which sort of means the NSA runs the nation. But, of course, that's a carefully curated image that may be a total fiction. So, should we treat them as a theoretical adversary and move on? Advocate against them at every opportunity, but just, move on?

1 0

Cryptography, backdoors and the Second Amendment
by Alfie John 11 Oct '14

11 Oct '14

After the Apple encryption announcement, we had the usual pundits bring up the Four Horsemen of the Infocalypse [1]: "Attorney General Eric Holder, the US top law enforcement official, said it is "worrisome" that tech companies are providing default encryption on consumer electronics. Locking the authorities out of being able to physically access the contents of devices puts children at risk, he said. ... Holder said he wants a backdoor to defeat encryption. He urged the tech sector "to work with us to ensure that law enforcement retains the ability, with court-authorization, to lawfully obtain information in the course of an investigation, such as catching kidnappers and sexual predators." After reading Keybase cofounder Chris Coyne's response to the backdoor nonsense, it got me thinking about cryptography and the Second Amendment: "A well regulated militia being necessary to the security of a free state, the right of the people to keep and bear arms shall not be infringed." As the US State Department classifies cryptography as a munition, shouldn't the use of cryptography be protected under the 2nd Amendment? If so, as the NSA continues its concerted effort to cripple encryption by providers [3] [4], shouldn't this be seen as the equivalent of the Department of Justice colluding with Smith & Wesson to manufacture guns that don't shoot straight and bullets that don't fire? Alfie [1] http://arstechnica.com/tech-policy/2014/10/us-top-cop-decries-encryption-de… [2] https://keybase.io/blog/2014-10-08/the-horror-of-a-secure-golden-key [3] http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-secu… [4] http://www.mail-archive.com/cryptography@metzdowd.com/msg12325.html -- Alfie John alfiej(a)fastmail.fm

5 5

ECI PAWLEYS and BULLRUN
by coderman 11 Oct '14

11 Oct '14

feeding the BULLRUN: AMBULANT APERIODIC AUNTIE PAINTEDEAGLE PAWLEYS PENDLETON PIEDMONT PICARESQUE [PIQ] PITCHFORD what else is missing?

1 0

ECI for bypassing NOFORN
by coderman 11 Oct '14

11 Oct '14

an interesting tidbit in latest docs, "WASHBURN - ECI created for use solely with GCHQ to shield GCHQ from CIA's NOFORN Control Channel" are there other past incidents of ECI compartments used to bridge over dissemination controls?

1 0