- cypherpunks - lists.cpunks.org

training grounds and basic training for cypherpunks
by Anonymous Remailer (austria) 20 Jan '14

20 Jan '14

can the millenials get a clue? methinks maybe not but as there may be one or two of them who are NOT soft in the head I invite those to read http://borg.uu3.net/ldetweil/medusa/detweiler.html , where freedom of speech comes in conflict with the tradegy of the commons, there were indeed a lot of valuable lessons learned from detweilers actions and those in opposition to same. perhaps some millenials can get a clue about killfiles(course you take a chance of missing the creation of memes and subsequent modification of same and cypherpunks is ALL about memes.) While the whole snowden affair is most certainly interesting, cypherpunks do things anonymously and pseudoanonymously, we have been embedded in some of the largest government agencies as well as some of the largest and smallest corps. Thing is for all the NDA and loyalty oaths you cant tell when someone comes over to the darkside quietly nowaday especially if they were always using tor to browse anyway and that of course in and of itself will come to be regarded as suspicious Just as using PGP was always suspicious too few using it.. and a LOT of those on insecure platforms. All the recent meme introduction both signal and noise memes have resulted in some interesting side discussions about censorship vs moderation which I suspect is what the postings were intended to produce. anon

1 0

Welcome to the Asylum!
by Anonymous Remailer (austria) 20 Jan '14

20 Jan '14

Hi All, I would add its NOT just a mailing list, it IS instead an insane asylum and experiment in social darwinism where reputation capitol has replaced wealth in the currency of the group. just my .02

8 12

Fwd: [tor-talk] giving up pseudonymity after collecting experiences with pseudonymous project development
by coderman 20 Jan '14

20 Jan '14

i find these kinds of experiments fascinating and would love to see more of them! ---------- Forwarded message ---------- From: Patrick Schleizer <adrelanos(a)riseup.net> Date: Sat, Jan 18, 2014 at 5:09 AM Subject: [tor-talk] giving up pseudonymity after collecting experiences with pseudonymous project development You may have noticed that I, previously known only known under the pseudonym adrelanos, decided to give up my pseudonymity. It was an interesting experience to pseudonymously maintain a Linux distribution (Whonix). I've learned a lot during these ~ 2 years. I didn't have too bad luck in the lottery of life and are won a citizenship, which is at low risk compared to less lucky ones. Living in a country, where pseudonymity for this kind of activity isn't crucial. Fortunately, according to latest press, neither the US nor Germany are killing their own citizen for criticizing "the system". That is, the mass surveillance police state, the military industrial complex, the system of economy, that needs exponential growth to prevent imploding. And so it doesn't become even worse, and better for the less lucky ones, it is important to speak out in public and to take action. Staying pseudonymous for such a long time became more and more a burden. For me, it is not healthy for psychology. When pseudonymously working a a project, you cannot tell anyone about it and they're wondering with what you never tell much. You need to constantly second guess every tiny action. Concentrate on not messing up. Also you'll never know if you already messed up and if "they" already know who you are. You only need to mess up once, and you're always linked to that project. Lucky me, I wasn't forced to stay pseudonymous for ever. I am looking forward to continue contributing to the awesome Free (as in freedom) Software community. Being no longer pseudonymous allows me to speak at conferences, to attend key singing parties, to meet up with other developers, to voice chat with other developers, to chat on IRC without fear of leaking too much information, to be less paranoid, sometimes even running searches in clearnet if that is more convenient, and so forth.

4 4

"Blackphone" said to be "a super-secure nsa-proof"
by Jim Bell 20 Jan '14

20 Jan '14

http://www.yahoo.com/tech/startup-launching-a-super-secure-nsa-proof-735110… Fears over NSA spying have prompted people around the world to think about security differently, whether it be petitioning for companies to better secure their data or changing the information they share online. In particular, security around smartphones has been of great concern, as people increasingly surf the Web, make calls and send messages from their mobile devices. An international group of privacy enthusiasts has come together to create Blackphone, a smartphone that claims it will help to better protect your information. Mashable writes that Blackphone is the brainchild of Silent Circle and Geekosphere, with participation from big players in the fight for information privacy and computer security. Phil Zimmermann, creator of data encryption protocol PGP (Pretty Good Privacy), is one of the minds behind the device. “Blackphone provides users with everything they need to ensure privacy and control of their communications, along with all the other high-end smartphone features they have come to expect,” Zimmerman said, according to Mashable. [ Right Click: Kiwi lifestyle tracker to free people from their smartphones ] The operating system is a custom build of Android OS called PrivatOS, designed for improved security. Silent Circle’s CEO Mike Janke says the project will be open source, as will the PrivatOS operating system. The phone likely won’t have the most outstanding specs, but the team says that’s because privacy is the top concern. No specific details have been given about the phone yet (although some of the code has been posted to GitHub). The companies say they’ll be unveiling it properly at Mobile World Congress in Barcelona beginning Feb. 24. Even with very little information about the device currently available, some media outlets are suggesting that the phone could be “NSA-proof.” That’s a tall order, especially in light of a story from The New York Times claiming that the NSA has implanted software in nearly 100,000 computers to create backdoor radio access. For more information on Blackphone, visit its website at https://www.blackphone.ch.

9 12

Cari Machet
by Anonymous Remailer (austria) 20 Jan '14

20 Jan '14

I've been watching this shit throwing match between Troy and Cari for the last few days and, let me just say, both of you need to GROW THE FUCK UP. I don't give a rats ass if Cari is a 'real Indian' or just some crazy bitch pretending to be one and I don't give a fuck if Troy is offended by her pretending. This list is NOT the place for this bullshit. Get a room and fuck it out or just take it off-list but keep us the hell out of it.

14 28

bespoke boot and runtime configuration [was Re: Debian System and /dev/random]
by coderman 20 Jan '14

20 Jan '14

On Sun, Jan 19, 2014 at 4:57 PM, coderman <coderman(a)gmail.com> wrote: > .... > since 2004 building my own rngd, my own FDE bootloader, my own > mandatory entropy health watchdog service, VIA Padlock enabled processors only. FDE was loop-aes. init enforces mtrngd[0] at boot in conservative configuration. if in key mode without networking, failure of XSTORE at any time causes mtrngd to exit non zero then halt. for normal operation defaults to sync, shutdown -h in 60 seconds. cypherpunks may write code, but sharing with anyone and everyone never the bargain ;) 0. mtrngd - high performance entropy daemon for XSTORE https://peertech.org/dist/mtrngd-0.7-2007.tgz see also https://peertech.org/archives/viarng/ --- custom kernel, initramfs, initrd, install.tgz builds produced bootable ISO mastered with per-image unique entropy mixed at boot using custom pre-boot auth that launches desired OS once encrypted root volume is mounted. the FDE boot process at the time (~2005) worked like this: # first some settings / defaults export keydir=/janus/keys export addir=/janus/active-domain export logfile=/var/log/start.log export klogfile=/janus/active-domain/system.log export tmpmntdir=/mnt/tmp export aes_mode="AES256" # note that message and log calls assume console; e.g. dialog --msgbox # define some common tasks; note that we're single user here (no race) gen_tmpname () { uuid=`cat /proc/sys/kernel/random/uuid` echo "/tmp/.${uuid}.tmp" } LBL_LENGTH=53 get_idlabel () { dev="$1" part=`echo $dev | sed 's/.*\///'` num=`echo $part | sed 's/[a-z]*//g'` drv=`echo $part | sed 's/[0-9]*//g'` tmpf=$(gen_tmpname) dd if=$dev of=$tmpf bs=1 count=$LBL_LENGTH grep IDLABEL $tmpf 1>/dev/null 2>/dev/null if (( $? != 0 )); then rm -f $tmpf return 1 fi rm -f $tmpf cat $tmpf | sed 's/^IDLABEL=//' } list_usb_storage_devs () { l "begin list_usb_storage_devs" done=0 timeout=4 while (( $done == 0 )); do if [ -f /dev/makedevs.sh ]; then l "invoking makedevs.sh" /dev/makedevs.sh 1>/dev/null 2>/dev/null fi sleep 1 ccount=0 devs=$(ls /dev/sd* | grep '[0-9]') for dname in $devs; do l "testing device $dname for readable" dd if=$dname of=/dev/null count=1 1>/dev/null 2>/dev/null if (( $? == 0 )); then l "$dname is readable" ccount=`expr $ccount + 1` fi done if (( $ccount > 0 )); then done=1 fi timeout=`expr $timeout - 1` if (( $timeout == 0 )); then done=1 fi done devs=$(ls /dev/sd* | grep '[0-9]') for dname in $devs; do l "testing device $dname for readable" dd if=$dname of=/dev/null count=1 1>/dev/null 2>/dev/null if (( $? == 0 )); then l "$dname is readable" echo $dname fi done } get_usb_dev_fstype () { l "begin get_usb_dev_fstype" if [ -z "$1" ]; then return 1 fi dname="$1" l "verifying readability for $dname" dd if=$dname of=/dev/null count=1 1>/dev/null 2>/dev/null if (( $? != 0 )); then l "$dname is not readable" return 2 fi if [ ! -d $tmpmntdir ]; then l "creating non existant temp dir $tmpmntdir" mkdir $tmpmntdir 1>/dev/null 2>/dev/null fi umount $tmpmntdir 1>/dev/null 2>/dev/null ismnted=0 mount $dname $tmpmntdir 1>/dev/null 2>/dev/null if (( $? != 0 )); then sleep 3 mount $dname $tmpmntdir 1>/dev/null 2>/dev/null if (( $? != 0 )); then fstypes="xfs ext2 ext3 reiserfs vfat ntfs msdos iso9660 romfs usbfs" for fst in $fstypes; do if (( $ismnted == 0 )); then l "attempting mount -t $fst $dname $tmpmntdir" mount -t $fst $dname $tmpmntdir 1>/dev/null 2>/dev/null if (( $? == 0 )); then l "mounted $dname" ismnted=1 fi fi done if (( $ismnted == 0 )); then l "unable to mount $dname at $tmpmntdir" return 3 fi fi fi fstype=$(mount -l | grep $dname | sed 's/.*type //' | sed 's/ .*//') if [[ "$fstype" == "" ]]; then l "unable to get fstype for $dname" return 4 fi echo $fstype l "got $fstype for mounted volume $dname" umount $tmpmntdir 1>/dev/null 2>/dev/null return 0 } ## keystore management ## a "keystore" stored on USB or microSD carried always on person ## id.txt is an ascii nickname, keys.dat loop-aes encrypted file backed volume ## and finally keys.gpg the disk encryption key wrapped with passphrase. list_keystores () { l "begin list_keystores" if [ -z "$1" ]; then return 1 fi basekeydir="$1" domains="" ddirs=`ls -1dF $basekeydir/* 2>/dev/null | grep '/$'` for dir in $ddirs; do dname=`basename $dir` domains="$domains $dname" done echo $domains return 0 } select_keystore () { l "begin select_keystore" if [ -z "$1" ]; then return 1 fi basekeydir="$1" domains="" ddirs=`ls -1F $basekeydir/` for dir in $ddirs; do if [ -d $dir ]; then dname=`basename $dir` domains="$domains $dname" fi done # MRP NOT IMPLEMENTED YET... return 0 } mount_keystore () { l "begin mount_keystore" if [ -z "$1" ]; then return 1 fi if [ -z "$2" ]; then return 1 fi domkeydir="$1" mntpoint="$2" name=`basename $domkeydir` ld=$(locate_free_loopdev) if [ -z "$ld" ]; then return 2 fi idfile="${domkeydir}/id.txt" if [ -f "${domkeydir}/keys.dat" ]; then keyfile="${domkeydir}/keys.dat" open=1 else if [ -f "${domkeydir}/keys.gpg" ]; then keyfile="${domkeydir}/keys.gpg" open=0 else d "Invalid key store" return 3 fi fi fsfile="${domkeydir}/fs.enc" if [ ! -f $fsfile ]; then d "Invalid key store" return 4 fi if (( $open == 1 )); then cat $keyfile | losetup -p 0 -e $aes_mode $ld $fsfile if (( $? != 0 )); then d "Could not configure keys for loop device." return 1 fi else gpgerrf=/tmp/.gpg_err done=0 while (( $done == 0 )); do d "Loading keystore $name" gpg --decrypt $keyfile 2>$gpgerrf | losetup -p 0 -e $aes_mode $ld $fsfile if (( $? != 0 )); then sleep 2 else done=1 fi done fi mount -t ext2 $ld $mntpoint 1>/dev/null 2>/dev/null if (( $? != 0 )); then losetup -d $ld 1>/dev/null 2>/dev/null return 1 fi echo "$ld" >&2 return 0 } ### the main initialization sequence main () { l "begin main" # args? d "Initializing ..." doinit # set run mode janusmode="default" grep JANUS_TARGET /proc/cmdline >/dev/null 2>&1 if (( $? == 0 )); then janusmode=`cat /proc/cmdline | sed 's/.* JANUS_TARGET=//' | sed 's/ .*//'` fi export janusmode grep VERBOSE /proc/cmdline >/dev/null 2>&1 if (( $? == 0 )); then export VERBOSE=true fi done=0 while (( $done == 0 )); do udevs=$(list_usb_storage_devs) if [ -z "$udevs" ]; then d "No USB storage devices found. Please insert one and press enter:" read sleep 5 else done=1 fi done if [ ! -d $keydir ]; then mkdir -p $keydir 1>/dev/null 2>/dev/null else umount $keydir 1>/dev/null 2>/dev/null fi chmod 700 $keydir 1>/dev/null 2>/dev/null unset xfsdevs unset odevs xfscount=0 for udev in $udevs; do fstype=$(get_usb_dev_fstype $udev) if [ -z "$fstype" ]; then odevs="$odevs ${udev}=none" else if [[ "$fstype" == "xfs" ]]; then xfsdevs="$xfsdevs $udev" xfscount=`expr $xfscount + 1` else odevs="$odevs ${udev}=${fstype}" fi fi done prompt_mkxfs=0 if (( $xfscount == 0 )); then e "No secure key storage domains found on USB devices!" return 2 fi if (( $xfscount > 1 )); then d "Currently only one USB device is supported." d "Please leave only a single secret USB key storage device and try again." noclear sleep 2 return 3 fi mount -t xfs $xfsdevs $keydir 1>/dev/null 2>/dev/null if (( $? != 0 )); then d "Unable to mount key storage" sleep 2 return 3 fi if [ ! -d $addir ]; then mkdir -p $addir 1>/dev/null 2>/dev/null fi chmod 700 $addir 1>/dev/null 2>/dev/null domains=$(list_keystores $keydir) if [ -z "$domains" ]; then e "No secure key storage domains found!" else l "selecting domain from set :${domains}:" dc=0 for domain in $domains; do dc=`expr $dc + 1` done if (( $dc > 1 )); then select_keystore $keydir 2>/tmp/.res if (( $? != 0 )); then d "Error selecting domain." sleep 2 return 5 fi adomain=$(cat /tmp/.res) else adomain=$domains fi mount_keystore $keydir/$adomain $addir 2>/tmp/.res if (( $? != 0 )); then d "Error selecting domain." sleep 2 return 5 fi cldev=`cat /tmp/.res` fi touch $klogfile do_disks_boot l "completed boot menu, assuming restart" if [[ "$VERBOSE" == "true" ]]; then sleep 5 fi return 0 } # execute main then exit l "entering main" doinit exec /sbin/init ### last but not least, modern linux makes this much easier (yay GUID!) ### otherwise shitty hacks required... get_part_keyfile () { l "begin get_part_keyfile" part=$1 num=`echo $part | sed 's/[a-z]*//g'` drv=`echo $part | sed 's/[0-9]*//g'` pdi="/proc/ide/${drv}/identify" if [ ! -f $pdi ]; then case $drv in 'sda') busno="001" ;; 'sdb') busno="002" ;; 'sdc') busno="003" ;; 'sdd') busno="004" ;; 'sde') busno="005" ;; 'sdf') busno="006" ;; *) busno="NOT_FOUND" esac uname=`lsusb | grep "Bus $busno" | grep "Device 002" | sed 's/ .*Device 002: ID ....:.... //' | sed 's/[^a-zA-Z0-9]/_/g' | head -1` pdi=/tmp/.tmp_pdi echo "$uname" > $pdi if [[ "$uname" == "" ]]; then l "No disk identifier found for partition $part at expected $pdi" return 1 fi fi did=`gpg --print-md sha512 $pdi 2>/dev/null | sed 's/.*://' | sed 's/ //g'` did=`echo $did | sed 's/ //g'` kf="${addir}/${did}.${num}" l "associated $kf to device $part" echo $kf return 0 } get_label_keyfile () { l "begin get_label_keyfile" part=$1 num=`echo $part | sed 's/[a-z]*//g'` drv=`echo $part | sed 's/[0-9]*//g'` lid=$(get_idlabel $drv) if (( $? != 0 )); then l "unable to locate label for $drv" return 1 fi kf="${addir}/${lid}.${num}" l "matched $kf to device $part" echo $kf return 0 } ## last but not least, the specifics of how the loop-aes mount and pivot done do_boot_enc_part () { l "begin do_boot_env_part" part=$1 kf=$(get_part_keyfile $part) lkf=$(get_label_keyfile $part) if [ -f $lkf ]; then kf="$lkf" fi ld=$(locate_free_loopdev) if [ -z "$ld" ]; then l "Unable to locate free loop device." return 1 fi pdev="/dev/${part}" cat $kf | losetup -p 0 -e $aes_mode $ld $pdev if (( $? != 0 )); then l "Unable to setup loop $ld for $pdev with keyfile $kf" return 1 fi mpoint="/mnt/${part}" if [ ! -d $mpoint ]; then mkdir -p $mpoint fi l "attempting to mount $part at $mpoint using loop device $ld" mount -t xfs -w $ld $mpoint if (( $? != 0 )); then l "Unable to mount XFS partition at $mpoint" losetup -d $ld return 1 fi # actual umount and pivot root l "cd $mpoint" cd $mpoint cdir=`pwd` l "unmounting filesystems before pivot_root in $cdir" l "umount $addir" umount $addir l "losetup -d $cldev" losetup -d $cldev l "umount $keydir" umount $keydir if [ ! -d initrd ]; then l "mkdir initrd" mkdir initrd fi l "umount /proc/bus/usb" umount /proc/bus/usb l "umount /proc" umount /proc #if [ ! -f etc/save-fstab ]; then # cp etc/fstab etc/save-fstab #fi #cat etc/fstab | grep -v '^.dev.hd' | grep -v '^#' > /tmp/.sf #echo "$pdev / xfs defaults 0 1" > etc/fstab #cat /tmp/.sf >> etc/fstab l "privot root filesystem onto target volume" pivot_root . ./initrd l "executing init..." exec /sbin/init # will never hit here l "ERROR: init could not be executed?" sleep 5 l "aborting exec..." return 1 } do_boot_norm_part () { l "begin do_boot_norm_part" part=$1 mpoint="/mnt/${part}" if [ ! -d $mpoint ]; then mkdir -p $mpoint fi l "attempting to mount $part at $mpoint" mount -w /dev/$part $mpoint if (( $? != 0 )); then l "Unable to mount partition at $mpoint" return 1 fi # actual umount and pivot root l "cd $mpoint" cd $mpoint cdir=`pwd` l "unmounting filesystems before pivot_root in $cdir" l "umount $addir" umount $addir l "losetup -d $cldev" losetup -d $cldev l "umount $keydir" umount $keydir if [ ! -d initrd ]; then l "mkdir initrd" mkdir initrd fi l "umount /proc/bus/usb" umount /proc/bus/usb #MRP l "umount /proc" #umount /proc l "pivot root filesystem onto target volume" pivot_root . ./initrd l "executing init from $cdir ..." exec /sbin/init # will never hit here l "ERROR: init could not be executed?" sleep 5 l "aborting exec..." return 1 } do_disks_boot () { l "begin do_disks_boot" argf=/tmp/.args echo "--title \"Boot Encrypted Operating System\" " > $argf echo "--menu \"Select the OS to boot:\" " >> $argf echo "18 70 10" >> $argf /dev/makedevs.sh 1>/dev/null 2>/dev/null drives=`cat /proc/partitions | grep ' hd[a-z][0-9]' | sed 's/.* hd/hd/' | sort` sdrives=`cat /proc/partitions | grep ' sd[a-z][0-9]' | sed 's/.* sd/sd/' | grep -v sda1 | sort` count=0 for part in $drives $sdrives; do kf=$(get_part_keyfile $part) lkf=$(get_label_keyfile $part) if [ -f $lkf ]; then kf="$lkf" fi l "$part expects $kf" if [ -f $kf ]; then count=`expr $count + 1` allkfs="${allkfs} part${part}:${kf}" cnf="${kf}.alias" cname=`cat $cnf` if [[ "$cname" == "" ]]; then cname=$part fi psize=`fdisk -l /dev/$part 2>/dev/null | grep Disk | sed s'/.*: //' | sed 's/,.*//'` echo "\"Boot $cname\" \"Boot into encrypted $psize partition $part\" " >> $argf l "found encrypted bootable $cname on $part" else l "non encrypted $part , no $kf found" if [[ "$janusmode" == "adv" ]]; then psize=`fdisk -l /dev/$part 2>/dev/null | grep Disk | sed s'/.*: //' | sed 's/,.*//'` echo "\"Exec $part\" \"Boot into UNencrypted public partition\" " >> $argf fi fi done echo "Exit \"Reboot into a different target\" " >> $argf dodispmenu=0 if [[ "$janusmode" == "adv" ]]; then dodispmenu=1 fi if (( $count > 1 )); then dodispmenu=1 fi if (( $dodispmenu )); then dialog --file $argf --output-fd 2 2> /tmp/.res if (( $? != 0 )); then l "unable to launch dialog prompt" return 2 fi dispn=$(cat /tmp/.res) selection=`echo ${dispn}` else if (( $count == 0 )); then selection="Exit" dispmsg "No operating systems found..." else selection="Boot $cname" fi fi l "do_disks_mount selection: $selection" case $selection in Boot*) for ckf in $allkfs; do kf=`echo $ckf | sed 's/.*://'` part=`echo $ckf | sed 's/:.*//' | sed 's/part//'` cnf="${kf}.alias" cname=`cat $cnf` if [[ "$cname" == "" ]]; then cname=$part fi tn=`echo $selection | sed 's/Boot //'` if [[ "$tn" == "$cname" ]]; then ddev=$part fi done do_boot_enc_part $ddev return $? ;; Exec*) tn=`echo $selection | sed 's/Exec //'` do_boot_norm_part $tn ;; *) return 1 esac return 0 }

1 1

request for transcript / presentation: "Random Number Generation, Revisited"
by coderman 20 Jan '14

20 Jan '14

RWC going on, and at http://realworldcrypto.wordpress.com/program/ Session 11: Crypto Applications II 2:00pm Yevgeniy Dodis | New York University Random Number Generation, Revisited

1 0

Re: hacker != cracker (Re: Swartz, Weev & radical libertarian lexicon)
by coderman 20 Jan '14

20 Jan '14

On Wed, Jan 8, 2014 at 6:04 PM, brian carroll <electromagnetize(a)gmail.com> wrote: > coderman wrote: >> i am exploring a gambit for disclosure post-statute-of-limitations, >> but even this protection seems meager and risky. > > (that is a beautiful idea) it may be a very bad idea, we'll find out together these months ahead ;) there are three tales to tell: the first: wifi security interests crossed paths with power institutions lacking tact. 2003 Synopsis scanned and vulnerable, Synopsis providing licensed IP to Intel, the Oregon behemoth, who then combined a PR ruse[0] with InfraGard pull for a FBI fishing expedition trying to catch dirt... the second: monitoring from convenient location unexpectedly colocated by covert crash pad for $TLA adventure leads to lessons on mutual authentication assurances. the third: a "research experiment" widely talked about yet so few know about. in 2007 a confluence of factors collided in the perfect storm: a Tor privacy appliance actively thwarted by VMWare, a Tor summer of code proposal rejected with prejudice, and a rash of mediocre Tor vulnerability papers garnering press and pomp for posturing poseurs. under this cloud of discontent we discovered and maximized a control port vulnerability to demonstrate both the inherent strength of a virtualized transparent proxy model, but also just how bad a truly a truly bad vulnerability can be in practice. (dialed to 11, and discovered the unbelievable without getting disappeared ;) in each a discussion of the security lessons learned, perhaps an insight here or there, much rambling implicitly entwined... that will do for now, until the future, best regards 0. called for lengthy discussion as background on article for wireless security, instead used as a scaryhacker caricature in FUD piece promoting Intel Centrino security features. never talked to media since; encourage all to never talk to media as well with rare exception. specific quote behind the interest: "Netstumbling is not against the law, says special agent Mary Kimura of the Federal Bureau of Investigation (FBI), but it comes awfully close. "It's not illegal to scan for open networks," Kimura says, "but once a theft of service, denial of service, or theft of information occurs, then it becomes a federal violation." Kimura is the Infragard coordinator in the FBI's San Francisco office."

1 1

cypherpunks and hackers who dont code?
by Anonymous Remailer (austria) 20 Jan '14

20 Jan '14

to the inmates: its seems we have a number of the intellectually lazy among us who either dont/wont or in some way refuse to code.. yet they wish to call themselves cypherpunks and hackers. am I missing something here about these wannabe(s)

8 12

Fwd: Debian System and /dev/random
by coderman 20 Jan '14

20 Jan '14

---------- Forwarded message ---------- From: coderman <coderman(a)gmail.com> Date: Sun, Jan 19, 2014 at 4:57 PM Subject: Re: Debian System and /dev/random On Sun, Jan 19, 2014 at 11:41 AM, Jeffrey Walton <noloader(a)gmail.com> wrote: > I'm working on a laptop with quad core i5 running Debian 7.3 x64 > (fully patched). > > You know this damn thing was running out of entropy in /dev/random > because no entropy daemon was installed out of the box.... since 2004 building my own rngd, my own FDE bootloader, my own mandatory entropy health watchdog service, in every distribution: none did FDE key management right (for loop-aes at the time), none did entropy right. in 2008 various "expert install" console only options began to support a suitable FDE solution with luks and boot by volume GUID (rather than device file). many years we've had full blown easy (for some degree of easy) FDE solutions in graphical installers out of the gate. progress! and yet entropy, the most critical component of any crypto system, is so horribly and woefully inadequate today. will no indications this will change soon... this is not an accident. :/ > And I was depleting it with a simple program that tried to read 32 > bytes to seed an OpenSSL generator. I could only get 9 or 16 or 19 > bytes out of it yup. for fun, check out how this setup seeds itself: https://github.com/catid/cymric/ """ Linux/Android: /dev/random (160 bits) /dev/urandom (96 bits) srand() and rand() from stdlib (64 bits) gettid() or pthread_self() (32 bits) getpid() (32 bits) Linux-type systems are a little strange in that /dev/random only keeps about 20 bytes of entropy in reserve. And it takes roughly 20 seconds for a VPS to collect 8 bytes of entropy, which means asking for 32 bytes of entropy takes an unreasonably long time. By asking for only 20 bytes, most of the requests by this library will complete immediately. And the remaining 12 bytes are satisfied by /dev/urandom... """ > Seriously... That's all it was on startup.... > > That's amazing in 2013........ amazingly effective! BULLRUN FTW [EDIT: to clarify, i am lamenting the lack of high rate, raw source physical entropy sources as native instructions in processors. this should be a baseline mandatory requirement! i am also lamenting the lack of user space entropy daemons and collectors being enabled by default in most distributions. i am also lamenting the lack of proper boot time / VM pass through entropy support in most distributions. i am lamenting the lack of any failure handling for entropy in any distribution, such that a failed RNG condition leads to service halt rather than blindly carrying on, perhaps for years, unaware that you're broken. i am also lamenting the lack of serious attention and thoroughness applied to entropy sources in nearly every computing system deployed across this planet. i could go on, but you get the point... *grin* ]

1 0