- cypherpunks - lists.cpunks.org

Re: Python Random Number Generator for OTP
by Bill Stewart 24 Jul '13

24 Jul '13

> > >Â Why not use /dev/random, instead of "ensuring you have entropy"Â > > /dev/random limits the output size to the > estimated entropy. So it has abysmal > performance unless there are high performance entropy sources available. This is for a one-time pad. Limiting the output size to the estimated entropy is a *requirement*. Abysmal performance is fine, because you're going to transfer the pad using a briefcase handcuffed to a courier's arm or some similarly high-cost high-latency physical distribution method, though if you've got a higher-performance entropy source, great. > After the initial seeding this gains very little security in practice. If "gains very little security in practice" is good enough for you, you don't need a one-time pad. Yes, the pseudo-random bits you get out of /dev/urandom will probably be much better than the bits the Russians got by mashing down the keys on typewriters, and you're probably not going to be attacked with the persistence of the Venona decrypters, but don't waste your time using one-time pads unless you're going to use them perfectly. You're much better off using a long-enough RSA key and some Diffie-Hellman session key generation. (Of course, you still want good random numbers for those, but /dev/random is plenty fast enough for that, at least on any non-virtual machine.)

3 3

Re: Gnu PG is more Safe ?
by Anthony Papillion 24 Jul '13

24 Jul '13

On Jul 23, 2013, at 9:01 PM, oxopz7(a)riseup.net wrote: > Hello everybody! > > I hope all are fine, and doing well! > > I'm good member :) I hope you will accept me! Welcome to the list! It's good to see so many new members coming on board. I'm new myself. > I like to ask about GNU PG, if is more safe than other kind of > software! > that talks about Crypto ? Because GnuPG is open source, it's been extensively peer reviewed and found safe and secure. That doesn't mean it's perfect and has no errors. But they are much less likely to exist in GnuPG than in some other solutions; particularly proprietary ones. > I like to ask also about good resources in Crypto, specially about > SSL/TLS? One of the best ways to learn about tech topics is reading RFC's. The entire way SSL/TLS operates is detailed in an RFC. Read I'd and you will be infinately more informed. Unfortunately, I can't really recommend any good crypto list because I've not found many. To learn about FnuPG and practice, you might want to look at the PGPNET list. Another of interest might be Cryptography. Regards and Welcome! Anthony

7 9

Re: [serval-project-dev] mesh networking patent application - prior art request
by Eugen Leitl 24 Jul '13

24 Jul '13

----- Forwarded message from Bryce Lynch <virtualadept(a)gmail.com> ----- Date: Tue, 23 Jul 2013 13:41:35 -0400 From: Bryce Lynch <virtualadept(a)gmail.com> To: serval-project-developers(a)googlegroups.com Subject: Re: [serval-project-dev] mesh networking patent application - prior art request Reply-To: serval-project-developers(a)googlegroups.com On Tue, Jul 23, 2013 at 7:54 AM, Dan Staples < danstaples(a)opentechinstitute.org> wrote: > That's sickening. Not paying a dime in US taxes on billions of dollars > of profit apparently isn't enough for GE, now they have to patent mesh > technology. > Mesh networking is too potentially dangerous to go unrestricted. That said, I just posted a bunch of stuff to that thread with as many links to verifiable code commits in public repos as I could. Anybody so inclined to check my work, please do, and some up-votes would be nice if they don't suck too badly. -- The Doctor [412/724/301/703] [ZS] https://drwho.virtadpt.net/ "I am everywhere." -- You received this message because you are subscribed to the Google Groups "Serval Project Developers" group. To unsubscribe from this group and stop receiving emails from it, send an email to serval-project-developers+unsubscribe(a)googlegroups.com. To post to this group, send email to serval-project-developers(a)googlegroups.com. Visit this group at http://groups.google.com/group/serval-project-developers. For more options, visit https://groups.google.com/groups/opt_out. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Crowdfunding code reviews [was: GnuPG Safe]
by grarpamp 24 Jul '13

24 Jul '13

On Tue, Jul 23, 2013 at 11:08 PM, Peter Gutmann <pgut001(a)cs.auckland.ac.nz> wrote: > Having code that's open source doesn't help at all if no-one looks at it. It is easy to write code. Harder to write it securely. Even harder to spot your own mistakes. And unless perfect written from the start, will need reviewed and fixed. Yet time to review and fix is not as free as the time writing it, is often viewed as a chore, and happens far less than open source assumes it does. Are we developed enough to begin putting together lists of most critical libraries/tools/apps and pipelining them through a crowdfunded independant peer review program? (501c3 perhaps) Or at least put bounties on the same lists.

1 0

Gnu PG is more Safe ?
by oxopz7＠riseup.net 24 Jul '13

24 Jul '13

Hello everybody! I hope all are fine, and doing well! I'm good member :) I hope you will accept me! I like to ask about GNU PG, if is more safe than other kind of software! that talks about Crypto ? I like to ask also about good resources in Crypto, specially about SSL/TLS? Have a nice day, Cheers, Ζακάρια

2 1

Python Random Number Generator for OTP
by Tom 23 Jul '13

23 Jul '13

Does anyone on the list have some Python source code for an OTP-focused random number generator they'd be willing to share? I'm interested in seeing how different people would approach it?

15 16

Re: The Muslim Problem
by Bill Stewart 23 Jul '13

23 Jul '13

At 11:39 PM 7/20/2013, Jens Christian Hillerup wrote: >BTW, Nicolai Sennels is a racist nutcase. He's had a long career of >nobody taking him seriously in Denmark Too bad other racist nutcases don't get the same lack of respect everywhere. He certainly won't find any around here, and we've had a fairly high tolerance for craziness over the years. >Also, wasn't this list supposed to be about cypherpunk? Absolutely.

4 3

NSA growth fueled by need to target terrorists
by Eugen Leitl 23 Jul '13

23 Jul '13

"By September 2004, a new NSA technique enabled the agency to find cellphones even when they were turned off." http://www.washingtonpost.com/world/national-security/nsa-growth-fueled-by-… NSA growth fueled by need to target terrorists View Photo Gallery — The NSA’s growing footprint: The spy agency is in the midst of a hiring, construction and contracting boom. Here is a look at some of its sites. By Dana Priest, Published: July 22 E-mail the writer Twelve years later, the cranes and earthmovers around the National Security Agency are still at work, tearing up pavement and uprooting trees to make room for a larger workforce and more powerful computers. Already bigger than the Pentagon in square footage, the NSA’s footprint will grow by an additional 50 percent when construction is complete in a decade. And that’s just at its headquarters at Fort Meade, Md. In post-9/11 world, dramatic — but largely hidden — growth at NSA Dana Priest JUL 22 The hiring, building and contracting boom at the agency has been fed by a rising need for the data it provides. The nation’s technical spying agency has enlarged all its major domestic sites — in Colorado, Georgia, Hawaii, Texas and Utah — as well as those in Australia and Britain. Since the attacks of Sept. 11, 2001, its civilian and military workforce has grown by one-third, to about 33,000, according to the NSA. Its budget has roughly doubled, and the number of private companies it depends on has more than tripled, from 150 to close to 500, according to a 2010 Washington Post count. The hiring, construction and contracting boom is symbolic of the hidden fact that in the years after the Sept. 11 attacks, the NSA became the single most important intelligence agency in finding al-Qaeda and other enemies overseas, according to current and former counterterrorism officials and experts. “We Track ’Em, You Whack ’Em” became a motto for one NSA unit, a former senior agency official said. The story of the NSA’s growth, obscured by the agency’s extreme secrecy, is directly tied to the insatiable demand for its work product by the rest of the U.S. intelligence community, military units and the FBI. The NSA’s broad reach in servicing that demand is at the heart of the controversy swirling around the agency these days. Both Congress and the public have been roiled by the disclosure of top-secret documents detailing the collection of U.S. phone records and the monitoring of e-mails, social-media posts and other Web traffic of foreign terrorism suspects and their enablers. Lacking a strong informant network to provide details about al-Qaeda, U.S. intelligence and the military turned to the NSA’s technology to fill the void. The demand for information also favored the agency’s many surveillance techniques, which try to divine the intent of people by vacuuming up and analyzing their communications. “There was nothing that gave you more insight into the inner workings of these organizations as the NSA,” said Michael Leiter, former director of the National Counterterrorism Center. “I can’t think of any terrorist investigation where the NSA was not a preeminent or central player.” One top-secret document recently disclosed by former intelligence contractor Edward Snowden, who is on the run from U.S. authorities, revealed that 60 percent of the president’s daily intelligence briefing came from the NSA in 2000, even before the surge in the agency’s capabilities began. “The foreign signals that NSA collects are invaluable to national security,” the agency said in a statement released Friday to The Post. “This information helps the agency determine where adversaries are located, what they’re planning, when they’re planning to carry it out, with whom they’re working, and the kinds of weapons they’re using.” A motto quickly caught on at Geo Cell: “We Track ’Em, You Whack ’Em.” With the 2003 invasion of Iraq, and the surprisingly quick disintegration of postwar conditions there, the NSA began sending collectors with surveillance equipment to embed with Army brigades and Marine regimental combat teams to target insurgents and terrorists. The units were called tactical cryptologic support teams. The military commanders often had no prior understanding of what the NSA did. But they quickly demanded more of the agency once they learned what it could do. At the same time, the NSA supported a parallel effort by CIA paramilitary units and clandestine Joint Special Operations Command (JSOC) teams tasked with capturing or killing al-Qaeda leaders, deemed “high-value targets.” NSA analysts and collectors moved into the JSOC commander’s new and growing operational headquarters in Balad, Iraq, which also serviced Afghanistan. By September 2004, a new NSA technique enabled the agency to find cellphones even when they were turned off. JSOC troops called this “The Find,” and it gave them thousands of new targets, including members of a burgeoning al-Qaeda-sponsored insurgency in Iraq, according to members of the unit. At the same time, the NSA developed a new computer linkup called the Real Time Regional Gateway into which the military and intelligence officers could feed every bit of data or seized documents and get back a phone number or list of potential targets. It also allowed commanders to see, on a screen, every type of surveillance available in a given territory. Air Force Gen. Michael V. Hayden, former director of the NSA, said in an interview last week that he would tell people, “If we could do this half well, this will be the golden age of sigint,” or signals intelligence. A growing reach The battlefield technology overseas was matched by a demand back in the United States for larger amounts of data to mine using the NSA’s increasingly sophisticated computers. Financial and biometric data, the movement of money overseas, and pattern and link analysis became standard NSA tools. Another example, recently revealed by Snowden, is the bulk collection of telephone metadata — information about numbers dialed and the duration of the calls. The NSA’s burgeoning secret activities splashed into public view in 2005 when the New York Times reported on the warrantless surveillance of U.S. communications, and subsequent statements by former NSA employees contended that the agency was collecting Americans’ e-mails and phone calls. Some suspected that NSA capabilities were limitless when it came to counterterrorism investigations. Although the NSA tries hard to maintain a low profile, the physical manifestation of its growing importance has been quietly evident to the communities that surround its major foreign and domestic bases. Within the past couple of years, bulldozers have plowed through the earth near Bluffdale, Utah, to ready a million-square-foot facility housing a center that will store oceans of bulk data. In 2007, ground was broken for a $1 billion facility on 120 acres at Fort Gordon, where an NSA workforce of 4,000 collects and processes signals intelligence from the Middle East, according to the agency. In Hawaii, the NSA outgrew its Schofield Barracks Army site years ago and opened a 250,000-square-foot, $358 million work space adjacent to it last year. The Wahiawa Annex is the last place that Snowden, then a contractor for Booz Allen Hamilton, worked before leaving with thousands of top-secret documents. The main job of the NSA’s Hawaii facility is to process signals intelligence from around the Pacific Rim. In Texas, the agency has added facilities to its San Antonio-based operations. Its main site, at Lackland Air Force Base, processes signals intelligence from Central and South America. In Colorado, the NSA’s expanding facilities on Buckley Air Force Base in Aurora collect and process information about weapons systems around the globe. Overseas, the NSA’s station at RAF Menwith Hill on the moors of Yorkshire is planned to grow by one-third, to an estimated 2,500 employees, according to studies undertaken by local activists. Although hidden from the main road, up close it is hard to miss the 33 bright-white radar domes that sprout on the deep green landscape. They are thought to collect signals intelligence from parts of Europe, the Middle East and North Africa. The NSA’s Pine Gap site in Australia has added hundreds of new employees and several new facilities in recent years. Over the years, Pine Gap has played a role in many U.S. and NATO military operations, including intercepting communications about possible nuclear testing by the Soviet Union during the Cold War and an analysis of the technical characteristics of Iraq’s GPS jamming systems during the 2003 invasion, according to a book by David Rosenberg, a former NSA analyst at Pine Gap. It also processes signals intelligence from parts of Asia. The upgrades to the cryptologic centers were done “to make the agency’s global enterprise even more seamless as we confronted increasingly networked adversaries,” according to the NSA statement to The Post. “However, we always adjust our efforts to exploit the foreign communications of adversaries and defend vital U.S. networks in accordance with national priorities and in full accordance with U.S. law.” It added: “The notion of constant, unchecked, or senseless growth is a myth.” Julie Tate contributed to this report.

1 0

[serval-project-dev] Building Dissent Networks: Towards Effective Countermeasures against Large-Scale Communications Blackouts
by Eugen Leitl 23 Jul '13

23 Jul '13

----- Forwarded message from "8f6e58ee(a)gmail.com" <8f6e58ee(a)gmail.com> ----- Date: Tue, 23 Jul 2013 09:50:05 +0200 From: "8f6e58ee(a)gmail.com" <8f6e58ee(a)gmail.com> To: serval-project-developers <serval-project-developers(a)googlegroups.com> Subject: [serval-project-dev] Building Dissent Networks: Towards Effective Countermeasures against Large-Scale Communications Blackouts Reply-To: serval-project-developers(a)googlegroups.com Abstract: Large-scale communications blackouts, such as those carried out by Egypt and Libya in 2011 and Syria in 2012 and 2013, have motivated a series of projects that aim to enable citizens to communicate even in the face of such heavy-handed censorship efforts. A common theme across these proposals has been the use of wire- less mesh networks. We argue that such networks are poorly equipped to serve as a meaningful countermea- sure against large-scale blackouts due to their intrin- sically poor scaling properties. We further argue that projects in this space must consider user safety as first design priority and thus far have failed to preserve user anonymity and to rely only on innocuous hardware. >From these two insights, we frame a definition of dissent networks to capture the essential requirements for blackout circumvention solutions http://www.eecs.berkeley.edu/~yahel/papers/Building_Dissent_Networks-Toward… -- You received this message because you are subscribed to the Google Groups "Serval Project Developers" group. To unsubscribe from this group and stop receiving emails from it, send an email to serval-project-developers+unsubscribe(a)googlegroups.com. To post to this group, send email to serval-project-developers(a)googlegroups.com. Visit this group at http://groups.google.com/group/serval-project-developers. For more options, visit https://groups.google.com/groups/opt_out. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

remotely rooting SIM cards
by Eugen Leitl 22 Jul '13

22 Jul '13

https://srlabs.de/rooting-sim-cards/ Rooting SIM cards SIM cards are the de facto trust anchor of mobile devices worldwide. The cards protect the mobile identity of subscribers, associate devices with phone numbers, and increasingly store payment credentials, for example in NFC-enabled phones with mobile wallets. With over seven billion cards in active use, SIMs may well be the most widely used security token in the world. Through over-the-air (OTA) updates deployed via SMS, the cards are even extensible through custom Java software. While this extensibility is rarely used so far, its existence already poses a critical hacking risk. Cracking SIM update keys. OTA commands, such as software updates, are cryptographically-secured SMS messages, which are delivered directly to the SIM. While the option exists to use state-of-the-art AES or the somewhat outdated 3DES algorithm for OTA, many (if not most) SIM cards still rely on the 70s-era DES cipher. DES keys were shown to be crackable within days using FPGA clusters, but they can also be recovered much faster by leveraging rainbow tables similar to those that made GSM’s A5/1 cipher breakable by anyone. To derive a DES OTA key, an attacker starts by sending a binary SMS to a target device. The SIM does not execute the improperly signed OTA command, but does in many cases respond to the attacker with an error code carrying a cryptographic signature, once again sent over binary SMS. A rainbow table resolves this plaintext-signature tuple to a 56-bit DES key within two minutes on a standard computer. Deploying SIM malware. The cracked DES key enables an attacker to send properly signed binary SMS, which download Java applets onto the SIM. Applets are allowed to send SMS, change voicemail numbers, and query the phone location, among many other predefined functions. These capabilities alone provide plenty of potential for abuse. In principle, the Java virtual machine should assure that each Java applet only accesses the predefined interfaces. The Java sandbox implementations of at least two major SIM card vendors, however, are not secure: A Java applet can break out of its realm and access the rest of the card. This allows for remote cloning of possibly millions of SIM cards including their mobile identity (IMSI, Ki) as well as payment credentials stored on the card. Defenses. The risk of remote SIM exploitation can be mitigated on three layers: Better SIM cards. Cards need to use state-of-art cryptography with sufficiently long keys, should not disclose signed plaintexts to attackers, and must implement secure Java virtual machines. While some cards already come close to this objective, the years needed to replace vulnerable legacy cards warrant supplementary defenses. Handset SMS firewall. One additional protection layer could be anchored in handsets: Each user should be allowed to decide which sources of binary SMS to trust and which others to discard. An SMS firewall on the phone would also address other abuse scenarios including “silent SMS.” In-network SMS filtering. Remote attackers rely on mobile networks to deliver binary SMS to and from victim phones. Such SMS should only be allowed from a few known sources, but most networks have not implemented such filtering yet. “Home routing” is furthermore needed to increase the protection coverage to customers when roaming. This would also provide long-requested protection from remote tracking. This research will be presented at BlackHat on Jul 31st and at the OHM hacking camp on Aug 3rd 2013 Questions? – sim(a)srlabs.de

1 0