- cypherpunks - lists.cpunks.org

New breakthrough could bring quantum encryption to smartphones
by Gutem 02 Sep '13

02 Sep '13

http://www.extremetech.com/extreme/165281-new-breakthrough-could-bring-quan… - Gutem

2 1

Re: [Cryptography] NSA and cryptanalysis
by Eugen Leitl 02 Sep '13

02 Sep '13

----- Forwarded message from Jerry Leichter <leichter(a)lrw.com> ----- Date: Sun, 1 Sep 2013 07:11:06 -0400 From: Jerry Leichter <leichter(a)lrw.com> To: Peter Gutmann <pgut001(a)cs.auckland.ac.nz> Cc: crypto.jmk(a)gmail.com, die(a)dieconsulting.com, "cryptography(a)metzdowd.com List" <cryptography(a)metzdowd.com> Subject: Re: [Cryptography] NSA and cryptanalysis X-Mailer: Apple Mail (2.1283) On Sep 1, 2013, at 2:36 AM, Peter Gutmann wrote: > John Kelsey <crypto.jmk(a)gmail.com> writes: > >> If I had to bet, I'd bet on bad rngs as the most likely source of a >> breakthrough in decrypting lots of encrypted traffic from different sources. > > If I had to bet, I'd bet on anything but the crypto. Why attack when you can > bypass [1]. Well, sure. But ... I find it hard to be quite so confident. In practical terms, the vast majority of encrypted data in the world, whether in motion or at rest, is protected by one of two algorithms: RSA and AES. In some cases, RSA is used to encrypt AES keys, so an RSA break amounts to a bypass of AES. If you want to consider signatures and authentication, you come back to RSA again, and add SHA-1. This is not to say there aren't other techniques out there, or that new ones aren't being developed. But to NSA it's clearly a game of numbers - and any kind of wedge into either of just two algorithms would expose huge amounts of traffic to interception. Meanwhile, on the authentication side, Stuxnet provided evidence that the secret community *does* have capabilities (to conduct a collision attacks) beyond those known to the public - capabilities sufficient to produce fake Windows updates. And recent evidence elsewhere (e.g., using a bug in the version of Firefox in the Tor Browser Bundle) has shown an interest and ability to actively attack systems. (Of course, being able to decrypt information without an active attack is always the ideal, as it leaves no traces.) I keep seeing statements that "modern cryptographic algorithms are secure, don't worry" - but if you step back a bit, it's really hard to justify such statements. We *know*, in a sense, that RSA is *not* secure: Advances in factoring have come faster than expected, so recommended key sizes have also been increasing faster than expected. Most of the world's sites will always be well behind the recommended sizes. Yes, we have alternatives like ECC, but they don't help the large number of sites that don't use them. Meanwhile, just what evidence do we really have that AES is secure? It's survived all known attacks. Good to know - but consider that until the publication of differential cryptanalysis, the public state of knowledge contained essentially *no* generic attacks newer than the WW II era attacks on Enigma. DC, and to a lesser degree linear cryptanalysis not long after, rendered every existing block cipher (other than DES, which was designed with secret knowledge of DC) obsolete in one stroke. There's been incremental progress since, but no breakthrough of a similar magnitude - in public. Is there really anything we know about AES that precludes the possibility of such a breakthrough? There's a fundamental question one should ask in designing a system: Do you want to protect against targeted attacks, or do you want to protect against broad "fishing" attacks? If the former, the general view is that if an organization with the resources of the NSA wants to get in, they will - generally by various kinds of bypass mechanisms. Of the latter, the cryptographic monoculture *that the best practices insist on* - use standard protocols, algorithms and codes; don't try to invent or even implement your own crypto; design according to Kirchoff's principle that only the key is secret - are exactly the *wrong* advice: You're allowing the attacker to amortize his attacks on you with attacks on everyone else. If I were really concerned about my conversations with a small group of others being intercepted as part of dragnet operations, I'd design my own small variations on existing protocols. Mix pre-shared secrets into a DH exchange to pick keys. Use simple steganography to hide a signal in anything being signed - if something shows up signed without that signal, I'll know (a) it's not valid; (b) someone has broken in. Modify AES in some way - e.g., insert an XOR with a separate key between two rounds. A directed attack would eventually break all this, but generic attacks would fail. (You could argue that the failure of generic attacks would cause my connections to stand out and thus draw attention. This is, perhaps, true - it depends on the success rate of the generic attacks, and on how many others are playing the same games I am. There's no free lunch.) It's interesting that what what little evidence we have about NSA procedures - from the design of Clipper to Suite B - hints that they deploy multiple cryptosystems tuned to particular needs. They don't seem to believe in a monoculture - at least for themselves. -- Jerry _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

[liberationtech] Snowden masks for Holloween?
by Eugen Leitl 02 Sep '13

02 Sep '13

----- Forwarded message from Paul Elliott <pelliott(a)blackpatchpanel.com> ----- Date: Mon, 2 Sep 2013 03:59:50 -0500 From: Paul Elliott <pelliott(a)blackpatchpanel.com> To: Liberation Technologies <liberationtech(a)lists.stanford.edu> Subject: [liberationtech] Snowden masks for Holloween? User-Agent: Mutt/1.5.21 (2010-09-15) Reply-To: liberationtech <liberationtech(a)lists.stanford.edu> Is it not funny, no one seems to be commercially oftering Snowden masks for this Holloween. I looked on Amazon and google and nothing on the first page of a cursory search. You would think it would be a top seller. Is presure being applied? Please tell me if you are aware of a source. Thank You. -- Paul Elliott 1(512)837-1096 pelliott(a)BlackPatchPanel.com PMB 181, 11900 Metric Blvd Suite J http://www.free.blackpatchpanel.com/pme/ Austin TX 78758-3117 --- "Encryption works. Properly implemented strong crypto systems are one of the few things that you can rely on. Unfortunately, endpoint security is so terrifically weak that NSA can frequently find ways around it." Edward Snowden -- Liberationtech is a public list whose archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Re: [tor-talk] New paper : Users Get Routed: Traffic Correlation on Tor by Realistic Adversaries
by Eugen Leitl 02 Sep '13

02 Sep '13

----- Forwarded message from Roger Dingledine <arma(a)mit.edu> ----- Date: Sun, 1 Sep 2013 22:10:56 -0400 From: Roger Dingledine <arma(a)mit.edu> To: tor-talk(a)lists.torproject.org Subject: Re: [tor-talk] New paper : Users Get Routed: Traffic Correlation on Tor by Realistic Adversaries User-Agent: Mutt/1.5.20 (2009-06-14) Reply-To: tor-talk(a)lists.torproject.org On Mon, Sep 02, 2013 at 11:35:22AM +1000, Erik de Castro Lopo wrote: > Hi all, > > Heads up on a new paper suggesting that its possible to unmask > Tor users using traffic correlation: > > http://www.ohmygodel.com/publications/usersrouted-ccs13.pdf > > Code here: > > http://torps.github.io/ > > Would be interested in hearing the opinions of the core Tor > develpoment team on this stuff. Yep. They're part of the Tor research community. I have plans for writing a blog post about the paper, to explain what it means, what it doesn't mean, what we should do about it, and what research questions remain open. Stuff keeps catching fire with bigger flames though. The extremely short answer is "Yes, a big enough adversary can screw Tor users. But we knew that. I think it's great that the paper presents the dual risks of relay adversaries and link adversaries, since most of the time when people are freaking out about one of them they're forgetting the other one. And we really should raise the guard rotation period. If you do their compromise graphs again with guards rotated every nine months, they look way different." https://trac.torproject.org/projects/tor/ticket/8240 https://trac.torproject.org/projects/tor/ticket/9321 --Roger -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

[tor-talk] New paper : Users Get Routed: Traffic Correlation on Tor by Realistic Adversaries
by Eugen Leitl 02 Sep '13

02 Sep '13

----- Forwarded message from Erik de Castro Lopo <mle+tools(a)mega-nerd.com> ----- Date: Mon, 2 Sep 2013 11:35:22 +1000 From: Erik de Castro Lopo <mle+tools(a)mega-nerd.com> To: tor-talk(a)lists.torproject.org Subject: [tor-talk] New paper : Users Get Routed: Traffic Correlation on Tor by Realistic Adversaries Organization: Erik Conspiracy Secret Labs X-Mailer: Sylpheed 3.4.0beta4 (GTK+ 2.24.10; x86_64-pc-linux-gnu) Reply-To: tor-talk(a)lists.torproject.org Hi all, Heads up on a new paper suggesting that its possible to unmask Tor users using traffic correlation: http://www.ohmygodel.com/publications/usersrouted-ccs13.pdf Code here: http://torps.github.io/ Would be interested in hearing the opinions of the core Tor develpoment team on this stuff. Cheers, Erik -- ---------------------------------------------------------------------- Erik de Castro Lopo http://www.mega-nerd.com/ -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Who bought off Zimmermann?
by StealthMonger 01 Sep '13

01 Sep '13

How ironic and sad it is that Phil Zimmermann, the author of PGP, has become so imbued with the enterprise culture that he's now so blind to the original peer-to-peer spirit of PGP that he would say things like There is no way to do encrypted e-mail where the content is protected. [1] This is simply false. If sender and receiver exchange keys out-of-band and nobody else knows the keys, the content can have cryptographically strong protection. Why would Zimmermann allow himself to be bought off? What kind of pressure is being brought to bear? Is this protracted world-class human engineering in action? [1] http://www.forbes.com/sites/parmyolson/2013/08/09/e-mails-big-privacy-probl… -- -- StealthMonger <StealthMonger(a)nym.mixmin.net> Long, random latency is part of the price of Internet anonymity. anonget: Is this anonymous browsing, or what? http://groups.google.ws/group/alt.privacy.anon-server/msg/073f34abb668df33?… stealthmail: Hide whether you're doing email, or when, or with whom. mailto:stealthsuite@nym.mixmin.net?subject=send%20index.html Key: mailto:stealthsuite@nym.mixmin.net?subject=send%20stealthmonger-key

9 11

So I discovered that my HP laptop leaks/transmits its built-in mic audio somewhere around 24Mhz
by Eugen Leitl 01 Sep '13

01 Sep '13

http://www.reddit.com/r/RTLSDR/comments/1le3if/so_i_discovered_that_my_hp_l… So I discovered that my HP laptop leaks/transmits its built-in mic audio somewhere around 24Mhz (self.RTLSDR) submitted 23 hours ago by cronek I accidentally stumbled upon a signal in the 24MHz range, appearing to be 4 carriers. I tuned to it and heard silence, then someone came into my office and started talking and I could hear them speak. The signal appeared to be coming from my other laptop (not the one running the SDR) and was pretty weak (my antenna, the crappy one that comes with the dongle, stuck to a metal stapler was right next to the HP laptop). Here's a picture Both mics transmit independently, in the picture I rubbed one mic. The signal appears to be mirrored. When I tap the microphone, or make a loud noise that would clip the preamp, the signal drifts off and then slowly comes back to its original frequency, as illustrated here (only one of the two mics drifted, if I hit it harder or clip both mics, both will drift). I'm pretty sure that if I build a nice high-gain antenna optimized for 24Mhz I would be able to pick up the sound from some distance away. The laptop is an EliteBook 8460p. I have checked identical laptops and they do not transmit at this frequency. I didn't have the time to scan the full spectrum though. I'm guessing the preamp is really crappy and somehow ends up transmitting FM at HF freqs. Anyone has any ideas about this? I work in a high security setting and having laptops transmitting audio from everyone's office/meeting room etc is a really big deal. I somewhat doubt it to be an intentional listening device due to the weird frequency drifting. For now I guess I'll just disconnect the mic preamp pcb.

2 1

Re: Who bought off Zimmermann?
by John Young 31 Aug '13

31 Aug '13

Emitting signal that "crypto works" is a hoary practice, nothing more useful than a belief in an uncrackable means of comms, used often in war and commerce and love affairs. Crypto-AG, AES, PGP, Tor, OTR, offline exchange of keys, the list is growing with each disclosure that something stinks in crypto ex-cess. Getting the best and brightest (BAB) to affirm that crypto works, say by open and limited competitions as well as by confidential testing results leaked, would be a part of that campaign. Leaking other forms of attack, like metadata, would be another part, bit by bit, authenticity heightened by obligatory redactions and vetting by quiet government consultation. Presume Snowden dribbling juicy comsec architecture and data, witting or unwitting of their ulterior purpose as beautifully crafted to appear suspicious to BABs but so tasty to be irresistable as a floating British officer corpse stuffed with secret war plans retrieved by the Germans. Until all of Snowden's booty is released and carefully studied by virulently suspicious and paranoid BABs not snared by sweet contracts to muse and declare authenticity, it cannot be seen as more than an ingenious ruse, likely with the complicity of the BABs once believed to be poorly-paid angels dancing on a pinhead. The saluatory benefit of these ruses is to shock the shit out of the lazy and arrogant comfuckers whose stake is put at risk by being left out of the ruse, not easy to do if they are lulled into complacency by admiration, handsome pay, invites to classified dances, insured and pensioned by NDAs, well, hell, why else raise a ruckus with ruses like crypto lists and fora and history confabbing at NSA. None of this is intended to impugn the few BABs who remain outside secret circles, or at least appear to do so in best and brightest ways. And don't invoke a hoary NSL as basis for silence. It does intend to impugn denial of the inevtiable failure of crypto alone or in concert with infrastructure. Remember that 1997 NSA paper foretelling the fail. Was that a ruse too? If I was a BAB looking for a edge on the competition for ruses, I might blurt that crypto deception is the essence of crypto, that is why it works so well.

2 1

[tahoe-dev] reproducible builds for Tahoe-LAFS: where do we start?
by Eugen Leitl 31 Aug '13

31 Aug '13

----- Forwarded message from Zooko O'Whielacronx <zookog(a)gmail.com> ----- Date: Sat, 31 Aug 2013 14:12:07 +0000 From: Zooko O'Whielacronx <zookog(a)gmail.com> To: tahoe-dev <tahoe-dev(a)tahoe-lafs.org> Subject: [tahoe-dev] reproducible builds for Tahoe-LAFS: where do we start? Folks: Here's some recent news: http://m.washingtonpost.com/world/national-security/us-spy-agencies-mounted… That article says that the U.S. espionage agencies have surreptitiously installed sophisticated malware on tens of thousands of remote machines, and have plans to increase that number into the millions. It is important to remember that while the U.S. espionage establishment is the one that is currently having its activities and plans exposed, it is not the only one of its kind. It is safe to assume that there are many other organizations with similar capabilities engaged in similar activities. It is also likely that some of those groups are engaged not in warfare but in industrial espionage or other kinds of theft or sabotage. In this modern world, it would be very useful if you could check whether the binaries that you are running are the same as the binaries that other people are running that were ostensibly built from the same source code. That way, implanted malware would be more likely to be exposed. This is the idea of "reproducible builds", as championed by Tor ¹, Bitcoin ², and Debian ³. LWN.net recently had a nice overview article about this: ⁴. Now: how do we start? We have a trac ticket: https://tahoe-lafs.org/trac/tahoe-lafs/ticket/2057# reproducible builds But I don't understand what the next step on the path to really protecting users. The situation we're considering here is that a user is installing Tahoe-LAFS, for example by running "sudo apt-get install tahoe-lafs" on Debian, and the computer that was used to build the tahoe-lafs Debian package had malware running on it, that inserted a backdoor into the tahoe-lafs Debian package. How can we help users to defend against that? There are lots of other packagers which provide installable versions of Tahoe-LAFS to their users. For example, the "pkgsrc/NetBSD" system ⁵, whose Tahoe-LAFS package is maintained by Greg Troxel, who reads this mailing list. If you click on the big friendly blue "Download Tahoe-LAFS" button on the front page of https://Tahoe-LAFS.org, it takes you to a menu of packages provided by different free-and-open-source operating systems. One thing that worries me about this issue is that it is one of those things were different open source projects can reasonably assume that it is Someone Else's Problem to fix this. I've often seen this: when there is an issue that spans multiple open source projects, that it is hard to make progress on that issue, since every open source project has a theory of how it ought to be fixed by some other open source project taking responsibility for it. So what can we do to push on this issue now? Regards, Zooko ¹ https://blog.torproject.org/blog/deterministic-builds-part-one-cyberwar-and… ² https://en.bitcoin.it/wiki/Release_process ³ https://wiki.debian.org/ReproducibleBuilds ⁴ http://lwn.net/Articles/564263/ ⁵ ftp://ftp.netbsd.org/pub/pkgsrc/current/pkgsrc/filesystems/tahoe-lafs/READM… _______________________________________________ tahoe-dev mailing list tahoe-dev(a)tahoe-lafs.org https://tahoe-lafs.org/cgi-bin/mailman/listinfo/tahoe-dev ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Re: [liberationtech] Why cant email be secure? - Silent Circle Blog
by John Young 31 Aug '13

31 Aug '13

A swell beginning, for email to be merely one way to communicate, supplemented with unlimited other ways which do not require email, or for that matter, the Internet or any digital means. Presume that digital means are the easiest to fuck with, sorry, subvert, corrupt, pack with junk, surveil, harvest, store, search, forge, track, make your own list on your digital device and expect it to be violated accordingly and used against you whether you know or not, usually not. Here especially. Now the other means, non-digital, ancient and amply used and understood among those who use them although susceptible to the digital vulnerabilites if considerable more difficult: Paper Music Sound Dance Architecture Plastic arts Graphic arts Poetry Drum Glossalia Jokes Holler Gypsy Mime Chant Curse Vulgarity Sex Sin And much more everybody uses with greater facility than digital emissions. Note that conventional lanugages are not on the list because of the heavy reliance upon them to communicate and thus most heavily scutinized and attacked, usually successfully. Language is like metadata, with only its mastery the content can be followed from end to end, then the ends burgled, beat, cut, shot, persuaded to talk in plain language. Steagonagraphy is not on the list unless it is non-digital, and if not, then hiding communication has great potential. Its weakness is finding a means, non-digital, for preparation and transceiving. For example, architecture is an ancient means of communication, among its funders, designers, builders, maintainers, destructors, restorers, investors, evaluators, burgler, surveyors, surveillors, protectors, attackers, underminers, repairers, materials suppliers, excavators, and a host of participants -- the list of guilds and unions and professionals is vast -- perhaps one of the largest cohorts of quasi-private aggregations on earth lagging only farmers if taken to mean any form of human construction. I flatter myself, so do yourself likewise. Similarly, just about any specialty of human intercourse has its quasi-private, esoteric, unique means of communication. The human body specialists -- scientific, shamanistic, soulseeking -- along with its pschobabbling corollary, generates a fantastic array of marketable, if not wholly, believable garble and gibberish. Politics and law the most vivid at laying on the self-serving shit about the necessity of government and the rule of law(yers). Now back to the simple task of communicating in private. Before that, a side note, the end is near: First do not expect anyone to believe anything using the word "security." So comsec is dead due to abuse. Maybe compriv is better, understanding that privacy has become a crock of shit too. "Shit bag" (thanks to Assange) Natsec needs to go as well because it has been abused the most of all since assuming the parmount importance of a secular religion prevailing over all belief-systems with deadly weaponry, heartlessness, amorality, criminality and unaccountability, motto: fuck with it and you will die. Much evidence of motto in deed. And much evidence it will be used against its insiders. This is relevant to private communication. Natsec really hates being cut out of any kind of communication. It will use virtually unlimited means to get inside, most of them kept secret and manifestly violent if needs be. So compriv should not be promoted as capable to exclude natsec's prying, stealing, owning, using to demolish with its opponents. OTR is futile, BTW, as comsec. Wind compriv down to comchat. Then wind comchat down to comgossip, to comwhine, comjoke, comlie, comlurk, comslur, com-social engineer. You get the point. Do nothing life-threatening or natsec defying by com-whatever. Communications is owned by those who provide its means and they are owned by extremely badass natsec ritualists willing to barbecue your beloveds to share the goodness carefully prescribed in their secret manuals of unlimited warfare. In conclusion, there you have it, com-bat, the most reliable means of communication. Anything less is com-ical.

3 2