- cypherpunks - lists.cpunks.org

Bruce Schneier on BULLRUN and related NSA programs
by coderman 06 Sep '13

06 Sep '13

select quotes from "The NSA Is Breaking Most Encryption on the Internet" http://www.schneier.com/blog/archives/2013/09/the_nsa_is_brea.html """ Remember this: The math is good, but math has no agency. Code has agency, and the code has been subverted. ... [regarding magic curve constants] Bruce Schneier • September 5, 2013 4:07 PM I no longer trust the constants. I believe the NSA has manipulated them through their relationships with industry. ... Bruce Schneier • September 5, 2013 7:32 PM "You recommended to 'Prefer symmetric cryptography over public-key cryptography.' Can you elaborate on why?" It is more likely that the NSA has some fundamental mathematical advance in breaking public-key algorithms than symmetric algorithms. [EDITOR: the safety margin for key lengths over time is definitely more reassuring for symmetric ciphers*. and aggravating that hardware security products and other encryption appliances and systems do not accomodate 4k or even 2k keys well, not to mention the varied cipher suites you may prefer...] ... Bruce Schneier • September 5, 2013 4:58 PM "Why are you not going to write about those 'other few things'? Can you write about the here please? I want to keep some secrets in my back pocket. """ * key length recommendations in bits Lenstra and Verheul Equations (2000) symmetric: 70 pubkey. 952 hash: 140 compare to: ECRYPT II 2011-2015 symmetric: 80 pubkey: 1248 hash: 160 and considering projection: ECRYPT II >2041 symmetric: 256 pubkey: 15424 hash: 512

1 0

what has the NSA broken?
by Andy Isaacson 06 Sep '13

06 Sep '13

Tinfoil hat time ... http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-secu… With today's disclosures, the question turns to -- what has the NSA broken? Unfortunately the journalists bowed to pressure from the espionage-industrial complex and decided not to publish specific details of what's broken; and the Snowden documents don't include all the compartmentalized details anyways. So all we can do is speculate based on what is already known and the high level overview provided. I don't believe that NSA has a complete AES break. Call me foolish if you must, but it's just not consistent with what we know so far. I believe that a correctly implemented, truly randomly keyed AES-256-CBC or -CTR cipher is robust against cryptanalysis. It seems just barely possible that AES-128 has a complete break, since I suspect NSA can do 2^80 work on 2^60 bytes if it gives them decrypts of all the AES-128 they can sniff. However, virtually nobody properly keys their ciphers with physical entropy. I suspect that correlated key PRNG attacks are almost certainly a significant part of the NSA/GCHQ crypto break. Many deployed systems expose a significant amount of correlated output of /dev/urandom or the in-process PRNG. Given a global passive adversary and serveral TFLOPs of built-to-spec supercomputers [1], this seems like an obvious place for a hidden advance. Also, retrieving key material from endpoints is a high return activity. Nearly nobody uses PFS ciphersuites, many HTTPS privatekeys are used for multiple years, and a single 1 KiB leak of key material is sufficient to decrypt all traffic under that key. (You don't even need the whole key, just half the bits are plenty to reconstruct RSA keys using attacks in the open literature.) Insiders copying privatekey files after hours, DRAM remanence after "hardware failure" in SSL offload boxes, bugdoors leaking key bits in subtly biased entropy from crypto accelerator hardware, on-disk encrypted keys decrypted due to low entropy passphrases, etc. Any key stored on a US-based VPS is obviously compromised. (Doubly so if your VPS is linode.) Radio emissions from colocated boxes are a nearly completely unexplored area of research. Server-class IPMI baseboard coprocesssors have undisclosed access to host RAM at runtime, and often unaudited access via provider management-plane Ethernets. If I had to get the keys out deniably, I'd be scanning RAM for high entropy key schedules and leaking key bits in the timing of heartbeat messages. It seems fairly likely that NSA is at least a decade ahead of academic RSA factoring. I've heard second-hand stories of $10M machines of custom ASICs built to attack RSA before 2005, and third-hand stories of machines far weirder than that. RSA-1024 I'd treat as dead, RSA-2048 is probably robust enough that if NSA have an attack it would be too valuable to risk exposing under anything but an existential threat scenario. Non-AES legacy/proprietary ciphers are probably toast. People switching to RC4, stahp! A5/2, lulz. Maybe GOST and twofish and Salsa20 are secure; I've met djb and all my checks for NSA minders came up negative. [1] Cray is still in business, building 10,000 CPU with attached FPGA and 1µs interconnect megaclusters for "undisclosed government customers". The systems listed as "Government" in the latest top500 list are just the tip of the iceberg; larger systems are built and installed without any public disclosure. -andy

1 0

Guardian on NSA & GCHQ cryptowar
by Gregory Foster 06 Sep '13

06 Sep '13

The Guardian (Sep 5) - "US and UK spy agencies defeat privacy and security on the internet" by @jamesrbuk, @julianborger, @ggreenwald: http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-secu… gf -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/

4 3

Re: [cryptography] regarding the NSA crypto "breakthrough"
by John Young 05 Sep '13

05 Sep '13

More words from a non-techie: David Kahn, James Bamford, Seymour Hersh and quite a few NSA and other spy types, in particular heads of agencies, Congress, POTUS. SCOTUS, DoJ, are word people. So try as they might to match a word account to the coders and mathematicians, it's pretty well impossible. And the reverse is true from the techies to the wordies. Not many hard core cryptographers are persuasive wordies, so the wordies often run the public show, in the same way the hard cores runs the labs and hacker blow-outs with wearable computers and fuzzy PowerPoints of what a literate person would see as alphanumeric wallpaper. Keep in mind that even many of the reputable tech reporters are not all that techie but are adept at using words lifted from tech drunken orgies. Same in my field of archtecture: the highly literate architectural critics know squat of the down and dirty but excell at reaching the public with artfully simulated accounts burnishing reputations of marketable greatness. In the case of NSA, be damn sure that all its heads knew or know squat about NSA deep tech so they are suited to move the product in blissful ignorance to customers of similar know-not. Michael Hayden and Keith Alexander are perfect for using vapid words to persuade non-techies as little truth as possible is just fine. Back to the latest failure to reveal technical docs. Those who know what's important about them are not likely to tell journalists that, may be incapable of doing so in a way that journalists can apply their vaunted skepticism of sources -- using word skills of truthiness. So what is transferred are narratives, stories, rhetoric, bombast, in lieu of technical specs, math, algorithms, fabrication drawings, chemical and electrical formulations, doses of EM and anti-EM just precisely zapped to the nano-fullerine /->^256/1029: the myrrh and honey of technies, sleep-eeze to the wordies who yawn is that a go or no go to slick brochure printing. "Breakthrough" is PR, which might suggest quotation marks around all the NSA revelations -- so far. A long shot that technical docs will be leaked inadvertently, maybe left as digital debris inside one of the PowerPoint files put on a reused thumb drive and recoverable in a filthy techie lab. I think Ross Anderson could siphon and decipher that compromising junk in a flash. Ross is pretty good at no-nonsense English too.

1 0

Re: Guardian on NSA & GCHQ cryptowar
by Nick Thomas 05 Sep '13

05 Sep '13

"Fuck" - the world -------- Original message -------- From: Gregory Foster <gfoster(a)entersection.org> Date: To: cypherpunks(a)cpunks.org Cc: effaustin-discuss(a)lists.effaustin.org Subject: Guardian on NSA & GCHQ cryptowar The Guardian (Sep 5) - "US and UK spy agencies defeat privacy and security on the internet" by @jamesrbuk, @julianborger, @ggreenwald: http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-secu… gf -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/

3 4

Re: [liberationtech] NSA Laughs at PCs, Prefers Hacking Routers and Switches
by Eugen Leitl 05 Sep '13

05 Sep '13

----- Forwarded message from Scott Helms <khelms(a)zcorum.com> ----- Date: Thu, 5 Sep 2013 10:02:39 -0400 From: Scott Helms <khelms(a)zcorum.com> To: Eugen Leitl <eugen(a)leitl.org> Cc: NANOG list <nanog(a)nanog.org> Subject: Re: [liberationtech] NSA Laughs at PCs, Prefers Hacking Routers and Switches The last paragraph in the post is the most important, but it invalidates the rest of the post. Core routers are a terrible intercept point because of load and the sheer amount of packets they process and they are also MUCH more likely to be running up to date firmware than a router in an edge network where the main technical person is primarily a Windows/Exchange admin. The problem with recording "everything" is that its not feasible and the idea that all/most/many core routers are merrily sending a copy of all packets to some external storage facility is demonstrably false. If you want to record flows that's a bit more technically (and legally in the US since its meta-data) feasible, but again netflow traffic from all/most/many core routers is extremely hard to hide on a 24/7 basis and again is demonstrably false. Its far easier (technically and legally) for the NSA to have a directory of devices they can tap on demand without the knowledge of the owners either through unpatched security flaws, cooperation from the carrier, or intentionally built back doors. Its also more feasibly for them (and we have good evidence this has happened) to directly mirror the layer 2 traffic on some of the largest backbone networks. This of course allows them to passively listen without impacting the core router, but that approach is quite difficult to leverage when you're trying to target a specific person or organization since the volume of unimportant information so greatly exceeds the targeted information. Scott Helms Vice President of Technology ZCorum (678) 507-5000 -------------------------------- http://twitter.com/kscotthelms -------------------------------- On Thu, Sep 5, 2013 at 7:20 AM, Eugen Leitl <eugen(a)leitl.org> wrote: > ----- Forwarded message from liberationtech(a)lewman.us ----- > > Date: Wed, 4 Sep 2013 22:27:46 -0400 > From: liberationtech(a)lewman.us > To: liberationtech(a)lists.stanford.edu > Subject: Re: [liberationtech] NSA Laughs at PCs, Prefers Hacking Routers > and Switches > Organization: The Tor Project, Inc. > X-Mailer: Claws Mail 3.9.2 (GTK+ 2.24.20; x86_64-pc-linux-gnu) > Reply-To: liberationtech <liberationtech(a)lists.stanford.edu> > > On Wed, 4 Sep 2013 20:33:09 -0400 > Robert Guerra <rguerra(a)privaterra.org> wrote: > > > > > Curious on people's comments on types of routers, firewalls and > > other appliances that might be affected as well as mitigation > > strategies. Would installing a pfsense and/or other open source > > firewall be helpful in anyway at a home net location? > > When I read this article, I read core routers and switches at ISPs, > like Cisco, Juniper, F5, etc. I don't read this as linksys, dlink, > netgear, etc. I'm sure NSA could crack into anything consumer > level with ease, it's likely any 4-bit criminal could do it too. > However, it makes more sense for NSA to watch the core connectivity > points on the Internet, rather than watching individuals, solely from > an economic effort versus benefit point of view. > > When I ran global networks, one can record everything and sort out the > individual streams later to find employees doing various layers of > fraud or not. There was no point in watching the end points because it > was too resource intensive. > > I'm sure the NSA has analyzed this and come to the same conclusion. > There's no point in going after tens of millions of endpoints, when you > can own them all with a handful of switches. > > A counterpoint is that most core Internet routers and switches are > running at capacity and any monitoring affects quality of service and > gets customers complaining. > > -- > Andrew > http://tpo.is/contact > pgp 0x6B4D6475 > -- > Liberationtech is a public list whose archives are searchable on Google. > Violations of list guidelines will get you moderated: > https://mailman.stanford.edu/mailman/listinfo/liberationtech. > Unsubscribe, change to digest, or change password by emailing moderator at > companys(a)stanford.edu. > > ----- End forwarded message ----- > -- > Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org > ______________________________________________________________ > ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org > AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5 > > ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Re: [tor-talk] Content and popularity analysis of Tor hidden services
by Eugen Leitl 05 Sep '13

05 Sep '13

----- Forwarded message from Asa Rossoff <asa(a)lovetour.info> ----- Date: Thu, 5 Sep 2013 04:36:14 -0700 From: Asa Rossoff <asa(a)lovetour.info> To: tor-talk(a)lists.torproject.org Subject: Re: [tor-talk] Content and popularity analysis of Tor hidden services X-Mailer: Microsoft Office Outlook 12.0 Reply-To: tor-talk(a)lists.torproject.org >From Lunar: > Eugen Leitl: >> http://cryptome.org/2013/09/tor-analysis-hidden-services.pdf >> >> Content and popularity analysis of Tor hidden services > > Watch out for dead horses [1] and see the previous discussion [2]. > > [1] https://en.wikipedia.org/wiki/Flogging_a_dead_horse > [2] https://lists.torproject.org/pipermail/tor-dev/2013-May/004909.html Whether or not all issues were discussed in detail or the same detail in the prior thread as well as in the paper, I don't know, but the paper has relevance beyond Tor network flaws: - It exposes an estimate on how manny hidden services existed at the time of the study - It gives a breakdown of what services/some of the services those hidden services offered. - It categories HTTP(S) services by content type, which is interesting. - It describes what resources they required to perform the attack, which sound relatively modest. - It highlights the botnet and botnet command and control activity on Tor. - It describes server configuration issues that allowed easily correlating the shared hosting of many services - It describes server configuration issues that allowed easily deanonymizing the true IP Address of some hidden services. The last two points are importasnt reminders of some of the pitfalls in attempting anonymization, and might be good to be documented in the wiki (if they're not) for setting up hidden services. The prior points are of social and historic value. The present situation with massively escalating numbers of Tor users/"users" highlights the threat that botnets might pose to the Tor network's ability to function. A botnet worm of course could also be used to create a largescale anonymity attack requiring many nodes. Today's RC just announced does some traffic prioritization which should be a bandaid for the current problem, but doesn't really address similar issues in the longterm. I don't know what solutions to propose, as obviously the fundamental rule is that this is an anonymous system, and we probably want to respect net neutrality to the point practical, but more thought/research/development may have to be done to guard against botnets threatening the functionality of the Tor network or botnets' potential to attack the network's anonymity features. Asa -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

2 1

US stops jailed activist Barrett Brown from discussing leaks prosecution
by Eugen Leitl 05 Sep '13

05 Sep '13

http://www.theguardian.com/world/2013/sep/04/barrett-brown-gag-order-us-gov… US stops jailed activist Barrett Brown from discussing leaks prosecution Federal court order prohibits Brown from talking to the media in what critics say is latest in crackdown on investigative journalism Ed Pilkington in New York theguardian.com, Wednesday 4 September 2013 22.50 BST Barrett Brown, Anonymous spokesman Brown's lawyer says the gagging order is a breach of Brown's first amendment rights. Photograph: Nikki Loehr A federal court in Dallas, Texas has imposed a gag order on the jailed activist-journalist Barrett Brown and his legal team that prevents them from talking to the media about his prosecution in which he faces up to 100 years in prison for alleged offences relating to his work exposing online surveillance. The court order, imposed by the district court for the northern district of Texas at the request of the US government, prohibits the defendant and his defence team, as well as prosecutors, from making "any statement to members of any television, radio, newspaper, magazine, internet (including, but not limited to, bloggers), or other media organization about this case, other than matters of public interest." It goes on to warn Brown and his lawyers that "no person covered by this order shall circumvent its effect by actions that indirectly, but deliberately, bring about a violation of this order". According to Dell Cameron of Vice magazine, who attended the hearing, the government argued that the gag order was needed in order to protect Brown from prejudicing his right to a fair trial by making comments to reporters. But media observers seen the hearing in the opposite light: as the latest in a succession of prosecutorial moves under the Obama administration to crack-down on investigative journalism, official leaking, hacking and online activism. Brown's lead defence attorney, Ahmed Ghappour, has countered in court filings, the most recent of which was lodged with the court Wednesday, that the government's request for a gag order is unfounded as it is based on false accusations and misrepresentations. The lawyer says the gagging order is a breach of Brown's first amendment rights as an author who continues to write from his prison cell on issues unconnected to his own case for the Guardian and other media outlets. In his memo to the court for today's hearing, Ghappour writes that Brown's July article for the Guardian "contains no statements whatsoever about this trial, the charges underlying the indictment, the alleged acts underlying the three indictments against Mr Brown, or even facts arguably related to this prosecution." The gag order does give Brown some room to carry on his journalistic work from prison. It says that he will be allowed to continue publishing articles on topics "not related to the counts on which he stands indicted". Following the imposition of the order, Ghappour told the Guardian: "The defense's overriding concern is that Mr Brown continue to be able to exercise his first amendment right as a journalist. The order preserves that ability." The lawyer adds that since the current defence team took over in May, Brown has made only three statements to the media, two of which where articles that did not concern his trial while the third ran no risk of tainting the jury pool. "Defendant believes that a gag order is unwarranted because there is no substantial, or even reasonable, likelihood of prejudice to a fair trial based on statements made by defendant or his counsel since May 1, 2013." Brown, 32, was arrested in Dallas on 12 September last year and has been in prison ever since, charged with 17 counts that include threatening a federal agent, concealing evidence and disseminating stolen information. He faces a possible maximum sentence of 100 years in custody. Before his arrest, Brown became known as a specialist writer on the US government's use of private military contractors and cybersecurity firms to conduct online snooping on the public. He was regularly quoted by the media as an expert on Anonymous, the loose affiliation of hackers that caused headaches for the US government and several corporate giants, and was frequently referred to as the group's spokesperson, though he says the connection was overblown. In 2011, through the research site he set up called Project PM, he investigated thousands of emails that had been hacked by Anonymous from the computer system of a private security firm, HB Gary Federal. His work helped to reveal that the firm had proposed a dark arts effort to besmirch the reputations of WikiLeaks supporters and prominent liberal journalists and activists including the Guardian's Glenn Greenwald. In 2012, Brown similarly pored over millions of emails hacked by Anonymous from the private intelligence company Stratfor. It was during his work on the Stratfor hack that Brown committed his most serious offence, according to US prosecutors – he posted a link in a chat room that connected users to Stratfor documents that had been released online. The released documents included a list of email addresses and credit card numbers belonging to Stratfor subscribers. For posting that link, Brown is accused of disseminating stolen information – a charge with media commentators have warned criminalises the very act of linking. As Geoffrey King, Internet Advocacy Coordinator for the Committee to Protect Journalists, has put it, the Barrett Brown case "could criminalize the routine journalistic practice of linking to documents publicly available on the internet, which would seem to be protected by the first amendment to the US constitution under current doctrine". In its motion to the Dallas district court, US prosecutors accuse Brown and his associates of having "solicited the services of the media or media-types to discuss his case" and of continuing to "manipulate the public through press and social media comments". It further accuses Ghappour of "co-ordinating" and "approving" the use of the media, and alleges that between them they have spread "gross fabrications and substantially false recitations of facts and law which may harm both the government and the defence during jury selection". But Ghappour in his legal response has pointed out that several of the specific accusations raised by the government are inaccurate. Prosecutors refer to an article in the Guardian by Greenwald published on 21 March 2013 based partly on an interview between the journalist and Brown, yet as Ghappour points out that piece was posted on the Guardian website before the accused's current legal team had been appointed. Under his legal advice, Ghappour writes, Brown has maintained "radio silence" over his case and has given no further interviews, thus negating the government's case for a gagging order.

1 0

Re: [liberationtech] NSA Laughs at PCs, Prefers Hacking Routers and Switches
by Eugen Leitl 05 Sep '13

05 Sep '13

----- Forwarded message from liberationtech(a)lewman.us ----- Date: Wed, 4 Sep 2013 22:27:46 -0400 From: liberationtech(a)lewman.us To: liberationtech(a)lists.stanford.edu Subject: Re: [liberationtech] NSA Laughs at PCs, Prefers Hacking Routers and Switches Organization: The Tor Project, Inc. X-Mailer: Claws Mail 3.9.2 (GTK+ 2.24.20; x86_64-pc-linux-gnu) Reply-To: liberationtech <liberationtech(a)lists.stanford.edu> On Wed, 4 Sep 2013 20:33:09 -0400 Robert Guerra <rguerra(a)privaterra.org> wrote: > > Curious on people's comments on types of routers, firewalls and > other appliances that might be affected as well as mitigation > strategies. Would installing a pfsense and/or other open source > firewall be helpful in anyway at a home net location? When I read this article, I read core routers and switches at ISPs, like Cisco, Juniper, F5, etc. I don't read this as linksys, dlink, netgear, etc. I'm sure NSA could crack into anything consumer level with ease, it's likely any 4-bit criminal could do it too. However, it makes more sense for NSA to watch the core connectivity points on the Internet, rather than watching individuals, solely from an economic effort versus benefit point of view. When I ran global networks, one can record everything and sort out the individual streams later to find employees doing various layers of fraud or not. There was no point in watching the end points because it was too resource intensive. I'm sure the NSA has analyzed this and come to the same conclusion. There's no point in going after tens of millions of endpoints, when you can own them all with a handful of switches. A counterpoint is that most core Internet routers and switches are running at capacity and any monitoring affects quality of service and gets customers complaining. -- Andrew http://tpo.is/contact pgp 0x6B4D6475 -- Liberationtech is a public list whose archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Content and popularity analysis of Tor hidden services
by Eugen Leitl 05 Sep '13

05 Sep '13

http://cryptome.org/2013/09/tor-analysis-hidden-services.pdf Content and popularity analysis of Tor hidden services July 29, 2013 Alex Biryukov University of Luxembourg alex.biryukov(a)uni.lu Ivan Pustogarov University of Luxembourg ivan.pustogarov(a)uni.lu Ralf-Philipp Weinmann University of Luxembourg ralf-philipp.weinmann(a)uni.lu ABSTRACT Tor hidden services allow running Internet services while protecting the location of the servers. Their main purpose is to enable freedom of speech even in situations in which powerful adversaries try to suppress it. However, providing location privacy and client anonymity also makes Tor hidden services an attractive platform for every kind of imaginable shady service. The ease with which Tor hidden services can be set up has spurred a huge growth of anonymously provided Internet services of both types. In this paper we analyse the landscape of Tor hidden services. We have studied Tor hidden services after collecting 39824 hidden service descriptors on 4th of Feb 2013 by exploiting protocol and implementation aws in Tor: we scanned them for open ports; in the case of HTTP services, we analysed and classified their content. We also estimated the popularity of hidden services by looking at the request rate for hidden service descriptors by clients. We found that while the content of Tor hidden services is rather varied, the most popular hidden services are related to botnets. Keywords Tor, hidden services, port scanning, classification

1 0