- cypherpunks@lists.ogf.org

Fwd: [Cryptography] FBI: Weaker Encryption Is a Worthwhile Tradeoff for Law Enforcement Access to Data
by grarpamp 17 Sep '15

17 Sep '15

---------- Forwarded message ---------- From: Henry Baker <hbaker1(a)pipeline.com> Date: Thu, Sep 17, 2015 at 1:15 PM Subject: [Cryptography] FBI: Weaker Encryption Is a Worthwhile Tradeoff for Law Enforcement Access to Data To: cryptography(a)metzdowd.com FYI -- Easy for the FBI to say; they're not on the hook for potentially billions in damages from any breach. (Leaving aside the egregious Constitutional violations.) http://www.nationaljournal.com/s/72407/fbi-weaker-encryption-is-worthwhile-… FBI: Weaker Encryption Is a Worthwhile Tradeoff for Law Enforcement Access to Data Government officials sparred with privacy advocates over encryption, but acknowledged that “back doors” come with risks of intrusion. Kaveh Waddell @kavehewaddell September 15, 2015 The Justice Department and the FBI are continuing their campaign to convince the tech community and the public that weakening encryption to allow law enforcement to access encrypted communications and data has its risks, but that the drawbacks are outweighed by the security advantages. Amy Hess, the executive assistant director of FBI’s science and technology branch, said at a Christian Science Monitor discussion that allowing access to encrypted messages to anyone other than the sender or the receiver comes with “some risk” of intrusion. But because law enforcement must be able to read encrypted data and communication to do its job, the risk of third-party access is acceptable, Hess said, as long as it is minimized. The Justice Department—-and especially the FBI—-has clashed with the technology community over the agency’s demands that online platforms stay away from encryption practices that keep data private even from the platforms themselves. If the communications service cannot access the data sent across its servers, it cannot turn the data over to law enforcement. Law enforcement has called on tech companies to take the lead in developing an encryption standard that is both secure and accessible to authorities upon request. Last week, FBI Director James Comey said technology experts just need to “try harder” to find a solution. But experts maintain that such a standard is impossible to achieve, because any third-party key for unlocking encrypted data—-even if reserved for extreme circumstances—-will be vulnerable to hackers. A company that builds vulnerabilities into its encryption becomes an attractive target of attack to foreign governments, criminal hackers, and “drooling teenagers in basements,” said Matt Blaze, a noted cryptography expert and professor at the University of Pennsylvania. Because companies are increasingly turning to stronger encryption, the FBI is running out of tools to fight crime, Hess said Tuesday. A request for a wiretap—-one of the most powerful surveillance tools available to the FBI—-is a long and complicated process that requires an agent to supply an extensive affidavit stating that every less-intrusive method of surveillance had already been considered or applied, according to Kiran Raj, Senior Counsel to the Deputy Attorney General. But Hess said FBI agents will not apply for wiretaps if they think a suspect is using encrypted communication, because they are not willing to expend the time and cost of crafting the request if the odds of its success are slim. The FBI’s claim was largely met with a shrug from privacy advocates. “A warrant is not a right that the government has to get data,” said Jon Callas, CEO of Silent Circle, a company that builds encrypted communications platforms. “It is a right to perform a search, to attempt to get the data, and there may be a lot of reasons why it can’t get to it.” But even as privacy advocates clashed with law enforcement officials onstage over the form encryption should take in the tech community, the groups said they both have the same objective—security—in mind. “The polarization of this debate is really harmful,” Blaze said. “I think that in terms of the end goals, there’s a lot more common ground here than maybe the debate lets on.” _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

1 0

Linux Foundation' Linux workstation security checklist
by Georgi Guninski 17 Sep '15

17 Sep '15

>From the reg: http://www.theregister.co.uk/2015/08/31/harden_like_linux_foundation/ with journo title: Linux Foundation releases PARANOID internal infosec guide The document appears to be: https://github.com/lfit/itpol/blob/master/linux-workstation-security.md Linux workstation security checklist Troll-friendly appears this claim: UEFI boot mode is used (not legacy BIOS) (CRITICAL) UEFI and SecureBoot (ask RMS ;-) )

8 15

Fwd: [Cryptography] An Open Source Analysis of NSA Cryptologic Capabilities
by grarpamp 17 Sep '15

17 Sep '15

---------- Forwarded message ---------- From: Ryan Carboni <ryacko(a)gmail.com> Date: Wed, Sep 16, 2015 at 5:27 PM Subject: [Cryptography] An Open Source Analysis of NSA Cryptologic Capabilities To: cryptography(a)metzdowd.com Timeline of Events of Note 1992 - DES is broken cryptanalytically, although with an attack greater than the birthday bound 1993 - SHA released, based on MD4/MD5 1995 - SHA-1 revised, original SHA now called SHA-0 1998 - Skipjack Released 1999 - Impossible Differential Analysis breaks 31 of 32 rounds 2001 - SHA-2 released, by Threefish's standards, a 256-round hash function 2005 - SHA-1 is broken by a non-practical attack, spurs SHA-3 competition 2010 - Xie and Feng announce a one block collision on MD5, which they cannot release for _security reasons._ The occasional cryptanalytic success implies that the NSA is generally more advanced, but not always. Cryptanalytic success seems to be a random process, but it requires previous successes to exist. The NSA seems to be more advanced than the Chinese, and the Chinese vaguely more advanced than the remaining cryptographic community. This can probably be attributed to the fact that the NSA has more money, has the support of other SIGINT agencies in cryptanalysis, and thus probably have half the world's mathematicians. Thus perhaps the NSA has a 42% chance of getting a genuinely new cryptanalytic success, the Chinese a 33%, and the rest of the world a 25% chance. The evidence to support such a claim is that impossible differential analysis nearly broke Skipjack, although maybe the NSA was aware of it and had less concerns about security margins than we think. Further attacks on SHA-1 and SHA-2 spurred the SHA-3 competition. While it was reasonable for the civilian cryptographic community to be concerned, the fact that the NSA was concerned is telling. It was a result they did not predict, and they possibly thought further cryptanalysis could break those two hash functions. Fortunately there is a large body of research on the cost efficiency of research programs. While one may conclude that the NSA must perpetually be making leaps and bounds ahead of everyone through the virtues of compound interest, the answer is pleasanter. There is a diseconomy of scale when it comes to research. For instance, the Moon program or the Manhattan project could have been cheaper if more time was allotted for its completion. Given that the nature of research changes over time as the easiest results are exhausted, and that large organizations do have waste, it is safe to say that any gap between NSA and civilian cryptography will shrink by a small extent, year over year. _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

1 0

US New Hampshire Needs Help Accepting Bitcoin For Taxes
by grarpamp 17 Sep '15

17 Sep '15

https://www.reddit.com/r/Bitcoin/comments/3l9cpq/tomorrow_0917_nh_will_try_… http://www.gencourt.state.nh.us/house/committees/billtext.aspx?billnumber=H… Tomorrow 09/17 NH will try to pass a bill to allow bitcoins to be used as a form of payment for taxes in the state. If you live in NH you can help by emailing them with your opinion. Link on comments. https://www.reddit.com/r/Bitcoin/comments/3l9fhi/tomorrow_im_testifying_in_… http://blog.lbry.io/testimony-to-subcommittee-on-hb552-to-legalize-bitcoin-… Tomorrow I'm Testifying in Favor of New Hampshire Accepting Bitcoin for Taxes and Fees

2 1

Re: [tor-talk] Torrents real-time and dynamic blocklist
by grarpamp 17 Sep '15

17 Sep '15

On Thu, Sep 17, 2015 at 6:09 AM, Aymeric Vitte <vitteaymeric(a)gmail.com> wrote: > Get the torrent dynamic blocklist: http://peersm.com/getblocklist > There is an annual fee to access the blocklist in order to finance this > work, make it evolve and finance our other privacy oriented projects. > Peersm : http://www.peersm.com/ Note that every post by this user advertises their own system / application of "torrenting". I say nothing more than that, do your own research.

1 0

Recommended Movie: "Sebastian" 1968.
by jim bell 17 Sep '15

17 Sep '15

Since people seem to be recommending things, I recommend the movie "Sebastian". Dirk Bogarde, Susannah York.https://www.youtube.com/watch?v=bIK3OYnD9MY Out of date even when it was made, I think it really represents the cryptography situation as of the 1930's. Jim Bell

4 6

JYA and Cryptome Passphrase Are Secure
by John Young 17 Sep '15

17 Sep '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 JYA and Cryptome passphrases are secure. Plaintext discovered not related to Cryptome, with alternative to decrypt: original not scrubbed. -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wsFVAwUBVfqf1UkY+k7YfUNsAQiovg/7BxJIAHhEUL65hjh4XsvwJlS91R1jE0zw LYBiut1uLPga1TZDH8L3NQP7Vq0y18yvsmch5n6Gy5AhQWbSZ7sJ2xP+ULc6uK+b MNpdaaCIgBVH4e83DVhyEh68r8qJ1fOhElW6WaLxXiPvDA/8WGKAhkpfR1/ghNpe SdbaY8PKIYzGYnXaESNhTKfsaiykO6FlaGMSYfyCe5Z4iEzB5HgCYLH1Nb+G91Q6 C2gcQSf6vBCzoPK99FxSAmqEahlECI1tNKJg5pH7uY3otzbuV7CcJ9Yn27MbrQvk dXJBIr1oMekz4d8Dp3b0hAvL394stKWsP5GfbZ4vvgltBKL0lVOwYMOFuHDXGTmb nANIUXvgbiIRUdX0u3uqk7I1NiChEGGwtA+7g4wTIqUy6SfviA0nTCu5Elka4T+j 32NLlxDpmLIM1KZ6t5YELz7CYVv2JYMNiOWkyAJOXbCglrJvpyvbyRLMuOEMgieD eICPHknwiHAdzI40eWVLpPaet0VKyqOvNb1cnjcA+NBUpH+idmcosNEBpvZVbZb0 99/4ii68qqz26N3xeIPxvmoSx9iXXRMUip4Iku4pQrbac64D/X3pck0ryd6yCaxU 8TldVI0oQVozp8H8VrP0ZICG+Y1vg//GYNorSJkoL3P3svwDfm/3WdcblWUrxhFw XVyThcbWdxQ= =XoD0 -----END PGP SIGNATURE-----

3 3

Re: [cryptography] a little help with cookies please
by grarpamp 17 Sep '15

17 Sep '15

What is of more crypto / security interest is not bandwidth use or even domain or path restrictions, but failure of webdevs to seed and restrict sensitive cookies (like your authenticated session id's) from and to TLS only sessions. Well known top100 sites that still have a legacy http mode fail to do this properly... banks, social, govt, etc. Even sites that immediately 302 your first hit (or other hits) over to https thereafter can be found doing it wrong. Ripe for wifi or wire monitoring based session stealing.

1 0

Fwd: [tor-talk] victory at kilton library
by grarpamp 17 Sep '15

17 Sep '15

https://freestateproject.org/blogs/historic-win-internet-freedom-nh-tor-nod… http://www.npr.org/2015/09/16/440914105/n-h-public-library-reconsiders-supp… ---------- Forwarded message ---------- From: Alison Macrina <macrina(a)riseup.net> Date: Wed, Sep 16, 2015 at 8:19 AM Subject: Re: [tor-talk] victory at kilton library To: tor-talk(a)lists.torproject.org > i just want to share the news that all of the hard work that has gone > into the library freedom project paid off today at kilton library. > despite pressure from the us federal government, which pulled out every > card to sell fear that they had in their hat, the local community > refused to accept it and thought on a global level to support the > library's choice to offer a tor relay to the public. > > this is truly a monumental moment. libraries in the usa have often been > the target of hostile actions that threaten the first amendment of the > us constitution and the privacy rights of people. through a long string > of legal battles, libraries have earned an extraordinary position that > provides them with the ability to offer services that could land other > people in significant legal battles which become both legally and > politically difficult to close down. > > i'd just like to say thank you to everyone involved in the library > freedom project who came up with the idea and didn't run away from the > fight. this is an excellent beginning. > > if you can, please send your support to the library freedom project. > https://libraryfreedomproject.org/donate > > this is a great victory for today. Thank you! I think I can speak for both mrphs and myself when I say that we are thrilled with the outcome. What we saw last night was an incredible display of community support for free speech and Tor, and an unequivocal rejection of unlawful government intrusion and FUD. The Lebanon Libraries staff and community did something historic; I've been an activist for a long time and I've never been a part of a direct action quite like that. This is what happens when communities come together to resist. Please keep an eye out for more news coverage. The local news in NH has already put something up with a few great quotes from community members present: http://www.vnews.com/home/18620952-95/library-joins-privacy-network If you're on twitter, say hi to @leblibraries or @nhleblibraries -- the second one is library director Sean Fleming, and I know he'd be moved to hear from folks in the Tor community about what his library community did last night. Thanks all for your support. We just had the world's first Tor protest, and it was a wild success. Imagine all the library exit relays we're gonna get now. :) Alison (director of Library Freedom Project) -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

1 0

peer to peer hypermedia protocol
by Michael Best 16 Sep '15

16 Sep '15

Tried to send this last week. but apparently I'd been unsubscribed from the list. Some interesting possibilities here, especially when combined with extra layers of encryption. "IPFS is a distributed file system that seeks to connect all computing devices with the same system of files. In some ways, this is similar to the original aims of the Web, but IPFS is actually more similar to a single bittorrent swarm exchanging git objects. IPFS could become a new major subsystem of the internet. If built right, it could complement or replace HTTP. It could complement or replace even more. It sounds crazy. It is crazy." Main page: http://ipfs.io/ Overview:https://github.com/ipfs/papers/raw/master/ipfs-cap2pfs/ipfs-p2p-fi… Git: https://github.com/ipfs/ipfs/ Alpha demo: https://www.youtube.com/watch?v=8CMxDNuuAiQ Why we must distribute the web: https://youtu.be/skMTdSEaCtA

1 0