- cypherpunks@lists.ogf.org

bitcoin
by Juan Garofalo 27 Jan '14

27 Jan '14

So, what do you think is going to happen 'if' bitcoin ever threatens the 'integrity' of the financial mafia, I mean, the integrity of the financial system of the Free and Democratic World?

9 18

Re: Infiltration/Exfiltration
by Anonymous Remailer (austria) 27 Jan '14

27 Jan '14

On 01/20/2014 09:17 AM, John Young wrote: > This how Cryptome got its first contributions from this cave. And > still does along with a long list of others. WikiLeaks and Snowden > the best yelled about, but far from disclosing the most information > which is done quietly and without "batshit" hyperbole and vulgar > braggardy. I'm talking about something slightly different here. With most of the information on Cryptome, it looks like someone came across some information and decided to exfiltrate it. They probably weren't deliberately looking for it or had joined the agency for the specific purpose of having access to and leaking such information. In this case, I'm talking about actual infiltration: going in with the explicit purpose of betraying the secrecy of the organization and getting valuable data out of it. > Claims of needing journalism and slow drips to hold public attention > are merely monetizing justifications. Biblical fundamentalism. I too wish the leaks would come at a faster pace. But I don't think Snowden posting the leaks to, say, an FTP server somewhere would have got any response. There are too many leaks with too much technical jargon. Joe Average would have given up after the first four pages. What the Guardian and other media outlets are doing is making the information more accessible to people. I wish they'd do it more quickly, yes, but I do think there is some value in what they're doing. > And may be much worse, as in the Snowden case, a rationale > for not releasing information except to a few selected abusers, > journalistic, technical and political "freedom of informaton." In > the bogosity of "doing no harm to national security" just like > secretkeepers who use that exact lingo. I'll admit here that I am not someone who believes that there should be no secrets. I do believe keeping certain things secret, at least for a little while, has value. But those things should respect civil and human rights and adhere to the principles of the Constitution. In too many cases, Snowden and Ellsberg being prime examples, official secrecy was used for no other reason than to cover up wrongdoing. The "national security" bullshit was just that - bullshit because they could. That's why I think we need more deliberate infiltrators. People who are well versed in the Constitution with a strong bend for civil and human rights. People who don't buy into the bullshit but also see value in some of the work being done. Someone who can filter through that and find what needs to be exposed while still protecting what shouldn't be.

6 9

mixmaster with 4096-bit RSA
by Anonymous Remailer (austria) 26 Jan '14

26 Jan '14

There is a mixmaster version that allows RSA keys of 4096 bits. http://www.zen19351.zen.co.uk/mixmaster302/ This is compatible with current s/w at size 1024 but for larger keys uses additional HMAC integrity and AES encryption steps over the 3DES and MD5 already present. Temporary test remailers are set up (do not use for real sensitive traffic). Test this new version and be ready for remailer key upgrades. This is the error legacy mixmaster generates with a large RSA key. $ fortune | ./mixmaster --chain=carrots -s test --to=abuse(a)carrots.org.uk Error: Encryption failed! carrots carrots(a)carrots.org.uk ad5a9748f33dd704dc85ae1dd1287870 2:3.0.2 CNm 2013-11-06 2014-01-15 -----Begin Mix Key----- ad5a9748f33dd704dc85ae1dd1287870 1026 ABDgYu+FBuHFxPHl1vH23f+V4+YH2NZg4HxFGxA1 QVUlG31H9QjYCjuwpbNOnwmNG6BpGL6CglP7W6T7 bFl2Dv+ptQkASiTm4Wj87w3AdoI+mGXU2bBe4k81 holEIXlCozL+P5Sw6TBKPXkyBBnP/5BBHATl1Q4J FmpX/B7e7ZqlLdkc3wpY4QlXtMF4+KnurKAxUI7e ruVr4W93+hFpJBB6WPP4CZaVEsIuqTKDUndWCcH2 xJMW8eLrqlm/ZR/kGmFTiOio0cM6dhrpaow+OMtg xPktl2joXhJYDZ3tFNJ9MduIrbaXRe9xtD8MqA6c NQBRE9fRM6gl8MfewYPEOTnxliCqoSYEeb7FZBvF IoBQIpJqkddO+zi+pw47TKEoo4eJs74Hq8hN6sA7 7SeJn4Ej9sOxKQgeLeb+RGyCtWdgllIAgWQGuU1q xPQqxCCx6Yo4VKU8GUfE5RtLxKwWCbCWpXJrhHjt g1rL7slvDhkbVUNFj02hq5tmr22+lr3eKW81hiwe 6B8kJV8w+MtFOy1H/IamhwSJyb6xCqbPB7hbobX0 5iHY76BDJQpx8LH/9SeNOkSjO+2x+LzEt9Whz4jT Ll+kxHS6a0lJBWKvWi4ikJV+oDM+XsiuQXE5yL61 jyF/tIX9eYaz3WVZxwEPcVypGVRqrq8jlhWPYpJe mqrW4wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAQAB -----End Mix Key----- coconuts coconuts(a)coconuts.org.uk bb6cf51abe871947a759ecb5b97ffa3f 2:3.0.2 MCNm 2013-11-11 2014-01-30 -----Begin Mix Key----- bb6cf51abe871947a759ecb5b97ffa3f 1026 ABCiAmzGS+qdEddcI9isI5Z/7VFu5KewVGYUwhDN hqq2DP49GXEui584aeyCN5llmVGEck9hcYA9DUiw /yVU/pxfaBfjf5PvFSckG+cagcL30hwTUIzz7KEK zyr0eamM1y74kUgMbnsldSdoeS66bundJhKd4z+F xgdLWdf355UIzXq94PXOi51x85A6nUVjfUetsUhW ZbknbCjCUlKkM2zV1Ty1gcxMzE6GoVRUmymYXJda 1cWoHQvITwx/lWGLGVu0cTb09bbFTY1IghviJOaF UkMtMoDqQYFcaYBcmK/2ghmuFZsoIjiyGkvIPliV vMyX8hCUZUYpIHuF65KLfnddCYQek5DqnYNQ3aFT H34MdXWIOZwoGQmy3/JJ66UnDfPOMDQK1nFimBjr SVwDGT4tgbpYxBN7ytqxQxlVxQ99s5BnraLCVlpW BiKhHLS48zZMnlp0S3ffcmaijJ60TKJOR0gkxqAA hxBoszpN+0Z9KSOmDxP/HYM7ZBFzSyFcPGTpqTXp ZFrcIfG64rf8IfVgWryuubYUkcyy04aygSzHBMl6 yln4vGKJJ8/z/zd9HEvATKkJ4kqiscY6yV96D2hl KKtbGn2QUVCbH6v64wF0/a5d+z2ZKrEOYhL7EmPI gLGQCcv9W7m5tdaBa4LXu09dArWNPwmwpOOC787T yp42ewAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAQAB -----End Mix Key-----

1 0

HOPE X Call For Speakers
by Greg Newby 26 Jan '14

26 Jan '14

Attention all hackers, makers, whistleblowers, artists, phone phreaks, rebels, technologists, and free thinkers everywhere! Come and share your ideas, thoughts, and passions with thousands of really bright, creative, and open-minded people in New York City this summer at HOPE X. We have room for around 100 talks and panels covering a wide range of topics, limited only by our collective imagination. Past talks and panels have included: anonymity, surveillance and countersurveillance, social engineering, hardware hacking, cryptography, privacy, security, censorship, programming, democracy and law, digital protests, society hacking, copyright, phone phreaking and telecommunications, new technologies, all manner of experimentation, and so much more. We are constantly searching for innovative subjects and presentation formats. Come and show us what you've got! All types of presentations are encouraged, from solo talks to panels, debates, demonstrations, and interactive discussions. (Workshop ideas and art exhibitions are also welcome - see the applicable sections on the HOPE X site.) Most presentations will be allotted 55 minutes - including time for questions from the audience. If you would like to be a speaker, submit a title and a description of the proposed presentation (two to three paragraphs) along with a short biography (three or four sentences will suffice). Submissions should be sent by email to speakers(a)hope.net. Be sure to tell us why you think the topic and content are relevant to the hacker community and to HOPE X attendees. We also recommend reading our additional tips on speaker submissions which can be found at http://x.hope.net under "Call for Participants."

2 1

Microsoft claims to fight back against NSA
by Jim Bell 25 Jan '14

25 Jan '14

From: http://news.yahoo.com/microsoft-bold-plan-beat-nsa-053014453.html "Microsoft is tired of waiting for the United States government to rein in the National Security Agency so it’s taking matters into its own hands. The Financial Times reports that Microsoft “will allow foreign customers to have their personal data stored on servers outside the U.S.,” a move that other tech companies such as Google have so far resisted due to cost concerns. However, Microsoft’s general counsel Brad Smith tells The Financial Times that “people should have the ability to know whether their data are being subjected to the laws and access of governments in some other country and should have the ability to make an informed choice of where their data resides.” That Microsoft is willing to go this far shows how much the NSA spying scandal has damaged trust between American tech companies and their international customers. Microsoft even took the unusual step late last year of classifying the United States government as “advanced persistent threat” to its customers’ security, a designation that the company normally uses only cyber terrorists sponsored by foreign governments." --------------------------quote ends------------------------------------------------------- Jim Bell's comment begins: Well, I suppose it's desirable that such big companies talk like they're fighting back against USG/NSA, but their final 'bite' had better be far more serious and definitive than their current 'bark'. Jim Bell

2 1

request for leaks: standards for secret (not published) true hardware random number generator requirements used by NSA
by coderman 25 Jan '14

25 Jan '14

on an unrelated tangent, also curious about the secret encryption suites (better than AES/ECDSA/ECDH/SHA? or just undisclosed different?[0]) perhaps the only individual who designed and implemented thought he was working on coding for radios lugged by grunts out in fields of adventure, now long retired into obscurity forever more... been trying to buy me some blackers with bitcoin; coming up empty not even a mucked boot for my fishing function. is it so much to ask??? best regards, except to earthhumans 0. that is to say, could this be true by tweaking constants and growing key bits? AES ~= MEDLEY ECDSA ~= SHILLELAGH ECDH ~= BATON SHA ~= SAVILLE ADH ~= WALBURN TRNG ~= JOSEKI-1 bonus points for leaking to https://en.wikipedia.org/wiki/NSA_Suite_A_Cryptography via the NSA TAO Covert Network!

1 3

Re: RFP: FOIA with privacy waivers[0] for oversight
by coderman 25 Jan '14

25 Jan '14

On Thu, Nov 28, 2013 at 12:25 PM, coderman <coderman(a)gmail.com> wrote: > Request for participants > > FOIA with privacy waivers[0] ... it is in my best interest not to pursue this effort any further. the donations received for this have gone to Cryptome instead for their FOIA efforts. if you would like to pursue your own requests please do so: "Citizen's Guide on Using the Freedom of Information Act" https://www.fas.org/sgp/foia/citizen.html and DOJ_361_revised_2-certification_of_identity.pdf if making requests on behalf other individuals. freedom of information laws are important and should be supported! perhaps i can do more at a later date...

1 0

dear Eve,
by coderman 25 Jan '14

25 Jan '14

it was fun! i assume we have come to an understanding - security, like anonymity, is best as public good that floats all boats UPSTREAM (even if current reality far from vision of ideal). hopefully a good arrangement not needlessly obstructed... best regards, except to the surreptitious surveillance-ers; you're the outlier here! love, codermange --- many of the best detections for advanced attacks involved not-quite consumer hardware and customized systems for distributed storage, observation, and processing. this is way beyond the budget, skill, and time afforded even modestly technical users for most intents and purposes. however, sometimes simple measures to thwart attacks combined with a keen situational awareness can identify sophisticated attacks with less technical means. anomalies signal to attempt counter measures and initiate in depth scrutiny. --- consider the following, - baseband attack against mobile target: + cannot "hot patch" running image, as some changes take effect during initialization. force push results in restart. anomaly #0. + battery longevity one third what expected, distinct transition post-baseband-push for longevity of full charge - power consumption doesn't lie. anomaly #1. + abnormal signal power level for well known location for cell link. anomaly #2. + outbound dial attempts cannot put cell radio into lower bitrate audio call mode - outbound dial attempts fail - serious anomaly #3. (workaround of making call immediately on boot appears effective, and keeping a call in voice mode appears to thwart data exfiltation when no wifi uplink avail. + (technical but possible) pushed baseband needs to pass authentication of image; signature valid, revision same as prior mtd partition archive version, however sha digests do NOT match! this is not expected for the same build version. anomaly #4. --- consider the following, - BIOS attack with post-boot re-infection vector triggered once graphics mode transitions from console to graphical display: + target hardware is a match and supported, however, root file system is XFS, ZFS, or other unsupported *nix variant. attempt to persist by injection on file system using kernel fs funcs and data structures (this gets around FDE by interacting before luks/mdcrypt/loopaes/cryptoloop layer) thus causes kernel panic. anomaly #0. [note: A for effort++ by setting a not-again flag after first attempt. this prevents the kernel panic from becoming a persistent DoS as the next boot attempt will complete normally into graphical desktop. Subsequent reactivation follows similar fail safe of next boot succeeding after post boot persistent hook failure and kernel panic.] --- consider the following, - SMS MitM attack against Android mobile target: + normal delivery of SMS using a client such as TextSecure that checks for delivery confirmation on SMS, (do NOT use fire-and-forget like majority of text clients). attack introduces latency on confirmation due to radio mode switching between high rate exfiltation mode and low rate SMS with additional MitM proxy processing latency added as well. this results in messages initially showing "Message delivery failed" before shortly then confirming successful transmisssion. anomaly #0. + abnormal signal power level for well known location for cell link. anomaly #1.

2 2

An Open Letter from US Researchers in Cryptography and Information Security
by Alex J. Martin 25 Jan '14

25 Jan '14

# Posted to http://masssurveillance.info/ January 24, 2014 Media reports since last June have revealed that the US government conducts domestic and international surveillance on a massive scale, that it engages in deliberate and covert weakening of Internet security standards, and that it pressures US technology companies to deploy backdoors and other data-collection features. As leading members of the US cryptography and information-security research communities, we deplore these practices and urge that they be changed. Indiscriminate collection, storage, and processing of unprecedented amounts of personal information chill free speech and invite many types of abuse, ranging from mission creep to identity theft. These are not hypothetical problems; they have occurred many times in the past. Inserting backdoors, sabotaging standards, and tapping commercial data-center links provide bad actors, foreign and domestic, opportunities to exploit the resulting vulnerabilities. The value of society-wide surveillance in preventing terrorism is unclear, but the threat that such surveillance poses to privacy, democracy, and the US technology sector is readily apparent. Because transparency and public consent are at the core of our democracy, we call upon the US government to subject all mass-surveillance activities to public scrutiny and to resist the deployment of mass-surveillance programs in advance of sound technical and social controls. In finding a way forward, the five principles promulgated at http://reformgovernmentsurveillance.com/ provide a good starting point. The choice is not whether to allow the NSA to spy. The choice is between a communications infrastructure that is vulnerable to attack at its core and one that, by default, is intrinsically secure for its users. Every country, including our own, must give intelligence and law-enforcement authorities the means to pursue terrorists and criminals, but we can do so without fundamentally undermining the security that enables commerce, entertainment, personal communication, and other aspects of 21^st -century life. We urge the US government to reject society-wide surveillance and the subversion of security technology, to adopt state-of-the-art, privacy-preserving technology, and to ensure that new policies, guided by enunciated principles, support human rights, trustworthy commerce, and technical innovation. /Martín Abadi / Professor Emeritus, University of California, Santa Cruz /Hal Abelson / Professor, Massachusetts Institute of Technology /Alessandro Acquisti / Associate Professor, Carnegie Mellon University /Boaz Barak / Editorial-board member, /Journal of the ACM/^1 /Mihir Bellare / Professor, University of California, San Diego /Steven Bellovin / Professor, Columbia University /Matt Blaze/ Associate Professor, University of Pennsylvania /L. Jean Camp / Professor, Indiana University /Ran Canetti / Professor, Boston University and Tel Aviv University /Lorrie Faith Cranor / Associate Professor, Carnegie Mellon University /Cynthia Dwork / Member, US National Academy of Engineering /Joan Feigenbaum / Professor, Yale University /Edward Felten / Professor, Princeton University /Niels Ferguson / Author, /Cryptography Engineering: Design Principles and Practical Applications/ /Michael Fischer / Professor, Yale University /Bryan Ford / Assistant Professor, Yale University /Matthew Franklin / Professor, University of California, Davis /Juan Garay / Program Committee Co-Chair, CRYPTO^2 2014 /Matthew Green/ Assistant Research Professor, Johns Hopkins University /Shai Halevi / Director, International Association for Cryptologic Research /Somesh Jha / Professor, University of Wisconsin -- Madison /Ari Juels / Program Committee Co-Chair, 2013 ACM Cloud-Computing Security Workshop^1 /M. Frans Kaashoek / Professor, Massachusetts Institute of Technology /Hugo Krawczyk / Fellow, International Association for Cryptologic Research /Susan Landau / Author, /Surveillance or Security? The Risks Posed by New Wiretapping Technologies/ /Wenke Lee / Professor, Georgia Institute of Technology /Anna Lysyanskaya / Professor, Brown University /Tal Malkin / Associate Professor, Columbia University /David Mazières / Associate Professor, Stanford University /Kevin McCurley / Fellow, International Association for Cryptologic Research /Patrick McDaniel / Professor, The Pennsylvania State University /Daniele Micciancio / Professor, University of California, San Diego /Andrew Myers / Professor, Cornell University /Rafael Pass/ Associate Professor, Cornell University /Vern Paxson / Professor, University of California, Berkeley /Jon Peha / Professor, Carnegie Mellon University /Thomas Ristenpart / Assistant Professor, University of Wisconsin -- Madison /Ronald Rivest / Professor, Massachusetts Institute of Technology /Phillip Rogaway / Professor, University of California, Davis /Greg Rose / Officer, International Association for Cryptologic Research /Amit Sahai / Professor, University of California, Los Angeles /Bruce Schneier / Fellow, Berkman Center for Internet and Society, Harvard Law School /Hovav Shacham / Associate Professor, University of California, San Diego /Abhi Shelat / Associate Professor, University of Virginia /Thomas Shrimpton / Associate Professor, Portland State University /Avi Silberschatz / Professor, Yale University /Adam Smith / Associate Professor, The Pennsylvania State University /Dawn Song / Associate Professor, University of California, Berkeley /Gene Tsudik / Professor, University of California, Irvine /Salil Vadhan / Professor, Harvard University /Rebecca Wright / Professor, Rutgers University /Moti Yung / Fellow, Association for Computing Machinery^1 /Nickolai Zeldovich / Associate Professor, Massachusetts Institute of Technology ------------------------------------------------------------------------ This letter can be found at: http://MassSurveillance.info Institutional affiliations for identification purposes only. This letter represents the views of the signatories, not necessarily those of their employers or other organizations with which they are affiliated. ^1 The Association for Computing Machinery (ACM) is the premier organization of computing professionals. ^2 CRYPTO is an annual research conference sponsored by the International Association for Cryptologic Research.

1 0

BurnerPhone
by Rich Jones 25 Jan '14

25 Jan '14

https://www.burnerphone.us/ Anonymous burners for 75$ in BTC. Sweet. http://blog.burnerphone.us/ "Right now, we sell a single item: a Burner Kit, which: - Comes with a new quality disposable GSM cell phone. - Comes with a pre-installed 30 day SIM card that provides you with unlimited US calling and unlimited international SMS. - Comes with a pre-charged phone battery ready for usage when it arrives. - Comes with on demand 2-minute activation. You can *activate* your Burner when you *need* it — this way you can hold onto it until necessary, then activate it and start your 30 days of usage. - Comes with nationwide coverage in the USA — no matter where you are on our nationwide GSM network, you’ll have service. - Can be bought with Bitcoin or Bank Card for 75$. - Can be thrown away (or recycled) when you’re finished with it — making it *extremely difficult* for third parties monitoring your communications to figure out *who you are* or *where you are*." Run by the wonderful @rdegges <https://github.com/rdegges>. Could be old news, but I just found out about it and thought I'd share.. R

3 3