- cypherpunks@lists.ogf.org

Re: [cryptography] Bruce Schneier on BULLRUN and related NSA programs
by Eugen Leitl 06 Sep '13

06 Sep '13

----- Forwarded message from ianG <iang(a)iang.org> ----- Date: Fri, 06 Sep 2013 13:01:54 +0300 From: ianG <iang(a)iang.org> To: cryptography(a)randombit.net Subject: Re: [cryptography] Bruce Schneier on BULLRUN and related NSA programs User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130801 Thunderbird/17.0.8 On 6/09/13 10:49 AM, coderman wrote: > select quotes from > > "The NSA Is Breaking Most Encryption on the Internet" > http://www.schneier.com/blog/archives/2013/09/the_nsa_is_brea.html > > """ > Remember this: The math is good, but math has no agency. Code has > agency, and the code has been subverted. Nice quote! > Bruce Schneier • September 5, 2013 7:32 PM > > "You recommended to 'Prefer symmetric cryptography over public-key > cryptography.' Can you elaborate on why?" Some of us have been saying this for a while. E.g., " #2.4 Avoid Public Key Cryptography like the Plague Public key cryptography is the kiss of death to simplicity. The problem is that it is not simple, not amenable to KISS, and full of traps that will swallow a battleship. Although the very basic idea is understandable and elegant, none of the instantiations of public key cryptography can create simple interfaces that are free of minefields. ..." http://iang.org/ssl/h2_divide_and_conquer.html#h2.4 > It is more likely that the NSA has some fundamental mathematical > advance in breaking public-key algorithms than symmetric algorithms. It is more likely that the implementors made a mistake. This can be seen also in that all the symmetric algorithms are amenable to black-box and deterministic testing, whereas the asymmetric ones are not so amenable. Oh, and forget the key sizes. This is not about the key sizes. iang _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

The US government has betrayed the Internet. We need to take it back
by Eugen Leitl 06 Sep '13

06 Sep '13

http://www.theguardian.com/commentisfree/2013/sep/05/government-betrayed-in… The US government has betrayed the Internet. We need to take it back The NSA has undermined a fundamental social contract. We engineers built the Internet – and now we have to fix it Bruce Schneier The Guardian, Thursday 5 September 2013 20.04 BST Internet business cables in California. 'Dismantling the surveillance state won't be easy. But whatever happens, we're going to be breaking new ground.' Photograph: Bob Sacha/Corbis Government and industry have betrayed the Internet, and us. By subverting the Internet at every level to make it a vast, multi-layered and robust surveillance platform, the NSA has undermined a fundamental social contract. The companies that build and manage our Internet infrastructure, the companies that create and sell us our hardware and software, or the companies that host our data: we can no longer trust them to be ethical Internet stewards. This is not the Internet the world needs, or the Internet its creators envisioned. We need to take it back. And by we, I mean the engineering community. Yes, this is primarily a political problem, a policy matter that requires political intervention. But this is also an engineering problem, and there are several things engineers can – and should – do. One, we should expose. If you do not have a security clearance, and if you have not received a National Security Letter, you are not bound by a federal confidentially requirements or a gag order. If you have been contacted by the NSA to subvert a product or protocol, you need to come forward with your story. Your employer obligations don't cover illegal or unethical activity. If you work with classified data and are truly brave, expose what you know. We need whistleblowers. We need to know how exactly how the NSA and other agencies are subverting routers, switches, the Internet backbone, encryption technologies and cloud systems. I already have five stories from people like you, and I've just started collecting. I want 50. There's safety in numbers, and this form of civil disobedience is the moral thing to do. Two, we can design. We need to figure out how to re-engineer the Internet to prevent this kind of wholesale spying. We need new techniques to prevent communications intermediaries from leaking private information. We can make surveillance expensive again. In particular, we need open protocols, open implementations, open systems – these will be harder for the NSA to subvert. The Internet Engineering Task Force, the group that defines the standards that make the Internet run, has a meeting planned for early November in Vancouver. This group needs to dedicate its next meeting to this task. This is an emergency, and demands an emergency response. Three, we can influence governance. I have resisted saying this up to now, and I am saddened to say it, but the US has proved to be an unethical steward of the Internet. The UK is no better. The NSA's actions are legitimizing the Internet abuses by China, Russia, Iran and others. We need to figure out new means of Internet governance, ones that makes it harder for powerful tech countries to monitor everything. For example, we need to demand transparency, oversight, and accountability from our governments and corporations. Unfortunately, this is going play directly into the hands of totalitarian governments that want to control their country's Internet for even more extreme forms of surveillance. We need to figure out how to prevent that, too. We need to avoid the mistakes of the International Telecommunications Union, which has become a forum to legitimize bad government behavior, and create truly international governance that can't be dominated or abused by any one country. Generations from now, when people look back on these early decades of the Internet, I hope they will not be disappointed in us. We can ensure that they don't only if each of us makes this a priority, and engages in the debate. We have a moral duty to do this, and we have no time to lose. Dismantling the surveillance state won't be easy. Has any country that engaged in mass surveillance of its own citizens voluntarily given up that capability? Has any mass surveillance country avoided becoming totalitarian? Whatever happens, we're going to be breaking new ground. Again, the politics of this is a bigger task than the engineering, but the engineering is critical. We need to demand that real technologists be involved in any key government decision making on these issues. We've had enough of lawyers and politicians not fully understanding technology; we need technologists at the table when we build tech policy. To the engineers, I say this: we built the Internet, and some of us have helped to subvert it. Now, those of us who love liberty have to fix it. • Bruce Schneier writes about security, technology, and people. His latest book is Liars and Outliers: Enabling the Trust That Society Needs to Thrive. He is working for the Guardian on other NSA stories

1 0

regarding the NSA crypto "breakthrough"
by coderman 06 Sep '13

06 Sep '13

of all the no such agency disclosures, this one fuels the most wild speculation. """ James Bamford, a veteran chronicler of the NSA, describes the agency as having made "an enormous breakthrough several years ago in its ability to cryptanalyze, or break, unfathomably complex encryption systems employed by not only governments around the world but also many average computer users". That sounds a lot like saying that the the spooks have managed to break at least some of the cryptographic codes that protect everything from secure e-mail to e-commerce. """ however, the crypto breakthrough discussed is more mundane: deployment of deep packet inspection with SSL/TLS capabilities.[0] this represents three significant efforts: 1. upgrading physical infrastructure (DPI systems at this scale use ASICs for processing, not software which can be upgraded on demand.) 2. secret partnerships with service providers to obtain server SSL/TLS secret keys. 3. key distribution to provision the DPI classifiers/sniffers with requisite secret keys when updated by service providers. hence, a "crypto breakthrough" providing unprecedented actionable visibility into previously opaque streams, with such inspection occurring at the edges rather than the mothership (where all encrypted data is sent, decryptable or not...) these efforts are compartmented, with few aware of how these different pieces fit together, thus fueling speculation about the nature of this break. from a technician point of view, you would notice the new ability to see inside SSL traffic, but may not understand how it was done. (e.g. with keys handed over in secret agreement for "reasonable compensation" and national security, rather than a basement full of quantum computers breaking web server keys...) class break in discrete log? quantum code crackers? you've been watching too much Sneakers![1] ;) 0. "SSL: Intercepted today, decrypted tomorrow" , should read "SSL: Intercepted and decrypted in real-time, almost everywhere" http://news.netcraft.com/archives/2013/06/25/ssl-intercepted-today-decrypte… less than a third of a percent of SSL/TLS web traffic uses forward secrecy! 1. "Sneakers" still the best hacker film to date... http://www.imdb.com/title/tt0105435/

4 8

Re: Bruce Schneier on BULLRUN and related NSA programs
by John Young 06 Sep '13

06 Sep '13

Thanks for this pointer which leads to Schneier's two reports in the Guardian about cooperating with Greenwald. As head of BT security it is hard to believe that Schneier did not know about BT's covert cooperation with GCHQ and NSA. His NDA with BT would likely prevent disclosing that knowledge along with protection of his vaunted rep as an incorruptible FOI battler. Similarly with other notable comsec wizards, the duplicity of NSA and GCHQ should not be a surprise unless pretense of surprise is part of the highly rewarding covert cooperation. Cryptographers are of necessity shady operators, the louder they profess trustworthiness the more likely not, NSA and GCHQ role models and dispensers of lucre the role model. I seem to recall that there is an inverse relationship between advertized trust and deserved. Modest and quiet cryptographers have superior ethics over word artists. So a good match between commercially successful essayists Schneier and Greenwald. Let the haughty rhetoric gush. And as Schneier blogs, wise to keep secrets in their pocket(book)s. And as he demurs to the Guardian and others on why not release all the Snowden docs, presumably the docs need careful vetting to prevent embarassing disclosures of duplicity of media and comsec wizards, a tradition as old as comsec. Schneier's aptly revealing humor about crypto weakness: it's never the math, its the agents of the code. At 03:49 AM 9/6/2013, you wrote: >select quotes from > >"The NSA Is Breaking Most Encryption on the Internet" > http://www.schneier.com/blog/archives/2013/09/the_nsa_is_brea.html > >""" >Remember this: The math is good, but math has no agency. Code has >agency, and the code has been subverted. >... >[regarding magic curve constants] >Bruce Schneier September 5, 2013 4:07 PM >I no longer trust the constants. I believe the NSA has manipulated >them through their relationships with industry. >... > >Bruce Schneier September 5, 2013 7:32 PM > >"You recommended to 'Prefer symmetric cryptography over public-key >cryptography.' Can you elaborate on why?" > >It is more likely that the NSA has some fundamental mathematical >advance in breaking public-key algorithms than symmetric algorithms. > >[EDITOR: the safety margin for key lengths over time is definitely >more reassuring for symmetric ciphers*. and aggravating that hardware >security products and other encryption appliances and systems do not >accomodate 4k or even 2k keys well, not to mention the varied cipher >suites you may prefer...] >... >Bruce Schneier September 5, 2013 4:58 PM >"Why are you not going to write about those 'other few things'? Can >you write about the here please? > >I want to keep some secrets in my back pocket. >""" > > >* key length recommendations in bits >Lenstra and Verheul Equations (2000) >symmetric: 70 >pubkey. 952 >hash: 140 > >compare to: ECRYPT II 2011-2015 >symmetric: 80 >pubkey: 1248 >hash: 160 > >and considering projection: ECRYPT II >2041 >symmetric: 256 >pubkey: 15424 >hash: 512

1 0

Bruce Schneier on BULLRUN and related NSA programs
by coderman 06 Sep '13

06 Sep '13

select quotes from "The NSA Is Breaking Most Encryption on the Internet" http://www.schneier.com/blog/archives/2013/09/the_nsa_is_brea.html """ Remember this: The math is good, but math has no agency. Code has agency, and the code has been subverted. ... [regarding magic curve constants] Bruce Schneier • September 5, 2013 4:07 PM I no longer trust the constants. I believe the NSA has manipulated them through their relationships with industry. ... Bruce Schneier • September 5, 2013 7:32 PM "You recommended to 'Prefer symmetric cryptography over public-key cryptography.' Can you elaborate on why?" It is more likely that the NSA has some fundamental mathematical advance in breaking public-key algorithms than symmetric algorithms. [EDITOR: the safety margin for key lengths over time is definitely more reassuring for symmetric ciphers*. and aggravating that hardware security products and other encryption appliances and systems do not accomodate 4k or even 2k keys well, not to mention the varied cipher suites you may prefer...] ... Bruce Schneier • September 5, 2013 4:58 PM "Why are you not going to write about those 'other few things'? Can you write about the here please? I want to keep some secrets in my back pocket. """ * key length recommendations in bits Lenstra and Verheul Equations (2000) symmetric: 70 pubkey. 952 hash: 140 compare to: ECRYPT II 2011-2015 symmetric: 80 pubkey: 1248 hash: 160 and considering projection: ECRYPT II >2041 symmetric: 256 pubkey: 15424 hash: 512

1 0

what has the NSA broken?
by Andy Isaacson 06 Sep '13

06 Sep '13

Tinfoil hat time ... http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-secu… With today's disclosures, the question turns to -- what has the NSA broken? Unfortunately the journalists bowed to pressure from the espionage-industrial complex and decided not to publish specific details of what's broken; and the Snowden documents don't include all the compartmentalized details anyways. So all we can do is speculate based on what is already known and the high level overview provided. I don't believe that NSA has a complete AES break. Call me foolish if you must, but it's just not consistent with what we know so far. I believe that a correctly implemented, truly randomly keyed AES-256-CBC or -CTR cipher is robust against cryptanalysis. It seems just barely possible that AES-128 has a complete break, since I suspect NSA can do 2^80 work on 2^60 bytes if it gives them decrypts of all the AES-128 they can sniff. However, virtually nobody properly keys their ciphers with physical entropy. I suspect that correlated key PRNG attacks are almost certainly a significant part of the NSA/GCHQ crypto break. Many deployed systems expose a significant amount of correlated output of /dev/urandom or the in-process PRNG. Given a global passive adversary and serveral TFLOPs of built-to-spec supercomputers [1], this seems like an obvious place for a hidden advance. Also, retrieving key material from endpoints is a high return activity. Nearly nobody uses PFS ciphersuites, many HTTPS privatekeys are used for multiple years, and a single 1 KiB leak of key material is sufficient to decrypt all traffic under that key. (You don't even need the whole key, just half the bits are plenty to reconstruct RSA keys using attacks in the open literature.) Insiders copying privatekey files after hours, DRAM remanence after "hardware failure" in SSL offload boxes, bugdoors leaking key bits in subtly biased entropy from crypto accelerator hardware, on-disk encrypted keys decrypted due to low entropy passphrases, etc. Any key stored on a US-based VPS is obviously compromised. (Doubly so if your VPS is linode.) Radio emissions from colocated boxes are a nearly completely unexplored area of research. Server-class IPMI baseboard coprocesssors have undisclosed access to host RAM at runtime, and often unaudited access via provider management-plane Ethernets. If I had to get the keys out deniably, I'd be scanning RAM for high entropy key schedules and leaking key bits in the timing of heartbeat messages. It seems fairly likely that NSA is at least a decade ahead of academic RSA factoring. I've heard second-hand stories of $10M machines of custom ASICs built to attack RSA before 2005, and third-hand stories of machines far weirder than that. RSA-1024 I'd treat as dead, RSA-2048 is probably robust enough that if NSA have an attack it would be too valuable to risk exposing under anything but an existential threat scenario. Non-AES legacy/proprietary ciphers are probably toast. People switching to RC4, stahp! A5/2, lulz. Maybe GOST and twofish and Salsa20 are secure; I've met djb and all my checks for NSA minders came up negative. [1] Cray is still in business, building 10,000 CPU with attached FPGA and 1µs interconnect megaclusters for "undisclosed government customers". The systems listed as "Government" in the latest top500 list are just the tip of the iceberg; larger systems are built and installed without any public disclosure. -andy

1 0

Guardian on NSA & GCHQ cryptowar
by Gregory Foster 06 Sep '13

06 Sep '13

The Guardian (Sep 5) - "US and UK spy agencies defeat privacy and security on the internet" by @jamesrbuk, @julianborger, @ggreenwald: http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-secu… gf -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/

4 3

Re: [cryptography] regarding the NSA crypto "breakthrough"
by John Young 05 Sep '13

05 Sep '13

More words from a non-techie: David Kahn, James Bamford, Seymour Hersh and quite a few NSA and other spy types, in particular heads of agencies, Congress, POTUS. SCOTUS, DoJ, are word people. So try as they might to match a word account to the coders and mathematicians, it's pretty well impossible. And the reverse is true from the techies to the wordies. Not many hard core cryptographers are persuasive wordies, so the wordies often run the public show, in the same way the hard cores runs the labs and hacker blow-outs with wearable computers and fuzzy PowerPoints of what a literate person would see as alphanumeric wallpaper. Keep in mind that even many of the reputable tech reporters are not all that techie but are adept at using words lifted from tech drunken orgies. Same in my field of archtecture: the highly literate architectural critics know squat of the down and dirty but excell at reaching the public with artfully simulated accounts burnishing reputations of marketable greatness. In the case of NSA, be damn sure that all its heads knew or know squat about NSA deep tech so they are suited to move the product in blissful ignorance to customers of similar know-not. Michael Hayden and Keith Alexander are perfect for using vapid words to persuade non-techies as little truth as possible is just fine. Back to the latest failure to reveal technical docs. Those who know what's important about them are not likely to tell journalists that, may be incapable of doing so in a way that journalists can apply their vaunted skepticism of sources -- using word skills of truthiness. So what is transferred are narratives, stories, rhetoric, bombast, in lieu of technical specs, math, algorithms, fabrication drawings, chemical and electrical formulations, doses of EM and anti-EM just precisely zapped to the nano-fullerine /->^256/1029: the myrrh and honey of technies, sleep-eeze to the wordies who yawn is that a go or no go to slick brochure printing. "Breakthrough" is PR, which might suggest quotation marks around all the NSA revelations -- so far. A long shot that technical docs will be leaked inadvertently, maybe left as digital debris inside one of the PowerPoint files put on a reused thumb drive and recoverable in a filthy techie lab. I think Ross Anderson could siphon and decipher that compromising junk in a flash. Ross is pretty good at no-nonsense English too.

1 0

Re: Guardian on NSA & GCHQ cryptowar
by Nick Thomas 05 Sep '13

05 Sep '13

"Fuck" - the world -------- Original message -------- From: Gregory Foster <gfoster(a)entersection.org> Date: To: cypherpunks(a)cpunks.org Cc: effaustin-discuss(a)lists.effaustin.org Subject: Guardian on NSA & GCHQ cryptowar The Guardian (Sep 5) - "US and UK spy agencies defeat privacy and security on the internet" by @jamesrbuk, @julianborger, @ggreenwald: http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-secu… gf -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/

3 4

Re: [liberationtech] NSA Laughs at PCs, Prefers Hacking Routers and Switches
by Eugen Leitl 05 Sep '13

05 Sep '13

----- Forwarded message from Scott Helms <khelms(a)zcorum.com> ----- Date: Thu, 5 Sep 2013 10:02:39 -0400 From: Scott Helms <khelms(a)zcorum.com> To: Eugen Leitl <eugen(a)leitl.org> Cc: NANOG list <nanog(a)nanog.org> Subject: Re: [liberationtech] NSA Laughs at PCs, Prefers Hacking Routers and Switches The last paragraph in the post is the most important, but it invalidates the rest of the post. Core routers are a terrible intercept point because of load and the sheer amount of packets they process and they are also MUCH more likely to be running up to date firmware than a router in an edge network where the main technical person is primarily a Windows/Exchange admin. The problem with recording "everything" is that its not feasible and the idea that all/most/many core routers are merrily sending a copy of all packets to some external storage facility is demonstrably false. If you want to record flows that's a bit more technically (and legally in the US since its meta-data) feasible, but again netflow traffic from all/most/many core routers is extremely hard to hide on a 24/7 basis and again is demonstrably false. Its far easier (technically and legally) for the NSA to have a directory of devices they can tap on demand without the knowledge of the owners either through unpatched security flaws, cooperation from the carrier, or intentionally built back doors. Its also more feasibly for them (and we have good evidence this has happened) to directly mirror the layer 2 traffic on some of the largest backbone networks. This of course allows them to passively listen without impacting the core router, but that approach is quite difficult to leverage when you're trying to target a specific person or organization since the volume of unimportant information so greatly exceeds the targeted information. Scott Helms Vice President of Technology ZCorum (678) 507-5000 -------------------------------- http://twitter.com/kscotthelms -------------------------------- On Thu, Sep 5, 2013 at 7:20 AM, Eugen Leitl <eugen(a)leitl.org> wrote: > ----- Forwarded message from liberationtech(a)lewman.us ----- > > Date: Wed, 4 Sep 2013 22:27:46 -0400 > From: liberationtech(a)lewman.us > To: liberationtech(a)lists.stanford.edu > Subject: Re: [liberationtech] NSA Laughs at PCs, Prefers Hacking Routers > and Switches > Organization: The Tor Project, Inc. > X-Mailer: Claws Mail 3.9.2 (GTK+ 2.24.20; x86_64-pc-linux-gnu) > Reply-To: liberationtech <liberationtech(a)lists.stanford.edu> > > On Wed, 4 Sep 2013 20:33:09 -0400 > Robert Guerra <rguerra(a)privaterra.org> wrote: > > > > > Curious on people's comments on types of routers, firewalls and > > other appliances that might be affected as well as mitigation > > strategies. Would installing a pfsense and/or other open source > > firewall be helpful in anyway at a home net location? > > When I read this article, I read core routers and switches at ISPs, > like Cisco, Juniper, F5, etc. I don't read this as linksys, dlink, > netgear, etc. I'm sure NSA could crack into anything consumer > level with ease, it's likely any 4-bit criminal could do it too. > However, it makes more sense for NSA to watch the core connectivity > points on the Internet, rather than watching individuals, solely from > an economic effort versus benefit point of view. > > When I ran global networks, one can record everything and sort out the > individual streams later to find employees doing various layers of > fraud or not. There was no point in watching the end points because it > was too resource intensive. > > I'm sure the NSA has analyzed this and come to the same conclusion. > There's no point in going after tens of millions of endpoints, when you > can own them all with a handful of switches. > > A counterpoint is that most core Internet routers and switches are > running at capacity and any monitoring affects quality of service and > gets customers complaining. > > -- > Andrew > http://tpo.is/contact > pgp 0x6B4D6475 > -- > Liberationtech is a public list whose archives are searchable on Google. > Violations of list guidelines will get you moderated: > https://mailman.stanford.edu/mailman/listinfo/liberationtech. > Unsubscribe, change to digest, or change password by emailing moderator at > companys(a)stanford.edu. > > ----- End forwarded message ----- > -- > Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org > ______________________________________________________________ > ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org > AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5 > > ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0