From tedks at riseup.net Sun Sep 1 17:44:51 2013 From: tedks at riseup.net (Ted Smith) Date: Sun, 01 Sep 2013 17:44:51 -0400 Subject: what to install on a secure communication device In-Reply-To: <[email protected]> References: <[email protected]> Message-ID: <1378071891.11504.9.camel@anglachel> On Sat, 2013-08-31 at 10:47 +0200, Eugen Leitl wrote: > I'm looking to build a list for reasonably secure (no snake oil) > ways to communicate (search, store, etc.). My ad hoc list so far is: > > Pidgin/OTR OTR is good, but libpurple is a "rat's nest of zero days" according to many (notably Jacob Applebaum), so I think I'd avoid it. Not sure what's better though. Maybe irssi+otr? > cables Is there really enough peer review of this system for it to be useful? > GnuNet I think this is redundant with Retroshare -- but I'd probably prefer GNUnet over RetroShare. GNUnet does f2f and p2p, and is developed by really smart people with a great track record. > No doubt I'm missing a lot. Any further suggestions? * Freenet -- also redundant with GNUnet, but better suited to censorship-proof storage. * Any async voice/video? Probably way easier to secure than real-time. What's the endgame for this? Just a webpage with a list of stuff on it? A livecd with stuff on it? With or without redundancy? -- Sent from Ubuntu -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 836 bytes Desc: This is a digitally signed message part URL: <http://cpunks.org/pipermail/cypherpunks/attachments/20130901/35945dc7/ attachment.sig> From eugen at leitl.org Mon Sep 2 03:49:03 2013 From: eugen at leitl.org (Eugen Leitl) Date: Mon, 2 Sep 2013 09:49:03 +0200 Subject: [tor-talk] New paper : Users Get Routed: Traffic Correlation on Tor by Realistic Adversaries Message-ID: <[email protected]> ----- Forwarded message from Erik de Castro Lopo <mle+tools at mega-nerd.com> ----- Date: Mon, 2 Sep 2013 11:35:22 +1000 From: Erik de Castro Lopo <mle+tools at mega-nerd.com> To: tor-talk at lists.torproject.org Subject: [tor-talk] New paper : Users Get Routed: Traffic Correlation on Tor by Realistic Adversaries Organization: Erik Conspiracy Secret Labs X-Mailer: Sylpheed 3.4.0beta4 (GTK+ 2.24.10; x86_64-pc-linux-gnu) Reply-To: tor-talk at lists.torproject.org Hi all, Heads up on a new paper suggesting that its possible to unmask Tor users using traffic correlation: http://www.ohmygodel.com/publications/usersrouted-ccs13.pdf Code here: http://torps.github.io/ Would be interested in hearing the opinions of the core Tor develpoment team on this stuff. Cheers, Erik -- ---------------------------------------------------------------------- Erik de Castro Lopo http://www.mega-nerd.com/ -- tor-talk mailing list - tor-talk at lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5 From eugen at leitl.org Mon Sep 2 06:11:07 2013 From: eugen at leitl.org (Eugen Leitl) Date: Mon, 2 Sep 2013 12:11:07 +0200 Subject: [tor-talk] New paper : Users Get Routed: Traffic Correlation on Tor by Realistic Adversaries Message-ID: <[email protected]> ----- Forwarded message from Roger Dingledine <arma at mit.edu> ----- Date: Sun, 1 Sep 2013 22:10:56 -0400 From: Roger Dingledine <arma at mit.edu> To: tor-talk at lists.torproject.org Subject: Re: [tor-talk] New paper : Users Get Routed: Traffic Correlation on Tor by Realistic Adversaries User-Agent: Mutt/1.5.20 (2009-06-14) Reply-To: tor-talk at lists.torproject.org On Mon, Sep 02, 2013 at 11:35:22AM +1000, Erik de Castro Lopo wrote: > Hi all, > > Heads up on a new paper suggesting that its possible to unmask > Tor users using traffic correlation: > > http://www.ohmygodel.com/publications/usersrouted-ccs13.pdf > > Code here: > > http://torps.github.io/ > > Would be interested in hearing the opinions of the core Tor > develpoment team on this stuff. Yep. They're part of the Tor research community. I have plans for writing a blog post about the paper, to explain what it means, what it doesn't mean, what we should do about it, and what research questions remain open. Stuff keeps catching fire with bigger flames though. The extremely short answer is "Yes, a big enough adversary can screw Tor users. But we knew that. I think it's great that the paper presents the dual risks of relay adversaries and link adversaries, since most of the time when people are freaking out about one of them they're forgetting the other one. And we really should raise the guard rotation period. If you do their compromise graphs again with guards rotated every nine months, they look way different." https://trac.torproject.org/projects/tor/ticket/8240 https://trac.torproject.org/projects/tor/ticket/9321 --Roger -- tor-talk mailing list - tor-talk at lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5 From eugen at leitl.org Mon Sep 2 06:14:31 2013 From: eugen at leitl.org (Eugen Leitl) Date: Mon, 2 Sep 2013 12:14:31 +0200 Subject: [Cryptography] NSA and cryptanalysis Message-ID: <[email protected]> ----- Forwarded message from Jerry Leichter <leichter at lrw.com> ----- Date: Mon, 2 Sep 2013 00:06:21 -0400 From: Jerry Leichter <leichter at lrw.com> To: "Perry E. Metzger" <perry at piermont.com> Cc: "cryptography at metzdowd.com List" <cryptography at metzdowd.com> Subject: Re: [Cryptography] NSA and cryptanalysis X-Mailer: Apple Mail (2.1283) On Sep 1, 2013, at 6:06 PM, Perry E. Metzger wrote: > We know what they spec for use by the rest of the US government in > Suite B. > > http://www.nsa.gov/ia/programs/suiteb_cryptography/ > > AES with 128-bit keys provides adequate protection for classified > information up to the SECRET level. Similarly, ECDH and ECDSA using > the 256-bit prime modulus elliptic curve as specified in FIPS PUB > 186-3 and SHA-256 provide adequate protection for classified > information up to the SECRET level. Until the conclusion of the > transition period defined in CNSSP-15, DH, DSA and RSA can be used > with a 2048-bit modulus to protect classified information up to the > SECRET level. > > AES with 256-bit keys, Elliptic Curve Public Key Cryptography using > the 384-bit prime modulus elliptic curve as specified in FIPS PUB > 186-3 and SHA-384 are required to protect classified information at > the TOP SECRET level. Since some products approved to protect > classified information up to the TOP SECRET level will only contain > algorithms with these parameters, algorithm interoperability between > various products can only be guaranteed by having these parameters as > options. > > We clearly cannot be absolutely sure of what they actually use, but > we know what they procure commercially. If you feel this is all a big > disinformation campaign, please feel free to give evidence for that. I > certainly won't exclude the possibility, but I find it unlikely. I'll make just a couple of comments: - Given the huge amount of material classified these days, SECRET doesn't seem to be a very high level any more, whatever its official definition. TOP SECRET still means a great deal though. But the really important stuff is compartmented (SCI), and Suite B is not approved for it - it has to be protected by unpublished Suite A algorithms. - To let's look at what they want for TOP SECRET. First off, RSA - accepted for a transition period for SECRET, and then only with 2048 bit moduli, which until the last year or so were almost unknown in commercial settings - is completely out for TOP SECRET. So clearly they're faith in RSA is gone. (Same for DH and DSA.) It looks as if they are betting that factoring and discrete logs over the integers aren't as hard as people had thought. The whole business of AES-128 vs. AES-256 has been interesting from day one. Too many recommendations for using it are just based on some silly idea that bigger numbers are better - 128 bits is already way beyond brute force attacks. The two use the same transforms and the same key schedule. The only clear advantage AES-256 has is 4 extra rounds - any attack against the basic algorithm would almost certainly apply to both. On the other hand, many possible cracks might require significantly heavier computation for AES-256, even if the same fundamental attack works. One wonders.... NSA also wants SHA-384 - which is interesting given recent concerns about attacks on SHA-1 (which so far don't seem to extend to SHA-384). I don't want to get into deep conspiracy and disinformation campaign theories. My read of the situation is that at the time NSA gave its approval to this particular combination of ciphers, it believed they were secure. They seem to be having some doubts about RSA, DSA, and DH, though that could be, or could be justified as, ECC being as strong with much smaller, more practical, key lengths.