funkenstein_: bad_duck, if you can't rely on the timestamps on the blocks what timestamps can you rely on?
trinque: do I understand correctly that you use a "signing key" to sign your various subkeys, thus associating them with one identity?
trinque: and aside that, may the words should, associated, and all other "ignore the gap" terms be put to the spike
BingoBoingo: mircea_popescu: tbh, someone has to explain this "subkeys" retardation to me sometime. fucking pseudohierarchy devoid of meaning. << Within your big GPG keyblock you can have multiple keys, say a 4096 RSA for signing and another 4096 to encrypt to. Beyond that you can keep stuffing moar keys in there just because...
mircea_popescu: (not saying it's likely the case, anyway)
mircea_popescu: depends a lot on the rng too
Apocalyptic: after 430 runs the probability of error is something like 1/e if I remember and if this doc is correct
Apocalyptic: I do count them
mircea_popescu: Apocalyptic you know it'd be halpful if youactually counted them / documented the attempts
Apocalyptic: mircea_popescu, rho pollard plus countless iterations of ECM for reasonable bounds assuming there is a 20-30 prime digit factor in the modulus reminder
Apocalyptic: I suppose it's the same as the master one though, so this situation can't happen since e is itself a prime
Apocalyptic: asciilifeform, somehow pgpdump refuses to print info about the invalid subkey, or at least I don't see the keyid referenced the way I see it for the master key and the signature packets
ascii_field: what of the baseband ?
ascii_field: Apocalyptic: look at the e
Apocalyptic: and as such there is no private to even begin with
ascii_field: for all we know, this is a straight 'dos' and no one actually knew the privates to these
ascii_field: the authors of the fakes also relied on the 'plausible deniability' of using random crud rather than proper mods
ascii_field: Apocalyptic: as a general rule, an rsa modulus generated without regard to rules (primality testing, pollard-rho, the lot) is cheap to factor.
fluffypony: yeah I know, but neither of us are terribly au fait with it, so we'll just dip our toe in;)
fluffypony: I need to tweak the presentation a bit, so the wife will go to the spa for a couple of hours
davout: fluffypony: neat! never been there
jurov: GNU picked it up then
jurov: someone has to explain this "subkeys" retardation << guess mr.zimmermann overengineered it and then left to rot
ascii_field: trinque: was going for 'simple' rather than 'fast'
trinque: I wonder if anyone ever tests this hypothesis
Hasimir: I recognise most of the names
Hasimir: well, that list 160 reads like regular posters to the enigmail mailing list
ascii_field: Hasimir: read carefully. we do not know where they came from. but the largest class we identified so far appears to consist of carefully crafted spurious keys, made with a particular transformation of original legit ones.
Hasimir: do they all have subkeys or not?
Hasimir: ok, these weak ones you found, have you identified a common generation program?
Hasimir: though you'll lose all the v2 keys
Hasimir: yeah, you might want to look at the keybox (.kbx) format used in gpg 2.1, designed to improve lookup speed with larger keyrings
Hasimir: though probably better than the sks solution
mircea_popescu: oh, is it rebuilding the P huh ascii_field
mircea_popescu: there's no such thing as a retest
mircea_popescu: that'd be the sadness of all time.
ascii_field: were all of them even odd, lol
ascii_field: mircea_popescu: quite a few. which is consistent with the 'random bits make terrible rsa moduli' thing.
ascii_field: i will be very surprised when a 'proper' pubkey that some fella actually has on his own box, fails the test
ascii_field: Hasimir: add it to the queue
mircea_popescu: Hasimir if it's been already processed you can see yourself the result
Hasimir: alright then, take a crack at mine, same one as used with -otc and in my /ns info
ascii_field: and the panic is entirely the work of the enemy, who is passing around the idiot strawman that 'rsa was broken. oh wait, no it wasn't! disregard the whole thing!'
ascii_field: Hasimir: so far each of the cases i have examined in detail had -at least one- legit rsa modulus in subkeys
assbot: Logged on 20-05-2015 11:53:36; *: mircea_popescu underscores the ~probably~. it is not a certainly. not yet at least. moar uranium has to be mined first.
ascii_field: Hasimir: the shenanigans exposed appear to have an intent which includes - but not necessarily limited to - passing off spurious rsa keys for various names
mircea_popescu: some others are yet unknown
mircea_popescu: two examples are given there, each with two moduli with 8-12 digit factos known
Hasimir: as all the president@whitehouse.gov ones prove
ascii_field: Hasimir: understand, someone can create a key containing an rsa modulus of the kind described here using a modified copy of your, e.g., el gamal, key
mircea_popescu: in general, one's at liberty to create a Patented Leather Assymetric Key and give it his name
mircea_popescu: the way text works is that the reader has the job of forming a mental image that does not contradict the text.
Hasimir: ok, let me see if I'm reading the article correctly
mircea_popescu: the way text works is not that reader is free to make whatever assumptions he wishes and it is the responsibility of the text to explicitly dispel them
ascii_field: (yes, lots of these. wtf)
Hasimir: which is the point
ascii_field: and go apply pollard rho, and lenstra, you will have the private. you don't even need us for this
ascii_field: Hasimir: private key naturally would correspond to the phony key
mircea_popescu: Hasimir wouldja quote the claim you speak of ?
ascii_field: barring some entirely unknown and very interesting number-theoretical result, the word-doubling is overwhelmingly likely to yield an 'easy' modulus.
ascii_field: Apocalyptic: there is a reason why generating proper rsa keys is cpu-expensive
mircea_popescu: Apocalyptic well sure, theoretical theory. but if you run a factorizing algo on any of the keys you'll see they break apart.
Hasimir: ascii_field, just the signing subkey?
ascii_field: the experiment specifically concerns moduli, not keys. a key contains zero or more rsa moduli
Hasimir: which means no getting the private cert or decryption
ascii_field: Hasimir: we don't deal with the rest of it.
mircea_popescu: well, it would be the rsa wouldn't it.
Apocalyptic: ascii_field, as the poeple whose key you're listing probably didn't craft it this way, it's very probable that it's further broken, yes
Hasimir: but the rest of it isn't
ascii_field: Hasimir: there we go.
mircea_popescu: ascii_field ima get the key one sec.
mircea_popescu: this isn't the assumption here
mircea_popescu: lemme fish them out for you a sec.
Apocalyptic: i'm just trying to show that finding a small factor is not inherently breaking the key
mircea_popescu: Hasimir "Rob Hansen" doesn't appear on the page ?
Apocalyptic: but the key is still as strong as my original
ascii_field: Apocalyptic: bugger took every other 32-bit word and copied over neighbour.
Apocalyptic: I multiply then the modulus N by 3 (or any other small prime, the value doesn't matter)
Hasimir: well, let's see there's Rob Hansen's key
Apocalyptic: let's say I take the two secret primes of my present key
ascii_field: thing about small factors is that we have them here because the moduli are essentially random shots in the integer dark.
Apocalyptic: mircea_popescu, it is breakage in the sense it reduces the apparent security, the key may still be pretty much alright
ascii_field: given as the bulk of the samples consist of the owner's own moduli with every other 32-bit word doubled (overwriting its neighbour) - the amount of 'crafting' appears to be minimal. in this particular case (there were other breakable keys.)
ascii_field: hanbot: and clearly the process, whatever it was, did not want to be found. but it does appear to consist of fucking with purported -public- keys and therefore intrinsically findable.
ascii_field: afaik the only possible point of crafting these -was- to disseminate them publicly as spurious copies of the real thing
hanbot: maybe this is the iceberg tip of some sort of process not really intended to be visible
hanbot: how do you know you're even seeing all/most of the magic keys? maybe they were not intended to show up in public servers, and end there through some error/leak
ascii_field: and see what happens when one actually tries to verify the signature with 'magic' key (and its bizarre composite mega-exponent) as reference
ascii_field: at the moment, i would like to collect a sample of material signed with one of the -legit- keys for which a 'magic' key exists
ascii_field: (these are rampant, >1300 instances alone)
ascii_field: comment out the bit with 'giant exponents'
ascii_field: incidentally you can run the heuristic finder yourself
ascii_field: Apocalyptic: at least two, iirc, had valid sigs. The remainder divide into ones with invalid selfsigs and ones with absent ones entirely (stripped)
Apocalyptic: ascii_field, of the 19 broken moduli so far how many are actually valid subkeys ?
ascii_field: which was the intent of whoever crafted it, yes.
Apocalyptic: ascii_field, ok, would love to compare the results when you're done, i'm throwing some stuff at it atm
Apocalyptic: anyway mircea it was just to say that in this case I would call it factor only if modulus is totally broken into primes, something i've referred as full factoring, otherwise not much you can do
ascii_field: is almost certainly because statistically - these are -easy- to break apart.
ascii_field: but the reason why malefactor did this 'random' bit,
Apocalyptic: <ascii_field> conceivably some of the resulting moduli are even... prime. // would be trivial to check
ascii_field: conceivably some of the resulting moduli are even... prime.
ascii_field: the result is essentially same as using a random integer as a modulus
Apocalyptic: i'm just commenting on the first invalid subkey that was discussed
mircea_popescu: Apocalyptic iirc shcneier actually was recommending e=3 (d is the private traditionally)
ascii_field: Apocalyptic: read mircea_popescu's latest article to learn how the bulk of the booby keys were generated
mircea_popescu: suppose the exponent was 3.
Apocalyptic: someone "factors" it, finds the 3, but the key is still as strong as the sane one you started with
Apocalyptic: I mean you can get a standard 4096-bit sane RSA key, multiply N by 3 and there you go
Apocalyptic: in the sense of finding a prime factor of a modulus that has more than 2
ben_vulpes: <davout> i'm afraid if i try on an ec2 box i'll accidentally break the internet << "we can therefore we must"
davout: i'm afraid if i try on an ec2 box i'll accidentally break the internet
davout: can someone explain to me how i'm able to malloc into existence more than 1tb, fill the first byte with some random int, and have valgrind report the massive allocated space. all this with a whopping 4gb ram and 512gb hdd?
mircea_popescu: bitstein honestly, the blowing up of the entire "car dealers" bs is pretty much the only thing i actually like about mr tesla.
ascii_field: the 'bubblear' link, i mean
bitstein: "Democratic state Rep. Senfronia Thompson criticized the company by saying that 'it would have been wiser if Mr. Tesla had sat down with the car dealers first.' But there is no 'Mr. Tesla' involved in the company, which is named after the late inventor Nikola Tesla and is founded and run by Elon Musk." https://fortune.com/2015/05/18/tesla-texas/
ascii_field: 'Unpaid Intern is, as the byline properly describes, an unpaid intern. Unpaid intern is a fresh-out-of-school, wide-eyed journalism grad who thinks one day they will make it to the New York Times. In the meantime they are stuck here, so they better get used to it.'
ben_vulpes: http://www.bubblear.com/reminder-get-cash-before-the-weekend/ << lol for all the printing they still can't keep atms full?
bitstein: whoops, my irc chat wasn't scrolled all the way down
bitstein: "Mr. Lawsky, who has spent his entire two-decade legal career in government, plans to open his own firm and serve as a lecturer at Stanford University, people briefed on the matter said." http://www.nytimes.com/2015/05/21/business/dealbook/benjamin-lawsky-to-step-down-as-new-yorks-top-financial-regulator.html
mike_c: found the original article on nyt: http://www.nytimes.com/2015/05/21/business/dealbook/benjamin-lawsky-to-step-down-as-new-yorks-top-financial-regulator.html
ascii_field: as in, the one sold to iran 'against sanctions' with boobytrap included
ascii_field: in other nyooz, https://www.incapsula.com/blog/ddos-botnet-soho-router.html << yes, same ubiquiti that made 'edgerouter'
jurov: dunno why the haven't attached flea legs instead, would work same as vtol
davout moves to set camp by the mailbox
BingoBoingo: mats: For some definitions of different (everything the F-35 B&C do-ish)
mats: they're intended to fly tandem in combat.
mats: BingoBoingo: well, the F-22 and F-35 do different things.
mircea_popescu: "In all these instances, data reporting and processing rules were changed during the year for no other reason than to paint a more favorable picture. Maintenance problems were determined to be so severe that the F-35 is only able to fly twice a week."
BingoBoingo: The silliest thing about the F-35 clusterfuck is the US had a decent somewhat stealthier plane in the F-22 coming off the line in flyable shape and... It was too expensive. Nao it would have been cheaper.
mircea_popescu: "Even in its third iteration, the F-35s helmet continues to show high false-alarm rates and computer stability concerns, seriously reducing pilots situational awareness and endangering their lives in combat;"
mike_c: davout:gonna get the schneier one to get started << mod6 told me to read this, it is awesome. I feel stupid for not having read it sooner.
mats: "lets ignore the guys who've been flying the most dangerous air frames in development for twenty years"
mircea_popescu: Defense spending analyst Winslow Wheeler concluded from flight evaluation reports that the F-35A "is flawed beyond redemption"; in response, program manager General Chris Bogdan suggested that pilots worried about being shot down should fly cargo aircraft instead.
mircea_popescu: "In March 2013, USAF test pilots, flying with pre-operational software that did not utilize the all-aspect infrared AAQ-37 DAS sensor, noted a lack of visibility from the F-35 cockpit during evaluation flights, which would get them consistently shot down in combat."
mircea_popescu: so they built a spitfire ?
mircea_popescu: the F-35C taking 43 seconds longer than an F-16 to accelerate from Mach 0.8 to Mach 1.2
mircea_popescu: "the electronic edge F-35 enjoys over every other tactical aircraft in the world may prove to be more important in future missions than maneuverability" << check it out, it got wifi
ascii_field: (and i'm still at a loss to craft a situation where gpg's p and q will occupy varying number of 'limbs' and lead to catastrophe in the given line)
mircea_popescu: usability problem: the canonical ASN.1 representation of
mats: osprey's not doing so good so i guess they decided to experiment more with f-35.
ascii_field: the attempts to do away with it - make sense
ascii_field: the need for runway is an ancient annoyance to airplane folks
mats: e.g. in the field.
mircea_popescu: except of course by 10k we mean "can get up in the air at least 10k"
mircea_popescu: so 2.5k planes of 2 missiles each. the chinese only have like 10k
mats: mircea_popescu: has been built. lotsa videos around of it doin the hovering trick.
mircea_popescu: so what, we're not going to allow the us in gossipd ?
ben_vulpes: christ the braindamage.
mike_c: depends what you consider the thing. I mean, an "F35" exists, and some things on it work..
mircea_popescu: "undergoing testing and final development by the United States"
mike_c: <isaackl> Yes. Increased utility of bomber planes, USD would buy more << hm, how does the utility of the F35 compare to how much has been spent on it?
mircea_popescu: dude, i remember the time back in 2012 when the pressure cooker wasn't on yet and all sorts of people didn't appear retarded.
ben_vulpes: claims to have read the logs, even!
ascii_field: in other news, herr kaspersky let in comment: https://threatpost.ru/2015/05/20/otstavit-paniku-4096-bitnye-rsa-klyuchi-ne-skomprometirovany/#comment-36991
ascii_field: the lost world of winblows pgptrons, closed-source crypto, etc. will have to be vivisected, likely
mircea_popescu: 25 ppm occurences can very well be a tiny pore in an otherwise solid implementation.
mircea_popescu: "Some widely deployed RSA implementations choke on big RSA public exponents. E.g. the RSA code in Windows (CryptoAPI, used by Internet Explorer for HTTPS) insists on encoding the public exponent within a single 32-bit word; it cannot process a public key with a bigger public exponent."
ascii_field: http://www.reddit.com/r/security/comments/36mi86/if_you_are_on_this_list_phuctor_may_have_your_pgp/ << shitsquad pushed 'the button' nulling 'ups' it appears, l0l
mircea_popescu: meh, chess. i'd rather play hanoi towers.
Hasimir: I returned to playing in order to make a good habit of it by the time senility struck in order to stave it off ... then discovered that years of IT logic paid off in unexpected ways
ascii_field: sorta the mental equivalent of a crowded hard disk. not quite same as senility
ascii_field: conan doyle in the 'sherlock holmes' stories described this
mircea_popescu: apparently some get it in their 30s ;/
ascii_field: 'Just as long as you actually know what you're doing, this sort of arrangement increases the costs of attacking your setup astronomically...'
Hasimir: mircea_popescu, well, listing a hundred and something frequent posters to gnupg-users with the statement "we probably have your private key" does imply a certain degree of breakage
assbot: Logged on 20-05-2015 16:13:53; mircea_popescu: asciilifeform do you remember where the fuck is that discussion about how a good hardening approach is to deviate from the toolset the attacker might reasonably expect to find is ?
Hasimir: though it it turns out to be the "you must all use openpgp cards" crowd I will laugh and laugh ...
ascii_field: other than idiot 'journalists'
Hasimir: no, not seriously, there's a big difference between some bunch of people with crap entropy sources and rsa being borked
assbot: Logged on 20-05-2015 01:19:10; asciilifeform: ben_vulpes: so i walk into $redacted on monday and folks compare me to pons & fleischmann. so there'll be teasing, yes.
assbot: Logged on 20-05-2015 00:58:59; pete_dushenski: and in other news, livejasmin is accepting btc, ripple raised $28 mn, and bitcoin is "leaderless" now : http://www.technologyreview.com/news/537486/leaderless-bitcoin-struggles-to-make-its-most-crucial-decision/
mircea_popescu: http://log.bitcoin-assets.com/?date=20-05-2015#1139742 << eh, the mit. about as relevant for tech as uzbekistan for banana pies.
Hasimir: assuming rsa isn't screwed by then, of course ;)
Hasimir: it's currently in a branch of git.gnupg.org/gpgme (to be merged with master when I finish cleaning up the last of the ancient examples)
mircea_popescu: Hasimir mind giving a self-intro for they such as myself that apparently know you from 3rd parties but otherwise not ?
mircea_popescu: http://log.bitcoin-assets.com/?date=20-05-2015#1139728 << there's a reason nobody (tm) is using it.
Hasimir: I ported the python bindings for gpgme to py3
assbot: Logged on 20-05-2015 00:42:58; decimation: so can someone explain why the nyse would have a bitcoin index without any actual bitcoin-backed securities for trade?
Naphex: mircea_popescu: a good attacker will do discovery, and map everything ahead of time. while there are some pluses into deviating from the toolset. they mostly come from building your own. which is going to end up better fitted for the task
mircea_popescu: asciilifeform do you remember where the fuck is that discussion about how a good hardening approach is to deviate from the toolset the attacker might reasonably expect to find is ?
mod6: lol, they used to have this "rabin-miller" function in the first import of gnupg (as so it's dated) that takes a paremeter "MPI n" and then does nothing and returns 0; http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=cipher/primegen.c;h=07d83d8314d8588e4f425a4d171fc41ebb3be4a9;hb=5393dd53c5e06f0458949217317601b2eaed8350G
mats: going to a music festival this weekend then san diego
mod6: ahh, i see, you gotta pick the bases for a randomly.
mod6: oh it might actually do this somewhere anyway... there are some references in the docs... although i haven't found it in the code yet.
mod6: by the end of the night i was digging into prime selection. gnupg does fast fermat checks in several places, but im starting to wonder if it wouldn't also be benificial to just check against a list of "Carmichael numbers"
mod6: <+mircea_popescu> maybe i wanna use e = 2686977, whose business is it. << i was looking at this yesterday too, had the same impression. mpi_set_ui( e, 65537);
fluffypony: mircea_popescu: nah, some interesting guys but they're all just trying to do gambling stuff in Romania and elsewhere
assbot: Logged on 20-05-2015 00:29:41; mod6: take a look at this: http://dpaste.com/0SQPBKC.txt Is there any reason when allocating the space for p & q to do Eulers totient they would initialize the space with 'p' and 'p', instead of 'p' & 'q'?
mircea_popescu: http://log.bitcoin-assets.com/?date=20-05-2015#1139680 << speaking of this, am I the only one nonplussed by all this "we use <<best practices>> fixed exponent" bs ? it's an unavoidalbe magic number , okay, but it's tyhe sort that should eminently be a knob for the user. a proper gpg would have e user-settable at the key generation phase (with 65536+1 as a default, sure)
davout: fluffypony: on IRC? nice! still up for the monero meeting tomorrow?
assbot: Logged on 19-05-2015 23:33:00; asciilifeform: (this could underplay the effect of 'bastards' however)
mircea_popescu: http://log.bitcoin-assets.com/?date=19-05-2015#1139657 << it would, and the whole thing's about bastards in the wild.
mircea_popescu: http://log.bitcoin-assets.com/?date=19-05-2015#1139628 << voice is not the criteria jurov
mircea_popescu: (for the record : the life of a smerd, like that of a kholop, was worth 5 grivna. that's about enough metal to make a decent shovel - roughly speaking the smartphone of the time)
assbot: Logged on 25-03-2014 20:41:17; asciilifeform: Officially, all Soviet representatives regard these parasites with touching feelings of friendship, but privately they call them 'shit-eaters' ('govnoed'). It is difficult to say where this expression originated, but it is truly the only name they deserve. The use of this word has become so firmly entrenched in Soviet embassies that it is impossible to imagine any other name for these people. A conver
mircea_popescu: one only needs to look at the czech commies post ru invasion to understand exactly how abject people actually are.
mircea_popescu: instead of parading them naked through the streets with a "i was a fucktard and am now sorry" thing around their neck, they let them sit around for twenty years coming up with reasons as to how their idiocy "wasn't really all that bad".
mircea_popescu: i have no fucking idea what west germany was thinking when it allowed the scumbags to join civilisation without first hanging every "intellectual" of the eastern school.
mircea_popescu: for as long as the free herring still lasts, they can run around derping about how they meditatively comprehensified the deep secrets of the universe.
mircea_popescu: c) god comes back in the shape of Kennedy and the Fulda gap. herring is being airlifted into berlin
mircea_popescu: b) god hath moved on, so now five centuries of hard labour and being basically as dirt-poor and pan troglodytus as the russian mujik.
mircea_popescu: a) god hath decided to give free herring out in the scania sounds. consequently, swedes now have a kingdom
assbot: Logged on 19-05-2015 19:21:04; decimation: mircea seems to credit the german geography for why 'nordic freedom' 'seems to work'. but I suggest it is the people themselves - having been beaten by the romans for centuries, and then forced by the church to mate outside their immediate family, they developed a concept of 'kinship' beyond L2 cousins
mircea_popescu: http://log.bitcoin-assets.com/?date=19-05-2015#1139522 << it's a thing, yo. the history of "nordic countries" (post roman empire, because pre that history consisted of being pretty much the pasthun of the time, raped with a sharpened stake covered in burning greek fire) is like so :
asciilifeform: at least, in the public.
asciilifeform: mod6: probably the most 'serious' general-purpose encyclopaedic work on crypto.
asciilifeform: before long, herr böck will claim that he tipped us off to the mess of diddled keys on sks.
mircea_popescu: asciilifeform they readily admit "we took register piece and translated"
mircea_popescu: what the fuck is everyone involved on ?
mircea_popescu: asciilifeform dude that zdnet article was probably the most idiotic thing i read today.
asciilifeform: davout: i cannot comment re: whether 20th anniversary thing censored any of the goodies from 2nd ed, or added nonsense. but it strikes me as likely.
mircea_popescu: get the 90s version.
davout: so wrt the schneier book i see 'second edition', and '20th anniversary edition'
mircea_popescu: any bets on whether bock shows up incidentally ?
mircea_popescu: i guess they're slow.
asciilifeform: unrelated, the toilets piece - http://www.tofugu.com/2013/07/22/why-japanese-toilets-are-failing-in-america - is pretty lulzy
davout: gonna get the schneier one to get started
asciilifeform: more or less the entire rest of the library on this subject is either pulp for lusers, or very narrow treatises for specialists
asciilifeform: get the tree.
asciilifeform: i have the dead tree, it is very nice.
asciilifeform: ^ all of the chapters on www
asciilifeform: (before they scooped out his brain)
asciilifeform: davout: there isn't terribly much good material other than the original 'red book' by - yes - schneier