Peter Gutmann

I'm drawing a blank on it sorry, it's somewhere in an archive of messages but I can't find the appropriate search term to locate it. However it did turn up a reference to something else, namely this, https://www.cs.auckland.ac.nz/~pgut001/pubs/x509guide.txt. It hasn't been updated for a long time but it does document some of the crazy that's in those standards. The various Lovecraft references I think are quite appropriate.

Basically zero. Great talk by Peter Gutman why this whole quantum topic is bollocks: https://www.cs.auckland.ac.nz/~pgut001/pubs/bollocks.pdf

"Love me some Peter Gutmann. This is classic Gutmann." Indeed he don't hold back and is quite funny in his frankness. Though when it comes to his book draft, he really need an editor. https://www.cs.auckland.ac.nz/~pgut001/pubs/book.pdf

https://www.cs.auckland.ac.nz/~pgut001/pubs/book.pdf "WebPKI" Is Going Just Great.

Peter Gutmann's "Engineering Security" book is an excellent treatise on trust and currently free: https://www.cs.auckland.ac.nz/~pgut001/pubs/book.pdf

The article you cite cites a Peter Gutmann article [1, Section 3.6] that details what programmers will do when things don't work as expected. Additionally, what the article recommends (Section 6.2) is that OS generators behave like FreeBSD: block only until enough entropy has been gathered, and then block no more. That is achievable on Linux using tptacek's suggestion, but of course a native solution would be better. [1] https://www.cs.auckland.ac.nz/~pgut001/pubs/usenix02.pdf

This is my favourite piece of "biometrics don't work" material - http://www.cs.auckland.ac.nz/~pgut001/pubs/biometrics.pdf It's a bit old now but it's still as valid.

This is fantastically good, it explains with convincing specifics why Flash is a bad idea on the iPhone OS ecosystem (and less so for Java, but that's much less of an issue). Also points out how the insanity of Blueray DRM plus Apple's installed base of hardware makes Blueray a non-starter for them. See also this invaluable essay on Vista and DRM: http://www.cs.auckland.ac.nz/~pgut001/pubs/vista_cost.html; it's what convinced me that Microsoft had turned against the users of its operating system.

You probably don't want to believe anything in this: The author is a well known scammer/con-artist (Craig Wright) who has a long running advanced fee fraud scheme predicated on convincing suckers that he created bitcoin and has some secret stash of billions that he could get to only if his victims help him with some cash flow problems. He has a long history of using forgeries, faked documents, plagiarism, and impersonation in order to pass himself off as some kind of credible. This article is debunked in the "Further Epilogue" of https://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html Moreover, the images of their supposed MFM imaging was just copied off a manufacturer's page ( https://web.archive.org/web/20090418043851/https://www.engr.sjsu.edu/W… shows another copy on a similarly old page, citing the source) -- so it seems unlikely that they ever performed any measurements at all. A big chunk was plagiarized from an uncited source ("A Practical Guide to Scanning Probe Microscopy (1993)")... another hallmark of Wright's lame forgeries. There was a phenomenal twitter thread that went over all this and more, but Wright used spurious legal threats to drive the author off twitter. The biggest loss was where it pointed out that one of the citations in this paper is where they tried to cite Nikola Tesla in [20], but used the title of the 1989 album The Great Radio Controversy by the rock band Tesla (…

If you like this, you will probably be interested in this: Everything you Never Wanted to Know about PKI but were Forced to Find Out, by Peter Gutmann: https://www.cs.auckland.ac.nz/~pgut001/pubs/pkitutorial.pdf Also, this, by the same person: X.509 Style Guide (which talks about the two date formats): “In coming up with the worlds least efficient machine-readable time encoding format, the ISO nevertheless decided to forgo the encoding of centuries, a problem which has been kludged around by redefining the time as UTCTime if the date is 2049 or ealier, and GeneralizedTime if the date is 2050 or later (the original plan was to cut over in 2015, but it was felt that moving it back to 2050 would ensure that the designers were either retired or dead by the time the issue became a serious problem, leaving someone else to take the blame). To decode a date, if it's UTCTime and the year is less than or equal to 49 it's 20xx, if it's UTCTime and the year is equal to or greater than 50 it's 19xx, and if it's GeneralizedTime it's encoded properly (but shouldn't really be used for dates before 2050 because you could run into interoperability problems with existing software). Yuck. To make this even more fun, another spec at one time gave the cutover date as 2050/2051 rather than 2049/2050, and allowed GeneralizedTime to be used before 2050 if you felt you could get away with it. It's likely that a lot of conforming systems will briefly become nonconforming systems in about half a…

It is just like signing certificates for servers of any type but the subject is you. I recommend using P12 as most browsers will 'just get it'. With Nginx for example, you can build in SSL support and then configure a directive to request a client cert at which point the web browser will load a relevant certificate to choose to pass along. More so, Nginx can be configured to extract information from the client certificate and use it as variables. http://wiki.nginx.org/HttpSslModule#ssl_client_certificate http://wiki.nginx.org/HttpSslModule#Built-in_variables So one can have ssl.awesome.io and extract info to only allow 'Joe231' to see ssl.awesome.io/Joe231. Even better is by serial or what have you. Now my 2 cents on the problem; it confuses people, revocation and issuance. I'm guessing here DoD had certificates built into our ID cards and that was extracted with the reader at a need. Not sure, just a guess. Personally I think the cryptic nature that is command line Openssl is what slows down the mob from pushing new tech unto everyone. Think about it. Some comments present are disappointing for hacker news; you should be playing with cryptic technologies and making them work. Want a startup idea? Plop certs into AXE body spray cans and done. oh looky what Wikipedia cited: http://www.cs.auckland.ac.nz/~pgut001/pubs/pfx.html

http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html "In the time since this paper was published, some people have treated the 35-pass overwrite technique described in it more as a kind of voodoo incantation to banish evil spirits than the result of a technical analysis of drive encoding techniques. As a result, they advocate applying the voodoo to PRML and EPRML drives even though it will have no more effect than a simple scrubbing with random data. In fact performing the full 35-pass overwrite is pointless for any drive since it targets a blend of scenarios involving all types of (normally-used) encoding technology, which covers everything back to 30+-year-old MFM methods (if you don't understand that statement, re-read the paper). If you're using a drive which uses encoding technology X, you only need to perform the passes specific to X, and you never need to perform all 35 passes. For any modern PRML/EPRML drive, a few passes of random scrubbing is the best you can do. As the paper says, 'A good scrubbing with random data will do about as well as can be expected'. This was true in 1996, and is still true now."

If we take near term to mean “while any of the participants in this thread are still alive”, I think we’re going to be safe for a while. https://www.cs.auckland.ac.nz/~pgut001/pubs/bollocks.pdf

A counter-point that perhaps everyone is taking PQ a bit too seriously [1]. Personally, it seems reasonable to at least spend some effort preparing for it, given the rather long lead time required to develop, study and stress the constructions needed. It might be a long time (if ever) before cryptographically relevant quantum computers show up, but if they do, we'll be glad we had a decade or two to get ready. The alternative of scrambling at the last minute while everything gets cracked seems unenviable. [1] https://www.cs.auckland.ac.nz/~pgut001/pubs/heffalump_crypto.pdf

ISO 646 and 61966? I won’t disagree with your annoyance with ISO water torture[1], but ASCII and sRGB are not the examples of needlessly sprawling web of references I would’ve chosen. Even if sRGB is an utter mess[2], it’s a mess you essentially have to use if you’re doing colour on computers. [1] https://www.cs.auckland.ac.nz/~pgut001/pubs/x509guide.txt [2] https://photosauce.net/blog/post/what-makes-srgb-a-special-color-space

Found it, pg 47 https://www.cs.auckland.ac.nz/~pgut001/pubs/defending.pdf

Here’s a similar story from 1998 in Auckland, New Zealand where everything failed for 5 weeks: https://www.cs.auckland.ac.nz/~pgut001/misc/mercury.txt

Sorry but what is to stop actual humans from signing bot generated or false content using their private keys? It also creates incentives to steal other keys. What will happen if your private keys get stolen and they start being abused by someone else? This sounds overtly Orwellian mixed with a PKI disaster. This is not a technical issue that can just be solved with crypto. See https://www.cs.auckland.ac.nz/~pgut001/tutorial/T2b_Signature_Law.pdf

The part on the placebo SSL certificate is interesting (https://www.cs.auckland.ac.nz/~pgut001/pubs/book.pdf#page37). Do users really ignore the big red warnings that web browsers give for invalid certificates? I imagine that it has to do with the fact that someone would rather be able to do what they want to do instead of heeding a warning they don’t understand.

Consider "Engineering Security", by Peter Gutmann: https://www.cs.auckland.ac.nz/~pgut001/pubs/book.pdf

PKI coverage here is quite narrow. Here's Peter Gutmann's PKI tutorial that covers PKI history more widely: https://www.cs.auckland.ac.nz/~pgut001/pubs/pkitutorial.pdf

Coincidentally, ASN.1 (specifically it's DER encoding) is used in X.509v3, better known as TLS certificates. For a taste of the crazyness that ensues check out Peter Gutmann's x.509 style guide [1]. Personal highlights: * Many different ways of encoding a simple string, with some very obscure encodings. * SET OFs are sorted in the DER encoding, to ensure consistent bytestreams. This sucks for embedded systems. * OIDs (unique identifiers for things) are unbounded. [1] https://www.cs.auckland.ac.nz/~pgut001/pubs/x509guide.txt

The use of SHA-2-224 is kinda weird. Based on a quick skim: * no kdf on the password, just SHA-2-224(password) * uses the same key and iv (which always starts as 0) in both directions * uses CFB mode without a MAC, which has malleability issues (IIRC you can flip bits in a ciphertext block, and the same bits will be flipped in the plaintext, but the rest of the stream will be garbage). * the authentication used is pretty sketchy (the key is fixed at 16 bytes and PW_LEN 15, so ljust shouldn't be doing anything): if tmp_data[:len(self.key)].ljust(PW_LEN,'0') != self.key.ljust(PW_LEN, '0'): log.msg("Remote unauthorized", logLevel=logging.INFO) Reminds me of this: https://www.cs.auckland.ac.nz/~pgut001/pubs/linux_vpn.txt

Early on in the implementation of one of the PKCS "standards" while at a browser company many years ago, due to an improper interpretation of a spec that was still in flux. There wasn't enough testing and "release bits" went live. I had to quickly get a patch in for the improper code and had to maintain that buggy implementation. In addition, the "standard" itself got a rather scathing write up from Peter Gutmann, which is completely valid: https://www.cs.auckland.ac.nz/~pgut001/pubs/pfx.html This is a critique on the "standard" itself, the process was just as ugly.

The idea of separation between DRM and the rendering layer is illogical. The dream of all DRM proponents is a leak-proof pipe between the encumbered media and your senses, lest you be able to rip a perfect copy. For a concrete example, look at how deep the content protection system introduced in Windows Vista goes. http://www.cs.auckland.ac.nz/~pgut001/pubs/vista_cost.html The proposed Encrypted Media Extensions standard is merely an interface between browsers and systems such as this.

There's Peter Gutmann's cryptlib, which also supports OpenPGP (among a huge number of other things). http://www.cs.auckland.ac.nz/~pgut001/cryptlib/ It's also has a dual license.

They might be remembering this: http://www.cs.auckland.ac.nz/~pgut001/pubs/vista_cost.html#quality I actually have no idea if that stuff ended up in the final product (never used it), but google is our friend.

The genesis of this was back in 2006 when Microsoft started requiring graphics board/chip makers to keep some aspects of their design secret, to support DRM in Vista. That includes hardware details and code, i.e. open source drivers. See http://www.cs.auckland.ac.nz/~pgut001/pubs/vista_cost.html I'm actually quite glad that adequate drivers are available, even if they're not open source. That outcome wasn't guaranteed.

From the article: "Both Quick Erase and DoD Short should be more than enough to prevent people from snooping on your data — but if you want to be really certain that no one, including the feds, can read your data, use 8-pass PRNG Stream." On a modern drive, quick erase (a single pass writing random data) is good enough to keep anyone from reading your data. As Peter Gutmann says in the Further Epilogue to his famous paper [0]: "Any modern drive will most likely be a hopeless task, what with ultra-high densities and use of perpendicular recording I don't see how MFM would even get a usable image, and then the use of EPRML will mean that even if you could magically transfer some sort of image into a file, the ability to decode that to recover the original data would be quite challenging." [0] http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html

That's easier said than done: http://cs.auckland.ac.nz/~pgut001/pubs/malware_biz.pdf