technology:pki

  • Distributed #pki: Development and Use Cases
    https://hackernoon.com/distributed-pki-development-and-use-cases-a828287a2e67?source=rss----3a8

    Distributed PKI isn’t a new idea. There are a lot of articles and attempts to implement the concept in practice. PKI (d) is based on the assumption that there are critical vulnerabilities in the process of issuance and management of certificates by CAs, so there is a need to decentralize certificate authority and make the process more transparent and difficult to compromise.The imperfections of centralized PKI rise to the surface once in a while, causing significant financial and reputational damage. One of the latest examples in mid-2018 describes researchers who found a brand new malware project using stolen digital certificates from several Taiwanese tech-companies, namely D-Link, to sign their malware and making them look like legitimate applications. What is baffling is that (...)

    #what-is-pki #distributed-pki #public-key-cryptography #cryptography

  • The Look of Silence: Important documentary on the aftermath of the 1965 Indonesia massacres - World Socialist Web Site

    http://www.wsws.org/en/articles/2017/03/06/look-m06.html

    The Look of Silence: Important documentary on the aftermath of the 1965 Indonesia massacres
    By Clara Weiss
    6 March 2017

    Directed by Joshua Oppenheimer

    The streaming provider Netflix is currently featuring The Look of Silence, a 2014 documentary by the Academy Award-nominated director Joshua Oppenheimer (The Act of Killing, 2012).
    The Look of Silence

    In a profoundly moving, intimate and disturbing way, The Look of Silence deals with the long-lasting and devastating impact the mass murder of up to one million Communists and suspected Communists in 1965-66 has had on Indonesian society.

    Following a US-backed coup that overthrew the bourgeois-nationalist regime of Sukarno in the fall of 1965, the Indonesian army, mobilizing gangster and lumpen elements, exterminated vast numbers of people who were members or supporters of the Indonesian Communist Party (PKI) within half a year. About a quarter million people were put in concentration camps, where many lingered for over a decade.

    #indonésie #massacres #asie_du_sud_est

  • KSI : Keyless Security Infrastructure

    An Estonian, blockchain stack alternative to PKI, developed in 2007

    https://guardtime.com/technology/ksi-technology

    Unlike traditional approaches that depend on asymmetric key cryptography, KSI uses only hash-function cryptography, allowing verification to rely only on the security of hash-functions and the availability of a public ledger commonly referred to as a blockchain.

    A blockchain is a distributed public ledger; a database of transactions such that there is a set of pre-defined rules as to how the ledger gets appended, achieved by distributed consensus of participants in the system.

    The KSI blockchain overcomes three major weaknesses of mainstream blockchain technologies - which were designed to facilitate asset transactions - making KSI suitable also for cybersecurity and data governance applications:

    • Scalability
    • Settlement time
    • Formal security proof

    It can be used to help combat cyberattacks :

    https://techcrunch.com/2016/12/05/how-blockchain-can-help-fight-cyberattacks

    “The fundamental threat with PKI is that you need to base your security on the secrets (keys) and the people who manage them,” Johnson says. “That is very hard to do well and impossible to prove — just as in the real world you can‘t prove a secret has been kept, in the security world you can‘t prove a key has not been compromised.”

    In contrast, instead of relying on secrets, blockchain-based security is predicated on distributing the evidence among many parties, which makes it impossible to manipulate data without being detected.

    “Blockchain has eliminated the need for trusted parties to verify the integrity of data just as in the cryptocurrency example it eliminated the need for a centralized authority to act as a bank,” Johnson explains.

    See also https://seenthis.net/messages/540234

    #blockchain
    #PKI #KSI
    #DDoS

  • How we built Origin CA: Web Crypto
    https://blog.cloudflare.com/how-we-built-origin-ca-web-crypto

    “In the Origin CA dashboard, we use WebCrypto to generate the key and PKI.js to create CSRs. When you click “next” in the one-click certificate dialog, your CSR is sent to the CloudFlare API. When the certificate comes back from the API, we use PKI.js to convert it to the right format and display it with your private key. CloudFlare’s servers don’t see your private key and you get to save yourself the hassle of learning obscure OpenSSL commands.”

    #WebCrypto_security_JavaScript_API_clevermarks

  • The Anti-Shia Movement in Indonesia

    http://www.understandingconflict.org/en/conflict/read/50/THE-ANTI-SHIA-MOVEMENT-IN-INDONESIA

    (Jakarta, 27 April 2016) The convergence of a non-violent hardline campaign against Shi’ism with a new determination of pro-ISIS groups to wage war at home is increasing the possibility of violent attacks on Indonesia’s Shi’a minority.

    The Anti-Shi’a Movement in Indonesia, the latest report from the Institute for Policy Analysis of Conflict (IPAC), examines the history of anti-Shi’a movement in Indonesia and the reasons for its newfound intensity. Three distinct groups are involved: Saudi-oriented Salafis who see Shi’ism as a deviant sect; a conservative fringe of the large Muslim social organisation Nahdlatul Ulama (NU) that is worried about competition from Shi’a schools, especially in East Java; and those influenced by ISIS propaganda that Shi’a are enemies who must be killed. The last is by far the smallest but several anti-Shi’a plots have already been foiled by police.

    Le rapport au format PDF :
    http://file.understandingconflict.org/file/2016/04/IPAC_Report_27.pdf

    B. Saudi Arabia and the Salafis in the 1980s

    At the same time that the Iranian revolution was causing concern in government circles, it was triggering a reaction in Saudi-supported Salafi circles. Chief among the Salafi-Influenced groups was Dewan Dakwah Islamiyah Indonesia (DDII), an organisation established in 1967 by Muhammad Natsir, the former leader of Masyumi. DDII’s link to Saudi was clear: it served as the Indonesian representative of Rabitah Alam Islami (World Muslim League), the Mecca-based organisation dedicated to strengthening Saudi Arabia’s cultural and religious influence in the Muslim world through the propagation of Wahhabism.39

    DDII’s da’wah agenda was related as much to Saudi Arabia’s geopolitical interests as to the local context. In the 1960s and 1970s when the Saudi leadership was preoccupied with curtailing the in uence of Gamal Abdul Nasser’s “Arab Socialism”, DDII focused on combating Commu- nism in Indonesia, just as Soeharto was purging the Indonesian Communist Party (PKI).40 Once Nasserism failed, the Iranian revolution threatened Saudi Arabia’s supremacy as the leader of the Islamic world. The Saudi government began to use various charity organisations to curtail Iranian influence by supporting anti-Shia campaigns, and DDII soon adopted this agenda. One scholar writes:

    No doubt encouraged by their Saudi and Kuwaiti sponsors,[DDII] polemicized against Shi’ism as a fatal deviation from Islam and published an unending series of anti-Shi’a tracts and books. Their activities appeared to be focused increasingly on perceived threats: threats from within (Shi’a, Islamic liberalism) as well as threats from without: the Christian and Jewish threats to the world of Islam.41

    In 1982, DDII’s monthly magazine, Media Dakwah, published what appears to be its first anti-Iran/anti-Shi’a article entitled “Iran Ready to Wage Ideological Invasion”. In explaining the threat of Khomeini’s Shi’ism to Muslim countries, the article argued that the imamah doctrine propagated by Khomeini entailed an expansionist ambition to “conquer the entire Islamic world [and] rule over the entire 900-million population of Muslims in the world”.42

    The anti-Shi’a campaign during this period was characterised by intellectual challenges to Shi’a doctrines, often by distorting them in a way designed to incite fear and hatred among Sunnis. The focus on the imminent danger of revolution may have reflected Saudi support, but it was also a way that DDII could present itself as a “friend” of the government in the context of Soeharto’s wariness of Islamic movements. DDII was established as a non-political movement precisely to avoid the fate of its predecessor, the Masyumi party. The 1990s saw the campaign change into more direct political lobbying for a ban on Shi’ism.

    • Rappel, ce passage de l’article consacré à la « doctrine Obama » :
      http://www.theatlantic.com/magazine/archive/2016/04/the-obama-doctrine/471525

      Though he has argued, controversially, that the Middle East’s conflicts “date back millennia,” he also believes that the intensified Muslim fury of recent years was encouraged by countries considered friends of the U.S. In a meeting during apec with Malcolm Turnbull, the new prime minister of Australia, Obama described how he has watched Indonesia gradually move from a relaxed, syncretistic Islam to a more fundamentalist, unforgiving interpretation; large numbers of Indonesian women, he observed, have now adopted the hijab, the Muslim head covering.

      Why, Turnbull asked, was this happening?

      Because, Obama answered, the Saudis and other Gulf Arabs have funneled money, and large numbers of imams and teachers, into the country. In the 1990s, the Saudis heavily funded Wahhabist madrassas, seminaries that teach the fundamentalist version of Islam favored by the Saudi ruling family, Obama told Turnbull. Today, Islam in Indonesia is much more Arab in orientation than it was when he lived there, he said.

      “Aren’t the Saudis your friends?,” Turnbull asked.

      Obama smiled. “It’s complicated,” he said.

  • There’s No DRM in JPEG—Let’s Keep It That Way | Electronic Frontier Foundation
    https://www.eff.org/deeplinks/2015/10/theres-no-drm-jpeg-lets-keep-it-way

    We encourage the JPEG committee to continue work on an open standards based Public Key Infrastructure (PKI) architecture for JPEG images that could meet some of the legitimate use cases for improved privacy and security, in an open, backwards-compatible way. However, we warn against any attempt to use the file format itself to enforce the privacy or security restrictions that its metadata describes, by locking up the image or limiting the operations that can be performed on it.

    #jpeg #copyright_madness #images_diffusion #DRM

  • Think Lavabit overreacted ? Think again: there is now proof that FBI extorts root certificates from companies. Cryptography is only as good as the PKI’s physical security and its political environment.

    http://www.reddit.com/r/worldnews/comments/1nm8nr/new_evidence_reveals_fbi_demands_companies/ccjv26q

    For those that don’t remember, Lavabit was Edward Snowden’s email provider, and they shut down their fucking business rather than cooperating with a court order they claimed “would make them complicit in crimes against the American people.” They were bound by a gag order and threatened with jail if they violated it.

    Today they won a victory in court and were able to get the secret court order unsealed, and holy shit is it a doozy: the ACLU’s Chris Soghoian called it “the nuclear option.” The court order revealed the US government demanded Lavabit turn over their root SSL certificate, something that allows them to monitor the traffic of every user of the service. Security researchers have argued for years over whether the government would be so heavy-handed as to try this, but there has never been any proof that they actually do, as no one has ever challenged such an order in court.

    If a government can force a company to turn over the SSL keys, it breaks the trust model for the entire internet. Everything from google to facebook to skype to your bank is only encrypted by SSL keys, and if the FBI can force Lavabit to hand over their SSL key, they can bet your ass they did the same thing to Google. People don’t understand how big this is from an internet trust model. This story changes everything. No US company that relies on SSL encryption can be trusted with sensitive data, which is what lavabit asserted in their “farewell address” and people thought was an overreaction."