Silk Road forums
Discussion => Security => Topic started by: AuDoMaN on August 01, 2013, 03:04 am
-
I've been using SR for almost a year now and It occurred to me that most vendors use a 2048bit RSA key. I've only seen one using 4096.
I'm used to using the command line GPG and It allows me to make keys up to 4096bit. You can make even larger ones but they are not compatible with some GPG UI software.
It seems with all this stuff about the NSA and data collection recently maybe vendors should start using larger key sizes? Is there some reason we are not using the strongest encryption available to us?
It's not the vendors data being encrypted against the 2048bit key, it's mine, and I would feel better encrypting against larger keys. Should this become a standard?
What are your thoughts?
-
There's no reason why most people use 2048 bit keys other than that's the default in a lot of PGP programs. On the other hand, 2048 bit keys should be safe for another 20 years, so it doesn't really matter. 1024 bit keys are considered weak because they will be crackable in a reasonable amount of time (100 days or so) with computer clusters within the next 5 years, so you might want to avoid vendors with 1024 bit or smaller keys, but there's nothing wrong with 2048 bit keys.
-
Then you never looked at my vendor profile. ;)
-
Let it be known: I'm more likely to buy from you if you have a larger key. :)
-
Mr Hoff, really! Such blatant self promotion! :o Actually it's fabulous, absolutely! So offer yourself SO much support there Jack, you could be a bra! :o ;D
btw, heya jack, how've you been? Bro, you are EVERYWHERE in these forums! How many browsers/pages have you got rolling on the road?! :o not that I give a fuck, but I'm impressed by the fortitude shown in the breadth of your posting! 8) :P
How is the vending jacky boy? I reckon you are more than just 'one' vendor, I reckon you have a few 'nyms, .... amirite! :D I hope you and they are all well and cruising 8)
Have some karma chum, not that you fuckin NEED it! lol...you karma whore you!
I've seen (one of you) hanging out in those sleazy 'gimme karma baby! uh huh, uh huh! threads, lapping it up! ::) Giwit toome baby ... yeaaahh yay! go jwacky! ;D
But seriously jack, EIGHT HUNDRED and somethin +k's!? :o whatchoo doing bro? ??? some of that voo doo K shit eh? EIGHT fucking hundred! Fuck. Jack, I reckon you ('Black and Bill',himself) will be the first to crack a grand of that special K! :o 8)
much love to you as always
m m m motek :)
-
You sure love emoticons Miss Motek! ;D Vending is going swell. Yes, it's pretty well known that I operate multiple accounts. I haven't been in that thread for at least a month. I used to frequent it though. :P
Later Miss m m m Motek :-*
-
There's probably only 20 or so vendors using 4096bit RSA/RSA keys.
Jack's one. We're one. Ballervision is another. Modwiz, Pharmington Rex, XXXoxtica, and a few others I can't remember offhand. I saw a lot of 1024bit keys out there though. I would think that that would be the majority keys, then comes 2048bit. Might even be some 512bit keys out there.
-
Yeah, when I imported 1020 vendor keys, I added up the different key sizes. At the time there was one vendor with an 8192 bit key, DrCol, but since then I think there has been one other vendor with a key that big, but I don't know his name. I forgot how many 4096 bit keys there were, but the vast majority were 2048 bit, then maybe 50 1024 bit keys, and 10 or so 512 bit keys. You can crack a 512 bit key in no time. Most of those vendors are using BCPG, where it is the default for some retarded reason.
-
There's no reason why most people use 2048 bit keys other than that's the default in a lot of PGP programs. On the other hand, 2048 bit keys should be safe for another 20 years, so it doesn't really matter.
@AuDoMaN: how do you generate those 4096bit keys? Could you post a link?
@Astor: lack of skills would be another, as you see. StExo mentioned a good reason to use 4096bit keys: you can and will be held responsible if what you encrypted contained evidence for illegal activities, even if they took place long ago. I think it would require thorough police work and some negligence on your side. You'd probably be fine if you're currently 80 years old.
Peace out
Jason
-
There's a statute of limitation in most jurisdictions to prosecute drug trafficking related crimes of this sort. Varies from maybe 5 to 7 years depending on state/federal/country. After that, it can't be pursued. Minor variances in the definition of the limitation (like when LE should have known) that might extend that a few months or so. Sending around PGP messages of just addresses doesn't constitute evidence other than you or someone is sending around PGP messages with your address. LE has to prove that you took possession and/or paid for the drugs. Lots of little dots in between that frustrate the whole thing. They like getting tips and making busts with drugs, cash, paraphernalia, weapons, cell phones, lists... tangible stuff a D/A can present before a grand jury or judge and make a simple narrative before a jury given all this evidence.
You PGP'ing around messages yet nothing directly connected to those messages has no value to a prosecutor of LE in a western world country. It's just interesting. Kinda.
They would love to decrypt a message that says something like, "The tracking number that you gave me XXXX XXXX XXXX XX for the order of 100 grams of molly, that I paid you 300 bitcoins from address 1zasjdasjdasjdasdasdas, is not showing any movement. Are you sure you sent it to joe schmoe, 123 anystreet, anytown, 00000? I'll keep checking. I hope my grey nissan sentra has enough gas to drive by and check every day. I get stuck In rush hour so I end up using like a quarter tank of gas just to drive 10 miles."
That's the LEO porn they drool over.
But a PGP message that's just an address after being decrypted is useless unless they can tie it to SR AND catch you taking or having possession of illegal narcotics in a quantity they can charge you with intent to distribute. Otherwise a personal use quantity might be consumed by the time they get around to getting a warrant. If they can at all.
-
If you killed someone and wrote the confession in a PGP encrypted message, then they'll care about decrypting it in 20 years, otherwise they won't care about petty drug transactions you made 20 years earlier. They'll be busy solving the crimes of the 2030s.
-
My key is 3072 because I like to be different ;)
-
My key is 3072 because I like to be different ;)
lol +1 to you sir.
BTW no one has mention the fact that larger key sizes could have vulrabilties that smaller ones do not.
-
My key is 3072 because I like to be different ;)
lol +1 to you sir.
BTW no one has mention the fact that larger key sizes could have vulrabilties that smaller ones do not.
I better get that +1 when you hit 100 posts jampants ;)
-
I considered discussing StExos thought in his audit thread, as I found it worthy of a second thought, yet I feared it would go unnoticed amongst the usual fan gibberish.
On a side note, I believe that security threads are generally interesting debates between mostly smart minds. I'm not kissing anyone's ass here...
There's a statute of limitation in most jurisdictions to prosecute drug trafficking related crimes of this sort. Varies from maybe 5 to 7 years depending on state/federal/country. After that, it can't be pursued. Minor variances in the definition of the limitation (like when LE should have known) that might extend that a few months or so.
As per today's US laws. You forget about importation, too. Recent developments regarding freedom of speech/civil liberties and massive generalized surveillance means and policies, tend to make me doubt of a favorable development in the years to come.
Sending around PGP messages of just addresses doesn't constitute evidence other than you or someone is sending around PGP messages with your address. LE has to prove that you took possession and/or paid for the drugs. Lots of little dots in between that frustrate the whole thing. They like getting tips and making busts with drugs, cash, paraphernalia, weapons, cell phones, lists... tangible stuff a D/A can present before a grand jury or judge and make a simple narrative before a jury given all this evidence.
I said it would require proper police work and some negligence for LE to come up with something tangible to be withheld against you. I realize that it would be not enough, if you wrote "penis" encrypted.
You PGP'ing around messages yet nothing directly connected to those messages has no value to a prosecutor of LE in a western world country. It's just interesting. Kinda.
They would love to decrypt a message that says something like, "The tracking number that you gave me XXXX XXXX XXXX XX for the order of 100 grams of molly, that I paid you 300 bitcoins from address 1zasjdasjdasjdasdasdas, is not showing any movement. Are you sure you sent it to joe schmoe, 123 anystreet, anytown, 00000? I'll keep checking. I hope my grey nissan sentra has enough gas to drive by and check every day. I get stuck In rush hour so I end up using like a quarter tank of gas just to drive 10 miles."
That's the LEO porn they drool over.
:)
But a PGP message that's just an address after being decrypted is useless unless they can tie it to SR AND catch you taking or having possession of illegal narcotics in a quantity they can charge you with intent to distribute. Otherwise a personal use quantity might be consumed by the time they get around to getting a warrant. If they can at all.
I notice you now speculate on what it would take to use PGP as evidence. This is exactly how I meant this comment to be understood. Additional considerations:
- laws evolve
- PGP is not only about SR transactions: what about Chinese human right activists, f.e? I bet my ass they'd get jailed if it leaks your one of them, once your message is deciphered. Even 20 years later.
- you realize there is a fair effort invested into shutting down this place? Even better for LE: siphoning and exploiting the data.
How do I set up such a 4096bit key, please?
-
I fail to grasp why any in this circus would communicate with less than a 2000ish bit RSA key. Just don't see why... Mine is over 3750 bits, just saying.
Mr. Bourne: Mind listing which PGP tool you are using? That could help someone in the way of instructing you to strengthen that RSA key.
-
How do I set up such a 4096bit key, please?
Download GPG4USB, it works on windows and linux (so also TAILS). It allows you to generate 4096bit keys and is way more convenient than gpg4win too.
-
@ JasonBourne.
Two things.
1. Yep, yep, and yep except my only concern is drug trafficing. It's an issue close to my heart. LOL. But I like Astor's comment about PGP'ing a confession to murder. A crime which has no statute of limitation. (I see what you did there).
2. Laws do evolve. But in the West, there's a concept of grandfathering. Meaning, for example, let's say that in Jan 2020 they now say that the statute of limitation to prosecute drug related crimes is 10 years. That means drug related crimes committed after the new statute goes into effect can be prosecuted with evidence gathered for 10 years before bringing it before a grand jury/judge. The evidence for crimes started in 2013 would be inadmissible under the new statute of limitation law since the old statute of limitation was 5 years. And in 2026, the evidence for drug related crimes would be inadmissible for crimes committed in Dec 2019 because they were still covered under the old statute of limitation.
For a prosecutor to push the limits of the statute, you'd have to be a heavy hitter and a near slam dunk worth attempting to set precedent over. AKA, High profile.
And what Tree says above. GPG4USB does 4096+ RSA/RSA
-
I tweaked the source code of my PGP software and now I'm rocking a 8192bit key.
It's a bit on the longish side, I know, but it's not paranoia if they're out to get you.
-
I fail to grasp why any in this circus would communicate with less than a 2000ish bit RSA key.
fucking-A Because many vendors could give two flying fucks about your security or they just do not know how to use it. As soon as one of them mentions Privscam I run. I recently dealt with a vendor who had his fucking Private Key up on his Vendor page and then told me to use Privnote because "his PGP is broke" :-/ I've quoted that a dozen times because it's not the first time I've heard such a stupid statement, my PGP is broke?? Or the vendor who told me that "not everyone PGP's their address, there is a box to put your info in like everyone else??" Really! WOW!!! How did I make all these transactions? Ya the box that people put their "contact info that they encrypted using your Public Key!" That is a tame example of how stupid this "vendor" was.
Please no buyers take offense, I'm only harsh about security practices when it come to vendors as lately it's amazing how many idiots have opened vendor accounts, mostly from the States. I'm a yank so no flaming about that ovservation:)
Mr. Bourne: Mind listing which PGP tool you are using? That could help someone in the way of instructing you to strengthen that RSA key.
THIS^^^ people asking for help leave this out all the time and often when I ask them so I can help they don't reply or don't know. I mean WTF is and who the fuck uses stuff like BCPG or whatever it's called(sorry if that is common and it's just my ignorance of M$ and crApple)
Anyway, once again PM for any help or advice, I won't say anything unless I am 110% positive.
Also, said it before but 2 books by Mike Lucas: "PGP and GPG: Email for the Practical Paranoid"(amazon has it in french for ebooks and english as a hardcopy last I checked), it covers PGP and GnuPG for Win, Mac, and Linux and the many different mail clients and other programs etc. Can't say enough about is books. Also "SSH Mastery; OpenSSH, PuTTY, Tunnels and Key's" is another great book. FreeBSD fans probably already know of his book "Absolute FreeBSD.
Ok, anymore and homeboy's gonna need to pay me advert fee's ;-)
-
Many of the top 10% vendors have weak keys.
Why?
First, PGP tends to be over weighted as a security measure. It's obsessed over by some. It seems to be so by those who are purely buyers and aren't thinking about all the steps involved in vending.
The truth of the matter is, PGP is a best practice against one particular vector of attack: SR is completely infiltrated by LEO. But consider that way less that half of all SR buyers use PGP. The overwhelming majority use clear text/privnote. Low hanging fruit is LEO's favorite. If they can get 1000 buyers using clear-text, they might not bother wasting time on the 200 using PGP of any strength. The mere fact of making arrests of low hanging fruit is enough to create FUD and render SR inoperable. LEO is not going to waste the expense of brute-force decyrpting a small percentage of buyers using PGP when they can net hundreds not using PGP for free. Politicians eager to put that feather in their cap wouldn't allow LEO to be patient once they learned that they got a foothold in SR.
Also think about this; a vendor has to decrypt your address, then copy and paste your address into some kind of label making software. So now we have your address in clipboard memory and label making software allocated memory. And for vendors that process multiple orders per day, they would have several sheets of addresses printed out before adhering them to their respective packages. It's going to be more efficient doing it that way instead of doing one at a time.
If a vendor gets raided or apprehended between the points where your address is decrypted to the point of your address being on a package about to be dropped to the postal system, your name and address has been compromised. Your PGP efforts rendered moot.
This is what I mean about over weighting the importance of PGP. It's important. But don't rely on it for protection. Concentrate more on plausible deniability. You should have your game plan down to the point that you would chuckle when accusation is brought against you. Assuming it *could* be brought against you.
PGP isn't plausible deniability. It's just running interference.
-
This thread teaches humility...
@/I_Surf_Worm_Holes: I had gpg4win. I'll follow trees advice, that sounds more suitable considered my skills. Thanks anyways.
@ tree: thanks I look it up.
@ Cimicon-Rep: I was aware there is a shelf life for crimes. I was absolutely ignorant of technicalities. I still don't know exactly how to fit following scenario into your model. Let's say I was part of a narcotic importation enterprise constantly active for the last 21 years. The gathered evidence relative to the respective offenses is to be considered relative to a period. But if the same scheme is run for 21 years, couldn't the evidence be used prosecuting one long lasting criminal enterprise?
@Zen Garden: I believe you'll soon have business from AuDoMaN
Thanks all of you. Let me see if I have karma left.
Edit:
@ uptera: your pretty worked up about PGP. I hit the search button stumbled upon this thread and figured I would ask about it. I'm aware I'm ignorant regarding this topic. I was deliberately not pushing further my questioning, as I realize I lack of general knowledge to assimilate the concepts you guys would throw at me in response. I already subbed a few threads I know I'd need to study prior to that. I do use PGP encryption since day one on the Road though.
Peace out
Jason
-
This thread teaches humility...
Edit:
@ uptera: your pretty worked up about PGP. I hit the search button stumbled upon this thread and figured I would ask about it. I'm aware I'm ignorant regarding this topic. I was deliberately not pushing further my questioning, as I realize I lack of general knowledge to assimilate the concepts you guys would throw at me in response. I already subbed a few threads I know I'd need to study prior to that. I do use PGP encryption since day one on the Road though.
Peace out
Jason
I am, but not about buyers, i do about vendors who open accounts and have no clue. it is not a magic bullet by any means a Cimicon mentioned but BOO fucking hoo if it is too much work for a vendor. It is a step to provide more protection, I am under no illusions that it is the end all but it is so easy why people fight against it I don't know. The other reason I'm a proponent is that many vendors use Privscam to extort, blackmail, and scam buyers. SR support is not going to help you if you come to them with threats, etc from a vendor and your proof is screenshots of a 3rd party software. Can't blame them. Not everyone who suggests it is out to fuck you but it is how some operate. Also, like I've said before I always offer to help when I comment on PGP/GnuPG. Good luck and all the best.
-
This thread teaches humility...
@ Cimicon-Rep: I was aware there is a shelf life for crimes. I was absolutely ignorant of technicalities. I still don't know exactly how to fit following scenario into your model. Let's say I was part of a narcotic importation enterprise constantly active for the last 21 years. The gathered evidence relative to the respective offenses is to be considered relative to a period. But if the same scheme is run for 21 years, couldn't the evidence be used prosecuting one long lasting criminal enterprise?
Thanks all of you. Let me see if I have karma left.
Paece out
Jason
Assuming US federal law since we're talking importation, if they had 21 years of evidence strictly related to narcotic importation and no other crime (like murder, or conspiracy to commit it) associated with it, their look back period would be limited to 5 years (the statute) from the time in which they levy charges against whatever defendants. But sitting on evidence for 21 years would be a problem for the state's case. Technically, they should have pursued the charges 16 years ago given that they have evidence going back 21 years from the time in which charges are filed. The only way around that is to prove that they (the state) only came upon this evidence which points to 21 years of activity, at most 5 years ago. There can be no logs or chains of evidence of any kind that contradicts that.
If there were any principals in this enterprise that got out of it say 7 years ago, they cannot be prosecuted for crimes covered under the statute. They can be compelled to testify to establish character of those defendants being charged and to corroborate certain aspects of the evidence. If there were any murders during this 21 years of operation, then that 5 year look back does not apply since there's no statute of limitations on murder. Everyone involved can technically be charged with conspiracy to commit murder or aiding and abetting of some kind. The smart criminals never get involved with that kind of nasty business.
That's why detectives and investigators, given this time limitation statute, work hard and fast and want slam dunks. Time is money. Money is limited. So they want one of three things; the big score or many mid levels scores or a dragnet's worth of low hanging fruit. The latter is a last resort. LEO seems to have a "cutoff the head of the snake" mentality. Mostly a view held by those who get to take credit before the media for busts. They just love their press conferences.
Anyway, let's take "the Farmer's Market" as an example. About 15 people were arrested on 2012. The evidence presented was from 2007 to 2009. But they started in 2005/2006. But because of the time of the arrests, the look back max was 2007. They also had evidence of hundreds of buyers. But they charged only principals and top suppliers. Basically they followed the money. Some buyers were caught up in it but were used as snitches and were probably given immunity.
Summary:
Statute of limitation for conspiracy (act of furthering a criminal enterprise) - 5 years in most US jurisdictions. Clock starts at last act in furtherance. So if you withdrew from "the biz" 6 years ago (last act) and LEO tries to bring charges now because they finally got around to decrypting your PGPs (or compelling you to divulge the passphrase)... too late for them. :)
Edit: +karma :)
-
I tweaked the source code of my PGP software and now I'm rocking a 8192bit key.
It's a bit on the longish side, I know, but it's not paranoia if they're out to get you.
I got you beat with this 16384 bit bad boy. :)
http://dkn255hz262ypmii.onion/index.php?topic=157004.msg1103032#msg1103032
-
I set my key to max strength. Can't take any chances in this day and age.
-
I tweaked the source code of my PGP software and now I'm rocking a 8192bit key.
It's a bit on the longish side, I know, but it's not paranoia if they're out to get you.
I got you beat with this 16384 bit bad boy. :)
http://dkn255hz262ypmii.onion/index.php?topic=157004.msg1103032#msg1103032
Aww yeah, push it to the limit, baby!
I considered generating one of those but it took a ridiculous amount of time to do so as well as it turned out to be hugely impractical for something replicated by copypasting.
Just my 2 cents.
Zen Garden
-
Wow, damn Astor!
Will a key like that work in all PGP software out there?
At 4096bit, I got a few buyers who said it wasn't importing. And sho' nuff, they didn't know which program they were using. So I guess it might have been user error. Code ID10T.
-
No, it won't work with any vanilla PGP programs that I know of. Even gpg has to be modified. I also did some benchmarks in a later post. It takes 34 times as long to decrypt a message that is encrypted with a 16K key compared to a 4K, so there's a noticeable 2+ second lag.
It is totally impractical, but I still have it as a novelty.
-
One day though, it won't be impractical. It may be the new norm. Just a few years ago 128bit & 256bit was the shit.
-
noticeable 2 second lag... totally impractical... ha!