Security and Digital Restrictions (DRM) Plots Like 'Attestation'
-
Rockyou Txt Wordlist Download 2023 – #1 Password List in Kali Linux
Rockyou is a password dictionary that is used to help perform various kinds of password brute-force attacks. It is a collection of the most widely used and potential access codes. Rockyou.txt download is a free wordlist found in Kali Linux used by various penetration testers.
-
Tor ☛ Global Encryption Day: Encryption's Critical Role in Safeguarding Human Rights
Today, October 21, 2023, is the third Global Encryption Day, organized by the Global Encryption Coalition, of which the Tor Project is a member. Global Encryption Day is an opportunity for businesses, civil society organizations, technologists, and millions of Internet users worldwide to highlight why encryption matters and to advocate for its advancement and protection.
Needless to say, fighting for the protection of encryption is a topic for us 365 days a year. But we want to use this day to reflect on some of the efforts we have initiated or supported in 2023 to ensure access to encryption and push back against government efforts that seek to undermine it - from signing letters and supporting ally organizations on a number of advocacy and awareness campaigns to expanding our outreach and training efforts or localizing educational content.
-
Adam Young: Attestation in a Nutshell
One of my current engineering efforts is in support of the concept of hardware attestation. What is that? Here’s my attempt at a summary:
Attestation is a way of showing something is true. In this case, it is proving that the software you are talking to is from a trusted vendor. In my case, that software is the Firmware for the System-on-A-Chip. While there are many levels of Attestation, they all resolve down to the lowest level software. It doesn’t matter if the Operating System is good if the Firmware is bad, there is the potential for a violation. This is no guarantee that there is not a violation. Attestation is necessary-but-not-sufficient.
How do we attest? Well, we have to talk to a server. There are two different types of servers I have been exposed to in my current effort: BMC and Operating System. They do roughly the same thing. Some external program makes a connection to either the BMC or the OS, and and makes an attestation request. “Show me the firmware you are running and a cryptographic signature for it.” Basically, I am back in the world of X509 certificates. Although attestation does not need to be done with X509, it needs all the stuff from X509 and so it is easiest to explain in terms of X509.