Saturday, January 28, 2017

Encryption Update ** UPDATED **


(Update at the bottom)

So, the NSA and IAD just released an advisory memo directed at US government entities and NGOs/Corporations that deal with classified material. In a nutshell, they are raising the minimum required encryption level for top secret data effective immediately. So instead of referring to the NSA's Suite B cryptography, we will now refer to what they are calling the Commercial National
Security Algorithm Suite. The changes are as follows:

Former Suite B standards

- RSA-2048                                       (Key exchange/Digital Sig)
- ECDH/ECDSA P-256                    (Key exchange/Digital Sig)
- AES-128                                         (Symmetric encryption)
- Diffie-Hellman 2048                      (Key exchange)
- SHA-256                                        (Integrity check/hash)


New NSS standards

- RSA-3072                                      (Key exchange/Digital Sig)
- ECDH/ECDSA P-384                   (Key exchange/Digital Sig)
- AES-256                                        (Symmetric encryption)
- Diffie-Hellman 3072                     (Key exchange)
- SHA-384                                       (Integrity check/hash)

Okay great.....what does this mean to you?

Well, for one, if the NSA feels there is a threat great enough to warrant raising these standards to protect national security structure, then it only makes sense for the public to do the same. After all, I place I high value on my privacy and the sanctity of my "data".


Things you should be checking:

1. Your VPN provider (you are using a VPN, right?). Most of the providers I recommend already meet or exceed the new standards. There are, however, some that still employ RSA-2048 and AES-128. Find out what your provider is using and if it does not meet the standard as set forth above I would contact them and encourage them to implement it as soon as possible.....or move to a different provider.

2. Your PGP/GPG keys. More and more people are discovering and utilizing GPG encryption for their mail and personal file security. I have noticed though that many of the people that contact me via GPG are still using RSA-2048 keys. I would encourage you to switch to the stronger RSA-4096 keys (or better yet, ECC keys with non-NIST curves....if you are savvy with the terminal).


These couple of steps will greatly increase your personal/business security level and, frankly, are pretty painless to implement.



I should note that you will get hands on experience with these techniques at my GroundRod 2 course.

***  UPDATE ***

We looked at the Suite B standards and the new NSS standards above.....now, here are my recommendations:

For key negotiation/exchange:

      - RSA-4096
      - ECC Brainpool P-384 or P-512
      - ECC Curve25519
      - DH 4096

For symmetric (payload) encryption:

      - Twofish / Threefish
      - Serpent
      - AES-256

For integrity check/hash:

      - SHA-512
      - Whirlpool

 As you can see, I favor non-NIST standards as much as possible. For most VPN providers you are stuck with AES for channel encryption, however, Proxy.sh and a couple others are working on implementing Serpent and Twofish as an option.









Wednesday, January 18, 2017

First GroundRod 2 Student Review

I just received a very humbling course review from one of the students from my recent GroundRod 2 course in Arizona. Here it is....


***

Praise for GroundRod2

* K is the Marcus Aurelius of Cyber Privacy and Security.

* Groundrod2 (GR2) was awesome. If you thought Groundrod1 was good, GR2 is even better

* K is an incredible instructor. He offers a wealth of experience and expertise related to privacy, security and liberty. The course is not just for those who like to be prepared, people who live off-grid, etc. GR2 is a hands-on, cyber security “boot camp” for freedom-loving Americans who cherish their constitutional rights. The training course is immersive, takes place in a small class environment while the goal for students is to leave with cutting-edge skills they can immediately apply in their daily life.

* K’s classes can be understood by individuals as well as both the business and the technical side of any organization. By way of example, K’s military and technical expertise combined with his attention to detail allow him to walk through complex scenarios and use cases with ease while applying risk principles to each situation so students can visualize the best outcome and discern the reasoning behind the analysis.

* K’s course will empower students with the skills and tools needed to win the battle against the wide range of cyber adversaries who want to harm you, your family and your environment.

*GR2 was a high-quality learning experience against a backdrop of constantly changing technologies and threats. Put another way, K’s class is a “Proving Ground” for all the latest, best and most secure technologies to safely and securely communicate.

*It’s clear based on the quality of class instruction and extensive classroom training tasks, K has extensive experience with successful classroom teaching techniques and delivering technical training for adult learners in corporate, government and military environments.

* Heaven forbid, but ... If Weimar Germany in 1923 or Venezuela in 2017 are any indication of what may happen here in the future in the US; If you care about your family, friends and loved ones and want to have the ability to communicate candidly, effectively and securely in a potentially hostile environment, you will want to take this class.

* Most people view insurance as something they need for their car, home or if they die ... for their loved ones after they pass on. Think of K’s class as insurance against “Normalcy Bias”. It’s the elixir against denial for what we already know is a mathematical certainty (the US Government will default on the 20T in national debt in the near future). Very few people have the skills and know-how to communicate securely over long distances with others in a hostile environment. And, you will be equipped with knowledge that will be in exceptionally high demand.

-PN01


***

My thanks to the wonderful students down in Arizona. Their quest for excellence, fearless questioning and overwhelming generosity represent the things that keep me going.



Wednesday, January 4, 2017

Upcoming Courses


GroundRod 2 is here and covers the following:

- Review of GroundRod Primer skills

- Discussion of current events as they relate to privacy, security and liberty

- In depth study of the Invisible Internet Project / I2P

- Setting up anonymous mail service via I2P

- Exploration of Zeronet and other distributed networking systems

- Setting up and using Retroshare with extra anonymity

- The latest in encryption techniques, including ECC

- Setting up open source router firmware

- Metadata analysis

- Testing secure alternatives to Skype and other mainstream teleconferencing software

- The latest in crypto-currency trends, techniques and software

- Real-world tradecraft application

- Setting up resilient, "Ministry of Truth" proof websites

- Hands on training for SEPIO laptop owners

- and tons more.........

***************************

These are the current course dates. Contact me if you want to reserve a seat or if you wish to host a course in your area. Cost is still just $350 (per course).


GroundRod 2                          --  Phoenix, AZ  -- 14-15 January

GroundRod Primer                --  Austin, TX -- 4-5 February    w/ Forward Observer

GroundRod Primer & GR2   --  Columbus, OH -- 24-27 February

GroundRod Primer & GR2   --   Clarksville, TN  --  27-30 April



The privacy fight is far from over folks.......regardless of who is occupying the White House.


** UPDATE **  For those of you attending any of the double classes (GR1 & 2) you only need to make one $100 class deposit as opposed to a $100 deposit twice for each course.