November 1992 - cypherpunks-legacy

"gleason speaks at CPSR..."
by George A. Gleason 29 Nov '92

29 Nov '92

Just a quick note of reassurance here. Someone at BMUG saw something I posted about crypto and education and values, and suggested I give a short talk on that to get discussion going. I will definitely Not 1) be a "spokesperson" for anything or anyone other than my own views, and 2) say anything likely to arouse premature publicity regarding things going on in the group or on the list. So in other words I intend to play it way careful, low-key, stick to social issues, and make it clear that there are many people far more qualified than I to discuss technical aspects in detail, and make it clear that there is wide debate and difference of opinion on the subjects of discussion. Now also, apologies for not contacting other folks on the list here when this was just getting set up. Actually it surprised the heck out of me to find out how fast the date came up; I was expecting at least another week. Properly, there are at least ten or twenty people on our list who could be addressing other groups on these issues. Any feedback, email back to me quick, because it's about 12 hours from now...! -gg

2 1

Cypher Bank
by donb＠netcom.com 29 Nov '92

29 Nov '92

Does anyone know of a law, rule, regulation, or other restriction that would prohibit the establishment of a simple cypher based bank? I can think of 3 basic areas that would have to be satisfied: 1. Federal law and agencies, Federal Reserve, etc.. 2. State and local (California for me). 3. Internet "Appropriate Use" policy. If the bank is operated on a not-for-profit basis --as an experiment. Then that should satisfy the appropriate use requirement. I could use some comments if anyone can cite specific federal or California regulations. Please respond either to me directly, donb(a)netcom.com, or to this mail list. -------- The cypher bank would work like this: I would publish my physical address; and offer to accept deposits by cash, check, or what have you. With the deposit, write on it your PGP handle. Email me your public key corresponding to the handle on the deposit. I will maintain a public list showing handles vs. Amount received, in collection, and in escrow.(Set Subject = "BANK" to get the list) Funds will be paid out based on instructions encyphered with your private key. Comments would be appreciated. Don Bellenger donb(a)netcom.com

4 3

Remailer followup
by edgar＠spectrx.Saigon.COM 29 Nov '92

29 Nov '92

No-one has replied to my request for help using the remailer at Remailing Service <hal(a)alumni.caltech.edu> Am I the only person having trouble making this thing work?? Recall I had to use the "::" convention since I can't specify network headers (except subject) from this system. -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Silicon Valley, Ca

1 0

crypto banking
by Karl L. Barrus 29 Nov '92

29 Nov '92

I'd like to see a digital bank go up as well - just to be able to work through the protocol, at first. I took a cryptography course last summer at the university, and learned a lot (and had some fun!) working through various protocols: coin flipping, poker, subliminal channels, number comparison without giving away the numbers involved, signatures, etc., and more recently since joining this group: dc-nets. It doesn't have to be fancy: this list or maybe just email between various participants at first, maybe then a fancier system with transactions posted or made public for study, then a more advanced system with telnet or mail to the digital bank and transactions kept private. We could make everybody's account balance public and then study ways to avoid traffic analysis on account fluctuations (maybe the only way to do this is to keep balances secret) - maybe everyone can have more than one account and pay off transactions with a little bit from each account (this would be inconvenient though...) Anyway, I'm just rambling on... :-) /-----------------------------------\ | Karl L. Barrus | | barrus(a)tree.egr.uh.edu (NeXTMail) | | elee9sf(a)menudo.uh.edu | \-----------------------------------/

1 0

Detailed Scenario of Dongle Usage
by yanek＠novavax.nova.edu 29 Nov '92

29 Nov '92

So, you walk up to ANY terminal directly connected to a host, or to a terminal server, or a personal computer of any kind connected through a modem, or borrow someone's laptop connected to a cellular modem. You connect your dongle in between the terminal/computer and the communications line, and punch in your secret code on the keypad (which, like phones, also has letters so you can remember fairly long ID-s). Call up, or telnet, dial up a bbs, or connect through any other means, to your host, and log in. Run your favorite mail reader, let's say _elm_. Start reading your mail as you usually would. Any time an encrypted message is displayed whose public key ID matches one of the private keys on your keyring, the dongle temporarily buffers the message it into its RAM, flashes the "decrypt" LED, while decrypting the message. Then you can view the plaintext using a simple, terminal-independent pager that lets you go forward/back one page, and search for a key word. When you are done, you press Q, and the plaintext is immediately deleted from the memory. Note that during all this, the plaintext did not appear anywhere on the host or any of the communication links connecting you to it. Let's say you want to reply to a message. Press 'r' or whatever key is used to reply in your particular mail reader. Or if you want to send a message, press 'm' and fill in the address. Then, if your editor is something like vi or ed that requires you to do something before you can input text (like press 'a') then do that. If you use an editor like EMACS or SMiLE or jove or cat or anything that lets you just type in text, you skip this step. Now, press the "encrypt" button on the dongle. It presents you with a simple line editor, that works with any terminal or terminal emulation, but is reasonably easy to use (something like most bbs-es use for composing messages). You type your message, or if it was prepared ahead of time on the local equipment, you transmit the text. NOTE: this is the simpler of the several different approaches to plaintext handling that I am considering. When you are done, you pick the public key to encrypt it with (or it can be automatically determined based on the address you typed in to your mail program previously). If you have lots of public keys, you could use a search to quickly find the one you want. Then you have the option of signing the message with any one of the private keys that you have. Finally, the dongle transmits the cyphertext to the host, and you type the _exit_ key sequence for the editor (:wq, or C-x C-c, or /done, etc). The message is sent by the mailer software on the host. Then you may want to scan a newsgroup like alt.w.a.s.t.e for any mail that may be for you. Put your dongle into "WASTE SCAN" mode (for example by pressing *WS on the keypad) and tell your newsreader something like "display all new messages". The dongle will detect a message whose key-id matches one of the keys on your key-ring decrypts and displays it, while ignoring all the other messages that are not for you. You must retrieve all the messages, so that anyone monitoring your activity has no way of knowing which one, if any, was actually addressed to you. Then you receive a "talk" request (or a chat call on a bbs, or you may be on irc or a MUD with "chat mode") from someone you know has a similar device (or software that emulates it). If you both know each other's public keys, the two devices both generate a random session key and encrypt it with the others' public key. If not, a key-exchange protocol may be used to generate a key both of you know, but that can not be later recovered by someone recording the data. Now the dongles encrypt any text (one line at at time) that you type, and decrypt anything received. Many other applications for a portable, trusted crypto engine could be thought of, given time. -- Yanek Martinson mthvax.cs.miami.edu!safe0!yanek uunet!medexam!yanek this address preferred -->> yanek(a)novavax.nova.edu <<-- this address preferred Phone (305) 765-6300 daytime FAX: (305) 765-6708 1321 N 65 Way/Hollywood (305) 963-1931 evenings (305) 981-9812 Florida, 33024-5819

2 1

George Gleason speaks out about cryptography: Today 2PM Berkeley.
by gnu 29 Nov '92

29 Nov '92

BMUG, Inc. Computer Professionals for Social Responsibility . . . . . . . Berkeley Chapter _______________________________________________________________ FOR IMMEDIATE RELEASE Contact: Judi Clark, 549-2684 (BMUG), 261-1869 (direct), fax: 261-4836 (direct), or e-mail judic(a)netcom.com November 27, 1992 Special Interest Group on Freedom, Privacy and Technology A public forum co-sponsored by BMUG and CPSR/Berkeley For those that need a brief break from Thanksgiving, the CPSR/BMUG Special Interest Group will explore cryptography with a brief overview and discussion lead by George Gleason. Gleason is founder of a telecommunications contracting firm in Berkeley. He is also professionally involved in psychological research on interpersonal communication and state variables (i.e. perception, cognition, etc.). Gleason's overview will be followed by a video taken from the Second Conference on Computers, Freedom and Privacy in Washington DC last March. The video is entitled: "Who Holds the Keys? Cryptography & Control: National Security vs. Personal Privacy." You are encouraged to join us on November 29, 1992 at 2:00 pm for a look into cryptography and personal privacy. The Special Interest Group's next meeting is Sunday, Nov. 29, 1992, at 2:00 pm. The monthly meetings are free and open to the public. The group meets on the last Sunday of the month at the BMUG office, 2055 Center Street, Berkeley -- a half block from the Berkeley Bart station.

1 0

Re: Electronic Banking
by Richard Childers 29 Nov '92

29 Nov '92

"On a related note, I noticed an article on electronic money in a recent issue of _the_Futurist_. It kept on coming back to the big advantage of cryptomoney: it is completely traceable. The main point was that cryptomoney would eliminate black marketeering (including the drug trade)." I don't think cash will _ever_ be eliminated. If it is, someone will make their own ( banks did this for many decades in North America ) and these will fill the role. There will always be transactions which will not justify the cost of the overhead in hardware and transaction processing, and market pressures will reward those whom develop a way to avoid this overhead, IMHO. -- richard

2 1

Re: Electronic Banking
by George A. Gleason 29 Nov '92

29 Nov '92

Tim and others write with concern about the possible legal consequences of setting up a model digital economy. I would like to suggest that there may be very little to worry about here. This entire project constitutes a research exercise which will no doubt be written up for publication (at least online publication, which makes sense culturally given the nature of the community of interest). It's research and education. The amounts of "digital money" involved can be utterly miniscule: pennies. This is a "token economy" in the same sense as when psychiatric hospital inmates work on the ward for tokens they can trade in for snacks and so on, or a highschool economics class does a similar exercise using Monopoly-type play money. This is not illegal any more than any other social science project would be illegal if all the subjects were adults giving informed consent. Pennies are not a controlled substance nor are they a weapon (unless dropped on people from high places... :-). By analogy I'm thinking of the laws against bigamy/polygamy, and a group of adults getting together to study the question of the effects of different kinds of marital arrangements. So they have a group where they "pretend" to carry out different arrangements and then examine the social dynamics resulting from each. It's quite obvious we're all concerned about the larger social impacts of the possibility of a transition to a cashless economy; and we're hypothesising possible negative consequences and trying to work out solutions. That is entirely admirable, and can be presented as such to anyone who cares to listen to the case. If this needs any further work to develop research angles, I'll gladly come up with a bunch of surveys and other measures, and we can put them into use and harvest some nifty statistical results which might be publishable in the academic literature. -gg

2 1

credibility & pseudonyms
by efrem＠informix.com 28 Nov '92

28 Nov '92

I have this persistent image of what a great boon all these encrypted networks will be for undercover work. Currently when some species of cop or spy goes undercover they take on a nearly full time acting job. They have to work for a long time to establish their credentials and throughout the process are usually in significant physical danger. I vaguely remember (the details are probably wrong) some Isreali spy got as far as the position of Minister of Defense in Jordan before he got hung. With digital signatures a dozen secretaries could run a hundred or more pseudoagents, build a solid reputation for each over years. The same approach would work for a patient con man. Real credibility has to be tied to a physical body. Some thing at risk. --efrem

2 1

MIME
by rebma!rebma!wmo＠kksys.mn.org 28 Nov '92

28 Nov '92

I got the metamail stuff running on my machine. I think it's a good way to get the multimedia mail job done. Does anyone on the list have a better .mailcap entry for pgp than the following....? application/pgp ; pgp < %s ; label="PGP encrypted text" ; compose="pgpcompose %s" where pgpcompose is a quick hack that looks like: #!/usr/bin/ksh rm /tmp/pgpcompose vi /tmp/pgpcompose echo What key? read key pgp -mae /tmp/pgpcompose $key mv /tmp/pgpcompose.asc $1 exit 0 I've just been fooling around with metamail for a couple days, and I don't know what the best way to include PGP is... This seems to work, but I'm guessing I'm missing something more elegant. -Bill -- Bill O'Hanlon wmo(a)rebma.mn.org

3 4