August 1993 - cypherpunks-legacy

Re: blinding message & newbie questions
by Karl Lui Barrus 26 Aug '93

26 Aug '93

-----BEGIN PGP SIGNED MESSAGE----- [I think I messed up when I responded originally ... KLB] Sure, I'll take questions :-) I may be a little slow in responding at the moment. >> Conceptually, when you blind a message, nobody else can read it. >So "blinding" is a synonym for encryption with your own public >key, aka multiplication by a very-hard-to-factor number? Not exactly. Blinding/Unblinding is multiplication; Encryption/Decryption is exponentiation. While I can unblind a document without knowing phi(n), I cannot decrypt a message without knowing phi(n). Knowing phi(n) is equivalent to knowing how n factors, so this is intractable. phi(n) = Euler totient function. >> under the right circumstances if another >> party digitally signs a blinded message, the unblinded message will >> contain a valid digital signature. >In other words if Alice encrypts and Bob signs, Da(Db(Ea(M))) = Db(M)? >Under what conditions? Does RSA (in PGP) satisfy those conditions? The conditions are usually satisfied. Offhand, the only one I can think of is that x and n must be relatively prime, otherwise there is no inverse of x mod n. With really huge numbers, the chances of guessing x such that gcd(x,n) != 1 are very small. If this does happen, then you've guessed x such that x is a multiple of one of the factors of n! Time for somebody to pick a new p,q, and n :-) As far as PGP, I think the only messages PGP produces are exponentiated. I mean, PGP doesn't produces messages obscured only by a muliplication factor; the ascii snow messages PGP generates are encrypted, signed, compressed, or all of the above. So this doesn't arise. >> If someone asks >> you to digitally sign a random stream of symbols, remember that what you >> sign may be unblinded to reveal a contract, etc. >For what applications would Bob want to sign an encrypted contract >instead of a plaintext? Let me get back on this. I beleive the general name these sorts of protocols go under is "embassy protocols". They are useful in things such a digital cash: blind a message, and get the bank to sign it. Then unblind and you have a valid, digitally signed piece of cash. The bank is unable to track it since it couldn't read it (message was blinded when the bank signed), but the bank can verify that the cash is digitally signed by them. It also arises in automatic protocols: say in computer security. If the computer sends a challenge string which you decrypt and send back, the computer can encrypt with your public key to verify you. If the challenge string is random, you may have unwittingly digitally signed a blinded document that is not in your favor... The cut-and-choose protocol allows a person to sign a blinded document and be sure they aren't signing something else. I'll get back on this as well. /--------------------------------------------------\ | Karl L. Barrus | | klbarrus(a)owlnet.rice.edu | | D1 59 9D 48 72 E9 19 D5 3D F3 93 7E 81 B5 CC 32 | \--------------------------------------------------/ -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLHzwP4OA7OpLWtYzAQEyuQP/Vrc5tB5TfbDc0/FRWN9uALdSZk/JZNwX UYmFfKHQzhYdqJkoOrDE+MMHbJaGuZkuSnYUbIEAFvos6SRPI9doRAvyWnKjQKfp 9h04BMGrB3IoHPBqK59CbH+jNtNc3hYgWw4zSpaFo3+1aEPM+WUHQ2plO2KjJSJg 2M272Y2Y3IE= =tHuX -----END PGP SIGNATURE-----

1 0

Re: Source Code NOT available for ViaCrypt PGP
by James Still 26 Aug '93

26 Aug '93

Carl wrote: >> I think he's trying to run ahead of Clipper and the resulting encryption >ban. >> Make a lot of $$$ from people by selling them soon-to-be-"useless" software. >> What a scam... > >Is anyone taking bets on encryption bans? [...] >If each user of RIPEM or PGP would get one newcomer to start using it >every month, for example, it would take less than 18 months to get the >whole US covered. Are there any volunteers among the Windows guru/programmer's here to kick out a shell that supports PGP? 2.3a is *much* more stable than 2.2 (and runs great from within PGPShell .PIF'd from Windows.) IMHO only a fraction of Carl's newcomers will even take a second look at PGP unless there's an interface for it. Our privacy shtick falls short on the masses that don't understand our zealotry or the need to protect their own privacy. They want it to be *fun* and could care less about the conspiracies involved. First you get the teeming millions to enjoy what they're doing (see? encryption is fun kids!) and more importantly, feel very comfortable using encryption tools. That way if the fateful day of encryption bans does come, these tools will be as hard to take away from them as from a Texan who first learns to shoot his father's gun. ---- still(a)kailua.colorado.edu -------------------------------------

1 0

Re: Source Code NOT available for ViaCrypt PGP
by mbriceno＠aol.com 26 Aug '93

26 Aug '93

Simon Trask writes: > A) No source code will be available, due to the nature of the > agreement between PKP and ViaCrypt. So we are supposed to trust it sight unseen? Why in the world would anyone buy an encryption program of questionable security --which any program for we can not get the source is-- when we can get a supposedy virtually identical program that we know is secure for free? > B) He is under 'a lot' of pressure to have a product 'on the shelves > in under two months', and therefore the first release will be a > MS-DOS version, then Macintosh, SVR4, SUN OS, and all of those unix > versions, and that they will eventualy put out a windows product and > start makeing improvements to the actual product. I can't help but wonder if the guy is feeling other pressures besides time pressures. Just thinking. I don't think that ViaCrypt will make much money of the people on this list. --Marc

3 2

Source Code NOT available for ViaCrypt PGP
by Christian D. Odhner 26 Aug '93

26 Aug '93

I talked once again with Dave Barnheart at ViaCrypt, and he told me: A) No source code will be available, due to the nature of the agreement between PKP and ViaCrypt. B) He is under 'a lot' of pressure to have a product 'on the shelves in under two months', and therefore the first release will be a MS-DOS version, then Macintosh, SVR4, SUN OS, and all of those unix versions, and that they will eventualy put out a windows product and start makeing improvements to the actual product. So in answer to (Paul Goggin's?) questions about verification of changes, "We'll Just Have To Trust Them(tm)" <g> But look on the bright side... This will blow David Sternlight out of the water! Happy Hunting, -Simon Trask <cdodhner(a)indirect.com> PGP public key available upon request.

3 2

Re: Visa, HNC Inc. develo
by Duncan Frissell 26 Aug '93

26 Aug '93

To: cypherpunks(a)toad.com M >Same goes for the supermarket reselling my M >buying patterns. If they can sell information about me, my groceries M >are cheaper (or they make money). Selling personal information is a M >competitive advantage. For most people, this is more important than M >privacy. M > M > Marc But it's trivial in the case of supermarket "Price Plus" card programs to use a nome de guerre and a mail drop (which you should be using in any case). Thus you get the discount and the supermarket gets purchasing info which may or may not match your actual demographics depending on whether or not you lied about those as well as your name on the initial ap. Secured credit cards allow you similar anonymous use of payment facilities (if obtained in a nome de guerre) without surrendering privacy. That said, I realize that it is difficult even to convince civilians of the benfits of receiving all their mail via an agent. They consider it weird. Perhaps "celebrity stalkers" and the general breakdown in civility will ecourage the use of communications screening devices like mail receiving services, voice mail, and the coming network-based communications servers. Duncan Frissell What this metaverse needs is a cheap anonymous communications server for all who want one. This software entity located "somewhere on the nets" would receive all email, voice, fax, video, and VR communications directed to an individual, record and filter them, and forward (anonymously) those communications that meet certain pre-established criteria to its principal located "somewhere on the nets." --- WinQwk 2.0b#0

1 0

info; ATM
by Brian D Williams 26 Aug '93

26 Aug '93

Paul Ferguson wrote; >Forgive me for furthering this slightly off-topic thread, but >Sprint has been offerring Frame Relay data sevices for quite some >time, both for private wide-area networks and for >interconnectivity to the global internet via SprintLink. Now, >Sprint will beat everyone else to the punch offerring up ATM - Too late; MFS plugs in leading-edge network for high-speed data transfers MFS Communications Corp. claimed the technological lead among data communications service providers last week with the launch of its end-to-end asynchronous transfer mode network. MFS, an upstart better known for its successful challenges to local telephone company monopolies, claims to have set up the first ATM network in the country. But analysts say that distinction could be fleeting, as at least one other service provider -- Sprint Corp. -- is expected to offer a similar service by year-end. Although these systems can carry regular telephone conversations, they are most apt to be used to transmit huge volumes of computer data and to make it possible for computers in widely separate locations to work together. Ultimately, Royce Holland, president of MFS, sees ATM networks providing the backbone for a telecommunications infrastructure that supplies movies to home television sets at the touch of a button. Investor's Business Daily -- August 24 -- Page 4 Sprint was also before congress last week asking that MFJ restrictions against the RBOC's entry into long distance be codified into law, and that they (the RBOC's) be restricted from entry into long distance for 10 years! can you say competition? Brian Williams Ameritech data center Cypherpatriot

1 0

Source Code NOT available for ViaCrypt PGP
by vince＠dsi.unimi.it 26 Aug '93

26 Aug '93

> Just thinking. I don't think that ViaCrypt will make much money of > the people on this list. Very true. Too bad that PGP is going commercial. Even worse the fact that sources won't be available. If PGP will become a commercial product and the public domain version will be unsupported or ``left behind'' in respect of the commectial version, then I believe that some hackers will start hacking the public domain version (probably infringing PGP's copyright as well), a new version, newly-featured version of PGP (let's call it NPGP) will start being used and then the commercial version of PGP will become suspect, poorly trusted and unpopular in the Internet community. -- David Vincenzetti, system adminitrator | <vince(a)ghost.dsi.unimi.it> DSI, Universita` degli Studi di Milano, | phone: ++39 2 55006 391 via Comelico 39, 20135 Milan, ITALY | fax: ++39 2 55006 373

1 0

Data battles amongst the "Big Three"
by fergp＠sytex.com 26 Aug '93

26 Aug '93

-----BEGIN PGP SIGNED MESSAGE----- On Wed, 25 Aug 93 22:36:33 -0600, "L. Detweiler" <uunet!longs.lance.colostate.edu!ld231782> wrote - > Two announcements on products that will bring internet to large > audiences. One by Continental Cablevision Inc. The cable line one > apparently uses special coaxial cable modems, and apparently is > full-duplex (?). On front page of today's Wall St. Journal. > Following that, AT&T announces the Interspan `Frame Relay Services and > Information Access Services' to the internet. In the former, one gets > `cost-effective' internet capabilities, in the later Forgive me for furthering this slightly off-topic thread, but Sprint has been offerring Frame Relay data sevices for quite some time, both for private wide-area networks and for interconnectivity to the global internet via SprintLink. Now, Sprint will beat everyone else to the punch offerring up ATM - excerpted from: Communications Week August 23, 1993 pages 1, 144 Sprint Takes Lead in ATM Service Race by Robin Gareiss San Francisco -- Four months ahead of schedule, Sprint will announce this week that its asynchronous transfer mode transmission service is available immediately, according to industry analysts. The service, to be introduced at the INTEROP 93 August show here, will be the first ATM service from a major long distance carrier. [....] Sprint plans to announce flexible, user-specific pricing, according to Jeffrey Held, partner with Ernst & Young's Network Strategies practice, Vienna, Va. Sprint briefed Held on its announcement last week. Sprint originally had planned to make its ATM service available in first-quarter 1994. According to sources, the carrier has been able to step up its plans because trials have gone more smoothly than anticipated. [....] Sprint will let users access its ATM-based service via local switched multimegabit data service or dedicated -T-3 lines, sources said. As specifications evolve, Sprint also will develop interfaces between its ATM and frame-relay and SprintLink TCP/IP services, Held said. [....] 8<-------- End excerpt ------ ferguson(a)icp.net ,-) -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLHyJbpRLcZSdHMBNAQHeOgP/Q/sY8kOcjsCF41+GNUl325TX00R0TtJw sxqxGw++lSsRWeA+T+fAU5at9oPaiE7zVgAgNBGoQjGy4Bz+paiyIjK+Mi9YHqa4 ufTKq2bV3ZutruznR1Nk9j3zYi/zGIkdrNg05y4pvEUcLeEgRTfnzo2EhXIu6M5l t6cUjP1XhlY= =exLc -----END PGP SIGNATURE----- Paul Ferguson | "Government, even in its best state, Network Integrator | is but a necessary evil; in its worst Centreville, Virginia USA | state, an intolerable one." fergp(a)sytex.com | - Thomas Paine, Common Sense Type bits/keyID Date User ID pub 1024/1CC04D 1993/03/15 Paul Ferguson <fergp(a)sytex.com> Key fingerprint = EE D2 93 7D 04 6D C6 05 AC 36 AD 9D 8E 4F 41 58

1 0

Re: "more money than brai
by M..Stirner＠f28.n125.z1.FIDONET.ORG 26 Aug '93

26 Aug '93

Uu> From: szabo(a)netcom.com (Nick Szabo) > M. Stirner: > Only one question: WHY? If PGP is freeware for noncommercial single > users, why on earth would anyone wish to drop $100 +/- for single-user > rights to a virtually identical program? Uu> There are several business proposals floating around the cypherpunks Uu> community that would require commercial licenses. Note that I was not speaking of commercial, but single-user licenses. Uu> I encourage the Uu> various crypto-entrepreneurs elaborate if they wish. Uu> Some of the proposals are quite interesting and illuminating. Uu> There's a strong habit of keeping business ideas "trade secret", Uu> which can be a bad idea, since (a) many of the ideas Uu> are obvious; trade secrets only work for subtle but important Uu> technological bottlenecks known to a small group of mutually Uu> trustworthy people, and (b) many of the ideas need to Uu> debugged by a wide variety of crackers and experts before they will Uu> provid good privacy. Trade secrets also inhibit the progress Uu> of the cypherpunks agenda, but that's a judgement call; I myself Uu> dont' feel morally bound to Reveal All for the sake of the Uu> Movement. But, "I'll post mine if you post yours". I feel rather in the dark. If you are going to say something, please say it. I had my circumlocution buffer filled by noon today by others who beat you to the punch. However, the mere mention of money makes my cute little ears stand right up, assuming it's not in non-negotiable digital gold coins, which niether my landlady nor the Arab bodega where I buy my menudo will accept... . ~ . M. ... "The good & the possible never seemed to coincide."Orwell ___ Blue Wave/QWK v2.12 -- M. Stirner - via FidoNet node 1:125/1 UUCP: ...!uunet!kumr!shelter!28!M..Stirner INTERNET: M..Stirner(a)f28.n125.z1.FIDONET.ORG

1 0

Re: "more money than brai
by M..Stirner＠f28.n125.z1.FIDONET.ORG 26 Aug '93

26 Aug '93

Uu> From: bei(a)dogface.austin.tx.us (Bob Izenberg) # Only one question: WHY? If PGP is freeware for noncommercial single # users, why on earth would anyone wish to drop $100 +/- for single-user # rights to a virtually identical program? Uu> Dumb as it may sound, at work the people from Finance want to see that Uu> we've paid for all the software on our machines. Yes, I've received several replies like yours, but note that company use was not the question - I understand the "why" there, complete with all the corporate shareware/freeware phobia - but the question was why a _private single user_ would pay $100 for the honor of a licensed private single-user release of a freeware program. THAT doesn't make sense, thus my question. . Conceivably, someone with assets (certainly not me, but I suppose such people exist somewhere) might be worried about the sound & fury emanating from PKP concerning lawsuits against all freeware PGP users, but $100 is mighty high insurance against an event with that low of a probability. ********************************************************************* * <m..stirner(a)f28.n125.z1.fidonet.org> - PGP Key D30909 via servers * * > What country can preserve its liberties if its rulers are not <* * > warned from time to time that their people preserve the spirit <* * > of resistance? Let them take arms!" - Thomas Jefferson, 1787 <* ********************************************************************* ___ Blue Wave/QWK v2.12 -- M. Stirner - via FidoNet node 1:125/1 UUCP: ...!uunet!kumr!shelter!28!M..Stirner INTERNET: M..Stirner(a)f28.n125.z1.FIDONET.ORG

1 0