August 1993 - cypherpunks-legacy

Re: No digital coins (was: Chaum on the wrong foot?)
by nobody＠shell.portal.com 25 Aug '93

25 Aug '93

If your goal is only privacy of personal information not economic privacy you would do better to support Clipper-like systems (such as DigiCash with an IRS-Tax Backdoor). Supporting untracable perfectly secure cash will make taxation and state economic planning hard if not impossible. It is contradictory for a liberal to support DigiCash, Strong Cryptography, etc because effective collective coercion requires personal information. All you have to do is take perfect anonymity to its natural conclusion and you see where it leads. (and it ain't socialism)

1 0

16th NCSC meeting Sep 20-23 1993 announcement
by L. Detweiler 25 Aug '93

25 Aug '93

>From Risks 14.86 Aug 24 1993 This is a Spook Central meeting, so the topics given are interesting `signal intelligence' on what's on the NSA^D^D^DNIST's mind at the moment. Also, it suggests what companies have active consulting & production arrangements with NSA (MITRE, Motorola, etc.). What's on their mind: hierarchical security systems (antithetical to the subversive PGP `web of trust'), distributed/network security, CLIPPER, `publishing work', (read: restrictions on cryptographic topics in journals?), `security requirements for cryptographic modules' (read: restrictions on cryptographic device export?) `International harmonization' by a Frenchman (hehe, sounds a lot like `Ministry of Truth'), a probable codeword for International Cryptographic Restriction. Acronyms: TPEP, TTAP -- sound big, what are they? Some kind of U.S. government `evaluation paradigms'. Again, probably for crypto-device export. Interesting presentations by spook outsiders & wannabes: virus attacks, `Security & Auditability of Electronic Voting Systems', `Privacy Impact of technology in 90's', `Electronic Crime Prevention & Investigation' Hopefully, some patriotic cypherpunk can sneak in and smuggle out a report! ------------------------------ Date: Thu, 19 Aug 93 12:32 EDT From: Reiner(a)DOCKMASTER.NCSC.MIL Subject: NCSC 16 Announcement for RISKS 16TH NATIONAL COMPUTER SECURITY CONFERENCE Dates: 20-23 September 1993 Location: Baltimore Convention Center Baltimore, Maryland Registration fee: $275 The National Computer Security Center and the National Institute of Standards and Technology will present the 16th National Computer Security Conference from 20-23 September at the Baltimore Convention Center. This year's three and one-half day program features tracks in : Research & Development; System Implementation; Management & Administration; Criteria & Evaluation; Tutorials & Other Presentations. aA summary of the technical program follows. To obtain more information about the technical program send a message to NCS_Conference at DOCKMASTER.NCSC.MIL or call the NCSC on 410-859-4371. To obtain a registration form, call the Conference Registrar at 301-975-2775 or send a message to NCS_Conference at DOCKMASTER.NCSC.MIL TECHNICAL PROGRAM SUMMARY: R&D TRACK PANELS - Strategies for Integrating Evaluated Products Chair: J. Williams, MITRE - Multilevel Information System Security Initiative Chair: G. Secrest, NSA - Trusted Applications Chair: J. Cugini, NIST - Best of the New Security Paradigms Workshop II Chair: H. Hosmer, Data Security Inc. - Enterprise Security Solutions Chair: P. Lambert, Motorola PAPER SESSIONS - Honesty Mechanisms Chair: E. Boebert, SCTC - Database Research Chair: M. Schaefer, CTA - Access Control Chair: P. Neumann, SRI SYSTEM IMPLEMENTATION TRACK Panels: - Perspectives on MLS System Solution Acquisition Chair: J. Sachs, ARCA - Network Management -- The Harder Problem Chair: R. Henning, Harris Corp. - Application of INFOSEC Products on WANs Chair: J. Capell, Lockheed - Security for the Securities Industry Chair: S. Meglathery, NYSE Paper Sessions: - Access Control Topics Chair: D. Balenson, TIS - Network Risks & Responses Chair: B. Burnham, NSA - Software Engineering Chair: V. Gibson, Grumman - System Engineering with OTS Products Chair: M. Tinto, NSA - Network Implementation Chair: F. Mayer, Aerospace Corp MANAGEMENT & ADMINISTRATION TRACK PANELS - Virus Attacks & Counterattacks: Real World Experiences Chair: J. Litchko, TIS - Terror at the World Trade Center Chair: S. Meglathery, NYSE - Contingency Planning in the 90s Chair: I. Gilbert-Perry, NIST - On a Better Understanding of Risk Management Techniques Chair: S. Katzke, NIST - Security Awareness, Training & Professionalization Chair: D. Gilbert, NIST - Accreditor's Perspective - How Much is Enough? Chair: J. Litchko, TIS - Security & Auditability of Electronic Voting Systems Chair: R. Mercuri, U. of Penn. - Protection of Intellectual Property Chair: G. Lang, Harrison Ave. Corp. - The Privacy Impact pof technology in the 90s Chair: W. Madsen, CSC - Electronic Crime Prevention & Investigation Chair: R. Lau, NSA PAPER SESSION - Managing & Promoting INFOSEC Programs Chair: D. Parker, SRI TUTORIALS & PRESENTATIONS TRACK Tutorials: - Threats & Security Overview A. Liddle, IRMC - Trusted Systems Concepts C. Abzug, IRMC - Trusted Networks R. Bauer, E. Schultz, ARCA - Trusted Databases G. Smith, W. Wilson, ARCA - Trusted Integration & System Certification J. Sachs, ARCA Panel Presentations: - CLIPPER Chip Chair: L. McNulty, NIST - Getting Your Work Published Chair: J. Holleran, NSA - INFOSEC Standards: The DISA Process Chair: W. Smith, DISA - Security Requirements for Cryptographic Modules; Chair: L. Carnahan, NIST CRITERIA & EVALUATION TRACK Presentations: - Introduction to the Federal Criteria G. Troy, NIST; D. Campbell, NSA - Federal Criteria: Protection Profile Development J. Cugini, NIST; M. DelVilbiss, NSA - Federal Criteria: Registration of Protection Profiles D. Ferraiool, NIST; L. Ambuel, NSA Panels - Federal Criteria: Protection Profiles for the 90s Chair: R. Dobry, NSA - Federal Criteria: Vetting & Registration of Protection Profiles Chair: L Ambuel, NSA - Evaluation Paradigms: Update on TPEP and TTAP Chair: S Nardone, NSA - European National Evaluation Schemes Chair: E. Flahavin, NIST - The European Evaluation Process Chair: P. Toth, NIST - International Harmonization I Chair: Y. Klein, SCSSI, France - Goals & Progress Toward the Common Criteria Chair: G. Troy, NIST - Federal Criteria User Forum Chair: C. Wichers NSA Plenary: "Information System Security Strategies for the Future" Chair: Stephen Walker Panel: James P. Anderson Dr. Willis Ware Dr. Roger Schell ------------------------------ End of RISKS-FORUM Digest 14.86 ************************

1 0

No Subject
by Gomes, Bill M'bio 25 Aug '93

25 Aug '93

Please subscribe me to the cypherpunks mailing list. Thanks.

1 0

Re: Digital Gold
by nobody＠soda.berkeley.edu 25 Aug '93

25 Aug '93

At 4:23 PM 8/24/93 -0400, hnash(a)mason1.gmu.edu wrote: > >I tried to imagine a digital currency which is not backed by >any bank, but just exists by mathematics and convention, like >gold. The result is the following currency system which >could be called digital gold. It involves three conventions, >(1) a convention for valuing coins, (2) a convention for >claiming coins, (3) a convention for transfering coins. > >I believe the resulting currency is unforgeable, >uninflatable, and untraceable. Let me know where I've gone >wrong (gently). I love this scheme, but I have two questions about it. 1) How will disputes be settled? >In order to claim a digital gold coin, the claimer must >publicize a "claim certificate", containing the signed >integer and the public key required to recognize the >signature. The first person to publicize a claim certificate >will be recognized as the owner. Some variant of the keyserver could be the public registry of gold. Can this be done in a reasonable way, where a large part of the transaction cost is not involved in verifying that the buyer really owns her cash? Is there some way to make this more like a web of trust? Can it be blinded in a way that maintains the trust but allows anonymous transactions? 2) Why should anyone value a digital gold coin in the first place? Money has value because of people's expectation (based on experience) that if they take it to a store they can buy stuff with it. Where will digital gold obtain its bootstrap value? Somebody has to start using it. My own feeling about how digicash will develop is that it will be added into an initially non-anonymous digital based debt clearinghouse. With PGP (etc.) we already have the means to create verifiable IOU's, contracts, loans, etc. (Is anyone using them?) If such IOU's were used widely but non-anonymously, it would require only a small innovation to move to anonymity (either through blinding, or use of agents with reputations, or ?). The problem is getting any kind of online action to begin with. (AMiX?)

1 0

rsa129 project: Mail problems, some mail lost
by explorer＠iastate.edu 24 Aug '93

24 Aug '93

If you replied to the rsa129 factoring project using rsa129-request(a)iastate.edu, please mail that address once again. We had a local mail problem and some mail was lost. If you have gotten a reply from me however, I will mail out source and such asap. Thank you --Michael

1 0

syntax for cut lines
by wcs＠anchor.ho.att.com 24 Aug '93

24 Aug '93

Mr. Anonymous sent the following to cypherpunks, through one remailer: > > I think the Hall Remailer at <nowhere(a)bsu-cs.bsu.edu> recognizes a > > "cut line" of > > --ignore-- > > I tried this and it failed the first time, but worked the second. > > You should try a message to yourself before relying on it. > Let us try it here and see how it works; the following line contains the > kiss-off "ignore" and everything that shows beyond it was added without > my intention: And it worked... I would recommend one change to the handling of cut lines like --ignore-- : - leave the cut line in the message, just cut the stuff after it This lets you use one --ignore-- line to chop of any trailers from multiple remailers, so you don't risk building up a trail. Getting rid of the first one is obviously the most critical, but the rest can also be a risk. Also, someone has commented that most people who use anonymous remailers test them by sending a message to themselves before sending it to their real destination. If your intended recipient is on the same system or group of systems that you are, this is a traffic analysis risk... Bill Stewart

1 0

Re: No digital coins (was: Chaum on the wrong foot?)
by dmandl＠lehman.com 24 Aug '93

24 Aug '93

Well said, Eric. There's no reason for people to assume that "We're all [fill in name of your political faction] here." We've got a common goal/program and happily we agree on many of the most crucial political issues. Everything seems to work fine without subtle swipes at other people's views or egocentric assumptions about what we all believe. Some people on this list, for example, are staunch anti-capitalists, but we're polite enough to hold off on the capitalist- and spectacle-bashing rhetoric because we generally respect other people's views and realize that there's no good in it. Recently, one bonehead posted a message stating, in effect, that this is an Extropian list. That is, of course, nonsense, but even more, it's obnoxious, egomaniacal, and pointless. This is a very diverse list, but I think we know what assumptions are NOT shared by everyone. Your remark did seem like a blatant taunt, Perry. --Dave. > From: hughes(a)ah.com (Eric Hughes) > > >Charge you for performing services? Shudder -- how horrible! > >Capitalism! Ohmygod! > > I count this comment as an intentional misreading of my position. > > I am not a libertarian, nor is it likely that I ever will be. I've > also read E. F. Schumacher's _Small is Beautiful_ and thought much of > it was just plain wrong, or, at best, unprovable. > > I read your words as an attempt to enforce a sort of libertarian > political correctness, as insulting as that phrase will no doubt be to > you. > > The agenda of privacy is orthogonal to most partisan political > positions. As strong as the libertarian presence is on this list, it > is by no means the only view. It is precisely because cypherpunk > issues cut clean across the political spectrum that they are so > powerful. > > I expect no one here to wear seamless garments of any cut or cloth. > > There are many on this list whose personal agendas call for making the > world safe for greater accumulations of capital. This is not at all > my agenda, yet I have put aside my repugnance at this in pursuit of a > common goal. While I expect no one to hold to any particular view, > I do expect that everyone here treat opposing views with respect, or > better yet, with silence.

2 1

Digital Gold
by hnash＠mason1.gmu.edu 24 Aug '93

24 Aug '93

-----BEGIN PGP SIGNED MESSAGE----- I tried to imagine a digital currency which is not backed by any bank, but just exists by mathematics and convention, like gold. The result is the following currency system which could be called digital gold. It involves three conventions, (1) a convention for valuing coins, (2) a convention for claiming coins, (3) a convention for transfering coins. I believe the resulting currency is unforgeable, uninflatable, and untraceable. Let me know where I've gone wrong (gently). Digital Gold ----------- Let's associate one digital gold coin with each positive integer. Let's agree that the coin for each integer N is worth half as much as the coin for integer N/2. integers: are each worth: -------- ----------- 1 - 1 1 ounce 2 - 3 1/2 ounce 4 - 7 1/4 ounce 8 - 15 1/8 ounce 16 - 31 1/16 ounce The total amount of digital gold is infinite. However, the amount in circulation will always be finite because the lowest denomination coins aren't worth claiming or to spending. (Claiming and spending of coins will be described shortly. For the time being, let's just assume that each requires a certain amount of computation.) For example, if it costs 1/10 ounce of digital gold to spend a digital coin, then 1/16 ounce coins will not circulate. The total amount of digital gold in circulation will then be 4 ounces. The supply of digital gold is similar to the supply of real gold. As the value of real gold increases (relative to the cost of mining), more real gold can be mined profitably. If the demand for digital gold doubles, its value will roughly double, and a lower denomination can then circulate. Similarly, if the cost of computation halves, a lower denomination of coins can circulate. In either case, the number of coins doubles, but the supply of digital gold increases only slightly. Each denomination represents an equal fraction of the digital gold in circulation. Therefore, as new denominations come into circulation, the supply of digital gold remains relatively stable. However, the number of coins increases in proportion to the demand for digital gold, and to the supply of computation. This seems appropriate. Also, only a small fraction of the digital gold is in the smallest denominations. This is important since the smallest denominations are always inefficient to spend. Claiming Digital Gold -------------------- Let's agree, by convention, that the first person to sign a particular integer, owns the digital gold corresponding to that integer. This is the law of initial acquisition of digital gold. In order to claim a digital gold coin, the claimer must publicize a "claim certificate", containing the signed integer and the public key required to recognize the signature. The first person to publicize a claim certificate will be recognized as the owner. A claimer can use a new alias for each new claim. In this way, he can claim coins without revealing his identity. Spending Digital Gold -------------------- In order to spend a coin, the payor signs a claim certificate from the payee. This voids the payor's ownership of the coin, and validates the payee's ownership. The payor uses his old alias to sign the payee's claim, so that he does not identify himself. The payee can generate a new alias for each new claim certificate, so he can accept coins without identifying himself. The law of property transfer for digital gold is the same as the law of property acquisition. The first person to publicize a new claim certificate signed by the previous rightful owner, rightfully owns the coin. The payee should have the claim confirmed (signed) by some of the agencies where he might like to spend the coin. A confirmation indicates that the agency is willing to accept the coin from the new alias. Before confirming a claim, an agency should establish that the payer owned the coin at one time, and that he has not yet granted it to anyone but the payee. If the claim is good, the agencies should take note of the new owner. If the claim is bad, the payee can confront the payer. Agencies can do enough research to avoid confirming most bad claims. For each coin, there exists a chain of claim certificates extending all the way back the the original owner of the coin. The backward chain proves that each alias has owned the coin at one time. The forward chain proves that each alias no longer owns the coin. Agencies can also sign claims with timestamps, in order to settle disputes over coins claimed by multiple owners. The result is ownership by consensus. If the agencies I wish to do business with agree that my alias owns a particular coin, then I own a certain amount of digital gold. ------- Yours Truly, ][adon Nash --------------------- in founding a family or a state, or acquiring fame even, we are mortal; but in dealing with truth we are immortal, and need fear no change nor accident. --------------------------- ][enry David Thoreau ----- -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLHo/dTIwr9YMSTuBAQE2yAQAqOXczfGi0SffaNoPj294bQQSoSTMkiTU Ko62ELCoshD729+2Qin5NqS+eFcW5zL+o/KZU4c1OZYa5Bt5PqlZIq29kjuNiNSr Z/E6++HyaLO0S4ivjUhWRqOorT5b8WwL+a37zk2cNEdXG8sfsyS6Hn+xhHHhUmgD 2E4dGeMeftY= =HWaS -----END PGP SIGNATURE-----

1 0

Blinding messages
by Karl Lui Barrus 24 Aug '93

24 Aug '93

-----BEGIN PGP SIGNED MESSAGE----- Earlier Perry asked for references to blinding methods. I can provide one, but the mathematics is fairly simple and straightforward, so I'll just talk about it here. Any good intro text on number theory, or even some crypto books (Denning, Seberry & Peiprzyk) will have all the math you need to know. Conceptually, when you blind a message, nobody else can read it. A property about blinding is that under the right circumstances if another party digitally signs a blinded message, the unblinded message will contain a valid digital signature. So if Alice blinds the message "I owe Alice $1000" so that it reads (say) "a;dfafq)(*&" or whatever, and Bob agrees to sign this message, later Alice can unblind the message Bob signed to retrieve the original. And Bob's digital signature will appear on the original, although he didn't sign the original directly. Mathematically, blinding a message means multiplying it by a number (think of the message as being a number). Unblinding is simply dividing the original blinding factor out. One thing protocols that involve signing blinded messages have to watch for are messages that you don't really want to sign. If someone asks you to digitally sign a random stream of symbols, remember that what you sign may be unblinded to reveal a contract, etc. Techniques of getting around this seem to be cut-and-choose protocols, which I won't get into here. Judy Moore's paper "Protocol Failures in Cryptosystems" - appeared in IEEE Proceedings, May 1988, Vol. 76, No.5, and also appears in the big IEEE Crypto book Simmons edited - discusses this as the "Notory Protocol." I'll excerpt from her paper: 1) To setup the notary protocol, Alice chooses RSA parameters p, q, e, d She publishes her public key e, and n = pq Bob now wants to trick Alice into signing a message which says she owes him some money. 2) Bob now chooses an arbitrary number x. He computes y = x^e mod n. e is Alice's public key and everyone knows it. Bob can now use y (bliding factor) to obtain forgeries on another document. 3) Bob forms the messages he wants, and muliplies in the blinding factor y. He calulates m' = ym 4) Alice agrees to sign a message m' which is total gibberish. She computes s = m'^d mod n and returns the result s to Bob. 5) Bob then calculates s' = s x^-1. A valid signature on m' is m'^d mod n = (ym)^d mod n = y^d m^d mod n = x m^d mod n so all Bob has to do is remove x from what Alice signed and he has m^d mod n, Alice's digital signature on message m. An example with numbers (I'm currently learning Scheme so I will give the Scheme code I used): Alice chooses p = 43, q = 47, thus n = 2021 d = 5, gcd(d,phi(n)) = 1, so e = 773 (* see note below) Bob chooses x = 314, y = x^e mod n = 314^773 mod 2021 = (expt-mod 314 773 2021) = 1271 Bob creates the message m = 99, which means Alice owes him money. Bob blinds the message by calculating m' = ym = 1271 99 = (modulo (* 1271 99) 2021) = 527 Alice agrees to sign 527, a message which is possible unintelligible. She calculates s = m'^d mod n = 527^5 mod 2021 = (expt-mod 527 5 2021) = 360 Bob takes Alice's signed message s = 360 and unblinds it. He calculates s' = s x^-1 First he calculates x^-1 = 354 (*see note below) Then, s' = 360 364 = (modulo (* 360 354) 2021) = 117 As a check, say Alice decides to sign the original message m=99. Then, the signed message would be m^d mod n = 99^5 mod 2021 = 117 So Bob does indeed have a message which is his original message with Alice's digital signature on it. Be more careful next time, Alice. * Note: There are two ways I know of to calculate the inverse of a number. First, x = a^((phi(n)-1) mod n will yeild x, the inverse of a mod n. But, sharp eyed people will note you need phi(n) to calculate this way - - and only Alice knows the factorization of n. So she can calculate e, the inverse of d mod phi(n) as: e = d^((phi(phi(n))-1) mod phi(n) = 5^(phi(1932)-1) mod 1932 = 5^(264-1) mod 1932 = 5^263 mod 1932 = (expt-mod 5 263 1932) = 773 Now how does Bob calculate the inverse of x mod n? He does not know the factorization of n. Well, for the purposes of this problem I did now how n factors so I used it :-) BUT, there is a way you can calculate the inverse of a number mod n without knowing how n factors. The algorithm is related to Euclid's, the one that you can use to tell if two numberse a relatively prime. Essentially, you run through Euclid's forwards, and then in the reverse direction, grouping and substituting, and the inverse will pop out. Once you do it by hand it will be clear, and you won't ever want to do it by hand again :-) If you use Mathematica, it will let you do PowerMod[x, -1, n] to calculate the inverse of x mod n. But Scheme won't since the three integers for expt-mod must be positive. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLHpvRoOA7OpLWtYzAQEpfwP/XjhLspMqeXfFeL6GiZ9QNEyZulYx+uWr ZgvyaPWwYbZ8PuO/ee4cglR2KydRao7Z/W6KbJo87Ugkts9dZp/tnAHO/PUCpgMf +IFUaqwCYwUN6r7KQo8pWoj7H55+o7FP5snI9774OFNiKSrwiGaMzXzpta+jPR9U cwoYLF+8HSU= =zigb -----END PGP SIGNATURE-----

1 0

No Subject
by anonymous＠extropia.wimsey.com 24 Aug '93

24 Aug '93

Uu> Reports of the wimsey remailer's demise are premature. I just used Uu> it to post this message! If this goes through, it's back up. I have used it recently and it worked again. Apparently, it was just temporarily ailing. Uu> pkcs_compat = 0 # Use backwards-compatible formats Uu> The PGP in use by the remailer may be version 2.0 or 2.1, which will Uu> not read PKCS-compatible PGP Messages. I don't think that this was the problem, but is there any drawback to installing this line in CONFIG just in case? Uu> Wimsey also has an anonymous reply mechanism using a message pool. Uu> For more info, send "help" to Uu> pool0-request(a)extropia.wimsey.com Will check this out. Uu> I think wimsey is also the only Cypherpunks remailer which resides Uu> outside the USA (It's in Canada). This obviously makes it much more Uu> inconvenient for USA Law Enforcement to broach the physical security Uu> of the remailer. On the other hand, it makes it fair game for legal interception by the NSA. Uu> I think the Hall Remailer at <nowhere(a)bsu-cs.bsu.edu> recognizes a Uu> "cut line" of Uu> --ignore-- I shall try this one also. Thank you very much for your assistance.

1 0