October 2000 - cypherpunks-legacy

CDR: Two items, of varying relevance to the list
by Tim May 16 Oct '00

16 Oct '00

Two items which may have only slight relevance to the list. I've been waiting for an opportunity to mention them in context... First, Judea Pearl's "Causality." A mix of logic, AI, and ontology. Closely related to issues of belief and causality. (Some of you may know of my interest in Dempster-Shafer belief theory...this is closely related.) Second, just watched "Lola rennt," aka "Run, Lola, Run," for the fourth or fifth time. Saw it in a theater the first time, a year or so ago. It's interesting that German is so willing to absorb new language terms, completely unlike French. English has embraced foreign expressions, and so, it seems, has German. Of these two points, the Pearl book is more significant, ultimately. But the film has its place. Sorry there is no "crypto significance" here. No S-box details, no Rijndael details. TS. --Tim May -- ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 831-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, "Cyphernomicon" | black markets, collapse of governments.

4 4

CDR: RE: Anonymous Remailers cpunk
by Trei, Peter 16 Oct '00

16 Oct '00

Jim: This is the last time I'm going to respond to you on this topic. Everyone else understands my point, and there's a limit to how much effort I'm going to go to correct a single obtuse individual. > ---------- > Jim Choate[SMTP:ravage@einstein.ssz.com] wrote > On Fri, 13 Oct 2000, Trei, Peter wrote: > > > A spammer (or your spammer's proxy) is not going to > > individually encrypt messages to thousands or > > millions of end-recipients, each with their own public > > key - the time factor makes this uneconomical, and > > the hassle factor of finding all the recipient public > > keys makes it impractical. Thus, only remailers > > which send out plaintext are useful to spammers > > as exit remailers. > > They do it now, sans encryption. The mass distribution is what makes it > economical. If the encryption can be gateway'ed then it's useless and > doesn't raise the cost significantly. > > A more useful mechanism would be to distribute the keys and appropriate > client software to spammers. What's a flat $50?... > $50 is nothing, of course. Requiring that each message to be encrypted with the final recipient's public key is far from nothing. Sending 10^5 emails without encryption is trivial. Encrypting 10^5 emails is far from trivial. We're raising the cost to the spammer far more than we're adding to the effort of the remailer operator. You speak of gatewaying - who exactly is going to set up a free gateway to encrypt 10^5 messages, each to a different public key? All that does is shift the cost to the gatewayer; it does not eliminate it. > > It is only exit remailers (ie, the remailer which sends > > to the final recipient) which get hassled for sending > > spam. > > And it has NOTHING to do with the encryption. The lack of log's is what > prevents back tracing. > Jim: go back to the genesis of this thread. The discussion was along the lines of "There are too few remailers. Why?" Among of the reasons cited are that remailer operators often get shut down by their ISPs or network poviders because of complaints from end recipients of messages - they get spam, threats, illegal material, etc. It does not matter that the remailer keeps no logs; the end recipients mail server does, and that's enough for the recipient's ISP (or the LEAs) to take action. This situation not only gets remailers shut down; it discourages people from starting them in the first place. My proposal makes using the remailer for spam economically prohibitive, and ensures that the only recipients are crypto-aware types, who are far less likely to misunderstand what's going on than J. Random Luser. > > The goal is to make remailer operators life easier by > > preventing them from being used to spam random > > lusers, who may initiate complaints against the > > remailer operator. > > No, the goal is to stop spammers. > There you go again... Please read the thread. The goal is not to 'stop spammers'. It's to 'Stop actions against remailers, some of which are caused by their misuse as spam conduits'. Preventing spam from exiting the remailers achieves that goal. > In addition, there are aspects of remailer operation that make the > complaints about spam pretty irrelevant. > > > It is not to prevent spam passing through a remailer > > somewhere in mid-cloud. While such encrypted > > spam will increase the volume of traffic, for most > > remailers that is a Good Thing - more material to > > confuse the traffic analysis. As long as it gets > > dropped before leaving the remailer network, no > > harm is done. > > Nobody said anything about the interim processing until now. How is this > relevant to the 'free speech' aspect of requiring the use of particular > forms of encryption end-to-end. > That's true. The use of doomed (since they'll be dropped before they leave the network) spam messages as cover traffic is something that occured to me as I wrote the letter. It is a nice side effect of my proposal, as long as spammers continue to send doomed spam into the system. > Where's the key management mechanism to ensure the security of the traffic > in the reamiler network? > Same as it always was. > > Steve understands this, as does every one else but > > you. > > > > What's the problem? > > It's your problem, there are aspects of this proposal that are simply > silly, and several others that haven't been adequately explained or > examined. > > You talk about decreasing the load due to spam, and don't even recognize > that you've replaced it with a whole other process. One that potentialy > could be more complicated, error prone, and expensive in time and resource > impact than the original 'problem'. > No Jim, I'm not talking about decreasing the load due to spam. I'm talking about making life easier for remailer operators. In the long run, it'll reduce spam as well, since spammers will learn not to include remailers which send only encrypted mail in their remailer chains. > The solution to bad speech is more speech, not regulation. And don't kid > yourself that setting up such a mechanism isn't regulatory. > A remailer operator can operate his remailer in any way he or she wants, and so long as they publish their policies and adhere to them, there is no basis for anyone to criticize them (this is a thing called 'freedom'). > > Any remailer operator can decide not to pass along plaintext. So long as > the > > message sender is aware of this property, nothing more needs to be > > distributed. > > There are no increased sysadmin issues. > > What algorithm are you proposing to identify plain-text? There are key > managment issues, what is your proposal for this problem? There is the > increased complication of admining the box (think of resources to support > both the remailer operation as well as the encryption - consider that > scale carefuly). > > I'm in Zimbabwe and the remailer is in the US, how do I manage the keys to > enter the network in such a way that it is secure? > Jim: I think I'm beginning to appreciate the depth of your lack of comprehension. Remailers do not encrypt anything. All the encryption steps are done by the originator of the message - successively encrypting the message with public key of the recipient (an optional step in current remailers), and then by the public key of each remailer in the chain working back to the originator. Each remailer decrypts the message with it's private key, All it knows is to send the inner contents on to the next remailer in the chain, or to the final recipient. This is how remailer chaining works today. The only change I propose is that, if after applying it's own public key to decrypt a message, the remailer notices that the decrypted material does not match one of the well known formats for encrypted messages (ie, it is likely plaintext), that it drop the message. I won't discuss the recognition algorithm here, since I have already done so and others have even published sample code. It can be done. > > No, there is not, beyond the fact that the message originator must know > the > > final recipient's public key. > > You need the key to get into the remailer, otherwise how does it tell the > message is encrypted? You seriosly propose sticking some static PGP header > for example will stop anyone, spammers know how to use word processors too > you know. > > > Jim, do you really understand how remailer chaining works? > > Yep. Apparently better than you do. > > Have a nice day you pretentious butthead. > ROTFLMAO > James Choate > Peter Trei

1 0

CDR: More on Carnivore
by George＠Orwellian.Org 16 Oct '00

16 Oct '00

http://foxnews.com/national/101300/carnivoretwo_riley.sml FBI's Carnivore Just the First Step In Cyber Surveillance Monday, October 16, 2000 By Patrick Riley The FBI says its controversial Carnivore system is just "the tip of the iceberg" when it comes to Internet surveillance because an even sharper-toothed information chomper is now in development. Amid all the hubbub over whether the current system violates privacy rights, the agency has been quietly working on both "Carnivore 2.0" and "Carnivore 3.0," according to FBI documents released this month under a Freedom of Information Act claim filed by the Electronic Privacy Information Center. The current Carnivore is version 1.3.4, according to the documents. An "Enhanced Carnivore" program has been under development since last November - under a $650,000 contract scheduled to end in January 2001. Most of the details on the souped-up snoopers were blacked out in heavy black marker before the papers were released. The Federal Bureau of Investigation makes no bones about its plans for the system, which sifts an Internet Service Provider's transmissions to track suspects' online activity. "As it looks today, it could be completely different a year from now," said FBI spokesman Paul Bresson. "Really, we've only seen the tip of the iceberg in terms of the change in technology." He said improving Carnivore is vital for keeping pace with criminal elements. "This is going to continue to be a cat-and-mouse game," he said. "There's always going to be software and other encryption technology that render a system less useful." He declined to give specific details. But privacy experts say an evolving Carnivore presents a problem for those trying to keep an eye on it. "It's a moving target," said David Banisar, a senior fellow at EPIC. "It means there needs to be continual oversight, not just onetime oversight. It means that if we get the source code we'll have to get the source code as it changes also, and do a re-analysis as the functions of the software change." The program's source code, the piece of information most sought after by activists trying to figure out if Carnivore reads the e-mail of more than just those targeted by a court order, was omitted from the 600-plus pages given to EPIC in the first of several planned releases. But the organization has vowed to continue fighting for it. Despite the incomplete technical blueprint, the newly public papers do shed some light on what sequels to Carnivore might look like. Three jargon-heavy lines of text that survived the FBI censor reveal that Version 2.0 will be capable of "built-in data analysis that Carnivore doesn't appear to do now," Banisar said. That means being able to display captured Internet data as soon as Carnivore intercepts it. The current system merely stores the data and two other programs - "Packeteer" and "Coolminer" - must be used to process and display it. No information was released from the Version 3.0 section but research mentioned elsewhere in the unclassified papers involves an aspect of the technology dubbed "Dragon Net" that captures telephone conversations held via the Web - a process known as "voice over IP" technology. Banisar suspects the FBI might also want its future sniffers to have the ability to track multiple targets simultaneously. That wouldn't bode well, he said. "The more capability it has to intercept more than one target, the more likely it is to be abused." While the current Carnivore is purely monogamous, it casts a wider net than commonly thought, according to an analysis of the FBI documents by anti-computer crime site SecurityFocus.com. Carnivore can "be programmed to watch for all the Internet activities of a particular person," said Kevin Poulson, editorial director at SecurityFocus and a former hacker. The system can even reconstruct Web pages viewed by a suspect. "All that's been talked about is its ability to monitor e-mail." In light of this, said EPIC's Banisar: "It makes you wonder what else they could possibly want."

1 0

CDR: Re: Glass doors [was: Rijndael & Hitachi] cpunk
by Trei, Peter 16 Oct '00

16 Oct '00

> ---------- > From: sustae@intergate.ca[SMTP:sustae@intergate.ca] > I wouldn't recommend boobytrapping the glass in that manner. > I'd go with a ballistic laminate on the glass. [...] > Ed > > At 02:51 PM 10/14/00 -0700, jim bell wrote: > > > > > >The solution is obvious, to a chemist. Make the glass door > double-glazed, > > >sealed at the edges, and filled with hydrogen cyanide (prussic acid). > I agree with Ed - let us not confuse our goals with our means. The goal is to have a door which is transparent - it lets those in look out (and, perhaps only coincidentally) those outside look in. It also acts as a window, letting letting light into the house, and at night illuminating the door area from the inside. The goal is *not* to secure a door made out of glass. The goal is a transparent door. Go with Lexan. I often find stepping back and saying 'exactly what are we actually trying to acheive here?' is a powerful tool for solving problems. Its all too easy to try to add fixes to a bad solution, rather than find a different one. Peter Trei [Anyone remember the guy who proposed invasion proofing a home by boobytrapping it with biowarfare agents, and somehow immunizing your family against them?] [I've dropped coderpunks and cryptography from the cc: list, since this has gone *way* off-topic. - pt ]

1 0

CDR: Fw: [Fwd: Markierte Musik: SDMI Crack]
by Marcel Popescu 16 Oct '00

16 Oct '00

Yiihaaaa! Will they release SDMI knowing that it is broken? [Not that it wasn't a bad idea from the start.] -------- Original Message -------- Subject: Markierte Musik: SDMI Crack Date: Fri, 13 Oct 2000 14:32:16 +0200 X-Loop: openpgp.net From: "q/depesche" <depesche(a)quintessenz.at> To: quintessenz-list(a)quintessenz.at q/depesche 00.10.13/1 Markierte Musik: SDMI Crack Wie Salon Magazine berichtet, wurde das von der Musikindustrie favorisierte Muik-Wasserzeichen System, die so genannte "Secure digital Music Initiative" einem Crack zugef|hrt. Was dieser zu bedeuten hat, ist noch nicht ganz sicher. -.-. --.- -.-. --.- -.-. --.- -.-. --.- -.-. --.- -.-. --.- -.-. --.- | Watch out -- recording industry executives are about to start running for cover. All of the Secure Digital Music Initiative's watermarks -- its much ballyhooed music protection scheme -- have been broken. A spokesperson for SDMI has denied the reports, but according to three off-the-record sources, the results of the Hack SDMI contest are in and not one single watermark resisted attack. The hacking contest, which invited the general Net population to break the recording industry's watermarking system and win $10,000, ended Sunday; this week, SDMI members are meeting in Los Angeles to discuss the results. Although a core group of participants (including members of the Recording Industry Association of America) who coordinated the testing process are aware of the contest results, the larger SDMI consortium has yet to be informed. The key issue is whether the breaks are meaningful or not -- in other words, could any hacker repeat the breaks, and is the quality of the music preserved even when the watermark is scrubbed out? According to one insider, all these hacks were, in fact, technically "solid." The hacker boycott of SDMI organized by members of the programming community who were suspicious of what they saw as an attempt to coopt their labor in the service of a corrupt industry has turned out to be effectively irrelevant. According to one witness attending the SDMI conference, recording industry members held an emergency meeting at 6 a.m. PDT Thursday to discuss the results. SDMI members and the press will likely be informed Friday, several sources said, although most speculated that the record industry would try to downplay the results. Voll Text <http://www.salon.com/tech/log/2000/10/12/sdmi_hacked/index.html? CP=SAL&DN=660>

3 2

Re: CDR: Authority - is it a useful concept today and in the future?
by Bill Stewart 16 Oct '00

16 Oct '00

At 11:33 AM 10/14/00 -0500, Jim Choate wrote: > >This is perhaps the fundamental question to human problems. Do you mean "Is threatening people with violence to get them to obey you a morally acceptable form of behavior" is the question, or do you mean "Does threatening people with violence successfully get what you want often enough that it's worth the risk of having them fight back, or do the peasants usually do a lousy job if you keep whipping them so it's not worth the bother"? Thanks! Bill Bill Stewart, bill.stewart(a)pobox.com PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639

1 0

CDR: New penalties to silence whistle blowers
by George＠Orwellian.Org 16 Oct '00

16 Oct '00

http://foxnews.com/national/101300/leaks.sml Congress Increases Penalty for Classified Leaks Friday, October 13, 2000 An intelligence bill passed by Congress could stifle the ability of whistle-blowers and the media to get information to the public by expanding criminal penalties for government employees leaking secrets. [snip]

2 1

CDR: Re: Rijndael & Hitachi
by Derek Atkins 16 Oct '00

16 Oct '00

"Steven M. Bellovin" <smb(a)research.att.com> writes: > Precisely. What is the *real* threat model? > > History does indeed show that believed-secure ciphers may not be, and > that we do indeed need a safety margin. But history shows even more > strongly that there are many better ways to the plaintext, and that's > the real goal. Why try to pick a Medeco when it's locking a glass door? :-) -derek PS: This isn't a hypothetical; I visited a friend's parents a number of years ago, and noticed that their front door, all glass (with nothing behind it) was locked using a Medeco lock. For those who don't know, a Medeco is a top-of-the-line lock, practically impossible to pick, drill out, etc. -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord(a)MIT.EDU PGP key available

11 10

CDR: Re: Re: A famine averted...
by James A.. Donald 16 Oct '00

16 Oct '00

-- > I freely admit that I have absolutely no authority over things > economic. But I do think you too have an overly simplified view of > the theory - you do not seem to distinquish between the derivation > of some of the parameters (e.g. price) of a dynamic system which is > assumed to be in equilibrium based on known ones (e.g. measures > of/related to demand, availability etc.) from actually working with > the time evolution of the system (none of the variables are known a > priori and the solution consists of complete time functions). Economists do that all the time. It is called modeling. Lucas and Lawrence Klein won nobel prizes for doing it. I expect that other economists that I am not familiar with have also won Nobels in it. > For instance, in the basic example given above - price formation of > a single good in an ideal closed market (i.e. given the normal > assumptions of independence of participants, continuity of > variables, perfect knowledge and so on) - can you cite a single > understandable source with the rigorous derivation of bounds for > over/undershoot in price upon rapid fluctuation in supply? I doubt that I could provide any source on economics that you would regard as understandable. You are asking for a prediction of the behavior of human actors, predicting what people will do. One can only derive "rigorous" results if one makes assumptions about how people think and what they want. The most rigorous attempt at that is known as "rational expectations theory". Rational expectations theory (for which Lucas got his Nobel) assumes that people will make the best guess they can about future behavior of the market, then base their present behavior on that best guess, and the market will then reflect that present behavior. This of course produces inaccurate results for obvious reasons, and economists attempt to model people more accurately but less rigorously by using "rational ignorance" and "bounded rationality." All these are major areas of study in economics. --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG DxdupuGKPAB/3JK3xLW6o/vv+Pqu/DksQ40lUL6M 4brEUhWqvkA5XljkmlgM1eGujT4yTvhuOYMtt5ayb

2 1

CDR: Gov. Bush links Columbine massacre to Internet use
by Declan McCullagh 16 Oct '00

16 Oct '00

http://www.cluebot.com/article.pl?sid=00/10/12/0326212&mode=nested Bush Links Columbine Massacre to Internet Use posted by cicero on Wednesday October 11, @10:25PM from the sounds-a-lot-like-joseph-lieberman dept. George W. Bush may have bested Al Gore in tonight's presidential debate, but it sure wasn't because of the governor's tech-savviness. Warned the Texas Republican, in response to a gun-control question: "Columbine spoke to a larger issue, and it's really a matter of culture. It's a culture that somewhere along the line we begun to disrespect life, where a child can walk in and have their heart turn dark as a result of being on the Internet and walk in and decide to take somebody else's life." It was undeniably a good, mushy, appeal-to-the-softhearted line, but the sheer schmaltziness of it is in questionable taste. For instance: Was the Net really to blame? Shouldn't even a "compassionate conservative" want to hold miscreants responsible for their own actions? And would the guv have offered the same warning to millions of Americans if the Columbine killers had, say, been regulars at the public library? Transcript is at: http://www.cluebot.com/article.pl?sid=00/10/12/0326212&mode=nested

8 10