August 2002 - cypherpunks-legacy

Privacy-enhancing uses for TCPA
by AARG! Anonymous 23 Aug '02

23 Aug '02

Here are some alternative applications for TCPA/Palladium technology which could actually promote privacy and freedom. A few caveats, though: they do depend on a somewhat idealized view of the architecture. It may be that real hardware/software implementations are not sufficiently secure for some of these purposes, but as systems become better integrated and more technologically sound, this objection may go away. And these applications do assume that the architecture is implemented without secret backdoors or other intentional flaws, which might be guaranteed through an open design process and manufacturing inspections. Despite these limitations, hopefully these ideas will show that TCPA and Palladium actually have many more uses than the heavy-handed and control-oriented ones which have been discussed so far. To recap, there are basically two technologies involved. One is "secure attestation". This allows machines to securely receive a hash of the software which is running remotely. It is used in these examples to know that a trusted client program is running on the remote machine. The other is "secure storage". This allows programs to encrypt data in such a way that no other program can decrypt it. In addition, we assume that programs are able to run "unmolested"; that is, that other software and even the user cannot peek into the program's memory and manipulate it or learn its secrets. Palladium has a feature called "trusted space" which is supposed to be some special memory that is immune from being compromised. We also assume that all data sent between computers is encrypted using something like SSL, with the secret keys being held securely by the client software (hence unavailable to anyone else, including the users). The effect of these technologies is that a number of computers across the net, all running the same client software, can form their own closed virtual world. They can exchange and store data of any form, and no one can get access to it unless the client software permits it. That means that the user, eavesdroppers, and authorities are unable to learn the secrets protected by software which uses these TCPA features. (Note, in the sequel I will just write TCPA when I mean TCPA/Palladium.) Now for a simple example of what can be done: a distributed poker game. Of course there are a number of crypto protocols for playing poker on the net, but they are quite complicated. Even though they've been around for almost 20 years, I've never seen game software which uses them. With TCPA we can do it trivially. Each person runs the same client software, which fact can be tested using secure attestation. The dealer's software randomizes a deck and passes out the cards to each player. The cards are just strings like "ace of spades", or perhaps simple numerical equivalents - nothing fancy. Of course, the dealer's software learns in this way what cards every player has. But the dealer himself (i.e. the human player) doesn't see any of that, he only sees his own hand. The software keeps the information secret from the user. As each person makes his play, his software sends simple messages telling what cards he is exposing or discarding, etc. At the end each person sends messages showing what his hand is, according to the rules of poker. This is a trivial program. You could do it in one or two pages of code. And yet, given the TCPA assumptions, it is just as secure as a complex cryptographically protected version would be that takes ten times as much code. Of course, without TCPA such a program would never work. Someone would write a cheating client which would tell them what everyone else's cards were when they were the dealer. There would be no way that people could trust each other not to do this. But TCPA lets people prove to each other that they are running the legitimate client. So this is a simple example of how the secure attestation features of TCPA/Palladium can allow a kind of software which would never work today, software where people trust each other. Let's look at another example, a P2P system with anonymity. Again, there are many cryptographic systems in the literature for anonymous communication. But they tend to be complicated and inefficient. With TCPA we only need to set up a simple flooding broadcast network. Let each peer connect to a few other peers. To prevent traffic analysis, keep each node-to-node link at a constant traffic level using dummy padding. (Recall that each link is encrypted using SSL.) When someone sends data, it gets sent everywhere via a simple routing strategy. The software then makes the received message available to the local user, if he is the recipient. Possibly the source of the message is carried along with it, to help with routing; but this information is never leaked outside the secure communications part of the software, and never shown to any users. That's all there is to it. Just send messages with flood broadcasts, but keep the source locked inside the secure part. Messages can be sent and received, and neither participants nor outsiders can tell what the source of any message is. As with the earlier example, such a system would never work without TCPA. Rogue software would easily determine which direction messages were coming from, and the anonymity provided would be extremely limited at best. But by eliminating rogues using secure attestation, and keeping the sensitive data safe from molestation, we are able to achieve using a very simple system what otherwise takes tremendous complexity. Here's one more example, which I think is quite amazing: untraceable digital cash with full anonymity, without blinding or even any cryptography at all! (Excepting of course the standard TCPA pieces like SSL and secure storage and attestation.) The idea is, again, trivial. Making a withdrawal, the client sends the user's password and account ID to the bank (this information is kept in secure storage). The bank approves, and the client increments the local "wallet" by that amount (also kept in secure storage). To make a payment, use the anonymous network for transport, and just send a message telling how much is being paid! The recipient increments his wallet by that amount and the sender decrements his. Deposit works analogously to withdrawal. Again, that's all there is to it. Nothing could be simpler. Yet it provides for secure (assuming TCPA is secure), anonymous, untraceable payments. The secure attestation is crucial, of course, to make sure that people are running legitimate clients, otherwise cheating would be rampant. And the secure storage is equally crucial, otherwise any software could increment the sum stored in the wallet and everyone would accept and believe those payments. I understand, of course, that this specific example is not very practical unless we have an extremely secure version of TCPA. If anyone who can break the security can give themselves unlimited money, it means that the security has to be essentially perfect. So this is more of a proof of concept than a realistic proposal. But eventually, with TCPA technology integrated into a tamper-proof, nanotech CPU with molecular sensors and built-in self-destructs, possibly this might be good enough. Or you could augment this solution with some crypto, similar with the "wallets with observers" proposals from Chaum and from Brands. Note that we can make the client open-source, allowing anyone to verify that it has no back doors or cheating potentials, which allows all users to trust that it is not going to hurt them (a problem that takes great complexity to solve with the observer protocols). But still the bare simplicity of the system should make clear how powerful something like TCPA can be for this kind of application. I could go on and on, but the basic idea is always the same, and hopefully once people see the pattern they will come up with their own ideas. Being able to write software that trusts other computers allows for an entirely new approach to security software design. TCPA can enhance freedom and privacy by closing off possibilities for surveillance and interference. The same technology that protects Sony's music content in a DRM application can protect the data exchanged by a P2P system. As Seth Schoen of the EFF paraphrases Microsoft, "So the protection of privacy was the same technical problem as the protection of copyright, because in each case bits owned by one party were being entrusted to another party and there was an attempt to enforce a policy." (http://vitanuova.loyalty.org/2002-07-05.html, 3rd bullet point) In fact, TCPA and Palladium have tremendous potential for enhancing and protecting privacy, if people will just look at them with an open mind.

8 8

Low Price Tobacco
by Sales Department 23 Aug '02

23 Aug '02

Dear Sir / Madam If you are fed up of being 'ripped off' by the British government every time you buy your tobacco, then you should visit our website, where you can now buy 4 cartons of cigarettes, or 40 pouches of rolling tobacco from as little as 170 Euros (approx 105 pounds), inclusive of delivery by registered air mail from our office in Spain. Why pay more??? Visit our website at http://www.tobaccodemon.com/?ID=2 Best regards Sales Department Tobacco Demon Spain xay1941001y

1 0

FINAL CHANCE
by Computer Developments UK 23 Aug '02

23 Aug '02

This is your FINAL CHANCE to buy Microsoft Office 2000 Professional, we have very few copies of this left in stock, so please call us on 01993 849200 as soon as possible to get your copy. CD plus License only £175 while stocks last. Call us now on 01993 849200 Regards The Sales Team Computer Developments UK All Offers are made subject to availability. Prices quoted are exclusive of VAT. All trademarks acknowledged. All sales subject to CD-UK's Terms and Conditions. To be removed from our email list please reply with remove as the subject and also stating email address if different from the one you are using, thank you. Computer Developments UK, Waterside Court, Witan Way, Witney, Oxfordshire, OX28 6FE Telephone: 01993 849200 Fax: 0870 458 2385 Email:mailto:sales@cd-uk.net

1 0

Stasi UK. Style.
by Matthew X 23 Aug '02

23 Aug '02

'MI5 investigated Royle Family star' Jason Deans Wednesday August 21, 2002 Ricky Tomlinson Clandestine operations by the secret services over the last 50 years are to be exposed in a new BBC series that will include disturbing details of the lengths to which MI5 went to track Royle Family actor Ricky Tomlinson. Confirming many conspiracy theories, the BBC2 documentary, True Spies, will show how government operatives infiltrated political groups, trade unions and media organisations Tomlinson, a former trade union activist, and the former Marxist Tariq Ali are among those confronted on camera by True Spies presenter Peter Taylor with evidence they featured in Special Branch and MI5 files. "All the conspiracy theories about the security services tapping phones and so on that we all dismissed turned out to be true," said Mr Taylor, whose credits include a number of award-winning documentaries about Northern Ireland and most recently the Iranian embassy siege. "They infiltrated everyone and everything, even Fleet Street and the BBC. The files they had were vast." It is known MI5 targeted BBC journalists in the 1970s - "subversive" journalists had files marked with little Christmas trees and BBC management submitted the names of journalists for vetting. But Taylor's documentary shows the extent of the secret service's investigations. "In some cases there was justification for what they did, but in many cases there was absolutely no justification whatsoever. They infiltrated things like Friends of the Earth and the anti-asbestos campaign. If you went on a CND demo, you could have ended up with a file," he said. "When I asked them 'what threat did organisations like this pose?', they said 'you never know until you find out'." Mr Taylor said he had not been allowed access to the files, but had interviewed a number of Special Branch officers for True Spies. Special Branch agents working undercover would infiltrate organisations in order to spy on their activities for MI5. Mr Taylor said both Tomlinson and Mr Ali were visibly shocked when confronted on camera with evidence that they had been the subject of secret service investigations. In the case of Mr Ali, a Special Branch undercover agent had infiltrated a leftwing organisation to which he belonged and made a copy of the office key so the secret service could gain access. Within the BBC in the 1970s and 1980s the secret services were particularly interested in the activities of broadcasting unions such as Bectu and the ACT, according to Mr Taylor. "When I asked about the BBC the interviewee said they had an inside source who told them about potential militants," Mr Taylor said. He added that the BBC no longer had an MI5 liaison officer who vetted employees and famously put the christmas tree-like signs on their files if they were thought to pose a potential threat to national security. "That post is no longer filled. I think it stopped in the early or mid-1990s," Mr Taylor said. http://www.telegraph.co.uk/news/main.jhtml;$sessionid$L3BDXMZQBGU13QFIQMGCF… Telegraph version.

1 0

Re: the underground software vulnerability marketplace and its hazards (fwd)
by Adam Back 23 Aug '02

23 Aug '02

Right. And I fail to see how any of this is dangerous. Clearly people are free to sell information they create to anyone they choose under any terms they choose. (For example the iDEFENSE promise of the author to not otherwise reveal for 2 weeks to give iDEFENSE some value.) This commercialisation seems like a _good thing_ as it may lead to more breaks being discovered, and hence more secure software. (It won't remain secret for very long -- given the existance of anonymous remailers etc., but the time-delay in release allows the information intermediary -- such as iDEFENSE -- to sell the information to parties who would like it early, businesses for example people with affected systems. Criminal crackers who can exploit the information just assist in setting a fair price and forcing vendors and businesses to recognise the true value of the information. Bear in mind the seller can not know or distinguish between a subscriber who wants the information for their own defense (eg a bank or e-commerce site, managed security service provider), and a cracker who intends to exploit the information (criminal organisation, crackers for amusement or discovery of further inforamtion, private investigators, government agencies doing offensive information warfare domesticaly or internationally). I don't see any particular moral obligation for people who put their own effort into finding a flaw to release it to everyone at the same time. Surely they can release it earlier to people who pay them to conduct their research, and by extension to people who act as intermediaries for the purpose of negotiating better terms or being able to package the stream of ongoing breaks into more comprehensive subscription service. I think HP were wrong, and find their actions in trying to use legal scare tactics reprehensible: they should either negotiate a price, or wait for the information to become generally available. Adam On Thu, Aug 22, 2002 at 08:02:16AM -0700, Steve Schear wrote: > >On August 7th, an entity known as "iDEFENSE" sent out an announcement, > >which is appended to this email. Briefly, "iDEFENSE", which bills > >itself as "a global security intelligence company", is offering cash > >for information about security vulnerabilities in computer software > >that are not publicly known, especially if you promise not to tell > >anyone else. > > > >If this kind of secret traffic is allowed to continue, it will pose a > >very serious threat to our computer communications infrastructure. > > A more serious and credible threat would be an escrow/verification service > which could support blacknet style auctions. It could also make the > hacker's time valuable enough to support a decent lifestyle fostering an > cottage industry. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

5 6

Forex Squawk-box
by Forexvoice 23 Aug '02

23 Aug '02

1 0

Ar�iv haz�r
by Ahmet Aykac 23 Aug '02

23 Aug '02

TrMelodi, Kýrýk linkli çalýþmayan ve birtek mp3 ü indirirken bile insanlarý kahreden sözde mp3 sitelerine alternatif olarak sizler için özenle hazýrlanmýþtýr. Her yaþtan her kesimden müziksevere hitap edebilmek için tasarlanmýþ 13 GB lýk dev Mp3 listesiyle sýnýfýnda rakipsiz olacak þekilde donatýlmýþ ve siz müzikseverlerin hizmetine sunulmuþtur. http://www.trmelodi.com adresindeki dev arþivimizde sizi bekleyen en sevdiðiniz sanatçýlarýn en sevdiðiniz þarkýlarýný birkaç dakika içinde bilgisayarýnýza indirin ve keyifle dinlemeye baþlayýn. Ýyi Eðlenceler.. http://www.trmelodi.com

1 0

Dictator uses chemicals on own people.
by Matthew X 23 Aug '02

23 Aug '02

http://portland.indymedia.org:8081/front.php3?article_id=17309&group=webcast 8:10 Update: More pepper spray by devidas 8:25pm Thu Aug 22 '02 (Modified on 9:49pm Thu Aug 22 '02) from the streets Calling from Broadway, an IMC reporter reports more pepper spray used on the crowd. He hands the phone to someone in the crowd: they just pushed a bunch of people and sprayed us. Its still going strong. ALSO http://www.nytimes.com/aponline/national/AP-Bush-Protesters.html This is a link to a new AP newswire report on today's events. Quotes from a member of Cascadia Forest Alliance, and a Vietnam Vet who opposes war in Iraq. http://www.nytimes.com/aponline/national/AP-Bush-Protesters.html This is a link to a new AP newswire report on today's events. Quotes from a member of Cascadia Forest Alliance, and a Vietnam Vet who opposes war in Iraq.

1 0

VENONA Echelon precursor.
by Matthew X 23 Aug '02

23 Aug '02

http://www.enhancetv.com.au/find_it/action.lasso?-database=Showcase&-layout… Fortress Australia Fortress Australia uncovers one of the most extraordinary chapters in Australia's history - the brazen attempt by successive Australian governments to fortress the nation with atomic weapons. This groundbreaking film reveals a web of intrigue as it penetrates a murky world of diplomatic double-dealing and atomic espionage. Set against a backdrop of cold war paranoia and fear of Asian aggression, it explores the motives of the politicians, defence chiefs and scientists who set out to buy, then ultimately build, a nuclear arsenal. Learning Areas: History DurationDuration: 55 mins Year of Release:2002 Broadcast Date:August 22 Broadcast Time:10pm Channel:ABC TV Acknowledgements:A Film Australia National Interest Program. Produced with the assistance of the Australian Broadcasting Corporation. Link:Fortress Australia Study Guide: Fortress Australia In a new documentary on au research on WOMD.It was revealed that the russians had their agents rout crucial wartime Intel through au as they could access it there. VENONA. http://www.filmaust.com.au/showcase/default.asp?content=8473 The Secret Bid for the Atomic Bomb This is a story all Australians should know about. Students of history, politics and science will find it illuminating. Teachers will find it a particularly useful resource. RICHARD BUTLER, CHIEF OF UN SPECIAL COMMISSION TO DISARM IRAQ 1997-1999 Fortress Australia uncovers one of the most extraordinary chapters in Australia's history - the brazen attempt by successive Australian governments to fortress the nation with atomic weapons. This groundbreaking film reveals a web of intrigue as it penetrates a murky world of diplomatic double-dealing and atomic espionage. Set against a backdrop of cold war paranoia and fear of Asian aggression, it explores the motives of the politicians, defence chiefs and scientists who set out to buy, then ultimately build, a nuclear arsenal. You can download a preview of Fortress Australia and an introduction by Richard Butler, Chief of UN Special Commission to Disarm Iraq 1997-1999, who says: Australia is well known for its efforts on behalf of nuclear disarmament. For example, at the United Nations it tabled the comprehensive test ban treaty. But that wasn't always the case. The surprising story that most people don't know is that for at least two decades Australia made repeated and serious attempts to acquire nuclear weapons. Also that a top expert in the MILIND complex recomended that au develop chemical and biological weapons of mass destruction.Paul Baxters comments made headlines in local papers earlier this year.AU supports UN security council resolutions when it suits the Govt of the day.An especially subservient US puppet mob is in power at the moment.Doco has footage of the 'dirty' monte bello testand a rainforest 'small nuke' test of 50 tons of TNT,operation blowdown.

1 0

Bush to be impeached for tax fraud?
by Matthew X 23 Aug '02

23 Aug '02

http://sf.indymedia.org/news/2002/08/141905.php BUSH MAY HAVE EVADED TAXES ON SALE OF BASEBALL TEAM By the Anonymous CPA Published August 19, 2002 A review of George W. Bushs 1998 tax return reveals that he reported the sale of his share of the Texas Rangers baseball team as a long term capital gain. As a result, he paid a tax on the more than $15 million proceeds at a tax rate of 20%, as opposed to the 39.6% rate on ordinary income. According to a press release dated June 18, 1998 from the Dallas Morning News, Bush paid $606,000 for about 1.8% of the team and became the managing general partner of B/R Rangers Associates, Ltd., a limited partnership that owned the team. Under the terms of the agreement, Mr. Bush was given an additional 10.2% of the proceeds as additional compensation if the team was sold. The incentive compensation became effective if the other partners received their entire investment back plus a 2% return per year. The team was purchased for $86 million in 1989 and sold in 1998 for $250 million to Tom Hicks, a person with whom Bush had prior official business while governor. As reported by Tom Kruger in his July 16, 2002 article, Tom Hicks had a relationship with Mr. Bush that afforded Hicks the opportunity to use $9 billion of the University of Texas endowment fund without any accountability. The management fee to Hicks for investing the $9 billion could have exceeded the $250 million he paid for the Texas Rangers. In effect, Bush handed Hicks the money to buy the team as part of his official duties as governor. In addition, the team received funding for the new stadium built by the City of Arlington. More than $150 million was funded by the City of Arlington with a new sales tax imposed on its citizens. The team leased the stadium from a development corporation that was exempt from any school district tax. The tax exemption directly reduced the lease cost to the team by a substantial amount. In addition, as governor, Mr. Bush supported legislation that would have reduced the teams school tax by $920,000 if the team exercised its option to purchase the stadium. Furthermore, this proposed tax reduction would have benefited Bush in another entity in which he had an equity interest with some of the partners of the Texas Rangers. As reported in the Houston Chronicle on April 22, 1997, The tax reform bill supported by Gov. George W. Bush would have saved at least $2.5 million in school property tax for a company founded by Bushs billionaire business partner and top campaign contributor, Richard Rainwater of Fort Worth. Mr. Rainwater headed a public company that was a real estate investment trust traded on the New York Stock Exchange. Bush himself had 4,222 shares of this stock when he proposed the tax reduction that would have benefited this company, Crescent Real Estate Equities, by more than $2.5 million. This same company owned psychiatric hospitals throughout the country that were closed down because of scandalous and fraudulent activities as reported by 60 Minutes and various publications, all before the presidential election of 2000. As if that was not enough, Bushs policies as governor further benefited Crescent by: 1. Allowing it to receive an extra $10 million stadium tax for a sports stadium used by the Dallas Mavericks 2. The State of Texas sold three office blocks belonging to the teachers retirement fundto Crescentthe sale of one block costing the pension fund system $44 million. 3. The trust fund for the Texas University Public School invested $20 million in Crescent during Bushs first term as governor. Mr. Bush sold his interest in Crescent through his blind trust, the Lone Star Trust. Lone Stars trustee was Mr. Bushs personal CPA, Robert A. McClesky. Bushs shares in Crescent were sold at its peak of $40/share, yielding him proceeds of $168,800. Shortly after the sale, Crescents stock plunged to $21/share. Besides the Harken transaction previously reported, Bush has had an excellent record in investing in rapidly appreciating assets. Prior to Harken, he had a rather miserable record of success. However, it is clear that his success was based upon more than normal market appreciation. His political influence before and after he became governor substantially contributed to his personal wealth. The question now rises as to whether this political influence reaches the level of public corruption. Returning to the sale of the Texas Rangers, it is clear that Mr. Bush earned his additional 10% of the team by adding considerable value to the team because of his political influence. Incentive clauses such as the one granted to Bush are common for managing partners adding value to their partnerships; however, such incentive clauses exercised on behalf of a sitting governor, even if he was not governor when the agreement was written, raises some serious tax questions in addition to the question of public policy conflicts of interest. According to IRS Revenue Procedure 93-27, The receipt of a partnership capital interest for services provided to or for the benefit of the partnership is taxable as compensation. As most people know, compensation is taxed as ordinary income, subject to the highest tax rates; in this case 39.6%. Mr. Bush treated the incentive portion of his proceeds as long term capital gain, and accordingly reduced his tax liability by at least $2.4 million. Mr. Bush may defend this aggressive tax position by pointing to aggressive planning by his accountants and lawyers. This by itself may be subject to dispute, and even though it is likely that the IRS would treat this incentive payment as ordinary income, Bush could possibly look to his accountants and lawyers as a defense. However, there is a further problem. It involves Otto Kerner, governor of Illinois from 1961 to 1968. In 1972, Gov. Kerner was convicted of income tax fraud for influencing public policy that benefited his holdings in a race track corporation. On the advice of his accountants, Gov. Kerner treated the proceeds ($180,000) of his race track stock as long term capital gain subject to the reduced tax. The U.S. Attorney, James Thompson, prosecuted Gov. Kerner for falsely treating these proceeds as a capital gain because Gov. Kerners public policies had a substantial effect on the appreciation of the stock. Gov. Kerner was a Democrat, and Mr. Thompson was appointed U.S. Attorney by President Nixon. Thompson later became governor of Illinois. According to an IRS agent who worked on the Kerner case, the governments theory was based on the idea that a true capital gain is based on the assumption that natural market forces enhance the value of the property sold. Natural market forces can include the legitimate contributions of managing partners. However, the government concluded, and the jury affirmed, the fact that people in official policy positions who enhance the value of their own property in whole or in part are guilty of a corrupt practice, and accordingly the gain is not capital gain. This is consistent with the theory behind giving tax incentives only for legitimate capital appreciation. It is clear that former Gov. Bush had a clear incentive to affect public policy for his own benefit. In the Kerner case, Gov. Kerner was already a wealthy man, and the proceeds he received were not significant in relation to his net worth. In the case of former Gov. Bush, the at least $12 million incentive he received was the bulk of his liquid assets. Many of the citizens of Illinois who supported Gov. Kerner were upset about this decision, according to the IRS agent involved. Gov. Kerner was not an active businessman, and many people have doubts that he would have directly affected public policy because of a relatively small holding he had in the race track company. Nevertheless, the jury held him to a higher standard because he was in a powerful public position. According to the IRS agent, if Gov. Kerner was convicted of tax fraud for his behavior relative to a passive holding of stock, Mr. Bush, as an active managing partner of the Texas Rangers, should at least be held to the same standard. The question is, when will people say enough is enough. All these business and tax practices cannot be based on innocent coincidences. add your comments

1 0