December 2003 - cypherpunks-legacy

Real ECash from Mark Twain Bank
by Hal 17 Dec '03

17 Dec '03

<URL:http://www.marktwain.com/ecash.html> will apparently have info on its "real ecash" starting late Sunday, October 22. It is not there yet at 6 PM pacific time. <URL:http://digicash.support.nl/publish/ec_pres3.html> will have a press release soon, as well. Here is what it says now: > First Real Electronic Cash Launched > > Copyright ) 1995 by DigiCash bv. > > FOR IMMEDIATE RELEASE (Release Date: October 23, 1995) > > This page will be available very soon.

1 0

hot news at DigiCash
by Bryce 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hot news at DigiCash. One, a real live bank is going to be issuing Ecash denominated in U.S. dollars. See "http://www.digicash.com/" and "http://www.marktwain.com/". Two, the one million trial cyberbucks have been issued and no more will be issued, although the First Digital Bank will continue to run the trial for now. In honor of the occasion I hereby offer E=100 US=$8.00 SELL-OFFER "Sun Oct 22 19:34:28 MDT 1995" 2 bryce(a)colorado.edu Pretty soon we'll be able to exchange First Digital Bank trial cyberbucks for Mark Twain Bank cyberbucks denominated in U.S. Dollars. I wonder if our trial cyberbucks will be considered collector's items? I know that I will always be proud of *mine*... Bryce signatures follow "To strive, to seek, to find and not to yield." <a href="http://ugrad-www.cs.colorado.edu/~wilcoxb/Niche.html"> bryce(a)colorado.edu </a> -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.01 iQCVAwUBMIrzb/WZSllhfG25AQEGNAQApa3hQlc7jWZBIzsSUqh4o6LQfhoCPzaJ dEOHWDTS+1L8IyNo1PS3Z0hZNeDDiGda7PsilwLouH6M8kUtD7BFXyU/31QDZnXq oLdiq/OJ3A5U04ElEtRXRn7m0eQtoPv4V41UkR0GGkLx93DyGPC6ecXX4vE14oKq jLc4Dt296gc= =gnEm -----END PGP SIGNATURE-----

1 0

Re: Mondex vs. Digicash (was: Godzilla vs. Mothra)
by Stephan Somogyi 17 Dec '03

17 Dec '03

At 10:35 22.10.95, Douglas Barnes wrote: > If the Digicash system allows people to set up their > accounts without getting out of their chairs (which I suspect will > be the case, if they do it right), it will initially get more > adopters. Agreed, especially since it's going to be a while until Mondex, NetBill et al are accessible by consumers outside of the trial areas. I wonder whether this DigiCash announcement will be a limited trial or a full-blown deployment. > I know at least one group of people who believe they have a good line > on a serious security problem in Mondex. Mondex is definitely practicing security by obscurity. Tim Jones, Mondex's CEO, was very cagey last week at the e-commerce conference about how transaction mechanics and where various public and private keys reside. I have serious questions about some aspects of Mondex's security. > o Even if the Mondex hardware were given away for free, think how > much fun it is for the average user to add a new piece of hardware > to their machines... ever install a sound card and CD-ROM drive on > a PC? I remember reading something like 20% of all "multimedia" > kits were returned, largely due to user install problems. If there > is a competing method that costs the same and _doesn't_ require > the hardware, people will tend go with this. Depends on the hardware. I recently saw a pamphlet for a mag-stripe + smart card reader with a numeric keyboard for PIN entry that plugs into a PC as a bump in the wire between the keyboard and the CPU. The company is in Arizona; I can't recall the name offhand. Adding smart card capability to a PC is not in the same league of user hassle as a multimedia upgrade. It's also much cheaper. > but if you explain that the money uses existing (auditable) > channels going in, and existing (auditable) channels going out, and > that only spenders are anonymous, they relax considerably. They may > change their minds later, but we're about to get an existence proof. The problem is with peer-to-peer transactions that don't go through a bank. Mondex claims that such transactions are anonymous and unaudited. What would stop someone from moving a 500 pound per-card maximum from one card to the next and then back up into the system elsewhere? I'm under the impression that Mondex's value isn't serialized the way DigiCash's is, so you can't track the value itself. And if the cards themselves keep no records of transactions made with peer devices, tracking seems rather tricky. > how can you be so sure that Mondex will win over > Digicash, and that they won't co-exist like, say, money orders, > currency and cashier's checks (three instruments with both similar > and dissimilar attirbutes)? The different schemes have enough overlap that it's not clear to me that a single bank will want to support multiple as yet untried systems. Admittedly, we haven't yet seen which bank is working with DigiCash, but Mondex has some pretty heavy hitters behind it already. Since DigiCash is Internet-focused and Mondex is a non-net-specific system that can be adapted for use over the Net, it seems to me that a bank adopting Mondex would get more out of its investment than if it bought into DigiCash. Banks are going to get into some kind of e-cash system sooner than later, and Mondex seems to be the farthest along. _______________________________________________________________________ Stephan Somogyi Senior Editor Digital Media

1 0

(Fwd) DIGITAL CASH IN AN ELECTRONIC WORLD
by tcmay＠got.net 17 Dec '03

17 Dec '03

I saw this on the Cyberia list. Those of you near Washington, D.C. may find this worth attending. By the way, one of the speakers, Kawika Daguio, was once on this list (and may still be, though I haven't seen posts from him in a while). --Tim May >Date: Sun, 22 Oct 1995 17:04:32 -0400 >Errors-To: thardy(a)mail.wm.edu >Reply-To: cyberia-l(a)warthog.cc.wm.edu >Originator: cyberia-l(a)listserv.cc.wm.edu >Sender: cyberia-l(a)warthog.cc.wm.edu >Precedence: bulk >From: "Cleveland Thornton" <thornton(a)legalbits.com> >To: Multiple recipients of list <cyberia-l(a)warthog.cc.wm.edu> >Subject: (Fwd) DIGITAL CASH IN AN ELECTRONIC WORLD >X-Listserver-Version: 6.0 -- UNIX ListServer by Anastasios Kotsikonas > > >For those in the Washington, DC area, you may find the following >meeting of interest, > > > >------- Forwarded Message Follows ------- >Date: Sat, 21 Oct 1995 21:54:36 -0400 (EDT) >From: Andrew Grosso <agrosso(a)access.digex.net> >To: Cleveland Thornton <cthornto> >Subject: Please Post > > THE FUTURE OF MONEY: > DIGITAL CASH IN AN ELECTRONIC WORLD > > The evolution of money has now completed >a one hundred eighty degree turn from the point >where our economy began: from a barter marketplace; >to paper currency; and, today, to pure information >exchanged globally over telecommunications lines. >Money is digital, and can be created, utilized, >and transmitted by individuals and companies, as >well as by governments. > > On Thursday, November 2, at noon, the >Computer Crime Subcommittee of the ABA will host >a luncheon program which will examine the birth >and promise of digital cash. The speakers repre- >sent all three of the important organizations >participating in this venture: designers, bankers, >and governments: > >Steve Crocker, Vice President in Charge of Develop- >ment, CyberCash, Inc. CyberCash is a Reston, >Virginia, based company which was established in >1994. It is in the forefront of the development >and implementation of digital cash in the global >marketplace. Dr. Crocker is himself involved in >both the technical and regulatory aspects of this >field. His talk will include a description of just >what digital cash is, and how we can expect it will >be used in the future. > >Kawika Daguio, Federal Representative for Operations, >Retail Banking, and Risk Management, American >Bankers Association: Mr. Daguio represents the >banking industry, and will discussed its concerns >and hopes for the new currency, and how it expects >that digital cash will change the industry. > >Stephen Kroll, Chief Counsel, Financial Crimes >Enforcement Network: Mr. Kroll's agency is primarily >concerned with the identification of money laundering >and other violations of federal laws concerning the >flow of money. He will discuss the government's >concerns over the effects digital cash will have on >those laws, and how governments may seek to protect >their currencies and their sovereignty. > > The program will be in the form of a brown >bag luncheon, and will take place at the ABA Criminal >Justice Section's Washington offices, at 740 15th >Street, N.W., Tenth Floor. The program is free. >For those who wish to order a brown bag lunch to be >provided by the ABA, the cost is $11.50, which must >be ordered beforehand and paid for at the time it is >picked up. (No cash accepted; make check payable >to ABA Criminal Justice Section.) > > For reservations, please contact Mable >Muldrow, at (202) 662-1520. For more information, >contact the program's co-moderators, Andrew Grosso, >Chair of the ABA Computer Crime Subcommittee, at >(202) 663-9041 [E-Mail: agrosso(a)acm.org] and >Daryl Jackson, Vice Chair of the ABA White Collar >Crime Committee, at (202) 942-5000. >__________________________________________________________ >Cleveland Thornton 202-543-9673 (Office) >Attorney at Law 202-543-3482 (Fax) >15 Second Street, N.E. 74746.1422(a)compuserve.com >Washington, D.C. 20002-7301 thornton(a)legalbits.com > >HomePage http://www.clark.net/pub/cthornto/home.html >__________________________________________________________ > > >__________________________________________________________ >Cleveland Thornton 202-543-9673 (Office) >Attorney at Law 202-543-3482 (Fax) >15 Second Street, N.E. 74746.1422(a)compuserve.com >Washington, D.C. 20002-7301 thornton(a)legalbits.com > >HomePage http://www.clark.net/pub/cthornto/home.html >__________________________________________________________ >

1 0

Re: textbooks
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

Good suggestions all, but don't forget "Network Security Private Communication in a PUBLIC World" by Kaufman, Perlman and Speciner. This book covers a lot of great stuff. It doesn't use complicated math when not required, and explains the math very clearly when it's needed. It explains DES and IDEA well enough in plain language that you can understand how to implement them. While I love Bruce's book, it's much harder to understand than NSPC. I highly recommend this book to everyone. I don't think any crypto library would be complete without it. It's in contention for the official bible of crypto along with Bruce's book. Patrick > From: "Dana W. Albrecht" <dwa(a)corsair.com> > > I also suggest "A Course in Number Theory and Cryptography, 2nd Edition" > by Neal Koblitz, published by Springer Verlag. > > "Applied Cryptography" is certainly the book of choice, but Koblitz > is an excellent secondary reference for covering a lot of the relevant > mathematics in more depth. > > In my opinion, "Applied Cryptography" was written from the perspective > of computer science, "The Codebreakers" was written from the perspective > of history, and Koblitz's book was written from the perspective of > mathematics. > > They are all nicely complementary. > > Dana W. Albrecht > dwa(a)corsair.com > _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Mark Twain Bank Launches Ecash
by Marcel van der Peijl 17 Dec '03

17 Dec '03

---------------------------PRESS RELEASE------------------------ Release date: Contact DigiCash New York: Monday, October 23, 1995 Mr. Daniel M. Eldridge Amsterdam, The Netherlands Tel: +1 212 909 2955 (direct) +1 212 909 4092 (main) Fax: +1 212 318 1222 email: eldridge(a)digicash.com Contact DigiCash Amsterdam: Contact Mark Twain Bank St. Louis: Mr. Paul Dinnissen Mr. Frank O. Trotter, III Tel: +31 20 665 2611 Tel: +1 314 997 9213 Fax: +31 20 668 5486 Fax: +1 314 569 4906 email: press(a)digicash.com email: ftrotter(a)marktwain.com http://www.digicash.com/ http://www.marktwain.com/ Mark Twain Bank Launches Ecash ============================== ----------------------------------------------------- Mark Twain Bank begins operating DigiCash's ecash(TM) on the Internet with U.S. Dollars ----------------------------------------------------- Mark Twain Bank of St. Louis Missouri starts accepting applications Monday October 23, 1995 for accounts that can be used to withdraw and deposit ecash over the Internet. DigiCash(TM) bv, of Amsterdam, the Netherlands, developer of ecash, is supplying the technology to Mark Twain Bank under non-exclusive license. The technology has been tested with a 'monopoly(TM) money' currency called CyberBucks(TM), but this U.S. dollar denominated system is the first time electronic cash is actually being offered using real currency. "This launch marks the beginning of a new era, one in which the digital equivalent of paper money and coins will become even more important than their physical precursors are today," according to Dr. David Chaum, Managing Director of DigiCash bv and inventor of electronic cash. "It will catalyze enormous growth in electronic commerce on the Internet, and prove of enduring value through its improved protection of consumers and society at large." Sweden Post, another ecash licensee, owns the retail bank that is responsible for more than 50% of value transfers in Sweden and has direct access to accounts of over 75% of Swedish households. Sweden Post has not yet announced its launch date. How does it work ---------------- Using ecash is like using a virtual ATM (Automatic Teller Machine). When connecting to it over the Internet, you authenticate ownership of your account and request the amount of ecash you want to withdraw, much like in person. But instead of putting paper cash in your wallet, your software stores the digital cash it obtains onto the hard disk of your PC. When you are asked to make a payment on the net, you confirm the amount, purpose and payee and then your ecash software transfers the correct value in coins from your disk. Sellers, ranging from casual participants in the global Internet bazaar to mega-retailers, deposit the digital coins they receive into their accounts. Behind the user interface, your computer actually chooses the serial numbers of the electronic coins based on a random seed. Then it hides them in special encryption envelopes, provides them to the virtual ATM for signing, and removes the envelopes from what is returned--leaving the bank's validating digital signature on the serial numbers. This way, when the bank receives from the shop the coins you spend, it cannot recognize them as coming from any particular withdrawal, because they were hidden in envelopes during withdrawal. And thus the bank cannot know when or where you shop or what you buy. The serial number of each signed coin is unique, allowing the bank to be sure it never accepts the same coin twice. In case you wish to identify the recipient of any of your payments, you can also reveal the serial number and prove that you formed it. And, in case your computer were ever to break down, if you had written down the secret random seed number you chose initially when opening your account, future versions would let you use it to re-create the coins in envelopes and thereby obtain a free re-issue of the signed coins that were lost. How safe is it -------------- Security is fundamental to electronic cash. The cryptographic coding protecting every 5 cent ecash payment is the same as that routinely relied upon for authenticating requests to move huge sums between banks and even for national security. But in principle ecash goes beyond such communications security to achieve true multiparty security: no one (buyer, seller, bank) can cheat anyone else, no matter how they might modify their own software; even if two parties collude, they cannot cheat the third. Replacing paper and coins with ecash would make life much harder for criminals. Because the payer's computer chooses the serial numbers of the coins, he or she can later irrefutably identify blackmarketeers, extortionists, and acceptors of bribes--were they to take ecash. Paper notes, briefcases full of which can be received without leaving any record, allow money laundering and tax evasion today. With ecash, however, all the amounts each person receives are known to their bank. Significant criminal activity could thus be thwarted by completely replacing paper money; moreover, the privacy of ecash would be essential to widespread acceptance of any electronic payment system that in effect becomes mandatory. Early, competing, and future systems ------------------------------------ Customers of Mark Twain Bank will have to fill out an application form that is available over the Internet, mail or fax it in, and receive a password by mail. The bank's unique multi-currency facilities will allow use from many countries. In the future, the ability to withdraw funds from ordinary checking accounts will be as ubiquitous as making withdrawals at physical ATMs today. Frequent visits to digital branches will give banks the opportunity to offer a full range of financial services to their customers. The over 60,000 people who registered for the CyberBucks experiment--more than all the other cyber-payment schemes combined--suggests a high level of support and interest in ecash. DigiCash plans to keep the experiment going for those who wish to continue using it. After CyberBucks went live almost exactly one year ago, and became the first cryptographically protected Internet payment scheme, a plethora of "me-too" schemes have been announced. Most are simply account-based, accepting requests from users to move money from their account to a specified other account, thereby revealing to the central system exactly when, how much, and to whom they pay, and putting users at the mercy of system errors that may result in loss of money or unexpected lock out. Only ecash works with digital coins, empowering people with full control over their side of financial transactions and full control over when and to whom identifying information is released. Ecash is currently software only: once you've opened an account you just download the software over the net and you're ready to run. DigiCash is developing chip cards and simple readers which will give provide even more security and portability of ecash between machines. DigiCash does not aim to operate ecash systems itself, but rather to continue developing new versions and licensing to financial institutions. (The following are trademarks and should always be referred to as such: CyberBucks, DigiCash, ecash, Mark Twain Bank and Monopoly.) * * * * * * * * * * * * * * * * * * * * * * DigiCash Backgrounder ===================== History and Mission ------------------- Since beginning operation in April 1990, DigiCash's mission and primary activity has been: to develop and license payment technology products--chip card, software only, and hybrid--that both show the true capability of technology to protect the interests of all participants and are competitive in the market. Founder ------- Dr. David Chaum, managing director of DigiCash, received his Ph.D. in Computer Science from the University of California at Berkeley, then taught at New York University Graduate School of Business Administration and at the University of California, and headed the Cryptography Group at CWI, the Dutch nationally funded center for research in mathematics and computer science, before taking his current position. He has published over 45 original technical articles on cryptography and also founded the International Association for Cryptologic Research. DigiCash Products ----------------- Blue: smart card technology for EMV & prepaid with dynamic public key Conforms to joint Europay, MasterCard, Visa specifications; multiple applications including loyalty and closed systems; superior data integrity in case of malicious/accidental interference/interruption; requires only the smallest and most proven chips, e.g. SC-24 or ST601; mask technology licensing. CAFE: smart card and card-accepting electronic wallet project Consortium of 12 other members founded and chaired by Dr. Chaum of DigiCash; simulation, mask and first readers developed by DigiCash; trial in November 1995 at the European Commission headquarters building; technology trial in participation with related open special interest group and partially funded by the EC. DyniCash: highway-speed road-toll collection system using smart cards Chip card inserts into battery-powered dashboard unit; reflected backscatter microwave technology by industry leader Amtech; prepaid mode has user privacy; open and/or closed pricing schemes; tested extensively in Japan; non-exclusive licensing of the payment technology. Ecash(TM): software only electronic cash system for internet/email Users download software that can make and receive payments; protects users' money like travellers checks and privacy like coins; world-wide experiment with tens of thousands of users; Macintosh, MS-Windows and X-Windows; any WWW browser; user software free with issuer licensing. Facility Card: complete facility management smart-card/reader system Cash replacement, access control, and time/attendance system; now in schools, hospitals, industry, offices, recreation; interfaces to vending, point-of-sale, access control, copiers, phones, gaming; downloadable & upgradeable readers work on-line and/or off-line; sold through VAR's. * * * * * * * * * * * * * * * * * * * * * * Early Adopter Companies ======================= AdOne Classified Network (Steve Brotman, +1 212 431 5842, http://www.adone.com/) BizNet Technologies (Doug Mauer, +1 540 231 7715, http://www.bnt.com/) Consensus Development Corporation (Christopher Allen, +1 510 559 1500, http://www.consensus.com/) Delorie Software (http://www.delorie.com/) Global-X-Change Communications (Elliot Burdett, +1 613 235 6865, http://www.globalx.net/) PULVER.COM (Jeff Pulver, +1 917 336 8240, http://www.pulver.com/) Sun Microsystems (Humphrey Polanen, +1 415 336 0022, http://www.sun.com/) The Electronic Frontier Foundation (EFF) (Stanton McCandlish, +1 415 668 7171, http://www.eff.org/) The Electronic Privacy Information Center (EPIC) (Marc Rotenberg, +1 202 546 6520, http://www.epic.org/) The New Sun Newspaper (Lese Dunton, +1 212 799 7402, http://shebute.com/newsun/today/) The Well (Bruce Katz, +1 415 332 4335, http://www.well.com/) Walter Shelby Group (John Buckman, http://www.shelby.com/pub/shelby/) These companies offering their clients ecash(TM) ------------------------------------------------ Husky Labs (David Levine, +1 410 889 3409, http://www.butterfly.net/) (Clients: National Public Radio, The National Geographic Society, PoliticsUSA, Penguin Books, E-Z Communications, Pentagon Cds and Tapes, AfroAmerican Newpapers, Ellicott Machine Corp., The Greater Baltimore Committee Technology Council, National Petroleum Council, Netv, Review.Net, Robert Rytter & Associates, and United States Holocaust Memorial Museum) Organic Online (Brian Behlendorf, +1 415 284 6888, http://www.organic.com/) (Clients: Advertising Age, Saturn Cars, Rubin Postaer Agency, Sybase, Inc., Volvo Cars of North America, Xircom, 1-800-Collect, Conari Press Books, Great Amercian Music Hall, City of Tribes Communications, Octel, Montgomery Securities, Macromedia) Poppe Tyson Advertising (Fergus O'Daly, +1 212 727 5600, http://www.poppe.com/) (Clients: American Express Travel Agency, PSINet Inc., Intercon Systems Corp., Fordham University, New York Cruise Lines Inc., Osram Sylvania, Pfizer, Food Service Group, Ridgewood Savings Bank, Warner Lambert, Drew, EUA COGENEX, New Jersey Travel and Tourism, AT&T, American Isuzu Motors, DataProducts, Magellan, Toshiba America, Computer Systems Division, Toshiba Computer Systems, Toshiba Disk Products, Applied Medical Informatics, Cascade Design Automation, Chrysler Corp. Cirrus Logic, Cypress Semiconductor, Escalade, Hewlett-Packard, Hyundai Electronics America, Intel Corp., International Network Services, Internet Profiles Corp., LANNET, Logic Modeling, Measurex, MIPS Tchnologies, Netscape Communications Corporation, Network Equipment Technologies, Network General, Nokia, North Mountain Software, Premisys Radiomail, Red Herring Magazine, Robert Half International, Sony Electronics Inc., Broadcast Product Group, Sync Research, Synopsys, Synopsys Logic Modeling Group, Touche, Valvoline) * * * * * * * * * * * * * * * * * * * * * * Further Documents Available =========================== 1. "The Ease of Using ecash", tutorial, October 1995, 10 pages. (Text with diagrams.) 2. Congressional Testimony: text of testimony delivered by Dr. David Chaum to Committee Hearing of the U.S. House of Representatives:"The Future of Money", Subcommittee on Domestic and International Monetary Policy; Committee on Banking and Financial Services, July 1995, 3 pages. (Text only.) 3. "Achieving Electronic Privacy", by Dr. David Chaum, Scientific American, August 1992, 6 pages. (Text with diagrams.) 4. European Union - Project CAFE: Conditional Access For Europe, brochure, 1994, 2 pages. (Text only online, diagrams and text only by post.) How to obtain documents ----------------------- Items 1-4 are available on our World Wide Web Server at: 1) http://www.digicash.com/publish/ecash_intro/ecash_intro.html 2) http://www.digicash.com/publish/testimony.html 3) http://www.digicash.com/publish/sciam.html 4) http://www.digicash.com/products/projects/cafe.html Please let us know, if you would like to receive any of Items 1-4 in one of the following other formats: a) via electronic mail in plain text (ascii) format, (Item 1 and 4 unavailable) b) via facsimile c) via post ---------------------------PRESS RELEASE------------------------

1 0

Digicash for-real announcement
by cman＠communities.com 17 Dec '03

17 Dec '03

(Finally, not just a "wait around" announcement) http://www.marktwain.com/ecash.html

1 0

Re: Reducing the Flames, Attacks, and Nit-Pickings
by todd＠lgt.com 17 Dec '03

17 Dec '03

>At 2:18 AM 10/22/95, Todd Glassey wrote: > >>As an aside - What blows my mind is the number of cycles people spend >>bitching and moaning about Java itself rather than working to create a >>better solution. My apologies, I should have taken this off-line with Dr. Fred. I did in my response to him as I had some personal commentary to add which would have beebn inappropriate to the list in general. But you are right. These lists are meant for us to exchange important information and technologies, not necessarily commentary as to what a piece of merde" something is. I respect Dr' Fred's commentary and others where there is a "prize" for all of us, but so much of the postings now happening seem to be of little technical value. Again I aploogize to all and to you Dr. Fred for posting my response to your statement to the world... > > >The recent flames and attacks are pretty typical of mailing lists, >especially mailing lists having 1200 highly-opinionated subscribers >(gulp!). Not that I like the flames, but they're not the problem I want to >really talk about. > >A trend that bothers me--and others too, from comments here--is the intense >"feeding frenzy" that is going on with each and every new product, from >Netscape, to Microsoft Network, to Java, to Digicash. > >Don't get me wrong--finding flaws is a useful thing to do. But this list is >becoming _consumed_ by the _process_ of attacking products. Worse, many of >the attacks are by innuendo, by rumors and speculations about what features >a product has. > >My comments will likely vanish without a trace, but I urge folks to hold >back a bit on jumping in with attacks and reports of problems. Be sure >something is _really_ a flaw before sounding the alarms. > >--Tim May > >Views here are not the views of my Internet Service Provider or Government. >---------:---------:---------:---------:---------:---------:---------:---- >Timothy C. May | Crypto Anarchy: encryption, digital money, >tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero >Corralitos, CA | knowledge, reputations, information markets, >Higher Power: 2^756839 | black markets, collapse of governments. >"National borders are just speed bumps on the information superhighway." Regards, T. S. Glassey Chief Technologist Looking Glass Technologies todd(a)lgt.com (415) 324-4318 -----BEGIN PGP SIGNATURE----- Version: 2.6 iQB1AwUBMFu5E6gNRnWhagU5AQHI+gL+Mwpcd3lAWd8FF06qcG6rnLhIYveHW71a XC7xh1T0uu8qnYX31yMp17OG28jWpKUbWec1IM9/eXOi+gInA7rKICWczV8zo9Z0 0puxjRRN7yO4KfRb3cPpk+r0p6pDg01Y =bTYb -----END PGP SIGNATURE-----

1 0

Re: Reducing the Flames, Attacks, and Nit-Pickings
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:25 AM 10/23/95, Todd Glassey wrote: >>At 2:18 AM 10/22/95, Todd Glassey wrote: >> >>>As an aside - What blows my mind is the number of cycles people spend >>>bitching and moaning about Java itself rather than working to create a >>>better solution. > > >My apologies, I should have taken this off-line with Dr. Fred. I did in my >response to him as I had some personal commentary to add which would have >beebn inappropriate to the list in general. Just to make things clear, when I quoted Todd Glassey's point (above), it was because I _agreed_ with his point about the "bitching and moaning" about Java, as an example. I was _not_ quoting it as an example of the flames on the list, per se. My concern is that the Cypherpunks list is evolving into a "bug list," concentrating on attacks on commercial products. As I've said, finding major flaws in protocols is a useful thing to do, but having the list focussed on debating the fine details of languages like Java and browsers like Netscape seems to be less useful. Worse, idle speculation about possible security flaws seems wasteful. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Chaum's cash: backup?
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

(I congratulate Chaum on his ecash trial. this is a milestone.) the recent Chaum press release and information says that cash is "downloaded" to your local computer. here is my question: of course, I'm sure they have some kind of a backup system. would someone care to comment on it? say I download $1000 to my hard drive and it crashes. what to do? if it was like "real" cash, then it really would be lost. if it wasn't like real cash, and the bank was actually tracking it, then they could determine whether it had been "spent" so far or prohibit someone from "cashing it in" like a hold on a check.

2 1

Freeh wants to wiretap millions
by Brad Dolan 17 Dec '03

17 Dec '03

Excerpt from latest CDT bulletin... Mr. (Un)Freeh wants to be able to monitor (perhaps as much as) the most troublesome 1% of the population. This would appear to be a rather large expansion of telephone wiretapping. bd ---------- Forwarded message ---------- [Excerpt] CENTER FOR DEMOCRACY AND TECHNOLOGY ------------------------------------------------------------------------ A briefing on public policy issues affecting civil liberties online ------------------------------------------------------------------------ CDT POLICY POST Number 26 October 20, 1995 CONTENTS: (1) FBI Announces Digital Telephony Surveillance Capacity Request (2) Subcribe To The CDT Policy Post Distribution List (3) About CDT, Contacting Us (1) FBI NOTICE BEGINS DIGITAL TELEPHONY COMPLIANCE PROCESS -- PUBLIC ACCOUNTABILITY FOR FBI REQUEST ESSENTIAL On Monday October 16 1995, the FBI published its initial request for surveillance capacity as required under Section 104 (a) of the Communications Assistance for Law Enforcement Act (PL 104-144, a.k.a. Digital Telephony). As required by law, the FBI will accept public comments on the proposed capacity requirements for 30 days (ending November 15, 1995). The notice, which includes instructions for submitting comments, is attached below. [...] SURVEILLANCE CAPACITY REQUIREMENTS Section 104 of CALEA requires telecommunications carriers to ensure that their systems posses sufficient capacity to accommodate a specified number of simultaneous intercepts, pen register, and trap and trace devices. As required by Section 104 (a)(1), the FBI, after consultation with state and local law enforcement officials and the telecommunications industry, has published an initial notice or capacity requirements. Section 104 (a)(1) requires that the FBI seek public comment and then publish in the federal register and provide to telecommunications carriers: [...] CATEGORY I -- Areas With Heavy Surveillance Activity Large urban areas and other areas the FBI estimates require the greatest surveillance capacity would fall under Category I [page 53646, see below]. ACTUAL CAPACITY: .5% of engineered capacity, or 500 simultaneous surveillance orders for each equipment, facility, or service serving 100,000 subscribers. MAXIMUM CAPACITY: 1% of engineered capacity, or 1000 simultaneous surveillance orders for each equipment, facility, or service serving 100,000 subscribers, by 1998. _______________________________________________________________________ [...] [editor's note -- Appendicies have been deleted to save spae. The entire text of this document can be found at CDT's Digital Telephony Web Page, URL:http://www.cdt.org/digtel.html] Dated: October 10, 1995. Louis J. Freeh, Director. [FR Doc. 95-25562 Filed 10-13-95; 8:45 am] BILLING CODE 4410-02-M --------------------------------------------------------------------------- (3) HOW TO SUBSCRIBE TO THE CDT POLICY POST LIST To subscibe to the policy post distribution list, send mail to "Majordomo(a)cdt.org" with: subscribe policy-posts in the body of the message (leave the subject line blank) [...]

1 0

digicash & unix clients
by sameer 17 Dec '03

17 Dec '03

I haven't seen any listing of the platforms supported by the live digicash system. Does anyone know where that information is available? Thanks. -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

2 1

Re: Chaum's cash: backup?
by James A. Donald 17 Dec '03

17 Dec '03

At 10:04 PM 10/22/95 -0700, Vladimir Z. Nuri wrote: >say I download $1000 to my hard drive and it crashes. what to do? > >if it was like "real" cash, then it really would be lost. It is really lost. Your disk drive contains information the bank *cannot* know. If you do not know that information either, you cannot prove to the bank or anyone else that you rightfully possess a legitimate coin. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Microsoft "Encrypted" Documents Hack FYI
by llurch＠networking.stanford.edu 17 Dec '03

17 Dec '03

I would provide the hack itself, but I'm on a Mac that lacks a proper Base64 handler at the moment. For people who only know how to use Netscape, the URL is news:465l8h$6sa@oznet03.ozemail.com.au. -rich From: lyal collins <lyalc(a)ozemail.com.au> Newsgroups: alt.security,comp.os.ms-windows.apps.misc,comp.os.ms-windows.win95.misc Subject: Re: More Microsoft Security Bugs Date: 19 Oct 1995 13:53:21 GMT Organization: not very, at the moment Lines: 366 Message-ID: <465l8h$6sa(a)oznet03.ozemail.com.au> References: <llurch-1510951157410001(a)tip-mp3-ncs-3.stanford.edu> NNTP-Posting-Host: slsyd3p02.ozemail.com.au Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="-------------------------------297591414826100" X-Mailer: Mozilla 1.22 (Windows; I; 16bit) Further to word document password protection, the attached offer a simple way to recover text in such files with this "protection". The source is included - at least one shwareare developer has taken up on this technique and releases a VB based version. cheers, lyal -rich graves, llurch(a)networking.stanford.edu moderator of the win95netbugs list http://www-leland.stanford.edu/~llurch/win95netbugs/faq.html My old PGP key has been compromised. Please finger this account for the revocation certificate and my new key.

1 0

Re: digicash & unix clients
by Marcel van der Peijl 17 Dec '03

17 Dec '03

sameer <sameer(a)c2.org> wrote: > I haven't seen any listing of the platforms supported by the >live digicash system. Does anyone know where that information is >available? Thanks. It will be the exact same list as ecash trial (but not exactly the same software). It will be available by the time real accounts are issued. Hopefully tomorrow. Working on it. // Marcel van der Peijl, DigiCash bv, http://www.digicash.com/~bigmac/ // "If you had to tell the Whole Truth, you'd never shut up."

1 0

Re: Re: Chaum's cash: backup?
by Marcel van der Peijl 17 Dec '03

17 Dec '03

"James A. Donald" <jamesd(a)echeque.com> wrote: >>if it was like "real" cash, then it really would be lost. >It is really lost. >Your disk drive contains information the bank *cannot* know. >If you do not know that information either, you cannot prove to >the bank or anyone else that you rightfully possess a legitimate coin. You seem to have different information than we have. Strange. Please reread the press release. I could give a hint: your random state initializer is not the too-often used srand( time( NULL ) ) but user-chosen during installation. Write that initializer down and you can re-generate all coins. The bank can check wether these coins were indeed signed, and, after revealing blinding factors, the bank can also check if they were used. The difference must have been on your disk. This system is not completely operational yet but will be used in the future. // Marcel van der Peijl, DigiCash bv, http://www.digicash.com/~bigmac/ // "If you had to tell the Whole Truth, you'd never shut up."

2 1

No Subject
by Anonymous User 17 Dec '03

17 Dec '03

Was at a party Friday night and ended up having a few beers with a friend who works at a medium-large software publisher. Turns out his company recently received a letter from Netscape to the effect that "we've noticed that there are 'x' copies of Navigator active at your site - you should remember that commercial use requires a license fee", etc. The friend didn't know if the count was per IP address or per "magic cookie installation" (see discussion of a few weeks prior) or some other metric. Not that getting paid for your work is evil, but it looks like Netscape's interest in the use of its browser goes beyond simple curiosity or the sales of advertising to third parties. Is the bean counter number sent to every site, or just to .netscape.com sites?

1 0

Re: Netscape question transformed
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Jeff Weinstein writes: >zoetrope(a)infinet.com wrote: >> Why would a compony like Netscape jeapordise themselves by even >> letting out a beta version so hackers have time to find bugs before the >> full version is released. Don't take me wrong I have only been on the net >> fer a little over a year and Love Netscape. And If I knew what I was >> Doing I would love to help them..... > > The reason we do it is that without wide exposure outside the > company, it is virtually impossible to get complete testing coverage. I see. Who has netscape retained to review its software. Can we have some public names who will vouch for the "partial testing coverage" before exposing it to the world?? Firms who will put their name on the line and say that Netscape meets all of the security guidelines say of the IETF -- the Internet Engineering Task Force?? Or does Netscape feel that International judgement will not matter?? > Given the incredible variety of machines, OS's, peripherals, etc. > that are available in the real world, there is no way we could > re-create every possible configuration in the lab. All the more reason I guess to stick to standard. Or don't you agree?? We're not asking you to re-create every possible configuration, but have you benchmarked Netscape against any standards at all?? And which ones?? > We also can't visit every web page, or think of every combination > of features that clever people in the real world come up with every > day. This is true. You can't visit every web page. So what assumptions did you start off with when you first started your code design?? Did you read the appropriate memorandums upon which the Internet is built? Did you assume that every server would be trustworthy?? That would be extremely negligent. That's like a bank trusting everyone who comes in and asks if the bank can cash a check for them. Any comments, Netscape?? Or are you still not making "official" statements. Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

Re: DejaNews all over again--a URL for Usenet Searching
by Duncan Frissell 17 Dec '03

17 Dec '03

At 12:28 PM 11/6/95 -0800, Timothy C. May wrote: > >I usually avoid passing on URLs of interesting sites, in the name of >conserving bandwidth (*), but this one really has me jazzed: > >http://dejanews.com/ > >It allows searching of Usenet archives (a few months' worth, from what I >can see). I'm not impressed since I've been using the subscription version of Infoseek for a while now which lets you search the last month of News and includes mailing lists as well (including cypherpunks). The free version is behind the Net Search button on Netscape but only searches the Web. http://www.infoseek.com A search for tcmay(a)got.net produced more than 200 hits. My Tim you *do* get around. Modesty prevents me from mentioning any newsgroup names. DCF

1 0

Re: DejaNews all over again
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Tue, 7 Nov 1995 lmccarth(a)cs.umass.edu wrote: > your True Name (verinym) from your name on the net. > Many will want to use > tentacles (*), er, separate pseudonyms for discussions in different parts of > the net. After all, I might not want the c'punks to hear about my past life > as a control freak (pun intended) in alt.config. Just a reminder.... > > (*) Speaking of tentacles, Dejanews reveals that my name is on the long list > of people whose signatures have been appropriated by Detweiler ;) You too, eh?? I wish that Detweiler could (seriously) go back to wherever he came from. Hopefully this time, he can make the attempt ... backwards. I no longer become incensed at his type of spoofing. I understand that a message may look like it appears to come from a site, but it in fact doesn't. Who really knows?? Even a message that is PGP signed isn't guaranteed to be from the person who apparently signed it. Someone might have a web server that asks Netscape Navigator (very politely) to send out someone's secret PGP keyring, or asks Navigator to monitor a person's keystrokes when they enter their password, or heaven forbid their electronic daytimer. Once you have that, it's easy to send a forged PGP SIGNED email. Even worse, most readers of email will tend to believe that an electronic signature is prima facie evidence that a message is from who it appears to be from. It just doesn't work that way. You have to look at the message and use "fuzzy" logic to determine how probable it is that a given message is from the person who it represents itself as coming form. And sometimes, you'll be wrong. Just like the good old, "Dr. Frederick B. Cohen", who posted to this list. Is he really the Dr. Cohen, noted international computer virus expert, the very man who coined the term "computer virus", or isn't he? Is he the man who the US military approached to verify whether missile guidance systems could be compromised by a foreign power utilizing a trojan horse or virus, or not. Do we believe his web page?? Even if we do, do we place a greater degree of trust in his words, than that of say, yours truly, Alice de 'nonymous, or of someone who claims to be Tim May when they BOTH say that there are very serious flaws and deficincies in the Netscape Navigator product? Or do we infer that a "no comment" coming from AT&T and Netscape, acts as confirmation that the *information* in the post is reliably correct. It's impossible to say with certainty. Maybe if someone on this mailing list attended Dr. Cohen's talk today at the Hilton Hotel, in Washington, D.C., and fills us in with what he said, (if we can trust _that_ poster) and we independently verify for ourselves whether what _he_ (Dr. Cohen or Mr. Confirmation) is saying *seems* to be reasonable, then we _might_ be able to say that we _may_ be reasonably certain, that we DO have an international celebrity amongst us and posting to this list, and notifying the world of a serious problem. I mean what would you expect, a Press Release?? Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

2 1

Re: using pgp to make an otp
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:31 PM 11/6/95 EST, Derek Atkins <warlord(a)MIT.EDU> wrote: >> PGP output is not random enough to be used for a one time pad. >> The security of a OTP is *entirely* based on the quality of the random >> numbers; they should come from some strong generator. Building good >> one time pads is tough, and usually not worth the effort. > >No, however the output of "pgp +makerandom=XXX filename.dat" _IS_ >random enough for an OTP. The problem then becomes distributing this >data. amp had written: | my point here is that _if_ pgp output is random enough, i wouldn't need | hardware. even i, with my extremely limited programming skills could create | a .cmd file or program that could be used as input for a stream cypher. The output of PGP should be random enough for your application, as long as you don't think you're getting a cryptographically-correct OTP out of the deal. PGP uses its randpool stuff in its random number generation, so there are likely to be at least 24 bytes of real randomness kept around, maybe more depending on the size of your randpool, but the rest of your security comes from algorithm quality and is theoretically crackable like any pseudo-random sequence (albeit requiring exponentially-large crackwork.) It's using IDEA in a feedback mode, so it's better than just repeated MD5s. The output of PGP +makerandom probably is secure enough for most applications, depending on how many bits you're using, what you're doing with it, and how paranoid you need to be. Check out the code to be sure. You may have special applications such as amp's stream cypher for which it's more convenient to XOR the makerandom instead of using PGP, but watch out for attacks like known-plaintext, which can really bite you in secure-voice systems where there's a lot of near-silence. Careless protocol work can spoil really decent random numbers.... #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

PGP Comment feature weakens remailer security PGP Comment feature weakens remailer security
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Suppose you want to mail or post something sensitive enough to chain through several remailers with PGP encryption at every stage to protect the privacy of communications. PGP can bite you. The PGP comment feature lets you stick one (or more?) lines of comment into your encrypted messages, after the Version: line but before the encrypted message body. If you use the PGP comment feature to say something more or less unique (mine says that you can get PGP outside the country from ftp.ox.ac.uk), anybody eavesdropping the last remailer in your chain can notice this in the remailer's input and recognize that it's from you, even though you've chained through six different places to get there. It's still encrypted, and protected to the extent that the remailer protects you, but if the remailer is corrupt or your message can be identified by size among the other remailer inputs, you're hosed. So, for safety, either turn off PGP comments before using it with remailers, or wipe out the comments by hand before each layer of encryption (easy to do with GUI-based systems like Private Idaho; I don't know if premail lets you do this or not.) Bill Stewart -----BEGIN PGP SIGNATURE----- Version: 2.7.1 Comment: PGP available outside U.S.A. at ftp.ox.ac.uk iQBVAwUBMKAgw/thU5e7emAFAQFStwH/QnIiiaeSmUp1YynDBLVo3HAWsVkS0nx8 Fc95Mr0YJ/YIoRDz+xuNgLHbjJZSTUbhOnigMRb7JLNqhmCGvS5RBQ== =ZWhB -----END PGP SIGNATURE----- #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

8 12

EARLY WARNING: Decemeber SF Bay Area Cyperpunks
by Katy Kislitzin 17 Dec '03

17 Dec '03

Hi-- Eric Messick and I will be holding the Decemeber C'punks meeting at our geodesic dome in the Santa Cruz Mountains. It will be a combination meeting and holiday get-together. It will be happening on the usual c'punks saturday, Dec 9, but will start at 4:00 pm instead of the usual noon. A more spirited announcement will follow closer to the date. --kt

2 1

Lotus Notes RSA Implementation Question
by bglassle＠kaiwan.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I am currently considering using Lotus Notes for a group-ware solution where security is of great importance. I have studied Notes documentation regarding thier implementation of the RSA encryption library, but it leaves some unanswered questions. If anyone on the list has knowledge of the following items, I would be very gratefull. 1) What is the key size used by the USA licensed version? 2) Considering RC4 is a proprietary scheme, have there been any concerted efforts to validate it's strength or lack of? If so, could you give a pointer to any documents I could review. ...Bob Glassley -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMKBVtW7xvKhVs/sNAQHCowP+LF2stvSPzatDfAkKx2DfU8sH5S7p6KwN PwDEak9it1Uq0eALHWVTc3VZ3WYY+6XIjYNnNyfdKsgehXb+2dVEgjz1qbHyK+uE 3JhlYOeCfBcXUrTbilAoYXghJHvrpJq8z+Pa6u2W5Wgxks+t9MYzjV3YKLM2Nj6Z y6jbBUcyyNc= =TN1O -----END PGP SIGNATURE-----

1 0

Re: Crypto++, Cpunk Icons, list noise
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Mon, 6 Nov 1995 s1113645(a)tesla.cc.uottawa.ca wrote: >> And as the messenger, I (hope) I don't have anything to fear, from the >> NSA or any other foreign group that would seek to pursue its own agenda >> within the borders of sovereign Canada. I really don't think that the >> NSA is "evil incarnate", as some list subscribers do. They have their >> intelligence and know how to use it. Usually, they use it prudently. > >They have a nice friend (the author of Spyworld would say outpost) >right here in Ottawa at the Communications Security Establishment. Yes. I'm well aware of where I can find an Operations Officer, if I need to. Locally, in fact. Don't really have to go to Ottawa, for that. (Wrong guess, btw ...) >They (CSE) seem to have done some recent spying on the opposition >parties and Quebec separatists (so I vaguely recall having read in >several places. Yes. At least in this part of the country, we're relatively ho-hum (big yawn) about scouts and scouting. Part of the territory, I guess. We're Canadian. We're civilized about these things. >If you're ever in town, they're just a bit past Carleton U. on Heron. >(it doesn't say CSE on the signs, but the guy at the gate will tell you so) Thanks. Personally, I'm much more interested in the Museum of Civilization. Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0