December 2003 - cypherpunks-legacy

NTT & electronic "cash"
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

This qualifies as one of the most uninformative news items I've seen from Reuters. Anyone know any substantive info on their process? -Allen --------------------- Reuters New Media _ Wednesday December 20 2:04 PM EST _ NTT Says Develops Secure Electronic Cash System TOKYO- Nippon Telegraph and Telephone said today that it has developed a secure electronic cash system which can be used for settling transactions on the Internet and in daily life using smart cards. "The system has very secure algorithms, and that makes fraudulent uses of the system very difficult," NTT researcher Mikio Suzuki told Reuters.

1 0

Ruby Block Cipher
by Michael Paul Johnson 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The Ruby Block Cipher has just been published. It is not a general block cipher in that it cannot be used in Electronic Codebook (ECB) mode. It is more like a cryptographic hash function with a block size of only 64 bits. Of course, 64 bits is too short for a cryptographic hash function intended for digital signature use, but it is just fine for a quick block cipher. This may be a good reference for those folks who want a quick & easy encryption algorithm that need not withstand nuclear attack but can provide something better than common weak encryption methods in use in the software industry. Your comments and suggestions on this rather strange little cipher are welcome. Information on the Ruby Block Cipher is available as ftp://ftp.csn.net/mpj/public/ruby_m4.ps and, if you are in the USA or Canada, a reference implementation is in ftp://ftp.csn.net/mpj/I_will_not_export/crypto_???????/mpj/rubycode.zip where the ??????? is revealed in ftp://ftp.csn.net/mpj/README rubycode.zip is also available on the Colorado Catacombs BBS at 303-772-1062. Note: this is not a product for sale (it is free and probably worth at least as much as you pay for it). It is also not a prepublication (it is THE publication in electronic form with no paper publication anticpated in the near future). ___________________________________________________________ | | |\ /| | | Michael Paul Johnson Colorado Catacombs BBS 303-772-1062 | | \/ |o| | PO Box 1151, Longmont CO 80502-1151 USA Jesus is alive! | | | | / _ | mpj(a)csn.net aka mpj(a)netcom.com m.p.johnson(a)ieee.org | | |||/ /_\ | ftp://ftp.csn.net/mpj/README.MPJ CIS: 71331,2332 | | |||\ ( | http://www.csn.net/~mpj -. --- ----- .... | | ||| \ \_/ | PGPprint=F2 5E A1 C1 A6 CF EF 71 12 1F 91 92 6A ED AE A9 | |___________________________________________________________| -----BEGIN PGP SIGNATURE----- Version: 2.7.1 iQCVAgUBMNiaP/X0zg8FAL9FAQHe0AP+N+tBxoaIdny3CEgxdA8LO9+5VyYiOety qYBc9aCrCbw4TpsFTcsg5bosPlkm3H+VwpWVGOshfl5p69J893jrma07xRamEvM0 /1Mro3X/Ga4SQ7rjHPSdPCBR3YxSA7UoIx27gldTBty2k8WAAeH0BTbn/5s1bGrf ej9ab/rd7Jc= =QRjc -----END PGP SIGNATURE----- P. S. -- I don't normally read this list, so please send a copy of follow-ups directly to me. Thanks!

1 0

KGB_cia
by John Young 17 Dec '03

17 Dec '03

12-21-95. WPutz: "In an unusual interview Yevgeny Primakov, head of the Russian Foreign Intelligence Service, discussed problems and challenges facing his intelligence agency in terms that often sounded like testimony that CIA Director John M. Deutch gave the House intelligence committee Tuesday. In comments that echoed those of his U.S. counterparts, Primakov charged that some post-Cold War budget cuts in his agency developed 'because the [Russian] press ganged up on us [and] many newspapers wrote absurd things about us, including statements that foreign intelligence was no longer necessary at all.' His remarks about media coverage were similar to recent statements by Deutch and his predecessors, R. James Woolsey and Robert M. Gates." KGB_cia (5 cia)

1 0

Re: What ever happened to... Cray Comp/NSA co-development
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- First, thanks for the obvious 'kind' thoughts Tim... It's heartening that you took the time to add some substantial info to the thread. However... > On 12/18/95 At 12:36 AM -0500, Timothy C. May wrote: > >What caught my attention was the architecture. > > > >A "hybrid design linking two supercomputer processors with an > >array of HALF A MILLION inexpensive processors" that were > >designed by the U.S. government laboratory affiliated with the > >NSA. The same chip house that brought us Clipper. > First, half a million chips is not that big a deal...the Connection Machine > had up to 64,000. Very few cryptographic problems of interest to us will be > affected by a mere factor of a million or so. O.K. Just a factor of 16 increase over the CM architecture right? Not knowing the computational capabilities of the individual processors, it might be difficult to say what the machine is capable of. Wouldn't that have some bearing? > Second, there was work on a "processor-in-memory" architecture, in > conjunction with a Bowie, Maryland spook-connected company. Perhaps this is > what you are thinking of? I didn't mention a 'processor-in-memory' architecture and neither did the NYT article. Don't know about any other company involvement, just CCC and NSA. > Third, all avenues of continued funding having fallen through, Cray > Computer (not Cray Research, of course) was shut down and assets > liquidated. I haven't heard what's become of Seymour, though. (He is > undoubtedly an asset, buy I doubt the Agency would have him liquidated.) You mean the avenues that are of PUBLIC record. The possibility could always exist that the development continues 'in-house'. It wouldn't be the first time that sort of move has been played. > >I've not kept up with the "ultimate" demise that eventually > >befell Cray Computer Company, but the October 16 FBI filing > >on capacity for Digital Telephony got me thinking back to this > >article. 1% seems like a rather huge need for horsepower. And > >what if GAK doesn't fly? And the widespread use of hard crypto > >just keeps increasing? > The tightly-coupled supercomputers are hardly needed for these sorts of > problems. You mean the problem of data collection? Well, it's true that this would be a misuse of a supercomputer's specialized talents. > >This kind of machine could, in theory: > > > >1) Implement ALL Clipper(II) based Key Escrow functionality in > > silicon (the easy part) AND allow for simultaneous decrypt and > > surveil of 'who knows how many' Clipper based data streams. > Huh? First, what evidence do you have for this claim? Second, who cares? > Implementing Clipper in a Cray Computer machine--why bother? [Rant mode on] Speculation Tim... I'm SPECULATING. Could, in theory... AND my kind of theory probably has holes you could drive a FLEET of Mack trucks through. I have NO evidence. I'm not sure WHO would care. I'M A PARANOID DILLUSIONAL PSYCHOPATH! O.K. well maybe not that last part... but I'm asking the questions, remember? I said I'm new here, so if your going to blow holes in my pet theories, then do me the 'kindness' of using an accurate weapon... that's why I posted... > As to the claim that a million-processor machine could do this, you need to > work out the math. (If a backdoor exists, or the LEAF has been gotten, a > supercomputer is not needed....) Again... I claimed NOTHING! SPECULATED MUCH! Now it's your turn... Why would YOU build a machine like this? What could POSSIBLY be it's capabilities? Speculate with me for a moment... *_take a chance_*. > >2) Implement general RSA based Prime Factoring functionality in > > silicon (the not so easy part) AND allow massively parallel > > decrypt and surveil of 'who knows how many' RSA/etc. based > > data streams. > Prime Factoring? Primes are easy to factor, of course. (Hint: Every prime > has two factors.) Yes, my terminology sucks! But you get the drift don't you? Math is not a strength of mine, I only know in very general terms what is involved (why, then, am I even bothering to bring this up?). Because I AM however, VERY concerned in the continual erosion of privacy rights in all forms communications, electronic and otherwise. [Rant mode off] > If you mean using supercomputers to brute force the general factoring of an > RSA modulus, this is nonsense. While there may be math shortcuts we don't > yet publically know about which make factoring easier than we currently > think it is, a mere million or even a billion processors will not make a > dent in the factoring of, say, a 700-digit modulus. See the tables in > Schneier and elsewhere for some estimates of factoring efforts needed. Nonsense? Is that 700 decimal digits or 700 binary digits? I don't have the tables that you refer to. Where may I find them? (LOL) > >3) Implement it all, AND 'on-line' transaction based surveillance > > via the FBI's 1% capacity infrastructure. > Let's see some numbers. (On second thought, let's not.) No, I've already said that math is not a strength I possess. I've wondered about the ability of the FBI to count on ten fingers and ten toes given some of the justification that I've read for this capacity figure... > >Chilling... Who needs key escrow (or RSA private keys) when > >you've got a massively parallel prime factoring machine. What if > >GAK was to become a 'non-issue'? How fast do you think a machine > >such as this could factor RSA 129? > Well, do the math. The MIPS-years for the RSA-129 crack were publicized, so > the computation for a million SPARC-equivalent (or even > UltraSPARC-equivalent) can be done. Sorry... I asked the question... and your speculation is (I would hope) MUCH more accurate than mine. Again, math is not a strength of mine. > When you've done this, and concluded that RSA-129 could be done in, say, X > minutes, then move on to RSA-384 (the BlackNet key cracked by the MIT > group), and on to the 1024- and 2048-bit keys. Tell us how many years or > centuries it will take. (Hint: Rivest and Schneier have done these > calculations....) Yes, I believe that I've read Rivest's paper on the statistical probabilities. I've never really believed in statistics, AND I'm sure you don't have the time to convince me Tim (I'm sorry if I've been less than reverencial about this, but I'm from Illinois which is right next door to Missouri). > --Tim May, who fears that he's just been trolled by Derek Atkins No Tim, you have not... but on another note... > It'll be _many_ years before a 384-decimal-digit number is factored, I > suspect. Let alone a 600-digit modulus, with or without the mysterious > "transphaser" technology mentioned by Anitro. The "transphaser" is an optical equivalent to the transistor. It is a quantum threshold optical switch, but it is not a 'mystery'. You should read Scientific American more often ;> O.K. I'm done with this line of discussion, you may however, continue to elaborate as I will, no doubt, continue to read... Anitro "I have a little shadow that goes in and out with me, And what can be the use of him is more than I can see" R. L. Stevenson - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMNiv8SoZzwIn1bdtAQHyewF+OXlM8KueHrCynKGhjqXy8eHLSonn12Df vcAdDoaajoi5t7CfY9lP/+FNeO2JKE+v =SIKC -----END PGP SIGNATURE-----

1 0

Re: The Problem With Blaze And Weinstein
by cpunk＠remail.ecafe.org 17 Dec '03

17 Dec '03

I'm not trying to start a flame war, just telling people what's REALLY happening. ATT and Netscape are both tools of the CIA/NSA. Blaze and Weinstein are in on the plot to force GAK upon us. Neither one says enough about the evils of GAK on their web page, so they're obviously for GAK and only pretending to be against it to fool the cypherpunks and curry favor with their NSA masters. Evidently the cypherpunks are all too impressed with Blaze and Weinstein's master degrees to see what's really happening. Only true visionaries like myself and Dr. Frederic B Cohen are telling it like it is; everyone else has had the wool pulled over their eyes by the NSA/ATT/Netscape axis. It's amazing how clear everything becomes once one stops taking the medication that THEY prescribed. s/ Bill Gates

4 3

Re: FTC Privacy Initiative (fwd)
by blancw＠accessone.com 17 Dec '03

17 Dec '03

From: Jyri Kaljundi From: Internet Marketing Discussion List The US Federal Trade Commission has launched a "Privacy Initiative" to investigate whether the information collected at websites (either that affirmatively submitted by a visitor via a form or information collected based upon a visitor's selection of pages at a site to reflect personal interests) should be the subject of regulation by the FTC. ............................................... "Hey, we can't just stand around here with nothing to do. Give us something to regulate - anything, pro or con; we must regulate something." Dang! .. Blanc

2 1

Re: ex encrypted script
by Rich Salz 17 Dec '03

17 Dec '03

>Is there a way to encrypt a script yet still allow it to be runnable? I >know that the simple answer is to write it in C and compile it but I don't >have the means of doing that at the moment. (i.e. there is not compiler on >the system) Given your constraints: no. /r$

1 0

Re: The Problem With Blaze And Weinstein
by Rich Salz 17 Dec '03

17 Dec '03

> MIT is practically floating on government subsidies. Actually, if you discount Lincoln Labs, not really. /r$

1 0

Surprise telecommunications bill?
by Alan Olsen 17 Dec '03

17 Dec '03

While watching the national news (NBC, I think) they mentioned that there had been a "surprising agreement on a telecommunications bill". From the sparse description, it sounded pretty nasty. Does anyone have any additional information on this? | Remember: Life is not always champagne. Sometimes it is REAL pain. | |"The moral PGP Diffie taught Zimmerman unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

2 1

An Apology to Mr. Merzger
by Dan Harmon 17 Dec '03

17 Dec '03

Perry and members of this list, I want to publicly apologize to Mr. Metzger. On reviewing the events of the day, it seems that I misunderstood a post by Perry. It seems that I was missing a previous post that was being referenced. As to the misunderstood message, I have to now agree with Perry and his reponse. Please accept this apology. Dan

2 1

Re: Microsoft Flame[tm] [NOISE]
by RobL 17 Dec '03

17 Dec '03

At 06:32 AM 12/21/95 CST, Roy M. Silvernail wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >There's a lot of finger waving going on over Microsoft's alleged >predatory practices. I just want to remind the pro-MS folks of >something. Microsoft has a documented track record of using >undocumented entry points in their OS and Windows products. These entry >points allow MS apps to do some things more efficiently than a [snip] > >While this isn't the grand-scale conspiracy some people seem to see, >IMHO it's still predatory. Perhaps the call to separate the OS and apps >divisions is a good idea. It would be interesting to see if Microsoft >could maintain its edge in applications when it had no sub rosa >advantage in OS access. IMHO, I see nothing wrong with predatory behavior.. then again, I hunt in the fall, so it must be a redneck thing.. MS and any of the other software companies are competing for domination in a narrow field.. MS just happens to be the only real choice for OS anymore.. well, for a standard, out of the box OS anyways. The fact that they have to leave in undisclosed hooks to get their own software to excell over others just points to the poor software they produce overall. I have to admit that I like, possibly admire, the way the Bill and crew have captured the market.. from a marketing standpoint, they did a first rate job of running with the ball until there was no pursuit.. Sure, from time to time, someone tries to throw a blocker in thier path, but they just overrun it and keep going.. Forget about the monopoly aspects for a second and look at MS as an American success story. It has all the classic elements: started small, with a crew of social misfits and eventually grew up. Just a few cents worth.. RobL ------------------|----------------------------------------------------------- Rob Lowry | PO Box 288 | Rockford Wa 99030 | ral(a)otc.mhs.compuserve.com robl(a)on-ramp.ior.com

1 0

Re: What ever happened to... Cray Comp/NSA co-development
by tcmay＠got.net 17 Dec '03

17 Dec '03

Anitro wrote: >O.K. Just a factor of 16 increase over the CM architecture right? Not knowing >the computational capabilities of the individual processors, it might be >difficult to say what the machine is capable of. Wouldn't that have some >bearing? Not in cracking "truly large" problems by brute force. Even if each of the million processors is capable of 100 MIPS (which is unlikely, given the PIM approach and the fine-granularity, few-bit-or-less word size, etc.), this is only 10^8 MIPS. For problems that (for instance) 10^75 machines would have to spend 10^10 years on, not even a drop in an ocean. The point is that no existing machines are going to make a dent in these calculations, though algorithmic cleverness _might_ make factoring much easier (personally, I doubt it). >> Second, there was work on a "processor-in-memory" architecture, in >> conjunction with a Bowie, Maryland spook-connected company. Perhaps this is >> what you are thinking of? > >I didn't mention a 'processor-in-memory' architecture and neither did the NYT >article. Don't know about any other company involvement, just CCC and NSA. I wrote my response before seeing the other response someone else (Thaddeus J. Beier) gave the name of the company. Thad's details match what I recall about this Bowie company. The archives should have articles on this, dating back about a year or so ago. As I recall, someone on the list knew people working at the Supercomputer Research outfit. >> Third, all avenues of continued funding having fallen through, Cray >> Computer (not Cray Research, of course) was shut down and assets >> liquidated. I haven't heard what's become of Seymour, though. (He is >> undoubtedly an asset, buy I doubt the Agency would have him liquidated.) > >You mean the avenues that are of PUBLIC record. The possibility could always >exist that the development continues 'in-house'. It wouldn't be the first time >that sort of move has been played. You, whoever you are, asked about the operational status of Cray Computer, and I answered. It entered Chapter Seven liquidation, parts of existing computers were sold for scrap or museum/curio objects, the GaAs fab was sold to another company, and the employees scattered. Claiming the NSA moved it "in-house" is implausible, at least in terms of these events. >> Huh? First, what evidence do you have for this claim? Second, who cares? >> Implementing Clipper in a Cray Computer machine--why bother? > >[Rant mode on] >Speculation Tim... I'm SPECULATING. Could, in theory... AND my kind of theory >probably has holes you could drive a FLEET of Mack trucks through. I have NO >evidence. I'm not sure WHO would care. I'M A PARANOID DILLUSIONAL PSYCHOPATH! >O.K. well maybe not that last part... but I'm asking the questions, remember? >I said I'm new here, so if your going to blow holes in my pet theories, then >do me the 'kindness' of using an accurate weapon... that's why I posted... I asked what evidence you have for this claim. Idle speculation, based on innumerate estimates of plausibility are helpful to no one. >> As to the claim that a million-processor machine could do this, you need to >> work out the math. (If a backdoor exists, or the LEAF has been gotten, a >> supercomputer is not needed....) > >Again... I claimed NOTHING! SPECULATED MUCH! Now it's your turn... Why would >YOU build a machine like this? What could POSSIBLY be it's capabilities? >Speculate with me for a moment... *_take a chance_*. On our list, and in the circles I am familiar with, "speculations" are not treated with more respect than are actual "claims" (whatever they are). If you speculate that "really, really fast computers" will make today's ciphers insecure, based on not even the simplest of calculations, expect to be either ignored or called to task. This is the way science works, by falsification of theories (and speculations). >> If you mean using supercomputers to brute force the general factoring of an >> RSA modulus, this is nonsense. While there may be math shortcuts we don't >> yet publically know about which make factoring easier than we currently >> think it is, a mere million or even a billion processors will not make a >> dent in the factoring of, say, a 700-digit modulus. See the tables in >> Schneier and elsewhere for some estimates of factoring efforts needed. > >Nonsense? Is that 700 decimal digits or 700 binary digits? I don't have the >tables that you refer to. Where may I find them? (LOL) A 2048-bit key, such as many of us use, uses a roughly 700-decimal-digit modulus. "Schneier," mentioned in my paragraph, is "Applied Cryptography." Page 284 of the 1st Ed. has a discussion of the work involved in factoring large moduli. Rivest has made some more detailed estimates. Given your rudeness and self-professed ignorance of even the basic math, I see no point in wasting any more of my time on your posts. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Digicash and capital adequacy
by Simon Spero 17 Dec '03

17 Dec '03

This came out of a corridor discussion yesterday as to how digicash would affect future banking systems: How does digicash interact with capital adequacy requirements? Should each digi-dollar issued require a corresponding hunk'o'assets in the customers account, or should the bank be able to issue digicash using existing rules? Digicash can have a much faster velocity than real cash, so I can sort of imagine their being periods where adequacy limits could be exceeded. What's the panels view? Simon p.s. I got to see the movie "Hackers" while I was sick in bed after WWW IV. The movie was pretty bogus, but the soundtrack was pretty cool. The wonderful movie website had nothing about any soundtrack albums; anyone know if there was one?

1 0

QCF_dec
by James A. Donald 17 Dec '03

17 Dec '03

--------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

the problem with attacks on Blaze & Weinstein
by Greg Broiles 17 Dec '03

17 Dec '03

The "Blaze & Weinstein are devils in disguise" business is ridiculous, as is the notion of "cypherpunk purity". Cypherpunks is a mailing list. If Blaze and Weinstein were up to something especially tricky, they'd probably post from accounts not traceable to their employers (like, say, anonymous remailers). Suggesting that a person is not to be trusted because they work for organization "X" is particularly silly where the suggestor isn't willing to provide the details of their own organizational ties. This is a mailing list. Mailing lists are for discussing things - like technological defenses for privacy. People may have interesting things to contribute because of, in spite of, or irrespective of their employment or other relationships with large organizations. (And, in fact, they do. Both Matt Blaze and Jeff Weinstein have done and said pro-privacy things despite the equivocal-to-hostile stance their employers have taken with respect to privacy. Brian Davis, the list's token prosecutor :), has recently been sending messages re the limits of governmental power in the context of criminal investigations. Microsoft employees have posted re Microsoft's choices about privacy and encryption/security. And so on.) If this were a secret organization and we were splitting up into individual cells for revolutionary/forbidden activity, your suspicion/paranoia might be useful. But we're not (it's an open list, archived on full-text searchable Web servers), so it's not. And, apart from whether or not they're valuable list contributors, the list really isn't in a position to not "tolerate" unwanted or unproductive readers or authors. The tools which make identity difficult to fix make it difficult to restrict/deny access to an unpopular or unwanted identity. Get used to it. Adapt or die, hmm? -- "The anchored mind screwed into me by the psycho- | Greg Broiles lubricious thrust of heaven is the one that thinks | gbroiles(a)netbox.com every temptation, every desire, every inhibition." | -- Antonin Artaud |

1 0

The War on Some Money [long]
by sdavidm＠iconz.co.nz 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [Yes - money laundering _again_.] I want to advance two theses: 1. That the interest and activities of governments in fighting money-laundering is directly contrary to the interest and activities of those seeking to develop anonymous digital commerce; 2. That there is a related, if not underlying, conflict between the rhetoric of concealment and the rhetoric of privacy. <Of course, what _does_ underly all of this is individual vs. state -- but that is pretty much a given.> If the push for anonymous digital commerce is exemplified by the Cypherpunks (and let's pretend it is), the battle against money-laundering is being led by the Financial Action Task Force (FATF), an autonomous international entity, set up by the G7 as part of the orgy of post-cold-war co-operation between States on this issue. The UN, G7, OAS, Commonwealth, EU and a host of supra- national bodies have called for co-ordinated action on stamping out dirty money. And in an unprecendented fashion, States have responded. There are over 100 States that either have or are considering the criminalisation of money- laundering. These include, by and large, the tax havens of Europe, the Carribbean and the South Pacific. So what is criminal money laundering? Concealing the source of funds that one knows come from serious crime. Three comments about this formulation: 1. The state of mind required is knowledge, although this knowledge can be inferred from objective facts (and knowledge tests in criminal definitions are notoriously elastic). 2. The source of funds must be serious crime. The early UN declaration only referred to drug dealing, but since 1990 there has been a move to widen this to all serious crime. As to what constitutes serious crime, this is still somewhat up for grabs. Some of the BSA's statements about software piracy being the drug dealing of the nineties, and linking piracy with organised crime can be seen as a strategy to position large scale intellectual property theft as serious crime. More ominous (at least for the relationship of citizen and state) is the occasional reference to tax evasion in the same breath as serious crime. 3. This is because the serious crime need not be committed in the same country as the money laundering. This makes sense for conventional serious crime (to coin a phrase), but if tax evasion is included represents a major departure from the convention that the courts of one country will not enforce the taxing statutes of another. Note also the possibility that fraud might be serious crime, which, since the test of fraud is dishonesty, directly brings the competing ethical (or rhetorical) systems into conflict. But more of this below. The key feature of the new supra-national regime, however, is not a more or less co-ordinated criminal law (there are some marked variations on the above scheme), but the new surveillance approach to the financial system. The most obvious signs of this are the requirement of financial institutions to "know your customer" (which includes an explicit prohibition of anonymous accounts) and to report "suspicious" transactions. But the approach goes much further. The FATF's chilling Forty Recommendations (on which the global approach is largely based) urges countries to "further encourage in general the development of modern and secure techniques of money management, including increased use of cheques, payment cards, direct deposit of salary cheques, and book entry recording of securities, as a means to encourage the replacement of cash transfers." [This is taken from a synopsis of the Recommendations.] In case anyone should think this is based on the insecurity to the _customer_ of cash and bearer securities, the FATF suggests countries (i.e. Governments) may like to consider monitoring all domestic financial transactions with a view to building databases for computer analysis -- such databases to be appropriately secured from unauthorised access, of course. So there we have it. The FATF wants a cashless, book entry, universally monitored financial system based on verified True Names. Some Cypherpunks want a cash based, bearer certificate, mathematically unmonitorable financial system revolving around impenetrable pseudonyms. Another way to put this is that Cypherpunks are for privacy, but the FATF is against concealment. Three arguments are often made for the attack on money laundering. 1. Money laundering leads to the corruption of societies and the undermining of institutions and States. This seems to be putting the cart before the horse, somewhat. Even if you consider money laundering as an inextricable part of rendering crime organised, the crimes usually cited (drug dealing, environmental crime, and the smuggling of cultural artifacts [!]) could be decriminalised relatively easily. And of course you could always abolish the State :-) 2. Money laundering puts the financial system at risk. (This, of course, is why the financial institutions used in the Pizza Connection money laundering chain (Merrill Lynch, E F Hutton, Bankers Trust, Barclays, Chase Manhattan, Chemical Bank, Citibank, American Express and Thomas Cook. Bank of Nova Scotia, Ueberseebank (Switzerland)) have without fail spectacularly collapsed.) In so far as this is a result of legislation providing for the forfeiture to the State of the proceeds of crime, another solution is clearly available. 3. The War on Drugs has been a failure, because it isn't in anyone in the drug distribution chain's interest to assist authorities. The financial system is organised crime's exposed flank. (As an(other) aside, it is often mentioned (asserted?) that terrorists are turning to drug dealing etc to finance their terror campaigns. I'm not sure whether this is intended to combat the "drug dealers are just businessmen" argument, or the "terrorists are just patriots" one. Perhaps both.) [Don't get me wrong. I'm not saying Statists are bad because drug dealers are good. I realise that reasonable people can differ as to the trade off between civil liberties and the protection of the State. I know people who think that it is all right to let the Police randomly breath test drivers in order to decrease road deaths. So I can easily imagine people might feel having to front up with two types of ID to open a bank account is a small price to pay to prevent the violence and misery of drug addiction. I happen to think both sets of people are wrong, and dangerously so.] So governments fight money laundering to make it harder for criminals to enjoy the wealth governments can't stop them making. As a side effect, governments gain valuable intelligence about everyone's everyday finances. And we might as well look at cracking down on those evil tax evaders while we're at it... Well -- even I'm willing to admit this summary is a tad glib. It misses something important about attitudes to secrecy: whether secrecy is about privacy or concealment. Michael Froomkin often [:-)] cites Sissela Bok on the danger of secrets inappropriately kept (see e.g. A. Michael Froomkin, "Anonymity and its Enmities," 1995 J. Online L. art. 4, par. 51) -- and certainly the overtones of locked doors, masks, whispers and shadows makes "secret" itself a suspect word. To be open is almost always good; to be secretive is definitely always bad. This sense of the inherent evil of secrets (dark secrets, guilty secrets) runs deep. Take the Equiticorp criminal trial (a local cause celebre of a few years ago) where executives of a company that failed spectacularly after the '87 crash were charged with (inter alia) conspiracy to defraud. The executives in question had caused a large sum of money of (at that time) completely unknown provenance (the so called H-Fee) to be paid to themselves through a series of companies in tax-haven/banking secrecy jurisdictions. The judge (there was no jury) found that, because no one had offered an honest reason to use such a structure, it could only have been for the purpose of concealment of the source of the money from those who may have had a legitimate interest in determining it (IRD, auditors etc.). This amounted to dishonesty, and the charge of conspiracy to defraud was made out. Note the reasoning here: a secret without a reason is concealment; concealment is dishonest. (Cypherpunks would reason exactly oppositely: a secret is an expression of privacy; privacy is good.) We can extend the concealment reasoning in an interesting way: concealment -> dishonesty -> fraud -> serious crime + concealment -> money laundering. So widespread concealment can (conceivably) give rise to an offence of money laundering with no other illegal act. The very fact that the State has an interest in detecting money laundering strengthens that first link: concealment - -> dishonesty. For the cypherpunks, of course, privacy -> nothing at all. Secrecy=privacy is the default. Secrecy=concealment is a red herring. This is not the forum to recite the virtues of privacy. So I'll leave you [at last, they cry!] with a sugestion as to its main (rhetorical) vice: privacy is opposed to public, and public is (usually) good. I'll go further. In the same way that "secret" gives rise to a cascade of negative associations, "public" gives rise to a chain reaction of happy, if not down right noble, thoughts: the public good; public service; the public's right to know; and, of course, the republic itself. Private (and privacy), on the other hand, gains meaning from its distinction from public -- it is _inherently_ negative. All this is so much old rope for those who reject the linguistic turn in philosophy, but I find it a useful way of thinking about trends. And we are seeing trends towards individuality, the rejection of the collective, the privatisation of what once was public. Part of this will be the reversal of the privilegeing of public over private, and the consequent/connected move from secrecy=concealment to secrecy=privacy. And a tangble manifestation of all that will be the rise of anonymous digital commerce, and the abandonment of The War on Some Money. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMNkJOVlo3j8JHzalAQGA/gP8D1mKUVyzybOVuI2AknuznciwghtvndH9 I0GtFnti8zFANMo6LIqb5/Hlz/XDTG6SFZR5D9omFlAd/J781pInaiEtTfXr/y+M BXOppcvXfo28adGR5bgi+JLoZE9XQ511Qrz+HKi7Oa47LudySpRHkd/THM1Wamnw 9aWkxh5JOXs= =FoHd -----END PGP SIGNATURE----- [Palmtop News Reader - Beta Version 3]

1 0

SSLeay 0.5.1
by Eric Young 17 Dec '03

17 Dec '03

SSLeay 0.5.1 is now available. It should be quite stable and has documentation for the lower level cryptographic routines. It is incompatible with the previous version but has no global variables of consequence so it should be a much nicer starting point for threaded libraries. The library should have no memory leaks and the general cryptographic functionality has been filled out more. Tim Hudson <tjh(a)mincom.oz.au> will be updating the applications available on ftp.psy.uq.oz.au in the next few days. I leave for an 11 week holiday today so please address any problems and questions to the ssl-users(a)mincom.oz.au mailing list (if it is of general interest) or to ssleay(a)mincom.oz.au which goes to both myself and Tim Hudson (who will be fixing any bugs while I'm away). Anouncing software and then leaving for 3 months would probably not normally be considered a good practice but 0.5.0 has been tested for the last week or so and I have faith in Tim Hudson's ability to fix bugs after doing pre-alpha testing for the last 6 months :-) As per usual, the primary ftp site is ftp://ftp.psy.uq.oz.au/pub/Crypto/SSL http://www.psy.uq.oz.au/~ftp/Crypto Documentation on the demo application is sparse but I hope Tim Hudson will be able to fill in the gaps while I'm away :-) eric <eay(a)mincom.oz.au> -- SSLeay v 0.5.1 21/12/955 Copyright (c) 1995, Eric Young All rights reserved. This directory contains Eric Young's (eay(a)mincom.oz.au) implementation of SSL and supporting libraries. The current version of this library is available from ftp://ftp.psy.uq.oz.au/pub/Crypto/SSL/SSLeay-x.xx.tar.gz There are patches to a number of internet applications which can be found in ftp://ftp.psy.uq.oz.au/pub/Crypto/SSLapps/ A Web page written by Tim Hudson <tjh(a)mincom.oz.au> can be found at http://www.psy.uq.oz.au/~ftp/Crypto This Library and programs are FREE for commercial and non-commercial usage. The only restriction is that I must be attributed with the development of this code. See the COPYRIGHT file for more details. Donations would still be accepted :-). The package includes libssl.a: My implementation of Netscapes SSL v 2 protocol. This library implements the SSL protocol. libcrypto.a: General encryption and X509 stuff needed by SSL but not actual logically part of it. It include routines for the following: libdes - My libdes DES encryption package which has been floating around the net for a few years. It includes 15 'modes/variations' of DES (1, 2 and 3 key versions of ecb, cbc, cfb and ofb; pcbc and a more general form of cfb and ofb) a fast crypt(3), and routines to read passwords from the keyboard. RC4 encryption, IDEA encryption - 4 different modes, ecb, cbc, cfb and ofb. MD5 and MD2 message digest algorithms, SHA (SHA-0) and SHA-1 message digest algorithms, RSA encryption/decryption/key generation. There is no limit on the number of bits. Diffie-Hellman key-exchange/key generation. There is no limit on the number of bits. X509 encoding/decoding into/from binary ASN1 and a PEM based ascii-binary encoding which supports encryption with a private key. Programs in this package include enc - a general encryption program that can encrypt/decrypt using one of 17 different cipher/mode combinations. The input/output can also be converted to/from base64 ascii encoding. dgst - a generate message digesting program that will generate message digests for any of md2, md5, sha (sha-0) or sha-1. asn1parse - parse and display the structure of an asn1 encoded binary file. rsa - Manipulate RSA private keys. dh - Manipulate Diffie-Hellman parameter files. crl - Manipulate certificate revocation lists. x509 - Manipulate x509 certificates, self-sign certificates. req - Manipulate PKCS#10 certificate requests and also generate certificate requests. genrsa - Generates an arbitrary sized RSA private key. gendh - Generates a set of Diffie-Hellman parameters, the prime will be a strong prime. ca - Create certificates from PKCS#10 certificate requests. This program also maintains a database of certificates issued. verify - Check x509 certificate signatures. speed - Benchmark SSLeay's ciphers. s_server - A test SSL server. s_client - A test SSL client. s_time - Benchmark SSL performance of SSL server programs. Documents included are A Postscript and html reference manual (written by Tim Hudson tjh(a)mincom.oz.au) A list of text protocol references I used. A initial version of the library manual. To install this package, read the INSTALL file. This library has been compiled and tested on Solaris 2.[34] (sparc and x86), SunOS 4.1.3, DGUX, OSF1 Alpha, HPUX 9, AIX 3.5(?), IRIX 5.[23], LINUX, NeXT (intel). For people in the USA, it is possible to compile SSLeay to use RSA Inc.'s public key library, RSAref. From my understanding, it is claimed by RSA inc. to be illegal to use my public key routines inside the USA. Read doc/RSAref.doc on how to build with RSAref. Read the documentation in the doc directory. It is quite rough, but it lists the functions, you will probably have to look at the code to work out how to used them. I will be working on documentation. Look at the example programs. There should be a SSL reference manual which is being put together by Tim Hudson (tjh(a)mincom.oz.au) in the same location as this distribution. This contains a lot more information that is very useful. For a description of X509 Certificates, their use, and certification, read rfc1421, rfc1422, rfc1423 and rfc1424. ssl/README also goes over the mechanism. We have setup some mailing lists for use by people that are interested in helping develop this code and/or ask questions. ssl-bugs(a)mincom.oz.au ssl-users(a)mincom.oz.au ssl-users-request(a)mincom.oz.au This library is reasonable stable now. Version 0.5 has had extensive rewriting since version 0.4. The purify package has been used extensively and I believe most if not all memory leaks have been removed. There are no writable global variable so a multi-threaded/DLL version of the library should be quite simple to write. Look at TODO for a list of thinks I know I still need to do. eric (December 1995) Eric Young (eay(a)mincom.oz.au) 86 Taunton St. Annerley 4103. Australia.

1 0

Cypherpunks resumes?
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Is there any chance of seeing a Cypherpunks 'Rogues Gallery' of sorts in the archives anytime soon? It would be nice to see a face connected to the postings here. Some of us don't get the chance of getting out west for the parties, The only other thing I know about Tim May besides being one of the Fathers of the Cypherpunks is that he was a naked hippie in a hot tub at some party that Robert Hettinga was at some weeks ago, That doesn't paint a good picture for me. Thanks, A.E.N.

1 0

Re: The Problem With Blaze And Weinstein
by blancw＠accessone.com 17 Dec '03

17 Dec '03

>From the Fool on the Hill(aka ECafe): ATT and Netscape are both tools of the CIA/NSA. Blaze and Weinstein are in on the plot to force GAK upon us.... ..Only true visionaries like myself and Dr. Frederic B Cohen are telling it like it is; everyone else has had the wool pulled over their eyes by the NSA/ATT/Netscape axis. ................................................... Surely you're joking, Mr. Feynman! Cpunks, do you not "get it" - This has to be a jest, poking at some of the attitudes which have been expressed on the list. I think it's a bit late, though, as most of the excitement has calmed, and this must be why it's not recognizable. (if you think it's worth a comment, at least make it *funny*!, right.) .. Blanc

1 0

Re: on web standards: sent to Markoff
by blancw＠accessone.com 17 Dec '03

17 Dec '03

Attila: I'm surprised at you. I thought you were anarcho-capitalist. Oh, well; I have a few pithy comments in reply to your post (but anything beyond this will be in private email). I'm tempted to say back to you, as you just recently stated: "if you have not walked in the other's shoes, keep silent." Have you read any of the books on Microsoft or Bill Gates? I think this would provide you with additional perspective on your conclusions about him and the company. But think about this: . no company which MS has done business with has been coerced into dealing with the company and its products. Those who felt compelled to do business on Billg's terms were influenced by their desire to reap the lucrative benefits of it. . no customer has been coerced into purchasing the products offered; they were not prevented from shopping for computers from companies which do not pre-install the OS; if it was already installed on the machines they purchased, they were free to delete it, they were not coerced into using it or into upgrading to the next release. . not only have many software companies not take advantage of the opportunities created for cashing in on the unexpected popularity of MS software, . there have been occasions where competitors failed to see opportunities in the market which Microsoft did and took aim for, or . attempted business deals/associations among competitor software companies did not come about, thus failing to create a concerted competitive threat to Microsoft, or . a dominant software product from a competitor suffered in the market place, (sometimes from the fault of "bad management"), thus again giving the advantage to Microsoft. Often it has been what the competition *didn't do*, which gave Microsoft the advantage in the "market place", rather than any amazing magical business savvy or "unethical business practices". Nevertheless, as someone at MS said, "it isn't the customers who are complaining". There have been many willing participants, apparently, who have cooperated (or "conspired", if you will) in making the company the success which it has become. And continue to do so. .. Blanc p.s. Nuri-logical: I like your idea for a "dog-eat-dog" welfare fund.

1 0

Re: The Problem With Blaze And Weinstein
by Greg Broiles 17 Dec '03

17 Dec '03

At 01:12 AM 12/21/95 GMT, "Bill Gates" wrote: [...] >Evidently the cypherpunks are all too impressed >with Blaze and Weinstein's master degrees to see >what's really happening. Only true visionaries >like myself and Dr. Frederic B Cohen are telling >it like it is; everyone else has had the wool >pulled over their eyes by the NSA/ATT/Netscape axis. > >It's amazing how clear everything becomes once >one stops taking the medication that THEY prescribed. > >s/ Bill Gates Oh, I see. I think you misspelled "troll". Hope this helps. -- "The anchored mind screwed into me by the psycho- | Greg Broiles lubricious thrust of heaven is the one that thinks | gbroiles(a)netbox.com every temptation, every desire, every inhibition." | -- Antonin Artaud |

1 0

Re: The Problem With Blaze And Weinstein
by cpunk＠remail.ecafe.org 17 Dec '03

17 Dec '03

I was not interested in starting a flame but I seem to have ignited one. I'm sorry about that. Since almost nobody sees these people from big corps as having a conflict of interest by being here I am willing to drop the subject having raised the point. It just seemed funny to me that cypherPUNKS would be so happy to have these fortune 500 types running the show. I guess I see the point that these people have something to contribute as long as they are honest about who they are. I have to say it rubs me wrong though. Like I said I've written a lot of code in my day and many of you are probably running some of it while you read this (enough said). I just don't want to depend on att or netscape to protect me. Even if they do a good job the cost of using their stuff is too high (for example the fine print in that att product). Lets write our own code and gpl it so no one can take it away! s/ Bill Gates

1 0

Re: COMMUNITY CONNEXION PIONEERS PRIVATE ELECTRONIC COMMERCE
by Robert Heffren 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On 19 Dec 95, sameer <sameer(a)c2.org> wrote; > COMMUNITY CONNEXION PIONEERS PRIVATE ELECTRONIC COMMERCE > Community ConneXion today announced a new service for its customers > which will make secure, private electronic commerce more accessible > to all merchants, from the small single-person business to large > corporations trying to sell goods and services over the > world-wide-web. There went the neighborhood. The Prez and the Coalition on one side and big biz on the other. AOL and their stings, all the motherfuckers spamming the piss out of everybody else and every place you turn, some swinging dick wants to put his goddamn hand in your pocket. Fuck it! Shut this sonfabitch down and take up doll-collecting. Who NEEDS this bullshit! Unsub this bastard AND gone; -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMNlMrBMzypiVqpjNAQG/fAL9GS5NiWR/5mb+KbKwxp2wSB6MUliwJaEV uBb+a7F5s7PQ0lQEWfujPKIoaF/iCB0zRKN0yLWCuvNiQe3YWMnwn5WggPekDRPl 0b3u37WHmeCKyhamMixnyK4w7jjT2use =WaxG -----END PGP SIGNATURE-----

1 0

Microsoft Flame[tm] [NOISE]
by roy＠cybrspc.mn.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- There's a lot of finger waving going on over Microsoft's alleged predatory practices. I just want to remind the pro-MS folks of something. Microsoft has a documented track record of using undocumented entry points in their OS and Windows products. These entry points allow MS apps to do some things more efficiently than a competitor which uses the published API. MS has been known to rearrange these undocumented calls, resulting in sudden incompatibilities with competitors. (remember when Win3.1 came out and DR-DOS was suddenly unable to run Windows?) And in the MS countersuit against Stac Electronics, MS successfully argued that undocumented system calls were protected as Trade Secret material. While this isn't the grand-scale conspiracy some people seem to see, IMHO it's still predatory. Perhaps the call to separate the OS and apps divisions is a good idea. It would be interesting to see if Microsoft could maintain its edge in applications when it had no sub rosa advantage in OS access. - -- Roy M. Silvernail [ ] roy(a)cybrspc.mn.org PGP Public Key fingerprint = 31 86 EC B9 DB 76 A7 54 13 0B 6A 6B CC 09 18 B6 Key available from pubkey(a)cybrspc.mn.org -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMNlXShvikii9febJAQFoGgP/YtHdGqO8++MfZmk3h61F8SmJBfPYfa1R JlccdIP9BZHVXZseao9b9DqxLY1xRYkK6fWETielJaSjXZKam1WlYKFzL5E8Hf1z IXQmj7rCIIfvqvq3byJq8B3IUbT4UnTMNDAHVlNUwkzrcJ+py8czsWtNy15g3ahY NzYL8UsOtwI= =MpV3 -----END PGP SIGNATURE-----

1 0

cyphernomicon
by avatar＠mindspring.com 17 Dec '03

17 Dec '03

If anyone is interested I would be willing to e-mail a copy of the cyphernomicon to you. BEWARE that it is 1.3MB in file size and 414 pages in text. Charles Donald Smith Jr. 582 Clifton Rd. N.E. Atlanta, Ga. 30307-1787 (404)-378-7282

1 0