December 2003 - cypherpunks-legacy

Re: FBI Wants to Wiretap One of Every 100 Phones in Urban Areas
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:03 AM 11/3/95, clark.matthews(a)paranet.org wrote: >Thanks for this item! Two little excerpts jump out at me. They follow: >> Last year, federal and state courts authorized 1,154 wiretaps, of which 48 >> percent .... >> "People are starting to say that seems awfully high," Dempsey said, noting that >> the overall level of such surveillance activity is now a total of 20,000 >> to 25,000 intercepts nationwide over an entire year. >So what is it? 1,154 wiretaps? Or 20,000? Perhaps that's 1154 wiretap victims, with an average of 20 intercepts each? In a separate article, Clark posted estimates that ranged from 500K - 1.5M people could be wiretapped, depending on how many people are in the 1%/.5%/.25% zones. It's worse than that - if they're tapping the average victim for (say) 3 months, that's 4 times as many victims.... And just how many cops do they plan to hire to watch all these phones? Computers can help some, especially for data, but who's going to read it all, even after the fancy pattern recognition systems pick out the possible good stuff. >FBI Director Louis Freeh testified under oath to 1,157. The FBI was asked >for the data to support those numbers. The FBI refused to release them >until the year 2002. [....] >One last thing. >What's so special about the year 2002? Statute of limitations? :-) #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

Re: video as a source of public randomness
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:23 AM 11/3/95, JMKELSEY(a)delphi.com wrote: >>From: tcmay(a)got.net (Timothy C. May) >>Subject: Re: Video as a source of randomness > >>Digitized video input, especially from something like a noisy channel (t.v. >>channel, for example), is quite likely to produce a lot more entropy bits >>per second than nearly any of us ever need. (One's PGP key could be seeded >>in a fraction of a millisecond, for example.) > >This seems like a potential source of a stream of public random >bits. If these can be authenticated and matched, this kind of thing >can be useful in a lot of protocols. For example, if there is some I'm not sure what you mean by "public random bits"...I don't plan to share my random bits with anyone, nor do I see any need for "public" random bits (except for some well-known situations involving statistical testing, for which certain PRNGs are actually preferable to "real" random numbers). And so there's no confusion, when I said "like a noisy channel (t.v. channel, for example)" I meant a snowy, noisy picture such as one gets with rabbit ears on top of the set, especially when the channel is an unused one. It is unlikely in the extreme that any attacker could deduce the snowy pixel values used in the distillation of entropy. (I'm not claiming this is the most practical source of randomness; I was just responding to an earlier post about this.) But back to the subject of "public random bits." Could you elaborate on what you mean by this? (I assume you don't mean a one time pad that Alice and Bob share, since that is really a separable issue from video as a source of randomness. Only one of them will generate the pad, and will then securely communicate it to the other.) What am I missing? --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

SSZ Test [No Reply]
by Jim Choate 17 Dec '03

17 Dec '03

Check Check Test No Reply

1 0

Re: FBI seeks huge wiretapping system
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:09 PM 11/2/95 -0500, Phill Hallam wrote: >On telephone tapping the statement was made that they do not allow >unauthorized taps and that technology was making wildcat taps by >local officials harder. Which makes sense. At least for the moment, wildcat taps have become much easier, since radio-tapping cellular phones is straightforward. >It is a fair point that just because technology has changed the >nature of the game it should not mean that wiretaps cease to be >possible. Back before telephones, you could steam open someone's mail if they sent it by the government post, but it was a lot harder if they sent it by private messengers, and they could always send it in some pre-arranged code. And you could always hang out under the eaves of their houses listening for conversations, but they could always check for themselves or talk while walking down the street. It's a fair point that just because technology has made it easier for eavesdroppers and mail-snoops today doesn't mean that private conversations should cease to be possible, or that we shouldn't be able to use technology to preserve the security of our papers and effects. >What is very odd however is the FBI request for $500 million. This is >a somewhat large quantity of money to say the least. The telephone >switches are programmable these days, it should be possible to >provide tapping at substantially less cost. $500 million is a drop in the bucket; they're talking about wedging themselves into multiple places in the telephone system, taking up to 1 percent of the capacity (without compensation as near as I can tell), and they want the ability to do all this without the inconvenience of going out to telephone wire offices where somebody might ask to see a warrant. >Mind you the Federal government is not known for tight cost control. Indeed :-) >The NSA reconned that a DES cracker would cost substantially more than >$1 million because the system costs would be much higher than the component costs. .... > Anyway the NSA price estimate was "two or more orders of magnitude more in cost" Wiener's design was about two orders of magnitude cheaper than Wayner's and the DEC guy's designs, which were in turn far cheaper than any previous. But it's a believable design, and could probably be done within a factor of two-three of his cost predictions; "system costs" need to include things like wiretapping equipment to steal and record the data to be cracked, and government employees to operate it, and bureaucrats and politicians to tell them what to do and who to target, and lots of real estate for them all. But to reach two or more orders of magnitude cost increase, I'd think you'd need a far bigger collection of cracking machines that Wiener's - perhaps to crack a few hundred keys per day. Interesting comments on banks' use of DES for authentication rather than privacy.... of course, if the government wants to tap banks' conversations, it can generally just demand that the banks tell them the information, at least for US-based and other cooperative banks. >If the NSA want a cheap DES cracker they have my number. I'll take 5% >ot the difference between the actual cost and $100 million (their >estimate of cost) as my fee. As Rodney Dangerfield said "Well to start with, you gotta throw in 10% for graft and corruption." #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

FBI Wants to Wiretap One of Every 100 Phones in Urban Areas
by Lee 17 Dec '03

17 Dec '03

FBI Wants to Wiretap One of Every 100 Phones in Urban Areas By MATT YANCEY Associated Press Writer WASHINGTON (AP) - The FBI wants the capability to simultaneously tap one of every 100 phone and data transmission lines in major urban centers, but a top Justice Department official said there are no plans to expand the existing number of wiretaps. As part of its effort to deal with a new breed of computer-savvy criminals adept at using new telecommunications technologies, the FBI said it wants phone companies to initially set aside 0.5 percent, or one of every 200 lines, for law enforcement use in high-crime urban areas. But it added it also wants the ability to rapidly expand that capability to one of every 100 lines if the need arises. The disclosure was made in a little-noticed announcement in the Federal Register. Despite the notice, Deputy Attorney General Jamie Gorelick said today, "There is no intention to expand the number of wiretaps or the extent of wiretapping .. . I don't think the American people should be worried about that." Last year, federal and state courts authorized 1,154 wiretaps, of which 48 percent were sought by federal agents. Increases in recent years have mostly come in drug trafficking cases. Gorelick acknowledged: "As we've gotten more aggressive in the drug war, as organized gang activity has been an increased focus for us, we've seen a slight increase." The FBI proposal, unveiled on three pages of the thick daily compendium of federal regulations and other government activities for Oct. 16, had been long anticipated since the passage last year of the Communications Assistance for Law Enforcement Act. "The entire purpose of the digital telephony legislation was to leave law enforcement in the same position it is now with respect to wiretaps: That is, to ensure that emerging digital technology would not defeat current lawful wiretaps," Gorelick said, noting that court approval would still be required for any wiretap. "There appears to be some misunderstanding or miscommunication as to the implications of what is contained in that notice." But experts familiar with the law did not expect the FBI's reach into the world new fiber optic cables, digital switches and high-speed modems for transmitting business transactions as well as voices to be so sweeping. "The level of capacity that the FBI is proposing here would come as a surprise to many who supported the legislation," said James X. Dempsey, deputy director of the Center for National Security Studies, a group that monitors government surveillance activities. While the federal notice does not specify which cities would be targeted, Dempsey said New York is likely to be one of them. Assuming there are 2 million separate phone and data transmission lines there, that means the FBI wants the ability to tap 20,000 of them simultaneously, he said. "People are starting to say that seems awfully high," Dempsey said, noting that the overall level of such surveillance activity is now a total of 20,000 to 25,000 intercepts nationwide over an entire year. The FBI said in its official notice that its capability needs were based on "an historical baseline of electronic surveillance activity" after surveying federal, state and local courts, prosecutors and police agencies. It did not offer a further explanation, but during hearings over the past four years leading to passage of the 1994 law, FBI and other officials cited the growing incidence of computer-based crimes. The law was intended to remove what law enforcement officials have considered a major impediment - the growing obsolescence of the copper phone wire - in probing drug trafficking, organized crime, terrorism, kidnaping and sophisticated new types of white-collar crime. "Without this bill ... we would have been completely prevented in a very short time from carrying out any court-approved wiretapping," FBI Director Louis Freeh said at the time. While law enforcement officers will still have to get court approval for any wiretaps they install, the technological measures authorized by the law would remove the objections of some judges. Copper telephone lines were relatively easy to tap because they carried only one conversation. But digital switches and fiber optics now in growing use often carry hundreds of conversations or data transmissions at the same time, making it difficult to isolate a single phone line. The law authorized $500 million for the government to pay the phone companies their cost in installing the necessary technology, but none of the money has been appropriated. And with increased criticism focused on the FBI for its role in the 1993 Branch Davidian siege in Waco, Texas, and the 1992 deadly standoff against white separatist Randy Weaver in Ruby Ridge, Idaho, there is no assurance Congress will be forthcoming with the money. Legislation sent by President Clinton to Congress seeking greater wiretap authority in the wake of the April bombing of the federal building in Oklahoma City is languishing in congressional committees and is given little prospect of being passed this year. http://www.trib.com/NEWS/HEAD/FBI.html

1 0

>>>AN IMPORTANT MESSAGE TO PARENTS!! PLEASE READ!!<<<
by dbhait＠juno.com 17 Dec '03

17 Dec '03

I love my Son!! When he is away I want to talk to him on a regular basis. Unfortunately, when he calls home collect is cost me over $1.00 per minute, plus surcharges. I would attempt the old switcho-chango, having to refuse the collect call and call him back, but that still added up to over .20 cents per minute. Significantly cheaper, but still expensive, and a pain in the rear. Not long ago, someone introduced me to a new long distance service! Initially, I wanted him to go away, just like I feel about insurance salesmen, but what he had to offer was amazing!!! 1) A 9.9 cent per minute rate, 24 hours a day, 7 days a week! 2) An 800 or 888 number direct to my house for only $1.50 per month with the same 9.9 cent rate! 3) A NO SURCHARGE calling card, with rates as low as 17 cents per minute! 4) 1+Long Distance Dialing so I didn't have to enter 26 additional numbers to get out! 5) Simple Billing, right on my current phone bill 6) Up to 40% Savings on International Calls 7) Nearly 90% Savings on Phone Cards compared to ATT, MCI, or Sprint!! 8) A Motorola Pager that works throughout the Entire United States! 9) Best of All..A 100% FREE Business Opportunity where I can generate a Large Second Income!! Well I took the offer and now my Long Distance Bills are cut in half or more!!! And the best part is, I get to talk to my son as often as I want without worrying about how much it's going to cost me. Now it's only 3 weeks later...I took my friends advice on the FREE BUSINESS OPPORTUNITY, and already I have 34 people signed up, and they get the same savings as me, as well as the FREE OFFER!! And what rewards!!! I get 2% commission on everybodies long distance bill that I refer, and that others refer. If I tell only 3 people and they tell only 3 people, I will be earning thousands of dollars a month, every month!! Do you have kids away at school? Have your kids grown and moved out of state? What about the rest of your family? When was the last time you took a good hard look at your phone bill? Isn't it time to start saving money? Whether you're interested in the business or not, I encourage you to accept this invitation! Here's another invitation!!! GET A FREE $10.00 PHONE CARD and test the service, it won't cost you anything. And if your interested in joining my success team, I'm going to offer you the following to help you get started! 1) A FREE Personalized Web Page 2) FREEDOM Bulk Emailer worth over $400.00 3) CHECKR Software worth over $200.00 4) A Very Large Contact List of Names 5) A FREE Marketing Kit, including sample letters and templates 6) One on One personalized training and support from myself (I did sign up 34 people in 3 weeks) 7) A list of over 2000 sites on the Internet to advertise FREE or close to FREE! 8) and Much, Much More! If you're interested in an immediate response for more information, please respond to netbiznis(a)answerme.com. If you would like me to send you more information, send me your name, address, phone number, and email address to fretel(a)juno.com or call me at (414) 669-3722. Thanks for your time, and I look forward to hearing from you soon. Respectfully Yours, Dan Hait ID# AH603800 (414) 669-3722 fretel(a)juno.com

1 0

800_ape
by John Young 17 Dec '03

17 Dec '03

11-5-95. NYPaper Sunday Magazine: "Making Microsoft Safe For Capitalism. How do you restrain an 800-pound gorilla?" Cover story. By James Gleick. If the software giant has its way, it will soon be in a position to collect a charge for every airline ticket you buy, every credit card purchase you make, every fax you send, every picture you download, every Web site you visit. It's time to draw the line. But where? 'Anything not a direct lie or clearly illegal is O.K. to do if it advances Microsoft's tribal cause,' Mitchell Kapor says. 'This licenses the worst sort of manipulations, lies, tortured self-justification and so on.' 800_ape (Long)

2 1

ICE Summary
by cmckie＠ccs.carleton.ca 17 Dec '03

17 Dec '03

Summary of the the 2nd International Cryptogrpahy Experiment (ICE) Workshop, Shape Technical Centre, The Hague, Sept.18-19, 1995 http://www.tis.com/crypto/ice/summary.html

1 0

PGMedia Challenges U.S. Government's Claim To Control Of The Domain Name System
by pgp＠pgmedia.net 17 Dec '03

17 Dec '03

Press Release September 18, 1997 PGMedia Challenges U.S. Government's Claim To Control Of The Domain Name System NEW YORK, NEW YORK: PGMedia, Inc. d/b/a name.space(tm), the New York-based company which sued Network Solutions, Inc. ("NSI") (the holder of the monopoly in commercial Internet Domain Name Registrations) for violations of U.S. antitrust laws in March of this year, has amended its Complaint in that case to join the National Science Foundation ("NSF") as a party-defendant. While PGMedia steadfastly believes that the National Science Foundation has no authority to restrict or forestall the complete opening of the Domain Name Registration market which PGMedia seeks in its case against NSI, over the last three months, the NSF has injected itself into the Domain Name dispute by claiming (on behalf of the U.S. Government) to exclusively control the Domain Name System. The NSF has exerted this control to prevent NSI from acquiescing in PGMedia's demand for access to the market. Again, PGMedia believes that the NSF possesses no such control or authority, but even if it did, such actions have the clear effect of limiting freedom of expression in the first and foremost avenue of speech on the Internet -- the Domain Name. Thus, either the NSF has no authority, and NSI should be allowed to comply with Federal and state antitrust law in settling with PGMedia, or the NSF must, pursuant to the First Amendment to the U.S. Constitution, acquiesce in PGMedia's demand to unlimited and shared Top Level Domain Names. The name.space(tm) Service PGMedia's name.space(tm) service(http://namespace.pgmedia.net) was launched in August 1996 to offer Internet Domain Name Registration Services in competition with NSI under virtually unlimited Top Level Domain names. That is to say, while NSI has forced Internet users to register their names under .com, .net and .org, name.space(tm) offers the full range of expression, in virtually any language, in the top level namespace. In addition, and significantly, name.space(tm) claims no exclusivity with respect to the right to register under any TLD. Indeed, PGMedia has developed software and code to allow multiple registries to register names under the same TLD. Unfortunately, until NSI changes the so-called "root zone file" (or directory of directories) which resides on its root name servers, the name.space(tm) top level domain names will not be universally resolvable on the Internet. Until NSI makes that change, only users who have visited the name.space(tm) web page and downloaded the self-executing application which points their browser to the name.space(tm) servers first can use a name.space(tm) domain name. PGMedia sues Network Solutions to Open the Domain Name Market In March 1997, after NSI refused PGMedia's request that reference to the name.space(tm) name servers be added to the root zone file, PGMedia sued NSI in Federal District Court in the Southern District of New York seeking, among other things, to compel NSI to add the name.space(tm) TLDs and nameservers to the root zone file. Initially, NSI refused, claiming that Dr. Jon Postel, of the so-called Internet Assigned Numbers Authority ("IANA"), was the only person who could add a TLD to the root zone file. However, after several discussions with PGMedia and its counsel, NSI proposed allowing unlimited TLDs, but only if the National Science Foundation had no objection. PGMedia has consistently contended that the NSF has no more of a place in this debate than any other interested party, and could not act to arbitrarily limit speech in the top level name space even if it did. In June and again in August of this year, the NSF informed NSI that the NSF controlled the root zone file, and that the NSF could not allow NSI to comply with Federal and state antitrust laws in granting PGMedia's reasonable request. With today's addition of the National Science Foundation to the case, the issue of who ultimately controls the Global Internet is squarely before a Court of competent jurisdiction. In addition, the arbitrary restriction by the U.S. Government of freedom of expression in the top level name space may soon finally come to an end. For more information, contact: law(a)pgmedia.net Or call (212) 677-4080

1 0

using pgp to make an otp
by amp 17 Dec '03

17 Dec '03

-- [ From: amp * EMC.Ver #2.3 ] -- -----BEGIN PGP SIGNED MESSAGE----- greetings c-punks, i may have posted this at some time in the past, as i have asked it elsewhere and gotten different responses. i'm interested in that the folx here think about it though, so here it is... i want a source of data for use as a otp. i don't want to have to hook up any external devices to my pc to do it. (although some of the methods mentioned in the past few days are quite interesting.) i'd like to know if there was a reason not to use the output of pgp to do it. i've been playing with the following method. i take a file and encrypt it to a key with the '-a' flag on. this generates an ascii file that is easily editable using simple, standard rexx calls. i strip the first 20 or so lines and the last 20 or so lines and put the resulting file aside. then i perform the same operation again and append the file to the previous result. i repeat until the file is sufficiently large for my purposes and then give the resulting file to the person(s) i want to have it. i still need a program to make use of the otp i've produced, but havent gotten that far as this is still pretty much a thought experiment and something for me to waste time with. once i'm ready to make use of it i'll either find a program or attempt to write something to use to make the data i've generated useful. i would think that the output of pgp should be pretty darn random. if it isn't, then it's usefulness is less than its reputation imo. as you can tell if you've read this far, i'm not a cryptographer. i just like the stuff and am working to become more proficient in its use as i think it is important if we are to maintain our privacy in an increasingly digital world. what are the holes in this? why would it be unadvisable to do it? otoh, would it be a good basis for a otp? amp <0003701548(a)mcimail.com> <alan.pugh(a)internetmci.com> PGP Key = 4A2683C1 November 5, 1995 1:16 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMJxWxigP1O9KJoPBAQFzxggAmRyJlfZVt8s6shqkkvFxmSpJdyZvaSEw O/hQEb5fJK4FuxZaIyw2Enp4Ca1/vGeEaw1Zc8JM2wSk2Km4Vjl7zlJjmIpOJ6Nw QAJfpHwwz77NMpMiWLj/m9nwkBeQs3IPcgDywIBu2Hfw6o79bndUS+GbEoG0f/+L jH7y0bZ+pNX/fLYaPZRnPPGVDqPn7VkfuvByT5Op5rNbHU56kSneW3bC79M1SO3K sYXpdGYU6mWC5xbYq1eQI9sCpkdB4pftMC3cizvKdueXGTMnXbngwBnu+Hk7GONz KOx9x6rWPJ/NBTJONiz4Scg28XelnziBP5OYXSWzBNFBoauZpcK0MQ== =8lYe -----END PGP SIGNATURE-----

5 5

Re: alt.anonymous.messages considered harmful
by loki＠obscura.com 17 Dec '03

17 Dec '03

I will feed alt.anonymous.messages to ANYONE who asks. I will accept a feed of that one group from any news server which is used by a remailer. -Lance At 1:13 PM 11/2/95, Futplex wrote: >Name Withheld by Request writes: >[re: problems with the Usenet newsgroup model of pseud/anonymous message pools] >> Denial of service attacks could be made somewhat less feasible by >> making the pool accessible as a mailing list and via http. > >Mailing lists of course suffer the problem of strictly limited participation. >The web approach might work better, in some future with better privacy- >protecting infrastructure in place. Specifically, if HTTP transactions with >a popular web server were routinely encrypted, then all reasonably long >visits to that site would act as cover traffic for a message pool on that >server. As a bonus, you could have a spiffy form on the web page that >searches the pool for you. > >In any event, the server could log your exploration. This returns us to the >issue of strongly anonymous web proxies. (And we could imagine >countermeasures, like daemons that search for randomly selected pseudonym tags >to muddy the waters. As Tim might say, lots of issues.) > >Also, the mention of "as a mailing list _and_ via http" is significant. Making >the pool available in multiple forms seems to be an unconditional benefit. > >-Futplex <futplex(a)pseudonym.com> ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

Re: The great GAK crack (making GAK economically impossible)
by geeman＠best.com 17 Dec '03

17 Dec '03

This seems to ignore a possible worst-case scenario, in which the only products which are ultimately approved wrap the key using a special law enforcement key, for example. If the Powers that be can mandate "escrow" --- really GAP, Gov't Access to Plaintext --- then it can be mandated to take a particular form that is defined to be tractable. At 05:25 PM 9/15/97 -0700, Tim May wrote: > >At 8:41 AM -0700 9/15/97, nospam-seesignature(a)ceddec.com wrote: >>If I have to GAK my keys, and there then exists a pgp-gak, then we simply >>recruit the same CPU power that generated the millions of DES keys to just >>run pgpk-gak with the shortest keylength and send billions of keys to the >>GAKserver each week. Many from out of the US if pgp-gak becomes available >>there. >> >>My test software uses a loop that generates a new pair every few seconds >>on a pentium (and found some very obscure bugs). I would be required to >>send all those to the gak.gov. If they really want them... >> >>What it probably means is the govenrment will issue keys or have to >>license people to create them. > >"There ain't no such thing as free escrow." > >Some fee will be collected to register keys. "To defray costs" (never mind >that the government is the party _requiring_ the damned escrow!). > >This will stop the "flooding attacks" which a free key escrow system would >generate. It will also, sadly for us, put an end to many applications where >keys are generated quickly, transiently, and on an ad hoc basis. There >simply will be no time to register the keys, and the $10 (or whatever) >processing fee will be unacceptable for these applications. > >--Tim May > >There's something wrong when I'm a felon under an increasing number of laws. >Only one response to the key grabbers is warranted: "Death to Tyrants!" >---------:---------:---------:---------:---------:---------:---------:---- >Timothy C. May | Crypto Anarchy: encryption, digital money, >tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero >W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, >Higher Power: 2^1398269 | black markets, collapse of governments. >"National borders aren't even speed bumps on the information superhighway." > > > > > >

2 1

[political NON-noise] Re: Crypto & Taxes
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:03 AM 11/4/95, s1113645(a)tesla.cc.uottawa.ca wrote: >Not that I want to get into a big political discussion, but David Friedman >has a nice, calm and rational book called The Machinery of Freedom, 2nd ed, >which argues anarchism/libertarianism from an economist'spoint of view. >The argument is not cased in terms of ethics and morals but rather >economic efficiency and utility. Slim, easy to read and cheap. He also >has a good sense of humor. Unfortunately the book is currently on back order. >I'm holding on to my library copy until they ship one to me. David Friedman is now teaching law at Santa Clara University, over in Silicon Valley. We've been in contact, and expect to meet for dinner sometime soon. (He attended a special Cypherpunks meeting a few years ago.) >You can butt heads with him and Tim on the cyberia list (I don't remember >the address but they have it at news://nntp.hks.net ) Ah, but the Cyberia list is a _law_ list, and political discussion is discouraged. >I gather from the cyphernomicon that someone recently converted him to >cryptoanarchy. His "Machinery of Freedom" and many other articles clearly establishes him as a leader in this area. He didn't previously know a lot about strong crypto, but now he sees that this makes many of the abstract ideas of "Machinery" near at hand. Vernor Vinge believes the same thing. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Many Topics are Appropriate for Discussion Here
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 10:35 PM 11/3/95, hallam(a)w3.org wrote: > Just a calibration point. The libertarians on the list do not seem >to shrink from expressing their political views. Indeed the entire discussion >on the NSA is a political thread pure and simple. My post related directly >to the question of personal privacy rights in a democratic, plural society. >I do not regard that it was off topic in any sense. I was not aware that >any agreement was in effect as to the method by which goals might be >achieved. I chose to persue goals by the means most likely to succeed. In >that I am a pragmatist. Government regulation often provides social benefits >it is not by definition an evil to be avoided. In any case regardless of the >rhetoric government regulation increases, I prefer to press for some >regulations I like rather than dream about there being none whatsoever. I for one have no problem with left-leaning (that is, nonlibertarian :-}) folks expressing views. That libertarians tend to be the most vocal and perhaps most articulate advocates of strong crypto is only a trend: I know of several left-leaning folks who strongly push crypto. We happen to disagree on some points, but agree on others. On this list, Dave Mandl and Rich Dutcher (probably no longer subscribed) have represented somewhat leftist views. The late John Brunner was a particular favorite of mine, whose "Stand on Zanzibar" was an utter masterpiece, and whose "The Shockwave Rider" was of course a major influence on many cyberspace privacy advocates. And yet he called himself a leftist and was strongly opposed to the corporate state. As I am, by the way. Much of the power of very large corporations comes from the power of the State enforcing certain franchises and monopolies granted to them. (Intellectual property laws are largely such franchises---if one doubts this, imagine a return to the era of the guilds, where the silversmith's guild could physically block other people from smithing silver, and so on for all of the guilds. Modern intellectual property law works mostly the same way, giving to Apple or Sun or Intel the control a "truly free" market certainly would not.) > I do not separate the question of politics from technology. My >reasons for working on the Web have from the start been explicity political. >I regard the persuit of technology without consideration of the political >consequences to be unethical. I agree. And though I have been called an "ethical monster" for pushing my agenda for crypto anarchy, I agree that one must always consider ethics and politics in technological matters. (I suspect we disagree about many conclusions of this view, however.) > I am only in a position to influence the political process if I >understand the position of the administration and can demonstrate an >appreciation of their concerns. As Sun Tsu said "you must build a golden >path along which your enemies may retreat". The problem with government >is not that it is a conspiracy, it is an interlocking series of >beuraucracies which all seek to avoid responsibility. I view governments as just another example of an organism or system which perpetuates itself. It's in the genes. Evolutionary game theory, etc. > If you want to get Phil Z. off the hook or foul up the governments >escrow scheme plans you have tobe prepared to step into their mindset >and walk about on the inside a bit. somewhere inside the government there is >a jobsworth who is deciding to hassle Phil Z., this person will be a civil >servant, not a political appointee. Ie the dregs which get left behind each >time there is a new administration. What we need to do is to identify that >person and nail their ass to the wall. It has to become apparent to the >administration that that individual has created an unnecessary source of >embarassment. This I think we have been already been doing a pretty good job at. I have been on panel discussions with Stewart Baker, former chief counsel of the NSA (and now with Steptoe, a D.C. law firm, and still active in pushing crypto legislation), and Ron Lee, the current chief counsel. And I spotted Dorothy Denning's deep involvement several years ago. Ditto for key escrow. And of course John Gilmore, Phil Karn, and others have been very active in "nailing their asses to the wall," so to speak. > If somone makes contiuous political spiels themselves but object when >I make one they disagree with (as one person has done) I am not going to take >their objection as indicating anything other than an inability to argue their >case. As this post should make clear, I certainly don't object. I doubt I'll have any energy to argue things I argued for the first time almost 30 years ago, but I'm very interested in the nuts and bolts of how strong crypto will affect institutions and policies. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Sources of randomness
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:04 AM 11/4/95, Peter Monta wrote: >Perhaps there ought to be a couple of standard random-bit-source >implementations, say at the CMOS-standard-cell and board-subsystem >levels, that are widely vetted and trusted (and used!). But it's >mostly a solved problem, seems to me. This is something John Gilmore called for when he wrote: At 9:50 PM 9/20/95, John Gilmore wrote: >Software-generated random numbers are likely to be of poor quality. >There just isn't that much true randomness visible to computers. >Several ways to build good hardware random number generators are >known. But before hardware random number generators can be >incorporated into common desktop computers, someone will have to put >them into a small fraction of a chip. > >Currently, random number generators are chips or larger circuits. >Nobody will pay to put these on a motherboard. But if a random number >generating circuit occupied 1/1000th of a CPU chip or "multi-function >I/O" chip, cost would not be a reason to leave it out. > >You probably can't build a hardware random number generator out of >existing "gate array" gates or "standard cell" cells, because all the >existing gates and cells are designed to behave completely >predictably! It will take designing a new circuit structure. > >Do we know any solid state physics / circuit design experts who think >this might be a fun thing to do? I bet you could get a paper out of >it. And probably improve the world a few years later, when companies >used your paper to close another hole in their computer security. > > John There were several other posts in this thread, so interested folks might want to check the archives for this time period. Continuing on with Peter Monta's post: >A radioactive source might be okay at the board level (though probably >costlier than its electronic counterpart), but it'd be a pain to >integrate, and it might disturb the rest of the chip. (I'd like to >have a get_random_bit instruction as part of a microprocessor, for >example.) Also if you want a high rate of random bits, you need many >decay events, whereas for electronic sources the corresponding >bandwidth is free---Johnson and shot noise are flat to 1 THz or so. I agree, for several reasons. First, I agree that electronic noise sources are easy to build, easy to get licenses for use (basically, no licenses, unless the ITAR boys decide random number generators are munitions--maybe the "This t-shirt is a munition" could have "export-controlled dice"? Second, the ease of integration as a standard library module. However, getting the chip companies to do this will not be easy. They generally don't see the need (hey, even _we_ don't, given the diverse opinions on what is needed). This is why many of us favor an external dongle that plugs in somewhere. Then it could be sold cheaply and not have to get "buy-ins" from industry and committees. One idea is something that superficially looks like a modem, as everyone has modem software and ports (though I suppose many people use internal modems and so can't easily access it.) One would attach the "RNG-modem," a little dongle, and grab noise into a buffer for processing (hashing, filtering, etc.), or as ASCII garbage. (Before anyone jokingly asks about "1-800-RANDOMS," I've thought of it. Not practical, for obvious reasons.) A purer approach would be just a noise source dumped into dev/random, or whatever one wishes to call it. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: alt.anonymous.messages considered harmful
by futplex＠pseudonym.com 17 Dec '03

17 Dec '03

> >Specifically, if HTTP transactions with > >a popular web server were routinely encrypted, then all reasonably long > >visits to that site would act as cover traffic for a message pool on that > >server. > > Qua? The "length" of the visit is just the time to download a document. > Leaving a page in the browser window doesn't generate traffic... You're absolutely right. I wasn't thinking sensibly about HTTP. I wanted to make an argument about the time it would take to search the pool and serve a results page. But upon reflection, I don't think that even holds up under my HTTP delusions of yesterday, let alone a realistic view. Please ignore the "reasonably long" part of my previous statement. Thanks for pointing that out. -Futplex <futplex(a)pseudonym.com>

1 0

Re: FBI Wants to Wiretap One of Every 100 Phones in Urban Areas
by clarkm＠cnct.com 17 Dec '03

17 Dec '03

Thanks for this item! Two little excerpts jump out at me. They follow: > Last year, federal and state courts authorized 1,154 wiretaps, of which 48 > percent [snip] > "People are starting to say that seems awfully high," Dempsey said, noting > that > the overall level of such surveillance activity is now a total of 20,000 > to 25,000 > intercepts nationwide over an entire year. So what is it? 1,154 wiretaps? Or 20,000? FBI Director Louis Freeh testified under oath to 1,157. The FBI was asked for the data to support those numbers. The FBI refused to release them until the year 2002. The FBI is being sued under FOIA to support Freeh's sworn testimony. (Of course, he used different numbers at different times....) One last thing. What's so special about the year 2002? .---. .----------- * :::::::::::::::::::::::::::: / \ __ / ------ * clark.matthews(a)paranet.org / / \(..)/ ----- * :::::::::::::::::::::::::::: ////// ' \/ ` ---- * //// / // : : --- * PERMISSION TO \\/ / * / /` '--* COPY / REPOST \*/ * //..\\ x-x-UU----UUx-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x '//||\\` N E M O..M E..I M P U N E..L A C E S S I T x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x

4 3

Re: Crypto & Taxes [WAS Re: Cybersecurity]
by Bill Stewart 17 Dec '03

17 Dec '03

A couple of weeks ago, Michael Froomkin <froomkin(a)law.miami.edu> wrote: >> > fully applied crypto (e. g. fully anonymous digital cash) >> > makes it essentially impossible to base a tax system on income. >Hold on. This is more "factoid" than "fact": recall that income is PAID >by people as well as EARNED by people. Most payers have easily >detectible physical presence and assets that can easily be attached by >regulators. It will be a cold day before, e.g., my employer agrees not >to report my earnings. And the same is true for most employers in most >industries. Unfortunately, this is true, at least for people whose employers are subject to income tax somewhere. Taxing businesses doesn't make sense economically - you could collect almost as much money with far less disruption to the underlying economy by taxing it as wages for workers and dividend or interest payments to owners* rather than inside the business itself, substantially reducing the accounting workload of businesses**. But it's still very attractive to governments, not only as a lever for implementing social policy and extracting cooperation, but as a critical tool to force businesses to report wages payed to employees - I don't know if law.miami.edu is a taxable business, but for most employers, if they don't report the wages they paid to their employees, but do report all their revenue, they get taxed on the additional profit, instead of the employee getting hit with the tax; most people I know who've been paid "under the table" have been working for small businesses that are also not reporting cash revenues. Of course, if a business isn't _spending_ money on employees, but is just contracting for work performed by an Anguillan corporation, they still have receipts for expenses, and the financial arrangements between the Anguillan corporation and any of its US employees aren't really their concern.... >And if it ever stops being true, we'll just get VAT, and VAT inspectors. >So the line about death and taxes remains as true as ever, crypto or no. Value is really hard to measure in a service economy. Most of my work over the last N years has been talking to people, typing on keyboards, going places on airplanes to talk to other people and type on other keyboards, and occasionally handing people piles of collated and stapled dead trees, a racket for which people pay my employer lots of money***. Where's the value? When was it added? If the Tax Collectors don't see people handing my employer lots of money, can they demonstrate how much money they can confiscate? - - - - - - * this misses payments to foreign owners and taxes on foreign customers, but any government foolish enough to discourage investment by foreigners and sales to foreign customers deserves to be blamed heavily for lost jobs.. ** US businesses spend approximately 40% as much calculating taxes as they do _paying_ them... *** My previous employer was very good at taking metal, sand, and fermented dinosaur parts, and shaping them into boxes and strings that people would give them money for; they were extremely optimistic that they could get lots of people to also pay them money for sending them people to talk about boxes and strings and getting other people to pay _them_ for talking and banging on keyboards. They shouldn't have been quite so optimistic, and now I'm in the racket on my own, having not yet acquired overseas corporations to shelter my income through :-) #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

5 5

The Crypto Applications we would rather not talk about
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

Anonymous remailer and PGP Unusual applications I dont know if anyone else caught it last year but High Times discovered anonymous remailers and PGP for an article last year for anonymous remote control of grow rooms. PGP Wins again? and lately the thule people(bigoted and racist Nazis) have been learning to protect themselves also according to news reports from germany. Crypto and Privacy tools protect everyone from the hero to the anti-hero... the technology itself is neutral I wonder how long it will be before we hear news reports of some of the governments people being caught using internet casinos from the white house network. On other notes CCCF(the chaos computer club France) was shown to have had a high level plant from the french intel services, The founder of the CCCF himself. this story seems to repeat itself over and over when you are doing something of which the authorities DONT approve they WILL attempt to infiltrate and subvert from the inside. The answers are there and have been published in most books on tradecraft, 3 person cells organized as pyramids. Anonymous remail tech and crypto make this system possible with out Face to face contact. When does this lesson finally get learned? anon

2 1

Cypherpunks Santa Cruz Meeting/Party, 95-11-11
by tcmay＠got.net 17 Dec '03

17 Dec '03

I have sent out a detailed announcement of a "Cypherpunks Santa Cruz" meeting/party at my house in Corralitos, California, on Saturday, 11 November. This was sent to the mailing list of interested folks I maintain. If you are on this list, you already got the detailed message. If you are interested in getting on the list, drop me a line. I can also send the detailed announcement to anyone who is interested. As background, the Cypherpunks Santa Cruz is for folks in the Santa Cruz, Monterey, Carmel, Boulder Creek, Watsonville, Salinas, Big Sur, etc. area, or for anyone else on the Central Coast. Or anyone else, for that matter. At the last (and first) party we had Greg Broiles down from Eugene, Oregon, and Jeff Simmons up from San Luis Obispo, plus a bunch of folks from "over the hill" in the Silicon Valley/Bay Area. All told, 25 people. I'm not sure if there is a Bay Area meeting that day. If so, attend one or the other, or both, as my party starts late afternoon (of course, it may be a long drive, depending on where the Bay Aryans are meeting). --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Crypto++, Cpunk Icons, list noise
by don＠cs.byu.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Wei Dai <weidai(a)eskimo.com> writes: >I am still talking to RSADSI's lawyers, but it's taking a lot longer And the efforts are appreciated. Of course, your original efforts can still be appreciated at utopia.hacktic.nl. I don't know about everyone else, but that TCP encryption sounded interesting. Any plans to discuss it on the list? - ----- An anonymous complainer writes: >Well, Perry, my opinion is that there is far too much noise on this list >as it is. I have already seen my words drowned out by bellyaching over >next to nothing. POT-KETTLE-BLACK. Also, since nothing you've written (in your commentary, as opposed to anonymous announcements or releases that most people use anonymity for here) indicates that you're using anonymity for any particular reason, please stop so people can killfile you. Or send it from a nym at alpha.c2.org. I mean, the NSA has your real name anyway, what's the point... - --------- Jay Campbell <edge(a)got.net> writes: >>masquerade as Injuns in the 1800's and waylay Pony Express riders in order >> ^^^^^^ >>I think you'll find the NSA was not in existence in the 1800's. >I'm disappointed at the sheer number of similar pieces of email I received >on this. You'da thought the Capn Crunch reference was silly enough that >people would give me a funny look and trash the original message. Hmm, I guess most of them at least had the sense to not send it to the list. The list still sees FAR too many personal queries and rebuttals. TO THE GUILTY: take your bonehead replies to email please. Jay: I had a similar experience when I mentioned elsewhere that all the primes under 1000 digits were really invented by the NSA over 20 years ago. I recommended wearing garlic around the neck for protection... Everyone: This 1% wiretap thing is getting old. Hint hint hint - ---- Lastly, regarding cpunk icons, the only ones I was able to find were at the BAP site. I've been drawing a few of my own, one of them is done. It's a yellow diamond that says Cypherpunk on Board. And it has the anarchy-A- inside-a-C symbol. It's interlaced and transparent, so it doesn't look too bad. You're all welcome to steal it at http://students.cs.byu.edu/~don. Also working on a PGP icon. BAP has an envelope with PGP being the seal. I was thinking maybe a deadbolt ("PGP") with the inscription "Mommy said to lock the doors at night" or some kind of safety lock-your-doors or lock-your-data reference. For the time being I'm working on a simple PGP/ZLDF icon, it will be on my page Real Soon Now[tm]. If you like my icons please tell me. Don -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMJvC7sLa+QKZS485AQFrIgL/VuRfkh7i+K3W3bLyep26riXdZgIVC557 RRcHf9VcacXOGyVvT03JESqNxV/XRcW2k8WDQ+fwhMDEHbHjkzWT5fUxXm6knRGc K0drBF8WlW0ZobEaiU7SgEnVjus5kFj4 =iAr6 -----END PGP SIGNATURE----- <don(a)cs.byu.edu> fRee cRyPTo! jOin the hUnt or BE tHe PrEY PGP key - http://students.cs.byu.edu/~don or PubKey servers (0x994b8f39) June 7&14, 1995: 1st amendment repealed. Junk mail to root(a)127.0.0.1 * This user insured by the Smith, Wesson, & Zimmermann insurance company *

1 0

Photuris Primality verification needed
by William Allen Simpson 17 Dec '03

17 Dec '03

Folks, I was somewhat disappointed in the response to our previous requests for verification of the strength of the prime moduli. Recently, someone asked for a smaller prime of only 512-bits for speed. This is more than enough for the strength of keys needed for DES, 3DES, MD5 and SHA. Perhaps this would be easier to have more complete and robust verification as well. Here are two "important" primes for Photuris use. If you have some spare cycles, it would be beneficial for in-depth verification of these strong primes. Implementation Optional. A 512-bit strong prime (p), expressed in hex: da58 3c16 d985 2289 d0e4 af75 6f4c ca92 dd4b e533 b804 fb0f ed94 ef9c 8a44 03ed 5746 50d3 6999 db29 d776 276b a2d3 d412 e218 f4dd 1e08 4cf6 d800 3e7c 4774 e833 The recommended generator (g) for this prime is 2. Implementation Required. A 1024-bit strong prime (p), expressed in hex: 97f6 4261 cab5 05dd 2828 e13f 1d68 b6d3 dbd0 f313 047f 40e8 56da 58cb 13b8 a1bf 2b78 3a4c 6d59 d5f9 2afc 6cff 3d69 3f78 b23d 4f31 60a9 502e 3efa f7ab 5e1a d5a6 5e55 4313 828d a83b 9ff2 d941 dee9 5689 fada ea09 36ad df19 71fe 635b 20af 4703 6460 3c2d e059 f54b 650a d8fa 0cf7 0121 c747 99d7 5871 32be 9b99 9bb9 b787 e8ab The recommended generator (g) for this prime is 2. > From: Phil Karn <karn(a)qualcomm.com> > I've used the mpz_probab_prime() function in the Gnu Math Package (GMP) version > 1.3.2 to test this number. This function uses the Miller-Rabin primality test. > However, to increase my confidence that this number really is a strong prime, > I'd like to ask others to confirm it with other tests. > Bill.Simpson(a)um.cc.umich.edu Key fingerprint = 2E 07 23 03 C5 62 70 D3 59 B1 4F 5E 1D C2 C1 A2

1 0

re:using PGP only for digital signatures
by James Black 17 Dec '03

17 Dec '03

Hello, I am in a discussion (during the week) with a system administrator about seeing if we can just make PGP publically available to everyone, but now the discussion seems to be to just allow PGP to do digital signatures, and I don't think that is the best choice, then. They are not against PGP being used, but there are legal issues as to whether they can offer it to everyone, as some students are international students, and are not allowed to use the version for the US, or so I have been informed, so now I need to see if we can have the international version, so these students can use it. :( Is there any good programs (for the Unix, SunOS) that just does digital signature encryption? What they are trying to do is make certain that no one can send a message to anyone, claim to be in the faculty, and cause problems that way. My position is just a student programmer, but I am trying to learn as much as I can, to answer questions and deal with problems. Thanx. James Black black(a)suntan.eng.usf.edu

5 6

Re: video as a source of public randomness
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:08 PM 11/3/95, Perry E. Metzger wrote: >Timothy C. May writes: >> I don't plan to belabor this point. Radioactive decay sources are >> certainly fine, though not likely to be purchased by most people. > >Video digitzation equipment connected to TV tuners turned to dead air, >your suggestion, are equally unlikely to be purchased by most ^^^^^^^^^^^^^^^^ >people. The geiger counters are very simple and cheap, too. It is not correct to call this my "suggestion." I was responding to a previous post by Andrew Isaacson who said: "How useful would it be to use a video stream as a source of random input to something like /dev/random? I'm thinking along the lines of a Connectix QuickCam (sp?) or the cool videocam that comes with the Indy...." I was commenting on the sources of randomness, such as atmospheric RF variations, antenna configuration, tuner sensitivity, amplifier noise, etc., that would make prediction of snow bits very difficult. As to suggesting setting the tuner to dead air, this was just one facet of the discussion. I have no brief with any of the proposed schemes: nearly any are better than what we have now, if widely deployed and suitable used. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Credentials Without Identity
by tcmay＠got.net 17 Dec '03

17 Dec '03

Rich Graves makes some very good points, but he said something I want to riff on. (And as a measure of how apologetic some folks are getting about discussing anything not on Perry's List of Approved Topics, Rich unfortunately labeled his post "[ID point semi-off-topic]..." In fact, the issue of credentials and identity is NOT off-topic, not even semi-off-topic. It is central to the themes of our list. I urge all to read Chaum's seminal work on "credentials without identity.") At 1:05 AM 11/5/95, Rich Graves wrote: >Proving legal residency requires a combination of two documents, one each >from specified lists. Most commonly a driver's license, green card (which >is actually pink), or birth certificate from list A, and a social >security card from list B. > >Chris Hibbert's SSN FAQ talks a little bit about how this works, and why >it's a Good Thing. Basically, for privacy and security reasons, it is a >very good idea to separate the issues of identity and authorization. > >I don't care how securely you can authenticate who I am -- by PGP, retinal >scan, whatever. I do not want a single digitizable token to be the key to >my identity. Even if that identity cannot be forged (and everything can be >forged), it can be used to track me, by the government, by the Direct >Marketing Association, by the private investigators of certain wacky .... Chris's (or Chris') points are admirable, but getting more and more irrelevant by the day. The notion of unlinking identity and authorization by separate pieces of identification is another form of "security through obscurity." The two forms of credentials can be linked in data bases. Just because one piece of ID has citizenship or voting status and another has other stuff is meaningless, provided the ID forms can be linked. As they can, in multiple ways. The credit tracking agencies can do this trivially, with names, social security numbers, driver's license numbers, addresses, phone numbers, etc. All are pointers into the cloud of numbers that constitutes one's dossier. Happily, Chaum's work on "credentials without identity," based essentially on the kind of "blinding" used in digital cash (with some differences, of course), allows for one to display a credential showing one is old enough to enter a bar or library (in 2005), without revealing a name (which is just another credential). --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

4 3