December 2003 - cypherpunks-legacy

(fwd) Articulation of PGP point of view?
by Carl_Ellison＠vos.stratus.com 17 Dec '03

17 Dec '03

>Date: Thu, 21 Oct 1993 10:54:43 -0500 >From: "Robert W. Shirey" <shirey(a)mitre.org> >Subject: Articulation of PGP point of view? >Is there anyone who has, or is able to, articulate >the PGP point of view for public key management and >compentently contrast it to the PEM point of view? >Is there, perhaps, someone who has written on this >subject or spoken publicly in an organized fashion? >I am seeking such a person for a presentation and >panel discussion at an international conference. >I need names ASAP! >Please feel free to forward this message to >appropriate newsgroups. >Regards, -Rob- >SHIREY(a)MITRE.ORG * tel 703.883.7210 * fax 703.883.1397 >Robert W. Shirey, The MITRE Corporation, Mail Stop Z202 >7525 Colshire Drive, McLean, Virginia 22102-3481 USA

1 0

cyphrs
by QBOSWT＠grace.tstc.edu 17 Dec '03

17 Dec '03

Longing to be free. Send info encrypting gov't from privacy. Who r cypherpunks? Why a toad?

1 0

Articulation of PGP point of view?
by Peter G. Trei 17 Dec '03

17 Dec '03

Robert W. Shirey writes: >Date: Thu, 21 Oct 1993 10:54:43 -0500 >From: "Robert W. Shirey" <shirey(a)mitre.org> >Is there anyone who has, or is able to, articulate the PGP point of >view for public key management and compentently contrast it to the PEM >point of view? >Is there, perhaps, someone who has written on this subject or spoken >publicly in an organized fashion? >I am seeking such a person for a presentation and panel discussion at >an international conference. >I need names ASAP! >Please feel free to forward this message to appropriate newsgroups. >Regards, -Rob- >SHIREY(a)MITRE.ORG * tel 703.883.7210 * fax 703.883.1397 >Robert W. Shirey, The MITRE Corporation, Mail Stop Z202 >7525 Colshire Drive, McLean, Virginia 22102-3481 USA I talked to Rob about this. What he's really looking for is not really so much a spokesman for the PGP vs "Big Brother" type of discussion, but rather someone who can discuss PGP key management issues from a technical standpoint. He'd really like to find someone who has dealt with managing a PGP key-server, thoroughly understands the "web of trust" model used in PGP (contrasting it to the certification authority hierarchy used in PEM) and is a good and articulate public speaker. Being partisan for PGP is fine, but you'd better be able to argue from a technical standpoint, not just an ideological one. Peter Trei ptrei(a)mitre.org

1 0

Re: Gold in them thar Bills...
by hsuutala＠fmdmfg2.intel.com 17 Dec '03

17 Dec '03

writes pmetzger(a)lehman.com (Perry E. Metzger) >I can take the pound of gold to MTB down the block and have dollars, >yen, or anything else I like, within 15 minutes. I can then take those >to buy Big Gulps. >Perry Yes, as long it was been minted in a recognized form i.e. a gold eagle, a panda, or gold peso. A gob of yellow shinny stuff is just that until it has been assayed, and then it is only as good as the backing or reputation of the assayer. Howard My opinion and mine alone, not the companies.........not by a long shot. Howard Suutala | Intel Connectivity Division Intel Corporation | m/s fm4-26 | 1900 Prarie City Road | Folsom | CA | 95630 [v] 916.356.4412 | [f] 916.356.3455 | [email] hsuutala(a)fmdmfg2.intel.com

3 2

Re: re:700 Club etc.
by djw＠eff.org 17 Dec '03

17 Dec '03

At 4:21 PM 10/21/93 -0500, F_GRIFFITH(a)CCSVAX.SFASU.EDU wrote: >The right to encryption and the "right" to abortion don't have the same >basis - encryption kills no one. I'm not sure that the FBI would agree with the second half of your statement... ................................................................... Daniel J. Weitzner, Senior Staff Counsel <djw(a)eff.org> Electronic Frontier Foundation 1001 G St, NW Suite 950 East Washington, DC 20001 202-347-5400 (v) 202-393-5509 (f)

1 0

Re: Gold in them thar Bills...
by lefty＠apple.com 17 Dec '03

17 Dec '03

>> Have you ever heard of doing an assay? > >Yes, but that would be at the expense of the owner, and if it looks like >gold, feels heavy in the hand like gold, and if it has the word Canada and >the number .999 stamped on it, then people (bankers) might take it at face >value (or might not, depending on the stability of that country). The "expense" of doing an assay is minimal. As another poster has pointed out, assaying is essentially trivial, given the right materials. -- Lefty (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

1 0

Metaverse info (was: Introducing digital cash in a MOO)
by plaz＠netcom.com 17 Dec '03

17 Dec '03

>can you send me info on how to gain access to metaverse? I've had a couple of requests to this effect. I originally tried to keep it off the list, but have decided that by sending business thier way I was actually contributing to one of the few digital cash startups in existance. Illuminatus wizards feel free to correct any mistakes. you can access the metaverse via: 'telnet metaverse.io.com 7777' That is domain name: metaverse.io.com port: 7777. To login, type as instructed: 'connect guest' At this point you can browse around with one of the pre-made characters. To get your own character, you'll have to sign up for an account @io.com. You can do this by: 'telnet io.com' ...and following instructions. Have a credit card ready. The base fees are $10/month for telnet access only. Other structures are available. Once you have an account, send mail to mentor(a)io.com from your io.com account with character name and password. You can find me in the 'verse as PlasticBeethoven. I am currently setting up a branch office of the Extropians Institute (Freegate Virtual Branch). Feel free to drop by and offer encouragement/suggestions/criticisms. ('go to ExI' will get you there.) Forward, upward, outward, onward, and every which way but loose! _______________________________________________________________________ Geoff Dale -- insert standard disclaimers here -- plaz(a)netcom.com "We are the shock troops of reality." - Voice of the Friends (Wild Palms)

1 0

Re: Eavedropping techniques revealed!
by peb＠PROCASE.COM 17 Dec '03

17 Dec '03

>/dev/audio is set to a default mode of 666 NeXT had the same problem; a few years ago users eavesdropped over the Internet. The next release of the NeXT OS plugged the hole by limiting access to whoever was logged into the console. Paul E. Baclace peb(a)procase.com

1 0

Digital cash
by kone＠COURIER1.SHA.CORNELL.EDU 17 Dec '03

17 Dec '03

While looking for a copy of Gresham's law, I ran accross William Brough's book "Open mints and Free Banking". On page 35 he writes "The more efficent money will always drive from circulation the less efficient if the individuals who handel money are left free to act in their own interest. It is only when bad money is endorsed by the State with the proprty of legal tender that it can drive good money from circulation." I think that as a few of the bugs are worked out of digital cash, in a free market, it would quickly drive out paper. Kone(a)courier1.sha.cornell.edu

1 0

Canon copiers
by XXCLARK＠indst.indstate.edu 17 Dec '03

17 Dec '03

Called a Canon copier dealer today. Here's what he said regarding the copying of currency [only after my convincing him I was not inter- ested in a career in funny money]: All Canon color copiers have _always_ marked their output with the serial number of the machine on which they were produced. [I failed to ask about non-color copiers.] He mentioned, specifically, currency, photographs and food stamps as examples of copied items from which the serial number could be recovered by Canon. Canon color laser copiers CL-300 and CL-500, not currently being produced, but still available, do _not_ have the anti-currency device included. They _do_, he said, place the machine serial number in copies made. Canon color laser copiers CL-350 and CL-550 _do_ have the anti- currency device included, which he said is a black box to local repair- men. He continued to say that not only would these models, when given currency to copy, produce only a black rectangle, but also: - store a copy of what one had attempted to copy in memory, and; - lock the machine in such a manner that only someone from the Canon factory "might" be able to render the machine useable. These machines also place the machine serial number in copies it allows to be made, he said. Only on the last item did his answer seem uncertain. His first response was that "the machine would be virtually destroyed." Anyone want to test this for us? He _did_ suggest which Canon copier would do a good job copying currency. I still haven't found the trade mag in which I originally read this...

2 1

Re: Canon copiers
by peb＠PROCASE.COM 17 Dec '03

17 Dec '03

> response was that "the machine would be virtually destroyed." > Anyone want to test this for us? Stand back, the thermite grenade in the black box could be hot. ;^) I'd like to know how they put the serial number into the copy. Paul E. Baclace peb(a)procase.com

2 1

Re: Gold in them thar Bills...
by msattler＠netcom.com 17 Dec '03

17 Dec '03

>writes pmetzger(a)lehman.com (Perry E. Metzger) > >>I can take the pound of gold to MTB down the block and have dollars, >>yen, or anything else I like, within 15 minutes. I can then take those >>to buy Big Gulps. > >writes hsuutala(a)fmdmfg2.intel.com (Howard Suutala - ICD) > >Yes, as long it was been minted in a recognized form i.e. a gold eagle, >a panda, or gold peso. A gob of yellow shinny stuff is just that until >it has been assayed, and then it is only as good as the backing or >reputation of the assayer. Isn't that just part of the recognition process, like "is this bill a real one, let me look..." ----------------------------------------------------------------------------- Michael S. Sattler msattler(a)netcom.com +1 (415) 621-2903 Digital Jungle Software Encrypt now; ask me how. (finger for PGP key) All that is required for evil to triumph is for {wo}men of good will to do nothing.

1 0

Regarding serializing photo copies.....
by sswift＠falcon.lhup.edu 17 Dec '03

17 Dec '03

Why do they not just watermark every sheet of paper in a specific way that identifies it with which lot, from which manufacturer that it came from? Might as well take paranoia to an extreme..... Sean Swift sswift(a)falcon.lhup.edu

1 0

Re: CRYPTO + REPUTATIONS = A NEW ERA
by grand-central!amix!chip 17 Dec '03

17 Dec '03

Tim May wrote: >Some percentage of all the digital money "in circulation" will >actually be primarily "pinging" money, designed to ping (test) the >system. (After a while, expect this to go down.) The beauty is that Maybe this is what my mom was talking about when she told me she was saving her ping money. Or something like that. -- ------------------------------------------------------------------------------- | Chip Morningstar |"Going into VR is like | | Electric Communities | wearing a pair of rented | | 3339 Kipling, Palo Alto, CA 94306 | bowling shoes on your face." | | 415-856-1130 | -- Doug Crockford | | chip(a)netcom.com or chip(a)amix.com | | ------------------------------------------------------------------------------

1 0

!#??@%&&!!!! it!
by W. Kinney 17 Dec '03

17 Dec '03

...and if somebody can kindly inform me how I can get my name in the "From" line on my postings instead of "To cypherpunks@..." I'll name my firstborn child "Diffie-Hellmann <your-email-address-here> Kinney". (I use elm). -- Will

1 0

Re: Regarding serializing photo copies.....
by lefty＠apple.com 17 Dec '03

17 Dec '03

Sean Swift suggests: > >Why do they not just watermark every sheet of paper in a specific way that >identifies it with which lot, from which manufacturer that it came from? First off, who are "they"? Second, how are "they" going to make people buy paper _with_ watermarks that's twice as expensive? Third, how will "they" keep paper manufacturers from producing cheaper paper without watermarks to satisfy demand? >Might as well take paranoia to an extreme..... Taking _something_ to an extreme, anyway. -- Lefty (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

1 0

Sharing a secret
by an41418＠anon.penet.fi 17 Dec '03

17 Dec '03

I posed a newbie question a while ago that resulted in a great summary of how detecting double spending in Chaum's paper works. Not only do I understand it now, but I'vee seen that explanation distributed on other mailing lists at my institution by others who read cypherpunks. Here's another question that most of you know the answer to, but the rest of us would greatly benefit from a simple, detailed expanation. In fact, if we get some more great summaries that are simplified the way the digital cash solution was simplified, we could produce an excellent FAQ. I am keeping these with plans to make such a document available (though a FAQ is probably not the form it will take). I know that there is a way to have a key, K, divided into n parts such that any i of them are needed to recunstruct K. The property holds that no i-1 parts are sufficient, and ANY i parts will do. How does this work exactly? Is it really the case that no i-1 parts give information? Is there a way to cheat? A good explanation would be great. BTW, many of you are exposing your anonymous ID's to me when you reply to my posts. If you are concerned with keeping your anonymous identity, you have to be careful. One more thing - I posted something yesterday that took about 12 hours from the time I posted it to Finland until it appeared on Cypherpunks. I think this is because Julf's remailer is a bit overloaded. Due to this, my post (about burning instead of shredding) arrived after 3 other people had posted the same idea. Please pardon such posts. The delay would make it appear that one is not following the list, but I can think of no way around it. Wonderer ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

DC-nets
by Douglas Sinclair 17 Dec '03

17 Dec '03

Can anyone point me to a detailed description of the dining cryptographers' protocol? I've had some thoughts on how to modify it, and I want to know if I'm just re-inventing the wheel. Please reply via e-mail. Thanks. -- PGP 2.3a Key by finger

1 0

An Intro to DC-Nets
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Douglas Sinclair asks about DC-Nets. I'm not sure if he's read the Chaum paper yet, but in any case there are probably others who would profit from seeing some introductory material on DC-Nets. Several folks are looking into this, including Henry Strickland (Strick) and several folks in the Austin group. Several others have tried to get something going in the past (Yanek Martinson, Marc Ringuette, etc.), but so far no one has produced a working DC-Net. I don't know if even Chaum has, and the several papers (Jurgen Bos, Pfaltzman, etc.) indicate the theory needs more work (especially on disruption by malicious attackers). Anyway, here's what Doug asked: >Can anyone point me to a detailed description >of the dining cryptographers' protocol? I've >had some thoughts on how to modify it, and I >want to know if I'm just re-inventing the >wheel. Please reply via e-mail. Thanks. >-- >PGP 2.3a Key by finger So here's an essay, a rather informal essay, I've posted a couple of times. As the essay notes, a full copy of the 1988 paper by David Chaum was also posted to the list by The Information Liberation Front. If there's interest in DC-Nets this time around, perhaps one of us who kept copies of it can post it again. <grin> Enjoy it! It is truly an astounding concept. Simple, too, once you get the idea. -Tim Date: Tue, 23 Feb 93 10:08:34 -0800 To: cypherpunks(a)toad.com From: tcmay(a)netcom.com (Timothy C. May) Subject: Dining Cryptographers Nets--An Introduction Nickey MacDonald writes: >Also, I have seen a number of references to DC nets... I must confess I >have never heard of the term before... can someone enlighten me? Here's a summary of the "dining cryptographers net" I wrote back in the pre-Cypherpunks days (which I later posted to the nascent Cypherpunks list). I'm posting it here because of the question just asked, thinking that others may be similary confused. (A "Glossary" also exists, and is in the "soda" archive site.) (I could apologize for the volume, but cyherpunks ought to be able to handle a few measly kilobytes of stuff. Besides, at least this won't go out multiple times to the list!) Understand that DC-Nets are further off in the future than the Cypherpunks-PAX-PENET-style remailers being discussed these last few months. Chaum-style mixes, based on his 1981 CACM letter, have yet to be implemented, let alone the more advanced DC-Net-style systems. Hal Finney, Marc Ringuette, and Yanek Martinson are some of the folks on this list who are interested in working on DC-Nets....Yanek even claims to have a primitive one running on his local machine and is interested in volunteers to test it on a larger basis. The "Information Liberation Front" also posted Chaum's entire 1988 paper, "The Dining Cryptographers Problem: Unconditional Sender and Recipient Untraceability." I suppose you could ask them to repost the article or forward it to you. Hope the newcomers enjoy this. To: Extropians(a)gnu.ai.mit.edu From: uunet!netcom.com!tcmay (Timothy C. May) Subject: Dining Cryptographers Date: Tue, 18 Aug 92 15:45:34 PDT Reply-To: uunet!gnu.ai.mit.edu!Extropians Marc R. has opened the door for me to get into some really exciting stuff: > > Tim May mentioned a new method from Chaum for defeating traffic analysis: > > > Chaum has since improved the tamper-responding "mix" by going to a pure > > software scheme which he calls "the Dining Cryptographers Protocol." It's > > described in Vol. 1, Number 1 of "Journal of Cryptology," 1988. If there's > > interest, I'll summarize it. > > Yes, please, Tim! > > > M. Complexity Warning: This stuff (I'm being informal) is easy once you get the basic idea. But getting the basic idea usually involves reading several articles on what RSA, digital signatures, etc., are all about, working out some examples, thinking about it, drawing pictures with other folks, and finally having an "Aha!" experience (in Werner Erhard's terms, you "get it"). The ASCII nature of the Net is not conducive to learning this stuff, despite the excellent summaries of crypto by Marc R. and Perry M. The almost-latest "Scientific American," August, has an article by David Chaum on digital money, and the latest "Spectrum," available at selected newstands, has several articles on security and cryptography. Also, there are lots of books. Look 'em up in a university library or flip through them at a large technical bookstore and pick the one you like the most. (I like a slim Springer-Verlag paperback, "Modern Cryptology," by Gilles Brassard, 1988, as a good intro to "modern"--as opposed to "classical"--crypto.) If the stuff in this posting, and on crypto in general, is beyond your current understanding, either ignore it, skim it and try to get the gist, or dig into the articles and books. Anyway, back to "The Dining Cryptographers Problem: Unconditional Sender and Recipient Untraceability," David Chaum, Journal of Cryptology, I, 1, 1988. Since this journal is hard to get, I'll discuss the article in some detail. (The techniques have major implications for anarchocapitalism and for Extropian ideas.) Abstract: "Keeping confidential who sends which messages, in a world where any physical transmission can be traced to its origin, seems impossible. The solution presented here is unconditionally or cryptographically secure, depending on whether it is based on one-time-use keys or on public keys. respectively. It can be adapted to address efficiently a wide variety of practical considerations." A word on terminology: "Unconditionally secure" means what it says: no computer will ever crack it. One-time pads are unconditionally secure...no code or cipher is involved, except the one-time pad, so the message is secure as long as the pad has not been compromised. "Cryptographically secure" means secure so long as various crypto ciphers are secure, which may be for a very, very long time (e.g., with very large primes, in RSA). Chaum describes some "dining cryptographers," which I will playfully change to "dining Extropians." (The term is of course a variant of the seminal "dining logicians problem" in computer science) Three Extropians are having dinner, perhaps in New York City. Their waiter tells them that their bill has already been paid, either by the NSA or by one of them. The waiter won't say more. The Extropians wish to know whether one of them paid, or the NSA paid. But they don't want to be impolite and force the Extropina payer to 'fess up, so they carry out this protocol (or procedure): Each Extropian flips a fair coin behind a menu placed upright between himself and the Extropian on his right. The coin is visible to himself AND to the Extropian on his left. Each Extropian can see his own coin and the coin to his right. STOP RIGHT HERE! Please take the time to make a sketch of the situation I've described. If you lost it here, all that follows will be a blur. I'm sparing you folks my attempt at an ASCII drawing! Each Extropians then states out loud whether the two coins he can see are the SAME or are DIFFERENT, e.g., "Heads-Tails" means DIFFERENT, and so forth. For now, assume the Extropians are truthful. A little bit of thinking shows that the total number of "DIFFERENCES" must be either 0 (the coins all came up the same), or 2. Odd parity is impossible. Now the Extropians agree that if one of them paid, he or she will SAY THE OPPOSITE of what they actually see. Remember, they don't announce what their coin turned up as, only whether it was the same or different as their neighbor. Suppose none of them paid, i.e., the NSA paid. Then they all report the truth and the parity is even (either 0 or 2 differences). They then know the NSA paid. Suppose one of them paid the bill. He reports the opposite of what he actually sees, and the parity is suddenly odd. That is, there is 1 difference reported. The Extropians now know that one of them paid. But can they determine which one? Suppose you are one of the Extropians and you know you didn't pay. One of the other two did. You either reported SAME or DIFFERENT, based on what your neighbor to the right (whose coin you can see) had. But you can't tell which of the other two is lying! (You can see you right-hand neighbor's coin, but you can't see the coin he sees to his right!) This all generalizes to any number of people. If none of them paid, the parity is even. If one of them paid, the parity is odd. But which one of them paid cannot be deduced. And it should be clear that each round can transmit a bit, e.g., "I paid" is a "1". The message "Attack at dawn" could thus be "sent" untraceably with multiple rounds of the protocol. The Crypto Ouija Board: I explain this to people as a kind of ouija board. A message, like "I paid" or a more interesting "Transfer funds from.....," just "emerges" out of the group, with no means of knowing where it came from. Truly astounding. Now there are many interesting wrinkles and elaborations to this protocol. I'll note just a few. 1. Collusion. Obviously the Extropians can collude to deduce the payer. This is best dealt with by creating multiple subcircuits (groups doing the protocol amongst themselves). Lots more stuff here. Chaum devotes most of the paper to these kind of issues and their solutions. 2. With each round of this protocol, a single bit is transmitted. Sending a long message means many coin flips. Instead of coins and menus, the neighbors would exchange lists of random numbers (with the right partners, as per the protocol above, of course. Details are easy to figure out.) 3. Since the lists are essentially one-time pads, the protocol is unconditionally secure, i.e., no assumptions are made about the difficulty of factoring large numbers or any other crypto assumptions. 4. Participants in such a "DC-Net" (and here we are coming to the heart of the "crypto anarchy" I have mentioned several times, and which is perhaps foolishly advertised in my .sig) could exchange CD-ROMs or DATs, giving them enough "coin flips" for zillions of messages, all untraceable! The logistics are not simple, but one can imagine personal devices, like smart card or Apple "Newtons," that can handle these protocols (early applications may be for untraceable brainstorming comments, secure voting in corportate settings, etc.) 5. The lists of random numbers (coin flips) can be generated with standard cryptographic methods, requiring only a key to be exchanged between the appropriate participants. This eliminates the need for the one-time pad, but means the method is now only cryptographically secure, which is often sufficient. (Don't think "only cryptographically secure" means insecure....the messages may remain encrypted for the next billion years) 6. Collisions occur when multiple messages are sent at the same time. Various schemes can be devised to handle this, like backing off when you detect another sender (when even parity is seen instead of odd parity). In large systems this is likely to be a problem. Solutions are left as an exercise. 7. Noise. Some participants may try to flood the circuit with spurious messages, to defeat the system or for whatever other reasons. This is still an issue. (If there's anything to take away from crypto, it's that nothing is as simple as it looks, that there are always devious ways to spoof, jam, and forge. I expect you've seen this from some of the debate on digital voting schemes.) What Can "DC-Net" Be Used For?: * Untraceable mail. Useful for avoiding censorship, for avoiding lawsuits, and for all kinds of crypto anarchy things. * Fully anonymous bulletin boards, with no traceability of postings or responses. Illegal materials can be offered for sale (my 1987 canonical example, which freaked out a few people: "Stealth bomber blueprints for sale. Post highest offer and include public key."). Think for a few minutes about this and you'll see the profound implications. * Decentralized nexus of activity. Since messages "emerge" (a la the ouija board metaphor), there is no central posting area. Nothing for the government to shut down, complete deniability by the participants. * Only you know who your a partners are....in any given circuit. And you can be in as many circuits as you wish. (Payments can be made to others, to create a profit motive. I won't deal with this issue, or with the issue of how reputations are handled, in this posting.) * The tamper-responding "digital mixes" can still be useful, and may supplement this purely software-based approach. * Digital money gets involved, too, both for payments in this system, and in terms of "alternative currencies." I'm not an economist, so I'll leave this for others to go into in more detail. Enough for now. Chaum's work is just the start. These systems can initially be set up for "innocuous" purposes like research into crypto techniques (not yet banned in the U.S.), role-playing games, religions, and the like. Once they get going, it'll be too late to stop the other things. Hope you liked this summary. Please read the articles...there's just no way my posting can do justice to them (though I admit I've concentrated my efforts on the political aspects, which "respectable" crypto researchers rarely mention, so perhaps the flavor here is a bit more Extropian than you'll find elsewhere.) --Tim (part of the "Too Many Tims!" Conspiracy) -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | RSA MailSafe Public Key: by arrangement

1 0

Subliminal Channels
by Karl Lui Barrus 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- A while ago I sent a post on subliminal channels - I had a chance to work a larger example. A subliminal channel is a communication channel that cannot be read by those for whom it is not intended. The problem is sometimes phrased as a prisoner's dilemma: two prisoners are allowed to communicate with each other by exchanging messages. They are able to digitally sign the messages to protect against spoofing. However, the warden will not allow the messages to be encrypted - only plaintext and the digital signature will be passed. All parties agree to these conditions and communication begins. Unknown to the warden, the prisoners are still able to coordinate their plans by using a subliminal channel to communicate, in full view of the warden! Essentially, the prisoners use some piece of shared knowledge to hide their real communication in the digital signature of an innocuous message. The warden sees the innocent message, checks that the signature is valid, and passes it along. The prisoner checks the signature to see if the warden didn't alter the message, and then extracts the real message from the digital signature. This topic came up when previously on the list, people were discussing the fact that encrypted communication over HAM radio is illegal - only authentication codes may be transmitted. I mentioned that actually, this restraint can be sidestepped by embedding encrypted communication a la subliminal channel style. YES, I KNOW THIS IS ILLEGAL AND I'M NOT SUGGESTING ANYBODY DO IT! I just pointed it out. What may be more important is that a subliminal channel may lurk in the digital signature standard (DSS). In turn, this is important because from time to time proposals are made concerning national id cards, national health cards, etc. If some agency is going to authenticate or otherwise digitally sign an identification card, they may also embed information into the signature. The DSS has been described as "very hospitable to subliminal channels." Imagine what records could be kept on you if various information were embedded in the digital signature of documents you own. First, a description and example of El Gamal authentication, and then of the subliminal channel based on El Gamal. El Gamal authentication: The sender picks a prime p, primitive element g, and random integer r. The public information is the triple (K,g,p), where K = g^r mod p To authenticate a message M, the sender picks another random integer r' such that gcd(r',p-1) = 1, and computes X = g^r' mod p Then, the sender solves for Y in the equation M = r X + r' Y mod p-1 The triple (M,X,Y) is the message and the signature - this is what is transmitted to the receiver. r and r' are kept secret. The receiver computes A = K^X X^Y mod p and accepts the message as authentic if A = g^M mod p El Gamal Example: p = 224737, r = 5135, g = 2 K = 2^5135 mod 224737 = 136800 The triple (136800, 2, 224737) is public. To send the message M = 12345, the sender picks r' = 89321 gcd(89321,224736) = 1 so r' is ok. Now compute X = 2^89321 mod 224737 = 87880 Solve for Y in: 12345 = 5135 87880 + 89321 Y mod 224736 ==> 18433 = 89321 Y mod 224736 ==> Y = 207929 The triple (12345, 87880, 207929) is the message and the signature. The receiver gets (12345, 87880, 207929) and knows (136800, 2, 224737). A = 136800^87880 87880^207929 mod 224737 = 160740 g^M mod p = 2^12345 mod 224737 = 160740 These are equal and the message is accepted as authentic. El Gamal Subliminal Channel: Now the interesting part is the subliminal channel. The sender and receiver must share the knowledge of random number r. To send the subliminal message M, where gcd(M,p) = 1, using a cryptogram C, the sender calculates X = g^M mod p and solves for Y in C = r X + M Y mod p-1 The triple (C,X,Y) is transmitted to the receiver. The receiver computes A = (g^r)^X X^Y mod p and accepts the message as authentic if A = g^C mod p To extract the subliminal message, the receiver calculates M = Y^-1 (C - r X) mod p-1 El Gamal Subliminal Channel Example: Suppose the sender and receiver share the knowledge r = 5135 The sender wants to send M = 11111 using the innocent message C = 12345. The sender calculates X = 2^11111 mod 224737 = 20944 and solves for Y in : 12345 = 5135 20944 + 11111 Y mod 224736 ==> Y = 194447 The triple sent to the receiver is (12345, 20944, 194447). The warden can check this if he wants, to very the signature: A = 136800^20944 20944^194447 mod 224737 = 160740 g^C mod p = 2^12345 mod 224737 = 160740 so the warden verifies the signatures. Convinced nothing fishy is going on here, he passes on the message. The receiver checks authenticity and is successful. However, now the subliminal message is extracted: M = 194447^-1 (12345 - 5135 20944) mod 224736 = 11111 The subliminal message is successfully extraced, and the prisoners have passed information right by the warden. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLMdlZoOA7OpLWtYzAQGLnAP/a21A7r4baW8I3PZiV50+mu8M7p+Xgcwj kx2pLkB0l+YHfonQDDIsqHdtEVASvcFeviFnKMkV9eGK/PPDI4DnfIdK/N0lDKq3 whyHZy91lCpnCCMKhoJ0UZ3Ss1JPogWNqdiKjPtWJhw+iZA86AQjrJ2bmwyWnCvP d+ZSgxeVhP8= =hqum -----END PGP SIGNATURE-----

1 0

hi/. .
by mench＠cs.unr.edu 17 Dec '03

17 Dec '03

hey, send me info on your movement! pete

1 0

Re: Backing
by baumbach＠atmel.com 17 Dec '03

17 Dec '03

"Perry E. Metzger" says: > Not a cryptography message -- sorry but I thought I had to discuss it... But it is, if digital cash is your interest. There may be more than one way to think about money. > > Peter Baumbach says: > > Isn't a finite source of backing a problem since it rewards those who > > hoard it? > > No. It punishes those who hoard it -- they don't get interest on their > money. Where does this interest come from. If you have a 100% backed currency with a finite supply, those who hoard it can't lose. If there is a total of 20,000 tons of gold in the world, and you own 1 ton, then don't you own 1/20,000 of the worlds wealth. As long as the total wealth of the world increases, doesn't your wealth increase along with it? > > > If neither Alice or Bob have a backed currency, does that mean they > > cannot trade? > > Depends if they consider what the other has to be of value. Its all up > to them. If Alice needs her street cleaned and Bob can do it, and if Bob needs some food prepared and Alice can prepare it, a currency is unneeded for their trade. > > > Has anyone invented a workable "barter currency"? > > I don't see what the point would be. Why not just deal in a medium of > exchange? Continuing with Alice and Bob, let's add Carl. If Carl needs his freezer repaired and Bob can repair it, and Bob wants some vegetables and Carl can supply them, a currency is still unneeded. Suppose, however, Alice wants the vegetables, but has nothing to offer Carl, a "barter currency" would solve her need. Alice pays Carl for the vegetables. Carl pays Bob for repairing his freezer. Alice pays Bob for cleaning her street. Bob pays Alice once for the vegetables, and once for her to prepare them to his liking. A small economy becomes facilitated. Useful stuff has been done without dealing with any outside parties. Why should some of these people own gold before their economy can function? If Alice kicks over a stone and finds a nugget of gold, why should she be any richer. She hasn't done anything for anyone, except maybe devalue the gold that everyone else already owns. Gold makes a good currency because it be can't be created by those who have done nothing of value for anyone else. (A government ;-) Gold makes a poor currency when it prevents the economy I describe above from existing since none of the participants have any. What medium of exchange can Alice, Bob, and Carl use? The answer to that, I would call a "barter currency" > > > Can I.O.U.'s be created such that they work like money? > > Sure. Thats what banknotes are. Your method requires another participant to the transaction. Everyone must trust that the bank doesn't print more banknotes than it can honor. Also, what is the banknote an I.O.U. for? Gold? An I.O.U. for particular services or goods are hard to use as a currency since you may wish to trade with someone who does not know the person whos name is on the I.O.U.. Carl might give Bob an I.O.U. for fixing his freezer: "I Carl owe the holder of this I.O.U. two bushels of carrots." It would be hard to give this in payment to someone who does not know the quality of the carrots or the trustworthyness of Carl. > > Perry > > I have just been learning about call and put options on stocks. If I sell a call option, I am agreeing to sell a certain amount of stock at a certain price at any time in the future until the option expires. These options behave something like the "barter currency" that I wish to have invented. People trade these options instead of trading in the stocks. Now if only my broker would accept an I.O.U. for two bushels of carrots in payment for ... Peter Baumbach baumbach(a)atmel.com

3 2

d-day
by nobody＠neva.org 17 Dec '03

17 Dec '03

What do you think about celebrating the expiration of the Diffie-Hellman patent by getting all the PGP users in the world to switch to DSS/DH keys all at once? It would take a massive education effort, but imagine the effect... we could even celebrate it annually, since there'd inevitably be significant lagging.

3 2

Re: hi/. .
by mench＠cs.unr.edu 17 Dec '03

17 Dec '03

> > hey, send me info on your movement! > > pete > > > > Well, this morning I was a bit constipated, so I ate four bran muffins, > and by late afternoon I succeeded in producing quite a decent bowl > movement. All in all I'd have to say I'm feeling much better now. Thanks > very much for asking. > > l8r, thug > Oh, thanks very much for the smartass reply. I take it this is a list? so do I send to Cypherpunks-request(a)toad.com? Also, I'd like to get a hold of Chris Odhner. Chris! email me! pete

2 1

No Subject
by nobody＠rebma.rebma.mn.org 17 Dec '03

17 Dec '03

Subject: spam ignore this is a test "To be responsive at this time, though I will simply say, and therefore this is a repeat of what I said previously, that which I am unable to offer in response is based on information available to make no such statement."

1 0