December 2003 - cypherpunks-legacy

Security of andrew.cmu.edu anon-server?
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

What kind of encryption is the anonymous contact system at andrew using? I think someone said that it used a home-brew cipher. How secure might such a system be against cryptanalysis (or just brute force key searches?) Or has it been changed to use something like DES or IDEA? (In the former case, DES, it might not be completely secure, unless you used 3DES or something.) If someone could break the code, they could find out _EVERYONE'S_ mail address that ever posted using an anon address from that remailer...

2 1

[julf@penet.fi: Re: VIRTUAL meeting needed]
by joshua geller 17 Dec '03

17 Dec '03

>> Instead, perhaps we need to organize for another virtual meeting again. >> With a little more organizing, it would go smoother. >How about trying IRC this time? be something worthwhile on irc for once. and people would be there who wouldn't otherwise (like me). josh

1 0

Mailing list software losing posts
by Matthew J Ghio 17 Dec '03

17 Dec '03

The list software seems to be having problems again. I sent the below post to the list three times, and it never got sent out. But since another post from me just showed up, maybe it's working now... (Let me know if you got more than one copy, because I sure didn't.) ----- To: cypherpunks(a)toad.com Subject: Re: lists of U.S. cypherpunks and Tentacles. CC: Matthew J Ghio <mg5n+(a)andrew.cmu.edu> In-Reply-To: <9402260131.AA08270(a)toad.com> References: <9402260131.AA08270(a)toad.com> Date: Sat, 26 Feb 1994 11:34:54 -0500 (EST) From: Matthew J Ghio <mg5n+(a)andrew.cmu.edu> mg5n+eaibiubkxb58z84cy2iaf9r61u26ra5x26mc0h(a)andrew.cmu.edu wrote: > Please add me to your list. As you can see, I clearly have > a US-based email address. :) hehe... This didn't come from my site tho. It looks like a clever port 25 hack. However, the return address is valid. I suppose this points out another problem with the US export laws: How can you know where a message came from? As the above example shows, there is really no way to know where the person you're communicating with is. In other words, you can't not break the US export laws. All you have is someone's word that they are in the US or not, but you really can't know for sure. Something to mention in your letters to Rep. Cantwell. > -Ibiu Cute... using part of your encrypted address as a handle? I never thought of doing that... hmm...

3 3

Re: Newsday Editorial
by bsteve＠zontar.attmail.com 17 Dec '03

17 Dec '03

Dorothy: We have not been formally introduced. My name is Steve Blasingame. I am a long-time proponent of quality encryption systems for both private and commercial communications. I am also a long-time employee of The AT&T Company responsible for AT&T-GIS strategies, programs and products in internetworking. I am very pleased that AT&T is manufacturing the "Clipper Phone" product and believe that "Clipper" is an enabling technology for government and business. However, I must challenge the basis of your "Newsday" editorial as false. >" The Clinton administration has adopted the chip, which would allow >law enforcement agencies with court warrants to read the Clipper codes >and eavesdrop on terrorists and criminals." It would be great if this were true, but it is false. Criminals and terrorists operate outside the confines of the law and are not obliged to use encryption schemes sanctioned by statute. >" But opponents say that, if >this happens, the privacy of law-abiding individuals will be a risk. >They want people to be able to use their own scramblers, which the >government would not be able to decode." Given that criminals would not be obliged to use the statutory method of encryption, what other purpose could be served by such a technology enforced by law? " If the opponents get their way, however, all communications on the information highway would be immune from lawful interception." It is clear that the security of communications on the information highway is an important issue. However, as a corporate citizen, I am more concerned about the un-lawful monitoring of communications and do not consider that there is a sufficiently robust encryption technology to make a statutory encryption standard workable for more than a few years. >" But then who would have >thought that the World Trade Center bombers would have been stupid >enough to return a truck that they had rented?" I think that this qualifies as an appeal to ignorance. "Can you prove it isn't true?" >"... Lawlessness would prevail." If you examine definition 3 from the latest edition of the "American Heritage Dictionary" in your study, you will find that "Lawless" means "not governed by law." This is certainly a law that we can all do without. Very truly yours, Steve Blasingame bsteve(a)zontar.com

1 0

Re: Infomercials, FUD... time?
by Anthony D Ortenzi 17 Dec '03

17 Dec '03

Excerpts from internet.cypherpunks: 24-Feb-94 Re: Infomercials, FUD... time? by Timothy C. May(a)netcom.co > However, a few minor problems with the infomercial idea: > > 1. The incredible cost. Ross Perot could afford to blow $5 million per > show, not many others can. Anyone know where ol' Ross stands on this issue? He could communicate the dangers to a large sector of the population... if he believes in our cause. It's hard to imagine him not, being a little on the paranoid side about the Republicans tapping his communications, and all that jazz... and he's got to have an internet e-mail address somewhere, although it is probably under a pseudonym or something to keep him from being inundated by the masses. Someone who uses whois with Perot finds lots of Perot Computer Systems or whatever the damn name of the company is. It can't be that hard to get in touch with him via e-mail. Someone has got to be able to get through to him to check. Even though he is now not as highly regarded because of the NAFTA fiasco, he's still got some pull. Go to it, 'punks... ()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()() ()/----------------------------------------------------------------------\() ()| Anthony Dante Ortenzi () ao27(a)andrew.cmu.edu () feynman+(a)cmu.edu |() ()| -------------------------------------------------------------------- |() ()| adortenz(a)suvm.acs.syr.edu () ortenzi(a)chaos.bsu.edu |() ()\----------------------------------------------------------------------/() ()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()

2 1

using mediamoo - correction
by David Galiel 17 Dec '03

17 Dec '03

re:previous message about possible use of mediamoo for mtg. Ooops - the ultimate NetSin - mispelled my address. It's galiel(a)world.std.com (sheepish grin) Flout 'em and scout 'em -- and scout 'em and flout 'em; Thought is free. -- Shakespeare

1 0

Cryptography, fascism; Perot
by Brad Dolan 17 Dec '03

17 Dec '03

There has been a lot of discussion of cryptography/communications issues on the UWSA reflector (uwsa(a)shell.portal.com) This list is monitored by people who work for Perot, so post there and it might get his attention. You can be added to the reflector by e-mailing to: telcon(a)shell.portal.com [I think that's right - I believe it used to be telconsort(a)shell.portal.com] Brad bdolan(a)well.sf.ca.us

1 0

Re standard for stegonography?
by Derek Upham 17 Dec '03

17 Dec '03

> Is there a standard for stego yet? I just added stego and de-stego > filters to my pbmplus image toolkit, using a simple protocol I made > up on the spot. Now I'm wondering if I should make them compatible > with existing stego tools. There appear to be two existing steganography packages for images. One is "jsteg", a Unix-based system which stores data in JFIF- compliant JPEG images; it is based on version 4 of the cjpeg/djpeg package. The other is "Stego", a Mac-based system which stores data in Mac PICT files (I think---I don't have a Mac to examine it). "jsteg" is available in the Cypherpunks FTP archive in the applications subdirectory as the original jpegsrc package, plus the patches, plus a README file. However, you might be better off tracking down the "Stego" sources since "jsteg" stores its data in a rather odd way (see the docs for more information). Derek Derek Lynn Upham University of British Columbia upham(a)cs.ubc.ca Computer Science Department ============================================================================= "Ha! Your Leaping Tiger Kung Fu is no match for my Frightened Piglet Style!"

1 0

Valente clarifies on Telescript
by Alan (Miburi-san) Wexelblat 17 Dec '03

17 Dec '03

[This was posted to RISKS in response to objections raised by several readers. Note that he says they are using "RSA" encryption; one wonders where their public keys are? --AW] From: "Luis Valente" <luis_valente(a)genmagic.genmagic.com> Subject: Safety in Telescript, Part Deux Following my posting to RISKS on January 17 entitled "Safety in Telescript" a number of readers have strongly questioned some of the statements I made in that posting. Two of those statements, in which I used casual or imprecise language, were particularly criticized: 1- "Telescript is interpreted and, thus, is safer than compiled languages." As pointed out by many readers, an interpreted language is not intrinsically safer than a compiled language. It is the Telescript language definition that provides that protection. Within the abstraction created by Telescript, programs lack operations for directly manipulating the physical resources of the "real" computer(s) on which they execute. That doesn't mean that Telescript programs cannot interact with applications (e.g., databases) outside the Telescript abstraction. However, that interaction can only take place via Telescript objects that act as proxies for the "external" applications. Each such proxy object defines the features of the corresponding external application that are to be made available to Telescript agents and places. It may also define and enforce a security policy for controlling access to those features (e.g., based on an agent's credentials and permit). Furthermore, the administrative authority for a given Telescript engine is capable of controlling (by means of mechanisms built into the language) who can and cannot create these proxy objects. 2- "Authority names are cryptographically generated and cannot be forged." Obviously, that statement is not true in an absolute sense since the "unforgeability" of the authority name is directly related to the cryptographic mechanism used to generate it. We currently use RSA-based public key cryptography for generating authority names. Entitlement to use a particular authority name can be linked to the secret key used to generate it. Aside from the criticism leveled against my poor choice of words in the aforementioned statements, several readers complained about the lack of more detailed information on the security technology used by Telescript, namely, what cryptographic algorithms are used, key sizes, key distribution and management issues, exportability issues, etc. Let me start by saying that my posting was not meant as a treatise on Telescript Technology but merely a brief description of some of the features of Telescript that can be used effectively against misprogrammed or ill-intentioned telescripts. General Magic has already published a white paper entitled "Telescript Technology: The Foundation of the Electronic Marketplace." This paper provides a high-level description of Telescript and is intended for the layman, not the techno-savvy reader. It can be requested directly from General Magic by calling (415) 965-0400. In the coming months we will publish additional information on many different aspects of Telescript Technology (including security). Let me further say that the point of my original posting was not that Telescripted networks are intrinsically secure (i.e., the "it won't happen here" syndrome). It was simply to let RISKS readers know that we have put a lot of thought into the security aspects of Telescript. In fact, when General Magic started developing Telescript, security was at the top of our list of concerns. As a result, we have built into the fabric of the language a number of features that, we believe, will enable application developers to write safe Telescript programs and network operators to run highly secure Telescripted networks. Heretofore, the discussions on RISKS have only covered a few of the many security issues faced by a dynamic, interpreted, communication-centric language like Telescript. As more detailed information on Telescript becomes widely available, I am certain it will generate heated debates on this and other forums. I look forward to them! -Luis Valente, General Magic, Inc. ------------------------------

1 0

standard for stegonography?
by Jef Poskanzer 17 Dec '03

17 Dec '03

Is there a standard for stego yet? I just added stego and de-stego filters to my pbmplus image toolkit, using a simple protocol I made up on the spot. Now I'm wondering if I should make them compatible with existing stego tools. --- Jef

6 18

anonymous mail
by catalyst-remailer＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >I assume from this statement that you haven't looked at my code. >Send me email and I'll give you a copy... or maybe someone that I >gave it to could put it up on an FTP site, so you can get it >anonymously. Hey Matt, I'd be interested in a copy of your code! >Yes, the cipher is of my own design. First off, I can assure you >that a brute-force keysearch will not work. The cipher employs three >36 element substitution arrays, which gives a total of 3x36! possible >keys, or over 10^42. DES has about 7.2 x 10^16 possible keys and IDEA >about 10^38. Well, you do have to be careful: a large number of keys doesn't mean a cipher is hard to break, there may be a faster method than brute force. For instance, those cryptograms some papers print in the puzzle section are a simple substition cipher, with 26! keys... yet they are also pretty much trivially breakable with enough input. Karl Barrus <klbarrus(a)owlnet.rice.edu> -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLXD7gIOA7OpLWtYzAQG6wQP/Qcim32WFYHrjZ53bIHJ2CSjmoRSmh5XI Gcm9LbvvwPOywAzEzWaTw0g31c6rz9xor/g8EYX25lyMsYSX36LpyrZRO77XeJI4 sEitU9S8Dp0GWIVgXT6a2reLkUwbIuTU5Y4KFpRvbvTKN33GU+GKFgPAxV6/+FLr d+rC3w2F/ms= =U9gg -----END PGP SIGNATURE-----

3 3

Capone's Cojones in loan Zones?
by Gary Jeffers 17 Dec '03

17 Dec '03

Tim May writes: >Regarding "Nobody"'s forwarding of the FBI's plans to move into <Russia, this is also similar to the rationale used by the German BND >(Bundesnachrichtendienst, if I rememer the spelling correctly) to move >into Eastern Europe in various overt and covert ways. >Expect Germany and the U.S. to lock horns soon. The real intelligence >war is just beginning, with Gehlen's boys battling their former >OSS/CIA cronies for world fascist domination. >"Nuclear terrorism" is indeed a threat, especially when practiced by >fascist nations--fill in the blanks with who you think I mean. >Those who thought "history ended" when the Cold War ended, now face >the prospects of Goldfingers proliferating. Exciting times indeed. >Bid deal, a few cities get nuked. The greater danger is that of the >control freaks like Denning clipping and skipjacking our remaining >freedoms and ushering in the thousand-year Reich of Kaiser Willy. Good point & good attitude Tim. While having a few big cities nuked is a truly horrible thing, its evil is completely dwarfed by the possibility of a world of billions of people crushed down by a long lived state using uncountable lies & computer monitoring to maintain control. That state evil would not have the flashiness & fear of a nuke. Its evil would be boring. Its horror would be in the hopelessness & lack of freedom of the people & in their lives being made up of lies. In the face of that threat, the idea of some ""terrorists"" or ""criminal"" gangs throwing around a few nukes on a wild Saturday night merely gives one cause for hope. Maybe a nuke would land on an oppressor & free us. Incidentally, what is this fear of ""criminals"" & ""terrorists"". I have never had a ""criminal"" extortionist take 40% of my income over a long period of time. I have never had a ""terrorist"" draft me into a war with people I don't know in a foreign country. Also, I don't know of any ""terrorists"" who occasionally murder millions of people. I think we have a problem with words. A ""terrorist"" is a soldier without a uniform. A soldier who ""failed to dress for success"". A ""criminal"" is a thug without proper papers & badges. WACO & the Weaver family were lessons for those who could set aside their prejudices for awhile. I am quite happy to share the internet with ""terrorists"" & ""criminals"" - if it gives me & my friends a chance for happiness & freedom! Anarchy is simply the absence of a monopoly on weapons & force. If anarchy gives me a chance for freedom & happiness I'll take my chances. Death before dishonor? How about an even better deal - a risk of death before a life of no honor & no hope! This is the offer of liberty. So, mr or ms State, please don't bother me. I'll take my chances with a few stray ""criminals"" & ""terrorists"". >War is Piece. No Gnus is Bad Gnus. Surveillance is Security. >--Winston May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Capone's Cajones
by Gary Jeffers 17 Dec '03

17 Dec '03

2nd edition. In 1st edition I edited badly & confused authors' texts. This edition will be clearer. Sorry Tim. Tim May writes: >Bid deal, a few cities get nuked. The greater danger is that of the >control freaks like Denning clipping and skipjacking our remaining >freedoms and ushering in the thousand-year Reich of Kaiser Willy. Good point & good attitude Tim! While having a few big cities nuked is a truly horrible thing, its evil is completely dwarfed by the possibility of a world of billions of people crushed down by a long lived state using uncountable lies & computer monitoring to maintain control. That state evil would not have the flashiness & fear of a nuke. Its evil would be boring. Its horror would be in the hopelessness & lack of freedom of the people & in their lives being made up of lies. In the face of that threat, the idea of some ""terrorists"" or ""criminal"" gangs throwing around a few nukes on a wild Saturday night merely gives one cause for hope. Maybe a nuke would land on an oppressor & free us. Incidentally, what is this fear of ""criminals"" & ""terrorists"". I have never had a ""criminal"" extortionist take 40% of my income over a long period of time. I have never had a ""terrorist"" draft me into a war with people I don't know in a foreign country. Also, I don't know of any ""terrorists"" who occasionally murder millions of people. I think we have a problem with words. A ""terrorist"" is a soldier without a uniform. A soldier who ""failed to dress for success""*. A ""criminal"" is a thug without proper papers & badges. WACO & the Weaver family were lessons for those who can set aside their prejudices for awhile. I am quite happy to share the internet with ""terrorists"" & ""criminals"" - if it gives me & my friends a chance for happiness & freedom! Anarchy is simply the absence of a monopoly on weapons & force. If anarchy gives me this chance then I'll take my chances with anarchy. Death before dishonor? How about an even better deal - a risk of death before a life of no honor & no hope! This is the offer of liberty. So, MR or MS State, please don't bother me. I'll take my chances with a few stray ""criminals"" & ""terrorists"". Thank You, Gary Jeffers * p.s. Bob Black originally said ""terrorists are soldiers who fail to dress for success."" PUSH EM BACK! PUSH EM BACK! WWWAAAAYYYYY BBBAAACCCCCKK! BBEEEAAATTT STATE!

1 0

Re: Mac encryption
by kkirksey＠world.std.com 17 Dec '03

17 Dec '03

>What is everyones opinion of the best encryption software forthe Mac? >Frederic Halper I've been using Kent-Marsh's CryptoMactic since last August and have been very pleased with it. It supports two proprietary (i.e. useless) algorithms, LightningCrypt and QuickCrypt, as well as DES, DES-CBC, and Triple (two key) DES. It automatically overwrites your plaintext with a pattern of your choosing. It's fairly quick, and it does what it claims. I do have a couple of minor nit-picks with it, however: 1) No support for IDEA. They've left the architecture open for additional encryption modules, but they've yet to produce the documentation (_Insided CryptoMactic) for the programming interface. I talked with one of Kent Marsh's people back in August and expressed an interest in writing an IDEA module for them, and he thought it was a great IDEA and would get me a copy of _Inside Cryptomactic_ when it was ready. I checked back with him last month, and they still don't have _IC_ together yet. 2) The Allow override feature. One of CryptoMactic's preferences lets you override encryption on any file if you have this feature activated. You simply run the CryptoMactic Administrator program from a floppy (you shouldn't be dumb enough to install it on your hard disk), enter your (entirely optional) password, chose the file you wish to decrypt, and click "Override". If you have the override option on, the security of your files is only as good as the physical security of your master floppy, especially if you do not choose to password protect the administrator app. How hard is it to crack the password on the administrator app? I'm working on it; I'll let you know.... :-) Until then, I'm leaving this option off. 3) The overwrite patterns. I'd like to see a little more flexibility in user defined patterns, akin to what Schneier suggests in _Applied Crypto_. JMHO, of course, Ken ============================================================================= Ken Kirksey kkirksey(a)world.std.com Mac Guru & Developer ----------------------------------------------------------------------------- Harassment is a power issue, and power is neither male nor female. Whoever is behind the desk has the opportunity to abuse power, and women will take advantage as often as men. - Michael Crichton (in _Disclosure_)

1 0

MISC: gopher & anon ftp
by Karl Lui Barrus 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- About the gopher site: I'm not sure how "easy" it will be to make the files available via anonymous ftp as well. I know Chael is running an anonymous ftp site on chaos, but I'm not sure where it's directory lives... the gopher data directory is within my own directory hierarchy. It may be hard to overlap the two and preserve the security standards Chael wants to maintain. Disk space is tight so just making a duplicate copy is probably not the way to go ;) However, I do back up the gopher data every month or so (and so does Chael!), and since I will be adding 10 or 15 more files over the next week (from anonymous video rental to magic money) and re-arranging the ones already there, I'd be willing to mail you or anybody else uuencoded, gzip'ed tar files. Since most (all?) files have more than eight character names, producing MSDOS compatible file names may be a problem, since there will be some collisions. And I like gopher! It's great for just browsing around :) For a while I was thinking of an "anonymous mail drop-off/pick-up" where mail sent would be filed in a gopher accessible directory. So for example you could reach Pr0duct Cypher, Deadbeat, Wonderer, etc. by mailing here and waiting for them to read your message via gopher. Problems concerning disk space and the lifetimes of messages would need to be addressed, as well as whether or not they would even use such a system to receive messages. Karl Barrus <klbarrus(a)owlnet.rice.edu> -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLXFAF4OA7OpLWtYzAQE5TwQAgLgoO/XotPD6YXX+Tb4JVQK7NuWoSDx6 1Lsa4Q6fhEkODXd/S6biZ65ZBkQypd25VspWniDwkzaHid6JsSot7Ow3pFemW/sc snCKi8vN2ZrupXuHDfhqB9yv+nSBhZ7c1/xdAaKjHje3IB3zGqfna1EfEp0lMzzI xax6Ng3buCU= =ZKl+ -----END PGP SIGNATURE-----

1 0

Re: standard for stegonography?
by Jef Poskanzer 17 Dec '03

17 Dec '03

On reflection, it seems that some users will want an interoperable standard, and other users will want complete stealth. So what I'll do is add a bunch of switches to pnmstego and pnmdestego, so that the user can specify all sorts of different formats. Letting the switches default will get you a simple interoperable mode, so you can send stuff to people without prior arrangement or put stuff on an ftp server; but an attacker will be able to extract the bits and try to decrypt them. Specifying things like offsets and bit-usage schedules will mean that the attacker won't even be able to extract the bits; but the settings you use will be equivalent to that much more key material that you have to communicate or remember. --- Jef

2 1

Newton Crypto?
by Matthew J Miszewski 17 Dec '03

17 Dec '03

Does anyone know of any packages available for/on the Newton or any other personal managers? Last I heard, even the password was in plaintext. --Matt ______________________________________________________________________________ In defense of liberty, encrypt for all purposes, civil and professional. In defense of privacy, encrypt all correspondence, personal and professional. In defense of sanity, do not encrypt your dry cleaning invoice! ++++++++--------mjmiski(a)macc.wisc.edu (c)1993

1 0

Re: standard for stegonography?
by Matt Thomlinson 17 Dec '03

17 Dec '03

Sergey Sez: > Have the offset default to the checksum-value of the reciever's public key! > The sending program could have the user specify the reciever, look his key > up in the public-keyring and offset the message accordingly. While, the > recieving program would automatically scan the file starting at the > appropriate offset based on the same public key checksum-value. While Tim May Sez: > Lots of options for standards. As others have noted, you just don't > want to have to flag what standard you're using in the message itself > (in plaintext, else why bother?) as that means the stego use is not > longer plausibly deniable. I think these two have a lot to do with each other. Sergeys' suggestion would definitely make it a tougher to pick out a starting place to search for hidden text. However, the message (if it is ever found in the file) points to the intended recipient. This defeats the purpose of "stealth pgp", (which would probably be used in this case to strip off telltale headers and such). If you weren't worried about this type of deniability, though, I don't see a problem with it. mt Matt Thomlinson Say no to the Wiretap Chip! University of Washington, Seattle, Washington. Internet: phantom(a)u.washington.edu phone: (206) 548-9804 PGP 2.2 key available via email or finger phantom(a)hardy.u.washington.edu

2 1

Anonymous Credit Cards
by geoffw＠nexsys.net 17 Dec '03

17 Dec '03

Anybody know anything about this?... ----- Begin Included Message ----- Path: internex.net!thumper.bellcore.com!owner-imp-interest From: dmk(a)allegra.att.com (Dave Kristol) Newsgroups: mlist.imp-interest Subject: Anonymous Credit Card on the Internet Date: 24 Feb 1994 14:57:19 -0800 Organization: InterNex Information Services, Inc. Lines: 71 Sender: daemon(a)internex.net Message-ID: <199402242247.RAA25510(a)thumper.bellcore.com> NNTP-Posting-Host: gaia.internex.net The anonymous credit card (ACC) protocol (paper available at research.att.com/dist/anoncc/anoncc.ps.Z and collude.ps.Z) is meant to be used the way a conventional credit card is - at the Point-of-Sale. (Awhile back) Gingery correctly pointed out that it can be extended to make an anonymous mercantile protocol on the Internet. We have made such an extension that can be used on the Internet to perform two functions: anonymous funds transfer from a customer to a seller, and anonymous delivery in the reversed direction. The delivery can be made either over the Internet, e.g. files, or otherwise, e.g. books, CDs. The following gives an overview of the protocol; a more detailed description of the protocol, including motivations for anonymity, can be found in a working paper available at research.att.com:/dist/anoncc/accinet.ps.Z. Overview of Protocol --------------------- A customer can purchase multiple files in a single session. How the customer chooses files of interest is outside the scope of our protocol. A session proceeds in three phases. In phase 1, a customer transfers funds anonymously from his/her bank account to the seller's bank account. The customer obtains a receipt from the seller's bank certifying the deposit, which he/she presents to the seller to open a session account at the seller. In phase 2, the customer makes possibly multiple requests of files from the seller. The seller deducts the purchase prices from the session account and delivers the files without knowing the identity or address of the customer. Phase 3 is entered when the customer finishes all desired purchases (or when the session account runs out of money). Any balance in the session account is refunded anonymously to the customer's account. Information separation and cryptographic techniques are applied to hide from each party the information the party does not need to perform its function. After a protocol session, 1) the customer's bank only knows that money has been withdrawn from (and deposited to) the customer's account, but knows neither the purpose nor the source (and destination) of the transfer(s); 2) the situation at the seller's bank is similar; 3) the seller only knows that it is paid for the purchase of certain files, but not the identity or the address of the customer. Differences from Gingery's Scheme --------------------------------- Although Gingery's scheme and ours have much in common, there are also several differences between them. For instance, in Gingery's scheme, the customer communicates directly with the seller, whereas in ours, they can communicate through an intermediary that hides one's identity from the other if the customer desires a higher degree of anonymity. In our scheme, the customer initiates a funds transfer by sending a message directly to his/her own bank; in Gingery's, the request (in encryption) is instead passed to the seller, and then forwarded to the seller's bank, and finally forwarded to the customer's bank. Hence, our scheme requires less communication (and the communication can be further reduced if anonymity requirement is relaxed to the same degree as in Gingery's scheme). Finally, unlike Gingery's scheme, the seller is provided with a key and an encrypted address by the customer so that the seller can encrypt and deliver the purchased files without knowing who the customer is. The encryption not only guarantees secrecy to the customer, but also protects the seller's interest since otherwise any eavesdropper can obtain the information for free. Dave Kristol ----- End Included Message -----

1 0

No Subject
by nobody＠jarthur.claremont.edu 17 Dec '03

17 Dec '03

A continual subject of debate has been the privacy of swiss accounts... and lichenstein and luxemborg banks... according to a recent text I read on the subject the hot way to conduct banking in privacy by mail is to a. use a canadian PO Box to avoid US mail covers on swiss postmarked incoming mail... b. if the money is derived honestly(i.e. legitamate but underground businesses simply underground for tax-avoidance) and NOT drug dealing derived or from an offence that is also an offense in Switzerland, then all privacy laws on swiss banks apply...tax avoidance is specifically excluded as an area where US. TLA can obtain cooperation of swiss authorities. c. Swiss Banks issue credit cards on accounts... :) d. further privacy is derived via a trust or corporation in Lichenstein and transferring the mony to said trust or corp from a swiss bank... e. A list of Swiss Banks to start with: Union Bank of Switzerland Bahnhofstrasse 45 8021 Zurich, Switzerland Telephone: 29-4411 Swiss Bank Corporation Aeschenborstadt 1 4002 Basel, Switzerland Telephone: 23-2323 Swiss Credit Bank Paradeplatez 8 8021 Zurich, Switzerland Telephone: 29-2811 Foreign Commerce BAnk Dept 284 Bellariastrasse 82 8022 Zurich, Switzerland Telephone: (01) 45.66.88 Foreign Commerce BAnk Dept 42 3 Rue de Marche CH-1211 Geneva 3 Rive, Switzerland Telephone: (01) 21.42.33 Bank Indiana Suisse Attn: F.C. Mishari 50 Ave. de La Gare 1001 Lausanne, Switzerland Telephone: 20.47.41 Bank Leu Postfach 8022 Zurich, Switzerland Cambio & Valorenbank Postfach 535 8021 Zurich, Switzerland Ueberseebank, A. G. Limmatquai 2 8024 Zurich, Switzerland f: All of the above was derived via "Personal Privacy through Foreign Investing..." and "How to determine Undisclosed Fianacial Interests" "a Manual for financial investigators.. both by loompanics press.... I am checking the above banks to see if ANY are internet connected and would be willing to receive orders via signed PGP messages If the above is positive I will get back to the group anon

1 0

RE: Civil Rights
by Blanc Weber 17 Dec '03

17 Dec '03

As I read the contribution from Jim Choate on the subject of "rights", I had some further thoughts & comments on the subject. Please delete if you don't care; it doesn't address cryptology directly, but some of you *are* interested, and if you have further comments please just send to me and copy only those others who also have expressed interest. ~ Blanc ---------- >From Jim choate: Seems to me that a 'right' as is being discussed should be 'Civil Right'. When used in this context I believe a suitable definition would be the following: Civil Right A characteristic granted to a citizen of a country which is beyond the normal law making ability of that countries governing body. In effect it grants a citizen the ability to make decisions and act on them without regulation or permission being required by the government. It in effect says that there are certain facets of an individual which are outside the normal operations of a government and can not be regulated or otherwise controlled through legistlative means. ........................................................................ It is true that the term a "right" can mean different things, depending on how one is considering the word & its meaning; in terms of a governed society, the meaning should be considered within the context of action as limited by agreement/consent, as something that involves the group's assessment of what is to be allowed (or not) within the organization; what permission will be granted and by whom, for what purpose, considering the consequences to all involved. The ability to determine what shall be considered a "right" depends upon the knowledge and intelligence of those who can make such decisions, who can achieve a comprehensive view of the situation and put individual action into perspective within this sweeping view. Given such a requirement, I would question the order of things, in concluding what the proper source is for the establishment of what these right should be, and give serious examination to the interpretation of what the actual nature of our circumstance is, (within the context of a society "under" government, but with liberty & justice for all, etc.). It is a bit difficult to make a succinct sentence which comprises all of my thoughts into a few sentences, I hope the above is not too difficult to understand. Not to make an example of Jim's contribution, but it just so happened that going through the sentences in the paragraph offered by him, I found concepts which I see as sources ripe for confusion & contention: A characteristic granted....... . So, the origin of this 'right' is from the decision-making of those elected to make considerations of this kind, which no one else is permitted to make. And I wonder: what qualifies them for this, the exclusive right to determine what it is all right to do within the context of a governed body of people, to be the ones who "grant" permissions to move, to do, to act. i.e., the source of an allowance to movement comes not from the ability to think correctly about it, to make valid judgements, but only from a permission *granted* to one by another. This immediately puts an individual's own thinking in danger; there is created the possibility of having one's own decisions categorized as without merit because they do not serve the purposes of the government, or because they do not serve the purpose of the governed society (the significance of which is seen as more important than that of being an individual of a singular character - compared to, say, an amoeba which absorbs all, as societies often begin to imagine themselves to be and presume themselves to have the right to demand utter mindless conformity on account of their numerous fears of what wanton individuals might do). It is unreal, that the determination for what is a 'right' is thought to come not from the ability to think successfully about life, liberty & the pursuit of happiness, but from the position one has been awarded over other citizens. This is like the right to a position over their minds, as well. And the ability to think and to serve the purposes of one's own interest are seen, then, as a crime, unless first submitted to the State for review and authorization as politically acceptable and therefore allowable. ...it grants a citizen the ability to make decisions and act on them without regulation or permission being required by the government...... . who are all honorable men..... :>) who recognize the merit of being an individual, not simply a "member" or society; i.e., not a lesser being, a minor "element" of the greater good, the Great Society, but, au contraire, who is expected to engage (to the max) in the pursuits explicity named in the Constitution (or was it the Declaration of Intent, Know What I Mean, George). ...there are certain facets of an individual which are outside the normal operations of a government . . . . . . As an exception to the rule? where most of the facets of being an individual are *within* the "normal" operations of a government? This concept does not represent they way that I think of the activities or the boundaries of my life, nor what I would wish to impose on others (or no one that I could admire). I'm sure government employees would agree with this, where I would not. It really is necessary to consider what is "normal" for a human being first, rather than what is normal for a government. First there must be someone to be governed......and a satisfactory reason why they should be governed. ...certain facets of an individual... cannot be regulated or otherwise controlled through legistlative means . . . . So there are a "few" things to be acknowledged, after all, as existing outside the atmosphere of governmental control. You know, "legislative means" are only the precursors to action; legislation only arranges verbally the threat of what will later be done physically to someone if they do not comply. This statement implies that one is only free secondarily, but primarily exists within an environment of control (external to one's own). I don't think it was intended that citizens of the US think of themselves as regulated first and freemen second. I don't think this is the correct way to think about life per se, or about "rights" within the context of an organization. Furthermore, the truth of the matter is that legislation alone does not control my (or anyone's) actions from some power of its own, and it alone does not automatically convince me of what I ought or ought not do, simply because it has been written, and voted agreeably upon, by members of an electorate. They could all be wrong. The control which exists as brought about by legislative means is only the effect upon the mind of those who will fear the consequences, delivered by "enforcement personnel" armed with weapons of subjugation. And as we all know, legislators themselves have ways of getting around this fear and its expected consequences. But this does not necessarily do any justice to reality, the cause/effect that we live with in the 'real world', which it is our responsibility to come to terms with if we want to live and have a quality existence. And this is what is left out of legislation: that we have to come to terms with it (reality) independently, not only in association with each other, and that we have to do this first in regard to our own lives, before we worry about those of others. The direction of the concept of a 'right' is set towards group thinking (the collective), whereas the Constitution would set it in the other direction. Gosh, I'm so glad everyone on this list is crypto-anarchist and can appreciate the fine details of anti-government analyses. ~ finis ~

2 1

T-shirt update...
by Christian Void 17 Dec '03

17 Dec '03

We are slightly behind schedule... I've been swamped by work and everything else. The shirts will be screened starting this week, and should be done by next week. I'll keep everyone updated. Thanks to everyone who ordered. This project has been a lot of fun to put together, and despite the few mishaps, has gone almost flawlessly (aside from being behind schedule!). Christian Void /T71 | "I don't like it, and I'm sorry I | V/M/Research, Inc. cvoid(a)netcom.com | ever had anything to do with it." | P.O. Box 170213 Tel. 1+415-998-0774 | -Erwin Schrodinger (1887-1961) | SF, CA 94117-0213 * PGP v2.3a Public Key Available Via Finger *

1 0

Re: I have FOIA'd the Clipper Key Escrow databases
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Steve Bellovin writes: > Good strategy. I still wonder if the decrypted keys are (all) classified, > while the encrypted ones aren't. After all, the local cops' magic decoder > boxes can strip off that layer of encryption (as, of course, anyone > who steals one of those boxes or bribes a local cop). I'm puzzled by the applicability of "classification" here. The NSA can classify stuff, since they're part of the military, and a few other government agencies can (State Dept., I think?), but are NIST and Treasury able to do so? (Assuming, of course, that we maintain the charade that the NIST and NSA are separate for crypto purposes.) I don't think they can, and if they could, they wouldn't be able to give any of the classified stuff to regular local cops. If things become classified by the NSA handling them at key-setting time, then they can't give them to the so-called escrow agencies, or if they do, those agencies can't give them to uncleared people. Perhaps the NSA's secret backdoor mechanisms in the key-setting process are classified, since the nation would feel very insecure if they knew about them, but that's a separate issue. Keys for batches of chips the NSA burns for use by Defense Department users are a different story, and probably have a different Family Key than civilian-wiretapping keys, but they're probably handled under entirely different rules anyway. > Anyway, I hope the idea works, or at least drives them a bit crazy... Bill

2 1

Re: standard for steganography?
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Doing a pnmstego isn't quite the right approach, since it's a special-purpose tool that advertises its presence. A more appropriate general-use tool would be something like pnmbitplane, which would let you do something like extract a specific bitplane from a ppm or pgm as a pbm, and a reverse tool which would let you substitute or xor a pbm into a pgm or ppm, with appropriate options for the ppm versions that let you do one color, all three, etc., and for both ppm and pgm to let you pick which bitplane. You'd also have to add something appropriate for padding, like a random-fill vs. 0- or 1-fill option, or else provide a tool that makes a string of bytes into a bitmap shaped like a given pnm. Some advantages - it's more general, there are other uses for it (such as adding titles to ppm pictures), it's not much more work to write, and only the NSA agents reading cypherpunks will know that's why it's there :-). A disadvantage, of course, is that potential users may not guess, unless people tell them things like "Oh, yeah, you could use ppmbitplane to do that, of course". This also lets you reserve the name ppmstego for translating between ppm and Stego Mac format. Bill # Bill Stewart AT&T Global Information Solutions, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 fax-6399 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

2 1

MEET: NE Ohio
by Derek Atkins 17 Dec '03

17 Dec '03

I'm going to be in Cleveland, March 3-7 this weekend (all day Friday-Sunday inclusive), so if anyone would like to meet, possibly echange signatures, or just chat, please send me personal email before 4pm Thursday! Hope to hear from some of you... -derek

1 0