December 2003 - cypherpunks-legacy

Status ongoing Key-Escrow (black) Humor
by Anonymous 17 Dec '03

17 Dec '03

That makes 3 of 4 .... Ye olde Spooge Meister spooge /spooj/ 1. Inexplicable or arcane code <spooge(a)dev.null.net> or random and probably incorrect output from a computer program.

1 0

returned mail NIST call for Comments on "Key-Escrow" (fwd)
by uunet!lebanon.cerf.fred.org!daemon 17 Dec '03

17 Dec '03

Paul Ferguson | "Government, even in its best state, Network Integrator | is but a necessary evil; in its worst Centreville, Virginia USA | state, an intolerable one." fergp(a)sytex.com | - Thomas Paine, Common Sense Type bits/keyID Date User ID pub 1024/1CC04D 1993/03/15 Paul Ferguson <fergp(a)sytex.com> Key fingerprint = EE D2 93 7D 04 6D C6 05 AC 36 AD 9D 8E 4F 41 58

1 0

RSA in new Apple product RSA in new Apple product
by remail＠tamsun.tamu.edu 17 Dec '03

17 Dec '03

>From a discussion of Powertalk in TidBITS#195/27-Sep-93, an online zine published by "Adam C. Engst" <ace(a)tidbits.com>: ------------------- forward --------------------------------------- Key Chain The Key Chain is the third new Desktop icon and perhaps the most important PowerTalk feature. It provides quick, transparent access to any number of password-protected servers or services through a single system-wide logon password. All applications and services are integrated with a single security model. For every service, the user creates a key. Each key has account information, communications settings (such as. modem settings, addresses, and system identifiers), and an encrypted password. After this one- time setup, the user attaches the key to the Key Chain and can forget the password. From now on, the system will automatically and transparently connect to the protected service when needed. Apple feels that this mechanism is especially secure since a user will find it easier to remember a single, frequently-used password and will be less likely to write down a list of passwords. At any time, you can lock the Key Chain by issuing a command or through an inactivity time-out. When the Key Chain locks, all windows containing information from protected services are hidden. Apple claims that PowerTalk is more secure than most other off- the-shelf software solutions since those use less secure algorithms to avoid export restrictions. Apple is the first company to receive an export license for a DES-based product. A new "I am at..." menu item (e.g. Home, Office, Car, Hotel) lets the system know which services are accessible and automatically resets communications settings for Ethernet, modem connection, packet radio, etc. so the system can continue to transparently establish connections over available media. A PowerTalk server can act as a trusted party in establishing authenticated communications across the net. Network traffic is encrypted with the RC4 algorithm of RSA and delivered via ASDSP (Apple Secure Datastream Protocol). ASDSP adds only about ten percent to the communication overhead. At least in the initial release, peer-to-peer traffic cannot be encrypted. [Sorry for all the acronyms! RSA is a company. -Tonya] Digital signatures, based on RSA Public Key Encryption, provide a secure way of ensuring data has not been altered and was signed by a particular person. The mechanism is similar to Kerberos [a security system developed at MIT -Adam], which was not mature enough at the critical point in PowerTalk development. Apple anticipates supporting Kerberos in a future PowerTalk release. To sign a document, simply drops it on a Signer icon. A prompt for the personal signer code then appears on the screen. If the content of the signed document later changes in any way, the signature becomes invalid. While being signed, a file automatically is locked to avoid inadvertent invalidation. The Get Info window of a signed file is used to uncheck the file lock, and it contains a Verify button with which the recipient can assert the integrity of the file and authenticity of its signature. Large companies can become trusted signature issuing agents for their employees by obtaining a titanium blackbox with key interlocks from RSA. The box contains a certain number of key combinations and can be connected to a Macintosh which runs an RSA-signed signature issuing application. Individuals can acquire a personal signature code through a notary. RSA always is at the root of the issuing process and signatures expire after two years. The issuing cost of a digital signature runs about $25. One limitation of the signature mechanism, at least in the initial implementation, is that only one signature can be attached to a document. This may be worked around by designing forms such that each signatory vouches for the authenticity of the previous sender's signature. For an APS price list, send email to: <aps-prices(a)tidbits.com> For information on TidBITS: how to subscribe to our mailing list, where to find back issues, how to search issues on the Internet's WAIS, and other useful stuff, send email to: <info(a)tidbits.com> Otherwise, contact us at: ace(a)tidbits.com * CIS: 72511,306 AppleLink & BIX: TidBITS * AOL: Adam Engst * Delphi: Adam_Engst TidBITS * 1106 North 31st Street * Renton, WA 98056 USA ----------------------------------------------------------------

1 0

Zimmermann testimony to House subcommittee
by Philip Zimmermann 17 Dec '03

17 Dec '03

Testimony of Philip Zimmermann to Subcommittee for Economic Policy, Trade, and the Environment US House of Representatives 12 Oct 1993 Mr. Chairman and members of the committee, my name is Philip Zimmermann, and I am a software engineer who specializes in cryptography and data security. I'm here to talk to you today about the need to change US export control policy for cryptographic software. I want to thank you for the opportunity to be here and commend you for your attention to this important issue. I am the author of PGP (Pretty Good Privacy), a public-key encryption software package for the protection of electronic mail. Since PGP was published domestically as freeware in June of 1991, it has spread organically all over the world and has since become the de facto worldwide standard for encryption of E-mail. The US Customs Service is investigating how PGP spread outside the US. Because I am a target of this ongoing criminal investigation, my lawyer has advised me not to answer any questions related to the investigation. I. The information age is here. Computers were developed in secret back in World War II mainly to break codes. Ordinary people did not have access to computers, because they were few in number and too expensive. Some people postulated that there would never be a need for more than half a dozen computers in the country. Governments formed their attitudes toward cryptographic technology during this period. And these attitudes persist today. Why would ordinary people need to have access to good cryptography? Another problem with cryptography in those days was that cryptographic keys had to be distributed over secure channels so that both parties could send encrypted traffic over insecure channels. Governments solved that problem by dispatching key couriers with satchels handcuffed to their wrists. Governments could afford to send guys like these to their embassies overseas. But the great masses of ordinary people would never have access to practical cryptography if keys had to be distributed this way. No matter how cheap and powerful personal computers might someday become, you just can't send the keys electronically without the risk of interception. This widened the feasibility gap between Government and personal access to cryptography. Today, we live in a new world that has had two major breakthroughs that have an impact on this state of affairs. The first is the coming of the personal computer and the information age. The second breakthrough is public-key cryptography. With the first breakthrough comes cheap ubiquitous personal computers, modems, FAX machines, the Internet, E-mail, digital cellular phones, personal digital assistants (PDAs), wireless digital networks, ISDN, cable TV, and the data superhighway. This information revolution is catalyzing the emergence of a global economy. But this renaissance in electronic digital communication brings with it a disturbing erosion of our privacy. In the past, if the Government wanted to violate the privacy of ordinary citizens, it had to expend a certain amount of effort to intercept and steam open and read paper mail, and listen to and possibly transcribe spoken telephone conversation. This is analogous to catching fish with a hook and a line, one fish at a time. Fortunately for freedom and democracy, this kind of labor-intensive monitoring is not practical on a large scale. Today, electronic mail is gradually replacing conventional paper mail, and is soon to be the norm for everyone, not the novelty is is today. Unlike paper mail, E-mail messages are just too easy to intercept and scan for interesting keywords. This can be done easily, routinely, automatically, and undetectably on a grand scale. This is analogous to driftnet fishing-- making a quantitative and qualitative Orwellian difference to the health of democracy. The second breakthrough came in the late 1970s, with the mathematics of public key cryptography. This allows people to communicate securely and conveniently with people they've never met, with no prior exchange of keys over secure channels. No more special key couriers with black bags. This, coupled with the trappings of the information age, means the great masses of people can at last use cryptography. This new technology also provides digital signatures to authenticate transactions and messages, and allows for digital money, with all the implications that has for an electronic digital economy. (See appendix) This convergence of technology-- cheap ubiquitous PCs, modems, FAX, digital phones, information superhighways, et cetera-- is all part of the information revolution. Encryption is just simple arithmetic to all this digital hardware. All these devices will be using encryption. The rest of the world uses it, and they laugh at the US because we are railing against nature, trying to stop it. Trying to stop this is like trying to legislate the tides and the weather. It's like the buggy whip manufacturers trying to stop the cars-- even with the NSA on their side, it's still impossible. The information revolution is good for democracy-- good for a free market and trade. It contributed to the fall of the Soviet empire. They couldn't stop it either. Soon, every off-the-shelf multimedia PC will become a secure voice telephone, through the use of freely available software. What does this mean for the Government's Clipper chip and key escrow systems? Like every new technology, this comes at some cost. Cars pollute the air. Cryptography can help criminals hide their activities. People in the law enforcement and intelligence communities are going to look at this only in their own terms. But even with these costs, we still can't stop this from happening in a free market global economy. Most people I talk to outside of Government feel that the net result of providing privacy will be positive. President Clinton is fond of saying that we should "make change our friend". These sweeping technological changes have big implications, but are unstoppable. Are we going to make change our friend? Or are we going to criminalize cryptography? Are we going to incarcerate our honest, well-intentioned software engineers? Law enforcement and intelligence interests in the Government have attempted many times to suppress the availability of strong domestic encryption technology. The most recent examples are Senate Bill 266 which mandated back doors in crypto systems, the FBI Digital Telephony bill, and the Clipper chip key escrow initiative. All of these have met with strong opposition from industry and civil liberties groups. It is impossible to obtain real privacy in the information age without good cryptography. The Clinton Administration has made it a major policy priority to help build the National Information Infrastructure (NII). Yet, some elements of the Government seems intent on deploying and entrenching a communications infrastructure that would deny the citizenry the ability to protect its privacy. This is unsettling because in a democracy, it is possible for bad people to occasionally get elected-- sometimes very bad people. Normally, a well-functioning democracy has ways to remove these people from power. But the wrong technology infrastructure could allow such a future government to watch every move anyone makes to oppose it. It could very well be the last government we ever elect. When making public policy decisions about new technologies for the Government, I think one should ask oneself which technologies would best strengthen the hand of a police state. Then, do not allow the Government to deploy those technologies. This is simply a matter of good civic hygiene. II. Export controls are outdated and are a threat to privacy and economic competitivness. The current export control regime makes no sense anymore, given advances in technology. There has been considerable debate about allowing the export of implementations of the full 56-bit Data Encryption Standard (DES). At a recent academic cryptography conference, Michael Wiener of Bell Northern Research in Ottawa presented a paper on how to crack the DES with a special machine. He has fully designed and tested a chip that guesses DES keys at high speed until it finds the right one. Although he has refrained from building the real chips so far, he can get these chips manufactured for $10.50 each, and can build 57000 of them into a special machine for $1 million that can try every DES key in 7 hours, averaging a solution in 3.5 hours. $1 million can be hidden in the budget of many companies. For $10 million, it takes 21 minutes to crack, and for $100 million, just two minutes. That's full 56-bit DES, cracked in just two minutes. I'm sure the NSA can do it in seconds, with their budget. This means that DES is now effectively dead for purposes of serious data security applications. If Congress acts now to enable the export of full DES products, it will be a day late and a dollar short. If a Boeing executive who carries his notebook computer to the Paris airshow wants to use PGP to send email to his home office in Seattle, are we helping American competitivness by arguing that he has even potentially committed a federal crime? Knowledge of cryptography is becoming so widespread, that export controls are no longer effective at controlling the spread of this technology. People everywhere can and do write good cryptographic software, and we import it here but cannot export it, to the detriment of our indigenous software industry. I wrote PGP from information in the open literature, putting it into a convenient package that everyone can use in a desktop or palmtop computer. Then I gave it away for free, for the good of our democracy. This could have popped up anywhere, and spread. Other people could have and would have done it. And are doing it. Again and again. All over the planet. This technology belongs to everybody. III. People want their privacy very badly. PGP has spread like a prairie fire, fanned by countless people who fervently want their privacy restored in the information age. Today, human rights organizations are using PGP to protect their people overseas. Amnesty International uses it. The human rights group in the American Association for the Advancement of Science uses it. Some Americans don't understand why I should be this concerned about the power of Government. But talking to people in Eastern Europe, you don't have to explain it to them. They already get it-- and they don't understand why we don't. I want to read you a quote from some E-mail I got last week from someone in Latvia, on the day that Boris Yeltsin was going to war with his Parliament: "Phil I wish you to know: let it never be, but if dictatorship takes over Russia your PGP is widespread from Baltic to Far East now and will help democratic people if necessary. Thanks." Appendix -- How Public-Key Cryptography Works --------------------------------------------- In conventional cryptosystems, such as the US Federal Data Encryption Standard (DES), a single key is used for both encryption and decryption. This means that a key must be initially transmitted via secure channels so that both parties have it before encrypted messages can be sent over insecure channels. This may be inconvenient. If you have a secure channel for exchanging keys, then why do you need cryptography in the first place? In public key cryptosystems, everyone has two related complementary keys, a publicly revealed key and a secret key. Each key unlocks the code that the other key makes. Knowing the public key does not help you deduce the corresponding secret key. The public key can be published and widely disseminated across a communications network. This protocol provides privacy without the need for the same kind of secure channels that a conventional cryptosystem requires. Anyone can use a recipient's public key to encrypt a message to that person, and that recipient uses her own corresponding secret key to decrypt that message. No one but the recipient can decrypt it, because no one else has access to that secret key. Not even the person who encrypted the message can decrypt it. Message authentication is also provided. The sender's own secret key can be used to encrypt a message, thereby "signing" it. This creates a digital signature of a message, which the recipient (or anyone else) can check by using the sender's public key to decrypt it. This proves that the sender was the true originator of the message, and that the message has not been subsequently altered by anyone else, because the sender alone possesses the secret key that made that signature. Forgery of a signed message is infeasible, and the sender cannot later disavow his signature. These two processes can be combined to provide both privacy and authentication by first signing a message with your own secret key, then encrypting the signed message with the recipient's public key. The recipient reverses these steps by first decrypting the message with her own secret key, then checking the enclosed signature with your public key. These steps are done automatically by the recipient's software. -- Philip Zimmermann 3021 11th Street Boulder, Colorado 80304 303 541-0140 E-mail: prz(a)acm.org

1 0

Re: Problems of anonymous posts
by nobody＠soda.berkeley.edu 17 Dec '03

17 Dec '03

From: "Robert J. Woodhead" <trebor(a)foretune.co.jp> > Possible low-tech solution: mail-list software where the moderator has > the ability to screen messages from particular sites and/or accounts. I think the problem here is the amount of time which would be taken by the moderator. If you were going to go this route, you might as well have a completely moderated list. This slows down list turnaround and is a lot of work for somebody. > Question: how easy is it to use public information (ie: out of the > phone book), PGP and an anon-remailer to create a "Fake ID" I'm not sure what you mean here. Perhaps you are talking about someone who posts saying, "Hi, this is Bill Gates, I just joined your list, and here's my PGP key, I'll just be posting through these anonymous remailers for now. Oh, and to prove it's really me, my annual salary is such-and- such, which you can confirm by reading the most recent annual report from Microsoft." This wouldn't fool anyone for an instant. Or, someone posts and says, "My name is Deadbeat, here is my PGP key, and I'll just be posting through anon remailers," then he does so for months on end. This also doesn't "fool" anybody, but does represent an ID which can get established and become as legitimate as other ID's on the net - in a sense, a "Fake ID"; this is what we call a digital pseudonym. Hal Finney

1 0

Re: Detecting double-spending (long)
by nobody＠alumni.cco.caltech.edu 17 Dec '03

17 Dec '03

For those of you who slogged through my description last week of Chaum's "simple" digital cash which detects double-spending, I've realized on further thought that a simplification is possible. Writing that long essay improved my own understanding of his system. Recall that the double-spending cash is the product, for i from 0 to k/2, of f(xi,yi)^(1/3), mod the bank's public modulus. f() is a one-way function, one which can't be inverted. xi and yi were a little complicated, and here is where my simplification comes in. Let xi be g(ai), where ai is a random number and g is a one-way function. Let yi be g(ai xor <info>), where <info> is Alice's identifying information, her account number. Normally the ai "blinds" that since it is random and it is xor'd onto it. But if ever both ai and ai xor <info> are known, <info> is revealed and Alice's goose is cooked. Everything else works as Chaum suggested; I have just eliminated his ci and di random numbers. In his proposal, g took two arguments, and ci and di were appended for the xi and yi cases. But I'm convinced now that these are unnecessary for our purposes. The purpose for ci and di are to provide "unconditional" anonymity to Alice if she doesn't cheat. Look what happens with my simpler system. She tells Bob ai and yi for certain i's. Now, g is a one-way function, but suppose Bob had a big enough computer to try all possible arguments to g. Sooner or later he'd find a value Z for which g(Z) was yi. So then he could figure that Z equals ai xor <info>, and he knows ai, so he could find <info>. This means that in my simplified system Alice is depending on Bob (and everyone else) being unable to crack g() in order to stay anonymous. Chaum's system is better. By having a g with two arguments he creates a huge number of solutions to g(Z1,Z2) = yi. There is no way for Bob to tell which one is right, so even with infinite computing resources he can't crack Alice's anonymity. My thought is, unconditional anonymity is really no better than computational anonymity in the real world. Eric Hughes often says "all cryptograpy is economics". In practice, beyond a certain point, anonymity would not be broken by a direct computational attack, but rather by other means - bribery, theft, etc. In the real world there is no such thing as "unconditional" anonymity. In practice, computational anonymity is enough. So my feeling is that for implementation purposes the ci and di in Chaum's system can be removed, simplifying the protocols somewhat, at the cost of reducing Alice's anonymity from unconditional to computational. Hal Finney hfinney(a)shell.portal.com

1 0

Re: why ecash is traceable
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 10:49 PM 9/15/95, Nick Szabo wrote: >Hal & Tim have made some interesting comments about payee untraceability. >I suspect it will clarify things to point out the orthogonality in >two of the major design choices: > >* Clearing: Offline vs. online >* Settlement: Deposit to payee's account vs. sending new cash to payee > >Because DigiCash wants their product to have payer, but not payee, privacy, >the current ecash(tm) software from DigiCash uses online clearing >and deposit to payee's account, but the three other combinations are >also quite doable if somebody wanted to implement them. The design that >allows symmetric untraceability combines online clearing with sending new >cash. This way the bank need not ID the payee Bob in order to credit Thanks, Nick, for summarizing this clearly in terms of these two axes. This symmetric untraceability is what I was getting at with my point about Bob clearing the transaction and getting back blinded cash. It's apparent that if Alice can get untraceable cash, and she tells her bank to go ahead and give the same kind of untraceable cash to Bob, then Bob can also get untraceable cash. .... >Offline clearing requires the potential to ID the payer in >order to punish double-spending after the fact. Offline clearing has many hurdles to overcome, and this "True Name" (ID) issue is not very attractive. Fortunately, the vast increases in Net speeds are on the side of online clearing, even for relatively small transactions. >Online systems without observers (such as ecash(tm)) don't >need to worry about trying to find multiple spenders, because this is >prevented by the online clearing. In fact, purposeful second-spending >is used to recover from some error conditions, specifically to determine >whether the payee in fact received the "coin" or not when there has been a >network error in the middle of a transaction. Distinguishing between >mistaken and fraudulent double spending is a very complex, not completely >tractable problem, so the current ecash(tm) punts it, which is reasonable >because it is online. An offline system would need an elaborate Sounds pretty compelling to me to concentrate on online clearing systems.... I can imagine limited needs for offline clearing, such as road toll systems, or parking tokens, etc. The amounts of money there can be somewhat limited, and the implications of double spending revealing identity are less serious. (Though I can imagine a worrisome scenario where a highway toll system "deliberately double spends" received tokens to track motorists...there may be precautions built into such systems that I just don't know about.) --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: CYPHERPUNK harmful. THE TRUTH IS TOLD
by Bill Stewart 17 Dec '03

17 Dec '03

>Hmmmm... If memory serves, a year or so ago there was just such a schism >when a prominent cypherpunk split off and formed the "cypherWONKS" list. :-) :-) And starting a new list lets us decided on a new LOGO to replace that old tacky rose-and-bits thingy :-) Cryptographic Professionals for Social Responsibility Cryptographic Industry Association National Steganography Alliance Cryptographers for Foreign Reflexivity Extremely Private Institute for Cryptography NII Institute of Cryptography American Cryptographic Legal Union Free Banking Institute Cryptographic Defense Taskforce Cryptographic Organization for Privacy and Security Entropy, Steganography, and Cryptography Research Organization for Women (If anything, what we need is a way to separate the technical/mathematical discussions from rants like this, but any time we get the list focused on mostly technical issues, the government goes out of its way to do something egregiously stupid or offensive...) Somewhat more seriously, though, there are times that it's useful to have a more respectable-sounding organization (or at least a letterhead...), that's open to participation by members and not just directors (which has been some people's concern about the EFF, CDT, EPIC, and maybe TAP or CPSR.) If none of those are respectable/accessible/non-socialist enough for you, and the British Cryptographic Privacy Association (or whatever their name was) can't be found or sounds too much like International Outside Agitators, and the various academic groups are too busy being academicly respectable to do political agitation ("CryptoAcademics Write Papers!"), then come up with a name and a Postscript letterhead, and start an email list that you can gateway to cypherpunks (as long as you can prevent duplications or mail-floods.) If the main goal is to have a calmer name and mostly the same activities, an alter-ego mailing list is one approach. #--- # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

RE: Mixmaster status
by loki＠obscura.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I apologize for being so terse in my first message. This is not a red herring. The organization that has approached me is very pro-privacy and anonymity. I see nothing but good coming from this venture. I will be very active in the development of the commercial version of Mixmaster. Let me be crystal clear. 1) I will not support any version of Mixmaster that is weakened. 2) All future clients will be able to generate the current message format. 3) All future servers will be able to read the current message format. 4) There will always be a free version of the client with source code. While I have not discussed it, I can not imagine that there would not also be a free version of the server code (with source). Without remailers what is the point of the client software? At 8:45 PM 9/14/95, ROBO Mixmaster Remailer wrote: >Flame Remailer <remailer(a)flame.alias.net> wrote: > >> Subject: Mixmaster status >> >> There has been an offer to purchase and commercially develop Mixmaster. >> This will hasten the development of Mixmaster for other platforms (e.g. >> Dos, Windows Macintosh), and bring significant improvements to the >> interface, but I will not compromise on the level of security provided by >> Mixmaster. Free client software will continue to be available. >> >> This could be the big breakthrough for remailers, finally thrusting them >> out of the hobbyist's closet into the corporate world. >> >> I wonder. Where is the commercial market for remailers? Who has an >> application for them except hobbyinst? Why would there be a commercial >> incentive to run a mixmaster server, or even a client? >> >> Could this "offer" be a red herring? > >I wondered the same thing myself. It would certainly be a more >cost-effective way for the NSA to compromise Mixmaster technology >than by brute force. > >Consider this scenario ... Mixmaster get's bought by the Acme >Crypto Company of Ft. Meade, MD. They "improve" it, and offer a new >version. It's even FREE (for non-commerical use)! But their >"improvements" make it incompatible with previous versions, and so >you have to upgrade. The new "commercial" version comes with no >SOURCE CODE, of course... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMFkzR/Pzr81BVjMVAQH6hAf+O+QdTEzNjUh0FYlJEnCakNws4MxPrOt4 miMPaz/aWDOReGb62UPZAEMNXP+hjgy0kTjW4xReTTBAPgtcsInr1Cct6MPr3O/r PGMGmE9z2Fkv3/k7MDG1NiptT2/RwVtmDikIJEQuH5j8ijir28Vvrk9Vs685Qc3j bFz5Q8uRLd57Uk51tQwIiBM6CJ4suQ3WFN++QNTHM9E47J9W8yFBux6ePWPlZOK8 8BnKkhY/auPm85X3MVZhL3y7F6zbFuqPpZrsKpwOOkme8o4l71t2xyhGcZHHxiB7 JLF2As9pNXsKWpYiPZEHTV9hsgxQTHortdhq25DeGyoxhZSrZByP/w== =+O16 -----END PGP SIGNATURE----- ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

3 3

Re: Explaining Zero Knowledge to your children
by Karl L. Barrus 17 Dec '03

17 Dec '03

At 08:18 PM 9/14/95 +0200, you wrote: >There is a paper about explaining Zero Knowledge methods in simple >words. It's titled "Explainig Zero Knowledge Authentication to your >children" or something similar. I think you are refering to Quisquater's (sp?) explanation, which is in terms of Ali Baba and a magic cave. A functionally similar explanation is in Schneier's Applied Crypto, pp. 85-86. -- Karl L. Barrus <klbarrus(a)infocom.net>

1 0

Washington D.C. Cyperhpunks Meeting Cybercast
by Thomas Grant Edwards 17 Dec '03

17 Dec '03

Catch the WashDC Cypherpunks meeting cybercast on CU-SeeMe tommorow, saturday Sept. 16 starting at 3:00 PM on the www.digex.net (205.197.247.33) reflector. CU-SeeMe software is videconferencing for PCs and Macs and can be found at ftp.gated.cornell.edu -Thomas

1 0

Re: your mail Re: on anonymity, identity, reputation, and spoofing
by nobody＠alumni.cco.caltech.edu 17 Dec '03

17 Dec '03

I do sympathize with L. Detweiler's concern about multiple identities. Human nature being what it is, if a series of posts appears quickly taking one view, people who disagree may think, well, I guess I'm in the minority on this, I won't make a stink about it. That's just part of the herd instinct, which, IMO, we all share. The lesson is that it is even more important on the net not to be afraid to take unpopular stands. You may find that there are more people who agree with you than you thought. In particular, although I think Detweiler's posts could be tightened up considerably, and I don't agree with his solutions in detail, I can understand his paranoia, having shared it from time to time. There are some possible technological solutions to some of the issues raised. Chaum, in his 1985 CACM paper, describes how "credentials" can be exchanged among various pseudonyms a person may have. A credential can basically be any statement by a 3rd party about a person. It could be a statement by a college that he had a certain degree. It could be a statement by a government that he had a driver's license. It could be a statement by a business that he was an agent for that business. The credential would be given to the person, then Chaum shows how it could be re-blinded and shown under other pseudonyms. The credential can be verified, but it can't be linked to the True Name or other pseudonyms of the holder. We could think about using something like this for reputations. Take Nick's question about how a new pseudonym could get through the filters. Maybe the person posts under his real name for a while, then some respected person is willing to give him a "valued poster" credential. He can re-blind this credential and submit it with posts he starts to make under his pseudonym. People will know that the pseudonymous poster is at least potentially capable of making sense, and give his words some weight. But there will be no connection to his True Name. (Of course, this could lead occasionally to a Dr. Jekyll who makes sensible and weighty posts under his own name, while under his Mr. Hyde pseudonym he rants and raves. But hopefully this would not happen too often.) Other credentials could be related to some of the other points Detweiler raised, such as list membership > some number of months. The point would be that these credentials are voluntary, used to get past people's filters, and that they retain poster anonymity while giving readers useful information about the poster. It's ironic that L. Detweiler, who has played a major part in spreading awareness of Cypherpunks technology through his widely read Privacy and Anonymity FAQ, is suggesting that people should be limited in their use of this technology. Still, the concerns he raises are going to be shared by many people, and we should try to be ready with technological solutions that are consistent with privacy protection. Hal Finney hfinney(a)shell.portal.com

2 1

Re: Why ecash is traceable
by loki＠obscura.com 17 Dec '03

17 Dec '03

At 9:46 AM 9/15/95, Timothy C. May wrote: >At 8:47 AM 9/15/95, Donald M. Kitchen wrote: >>-----BEGIN PGP SIGNED MESSAGE----- >> >>Excellent discussion on the subject, actually. However, your idea of >>the "first person to the bank" maintaining anonymity via remailer block >>is flawed. First of all, if a collusion with the bank is being taken into >>account, presumably sufficient enough resources are involved that someone >>may try and track the reply block. Mixmaster (as your messages mentioned >>by name) would be necessary to eliminate the chance of tracking the block >>through combinations of replay attacks etc. (Which reminds me, has anyone > >Just to clarify a minor point, I mentioned "mixes," not Mixmaster. I have >nothing against Mixmaster, but "mix" is the term Chaum invented for what we >later started to call a "remailer." > >--Tim May > Indeed Chaum's phrase "digital mix" was the inspiration for the name Mixmaster. -Lance ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

Why ecash is traceable
by Hal 17 Dec '03

17 Dec '03

There has been considerable discussion on sci.crypt and on the cypherpunks list about the fact that currently proposed digital cash is "traceable", or to put it another way, that there is no payee anonymity. This is an annoying asymmetry, where the payor is protected more than the payee. But there is a fundamental reason for this, which I want to explain here. It is not just perversity on the part of digital cash designers. The problem is that there is a conflict between the desire for payee anonymity and the need to prevent double spending. And preventing double spending is far more important, since without that the cash would be worthless. Here is how the conflict occurs. Suppose Alice has a piece of digital cash which she wants to spend with Bob. She goes through some protocol and transfers data to him. Bob, then or later, sends some resulting data to the bank and gets his account credited. Now if Alice spent that same coin with Charlie, we need to have the bank find it out. When Charlie deposits his data with the bank, and the bank compares that with what Bob sent in, there must be a red flag that goes up. The fundamental requirement of preventing double spending implies that Bob's and Charlie's data, when sent to the bank, has some correlation which will identify the fact that they both come from the same coin. It doesn't matter exactly what the form of this data is, or how it has been blinded and stirred, but if double spending is to be detected there must be a correlation which the bank can see. But this correlation is what makes the coin traceable. Suppose Alice is paying a coin to Bob via an anonymous network, and she and the bank are going to try to figure out who he really is. She goes through the payment transaction, and Bob sends his resulting data to the bank. Before doing so, though, Alice simulates a payment of the same coin to Charlie. Charlie doesn't actually have to be involved, Alice can just go through what she would have done if she had spent the coin elsewhere. The result of this simulated payment has been shared with the bank. Now, when Bob deposits his data, the bank compares it with the data Alice sent, the result of her simulated spending of the same coin. By the argument presented above, Bob's deposit will be flagged. It will correlate with the data Alice sent in since this will be the equivalent of a double-spending. So when Bob makes the deposit he can be linked to the specific coin payment which Alice made, and his anonymity is lost. It would seem that any system which is capable of detecting double- spending just from the information which the payees send in to the bank would be vulnerable to this. Systems which use tamper-proof observer chips to prevent double spending beforehand can avoid it, but of course if someone breaks an observer the whole cash system might crash. In general it does not look like payee anonymity is possible without giving up other very important features. Hal Finney hfinney(a)shell.portal.com

3 2

Re: Why ecash is traceable
by Donald M. Kitchen 17 Dec '03

17 Dec '03

Re: ecash being non-tracable if anon accounts are allowed... And if not, a market will probably develop to launder ecash. Don

1 0

Re: DD, pedaphiles, and Terrorists, oh my
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <9509141640.AA30602(a)zorch.w3.org>, hallam(a)w3.org wrote: >We never used to see kiddie porn on the internet. The net would go balistic if a >picture of a teen age nude was posted. Recently there has been a flood of hard >core paedophile material. There has always been nude teens on the net. The kind of pictures the most casual observer can take at any Mediteranian beach at any given day in the Summer. There is no real kiddy porn readily available on the net. I looked long and hard. Its a red herring. ANYBODY on this list seen some real kiddy porn on the net? I am talking intercourse, etc., not scans of six year olds from the Sears catalog, or naked boys building sandcastles on the beach. - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMFjDkioZzwIn1bdtAQEB0gF+M67Ih6WLAl8J9bxPZOBmyjxKsxUczpqv th5x7ZuILyuf/+bFTtcLKwbOnzZkIfpJ =pjLL -----END PGP SIGNATURE-----

3 2

PGP BUG/FEATURE: multi-platform keys
by nobody＠alumni.cco.caltech.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Recently I have received two keys that were unusable without modification (from wonderer and Sameer) because they were not prepared using canonical text. I had to replace all the carriage returns by hand (this is the workaround for mac users who receive PC keys). Why is non-canonical text even an option in pgp? Who would use it except by mistake? As long as I'm at it, here are some more macPGP2.3 bugs, for those who care. Trying to decrypt a message signed by a key I don't have causes a serious crash requiring reboot. Trying to select cancel in a signature dialogue just raises the same dialogue box instead of cancelling. I'm running on a powerbook 145 under system 7.0.1. Eternal!Optimist(a)anon.penet.fi (copyright 1993, Eternal Optimist [Ha Ha Ha]) 0) 0) =:()]-< <na26436(a)anon.penet.fi> -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLNe7R4jvfLxJbYYtAQFFHQP7BCqn1JKaI09wBrWnjOF73CPz7GetaC/y XL8zqhmzDdrGdLbWB/vBDgXW7z+2EJHazbvqaUhq1GQw8bq+opC2fe4mXcw2x3Y+ wliLy1CWDtfl24L8ah//nLQMtttfG4kXjiB8JqUnS7US+W3vvH3AXxi+wZb5W2qi 7gPXMErUCUA= =Ew/6 -----END PGP SIGNATURE-----

1 0

Re: Digital Fingerprinting
by James Caldwell 17 Dec '03

17 Dec '03

On 12 Sep 95 at 11:27, Andrew Loewenstern wrote: > Such technology would be very useful in business, especially the > high-tech industry. Think of how many non-disclosure agreements > are signed every day relating to new products developed for the > software industry alone. Many companies are very paranoid and > already 'fingerprint' information by using unique code-names for > projects, for instance. i.e. the spec sheet on their new GAK > crypto product they give to Alice may be code-named 'project foobar' > but the one they give to Bob may be code-named 'project burris'... > Then, when the information leaks out they check which person they > gave the document with that code-name and they know who to sue (or > at least not give any more trade-secrets to). It's very simplistic > but it has been know to work in the past. > > Most of the real technology for doing this is much better, of > course... However, what stops you from printing out a > fingerprinted document and scanning it back in, for instance? Well, there is selective wording, mispellings, punctuation and formatting. These can be corrected easily if allowed to be transported as a text or common file type. Another way is to place the document in a PItA proprietary graphical format for transport and viewing only, stego identifier imbedded if you chose * , so that every portion of the document has some indentifier imbedded in it. Many obvious and many devious. Electronic drawings with a harmless and useless circuit(s) added on , software with do nothing code (by design!:) ). Difficult and time consuming to do, but for megabuck items, no prob. Automated for an additional fee of course. Start a service industry for such, make money, pay me back by running a fast, reliable remailer. Idea is to make the thief go to some major effort and if the scanning option is used to make the deletions as obvious and telling as the former identifier. > andrew note* Makes a neat way of putting copyright & source information in picture and sound files, somewhat useless but every trip up helps.

1 0

e$: Progress and Freedom Conference this Summer
by rah＠shipwright.com 17 Dec '03

17 Dec '03

There was a pointer here to an article in the NYT or WSJ about the conference this summer of the Progress and Freedom Foundation, with muchos net.luminarios (Huber, Myhrvold, Barlow, Brand, Kelly, Dyson, Keyworth, etc.) in attendence. Topics were mostly about e$ and the causes/consequences thereof. I just saw this thing on CSPAN, and I thought it was way cool. Here's how to get it from CSPAN in case they don't run it again. Ask for Tape number 57759-63 CSPAN prices their tapes by the hour, at $35/hr. This tape is $105.00 CSPAN Department 53 Washington, DC 20055 In case I botched something above, or you want to put this on your favorite book-entry transaction account ;-), CSPAN's phone number is 202-737-3220 and ask for Viewer's Services. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

3 2

Hazard of encrypt to self?
by nobody＠eli-remailer 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I always encrypt stuff when I send it to the remailers. I always encrypt to myself along with the remailer, in case I need to look at the message again. But since trying to decrypt a message reveals the id's of the keys that can decrypt it, this reveals information about the sender of the message that wouldn't be available if I only encrypted to the remailer. A partial solution - I generated a new key pair to use for the encrypt-to-self function (a nice short one). I put some meaningless nonsense in the id, so anyone who observes my message on its way to the remailer will no know it is from Eternal!Optimist(a)anon.penet.fi (copyright 1993, Eternal Optimist [Ha Ha Ha]) 0) 0) =:()]-< <na26436(a)anon.penet.fi> -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLObHdojvfLxJbYYtAQEZAgP8Db7qpgqy17wmP91/zl5ZioF/53IIugpW eFjJVtT/UC0wEB/wdvQSBuG2xoXFPWxwWraEtWUCvsAP580juKiGSvmpZARxnm30 yfHVuqv+cfo8FYm7KJpWGdSIFmoqvG8h/a4wiGWMg/Dnai5wOZtRt0mWDyftj+gt EzgFJSwTtIc= =xEZA -----END PGP SIGNATURE-----

1 0

Re: laptop passwords
by Alan Olsen 17 Dec '03

17 Dec '03

At 01:22 PM 9/15/95 -0800, you wrote: >I've got a dilema. > 2 laptops that I just purchased at a police auction have passwords, >from what I can tell they are passworded at the cmos level. I would normaly >just pull out the battery and clear the cmos but these are laptops and I'm >not to comfortable about doing that. Any ideas? > >laptop1 - Toshiba Satelite Pro T2400CT >laptop2 - Epson Action Note 500 c I am not familiar with those models, but if they work like a regular AMI bios, try hitting ctrl-alt-delete at the password prompt. On many passworded bios it will get you right past it. That will at least give you enough info to see if there is anything worth saving. (I have no problem giving out that trick since I have found most bios passwords pretty useless unless used against the most clueless of users.) | Minister of Forced Caffinization in the DNRC | alano(a)teleport.com | |"The moral PGP Diffie taught Zimmerman unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.| | http://www.teleport.com/~alano | <fnord> |

1 0

Re: Digital Fingerprinting
by Alan Olsen 17 Dec '03

17 Dec '03

At 12:28 PM 9/15/95 +5, you wrote: >Another way is to place the document in a PItA proprietary graphical >format for transport and viewing only, stego identifier imbedded if >you chose * , so that every portion of the document has some >indentifier imbedded in it. Many obvious and many devious. Electronic >drawings with a harmless and useless circuit(s) added on , software >with do nothing code (by design!:) ). Difficult and time consuming >to do, but for megabuck items, no prob. Automated for an additional >fee of course. Start a service industry for such, make money, pay me >back by running a fast, reliable remailer. I seem to remember a software piracy case from a number of years back. The case was settled by Apple showing that their code had been copied by the copyright "easteregg" hidden in the roms. Made for a quick and effective demonstration in court. (The story may be apocryphal, but it makes for an example as to how such things do have a (supposed) valid use in protecting code from being snagged by other companies.) | Minister of Forced Caffinization in the DNRC | alano(a)teleport.com | |"The moral PGP Diffie taught Zimmerman unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.| | http://www.teleport.com/~alano | <fnord> |

1 0

PRZ is still at large
by Philip Zimmermann 17 Dec '03

17 Dec '03

I have received several phone calls today from people who read some sort of April-fools posting on some newsgroup that I had been arrested for PGP-related stuff. Well, it isn't true. I'm still at large. I'm still unindicted. And still not sued. Someone had an idea that this would make a funny April fools joke. I hope this clears things up. Feel free to repost this message to all the relevant newsgroups, because I can't do it because the newsreader at my sight is having problems. I hope this cuts down on the phone calls. Philip Zimmermann prz(a)acm.org

2 1

SecureDrive News - Win95 yes, Iomega zip drive no
by edgar＠highnrg.sbay.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- SecureDrive Users, I have seen inquires here and received direct e-mail enquirinq about SecureDrive and WIN95, and the Iomega zip disk. I have recently heard from users that SecureDrive 1.3d does work on Windows 95, although it does force it into "DOS Compatibility Mode", which is a performance hit on disk access. I've also heard that LOGIN does not work from a WIN95 DOS window, so has to be issued outside of Windows. I haven't heard anything specific about SecureDrive 1.4, but I believe it should work the same as 1.3d on WIN95. I'm sorry to report that SecureDrive does not support the Iomega ZIP drive. I believe that's because the TSR driver supplied with the hardware does not support a DiskBIOS interface. I had thought that Secure Device, another real-time encryption system, would support this drive, since it works through a device driver mapped to a dos file. But an actual trial proved otherwise. The problem is that the DOS file must be present when the CONFIG.SYS DEVICE= statement for the SECDEV.SYS is processed. But the zip drive driver is a TSR that doesn't get loaded until after all DEVICE statements have been processed. There's no particular reason that Iomega couldn't have written their driver as an MSDOS device driver rather than a TSR, in which case SecureDevice would probably work, but they didn't, so it doesn't. Hope this info is helpful. If any of you discover any interesting new facts using SecureDrive, please let me know. Edgar W. Swank <edgar(a)HighNRG.sbay.org> -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMFirU94nNf3ah8DHAQEEHAQAg4IB1XDQdFIxHto1iTPpORjuubUdhRzD t8MT350E0KZVCMSj+Vh4y4wEPw2dmms/QY1iMxuwVV/lja+l9yHaRPuxpi5EjQdv Mi8Sk73M/gcL35TTjUli5dnjzHsJ6uYt5Q51j7s0EspJ1qprQlSlgmNvvOTqDgyf /he5BfEfAU4= =GXYT -----END PGP SIGNATURE----- --- edgar(a)HighNRG.sbay.org Keep Freestyle Alive!

1 0

number theory number theory
by catalyst-remailer＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- All right, a number theory discussion! >The integer N is prime if: > 2^N - 2 > --------- > N is an integer. Well, this is false. The above formula is derived from Fermat's Little Theorem, or Euler's Generalization of Fermat's Little Theorem. a^(n-1) = 1 mod n, n prime, gcd(a,n) = 1 ==> a^n = n mod n a^n - n = kn, for k some integer (a^n - n)/n = k, for k some integer now sub in a = 2. However, the converse of this is not true (n isn't necessarily prime if it satifies the formula). Composities that satisfy this are called pseudoprimes. For example, for a = 2, n = 341 satisfies the relation, so 341 is a pseudoprime base 2. Now it works "most" of the time, and in fact one method of testing large integers for primality is to choose a whole bunch of a's and plug in n. If a^(n-1) mod n != 1, the number is composite and can be rejected. But, if a^(n-1) mod n == 1, you can only be 50% sure n is prime. (Roughly speaking; Phil Karn notes that the PGP docs indicate a 50%, I've seen proofs that this pseudoprime test fails 50% of the time, etc. But these are upper bounds; the real percentage seems much lower and I haven't seen a tighter bound on it). There is a "strong psuedoprime" test, in which failure occurs for at least 25% of integers in the range, thus the probability that a composite will pass is at most 25%. Even better is Lucas' test, but it runs a bit slow. However, you can be unlucky and pick a Carmichael number, which will pass the pseudoprime test for all bases relatively prime to n (for all a such that gcd(a,n) = 1). Ray Cromwell advises to choose n = 561, the smallest Carmichael number (an excellent choice!) Carmichael numbers exist, they are relatively rare, formulas exists for generating some of them... Eric Hughes mentions that 1729 is the next Carmichael number... not quite true. 1105 is the next Carmichael number. (But congrats Eric for even remembering the third one!) ;) Now, some other topics: > For any number n which is prime, (2^n)-1 is also prime (Mersenne's > theorem). Hm... some confusion here. A Mersenne prime is of this form (2^n) - 1 where n is prime, but not all number this formula generates are primes. Mersenne primes are related to perfect numbers. An example of a composite of this form: for n = 11, 2^11 - 1 = 2047 = 23 * 89 > For any number n (2^(2^n))+1 is prime. (I might have that wrong, I > don't remember exactly) Well, no. These number are Fermat numbers, and while the first 5 (n=0 to n=4) but Euler showed that the Fermat number for n=5 is composite. As an aside, Fermat numbers satisfy the pseudoprime test. > For any number n, if the square root of (n!)+1 is an integer, it is > also prime. (This is interesting, but rather useless in practice) A couple of issues here: I think you may be remembering a different theorem, a consequence of Wilson's theorem. Wilson's theorem says: for any prime p, (p-1)! = -1 mod p The theorem I think you are referring to is: if P is the product of the remainders relatively prime to m, then P = +/- 1 mod m; +/- = plus or minus The congruence is +1 except in three cases: 1) m = 4 2) m = p^b (m is a power of an odd prime) 3) m = 2p^b (m is twice the power of an odd prime) I'm still trying to either prove or disprove your claim! Two followups relating the the original formula posted: > For any number a, 1<a<=n, n! mod a == 0; therefore, n!+1 mod a == 1. > n!+1 is prime. Prime numbers don't have integral square roots. Good analysis, except for the "n! + 1 is prime" part. The only thing you can say is n!+1 has no factors <= n. For example, n = 4, n!+1 = 25 = 5 * 5. > Well, it was quoted from memory, so it's possible that I made an > error, but it seems to work as stated... > For example : > (4!+1)^(1/2)=5 > (5!+1)^(1/2)=11 > (7!+1)^(1/2)=71 > I can't find a value which produces a result that is a non-prime > integer. (Of course that doesn't prove that there isn't one.) Still working on this... ;) -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLanNNYOA7OpLWtYzAQF10wP9GExbaoloiXqFe7AtXb/UzUHXhW3VDC1b mfD0RhgK2i0Dr05RW5FCvj/9i7Jxhrd3E26hTe5g4WckvIcvp+GWhE/5fkdtVMA9 THutX1ukGO/5qCxSRT4hVCeXStAz7tunkF3fcEQjPe8pSSvKxN8tw/wIZzclRDRx JDE4HYRhAz0= =OW8h -----END PGP SIGNATURE-----

4 4