December 2003 - cypherpunks-legacy

Re: Members of Parliament Problem
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 6:32 PM 11/17/1996, Peter Hendrickson wrote: >At 1:23 PM 11/17/1996, Timothy C. May wrote: >>At 11:43 AM -0800 11/17/96, Peter Hendrickson wrote: >> For the specific example Peter cites, of a member of Parliament who doesn't >> like the possibility of anonymity....well, he wouldn't be part of the >> DC-Net would he? Generally, there are no cryptographic solutions that will >> encompass the case where some member wants to speak anonymously, but no one >> else does. If a message originates from "someone in Parliament," but only >> one member of Parliament is set up to speak anonymously, then of course by >> simple elimination he is the speaker. As before, this is beyond any >> cryptographic solution. > It turns out - amazingly enough - that this is not true! It turns out - not so amazingly - that Tim is right! See Hal Finney's post of about this time. It turns out that the other Members of Parliament do have to cooperate. Sorry about that. Peter Hendrickson ph(a)netcom.com

2 1

HP's crypto technology
by Hal Finney 17 Dec '03

17 Dec '03

I was poking about on the hp web server, trying to get some more hints about the technology they are pushing: <URL: http://www-dmo.external.hp.com/gsy/press/sevcik.html> > Date: 7/11/96 > > Rich Sevcik, vice president and general manager of the Systems > Technology Group, testified to a U.S. Senate subcommittee June 12 on > the importance of cryptography to Hewlett-Packard's ability to compete > in the international marketplace and to the nation's high-technology > competitiveness. > > [...] > > In conclusion, he introduced HP's technology called the International > Cryptography Framework (ICF). Products based on ICF would contain a > suite of cryptography capabilities of various strengths and types, > all non-functional. A customer then could enable the desired types and > strengths of cryptography in conformance with export and host government > regulations by obtaining a stamp-size smart card (known as a "policy > card"), programmed to turn on the particular cryptography capability > allowed. This would protect the right of each nation to establish an > independent policy governing cryptography in digital communication and > storage. Sevcik showed the subcommittee members a prototype cryptography > unit and several policy cards. He said HP plans to have an initial > ICF product available later this year as part of a total smart card > system solution offered due to an alliance with Informix and GEMPLUS, > with other ICF-based products planned for next year. > > U.S. export license authorities are finishing their review of this > first-phase implementation of ICF. "We have been extremely pleased with > the responsiveness and cooperation of these agencies in the review of > our technology," Sevcik said. "We have every reason to believe that > the cryptographic unit and host systems will be granted liberal export > authorization consistent with our expectations for ICF." <URL: http://www.hp.com/csopress/95sep26.html> > Press Release > > HP Announces Alliance with Gemplus and Informix to Deliver Personal > Information Cards for Consumers > > U.S. Government Reviewing Industry-backed HP International Cryptography > Framework > > September 26, 1995 > > PALO ALTO, Calif., Sept. 26, 1995 -- Hewlett-Packard Company, Gemplus > and Informix today announced the formation of an alliance to develop a > secure infrastructure that will enable corporations to speed new services > to consumers via a credit-card-sized personal information card. > > These cards will carry several thousand times the amount of data carried > by currently available smart cards. Additionally, the data on these cards > will be fully encrypted for secure international communication, so the > card will be able to be used anywhere in the world. HP believes that > the U.S. government will authorize the export to commercial enterprises > of products in Phase I(1) of HP's international cryptography framework > standard -- one of the underlying technologies in the infrastructure > that will enable the international use of personal information cards. The > framework is based on HP's open cryptographic structure. > > [...]

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{'alpha'} = '<alias(a)alpha.c2.org> alpha pgp'; $remailer{'nymrod'} = '<nymrod(a)nym.jpunix.com> alpha pgp'; $remailer{"lead"} = "<mix(a)zifi.genetics.utah.edu> cpunk mix pgp hash latent cut ek"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; $remailer{"lucifer"} = "<lucifer(a)dhp.com> cpunk mix pgp hash latent cut ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash latent cut ek"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"balls"} = "<remailer(a)huge.cajones.com> cpunk pgp hash latent cut ek"; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp hash latent cut ek"; $remailer{"middle"} = "<middleman(a)jpunix.com> cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{"dustbin"} = "<dustman(a)athensnet.com> cpunk pgp hash latent cut ek mix reord middle ?"; $remailer{'weasel'} = '<config(a)weasel.owl.de> newnym pgp'; $remailer{"death"} = "<x(a)deathsdoor.com> cpunk pgp hash latent post"; $remailer{"reno"} = "<middleman(a)cyberpass.net> cpunk mix pgp hash middle latent cut ek reord ?"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. remailer(a)crynwr.com is _not_ a remailer. nym.alias.net is back up. There is no remailer at relay.com. Groups of remailers sharing a machine or operator: (cyber mix) (weasel squirrel) The alpha and nymrod nymservers are down due to abuse. However, you can use the nym or weasel (newnym style) nymservers. The cyber nymserver is quite reliable for outgoing mail (which is what's measured here), but is exhibiting serious reliability problems for incoming mail. 403 Permission denied errors have been caused by a flaky disk on the Berkeley WWW server. This seems to be fixed now. The penet remailer is closed. Last update: Mon 18 Nov 96 6:48:35 PST remailer email address history latency uptime ----------------------------------------------------------------------- jam remailer(a)cypherpunks.ca * ********** 14:29 99.94% balls remailer(a)huge.cajones.com - ********** 5:32 99.81% replay remailer(a)replay.com - **++****** 9:22 99.69% haystack haystack(a)holy.cow.net - ***#***--# 24:20 99.57% cyber alias(a)alias.cyberpass.net - +**+ ++** 37:22 99.46% weasel config(a)weasel.owl.de ++-++- 2:11:49 99.16% middle middleman(a)jpunix.com - -.- * +-- 1:53:39 98.71% lead mix(a)zifi.genetics.utah.edu +++++++++* 35:42 98.50% squirrel mix(a)squirrel.owl.de - ++--+-++ 2:19:11 98.29% reno middleman(a)cyberpass.net +*-- 1:16:19 98.24% lucifer lucifer(a)dhp.com - + ++++++++ 42:33 98.05% mix mixmaster(a)remail.obscura.com - -+..+++++- 2:00:45 96.31% nym config(a)nym.alias.net #* *#*# :42 95.87% extropia remail(a)miron.vip.best.com .--------- 9:21:36 92.07% dustbin dustman(a)athensnet.com - -++-- 3:39:00 69.30% exon remailer(a)remailer.nl.com ## 7:06:33 41.67% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

No Subject
by Piotr Kunio 17 Dec '03

17 Dec '03

unsunscribe

3 2

No Subject
by nobody＠replay.com 17 Dec '03

17 Dec '03

>While I don't believe many people in government are "evil" or have "bad >intentions," I'm a strong believer that _systemic_ or _institutional_ evil >is possible. Thus, the wide opposition to mandatory key escrow, just as >civil libertarians of all stripes would oppose mandatory tatooing of >national I.D. barcodes on arms, or the mandatory retro-fitting of all homes >with special curtains containing a police-accessible "transparency mode." And the vision of 1984 looms ever closer. Pity you guys guessed....your activites have put us 12 years behind schedule to date, and we're not happy about that. --NSA

1 0

Re: The Utility of Privacy
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

At 8:03 PM 11/17/1996, Black Unicorn wrote: >On Sun, 17 Nov 1996, Huge Cajones Remailer wrote: >> Are there similar sources of information calculating privacy risk? I >> don't think so. > >Ah, so let's ignore the risks, on the grounds that we have no idea what >they might be, or their magnitude. That's clever. I like that. The risks are not being ignored. What is there to fear? >> Informally, I don't know anybody who has suffered due to a loss of >> privacy. > >Your circle of associations must be limited. Examples? >> My question remains unanswered, probably because privacy isn't worth >> the effort. > >And no one can answer that question but you. Privacy is a personal >decision. I'm sure there are many out there who will suffer no harm even >if their SSN is published in the Wall Street Journal. The experience of others has value. >Why, however, fail to take out insurance when the cost is so low? Really >it doesn't take much in the way of effort or money to assure one's >privacy. (Hint: It's getting cheaper every day in some ways). > >Answer: Nearly all of the cost of privacy is concentrated in set up cost. >Maintaince costs are minimal once set up has been made. Yet getting over >that first hurdle is the biggest leap. Good. We are getting somewhere.

6 5

Re: Does John Gilmore...
by George A. Stathis 17 Dec '03

17 Dec '03

At 08:04 ìì 17/11/1996 -0500, Black Unicorn wrote: >> Given that the free market rule is "he who has the money makes the >> rules", please explain how anything less than "subsidized speech" (as >> you put it) is anything close to free speech? >> >> [For those who's assumptions rule their perception: I am *not* arguing >> that all speech should be subsidized. I am merely pointing out that >> the organization that is spending the money to broadcast is >> controlling the speech, hence it is *not* free speech in terms of >> freedom or cost.] >Again, you confuse free speech with free broadcast. Well, I propose a solution to this problem: I don't mind paying fees in fact, if the prices are reasonable. For instance THIS text was _paid_ for, since I pay my Internet provider a certain amount of money every month. It would be unthinkable, however, that my Internet Provider would mess around with THIS text, or with ANY opinion of mine (I am sure you agree). Now, a mailing list has _some_ similarities to the services of an Internet provider, except (usually) the _cost_. I am sure Mr. Gilmore would be more than happy to be _paid_ for the (faulty) services he provides (to his list-members), since e.g. 1900 members times $1 per 2 months (shall we say) would earn him (shall we say) 950 dollars a month; Not much perhaps in some countries, but enough in most places as compensation for the services he provides. The problem with Mr. Gilmore (apart from being an asshole) is really that he is rather a thick-minded proponent of censorship of his list's 'eccentric' members, that such subtleties don't even cross his mind. >Forward complaints to : European Association of Envelope Manufactures >Finger for Public Key Gutenbergstrasse 21;Postfach;CH-3001;Bern >Vote Monarchist Switzerland "Heaven is a place policed by the English, cheered-up by the the Greeks, and organized by the Germans. Hell is a place organized by the Greeks, policed by the Germans, and cheered-up by the English." ...And what have the noble Swiss got to with this shit? They are the bankers for both! :-) Regards George

2 1

No Subject
by Bovine Remailer 17 Dec '03

17 Dec '03

The report estimated no such thing..its an urban myth. Give me a citation for the statistic from the report. On Sun, 17 Nov 1996, blanc wrote: > From: Dr.Dimitri Vulis KOTM [cut] > dv: I don't think John Gilmore's sexual practices are *that* bizarre. > The Kinsey report estimates that 10% of the population shares his > practices. > > bw: I guess you think you're talking to someone who gives a flip.

1 0

Re: [Fwd: National Emergency]
by Bob Faw 17 Dec '03

17 Dec '03

At 10:15 PM 11/17/96 -0700, you wrote: >This information may be of interest to you. Forwarded with permission. > >--RJ Dawnne Gee Why Dawnne, this is only logical--considering that the new "WEB-access TV" set announced this week has been declared a "weapon" for export purposes by our government. When our leaders consider public information to be a threat to national security, we're in a whole lot more trouble than most folks realize. bob faw p.s. Go to bed, dude, it's getting late. ;-) bob ----------------------------------|------------------------------------- B. D. "Bob" Faw |NewMedia Editor, Columnist, Webmaster Poet, Scholar, WordSmith, Engineer|"American Wine on the Web" http://www.eee.org/bobfaw/ | (a complete Internet wine magazine) bob_faw(a)eee.org | http://www.2way.com/food/wine/ bfaw(a)cello.gina.calstate.edu| newbie(a)pobox.com author(a)pobox.com |Senior Writer, "Faultline" TV Series ----------------------------------|------------------------------------- Webmaster, "The Journal of International Information Management" (JIIM) http://bpa1.aic.csusb.edu/pages/students/info479/bfaw/jiim/ ----------------------------------|-------------------------------------

1 0

BayLISA: Randal Schwartz, Just Another Convicted Perl Hacker (fwd)
by Rich Graves 17 Dec '03

17 Dec '03

This should be QUITE entertaining. -rich ---------- Forwarded message ---------- Date: 17 Nov 1996 19:03:17 -0500 From: Laura de Leon <deleon(a)cat.hpl.hp.com> Newsgroups: ba.announce Subject: BayLISA: Randal Schwartz, Just Another Convicted Perl Hacker The BayLISA group meets monthly to discuss topics of interest to systems and network administrators. The meetings are free and open to the public. BayLISA holds monthly meetings on the third Thursday of each month at 7:30 PM PST. We meet at Cisco building J in San Jose, on Tasman Drive near First street. (This is across the street from the room we met in at Cisco last month). See www.baylisa.org for more information. The meetings are also broadcast via MBONE. NOTE: AS OF OCTOBER, WE HAVE MOVED TO CISCO. This is a new location. Thanks very much to Synopsys for hosting us. Schedule -------- November 21 Randal Schwartz: Just Another Convicted Perl Hacker This talk will describe how the speaker became a felon in the process of doing his job as a systems administrator in the well-publicized Oregon v. Schwartz case (victim: Intel). It will include some points about Oregon's current law and the implications of this case on the computer community. There will be a special focus on how to make sure this doesn't happen to you. There will be copies of Randal's new PERL book available if you would like to get one signed. BayLISA Board Elections & member meeting before the regular meeting At 7:00, Elections for the BayLISA board will be held. We encourage all members to vote. If you aren't a member, this is a good time to join (see our Web site) December 19 Our Holiday meeting-- Join us to share goodies and computer horror stories, as well as descriptions of stupid computer tricks. There will be a prize for best story. This is a very informal meeting, and will not be broadcast on the MBONE. January 16 Brent Chapman, Containment Zones (firewalls to keep people in) February 20 Standards efforts and how they will effect you March 20 Paul Vixie [Schedule subject to change] For further information on BayLISA, check out our web site: http://www.baylisa.org/ To get further information on the meeting location, you can also ftp it from ftp.baylisa.org:/location For any other information, please send email to: info(a)baylisa.org If you have any questions, please contact me or the info alias listed above.

2 1

FC97 Final Call for Papers
by R.Hirschfeld＠cwi.nl 17 Dec '03

17 Dec '03

Financial Cryptography '97 February 24-28 1997, Anguilla, BWI FINAL CALL FOR PAPERS General Information: Financial Cryptography '97 (FC97) is a new conference on the security of digital financial transactions. The first meeting will be held on the island of Anguilla in the British West Indies on February 24-28, 1997. FC97 aims to bring together persons involved in both the financial and data security fields to foster cooperation and exchange of ideas. Original papers are solicited on all aspects of financial data security and digital commerce in general, including Anonymous Payments Fungibility Authentication Home Banking Communication Security Identification Conditional Access Implementations Copyright Protection Loss Tolerance Credit/Debit Cards Loyalty Mechanisms Currency Exchange Legal Aspects Digital Cash Micropayments Digital Receipts Network Payments Digital Signatures Privacy Issues Economic Implications Regulatory Issues Electronic Funds Transfer Smart Cards Electronic Purses Standards Electronic Voting Tamper Resistance Electronic Wallets Transferability Instructions for Authors: Send a cover letter and 9 copies of an extended abstract to be received by November 29, 1996 to the Program Chair at the address given below. The extended abstract should start with the title and an abstract followed by a succinct statement appropriate for a non-specialist reader specifying the subject addressed, its background, the main achievements, and their significance to financial data security. Submissions are limited to 15 single-spaced pages of 12pt type. Notification of acceptance or rejection will be sent to authors no later than January 17, 1997. Authors of accepted papers must guarantee that their paper will be presented at the conference. Proceedings: Proceedings of the conference will be published online in the Journal of Internet Banking and Commerce. Instructions and deadlines for submission of final papers will be sent along with notification of acceptance. Stipends: A very limited number of stipends may be available to those unable to obtain funding to attend the conference. Students whose papers are accepted and who will present the paper themselves are encouraged to apply if such assistance is needed. Requests for stipends should be addressed to one of the General Chairs. Registration: Conference registration and information on travel, hotels, and Anguilla itself is available at URL http://www.offshore.com.ai/fc97/. Workshop: A workshop, intended for anyone with commercial software development experience who wants hands-on familiarity with the issues and technology of financial cryptography, is planned in conjunction with FC97, to be held during the week preceding the conference. For further information, please contact one of the General Chairs. Send Submissions to: Rafael Hirschfeld FC97 Program Chair CWI Kruislaan 413 1098 SJ Amsterdam The Netherlands email: ray(a)cwi.nl phone: +31 20 592 4169 fax: +31 20 592 4199 Program Committee: Matthew Franklin, AT&T Laboratories--Research, Murray Hill, NJ, USA Michael Froomkin, U. Miami School of Law, Coral Gables, FL, USA Rafael Hirschfeld, CWI, Amsterdam, The Netherlands Arjen Lenstra, Citibank, New York, NY, USA Mark Manasse, Digital Equipment Corporation, Palo Alto, CA, USA Kevin McCurley, Sandia Laboratories, Albuquerque, NM, USA Charles Merrill, McCarter & English, Newark, NJ, USA Clifford Neuman, Information Sciences Institute, Marina del Rey, CA, USA Sholom Rosen, Citibank, New York, NY, USA Israel Sendrovic, Federal Reserve Bank of New York, New York, NY, USA General Chairs: Robert Hettinga, Shipwright, Boston, MA, USA email: rah(a)shipwright.com Vincent Cate, Offshore Information Services, Anguilla, BWI email: vince(a)offshore.com.ai Conference, Exhibits, and Sponsorship Manager: Julie Rackliffe, Boston, MA, USA email: rackliffe(a)tcm.org Workshop Leader: Ian Goldberg, Berkeley, CA, USA email: iang(a)cs.berkeley.edu Financial Cryptography '97 is held in cooperation with the International Association for Cryptologic Research. Those interested in becoming a sponsor of FC97 or in purchasing exhibit space, please contact the Exhibits and Sponsorship Manager. A copy of this call for papers as well as other information about the conference will be available at URL http://www.cwi.nl/conferences/FC97.

1 0

Re: Cypherpunks, Inc?
by Remo Pini 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: azur(a)netcom.com, cypherpunks(a)toad.com Date: Mon Nov 18 14:00:17 1996 > Now why don't the cypherpunks put together something like the item > below? In fact, why don't we form some sort of Guild, trademark the term > cypherpunks (I'll volunteer) and offer cracking and security products > (like the one below) or services? A product security endorsement from > Cypherpunks Inc. could carry a lot of weight :-) "We", do, check out the cryptocd at www.rpini.com. - ------< fate favors the prepared mind >------ Remo Pini rp(a)rpini.com PGP: http://www.rpini.com/crypto/crypto.html - ----< words are what reality is made of >---- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv Comment: http://www.rpini.com/crypto/crypto.html iQEVAwUBMpBd4hFhy5sz+bTpAQFqewf/aJ/xx/hxZn1o/nMKJcLjauCpfcZmxX12 aGD2fJw8PncAzmZAnyxP0/ymK21+mdry1wZPsJXLtqrwJqT8nxPqEXXtfh19MHm9 HB1pDo0nYSOWfP7ENq3lNe995FGEvQ6EMiyy/7PxulcY+0T53Q78CTk6GD0KgPxd rqmfmxvqNuKERzCONhtirkiwkm2NjFT2ytd7H3VTFSUv7wIHGp2dFiiscC2csP2I XUlVlQ7w6TUGkO498qSY3wB+ZLHMYYkU21rvKgCTz4AZqmTLRWgZar5g3qlug1uS RA1r/GB3vfa6KuTcOGowt26FvROEsHu3ZSrZzOry8U0LMo2tgIcNtA== =vtPA -----END PGP SIGNATURE-----

1 0

FC97 Final Call for Papers
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: e$(a)thumper.vmeng.com Reply-To: R.Hirschfeld(a)cwi.nl Precedence: Bulk Date: Mon, 18 Nov 1996 11:46:13 +0100 From: R.Hirschfeld(a)cwi.nl To: Multiple recipients of <e$(a)thumper.vmeng.com> Subject: FC97 Final Call for Papers Financial Cryptography '97 February 24-28 1997, Anguilla, BWI FINAL CALL FOR PAPERS General Information: Financial Cryptography '97 (FC97) is a new conference on the security of digital financial transactions. The first meeting will be held on the island of Anguilla in the British West Indies on February 24-28, 1997. FC97 aims to bring together persons involved in both the financial and data security fields to foster cooperation and exchange of ideas. Original papers are solicited on all aspects of financial data security and digital commerce in general, including Anonymous Payments Fungibility Authentication Home Banking Communication Security Identification Conditional Access Implementations Copyright Protection Loss Tolerance Credit/Debit Cards Loyalty Mechanisms Currency Exchange Legal Aspects Digital Cash Micropayments Digital Receipts Network Payments Digital Signatures Privacy Issues Economic Implications Regulatory Issues Electronic Funds Transfer Smart Cards Electronic Purses Standards Electronic Voting Tamper Resistance Electronic Wallets Transferability Instructions for Authors: Send a cover letter and 9 copies of an extended abstract to be received by November 29, 1996 to the Program Chair at the address given below. The extended abstract should start with the title and an abstract followed by a succinct statement appropriate for a non-specialist reader specifying the subject addressed, its background, the main achievements, and their significance to financial data security. Submissions are limited to 15 single-spaced pages of 12pt type. Notification of acceptance or rejection will be sent to authors no later than January 17, 1997. Authors of accepted papers must guarantee that their paper will be presented at the conference. Proceedings: Proceedings of the conference will be published online in the Journal of Internet Banking and Commerce. Instructions and deadlines for submission of final papers will be sent along with notification of acceptance. Stipends: A very limited number of stipends may be available to those unable to obtain funding to attend the conference. Students whose papers are accepted and who will present the paper themselves are encouraged to apply if such assistance is needed. Requests for stipends should be addressed to one of the General Chairs. Registration: Conference registration and information on travel, hotels, and Anguilla itself is available at URL http://www.offshore.com.ai/fc97/. Workshop: A workshop, intended for anyone with commercial software development experience who wants hands-on familiarity with the issues and technology of financial cryptography, is planned in conjunction with FC97, to be held during the week preceding the conference. For further information, please contact one of the General Chairs. Send Submissions to: Rafael Hirschfeld FC97 Program Chair CWI Kruislaan 413 1098 SJ Amsterdam The Netherlands email: ray(a)cwi.nl phone: +31 20 592 4169 fax: +31 20 592 4199 Program Committee: Matthew Franklin, AT&T Laboratories--Research, Murray Hill, NJ, USA Michael Froomkin, U. Miami School of Law, Coral Gables, FL, USA Rafael Hirschfeld, CWI, Amsterdam, The Netherlands Arjen Lenstra, Citibank, New York, NY, USA Mark Manasse, Digital Equipment Corporation, Palo Alto, CA, USA Kevin McCurley, Sandia Laboratories, Albuquerque, NM, USA Charles Merrill, McCarter & English, Newark, NJ, USA Clifford Neuman, Information Sciences Institute, Marina del Rey, CA, USA Sholom Rosen, Citibank, New York, NY, USA Israel Sendrovic, Federal Reserve Bank of New York, New York, NY, USA General Chairs: Robert Hettinga, Shipwright, Boston, MA, USA email: rah(a)shipwright.com Vincent Cate, Offshore Information Services, Anguilla, BWI email: vince(a)offshore.com.ai Conference, Exhibits, and Sponsorship Manager: Julie Rackliffe, Boston, MA, USA email: rackliffe(a)tcm.org Workshop Leader: Ian Goldberg, Berkeley, CA, USA email: iang(a)cs.berkeley.edu Financial Cryptography '97 is held in cooperation with the International Association for Cryptologic Research. Those interested in becoming a sponsor of FC97 or in purchasing exhibit space, please contact the Exhibits and Sponsorship Manager. A copy of this call for papers as well as other information about the conference will be available at URL http://www.cwi.nl/conferences/FC97. --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

DOO_dad
by John Young 17 Dec '03

17 Dec '03

Several pieces on the export of encryption regs, the crypto czar, Motorola's crypto modem, PGP's buy of PrivNet, and Keytronic's finger-ID keyboard. Professor Denning opines that the HP doodad will include GAK. ----- http://jya.com/doodad.txt DOO_dad ---------- The NYT has a long report today on a pedophile computer racket run from a prison. With details on how investigators were able to break through hard drive security and use DejaNews to track a suspect. A prison computer business was used to cloak the kiddy pixels. Red flags the Internet's lurid prospects compared to the virtues of do-me-dads like the Times. see: www.nytimes.com

2 1

Squirrel goes Mixmaster-only
by Johannes Kroeger 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hello remailer users! I'm sorry, but my ISP complained that the huge mail traffic for squirrel overloaded their servers. Effective immediately, my remailer accepts only Mixmaster packets and is not listed in Raph's type-1 statistics anymore. The operation of the nym server at weasel.owl.de is not affected. Regards, Johannes - -- Johannes Kroeger <jkroeger(a)squirrel.owl.de> Send me mail with subject "send pgp-key" to get my PGP key -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: latin1 iQEVAgUBMpBs1bwPSJ4oQv5pAQF3Agf/UYmh1P7DM0Wqy9Dzoq/e0jZdvcTDHpNH 2MFohAmU1rYn0tKCRW1jUDkG8ULAmfM4HY+aSdKwoihndLL4wTRkhzcl2qePVx6L 69ZEs7EpTLpdiFuTAvIvAD8AInqRZY1WgKII9jk7gccU379gl8nxDZtlIyA89jrG 795R8QWysQs5zfyQ4VtS2s94ZchFJD+Wp5u6fsVhzklsjxwb43EdVZ4/dPUFo7nO azctBYNpWdJBW2Rf81zQDE2OPPs+2kXcvDXU/cg64gtGVGf+8okysEr2fEqdVkFe yQsFvpNngaClUSu6xxMIJXiTy3WlbEYXceQE6hUGStq/PkhqKxkqYQ== =nAT3 -----END PGP SIGNATURE-----

2 2

Re: The Utility of Privacy
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

At 11:13 PM 11/17/1996, Huge Cajones Remailer wrote: > Examples? How about the draft? The privacy protected child has options the others do not. Legal risk okay - beats getting shot. diGriz

2 1

RE: NT insecurity
by Kenneth L. Hamer 17 Dec '03

17 Dec '03

Really? Could you provide a reference for this assertion? What is the name of the "password file"? Where is it located on the disk? I'd be very interested to try this out on one of my test systems, especially if it is true. But my experiences with corrupted registry hives leads me to believe you are incorrect. NT usually does nothing so nice when it's registry is corrupted. That's why we keep "emergency repair disks" around 8-). - Ken >---------- >From: Adamsc@io-online.com[SMTP:Adamsc@io-online.com] >Sent: Monday, November 11, 1996 9:36 PM >To: cypherpunks >Subject: BoS: NT insecurity > >Given the recent comments about insecure machines, I thought it was >interesting to note that you can clear *every* password on an NT box by >using >a diskeditor to corrupt the password file (Boot off of a floppy and use >NTFSDOS if you have to). It'll reboot several times and then you'll be >allowed to login. > ># Chris Adams <adamsc(a)io-online.com> | >http://www.io-online.com/adamsc/adamsc.htp ># <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" >"That's our advantage at Microsoft; we set the standards and we can >change them." > --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review >editorial) > >

1 0

Re: Command confirmation request (057CCA)
by csa＠netmaine.com 17 Dec '03

17 Dec '03

ok

1 0

TIS + HP
by John Young 17 Dec '03

17 Dec '03

A blurb in the Wash Post today says that the HP roll-out this morning will include TIS's "trusted third party" product. "One essential ingredient in the equation: technology developed by TIS. TIS is so far the only company that has received permission to export encryption technology overseas that exceeds the government's existing threshold." Guess we'll know shortly who else in the System is to be Trusted with Information -- other than Thirds, Fourths and other Dots and Steves.

1 0

POC_ket
by John Young 17 Dec '03

17 Dec '03

WaJo reports today on IBM's tiny pocket computer that transmits data through the body -- to another body or to a device such as a telephone. Invented by Tom Zimmerman, formerly of the Media Lab, it can tell "anything you touch who you are." Being shown at Comdex. The body as a token. How to crack a human? Grab and squeeze out a pass phrase. ----- http://jya.com/pocket.txt POC_ket

3 2

Re: [REBUTTAL] Censorship on cypherpunks?, from The Netly N
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> If you do not send it to me by e-mail, I will never see it. > Why are you so paranoid that someone is reading your e-mail? > I never do anything criminal, so I could give a shit less if > everybody reads all of my fucking mail. I was trying hard not to get into this thread as it is basically just one long flamewar that is getting out of control but I have to comment here: There need be no reason for paranoia. I don`t call it paranoia, I call it constant vigilance, to demonize it is a statist position and tries to ostricise those who protect their privacy. Whether you do anything criminal or not is not the point. Indeed I would say that 90-95% of encryption usage is for perfectly legal purposes, and only about 0.1% of encrypted material is concerned with unethical acts rather than illegal acts. The point is you should retain the right to protect your privacy. Sure, it`s not illegal to put forward anarchist arguments in mail today, but do you really want your company boss knowing about it? I personally don`t work - I`m a student so it doesn`t matter to me, but whether it is right that your employement and political views should affect each other they do, so you should be able to protect yourself with technology... Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

4 5

RE: ideal secure personal computer system
by John Fricker 17 Dec '03

17 Dec '03

>Bill Frantz (frantz(a)netcom.com) said something about RE: ideal secure personal computer system on or about 11/17/96 5:37 PM >(Note that even if it only runs with a user's privileges, a Trojan horse >will have no problem stealing e.g. that user's PGP secret key ring. Not >everything of value is in system files. True enough. >Question, can a user-level Trojan >horse insert itself as a keyboard monitor and get the PGP pass phrase as >well?) In the September 95 issue of NT Developer Richard Wright describes an NT Key Log Service (started as a challenge after his wife threatened to password protect the familiy accounting software <g>). Source code for such a trojan is provided. Note that the Login screen is *never* hooked. There must be a way to walk the chain of system hooks. I'll let you know when I find it as that would be the key to writing a detector. --j ----------------------------------- | John Fricker (jfricker(a)vertexgroup.com) | -random notes- | My PGP public key is available by sending mail with subject "send pgp key". | www.Program.com is a good programmer web site. -----------------------------------

1 0

HP crypto-announcement and key recovery, from The Netly News
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Mon, 18 Nov 1996 09:03:25 -0800 (PST) From: Declan McCullagh <declan(a)well.com> To: fight-censorship(a)vorlon.mit.edu Subject: HP crypto-announcement and key recovery, from The Netly News The Netly News http://netlynews.com/ November 18, 1996 Under Lock And Key Recovery By Declan McCullagh (declan(a)well.com) As a non-event, it was a rather well-attended one. This morning Hewlett-Packard Co. threw a press conference in Washington, DC to announce that it had vaulted the Federal government's export restriction hurdles by including "key recovery" technology in its encryption products. At least that's what the press release said. The reality is somewhat less exciting: HP's announcement is crypto-vaporware. "We're not making any specific announcements of products today," admitted Doug McGowan, HP development director. HP's move comes after competitors such as IBM and DEC stole the limelight last month by being the first to buy into the Clinton administration's latest key escrow scheme which would allow U.S. law enforcement agencies to locate copies of the private keys used to encode files and communications. The company's announcement follows a presidential executive order signed last Friday codifying the administration's "key recovery" proposal unveiled in October, which the White House hopes will splinter an industry previously united in opposition to Federal regulations governing encryption exports. HP responded by flying CEO Lew Platt into town today to announce a product using plug-in hardware or software "activation tokens" that can vary by country -- but Platt admitted that the tokens don't exist yet. Rather, he admitted, it's only a product with "a security framework built into it" that currently uses woefully-insecure 40-bit DES encryption. Eventually, HP hopes to export crypto that's stronger, but the company declined to discuss details. Dave Banisar, a policy analyst at EPIC, says such a system would be "worse" than current policy. "It's got this new detection system in it that requires monitoring of your crypto use and program use to determine what the national government says is correct," he says. The "key recovery" technology HP licensing is likely to come from Trusted Information Systems Inc., a company founded by former NSAers that still enjoys close ties to the spook community. TIS's Commercial Key Escrow uses the 56-bit Data Encryption Standard and so was cleared for export on January 18, 1996. "This is the first step toward implementing key recovery. That's a policy that's just not going to solve the privacy problem for Internet users," says Alan Davidson, staff counsel for the Center for Democracy and Technology. "This is the first step on that road toward building key recovery for the world. It's a very dangerous thing." Clinton's executive order is carefully crafted to counter the three strategies that crypto privacy proponents have devised to kill the export rules: the public relations, the judicial and the legislative approaches. Netizens, privacy advocates and high-tech firms rightfully blasted the old export policy, which classified crypto as a "munition," as a relic of the cold war -- a sentiment with which even The New York Times agreed. So Clinton has reclassified it as a non-munition, yet the change is in name only: Netscape browsers remain subject to export controls. Several lawsuits are challenging the constitutionality of the old export regulations. So Clinton's executive order contains language that EFF's John Gilmore says is designed "to evade the current lawsuits" by taking aim at some of the legal arguments. Administration officials spent an unhappy summer on Capitol Hill being grilled by senators who were considering legislation to lift the crypto export embargo. So Clinton carefully crafted his announcement to defuse some of the reasons to pass this legislation when Congress returns in January. In other words, the White House has been able to answer or deflect many issues that netizens have raised in favor of strong encryption. But another argument may not be as easy to counter. Patrick Ball is a senior program associate at the American Association for the Advancement of Science who has traveled the globe teaching human rights workers how to protect themselves from oppressive governments. The stamps on his passport read like a who's who of censor-happy regimes: El Salvador, Ethiopia, Haiti, Guatemala, South Africa and Turkey. "I have done PGP training in every country I've worked in," says Ball. To Ball, the debate over crypto isn't about civil rights or businesses losing export dollars, but over something much more fundamental: human rights. He says: "Why do security police grab people and torture them? To get their information. If you build an information management system that concentrates information from dozens of people, you've made that dozens of times more attractive. You've focused the repressive regime's attention on the hard disk. And hard disks put up no resistance to torture. You need to give the hard disk a way to resist. That's cryptography." And that's a winning argument. ###

1 0

Re: Crypto Bounties: Another Thought that crossed my mind.
by Ian Grigg 17 Dec '03

17 Dec '03

snow(a)smoke.suba.com said: > Well, I was thinking, what if a "Crypto Software Bounty Server" > were set up, so that someone could propose a tool that they would like > to see, along with an initial bounty. Others could contribute toward that > bounty (anonymously if they wish) until either the tool was delivered. > > The original issuer sets standards for the software (i.e. "easy to > use interface to mixmaster remailers for Macintosh", then must define > easy to use; Software considered delivered when in [alpha beta late-beta > &etc.]). The first to present software meeting these qualifications gets > the bounty, with the caviate that the software must be either gnu-copylefted, > or some similar "free use" copyright, after all, "The Net" paid for it... Hmmm. This is a one shot game (is that the term?) whereas software generally has implications that escape a single sale scenario. For example, the more difficult the software, the more risk there is that someone else will beat you, thus lowering the real risk-adjusted payoff dramatically. For this reason, more complex stuff would need some sort of contract+reputation scenario that allows a repeating game to work. A contractual alternative could work like this. I (the initial desirer) write a contract specifying my requirements. I publish this as a market tender, where other desirers can contribute funds, and this becomes a cumulative sum that grows. Programmers can offer to supply by naming a price. The market clears when the pot of desire equals or exceeds the lowest offer to supply. In a simplistic scenario, the contract is now sealed and the work is done and paid for. In order to overcome project failure, I could write my contract as a multi-supplier seed project (often done by governments). That is, the pot gets shared around, say, the three best alternatives. Once supplied, all are free to pick from the alternatives. In order to overcome the low silly bid, somehow reputation would have to be built into the market. That is, your efforts in the past as programmer will cause your solution to be better valued than mine. So perhaps we should turn this around. Programmers would write contracts to supply the given requirements at clearance+T, also specifying the clearance price. Your price is 2000 for the widget, mine is 1000. (That makes three contracts, a widget spec, my work plan and your work plan.) The market (the desirers) would then push funds back and forth between the two until it became clear that one or the other cleared. As more pressure increases, more funds pour in. Then, deliverables could be phased, with monies similarly phased, so that the market has a chance to monitor. Now, if it is not delivered, reputation suffers, and you have to lower your price for the next job (or hide in shame). There's a lot of aspects of newbies and switching funds that I havn't really thought through here. However, I like this viewpoint because it eliminates the need for judges. History shows that a good market microstructure will beat an authority approach in the long run. Also note that if you drop the free software assumption, and make it, say, moneyware, then the market becomes much more workable - the asset being traded is a share of future revenues. This has more ramifications than might be obvious: Propose a market to write a GAK killer for e$10,000. If it clears and is built, is the Dept. of Justice forced to buy the rights out? > Has anything like this been proposed before? I don't know if this has been proposed before, but it is a logical conclusion of the CP world. If the Internet transaction costs make single-person economic entities the most efficient unit in the machine, and e$ in all its forms provides the oil, then we need some way to connect up the parts for grand projects where there are hard cash incentives. There has to be some mechanism to distribute that cash in the most efficient manner to produce the result. BTW, this is a here and now issue, not a hypothetical future. We have already found that there is too much work on our plate, and limited efficiency in farming it out. Others may have found the same. -- iang iang(a)systemics.com

4 4

Re: Members of Parliament Problem
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> I don't quite follow how this would work. If Trent issues a blind > signature, then that means (doesn't it?) that he doesn't see what he > is signing. So how can he confirm that the message is actually from > a member of the group when he doesn't see it? I should have elaborated a little on this. My idea was that trent should be able to decrypt the message and verify it was meaninful (at least probably so) by some form of frequency analysis, as he would be a computer program this would not be a significant time loss in a system with few users (such as parliament as suggested with the initial problem) if the resulting message didn`t have approximate frequency distributions of letters you would expect in natural langauge or source code or whatever the message would not be published as it is probably an invalid key being used thus decrypting to garbage. A better way to do all this would probably just be to have Bob sign the message then Trent strip the signature before signing it himself but I just dashed this off as a quick response without really thinking it through. A nicer protocol would be one where the key distribution is easier initially (isn`t this always the case ;-)) or even a protocol which isn`t arbitrated, like your reply said Chaum mentions protocols for this. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0