December 2003 - cypherpunks-legacy

NTSC version BBC-4 show (cryptography/privacy)
by baum＠apple.com 17 Dec '03

17 Dec '03

I have a copy of the recent BBC 4 show on cryptography & privacy, transferred from PAL to NTSC so it can be watched here. Anyone who wants to borrow it (& lives in the SF Bay area) is welcome to email/call me to arrange to borrow it. ************************************************** * Allen J. Baum tel. (408)974-3385 * * Apple Computer, MS/305-3B fax (408)974-0907 * * 1 Infinite Loop * * Cupertino, CA 95014 baum(a)apple.com * **************************************************

1 0

Re: Commercial Mixmaster (was Re: Mixmaster status)
by loki＠obscura.com 17 Dec '03

17 Dec '03

That is correct. The current code can not be recalled. That is part of why I released it that way. So that I could not be coerced into withdrawing it. -Lance At 12:48 PM 9/15/95, Futplex wrote: >Anonymous writes: ># Consider this scenario ... Mixmaster get's bought by the Acme ># Crypto Company of Ft. Meade, MD. They "improve" it, and offer a new ># version. It's even FREE (for non-commerical use)! But their ># "improvements" make it incompatible with previous versions, and so ># you have to upgrade. The new "commercial" version comes with no ># SOURCE CODE, of course... > >Lance Cottrell writes: >> 4) There will always be a free version of the client with source code. >> >> While I have not discussed it, I can not imagine that there would not also >> be a free version of the server code (with source). Without remailers what >> is the point of the client software? > >Beyond taking Lance on his PGP-signed-word, which I'm strongly inclined to do, >I suspect he may not have much legal leeway in this regard. > >With the caveat that I Am Not A Lawyer, it seems to me that the GNU General >Public License (Version 1 from 1989, Mix/GNU.license in the Mixmaster .tar or >http://hopf.math.nwu.edu/docs/Gnu_License) which covers all extant >distributions of Mixmaster, has some significant implications for any >commercial development of Mixmaster. It's applicable to "the Program or any >derivative work under copyright law: that is to say, a work containing the >Program or a portion of it, either verbatim or with modifications and/or >translated into another language". > >The GNU GPL specifies that: > > 2. You may modify your copy or copies of the Program or any portion of > it, and copy and distribute such modifications under the terms of > Paragraph 1 above, provided that you also do the following: > [...] > b) cause the whole of any work that you distribute or publish, that > in whole or in part contains the Program or any part thereof, either > with or without modifications, to be licensed at no charge to all > third parties under the terms of this General Public License (except > that you may choose to grant warranty protection to some or all > third parties, at your option). > >and that: > > 3. You may copy and distribute the Program (or a portion or > derivative of it, under Paragraph 2) in object code or executable > form under the terms of Paragraphs 1 and 2 above provided that you > also do one of the following: > a) accompany it with the complete corresponding machine-readable > source code, [...] or, > b) accompany it with a written offer, [...] to give any third party > free (except for a nominal charge for the cost of distribution) a > complete machine-readable copy of the corresponding source code, [...] > >So it looks to me as though Mixmaster source code will continue to be >legally available, no matter what.... > >Better informed interpretations are enthusiastically solicited. > >-Futplex <futplex(a)pseudonym.com> ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

laptop passwords
by RopeGun＠alaska.net 17 Dec '03

17 Dec '03

I've got a dilema. 2 laptops that I just purchased at a police auction have passwords, from what I can tell they are passworded at the cmos level. I would normaly just pull out the battery and clear the cmos but these are laptops and I'm not to comfortable about doing that. Any ideas? laptop1 - Toshiba Satelite Pro T2400CT laptop2 - Epson Action Note 500 c Oren Tanay RopeGun Productions \\V// o o J +--

1 0

Re: Linking = Showing = Transferring?
by Carl Ellison 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >>To:cyberia-l@warthog.cc.wm.edu >>From:tcmay@got.net (Timothy C. May) >>Subject:Linking = Showing = Transferring? >>_Linking_ is effectively _showing_, given the point-and-click mechanics of >>hypertext. This is a situation anticipated by authors (e.g. Ted Nelson), >>but is now coming to the fore. >> >>Granted, providing a link is not the same as actually _including_ the >>material the link points to, but it is very, very close. Arguably, the >>same. There are two important differences. The first difference is in ownership of the data. If the source of the link decides to clobber the file, then the fact that I have a page with the URL does not guarantee access to that file for the user of *my* page. Similarly, the person owning the file can freely change the content of the file, without my changing the URL which points to it. The other difference is in handling of the data. If the link were to a pornographic image and someone were to access it through my page's URL, the bits of that image would never touch my computer. Meanwhile, <a href="http://dcs.ex.ac.uk/~aba/rsa/"> RSA encryption system in PERL </a> might be a URL which violates US export laws -- if this interpretation were to be taken -- but if so, does it violate them in this mail message? That depends, I suppose, on whether your mail agent is aware of URLs and turns them into point-and-click units. Is it a violation if the URL is printed in a paper magazine? After all, it's the convenience of the web browser which is at issue. One can invoke netscape with or without a parameter. Yes -- interesting legal times ahead. - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | ``Officer, officer, arrest that man! He's whistling a dirty song.'' | +----------------------------------------------------------- Jean Ellison -+ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMFniL1QXJENzYr45AQFlYAP8DGHGk6EEmHXyPbeA7hoZjQ1pkEiyW2xB 1srFbXVsdJt9cwNQbBmFSfKARKVOnh1f+rEEqFZEwXXS1BbwlSljDz/hykZwfQwv h1kXPvJ9MMqleg6y8IXM5nTL9lKnq+ThKmgl/aciDYZqZ009IL4ssb81gUA5r5lC mYkfhqulWsU= =AYRX -----END PGP SIGNATURE-----

1 0

Re: Commercial Mixmaster (was Re: Mixmaster status)
by droelke＠rdxsunhost.aud.alcatel.com 17 Dec '03

17 Dec '03

> With the caveat that I Am Not A Lawyer, it seems to me that the GNU General > Public License (Version 1 from 1989, Mix/GNU.license in the Mixmaster .tar or > http://hopf.math.nwu.edu/docs/Gnu_License) which covers all extant > distributions of Mixmaster, has some significant implications for any > commercial development of Mixmaster. It's applicable to "the Program or any > derivative work under copyright law: that is to say, a work containing the > Program or a portion of it, either verbatim or with modifications and/or > translated into another language". > Most common mis-understanding about the GPL. If you GPL something, *you* hold the copyright to the material, and can still do anything you want with it. See Perl for a good example - released under an artistic license and under GPL. GPL prevents *others* from making distributions without distributing the source code. Of course, if you accept GPL'ed patches to your code, the whole thing gets messy, as now you can't claim complete ownership of the entire code base. I have simplified this - go to gnu.misc.discuss for a complete rehash of this subject every 2-3 weeks. Dan ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX

1 0

Re: "Use implies consent to monitoring"
by Rich Salz 17 Dec '03

17 Dec '03

`h > Please be advised that use constitutes consent to monitoring Use of what?

1 0

Re: Commercial Mixmaster (was Re: Mixmaster status)
by Rich Salz 17 Dec '03

17 Dec '03

>Better informed interpretations are enthusiastically solicited. Lance owns the code. He can take it, strip off the copyright, and transfer all rights to Bill Gates for a million bucks. He cannot, however, rescind the copyright or licenses that he has previously given out. /r$

1 0

Re: CYPHERPUNK considered harmful
by Rich Salz 17 Dec '03

17 Dec '03

What's in a name? That which we call a rose would by any other name still smell as sweet. Surely, right now, there are more important things to work on. /r$

1 0

Re: CYPHERPUNK harmful. THE TRUTH IS TOLD
by rah＠shipwright.com 17 Dec '03

17 Dec '03

>Hmmmm... If memory serves, a year or so ago there was just such a schism >when a prominent cypherpunk split off and formed the "cypherWONKS" list. >The failure of that list can be attributed to one thing and one thing >alone: a concerted effort by YOU and your acolytes against it. You refuse >to even mention this, which is all the proof any open-minded person needs. >Now you are trying to stifle all open debate by doing it again. So, Mr. >May/Szabo (if that IS your name), why not come clean once and for all >about your role in the deaths of Vince Foster and Randy Weaver's wife, and >your part in the newly-emerging administration scandal: TENTACLE-gate. Yeah!!!! What he said!!!! Seriously. It seems to me that if a list of cypher-interested "cryptologists, hackers, and mathematicians" (Copyright, Wall Street Journal), want to call themselves "punks", it's fine by me. Face it folks, people of the "punk" genre have innoculated this particular petri dish. There's enough information-agar to munch on here for quite a while, so it doesn't look like we're going to go anywhere. If some members of this particular community wants to bud off, or fission, or spore, or whatever this particular meme does to reproduce, in order to change its name to something reputable, they're welcome to. Frankly, I find it entertaining to phone up the local internet-hysterical talkshow host's call screener and say, "I'm a cypherpunk, and I disagree with the host". It gets me to the head of the line, even if the innumerate technophobe who's managing the queue couldn't spell "cypher" if he/she/its life depended on it... So long, and you're welcome for all the fish. Can we get back to c-coding and dissolving reality as we know it, now? Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: "Use implies consent to monitoring"
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 6:08 PM 9/15/95, Rich Salz wrote: >`h >> Please be advised that use constitutes consent to monitoring > >Use of what? Uh, it looks like the .com registration to me... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: why ecash is traceable
by szabo＠netcom.com 17 Dec '03

17 Dec '03

Hal & Tim have made some interesting comments about payee untraceability. I suspect it will clarify things to point out the orthogonality in two of the major design choices: * Clearing: Offline vs. online * Settlement: Deposit to payee's account vs. sending new cash to payee Because DigiCash wants their product to have payer, but not payee, privacy, the current ecash(tm) software from DigiCash uses online clearing and deposit to payee's account, but the three other combinations are also quite doable if somebody wanted to implement them. The design that allows symmetric untraceability combines online clearing with sending new cash. This way the bank need not ID the payee Bob in order to credit him with the value of the transaction; Bob and the bank can complete the clearing and settlement via anonymous channel. (The bank will also want to receive an anonymous payment from Bob for the service, and Chaum has described a second blinding step the payee must perform for the symmetric case, complications which I won't go into here). Offline clearing requires the potential to ID the payer in order to punish double-spending after the fact. Online systems without observers (such as ecash(tm)) don't need to worry about trying to find multiple spenders, because this is prevented by the online clearing. In fact, purposeful second-spending is used to recover from some error conditions, specifically to determine whether the payee in fact received the "coin" or not when there has been a network error in the middle of a transaction. Distinguishing between mistaken and fraudulent double spending is a very complex, not completely tractable problem, so the current ecash(tm) punts it, which is reasonable because it is online. An offline system would need an elaborate blacklisting system as well as active support of law enforcement in all jurisdictions using the ecash, would need to come up with reasonable ways to distinguish between fraudulent and mistaken double-spending, and would need more elaborate and specialized error-recovery protocols. If hardware "observers", based on "tamper-proof" hardware instead of mathematical protocol, and which prevent double-spending at the source, can be made harder to crack than the maximum a cracked card is allowed to spend, then such small-value transactions might be feasible offline. (This is the major avenue being pursued commercially, because online transactions are perceived to be too expensive, which is false in the case of the Internet IMHO). Nick Szabo szabo(a)netcom.com

1 0

Picking the Crypto Locks
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Byte, October, 1995, pp. 77, 80. Picking the Crypto Locks A new technique called differential cryptanalysis can break even DES quickly By Peter Wayner How secure is your encrypted data? Advances in mathematics and increased computing power mean you need longer keys and stronger algorithms if you still want to keep your secrets. Both private-key encryption (which uses a single key for coding and decoding) and public-key systems (which use separate keys for encryption and decryption) are increasingly vulnerable to determined attack. But do these weaknesses represent a real threat to encrypted data, or are they still just intriguing research results? Unfortunately, when we try to assess the effectiveness of today's popular cryptographic systems, we run into a problem of mathematical ignorance. Most people who are familiar with mathematics can work in two directions, forward and backward, like the simple algebraic equation a = b + 1. We can determine the value of the first variable from that of the second and vice versa. Crypto systems, however, generally rely on mathematics that works only in one direction. People assume these systems are secure because no one has yet shown how to work the mathematics backward and break open the message. In general, we determine the strength of most cryptographic systems by seeing how well they avoid the attacks we know have been used on other systems. If none of the past attacks seems to work, then we deem a system secure. For now. Let's look at how today's codebreakers work, the resources and time they need, and what we require in the way of new systems and longer keys. Recent assessments of the strength of private-key crypto systems involve looking for theoretical holes and measuring the time needed for a brute-force attack. Finding the holes can be devilishly hard, calling for deep mathematical insights. Brute-force attacks are easier to mount if enough computational hardware is available, but they're also easy to defend against. The most important development in the realm of data encryption in recent years is Eli Biham and Adi Shamir's differential cryptanalysis. They showed how to mount a limited attack on today's most widely used cryptosystem, DES (the federal Data Encryption Standard), which is also the basis for Unix's password system. Imagine that you had access to your victim's DES cipher "box" (the common term for an enciphering system) with preloaded keys. Your goal is to determine the 56-bit key, so that you can decrypt the other messages your victim had encrypted with the box. Biham and Shamir showed that you could infer the hidden key if you could pass 247 messages through the box and observe what came out. This chosen plaintext attack builds up a statistical model of the cipher, and it needs this many plaintexts to produce an answer with confidence. Most intriguing, this work exposed flaws in many DES substitutes. Because the U.S. government classified the details behind DES's design, many assumed that there might be a trapdoor through which the government could eavesdrop. To circumvent these potential trapdoors, some folks designed their own variations of DES. Most of these new ciphers, however, fall even faster to Biham and Shamir's mathematical machinery. FEAL-4, a faster replacement, for example, takes only four well-chosen plaintexts. _______________________________________________________ Strengths and Weakness of Crypto Algorithms _______________________________________________________ Algorithm Comment Strengths Weaknesses _______________________________________________________ DES Standard, Long-tested Has yielded Widely to DC Accepted _______________________________________________________ FEAL-4 DES Easily broken substitute by DC _______________________________________________________ GDES, DES-like Easily broken New DES by DC _______________________________________________________ Khufu DES-like Secure New, unknown against DC _______________________________________________________ Blowfish DES-like Secure New, unknown against DC _______________________________________________________ RC-4 Proprietary Variable- Unknown length key _______________________________________________________ RSA Widely used Long-tested Vulnerable to Public Key advances in factoring _______________________________________________________ Skipjack Classified Considered Algorithm must strong remain secret to preserve law-enforcement trapdoor _______________________________________________________ DC = differential cryptanalysis _______________________________________________________ Recently, the IBM scientists who originally designed DES revealed that they anticipated Biham and Shamir's attack and optimized DES to resist it. Because other nongovernment cryptographers didn't know about this attack, they couldn't design their software to resist it. Now the information is public, and there are new ciphers that hold up well against these attacks. Ralph Merkle's Khufu and Bruce Schneier's Blowfish are two private-key ciphers that are similar to DES but resist differential cryptography. They do this by creating new S-boxes for each encryption, using the key to randomize them. (S-boxes are the essential scrambling elements of DES-like ciphers. Think of them as lookup tables or nonlinear functions; their outputs should be as random as possible.) Differential cryptanalysis works only if the attacker knows what's in the S-boxes. This work also revealed some stunning counterintuitive results. Key length is usually taken as a rough measure of a system's security. DES uses 56-bit keys; a brute-force attacker might need to try all 2^56 keys to find the right one. A longer key would mean a longer brute-force attack. However, Biham and Shamir showed that even if DES used longer keys, it would hardly be any stronger against differential cryptanalysis. The statistical model would still be solvable if DES used the maximum of 768 bits. Applying this knowledge to other types of ciphers is tricky. RSA Data Security markets a proprietary algorithm called RC-4 that accepts a variable-length key; this algorithm is used in many products. The flexible key length can be an advantage in some situations. For example, the government allows general export of software using RC-4 with a 40-bit key, but similar software using a longer key must stay within the U.S. While we don't know if differential cryptanalysis can be applied to RC-4 directly, because of the algorithm's proprietary nature, the results with DES suggest that more key is not necessarily stronger. Men and Machines Mathematical tools like differential cryptanalysis can be the most powerful attack against a cipher system. Brute-force attacks are normally a last resort, rare in practice because cipher designers routinely use long key lengths specifically to preclude them. But times are changing. We're reaching a point at which a large machine can quickly search the entire keyspace of DES. DES is still in wide use; it' s been the commercial and governmental standard for nearly two decades. Replacing such standards can be a painfully slow process. DES users should be thinking about what can be done with off-the-shelf hardware. Brute-force attacks simply use large machines that try all possible passwords in parallel. It's even possible to produce native chips that run DES. Michael Wiener of Bell Northern Research described how to build a $1 million machine using a pipelined DES processor that could cruise through all possible keys in about 7 hours. Massively parallel machines can also attack the problem. Some of the most promismg emergmg machines distribute small, 1-bit processors directly onto the memory chips. Some have 1024 processors on a chip with 42 bits of memory per processor. (Before it entered Chapter 11, Cray Computer was building for the National Security Agency a special Cray 3 with such processor-embedded memory.) In 1992 I designed a machine using 1 million associative processor memory chips (standard DRAM densihes) from Coherent Research (Syracuse, NY) that could attack all of DES in one day. This machine could be reprogrammed to attack other DES-like ciphers. Linden Technology (Austin, TX) is currently exploring manufacturing new 4-Mb DRAMs with the 1024 associative processors built onto the chip. The effect of brute-force attacks on DES is also important for Unix security, which stores each password after passing it through DES 25 times. At log-in, you type your password; it's encrypted 25 times and the result compared against the password file. If it matches, the system grants you access. Because the password file doesn't contain the passwords themselves, unauthorized users can't use the file to recover them directly. They must use a brute-force machine. However, the brute-force attack can be relatively successful against Unix, because the keyspace is smaller. Most users limit their passwords to alphabetic characters, occasionally adding numbers. This makes searching for passwords much faster; it could be done quite quickly with an associative-memory parallel processor. One estimate suggests that a computer using 512 of Linden's chips could test all six-character alphanumeric passwords in 15 minutes. Clearly. the Unix password structure needs to be rethought in light of today's machines and code-breaking techniques. Because of this new vulnerability, you may want to explore other, newer ciphers. such as Merkle's Khufu or Schneier's Blowfish. The classified Skipjack algorithm buried inside the U.S. government's Clipper and Capstone encryption chips also uses S-boxes, but little is known about their design. There's little reliable public information about RSA Data Security's RC-4. Anyone who uses these algorithms must be prepared to trust the wits of the designers, because the algorithms have not undergone the intensely thorough and long-time public scrutiny given to DES. Many organizations have opted to continue with DES, but the current state of the art is triple-DES -- three passes of the algorithm with either 112- or 168-bit keys. This effectively guards against both brute-force and differential analysis attacks. These users can rest assured that, paradoxically, all the attacks focused on DES continues to keep it strong. ----- Peter Wayner is a BYTE consulting editor living in Baltimore, MD. You can reach him on the Internet at pcw(a)access.digex.net, on BIX as pwayner(a)bix.com, or on the World Wide Web at http://access.digex.net/~pcw/ pcwpage.html. ----- Byte, October, 1995, p. 78. Factoring in Public-Key's Future Long thought nearly unbreakable, public-key cryptogratphy is yielding to attack. The secret of security here is key length. By Bruce Schneier Factoring large numbers is hard but not as hard as it used to be. This has grave implications for the effectiveness of public key cryptocraphy, which relies on the difficulty of factoring long keys for its security. But how long is long enough'? In 1976, Richard Guy wrote: "I shall be surprised if anyone regularly factors numbers of size 10^80 without special form during the present century." In 1977, Ron Rivest said that factoring a 125-digit number would take 40 quadrillion years. In 1994, a 129-digit number was factored. The lesson here is that making predictions is foolish. Today, 512-bit keys are common. Factoring them, thus destroying their security, is well within the range of possibility for today's computing resources. A weekend- long worm on the Internet could do it. Computing power is measured in MIPS-years: a million-instructions-per-second computer running for one year, or about 3 x 10^13 instructions. A 100-MHz Pentium is about a 50-MIPS machine; a 1600-node Intel Paragon is about 50,000 MIPS. In 1983, a Cray X-MP supercomputer factored a 71-digit number in 0.1 MIPS-years, using 9.5 CPU hours. That's expensive. Factoring the 129-digit number in 1994 required 5000 MlPS-years and used the idle time on 1600 computers around the world over an eight-month period. Although it took longer, it was essentially free. Those two computations used what's called the *quadratic sieve*, but a newer, more powerful algorithm has arrived. The *general number filed sieve* is faster than the quadratic sieve for numbers well below 116 digits and can factor a 512-bit number over 10 times faster -- it would take less than a year to run on an 1800-node Intel Paragon. And the process gets still faster. Mathematicians keep coming up with new tricks, new optimizations, and new techniques. A related algorithm, the special number field sieve, can already factor numbers of a specialized form (not generally used for cryptography) much faster. So we can probably optimize the general number field sieve to run that fast. For all we know, the National Security Agency is already doing it. The figure "MIPS Years Needed to Factor" gives the number of MlPS-years required to factor "special" and "general" numbers of different lengths. How Big Is Big Enough? The wise cryptographer is ultraconservative when choosing key lengths for a public-key system. You must consider the intended security, the key's expected lifetime, and the current state of the factoring art. Now you need a 1024-bit number to get the same security you got from a 512-bit number in the early 1980s. If you want your keys to remain secure for 20 years, 1024 bits is probably too short. Consider these assumptions from the mathematicians who factored RSA-129: We believe we could acquire 100,000 machines without superhuman or unethical efforts and without an Internet womm or virus. Many organizations have several thousand machines on the Net. Using their facilities would require diplomacy but should not be impossible. Assuming an average power of 5 MIPS and one year elapsed time, we could reasonably embark on a project that would require half a million MIPS-years. The project to factor the 129-digit number harnessed an estimated 0.03 percent of the Internet's total computing power. A well-publicized project might be able to harness 2 percent of the world's computing power for a year. My recommendations for public-key lengths are given in the figure "Recommended Public-Key Key Lengths" according to how long you require the key to be secure. There are three key lengths given for each period -- one secure against an individual cryptanalyst who can get his hands on 10,000 MlPS-years, one against a major corporation that could harness 10^7 MIPS-years, and the third secure against a major govemment and 10^9 MIPS-years. These figures assume that computing power will increase by a factor of 10 every five years and that mathematical advances will let us factor numbers at the speeds of the special number field sieve. Not everyone will agree with these final recommendations. The National Institute of Standards and Technology has mandated 512- to 1024-bit keys for its Digital Signature Standard. PGP has a maximum RSA key length of 1280 bits. Aljen Lenstra, the world's most successful factorer, refuses to predict beyond 10 years. There's always the possibility that an advance in factoring will surprise me as well, though I tried to factor everything into my calculations. But why trust me? I just proved my own foolishness by making predictions. _______________________________________________________ MIPS Years Needed to Factor _______________________________________________________ Ascending Line of General Number Field Sieve Ascending Line Special Number Field Sieve Y-axis: MIPS-years 10^0, 10^3, 10^6, 10^9, 10^12, 10^15, 10^18, 10^21 X-axis: Bits 512, 768, 1024, 1280, 1536, 2048 _______________________________________________________ _______________________________________________________ Recommended Public-Key Key Lengths _______________________________________________________ Ascending bars for: Individual, Company, Government Y-axis: Bits 0, 500, 1000, 1500, 2000, 2500 X-axis: Year 1995 2000 2005 2010 2015 _______________________________________________________ ----- Bruce Schneier is the author of Applied Cryptography (John Wiley), the second edition of which is due out in December. He can be reached on the Internet as schneier(a)winternet.com, or on BIX c/o editors(a)bix.com. -----

1 0

Just the facts, ma'am.
by uunet!attmail.com!uucp internet!sytex.com!fergp/G=Paul/S=Ferguson 17 Dec '03

17 Dec '03

message

1 0

Status ongoing Key-Escrow (black) Humor
by Anonymous 17 Dec '03

17 Dec '03

That makes 3 of 4 .... Ye olde Spooge Meister spooge /spooj/ 1. Inexplicable or arcane code <spooge(a)dev.null.net> or random and probably incorrect output from a computer program.

1 0

returned mail NIST call for Comments on "Key-Escrow" (fwd)
by uunet!lebanon.cerf.fred.org!daemon 17 Dec '03

17 Dec '03

Paul Ferguson | "Government, even in its best state, Network Integrator | is but a necessary evil; in its worst Centreville, Virginia USA | state, an intolerable one." fergp(a)sytex.com | - Thomas Paine, Common Sense Type bits/keyID Date User ID pub 1024/1CC04D 1993/03/15 Paul Ferguson <fergp(a)sytex.com> Key fingerprint = EE D2 93 7D 04 6D C6 05 AC 36 AD 9D 8E 4F 41 58

1 0

RSA in new Apple product RSA in new Apple product
by remail＠tamsun.tamu.edu 17 Dec '03

17 Dec '03

>From a discussion of Powertalk in TidBITS#195/27-Sep-93, an online zine published by "Adam C. Engst" <ace(a)tidbits.com>: ------------------- forward --------------------------------------- Key Chain The Key Chain is the third new Desktop icon and perhaps the most important PowerTalk feature. It provides quick, transparent access to any number of password-protected servers or services through a single system-wide logon password. All applications and services are integrated with a single security model. For every service, the user creates a key. Each key has account information, communications settings (such as. modem settings, addresses, and system identifiers), and an encrypted password. After this one- time setup, the user attaches the key to the Key Chain and can forget the password. From now on, the system will automatically and transparently connect to the protected service when needed. Apple feels that this mechanism is especially secure since a user will find it easier to remember a single, frequently-used password and will be less likely to write down a list of passwords. At any time, you can lock the Key Chain by issuing a command or through an inactivity time-out. When the Key Chain locks, all windows containing information from protected services are hidden. Apple claims that PowerTalk is more secure than most other off- the-shelf software solutions since those use less secure algorithms to avoid export restrictions. Apple is the first company to receive an export license for a DES-based product. A new "I am at..." menu item (e.g. Home, Office, Car, Hotel) lets the system know which services are accessible and automatically resets communications settings for Ethernet, modem connection, packet radio, etc. so the system can continue to transparently establish connections over available media. A PowerTalk server can act as a trusted party in establishing authenticated communications across the net. Network traffic is encrypted with the RC4 algorithm of RSA and delivered via ASDSP (Apple Secure Datastream Protocol). ASDSP adds only about ten percent to the communication overhead. At least in the initial release, peer-to-peer traffic cannot be encrypted. [Sorry for all the acronyms! RSA is a company. -Tonya] Digital signatures, based on RSA Public Key Encryption, provide a secure way of ensuring data has not been altered and was signed by a particular person. The mechanism is similar to Kerberos [a security system developed at MIT -Adam], which was not mature enough at the critical point in PowerTalk development. Apple anticipates supporting Kerberos in a future PowerTalk release. To sign a document, simply drops it on a Signer icon. A prompt for the personal signer code then appears on the screen. If the content of the signed document later changes in any way, the signature becomes invalid. While being signed, a file automatically is locked to avoid inadvertent invalidation. The Get Info window of a signed file is used to uncheck the file lock, and it contains a Verify button with which the recipient can assert the integrity of the file and authenticity of its signature. Large companies can become trusted signature issuing agents for their employees by obtaining a titanium blackbox with key interlocks from RSA. The box contains a certain number of key combinations and can be connected to a Macintosh which runs an RSA-signed signature issuing application. Individuals can acquire a personal signature code through a notary. RSA always is at the root of the issuing process and signatures expire after two years. The issuing cost of a digital signature runs about $25. One limitation of the signature mechanism, at least in the initial implementation, is that only one signature can be attached to a document. This may be worked around by designing forms such that each signatory vouches for the authenticity of the previous sender's signature. For an APS price list, send email to: <aps-prices(a)tidbits.com> For information on TidBITS: how to subscribe to our mailing list, where to find back issues, how to search issues on the Internet's WAIS, and other useful stuff, send email to: <info(a)tidbits.com> Otherwise, contact us at: ace(a)tidbits.com * CIS: 72511,306 AppleLink & BIX: TidBITS * AOL: Adam Engst * Delphi: Adam_Engst TidBITS * 1106 North 31st Street * Renton, WA 98056 USA ----------------------------------------------------------------

1 0

Zimmermann testimony to House subcommittee
by Philip Zimmermann 17 Dec '03

17 Dec '03

Testimony of Philip Zimmermann to Subcommittee for Economic Policy, Trade, and the Environment US House of Representatives 12 Oct 1993 Mr. Chairman and members of the committee, my name is Philip Zimmermann, and I am a software engineer who specializes in cryptography and data security. I'm here to talk to you today about the need to change US export control policy for cryptographic software. I want to thank you for the opportunity to be here and commend you for your attention to this important issue. I am the author of PGP (Pretty Good Privacy), a public-key encryption software package for the protection of electronic mail. Since PGP was published domestically as freeware in June of 1991, it has spread organically all over the world and has since become the de facto worldwide standard for encryption of E-mail. The US Customs Service is investigating how PGP spread outside the US. Because I am a target of this ongoing criminal investigation, my lawyer has advised me not to answer any questions related to the investigation. I. The information age is here. Computers were developed in secret back in World War II mainly to break codes. Ordinary people did not have access to computers, because they were few in number and too expensive. Some people postulated that there would never be a need for more than half a dozen computers in the country. Governments formed their attitudes toward cryptographic technology during this period. And these attitudes persist today. Why would ordinary people need to have access to good cryptography? Another problem with cryptography in those days was that cryptographic keys had to be distributed over secure channels so that both parties could send encrypted traffic over insecure channels. Governments solved that problem by dispatching key couriers with satchels handcuffed to their wrists. Governments could afford to send guys like these to their embassies overseas. But the great masses of ordinary people would never have access to practical cryptography if keys had to be distributed this way. No matter how cheap and powerful personal computers might someday become, you just can't send the keys electronically without the risk of interception. This widened the feasibility gap between Government and personal access to cryptography. Today, we live in a new world that has had two major breakthroughs that have an impact on this state of affairs. The first is the coming of the personal computer and the information age. The second breakthrough is public-key cryptography. With the first breakthrough comes cheap ubiquitous personal computers, modems, FAX machines, the Internet, E-mail, digital cellular phones, personal digital assistants (PDAs), wireless digital networks, ISDN, cable TV, and the data superhighway. This information revolution is catalyzing the emergence of a global economy. But this renaissance in electronic digital communication brings with it a disturbing erosion of our privacy. In the past, if the Government wanted to violate the privacy of ordinary citizens, it had to expend a certain amount of effort to intercept and steam open and read paper mail, and listen to and possibly transcribe spoken telephone conversation. This is analogous to catching fish with a hook and a line, one fish at a time. Fortunately for freedom and democracy, this kind of labor-intensive monitoring is not practical on a large scale. Today, electronic mail is gradually replacing conventional paper mail, and is soon to be the norm for everyone, not the novelty is is today. Unlike paper mail, E-mail messages are just too easy to intercept and scan for interesting keywords. This can be done easily, routinely, automatically, and undetectably on a grand scale. This is analogous to driftnet fishing-- making a quantitative and qualitative Orwellian difference to the health of democracy. The second breakthrough came in the late 1970s, with the mathematics of public key cryptography. This allows people to communicate securely and conveniently with people they've never met, with no prior exchange of keys over secure channels. No more special key couriers with black bags. This, coupled with the trappings of the information age, means the great masses of people can at last use cryptography. This new technology also provides digital signatures to authenticate transactions and messages, and allows for digital money, with all the implications that has for an electronic digital economy. (See appendix) This convergence of technology-- cheap ubiquitous PCs, modems, FAX, digital phones, information superhighways, et cetera-- is all part of the information revolution. Encryption is just simple arithmetic to all this digital hardware. All these devices will be using encryption. The rest of the world uses it, and they laugh at the US because we are railing against nature, trying to stop it. Trying to stop this is like trying to legislate the tides and the weather. It's like the buggy whip manufacturers trying to stop the cars-- even with the NSA on their side, it's still impossible. The information revolution is good for democracy-- good for a free market and trade. It contributed to the fall of the Soviet empire. They couldn't stop it either. Soon, every off-the-shelf multimedia PC will become a secure voice telephone, through the use of freely available software. What does this mean for the Government's Clipper chip and key escrow systems? Like every new technology, this comes at some cost. Cars pollute the air. Cryptography can help criminals hide their activities. People in the law enforcement and intelligence communities are going to look at this only in their own terms. But even with these costs, we still can't stop this from happening in a free market global economy. Most people I talk to outside of Government feel that the net result of providing privacy will be positive. President Clinton is fond of saying that we should "make change our friend". These sweeping technological changes have big implications, but are unstoppable. Are we going to make change our friend? Or are we going to criminalize cryptography? Are we going to incarcerate our honest, well-intentioned software engineers? Law enforcement and intelligence interests in the Government have attempted many times to suppress the availability of strong domestic encryption technology. The most recent examples are Senate Bill 266 which mandated back doors in crypto systems, the FBI Digital Telephony bill, and the Clipper chip key escrow initiative. All of these have met with strong opposition from industry and civil liberties groups. It is impossible to obtain real privacy in the information age without good cryptography. The Clinton Administration has made it a major policy priority to help build the National Information Infrastructure (NII). Yet, some elements of the Government seems intent on deploying and entrenching a communications infrastructure that would deny the citizenry the ability to protect its privacy. This is unsettling because in a democracy, it is possible for bad people to occasionally get elected-- sometimes very bad people. Normally, a well-functioning democracy has ways to remove these people from power. But the wrong technology infrastructure could allow such a future government to watch every move anyone makes to oppose it. It could very well be the last government we ever elect. When making public policy decisions about new technologies for the Government, I think one should ask oneself which technologies would best strengthen the hand of a police state. Then, do not allow the Government to deploy those technologies. This is simply a matter of good civic hygiene. II. Export controls are outdated and are a threat to privacy and economic competitivness. The current export control regime makes no sense anymore, given advances in technology. There has been considerable debate about allowing the export of implementations of the full 56-bit Data Encryption Standard (DES). At a recent academic cryptography conference, Michael Wiener of Bell Northern Research in Ottawa presented a paper on how to crack the DES with a special machine. He has fully designed and tested a chip that guesses DES keys at high speed until it finds the right one. Although he has refrained from building the real chips so far, he can get these chips manufactured for $10.50 each, and can build 57000 of them into a special machine for $1 million that can try every DES key in 7 hours, averaging a solution in 3.5 hours. $1 million can be hidden in the budget of many companies. For $10 million, it takes 21 minutes to crack, and for $100 million, just two minutes. That's full 56-bit DES, cracked in just two minutes. I'm sure the NSA can do it in seconds, with their budget. This means that DES is now effectively dead for purposes of serious data security applications. If Congress acts now to enable the export of full DES products, it will be a day late and a dollar short. If a Boeing executive who carries his notebook computer to the Paris airshow wants to use PGP to send email to his home office in Seattle, are we helping American competitivness by arguing that he has even potentially committed a federal crime? Knowledge of cryptography is becoming so widespread, that export controls are no longer effective at controlling the spread of this technology. People everywhere can and do write good cryptographic software, and we import it here but cannot export it, to the detriment of our indigenous software industry. I wrote PGP from information in the open literature, putting it into a convenient package that everyone can use in a desktop or palmtop computer. Then I gave it away for free, for the good of our democracy. This could have popped up anywhere, and spread. Other people could have and would have done it. And are doing it. Again and again. All over the planet. This technology belongs to everybody. III. People want their privacy very badly. PGP has spread like a prairie fire, fanned by countless people who fervently want their privacy restored in the information age. Today, human rights organizations are using PGP to protect their people overseas. Amnesty International uses it. The human rights group in the American Association for the Advancement of Science uses it. Some Americans don't understand why I should be this concerned about the power of Government. But talking to people in Eastern Europe, you don't have to explain it to them. They already get it-- and they don't understand why we don't. I want to read you a quote from some E-mail I got last week from someone in Latvia, on the day that Boris Yeltsin was going to war with his Parliament: "Phil I wish you to know: let it never be, but if dictatorship takes over Russia your PGP is widespread from Baltic to Far East now and will help democratic people if necessary. Thanks." Appendix -- How Public-Key Cryptography Works --------------------------------------------- In conventional cryptosystems, such as the US Federal Data Encryption Standard (DES), a single key is used for both encryption and decryption. This means that a key must be initially transmitted via secure channels so that both parties have it before encrypted messages can be sent over insecure channels. This may be inconvenient. If you have a secure channel for exchanging keys, then why do you need cryptography in the first place? In public key cryptosystems, everyone has two related complementary keys, a publicly revealed key and a secret key. Each key unlocks the code that the other key makes. Knowing the public key does not help you deduce the corresponding secret key. The public key can be published and widely disseminated across a communications network. This protocol provides privacy without the need for the same kind of secure channels that a conventional cryptosystem requires. Anyone can use a recipient's public key to encrypt a message to that person, and that recipient uses her own corresponding secret key to decrypt that message. No one but the recipient can decrypt it, because no one else has access to that secret key. Not even the person who encrypted the message can decrypt it. Message authentication is also provided. The sender's own secret key can be used to encrypt a message, thereby "signing" it. This creates a digital signature of a message, which the recipient (or anyone else) can check by using the sender's public key to decrypt it. This proves that the sender was the true originator of the message, and that the message has not been subsequently altered by anyone else, because the sender alone possesses the secret key that made that signature. Forgery of a signed message is infeasible, and the sender cannot later disavow his signature. These two processes can be combined to provide both privacy and authentication by first signing a message with your own secret key, then encrypting the signed message with the recipient's public key. The recipient reverses these steps by first decrypting the message with her own secret key, then checking the enclosed signature with your public key. These steps are done automatically by the recipient's software. -- Philip Zimmermann 3021 11th Street Boulder, Colorado 80304 303 541-0140 E-mail: prz(a)acm.org

1 0

Re: Problems of anonymous posts
by nobody＠soda.berkeley.edu 17 Dec '03

17 Dec '03

From: "Robert J. Woodhead" <trebor(a)foretune.co.jp> > Possible low-tech solution: mail-list software where the moderator has > the ability to screen messages from particular sites and/or accounts. I think the problem here is the amount of time which would be taken by the moderator. If you were going to go this route, you might as well have a completely moderated list. This slows down list turnaround and is a lot of work for somebody. > Question: how easy is it to use public information (ie: out of the > phone book), PGP and an anon-remailer to create a "Fake ID" I'm not sure what you mean here. Perhaps you are talking about someone who posts saying, "Hi, this is Bill Gates, I just joined your list, and here's my PGP key, I'll just be posting through these anonymous remailers for now. Oh, and to prove it's really me, my annual salary is such-and- such, which you can confirm by reading the most recent annual report from Microsoft." This wouldn't fool anyone for an instant. Or, someone posts and says, "My name is Deadbeat, here is my PGP key, and I'll just be posting through anon remailers," then he does so for months on end. This also doesn't "fool" anybody, but does represent an ID which can get established and become as legitimate as other ID's on the net - in a sense, a "Fake ID"; this is what we call a digital pseudonym. Hal Finney

1 0

Re: Detecting double-spending (long)
by nobody＠alumni.cco.caltech.edu 17 Dec '03

17 Dec '03

For those of you who slogged through my description last week of Chaum's "simple" digital cash which detects double-spending, I've realized on further thought that a simplification is possible. Writing that long essay improved my own understanding of his system. Recall that the double-spending cash is the product, for i from 0 to k/2, of f(xi,yi)^(1/3), mod the bank's public modulus. f() is a one-way function, one which can't be inverted. xi and yi were a little complicated, and here is where my simplification comes in. Let xi be g(ai), where ai is a random number and g is a one-way function. Let yi be g(ai xor <info>), where <info> is Alice's identifying information, her account number. Normally the ai "blinds" that since it is random and it is xor'd onto it. But if ever both ai and ai xor <info> are known, <info> is revealed and Alice's goose is cooked. Everything else works as Chaum suggested; I have just eliminated his ci and di random numbers. In his proposal, g took two arguments, and ci and di were appended for the xi and yi cases. But I'm convinced now that these are unnecessary for our purposes. The purpose for ci and di are to provide "unconditional" anonymity to Alice if she doesn't cheat. Look what happens with my simpler system. She tells Bob ai and yi for certain i's. Now, g is a one-way function, but suppose Bob had a big enough computer to try all possible arguments to g. Sooner or later he'd find a value Z for which g(Z) was yi. So then he could figure that Z equals ai xor <info>, and he knows ai, so he could find <info>. This means that in my simplified system Alice is depending on Bob (and everyone else) being unable to crack g() in order to stay anonymous. Chaum's system is better. By having a g with two arguments he creates a huge number of solutions to g(Z1,Z2) = yi. There is no way for Bob to tell which one is right, so even with infinite computing resources he can't crack Alice's anonymity. My thought is, unconditional anonymity is really no better than computational anonymity in the real world. Eric Hughes often says "all cryptograpy is economics". In practice, beyond a certain point, anonymity would not be broken by a direct computational attack, but rather by other means - bribery, theft, etc. In the real world there is no such thing as "unconditional" anonymity. In practice, computational anonymity is enough. So my feeling is that for implementation purposes the ci and di in Chaum's system can be removed, simplifying the protocols somewhat, at the cost of reducing Alice's anonymity from unconditional to computational. Hal Finney hfinney(a)shell.portal.com

1 0

Re: why ecash is traceable
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 10:49 PM 9/15/95, Nick Szabo wrote: >Hal & Tim have made some interesting comments about payee untraceability. >I suspect it will clarify things to point out the orthogonality in >two of the major design choices: > >* Clearing: Offline vs. online >* Settlement: Deposit to payee's account vs. sending new cash to payee > >Because DigiCash wants their product to have payer, but not payee, privacy, >the current ecash(tm) software from DigiCash uses online clearing >and deposit to payee's account, but the three other combinations are >also quite doable if somebody wanted to implement them. The design that >allows symmetric untraceability combines online clearing with sending new >cash. This way the bank need not ID the payee Bob in order to credit Thanks, Nick, for summarizing this clearly in terms of these two axes. This symmetric untraceability is what I was getting at with my point about Bob clearing the transaction and getting back blinded cash. It's apparent that if Alice can get untraceable cash, and she tells her bank to go ahead and give the same kind of untraceable cash to Bob, then Bob can also get untraceable cash. .... >Offline clearing requires the potential to ID the payer in >order to punish double-spending after the fact. Offline clearing has many hurdles to overcome, and this "True Name" (ID) issue is not very attractive. Fortunately, the vast increases in Net speeds are on the side of online clearing, even for relatively small transactions. >Online systems without observers (such as ecash(tm)) don't >need to worry about trying to find multiple spenders, because this is >prevented by the online clearing. In fact, purposeful second-spending >is used to recover from some error conditions, specifically to determine >whether the payee in fact received the "coin" or not when there has been a >network error in the middle of a transaction. Distinguishing between >mistaken and fraudulent double spending is a very complex, not completely >tractable problem, so the current ecash(tm) punts it, which is reasonable >because it is online. An offline system would need an elaborate Sounds pretty compelling to me to concentrate on online clearing systems.... I can imagine limited needs for offline clearing, such as road toll systems, or parking tokens, etc. The amounts of money there can be somewhat limited, and the implications of double spending revealing identity are less serious. (Though I can imagine a worrisome scenario where a highway toll system "deliberately double spends" received tokens to track motorists...there may be precautions built into such systems that I just don't know about.) --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: CYPHERPUNK harmful. THE TRUTH IS TOLD
by Bill Stewart 17 Dec '03

17 Dec '03

>Hmmmm... If memory serves, a year or so ago there was just such a schism >when a prominent cypherpunk split off and formed the "cypherWONKS" list. :-) :-) And starting a new list lets us decided on a new LOGO to replace that old tacky rose-and-bits thingy :-) Cryptographic Professionals for Social Responsibility Cryptographic Industry Association National Steganography Alliance Cryptographers for Foreign Reflexivity Extremely Private Institute for Cryptography NII Institute of Cryptography American Cryptographic Legal Union Free Banking Institute Cryptographic Defense Taskforce Cryptographic Organization for Privacy and Security Entropy, Steganography, and Cryptography Research Organization for Women (If anything, what we need is a way to separate the technical/mathematical discussions from rants like this, but any time we get the list focused on mostly technical issues, the government goes out of its way to do something egregiously stupid or offensive...) Somewhat more seriously, though, there are times that it's useful to have a more respectable-sounding organization (or at least a letterhead...), that's open to participation by members and not just directors (which has been some people's concern about the EFF, CDT, EPIC, and maybe TAP or CPSR.) If none of those are respectable/accessible/non-socialist enough for you, and the British Cryptographic Privacy Association (or whatever their name was) can't be found or sounds too much like International Outside Agitators, and the various academic groups are too busy being academicly respectable to do political agitation ("CryptoAcademics Write Papers!"), then come up with a name and a Postscript letterhead, and start an email list that you can gateway to cypherpunks (as long as you can prevent duplications or mail-floods.) If the main goal is to have a calmer name and mostly the same activities, an alter-ego mailing list is one approach. #--- # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

RE: Mixmaster status
by loki＠obscura.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I apologize for being so terse in my first message. This is not a red herring. The organization that has approached me is very pro-privacy and anonymity. I see nothing but good coming from this venture. I will be very active in the development of the commercial version of Mixmaster. Let me be crystal clear. 1) I will not support any version of Mixmaster that is weakened. 2) All future clients will be able to generate the current message format. 3) All future servers will be able to read the current message format. 4) There will always be a free version of the client with source code. While I have not discussed it, I can not imagine that there would not also be a free version of the server code (with source). Without remailers what is the point of the client software? At 8:45 PM 9/14/95, ROBO Mixmaster Remailer wrote: >Flame Remailer <remailer(a)flame.alias.net> wrote: > >> Subject: Mixmaster status >> >> There has been an offer to purchase and commercially develop Mixmaster. >> This will hasten the development of Mixmaster for other platforms (e.g. >> Dos, Windows Macintosh), and bring significant improvements to the >> interface, but I will not compromise on the level of security provided by >> Mixmaster. Free client software will continue to be available. >> >> This could be the big breakthrough for remailers, finally thrusting them >> out of the hobbyist's closet into the corporate world. >> >> I wonder. Where is the commercial market for remailers? Who has an >> application for them except hobbyinst? Why would there be a commercial >> incentive to run a mixmaster server, or even a client? >> >> Could this "offer" be a red herring? > >I wondered the same thing myself. It would certainly be a more >cost-effective way for the NSA to compromise Mixmaster technology >than by brute force. > >Consider this scenario ... Mixmaster get's bought by the Acme >Crypto Company of Ft. Meade, MD. They "improve" it, and offer a new >version. It's even FREE (for non-commerical use)! But their >"improvements" make it incompatible with previous versions, and so >you have to upgrade. The new "commercial" version comes with no >SOURCE CODE, of course... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMFkzR/Pzr81BVjMVAQH6hAf+O+QdTEzNjUh0FYlJEnCakNws4MxPrOt4 miMPaz/aWDOReGb62UPZAEMNXP+hjgy0kTjW4xReTTBAPgtcsInr1Cct6MPr3O/r PGMGmE9z2Fkv3/k7MDG1NiptT2/RwVtmDikIJEQuH5j8ijir28Vvrk9Vs685Qc3j bFz5Q8uRLd57Uk51tQwIiBM6CJ4suQ3WFN++QNTHM9E47J9W8yFBux6ePWPlZOK8 8BnKkhY/auPm85X3MVZhL3y7F6zbFuqPpZrsKpwOOkme8o4l71t2xyhGcZHHxiB7 JLF2As9pNXsKWpYiPZEHTV9hsgxQTHortdhq25DeGyoxhZSrZByP/w== =+O16 -----END PGP SIGNATURE----- ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

3 3

Re: Explaining Zero Knowledge to your children
by Karl L. Barrus 17 Dec '03

17 Dec '03

At 08:18 PM 9/14/95 +0200, you wrote: >There is a paper about explaining Zero Knowledge methods in simple >words. It's titled "Explainig Zero Knowledge Authentication to your >children" or something similar. I think you are refering to Quisquater's (sp?) explanation, which is in terms of Ali Baba and a magic cave. A functionally similar explanation is in Schneier's Applied Crypto, pp. 85-86. -- Karl L. Barrus <klbarrus(a)infocom.net>

1 0

Washington D.C. Cyperhpunks Meeting Cybercast
by Thomas Grant Edwards 17 Dec '03

17 Dec '03

Catch the WashDC Cypherpunks meeting cybercast on CU-SeeMe tommorow, saturday Sept. 16 starting at 3:00 PM on the www.digex.net (205.197.247.33) reflector. CU-SeeMe software is videconferencing for PCs and Macs and can be found at ftp.gated.cornell.edu -Thomas

1 0

Re: your mail Re: on anonymity, identity, reputation, and spoofing
by nobody＠alumni.cco.caltech.edu 17 Dec '03

17 Dec '03

I do sympathize with L. Detweiler's concern about multiple identities. Human nature being what it is, if a series of posts appears quickly taking one view, people who disagree may think, well, I guess I'm in the minority on this, I won't make a stink about it. That's just part of the herd instinct, which, IMO, we all share. The lesson is that it is even more important on the net not to be afraid to take unpopular stands. You may find that there are more people who agree with you than you thought. In particular, although I think Detweiler's posts could be tightened up considerably, and I don't agree with his solutions in detail, I can understand his paranoia, having shared it from time to time. There are some possible technological solutions to some of the issues raised. Chaum, in his 1985 CACM paper, describes how "credentials" can be exchanged among various pseudonyms a person may have. A credential can basically be any statement by a 3rd party about a person. It could be a statement by a college that he had a certain degree. It could be a statement by a government that he had a driver's license. It could be a statement by a business that he was an agent for that business. The credential would be given to the person, then Chaum shows how it could be re-blinded and shown under other pseudonyms. The credential can be verified, but it can't be linked to the True Name or other pseudonyms of the holder. We could think about using something like this for reputations. Take Nick's question about how a new pseudonym could get through the filters. Maybe the person posts under his real name for a while, then some respected person is willing to give him a "valued poster" credential. He can re-blind this credential and submit it with posts he starts to make under his pseudonym. People will know that the pseudonymous poster is at least potentially capable of making sense, and give his words some weight. But there will be no connection to his True Name. (Of course, this could lead occasionally to a Dr. Jekyll who makes sensible and weighty posts under his own name, while under his Mr. Hyde pseudonym he rants and raves. But hopefully this would not happen too often.) Other credentials could be related to some of the other points Detweiler raised, such as list membership > some number of months. The point would be that these credentials are voluntary, used to get past people's filters, and that they retain poster anonymity while giving readers useful information about the poster. It's ironic that L. Detweiler, who has played a major part in spreading awareness of Cypherpunks technology through his widely read Privacy and Anonymity FAQ, is suggesting that people should be limited in their use of this technology. Still, the concerns he raises are going to be shared by many people, and we should try to be ready with technological solutions that are consistent with privacy protection. Hal Finney hfinney(a)shell.portal.com

2 1