December 2003 - cypherpunks-legacy

VCRplus code Algorithm
by ogre＠brainlink.com 17 Dec '03

17 Dec '03

I've been trying (without success) to crack the encryption scheme that Gemstar uses in its' VCRplus codes. I have written a TV/cable show management system that generates plus codes for half-hour boundary shows (ie 4 to 6 digit codes). I can't seem to find anything on 7 and 8 digit codes which handle 5 minute increments for program start time and length. (And yes, I have the article "Decoding a VCR Controller Code" by Ken Shirriff, Curt Welch and Andrew Kinsman. It was published in Cryptologia. Unfortunately, they didn't get beyond 6 digits either.) BTW, this is strictly for my own use. I'm just tired of approximating shows and also a bug that I have that occasionally gives incorrect results (I think it may be a leading zero being trimmed by the math formulas). Can anyone help?

1 0

Re: MITM attacks and True Names (again...)
by Bill Stewart 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 07:02 PM 10/6/95 -0600, bryce(a)colorado.edu wrote: >(As an aside I fully sympathize with those who rail against the popular >(?) impression that a True Name is somehow necessary to communication. >That is a dangerous idea, since all a True Name is really necessary for >is violence. (And, pending certain eagerly-awaited technological >developments, for sex.)) That's incorrect - it can also be necessary for _avoiding_ violence. You don't need a full True Name for that, but you do need an accurate partition of the namespace into those entities who will, won't, or might come and beat you up based on what you say. Thus, if you're talking to Subcommandante Marcos about your plans for overthrowing the governor, you don't need to know his True Name, but you do need to know if he's a cop; anybody doing a successful MITM job on your data communications probably is. Similarly, if you're in the pharmaceutical retail business and talking to your wholesaler, you may even want to avoid knowing his True Name, but you not only want to know if he's a cop, but you may want to know whether, if you show up at the appointed physical location with your physical body, you'll be met by just him (with his merchandise), or by other people as well (eavesdroppers using MITM because it's easier than cracking crypto), or by one of his or your competitors trying to rip you off. (You'd also like to know if you'll be met by him without his merchandise, but with his big ugly friends, which is why you plan to meet him in a public place...) -----BEGIN PGP SIGNATURE----- Version: 2.7.1 Comment: PGP available outside U.S.A. at ftp.ox.ac.uk iQBVAwUBMHdVcPthU5e7emAFAQHRNwH9ErIcbgioSJOD5270SJ2hRfycNd6sMAj3 Q5jzguJVkbmsrI9I85eB/caV9UOOkSTX29v3gTAHWbeNuAL9t/Yyrw== =3qir -----END PGP SIGNATURE----- #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

3 2

Re: cypherpunks digicash bank?
by cman＠communities.com 17 Dec '03

17 Dec '03

I strongly recommend that anyone considering licensing from Chaum first read my paper on some interesting aspects of his basic blinding patent. The paper is at: http://www.communities.com/paper/agnostic.html. I will be putting up another short paper on anonymous currency management within the next few days. Also, I strongly recommend that anyone serious about this not use the word "bank", and take the time to figure out how to structure the service as an NBFI (non-banking financial institution) and not a "bank". Note that NBFIs are still regulated, and you will, at minimum, need to consult with your state banking regulators as well as the IRS (who also regulate money transmitters, i.e. issuers of traveller's checks, moneygrams, etc.) Note that the BSA (Bank _non_ Secrecy Act) does in fact apply to NBFIs and money transmitters, and you should be sure to educate yourself as to the implications of this. I will be covering some aspects of these issues at length in my trip report on the anti-money-laundering conference I recently attended, which was a real eye-opener in a number of ways.

2 1

Two bugs in CERN3.0 HTTPD
by Ray Cromwell 17 Dec '03

17 Dec '03

I have not verified whether or not both of these are security holes yet, but the first one is very probably a security hole. 1) overlong domain bug in Proxy mode Symptom: send a proxy request to the server, for instance GET http://overlongdomain HTTP/1.0 This is the same bug that's in Netscape 1.1. The domain buffer is a 256 byte buffer declared on the stack. (char host[256]) 2) too many headers from CGI script Symptom: HTScript.c allocates an array of pointers to char on the stack. This array has size 100. The loop where they parse the output of a CGI script is not bounds checked. To crash the server, create a CGI script that outputs a large number of headers before the document body. (I simply made a perl script that did for($i=0; $i<1000; $i++) { print "Header$i: $i\n") Although this bug can coredump the process servicing the request, I doubt it is exploitable. All that happens is an unchecked header_line[header_index++]=malloc(some space) gets executed. In the worst case, you overwrite the stack with excessive malloc pointers. You may be able to cause a foreign server to crash by having your own fake server return the exploit, and then getting the foreign server to read the headers by issuing a proxy request to your server. Suffice it to say, the CERN code is *littered* with temporary local stack arrays, and I'm guessing that many of them have faulty bounds checking (or none at all) -Ray

1 0

Re: Graphic encryption
by Bill Stewart 17 Dec '03

17 Dec '03

At 08:17 AM 10/6/95 -0700, privsoft(a)ix.netcom.com (Steve ) wrote: >Also if any of ya'll are famillar with graphic encryption, I am looking >for opinions as to its strengths / weaknesses. While normally I'd agree with Lucky Green and say that a good encryption algorithm's strength is independent of its input data, there are exceptions. The description of Privasoft's method on their web page sounded like* it broke up a fax image into little squares and shuffled them around based on some proprietary (hence presumably weak) algorithm, somewhat like feeding them to a shredder or puzzle-box, then put them in a file you can ship with regular fax software or decrypt yourself. If that's the case, and if the squares are sufficiently big to have enough pixels for fax software to compress decently, then it's weak no matter _how_ strong the encryption algorithm that shuffles them is, because you can piece together matching edges like a jigsaw puzzle, or like a bunch of Iranian students with American Embassy shredded documents. Using computers is a lot easier, since you've got precise images of print - most edges will match pretty well with the edges of the adjacent squares, and you can jigsaw the parts that still need work if you get too many multiple matches. A much stronger way to encrypt faxes is to do the Group 3 (or G4) compression first, then encrypt using a real algorithm, ship the (now-useless-for-fax) encrypted bits, decrypt, and read with your favorite fax-image viewer. Or, of course, take the raw file you would have done this with, which is much smaller than the fax-compressed image, encrypt it, ship, decrypt, and view, but that means the person on the far end needs the same word-processor. ------- * The software was on the web page; if I'd had spare disk space that day and some slack time I could have downloaded the demo version and tried it, but this is what the description sounded like it meant. #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

Certification Authorities in history.
by Bill Stewart 17 Dec '03

17 Dec '03

Timothy C. May (or somebody like him, or Tim the Enchanted) wrote: >> The talk of certification authorities is OK, so long as the practice is >> _completely_ and "strongly" voluntary (*). It occurred to me that the authors of the US Constitution had direct experience with the equivalent of mandatory certification hierarchies for legally acceptable digital signatures. They called it "The Stamp Act". If you wanted to make a legal document, such as a contract or will, it needed to be on paper with a tax stamp on it; I forget if this was a watermark or a stick-on stamp, but you could only get it from the authorities. They didn't like it. There was also a few-percent sales tax on tea around that time. They didn't like that either :-) -------- </serious_mode> <Don_Hopkins_Monty_Python_Voice> <i> WHAT </i> is your name? <i> WHAT </i> is your certificate number? </Don_Hopkins_Monty_Python_Voice> <serious_mode> #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

3 3

NEW Netscape RNG hole
by an402976＠anon.penet.fi 17 Dec '03

17 Dec '03

Did anyone else notice a bug in the new, public Netscape RNG code? It appears that on Windows builds, during the RNG seeding, the function that hashes in file contents (EnumSystemFiles) doesn't close a file handle (lFileHandle). This doesn't hurt too badly on the client, but on a server, leaking these resources is deadly. I ran some experiments. It took a few thousand calls before these open file handles forced not only the file content function to fail, but also made OTHER calls quietly fail. With these calls quietly failing, the RNG is significantly weakened. In my tests on Windows NT, ALL of the following RNG functions failed: * GetComputerName * GetVolumeInformation volume Name, volume Serial Number, Maximum Filename Length Filesystem Flags Filesystem Name * GetDiskFreeSpace SectorsPerCluster BytesPerSector Free Clusters Total Clusters * subroutine for the inclusion of system files, both number of them & contents ReadSystemFiles() * subroutine used for other history file accesses SEC_FileForRNG(*filename) How did this get past Netscape testers? Does anyone know if this was fixed before Netscape shipped? Does it rate a shirt, or does this mean Jeff W. gets to shave his head? I seem to remember him promising to shave it if we could show a significant weakness in the new RNG code, and since this does (IMO)... On another note, has anyone noticed the 73 (!!!) or so handles that are leaked by simply opening and closing &Options -> &Preferences... ? Looks like somebody had a problem coding the tabbed dialog. RingZero --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

2 1

Image Tape - view with Java enhanced Netscape mail reader
by Andy 17 Dec '03

17 Dec '03

http://www.javasoft.com/JDK-prebeta1/applets/ScrollingImages/example1.html Title: Image Tape The source.

1 0

FOR_who
by John Young 17 Dec '03

17 Dec '03

10-8-95. NYPaper: "Foreign Policy 3.1. Microsoft as World Power." [Foreign affairs column] Does Microsoft have a foreign policy? Mr. Ballmer says Microsoft doesn't have a foreign policy per se. But it does have a global business agenda. Since Microsoft today has twice the market value of General Motors, it's worth looking at that agenda because it is bound to influence U.S. foreign policy. Microsoft doesn't need Washington to open doors for it because foreign governments are begging Microsoft to come in and translate Windows 95 into their languages, so they can get on the information highway. Describing his contacts with foreign leaders, Mr. Ballmer put it this way: "People say, 'You have this technology. We hear it's changing the world. Tell us how it can help us.' " 10-7-95. The Econofog: "The myth of the powerless state." [lead for a superb 40- page survey of the world economy] The increasing "globalisation" of the world economy is a fact, and one that nobody can ignore. To many, however, one aspect of this change is especially important: its effect on "economic sovereignty". They claim that global integration is emasculating the modern state. If the number of believers is any guide, these views are appealing. Yet the new orthodoxy is wrong. The world has changed, the global economy has indeed arrived: nonetheless, the emasculated state is a myth. Micro and Macro: FOR_who (19 kb)

1 0

Boston Globe article
by Bob Bruen, MIT Lab for Nuclear Science 17 Dec '03

17 Dec '03

The Boston Sunday Globe Business section has an article by Jon Auerbach entitled Cypherpunks with a picture of Carl Ellison and one of Ian Goldberg and David Wagner. It stresses privacy, anarchy and the fears of the FBI.

1 0

Cypherpunks in the Boston Globe
by nyuan＠husc.harvard.edu 17 Dec '03

17 Dec '03

"Cypherpunks: In pursuit of privacy they break codes, fault government plans" by Jon Auerbach is on the front page of the business secion of today's Boston Globe. It leads with a paragraph on Carl Ellison, along with a picture captioned with his quote "We have privacy in the real world." Aside from a few minor inaccuracies and simplifications, it seems like a very balanced, cypher-favorable article. -nhy --------------------------------------------------------------------------- Nina H. Yuan yuan(a)wjh.harvard.edu nyuan(a)fas.harvard.edu nyuan(a)bbn.com "Education is a progressive discovery of our own ignorance." - Will Durant ---------------------------------------------------------------------------

1 0

Re: cypherpunks digicash bank?
by cman＠communities.com 17 Dec '03

17 Dec '03

Adam -- I'm afraid you may have somewhat misunderstood the motivation behind the Identity Agnostic paper. In no way is it intended as a way of not facing the music wrt regulators in the country(s) where such an institution has offices. The IA approach is intended as an possible alternative for an institution that might otherwise license from Chaum. The regulators I've discussed this with are primarily concerned with how money moves into and out of a digital cash system. The fact that small payments cannot be traced from buyer to seller is not at the top of their list of concerns -- it's already a basic fact of life for them in existing payment systems. They are also not oblivious to the privacy concerns inherent in an institution logging masssive amounts of counterparty data about small transactions. I would strongly discourage anyone from trying to set up a garage- type operation. While regulators clearly don't appreciate the subtleties of this stuff, they can spot an illegal bank or an unlicensed money transmitter from a mile away. If your concern is creating account anonymity, then you're going to need to set up outside of the US. Do be aware that even the more relaxed countries of the world have regulations that cover this sort of thing, and they are especially interested in making sure you at least pay the appropriate licensing fees.

1 0

Re: Rethinking the utility of netnews "cancel" control messages
by Erik E. Fair 17 Dec '03

17 Dec '03

At 9:50 10/5/95, Rich Salz wrote: >Cancel/Supercede is a useful model -- architecting them out of Usenet >is a very bad idea. Ask Clarinet. Is it? The principal effects of not having the mechanism is a slightly higher disk storage requirement for netnews - something completely unheard of in the annals of USENET. The downsides of having the mechanism (especially unauthenticated) we see now: official and unofficial squelching of articles that someone doesn't like for whatever arbitrary or situational reason. In the long run, which is the more detrimental effect? It isn't desireable for systems to be perfectly efficient, if they generate imperfect results; as I understand it, the ponderousness of our federal legislative system was designed in for precisely this reason: they were optimizing for long term correctness, instead of efficiency. Frankly, I think that if the question were posed correctly, I'm sure that Brad Templeton (President of Clarinet) would think carefully about answering it, since it has quite a few aspects. I'm just trying to stimulate a little more careful thought about this as a philosopical issue, before you go whack on INN again... Erik Fair

5 4

Re: Netscape 2.0 beta
by David K. Merriman 17 Dec '03

17 Dec '03

Even nicer would be if the Windows beta included *all* the files needed. The setup routine wants to install some OLE2 .dll's, but they don't seem to be included with the compressed file, or even on the Netscape site. I was able to work around it, since I already had the OLE2 stuff on my machine, and edited the installation scripts and such - other folks aren't likely to be as 'lucky'. I suspect that Netscape is going to be hearing about that little oversight..... Dave Merriman This is a test (3 UUE lines) of the unconstitutional ITAR - 1/713th of the PGP executable. See below for getting YOUR chunk! ------------------ PGP.ZIP Part [015/713] ------------------- M=$<(&L`#*IPP",(G6(,,S,`P](<2RWU96XCW86/JBYV8A\D8@X'HB_9H#&\X MX'PCUB.,13B"X8`R?^J-:UB.M_`U\>[#)BS&5$0C,Y#^1CS>1`\T1QTXX6!3 M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/ <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geopages.com/CapitolHill/1148

1 0

Nat Sec Eco Espo
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

The anonymous post of the White House's National Security Science and Technology Strategy recalls debate on this policy underlying reports on CIA economic espionage: Clinton instructs CIA to focus on trade espionage - report Los Angeles, Jul 23 (Reuter) - President Clinton has ordered the Central Intelligence Agency to make economic espionage a top priority, according to a report in the Los Angeles Times on Sunday. The report quotes American intelligence sources who say the CIA was instrumental in providing U.S. trade negotiators information during heated auto trade talks with Japan this spring, and has helped uncover bribes by rival nations competing with U.S. firms for government contracts. The sources say Clinton has issued a classified set of intelligence priorities for the post Cold-War era, and that the CIA is providing case officers with new training on economic matters to meet the new challenge. The recent trade talks with Japan were viewed as a success of the new policy, according to the Times report. It said U.S. Trade Representative Mickey Kantor was pleased with the CIA's ability to report on the bargaining positions of American rivals. But the agency has reportedly been less willing to spy on individual companies. In one recent success in that area the CIA discovered that the French were offering bribes to Brazilian officials to help telecommunications giant Thompson win a government contract. The report says intelligence information helped U.S.-based Raytheon Co. elbow out Thompson of France to win the work. But the problem in such work, say intelligence sources, is determining which multinational corporations based in the United States should be considered "American" firms deserving assistance. Because of this confusion, CIA officials argue they should be kept out of spy work targeting individual foreign business at the behest of U.S. corporations. Even so, the Times report says the intelligence community has told Congress it can claim credit for uncovering bribes affecting $30 billion in foregin contracts over the past few years. -----

1 0

Re: cypherpunks digicash bank?
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

Douglas Barnes <cman(a)communities.com> writes on cypherpunks: > I'm afraid you may have somewhat misunderstood the motivation behind > the Identity Agnostic paper. In no way is it intended as a way of > not facing the music wrt regulators in the country(s) where such an > institution has offices. The IA approach is intended as an possible > alternative for an institution that might otherwise license from > Chaum. So it's intended for avoiding patent issues only? But the identity agnostic idea, and the idea of using software not officially supplied by the bank does not sound like something that would be easy to convince a bank, or other financial institution of? I mean the agnostic server idea is that the user must obtain patent infringing software in order to gain anonymity, or else the user individually obtain on a case by case basis a license from Chaum. A similar mess to the early problem with PGP, back in the days when RSA contended that PGP was a patent infringement, and the other side of the story was that it was the users responsibility to get a license from RSA. As early versions of PGP demonstrated individuals can get away with this kind of thing, but it doesn't help commercial uptake of the software. You need commercial uptake, as a lot of the shops will be commercial service providers, plus value added information or product providers. What I'm saying is that whilst technically the server need do nothing infringing, without the infringing client software it provides nothing new over existing systems, and that the stigma of illegality, might adversely affect the acceptability of the whole scheme to a bank. Ie if you really wanted to sell the system to a bank, you'd presumably stand a better chance if you removed the potential for blinded signatures altogether. Tim is right, patents most definitely retard advancement of technology. > The regulators I've discussed this with are primarily concerned with > how money moves into and out of a digital cash system. The fact that > small payments cannot be traced from buyer to seller is not at the > top of their list of concerns -- it's already a basic fact of life > for them in existing payment systems. So you think with the $10k limit, they might even be happy with a system such as I just described? (note: I did not imply anonymous accounts, only payer anonymity, basically exactly what Chaum has in his trial system right now). > They are also not oblivious to the privacy concerns inherent in an > institution logging massive amounts of counterparty data about > small transactions. I had not realised they were concerned over such things. How does this fit in with the separate 100$ bill for domestic and foreign use? It was previously my suspicion, that 100$ bills were first, and that soon they would be trying to outlaw cash altogether! Perhaps I am too cynical, and I am glad to hear it. (Anyone know if anything ever come of this creation of a foreign issue of 100$ bills which had to be exchanged at customs in entry and exit, each being legal tender only when used in the correct jurisdiction?) > I would strongly discourage anyone from trying to set up a garage- > type operation. While regulators clearly don't appreciate the > subtleties of this stuff, they can spot an illegal bank or an > unlicensed money transmitter from a mile away. I was talking of doing it by the book, patent licenses, appropriate banking licenses, banking regulatory approval. Your description of the banking regulatory bodies likely stance on transferring small amounts anonymously was more favourable than I envisaged. The garage-type operation: I was having problems convincing myself that any bank could be persuaded to do it. Hence I thought, well the civilian sector would have to do it. It doesn't have to be amateurish, just has to be run by people who have an interest in privacy, cypherpunks aren't excluded from doing things professionally, and in fact have a vested interest in seeing it succeed even. You can't expect big banks, governments or corporate types to deliver privacy on a plate, it is counter to their interests - they like nicely indexed, cataloged user profiles, as they are saleable items. Accurate user demographics is big business. The closest that I've seen to a bank offering any semblance of anonymity is Mondex, and it's a crock as far as privacy goes IMO, as as far as I understand the card knows everything, and there is *nothing* stopping the bank downloading *all* of that information next time you plug the card in. That's the kind of anonymity I was growing used to seeing banks offer. Also the fact that it relies purely on the tamper resistance of the card isn't very inspiring, no cryptographic protocols, just a counter buried in a tamper proof card. > If your concern is creating account anonymity, then you're going to > need to set up outside of the US. That was not the immediate concern, only payer anonymity. I thought this would be too much to expect to get away with. Your comments backup that belief. > Do be aware that even the more relaxed countries of the world have > regulations that cover this sort of thing, and they are especially > interested in making sure you at least pay the appropriate licensing > fees. Licensing fees for what? I lack details, and insight into the background of financial dealings (as you might have noticed:-), but my outburst was prompted by impatience with the take up of DigiCash, or any half decent alternative. Blind signature technology has been around for a long time now, and there is not one on-line instance of a practical real world use of this technology. So what problems remain to be solved with a system which has the following characteristics: 1) either agnostic (to save $150k + 10% profits) or coughing up the $150k for Chaums patents - I'm not fussy, only concern for me is implications on uptake as described above 2) no anonymous accounts 3) payer anonymous 4) on-line, normal banking style records kept of money paid in 5) 100% real currency backed 6) profits by keeping interest on backed currency, possibly small % on cashing to pass on VISA costs, etc if necessary Would US banking regulations in your opinion have a problem with this? If $150k is the real sticking point then I'm surprised, I mean ok, it's some money, perhaps the 10% cut of profits Chaum requires is more of a concern. But surely this would win as a privacy preserving internet payment system for convenience, on-line instant payment. With the kind of money investors seem to be willing to back netscape with and the unexpectedly high level of interest in their commerce servers, even Chaum's $150k seems like small change. There must be more to it, what a $1M lawyers bill to sort out the technicalities, and legal implications with regulators? Adam -- #!/bin/perl -s-- -export-a-crypto-system-sig -RSA-3-lines-PERL $m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2%Sa 2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*',$_)while read(STDIN,$m,($w=2*$d-1+length($n)&~1)/2)

1 0

Kerserver keyrings
by jgrubs＠left.webcasters.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- "Jim Grubs (W8GRT)" <jgrubs(a)webcasters.com> writes: > -- [ From: Jim Grubs (W8GRT) * EMC.Ver #2.5.02 ] -- > Attachment: mailsig Code: 0006727 \ Created: 10-03-95, 07:16 PM [1 Kb] > > Someone at Uni-Hamburg must have seen my message and said, "Oops, who turned > that off?" Anyway, their keyring was upated today. It's 6.4 megs!!!! (My > first HD was only 10.) > > > > begin 644 mailsig > M+2T-"B`@("`@("`@("`@("`@("`@("`@("`@(%=E8D-A<W1E<G,H=&TI#0I* > M86UE<R!#+B!'<G5B<R`@("`@("`@("`@("`@("`@("`@("`@("`@("`@:F=R > M=6)S0'=E8F-A<W1E<G,N8V]M#0HV.#$W($UA<&QE=V]O9"!!=F5N=64@("`@ > M("`@("`@("`@("`@("`@("`@("`@5&5L+CH@-#$Y+3@X,BTR-CDW#0I3>6QV > M86YI82P@3V@@-#,U-C`@("`@("`@("`@("`@("`@("`@("`@("`@("`@($9A > M>#H@-#$Y+3@X-2TR.#$T#0H@($EN=&5R;F5T(&-O;G-U;'1I;F<L($A434P@ > E<')O9W)A;6UI;F<L($EN9F]R;6%T:6]N(&)R;VME<FEN9PT*(``` Apologies to all for the mite in E-Mail Connection that caused it to think my .sig was an attachment. Needless to say, I have purged my system of it... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: LIBERTY!! Use it or lose it!! iQCVAwUBMHgO7t74r4kaz3mVAQGPOwP9HLmDUXzv6FHyWUwIiK+kGQkm2f/wS6+C snRmcyuzUK1bYk/xKleq1bdwGo1p6WfkdonAKYlV2sQIfx5smMlwtVqyKCJ8PJZJ EnNhT9i47x0/oF9qta0O225LRGKEFgMswaqAZoRbrwWk1wwDQy1Be1GdUnUMxCTt Ss8yYdV5p4o= =8fAh -----END PGP SIGNATURE----- -- WebCasters(tm) James C. Grubs jgrubs(a)webcasters.com 6817 Maplewood Avenue Tel.: 419-882-2697 Sylvania, Oh 43560 Fax: 419-885-2814 Internet consulting, HTML programming, Information brokering

1 0

Re: Certification Authorities in history.
by James A. Donald 17 Dec '03

17 Dec '03

At 10:26 AM 10/8/95 -0700, Hal wrote: > One key to rule them all; > One key to find them; > One key to bring them all > And in the darkness bind them. A more famous statement on key certification authorities: And he causeth all, both small and great, rich and poor, free and bond, to receive a mark on their right hand, or in their foreheads: And that no man migh buy or sell, save he that had the mark, or the name of the beast, or the number of his name. Coming soon: True names neatly linked to your social insecurity number --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

(ecm) Chaum patent prices (was Re: cypherpunks digicash bank?)
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

[Marcel just posted this in the ecm list, I'm taking the liberty of doing a Rob Hettinga and acting as human gateway between lists, as the posts this was in response to were posted to both lists. -Adam] Forwarded from the ecm(a)ai.mit.edu (Electronic Cash Market) mailing list: >>>>>>>>>>>> From: Marcel van der Peijl <bigmac(a)com.digicash> To: ecm(a)edu.mit.ai Subject: Chaum patent prices Sender: bounce-ecm(a)edu.mit.ai Precedence: bulk Reply-To: Marcel van der Peijl <bigmac(a)com.digicash> Hi, I just want to make a quick comment on the prices that have been floating around on this list ($150K +10%). No doubt this is what David asked at some point to some individual but it is NOT the 'list price' -- there is no such thing as a list price. It all depends on the application, business potential etc. The up-front patent price should never be an obstacle for setting up business. If you wanna do serious business, I suggest to give David Chaum a call, or call Dan Eldridge. Phone numbers and email addresses can be found on our web pages. You might be surprised. And may I remind you that the patent price that is quoted is just a tiny drop in the bucket compared to the kind of money spent on marketing budgets for systems like Mondex!!! You are really talking about a non-issue here, IMHO. Marcel van der Peijl DigiCash bv

1 0

[NOISE] Caution! Netscape 2.0 and Linux
by Christopher J. Shaulis 17 Dec '03

17 Dec '03

Hi all. Just a warning to steer clear of Netscape 2.0 on Linux. It can't resolve FQDNs, its distributed as a staticly linked a.out binary *AGAIN*, and I'm hearing lots of reports sitting here on IRC that it locks up R6 versions of XFree solid on a random basis. Not to mention that there is no java support yet for Linux, and the Java support in the Sun/Windows version of netscape is based on the new (and imcompatible with earlier versions) beta version of Java which sun pimped out to Netscape and won't release the source code too. The part about not resolving FQDNs might be an undocumented feature. The most secure transaction is one that doesn't take place at all. ;) Have fun, Christopher

3 3

Re: Chaum patent prices
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

Tim wrote in his (to me) spot on article (cypherpunks list) about patents wrecking technolgical progress, and hindering all important experimentation, and exploration of technology: > [...] for example, can't use the Chaumian blinding protocols > without hiring lawyers, paying Chaum his up-front fee, and laying > out his designs and business plans (which he very probably doesn't > even have!). from Marcel's post: > I just want to make a quick comment on the prices that have been > floating around on this list ($150K +10%). No doubt this is what > David asked at some point to some individual but it is NOT the > 'list price' -- there is no such thing as a list price. It all ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > depends on the application, business potential etc. ^^^^^^^^^^^^^^^^^^^^^^ ie laying your plans out up front, plans which don't exist! Business potential is not predictable, even obtaining appropriate status, and banking licenses would presumably be doubtful unless a concerted, organised effort were put together. Requiring business plans rules out experimenting. The freeware mosaic browsers growth while being developed by academia, and the WWW in general seems to be a model which works rather well for the internet, if the netscape success story is anything to go by. Internet payment is rather harder to set up as a small experimental operation due to the legal and political implications, but a *real* example by Digicash would be nice. As in: if no licensing banks for digicash can be found, perhaps it would be a good approach for digicash to do it themselves, and support an offical exchange mechanism, if such a mechanism took off, banks might be interested to buy into an existing client base. On the $150k + 10% figures, my apologies, I picked them up from earlier posts on ecm I think, and had assumed incorrectly that this was a fixed price. > The up-front patent price should never be an obstacle for setting up > business. If you wanna do serious business, I suggest to give David > Chaum a call, or call Dan Eldridge. Phone numbers and email addresses > can be found on our web pages. You might be surprised. I am tempted to say: "how about free for a good cause :-)" And it might (theoretically) be nice as an analogue of the relationship between PGP and RSA with PGPs current free non-commercial use license from RSA, that seems to have helped RSA quite a lot. RSA are fond of quoting statistics about the world wide usage of their algorithms, one rather suspects that PGP is included and a major contributer to their figures :-) However, being realistic, I expect the answer to be no. I can understand this, but IMO it is still not a good situation from the point of view of advancing technology. My point however, is lets see a digicash payment system with a real exchange and soon! I don't care who does it so long as it gets done! > And may I remind you that the patent price that is quoted is just a > tiny drop in the bucket compared to the kind of money spent on > marketing budgets for systems like Mondex!!! You are really talking > about a non-issue here, IMHO. True enough. The 10% is likely more of a sticking point tho, but as you say this is all negotiable. But hey, I don't have a high powered business plan, I'm just a little cypherpunk be-moaning the fact that there are no digicash licensing banks which I can use to take advantage of Chaum's privacy technology, and instant on-line buying. Just think how much hassle could be saved when buying the perl rsa T-shirts even (no, I promise no more shirts arguments, I'm talking of payment!), all the foreign cheques, the hugely exhorbitant charges banks charge for writing small value foreign currency cheques, the risks (and dubious technical legality in some places) of posting paper cash in the mail, and the odd postal order which the bank would like to charge more than the face value to cash (I kid you not, I asked a few people to send different payment forms). "Click here to buy" would be infinitely better. The market is impatient, and inferiour, non-privacy preserving payment forms are in danger of soon becoming entrenched as standard internet payment methods. Digicash has or soon will have MSN money systems to compete with. Digicash now! Adam -- #!/bin/perl -s-- -export-a-crypto-system-sig -RSA-3-lines-PERL $m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2%Sa 2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*',$_)while read(STDIN,$m,($w=2*$d-1+length($n)&~1)/2)

1 0

Re: NSA Realists v. Nuts
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199510071424.AA00279(a)october.ducktown.org>, mkj(a)october.ducktown.org wrote: > Need I point out that pride in one's work is not necessarily exclusive > of evil? Rarely does anyone actually think of themselves as evil -- > and those few who do are usually just harmless nuts. The most evil > and destructive people throughout history have always thought of > themselves as good people, doing good work. Let me illustrate this with an example. During my visit to Dachau Concentration Camp, I saw original lab notebooks of experiments designed to increase the survial rate of pilots downed above the cold waters of the North Sea. A noble cause. The notebooks contained pages upon pages of tables listing survial times vs. water temperature, the data gained by dropping subjects into a tub containing water of a defined temperature. I them saw more tables of the effects of various methods investigated to revive hypothermia victims who were near death. One of the treatments under investigation was dropping the patient into boiling water. Surely this type of research falls under the category of evil. But the scientists that conducted the study would not have thought so. They believed that they did a favor to humanity. The fact that to this day the treatment of hypothermia is based upon the results of this study, saving the lives of thousands of patients over the decades past, would surely - in the experimenters' minds - have vindicated their gruesome deeds. Ponder this, - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMHgyXyoZzwIn1bdtAQFZCAGAvCKsAfc09eefeVsp3Oec73L6WsvxJcbH nlyp7+gX0rG1vBZcsTemp817MSa/WUbb =UuOA -----END PGP SIGNATURE-----

6 6

Re: Noise: anyone experience with brain waves input devices (IBVA,...)
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <9510080007.AA01951(a)hplyot.obspm.fr>, dl(a)hplyot.obspm.fr (Laurent Demailly) wrote: > I'd like to know if anyone have first hand experience with brain wave > and other (hyped) input devices like IBVA or others and/or pointers to > informations ? The pioneering work in this field was done by Andrew Junker, formerly Air Force labs. He now uses his system to sail his boat. At Rand Mac Millan Air Force Base, they have a simulator that is controlled by brain waves alone. Note that all the brain wave interfaces only allow a simple left/right type of control. Right turn is easy, but left turn is rather hard to learn. Anything bejond that, as well as direct input of data into the brain requires a direct link to neurons that can only be achieved by surgical means. See Brindley G S et al and the work done by Normann R A at U of Utah for the studies that defined the field. I have developed a design that solves the notorious problem of connecting the silicon matrix to individual neurons, but really can't elaborate on it until I get around to file a patent for it. Also take a look at the breakthroughs reported in PHYSICS NEWS UPDATE The American Institute of Physics Bulletin of Physics News Number 236: August 7, 1995 by Phillip F. Schewe and Ben Stein available at http://www.hep.net/documents/newsletters/pnu/1995/pnu-236.html Have fun, - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMHg4gSoZzwIn1bdtAQFpWAF9HQg2f8myEyI4HrHY/5ZCnB/nLG+AzZXo rA8zMPMo0l5t24i74tlTBJnaZYS4zkSW =Hq/0 -----END PGP SIGNATURE-----

1 0

Calming
by John Young 17 Dec '03

17 Dec '03

PC Mag of Oct 24 odes Damien's mode, yodels out-of-tunely Netscape's sec, cites the sites of the SSL hacking axes, and declares that, whew, nervous darlings, all is lovely waltzing at crypto-crystal ball. Also casts doe eyes at STT and pre-lubed sheaths. It says the "National Security Administration" Rx's 40-56 itty-bit fits for muleing precious US fairy dust. Oilpalming the jittery globalists of squat fearing cleartext.

1 0

anonymous cash without blinding
by Wei Dai 17 Dec '03

17 Dec '03

With all this talk about Chuam patents, I would like to remind people that blind signatures are not absolutely essential to an anonymous digital cash system. You can combine a traceable cash system with an anonymous communication system in a fairly obvious way to get a fully (both payer and payee) anonymous cash system. Suppose a bank is running a digital cash system that works like this: it maintains a database of valid coins, and whenever someone presents it with a valid coin (string of bytes) it erases that coin from its database, and then either gives the person an equivelent amount of paper cash or a newly created coin(s) of the same value. Now if the bank allows this exchange of old coins for new coins to be done over an anonymous network (e.g., a remailer-net), then the system is anonymous as long as you don't move physical money in or out of the system. Maintaining anonymity when moving physical money in and out of the system is what blinding helps you to do, but this will be less useful in a fully digital economy where such movement will be infrequent. Wei Dai

1 0