December 2003 - cypherpunks-legacy

ChemWeb.com
by Davina Heaven 17 Dec '03

17 Dec '03

Dear Dr Cypherpunks Thank you for your message to ChemWeb.com. Please enter your Member Name (user name) and Password exactly as shown below (please note that our system is case sensitive and will not tolerate spaces): Member Name: cypherpunks Password: crossfire If you have any further queries or comments, please do not hesitate to contact me again. Yours sincerely, Davina Heaven Customer Services ChemWeb Inc. 50 New Bond Street London W1Y 6HA Tel: +44 (0)171 499 4748 Fax: +44 (0)171 499 4102 http://ChemWeb.com World Wide Club for the Chemical Community > -----Original Message----- > From: cypherpunks(a)toad.com [SMTP:cypherpunks@toad.com] > Sent: None > To: info(a)chemweb.com > Subject: ChemWeb password > > Request for password: > > Full name: cypherpunks cypherpunks > Current e-mail: cypherpunks(a)toad.com > Other e-mails: > Member name: cypherpunks > Comment:

1 0

ChemWeb password
by info＠chemweb.com 17 Dec '03

17 Dec '03

Dear Dr cypherpunks cypherpunks Someone has used our password utility located at http://chemweb.com/user_gateway/html/forgot_password.html to request that the password for your account be sent to this email address (the one that we have on file for your account). If it wasn't you, don't worry, because no one can ever get your password except you (we only mail it to the email address on file). Someone probably entered the wrong address by accident. If it was you, then here's the information that you've been waiting for. Your Member Name is: cypherpunks Your Current Password is: crossfire For additional help with technical problems, please see our online help guide at http://chemweb.com/help/html/index.html ChemWeb administration

1 0

The Beeb speaks like a cypherpunk once removed...
by Robert Hettinga 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- There's some discussion on the BBC about that Chinese businessman who's now in the klink for "conspiring against the state using the internet" :-). The Beeb has an internet correspondent, and he's, right now, talking about strong crypto, anonymous remailers, and quoting Gilmore's censorship is damage line. All without using the words "strong cryptography", or "anonymous remailers", or "John Gilmore". :-). He was talking about how the Chinese website was hacked within hours and painted over with pro democracy stuff and links to Amnesty International, among other things. All of this was in a favorable, horse is out of the barn, this is good for freedom, light. Cheers, Robert Hettinga -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.5.5 iQEVAwUBNmfw9cUCGwxmWcHhAQEDEwf9H9xqZ2LU935VawA9ZwpzFPF2CKrl1xam jzGJX2uTOhiYGtkQhZ2hFY7/ISoNGXvinwHACycXVi5AdxR6//2tzr1szjk4bgB5 NvKW+1gJJWP5bD0Kz3JwYui3t2fAetjSg94HCxcWbSQM4NJVP6IBXyg48ZtGmkVE UqvhwYc41NHVDgZt/ist5EQEAWcWh3/qApEbeS8xG7SP4FZeCeogCidVmQuMWC1u sAQbrd5fdFdTcUs0feuk9zBpEklTe3AljfnDbfSEUpyok29L+9R3cqAyh/5GM0yd 3uVQTmqOSMLK0o+L9tuejgkaTGnI7Co2NXaYbh/jPKGzm/OAYr7/fQ== =FU5E -----END PGP SIGNATURE----- ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Wassenaar Statement
by John Young 17 Dec '03

17 Dec '03

The Secretariat of The Wassenaar Arrangement has issued brief public docs on the recent meeting: http://jya.com/wa-state98.htm Only one brief mention of encryption: "8. The WA agreed control list amendments to take into account recent technological developments. The amendments to the lists included elimination of coverage of commonly available civil telecommunications equipment as well as the modernisation of encryption controls to keep pace with developing technology and electronic commerce, while also being mindful of security interests. Participating States also discussed the potential need for the WA and national export control authorities to respond quickly and effectively to the emergence of new technologies." Which appears to confirm that each state will implement and announce its encryption policy as it sees fit. The US has jumped to proclaim to its constituencies that it has won. Though it's the secret agreements that remain to be publicized. Note the gaps in the public docs and dissimulative assurances. We also offer a recent related message from Denmark on its fluid crypto policy: http://jya.com/dk-crypto98.htm

1 0

TESTING... Seems like I don't get all my mail...
by Jan Dobrucki 17 Dec '03

17 Dec '03

TEST TEST TEST TEST JDO

1 0

Surf the Web 20-Times Faster
by RealNetworks News 17 Dec '03

17 Dec '03

Dear RealPlayer User, Want to speed up your Internet connection without purchasing a new modem? Tired of long-download times and network problems? For a limited time, RealNetworks invites you to download PeakJet 2000-which can speed your web surfing up to 20-times faster-for only $14.95! Read on, or download now: => http://www.realstore.com/specials/onesurfing.html How does it work? PeakJet's technology automatically learns from your browsing habits. While you read through a page, PeakJet 2000 intelligently works behind the scenes and preloads and freshens links according to your interests. When you click, the next page appears almost instantly. All you do is download PeakJet 2000 and start surfing at lightening speed! PeakJet 2000 also offers these great benefits: - Speeds Web surfing up to 20-times faster without requiring a new modem-and works with any modem speed. - Maximizes idle modem time; intelligently preloads pages while you go about your normal browsing. - Economizes bandwidth by devoting cache to your favorite links or frequently visited Web pages. - Comes with a 30-day money-back guarantee. PeakJet 2000 was awarded a 5-star rating by ZDNet. For a limited time, it is only $14.95 - the lowest price for PeakJet 2000 anywhere! To download now, visit: => http://www.realstore.com/specials/twosurfing.html Thank you for continuing to use RealNetworks products. Maria Cantwell Senior Vice President RealNetworks, Inc. Seattle, WA USA ---------------------------- ABOUT THIS E-MAIL Participation in RealNetworks product updates and special offers is voluntary. During the installation of the RealPlayer software you indicated a preference to receive these e-mails. For information about unsubscribing from future announcements, do not respond to this email, instead visit: http://www.real.com/mailinglist/

1 0

joy of export, h/ware
by Anonymous 17 Dec '03

17 Dec '03

At 10:06 AM 12/3/98 -0800, Michael Motyka wrote: >> Their architecture has real $$ value because it cracks 99% of >> "encrypted" traffic. >> >What type of attack was used in the famous test? Known plaintext? It >gets a bit tougher in the real world doesn't it? Not really. >> Offering the real stuff for sale in US requires some investment. >> >Really? Interesting question. Open a delaware corporation and sell munition-quality gate arrays in the back pages of Popular Electronics or EE Times... keep us posted... >I expect it would be easier to convince a manufacturer to participate >with a working prototype than it would with only an idea. Duh :-) >> Hardware is overkill for the single voice line. PGPfone works fine >> there. ^^^^^^^^ >> >No it is not. 500k gates may be too much but I maintain that you simply >cannot trust the Wintel HW, Windows or anything you cannot analyze in >detail and freeze. Besides, people like little palm-sized gadgets. * 10,000 gates cost less than a paper clip. 500K is high for a block cipher. * If we don't find something to do with them, at the rate we're producing them, the earth will be covered with silicon and its compounds soon. :-) * Its not like we'd ever put floating point routines, or blitting routines, out of business by integrating those functions in Si, is it? Naah, we'd never accelerate encryption with hardware, the CPU is bored and has nothing better to do, and its soooo expensive to print chips.. (That being said, I'll point out to myself how many asics have been replaced by dsps...but not without some inefficiency) * PGPfone on a very fast cpu plus fast link is still less pleasant than a noisy cordless (no pun intended). * We'd never take encryption hardware through the same path as modems, would we? First used between companies, then used for remote access, eventually you can't buy a bloody machine without one. Getting cheaper, faster, closer to the motherboard, taken for granted by applications. Ever seen a 300 baud, 40 lb modem, cost probably $3000 in 1970 dollars? The final level of deployment is when garage-door-openers, car remotes, and childrens' toys (e.g., radio controlled cars) use encryption chips... or chips with encryption, anyway. >Now an embedded system for secure e-mail that used a PC as a gateway >might be kind of cool. You drop encrypted attachments onto a driver that >sends them to the unit where you read them. Anything you enter and >encrypt at the unit is presented as a file at the host to be attached >and sent. USB would be plenty quick for that sort of stuff. Yes, the PC can be used as an untrusted router if the encryption is done outside it. The outside encrypting unit should also perform NAT, otherwise the PC (doing the tunnelling) can broadcast traffic ('trap and trace' in the pots world) info. The lower power used in PDAs really helps keep the boys in the White Van Across the Street busy. Email is so low-bandwidth that software suffices. Secure video conferencing on your Dick Tracy (tm) telewatch needs h/w support. --- Is 5% of YOUR communications encrypted or anonymous in '98 ?? ---

1 0

Re: Wassenaar Statement
by Anonymous 17 Dec '03

17 Dec '03

If these reports are correct, the United States could end up being one of the countries with the most LIBERAL export controls. In the United States, it is currently legal to export any cryptographic software you like - as long as it is in printed form. This is because of fears of violating the First Amendment. Not all countries have such strong conventions for protecting the printed word. PGP source code is being exported in printed form, scanned in overseas, and then distributed from there. If the Wassenaar Arrangement prevents it from being exported from its current overseas distribution site, a solution can be to ship it in printed form from the U.S. to a wide range of other countries. As long as those countries don't prohibit domestic distribution of crypto software, strong cryptography can still be made available almost everywhere. The PGP source code books begin with a section that is, in effect, a "how-to" for printing software in such a way that it can be reliably scanned. Each page and each line has a checksum. The books come with a Perl script short enough to enter by hand that does basic checksum verification. This is used to read a second, longer Perl script that can do error correction; and this is then used to bootstrap into the full script which will read the books, create all the files, organize the directories, and reconstruct the entire source code tree. It may be that in the future this will be the most effective way to communicate internationally about security software. It would be good for other groups to become familiar with this technology which has been pioneered by PGP.

1 0

Send email list - go to jail for life in China [/.]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > X-within-URL: http://news.bbc.co.uk/hi/english/world/asia-pacific/newsid_224000/224907.stm > Cyber dissident awaits trial in China > By China Analyst James Miles > > A man is awaiting trial in Shanghai prison charged with using the > Internet to try to subvert the government. > > Patrick Lin, 30, was arrested in March for sending 30,000 Chinese > e-mail addresses to an Internet magazine run by Chinese dissidents > abroad. [text deleted] ____________________________________________________________________ Technology cannot make us other than what we are. James P. Hogan The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Ethical programming guild? [/.]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > X-within-URL: http://slashdot.org/features/98/12/04/1158251.shtml > The following was written by Slashdot Reader James Moyer . > > In proposing this idea, I think that it would a little bit of > background would be appropriate. I am a student at Ohio State, and I > have a strong interest in civil liberties and privacy issues. In fact, > I am now in the process of organizing an on-campus student > organization to criticize Ohio State's overuse of the social security > number, biometric identification and other related issues to privacy > directly concerning the university. > > Here on Slashdot I use the nickname JimBobJoe posting from email > address vampire(a)innocent.com. > > I also consider myself a Libertarian, and from many of the postings on > Slashdot, it appears that there are quite a lot of Libertarians out > there too. There is no coincidence, in my mind, that some of the most > stringent privacy laws in the nation hail from a highly technical, > Libertarian state, being Washington state. In the same vein, it is > rather amusing to see countries such as Malaysia attempt to draw > computer professions into their country, where the severity of their > laws turn many away. [text deleted] ____________________________________________________________________ Technology cannot make us other than what we are. James P. Hogan The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

export of printed crypto [Was Re:Wassenaar Statement]
by Anonymous 17 Dec '03

17 Dec '03

The PGP source code is open, published in book form and this gets stronger 1st amendment protection. US crypto companies have also read the relevant portions of the EAR. Yet, none, to my knowledge, have tried this. Would any attorney reading the list care to comment? The EAR clearly states that printed crypto is not subject to the EAR whether the material is publically disseminated or not. Anyway, about one second after somebody did this another extra- constitutional "emergency" executive order would prohibit it. -Wassenaar >In the United States, it is currently legal to export any cryptographic >software you like - as long as it is in printed form. This is because >of fears of violating the First Amendment. Not all countries have such >strong conventions for protecting the printed word. >PGP source code is being exported in printed form, scanned in overseas,

1 0

Streams, Voice, and Sensitive Dependence
by Lee Davis 17 Dec '03

17 Dec '03

It is my understanding that the PGP algorithm is primarily intended as a block cypher. Therefore, wouldn't an Outer Block stream cypher be more effective for phone conversations? Both solutions require hardware for a practical (tolerably noiseless) implementation, so there's nothing to be gained by streaming data into a block format. In any case, there has been a lot of recent work in dynamic systems (Chaos), especially in the fast computations of Julia Sets. Has anyone seen a paper on exploiting the sensitive dependance in these systems for pseudorandom number generation?

2 2

Re: joy of export, h/ware
by Michael Motyka 17 Dec '03

17 Dec '03

>>What type of attack was used in the famous test? Known plaintext? It >>gets a bit tougher in the real world doesn't it? > > Not really. > Even if you don't know what you're looking for? Help me out with that one. > * PGPfone on a very fast cpu plus fast link is still less pleasant > than a noisy cordless (no pun intended). > You trust PGPfone on commercial HW enough to do your spy work with it? A system with dedicated audio compression ( http://www.dspg.com/ e.g. ) and a modem could probably be used to establish a secure, full-duplex link over the POTS. A microP, possibly with a small gate array to accel the crypto, would be able to handle the rest of job. Actually a pretty simple product. It could even use your dial-up account and be your internet phone. I know it has been done. I just won't be happy 'til it's in 50 million homes. > * We'd never take encryption hardware through the same path as modems, > would we? First used between companies, then used for remote access, > eventually you can't buy a bloody machine without one. Getting > cheaper, faster, closer to the motherboard, taken for granted by > applications. Ever seen a 300 baud, 40 lb modem, cost probably $3000 > in 1970 dollars? > Yes, I have. Fortunately encryption HW will not have to go through that sort of process. The frontier has been tamed, there are freeways everywhere - all you have to do is pick a lot and build. IOW - that 300 baud modem if done from scratch now would cost nowhere near $3000/unit. > The final level of deployment is when garage-door-openers, car > remotes, and childrens' toys (e.g., radio controlled cars) use > encryption chips... or chips with encryption, anyway. > The time is ripe. > The outside encrypting unit should also perform NAT, otherwise > the PC (doing the tunnelling) can broadcast traffic ('trap and trace' > in the pots world) info. > Clueless again! What is 'NAT'? > Email is so low-bandwidth that software suffices. > Absolutely. The issue there is more one of trustworthy HW and SW. Back to WINTEL/MICROSNORT. Again, !barf!.

1 0

Wassenaar Addendum
by John Young 17 Dec '03

17 Dec '03

Caspar Bowden in the UK says by telephone that a Wassenaar spokesman told him today that the WA org will issue next week a detailed "template" which specifies terms of the recent agreement to control encryption. It will go well beyond what has been heretofore generally agreed to by the member states under which there was a good bit of latitude for each to determine its own policy. This is an unprecedented united front by the members, and the paper will be a first for detailed export controls issued by the Wassenaar org rather than by each nation. When ready it will be put on the Wassenaar Web site: http://www.wassenaar.org. We've made a request to DoC for elaboration of the press release yesterday which featured David Aarons' general claims, but no response yet. The USG may not comment until the WA paper is issued. Caspar posted a capsule of his infor on UK Crypto: From: "Caspar Bowden" <cb(a)fipr.org> To: <ukcrypto(a)maillist.ox.ac.uk> Subject: News from Wassenaar Secretariat Date: Fri, 4 Dec 1998 16:23:58 -0000 Message-ID: <000101be1fa2$9da127e0$dc77e4d4@cpsb> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal Just talked to Dirk Weicke, Senior Adviser to Wassenaar Organisation. (Tel:+43 1 516360) No written details will be issued until next week, but gist is: *) No alteration to question of whether Wassenaar covers intangible exports. Up to signatory states to interpret and legislate. *) mass-market software, symmetric key length limited to 56-bits *) software generally available, but with other restrictive tests on end-user re-configurability, symmetric key length limited to 64-bits *) Assymetric key lengths (not sure how relates to above) limited to: RSA & Digital logarithm: 512 bits Elliptic curve : 112 bits -- Caspar Bowden http://www.fipr.org Director, Foundation for Information Policy Research Tel: +44(0)171 354 2333 Fax: +44(0)171 827 6534 ----------

1 0

Re: Streams, Voice, and Sensitive Dependence
by Jim Gillogly 17 Dec '03

17 Dec '03

"Lee Davis"<lee.davis(a)thomasmore.edu> skribis: > In any case, there has been a lot of recent work in dynamic systems (Chaos), > especially in the fast computations of Julia Sets. Has anyone seen a paper on > exploiting the sensitive dependance in these systems for pseudorandom number > generation? A number of attempts have been made to apply chaos to cryptosystems. The two that I've broken suffered from the same fault: although it's difficult to find the precise starting point (key) due to sensitive dependence, chaotic systems are by definition non-random, and have preferred orbits. If the cryptanalyst finds an orbit that's close to the one used by the actual key, the stream is mostly the same; this is good enough to hone the attack for the next pass. I'm not saying chaos has no applications in cryptography; only that the applications are not obvious. -- Jim Gillogly Trewesday, 14 Foreyule S.R. 1998, 19:37 12.19.5.13.7, 6 Manik 20 Ceh, Sixth Lord of Night

1 0

Re: Mixmaster client 4 the Mac OS?
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Mime-Version: 1.0 X-Sender: loki(a)sirius.infonex.com Date: Fri, 4 Dec 1998 10:08:01 -0800 To: Robert Hettinga <rah(a)shipwright.com>, mac-crypto(a)vmeng.com From: Lance Cottrell <loki(a)infonex.com> Subject: Re: Mixmaster client 4 the Mac OS? Sender: <mac-crypto(a)vmeng.com> Precedence: Bulk Several people have offered, but none have produced a fully functional version. -Lance At 8:53 PM -0500 12/3/98, Robert Hettinga wrote: >--- begin forwarded text > > >Date: Fri, 4 Dec 1998 01:42:19 +0100 >From: Anonymous <nobody(a)replay.com> >Comments: This message did not originate from the Sender address above. > It was remailed automatically by anonymizing remailer software. > Please report problems or inappropriate use to the > remailer administrator at <abuse(a)replay.com>. >Subject: Mixmaster client 4 the Mac OS? >To: cypherpunks(a)toad.com >Sender: owner-cypherpunks(a)cyberpass.net >Precedence: first-class >Reply-To: Anonymous <nobody(a)replay.com> >X-Loop: cypherpunks(a)cyberpass.net > >I heard sometime last summer that the mixmaster client was being ported to >the Mac. Does anyone know the status of this project? > >--- end forwarded text > > >----------------- >Robert A. Hettinga <mailto: rah(a)philodox.com> >Philodox Financial Technology Evangelism <http://www.philodox.com/> >44 Farquhar Street, Boston, MA 02131 USA >"... however it may deserve respect for its usefulness and antiquity, >[predicting the end of the world] has not been found agreeable to >experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' ---------------------------------------------------------- Lance Cottrell loki(a)infonex.com PGP 2.6 key available by finger or server. http://www.infonex.com/~loki/ "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ---------------------------------------------------------- --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: joy of export, h/ware
by Jim Gillogly 17 Dec '03

17 Dec '03

>>> What type of attack was used in the famous test? Known plaintext? It >>> gets a bit tougher in the real world doesn't it? >> >> Not really. Michael Motyka <mmotyka(a)lsil.com> skribis: > Even if you don't know what you're looking for? Help me out with that > one. The question was "in the real world": in this case, as opposed to artificial challenges, you often (or normally) do have access to known or chosen plaintext. This can involve expected headers ("\nSubject: " somewhere near the beginning of a message has a good chance of giving you a 64-bit block), standard plaintext (". The " is a perennial favorite), or known C idioms ("#include <stdio.h>\n") can all be tried. The EFF hardware is set up to look for various kinds of patterns. For example, it can check the high bit on the recovered plaintext, to see whether the result is ASCII. This is certainly the easiest way to get in if you're breaking normal uncompressed messages or source code. If it's compressed, you still may be OK -- most compression packages put magic file identifiers at the beginning, and some have guessable trees there. If you're breaking a transaction stream it's likely to be even easier, with the standard headers, even if you don't go to the trouble of injecting your own know transaction into the stream. -- Jim Gillogly Trewesday, 14 Foreyule S.R. 1998, 20:22 12.19.5.13.7, 6 Manik 20 Ceh, Sixth Lord of Night

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

Citibank in drug cash probe GAO report slams bank for secretly moving millions in alleged drug money December 4, 1998: 10:56 a.m. ET http://cnnfn.com/worldbiz/9812/04/citibank/ Citigroup's Dimon resigns - Nov. 02, 1998 Citibank Buys Into Microsoft-Supported E-Billing Venture - Sep. 14, 1998 General Accounting Office Citibank NEW YORK (CNNfn) - Citibank secretly transferred up to $100 million in alleged drug money for the brother of the former Mexican president and violated its own internal controls on money laundering, the General Accounting Office said Friday. The GAO charged in a report that the second-largest U.S. bank facilitated "a money-managing system that disguised the origin, destination and beneficial owner of the funds." The report, entitled "Raul Salinas, Citibank and Alleged Money Laundering," could lead to congressional hearings against Citibank in the new year. Salinas is the eldest brother of Carlos Salinas de Gortari, who served as Mexican president between 1988 and 1994. There have been repeated rumors that Salinas was linked to drug lords. But according to the report, Citibank's private banking unit asked Salinas few questions when approached by him in 1992. As a mid-level government employee, Salinas earned less than $200,00 a year. But between 1992 and 1994 he moved more than $90 million through Citibank accounts. Checks worth millions of dollars were taken by hand to Citibank Mexico by Salinas' wife Paulina. The money then was moved to Switzerland through a complex series of international transactions. Starting in mid-1992, the GAO said, "Citibank actions assisted Mr. Salinas with these transfers and effectively disguised the funds' source and destination, thus breaking the funds' paper trail." Citibank has its own "know-your-customer" procedures, which it failed to follow in the Salinas case, the GAO said. It was only after Salinas was charged with murder in 1995 that Citibank investigated the source of funds. Even then, according to a bank representative, "Citibank New York's Mexican division believed that all of Mr. Salinas' funds had been obtained legally, with a large portion resulting from the sale of a construction company he owned," the report states. "However, Citibank reportedly knew no details about the construction company, including its name, who had purchased it, or the amount of money generated by its sale." GAO investigators also criticize the bank for establishing a Cayman Islands trust to disguise the source and destination of Salinas' money. Salinas has denied any wrongdoing, saying that the money came from Mexican industrialists who wanted him to establish an investment fund. Citibank said in a statement the report "contains gross errors of fact and interpretation" and "ignores recent progress in strengthened law and industry procedures which Citibank strongly supports in keeping with our commitment to combat money laundering, to comply with the letter and spirit of related laws and to continually strengthen our procedures everywhere we operate." Spokesman Dick Howe added, "We have looked into the matter ourselves and have found that neither the company nor any employee has violated the law. We're cooperating fully with law enforcement authorities." The GAO said it was unable to determine whether Citibank broke U.S. money laundering laws. But the Justice Department also is investigating the company's actions. No law specifically requires banks to know their customers, but money laundering -- concealing the source of funds obtained from illegal activity including drug sales -- is illegal. Salinas is in prison, being tried for murder. Citibank is now part of Citigroup (C) following its merger with Travelers.

1 0

Re: Streams, Voice, and Sensitive Dependence
by Michael Motyka 17 Dec '03

17 Dec '03

> It is my understanding that the PGP algorithm is primarily intended > as a block cypher. Therefore, wouldn't an Outer Block stream cypher > be more effective for phone conversations? Both solutions require > hardware for a practical (tolerably noiseless) implementation, so > there's nothing to be gained by streaming data into a block format. > Unless you have a really fast ( 1 Mbit / s? ) data connection you're going to want to do some voice compression. The algorithms I've seen break the audio into discrete time frames and (de)compress frame by frame. As a point of reference say about 16 bytes for every 33 msec of voice. Quality roughly follows data rate, of course. This makes a block cipher seem not so unreasonable. Block cipher or stream cipher, either way you're going to have to introduce a latency of _at_least_ a couple of frames to allow for resends or deliberate out-of-order frame transmission. This makes the block cipher look like the better choice. I think that using HW voice compression and a 33.6 modem you could get a full duplex secure conversation over POTS with a latency in the 0.1 - 0.3 second range and a direct cost in the vicinity of $100. With a reasonably quick microP any encryption method could probably be done as SW. This is not a particularly difficult device to build. Any fine US citizens want to build some prototypes? Mike

2 1

RE: Wassenaar Statement
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text From: "Phillip Hallam-Baker" <hallam(a)ai.mit.edu> To: "Robert Hettinga" <rah(a)shipwright.com>, <dcsb(a)ai.mit.edu> Subject: RE: Wassenaar Statement Date: Fri, 4 Dec 1998 18:02:40 -0500 MIME-Version: 1.0 X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-MimeOLE: Produced By Microsoft MimeOLE V4.72.2106.4 Importance: Normal We have seen this type of press release before. Uncle Sam goes off to a conference and returns to state that the rest of the world has committed to its position - only to find out later that the rest of the world did not. Anyone remembe the time the crypto Tzar went off to the European Association (a non binding talking shop) and got a similar 'undertaking'. It is more likely that the Wassenaar statement reflects what went on at the meeting. But even then most countries in Europe have a democratic process in which decisions are made by elected representatives and not by beaureacrats at closed treaty negotiations. Just as the munitions acts under which the ITAR crypto regulations are purported to be made clearly do not provide the executive with the powers claimed, neither do most of the European enabling acts for COCOM. Nor in a parliamentary system is it quite so easy for the executive to perform Zimmerman type persecutions. If the same tactics had been used in the UK the Home secretary would have faced political consequences for the failure of the prosecution. The Matrix Churchill affair played a significant part in the collapse of the Major government in the UK. I doubt Straw would be keen on a repeat. The UK DTI proposals requiring GAK as a condition of CA licensing may appear to meet the Freeh objectives but since there is no proposal to make licensing a requirement of doing business the result is most likely to be nobody becomes a 'licensed CA'. There is a legitimate business need for key recovery but nobody offering those services is going to want access to the customer's private keys. Doing so would be akin to keeping triffids as pets. It is not necessary to keep actual private keys to achieve the objective of controlling access to the private keys. Phill --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: FC: So far, I think Mr. Aarons' Wassenaar statement is disinformation
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Fri, 4 Dec 1998 18:19:58 -0500 (EST) From: Peter F Cassidy <pcassidy(a)world.std.com> To: Robert Hettinga <rah(a)shipwright.com> Cc: dcsb(a)ai.mit.edu Subject: Re: FC: So far, I think Mr. Aarons' Wassenaar statement is disinformation Mime-Version: 1.0 Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: Peter F Cassidy <pcassidy(a)world.std.com> Friends, In e-mail exchanges with EC ministers and government ministers in W. European nations that I have had about Aarons one thing is consistent. All seemed to be shocked and dismayed at his ability to report out facts to the press in the US and to the Clinton Administration that have little to do with actual events. It would not surprise any of them if Aarons' unilaterally declared a 33 nation crypto-control agreement that was based entirely on his baroque misunderstanding of the facts. PFC On Fri, 4 Dec 1998, Robert Hettinga wrote: > > --- begin forwarded text > > > X-Sender: declan(a)mail.well.com > Date: Fri, 04 Dec 1998 15:29:29 -0500 > To: politech(a)vorlon.mit.edu > From: Declan McCullagh <declan(a)well.com> > Subject: FC: So far, I think Mr. Aarons' Wassenaar statement is > disinformation > Mime-Version: 1.0 > Sender: owner-politech(a)vorlon.mit.edu > Reply-To: declan(a)well.com > X-Loop: politech(a)vorlon.mit.edu > X-URL: Politech is at http://www.well.com/~declan/politech/ > > [John is basing his analysis below on what's been posted on the Wassenaar > site so far, and these kinds of documents aren't always put online > immediately. That said, if Ambassador Aaron is talking about the online > documents and John's analysis is correct, the Clinton administration is > going beyond mere spin: it is trying to deliberately deceive. --Declan] > > ********* > > Subject: So far, I think Mr. Aarons' Wassenaar statement is disinformation > > Date: Fri, 04 Dec 1998 10:55:00 -0800 > From: John Gilmore <gnu(a)toad.com> > > I have not found a single confirmation of the Aarons statement that > the 33 Wassenaar countries have agreed to change the exemption for > mass market crypto software. (The NY Times and Reuters stories both > quote Ambassador Aarons.) > > This lack of confirmation includes the Wassenaar Arrangement statement > itself, which merely says: > > The amendments to the lists included elimination of coverage of > commonly available civil telecommunications equipment as well > as the modernisation of encryption controls to keep pace with > developing technology and electronic commerce, while also being > mindful of security interests. > > http://www.wassenaar.org/docs/press_4.html > > The Wassenaar Arrangement works by consensus; any member can block the > adoption of any item merely by voting against it. The policy Aarons > announced is directly contradictory to the recently reaffirmed > government policies of Finland and Ireland. In addition, Canada and > Germany have recently stated strong pro-crypto positions (while > waffling on the particular issue of the treatment of PD and MM > software). > > The Wassenaar Arrangement also states: > > This arrangement will not be directed against > any state or group of states and will not impede > bona fide civil transactions. > > To the extent that there is any attempt in the Agreement to control > mass market or public domain crypto software, such a provision > would clearly contradict this limitation written into the Arrangement. > The Arrangement is for military goods -- not for civilian goods. > PGP and other civilian crypto tools are not military by any stretch > of the imagination. It's hard to imagine that all 33 countries would > ignore this obvious problem, especially when it was pointed out to them > by concerted lobbying over the last several months. > > I also note that none of the statements are clear about exactly what > is affected. PGP, SSH, SSLEAY, Linux IPSEC, and many other crypto > tools are "public domain" rather than "mass market" software. The > General Software Note (originally from COCOM, and adopted bodily by > Wassenaar when it was formed) exempted both "public domain" and "mass > market" software from all controls. > > Finally, a companion paper released from Wassenaar yesterday shows a > clear concern by the body for human rights and fundamental freedoms: > http://www.wassenaar.org/docs/criteria.html: > > e. Is there a clearly identifiable risk that the weapons might > be used for the violation and suppression of human rights and > fundamental freedoms? > > (In this case if the the Aarons statement was true, Wassenaar itself > would be used for the violation and suppression of human rights and > fundamental freedoms. It's hard to see that the delegates would also > ignore this and vote to suppress human rights and freedoms.) > > So, I see two major probabilities here: > > * Either Aarons is lying, to see how much trouble this stirs up. > This would be taking a page from FBI Director Freeh, who > announced FBI support for domestic controls on crypto last year, > and was then disavowed by the Administration when a ruckus > resulted. > > * Or the NSA has cut a deal with these countries. Then the > question is: what did NSA offer in return? The usual trade > has been access to the flow of wiretaps (as in the UKUSA > agreement that gives Britain, NZ, Australia, and Canada access > to Echelon -- look who the strongest supporters of the US position > are). Another alternative is that they used wiretaps to > blackmail senior politicians in the recalcitrant countries. > (It happened in the US by J. Edgar Hoover for many years.) > > Do either of you have any info that would tend to confirm or deny > one of these theories? > > EFF and the GILC members are checking with various governments to > start to flesh out what *actually* happened. > > I should also note that developments like this are rather expectable. > Every time crypto policies get decided in a closed-door meeting where > the US government is invited, they get worse. Whenever crypto > policies are set in open meetings where the public and the press are > able to watch -- or even, god forbid, participate -- they get better. > The OECD meetings of a few years ago were intended to be the first, > but citizens and journalists swarmed the meeting site, buttonholed > delegates as they entered and left, and turned it into the second. We > should've done the same with this Wassenaar meeting. > > US civil libertarians are prying crypto policy decisions into the > light of day via the courts and the Freedom of Information Act. > Classified NSA/FBI testimony to Congress is getting declassified, and > then its obvious lies are easily rebutted by the public. > > The natural response of a bureacracy that is more concerned with its > own power to wiretap, than with making the right decisions for its > citizens, is to move its crypto maneuvering overseas into "diplomatic > meetings", held under cover of diplomatic secrecy, where they can lie > and twist arms with impunity. > > John > > > -------------------------------------------------------------------------- > POLITECH -- the moderated mailing list of politics and technology > To subscribe: send a message to majordomo(a)vorlon.mit.edu with this text: > subscribe politech > More information is at http://www.well.com/~declan/politech/ > -------------------------------------------------------------------------- > > --- end forwarded text > > > ----------------- > Robert A. Hettinga <mailto: rah(a)philodox.com> > Philodox Financial Technology Evangelism <http://www.philodox.com/> > 44 Farquhar Street, Boston, MA 02131 USA > "... however it may deserve respect for its usefulness and antiquity, > [predicting the end of the world] has not been found agreeable to > experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' > > For help on using this list (especially unsubscribing), send a message to > "dcsb-request(a)ai.mit.edu" with one line of text: "help". > For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)ai.mit.edu" with one line of text: "help". --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

PGP Disk
by Mixmaster 17 Dec '03

17 Dec '03

Has anyone had the chance to try out the new McAfee PGP disk? It seems pretty straightforward, allowing for the creation of encrypted "drives" using the CAST algorithm. Is anyone aware of any security flaws with it?

1 0

Re: y2k/gary north delusions (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Fri, 04 Dec 1998 20:22:18 -0500 > From: Michal Hohensee <mah248(a)nyu.edu> > Subject: Re: y2k/gary north delusions > You cannot sustain a modern city without a working sewer system. > Remember what cities were like in the middle ages? I believe some > historians refer to them as "population sinks" for the surrounding > countryside. Not for a lack of wealth or commerce, but for a lack of > sanitation. Paris and London had populations of over a million each and didn't have a sewer system. It was traditional for people to throw their chamber pots out into the street along with the offal from the various animals. The reality is that the folks who support the various systems would have them no manual over-ride within 24 - 48 hours so the worst case scenario won't happen. Countries that aren't automated won't notice the difference and the city services that are won't be down more than a week. ____________________________________________________________________ Technology cannot make us other than what we are. James P. Hogan The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

2 1

Re: y2k/gary north delusions (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Subject: Re: y2k/gary north delusions > Date: Fri, 4 Dec 1998 17:40:59 -0600 (CST) > From: ichudov(a)algebra.com (Igor Chudov @ home) > Well... The answer is that there is much less washing needed for > survival than it is needed for day to day civilized American life. True, you don't have to water your grass and wash your car. > For instance, I change my shirts every day. If shit hits the fan, > you can wear a shirt for two weeks. Similar story is with other > clothes. You won't do that sort of stuff for long. A couple of months at best before you get skin infections and then it's down-hill from there. It's pretty much a bogus point though since none of the systems like power, water, and sewer won't be down more than a week at most. ____________________________________________________________________ Technology cannot make us other than what we are. James P. Hogan The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Re: y2k/gary north delusions (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Subject: Re: y2k/gary north delusions (fwd) > Date: Fri, 4 Dec 1998 18:46:17 -0600 (CST) > From: ichudov(a)Algebra.Com (Igor Chudov @ home) > > Paris and London had populations of over a million each and didn't have a > > sewer system. It was traditional for people to throw their chamber pots out > > into the street along with the offal from the various animals. > > Guess why they had those devastating epidemics. True enough, but that sort of stuff takes more than a week or two. The various cities could go around setting up port-a-potties and latrines in parks with plastic liners for easy removal, etc. It isn't nearly the civilization shaking event some would make of it. ____________________________________________________________________ Technology cannot make us other than what we are. James P. Hogan The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

3 2

.
by Anonymous 17 Dec '03

17 Dec '03

... > A few rules of thumb result from even cursory examination > of the likely environment: > ... > 5. Ultimately, the only way the remailers will provide > what might be described as Pretty Good Security will > be when we have software that maintains a regular > or random rate of messages to and from the remailer > cloud, a stream into which the meaningful messages > can be inserted with no visible change in traffic. > Until then, the best we can do is try to keep traffic > levels up, and to send and receive frequently enough > to frustrate end-to-end traffic analysis. Well, the existing remailer net doesn't make "Pretty Good" anonymity very feasible. I'd think something based on the general idea behind Crowds. (Furthermore, most remailer structures still can't erase some other security concerns -- 1: remailers acutally can be hacked or physically compromised 2: clients really can be screwed 3: etc. To help solve the first, you'd want a two-box setup doing remailing, with the security-critical stuff loaded on a box not directly connected to the Net with something 140-1ish to make tampering harder, a secure OS, etc. -- or, of course, you can scrap all that to get really big remailer count. To help solve the second problem, there needs to be a better web-of-trust setup -- that is, one which applies to code as well as keys. Those who wish to verify code get a .sig-verifying program from a trusted source then use a WoT to authenticate various facets of the program necessary for security. A solution to the third problem is expected RSN.) > > 6. Don't send anything that can have grave consequences. Remember the consequences to an adversary who uses its secret decoder ring, though: the more plausible it becomes that a certain source is being used for intelligence-gathering, the more likely it is that that source will promptly begin to run dry as the spied-upon realize that Something Got Broke. My advice, however, agrees with that of the other Anonymous. That is, unless you've really thought things out, think of an remailed message as merely .sigless, not anonymous. > > 7. Take names. Always take names. Some day... > > FUDBusterMonger > > It Ain't FUD til I SAY it's FUD!

2 1

the shit hitting the fan
by Anonymous 17 Dec '03

17 Dec '03

At 02:48 PM 12/4/98 -0600, Igor Chudov @ home wrote: >Even flushing toilets is not necessary as anyone can shit outside. > >I am speaking out of personal experiences, living with water outages >while we were in the Russian countryside. It was no big deal, period. Moron. At a low population density you can do anything, burn wood, leaded gas, etc., no problem. LA has 1e7 people who shit about a kilo per day. Compute the volume of that after a week.

2 1

PGP Disk
by Anonymous 17 Dec '03

17 Dec '03

>Has anyone had the chance to try out the new McAfee PGP disk? >It seems pretty straightforward, allowing for the creation of >encrypted "drives" using the CAST algorithm. Is anyone aware of >any security flaws with it? I'm sure somebody will check if they are bored some day. Where can we find the source code? If the source code isn't available, don't trust it. That's a good general rule.

1 0

What was the quid pro quo for Wassenaar countries?
by John Gilmore 17 Dec '03

17 Dec '03

I spoke some hours ago with Tatu Ylonen in Finland. His company has confirmation from the Finnish government that the government agreed to a proposal to limit mass-market crypto exports to 56 bits. Perhaps he or someone else from SSH can post more details. So *something* really did happen at the Wassenaar meeting, but we don't know two important things: * What exactly did they agree to? In particular, is public domain -- as opposed to mass market -- crypto controlled? * And what did NSA offer, to convince many countries to directly contradict policies that they had arrived at during year-long public consultations with their own citizens? A carrot? A stick? Blackmail from wiretaps? Access to NSA's wiretap network in return for cooperation? What was the strong motivation for so many countries to go against their own economic and self-determination interests? It was pointed out to me that the Wassenaar Arrangement has no legal effect. Each country has to go back and amend its own local controls. However, I personally saw cases more than a year ago where both Japan and Belgium were restricting bona fide civilian crypto transactions "because Wassenaar requires us to" when in fact it didn't. This development will give these countries much more "cover" to implement draconian policies, under secret arm-twisting from the US. We will have to fight this one in the trenches, in each country. First step is to raise a hue and cry and put each government on the defensive (as they well ought to be). Then let's find out what "deal" they made with the devil. Finally let's see whether, as Perry says, civil rights and political processes work, and the will of the people will actually end up codified in the laws of each country. Or not. John PS: I particularly like Ambassador Aaron's characterization that this new development will help US industry, by censoring foreign crypto publishers in the same way the US government censors US publishers. A giant step forward for freedom and commerce everywhere, eh Mr. Aaron? What an incredibly talented liar, I mean diplomat, he is.

8 9

Re: Vengeance Libertarianism
by Michael Motyka 17 Dec '03

17 Dec '03

My oh my, The alternative to outright revolution has historically been to pack up and ship out to whatever frontier was in vogue. Dangerous, difficult, but apparently compelling if the home situation sucked badly enough. Potentially very rewarding to the survivors. The historical fate of any frontier has been that as soon as it has become somewat hospitable the shitheads arrive with their carpet bags and make it over into the same fucking thing that everyone ran away from in the first place. The first sign of inFESTERation was often a church, followed by a town hall which filled up quickly enough and shortly thereafter hired a sheriff to enforce the town gun ban and who eventually needed more men... And so the cycle repeats with the virtual frontier we're in right now. It was just fine until "they" came along to "civilize" it. Unfortunately backs are to the wall and there is nowhere else to go because SPACE SUCKS MOOSE ALIENS DRY LIKE BUGS. Top that. they - esRb to civilize - to own, regulate, commercialize and tax esRb - evil, scumsucking, Reptilian bastards I could probably develop some sort of virtual space cowboy allegory here that would go on for (p)ages and involve the painful, bloody death of many an evil villian at the hand of a courageous hero and enough deviant sex ( whinny ) to keep the audience enthralled to the very end. The story could probably be continued until well after the traffic has subsided but what the hell, I like driving 5 mph, it's good for my car's engine, my patience and the bandwidth shortage. m

1 0

Re: Streams, Voice, and Sensitive Dependence
by Michael Motyka 17 Dec '03

17 Dec '03

> http://www.starium.com > 14.4 modem, awsome sound quality, 2048 bit DH, 3DES. The web site is pretty sparse. No wonder I couldn't find them before - I was looking for "Starion" a while back. I'll call them next week - they're practically local. What's the approximate price? I have another question for you: I thought I was a real whiz kid a few years back when I figured out that by using an agreed upon startup key then using a "random" public/private key pair generated by the SW, two voice stations could exchange a "random" session key. With thumbscrews and the rack you could not get the session key. Even the dreaded rubber hose would fail. The startup key protected the PK. The ultimate security was as good as the PK portion. The conversation was practically pre-shredded. I was bummed when I discovered this had already been patented and was called EKE. Does the Starium phone accomplish this effect? Mike

3 2

Re: y2k/gary north delusions (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Subject: Re: y2k/gary north delusions (fwd) > Date: Fri, 4 Dec 1998 19:21:36 -0600 (CST) > From: ichudov(a)Algebra.Com (Igor Chudov @ home) > > True enough, but that sort of stuff takes more than a week or two. The > > various cities could go around setting up port-a-potties and latrines in > > parks with plastic liners for easy removal, etc. > > > > It isn't nearly the civilization shaking event some would make of it. > > Well, at least shitting is not going to be the hardest part of it. True enough. Power, water, police, fire, etc. will come back pretty quickly if anyone notices it was ever down. The really poor won't notice anything. The most effected would be the wealthy. There will be outbreaks in Compton and similar ilk but by no stretch of the imagination will it become a conflagration. That's the beauty of an armed populace. Even if the police don't respond it'll burn out as the front of rioters thin with increasing radius and the odds go down. I'd bet the delivery of foodstuffs to the store wouldn't slow down one bit. It's possible to run a combine without the GPS. The trucks are driven by people, they're loaded by fork-lifts. And you'll need to hunt long and hard for a commercial freezer with a clock in it. I've never seen a damn that didn't have manual gate controls so flood control and hydro-electric will come back pretty quickly. The actual switch control panel in power plants have manual over-rides everywhere. Ditto for electric power grids. Mass transportation like trains and aircraft will be effected. Individual transportation like cars won't stop. Inconvenient and expensive, you betcha. The decline of western civilization, not hardly. ____________________________________________________________________ Technology cannot make us other than what we are. James P. Hogan The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

2 1

the shit hitting the fan (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sat, 5 Dec 1998 06:00:13 +0100 > From: Anonymous <nobody(a)replay.com> > Subject: the shit hitting the fan > At 02:48 PM 12/4/98 -0600, Igor Chudov @ home wrote: > >Even flushing toilets is not necessary as anyone can shit outside. > > > >I am speaking out of personal experiences, living with water outages > >while we were in the Russian countryside. It was no big deal, period. > > Moron. At a low population density you can do anything, burn wood, leaded > gas, > etc., no problem. > > LA has 1e7 people who shit about a kilo per day. Compute the volume of that > after a week. It's not the raw volume that's critical but rather the percentage of the average personal space per inhabitant versus how much to store a weeks worth. For the average person storing a weeks worth of solid waste in a platic bag with bleach, lye, or similar material is reasonable. I've gone on long duration camping trips of about a weeks length and the storing and portage costs are not excessive (having a boat or horse helps move it around). ____________________________________________________________________ Technology cannot make us other than what we are. James P. Hogan The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

2 1

pgp disk
by Anonymous 17 Dec '03

17 Dec '03

At 03:05 AM 12/5/98 +0100, Anonymous wrote about some new product: >If the source code isn't available, don't trust it. That's a good general >rule. Where is the source for pgpfone?

1 0

RE: What was the quid pro quo for Wassenaar countries?
by Phillip Hallam-Baker 17 Dec '03

17 Dec '03

John Gilmore may be right, but remember folks that in Europe we have this thing the Greeks invented called democracy. One of the ideas of democracy is that decisions are not made in secret closed meetings. The interpretation of the US ambassador appears to be based on the assumption that the governmental proceedures of democratic countries are like those of his home country. In fact European governments cannot make law simply by telling the national police force to arrest folk who engage in particular behaviour. The system of checks and balances may be described in the US constitution but it is entrenched in the European polity. The UK does not have a national police force precisely to stop Hooverism. Even directives of the European Commission do not have legal force until the national parliaments enact legislation to implement the directive. One should also remember that the government of the Netherlands has agreed to control the sale and use of narcotics. If their efforts to control cryptography are as dilligent we have nothing to worry about. In addition under the single European act the entire country of Europe is one export zone for crypto control purposes. I fail to see that stopping Brits from exporting crypto to the US changes the equation a great deal. There once was an English king called Canute who attempted to demonstrate to his courtiers that he was fallible and could not order the tide to turn. Perhaps Clinton's courtiers need to learn that they suffer the same limmitation. Phill

3 2

Fwd: Attn. INTERNATIONAL FIREARM COMMUNITY !
by Jean-Francois Avon 17 Dec '03

17 Dec '03

==================BEGIN FORWARDED MESSAGE================== >Date: Fri, 04 Dec 1998 22:35:56 -0800 >From: Donna Ferolie <donnaferolie(a)sympatico.ca> >Subject: Attn. INTERNATIONAL FIREARM COMMUNITY ! This message has gone out to firearm owners all over the world as well on the cdn-firearm chat and cdn-firearm digest. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ATTENTION INTERNATIONAL FIREARM COMMUNITY This message is specifically dedicated to sport shooters from around the globe. I would like to acknowledge our friends from the U.K, South Africa, Brazil, New Zealand, Australia and the good old U.S.A. I have just sent out idividual messages to all of these countries and some others including Germany, Belgium, Austria, Boliva, Argentina, Aruba Slovakia and Barbados. If your country has not been listed please contact me directly. I am trying to develop a list of countries that are logging onto our open firearms chat line. It is my goal to have firearm owners from every country monitoring and sharing their experiences. Please encourage fellow shooters in your country to come on line and take advantage of this open forum. I fully realize that the primary focus of the Canadian Firearms Chat Line is aimed at Canadian gun laws; however, there is a great deal of pertinent international information that could be shared in this medium and we will all be the beneficiaries if we willfully share our ideas and experiences. I have another strategy up my sleeve regarding rallying the international firearm community prior to the final outcome of the United Nations firearms workshops in the year 2000; therefore it is paramount that we maintain frequent global communications. I will be exploring some of my ideas with the NRA and the Sporting Shooters Association of Australia in the new year and floating some draft strategies for open discussion. Moreover, I fully intend on attending most of the United Nations firearm workshops therefore having everyone connected to one open forum would assist me in getting this information out all of you in a quick concise manner. I've had a few myopic individuals ask me why I should be so concerned about gun control in other countries ? As far as I am concerned we should all be concerned -VERY concerned ! When one of our sister countries falls we should all feel their pain and learn something valuable, because we may be next. We cannot for a minute forget about the draconian laws rammed down the throats of other Commonwealth countries in particular or any free-thinking society. Can we really delude ourselves into thinking that it couldn't happen here- don t kid yourself, as I write, the erosion of our rights is going down the same path as Australians are treading, faster than we care to admit, and we all should instinctively know it? How would Canadians like to have all of their semis and pump shotguns and rifles declared illegal and confiscated overnight by a communist-leaning, bleeding heart liberal government- think about it !! It is important for Canadians to realize that countries all over the world feel no different that we do. They feel just as vulnerable and thus are seeking guidance and support. We are in an excellent position to offer assistance to each other via this open forum. I truly believe we can learn from each others mistakes and triumphs. Perhaps if we can tap into this universal intelligence on a continuous basis we could overtake the mighty Goliath. If time permits I would like to post the names of all anti-firearm NGO's and their meetings which are going on simultaneously all over the world as we speak. I think it is high time that we banded together as one solid global unit in an effort to effectively launch a counter attack against those that take glee in the gradual erosion of our civil rights and liberties. A frequent complaint about this type of forum is the problem of receiving an excessive number of messages, but I believe the rewards associated with this hassle far out weigh the inconvenience. I care very much that our friends in South Africa are now subject to new guns laws. I am sickened by what has transpired in Australia and the U.K. I want the world to know how crime has escalated in Brazil and yet they live under the most stringent gun control laws. As a point of interest the " boys from Brazil " will be preparing a written paper outlining this very fact which I will present on their behalf to the anti-gun Brazilian delegation at the next U.N workshop in Vienna in the latter part of Jan/99. In conclusion, if you are interested in banding together as one strong universal voice, then get your friends connected to this open chat /and or digest. Let us not lose focus of our own battle at home, but let us not turn a blind eye to our global neighbours struggles. I understand that English is a problem for some of you, but we are understanding and we willing to work through any language barriers. So please do NOT feel uncomfortable to communicate with us - we d love to hear what has transpired in your country ! Remember, repeated blows to the lower extremities will eventually cause the giant to fall ! You can subscribe to the Canadian Firearms Digest and the Firearms Chat line by 1) Subcribe to the cdn chat & cdn digest ( separately ) 2) e-mailing the following address for both chat & digest: <majordomo(a)sfn.saskatoon.sk.ca> 3) Leave the subject section blank 4) Write in the body of the message subscribe cdn-firearm chat end subcribe cdn-firearm digest end Remember when you are subscribing to the chat is separate from the digest. Please feel free to contact me anytime at the following: donnaferolie(a)sympatico.ca Donna Ferolie Keep up the fight! Donna Ferolie Canada ===================END FORWARDED MESSAGE===================

1 0

Re: Netsurfer Digest: Vol. 04, #35
by Robert Hettinga 17 Dec '03

17 Dec '03

At 4:14 AM -0500 on 12/5/98, editor-bounce(a)netsurf.com wrote: > Secret Netsurfing... for a Fee > > You meet such nice people in this job. People like Cyber Promotions, who >believe the way to a great Web site is not content, originality, or >design, but an "aggressive marketing campaign every week" - it sells spam. >For a fee, Cyber Promotions will send out up to 50,000 messages at a time >through untraceable remailers and silent servers. This delightful >organization also bring us - as expected, for a fee - Ultimate Anonymity, >under the guise of the old-style anonymity sites which campaigned to the >death against censorship and government interference (remember Penet?). >Anyone with $14 can use this site to post anonymously in newsgroups, send >unlimited quantities of untraceable e-mail (with attachments), and >generally pollute the bandwidth. There may be genuine privacy campaigners >using the site, if they can squeeze in between all the amateur porn >merchants.... <http://www.ultimate-anonymity.com/> >http://www.ultimate-anonymity.com/ ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Greg Taylor: preliminary Wassenaar details from three countries
by John Gilmore 17 Dec '03

17 Dec '03

[Greg graciously allowed me to repost this. --gnu] Date: Sat, 05 Dec 1998 15:22:53 +1000 From: Greg Taylor <gtaylor(a)efa.org.au> Hi John, You wrote: >I have not found a single confirmation of the Aarons statement that >the 33 Wassenaar countries have agreed to change the exemption for >mass market crypto software. (The NY Times and Reuters stories both >quote Ambassador Aarons.) I think Aarons must have an advanced degree in spin doctoring, but nevertheless information about new restrictions on mass market software has also come from 3 independent well-placed sources. >From the UK crypto list: ================= Just talked to Dirk Weicke, Senior Adviser to Wassenaar Organisation. Tel:+43 1 516360) No written details will be issued until next week, but gist is: *) No alteration to question of whether Wassenaar covers intangible exports. Up to signatory states to interpret and legislate. *) mass-market software, symmetric key length limited to 56-bits *) software generally available, but with other restrictive tests on end-user re-configurability, symmetric key length limited to 64-bits *) Assymetric key lengths (not sure how relates to above) limited to: RSA & Digital logarithm: 512 bits Elliptic curve : 112 bits ===================== And here's a view from David Jones (EFC), from the GILC list: ===================== - There is "some relaxation" for restrictions on symmetric methods using key lengths of 56 bits or less. Stronger crypto would require an export license. - There is no restriction on mass-market software using symmetric methods and a key length of 64 bits or less. Stronger mass-market crypto would require an export license. - "Public Domain Software is not restricted" [If this is really true, this is still an important loophole.] - There is not yet any clear information about the status of "intangible goods", like crypto software on a web site, or sent by email, as opposed to "tangible goods", like software on a floppy disk or CD-ROM. - The restrictions on mass-market software greater than 64 bits is "for public safety" reasons and will last for 2 years, after which it will be reviewed. ============================= Yesterday I got the Australian government interpretation from Robbie Costmeyer in Canberra. Costmeyer is the Defence bureaucrat responsible for approving export licenses. I was told that Wassenaar had now agreed that the General Software Note waiver no longer applied to Category 5/2 items (i.e. crypto) on the controlled goods list. It has always been the view of Defence Signals Directorate here that it was an oversight that crypto software came under the GSN. That reason was used to justify Australia's going one step further than required under the original Wassenaar Arrangement and disallowing exemptions to the export licensing rules. A few other countries do the same (USA, New Zealand, France, Russia). Canberra thus views the latest change as the correction of an oversight. Clearly there is a difference of interpretation here regarding public domain software (compare the Canadian view above). This question needs further investigation. The Australian view is that the latest Wassenaar changes are a relaxation of the previous rules. And they're right, when compared with the previous rules applying here. Australia will now move to amend the Defence Strategic Goods List (DSGL) to allow exemptions for small key lengths as decribed above. For other countries, the effects remain to be seen. We'll just have to wait for more information to filter out. Greg

1 0

FREE WEEK XXX PORN SEX http://i.am/dupri
by Thomas Dupri 17 Dec '03

17 Dec '03

PORN AT IT'S FINEST! YOUR SEARCH IS OVER! CLICK NOW FOR A FREE FREE FREE LIMITED TIME OFFER! ONE WEEK FREE! HURRY! http://i.am/dupri http://i.am/dupri

1 0

ZDNet and ZDTV Forums Update
by ZDNet Announce 17 Dec '03

17 Dec '03

++++++++++++++++++++++++++++++++++++++++++++++++++++++ This is the second message from ZD to all the members of our message boards. It contains information and tips about a coming transition to new software. You will receive just one or two more of these messages in the coming week. ++++++++++++++++++++++++++++++++++++++++++++++++++++++ When you go to the ZDNet or ZDTV forums on Tuesday, Dec. 8, you will find the new Deja News software in place. You will see some differences in the way the message boards operate, so you may need to experiment a little. If you are very familiar with our current forum features, it will take some time to become comfortable with the new system. We apologize for the inconvenience this causes and are trying to make the switch as painless as possible. We'll have dozens of sysops online answering your questions every day. We also will update the on-line help files frequently to highlight key differences between the current software, called Podium, and the new version. Below are some advance hints for everyone making the switch to Deja News. You can try these features out in now our Test Forum at http://f5.dejanews.com/frames/test.html ** Messages that you have not yet read appear in bold. ** That's how Deja News tells you which posts are new since you last visited. Once you open and read a message, the bolding goes away. You have the option to Mark Thread As Read, and an entire set of messages will lose their boldness. In addition, you can Mark All As Read, and every message in that forum will become un-bold. ** When you leave a forum and come back later, messages that you read previously are not displayed. ** You can see these already-read messages by clicking the Show All button. Here's the tricky part: If you read all the messages in a thread and then someone adds another, the entire thread will be displayed and most messages will not be bold. Just the new message that you have not yet read will appear with bolded text. (In our current message board software, messages that you had already read remain hidden when a new message is added.) ** On Tuesday, some messages that you have read will be marked as unread. ** We will migrate all the messages currently in Podium over to the new Deja News software. However, we cannot keep track of which messages every user has read. As a result, all messages will be marked initially as unread. You can easily take care of this by doing one of two things: 1) Use the Mark All As Read found at the top of the new message board. This approach is fastest, but it might make you overlook some messages you really do want to read. 2) Use the Mark Thread As Read text link found at the beginning of each thread. This approach is a more selective way to get up-to-date, but it takes a bit more time. ** You can Expand or Collapse the entire thread list. ** The thread list shows all the individual "conversations" happening in the message board. The default setting shows you just the starting topic in each thread. If you want to see a detailed list of all the replies to that initial message, just click the Expand button. To shrink your threads list again, click the Collapse button. Collapse and Expand are basically toggle buttons. Show All and Show Unread are also toggle buttons, and they oper- ated independently of the Collapse and Expand controls. ** Your browser's reload button works in the forums. ** In Podium, when you hit reload in your browser, your forum display settings would disappear. In the upcoming Deja News software, your settings are preserved. So go ahead and hit reload to see if new messages have been added while you are online -- it works! ** Give Search a try. ** The Deja News fast search capability will help you track down messages easily. You can look across all the forums or in just one, for any text in a message. If you choose Mark All As Read but want to locate an earlier message, use the Search function. Thanks for taking the time to read this note. I hope these tips give you some insight into the new software and make the switch smoother. We're adding user-suggested info to our help file with the launch of the new forums next week, so keep those comments and ideas coming! We look forward to seeing you in the new forums, and we are glad to have you as a part of the ZD Community. Wendy Frankwich ZD Community Central http://chkpt.zdnet.com/chkpt/zdn11204/www.zdnet.com http://chkpt.zdnet.com/chkpt/zdn11204/www.zdtv.com _______________________________________________________________________ To be removed from this list, simply reply to this message with "unsubscribe" as your subject.

1 0

[Fwd: y2k/gary north delusions]
by Soren 17 Dec '03

17 Dec '03

To: Igor Chudov <ichudov(a)algebra.com> Subject: Re: y2k/gary north delusions From: Soren <sorens(a)workmail.com> Date: Sat, 05 Dec 1998 08:29:23 -0500 References: <199812042341.RAA18742(a)manifold.algebra.com> Igor Chudov @ home wrote: > > > Well... The answer is that there is much less washing needed for > survival than it is needed for day to day civilized American life. > > For instance, I change my shirts every day. If shit hits the fan, > you can wear a shirt for two weeks. Similar story is with other > clothes. This is a good one. What about the other half of American life (the uncivilized?). You know, the americans who live in those old refrigerator cartons? The ones that nobody sees? I think they get more than 2 weeks out of their shirts. The sad fact is that city brats haven't got the faintest idea what survival is all about (you mean I have to *walk* to the supermarket?). It was in the 1890's when Queen Victoria issued an edict that forced all the english to 'bathe at least once a year'. Sit back and enjoy the carnival.

1 0

Re: What was the quid pro quo for Wassenaar countries?
by HyperReal-Anon 17 Dec '03

17 Dec '03

"Phillip Hallam-Baker" <hallam(a)ai.mit.edu> writes John Gilmore may be right, but remember folks that in Europe we have this thing the Greeks invented called democracy. One of the ideas of democracy is that decisions are not made in secret closed meetings. Yes, and people democratically demand government enforcement of the majority will, something made more difficult if the subjects have strong cryptography. As Donn Parker observed several years ago, strong cryptography is inconsistent with democracy. (Published in Scientific American --- reference on request.) John Gilmore <gnu(a)toad.com> writes Some countries actually seem to care what their citizens think about their crypto laws, unlike the shining example of democracy, the USSA. And when we educate the citizens, they tend to make the right choices. Let's keep trying. But don't educate them too much, or they will understand that cryptography can set people free, and if people were free there would be no political government, and if there were no political government their social security checks would stop coming, along with all their other government ``benefits''.

1 0

a strategy
by bill payne 17 Dec '03

17 Dec '03

I just read the most recent AFTER MONTHS of nothing happening. http://jya.com/a6e.htm Love it. Can you possibly get suspected terrorists on your landlord's case?

1 0

Frequent Asked Questions Re: $9.99 to build your own
by promo124＠hotmail.com 17 Dec '03

17 Dec '03

(FAQ) Frequent Asked Questions --CABLE TV DESCRAMBLER (do not hit the reply button, this message is generated automatically for those interested in the product. You'll receive this message only once) Hello!!! =) "Thank you for requesting more information about the Cable Television Descrambler. I've been asked so many good questions that I left unanswered in my first letter. For that reason, I have put together this Question & Answer letter. I apologize in advance for not being able to answer each of your questions personally. The response has been overwhelming. " Q: Will the descrambler on Fiber, TCI, Jarrod and satellite systems? A: The answer is YES. In respect to satellite, you just get MORE stuff! Q: Do I need a converter box? A: This plan works with or without a converter box. Specific instructions are included in my plans for each! Q: Where can I find the 75pf-100pf variable capacitor, Radio Shack doesnt have it? A: Many Radio Shacks do have it. However, you have two other options. 1st call a radio speciality supply store in your area that is listed in the yellow pages. 2nd you can order the capacitor from me. If needed I will mail you as many as you need for the price (s) below. Im not trying to make a profit out of it, just want to help you. Ill wrap it carefully and send it to you only if you send me a self addressed #10 size padded envelope, with 64c postage affixed. 1-10 75pf - 100pf variable capacitor $12.99 ea. 20-Up ................ $ 10 ea. Q: Can the cable company detect that I have the box? A: No, the signal descrambles right at the box and does not move back through the line. Q: Do I have to alter my existing cable system, television or VCR? A: The answer is no. Q: Does this work with my remote control? A: The answer is no. It's a manual kind of thing... but very easy. Have your spouse or significant other get off the couch to do the deed! Q: Can you email me the plans? A: No, the plans come with an easy to follow picture guide. Q: Does this work everywhere across the country? A: I have friends in four states and one in England and Brasil that use the same parts and the same plans and they are all successful. Q: Is this deal guaranteed? A: Yes, if you are unhappy for any reason I will refund your money. Q: Is this a rip off or a scam? A: No, if it were Id charge $50.00 or more for the plans. Be sure I not going to damn myself to hell by ripping you off for a measly $9.99 or so. Q: When I order, when will I get my stuff? A: I mail out all orders within 24 hours of receiving it... IF YOU SUPPLY A SELF ADDRESSED, STAMPED RETURN ENVELOPE WITH 55 CENTS POSTAGE AFFIXED. Q: Again, How much does it cost to get the instructions plans and the easy to follow diagrams? A:To order a set of the instructions send $9.99 by cash, check or money order payable to: RMS Enterprises Send to: 50 Lexington Ave, Suite 209 / New York City, NY 10010. Q: Can you give me a list of the parts again? A: Yes. 1 - Radio Shack mini box (part #270-235) 1 - Œ watt resistor 2.2K - 2.4K ohm (part #271-1325) 1- 75pf-100pf variable capacitor (special order) 2 - F61a chassis-type connectors (part #278-212) 12" no. 12 solid copper wire 12" RG59 coaxial cable Q: I lost your address, could you give it to me again. A: 50 Lexington Ave, Suite 209 / New York City, NY 10010 USA Q: How can I pay for this? A: Check, Money Order or Cash. Sorry, no credit cards accepted. I look forward to your order. Raul Mendez Enterprises (RMS Enterprises) Kindest Personal Regards, Raul Mendez

1 0

..
by Anonymous 17 Dec '03

17 Dec '03

> > (Furthermore, most remailer structures still can't erase some other security > > concerns -- > > 1: remailers acutally can be hacked or physically compromised > > 2: clients really can be screwed > > 3: etc. > > > > To help solve the first, you'd want a two-box setup doing remailing, with the > > security-critical stuff loaded on a box not directly connected to the Net with > > something 140-1ish to make tampering harder, a secure OS, etc. -- or, of > > course, you can scrap all that to get really big remailer count. > > As long as you do not see the box and do not control its manufacture, > I see no reason why you should have ny more trust in it. Well, you shouldn't have complete trust -- a tamper-resistant net could be compromised, too -- but there's a good reason to have more trust in it than in the existing one. More on that after a parenthetical remark. (This brings up the "hardware web-of-trust" issue; you can set up such a web with trusted spot-checkers and statistical/cryptographic means of assuring the user that the box works as advertised, if your threat model demands it. There's more about it in the "Beyond Class (A1)" section of the Orange Book, although the section's use to Cypherpunk types is limited because it's written without any thought to, say, doing things cheaply or having a decentralized setup.) The tamper-resistance simply means that if the mailer was set up secure, it's not going to become compromised. Instead of having to trust that one of the remailer operators is currently honest and has always done all the necessary homework to ensure the system was safe, you have to trust that this entity was honest and diligent when the remailer was set up (unless, of course, you think the tamper-resistance was circumvented); if the operator is bribed after the remailer's set up and the public key is published, there's no way to suddenly and invisibly make messages traceable, as there is in a "normal" Mixmaster remailer. (This is because, given the normal assumptions about crypto strength, it takes the remailer's private key to process a Mixmaster-like packet and that key is generated by and stays within the tamper-resistant box) My predictions about the biggest attacks on a tamper-resistant remailer net: 1: traffic analysis. Until the net structure is overhauled, this will always be possible. 2: propagation and exploitation of faulty server software. Related to the whole web-of-trust issue. 3: direct attacks on specific clients. Again, no web of trust. 4: creation of bad remailers and attempts to shut down good ones. More messages could be traced in a world with 6 good and 47 bad remailers than in one with 9 good and 3 bad. 5: direct attacks on new remailers 6: attempts to make an operator feign a catastrophe and set up a new, compromised remailer. Users, however, would know that the new key not signed by an old one means that they must now trust that the remailer was not compromised before the publication of the new key. 7: attacks on tamper resistance ... n: attacks on crypto n+1: etc.

1 0

pgp disk
by HyperReal-Anon 17 Dec '03

17 Dec '03

>At 03:05 AM 12/5/98 +0100, Anonymous wrote about some new product: >>If the source code isn't available, don't trust it. That's a good general >>rule. > > >Where is the source for pgpfone? Good question. That's why I wouldn't use it either. (I haven't had reason to use it, so 'll take Anonymous's word that source isn't available.) If people want to release software like this, they need a better argument for its security than "Trust us, it's secure." Considering that there is no net loss when developers of such a product release source code so that people can look it over and compile it themselves, I don't have any reason to trust such software. Aren't McAfee and PGP Inc. members of KRAP and promoting Big Brother Inside? I've lost track.

4 3

No Subject
by Anonymous 17 Dec '03

17 Dec '03

Sorry for all the questions but I've been away from crypto for a while and I'm looking for the best encryption program for exchanging email between Unix and Windows folks. I hope these questions are appropriate here. What do people generally think about S/MIME ? Is it well designed (strong and extendable) ? Is it convenient because its available in the popular email clients ? Is the most annoying thing about it that you have to pay for the keys ? Is there a way to self-sign keys ? SSLeay ? Are most people still using PGP ? If IDEA and MD5 (and PGP2.6.2) are not strong enough anymore, what are the Unix folks using ? Does the source for PGP5/6 compile to any target besides Windoze ? Thanks

1 0

(fwd) Markus Kuhn on eternity
by Adam Back 17 Dec '03

17 Dec '03

Markus Kuhn (on ukcrypto) discussing his PhD project: the design of an eternity file system with a distributed administration function system controlled via a cryptographically enforced digital constitution. Comments to follow. Adam ====================================================================== To: ukcrypto(a)maillist.ox.ac.uk Subject: Re: intangible definitions are hard to pin down Date: Thu, 19 Nov 1998 16:28:21 +0000 From: Markus Kuhn <Markus.Kuhn(a)cl.cam.ac.uk> Ben Laurie wrote on 1998-11-19 12:22 UTC: > Ross Anderson wrote: > > It will get worse. One of my students is developing a file system that > > can be spread over a WAN, so that for example you can force all file > > modifications in directory foo to be backed up automatially using a > > kind of RCS at a server in America. Useful stuff - real businesses are > > much more interested in backup and disaster recovery than they are in > > crypto (and spend a couple of orders of magnitude more money). But how > > does this sort of system interact with export control? > > Cool - is this going to be open source? Of course. > Presumably, even though, as you > say, businesses are less interested in crypto, it will, nevertheless, > use crypto for data protection and user authentication? Of course. The main research aspect of this project is the joint administration of such distributed archives. For spam protection, you still need people who decide, which files are allowed on the distributed server infrastructure, and which are not. This administration is so far the weak link in the Eternity Service concept, because whoever decides that something is not spam takes over some responsibility for the content, and is therefore subject to legal power of national powers. The distributed administration in my system will be controlled via a sort of cryptographically enforced digital constitution (written in a tiny special purpose functional programming language) that determines administrative rights in a freely configurable way for a distributed server architecture (allowing elections, votes, vetoes, impeachment, updates to the constitution, etc.). This way, no single person will be responsible for the maintenance of such international software repositories, but a (usually international) group of democratically controlled volunteers does this. This way, US people can easily contribute to the administration of such distributed archives without having to share any legal responsibility for the fact that the archive also contains export controlled software, because the majority of administrators and not some single citizen alone has decided which files are allowed to use server space. The goal of this project is of course not primarily to by-pass export controls. It will hopefully advance the state-of-the-art of how we use the Internet to distribute information to a point where classical export control laws and national control of Internet content in general are led completely ad absurdum, without enabling at the same time the wide distribution and robust long-term storage of commonly considered despicable material such as child pornography, instructions for building weapons of mass destruction, or unwanted commercial advertising. In fact, by providing easy to configure governmental mechanisms comparable to those national governments are based on for software repositories, we distribute the responsibility in a cryptographically enforced way over the thousands or millions of users of such archives, effectively bypassing any control of national governments, without the negative aspects of complete anarchy (spam). To avoid misunderstandings: the ultimate idea is not to just by-pass national laws, but to offer a productive and democratic alternative technical means for controlling online resources, because the classical options of either national legislation and complete anarchy both have serious problems. Markus (Ross' student, who tries to get a PhD for developing a theoretical foundation and practical implementation of global-scale jointly administrated file spaces) -- Markus G. Kuhn, Computer Laboratory, University of Cambridge, UK Email: mkuhn at acm.org, WWW: <http://www.cl.cam.ac.uk/~mgk25/>

1 1

Wei Dei's "b-money" protocol
by Adam Back 17 Dec '03

17 Dec '03

Wei Dei recently announced (on cypherpunks) his "b-money, a new protocol for monetary exchange and contract enforcement for pseudonyms". Below is the text of his proposal. Comments to follow. Adam ====================================================================== http://www.eskimo.com/~weidai/bmoney.txt ====================================================================== I am fascinated by Tim May's crypto-anarchy. Unlike the communities traditionally associated with the word "anarchy", in a crypto-anarchy the government is not temporarily destroyed but permanently forbidden and permanently unnecessary. It's a community where the threat of violence is impotent because violence is impossible, and violence is impossible because its participants cannot be linked to their true names or physical locations. Until now it's not clear, even theoretically, how such a community could operate. A community is defined by the cooperation of its participants, and efficient cooperation requires a medium of exchange (money) and a way to enforce contracts. Traditionally these services have been provided by the government or government sponsored institutions and only to legal entities. In this article I describe a protocol by which these services can be provided to and by untraceable entities. I will actually describe two protocols. The first one is impractical, because it makes heavy use of a synchronous and unjammable anonymous broadcast channel. However it will motivate the second, more practical protocol. In both cases I will assume the existence of an untraceable network, where senders and receivers are identified only by digital pseudonyms (i.e. public keys) and every messages is signed by its sender and encrypted to its receiver. In the first protocol, every participant maintains a (seperate) database of how much money belongs to each pseudonym. These accounts collectively define the ownership of money, and how these accounts are updated is the subject of this protocol. 1. The creation of money. Anyone can create money by broadcasting the solution to a previously unsolved computational problem. The only conditions are that it must be easy to determine how much computing effort it took to solve the problem and the solution must otherwise have no value, either practical or intellectual. The number of monetary units created is equal to the cost of the computing effort in terms of a standard basket of commodities. For example if a problem takes 100 hours to solve on the computer that solves it most economically, and it takes 3 standard baskets to purchase 100 hours of computing time on that computer on the open market, then upon the broadcast of the solution to that problem everyone credits the broadcaster's account by 3 units. 2. The transfer of money. If Alice (owner of pseudonym K_A) wishes to transfer X units of money to Bob (owner of pseudonym K_B), she broadcasts the message "I give X units of money to K_B" signed by K_A. Upon the broadcast of this message, everyone debits K_A's account by X units and credits K_B's account by X units, unless this would create a negative balance in K_A's account in which case the message is ignored. 3. The effecting of contracts. A valid contract must include a maximum reparation in case of default for each participant party to it. It should also include a party who will perform arbitration should there be a dispute. All parties to a contract including the arbitrator must broadcast their signatures of it before it becomes effective. Upon the broadcast of the contract and all signatures, every participant debits the account of each party by the amount of his maximum reparation and credits a special account identified by a secure hash of the contract by the sum the maximum reparations. The contract becomes effective if the debits succeed for every party without producing a negative balance, otherwise the contract is ignored and the accounts are rolled back. A sample contract might look like this: K_A agrees to send K_B the solution to problem P before 0:0:0 1/1/2000. K_B agrees to pay K_A 100 MU (monetary units) before 0:0:0 1/1/2000. K_C agrees to perform arbitration in case of dispute. K_A agrees to pay a maximum of 1000 MU in case of default. K_B agrees to pay a maximum of 200 MU in case of default. K_C agrees to pay a maximum of 500 MU in case of default. 4. The conclusion of contracts. If a contract concludes without dispute, each party broadcasts a signed message "The contract with SHA-1 hash H concludes without reparations." or possibly "The contract with SHA-1 hash H concludes with the following reparations: ..." Upon the broadcast of all signatures, every participant credits the account of each party by the amount of his maximum reparation, removes the contract account, then credits or debits the account of each party according to the reparation schedule if there is one. 5. The enforcement of contracts. If the parties to a contract cannot agree on an appropriate conclusion even with the help of the arbitrator, each party broadcasts a suggested reparation/fine schedule and any arguments or evidence in his favor. Each participant makes a determination as to the actual reparations and/or fines, and modifies his accounts accordingly. In the second protocol, the accounts of who has how much money are kept by a subset of the participants (called servers from now on) instead of everyone. These servers are linked by a Usenet-style broadcast channel. The format of transaction messages broadcasted on this channel remain the same as in the first protocol, but the affected participants of each transaction should verify that the message has been received and successfully processed by a randomly selected subset of the servers. Since the servers must be trusted to a degree, some mechanism is needed to keep them honest. Each server is required to deposit a certain amount of money in a special account to be used as potential fines or rewards for proof of misconduct. Also, each server must periodically publish and commit to its current money creation and money ownership databases. Each participant should verify that his own account balances are correct and that the sum of the account balances is not greater than the total amount of money created. This prevents the servers, even in total collusion, from permanently and costlessly expanding the money supply. New servers can also use the published databases to synchronize with existing servers. The protocol proposed in this article allows untraceable pseudonymous entities to cooperate with each other more efficiently, by providing them with a medium of exchange and a method of enforcing contracts. The protocol can probably be made more efficient and secure, but I hope this is a step toward making crypto-anarchy a practical as well as theoretical possibility. ======================================================================

3 6

RE: What was the quid pro quo for Wassenaar countries?
by Vivek Vaidya 17 Dec '03

17 Dec '03

>John Gilmore may be right, but remember folks that in Europe we have >this thing the Greeks invented called democracy. One of the ideas of >democracy is that decisions are not made in secret closed meetings. Would you really call the EU protocols a democracy? rule by the unelected technocrats? And Europes history of not making decisions in secret closed meetings is hardly commendable. Excepting perhaps the swiss. >The interpretation of the US ambassador appears to be based on the >assumption that the governmental proceedures of democratic countries >are like those of his home country. In fact European governments >cannot make law simply by telling the national police force to >arrest folk who engage in particular behaviour. Now my understanding of european law is, of course, limited. But in France wasn't there that case of some rapper been arrested for insulting the police? And in Germany you can strip the constitutional rights of citizens who engage in treasonous behaviour ( could this include cryptography? if connected with neo-nazis almost certainly right? ) >The system of checks and balances may be described in the US >constitution but it is entrenched in the European polity. The UK >does not have a national police force precisely to stop Hooverism. > >Even directives of the European Commission do not have legal force >until the national parliaments enact legislation to implement the >directive. What about those airline accords where the EU took its member states to court over cabotage agreements. I'm sure there are ways to sneak these things through. >One should also remember that the government of the Netherlands has agreed >to control the sale and use of narcotics. If their efforts to control >cryptography are as dilligent we have nothing to worry about. > >In addition under the single European act the entire country of Europe is >one export zone for crypto control purposes. I fail to see that stopping >Brits from exporting crypto to the US changes the equation a great deal. > > >There once was an English king called Canute who attempted to demonstrate >to his courtiers that he was fallible and could not order the tide to >turn. Perhaps Clinton's courtiers need to learn that they suffer the same >limmitation. I'm afraid that that may not be the point. The primary objective of the arms control laws ( which are the ones being used as references in this case ) is to prevent advanced weapons technology from spreading to the third world. Now Europe, America, Japan, and other first world countries are all capable of developing high level crypto indiginously. The less advanced countries on the earth are forced to import it from these countries. What the passage of this law will do is prevent this export ( example: the Netherlands, as you pointed out has not cracked down on its internal narcotics trade. However it doesn't permit exporting narcotics. Similarly this agreement will probably freeze exports of high level crypto by all the signatory countries, in the same way that america no longer permits high level crypto exports. ) The end result being the NSA should able to read India and Chinas communications without irritations. Vivek Vaidya ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0