December 2003 - cypherpunks-legacy

Re: TCM: mafia as a paradigm for cyberspace
by jim bell 17 Dec '03

17 Dec '03

At 03:55 PM 5/21/96 -0500, snow wrote: >On Mon, 20 May 1996, Vladimir Z. Nuri wrote: > >> the assassination politics is quite Hitleresque at its root. >> "kill our enemies, and everything will be better. it is our enemies >> that are the root of all evil in the world. extinguish them, and >> you solve all problems automatically" > > It is more the MAD theory brought down to the personal level. With all due respect, I think that comparison is a bit flawed. MAD (mutual assured destruction) is based on a model where you know the enemy (country) attacking you, in the national model by sophisticated radar systems. It is also based on the (reasonable) assumption that there is no way to pre-emptively attack in such a way as to defeat the ability of the enemy to counter-attack. With AP, and a world populated by 5 billion people, there is no way to know, for sure, who is targeting you. You may _guess_, and you may be right, but such a guess must be based on external information that you've received elsewhere. With AP, you CAN attack and destroy an individual in such a way he doesn't know who hit him. A crook who has victimized many people would be an excellent example of a target who can't know, because he has many enemies. A person who has just jilted a rich lover and has no other enemies would be the opposite. I contend that the kind of targets which are the most "deserving" will tend to be those who don't know who's targeting them. Those that are least deserving will have a good clue about who's giving them the finger. Since such prices are publicly known, a donor would have to be particularly careful about targeting a generally good, well-liked person, if that person could reasonably guess who's naming him. This is one of the many reasons I have a fair degree of confidence that AP will do a lot of good, and very little bad. > The >government has the power and authority to kill anyone of us, AP brings out >into the open the fact that WE ALL HAVE THAT POWER. KIlling people is >(physically) very easy, AP turns the THREAT back on those who hold the >power. This I agree with. But remember that the ability to combine the desires of thousands of people counts for something as well. If the only time you had to worry is if one individual was mad enough to see you dead, and would either do it himself or pay the whole bill himself, you'd feel relatively safe. If, on the other hand, the cost could be split up 10,000 ways or more, you'd better not be a crook! >Note: I don't necessarily think that AP is a good idea. I think >that people should do their own dirty work. In practice, I think this would be comparatively common as well. What currently deters such "take the law into your own hands" is the fact that police (being, essentially, in the business of protection) don't want you to provide for yourself by protecting yourself. They make it hard on people, in the same way they did with Bernard Goetz, the guy who shot four muggers on the New York city subway system. Once AP gets rid of the police, it will be much easier to protect yourself and not risk jail time, etc. Superficially, a person might argue that the lack of police would also make it easier for the muggers. However, a "professional mugger" would make a LOT of enemies, and it wouldn't take long before he's dead. He'd only have to be caught once. Any victim of any mugger would be happy to donate to see him gone. >> such is the total moral perversion of the thinking behind >> "assassination politics". most of the adherents work from the >> following argument, nicely summarized by JFA above: >> 1. the government is corrupt >> 2. therefore, it is okay to kill people who further that corruption. >> wow, what brilliant logic. > > How about this: > Goverments, and the people in them are corrupt. This corruption, >caused by acts of these people, lead to oppression and death. By THEIR >MORALITY oppression and killing are ok, so it is ok to use their tools >agaisnt them. In part 7 I use somewhat different justification. I believe that a person should be able to use whatever level is force is necessry to get rid of the transgression, with no upper limit. In any case, I think that government corruption is way more than enough to justify whatever level of counter-attack is needed. >> there is a trite saying, "two wrongs do not make a right" (trite >> because most have mastered the simple truth of it in their pre-teen >> years). a concept not grasped by some second-graders. some >> require a lifetime of lessons to comprehend it in the end.. > > Putting people in cages is wrong. > Stealing is wrong. > Is putting people in cages for stealing wrong? Yes; I've noticed that people who oppose AP generally don't want to address the question of self-defense issues. >> carefully the errors of those who have come before you. write >> a long treatise with lots of footnotes to past assassination >> difficulties and how you would advance past them. I tell >> you flat out that any respectable assassin would be quite embarrassed >> to be associated with you at the moment because of your arrogance >> and ignorance. > > I might be wrong here, but I don't think that Mr. Bell actually >wants anyone actually shot, Shot? Not necessarily. Let's not forget about blown up, poisoned, stabbed, beheaded, etc. B^) > well, maybe he does, but what he wants is to >have the same power over members of governments than they have over him. Right. Moreover, I believe that governments simply cannot exist as we know them under these circumstances. Besides, they won't be necessary. Jim Bell jimbell(a)pacifier.com

2 1

Re: SEVERE undercapacity, we need more remailer servers FAST (fwd)
by hendersn＠zeta.org.au 17 Dec '03

17 Dec '03

>Had he posted it through a remailer, I think it would have been well >justified. He was obviously blowing the whistle on what he saw as illegal >activities. The only reason that Keith could post NOTS 34 at all was because it had previously been posted to a.r.s anonymously. Prior to that, no-one outside of the Church had a copy of any NOTS materials(or so the Church says). > That's a much different matter than posting the entire NOTs >series, though. The wholesale copying is what most people seem to object >to, though my observations tell me that the "Church" objects to any >copying, even for fair use... Grady Ward got sued by the Church just because he _asked_ for a NOTS pack to be sent to him. The Church will do everything within its not inconsiderable power to prevent NOTS material being disseminated on the Internet - up to and including destroying the anonymous remailer network. Zed(hendersn(a)zeta.org.au) "Don't hate the media, become the media" - Jello Biafra PGP key on request

1 0

DC area physical meeting, this saturday
by Pat Farrell 17 Dec '03

17 Dec '03

Appologies to the 1000+ folks who are too far away to care about this... The next Washington DC area cypherpunks physical meeting will be this saturday, May 25 at 3:00 PM, at Digex.net. Details, directions, etc. at http://www.isse.gmu.edu/~pfarrell/dccp Pat Pat Farrell Grad Student http://www.isse.gmu.edu/~pfarrell Info. Systems & Software Engineering, George Mason University, Fairfax, VA PGP key available on homepage #include <standard.disclaimer>

1 0

Re: The Twilight of the Remailers?
by middle-man-admin＠alpha.c2.org 17 Dec '03

17 Dec '03

On Tue, 21 May 1996, Timothy C. May wrote: > At 7:59 PM 5/21/96, Alex Strasheim wrote: > >I'm closing my mixmaster, nsa(a)omaha.com, on the 4th of June. > Between Hacktic going down, Hal's comments that he may shut down his two > sites, and this, plus others who are more quietly making plans to shut > down, I think the thread title "The Remailer Crisis" is more apt than ever. I tend to agree. I realize that the middle-man remailer requires that there be bastion remailers on the end of the chain. Without them, the "middle-man" concept won't work. I thank the remailer sites the allow the middle-man to work. Anyway, with all the remailers that have either vocalized their retirement and those that are silently considering retirement, I would like to announce that the middle-man remailer should be available for download as early as this weekend. Utopia.hacktic.nl (basement) and c2.org have agreed to carry the middle-man remailer on their FTP sites. As soon as I can get the documentation finished, I'll post it. middle-man-admin

1 0

Reply to e$: The Wealth of Nation-States
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Tue, 21 May 1996 23:35:22 +0900 To: rah(a)shipwright.com From: tatsuo(a)glocom.ac.jp (Tatsuo Tanaka) X-Sender: tatsuo(a)izanagi.glocom.ac.jp Subject: Reply to e$: The Wealth of Nation-States Cc: tatsuo(a)glocom.ac.jp (Tatsuo Tanaka) MIME-Version: 1.0 Dear Mr. Robert Hettinga, Please allow me to write you. I am a visiting research fellow of Columbia University, and study digital cash from the economics point fo view. I read your article on "e$:The Wealth of Nation-States." ineterestingly. I also think that digital cash will cause a conflict with the Nation-States, though my major concern is financial economics view point, not taxation problem. I wrote a paper on this issue,"Possible Economic Consequences of Digital Cash " which is supposed to be presented at the coming INET96. This paper's URL is http://tenjin.glocom.ac.jp/tanaka/inet/DigitalCash_v1e.html I hope this paper might be of interest to you. Following is an abstract of this paper. Author discusses possible consequences of digital cash from the view of economics and forcasts a possible scenario for the future. Digital cash will bring us benefits as well as problems. One major benefit of digital cash is its increased efficiency which will open new business opportunities, especially for small businesses. On the other hand, it will bring us four problems: taxation and money laundering, instability of the foreign exchange rate, disturbance of money supply, and the possibility of financial crisis. There is one important attribute of digital cash, however, that overshadows these benefit and problems. It is the transnationality of digital cash, that is, the ability of digital cash to flow freely accross national borders. Every bank can issue it and everybody all over the world can use it. This transnationality is a cause for both benefits and problems, and could have significant repurcussions internationally. From the economic stand point, the most important characteristic of digital cash is its transnationality. If digital cash circulated only within a traditional national border and was controlled under a central monetary authority, there would be no economic implications that would be worth analyzing. In this case, digital cash would be nothing more than a convenient transaction method such as a credit card. However, digital cash is more than that. Its transnationality has the potential to cause conflict between cyberspace and nation states. If digital cash spreads successfully in the 21st century, its history may be written as a record of its battle with nation states. Thank you for your time. Sincerely yours, Tatsuo TANAKA Tatsuo Tanaka Email:tatsuo@glocom.ac.jp -Current Address- -Contact in Japan- Center on Japanese Economy & Businness Center for Global Communications 521 Uris Hall International Univ. of Japan Columbia University 6-15-21, Roppongi,Minato-ku New York, NY, 10027, USA Tokyo 106,Japan Fax:+1-212-678-6958 Tel:665-5028 Fax:+81-3-5412-7111 Tel:5411-6677 --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "If they could 'just pass a few more laws', we would all be criminals." --Vinnie Moscaritolo The e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

Re: The Crisis with Remailers
by Matts Kallioniemi 17 Dec '03

17 Dec '03

At 11:58 1996-05-22 +0200, bryce(a)digicash.com wrote: >Matts, _floating_ point numbers are _not_ useful >if you want to handle a number with a lot of precision, nor >indeed, if you want to be able to _know_ the precision! If you >have a number that represents money, you want to know the >precision! As I said yesterday, there are in fact people dealing with billions in all major currencies that keep their money in 64 bit floats. The precision is far better than anything you can do in 32 bit integers. Trust me, this is a fact and can easily be proven. >I shall try to refrain from taking umbrage at your comment that >DigiCash is "not real". The "get real" was a pun on floats. Many languages, such as Pascal, calls them real numbers. Sorry I forgot the smiley. >Also that DigiCash doesn't "do" currency. What could you possibly >mean by that? In my client (2.1.5a MT) there is no way to do currency conversion. If I go to a FIM or DEM merchant I can't buy anything in the store. This will probably change in the near future when a new client is released, and then we'll have the question of how to represent these currencies in one wallet. What do you think will happen if you have a one italian lira coin and you try to deposit it with Mark Twain's USD account? With integer math it won't be pretty. >For further reading on floating point and other representations >of numbers in computing, I recommend any good introductory >university text on mathematical computing. Sorry I don't have >mine handy or I'd give you a specific reference. Maybe you should start looking for it. You'll need it when the lira arrives... Regards, Matts

7 9

Re: Clipper III analysis
by frantz＠netcom.com 17 Dec '03

17 Dec '03

John Gilmore wrote an excellent description of GAK 3 (aka Clipper III, aka Enabling Privacy, Commerce, Security and Public Safety in the Global Information Infrastructure). Here are a couple of other points that even the proponents of this scheme should agree to: (1) GAK3 does not provide for the significant public purpose of protecting dissident groups under repressive regimes. Human rights groups in Bosina/Serbia have used PGP to protect their files. Since their computers have been frequently seized, the only protection for those people who have made human rights complaints has been that the local government has not had access to the keys. (2) The paper fails to differentiate between the needs of communication privacy and data storage privacy. No rational person would want to GAK their communication keys. Data lost because keys are lost can always be retransmitted. Since communications are easy to intercept, having a long term GAK key greatly increases the chances that the long term key will be stolen and the session keys intercepted. Communication session keys should be decided by techniques such as Diffie Hellman which ensure that the only entities with access to the key are the programs/hardware at each end of the link. A better case for escrowing long term data storage keys can be made. Physical security provides some protection for the cyphertext. Loss of a key can mean loss of the data. However, it is not clear why encrypting for data storage is any different from storing confidential data in a safe. If the government has a legitimate need to access the data, they can access it through the same legal processes they use to access data in safes. While long term data storage can use escrow agents, it does not need GAK for any legal public purpose. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

3 2

Another Analysis -- Re: NIST Draft Key Escrow Paper
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

Declan McCullagh and Gilmore have already provided a brief summary of the doc, here are a few thoughts I sent to some others last night: - the meat is in the footnotes. - buzzword compliance: key recovery and Key Management Infrastructure (KMI). - intro: market forces and government/industry cooperation. - key bullet points: o Certificate authorities will operate within performance standards set by legislation o Agreements between governments will serve as the basis for international cross certification. o Self-escrow will be permitted under specific circumstances. [1] [1] The escrow agency must meet performance requirements for law enforcement access. - Denning's CACM survey key escrow article and Hoffman's "Building in Big Brother" are cited. - A lot of talk about "mutually trusted CAs" A footnote [4] "A mutually trusted authority is an escrow agent trusted by users to store keys and trusted by law enforcement to provide access upon certification of lawful authority." One has freedom to choose any CA, as long as the mutual trust exists. - At the international level "Law enforcement and some national security concerns would be protected since government agencies would be able to obtain escrowed key pursuant to government-to-government agreements." - Products can be exported to countries with these agreements. - Self escrow: "To avoid this risk [of investigations being compromised], independent escrow authorities could be added as another layer. Such a solution would drive up the cost to operate the PKI and drive down the efficiency of conducting public key certification functions, particularly for individual users." [Ok, so independent CAs are "bad" things"] "The solution may be a national policy which allows CAs for an organization to be escrow authorities if they can reliably turn over keys in a timely fashion when requested and to protect the confidentiality of any request for escrowed key. To this end, the government should seek legislation that would shield organization certificate authorities from internal pressures in the course of law enforcement investigations." [A "good" thing?] - provisions for legislation on civil or criminal liability on the commercial/private side. - gives requirements for KMI: key integrity, key accessibility, key recovery with respect to confidentiality, availability and responsiveness (24 hours) requirements. So Clipper III is a bit meaner and leaner. If Clipper I would have sunk because of sheer clumsiness, a sleeker ship carrying the same load will now be developed by the free market. The load is the assumption that citizens can be "compelled in any criminal case to be a witness against himself." _______________________ Regards, We could never learn to be brave and patient, if there were only joy in the world. -Helen Keller Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0

REMINDER: Leahy at Hotwired 5/22/96 4pm EST
by shabbir＠vtw.org 17 Dec '03

17 Dec '03

------ Date: May 22, 1996 (THIS IS TODAY) Senator Patrick Leahy (D-VT) will be on HotWired TODAY, May 22nd at 4pm EST at http://www.hotwired.com/wiredside/ You can tune in and listen to the chat with the RealAudio software (http://www.realaudio.com) You can ask questions of the Senator through a moderator and get real, immediate responses. Topics likely to be covered: Clipper I/II/III and Net Censorship -Shabbir J. Safdar shabbir(a)vtw.org

1 0

Misquoting and Vlad (LD?)
by Jean-Francois Avon 17 Dec '03

17 Dec '03

Here, I quote some text that is quoted frequently: > >> such is the total moral perversion of the thinking behind > >> "assassination politics". most of the adherents work from the > >> following argument, nicely summarized by JFA above: ^^^^^ > >>1. the government is corrupt > >>2. therefore, it is okay to kill people who further that > >> corruption. wow, what brilliant logic. I would appreciate if everybody would stop using that example. No threat or heinous tone here, but simply a reasonable request. I am getting tired of it. Of course, the collectivist who wrote that sentence is totally wrong because I never said such things in the context he meant them. But again, it is not everybody that followed the thread and I am fed-up of seing thoses words attributed to me. I have no problem in building my bad reputation myself. I don't like it when other do it... So, please, if ever you quote it again, put at the beginning of the paragraph: "Vlad Z. Nuri wrote:" or "Vlad Z. Nuri aka L. D(R)otweiller wrote:" Thanks and Regards. JFA DePompadour, Societe d'Importation Ltee; Limoges porcelain, silverware and crystal JFA Technologies, R&D consultants; physists, technologists and engineers. PGP keys at: http://w3.citenet.net/users/jf_avon ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 I reserve the right to post publicly any private e-mail sent to me. Unsollicited commercial e-mail will be proofread at US165 $/h Any sender of such material will be considered as to have ac- cepted the above mentionned terms.

1 0

Floating Point and Financial Software
by mpd＠netcom.com 17 Dec '03

17 Dec '03

There seem to be a few mini-flames on the list over whether floating point data representations are appropriate for financial software. In a nutshell, the answer is "YES", and the use of floating point arithmetic is common in such applications. One argument heard against the use of floating point is that it is inherently "imprecise." In reality, floating point representations and the results of floating point operations are perfectly well defined, and the points on the real number line which are exactly representable by double-precision floating point values are usually a superset of those representable by the default integer on most machines. Storing monetary values as double-precision floats having integer values in cents is even common in COBOL programs, where the "COMP-3" data type allows the use of fast floating point in lieu of the default and slow manipulation of packed decimal and decimal data. It is even common in certain CPUs, like CDC Mainframes and SPARCS, which are primarily floating point engines, to omit integer divide and sometimes even multiply, and to provide a subroutine which employs floating point calculations to emulate these operations. This is completely transparent to the user of the machine, and there is no problem in using floating point to do integer operations. In fact, when running financial applications on large engineering mainframes, which generally lack a business instruction set, floating point is not only commonly employed, it is the obvious way to get the maximum performance out of the machine. -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

4 4

Re: Bit tax proposal?
by Rev. Mark Grant, ULC 17 Dec '03

17 Dec '03

> All interactive digital information would be subject to the new tax. > Thus digital broadcast and digital radio (all 'one to many' broadcasts) > would be exempted from the tax. Gosh, so the TV and radio companies would get to broadcast tax-free and the rest of us would have to pay. Not like this is intended to turn the scary old Internet into the digital equivalent of the broadcast media. I'm sure that idea never even considered crossing their minds... Hmm, maybe "Cypherpunks Productions" should start broadcasting soap operas and gameshows with email and Usenet stego-ed into the low bits. Mark

1 0

Re: The Crisis with Remailers
by Bruce Baugh 17 Dec '03

17 Dec '03

At 12:30 AM 5/22/96 EDT, E. ALLEN SMITH wrote: > Would you suspect that having more warning labels (before & after, >not just in the headers) would help with any negative reputation thus >generated? Probably not. Does it really matter how many times I tell you "I'm not being a jerk" if everything I send you is in fact jerky? (FBI and "this is not an assault", anyone?) Pointing people at legitimate uses of anonymity, as various folks have suggested, is undoubtedly a good idea. Would anyone care to suggest a few newsgroups where the vast majority of anonymous posts have really good reasons for being so? In cases where there's been serious abuse of remailers that's been caught and dealt with, some PR on the part of remailer operators might go a long way toward helping things. "Yes, this person was doing loathsome things, but we put a stop to it [insert details here." >put into public view... I see no reason to give lawyers more of a privilege >than religious/psychiatric individuals. Ditto. Likewise, I liked the instance last year of a student applying for the mail logs of the local (state?) government. It is Good for rulers to feel the same weight of the rules they impose on others. -- Bruce Baugh bruce(a)aracnet.com http://www.aracnet.com/~bruce

2 1

CDT Policy Post 2.20 - Clinton Administration Floats Clipper III Draft
by bobpal＠cdt.org 17 Dec '03

17 Dec '03

----------------------------------------------------------------------------- _____ _____ _______ / ____| __ \__ __| ____ ___ ____ __ | | | | | | | | / __ \____ / (_)______ __ / __ \____ _____/ /_ | | | | | | | | / /_/ / __ \/ / / ___/ / / / / /_/ / __ \/ ___/ __/ | |____| |__| | | | / ____/ /_/ / / / /__/ /_/ / / ____/ /_/ (__ ) /_ \_____|_____/ |_| /_/ \____/_/_/\___/\__, / /_/ \____/____/\__/ The Center for Democracy and Technology /____/ Volume 2, Number 20 ---------------------------------------------------------------------------- A briefing on public policy issues affecting civil liberties online ---------------------------------------------------------------------------- CDT POLICY POST Volume 2, Number 20 May 22, 1996 CONTENTS: (1) Clinton Administration Floats Clipper III Key-Escrow Proposal (2) Join Sen Leahy TODAY (5/22) At HotWired to Discuss His Crypto Bill (3) Subscription Information (4) About CDT, contacting us ** This document may be redistributed freely with this banner in tact ** Excerpts may be re-posted with permission of <editor(a)cdt.org> ----------------------------------------------------------------------------- (1) CLINTON ADMINISTRATION FLOATS 'CLIPPER III' KEY ESCROW PROPOSAL The Clinton Administration Tuesday (5/21) unveiled a new encryption policy proposal which would use a government-sanctioned key certification system as an incentive to virtually impose key escrow on domestic users. The draft proposal, "Achieving Privacy, Commerce, Security and Public Safety in the Global Information Infrastructure" (already dubbed Clipper III), seeks to establish a "public key infrastructure" for encryption. Broadly speaking, a public key infrastructure would enable users to clearly identify the people they are communicating with and facilitate key management, and is widely viewed as an important component of a secure and trusted communications environment. However, the Clipper III would establish this infrastructure at a price: All users of the public key infrastructure would have to ensure government access to their encryption keys through an approved key escrow authority. A detailed analysis of the Administration's latest draft proposal is attached below. Among other concerns: * The proposal is hardly voluntary - Key-escrow would become a prerequisite for participation in the Global Information Infrastructure. * The proposal contains few guidelines for how keys would be shared with foreign governments. * The proposal encourages the collection of highly sensitive private key information. * The proposal does not address major privacy concerns such as liability for key holders, limitations on law enforcement access, audit requirements, and other concerns that many have already identified as crucial to protecting individual privacy even in a voluntary key escrow system. CDT believes that the Administration's draft proposal does not meet the privacy and security needs of Internet users or the demands of the marketplace. While the proposal represents real progress by the Administration in recognizing the importance of encryption and the value of a public key infrastructure, in reality it provides few provisions to protect individual privacy. Moreover, the Clipper III proposal, like its predecessors, continues to put law enforcement and national security concerns above the privacy and security needs of the American public. The latest Administration proposal comes in the midst of Congressional efforts to relax encryption export controls and encourage the widespread use of strong, easy-to-use encryption and prohibit the government from imposing key escrow domestically. It also comes in the wake of a letter signed by over 27 Representatives last week urging the Administration to abandon its key-escrow initiative (See CDT Policy Post 2.19) A copy of the Draft proposal is available on CDT's encryption policy web page (http://www.cdt.org/crypto) SUMMARY OF THE PROPOSAL: ------------------------ Taking a nod from the efforts currently under way through the European Commission to establish a Public Key Infrastructure (PKI) in Europe, the Clipper III seeks to establish a means of ensuring authentication and key management for Americans. Among other things, the Clipper III draft proposal: * RECOGNIZES THAT THE GOVERNMENT SHOULD NOT IMPOSE ENCRYPTION STANDARDS ON MARKET: One positive element of the new proposal is an explicit recognition of the importance of encryption and the need for private sector, as opposed to government solutions. The draft states, "Government can no longer monopolize state of the art cryptography ... It is unrealistic to believe that government can produce solutions which keep ahead of today's rapidly changing information technology". * ESTABLISHES KEY MANAGEMENT INFRASTRUCTURE: The draft proposal would create a new public key infrastructure designed to tie individuals and entities to their public keys. * RELAXES EXPORT CONTROLS FOR KEY ESCROW PRODUCTS: The new draft would continue and expand the effort started with the Clipper II proposal by allowing the export of software with 64 bit key lengths (80 bits for hardware) on the condition that products contain a key-escrow function. Keys could be escrowed in the United States or where the US has a bilateral escrow agreement. Other exports to certain markets would be considered on a case-by-case basis. * PROVIDES FOR 'SELF ESCROW' OF ENCRYPTION KEYS: Self Escrow (where a corporation or individual could become an escrow agent for its own private keys) would be permitted, though the exact conditions of and obligations are not specified in the draft. MAJOR FLAWS IN THE CLIPPER PROPOSAL RENDER IT A NON-STARTER ----------------------------------------------------------- * CLIPPER III IS NOT VOLUNTARY & MAKES KEY-ESCROW A PRECONDITION FOR PARTICIPATION IN THE GLOBAL INFORMATION INFRASTRUCTURE While the Administration deserves credit for recognizing that a trusted public key infrastructure is an important component of a workable National Encryption policy, the latest proposal attempts to use the need for a public key infrastructure as a means to impose key escrow domestically. Although the Administration has repeatedly stressed that any key-escrow initiative would be a voluntary system, the text of the latest draft directly contradicts that contention. The proposal states that in order to participate in the Global Information Infrastructure, users will need to escrow their keys; if they choose not to participate in the key infrastructure, "users cannot know with whom they are dealing on the network, or sending money too, or who signed a document, or if the document was intercepted and changed by a third party." (page 3). The proposal goes on to state: "To participate in the network a user needs a public key certificate signed by a CA [Certification Authority] which 'binds' the user's identity to their public key. One condition of obtaining a certificate is that sufficient information (e.g., private keys or other information as appropriate) has been escrowed with a certified escrow authority to allow access to a user's data or communications." (page 5) In other words, the Clipper III proposal would require individuals and businesses to use key-escrow encryption as a condition of participating in the Global Information Infrastructure. Under the proposal, an individual cannot obtain certification by a Key Certification Authority (a necessity under the Clipper III scheme) unless he or she registers with a "certified escrow authority". There is no technical or structural reason (beyond law enforcement access) why key escrow must be a component of a public key infrastructure. In fact, a robust example of a public key infrastructure exists today for exchanging PGP keys (the PGP public key server at MIT <http://www-swiss.ai.mit.edu/~bal/pks-toplev.html>). * CLIPPER III TARGETS DOMESTIC USERS While export controls have ostensibly been aimed at controlling the use of encryption by foreign users (and indirectly, at domestic users as well), the Clipper III proposal is aimed directly at the domestic use of encryption and seeks to establish a system whereby key escrow becomes a de-facto component of domestic encryption products. * RAISES MAJOR QUESTIONS WITH RESPECT TO INTERNATIONAL KEY EXCHANGE In order to work, Clipper III assumes bi-lateral agreements between the US and other countries with respect to law enforcement access to escrowed keys, who could legally be an escrow agent, and other factors. Currently no such agreements exist. Bilateral agreements also raise important privacy issues, including how to deal with releasing keys to foreign governments, particularly those without any tradition of privacy protections. Finally, a patchwork of international agreements can create problems for interoperability. The same encryption and or authentication scheme exportable to Germany or England might not be exportable to India or China in the absence of a appropriate bi-lateral agreements. * CONTAINS NO PRIVACY PROTECTIONS/RESTRICTIONS ON LAW ENFORCEMENT ACCESS TO ESCROWED KEYS: Like Clipper and Clipper II, the latest proposal does not squarely address standards for law enforcement access to escrowed keys, unauthorized disclosure of keys by escrow agents, and other privacy issues associated with key escrow. * CREATES VULNERABILITY AND INSECURITY BY ENCOURAGING STORAGE OF PRIVATE KEYS: The proposal suggests that escrow agents hold either a user's private key or "other information as appropriate". Allowing escrow agents to accumulate private keys creates severe vulnerabilities in the network. Once a private key is disclosed (either to law enforcement or to an unauthorized third party), *every* communication using that key is compromised. Although the draft does attempt to limit this concern by allowing escrow agents to hold "other information", the proposal no where specifies what that would be. NEXT STEPS ---------- Congress is currently considering legislation which would head off the Administration's efforts to encourage domestic key-escrow encryption schemes and promote the widesprad avaiability of strong, easy-to-ues encryption technologies. Several bills, including S.1726 (the Pro-CODE bill) sponsored by Senators Burns (R-MT), Leahy (D-VT), Dole (R-KS), Pressler (R-SD), Wyden (D-OR) and others, along with HR 3011, sponsored by Reps Goodlatte (R-VA), Eshoo (D-CA), Campbell (D-CA) and over 25 others are currently being considered by Congress. Both bills would relax export restrictions and prohibit the government from imposing key escrow domestically. CDT looks forward to working with Members of Congress to pass legislation that encourages the widespread availability of strong, easy-to-use encryption technologies based on marketplace, not government, standards. ----------------------------------------------------------------------- (2) JOIN SENATOR LEAHY TODAY (Wed 5/22) TO DISCUSS PRIVACY AND SECURITY ONLINE Senator Patrick Leahy (D-VT), the "Senior Senator from Cyberspace", ardent proponent of Net.Freedom and co-sponsor of 2 bills to repeal encryption export controls, will hold an online "town meeting" on Wednesday May 22 to discuss privacy and security online. DETAILS ON THE EVENT * Wednesday May 22, 4 - 5 pm ET (1 pm Pacific) on HotWired URL: http://www.hotwired.com/wiredside/ To participate, you must be a registered HotWired member (there is no charge for registration). You must also have RealAudio(tm) and a telnet application properly configured to work with your browser. Please visit http://www.hotwired.com/wiredside/ for information on how you can easily register for Hotwired and obtain RealAudio. Wednesday's town meeting is another in a series of planned events, and is part of a broader project coordinated by CDT and the Voters Telecommunications Watch (VTW) designed to bring the Internet Community into the debate and encourage members of Congress to work with the Net.community on vital Internet policy issues. Events with other members of Congress working on Internet Policy Issues are currently being planned. Please check http://www.crypto.com for announcements of future events ------------------------------------------------------------------------ (3) SUBSCRIPTION INFORMATION Be sure you are up to date on the latest public policy issues affecting civil liberties online and how they will affect you! Subscribe to the CDT Policy Post news distribution list. CDT Policy Posts, the regular news publication of the Center For Democracy and Technology, are received by more than 9,000 Internet users, industry leaders, policy makers and activists, and have become the leading source for information about critical free speech and privacy issues affecting the Internet and other interactive communications media. To subscribe to CDT's Policy Post list, send mail to policy-posts-request(a)cdt.org with a subject: subscribe policy-posts If you ever wish to remove yourself from the list, send mail to the above address with a subject of: unsubscribe policy-posts ----------------------------------------------------------------------- (4) ABOUT THE CENTER FOR DEMOCRACY AND TECHNOLOGY/CONTACTING US The Center for Democracy and Technology is a non-profit public interest organization based in Washington, DC. The Center's mission is to develop and advocate public policies that advance democratic values and constitutional civil liberties in new computer and communications technologies. Contacting us: General information: info(a)cdt.org World Wide Web: URL:http://www.cdt.org/ FTP URL:ftp://ftp.cdt.org/pub/cdt/ Snail Mail: The Center for Democracy and Technology 1634 Eye Street NW * Suite 1100 * Washington, DC 20006 (v) +1.202.637.9800 * (f) +1.202.637.0968 ----------------------------------------------------------------------- End Policy Post 2.20 5/22/96 -----------------------------------------------------------------------

1 0

Criminal Law Web Site
by AFDA2＠aol.com 17 Dec '03

17 Dec '03

The upgraded Web site for the Association of Federal Defense Attorneys (AFDA) is now available at http://www.afda.org The site provides several valuable tools for criminal defense attorneys who practice in the federal courts: (1) a convenient compilation of over 100 Web sites pertaining to federal law, including search capabilities through all the statutes and case law rulings; (2) an online newsletter that is updated weekly; (3) a message board; (4) a form library for downloading documents (we will soon begin uploading documents to the library); (4) a listing of upcoming seminars for which you can register online; (6) a feedback form so that you can give us your comments and suggestions; (7) and a survey function so that we can conduct polls within the criminal defense bar online for submission to Congress. The Web site is financed through membership dues on a non-profit basis. Until mid-June, the site will be free to all users but will then become password-protected for members only. We hope you will take advantage of this important resource and join the Association so that we can continue providing the defense bar with needed support. To join, simply click the "Join AFDA" bar on the main page of the Web site. Best regards to all. Greg Nicolaysen (Los Angeles)

1 0

Re: Another Analysis -- Re: NIST Draft Key Escrow Paper
by jim bell 17 Dec '03

17 Dec '03

At 11:35 AM 5/22/96 -0400, Joseph M. Reagle Jr. wrote: >Declan McCullagh and Gilmore have already provided a brief summary of the >doc, here are a few thoughts I sent to some others last night: [schtuff deleted] >So Clipper III is a bit meaner and leaner. If Clipper I would have sunk >because of sheer clumsiness, a sleeker ship carrying the same load will now >be developed by the free market. The load is the assumption that citizens >can be "compelled in any criminal case to be a witness against himself." I didn't notice any specific reference to the difference between materials encrypted for long-term storage or transmission (data, email) and on the other hand audio telephone communications, the original stated application for the Clipper chip. I can't see any reason that an individual would want the key to his own crypto telephone keys escrowed; unlike the key for data on a computer, which at least theoretically might be lost, the cryptophone data is by definition lost as soon as it is used. Therefore, I can see no argument which would make a person support this key escrow for that purpose. Since the whole system is supposed to be "voluntary", who is going to accept this? Jim Bell jimbell(a)pacifier.com

1 0

Re: An alternative to remailer shutdowns (fwd)
by David Rosoff 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 10:24 AM 5/21/96 -0800, jim bell <jimbell(a)pacifier.com> wrote: >At 06:28 PM 5/20/96 -0500, Jim Choate wrote: >> >>Forwarded message: >> >>> Date: Mon, 20 May 1996 15:02:08 -0700 >>> From: Hal <hfinney(a)shell.portal.com> >>> Subject: An alternative to remailer shutdowns >> >>> was apparently sent through my remailer. According to 18 USC 875(c), >>> "Whoever transmits in interstate commerce any communication containing >>> any threat to kidnap any person or any threat to injure the person of >>> another, shall be fined not more than $1,000 or imprisoned not more >>> than five years, or both." I may not be able to continue operating >>> either of my remailers (alumni.caltech.edu and shell.portal.com) for >>> much longer due to this kind of abuse. >> >>There should be a section in there dealing with 'knowingly'. If not then we >>should immediately bring charges against any and all newspapers who have >>ever printer a ransom letter, or perhaps even the Unibomber Manifesto since >>there is clear evidence of 'threat to injure the person of another'. > >But even "knowingly" needs to be carefully defined. A remailer operator >today KNOWS that his system COULD be used for illegal activities; he merely >doesn't know that they are, currently. I think that the definition should >be so narrow that it is impossible for a third party (or the government >itself) to incriminate the remailer operator by having his system forward >arguably illegal or copyright-violating material. > > >Jim Bell >jimbell(a)pacifier.com Can the same sort of standards as per the U.S. CDA be applied? The first draft of the CDA would have held ISP's responsible for, e.g., porn transmitted using their services. Isn't this the same sort of thing - that is, that remailer operators provide a service, and they cannot be held responsible for people who abuse that service? I think that this line of thought is reasonable. David -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMaNZlxguzHDTdpL5AQGkIgQAkfTaXyFp32yX1CiKK/7xlfvojYK+oG2U BWS5w2gMWeorRB1jPJW3Aec3cAlUQCoYg7TOd+Z8EgHWqHxR30cDUBd56oq1wlmf 0X3d2rjnM64Bcq8gonFXPxeSU+C3O0qobdj58BUpo+o2ueNo0sPGLK79KKAHuhWW oBBXV6jGTWc= =AXOt -----END PGP SIGNATURE-----

1 0

Re: The Crisis with Remailers
by John Deters 17 Dec '03

17 Dec '03

At 12:14 PM 5/22/96 -0400, Perry wrote: > >Matts Kallioniemi writes: >> At 17:44 1996-05-21 +0200, bryce(a)digicash.com wrote: >> >Matts, you don't want to do floating point for money, because >> >floating point doesn't give you good control of precision. >> >> Yes I do. Several major currency traders in Sweden keep all >> their money in 64 bit floating point storage. > >I have trouble believing you. None of the forex accounting I know of >in the U.S. is done in floating point. It simply isn't accurate >enough. > >It is true enough that *rates* can be stored as floats if you want, >but never actual sums. I wish there were a hard-and-fast rule that this were true. I work in Point Of Sale (POS or cash registers), and occasionally we will see a vendor whose software stores money/currency in floating point data types. I try very hard to make sure we do not purchase their software, because this implies the most gross lack of understanding imaginable. Floating points are simply not accurate when you're performing math on other people's money. And, yes, rates are acceptable to store and use as floats, but even the conversion process ultimately yields a long, not a float. And, we usually go out of our way to code rates up as integers and perform the decimal point shifting in code. In the currency class we use, we have an exponent property that defines where the decimal point is. I imagine that by converting the exponent from a short to a long we could even handle lira! :-) * * Note to persons who respect the Italian economy**: That was a joke! ** Note to persons who believe there are people who respect the Italian economy: That was a joke! -john -- J. Deters >From Senator C. Burns' Pro-CODE bill, which I support and you can find at: http://www.senate.gov/member/mt/burns/general/billtext.htm " (2) Miniaturization, disturbed computing, and reduced transmission costs make communication via electronic networks a reality." +---------------------------------------------------------+ | NET: jad(a)dsddhc.com (work) jad(a)pclink.com (home) | | PSTN: 1 612 375 3116 (work) 1 612 894 8507 (home) | | ICBM: 44^58'33"N by 93^16'42"W Elev. ~=290m (work) | | PGP Key ID: 768 / 15FFA875 | +---------------------------------------------------------+

1 0

Re: (Fwd) Re: TCM: mafia as a paradigm for cyberspace
by Jean-Francois Avon 17 Dec '03

17 Dec '03

Take note: If you want me to read you, cc me since I unsubscriVed :) from Cypherpunks... While frothing at the mouth (and god knows what other sphincters...), on a 22 May 96 at 12:37, somebody that behaves like a Rotweiller wrote: > oh, so in other words, a lot of "innocent" people will be murdered > under AP. ah, another great "feature", not a "bug", right?? Yes, but please note that the point for the validating of his statement is that even if this will happens, overall, *less innocents* will suffer from the seemingly random violence of AP than from the actual system. He might be wrong, but you seem to bring no new knowledge that would elucidate the question. Should the US have not dropped the A-Bomb on Japan and let happen 10 times mores casualties (from both sides)? The following paragraphs illustrate very well the way our local Rotweiller sees the world, which is very close to the vision of most statists. > ah, like murder. I see. well, I think you are violating my rights > by disagreeing with me. I shall arrange your consequences > accordingly. > but who decides what is wrong? the arbitrary opinion of some single > human idiot out anywhere in the world? don't you see the tyranny of > this? > it is far worse than the tyranny of a government if I were to > be killed by someone who believes that I violated his rights by > breathing air particles or whatever. via AP, you wish to give him > the mechanism to murder me without trace. Why do you fear so much for yourself? I guess, thoses who want to murder for all sort of reasons like hunting white baby seals or smoking in public simply share your psycho-epistemology. They would have no reasons to put a contract on you. Or would they anyways? > deny rights, legitimacy, justice, blah, blah, blah. the terms you > use have no meaning in the system you are advocating. there are no > "rights" in an anarchy, because a government is the entity created > to safeguard/protect them. all actions are legitimate in an > anarchy, because there is no civilized system that rejects any ones > in particular. By definition, you are right. But note that *they* never advocated true anarchy, only *you* claim that they do. Their vision of Life clearly entail some vision of Rights, Rules of Conduct, etc. They did *not* rule out laws, they only said that they do not like laws that are there to oppress peoples. Now, might you say, how are you gonna know? Because your philosophy is somewhat of a cross between Nietche and Sartre, you see no way out. But they (proponents of AP) have a vision of life that value, as the good old american constitution say, life, liberty and "pursuit of happiness". I might even agree with you, dear Rotty, that Jim Bell is a bit naive and shows a kind of outdated philosophy. Jim Bell et al. entertain the delusion that human beings are intrinsically joyous rationnal animals that, most of the time, love life. Therefore, for them, the AP scheme cannot lead to anything but a kind of laissez-faire world where everybody would be able to pursue happiness to the best of their abilities. OTOH, you believe that the natural tendency of AP would bring a world as you describe it vocally here. A world where the essence of Mankind is not to be a rationnal animal, but an animal, period. In that vision, you believe that a bloodthirsty beast within us will always take over. Maybe you learned that truth from your *own* life experience, I have no idea. So, according to your logic, anybody who doesn't like you will put a prize on your head, and probably look up the necrology section of the paper everyday while gigling. And here, I have to conceed that you may be right. After all, what philosophy ran the country since a hundred years? Huhh? So many peoples are so convinced of that that AP might very well turn against it's originator and further corruption. Don't you think so? > if you think that a government is a tyranny, perhaps you are not > aware of the tyranny of the irrationality of individual men. That sentence should earn one of the top spot of the CP top-ten-of-the-year list! ROTFL and L and L and L ! > it will "work" exactly as anonymous murdering now works. Nobody is more deaf than the blind who does not want to smell... > ah yes, exactly what we need. "enhanced anarchy". you and TCM really > should get together and collaborate. I'm sure you'd come up with > some fruitful conclusions. Who knows? JFA DePompadour, Societe d'Importation Ltee; Limoges porcelain, silverware and crystal JFA Technologies, R&D consultants; physists, technologists and engineers. PGP keys at: http://w3.citenet.net/users/jf_avon ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 I reserve the right to post publicly any private e-mail sent to me. Unsollicited commercial e-mail will be proofread at US165 $/h Any sender of such material will be considered as to have ac- cepted the above mentionned terms.

1 0

Re: MixMaster fair use
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"loki(a)infonex.com" 22-MAY-1996 03:43:54.45 >It is patent on RSA, which expires in 2000 as I remember. It can be >licensed, but it is not cheap. I don't know how they would handle a free >program which people pay to use. Do they allow non-profit usage? If so, you could send out a new version that supported ecash payments, with an agreement not to use it for profit. I'd call building up a reserve against legal fees a justifiable action for a non-profit organization (if the interest went back into the same account or toward operating the remailer), but IANAL. Could someone who is comment, preferably after looking over the RSA license? -Allen

1 0

Number one story on CNN this hour.
by Alan B. Clegg 17 Dec '03

17 Dec '03

There are 40 million 'attack capable' systems connected to the Internet and over 120 countries have developed or are developing 'attack software'. [BTW, there will be a BUNCH more attacking systems when 'a new protocol is deployed because they are running out of addresses'] Sheesh. -abc \ Alan B. Clegg Just because I can \ Network Technologist does not mean I will. \ gateway.com, inc. \ <http://www.gateway.com/>

4 3

Re: TCM: mafia as a paradigm for cyberspace
by jim bell 17 Dec '03

17 Dec '03

At 10:02 AM 5/22/96 -0500, snow wrote: >On Wed, 22 May 1996, jim bell wrote: >> more, you'd better not be a crook! > > Or turn in too powerful a crook. Since ratting on people can always be anonymous (and especially so after the advent of good encryption and remailers, assuming they survive!) I don't think it'll be a problem to turn in somebody "too powerful." In fact, the AP system will probably spur the simultaneous development of a system to anonymously reward people who identify and locate bad people of all kinds, even if all they do is this. But unlike the current form of rewards, the snitch won't have to reveal himself to anybody. > Law enforcement won't just go away. That's true, but with a caveat: Post-AP, there will be no such thing as "laws" per se. What there will be is an amorphous world of various interests, of people who feel stepped on if you abuse them, etc. Cumulatively, those interests will constitute "laws," but not like a list of hard-and-fast rules. >There will always be those of us who feel that most crimes _don't_ >deserve the Death Penalty, and that some sort of penal system will >continue to be necessary. In your system this would not be possible >because most people would be afraid to turn people in for fear of >reprisal. Unfortunately, I still haven't written up a description of a replacement for the current "criminal justice system" that I anticipated, and another person on a different list independently though of and described in much greater detail: A set of independant, privatized court systems which an agrieved victim can go to (perhaps anonymously) to charge the "defendant." The defendant, however, doesn't have to show up because it's a voluntary system. The punishment will probably be usually a monetary penalty, which if not paid is numerically added to the reward fund against that person. A defendant is motivated to defend himself to prevent such an eventuality. The accuser is, likewise, motivated to use this system because if the defendant is exposed as an unchallenged criminal, potential assassins (and AP organizations) will presumably work cheaper for their deaths if the defendant doesn't pay the fine. > I think that the biggest flaw in your system is the belief that >people will act rationally. Do you think that the Menendez(sp?) brothers >would have hesitated one second in having there parents offed to collect >the inheretance? Did the Menendez family have relatives who might have wanted retribution for the killings? If so, they could have gotten their revenge very cheaply. How about other rich people who didn't want their to be a precedent that two sons could kill their rich parents and get away with it? >> >Note: I don't necessarily think that AP is a good idea. I think >> >that people should do their own dirty work. >> >> In practice, I think this would be comparatively common as well. What >> currently deters such "take the law into your own hands" is the fact that >> police (being, essentially, in the business of protection) don't want you to >> provide for yourself by protecting yourself. They make it hard on people, >> in the same way they did with Bernard Goetz, the guy who shot four muggers >> on the New York city subway system. Once AP gets rid of the police, it will >> be much easier to protect yourself and not risk jail time, etc. > > Umm... I think that the biggest reason that the Police don't want >you taking the law into your own hands is that civilians tend to screw up >badly. They get the wrong target, they don't stop when they should etc. While I can't quote a specific study, I seem to recall a statistic that civilians were actually MORE likely to shoot and/or kill the RIGHT person, as opposed to the wrong person Remember, most police show up substantially after an incident starts, and they don't know who's in the wrong. A person who's in the right KNOWS this already; he's seen the incident from the beginning. Also, you said civilians "don't stop when they should." Who decides when they should stop? Well, more likely than not it's the police, who would prefer to NOT obsolete themselves, and a dead criminal is far less valuable to the police, prosecutors, and jailers than a live one. I'd say that's a conflict of interest, wouldn't you? (a live criminal results in profits to all these groups, plus lawyers, etc.) > The POLICE usually don't have a problem with an individual >protecting themselves (as long as the response fits the crime, killing a >shoplifter is a no no.) It is the court system that frowns on it. It doesn't really matter which group is making it difficult on the civilians, if they are doing it, it makes it harder for the civilians to protect themselves. > Is there the ability to predict a "mild beating" with your system? >or a "severe beating", or simply a killing? Having one level of punishment >is not a very good legal system. AP cannot replace it. It can with the competing, privatized system with punishments based on fines that I described above. >> Superficially, a person might argue that the lack of police would also make >> it easier for the muggers. However, a "professional mugger" would make a >> LOT of enemies, and it wouldn't take long before he's dead. He'd only have >> to be caught once. Any victim of any mugger would be happy to donate to see >> him gone. > > Give me the name of a mugger. Offer to pay money for such information in most inner cities, and you'll get plenty of takers if the reward's high enough. (and can be collected anonymously.) Remember, AP works because certain people with access to information are given the financial motivation to either kill the criminal or simply reveal (possibly anonymously) who he is. The current system uses money rewards only sparsely, and does not publicize them very well. >> Right. Moreover, I believe that governments simply cannot exist as we know >> them under these circumstances. Besides, they won't be necessary. > > See, you have far more faith in humanity than I do. I have plenty of faith that once the centralized, heirarchical political structure is demonished, things will be better. Jim Bell jimbell(a)pacifier.com

1 0

Re: The Crisis with Remailers
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"bruce(a)aracnet.com" "Bruce Baugh" 22-MAY-1996 17:00:33.67 >Pointing people at legitimate uses of anonymity, as various folks have >suggested, is undoubtedly a good idea. Would anyone care to suggest a few >newsgroups where the vast majority of anonymous posts have really good >reasons for being so? While it isn't usage of true cypherpunk remailers, the sexual abuse survivors newsgroup(s) would appear to be a place to start. Some of the groups discussing human rights cases are also a possibility, as is alt.religion.scientology. -Allen

2 1

Alleged abuse of anonymnity/pseudonymnity
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

Someone's forgetting that it would be smart - and should be possible - for the men in question also to be anonymous/pseudonymous. As it was, they could have been, and were evidently too dumb. Edited for fair use. -Allen >Kansas veterinarian extorts husbands on 'married but looking' chat line >Copyright 1996 Nando.net >Copyright 1996 The Associated Press >(May 21, 1996 10:41 p.m. EDT) Men flirted shamelessly with "Rita" in >America Online's "Married But Looking" computer chat line. The typed chatter >often got steamy, and she even offered them provocative photos of herself. >But some men found that "she" was a "he" -- with printed copies of their >explicit exchanges and blackmail on his mind. >Veterinarian Ron Hornbaker, 29, of Shawnee Mission, Kan., pleaded guilty to >extortion Tuesday in a case that some say illustrates problems in the >unpoliced Internet. He faces two years in prison and fines up to $250,000. >"It's an old crime, just new tools," said assistant U.S. Attorney John >McKenzie, who prosecuted the case in U.S. District Court in Rockford, Ill. [...] >In August 1995, Hornbaker created an America Online profile of himself as a >married woman named Rita, authorities say. He would log into "Married But >Looking" or similar chat areas and start engaging male victims in typed >conversation. After a while, he would ask them to go to a more confidential >area called a private chat room "to get to know each other better. >"There Rita would engage each man in erotic conversation, asking the victim >to get her "hot" and offering a sexy photograph. >Hornbaker, meanwhile, stored the conversation and printed out transcripts. >Victims awaiting the nude photograph instead got a threatening letter. In it, >Hornbaker -- now posing as Rita's enraged husband -- said he'd found a >transcript of the conversation between the victim and Rita. >Hornbaker set up boxes at private mail services to handle the bribes, >usually between $500 and $2,000. None of the recipients paid him.

1 0

(Another) alternative to remailer shutdowns
by Leonard Janke 17 Dec '03

17 Dec '03

Instead of having the last remailer in the chain store the plaintext of an encrypted anonymous message, it might be more convenient to have the sender split the message into two messages and send these. The first message would contain random characters, and the second would contain the xor of these random characters with the anonymous message. By themselves, each piece would, of course, be harmless random text, so remailer operators greatest crime would be spamming. If the two pieces were sent through chains with different last remailers, no one operator could be held accountable, and, of course, it would be ridiculous to suggest that one operator could be held responsible for that fact that another sent some random text which happened to be the xor of the random text another had sent with a harassing message. (For instance, the other operator could be trying to frame the first, with the help of the receiver.) It seems to me that the only way to deal with a remailing scheme of this kind would be outlaw anonymous remalining in general. Leonard

1 0

Re: (Fwd) Re: TCM: mafia as a paradigm for cyberspace
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

I will quote an anonymous AP proponent with the initials EAS >>the above sentence I find absolutely abhorrent: it justifies killing, >>not merely because of the effect (the sort of "ends-justifies-the-means" >>argument used by most here), but that in addition it is >>supposedly "ethical". ethical?!?!? for g*d's sakes, promote your >>depraved scheme under any other heading, but do not claim it is >>"ethical" unless you want to further demonstrate how far from >>morality you have twisted your brain. > > In other words, if I'm shooting at you, it's unethical for you to >shoot back? get a clue. I didn't argue against someone shooting at you. I argued against the claim that you should be allowed to shoot anyone in the government because you think the government is corrupt. While I'm not sure whether I approve of Assasination Politics or >not (I'm not sure whether it'd lead to more or less violations of rights than >other possible means of changing the current setup), as I wrote, there is no such thing as a "right" in a society in which people decide who they would like to kill based on their own whims. there are no rights in a socieity in which killing is considered an everyday part of life, period. note I do agree this applies to some forms of government. I do achnowledge the >rightness of self-defense against governmental evildoing. ah, now there's where the silly non-sequitur of AP proponents comes in. "the government is corrupt, therefore we should be able to shoot any government employees we choose". the government is not sticking a gun down your throat this minute, are they? well, why are you seriously contemplating the converse? oh, you say that FIGURATIVELY the government is doing this to you? and you want to respond LITERALLY? I wonder who is the tyrant in this situation? "the government might shoot me if I don't pay my taxes". uhm, can you point out who this actually happened to you? what? you have an example? out of the 250 million people in this country, you actually found one? and you are concerned this will happen to you? well if you keep making a lot of noise, maybe you can achieve what appears to be your wildest fantasy!! AP proponents piss on the english language in their quest for "justice". the ways that AP proponents are twisting language, AP trash is almost worse than much classic government propaganda that has started past wars. "we have rights. we want justice. our rights are being violated. we are acting in self defense." TRASH, TRASH, TRASH To use your >example of Hitler, somehow I think an assasination of him would have been >ethical. I used him as an example of the kind of thinking that "murdering your enemies solves all your problems". yes, that was his point of view, and you inform me that you share it? well, congratualations!! hitler doesn't have too many friends and can use all the sympathy he can get. murdering Hitler would not have solved all the problems of WWII. the problem was militarism that was embodied by many cultures outside of his own, e.g. Japan and Russia. AP proponents believe that: 1. the world is full of people that are part of the problem or part of the solution 2. I can tell precisely the difference 3. I'd like to kill those that are part of the problem. 4. if AP existed, and it appeared there was a way to kill other people without trace, I would go through with it. 5. I have a lot of teachers I hated in my childhood too. I think I will go for them next. possibly not before seeing if they beg for mercy.

1 0

Re: (Fwd) Re: TCM: mafia as a paradigm for cyberspace
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"vznuri(a)netcom.com" "Vladimir Z. Nuri" 22-MAY-1996 15:50:29.93 To: IN%"EALLENSMITH(a)mbcl.rutgers.edu" "E. ALLEN SMITH" CC: IN%"vznuri(a)netcom.com", IN%"cypherpunks(a)toad.com" Subj: RE: (Fwd) Re: TCM: mafia as a paradigm for cyberspace Received: from netcom11.netcom.com by mbcl.rutgers.edu (PMDF #12194) id <01I50FPCUY748WW02X(a)mbcl.rutgers.edu>; Wed, 22 May 1996 15:50 EDT Received: from localhost (vznuri@localhost) by netcom11.netcom.com (8.6.13/Netcom) id MAA29965; Wed, 22 May 1996 12:52:08 -0700 Date: Wed, 22 May 96 12:52:07 -0700 From: "Vladimir Z. Nuri" <vznuri(a)netcom.com> Subject: RE: (Fwd) Re: TCM: mafia as a paradigm for cyberspace In-reply-to: Your message of "Wed, 22 May 96 00:57:00 EDT." <01I4ZKIOEV7G8Y5IL9(a)mbcl.rutgers.edu> To: "E. ALLEN SMITH" <EALLENSMITH(a)mbcl.rutgers.edu> Cc: vznuri(a)netcom.com, cypherpunks(a)toad.com Message-id: <199605221952.MAA29965(a)netcom11.netcom.com> X-Envelope-to: EALLENSMITH >I will quote an anonymous AP proponent with the initials EAS >>>the above sentence I find absolutely abhorrent: it justifies killing, >>>not merely because of the effect (the sort of "ends-justifies-the-means" >>>argument used by most here), but that in addition it is >>>supposedly "ethical". ethical?!?!? for g*d's sakes, promote your >>>depraved scheme under any other heading, but do not claim it is >>>"ethical" unless you want to further demonstrate how far from >>>morality you have twisted your brain. >> >> In other words, if I'm shooting at you, it's unethical for you to >>shoot back? The above is evidence that your accusing anyone of reposting private email is the pot calling the kettle black, LD (unless, as Dr. Vulis said, you're too dumb to be him). That was specifically sent in private email, for the simple reason that I saw no reason to clutter up the list with another response like the 10 others that had been sent. >get a clue. I didn't argue against someone shooting at you. I argued >against the claim that you should be allowed to shoot anyone in >the government because you think the government is corrupt. Nobody, so far as I know, is arguing that one ought to shoot anyone in the government... I'd be in danger if that were the case, given that my current employer is a state university. If someone is in government and is doing something very wrong (although one may disagree on what is wrong, of course), then they're a proper target. >>I do achnowledge the rightness of self-defense against governmental evildoing. >ah, now there's where the silly non-sequitur of AP proponents comes >in. "the government is corrupt, therefore we should be able to shoot >any government employees we choose". the government is not sticking >a gun down your throat this minute, are they? well, why are you >seriously contemplating the converse? oh, you say that FIGURATIVELY >the government is doing this to you? and you want to respond >LITERALLY? I wonder who is the tyrant in this situation? If the only workable method of self-defense is to kill the person, then that's a justifiable means of self-defense. Hopefully, other means of removal of those in government who do what is wrong is possible; I do my best to work for this. But if it isn't, I'll support AP as an alternative. >>To use your >>example of Hitler, somehow I think an assasination of him would have been >>ethical. >I used him as an example of the kind of thinking that "murdering your >enemies solves all your problems". yes, that was his point of view, and >you inform me that you share it? well, congratualations!! hitler >doesn't have too many friends and can use all the sympathy he can get. All your problems? No. But leaving it out as a possible partial solution is irrational. >murdering Hitler would not have >solved all the problems of WWII. the problem was militarism that >was embodied by many cultures outside of his own, e.g. Japan and >Russia. Executing Hitler would have saved a lot of lives, even if it didn't stop the war entirely. Germany without him would, more than likely, not have held together nearly as long as it did. >AP proponents believe that: >1. the world is full of people that are part of the problem or part >of the solution >2. I can tell precisely the difference No, I don't think that I can tell precisely the difference. But it appears possible that I'd make less mistakes than the current government does, even considering only the cases in which they do kill people (e.g., shootouts with drug dealers et al). >3. I'd like to kill those that are part of the problem. If that's the only way that works, yes. >4. if AP existed, and it appeared there was a way to kill other people >without trace, I would go through with it. Again, if that's the only way that works, yes. >5. I have a lot of teachers I hated in my childhood too. I think I >will go for them next. possibly not before seeing if they beg for mercy. I invite you to look at the psychological defense mechanism known as projection, preferably along with a trained psychiatrist or clinical psychologist in inpatient therapy. -Allen

2 1

Re: An alternative to remailer shutdowns
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"unicorn(a)schloss.li" "Black Unicorn" 22-MAY-1996 19:03:58.98 >On Tue, 21 May 1996, Ben Holiday wrote: >> On Tue, 21 May 1996, Daniel R. Oelke wrote: >>> The second is to simply include the >>> consent-code along with the encrypted peice of mail and a legal notice >>> stating that decryption of the mail constitutes your consent to receive >>> the mail, as well as your agreement to hold the remailer-operator harmless >> >> By reduction - you could just do a rot13 on the message and >> append the "legal notice". If all the information for decoding >> a message is present in that message, is a different encoding >> mechanism really any different from straight ASCII text? >> (i.e. Netscape 9.13 might have auto decoding built it....) >> Then, the user doesn't do anything "extra" - does this invalidate >> the notice? >A person has notice of a fact if he knows the fact, has reason to know it, >should know it, or has been given notification of it. Restatement, >Second, Agency section 9. >The important issue here is what constitutes constructive or implied >notice (the second example above). >Constructive notice exists where a party could have discovered a fact by >proper diligence and where the situation casts a duty on him to inquire >into the matter. >A person who has _actual_ notice of circumstances which would set of the >"alarm bells" of a prudent person has constructive notice of the issue >itself where a notice clause was available and easily referenced. >See F.P. Baugh, Inc. v. Little Lake Lumber Co., 297 F.2d 692, 696. >Also comes the question what notice is adequate? Notice reasonably >calculated, in all circumstances, to apprise all interested parties of >actionm and opportunity to present their objections, says U.S. v San Juan >Lumber Co., 313 F.Supp. 703, 709. >I'm not going to discuss what constitutes a legal agreement here for the >purposes of waiving rights to hold the remailer operater harmless. These >are traditionally unnegotiated agreements that courts are not likely to >want to enforce. (Back of a ski lift ticket, notice that the garage is >not responsible for theft). Umm... the RSA licensing agreement isn't exactly a negotiated contract. What makes the difference between the contract in question and the RSA licensing agreement (to use it as an example)? >If a court feels that the remailer operator is being negligent or some >such, a notice like you are talking about is not likely to be very >effective. Part of this depends on negligent in what sense. If, due to the message being encrypted, the remailer operator couldn't read it to see if it was copyright-violating anyway, would he/she be negligent to send it on? >I find that making the user decrypt the message as acceptance of the mail >is clever, but what exactly does it accomplish? The user can still have >his copyrights violated in the text, what does it matter that he did or >did not accept the mailing? The primary use of the contract is to avoid complaints from the user for "harrassing" email, not to avoid copyright problems. I'm not sure if there is anything that could be done to avoid the copyright problems, aside from the disposable output addresses with multiple remailers using them. (One possible problem with these is that it could be argued that the remailer operators sending to such addresses can read over the mail before encrypting it to the front end and check to see if it's a copyright violation. However, they would appear to be covered by the exemptions that should be in the copyright law, namely for ISPs - if they aren't covered, then the Net is dead anyway.) One method around this would be for the initial user to specify the output address - or, preferably, input address that outputted to multiple different output addresses - to use, and encrypt the message for that addresss. However, this would require common knowledge of the input addresses, which could lead to their being shut down quickly or the owner being held liable. One could have a group of input/output providers with a common public/private key for the initial user to use for the final encryption, although then you'd need to be careful about who you let into this group. -Allen

2 1

Re: The Crisis with Remailers
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

I just realized that I haven't been making something clear. The ephemeral endpoints (to use Lance Cottrell's phrase) will be identified when they're used. The purpose of concealing from all but a trusted group (remailer operators) their address (at first) is to slow that identification as much as possible. If it takes someone (NSA or whatever) repeatedly sending messages through to discover each new address, this will take longer (and make it harder for traffic analysis, especially by other parties) than if the output end's address were immediately made public knowledge. This can be helped by the remailer(s) sending to the output address only accepting such mail from another remailer. -Allen

1 0

Re: FTC online workshop on privacy
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

It's unsurprising that some of the same groups backing the CDA are backing this, since they used danger to children as an excuse for it. (A rather transparent one, given the actions vs Compuserve). I am disappointed in EPIC for cooperating with them. From: IN%"declan+(a)CMU.EDU" "Declan B. McCullagh" 22-MAY-1996 17:46:10.71 >Excerpts from internet.cypherpunks: 22-May-96 Re: FTC online workshop on >.. by Declan McCullagh(a)CMU.EDU >> The legislation being introduced at 10:30 am will restrict selling >> mailing lists with childrens' names and other identifying info on them, >> including email lists. Another attempt to regulate the net, or a good >> thing? >Whoops. I should have said the press conference happened at 10:30 am. >The bill will be introduced in both houses later this week. >Interesting press conference. Enough is Enough! took quite a bit of time >to rant about the dangers of the Internet. Pedophiles, chat rooms, >illegal pornography. >You get the idea. Quite. -Allen

2 1

Re: An alternative to remailer shutdowns (fwd)
by jim bell 17 Dec '03

17 Dec '03

At 12:40 PM 5/22/96 -0600, David Rosoff wrote: >>But even "knowingly" needs to be carefully defined. A remailer operator >>today KNOWS that his system COULD be used for illegal activities; he merely >>doesn't know that they are, currently. I think that the definition should >>be so narrow that it is impossible for a third party (or the government >>itself) to incriminate the remailer operator by having his system forward >>arguably illegal or copyright-violating material. >> >> >>Jim Bell >>jimbell(a)pacifier.com > >Can the same sort of standards as per the U.S. CDA be applied? The first >draft of the >CDA would have held ISP's responsible for, e.g., porn transmitted using their >services. Isn't this the same sort of thing - that is, that remailer >operators provide a service, and they cannot be held responsible for people who abuse that >service? I think that this line of thought is reasonable. "Reasonable," yes. But remailers provide a service that governments won't consider politically popular; ISP's provide a nominally popular service. The government will find a way to interpret the actions of a remailer entirely differnetly than that of an ISP. Sigh. Jim Bell jimbell(a)pacifier.com

1 0

Re: PROPOSAL
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"unicorn(a)schloss.li" "Black Unicorn" 22-MAY-1996 20:48:51.42 >Motion: To create the alt.politics.assassination.politics newsgroup and >the "AP" mailing list so as to clear the meaningless traffic (for which I >am significantly responsible) out of this forum. >Any seconds? So long as the AP list is specifically for debates about the ethics of such, seconded. If it would remove from cypherpunks discussion of implementation or of social consequences, that wouldn't be good, since the implementation of this is definitely cypherpunks material. -Allen

1 0

Re: Is Chaum's System Traceable or Untraceable?
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"iang(a)cs.berkeley.edu" 22-MAY-1996 14:51:29.42 >In the "normal" protocol, the payee has to go online. In the "anon" protocol, >the payer has to go online. Since you don't want to go online when you >walk into a shop, you can pay the shop with the "normal" protocol, and >the shop gives you change with the "anon" protocol. >That way, you never need to go online, and your identity is never compromised. However, the shop's still is, although the bank might not be able to determine as much about how much income is coming in. OTOH, we're talking about a physical shop situation; I'm not sure how critical it is to have shop anonymnity with payor cooperation for this, since the payor can break it anyway. -Allen

2 1

Re: An alternative to remailer shutdowns
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"unicorn(a)schloss.li" "Black Unicorn" 22-MAY-1996 18:40:57.71 >On Tue, 21 May 1996, Andrew Loewenstern wrote: >> IANAL, but I have one, and he said (a couple of years ago) that these >> shrinkwrap contracts are practically worthless without a signature. At >> least this was how things were being handled in some districts. Anyone >> care to comment? >I concur. Those (other) lawyers who I have read on the subject would also concur. >> crypto relevance: Can RSADSI __really__ enforce the silly "thou shalt not >> call certain functions" restrictions in their 'license'? I doubt it, but I >> would love for someone to prove me wrong. >This is closer. You're asked to accept the terms of the license or return >the product. It's a stronger issue and more likely to be upheld. Would this be extensible to the remailer question by saying "agree to hold us blameless for the contents of this mail or don't mail it back to us for decoding"? Admittedly, this might not get around the problem of overly long mail used for bombing, but with Mixmaster you'd get such a letter for each section as I understand it. -Allen

1 0

RE: CDT Policy Post 2.20 - Clinton Administration Floats Clipper III Draft
by Blanc Weber 17 Dec '03

17 Dec '03

>From the Proposal: "To participate in the network a user needs a public key certificate signed by a CA [Certification Authority] which 'binds' the user's identity to their public key. One condition of obtaining a certificate is that sufficient information (e.g., private keys or other information as appropriate) has been escrowed with a certified escrow authority to allow access to a user's data or communications." ...................................................................... Along with the escrow requirement, I keep seeing in here somewhere the eventuality of a tie being established between public keys and a national identifying scheme, possibly to update and replace the present Social Security system. .. Blanc

1 0

PROTOCOL: Encrypted Open Books
by tcmay＠got.net 17 Dec '03

17 Dec '03

>Date: Mon, 16 Aug 93 22:25:47 PDT >To: cypherpunks(a)toad.com >Subject: PROTOCOL: Encrypted Open Books >From: hfinney(a)shell.portal.com >Status: OR > >Eric had some good ideas in his protocol for verifying anonymous bank >deposits. One thing wasn't clear to me: what if the bank creates >a fake account? > >It would seem that the bank could explain away a sudden decrease in its >asset reserves (money that the bank officers actually spent on mistresses >and drugs) by creating a fake anonymous account which made a large with- >drawal. The books would still balance. > >It wasn't clear to me in Eric's protocol whether it would be expected that >the identity of accounts which made such withdrawals would be revealed. >Doing so would seem to go against the purpose of the digital bank. But >without that ability it would seem that fake accounts could cover up any >amount of mismanagement. > >Hal Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Layman's explanation for limits on escrowed encryption ...
by Ernest Hua 17 Dec '03

17 Dec '03

Could someone with some knowledge of NSA/DoS/FBI intentions please explain why key length limitations are necessary for escrowed encryption? Please reply by E-Mail. Thanks! Ern

3 2

Re: PROTOCOL: Encrypted Open Books
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:45 AM 5/23/96, David Wagner wrote: >Apologies for replying to a reposted article; I wasn't subscribed when >the (very interesting!) open books protocol was originall proposed. ... >Did I miss an important part of the protocol, or does some extra >mechanism need to be added to counter this threat? I only forwarded the original article, not any of the discussion which followed. Inasmuch as the archives at hks don't appear to be coming back anytime soon (the March 18th message said "a few days"), I'll forward to the list the followup articles by Hal Finney and Eric Hughes. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: An alternative to remailer shutdowns
by minow＠apple.com 17 Dec '03

17 Dec '03

Black Unicorn <unicorn(a)schloss.li> comments on the responsiblity of prudent persons (in, I presume, the context of threating e-mail sent through an anonymous remailier). I'm still perplexed: what can a "prudent" remailer operator do if a threatening e-mail was sent through a remailer under one or more of the following conditions: -- The remailer operator is legally enjoined from reading messages transversing his system. (For example, the remailer is subject to data privacy laws.) -- The message was encrypted using the intended recipient's public key. (This means that, without access to the private key, the operator has no mechanism to examine the e-mail.) Confused in Cupertino. Martin Minow minow(a)apple.com

2 1

Re: FTC online workshop on privacy
by shabbir＠vtw.org 17 Dec '03

17 Dec '03

There's actually an interesting parallel here. If you look at the Dworkin "ban pornography because speech is action" crowd, they often end up on the same side of things as the Christian Coalition "ban porn because it drives you to ungodly acts" crowd. They both happily support legislation that would ban such images. The left and the right move so far off the edges of the scales that they come around and meet each other on the same side of the issue. -Shabbir J. Safdar * Online Representative * Voters Telecomm. Watch (VTW) http://www.vtw.org/ * Defending Your Rights In Cyberspace "E. ALLEN SMITH" writes: > It's unsurprising that some of the same groups backing the CDA are >backing this, since they used danger to children as an excuse for it. (A >rather transparent one, given the actions vs Compuserve). I am disappointed in >EPIC for cooperating with them. > >From: IN%"declan+(a)CMU.EDU" "Declan B. McCullagh" 22-MAY-1996 17:46:10.71 > >>Excerpts from internet.cypherpunks: 22-May-96 Re: FTC online workshop on >>.. by Declan McCullagh(a)CMU.EDU >>> The legislation being introduced at 10:30 am will restrict selling >>> mailing lists with childrens' names and other identifying info on them, >>> including email lists. Another attempt to regulate the net, or a good >>> thing? > >>Whoops. I should have said the press conference happened at 10:30 am. >>The bill will be introduced in both houses later this week. > >>Interesting press conference. Enough is Enough! took quite a bit of time >>to rant about the dangers of the Internet. Pedophiles, chat rooms, >>illegal pornography. > >>You get the idea. > > Quite. > -Allen

3 2

INFO: Transcript of Sen. Leahy's RealAudio chat now available! (5/22/96)
by Voters Telecommunications Watch 17 Dec '03

17 Dec '03

============================================================================= ____ _ _ _ / ___|_ __ _ _ _ __ | |_ ___ | \ | | _____ _____ | | | '__| | | | '_ \| __/ _ \ _____| \| |/ _ \ \ /\ / / __| | |___| | | |_| | |_) | || (_) |_____| |\ | __/\ V V /\__ \ \____|_| \__, | .__/ \__\___/ |_| \_|\___| \_/\_/ |___/ |___/|_| REALAUDIO TRANSCRIPTS OF LEAHY'S WIREDSIDE CHAT AVAILABLE CLIPPER III RESOURCES AVAILABLE REP. RICK WHITE (R-WA) SCHEDULED FOR HOTWIRED CHAT 6/5/96 9-10PM EST Date: May 22, 1996 URL:http://www.crypto.com/ crypto-news(a)panix.com If you redistribute this, please do so in its entirety, with the banner intact. ----------------------------------------------------------------------------- Table of Contents News How to receive crypto-news ----------------------------------------------------------------------------- NEWS Rave reviews of Senator Leahy's appearance on HotWired's WiredSide chat are coming already. With this appearance, the gentleman from Vermont proves once again that he knows net.politics on a personal level, and can understands the subtleties that we assume many in Congress are just learning. If you missed Sen. Leahy's appearance, arranged by HotWired, the Center for Democracy and Technology (CDT), and the Voters Telecommunications Watch (VTW), you can still hear the Realaudio transcript from the front page at http://www.crypto.com/ A new Clipper III section has been added to www.crypto.com, with pointers to the online version of the White House proposal and the initial analyses from EPIC, CDT, and John Gilmore of the EFF. DON'T FORGET! Representative Rick White (R-WA) will be on HotWired Wednesday June 5th at 9pm EST at http://www.hotwired.com/wiredside/ You can tune in and listen to the chat with the RealAudio software (http://www.realaudio.com) You can ask questions of the Representative through a moderator and get real, immediate responses. Rep. White is part of the new breed of legislators leading Congress to make better net policy through his leadership in the Internet Caucus, a vanguard group of legislators who have vowed to provide sound leadership and advice to other members of Congress in the area of net.policy. ----------------------------------------------------------------------------- HOW TO RECEIVE CRYPTO-NEWS To subscribe to crypto-news, sign up from our WWW page (http://www.crypto.com) or send mail to majordomo(a)panix.com with "subscribe crypto-news" in the body of the message. ----------------------------------------------------------------------------- End crypto-news =============================================================================

1 0

PROTOCOL: Encrypted open books
by tcmay＠got.net 17 Dec '03

17 Dec '03

>Date: Thu, 26 Aug 93 11:28:14 -0700 >From: Eric Hughes <hughes(a)soda.berkeley.edu> >To: cypherpunks(a)toad.com >Subject: PROTOCOL: Encrypted open books >Status: OR > >Note: I started this reply last week; I've decided to post what I >know, since I don't have a solution and I've run out of simple ideas >for now. > >Hal' criticism that (real) money could leak out of the system is >correct. The problem is that while the books would still balance, >i.e. sum to zero, some fake depositor would have a negative balance, >the net result of taking out more money than you put in. Negative >numbers just aren't allowed in double-entry bookkeeping, but they were >allowed in the first protocol set. > >The first part of the solution is to allow no private accounts on the >left hand (asset) side of the ledger, in other words, no anonymous >loans. A protocol for doing anonymous loans could be invented, but >since the first problem is merely to run a money exchange and not more >complicated financial services, this is acceptable. Most of the money >that left the S&L's was by corrupt loan practices, so I don't consider >this omission a particularly glaring one right now. > >Therefore all the private accounts must be on the right hand side, >that is, they are all liabilities. In layman's terms, the bank owes >you; should you ask for your money, they have to give it to you. If >we can verify that each of these accounts never goes negative, then we >can be certain that if the books balance, that the amounts of money in >each account are accurate. > >Consider this. If money was transferred from your account to another >one, that transaction shows up in the public encrypted transaction >record. If you have due diligence over this record, you can assertain >that no transaction was performed against your will. This case >corresponds to a debit and credit against two customer accounts, >decreasing one and increasing the other. > >Another way that money might end up in a fake account if it were >credited with assets. A debit to an asset increase its value and the >credit to the account increases that value. This is the case of a >deposit; the bank gets cash (+asset) and credits someone's account >(+account). Now if they want to give someone money this way, they >have to do so by increasing the assets somehow; in other words, they >money has to come from somewhere. It didn't come from any of the >customers because they've already verified that. It didn't magically >appear from one of the other asset accounts because these are all >publically audited. > >In summary, we need to ensure that all accounts have positive balance. >Public accounts can be revealed and seen to be positive. Private >accounts need a cryptographic assurance. > >A private account starts off at zero. This can be publically >revealed. Then to the encrypted transaction log and the public cyclic >balances we add publication of the private balances in encrypted form >that allows us to verify to the blinded balance is positive. This >balance is verifiably linked to previous cyclic balances via the >transaction log. It is therefore linked all the way back to the >beginning balance which was zero. > >Consider all the transaction triples for which the first element is >equal to the private account in question, since the account was >opened. Take a product of all of the second elements and a product of >all the third elements. It is clear that these products can be >calculated inductively from the previous cyclic products and the >activity in this cycle. > >The products on second and third elements are equal to > > g^( Sum x_i,j,t + Sum r_i,j,t ), h^( Sum r_i,j,t ) > >where I've added a time index by cycle which was implicit before. The >notation for the inductive calculation is different, of course, and >also obscures the underlying invariant. > >What we want is a certificate that Sum x_i,j,t is positive. Here it >gets a bit hairy. There are likely other solutions to this technical >requirement; here is the one I thought up yesterday and today. > >I thought I had an idea with promise on how to create such >certificates using quadratic residuosity, but it doesn't work. I'm >still thinking about it; this certificate doesn't seem impossible to >create, but the standard ideas that I know about in algebraic protocol >design don't seem to work. > >If anybody wants to work on this technical point off-line with me, >send me mail. The math involved is advanced enough that I'd prefer to >post summaries of work rather than all the detailed discussion. > >Another non-technical attack on the problem is to require periodic >bank holidays, where all private balances will be revealed to be zero >(preferably), or whatever is actually in the account. This doesn't >prevent owner fraud, but does put an upper bound on the time in which >to perpetrate it. > >Eric

1 0

re: "Very Famous Reporter"
by Deranged Mutant 17 Dec '03

17 Dec '03

On 21 May 96 at 10:06, Robert Hettinga wrote: > In the meantime, it appears that I have egg on my face, as no story has > emerged... > > By the way, did I say it was a rumor? ;-). Likely the Very Famous Reporter (tm) misheard something about MD5, confused it with DSS (and possibly even something to do with PGP), though (s)he had a hot story, spoke to some folx, and it fizzled. Nah. Just a rumor. Rob. --- No-frills sig. Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

No Subject
by unknown＠example.com 17 Dec '03

17 Dec '03

The answer to information is more information.

2 1

Re: PROTOCOL: Encrypted Open Books
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 05:45 PM 5/22/96 -0700, David Wagner wrote: > a fake account, without a real >customer, and fakes a transfer into that account, pocketing the >money that should have gone into that account? Then the total indebtedness of the bank will go up, but its total assets will not. If the bank does this, then there is no point. If an employee does this, then the loss will show up on the books. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: Long-Lived Remailers
by David E. Smith 17 Dec '03

17 Dec '03

At 20:40 22 May 96 NSA operative Loren James Rittle <rittle(a)comm.mot.com> wrote... (This was originally me. Wow.) > >:: > >Remailers-To-Chain: 7 > >Remailers-To-Avoid: remailer(a)nsa.gov > >Final-Destination: tcmay(a)got.net > > This will not work. The original sender must pick the path himself, > if maximum encryption to hide the final destination is to be used. > The properly used cypherpunks-style remailer network provides that as > long as even one remailer in the chain is trustworthy, your secret is > safe. Under your scheme, if the first remailer is untrustworthy, > everything is blown. This is because unless the original sender > pick's the path (or at least the last hop explicitly), the final > destination and message must be available to each hop. Well, I freely admit that it was just a notion that sort of came to me whilst at the terminal, with a beer on the desk. The sort of thing that often impairs my already-limited judgment :) Although... is this a possible way to lessen remailer-operator liability? If it is known that every remailer along the way chooses another remailer at random, it might become less likely to hold any given last-hop remailer liable for the CO$ documents spewed forth from it. It would become necessary to keep track of the final destination and to decrypt at every stage, unless there's a set Last-Hop: header; but that would defeat the whole purpose. Having traffic going all over the place randomly might be useful to defeat traffic analysis, though. I think I've just argued myself out of the whole idea. Never mind :) dave ObCPList: Have I been killfiled yet? If you don't see this message, send me a note :) ---- David Smith Box 324 Cape Girardeau MO USA 63702 http://www.prairienet.org/~dsmith dsmith(a)prairienet.org Reality is only for those lacking in true imagination... Send mail w/'send pgp-key' in subject for PGP public key

1 0

Re: FTC online workshop on privacy
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"declan+(a)CMU.EDU" "Declan B. McCullagh" 22-MAY-1996 19:58:03.69 >Excerpts from cypherpunks: 22-May-96 Re: FTC online workshop on .. by "E. ALLEN SMITH"@ocelot. >> It's unsurprising that some of the same groups backing the CDA are >> backing this, since they used danger to children as an excuse for it. (A >> rather transparent one, given the actions vs Compuserve). I am >> disappointed in EPIC for cooperating with them. >You shouldn't be, and I should have been more clear. There is a broad >coalition of groups supporting this legislation, including (from memory) >the Kids off Lists! project, Center for Media Education, and Consumer >Federation of America. This appears to be another liberal (e.g., EPIC) vs libertarian difference. Liberals say we've got to have laws to protect the children, such as via keeping them from _email_ lists. Libertarians say it's the job of the parents (and the police, for non-anarchists) to protect the children. Yes, such lists can be misused (although I see no more reason to say the email ones can be truly misused than to say the CDA was justified). So can, say, cryptography. -Allen

1 0

NOISE.SYS and Win95?
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

I've just got a Pentium and Win95 so I can try to get NOISE.SYS working for both. It seems to crash in Win'95 though... not sure why yet: has anybody used it or had problems with it on Win95/DOS7? (I've gotten it loaded using a device driver loading util from the command line, but the RANDOM$ device produces only one byte and a string of zeros... not good at all. Very bad, actually. URANDOM$ seems to work fine though.)

1 0

Re: An alternative to remailer shutdowns
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"minow(a)apple.com" 23-MAY-1996 01:57:15.69 >-- The remailer operator is legally enjoined from reading messages > transversing his system. (For example, the remailer is subject to > data privacy laws.) I suspect that it is rather unlikely that the court would find a remailer operator covered by those laws. >-- The message was encrypted using the intended recipient's public key. > (This means that, without access to the private key, the operator > has no mechanism to examine the e-mail.) This is related to the old ISP liability question, although amplified by being not only a practical impossibility to filter but close to a physical impossibility also. (Please note the "close" part.) I am not sure if a judge could find any grounds to slap a remailer operator with contempt of court in such a case, but if it were so, Uni has pointed out that it's rather difficult to override a judge in such a matter, even based on plain facts. -Allen

1 0

Re: FTC online workshop on privacy
by Deranged Mutant 17 Dec '03

17 Dec '03

On 22 May 96 at 11:16, Rich Graves wrote: > I'd have to see the bill, but I think it's a good general idea, provided > there's the caveats KNOWINGLY and WITHOUT THEIR [parent/guardian's] > KNOWLEDGE. As much as I hate direct marketers, I don't want them subject > to malicious and arbitrary prosecution because one address out of > thousands happens to belong to a kid. When I was on the FTC privacy list a while back there were more details about that. Companies would set of very commercial web sites oriented towards kids, for the main purpose of getting the kids to give information about themselves. So imagine if somebody set up a Barney fan page with all sorts of links and goodies but with the encouragement (if not requirement for access) to fill out personal information, even personal info about family members. Ok... maybe that's within one's right. But while (most) adults would be suspicious, it's not necessarily so with some children... (who'd give out parent's CC#'s if they knew them). Teaching kids basic privacy issues is a whole lot better than legislation. (Caveat emptor aside, fraud and cons are still illegal...). I haven't seen the legislation so I won't rant for or against it (at least not on the list) for now. Rob. --- No-frills sig. Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0