December 2003 - cypherpunks-legacy

Re: Something of Interest
by John Young 17 Dec '03

17 Dec '03

JM provided IRS Inpsector message Number 5, which is earlier than the four I posted a while ago: Return-Path: <owner-pdg(a)ifi.uio.no> Date: Thu, 17 Jul 1997 12:25:26 -0400 From: IRS Inspection <irsnwpr(a)net.insp.irs.gov> Message-Id: <199707171625.MAA02707(a)net.insp.irs.gov> Starting with these 5 we'll put the full message headers we get at: http://jya.com/irs-header.txt And post here the brief version. JM also provided Treasury's mail echangers: >Checking DNS for MX records for net.insp.irs.gov >indicate (as shown below) three mail exchangers: > >QUESTIONS: > net.insp.irs.gov, type = MX, class = IN > >ANSWERS: > > -> net.insp.irs.gov > MX preference = 20, mail exchanger = tcs-gateway1.treas.gov > ttl = 86400 (1 day) > > -> net.insp.irs.gov > MX preference = 30, mail exchanger = gotcha.treas.gov > ttl = 86400 (1 day) > > -> net.insp.irs.gov > MX preference = 10, mail exchanger = tcs-gateway2.treas.gov > ttl = 86400 (1 day)

1 0

Brands cash
by Hal 17 Dec '03

17 Dec '03

Last year, Stefan Brands announced that he had come up with improved versions of Chaumian cash and credentialling protocols which were smaller, faster, and had provable correctness. He still hasn't gone public with them, but I thought I'd write up an introduction to his earlier work so people can see what direction things are going. IMO, if he plays his cards right his technology could be the foundation for electronic commerce. OTOH if he is too greedy he'll be bypassed. It appears he is seeking patents on everything, a necessary step for commercial interest, but we'll see how he markets it. This is based on Brands' "An Efficient Off-line Electronic Cash System Based on the Representation Problem", which was available on the net for a while before he took it off. I'm not sure what its status is now. Perhaps he removed it pending release of his improved version. Brands' work is based on discrete logs rather than RSA. The discrete logarithm problem is the "other" widely-used foundation for crypto primitives, underlying Diffie-Hellman key exchange, ElGamal, Schnorr, and DSS signatures, and many others. I'll do a brief intro to using discrete logs and then get to Brands' cash. Discrete-log based cryptosystems generally work with a modulus n which is prime, along with a "generator" g < n such that the series g^0, g^1, g^2, ... , includes all values from 1 to n-1. It is pretty straightforward to find such n's and g's. It is easy to compute g^x for any x, but intractable to calculate x given just g^x. (Notation: ^ represents exponentiation, and all math is implicitly mod n). x is called the discrete log (to the base g) of g^x and the difficulty of solving this is the foundation of these protocols. Note that unlike RSA, where taking eth roots is hard for everyone except the owner of the secret key, taking discrete logs is hard for everyone, without exception. There is no trap door here. Diffie-Hellman key exchange As an introduction, consider Diffie-Hellman key exchange. In this protocol, two people, Alice and Bob, want to publicly exchange data and end up with a secret value which only they know. 1. Alice chooses a random x and sends GX = g^x to Bob. Bob chooses a random y and sends GY = g^y to Alice. 2. Alice calculates GY^x, which is g^(y*x). Bob calculates GX^y, which is g^(x*y). 3. These are equal, so they use them as their shared secret value. An observer sees only GX and GY, and without knowledge of x and y is unable to calculate g^(x*y). DH-based identification protocol An identification protocol allows someone to prove that he is really who he claims. In this context, the prover Paul will convince the verifier Vicki that he knows the secret key corresponding to Paul's established public key. In this and the following systems, Paul has a secret key x<n, and a public key GX = g^x. Again, note that it is impossible to go from GX to x assuming discrete logs are hard. 1. Vicki chooses a random y and sends GY = g^y to Paul. 2. Paul calculates GYX = GY^x = g^(y*x) and sends that back to Vicki. 3. Vicki confirms that GYX = GX^y; both should be g^(x*y). This is like DH except that Paul exposes the secret information he calculated, and only he could have done this. One problem with this protocol is that perhaps Paul calculating xth powers for Vicki might reveal something about x. The next protocol solves that: Schnorr identification protocol This comes from Schnorr, Journal of Cryptology, v4 n3, 1991. 1. Paul chooses a random w and sends GW = g^w to Vicki. 2. Vicki chooses a random c and sends it to Paul. 3. Paul calculates r = cx+w and sends that to Vicki. 4. Vicki confirms that g^r = (GX^c)*GW. Both should be g^(cx+w). The extra step of Paul sending g^w for a random w makes this protocol reveal less information about x. For any one run of the protocol, there is some value of w which would produce a given r for any x, so knowing r and c doesn't tell you anything about x. Chaum discrete-log interactive signature protocol This is the basic signature used by Brands, but I believe it comes from Chaum&Pederson, Crypto 92. It is an extension of the previous protocol to allow signatures. A digital signature on a value m is a certificate which could only have been produced by the owner of a particular public key. In this protocol, a message m (<n) is being signed. The basic signature value is MX = m^x, which Paul sends. By itself, though, this signature is not obviously correct. Without knowing x, Paul's secret key, there is no way to confirm it. So, Vicki must engage in an interactive protocol with Paul in which he will prove that MX is equal to m^x. It is very similar to the previous one: 1. Paul chooses a random w and sends GW = g^w and MW = m^w to Vicki. 2. Vicki chooses a random c and sends it to Paul. 3. Paul calculates r = cx+w and sends that to Vicki. 4. Vicki confirms that g^r = (GX^c)*GW. Both should be g^(cx+w). She also confirms that m^r = (MX^c)*MW. Both should be m^(cx+w). This is the previous protocol plus one extra number, MW. The fact that the same r is used for both m and g shows that m was raised to the same power as g in creating MX vs GX. Chaum Discrete-Log Signature Protocol Interactive signature protocols may have advantages in some circumstances, but in most cases we would prefer a signature which can be checked without help from Paul. There is a simple trick which can turn most interactive signature protocols into regular signatures. The idea is that instead of c being chosen at random by Vicki, it is calculated by using a cryptographically strong hash function (such as MD4, MD5, or DHS) on the values which are publicly known by that point in the protocol: m, MX, GW and MW. Since both Paul and Vicki could calculate the hash, there is no need for Vicki to send c to Paul. Instead, he can do everything in one step. This leads to: 1. Paul calculates MX = m^x. He then chooses a random w and calculates GW = g^w and MW = m^w. He then calculates c = hash(m,MX,GW,MW). He calculates r = cx+w, and sends MX, GW, MW and r to Vicki. The tuple (MX,GW,MW,r) is the signature on m. 2. Vicki calculates c = hash(m,MX,GW,MW). She then verifies, as before, that g^r = (GX^c)*GW. Both should be g^(cx+w). She also confirms that m^r = (MX^c)*MW. Both should be m^(cx+w). This protocol is not interactive. Once Paul has completed step 1, the signature can be published and anyone can play Vicki's part in checking it. Such a signature is functionally similar to the PGP signatures we see on messages on the net, but as you can see the mathematics behind it is completely different. OK, that's all for now. Next comes the good part: blind signatures. Unlike Chaum's original blind signatures, which are the foundation of his cash system, the discrete-log blind signatures have "restrictive blinding", where there are limitations on what kinds of changes can be made to the number being signed during the blinding process. This allows Brands to dispense with the clumsy cut-and-choose techniques Chaum was forced to use in his advanced cash and credential systems. I'll write more about this later today or tomorrow. Hal

1 3

Another Denning's view
by Pat Farrell 17 Dec '03

17 Dec '03

C'punks: There is another Professor Denning who is chair of a CS department in the Washington DC area. Here is a position paper that was published in a packet distributed at the 1992 Computers, Freedom, and Privacy conference (CFP-2) Washington DC. It is interesting to contrast this with the support for GAK that the other Prof. Denning supported publicly. Of course, this is dated, and the positions held may no longer be current. BTW: does anyone know the RSA keylength used in Lotus Notes? ===============begin quoted material================ From: pjd(a)cs.gmu.edu (Peter J. Denning) Subject: How's this? To: denning(a)cs.georgetown.edu, hoffman(a)seas.gwu.edu Date: Tue, 21 Jan 92, 10:41:46 EST PUBLIC POLICY FOR THE 21ST CENTURY A position statement Peter J. Denning DRAFT 1/22/92 To plan for the 21st century, must begin with an understanding of the current clearing in which we live and work and then anticipate the emerging clearing. Our public policy must be appropriate to the times. The clearing is a metaphor for the space of assumptions, agreements, and traditions in which a community of people live and act. The name recalls a clearing in a forest: a space among dense trees with more light and with more freedom of action than elsewhere in the forest, a space to dwell in and chart a course to other parts of the forest. The clearing is not fixed: it shifts as the inhabitants and other influences change the environmental conditions. Starting around 1850, people of many countries looked to their governments to regulate commerce, erase inequality, and build societies of better human beings. For over a hundred years, many people from peasents to intellectuals had faith that strong governments would bring them a better life. This faith was part of the clearing in which communist governments flourished. Although the United States took an anticommunist stand, the same faith fostered a strong government that promised salvation by great national programs including Social Security, Welfare, Food Stamps, the War on Poverty, and the Great Society. This faith is now shattered. People no longer trust that Powerful Government can deliver a better life. The dramatic collapse of communism in Europe and the Soviet Union illustrates this, as does the growing disillusionment of the American people with federal, state, and local governments. Disillusionment does not stop people from demanding that government provide more, but they now have serious doubts that it can or will. But the poor track record of Powerful Governments is not the only reason for the shift in the clearing. Information technology has accelerated the process. Communications that took weeks in the last century now take fractions of a second. Business success depends on what happens around the globee, not on local conditions. Radio, TV, telephone, fax, and now email are so common worldwide that not even a Powerful Government can control what information its citizens have. Because the space of opportunity for people to engage in transactions has been so enormously enlarged in the past decade, faith in marketplace democracies is on the rise worldwide. Correspondingly, faith in central management mechanisms is on the decline. The shift of the clearing brings with it a shift of the power of institutions. Government institutions tend to try to hold on to their power by regulatory coercion to enforce the old ways. This can produce big tensions which if not alleviated can produce breakage. Nowhere can this be seen more clearly than in cryptographic technology. This technology provides mechanisms for digital signatures, authentication, electronic money, certificates, and private communication -- offeringla way for standard business practices based on paper to be shifted to electronic media. The success of workldwide enterprises depends on this shift being completed rapidly and effectively. As more people realize this, the momentum for incorporating cryptographic technology into the information infrastructure is increasing. But in the United States, the National Security Agency has been given the authority to regulate cryptography. This authority was granted in another time, in a clearing when the success of the country depended on the ability of its government to gather intellegence and to communicate in secret. These premises made sense in a world where most of the power resided in governments. But the world is changing. Much economic power is now accumulating in large, apolitical, transnational corporations. These organizations place their own concerns and strategies ahead of those of the governments of the countries in which they do business. Like governments, they are interested in gathering intellegence about competitors and in conducting business in private. Unlike governments, they want open access to the technologies of authentification, electronic money, digital signatures, and certificates that will allow them to conduct business transactions accross the network. So the old notion of national power and national security are increased when government has the sole right to gather intellegence and to encipher communications no longer holds. Now the strength of the country depends not only on its government but on its corporations. The old premises have fallen away in this new reality, but the old policy remains. It is time to rethink that policy before tensions between the threatened government and corporations produce significant social tension and perhaps breakage. A new policy aligned with the new clearing would be for the National Security Agency to make its expertise available to the private sector, encabling markets to flourish in a worldwide information medium. Information technology in producing a clearing in which individuals and corporations are key players besides government. Any attempt by government to control the flow of information over networks will be ignored or met with outright hostility. There is no practical way that government can control information except information directly involved in the business of governing. It should not try. ===============end quoted material======================= Pat Pat Farrell Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

2 1

Re: Attention Shoppers: Internet Is Open (NYT, 12Aug94)
by L. Todd Masco 17 Dec '03

17 Dec '03

hart(a)chaos.bsu.edu (Jim Hart): >All in all a good article. I have a couple problems with it, >which may be due more to the people interviewed than to the >reporter: The biggest problem I have (obviously) with it is that the premise is wrong: NetMarket was *not* the first company to take a credit- card order via automatic encryption software. Over a month before the sale they site, Bibliobytes made its first sale with an automatic encryption program: the only real difference is that NetMarket used hhtp, where bibliobytes used e-mail -- so their interface is much prettier (and that we used RIPEM where they used PGP). Well before us, people were taking orders via PGP -- the thing about our client was that the user didn't have to know anything about encryption programs. We've contacted the author of the article and he claims that he'll be retracting the claim... we'll see. The Voice already snickered at the NYT's fuck-up in this week's edition. My other company (and the one I have the larger interest in), HKS, is about to announce a point of sale system (called ICE, for Internet Creditcard Encryptor -- don't blame me, I didn't name it) that'll be a drop-in solution for companies, end to end from customer to delivery for soft products and delivery lists for hard products. The problem here, and the one that's of interest to Cypherpunks, is how to change this system, using credit cards and all the loss of privacy they entail, into one using anonymous digital cash. HKS certainly has a commitment (though in word only at this point, since it's vaporware) to support digital cash, but as I've noted before it a very difficult bootstrap problem. There has to be some reason people would use digital cash over credit cards and frankly, I don't see it happening in the near future except by some large power (like banks) decided to support it. The american people keep claiming in polls that they want better privacy protection, but the fact is that most aren't willing to do anything about it: it's just a preference, not a solid imperative. Until something Really Bad happens to many people as a result of privacy loss, I really don't think much will be done that requires real work and inconvenience from people, like moving to something other than credit cards for long-distance transactions... and that's a tragedy. -- L. Todd Masco | "Large prime numbers imply arrest." - Meaningless cactus(a)bb.com | grammatically correct sentence. Right.

1 0

e$: buyinfo, internet commerce, and GMU
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 1:41 PM 8/20/94 -0400, Pat Farrell wrote: >C'punks: > >There is another Professor Denning who is chair of a CS department >in the Washington DC area. Here is a position paper that was >published in a packet distributed at the 1992 Computers, Freedom, and >Privacy conference (CFP-2) Washington DC. > [snip] >Department of Computer Science George Mason University, Fairfax, VA ^^^^^^^^^^^^^^^^^^^^^^^^ There are some people from GMU ("Coalition for Electronic Markets; George Mason Program on Social and Organizational Learning") talking about superdistribution schemes (one put an article in the new Wired) and internet commerce on the new (?) www-buyinfo list I just started watching. The buyinfo folks seem to be reserecting the discussions which used to take place on the imp-interest list, which has pretty much croaked. They are talking on buyinfo about secure mosaic, digital signatures, digital cash, etc. I think the list is driven by majordomo and its address is: www-buyinfo(a)allegra.att.com If anyone has comments on this bunch, it may be interesting to hear them here. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

2 1

ACTION ALERT! PTO Commission Lehman's Intell. Property report
by Jim Warren 17 Dec '03

17 Dec '03

Hi all -- [blind cc'ed to numerous folks] Just spotted this in Dave Farber's interesting-people msgs. Personally, I think that Lehman and the PTO is permanently-entrenched in offering nothing better than band-aids to protect the past. I think that the *only* chance we have for a more-enlightened approach to freedom versus software monopolies is massive, virulent [articulate] *torching* of our Congress-creatures. (At the least, it will force the monopolists to spend much more loot bribing friendly votes from the representatives they are buying.) Like always, freedom requires vigilence AND action. --jim Jim Warren, columnist for MicroTimes, Government Technology, BoardWatch, etc. jwarren(a)well.com -or- jwarren(a)autodesk.com 345 Swett Rd., Woodside CA 94062; voice/415-851-7075; fax/415-851-2814 ===re===

1 0

coming soon: secure digit
by weidai＠eskimo.com 17 Dec '03

17 Dec '03

To: cypherpunks(a)toad.com -----BEGIN PGP SIGNED MESSAGE----- tcmay(a)netcom.com wrote: > Their work involves having the user compute a hash of the document > he wishes to be stamped and sending the hash to them, where they > merge this hash with other hashes (and all previous hashes, via a > tree system) and then they *publish* the resultant hash in a very > public and hard-to-alter forum, such as in an ad in the Sunday New > York Times. Can you give a more detailed description of the system? The specific question I have is how exactly does a third party know that a time stamp is not forged? What algorithm or protocol does he use? If there is more than one time stamping service and if they use different systems, how do the courts know which ones to accept? Wei Dai cc: TCMAY(a)NETCOM.COM in 0009 on ESKIMO -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLlad5Tl0sXKgdnV5AQFjXQQAuIU+eb/yLxrhXWwDwOfuK/rKi7Tq+Pz8 3FFe+BD6ZB+nLrXPnb5geNQuVFQX3K4cW1JEm4dVPvo5DDXFZaM/sH5g2XySrjaz 9FeeTa4wYtEydhJXAlzpENuWxyXTn+NIQov+e5kKQybKgOW5AglwnMexd+ls7o1U juUxkbqdSZY= =FyNB -----END PGP SIGNATURE----- PGP Public Key available

1 0

Re: ecash-info
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 1:02 PM 8/19/94 -0700, Eric Hughes wrote: > Anyway, when I screwed up the guts to ask, Chaum told me that the going > price for the underwriter's license/code was $275K plus a percentage of the > net profits. > >It's no small wonder that he's not gotten anywhere. Anybody who wants >an operational cut of a finance system is asking for way more money >than anybody might want to pony up. A bank (or similar) wants to buy >technology, not a partner. Here I was thinking it was common knowlege, and that's why I never said anything about it. I have to say that I have several friends who build real good financial models for portfolio analytics, and they get a cut of the trading profits. A bank is one of his customers. Of course, they're in Switzerland. I'm sure it happens on this side of the Atlantic with people who do currency analysis. Soft dollar stuff is a pretty common way to pay for research and software. That said, I think that there are probably cleaner ways for him to make money, like leasing his software, for instance. > the increase in traffic about his inactivity in promotion leads me to > believe that he's either working hard in getting his product market-ready, > which makes sense, or he's dropping the ball, which I would charitably say > is an unfair reading of the facts. > >A third possibility is that he's just not getting anywhere. If you >want too much money for what someone else is willing to pay, you don't >make a sale. Agreed. I was trying not to tread on the sainted reputation of the master by using the word "charitable". I count your "third possibility" under "dropping the ball", by the way. In fairness, it may be true that he's really trying to bring something to market. We may never know until we read about it on the front page of the Wall Street Journal, or in the same paper's legal notices... >There are three potential benefits from any Internet money system: > >1. The ability to transact and settle to the outside banking system. [snip] >Here's the crux. ONLY property one has large and direct and immediate >economic benefits to the issuer. [snip] >If you were a bank, would you pick system 1, 2, or 3? System one will >result in direct customer fees. [snip] >So, with these three kinds of transaction systems in competition with >each other, which do you think will win? > >Let me answer that for you. It's system 1. > >Now Chaum wants to offer system 3, and it's expensive to purchase. >Surprised at lack of success? Not at all. I think you're right. It goes back to the haggle we had when I first joined this list. I learned rather quickly that privacy ain't necessarily the point here. The technology of privacy, in particular strong crypto, yields something useful in a much larger arena digicash and other e$. Privacy is a beneficial byproduct of immediate and final clearing on the internet through digicash. It is not necessary and sufficient for it's use. It's possible that Chaum is immersed in the cryptographic details that he thinks that privacy is digicash's primary selling point. It certainly is the enabling technology. However, it seems that his marketing approach to date has been more product driven ("Look, you can fly, and we'll let you do it, but you'll have to do it our way.") possibly sales driven ("C'mon, fly, and I won't bother you anymore."), but certainly not market driven ("Look what you can do if you fly!"). Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

2 1

Re: In Search of Genuine DigiCash
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 4:24 PM 8/19/94 -0700, Eric Hughes wrote: >The withdrawal transaction posts a debit to a customers demand deposit >account (decreasing it) and a credit to the suspension account >(increasing it). NewJargonNotice("suspension account") Is this new nomenclature? It sounds less risque than "float", I must say... >Where digital cash is immediately useful is online as a retail level >wire transfer system. [snip] >the cost of networking is >dropping and the cost of computation is dropping. I personally don't >expect that off-line digital cash techniques will ever actually be >economically most efficient. Existing alternates (e.g. credit cards) >work well enough today, and by the time PDA's work well enough and are >cheap enough to be universal, the cost of an online verification will >be down in the fractions of a cent. Immediate and final clearing must save money, somehow, but right now, it's hard to prove whether cash is still king in cyberspace. I have a (somewhat religious, in the sense that it may not be empirically proved in my lifetime) belief that that's the case. That's why I like to agitate for a test. Yes, Tim, I know, you guys aren't bankers... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

5 4

Re: In Search of Genuine DigiCash
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 4:43 PM 8/19/94 -0700, Eric Hughes wrote: >If there were already a fully identified digital money system, Is there one? >On the other hand, there is likely also a local maximum where the >premium is fairly small. In this case you get not only all the people >above, but a large percentage of the people who are willing to pay >just a little more for privacy. > >As to where these local maxima actually are, and which yields the >larger profits, I have no idea. It all boils down to Bedford Forrest's maxim "Get there first with the most men." (Sun Tsu said it first, but Forrest probably wouldn't have liked to know that, I'm sure) If in fact there is no method for making cash transactions on the internet, particularly "off-line" transactions with no trusted third party in the loop at transaction time, then digital cash is all we have. Eric has destroyed the point about the efficacy or need for off-line transactions already, but to expand on his last sentence, there needs to be empirical evidence to back up or refute his and my opposing claims. >The costs associated with anonymous digital cash may well be less that >for identified digital money systems. [reasons elided] > >Digital cash, on the other hand, needs a redeemed note database, but >this is one of its only unique costs. [snip] >It is likely that digital cash is more efficient economically, since >it unbundles a bunch of previously linked services and allows them to >be purchased separately by those who actually need them. Halleluja! Eric, for the last three months, you have said that there was no way to prove whether digital cash was more cost effective than other forms of e$, and thus potential efficiency was useless as an economic argument for its adoption. Perry and have held that it must be, and you have just now given a bunch of real good reasons. Now we need to figure how to test all this out... I love this place... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

3 3