December 2003 - cypherpunks-legacy

Re: court order required for keys?
by TruthMonger 17 Dec '03

17 Dec '03

Roger Schlafly wrote: > Posted online news accounts of the McCain-Kerrey bill have implied > that the a court order is required under the bill to get keys. > [AP, 07/09/1997] > As with wiretaps, authorities would have to obtain court orders to make > the keys available for law enforcement. ^^^^^^^^^^^^^^^^^^^ > [Wired, 11.Jul.97] > Law enforcement could then access that copy of your key > through a court order. > ^^^^^^^^^^^^^^^^^^^^^ > > I find this distressing, because I have read the bill, and a court order > is most emphatically NOT required. Only a form specified by J. Reno. Most people don't realize that many of the so-called protections that are in place to guard our constitutional rights and our privacy only apply to _use_ of the material in an _official_ proceeding, such as a trial or hearing. Government, private agencies and corporations daily exchange all manner of supposedly private information, often using court orders only to _officially_ get portions of what they already had. It is no accident that LEA's often get court orders asking only for access to certain incriminating information (since they've already done the "fishing"). This is a tricky point in the bill, but notice that: > (1) Court orders are not required for wiretaps in the US. While it may > be true that court orders are used most of the time when wiretap evidence > is used in a criminal trial, there are a number of exceptions. Also, many of the wiretaps have already been in place when the court orders are applied for. "Redating" of wiretap records is a common and sophisticated part of LEA practice. NSA has a database that is used to cull out wiretap references which are out of sync with the purported time-stamp on records. It lists all worldwide social and religious time-sequence indentifiers such as Easter, Hannuka, the running of the bulls, sports contests and playoffs, etc. > (2) There is no restriction in the bill to getting keys to decipher > communications covered by the wiretap > Under S.909, > if the cops can get access to the data, then they can get the keys > without any court order. Which they no doubt will do and apply for the court order after they have found what they want. This will be even more effective than their voice-wiretap methods have been because their will be no need to redate the information they claim as being found after getting the court order since files, unlike voices, linger. > (4) In S.909, all of the requirements on law enforcement officials > can be lifted by executive order. Which means it can be done _retroactively_ with a nod, a wink, and a few simple strokes of a pen. S.909 quite simply butt-fucks the Constitution and the citizenry. The shameless criminals on Capitol Hill of Manure no longer even seriously pretend to be in the least concerned with Constitutional issues. They think (and may be right) that they only have to chant the "National Security" mantra a couple of times to absolve all of their sins against the Constitution. TruthMonger

1 0

FTC privacy comments from CEI and National Consumer Coalition
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Fri, 18 Jul 1997 10:30:59 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: fight-censorship-announce(a)vorlon.mit.edu Subject: FTC privacy comments from CEI and National Consumer Coalition The Competitive Enterprise Institute and the National Consumer Coalition filed these comments in response to the FTC's four-day privacy hearing last month. Some excerpts: The fear over children seeing sexually explicit materials online led to hasty calls for Internet censorship in the Communications Decency Act. Yet the Supreme Court recently struck down the law, ruling that the Federal government should not be in the business of trying to protect children with such a blunt - and patently unconstitutional - instrument. Similarly, the rhetoric surrounding the issue of children's privacy on the Internet has led to hasty calls for regulation. Indeed, the Administration has taken a strong, even ominous position: "This problem warrants prompt attention. Otherwise, government action may be required." [...] Sometimes information has been released to anybody and everybody, via chat rooms or other forums. Since this information becomes part of the knowledge of others, our "property right" to control this information is actually a "right" to control the actions of other people who now have this information. This is an infringement upon our basic freedoms of association, contract, and speech. There is nothing wrong with collecting information freely placed in public, as much of this information is. [...] More info: http://pathfinder.com/netly/editorial/0,1012,1050,00.html http://pathfinder.com/netly/opinion/0,1042,1055,00.html -Declan ---------- Forwarded message ---------- July 14, 1997 Secretary Federal Trade Commission Room H-159 Sixth St. and Pennsylvania Avenue, NW Washington, D.C. 20580 Consumer Privacy 1997 Additional Comments P954807 To the Secretary: The Competitive Enterprise Institute and the National Consumer Coalition hereby file additional comments on the Commission's June 10-13 hearings on "Consumer Privacy Issues Posed by the Online Marketplace." CEI is a non-profit, non-partisan free-market research and advocacy group. The NCC is a coalition of nine organizations dedicated to the proposition that consumers are best served by a free market in goods and services. We thank the Commission for including us in the four Roundtable discussions during the hearings, and appreciate the opportunity to elaborate upon some of the issues raised during the course of the hearings. What is Privacy? - Part II In our opening comments, we wrote that when it comes to collection of consumer data, "privacy is not a right, it is a preference." The evidence presented during the hearings regarding ways to "protect" privacy, as well as the surveys showing consumer views, have convinced us that this remains true. The Harris/Westin survey was an interesting contribution to the discussion of privacy on the Internet. We are not convinced, however, that everyone interviewed understood "privacy" in the same way. Privacy is an abstraction, like "freedom" or "justice," so it is likely that the people surveyed imposed their own concerns upon the term "privacy." One point on which the survey is clear is that people who are concerned about their privacy have done something about it. In this case, it is more illuminating to look at what people do than at what they say. Nevertheless, some have used this survey to support their arguments for federal regulation and congressional privacy legislation. Neither of these would be appropriate responses to consumers' hesitance towards Internet commerce. It is the job of companies operating on the Internet to gain consumer confidence, not the duty of the government. Indeed, the proper role for the government is to guard against force, theft, and fraud. Property Rights on the Internet Professor Alan Westin said that web users "are worried that their e-mail communications may be intercepted, their visits to web sites can be covertly tracked, their participation in chat rooms and forums can be monitored without their consent." One possible solution was to give individuals a "property right" in the information they have released onto the Internet. From this follows a call for federal protection of this "property right" via limits on the collection and sale of personal data. The argument that people have a "property right" in their personal data is ironic, as it comes from those who would have the government infringe upon the property rights of both ISPs and companies on the Web. We believe that this upside-down conception of "property" will work against consumers' interests in freedom of contract and association. Traditionally, private property rights have been understood to be the means by which we secure our privacy, as expressed in the old adage, "A man's home is his castle." Our system of property rights enables us to enjoy privacy (i.e. from government intrusion). In recent years, however, the basis for legal claims has become the idea of an inviolate personhood. A "legal right" to information about oneself on the Internet, as some have advocated, is the next step. >From this comes the "right" to control information about oneself after one has already released it. This is a step in the wrong direction. If an individual has released information about himself in a contractual agreement with certain limits on it, then he has a right to see that that information is treated in a certain way. For example, if a company web page says that it will not collect information, and it does, then that is a broken contract. On the other hand, if a company says it will collect all kinds of information, then privacy-sensitive individuals have been warned and should avoid that site. From the examples discussed at the hearing, it seems that many companies are still getting used to the way the Internet works, and they are only beginning to understand the utility of publishing privacy policies. For example, the New York Times discovered during the course of the hearings that it had no published privacy policies on its web site, a situation it addressed immediately. Time-Warner's Pathfinder site recently added prominent links to its privacy policy as well. Sometimes information has been released to anybody and everybody, via chat rooms or other forums. Since this information becomes part of the knowledge of others, our "property right" to control this information is actually a "right" to control the actions of other people who now have this information. This is an infringement upon our basic freedoms of association, contract, and speech. There is nothing wrong with collecting information freely placed in public, as much of this information is. Nor is there anything wrong with one party selling information to another party as long as it was not under fraudulent circumstances. If a person objects to this information being sold, then it is up to the individual to make alternative arrangements with which he is more comfortable. . In other words, protecting your privacy is your responsibility. That is the value inherent in the freedom to contract. Bringing back the original conception of property rights, as well as freedom of contract, is the best way of protecting an individual's privacy preferences on the Internet. Rather than implementing a system of government regulation of data collection practices, people should be able to choose whether or not to contract with a company or otherwise. Restricting the downstream actions of others based upon a made-up right will undercut our other valued freedoms. On Self-Regulation We laud the Federal Trade Commission for its cautious response toward calls to regulate the Internet. We are also pleased with the Clinton Administration's stated intention to refrain from regulating most parts of the Internet. We agree in principle that data-gatherers ought to inform consumers what kinds of data they are collecting and how that data will be used. If it really is true that consumers are highly concerned about this, then companies scrambling to sell goods and services over the Internet will accommodate them. (We also note that there are already strong incentives for information brokers to ensure the accuracy of information they collect, since there is no market for inaccurate information.) What troubles us is the concept of "self-regulation." Although the term implies a lack of government regulation, many of these codes are being developed in response to a threat of regulation. As the Clinton Administration's recently released report on Internet commerce stated, "We believe that private efforts of industry working in cooperation with consumer groups are preferable to government regulation, but if effective privacy protection cannot be provided in this way, we will reevaluate this policy." We believe that the Commission should not use "self-regulation" as a way to steer the development of policies on the Internet without going through the standard process for proposing regulations. The Commission must still defend whatever goals it proposes. One component of this "self-regulation" was the Platform for Privacy Preferences. This template would allow consumers to fine-tune their preferences and allow them to know what sort of policies a web site has. This may be a fine idea, and we hope that if consumers find it acceptable, it will be adopted by many organizations. However, we do not believe that a single privacy standard is necessarily desirable. There are many real-world examples of competing standards co-existing peacefully. There are different monetary systems, there are different systems of measurement (English and metric, Celsius and Fahrenheit), there are different languages. The Commission should be wary of backing a single standard for the Internet. The threat of regulation is nearly as serious as actual regulation. It may well be that the solutions supported by the Commission and the Administration are the best ones. It also may be that there is an alternate solution around the corner, one which we cannot predict now but one which might be stifled because it does not match the goals supported by current government officials. This could have very serious ramifications for the future development of the Internet. After all, companies already entrenched in a particular market that ask for regulation often do so in order to constrain the actions of future competitors and to derive windfall benefits, a practice known as "rent-seeking." If regulation stymies the growth of the Internet, we will have no way of knowing what we have given up as a result. The idea that federal regulation of the Internet is somehow better than a market solution to privacy questions is completely unfounded. Indeed, the evidence is that federal regulation in every other sector of American life has had adverse and unforeseen consequences which end up hurting consumers. There is no reason to believe that federal regulation of privacy practices will be any better than the current situation, and it may well be worse. Children and The Internet The fear over children seeing sexually explicit materials online led to hasty calls for Internet censorship in the Communications Decency Act. Yet the Supreme Court recently struck down the law, ruling that the Federal government should not be in the business of trying to protect children with such a blunt - and patently unconstitutional - instrument. Similarly, the rhetoric surrounding the issue of children's privacy on the Internet has led to hasty calls for regulation. Indeed, the Administration has taken a strong, even ominous position: "This problem warrants prompt attention. Otherwise, government action may be required." We believe that before the Commission begins to regulate in the name of children, it should recognize from the start that today's children are tomorrow's adults, and that these regulations may restrict their rights when they are grown up. The Commission should be wary of proposals which would effectively treat adults like children. The Center for Media Education's report on the privacy practices of some web sites seemed to shock the Commission. Yet we are not sure why the fact that a toothpaste company which sends a solicited e-mail to a child in the name of the Tooth Fairy - an e-mail which contains neither the name of the product being sold nor the name of the company -is so disturbing, especially since for many years people have been able to have letters from Santa Claus sent to children. We are in fact puzzled as to why similar "information collection practices" which have gone on for decades (e.g. children sending box tops away for magic decoder rings) are suddenly sinister when performed over the Internet. We note that CME's primary objection is advertising itself, and "privacy" is just a means to criticize it. For example, one target of CME's outrage is "animated product spokescharacters," e.g. Tony the Tiger, which "interact with your children...fostering intimate relationships that compel your children to buy specific products and services." That these "spokescharacters" also ask children for e-mail addresses appears to be a slightly less urgent concern. CME's recommendations to the Commission include restrictions on the use of these cartoons: "Product and other fictional figures should not be used to solicit personally identifiable information from children." Indeed, elsewhere CME states explicitly that "there should be no direct interaction between children and product spokescharacters" on web pages. This is tantamount to a ban on selected content simply because of its advertising nature. This is not the proper forum for a discussion of the great value of advertising to consumers, and why advertising is not, and never was, a sinister seducer of consumers. We will, however, say that children are far more skeptical of advertising than CME gives them credit for. No matter how much advertising, or how little, there is, children will still want things and their parents can still tell them, "No." In short, it appears that this issue has very little to do with privacy on the Internet, and far more to do with CME's anti-advertising agenda. Nonetheless, CME did introduce some interesting issues. CME looked at the existence and content of privacy practices on children's web sites, and publicized them. There is nothing wrong with this; indeed, if children's privacy is such a high concern for individuals, then companies will respond (many of the web sites in question addressed the issue as soon as it was brought to their attention). As more and more people become comfortable with the Internet, and become aware of its capabilities, we expect to see all kinds of practices - from content, to advertising, to data collection - to become more refined in response to consumer demand. CME also raised the question of how and when to obtain verifiable parental consent to collect information from children. One suggestion was to have parents mail in a signed form indicating that their child may use the web page and may divulge certain information. Not only would this curtail what is an essentially benign practice - not even CME can explain what actual harm might result from this collection - but anyone who has ever known a child to forge his parent's signature to play hooky knows that this is not a good solution. It is an irony of the Internet that the technology which enables data-gatherers to collect information on what people look at can easily be thwarted by Anonymizers and other disguising technologies. It still holds true that sometimes on the Internet, as the famous New Yorker animal cartoon showed, "nobody knows you're a dog." Nobody has to know that you are or are not a child, either. Obviously, forcing children to identify themselves as minors, especially in such a public area as the Internet, would be unwise. Consequently, regulations aimed at "protecting children's privacy" are going to hit adults as well. For this reason, we urge the Commission to refrain from drawing up regulations specifically targeted towards children. Nor should the role of parents be underestimated or tossed aside in favor of federal regulation. Though the Harris/Westin survey showed a nearly unanimous belief that children's privacy ought to be protected on the Internet, the survey also said that not even a plurality of parents have done much to protect it. There are a plethora of technologies available to enable parents to monitor and adjust what their children see, and more are on the way. We urge parents to keep in mind that just as they would think twice before allowing a child wander around New York City alone, they should supervise their children on the Internet. Conclusion The Commission is under a great deal of pressure, from within the government and without, to regulate at least some parts of the Internet. As more and more people become Internet users, it is even more important for the government to refrain from regulating. The Commission should confine itself to policing fraud and investigating any actual injury. Julie DeFalco on behalf of the Competitive Enterprise Institute and for the National Consumer Coalition Endnotes ------------------------- Declan McCullagh Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/

1 0

No Subject
by Mix 17 Dec '03

17 Dec '03

I think we should all follow jim's example.

1 0

Remailer message bundling
by tk＠ai.mit.edu 17 Dec '03

17 Dec '03

If each remailer encrypts outgoing traffic with its (immediate) recipient forwarder's public key, then several outgoing messages headed in the same direction can be bundled together, obfuscating further the message identities. No need to have 1 message in ==> 1 message out, with or without delay, reordering, or whatever. But maybe everyone already thought of this.

1 0

Re: Remailer ideas (Was: Re: Latency vs. Reordering)
by anonymous＠hacktic.nl 17 Dec '03

17 Dec '03

Jim Dixon writes: >Commercial remailers would probably be very concerned with legal >issues, both criminal (pornography, etc) and non-criminal (copyright >violations). Those commercial remailers probably will be located around the world, so pornography could be send by using an "offshore" [=non-american] remailer as last link in the chain. The jurisdiction where this remailer could be located, preferably shouldn't care about pornografy. [Holland, Scandinavia ?] >-- >Jim Dixon

2 1

Dallas Morning News article
by Phil Karn 17 Dec '03

17 Dec '03

Dallas Morning News, July 23, 1994, Page 5F Cryptography tests rights of electronic word Tom Steinert-Threlkeld Cybertalk The electronic word appears to have fewer rights than the printed word. At least that could be the conclusion drawn from an unusual case emerging from the Bureau of Politico-Military Affairs in the U.S. State Department's Office of Defense Trade Controls. There, a book about encryption techniques has won an export license, but a computer disk containing the same information has not. The book in question is titled "Applied Cryptography", an attempt by data security consultant Bruce Schneier to translate 20 years of academic research in scrambling computer traffic "into terms understandable by mere mortals." In so doing, Mr. Schneier hopes to do "more to further the spread of cryptography around the globe than any single (encryption) product could." So far, his publishers, John Wiley & Sons, believe the 600-page tome has been doing almost that. Since its release in November, almost 15,000 copies of the book have been sold. Of that, between 1,500 and 2,000 have been to programmers and other interested parties abroad. Those foreign sales are possible because the book did not have to get an export license. Such controls are used by the State Department to guard against the spread of cryptographic methods that could be too difficult to break, posing a threat to national security. The book contains what Mr. Schneier estimates is about 100 pages of algorithms, hash functions and other lines of computer code that can be used to encrypt messages. But the Office of Defense Trade Controls in March rendered the opinion that the book "is not subject to the licensing jurisdiction of the Department of State since the item is in the public domain." No so with two disks containing the same "source" code. In a May 11 letter, office director William B. Robinson designated the disks as an article "under category XIII(b)(1) of the United States Munitions List." As such, the author would require an export license for the disks. The code itself was not a finished product. It would have to be "compiled" into an executable program before it actually could be used to disguise any data on a computer network. The code was also exactly the same as appeared in the book, or at least as nearly as possible, given the transfer to a magnetic disk. But that appeared to be enough of a difference for the State Department. Mr. Robinson stated, "The text files on the subject disk are not an exact representation of what is found in 'Applied Cryptography'. Each source code listing...has the capability of being easily compiled into an executable subroutine." A State Department official Friday translated the distinction this way: "The difference with the code in the book is you have to type it all in and correct all the errors" before it is usable by a computer programmer. The "value added" by putting the code on the disk is that it is already typed in. "That was the determination we made", the official said. Practically speaking, the distinction escapes the author, Mr. Schneier. Once one overseas programmer types in the code and corrects the errors, hundreds of copies can be easily made and shipped to any country. For the programmer who is too lazy to type, the book's pages even can be scanned in. "What do we think? Foreigners can't type? Or is the worldwide scanning industry influencing this decision?" he asks. Others see larger, constitutional questions. "They're trying to say electronic words have less protection than written words," said David Banisar, policy analyst with the Electronic Privacy Information Center in Washington, D.C. "That's not a proposition that I think any court will support." As more and more words -- from book, magazine and newspaper publishers, for instance -- become electronic, the issue could become critical. "When all words are electronic, they won't be able to be protected under the First Amendment" if this difference between words on a paper medium and words on a digital medium gains footing, he said. Phil Karn, an engineer and ally of Mr. Schneier, however, is appealing the stand on the disks. The State Department's view also is not the final law of the land. "It seems like kind of a foolish distinction and one which in any case is ultimately doomed to failure," said Internet Society executive director Anthony Rutkowski. The different rulings on the book and the disk are "utterly stupid, but that's the way bureaucracies work." Mr. Robinson and the trade control office's deputy director, Rose Brancaniello, declined to comment. Another officer, Tom Denner, said comment was prohibited by confidentiality provisions contained in section 38(e) of the Arms Export Control Act. ------ CyberTalk appears every other Saturday, discussing people, places and problems populating the world of computer communications known as cyberspace. Tom Steinert-Threlkeld can be reached at the Internet address, tomhyphen(a)onramp.net; at America Online, tomhyphen; or at Prodigy, trfj19a.

1 0

Cyphers Out There?
by an114＠vox.hacktic.nl 17 Dec '03

17 Dec '03

:: Encrypted: PGP -----BEGIN PGP MESSAGE----- Version: 2.6 hEwCTL2DNtw2i0EBAf4joQKrL2wlyfeRCIHGKaIlSnDhfNdSJ3+MPylu1fix0TIr E//Iw3Z9H2rdbVkJ4gyMQrE7kZzpquyys5ia4031pgAAAjb/CvnS8B2ZX0gpx+dh 8+7dS7i0vbwOePbd/6RIMaemyQhc98npIqQqWodr7z4a+hPp9PyBw5tVPa9N29CF 5b/X50eaeK9vuUVAp1qAB247LsqmQ+nWlFtVXlcy2M3AqZFG0KwvGCg1FLcrSIKj 4gEbp+qD42cetTBe3HFY45Xie1tcEVrTblpibIKZ41NgKcGdRJ8s+ivv/tKu+bDh pftPmiJjqIM1hpOtDqAQvlocP/j4RmxrZFCkdtmczAOKPhG0F6B4tmW/GKY7Kfdk 7vfhrMF6+8sAQSXLSp8xSCpjSGT/RsZKRNOLFK8E6QGCk5MToV5FBtCUd7sVSY7H t+GEsVT4KgLq1jdGGwrsegB99K4ttQ0rYxPn5xQUgUNt6ekOK3v2mfUHQbuY2rdf OTN+RHGRiFI8oplVYVUQGo0q/Ghl7P56TSxVZTHTrxRbFDc/xcnflQHsrVHS/9KC xxP3xuZTrCJaXrZEi8xZ2h/gyQB7xT7VdNvFm4KpFapkt9UP510+4YmyN06SSMq7 zSX4lmcihnf1FGt0A3Q5KOjUjzXz4V4xD9BYtC2Tg+Bp+QtVfJTVhSJ8u8tGs0cB LMSHkj5H2RocbhMhpnmm5Lqnwp+UgUWbH2cVNnx51DbAlOt1NrwetjXs75YZbtfw JBgLj2AOfAi5txky+4xZx/S2uSyrwe0OSFTsBXoSonSSRMjkBPjJ/H0d1XU715oN RSxlTlFIlS8GnUlaiq+eYhHp3sbZILS57A== =YwyP -----END PGP MESSAGE----- -------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)vox.hacktic.nl Please report any problems, inappropriate use etc. to admin(a)vox.hacktic.nl Direct replies to the sender of this message are -not- anonymised <YuK>

1 0

RE: (none)
by Jeff Gostin 17 Dec '03

17 Dec '03

Blanc Weber <blancw(a)microsoft.com> writes: > I really meant to ask 'where cypherpunks'. It had been a whole day & > more without the hordes messages and my day seemed empty, without code > or purpose, lacking controversy & jibber jabber. Actually, my response was more of a joke... More than a few people commented on the fact that WHO CYPHERPUNKS is the 'domo command to get a list of subscribers. Your name looked familiar from the list, so I decided to gamble a joke. Guess the joke's on me, eh? :-) --Jeff -- ====== ====== +----------------jgostin(a)eternal.pha.pa.us----------------+ == == | The new, improved, environmentally safe, bigger, better,| == == -= | faster, hypo-allergenic, AND politically correct .sig. | ==== ====== | Now with a new fresh lemon scent! | PGP Key Available +---------------------------------------------------------+

1 0

Re: RemailerNet
by jdd＠aiki.demon.co.uk 17 Dec '03

17 Dec '03

In message <9408062108.AA18761(a)snark.imsi.com> perry(a)imsi.com writes: > > Jim Dixon says: > > You can send from a very large network and forge your TCP/IP or > > (more difficult) Ethernet source address. But I can sit on the same > > network, build a table relating TCP/IP to ethernet (or whatever) > > addresses, and filter out messages that should not be there. There > > are commerical packages that do this sort of thing. > > Huh? > > If you are sitting on a network in England, which you appear to be, I > defy you to record anything at all about the ethernet addresses of the > machines that originated this message. [etc] Forgive my casual use of the English language. "A may send from a very large network and forge his or her TCP/IP or Ethernet source address. But if B is on the same network, he or she can build a table ..." The size of the source network is related to the difficulty of determining which machine is forging addresses. If you are ... sorry, one is on a large network, forgery without detection is much easier. Assuming idiocy on the part of correspondents may make for easy and fast responses, but it injects an undue amount of noise. -- Jim Dixon

1 0

Re: Latency vs. Reordering (Was: Remailer ideas (Was: Re: Latency vs. Reordering))
by jdd＠aiki.demon.co.uk 17 Dec '03

17 Dec '03

In message <9408070005.AA17290(a)ah.com> Eric Hughes writes: > In a system that is carrying continuous traffic, random packet delay > is functionally identical to packet reordering. > > OK. Prove it. Here are some difficulties I expect you'll find along > the way. > > First, "continuous traffic" is the wrong assumption; some sort of > multiple Poisson distribution for arrival times is. Sigh. I say "A implies B". You say, "not A, and so proposition is incorrect". In elementary logic, you are wrong. IF the traffic is continuous, THEN random delays introduce reordering. The proposition is completely obvious. Do I really have to spell out a trivial proof? > This is by no > means a hypothetical. The backoff algorithms for TCP had to be > developed because packet streams are not continuous, but bursty. Under this modified assumption, you must remember that I proposed that noise packets be introduced to defeat traffic analysis. The bursts will be smoothed out. Not perfectly. Many of the characteristics of TCP/IP derive from its design being optimized for speed. RemailerNet would give less importance to speed, and more importance to opaqueness to traffic analysis. [snip] > Fourth, the problem is incompletely specified, since the distribution > of random added latencies is not made specific. Correct. You assume details that have not been specified, and then critique them at length. > If messages are fragmented, random delays on sending packets out is > functionally identical to reordering. > > This is false; a system that concentrates on reordering has provably > better average latency that one based only on adding latencies. If a message is fragmented into N packets, and then the dispatch time slot for each packet is assigned randomly, the packets are reordered. [Comments deleted ignore the fact that messages are fragmented, and so are irrelevant.] His arguments also ignore the fact that reordering messages of different lengths is useless as a defense against traffic analysis, suggesting that this is polemic rather than a serious argument. > More importantly, RemailerNet as described defeats traffic analysis by > more significant techniques than reordering. Reordering is a weak > technique. > > WHAT?? > > Anyone else listening to this: I believe the above quoted two > sentences to be distilled snake oil. I say again: reordering is not weak, it is irrelevant if messages are of signficantly different lengths and are not fragmented. > The introduction of noise, 'MIRV'ing of messages, > fragmentation of messages, random choice of packet routes, and > encyphering of all traffic are stronger techniques. > > Encyphering is necessary. Reordering of quanta is necessary. > > "MIRV" messages may actually decrease security; multiple routes may > decrease security; fragmentation may decrease security. Noise > messages may not be resource effective. > All the above claims require > some justification, and I have seen nothing robust yet. If by "the above claims" you mean the preceding two sentences, I do agree. -- +-----------------------------------+--------------------------------------+ | Jim Dixon<jdd(a)aiki.demon.co.uk> | Compuserve: 100114,1027 | |AIKI Parallel Systems Ltd + parallel processing hardware & software design| | voice +44 272 291 316 | fax +44 272 272 015 | +-----------------------------------+--------------------------------------+

1 0