December 2003 - cypherpunks-legacy

RESEND: Re: MTGS: Conflict Alert
by dkrieger＠netcom.com 17 Dec '03

17 Dec '03

At 5:02 PM 12/14/93 -0800, Geoff Dale wrote: >>If the Cypherpunks schedule their January '94 meeting on the 2nd >>Saturday, Jan 8, that will conflict with a party announced >>by visiting Exi fireman Harry (Hawk) Shapiro. Harry said: >> >> As I announced a month or so ago, I am holding a party on Jan 8, >> at the Shearaton Palace Hotel in San Fran. >> >> Jan 8th is the last day of MacWorld. Hopefully a group of us will >> meet for dinner arround 6pm. The party will start about 8 or >> 8:30. >> >>As I doubt either Harry or MacWorld will change their schedules for >>our benefit, I suggest the Cypherpunks consider (and announce with >>plenty of lead time) changing theirs to the Saturday after (Jan 15) >>(The Saturday before is New Year's day). > >Actually, there were plans to move the CyPunks meeting to Sat, Jan 15 >anyway, since Jan 8th already conflicts with something else (Usenix? >something Unix-y). > >Of course, the 15th is when the ExI-BATF (Extropy Institute - Bay Area >Transhumanist/Task Force, for the extropianly-impaired) meeting would >normally be held. I think we can ask Dave Krieger to put this off one week >to the 22nd. If so, then I'll be happy. What d'ya say Dave? Dammit, I specifically picked 3rd Saturdays so they wouldn't conflict with cpunks. Okay, just this once. Remind me at New Year's so I get it right in announcements. dV/dt

1 0

Re: anonymous video rental store
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

I'm not convinced a simple anonymous customer/buy-back(or deposit) mechanism is the ideal solution. First, the clerk sees what videos you rent and might be able to identify you from a picture. Second, if the store issues ID cards, then the store can track which videos are rented by each ID. Although the store doesn't know for your real identity, it wouldn't be to hard to find it out in many cases. The clerk coud look out the store window and get the license number of your car. You could avoid some of these problems if the store didn't issue permanent ID cards, but instead issued one-time ID cards. You would get a new ID card everytime you rented some videos. This would make it impractical for the store to automatically track your rentals. This doesn't eliminate the posibility of a clerk remebering your face and pairing it up with a specific rental, or a rental pattern. "Oh yeah, I remember that guy. he usually comes in late Friday night, just before closing. He always rents children's videos. Is he some kind of pervert?" Jim_Miller(a)suite.com

1 0

Re: Improved DH system.
by collins＠newton.apple.com 17 Dec '03

17 Dec '03

Howdy, >I have been told that there is a new improved version of >DH key exchange, which is authenticated. Could >someone give me the reference, and/or tell me what it is >all about?........ Diffie?? I'm back at the office and can (finally) provide the information, sorry for the delay. The paper is "Authentication and Authenticated Key Exchanges" by Whitfield Diffie, Paul C. van Oorschot, and Michael J. Wiener, published in _Designs, Codes and Cryptography, 2, 107-125 (1992), by Kluwer Academic Publishers. Here is some notation, and a brief description of the basic protocol. Almost everything from this point forward is quoted directly from the paper. {.} Braces indicate a hash function. {x, y} is the result when a hash function is applied to x concatenated with y. S_A Alice's secret key for a signature scheme. S_A(x) is Alice's signature on x. S_A{x} is Alice's signature on the hashed version of x. P_A Alice's public key for a signature scheme. If the signature scheme is a public-key cryptosystem, then we define P_A{x} and P_A(x) to be Alice's public key encryption function with and without hashing. E_K(x) Encryption using a symmetric cryptosystem with key K. [...] 5.1. Basic [Station-to-Station] Protocol The STS protocol consists of DH key establishment, followed by an exhcange of authentication signatures. In the basic version of the protocol, we assume that the parameters used for the key establishement, (i.e., the specification of a particular cyclic group and the corresponding primitive element a) are fixed and known to all users. While we refer to the DH operation as exponentiation, implying that the underlying group is multiplicative, the description applies equally well to additive groups (e.g., the group of points of an elliptic curve over a finite field). We also assume in this section that Alice knows Bob's authentic public key, and vice versa; this assumption is dropped in the following section [which I did not type in]. [...] Alice Bob ----- --- a is known, x is random ------------- a^x --------------->> a is known, y is random K = (a^x)^y = a^(xy) <<---- a^y, E_K(S_B{a^y, a^x}) ---- K = (a^y)^x = a^(xy) ------- E_K(S_A{a^x, a^y}) ------>> The paper is a very good read. It describes the motivations behind the protocol; how to assure (or dis-abuse) yourself of the security of other protocols; modifications; other uses; etc. I highly recommend it. Hope this helps, Scott Collins | "Few people realize what tremendous power there | is in one of these things." -- Willy Wonka ......................|................................................ BUSINESS. voice:408.862.0540 fax:974.6094 collins(a)newton.apple.com Apple Computer, Inc. 5 Infinite Loop, MS 305-2B Cupertino, CA 95014 ....................................................................... PERSONAL. voice/fax:408.257.1746 1024:669687 catalyst(a)netcom.com

1 0

Re: Error-Qualifying Signatures
by collins＠newton.apple.com 17 Dec '03

17 Dec '03

Peter, Since this description is of a more general interest, I am cc'ing this thread back to the list. >Yes, but inverting a hash function isn't necessarily a problem. >Inverting an encryption function is. With hash functions, we >really want to know it is hard to take message A and append something >B so that f(AB)=f(C). Now, ideally people have always thought >that it was bad if given C, one could come up with a D such that >f(C)=f(D). But I haven't figured out how that can affect practical >problems. Did I miss something? Let {x} be a hash on x. Let S_A{x} be encryption of the hash of x with Alice's secret key, i.e., Alice's signature over x. Thus, a signed 'thing' is (x, S_A{x}). If {x} yields the function f(y) which tells how different y is from x (ostensibly to measure what damage x sustained in transit, to become y), then f(y) can be exploited to find y such that {y} = {x} (this is, after all, the design criteria behind f(y)). If {x} = {y} then S_A{y} = S_A{x}, and therefore I can publish a document signed by Alice (y, S_A{y}), without her knowledge (both meanings) or cooperation. Someone on the list showed a few months back that provably few errors (or abitrary attacker introduced changes) are needed to get to a matching hash, but finding the changes to introduce is expensive. Building a hash function such that a distance measure is easy to calculate and exploit, makes finding the right errors easier, and thus allows falsified signatures. I take x, introduce my required changes yielding y, and then exploit f(y) with say a genetic search, or simulated annealing, to find y' such that {y'} = {x}, then I republish (y', S_A{x}): my altered document/image/whatever, + some errors to make the hashes match, + Alice's original signature. The signature is verifiable. Scott Collins | "Few people realize what tremendous power there | is in one of these things." -- Willy Wonka ......................|................................................ BUSINESS. voice:408.862.0540 fax:974.6094 collins(a)newton.apple.com Apple Computer, Inc. 5 Infinite Loop, MS 305-2B Cupertino, CA 95014 ....................................................................... PERSONAL. voice/fax:408.257.1746 1024:669687 catalyst(a)netcom.com

1 0

Keyservers and anonymous Mailings
by Black Unicorn 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- It seems that PGP keyservers have been attacked of late for alleged copyright violations. Nice tactic if you are PKP I guess. Has anyone considered the use of anonymous remailers to run a keyserver? A double blind keyserver might solve the operator a good deal of heat. Would this simply cause more problems than it solves? Perhaps the ethics are simply too black? (LD are you listening?) If PKP is going to employ this tactic, it seems that even the 'new' keyservers that run as simple databases and thus are not a copyright question are subject to harassment in the least, even if unfounded. If this is true, would anonymous remailing provide a buffer of some type? It always confused me that anonymous remailers were not used more actively for 'questionable' (read fringe) internet services. Perhaps there is a reason for this? Criminal liability I suspect. :) Perhaps I am mistaken in thinking that the lack of attribution just makes centralization less of an option on the 'data highway'? Considering the attitude of the current U.S. administration I am surprised this is not more of a common practice. After all, with the methods available, why make it easy to put the genie in the bottle? Again, would this just cause more problems than it solves by calling attention to already on the rocks anonymous remailers? Would make a nice test case. Or a poor one? - -uni- (Dark) -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLQ/DJxibHbaiMfO5AQH8+QQA1FkotVUUabYOV+aYSqOgzhOjntl5jIE5 l9xHQ1XbzLrhHwamHPIjanGEfWow6xlGfaA6dUP/RvqVpZjNcAGMQ6v33bxJNpmb 5jL/w2/xq/GNssqeaJMeb0gCkQPJXrlZohY9EZeDOiZJzobLCbCIRdzXSjXoRir0 C83FYcN1Xns= =Wn1F -----END PGP SIGNATURE-----

1 0

DCASH: ACM Digital Cash Paper Available via FTP
by edgar＠spectrx.saigon.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The following is excerpted from the Internet Business Journal Electronic Currency NetCash: A Design for Practical Electronic Currency on the Internet, proceedings of the First ACM Conference on Computer Communications Security (November 1993), Medvinsky, Gennady and B. Clifford Neuman. This document is available via FTP: prospero.isi.edu /pub/papers/security/netcash-cccs93.ps.Z. Note: PostScript documents can be printed/viewed without a postscript printer with "Ghostscript", which is available from the SIMTEL archive. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLQ+n9N4nNf3ah8DHAQHEpwP6Arilf9L7wyRhaDPVFlXsbK9JQDwYhcMM WQmVTkU1BtDX7RKV1zfU3QcmKUqo5/VY/EopMAqNI0GqEbnaSU9kNkAzlS0eK1CP 9CdRDXrl0Gv4HTOKJWrWkoYwQdCxpuQLr28foBebGsKXPVwVDWSfJvAU4QZWoubY yyveAX87McM= =H5Fs -----END PGP SIGNATURE----- -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Cupertino, Ca

1 0

traffic report: expect delays on the 93
by Eric Hollander 17 Dec '03

17 Dec '03

Commuters should expect random delays of between 0 and 20 minutes on the 93 (the 128.32.182.93, or cicada.berkeley.edu) remailer. I'm starting my project of modifying my remailers to thwart traffic analysis, so as the first step I put in a random delay. The next step is to add an "ignore me" header command and also a "bounce me to neverneverland" header command. Other header commands (all in an encrypted header, which will have to wait until I finish configuring encrypted remail on cicada) will say things like "chop off the last X bytes and continue" or "add X random bytes to the message and pass it on", all with random delays. I also want to set it up so that it just spontaneously mails stuff to random places. e

1 0

more traffic delays!
by Eric Hollander 17 Dec '03

17 Dec '03

I've "upgraded" all of my remailers (hh@soda, hh@cicada, hh@pmantis, 00x@uclink) to insert a random delay in the remailings. e

1 0

No Subject
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

To: cypherpunks(a)toad.com Subject: Re: Keyservers and anonymous Mailings Newsgroups: mail.cypherpunks In-Reply-To: <199312160710.AA28701(a)access3.digex.net> Organization: An Teallach Limited In article <199312160710.AA28701(a)access3.digex.net> you write: :If PKP is going to employ this tactic, it seems that even the :'new' keyservers that run as simple databases and thus are not a :copyright question are subject to harassment in the least, even if :unfounded. If this is true, would anonymous remailing provide a :buffer of some type? First of all, I wrote the new replacement keyserver and I happen to know it isn't even released yet (except to a handful of people for the purposes of testing portability and ease of installation etc), so it is not *possible* that the new sites have been harassed, and I think you should wait until it happens before you start worrying about it. As I've said before, all these keyservers will be doing is *publishing* information, and that's a protected right in the US. Now, if pkp choose to start chasing down people who publish their keys and asking them if they have a license (assuming they're in the US and need one), that's a different thing altogether, but that could happen at the moment given that the actual keys are up for ftp all over already. A keyserver that doesn't patent (or copyright? Who told you that?) infringe *cannot* be closed down even if the people whose keys are published *are* harassed. Anyway, the keyservers have to exist for the benefit of both ViaCrypt customers and European FreePGP users. G

1 0

addme
by Ophir Ronen 17 Dec '03

17 Dec '03

Hi Eric, Please add me to the list. *Thx, -Ophir

1 0