December 2003 - cypherpunks-legacy

Re: Giving Value to Digital Cash
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Perry writes: > > Most major economies are using fiat money today, so it is clear that > > fiat money will work. > > Fiat money works because guns are used to force people to accept it. > You have to pay your taxes in it, the laws are written so that all > commercial paper requires that you use it, the government makes all > its purchases in it, etc. The result of this is that it is accepted. > It is substantially harder for people to accept fiat money that > doesn't have guns barrels backing it up. Fiat money works because people can get other people to accept it, though guns are a popular way of making that happen. Most major economies use it because it's a good deal for guys with guns. You don't have to pay taxes in fiat money in the US; they'll accept real gold or silver money if you want to use it instead of the cheap paper. It's still legal _payment_ for debts, as opposed to mere tender like greenbacks. But bad money does drive out good, so people spend fiat money. Green stamps were fiat money, but somewhat useful once. US postage stamps are fiat money, and they do use guns to prevent other people from offering competing mail service, but people will often accept them as money for small purchases; it used to be a popular way of sending small payments by mail before checking accounts became nearly universal. Bill

1 0

Hacking the ITARs
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

> This is sick. According to this, I cannot teach > foreigners about cryptography in the U.S. -- even about > the open literature. This is a grotesque denial of my > first amendment rights. > > I wonder if I should hold an open enrollment cryptography > class for the sake of civil disobediance. > > Perry It not as bad as that. Well, actually, it's hard to say just how bad it is because the ITAR regulations regarding cryptography are contradictory. It might depends on whether the class teaches only from a book, or actually lets the foreign students write and exchanged programs. Here are the relevant paragraphs from the ITAR: (the terms to keep track of are - defense article, defense service, technical data, and information) ---------------------------------------------- #120.5 Relation to regulations of other agencies. If an article or service is covered by the U.S. Munitions List, its export is regulated by the Department of State... #120.6 Defense article. Defense article means any item or technical data designated in #121.1 of this subchapter. The policy described in #120.3 is applicable to designations of additional items. This term includes technical data recorded or stored in any physical form, models, mockups or other items that reveal technical data directly relating to items designed in #121.1 of this subchapter. It does not include basic marketing information on function or purpose or general system descriptions. #120.9 Defense service. (already posted this) (1) The furnishing of assistance (including training) to foreign persons, whether in the United States or abroad in the design, development, engineering, manufacture, production, assembly, testing, repair, maintenance, modification, operation, demilitarization, destruction, processing, or use of defense articles; or (2) The furnishing to foreign persons of any technical data controlled under this subchapter (see #120.10), whether in the United States or abroad. #120.10 Technical data. (1) Information, other than software as defined in #120.10(4), which is required for the design development, production, manufacture, assembly, operation, repair, testing, maintenance or modification of defense articles, This includes information in the form of blueprints, drawings, photographs, plans, instructions and documentation. (2) Classified information relating to defense articles and defense services; (3) Information covered by an invention secrecy order; (4) Software as defined in #121.8(f) of this subchapter directly related to defense articles; (5) [** deferred, see below **] #121.8 (f) Software includes but is not limited to the system functional design, logic flow, algorithms, application programs, operating systems and support software for design, implementation, test, operation, diagnosis and repair. #121.1 General. The United States munitions list. (a) The following articles, services and related technical data are designated as defense articles and defense services pursuant to sections 38 and 47(7) of the Arms Export Control Act. . . . Category XIII -- Auxiliary Military Equipment . . (1) Cryptographic [ ] systems [ ] or software with the capability of maintaining secrecy or confidentiality of information or information systems, except cryptographic equipment and software as follows: . . . (v) Limited to access control, such as...or similar data to prevent unauthorized access to facilities but does not allow for encryption of files or text, except as directly related to the password or PIN protection. (vi) Limited to data authentication which calculates a Message Authentication Code (MAC) or similar result to ensure no alteration of text has taken place, or to authenticate users, but does not allow for encryption of data, text or other media other than that needed for the authentication. ---------------------------------------------- The ITAR sections I just quoted seems to state quite clearly that cryptographic information and software systems are export controlled. However...the section I deferred. ---------------------------------------------- #120.10 Technical data. ... (5) This definition does not include information concerning general scientific, mathematical or engineering principals commonly taught in schools, colleges and universities or information in the public domain as defined in #120.11. #121.11 Public domain. Public domain means information which is published and which is generally accessible or available to the public: (1) Through sales at newsstands and bookstores; (2) Through subscriptions which are available without restriction to any individual who desires to obtain or purchase the published information; (3) Through second class mailing privileges granted by the U.S. Government; (4) At libraries open to the public or from which the public can obtain documents; (5) Through patents available at any patent office; (6) Through unlimited distribution at a conference, meeting, seminar, trade show or exhibition, generally accessible to the public, in the United States; (7) Through public release (i.e., unlimited distribution) in any form (e.g., not necessarily in published form) after approval by the cognizant U.S. government department or agency (see also #125.4(b){13} of this subchapter); (8) Through fundamental research in science and engineering at accredited institutions of higher learning in the U.S., where the resulting information is ordinarily published and shared broadly in the scientific community. Fundamental research is defined to mean basic and applied research in science and engineering where the resulting information is ordinarily published and shared broadly in the scientific community, as distinguished from research the results of which are restricted for proprietary reasons or specific U.S. Government access and dissemination controls. University research will not be considered fundamental research if: (i) The University or its researchers accept other restrictions on publication of scientific and technical information resulting from the project or activity, or (ii) The research is funded by the U.S. Government and specific access and dissemination controls protecting information resulting from the research are applicable. ----------- These sections seem to state that it is ok to teach about cryptography, and distribute information about cryptography, even to foreign persons, as long as the information is in the public domain. However, these sections do not seem to allow people to freely distribute cryptographic software, even if that software is in the public domain. Why? The ITAR defines software as *technical data*, but not *information*. Only *information* can be in the public domain, according to my interpretation of the ITAR. However, according to section #121.8 (f), the term *software* includes system functional design, logic flow, algorithms, application programs, operating systems and support software for design, implementation, test, operation, diagnosis and repair. I can understand using the term *software* for application programs, operating systems and support software. But it seems ludicrous to define system functional design, logic flow, and algorithms as *software* and not *information*. Actually, it seems ludicrous to treat software on a disk as technical data subject to export regulations, but treat software printed in a book as information in the public domain. So, can you teach a cryptography class and let your foreign students write cryptographic software? Yes, but only on the first Tuesday following the second full moon after the summer solstice, unless its a leap year, in which case they can only program in BASIC every other Saturday, or until you annoy someone at the State Department, whichever comes first. Jim_Miller(a)suite.com

1 0

Varian Synopsis
by Jeff Davis 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Distributed to TAP-INFO, a free Internet Distribution List (subscription requests to listserver(a)essential.org) TAXPAYER ASSETS PROJECT - INFORMATION POLICY NOTE May 3, 1994 This is a note about an important issue: the future pricing of Internet services. Please repost freely. - University of Michigan Economist Hal Varian says the Internet is likely to face some type of usage based pricing in the future. - Varian says increasing demands on Internet by multimedia applications and commercial bypass of telephone networks will lead to significant increases in demands on Internet resources, and create pressures for usage based pricing models. - Varian proposes a system of congestion based pricing, that will allow free off-peak usage, but speculates that other outcomes are possible, and - Predicts eventual demise of CIX model of flat rate (no settlements) pricing for Network Service Providers. NOTES ON PROFESSOR HAL VARIAN'S APRIL 21 TALK ON INTERNET ECONOMICS by James Love (love(a)essential.org) May 3, 1994 On April 21, the Telecommunications Policy Roundtable (TPR) held its first workshop on the future of democratic discourse on the Internet. Hal Varian, a professor of economics and finance from the University of Michigan, presented "Economic FAQs about the Internet," a paper co-authored with Jeffery K. Mackie-Mason. The Workshop was held at the Carnegie Institution in Washington, DC, and attended by about 60 persons. There was considerable interest in the topic. TAP had received more than 400 requests for copies of the paper (including about 350 requests by electronic mail). The paper is available for anonymous ftp, gopher, or World Wide Web at gopher.econ.lsa.umich.edu, or by sending an email message to ndaly(a)essential.org. Professor Varian's prepared talk followed the paper fairly closely, with a number of facts and antidotes thrown in to illustrate his main points. Among economists Varian is known as a superb expositor, and his presentation was as clear and accessible as the paper. Varian spent the first part of his talk describing such topics as who "owns" various components of the Internet (backbones, midlevel networks, etc), technical aspects of Internet routing, and the growth of traffic on the Internet. I won't bother to go over all the points which are explained in the paper, but a few items are worth mentioning. Varian disclosed that Internet data packets contain an unused "priority bit," that was originally designed to allow Military brass to assign priorities in data routing. The costs of routers (workstations) had fallen much faster than the long distance transport costs, and the long distance backbone facilities were often the bottleneck. Varian also spent a good amount of time explaining how Internet usage is changing, and that while electronic mail is the service most widely used, it constitutes only about 8 percent of the bits sent over the network. New applications, such as the multimedia Mosaic, Internet Fax, and Internet radio are rapidly becoming large users of Internet resources, and these new uses of the Internet are creating huge pressures to change the way Internet services are priced. To illustrate his point, Varian talked about the new Power PCs, which will allow a single user (a college student talking to his parents) to hook up a video camera, and send about 1 megabyte of data per second to the Internet, nearly tying up an entire T-1 line. Varian indicated that the power of workstations connected to the Internet is increasing much faster than the capacity of the Internet to carry traffic. Moveover, a number of commercial users of the Internet are rapidly finding ways to bypass the higher priced telephone networks, both domestically and internationally. Varian was focused largely on the increased congestion cause by the new demands on the Internet. Interestingly, his own research indicated that peak demands shifted from day to day, and peak and off-peak usage could not be easily predicted by the time-of-day, as it is for telephone service. In the United States the Internet is unregulated, and there are no internal prices for Internet usage. Network service providers typically buy bandwidth, or capacity, and face zero marginal costs for usage. End users face a variety of charges, depending upon how their service providers resell access to the network. Some foreign countries, such as New Zealand and Chile, charge Internet users for traffic, as measured by bits. Different uses for Internet services have different requirements in terms of routing priorities. Electronic mail generally does not require an immediate claim on network bandwidth, and can be managed to travel "off peak." On the other hand, some services, such as video conferencing, Internet "talk," or running Mosaic, generally allow the user to command bandwidth at a particular time. Varian was quite clear that he believes that the problem of congestion on the Internet will become a much larger problem as the Internet becomes used for a more diverse set of applications (and the growing power of desktop computers to generate data). Varian said that he believes there will eventually be prices for Internet usage, and the only real uncertainty will be which pricing system is used. A very difficult problem will be the development of accounting systems and other mechanisms to facilitate billing for Internet usage. Generally speaking, it is not simple to determine if data packets contain electronic mail, fax transmissions, video, or other data, making content based pricing problematic. There are also a number of complex issues relating to when or where traffic would be "charged" for internet usage, since users gain access to the Internet from a highly decentralized network of workstations and networks. Varian also talked about problems in determining if senders or receivers would pay for data transmissions, which he illustrated by talking about ftp or gopher servers (who was the "sender" of the data, the person sending the query, or the file server which returns data?). According to Varian, a number of persons are working on these problems, and many important decisions will be determined by engineers working on technical issues. He singled out the Internet Society's Internet Engineering Task Force as the most important forum for groups sorting these issues out. Varian said that any scheme to charge for internet usage would also involved non-trivial costs in terms of metering or accounting, and possibly significant changes in the culture of the Internet (the question on many persons minds is the future of the Internet Listserves), although on a more optimistic note, he said the costs of routing and backbone services should be low, if calculated on a per user basis. Varian said little about the Commercial Internet Exchange (CIX) in his prepared remarks, but in response to questions, he said that he did not believe the CIX pricing model (a flat fee for connectivity) was sustainable, and he thought that the new Network Access Point (NAP) providers (Ameritech, Pac Bell, Sprint, and MFS) would employ a usage based pricing approach. Varian also talked at some length about work underway to create mechanisms for charging for other types of transactions, using a variety of schemes to create "virtual cash" for use on the Internet, such as the services recently announced by Commerce Net using technology developed under NSF funded R&D. Varian said that government R&D in this area was welcomed, because it provided neutral non-proprietary systems that couldn't be controlled or manipulated by a single firm. Varian described the new Internet architecture, which is based upon four NAPs, each controlled by a telephone company, which Varian described as the new "cloverleaves" for the Internet (connecting various backbones and networks), and the new vBNS high speed backbone. Varian said the high interest in the vBNS contract was due largely to its strategic role in the development of new Internet technologies, including accounting and payment mechanisms, which may eventually be deployed to the entire Internet. (MCI "won" the recent NSF contract for the vBNS, but the award is being contested by Sprint. AT&T was also rumored to have been an unsuccesful bidder on the vBNS). Varian's own preference for Internet pricing is a system that only charges for priority routing. As described in several papers (written with MacKie-Mason), Varian would employ a system whereby users would "bid" for access when congestion was a problem, and routers would give priority to packets that had the highest willingness to pay. Users would pay the lowest price that was accepted in this routing "auction," so everyone would have an incentive to reveal their true willingness to pay. Under Varian's scheme, all Internet traffic which did not claim priority status would travel for free. Thus, for example, a large Internet mailing list such as Humanist, PACS-L or CPSR- Announce could mail for "free," with an off peak priority. For Varian's scheme to work, it would be necessary to have routers compare "bids" by packets, priority bidders would have to "pay" for access to someone, and there would have to be a high degree of consensus, so the priority packets would not face bottlenecks or delays anywhere on the Internet. Varian acknowledged that it was possible that the Varian (and MacKie- Mason) system of pricing might not be adopted, and some less elegant system, such as pricing by the bit, may be coming. A number of persons wanted to know who would decide these issues, and Varian was not too specific. The message (the "guess") seemed to be that the companies which controlled the NAPs and a critical mass of the backbones would have a lot to say about what was eventually adopted. Varian was asked to speculate about future telco investments in Internet providers, such as purchases of companies like PSI or UUNET, but he was reluctant to predict much, other than to emphasize the importance of competitive free entry into the market for Internet services, which would undermine monopolist practices. Varian was asked if it was possible that a coalition of Internet providers would have the power to implement a pricing scheme that would have an adverse impact on the future of Internet listserves (many of which "send" more than 100,000 messages per day), but he was reluctant to be very specific in his predictions, other than to say that many outcomes were possible. Note: On April 29, a follow-up workshop was held with Dr. Steve Wolff of NSF, Professor David Farber, and PSI CEO William Schrader. Notes from that workshop and other information regarding Internet pricing will be posted to tap-info. --------------------------------------------------------------------- TAP-INFO is an Internet Distribution List provided by the Taxpayer Assets Project (TAP). TAP was founded by Ralph Nader to monitor the management of government property, including information systems and data, government funded R&D, spectrum allocation and other government assets. TAP-INFO reports on TAP activities relating to federal information policy. tap-info is archived at ftp.cpsr.org; gopher.cpsr.org and wais.cpsr.org Subscription requests to tap-info to listserver(a)essential.org with the message: subscribe tap-info your name --------------------------------------------------------------------- Taxpayer Assets Project; P.O. Box 19367, Washington, DC 20036 v. 202/387-8030; f. 202/234-5176; internet: tap(a)essential.org --------------------------------------------------------------------- -- PGP PUBLIC KEY via finger! JAFEFFM Speaking & Thinking For Myself! * eagle(a)deeptht.armory.com email info(a)eff.org * *** O U T L A W S On The E L E C T R O N I C F R O N T I E R **** ***** Committed to Free Public Internet Access for World Peace *****

1 0

Double betting and money laundering...
by Peter Wayner 17 Dec '03

17 Dec '03

This is a corollary to the debate on using financial markets for laundering by placing bets on both directions. Apparently, casinos are now on the lookout for people who are teaming up to play both halves of a bet. One casino kicked out two guys who apparently were betting on pass and don't pass on the craps table. Why were they bothering? Was it laundering? Nope. It turns out that casinos hand out free "comps" based on the amount of betting that you do. This is called being "rated." They notice that you're betting $10 chips and figure that the math shows that you'll probably lose x dollars per hour. Then they give you free room and food to show their appreciation. The casinos have elaborate computer tracking systems that would scare privacy activists. They watch you're trading and try to give you free amenities worth up to some fixed percentage of what the odds say you'll lose. The article that I dug this out of said the percentage was often 30%. (I think it was in this morning's NYT.) So these guys were betting like crazy to make it seem like they were high rollers who were entitled to big comps. -Peter

1 0

Re: Lobbying/Politics/etc.
by lefty＠apple.com 17 Dec '03

17 Dec '03

>I suspect significant problems implementing a law that criminalizes >crypto. The government currently spends $billions per year trying to >eliminate illegal drugs, to very little effect. Drugs should be >easier to eliminate than crypto since phys-obs can't be copied ad >infinitum as bits can. I agree entirely. Personally, I'd be thrilled to see 'em try, purely for the fun of watching 'em going broke and looking foolish... -- Lefty (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

1 0

Brittleness and Our Crypto Future
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Hugh Daniel writes: > This is a protocol issue on two levels, the first is that the idea > of accounting for packets/bandwidth/capacity (in some unknown manner) > was left out of TCP/IP in the first place. The second is that it is > going to be a very large amount of work to replace the current plant > of TCP/IP hardware and software as none of these protocols are > negotiated, just presumed to be the only way to do things. > > If we build systems like these, then they will be 'brittle' and > might inspire a few folks but not be usable by most, and some other > (large) organization will build what it wants on top of our dreams > rubble. > There is little chance that I will ever use a monetary system that > is so brittle that it fails if one link is down or one cypher > unuseable due to it's being cracked by some unscrupulous agency. Indeed. "Brittleness" is what's making the creakiness of the Net all the more apparent and critical every day. (Some things it does very well, and I'm amazed that it works as well as it does...a lot of clever people out there making patches.) Software has been compared to building a Boeing 747, except that flipping one little switch accidentally can make the wing fall off. We see islands of relative stability (word processors, apps, etc.) separated by flaky, error-prone (human, mostly) networks, with little interoperability. We mainly do "encryption" and "remailing" with our wonderful crypto tools--and we *don't* do much of the other neat stuff that is possible--for a simple reason: the only thing all of our myriad mail systems, newsreaders, various platforms, and communication systems can reliably communicate to each other is the _simple text message_! Although much more complicated objects are in principle intercommunicable (and Mosaic can do images, etc., so things are changing), the basic object of communication is the text block. It can be encrypted/decrypted, signed, and remailed, with people at the receiving end knowing how to handle it....that's why PGP and remailers work. The other protocols rely more on complicated objects, signals sent back and forth, and are much less interoperable and semantically more ambiguous. > This important subject of protocols is the topic of the next San > Francisco Bay Area Cypherpunks meeting. I agree. If the meeting is still on the 14th, the normal "second Saturday," I'll be there. If it's been moved to the 21st, as was being talked about, I'll be down in Los Angeles (where I'd still like to meet with any LA-area Cypherpunks who wish to meet). --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

ghostmark trading, etc.
by Matt Thomlinson 17 Dec '03

17 Dec '03

I've had quite a few messages requesting ghostmarks, and I'm responding to each of them. For the first few days (at least) I'll be sending a few (less than 4) ghostmarks to whomever wants them (and starts up their "electronic wallet" -- the client software). send me mail with your clients' key to redeem my startup offer. Remember, if you want to bet on the sonics/nuggets game, the deadline is 3pm PST. Stakes: 20gm. (you need not have a client key already generated to enter this drawing) if you have any questions about how to use my bank or where to get the software, feel free to mail. That's what I'm here for. mt Matt Thomlinson Public Relations The Phantom Exchange Matt Thomlinson University of Washington, Seattle, Washington. phone: (206) 548-9804 Check my home page -- ftp://ftp.u.washington.edu/public/phantom/home.html PGP 2.2 key available via email, or finger phantom(a)hardy.u.washington.edu

1 0

re: digital cash
by lassie!jim%lassie＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- X-date: 5/3/94 X-pay-to: Cypherpunks subscription X-amount: 36.25 -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLcftKVfzDU5jV4uhAQHV4wQAhaLeXcGW2vAbkh5nA39oOc+/OK39C9V8 5W/bmOVFfxtheZ+BKRYqJ3hewmBPIKW1epJ4+C8eh+1Jy6XllYAkFZmG8HbtsBAl kP80Fz7uTloANQahfdMajbQQum0PDuasXNX4rMkBYoQG93k2JloRJfWNBWcBPpeU djXEXYngy1M= =whUr -----END PGP SIGNATURE----- Make sure that you run this thru the bank server so I get a copy of my canceled check back and my mounthley reconciliation is updated. -- * Spelling errors are intentional and international * Jim Nalbandian netcomsv!lassie!jim%lassie(a)netcom.com Tempe, Arizona, USA N7SZS(a)K7BUC.AZ.US.NA No free man shall ever be de-barred the use of arms. The strongest reason for the people to retain there right to keep and bear arms is as a last resort to protect themselves against tyranny in government. <-------- Thomas Jefferson --

1 0

The ITARs [support your CRYPT-IN rights!]
by a2＠ah.com 17 Dec '03

17 Dec '03

> Jim Miller says: > > Section #120.9 of the ITAR defines "Defense Service" as: > > > > (1) The furnishing of assistance (including training) to foreign > > persons, whether in the United States or abroad in the design, > > development, engineering, manufacture, production, assembly, testing, > > repair, maintenance, modification, operation, demilitarization, > > destruction, processing, or use of defense articles; or > > (2) The furnishing to foreign persons of any technical data > > controlled under this subchapter (see #120.10), whether in the United > > States or abroad. > Perry E. Metzger responds: > This is sick. According to this, I cannot teach foreigners about > cryptography in the U.S. -- even about the open literature. This is a > grotesque denial of my first amendment rights. > > I wonder if I should hold an open enrollment cryptography class for > the sake of civil disobediance. > > > This is exactly the sort of issue the Cypherpunks were formed to address. CALL TO ACTION: I suggest that those of us who are able to do so immediately lay plans to offer such courses. These courses should only contain open information, and they be specifically advertised to foriegn nationals living in the US. To the extent possible we should coordinate these courses, perhaps to content, certainly to date and notification of the interested authorities. The should happen in every corner of the land. The time for the CRYPT-INs has come! [No one who supports with the government's right to suppress publically available information should participate.] -a2

1 0

secure rlogin?
by Ed Carp 17 Dec '03

17 Dec '03

In the licensing agreement that comes with RIPEM, there is mention of a secure rlogin using D-H key exchange. Does anyone know if this is publically available? Thanks! Ed Carp, N7EKG/VE3 ecarp(a)netcom.com 519/824-3307 Finger ecarp(a)netcom.com for PGP 2.3a public key an88744(a)anon.penet.fi If you want magic, let go of your armor. Magic is so much stronger than steel! -- Richard Bach, "The Bridge Across Forever"

1 0