December 2003 - cypherpunks-legacy

IMP (was Re: ecash-info (fwd))
by rah＠shipwright.com 17 Dec '03

17 Dec '03

>Forwarded message: >> From info(a)DigiCash.nl Mon May 30 05:44:18 1994 [snip. . .] >> http://digicash.support.nl [snip. . .] This, like CommerceNet(tm), seems to be pretty much under construction. The store windows look nice, however... >> >>... >> David Chaum On another point, I still think I'm subscribed to imp-interest, the internet mercantile protocol list, though I haven't seen anything much come out of there lately. It got Detweiler-infested and flamed over pretty badly before it went moribund, but I think imp-interest died primarily because implicit in it was a sort of top-down-plan idea that was incongruous with the do-it-first ethic of the internet. Cypherpunks write code, or Chaum does, anyway ;-). At the risk of violating that canon, ( I couldn't code my way out of a paper bag, even though I've designed an application or two) I'd like to start a thread here. Could we talk about IMP here? Here's what I think: 1.) Chaum's e-cash coupled with WWW/Mosaic is a de facto internet mercantile protocol. 2.) It seems to me that that e-cash, contrary to the status quo's thinking, is *critical* to internet commerce. An anonymous cash market is most unrestricted and efficient market there is, because privacy/security (more than trust, I think) is the capstone of any serious transaction mechanism. The imp-interest people seemed to be afraid of e-cash because the Chaum-patent hairball reminded them too much of the RSA/PGP fight, and probably because they didn't want to be associated with any wild-eyed crypto-anarchists(tm). (As a dyed-in-the-wool yellow-dog congenital up-by-your-bootstraps crypto-fascist <gasp> republican, I haven't the slightest idea what they're talking about. . .) 3.) Since a big pile of the discussion on this group lately has been about our collective concerns about an RSA-approved version of PGP, I think there is a real parallel here in e-cash. Not that some enterprising cypherpunk should immediately code up "e-cash for the masses"; that would be way cool but probably not within the second-mortgages of the people here. However, some effort should be made to get Chaum et. al. to see to logic of distributing *both* the "cash-register" and the "wallet" of this e-cash system to anyone who wants it. It seems that, like Mr. Bill (Gates), his real market is the people who make e-cash ("banks", "currency exchanges", "mints"), not the people who use it. Just a second. My flame-suit is around here somewhere... OK. Flame on. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

3 3

Re: IMP (was Re: ecash-info (fwd))
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Oh boy. Now I'm in for it... I *really* didn't mean to put the ball through the window, mister, I was just trying to play.... Tim May said, > >David Chaum's work is of course central to Cypherpunks... [Agree to all up to this point \|/] >IMP-interest folks had an especially naive view, for the most part >(based on posts I saw and things I heard from participants). I wished >them well, but it seemed unlikely that a group of such hobbyists could >build a real digicash system while avoiding Chaum's work! > >> implicit in it was a sort of top-down-plan idea that was incongruous with >> the do-it-first ethic of the internet. Cypherpunks write code, or Chaum >> does, anyway ;-). > >Even with the smiley, are you implying Cypherpunks don't actually >write code? [I think the ball goes through the window about here...] I *really* didn't mean that at all. I did not *even* mean to "cast asparagus" on your collective efforts. *Really*. What I meant is that Chaum seemed to be making the implicit claim that he had gone out and done something a whole lot of people around here seem to have been hoping for for a long time: an Internet Mercantile Protocol. *Not* a Kerberos-based Billing Server, *Not* anonymous credit cards, *Not* a coffee-klatch at a BOF session somewhere, but a real way for people to do cash transactions on the internet. I think of Chaum as the 900 lb gorilla in all of this. Chaum is really (because he owns the patents, after all) the only guy who could do something here. I am _happy_ that he and his folks have kicked the snowball down the hill. In my enthusiasm, I was applauding Chaum for doing something whose time has come; I was *not* saying anything about the efforts of the people on this list. If I gave that impression I *really* apologize. Now the other stuff... >> Could we talk about IMP here? > >Digital cash is discussed here often. And every one of the various >"digital money" schemes announced by folks has--I think--been forwared >here and discussed. In my view, Cypherpunks have talked a lot more >about Internet Mercantile Protocols than the IMP-interest list has >talked about crypto (an absolutely core technology, of course). Having read the roasted-over imp-archives on thumper at belcore, I agree. I was making the request in light of the fact that you folks have worked over this ground before. I was asking your indulgence more than anything else... > >> 1.) Chaum's e-cash coupled with WWW/Mosaic is a de facto internet >> mercantile protocol. > >Hardly. Maybe it will be in the future, but enough infrastructure >pieces are lacking that it can hardly be called a "de facto internet >mercantile protocol." [snip] > >(Cf. the soda archives for a "Glossary" and various articles on >Chaumian things.) [will do] This is the main point of my posting, I believe. It seems to me that more than that is being claimed by Chaum and Co. [snip] >Of course crypto and true digital cash is central....this is our whole >message, nearly. Violent agreement here... >You may be new to the list, but Magic Money/Tacky have been discussed >as recently as last week. And ftp sites have been listed. Also, within >the last week there were several discussions of making the schemes >more "usable by the masses." (Having said this, MM is _not_ an easily >usable, readily-convertible currency or even a payment xfer system for >real currency...again, see the many posts on this.) I agree. I just started learning about all this stuff in the last three months or so. But, I've been lurking here since. I have been paying attention. Honest. I've been trying to do my homework. I've pulled everything down out of Nexis/Lexis that I could find on Internet Commerce and Digital Cash, Chaum, Eric, the Cypherpunks group (not you in particular, I'm afraid ;-)). Hell, I've even read Schneier, though for the life of me I couldn't discuss 10% of the technical stuff and keep a straight face (for pretending like I knew what I was talking about, in other words). > >> Just a second. My flame-suit is around here somewhere... OK. Flame on. Putting this thing on has drawn more fire than it kept off of me. I better keep it off. > >I don't think of my comments as flamish, but the comments here seem to >bespeak no awareness of the heavy focus Cypherpunks has had on digital >cash for a long time. Here's where I wish eudora had a "say what I mean" feature... Again my apologies... >That we have not "deployed" digital cash is >related to many factors, including patents, lack of financial >incentive (Chaum's folks have spent perhaps 10-20 man-years and >several million dollars, and Chaum holds key patents...it is hard to >imagine any of us competing head on...and make no mistake about it: a >"Pretty Good Digital Cash" scheme would, on the whole, be a much >larger project than PGP was), etc. I suppose my point was that Chaum seems to be seeing what is happening out there, (CommerceNet) and has decided he can make things happen by opening up things a little bit. I applaud this. I was egging him on. I was *not* trying to get my tail-feathers fried. My analysis may be simplistic, but when Digicash Inc. says this: > >Payment from any personal computer to any other workstation, over >email or Internet, has been demonstrated for the first time, using >electronic cash technology. I figure that somebody acted. Somebody wrote code. Is it shipping? I have a product I'm dying to sell this way right now. Maybe I should wait a day before I post when I get excited about something... As it is, I feel like Garth and/or Wayne. "I'm not worthy!, I'm not worthy!" I really didn't want get into it with Tim May of all people... How many lawns do I have to mow to pay for the window, mister? ;-). ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

3 2

Seattle Times cpunks article, 5/27/94
by Matt Thomlinson 17 Dec '03

17 Dec '03

Paul finally polished this one up and put 'er in print. It talks about the NSA document, cypherpunks, and clipper. Pretty good, I thought. (c) 1994 Seattle Times, I'm sure.. ;) Is government chipping away at freedom, privacy on new information highway? --------------------------------------------------------------------------- -Another in a periodic series looking at the impact of technology on contemporary society- By Paul Andrews, Seattle Times staff reporter Long dormant, '60s-style civil disobedience may soon make its reappearance -- not at college campuses or draft inductions but on the information superhighway. The issue this time around: electronic privacy. An underground computer group, known as cypherpunks, is among a variety of groups fighting the Clinton administration's attempt to monitor electronic communications, saying it smacks of Big Brother and thought control. And they're intent on using the electronic equivalents of protest marches, sit-ins and card burnings to make their point. The dress rehearsal came last month when cypherpunks distributed the employee manual of the National Security Agency over the Internet in an attempt to embarrass the administration. The incident was generally viewed as a teenage prank. Although an intriguing glimpse into the psychology of one of the government's most secret bureaus, the manual is not a "Top Secret" document. The agency contacted and questioned at least one cypherpunk, but took no formal action. "There was no information in the document that would be considered damaging to national security," said Judi Emmel, public-relations officer for the NSA. But observers say the episode presaged the inevitable: digital enactments of civil disobedience not seen since publication of the Pentagon Papers in 1971. In that case, a one-time Pentagon consultant named Daniel Ellsberg leaked documents to The New York Times and Washington Post, detailing decades of official deceit, ineptitude and ignorance over Vietnam foreign policy. The Justice Department attempted--unsuccessfully--to bar newspapers from printing the papers, arguing that publication threatened U.S. soldiers and wartime strategy. Ellsberg, whose action contributed to President Nixon's eventual disgrace and resignation, was charged with 12 counts of espionage, conspiracy and theft. The case ended in a mistrial. Inevitably, Net observers say, an Ellsberg-style cyber protester will post classified documents on the Internet--not as a prank, but to embarrass, disrupt or otherwise bait the government. Digital protests could take other forms as well -- everything from mail "bombs" -- long files meant to slow a system's functions or operations -- to viruses or "hacking" (entering and damaging files in) federal computers. If such actions happen, the government's response may move legal principals behind the First Amendment and Bill of Rights to a new and untested electronic arena. "It's absolutely going to occur," said Winn Schwartau, author of the recently published "Information Warfare." As government documents leak and people get hold of them, whether for personal or political reasons they're going to be on the Net." Like Ellsberg, cypherpunks say their aim is to expose government mendacity and incompetence as a defense of the public's right to know in a democracy. Their target: the Clipper chip, a device placed in computers that would enable security agencies to eavesdrop on, store and search all electronic communications. Last month's episode began when a 25-year-old Austin, Texas, computer engineer, Chris Goggans, posted an electronic version of the NSA manual in Phrack, an on-line magazine he publishes. It was then copied and redistributed to Electronic Frontier Foundation (an activist organization) and cypherpunk news groups on the Internet. Goggans, who uses the on-line alias "Erik Bloodaxe," reported that he received the manual in a white envelope with a Silicon Valley-area postmark and no return address. It's impossible to determine how many of the Internet's estimated 15 million to 20 million users saw the posting. Among the Net's community of users concerned about electronic privacy, it received wide distribution. Traditionally the NSA, whose specialty is decoding encrypted information, has been steeped in secrecy. During the Cold War era, its existence was routinely denied, but it has become more open since President Clinton office. The NSA manual urges employees to be vague about their job without drawing "attention to themselves nor to their association with this agency." Intelligence employees with specific job classifications are directed to "generalize" their titles to "research analyst." The manual states that it is "FOR OFFICIAL USE ONLY," encompassing "information or material which, although unclassified, ... should not be given general circulation." If the manual is disclosed, "appropriate administrative action will be taken to determine responsibility and to apply corrective and/or disciplinary measures," it states. Emmel indicated that the agency, although "not particularly pleased" with the cypherpunk posting, did not consider it illegal. "A Freedom of Information request could do the same thing," she said. Cypherpunks say the symbolism is more meaningful than the action itself. The manual was posted "to embarrass the NSA at a point where they are pushing the Clipper chip," wrote Grady Ward, an Evergreen State College graduate living in northern California, in response to an electronic inquiry. "If the NSA can't keep its own security manual from the hands of the public, what guarantees they can keep the Clipper keys" from falling into the wrong hands, he said. Ward was contacted afterward by an NSA security officer, whom he gave instructions on how to subscribe to Phrack. A Seattle cypherpunk, Matt Thomlinson, who goes by "Phantom," said he would have published the NSA manual even if it had been classified. A Univeristy of Washington senior from Auburn who had never heard of the Pentagon Papers episode, Thomlinson said he would publish classified documents to make a point only if doing so would neither harm national security, nor put someone in physical jeopardy. "It really depends on the situation," he said. The Clipper chip is designed to encrypt data transmissions over telephone lines so they cannot be read without a decoding key. Under the administration's plan, one half of the key would be held in escrow by the Treasury Department and the other by the National Institute of Standards and Technology within the Commerce Department. Government security agencies would have to get permission from the escrow agencies to use the key to decode suspect communications. Cypherpunks, a largely anonymous group of programmers whose name combines the terms cyberpunk and cipher(using the British spelling), support encryption, but say only senders and recipients should hold the keys. They argue that the Clipper keys would fall into the hands of terrorists, criminals or spies. "The idea that nobody will do this is ludicrous," said Scott Northrop, a Seattle cypherpunk who uses the pseudonym "Skyhawk." "The incentives are enormous." The Clipper chip would be replicated, they say, or obtained by a double agent such as Aldrich Ames, who has been in the news latedly for selling classified material to the Russian government. "They (cypherpunks) didn't have to go to the trouble of printing the NSA manual to make their point," said Jim Warren, a Silicon Valley computer-industry pioneer who founded an annual conference on Computers, Freedom and Privacy. "Aldrich Ames is evidence enough." Warren thinks foreign corporations after trade secrets would eagerly pursue Clipper technology -- "and they have a considerably more suspicious profile than foreign governments." The administration counters that without the Clipper "trap door" capability for monitoring communications, encryption will be used to conceal covert or illegal activities from enforcement authorities. Administration officials have suggested that without Clipper capability, encryption may have to be banned altogether. An attempted ban would be a folly, said Schwartau: "From a political, social, technological and pragmatic standpoint, it ain't gonna happen." A popular slogan on the Internet sums up opposition to a ban: "If encryption is outlawed, only outlaws will have encryption." Unswayed, the administration is moving to put Clipper encryption in government interagency communications. So far it has indicated that compliance by private industry and citizens should be voluntary. If classified documents were posted on the Internet, it's unclear what government response would be. Emmel said such a step would be met with "appropriate action," but she declined to elaborate. ----- Matt Thomlinson University of Washington, Seattle, Washington. phone: (206) 548-9804 Check my home page -- ftp://ftp.u.washington.edu/public/phantom/home.html Get PGP 2.2 or 2.5 key via email or finger phantom(a)hardy.u.washington.edu

1 0

Diff utility available from SIMTEL
by edgar＠spectrx.sbay.org 17 Dec '03

17 Dec '03

To: rel(a)lipo.st.co.at (Roland E. Lipovits) CC: Cypherpunks <cypherpunks(a)toad.com> Roland, Thanks for posting the additional changes needed for Alan Barrett's formatting of 8-character Key ID's. It was very helpful. You also said, (Sorry for the format, I have no diff-utility therfore it's made by hand.) You can get a free diff utility from SIMTEL. dif115ax.zip 73327 02-04-93 <gnuish> B GNU Text file differences finder, v1.15, EXE You can get via FTP from Repository primary mirror site OAK.Oakland.Edu (141.210.10.117) and its mirrors wuarchive.wustl.edu (128.252.135.4), archive.orst.edu (128.193.2.13), ftp.uu.net (192.48.96.9), ftp.funet.fi (128.214.6.100), src.doc.ic.ac.uk (146.169.2.1), ftp.switch.ch (130.59.1.40), archie.au (139.130.4.6) or NCTUCCCA.edu.tw (140.111.1.10), ftp.technion.ac.il (132.68.1.10), or by e-mail through the BITNET/EARN file servers. If you don't have FTP you can order it via an E-mail server. To: LISTSERV(a)VM1.NODAK.EDU (ND State Univ - SIMTEL) Subject: any Body: /PDGET MAIL /pub/msdos/gnuish/dif115ax.zip -- edgar(a)spectrx.sbay.org (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Cupertino, Ca

2 1

sorry, serios error in previoos text
by jp＠jep.pld.ttu.ee 17 Dec '03

17 Dec '03

It is rather hard to factorize even small primes :-) it should of cource read like fact. large numbers. JP from TTU.

1 0

Re: (fwd) Re: NSA Helped Yeltsin Foil 1991 Coup
by jpp＠jpplap.markv.com 17 Dec '03

17 Dec '03

Date: Fri, 27 May 94 18:54 PDT From: jpp(a)jpplap.markv.com (Jay Prime Positive) Infact, the birthday paradox just about garantees that the number is less than E1*E2*E3. After thinking about it some more, I think I would like to rephrase that. I don't think 2^k is nearly close enough to ((2^k)!)^(1/2) for me to say 'garantee'. But, it is possible for E1*E2*E3 to excede the number of permutations of the e1( e2( e3( x ))) system. j(no i am not a tmp tenticle)'

2 1

Re: IMP (was Re: ecash-info (fwd))
by Hal 17 Dec '03

17 Dec '03

> From: rah(a)shipwright.com (Robert Hettinga) > >> http://digicash.support.nl > This, like CommerceNet(tm), seems to be pretty much under construction. > The store windows look nice, however... I agree with this, which is why I don't understand why you said: > 1.) Chaum's e-cash coupled with WWW/Mosaic is a de facto internet > mercantile protocol. You're jumping the gun here a little, aren't you? There is no evidence yet that Chaum's current proposals are going to catch on. The CommerceNet idea seemed to have more backing judging from the press releases. And it did not appear to support anonymous transactions. > 2.) It seems to me that that e-cash, contrary to the status quo's thinking, > is *critical* to internet commerce. An anonymous cash market is most > unrestricted and efficient market there is, because privacy/security (more > than trust, I think) is the capstone of any serious transaction mechanism. I don't follow this argument. You are suggesting that an anonymous cash market would be more efficient than one based on checks and credit cards? It would have lower transaction costs, so things would be available for lower prices? Why is this? The hypothetical discussions we've had here on "if I ran an anonymous bank" often talked about service charges. Your use of the term "capstone" is unclear in this context. Are you suggesting that retaining privacy is more important for most people than trusting a seller in most transactions? Most people would rather buy from FlyByNight Corp if they could stay anonymous than from Sears using their credit card? I don't think so. For some people, the kind who won't use checks today and get by with cash and money orders, this might be true. But I don't see it as being the rule. > The imp-interest people seemed to be afraid of e-cash because the > Chaum-patent hairball reminded them too much of the RSA/PGP fight, and > probably because they didn't want to be associated with any wild-eyed > crypto-anarchists(tm). (As a dyed-in-the-wool yellow-dog congenital > up-by-your-bootstraps crypto-fascist <gasp> republican, I haven't the > slightest idea what they're talking about. . .) It seemed to me that the IMP list discussions degenerated into flame wars between Detweiler and cypherpunks. Those in the middle, which included most subscribers, were shocked and disgusted by Detweiler's crude flaming and this made everyone uncomfortable about bringing up the topic of anon- ymity and cash. With Detweiler on the list it was impossible to have a serious discussion of the matter. > 3.) Since a big pile of the discussion on this group lately has been about > our collective concerns about an RSA-approved version of PGP, I think there > is a real parallel here in e-cash. Not that some enterprising cypherpunk > should immediately code up "e-cash for the masses"; that would be way cool > but probably not within the second-mortgages of the people here. However, > some effort should be made to get Chaum et. al. to see to logic of > distributing *both* the "cash-register" and the "wallet" of this e-cash > system to anyone who wants it. It seems that, like Mr. Bill (Gates), his > real market is the people who make e-cash ("banks", "currency exchanges", > "mints"), not the people who use it. Chaum is trying to make money off his ideas. In doing so, he is being guided by the invisible hand of the market to try to find those niches where his technologies can be most profitable. Maybe going after the bankers is the wrong idea, but it is understandably tempting to prefer trying to get millions of dollars from a few people than a few dollars from millions of people. It does sound, though, like he is trying to branch out now and spread his technology around. Perhaps he will follow the lead of RSA and make a "ChaumREF" free implementation of his cash technology. The Commerce- Net model had RSA supplying free client software while charging the vendors licensing fees, I believe. Chaum may be planning a similar approach. It would be nice to see more details about what Chaum has in mind. My WWW access is very weak. Could someone summarize what is available at the page listed above? Hal

5 8

Re: Email Stalking on CNN
by lile＠netcom.com 17 Dec '03

17 Dec '03

I heard it too. I thought, gosh too bad she didn't know about kill files.... :( -lile

5 4

Re: "lifeguard(?)": bullet tracking system???
by rarachel＠prism.poly.edu 17 Dec '03

17 Dec '03

> What's the relevance to crypto or politics of lifeguard? What's the relevance of microphones in Dunkin Donuts? What's the relevance of Digital Telephony II? What's the relevance of 1984? What's the relevance of yet another use of technology by Uncle Sam to strenghen law enforcement and the millitary? I'm surprised at you Eric... I'd expected you jump on this from the other side...

5 5

encrypted IP
by Jim Hart 17 Dec '03

17 Dec '03

Does anybody have an update on the crypto IP efforts? I've heard there are several commercial products, including weakened U.S. DES versions from Semaphore Technologies, Motorola, Hughes, and UUNET technologies. Also, some higher quality foreign versions. How many of these products interoperate across vendors? Are there any public domain versions available or in the works? Any emerging standards, so that if I wrote my own system it could interoperate with other crypto IP based clients and servers? thanks, Jim Hart hart(a)chaos.bsu.edu

2 1