December 2003 - cypherpunks-legacy

Re: Mixmaster status changing
by James A. Donald 17 Dec '03

17 Dec '03

At 03:04 PM 9/14/95 -0700, Lance Cottrell wrote: >There has been an offer to purchase and commercially develop Mixmaster. >This will hasten the development of Mixmaster for other platforms (e.g. >Dos, Windows Macintosh), and bring significant improvements to the >interface, but I will not compromise on the level of security provided by >Mixmaster. Free client software will continue to be available. This is great, but of course what we urgently need is a free windows client. What is the score on this? --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

RE: Commercial Mixmaster
by syrinx＠c2.org (Syrinx Anonymous Remailer) 17 Dec '03

17 Dec '03

nelson(a)crynwr.com (Russell Nelson) wrote: > There *will* always be a free version of the client with source > code, but the proprietary improvements will probably not be merged > into the free version. Lance, and only Lance, as copyright holder, > has the publish the code under a different copyright. It's the same > thing that Phil Z. did with ViacryptPGP. It's not the same thing, though. PGP 2.6.2 and PGP 2.7 are compatible. You can compile 2.6.2 from the sources and have it interoperate with Viacrypt 2.7. The concern is not "commercialization", per se, but rather the use of "commercialization" as an excuse to build in "proprietary" features (Back doors?) for which no corresponding source code is involved. Since no one has made a good case for there even being a COMMERCIAL market for Mixmaster, could there be other motives? Without building an anonymous e-$ infrastructure first, there's no way to even charge for the use of a remailing service without sacrificing anonymity, even if people were willing to pay to have messages anonymously remailed. No, I'm not accusing Lance. But if he no longer has the time to support Mixmaster, then perhaps some other crypto-friendly group should take over the task and keep it an OPEN system, with source code available. In fact, even freezing Mixmaster as is would be preferable to "improvements" that people don't/can't trust. True, they *COULD* provide source code, but how many commerical products come with complete source code?

4 3

[ASSENT NOISE] Re: C-punks, marketing for the masses
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:08 PM 9/16/95, Greg Broiles wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >No disrespect intended, but I think that the various "let's sanitize >the Cypherpunk message for mass acceptance" marketing/soundbite >proposals are pointless. Cypherpunks is a mailing list, not a political >party (or a platform). > >- From my perspective, the organizing meme for the list is not "strong >crypto is really important, so let's write some and lobby our lawmakers >to make sure it stays legal" but "strong crypto is here and is changing >the dynamics of force, politics, and power, so let's see what we can >do with it." Hear, hear! Greg is absolutely right. (And Dave Mandl was, too, about our mailing list not being a corporation trying to increase market share.) I applaud the efforts to lobby Congresscritters to vote in ways we would find desirable (though I note with some irony that the Congressman who has come out most strongly _against_ Net censorship is Newt Gingrich, often demonized by many. To the credit of EFF and EPIC, and others of that ilk, they noted this fact.) But as Greg points out, we are not a political party. More to the point, we have no centralized resources, no staff, no travel budgets, no ability to appoint spokespunks to speak to the media. This is a weakness, and a strength. I think it was Bill Stewart who noted that the "conventional" cyberspace lobbying groups, such as EFF, EPIC, CPSR, etc., are largely "director-driven," with a handful (or just one or two) directors making decisions, speaking publically, and getting all the attention. The Cypherpunks group is not like that. Lacking any formalized leadership, and--most importantly--lacking offices in D.C., we can't be asked to perform like the usual trained seals who produce the soundbites that fit into the stories too many reporters want. Again, a weakness and a strength. I sense in the debate here that some of us want to have more of an impact, more of a political impact. The cynic in me says these people have just not been in the game long enough to become realists (to a cynic, cynicism is realism). >(And no, I don't think it's important to spread that "meme" (a term >I use with some trepidation) around to get "market share" for it. >Ideas are not football teams nor initiative proposals.) > >I appreciate and support and have participated in various write-yer- >legislator activities. They're useful short-term. But if Tim May and >Duncan Frissell and the other list members who've dared to make predictions >about the impact of crypto on government and economics are correct, >what the government and the legislators want doesn't matter. If they're >wrong, what we want doesn't matter. I suppose it is mainly Duncan and I that make these points, with contributions also from Sandy Sandfort, Black Unicorn, Lucky Green, and others (sorry if I've left you out of the Cryto Anarchy Hall of Shame^H^H^H^H^H Fame). Please understand that I am not elitist in the sense of wishing to limit access to ideas many of us espouse. I discourage no one from calling in to radio talk shows, from writing articles, and so on. But I'm not convinced that "political action" matters very much. As Greg puts it, if we're right, politics won't matter. And if we're wrong, politics won't matter. --Tim ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Newbie Crypto question: MOD?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:39 PM 9/16/95, Childers James wrote: >Ok folks, I recently received "Applied Cryptography" as a gift, and just >have one question: How does the MOD function work in crypto functions? It >seems to work differently than what I've seen before, i.e.: C/C++ MOD. I >also didn't see anything in TCM's FAQ... > >If this is considered noise, I apologize in advance. I didn't put anything in my FAQ about "mod" because my FAQ was not a crypto FAQ per se, of which there are at least two. (Cf. sci.crypt for regular pointers.) And I doubt that either of these FAQs discusses the mod function, though I haven't checked. In any case, Schneier devotes several pages to mod, starting with "You all learned modular arithmetic in school; it was called "clock arithmetic"" (p. 198). After defining it, Schneier goes on to discuss its use in modern cryptography. If this isn't enough of an explanation, I don't know what more to say. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Commercial Mixmaster
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Adam Shostack writes: > Its worth noting that the source code to Julf's Penet remailer > is not public (AFAIK). People use it becuase they trust Julf, or > trust people who trust Julf. People don't use Julf's source code. People use the services provided by Julf's remailer, which runs Julf's source. Trusting anon.penet is relatively simple (conceptually) because the author, distributor, and user of the remailer code (where user = remailer operatror) are all the same person. I would be less likely to trust Julf if I thought he was running software he received (through unknown distribution channels, from an unknown author) as an executable without source. I trust Julf because (a) he seems to be a decent/trustworthy person, and (b) because I think he has enough information available to him to be sure that his system doesn't have intentional back doors nor glaring unintentional ones. If only one of (a) and (b) were true, I'd trust anon.penet.fi a lot less. I've seen messages from people who refuse to use ViaCrypt PGP because they can't see the source. I own a copy because I don't want to worry about licensing when I use it in a commercial context and because I don't think Phil would have been associated with it if the binaries distributed weren't free of known weaknesses different from those document with the freeware PGP or otherwise discloses. My inclination is to feel the same way about distributions of Mixmaster. If Lance is willing to sign the code which is shipped, my hunch is that there's nothing tricky going on. If Lance disappears, and the purchaser turns out to be unknown, I dunno if I'd run it before someone trusted had disassembled it (or someone liberated the source code) and it was inspected and found to be clean. [I think it's useful to continue beating the almost-dead horse of the marketing of Mixmaster because I suspect that the anonymous purchaser of Mixmaster subscribes to the list, and is thereby aware of what potential remailer operators and remailer users are going to like, and not like.] > Why pay for remailers when there are free ones? Speed and > lawyers pop right up as damn good answers. Putting up a couple of > p120s on a T1 in the Carribean isn't cheap, nor is making sure you > have a good lawyer who'll protect the machines when the bad guys show > up with warrants. I'd be much happier to use a fast system on good > legal ground than a freebie. It's safer still to use a system which doesn't keep logs and has otherwise taken steps to minimize inadvertent data leakage. (Imagine me mentioning here all of the by now tiresome ideas about thermite, degaussers, low-level-formats of the HD, etc, etc. Please, please, let's not start that thread again for at least 6 months.) I'm not sure that there are any special lawyer tricks to stop the execution of a search/seizure warrant. An attorney may help you keep items found out of court later. I suppose it'd be possible, if the cops were cooperative and the attorney immediately available and the magistrage/judge who signed the warrant was immediately available to try to stop the execution of the warrant, but that seems pretty far-fetched. I've been reading a lot of search & seizure cases lately for work and haven't seen anything like this mentioned, ever. If anyone's got a cite for "how to stop a warrant search & seizure in progress", please pass it along. I'm sure my boss (and his clients) would be interested. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMFuuJn3YhjZY3fMNAQGsRAP+PIm6ZsjfCFetFr0//LPUuBg+tiK9b8Dh 4WXji1ab6kCfB+SCbNhU7IDNCR7pK7c1rWjVL+r0gbded46Um6+mn5hDKagKhztD nqld1vTETJFX9TmsRe3mXBE/TW1pqysoiS3PnM4mZ8b0GjErOdSbNpxOizvBOdhi jLoNKnEGnpA= =3dgI -----END PGP SIGNATURE-----

2 1

Mixmaster Licensing Offer Explained
by loki＠obscura.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- From: Lance Cottrell <loki(a)obscura.com> Date: 17 September 1995 Subject: Mixmaster Licensing Offer Explained Permission is granted to distribute this document in any media for any purpose as long as the entire document is distributed with the attached digital signature intact, or the document is clearly marked as having been modified with the locations of deleted text indicated. Several rumors have surfaced following my announcement of Mixmaster's changing status. I want to nip these worries in the bud. After discussion with the party interested in commercially licensing Mixmaster we have decided to explain the whole situation publicly. The company offering to license Mixmaster is Phoenix DataNet, a Houston area ISP. John Perry, a person well known to this list and the remailer community in general, is a Senior Systems Administrator at Phoenix. On Thursday I received a call from John. Some others at Phoenix had just noticed a Mixmaster remailer he had been running on one of their machines. Phoenix has several large corporate customers who need secure transactions for some special applications. The core engine of Mixmaster is well suited to that purpose. They offered to license the code from me to use as the framework on which to build these other programs. In the process they will rewrite many basic functions in Mixmaster that need major overhaul (e.g., key management). We will incorporate those improvements back into Mixmaster. This should lead to porting Mixmaster to several other platforms, and to fixing most of my worst coding atrocities. I had never considered licensing Mixmaster, but I know John Perry both personally and by reputation. He has thoroughly assuaged my fears that Phoenix would try to weaken or restrict Mixmaster in any way. John will be leading this project on the Phoenix end. He asked that I delay the release of the next version of Mixmaster pending clarification of every one's intentions. Now that we have reached an understanding the planned release of Mixmaster version 2.0.2 will take place as soon as I can get it ready. There are no plans to sell Mixmaster clients or servers. They will continue to be released free with source code. I will still control the contents of all releases of Mixmaster. All future versions of Mixmaster will be backward compatible. There will be no "Legal Kludges" preventing old clients from working with new remailers, and new clients will be able to generate old message formats. Currently there are no plans to change the message format at all. -Lance Cottrell -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMFvVivPzr81BVjMVAQHzhgf/f9zM91/N0S/JljicjDpoGzQ6Pt4gZVy9 ar407vp6js7EJ7Kg2XHtni6FwowM066rbGrt8W/8ZoQJGBxgKkfSvhLpEL7E926M tn5QDEysVa1itzkvym2rQuNRIALfLOwzcYyLMdfjBtPMhRJkfwDthrrl9ocHkrSR WW1wPwBRj/t+LFl6ueXwN8ZYLJVmbIoLy7BcqbNzLWjqmB7jgN2toxVCRfM7qfkE DX1M/+hPddE6dT8ZgWdSt9dUvMQ7hu8BfHKCkcf0XWKmmeJ8jh+XDISvC7EFgIGT H5XjkLpA2Eg+qmYzKHDOQaQT9SfzSVs4Y9sTzMlbewBi3jna6Dz/Sw== =G2pZ -----END PGP SIGNATURE----- -- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche

1 0

Re: [ASSENT NOISE] Re: C-punks, marketing for the masses
by banisar＠epic.org 17 Dec '03

17 Dec '03

> >The Cypherpunks group is not like that. Lacking any formalized leadership, >and--most importantly--lacking offices in D.C., we can't be asked to >perform like the usual trained seals who produce the soundbites that fit >into the stories too many reporters want. Again, a weakness and a strength. Hey! Bark Bark Bark Bark Dave (partially trained seal protesting that description) PS Sorry all for my last message that should have only gone to Bruce. I'm claiming jetlag. David Banisar (Banisar(a)epic.org) * 202-544-9240 (tel) Electronic Privacy Information Center * 202-547-5482 (fax) 666 Pennsylvania Ave, SE, Suite 301 * ftp/gopher/wais cpsr.org Washington, DC 20003 * HTTP://epic.digicash.com/epic

1 0

Trained Seals and Beltway Insiders
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:23 PM 9/17/95, Dave Banisar wrote: >> >>The Cypherpunks group is not like that. Lacking any formalized leadership, >>and--most importantly--lacking offices in D.C., we can't be asked to >>perform like the usual trained seals who produce the soundbites that fit >>into the stories too many reporters want. Again, a weakness and a strength. > >Hey! Bark Bark Bark Bark > >Dave (partially trained seal protesting that description) Well, sorry for letting my rhetorical excesses come to the fore! On even days I think the work of the Washington lobbying/policy groups is very useful, even if not always done the way I would do it. (Having grown up just outside D.C., nothing would ever get me to live in that area again, though.) On odd days, I think of them as "Beltway insiders," with the same handful of "spokeswonks" handling all of the issues, dealing with all of the press conferences, attending the various D.C. events, and essentially being part of the System. I never did memorize what all those "estates" are, as in the Third and Fourth Estates. But I think the Washington crowd has several components: The Gubment (itself divided into several branches), the Press, the Contractors, and the Lobbyists. The "think tanks" which ring D.C. and other areas (Brookings, Cato, the new Progress and Freedom Foundation, the military advisory think tanks, and a dozen or more others) are an industry unto themselves. Add to these the various lobbying groups (NRA, AMA, tobacco, Right to Life, etc.). And throw in various national groups with D.C. offices. Quite a stew. They all play off each other, with the lobbying groups trained to "give good sound" to the reporters who want some quotable line about child porn, or Clipper, or whatever. Any conclusions for us? Maybe, but I won't touch them here. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: CYPHERPUNK considered harmful
by David C. Lambert 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Black Unicorn <unicorn(a)polaris.mindport.net> wrote: > On Fri, 15 Sep 1995, David C. Lambert wrote: > > > BTW, I'm not for changing the name of the list, but I do see the logic > > in a more establishment-friendly name to use when lobbying the public. > > Distrubute [sic] watered down cypherpunk "teachings" in more benign forms which > hide their true (Ohhh! Scary!) potential in an effort to make them commonly > acceptable to joe sixpack. I believe you misstate the point that people are trying to make. I haven't seen anyone advocating the "watering down" of any so-called "teachings" to "hide" any "true potential". The only thing that people have mentioned is that some of the less clueful out there have a knee jerk response to the name "cypherpunk". That's all. > Can't we all see what road this leads down? No. Please enlighten us. > At the risk of politicizing the issue, I wouldn't be the first to call this > "left-speak" or "term-sanitizing." And this matters because...? > Really the core issue is that the citizens of their respective nations > need to either: > > 1> See cryptography for the important individual rights issue that it > is and latch on to the basic desire for free and unmonitored commerce and > exchange without censorship or observation. > > or > > 2> Decide that they are not interested in the issues because these > issues are too radical, or simply because their own political ideas > fall left (or statist) of this spectrum. What exactly is it that you feel "the citizens of their respective nations" are doing right now, if not this? > in the end I > don't care if every joe sixpack on the planet uses real crypto, just so > long as those I am to conduct commerce (of data or goods) with do. If this is the case, then I'm at a loss to understand how you fail to see the merit in a "term-sanitizing", as you put it, in order to make the use of strong crypto desired and required by Joe Sixpack. How do you expect the legality of string crypto to survive unless Joe and his friends exert political pressure to keep it alive? Isn't it obvious that unless this happens, that strong (unescrowed) crypto is on the path to being outlawed (at least in the US, and several other countries)? > The final judgement will be in the advantage of velocity and security of > transactions and the wealth that this "allocates" to those wise enough to > adopt crypto exchange systems. Evolution in action. If this makes me > elitist, so be it. Elitist or not, this is beside the point. People are bringing up political and rhetorical concerns because they feel that political and persuasive methods are required *right now* in order to preserve the *legality* of strong crypto. I only care about whether Joe Sixpack wants strong crypto because if I can't persuade him that he does, he won't help me keep it legal in my country of residence. Once it's legality seems safe(r) from attack, he can go on using rot13 for all I care. David C. Lambert dcl(a)panix.com (finger for PGP public key) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMFxSiapplsfgM88VAQGj5wQAoY2FQe0rh0InWF1xOmST91QDCy4TrYUj Y6Vnu/i3yspS/vDsKLMbIYAezAJEtgOPHEOf7Rv1Y4gKDyZNAJbYESXiYTQXD7O3 SNWNtb9nAT6l1RPqsnFR9yWAWYQ1CS3dLRpNpMBIqzL/HnKyKrgitLKQ530XtF8O 78u6jtmsBa4= =Jgoe -----END PGP SIGNATURE-----

3 2

Re: Mixmaster Licensing Offer Explained
by tcmay＠got.net 17 Dec '03

17 Dec '03

(I've trimmed the mailing lists I'm not on...) At 8:01 AM 9/17/95, Lance Cottrell wrote: > Permission is granted to distribute this document in any media for any >purpose as long as the entire document is distributed with the attached >digital signature intact, or the document is clearly marked as having been >modified with the locations of deleted text indicated. So sue me. :-} (That is, I'll treat this article in the normal way, trimming sections I'm not responding to and making note of elisions only where I think it important to.) ... >The company offering to license Mixmaster is Phoenix DataNet, a Houston >area ISP. John Perry, a person well known to this list and the remailer >community in general, is a Senior Systems Administrator at Phoenix. > >On Thursday I received a call from John. Some others at Phoenix had just >noticed a Mixmaster remailer he had been running on one of their machines. >Phoenix has several large corporate customers who need secure transactions >for some special applications. The core engine of Mixmaster is well suited >to that purpose. They offered to license the code from me to use as the >framework on which to build these other programs. In the process they will >rewrite many basic functions in Mixmaster that need major overhaul (e.g., >key management). We will incorporate those improvements back into >Mixmaster. This should lead to porting Mixmaster to several other >platforms, and to fixing most of my worst coding atrocities. First, I think it generally a Good Thing that remailer software gets commercialized and cleaned-up, or that at least commercial packages exist. (I'm not going to get into commercial vs. non-commercial and Microsoft vs. Gnu issues.) If Lance makes a bunch of money off this, more power to him. However, this commercialization raises some interesting issues. Others have dealt with various concerns about the code integrity, about features added, and even about TLA access. I'll address some liability and legal issues. * Will Phoenix DataNet be making the mix software available for purchase, or are they funding _internal development_? (That is, mixes for their corporate clients, which raises some interesting issues in and of itself, as discussed below.) * If Phoenix is planning to resell Mixmaster, or whatever they call it (as "Mixmaster" may remain a trademark of the appliance company which originated the name), what will be their liability for the various abuses which are likely to occur? None of the existing remailers/mixes has had "corporate" backing, and the "deep pockets" corporations are often presumed to have, so lawsuits have not gone after corporations. * On the other hand, if Phoenix is primarily aiming at internal use, for specified corporate customers, how will they stop others from using the service? If chaining is used, and absent any special "untraceable postage tokens" they might issue (as one way to control access), how will the Nth mix in a chain of M mixes "know" whether an incoming message can be remailed or not? (Schemes to sign the packets obviously flunk the anonymity test.) There are many other interesting issues which crop up when Giant Corporation begins to deploy and use remailers. What if, for example, the Justice Department claims that Phoenix and its customers are using remailers for price fixing and collusion? (Just to be clear on this, I personally have no problems with such collusion....but the Antitrust people see things differently.) (To be sure, telephones can and of course have been used to collude. Partly, wiretaps help here (until voice encryption happens...). But Justice has gone after airline reservation computer systems which they believe were used to "signal" price information. Imagine how overjoyed they'll be to see Phoenix DataNet deploy their system!) Again, don't confuse my arguing points here with any kind of advocacy of the Justice Department/Antitrust Division position. I'm only trying to think out what some of the legal issues will be that face the first U.S.-domiciled company to actually start selling remailers or to set up a remailer network for customers. Interesting times ahead. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0