December 2003 - cypherpunks-legacy

No Subject
by norm＠netcom.com 17 Dec '03

17 Dec '03

Protocols for a Data Bank The purpose of a data bank is to store large bodies of information for long periods of time. I suggest here some protocols and contracts for a data bank and its customers. We then discuss risks, incentives and stratification of the data storage industry. These ideas implicitly rely on several types of cryptography-- public key, secure hash, symmetric ciphers and blind signatures. To explain these technologies here would substantially obscure the presentation for those who know of such things and help very little for those who don't. Here are several transactions that a data bank engages in. Acquire data: A client anonymously sends a collection of data along with funds sufficient to warrant the bank's holding the data for a few days and computing its secure hash. The bank knows the data only by its secure hash. Selling Hat Checks: The bank will sell a hat check to anyone who will pay a negotiated price. The hat check specifies the secure hash of the data, the penalty to be paid upon failure to produce the data, and the cost of redeeming the data. The hat check is signed blindly by the bank and is a bearer instrument. Any holder of a hat check can present the check along with the redemption fee and demand the data. The data bank must then either produce the data or pay the penalty to the holder of the hat check. A particular hat check is canceled whenever the bank pays the penalty like a spent Chaum DigiCash note. The bank can sell multiple hat checks for the same data. Different hat checks for the same data may specify different penalties. Sell a copy of an acquisition: Any one can request a piece of data identified only by its secure hash. The bank is free to sell a copy of the data to anyone with the secure hash. The bank sets the price. Publish index: The bank can publish its list of hashes. (This makes data hunters possible.) Cancel a hat check: A holder of a hat check may sell it back to the bank at a negotiated price thus releasing the bank from the threat of paying a penalty in the future. This also allows the bank to retrieve the physical storage where the data is stored if it is sure that it has not sold other hat checks for the data. The hat check may specify expiration dates, cancellation terms etc. The bank is explicitly permitted to disseminate the data and may well do so to lay-off risks. In this sense a data bank is like in insurance company that spreads and shares risks. A hat check may be viewed as a life insurance policy for the data. Risks Dividing trust may be done by agreeing on a notary. Upon redemption, for instance, a trusted notary might examine the hat check, accept the payment specified therein from the client, pass over the data on its way from the bank to the client while computing the secure hash, and if the secure hash matches that in the hat check, deliver the payment to the bank. The notary need not have long term financial stability as must the bank. Brokers may have an interface similar to a bank. They return baskets of hat checks. This reduces the risk to the client that one of the data banks will fail financially and be unable to pay the penalty. The broker need not be financially stable. Data Hunters can engage in knowing who has what data. Given a hash they can tell you what banks have the data. This would presumably require a new protocol with the bank. This might be the ultimate URL or URI server. Inflation can damage incentives. Hat checks might be denominated in gold or currency baskets or what ever. RSA modulus size is critical for long term contacts. 2K bits of modulus or more may be warranted. Example I can imagine the Getty Museum digitizing its Rembrandts and storing the results in a data bank. The data might be insured for $100,000,000. The bank would disseminate the data to increase security and lower its risk. The museum would probably encrypt the data and share the key and hash ala Shamir for safe keeping. The museum would not share the hat check because it wants to be the one paid upon default. Incentives A data bank, or any other player, may find that keeping data profitable beyond the point of any outstanding hat checks. It can make money by supplying copies of the data in return for a fee plus secure hash. Indeed new hat checks may be sold after the last had expired. Data banks thus have an incentive to disseminate their list of holdings in the form of hashes, as input to bounty hunters. Design Considerations It may seem strange that the data bank does is willing to sell data to who ever will pay. I suggest that because it is so easy to encipher the data and not have to trust the bank. You can distribute the key thru what ever channels you transmit the secure hash of the data. Note that bank clients are always anonymous. Data is never held for some known person. Data may be held solely for speculation. The purpose of the penalty is to motivate the bank to keep data for which there is no reason to forecast sales revenue. The Bank's State Logically the bank can perform all of these transactions by merely keeping the unordered set of acquisitions. It is practically necessary to index these by their secure hash but this can be rebuilt on demand. It must keep canceled hat checks lest it become liable to extra penalties. The bank need not keep records of hat checks that it has sold unless it wants to know when it can delete acquisitions. It may want to keep marketing information to know when acquisitions are worth keeping merely to sell copies of.

3 2

Re: Remailer Specs
by Jaeson.M.Engle＠josaiah.sewanee.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >ftp myriad.pc.cc.cmu.edu /pub/remailer >ftp cs.cmu.edu /afs/andrew.cmu.edu/usr12/mg5n/public/remailer Thanks for the sites, but after looking at them, I can say they will NOT build in THINK C. But, They might help me figure out what to do with Remailer (the Mac version I'm building). Also, I'm not writing mine in C, I'm doing it in Pascal, because 1) I have the TCP libraries for it and 2) I don't now C very well at all. -----BEGIN PGP SIGNATURE----- Version: 2.6ui iQCVAgUBLyrN9UiLvmPjc4XdAQHeuAP/djk9XYKP3YmfdluJN8hMkNajetRAjKVK i0AvDyMUjN0fs5MXfez6v8tBx65qeWY0WIi8O53O5UzS7JOtiKNF4uLbDfJZiYRW okgdCutn6l4nHxz7MiNNCo1TXvMvPyYffy+cdPuRwX7IzfxdfaVHqD14e/x+S3Cs cy9zpuCnho0= =cDiR -----END PGP SIGNATURE----- aka: (-: Jaeson M. Engle || jme(a)josaiah.sewanee.edu :-) (-: www server: http://josaiah.sewanee.edu/ :-) (-: It's February 8th! IT'S TIME!!! Ask me for details!:-) (-: Finger 'jme(a)josaiah.sewanee.edu' for my Public :-) PGP block.

1 0

Re: Encrypted Magazine Subscriptions Via E-Mail?
by Michael Sattler 17 Dec '03

17 Dec '03

>I posed this question in alt.wired. Am I missing something obvious as to >why Wired (or magazines in general) don't do this to make subscribing >easier? Because if you saw the low-tech state of the Wired office you'd understand; they're at capacity just opening envelopes and manually entering names and addresses off the checques. Visit them whenever you're in downtown San Francisco. -----------------------------------------------------------------------+ Michael Sattler <msattler(a)jungle.com> San Francisco, California | Digital Jungle Consulting Services http://www.jungle.com/msattler/ | | And so these men of Indostan/ disputed long and loud/ each in his own | opinion/ exceeding stiff and strong/ though each was partly right/ and | all were in the wrong! - John Godfrey Saxe |

2 1

Again, where to upload code?
by Robert Rothenberg 17 Dec '03

17 Dec '03

I posted this query recently with no replies, then again it's not been "duped" back to my account either, so I'm not sure if it went through. I've written some fingerprinting code for MD4, MD5, SHA, RIPE-MD and HAVAL in assembly language for 386 machiens and would like to make it available, not sure of an ftp-site... pref. ITAR-safe or are those algorithms not covered under it?

3 4

Re: Protocols for a Data Bank
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 4:39 PM 1/28/95, jpp(a)markv.com wrote: >> Date: Sat, 28 Jan 1995 15:49:13 -0800 >> From: norm(a)netcom.com (Norman Hardy) >> [...] >> Selling Hat Checks: The bank will sell a hat check to anyone who will pay a >> negotiated price. The hat check specifies the secure hash of the data, the >> penalty to be paid upon failure to produce the data, and the cost of >> redeeming the data. The hat check is signed blindly by the bank and is a > ^^^^^^^ >> bearer instrument. Any holder of a hat check can present the check along >> with the redemption fee and demand the data. > > Why in the world would the bank want to sign blindly? The bank >would be undertaking an obligation of an unknown nature. Would you >sign a blank check? A blank contract? I wouldn't. .... You are right. I forgot that the blind signer knows nothing of what we signs. The protocol requirements seem clear but I lack a protocol. I think I have a fix but I will be more careful before I post.

1 0

Re: MS Office NT
by Chris Claborne 17 Dec '03

17 Dec '03

Re: Office for NT, kahuna(a)fc.net writes: >I installed it yesterday, and played with it for about 5 minutes. ... I >wasn't able to save more than 8.3 in powerpoint, but Word did recognize this >feature, and I saved a file as 13456789012345.doc without a porblem. ...yay? This is one of the major features in NT, why the hell would they bother shipping it if it didn't support 255 char names??? ... __o .. `\<, Chris.Claborne@SanDiegoCA.ATTGIS.COM...(_)/(_). CI$: 76340.2422 --------------------------------------------------------------------------- PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Available on any Pub Key server. PGP encrypted mail welcome.

1 0

Re: Philadelphia CyberCrime
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> Heard on the news today that they arrested a plumber and are holding > him in lieu of $50,000 bail. > He used a PC to crack into the phone system and set up 'Ultra' call > forwarding which forwarded calls to other plumbers businesses to his. > He then took the calls and told the callers that his company was > covering for the one they actually called. The irony is that the original dial telephone switch was invented to prevent this kind of problem, by a Kansas City undertaker named Strowger who thought his competitor was bribing the phone operators to redirect business, and wanted to get the humans out of the loop. Bill

1 0

Re: Even more unix holy wars.
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

(Undeleting files is a security issue that's still got _some_ tenuous connection to cypherpunks :-) > How would I go around undeleting a file under Unix? It's easy on the > Mac. Doing it under DOS is ugly, but it works. But with unix, there > is no way. Sure there is. Multiple ways, depending on your objectives. All with different syntax, since this _is_ Unix :-) The simple way, implemented by lots of universities, is a fake delete, which actually renames or moves the file to some hidden location instead of deleting it; the undelete program renames it back, and there's a space-scavenger that genuinely deletes old rename-deleted files after a few days. Undeletes after that consist of getting the file from tape backup. While the System V filesystem doesn't save enough pointers to guarantee getting complete files back from deletion (if the space they used hasn't been reused already), there have been undeletes that scrounge up the newest n blocks off the free list. Of course, those were the first blocks to get used in new files, so it wasn't much use in a multi-user system, but it was there. Besides, disk drives on multi-user machines are always >95% full, and often over 98% full, so deleted files are fair game anyway... Bill

1 0

Tabloid TV coverage of pedophiles using BBS - with feedback #s
by craig＠passport.ca 17 Dec '03

17 Dec '03

On TV as I am hacking here, is some Tabloid Trash called "The Crusaders", which I would have definitely flipped off once the late movie was over, if it hadn't been for these 'intriguing' sound bites they ran: "Your children may fall victim to pedophiles in the safety of their own bedroom! And the Crusaders are out to stop them..." "The newest high tech scheme sex offenders use on your children, and how you can stop it! Child molestors on your home computer!" I am staying tuned through stories on adoption reunions and nursing home neglect, just to see how to protect my children... (20 min. later) They show a lot of kids using computers, then modems and BBS systems. They mentioned the usefulness of nets for 'homework' and games, but: "We recently tapped into a bulletin board containing hordes of files, from lingerie shots to shocking pictures... that show anything goes." "10% of the adult population on the boards are looking to solicit children, says a police chief in (Amish country in PA)." >From there I expected a lot worse, but actually it got a whole lot better: "Talk to your kids, and don't use the computer as a babysitter... parents need to know there are dangerous people out there..." An FBI expert said that the 'best way' to combat pedophiles was to educate police how computers work, and second to make people aware without implying that a computer is a bad thing. He said he thought teenagers would seek out sexually explicit material and that current 'protections' (e.g. warnings on explicit files) were inadequate. [What this had to do with pedophilia he didn't say. All the kids interviewed had been solicited on other premises... e.g. one had been lured to a pedophile's home to install a non-existent net. It seems that none of the pedophiles had lured kids with sexual materials but no point was made of this. They indirectly implied a relationship.] Other advice offered was to keep kids from offering personal information on the BBSs, and to accompany your child the first time they go to meet someone they met on a BBS. There was no brainless advocacy of censorship, nor a call to ban anoynimity (although the police chief in PA said he thought pedophiles were 'emboldened' by the 'anonymous computer environment' which is probably more or less true), even though they talked directly to one (male) kid who'd actually been raped. This was exploitative, but it was also real, and it was just stark enough to make the point. No hysteria, the kid was calm. This was the kid who had been lured to install the net. Given that they actually gave practical advice that might actually work and was not generally hysterical, it was about as good as one might expect. They fell short of saying that the pedophilia was isolated and unrelated to most of the graphic material on the boards. The "10%" was the only number they offered. Apparently they could find only 2 convictions for BBS-related pedo- philia in the US. Actually it seemed to me that the most objectionable things was this crazy 10% estimate, which might mean 10% of the adults on purely porn-oriented BBS sites, but it was left implied that 10% of *all* adult BBS/network users were trying to lure children into sexual situations! After that the most objectionable thing was the hysterical tag lines which are mandatory on Tabloid TV. They didn't seem to be written by the reporter. Reporter's name was Howard Thompson, editor was Ralph Herman Fax number for the show is 818-841-6500. Transcripts of the show are available for $6 at 1-800-777-T-E-X-T (Burrelle) Craig

1 0

Heavy Weather
by bart＠netcom.com 17 Dec '03

17 Dec '03

Just finished reading Bruce Sterling's newest novel. I enjoyed it and suggest it will interest hard sci-fi fans. Its a very much post cypherpunk world he writes about, e.g.: " ... It all had to do with unbreakable encryption, digital authentification, anonymous remailing, and network untraceability. These were all computer networking techniques that had once been considered very odd and naughty. They were also so elementary to do, that once they were in place, they couldn't be stopped without tearing the whole Net down. Of course once these techniques were in place, they conclusively destroyed the ability of governments to control the flow of electronic funds, anywhere, anytime, for any purpose. As it happened, this process had pretty much destroyed any human control at all over the modern electronic economy. ..."

1 0