December 2003 - cypherpunks-legacy

SURVEY: Money on the Internet
by rah＠shipwright.com 17 Dec '03

17 Dec '03

I saw this in sci.econ. I filled it out, but mostly I'm interested in the results. The survey seems pretty thorough, mostly crypto-aware, and it includes a question about the value of anonymity... Cheers, Bob Hettinga : From: weiler(a)ic.ac.uk (Mr R.M. Weiler) : Newsgroups: sci.econ : Subject: SURVEY: Money on the Internet : Date: 31 Jul 1995 11:15:02 GMT : Organization: Imperial College of Science, Technology and Medicine, London : Lines: 18 : Sender: r.m.weiler(a)ic.ac.uk : Followup-To: : Message-ID: <3vidvm$lnm(a)oban.cc.ic.ac.uk> : NNTP-Posting-Host: sg1.cc.ic.ac.uk : : Hi there! : : I am doing a research on the use of money on the Internet. I would : appreciate it if you could answer a short survey on this subject, found at : the following Web site: : : http://graph.ms.ic.ac.uk/money : : I would also appreciate any remark on this survey. Please tell your friend : about it, too. : : Many thanks! : : Roy Weiler : The Management School : Imperial College : e-mail: r.m.weiler(a)ic.ac.uk -- Robert Hettinga (rah(a)shipwright.com) "There is no difference between Shipwright Development Corporation someone who eats too little 44 Farquhar Street and sees Heaven and someone Boston, MA 02331 USA who drinks too much and sees (617) 323-7923 snakes." -- Bertrand Russell Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf

1 0

FIPS number for SHA - The Next Generation
by Perry E. Metzger 17 Dec '03

17 Dec '03

Since I last asked a while back, have the folks at NIST published a new version of the SHA FIPS with the small modifications made to it to "repair" the defect? I need the information for an RFC that is being submitted to the RFC editor today so its kind of important... Perry

1 0

Re: RSA has been proved correct
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

Mmmh, correctness does not mean "it's a nice thing". It just means that something fulfills the specs. Do you know which specs were fed into the prover? The specs could be as weak as - RSA must terminate if fed with the number 42 - x ^ (e * d) = x mod n for all x from 0..(n-1) Hadmut

1 0

RE:NRC Panel, Law Enforcement questions
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

Hello Jim, I apologize that I didn't answer immediately. I have subscribed to several mailing lists and sometimes get some hundred mails a day. I don't have the time to read everything and therefore I have to select. I didn't read this thread, but I found it in my archives. > I wonder, and perhaps my kind friend Hadmut can help me here, if there is > an English translation of any and all Nazi-era German laws/regs regarding > cryptography. As I [dimly] recall, Enigma was born as a private enterprise > and the patent was only later taken over by government and classified after > it was offered for sale to businesses (without much luck). These laws, if > they exist, might make for interesting reading in side-by-side comparison > with either Sen. Grassley's latest proposals, or with anything regarding > cryptography coming from our paranoid FBI director. I fear I have to disappoint you. :-( First of all I don't know of any english translation of such laws. The only english translation of law I know about is the translation of our current basic law. It might be easier to find english translations in english or american libraries than in german libraries. Second, I don't know whether they had a certain law about cryptography. AFAIK Enigma was a commercial product first and was taken over by the government. But I don't know they way they did. Third, there was no need to have laws. I don't want to restart the discussion, but the Nazis didn't understand laws as so important. I have read a book about their justice some time ago. The 'idea' and the 'public feeling' was seen as more important than laws. But perhaps another telecommunication law may be interesting. It was forbidden to receive foreign radio senders. If they came into the house and the radio was tuned to foreing frequencies, you got into serious trouble. I just don't know where to find the text of the law. regards Hadmut

1 0

Re: Java, Netscape, OpenDoc, and Babel
by strick at Jihad 17 Dec '03

17 Dec '03

> But in which framework or language, given the profusion of frameworks and > languages? > > We had some TCL advocates a while back (Strick, Hal...)...any reaction to Java? TCL solved my specific problem at that time. Unfortunately I haven't studied Java. PM's comments (as usual) intrigue and bother me; I need to study it. TCL's biggest problem is that it's slow -- it's designed to be used in the parts where speed doesn't really matter -- and it sounds like java sovles that. Perry -- do you have the same basic objection to Safe-TCL that you do do to Java? I would think so. strick > And so it goes. > > --Tim May

3 2

to usura
by NSA Spook 17 Dec '03

17 Dec '03

usura cfs coming send note to list if you receive

1 0

to usura
by Chris Brenton 17 Dec '03

17 Dec '03

Original-From: NSA Spook <remailer(a)spook.alias.net> Original-Date: Fri, 4 Aug 1995 10:37:00 -0500 >usura >cfs coming >send note to list if you receive Thank you for posting this to the list. I needed some more useless mail...

1 0

NIST/NCSSC National Information Systems Security Conference
by droelke＠spirit.aud.alcatel.com 17 Dec '03

17 Dec '03

A couple of days ago I got a booklet about the "18th National Information Systems Security Conference (formerly the National Computer Security Conference) " being held October 10-13 in Baltimore. Just a little excerpt about it: One of the tracks is "The Internet and Beyond" Several of the sessions look rather interesting. The "Management and Administration" track includes at least two sessions by D. Denning of Georgetown Univ. One of them is "Legalities: Will Encryption Keep Out Hackers" and the other is "Critical Factors of Key Escrow Encryption Systems". The first of those has a panel of S. Bellovin of AT&T, M. Higgins of DISA, S. Kent of BBN, and E. Spafford of COAST. So, is this a converence that is really worth something, or something that the management heads might learn something at? ;-) I guess that ordering my personal set of the Rainbow books gets me on more lists than I thought :-) Dan ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX http://spirit.aud.alcatel.com:8081/~droelke/

1 0

Re: Java and Safe-TCL security
by Hal 17 Dec '03

17 Dec '03

The safe-tcl mailing list has not been active for a few months. I think a lot of interest has transferred to Java. One problem is that safe-tcl was oriented around email, so it lacks facilities for accessing web pages. I agree with Ray that the security of safe-tcl leaves something to be desired. I implemented a safe-tcl mail filter which would automatically run incoming mail scripts which were in safe-tcl format. This would be a generalization of a remailer, so that users could write scripts which would determine when the remailing would occur, etc. However I ran into a number of problems, particularly related to persistent storage (e.g. disk file access). This is a hard problem for a "safe" system to solve. One solution is to just forbid it, but beyond that you need to have rules about how much disk space a script can use, whether they can access each other's space, etc. There are some nice applications if they can do so, for example the telescript model where two software agents come together and exchange some information. Another tricky issue is if you are going to let the script talk to the outside world via email or tcp connections. How do you prevent abuse of this feature (sending junk email, or connecting to a web page and entering bogus data into a form)? But again, without this capability the script is pretty much limited to drawing pretty pictures on your screen, which isn't very useful. Here is one message I sent to the safe-tcl list earlier this year describing some of these problems in a little more detail. Note that there were also several bugs in the implementation which left security holes, things being checked in the wrong context and such. This is similar to what Ray was citing. Hal > From owner-safe-tcl(a)CS.UTK.EDU Fri Feb 10 22:30:35 1995 > X-Resent-To: safe-tcl(a)CS.UTK.EDU ; Sat, 11 Feb 1995 01:22:02 EST > Date: Fri, 10 Feb 1995 22:21:28 -0800 > From: Hal <hfinney(a)shell.portal.com> > To: safe-tcl(a)CS.UTK.EDU > Subject: setconfigdata and delivery time > Status: R > > The spec appears to allow delivery-time scripts to do setconfigdata. > This is a mechanism for a script to store persistent data. One application > would be a telescript-like interaction between scripts. Some data could > be stored by one script and later read by another. More interesting, a > script could even store some script, perhaps some or all of itself, into this > persistent store. That script could then be read and eval'd by a later > script. This way scripts could in effect call subroutines in each other, > providing somewhat similar functionality to telescript's procedure calls > between agents. > > At activation time the user gets asked whenever a script does > getconfigdata, although oddly not when a script does setconfigdata. > Also, the .safetcl.conf file is written on any getconfigdata after the > user has supplied or confirmed a database value. This will have the > side effect of writing out any setconfigdata values which have been > previously set by the script. > > At delivery time the current implementation will not ask the user since > there is no user to ask, which causes the writing out of the config data > base never to happen. So there is actually no way for a delivery time > script to set a persistent value right now. It would be easy to change > the code to allow delivery time scripts to set persistent values with > setconfigdata. > > However, this does open up a possible avenue for abuse. There is > presently no limit on how much data is written with setconfigdata. And > actually if the idea above were used where scripts put themselves into > the database for later running then the database could legitimately be > quite large. The problem would arise if a script abused this capability > by filling the disk with junk database entries. > > Maybe something is needed analogous to AutoConfirmMailHook to determine > whether a given SafeTcl_setconfigdata should be able to go out to the > disk. It would want to be given the data as input and possibly also > the size of the current database. Maybe there should be a counter of how > many times the current script has written to the database (or perhaps the > hook could retain this information itself). > > Two other points: as mentioned before the use of the database to retain > "system" information conflicts with its use for this purpose. If > database entries like "mailer" or "external-site" are changed and saved > to .safetcl.conf, that could break later invocations of swish. I think > this system data should be somewhere else (or else there needs to be > another form of persistent store for scripts). > > Secondly, the code right now checks the SafeTcl_evaluation_time > variable in the restricted interpreter to decide whether it should ask > the user. This is not reliable as the untrusted script could change > SafeTcl_evaluation_time. In other places the code checks > SafeTcl_InterfaceStyle and if it is empty then it doesn't ask. That > seems safer. > > Hal Finney > hfinney(a)shell.portal.com

2 1

PC E-cash (NewsClip)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Secret Service Says Student Used PC To Print Money Lubbock, Tex., Aug. 3 -- PC graphics programs have come a long way since their inception, but not far enough to fool the Secret Service. That's what a Texas Tech student tried to do when he used his personal computer to print counterfeit money, according to Secret Service agents. "He really put his whole heart and soul into it," according to Lubbock, Texas Secret Service Resident Agent David Freriks. Freriks said the man is an engineering student at Texas Tech, but told agents he plans to change his major to computer science. The 20-year old student hasn't been identified by name since he hasn't been formally charged yet, according to Freriks. But officials apparently aren't concerned that he will flee. "At this point, he's more afraid of his dad than anything," said one agent. Freriks said the Pakistani national, who resides in affluent southwest Lubbock, scanned a real $50 bill into his PC, then printed the image to an Epson inkjet color printer. Agents said the money looked real at a distance but up close the designs were blurred, the coloration was faulty, and the paper was slick and didn't have a watermark strip. Freriks said agents are confident that all of the approximately $3,300 that was circulated has been recovered except for about $1,000 which he said he is sure will show up eventually, since the quality makes it easy for bank employees to spot. ... Investigators seized the home computer, printer and scanner from the student's home. They said they also found a suitcase containing almost $260,000 in fake $50 bills. --

1 0