December 2003 - cypherpunks-legacy

Media coverage of NIST Export meetings?
by Pat Farrell 17 Dec '03

17 Dec '03

Has anyone seen any media coverage of last week's meetings? I haven't seen anything in either the Washington Post or the Wall Street Journal. Nothing on radio or local TV either. I don't expect much coverage, as Joe Sixpack has no knowledge of why he should be interested. But I expected at least a paragraph hidden somewhere inside. Perhaps I missed it. Anyone else seen any??? Pat Pat Farrell Grad Student http://www.isse.gmu.edu/students/pfarrell Info. Systems & Software Engineering, George Mason University, Fairfax, VA PGP key available on homepage #include <standard.disclaimer>

2 1

Brand e-cash implementation?
by Michael Froomkin 17 Dec '03

17 Dec '03

Have there been any implementations, even as trials, of Brands' protocols? Do any ecash systems on the drawing board even include real user anonymity? A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | mfroomki(a)umiami.ir.miami.edu U. Miami School of Law | P.O. Box 248087 | It's hot here. And humid. Coral Gables, FL 33124 USA | See (soon to move to its real home): http://www.law.miami.edu/~mfroomki

2 1

crypto confrontation
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

regarding the NIST policies on cryptography being shaped at this moment, an idea occurred to me. one of the most important aspects of protest is getting the public to be on your side. right now the american public is pretty indifferent about the cryptography issue, but there could be some very graphic situations that would help bring it out into the limelight even more than it is at the moment, and make anyone promoting government key escrow seem like the bad guys. the minor protest going on with the Perl t-shirts is really fantastic (last count, ~700 shirts out the door), but what really brings an issue to the forefront of american consciousness (i.e. the media) is *confrontation*. picketers in front of buildings clashing with police is almost guaranteed to get a little media coverage, almost no matter what the issue. now, some day we might reach this point with crypto rights. it would be quite a spectacle. (I'm sure people would argue against it here, but IMHO even a simple demonstration of a few dozen people might do more for widespread public consciousness of the issue than a million lines of code on an FTP site..) -- in the meantime here's another possibility: suppose that a software company intentionally set up a situation where they are exporting a cryptographic algorithm out of the country. and they have filming crews on hand when the bad-guy customs agents or whoever stop the truck at the border and confiscate the software. have the reporters asking questions like "why are you confiscating this"? "answer: this is classified a munition". this could really be a fantastic segment for Hard Copy or any of the other trashy tabloid shows. just a confrontration for confrontation's sake, with nothing resolved, just a lot of people pissed off at each other, and the end result the viewer coming away saying, "what a disgrace!! somebody should do something!!" I mean, imagine a segment where you see the customs officers pointing guns at a truck driver or whatever (that would *really* be optimal), and them breaking into the truck to pull out the software. the reporter could say, "what's so deadly that's in the box??" and pull out a computer disk. sound bites of people outside the country saying how they want to use the crypto. a nice businessman in a tie, in the middle of an office with hardworking suits and ties. "we're not criminals!! we're trying to *protect* ourselves from criminals!! but your government won't let us!!" other sound bites: joe sixpack goes and buys crypto package from Germany because he doesn't have to put up with illegality and uncle sam. shots of massive Microsoft and an executive or programmer complaining how they can't put the code they want to in their programs, that users *want*, that would solve these horrible hacker problems that the country is having, because uncle sam is interfering. other scenes: businessmen calculating how much the U.S. software market (which, BTW, we are premiere in the world in) has already lost in sales, or could potentially lose on the information highway. "my company personally had [x] ready but could not release it. [y] was delayed [z] years for approval. we estimate we have lost [a] and have had to hold off hiring as much as [b] people". (the actual numbers should be as close to reality as possible, but from a PR point of view don't even matter!!) much made of how the Internet committees are now ignoring the US recommendations that require escrowed crypto. "the U.S. may ironically become only a inconsequential rest stop on the information superhighway of the future" much FUD about how the US could become a "backwater in cyberspace" because of these policies. etc!! lots of hype about how cyberspace will become the very basis of future global economies, and that anybody who opts out will be slitting their own throat. also, crypto being absolutely essential to secure transactions. in fact, if we play this right we could even get a new kind of semi-conventional wisdom into that easily-manipulated thing called the public consciousness: "hackers can be foiled by good crypto. the government is killing good crypto. therefore hackers are proliferating because of the government!!" plus, you could throw in the Phil Zimmermann thing too, although that might be overdoing it. as for all the bill of rights angle and those kinds of things, those could be put in there, but remember that people generally hate lawyers <g> -- actually, I'm actually rooting for PRZ to be indicted. an acquittal would be extremely costly, but it could really bring the key issues to the forefront of the american or even world consciousness. hell, it would beat the OJ trial any day in my book!! and in fact it might be just the ticket to the kind of mainstream journalism that could really tip the balance of public opinion. (the press is pretty sleazy, I admit, but it is a *monster* machine that one might be able to trick into working for you!! in fact, I would consider that quite the ultimate hack in social engineering!! any weenie hacker can con a phone repairman, but can you trick the whole U.S. media system into telling the public what you want it to hear? sounds like a real challenge to me!!) and BTW, I am aware of how DJBernstein and others have various lawsuits and FOIAs against the government. but I don't think these are really penetrating Joe Sixpack's brain, when that is really where the battle lies. and Joe Sixpack doesn't understand esoteric things like the bill of rights, the constitution etc.-- but he does understand pictures of police confronting someone who doesn't seem to be doing anything wrong and is arguing in favor of something good for america. you might think, "what does public opinion have to do with government?" answer: a lot. if in a public poll, a large majority were in favor of releasing crypto regulation, you can bet that the "which way is the wind blowing NOW?!?!?!" politicians (that is, all of them, <g>) would be scrambling to appease the public. even Clinton has a long record of merely going with what is politically expedient. I can fully imagine him defying key law-enforcement agencies if the public was more in support of good crypto. and, if we can get scenes like what I'm talking about, that day may become a reality. I continue to believe that the way to really hammer the issue and get what we want may amount to a kind of "psychological terrorism": "propaganda" on television that promotes our cause to joe sixpack, and simply honestly tells what is at stake. (that's the beauty of our position, is that even the simple truth is very powerful propaganda-- in fact that's how you can generally tell if you are on a side that is likely to win in the long run!!). there are many here who will argue for less confrontational approaches, about not getting anyone upset, about not trying to paint anyone as a bad guy, about just opting out of a "hopeless" political process, about how the whole US system is so screwed up anyway that we're all pretty much screwed when it comes down to it, etc. ad nauseaum, ... but IMHO a pound of nonconfrontration is worth a feather of confrontation in the long run. and I continue to believe the confrontation, while a bit messy and unpleasant at times, will really get the ultimate result that we want: (1) widespread public consciousness on the issue, (2) widespread support of our side. again, the code distribution is great, but in the long term, I continue to believe that public opinion is ultimately what runs a government, and a tyrannical government cannot exist without the tacit support of the population. I applaud the Perl t-shirt sellers for their great victory but suggest that greater victories lie in waiting. how about a demonstration of a bunch of people wearing the shirts, for starters? --Vlad Nuri

2 1

RE: Europe puts pressure on FCC over accounting rate moves
by Conor Lillis 17 Dec '03

17 Dec '03

Check the mail headers to see where it originated from ....., and then blast it with the greatest pile of trash you have, for about a fortnight. >---------- >From: John Young[SMTP:jya@pipeline.com] >Sent: 03 September 1997 15:36 >To: cypherpunks(a)toad.com >Subject: Re: Europe puts pressure on FCC over accounting rate moves > >So-called John Young wrote: >>Tim May wrote: > >>Announcing Black-and-WhiteNet (256-Gray, plaid, checkered, houndstoothed) >>Op Center (B&WOC(256-GPC-fang) which will minutely trivialize the most > >Not that it matters, but this is not mine. But not sure how to prove it, >probably >best to not try to be serious and thereby reify parody self-parody, >self-parody, >self-parody. > >

1 0

Elliptic Curve Public Key Crypto available
by Mike Rosing 17 Dec '03

17 Dec '03

in the cypherpunks ftp site /pub/cypherpunks/ciphers are 2 ascii files. One contains code and the other contains documentation: eliptic.src and elliptic.doc. The code portion is a cat'ed block of files: headers, C sources and a set of prime numbers. The documentation attempts to explain the math, but it does help if you already know number theory. It hopefully isn't necessary. The code is a specific implementation of one particular type of math. It violates no known patents. It appears to work. The academics claim that elliptic curves over Galois Fields are really secure. Preliminary testing bears this out, changing one bit of input gives uniformly distributed "random" output. Previous to the availabilty of 100 MHz processors this method of public key crypto was ridculously slow. The only versions were laboratory curiosities implemented in ASIC hardware. Code, if it exists, is not in the public domain. The code is based on several papers (some 15 references are listed in the doc file, 6 are more directly important) and a couple of books. It includes optimal normal basis math, elliptic curve math, and public key secret sharing. With 128 bit symmetric encryption, a 226 bit field is more than sufficient to hide it. I believe it is really strong crypto. I did not invent anything. I just implemented a few textbook examples that nobody else has. Since it's from public domain sources, and it's now public domain software, it can be freely used. You get what you pay for. Code is a living thing. It takes lots of people lots of time to make any code useful. The purpose of this code is to show that there is more than one way to create public key cryptosystems and to bring academic discussion into the everyday realm of real world problems. I suggest you get a copy to work with before it becomes illegal ;-) Patience, persistence, truth, Dr. mike

1 0

Re: Brand e-cash implementation?
by Hal 17 Dec '03

17 Dec '03

From: Bryce Wilcox <wilcoxb(a)land.cs.Colorado.EDU> > Could someone point me to Brand's electronic money protocol? I have heard of > it and would like to learn more. If it is a discussable topic then please > someone try to convince me that it is better than Chaum's or > Chaum's-plus-anonymity-both-ways, or some other candidate for E-Money > Protocol Which Has Official Cypherpunk Blessing. <URL:http://ganges.cs.tcd.ie/mepeirce/Project/Mlists/brands.html> has a good collection of earlier discussions on Brands' cash, as well as pointers to Brands' work itself. Brands' home page, <URL:http://www.cwi.nl/~brands> has a long list of advantages which his system has over Chaum's original cash proposals, mostly technical in terms of efficiency and provability. Brands' and Chaum's systems have similar anonymity properties so I don't see much to choose between them on political grounds. Brands tends to work in the context of off-line systems with "observer" chips which prevent double spending. But his protocols can be used in other payment environments as well. Hal Finney

1 0

away from my mail
by zinc 17 Dec '03

17 Dec '03

I will not be reading my mail for a while. Your mail concerning "Re: CFV: rec.knives" will be read when I'm back.

1 0

Dr. Dobbs CD-ROM outside the US?
by Unicorn 17 Dec '03

17 Dec '03

Hi Guys (F/M), I am seeing messages about the Dr.Dobbs Crypto CD-ROM not being received by persons inside the US, but right now I wonder if this information is or will be available, in this form, outside of the US? personally I would love to have this info available on CD-ROM, enabling me to take it with me wherever I go (stuck with a laptop or notebook)... And yes, I would of course have no problem with paying for it, or donating the US$ price to a good course. Ciao, Unicorn. -- ======= _ __,;;;/ TimeWaster ================================================ ,;( )_, )~\| A Truly Wise Man Never Plays PGP: 64 07 5D 4C 3F 81 22 73 ;; // `--; Leapfrog With a Unicorn... 52 9D 87 08 51 AA 35 F0 ==='= ;\ = | ==== Youth is not a time in life, it's a State of Mind! ========

6 6

spam apology
by zinc 17 Dec '03

17 Dec '03

cpunks, sorry for my recent spam of the list due my inept testing of how procmail interacts with the vacation program. -pjf patrick finerty = zinc(a)zifi.genetics.utah.edu = pfinerty(a)nyx.cs.du.edu U of Utah biochem grad student in the Bass lab - zinc fingers + dsRNA! ** FINGER zinc-pgp(a)zifi.genetics.utah.edu for pgp public key - CRYPTO! zifi runs LINUX 1.2.11 -=-=-=WEB=-=-=-> http://zifi.genetics.utah.edu

1 0

Re: Digital Fingerprinting
by tcmay＠got.net 17 Dec '03

17 Dec '03

Many interesting points here...but I'll stick to just one: At 2:56 AM 9/11/95, Douglas Barnes wrote: > On the legal front, it's not clear what you can do to someone > even if you _can_ prove that the 100,000 pirate copies of Windows > 95 circulating in Amsterdam stemmed from his copy. Machines get > hacked, co-workers and family members often have free access to > machines running software -- it's not clear that media companies > _want_ to invoke the paranoia associated with potential responsibility > for millions of dollars in damages if someone makes an illegal copy > of one's software and the loaves and fishes ensue. [Imagine what > great revenge this would make for jealous co-workers, ex-wives, etc.] If a piece of mail addressed to me is found littering the highway, can I be convicted of littering? No, because the _provenance_ of that item of mail cannot be determined...it might have accidentally blown out of a trash truch delivering my mail to the dump, for example. Ditto for most schemes to serialize software. As Doug notes, the offending item might have been copied when I wasn't looking, copied by my girlfriend when I was away, or even copied at the factory or at the software store prior to my gaining control. Or copied after I discarded it. (Requiring owners of Microsoft Word to treat it like a state secret--more on state secrets in a minute--is impractical and unenforceable.) One thing serialization could do is to allow proof that a distributor had not acquired a particular copy/instance through normal channels. But it's usually obvious anyway when Joe's Really Cheap Warez has 200 copies of Microsoft Word, all with the same serial number. The "light signatures" scheme I've written about here could be used to authenticate the distribution media itself, though not the installed copies of course. (This would be like the Microsoft hologram, except in spades.) Since the technology for this is not available to home or business users, I don't see this as a viable approach. Another thing that could work to foil mass counterfeiters is to serialize the diskettes and include a hash of the serial number, as some lottery tickets now include. Counterfeiters could try two basic approaches: 1. Make up their own numbers. But they could not compute a valid hash, as they lacked the (presumably secret) knowledge to do so. With public key approaches, a customer could "authenticate" that at least Microsoft, say, must have generated the number. (This doesn't take care of multiple copies of the same serial number, which takes us to:) 2. Multiple copies of a single, valid serial number. Here, the counterfeiter directly copies both the serial number and its hash. (This approach doesn't work to counterfeit lottery tickets. The reason is left as an exercise for the reader.) One way I can think of to head this off is to have a registry of "taken" or "sold" numbers, in which serial numbers are deposited. A purchaser could consult this data base to see if the number on the package he is planning to buy is already registered. (There are complications about time delays, and so forth, but this would eventually limit multiple same number packages.) This discussion assumes that purchasers are interested in getting valid, non-counterfeit programs. Many are not, of course. Certain types of programs pretty much require support by the vendor, others don't. A standard discussion topic. I said I'd mention "state secrets" again. The usual example for making subtle modifications to documents to see who leaked it is the intelligence community, which gave us the term "barium" (because the changes look like barium in an x-ray diagnostic). In that case, the agencies can enforce their laws in a draconian way, sometimes merely by suspicion. And the workarounds we discuss, of DIFFing the files, are unlikely to be practical. ("Hey, Sid, can I borrow your copy of "Covert Operations in Bosnia" so I can DIFF it with my copy?") --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

3 2