December 2003 - cypherpunks-legacy

Physician, Heal Thyself
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:38 PM 11/3/95, Perry E. Metzger wrote: >Tim May will doubtless disagree, but he has nothing else to do in life ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ >than read the net so his incentives to see traffic minimized aren't >the same as other people's. Perry, would you please knock off the drone of snide remarks about me? I mostly don't respond to your posts. You often make very good points, but at other times you demonstrate a shrillness and apparent lack of socialization that I find appalling. Your snide remarks are, to use your own rhetoric, "wasteful of bandwidth." They are also tacky, childish, and pointless. You are often quick to say "What has this got to do with Cypherpunks?," but you yourself are perfectly willing to rant on about Nietzsche, the East Germans, and Louis Freeh. Physician, heal thyself. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Re: Crypto & Taxes [WAS Re: Cybersecurity]
by Bill Stewart 17 Dec '03

17 Dec '03

A couple of weeks ago, Michael Froomkin <froomkin(a)law.miami.edu> wrote: >> > fully applied crypto (e. g. fully anonymous digital cash) >> > makes it essentially impossible to base a tax system on income. >Hold on. This is more "factoid" than "fact": recall that income is PAID >by people as well as EARNED by people. Most payers have easily >detectible physical presence and assets that can easily be attached by >regulators. It will be a cold day before, e.g., my employer agrees not >to report my earnings. And the same is true for most employers in most >industries. Unfortunately, this is true, at least for people whose employers are subject to income tax somewhere. Taxing businesses doesn't make sense economically - you could collect almost as much money with far less disruption to the underlying economy by taxing it as wages for workers and dividend or interest payments to owners* rather than inside the business itself, substantially reducing the accounting workload of businesses**. But it's still very attractive to governments, not only as a lever for implementing social policy and extracting cooperation, but as a critical tool to force businesses to report wages payed to employees - I don't know if law.miami.edu is a taxable business, but for most employers, if they don't report the wages they paid to their employees, but do report all their revenue, they get taxed on the additional profit, instead of the employee getting hit with the tax; most people I know who've been paid "under the table" have been working for small businesses that are also not reporting cash revenues. Of course, if a business isn't _spending_ money on employees, but is just contracting for work performed by an Anguillan corporation, they still have receipts for expenses, and the financial arrangements between the Anguillan corporation and any of its US employees aren't really their concern.... >And if it ever stops being true, we'll just get VAT, and VAT inspectors. >So the line about death and taxes remains as true as ever, crypto or no. Value is really hard to measure in a service economy. Most of my work over the last N years has been talking to people, typing on keyboards, going places on airplanes to talk to other people and type on other keyboards, and occasionally handing people piles of collated and stapled dead trees, a racket for which people pay my employer lots of money***. Where's the value? When was it added? If the Tax Collectors don't see people handing my employer lots of money, can they demonstrate how much money they can confiscate? - - - - - - * this misses payments to foreign owners and taxes on foreign customers, but any government foolish enough to discourage investment by foreigners and sales to foreign customers deserves to be blamed heavily for lost jobs.. ** US businesses spend approximately 40% as much calculating taxes as they do _paying_ them... *** My previous employer was very good at taking metal, sand, and fermented dinosaur parts, and shaping them into boxes and strings that people would give them money for; they were extremely optimistic that they could get lots of people to also pay them money for sending them people to talk about boxes and strings and getting other people to pay _them_ for talking and banging on keyboards. They shouldn't have been quite so optimistic, and now I'm in the racket on my own, having not yet acquired overseas corporations to shelter my income through :-) #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

5 5

Apologies for spam
by cjl 17 Dec '03

17 Dec '03

C-punx I really didn't mean to send that last message to the list. I had stiffened my resolve not to rise to the obvious troll bait, but a minor seizure of some sort resulted in the send command being issued instead of the cancel command. . . By way of making up for it I thought that some of you might be interested in knowing that AAAS is having it's annual meeting in Baltimore this year and of interest to those pondering alternative means to bruting cryptosystems are the sessions below: DNA Computing, Friday Feb. 9, 8:30 - 11:30 am Organized by Richard Lipton, Princeton University Quantum Computation, Friday Feb. 9, 2:30 - 5:30 pm Organized by Seth Lloyd, MIT C. J. Leonard ( / "DNA is groovy" \ / - Watson & Crick <cjl(a)welchlink.welch.jhu.edu> / \ <-- major groove ( \ Finger for public key \ ) Strong-arm for secret key / <-- minor groove Thumb-screws for pass-phrase / )

1 0

Re: FBI Wants to Wiretap One of Every 100 Phones in Urban Areas
by clarkm＠cnct.com 17 Dec '03

17 Dec '03

Thanks for this item! Two little excerpts jump out at me. They follow: > Last year, federal and state courts authorized 1,154 wiretaps, of which 48 > percent [snip] > "People are starting to say that seems awfully high," Dempsey said, noting > that > the overall level of such surveillance activity is now a total of 20,000 > to 25,000 > intercepts nationwide over an entire year. So what is it? 1,154 wiretaps? Or 20,000? FBI Director Louis Freeh testified under oath to 1,157. The FBI was asked for the data to support those numbers. The FBI refused to release them until the year 2002. The FBI is being sued under FOIA to support Freeh's sworn testimony. (Of course, he used different numbers at different times....) One last thing. What's so special about the year 2002? .---. .----------- * :::::::::::::::::::::::::::: / \ __ / ------ * clark.matthews(a)paranet.org / / \(..)/ ----- * :::::::::::::::::::::::::::: ////// ' \/ ` ---- * //// / // : : --- * PERMISSION TO \\/ / * / /` '--* COPY / REPOST \*/ * //..\\ x-x-UU----UUx-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x '//||\\` N E M O..M E..I M P U N E..L A C E S S I T x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x

4 3

public random numbers
by JMKELSEY＠delphi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >Date: Fri, 03 Nov 1995 00:44:02 -0800 >From: tcmay(a)got.net (Timothy C. May) >Subject: Re: video as a source of public randomness > >At 6:23 AM 11/3/95, JMKELSEY(a)delphi.com wrote: > >>This seems like a potential source of a stream of public random >>bits. If these can be authenticated and matched, this kind of thing >>can be useful in a lot of protocols. For example, if there is some > >I'm not sure what you mean by "public random bits"...I don't plan to share >my random bits with anyone, nor do I see any need for "public" random bits >(except for some well-known situations involving statistical testing, for >which certain PRNGs are actually preferable to "real" random numbers). Imagine there is a stream of totally random bits over which neither Alice nor Bob has any control. We can use this to make a lot of interactive protocols non-interactive. Suppose we have a protocol where we need a random challenge from Bob. Alice sends a message to Bob starting the protocol, stating that the public random bit stream is currently at bit i, and committing to use the n-bit string starting at position (i+t) as the challenge. The t parameter here needs to be large enough to ensure that Bob receives and logs the message before the public random bit stream outputs bit i+t. Alice proceeds with the protocol, using the n-bit string starting at bit (i+t) as the challenge. She sends the resulting message to Bob. No interaction was required of Bob--he merely had to log the times of the messages, and keep track of the public random bits. This could be really useful implementing noninteractive digital cash schemes, I think, because the merchant wouldn't have to send anything back. (The merchant can also be very hard to track down by following the messages, since these messages of Alice's can be encrypted under his public key and posted to a newsgroup or something, though this implies really large values of t.) Naturally, this only works if Alice and Bob get the same random string, and if it's not possible for anyone to alter the public random bit string either one receives. For large-scale applications, the way to do this is probably to put a hardware RNG into a communications satellite, and devote one channel to continuous digitally-signed packets of random data. For smaller-scale or underground applications, it might be sufficient to use some digitized transmission that would probably not be worth the trouble for an attacker to alter, even if one could. For example, if we used the entire digital video feed off some major satellite, it would be enormously expensive to take control of that for any length of time, to attack some protocol. To prevent simple attacks, we can hash the digitized input, and we can make each shared random packet dependent on previous packets by some relation like random_packet[i+1] = SHA1(random_packet[i],SHA1(digital_video_packet[i])). >And so there's no confusion, when I said "like a noisy channel (t.v. >channel, for example)" I meant a snowy, noisy picture such as one gets with >rabbit ears on top of the set, especially when the channel is an unused >one. It is unlikely in the extreme that any attacker could deduce the snowy >pixel values used in the distillation of entropy. I was just thinking of the unintended entropy in the stuff going on on the screen. Static would mess this idea up, though there are some ways to recover. >But back to the subject of "public random bits." Could you elaborate on >what you mean by this? (I assume you don't mean a one time pad that Alice >and Bob share, since that is really a separable issue from video as a >source of randomness. Only one of them will generate the pad, and will then >securely communicate it to the other.) No, of course not. Public random bits can be used in the derivation of a shared key, to prevent replay attacks in key-exchange protocols, but you certainly wouldn't want to use the public random bits directly as key material! >--Tim May Note: Please respond via e-mail as well as or instead of posting, as I get CP-LITE instead of the whole list. --John Kelsey, jmkelsey(a)delphi.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCUAwUBMJqtkUHx57Ag8goBAQGWRgP1HES4nQiWRx0P31bi94g5MI8pSEwf5CZu 0RlWLyCl5CLB6PKu7bJDqiyHIBBJ90qqvJvZB740QHVxoRKycOD459nMWjiQXcnA 70Aq8gR+ZYCivsJLJfhKxoxuT+s/VyYVMB7mSfqGIGHHErbXHR4oA2T+Owmm8POi WDr4w3OjyQ== =3QHQ -----END PGP SIGNATURE-----

1 0

Real randomness generators
by fc＠all.net 17 Dec '03

17 Dec '03

Two points: 1 - The noisiest thing on most lists is the noise about other peoples' noise. 2 - Why not use the postings of people complaining about other peoples' posts as a source for noise. Surely few things in the Universe are more random. On the the subject at hand: There are two major technical issues I have encountered in using EM waves (which is what video and radio noise are) for generating randomness. 1 - They tend to be biased toward 1 or 0. This can often be compensated for by (for example) xoring one bit stream from the same source with the inverse of another. By doing this enough times, you can eliminate many of the characteristics of interest. 2 - Noise tends to be characteristic for different media and noise causes. This is a more difficult issue. For example, certain types of media tend toward short noise bursts. In these cases, you have to be quite careful to assure that the bit streams meet the randomness criteria of the application. As a side issue, you may find that once you start sending enough information with truly random characteristics, you will be visited by people that don't want you sending it. I know people who have experienced these visitations and felt highly constrained as a result. -- -> See: Info-Sec Heaven at URL http://all.net Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

3 2

consumer products that make nice sources
by Brad Dolan 17 Dec '03

17 Dec '03

>Date: Fri, 3 Nov 1995 10:34:00 -0500 (EST) >From: Brad Dolan <bdolan(a)use.usit.net> >To: s1113645(a)tesla.cc.uottawa.ca >Cc: "Perry E. Metzger" <perry(a)piermont.com>, cypherpunks(a)toad.com >Subject: Re: Sources of randomness > > >> What prices have you got listed? Is the equipment sensitive enough to get >> lots of entropy from a normal environment or do you need artificial sources >> of radioactivity? (easy, safe and cheap enough to get?) The tag on my Montana Sunshine Radon Mine radon pillow is a little blurred. I think the following is the right phone number. Sunshine Mine is an amusing concept. People pay money to go breathe radon there, while others are spending much money avoiding radon. Anyway, the pillows make nice sources and good conversation pieces. bd >Safe, easy-to-obtain gamma sources: orange fiesta-ware pottery (at flea >markets), old-style Coleman lantern mantles (not sure about the new >ones), uranium-ore "health pillows" (Sunshine Mine, 408-225-3670). ^^^ 406

1 0

Computers at wholesale, Pentiums & AMD(k-5,k-6)
by ceo35＠concentric.net 17 Dec '03

17 Dec '03

For removal, please put remove on subject line and email me at Endless(a)Gosnet.com *Don't press reply, it won't get back to me. Follow instructions down below. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - "FULLY CONFIGURED, NEW PENTIUM MMX - TECHNOLOGY COMPUTERS" -FOR SALE- PENTIUM-133 TO MMX-233 COMPUTER SYSTEMS AT WHOLESALE TO YOU! Have you been looking for that one real, solid, GREAT computer buy at real 'Deal', yes! Well then, all that you have to do is to follw this link: It will be up thursday or friday, until then email me. Follow directions at end of page. Http://www.gosnet.com/success/pentiums.htm Some of the systems: P-133 @ $685.00 MMX-P-166 @ $740.00 Pentium-2's- 233 @ $1,540.00 P-150 @ $700.00 MMX-P-200 @ $825.00 Pentium-2's- 266 @ $1,640.00 P- 166 @ $737.00 MMX-P-233 @ $975.00 P-200 @ $809.00 AMD K-5/ 90 @ $585.00 K-6/ 166 @ $710.00 K-5/ 120 @ $620.00 k-6/ 200 @ $780.00 K-5/ 133 @ $632.00 k-6/ 233 @ $995.00 K-5/ 166 @ $690.00 MONITORS "14" TO "17" A steal of a deal on "17" monitors with a built in stereo-speaker system @ $440.00 "14" @ $220.00 "15" @ $250.00 AND MORE!! WINDOWS 95 @ $110.00 ROM DRIVES 16x, 24x starting @ $89.00 Continuose read/write CD'S @ $50.00 for a 10 pack Ethernet Cards PCI, 10Base-T/BNC @ $31.00 Soundblater 16 Model 2961 $ 65.00. , Mice $12.00, (serial port 3 button) Modem - 115.20 Bps down to 14.000 Bps, fax/mode W/V @$120.00 Many more products on web page when up. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Please include your name and phone number in your e-mail to us. Emailto: user2384(a)xsend.com We will call you to help you complete the purchase of your system. Hours 9-7pm(pacific)M-F, Sat 9-6. Important! Please put more info on subject line of email to us.

1 0

Re: National Security Committee amendments to SAFE
by Amanda Walker 17 Dec '03

17 Dec '03

> I take it this last sentence is intended to kill Bernstein, Karn and Junger > and any other cases we might try to bring. Correct? Looks like a separation of powers problem at first glance; how many situations are there where the legislative branch and the executive branch can collude to take the judicial branch out of the loop entirely? Amanda Walker Ascend Communications, Inc. amanda_walker(a)ascend.com

1 0

Re[2]: FBI seeks huge wiretapping system
by sharborth＠hai-net.com 17 Dec '03

17 Dec '03

Subject: Re: FBI seeks huge wiretapping system Author: Jay Campbell <edge(a)got.net> at internet Date: 03-11-95 06:08 >I was being facetious. The point is that the government has no >inherent right to tap our phones -- indeed, it didn't do so for nearly >the first 200 years of our existance, and we did just fine -- better, >in fact. It is a well-known fact that it was common practice for NSA operatives to ^^^ masquerade as Injuns in the 1800's and waylay Pony Express riders in order ^^^^^^ I think you'll find the NSA was not in existence in the 1800's. to intercept communications between targeted parties. This practice lost popularity towards the end of the century with the advent of boxed cereal, and with it the Lone Ranger Decoder Ring, since the operatives were too underfunded to afford anything more than oatmeal. [ducks] -- Jay Campbell edge(a)got.net - Operations Manager -=-=-=-=-=-=- Sense Networking, Santa Cruz Node Jay(a)Campbell.net got.net? PGP MIT KeyID 0xACAE1A89 "On the Information Superhighway, I'm the guy behind you in this morning's traffic jam leaning on his horn."

1 0