December 2003 - cypherpunks-legacy

Insiders vs. Outsiders...a Nice Metaphor
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:03 PM 10/5/95, Carl Ellison wrote: >Crypto is used for making sure that insiders get in while outsiders are >kept out of encrypted files/messages. > >Strong crypto does a better job of keeping outsiders out. > >Things like TIS CKE are mechanisms for making sure that insiders continue >to get in, in spite of mishaps with their keys. > > >Any such system can be evaluated on its technical merits (does it really >separate the insiders from the outsiders as well as it claims to?) (does it >survive various disasters (because if it doesn't survive, it can't keep >insiders in)?) > > >This is a separate topic from GAK -- which boils down to the Government's >claim that it should be listed as an insider for everybody. > > >That's what needs to be brought to everyone's attention. This is a very nice metaphor for what is going on. It also touches on some of the issues about key certification. The issue of who a person is has nothing to do directly with whether they are an "insider" or an "outsider." (In fact, who a person "really is" is almost beside the point.) --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: FORGED CANCELS of posts on n.a.n-a.m
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:47 AM 10/4/95 EDT, dlv(a)bwalk.dm.com (Dr. Dimitri Vulis) wrote: >When an article is posted, two quantities are computed by the posting program: >M1 = H(article body + newsgroups + message-id + date + passphrase) and >M2 = H(M1). The posted article contains the header "Cancel-lock: M2". >[.. Cancel-key: M1 to cancel or supersede.] >[..Daemons forward suspected forged cancels to originator] Aside from the forged-From:-bogus-cancel spam /r$ proposed, this has the problem that it still only allows the originator to cancel a message, and not either the moderator of a moderated group or a Good Spam-canceller like CancelMoose, as well as stopping censors and cancel-spammers. Cancellation is a sufficiently local-policy-dependent issue, and reasonably low volume compared to the rest of news, that it probably makes sense for the various news programs to hand cancellation requests off to an external program, which can be locally modified as desired. One approach is to add digital signature and verification capability to News, at least to support cancels; doing this in an outboard cancel-daemon is obviously easier. RIPEM-SIG is a signature-only version of RIPEM which is exportable, probably just in binaries. The local cancel-daemon could accept cancellation requests that were signed by anybody on the list of locally-approved cancellers; one site could accept cancels from Cancelmoose, newsgroup moderators, and Helena Kobrin; another could do authors only. This would, of course, encourage people to get their digital signatures out there to allow themselves to cancel their own messages. ---------------- BTW, on the general topic of spam, I got a nice note back from the Johnson-Grace folks saying they were sorry they posted their ad/announcement to the list and it won't happen again. And you can download their compression stuff from www.jgc.com but they're not actually making the algorithms public... ----- #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

3 3

Re: GC Tech GlobeID pilot
by Jay Campbell 17 Dec '03

17 Dec '03

> http://globeid.gctech.fr/cgi-gid/welcome?Language=English >Sorry again, but because real content is and will be available >we commited to deliver only a few hundreds Web Wallets for this >pilot. You can still use the web form to apply for one... Except for this clause... | Caution: Following form is provided for demonstration purpose only. | If you really want to participate to the Globe ID electronic wallet pilot | program, please contact Mr. Pierre Edelman or GID95(a)GCTech.fr. On the surface, this doesn't look much different than First Virtual or any of the myriad other "let me hold your credit card number for you" sites. -- Jay Campbell - Regional Operations Manager -=-=-=-=-=-=- Sense Networking (Santa Cruz Node) edge(a)you.got.net "Shoot the Fruit Loop" 408.469.9400 "On the Information Superhighway, I'm the guy behind you in this morning's traffic jam leaning on his horn."

1 0

Re: NetManage & Cylink Crypto
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <9510060012.AA02236@ch1d157nwk>, andrew_loewenstern(a)il.us.swissbank.com (Andrew Loewenstern) wrote: > Anonymous wrote: > > The link with Cylink will allow NetManage to license and include > > the Cylink public key encryption technology in its applications > > with a variety of ciphering systems to be used in the NetManage > > suite, including: DES, Triple DES, Safer, IDEA, Skipjack, RC-2, > ^^^^^^^^ > > and RC-4. > > Hey, this is interesting... will Skipjack be included in future NetManage > products or is this press-release only mentioning Skipjack as an example of a > possible encryption algorithm for use with NetManage? It probably requires a PCMCIA card. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMHSpfCoZzwIn1bdtAQHhuAGAk64TLT89fxllmp1WhLxT/QJCrUuz3RmG MPI9irXcFyldaHEIlnDGpk7OQug5uTY1 =dyzf -----END PGP SIGNATURE-----

1 0

Re: Certificates, Attributes, Web of Trust
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <ac9961b42202100433c4(a)[205.199.118.202]>, tcmay(a)got.net (Timothy C. May) wrote: [...] > But I go further: a huge number of interesting applications of strong > crypto have no connections at all with physical persons, let alone with > True Names. Agents in computer transactions, applets fired across networks, > agoric entities in computational ecologies, BlackNet sorts of markets, and > on and on. This is true. Some of the most interesting applications of crypto don't involve True Names at all. The only reason, IMHO, why crypto is often thought of in terms of communicating between two True Names is because it is an obvious application to the layman. But it are the Blacknet type of uses where crypto really shines. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMHSr6CoZzwIn1bdtAQECCAF+Jok52IdshM4nLGjwqiImzw93dy/zSy9E QBmUR1yzX+17uuUoflSRE3R0bpx3uv+F =UM4a -----END PGP SIGNATURE-----

1 0

Re: Simple Hardware RNG Idea
by norm＠netcom.com 17 Dec '03

17 Dec '03

Simon Spero writes: .... > What about a beam of high intensity ionising radiation aimed at the > detector? .... You presumably use the oddness of the count for your random bit in some predetermined time interval. External radiation can change, but not bias the parity. If the counter saturates, the counter may be biased towards one parity but the software can easily detect saturation presuming it gets the count. You can use the source in a smoke detector.

2 1

Re: FORGED CANCELS of posts on n.a.n-a.m
by jms＠tennis.opus1.com 17 Dec '03

17 Dec '03

In article <V0BgcD4w165w(a)bwalk.dm.com>, dlv(a)bwalk.dm.com (Dr. Dimitri Vulis) writes: > I'd like to remind everyone of the well-thought-out scheme for authenticating > cancels proposed some time ago by Taneli Hujskonen and Benjamin Franz, that can > also be integrated into a Lazarus-like system for tracing forged cancels. Maybe. On the other hand, there's nothing to keep certain well-connected news administrators from removing the appropriate header line, or, even more interestingly, substituting values such that the cancel equation is well known. Fundamentally, though, what I've discovered is that any significant change to the news system is impossible to do, because installed base restricts what people are willing to change. Look at the dozens of extensions to NNTP which all conflict, are non-standard or ill-described, yet are demanded by moronic software such as Netscape's news reader. When will we see NNTP v3? Never... jms Joel M Snyder, PhD, 1404 E Lind Rd, Tucson, AZ, 85719 Phone: +1 520 324 0494 (voice) +1 520 324 0495 (FAX) jms(a)Opus1.COM http://www.opus1.com/jms Opus One PLEASE NOTE: The useful parts of Arizona changed from area code 602 to area code 520 on March 20, 1995.

1 0

Re: Simple Hardware RNG Idea
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 8:20 PM 10/5/95, Simon Spero wrote: >On Thu, 5 Oct 1995, Norman Hardy wrote: .... >> You presumably use the oddness of the count for your random bit in some >> predetermined time interval. External radiation can change, but not bias >> the parity. If the counter saturates, the counter may be biased towards one > >Hmmm. But isn't this method slightly biased? If the probability of N >events < the probability of N+1 events, wouldn't you need a large number >of events per bit to make the bias insignificant? .... What you really need is entropy (information). I propose concatenating several counts and sending them thru MD5. The counts are distributed the same way but are independent so that the entropy of the concatenation is the sum of the entropies. Each count has a Poisson distribution. That tells you how many bits of entropy there are in the input to the MD5. Take that many bits, rounded down, as your random bits. If there are an average of x bits in a time interval then the probability that the count will be exactly K is (x^K/(K!))exp(-x). That is the Poisson distribution. The entropy is then: - sum[i=0 to infinity] (x^K/(K!))exp(-x)log( (x^K/(K!))exp(-x)) = - sum[i=0 to infinity] (x^K/(K!))exp(-x)(log(x^K/(K!)) - x) = - sum[i=0 to infinity] (x^K/(K!))exp(-x)(K*log(x) - log(K!) - x) Here is a klutzy Scheme program to evaluate these: (define (sum g)(letrec ((ss (lambda (n) (if (= n 0) (g 0) (+ (g n) (ss (- n 1))))))) (ss 30))) (define (log2 x)(/ (log x)(log 2))) (define (fact n)(if (= n 0) 1 (* n (fact (- n 1))))) (define (p x k) (* (/ (expt x k)(fact k))(exp (- x)))) (define (en n)(sum (lambda(x) (let ((c (p x n))) (if (= c 0) 0 (* c (log2 c))))))) (en 1) => 2.07 (en 3) => 2.92 (en 10) => 3.73 (en 15) => 4.0 I.e. if 1 count is expected on average there are two bits of entropy in the count (supprising!) and if the count averages 10 then there are 3.7 bits worth. It goes up as the log. Before you bet your enterprise on this scheme consider that the math was done at 03:30 AM.

1 0

Re: subjective names and MITM
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:24 PM 10/5/95 -0400, Adam Shostack <adam(a)homeport.org> wrote: > The key does indeed have a high likelihood of being unique, >but dealing with 1024 bit identifiers could strain database systems, >especially when 100 well chosen bits would be than enough. If everybody in the world has a 1024-bit key, that's 750 GB; that's not bad at all by the time everybody in the world would have one, and you could do MD5s in about 100 GB, which is a little more convenient. Today, for 750 GB, you'd probably have tape in your system, or optical jukebox. But not everybody has one; on the other hand, I suppose individuals in well-heeled countries might end up with dozens of their own. On the other hand, the number of 1024-bit primes is something like 2^1023/log(2^1024) (if I remember right), or roughly 2^1013. The probability of two independent uniformly distributed primes matching is about 2^1023/2^32, which is still an astoundingly mindbogglingly LARGE number. If you've got 1024 bits of entropy in your input process, there will not _be_ any matches. (If people insist on using sources of randomness like clocks or user names, the chances are a lot higher....) Now, for 128-bit hashes, whether it's MD5 or just the near-bottom 128 key bits, by the time you get 2^64 of them together, you've got a 50% chance of a match. Not a problem, since you'll not likely need that many, even for the 2^33 people in the world. Still not a problem. #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

Re: FORGED CANCELS of posts on n.a.n-a.m
by Erik E. Fair 17 Dec '03

17 Dec '03

An NNTP v2 protocol specification effort is underway in the IETF now. Strictly to clean up existing extended practice - not to do new things. Erik Fair

1 0