December 2003 - cypherpunks-legacy

Re: Re: Chaum's cash: backup?
by Jiri Baum 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hello Marcel van der Peijl, > From: "Marcel van der Peijl" <bigmac(a)digicash.com> > Date: Tue, 24 Oct 1995 14:10:58 +0100 Sorry about taking so long to reply... I'll quote more than usual to make up for it. > > > I could give a hint: your random state initializer is not the too-often > > > used srand( time( NULL ) ) but user-chosen during installation. > > This sounds great... Will the bank be running crack against the proto-coins > > it gets? (Say, at the behest of a LEA?) > It is not the bank's intention to screw the clients, but mostly the > other way around. I was referring to the claim that the system is payer-anonymous. Thinking of it again now, what's to stop Eve the eavesdropper from spying on the proto-coins, running crack against it, and then (later) eavesdropping on the bank-signed coins and unblinding/depositing them before Alice/Bob does? (No, being encrypted by the bank's public key is not enough.) > If the bank wants to screw the clients the easiest > way is to change their account balance. Remember, you trust them with > your money. That's why they're a bank. Yes, but is the bank really interested in protecting privacy? > > Is there any way for the user to re-initialize the random state? > > > Write that initializer down and you can re-generate all coins. > > ... > > That's going to be one hell of a valuable piece of paper. > > (Certainly to your enemies/prosecutors - it reveals the blinding factors > > for every coin you ever spent.) > You may choose to burn it or change random state and have no > recoverability. What do you value more? Your privacy or your money? > Each user will have too choose. a) It would be nice if the protocol didn't require this choice. b) This choice should be made explicit to the user. c) As I noted above, wouldn't it also strongly reduce security? See you! Jiri - -- <jirib(a)cs.monash.edu.au> <jiri(a)melb.dialix.oz.au> PGP 463A14D5 -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQCVAwUBMJnEeCxV6mvvBgf5AQF2BwP/XdMn6ktMGjToDltqo014kT1i3Z/GGXPr HPW1gBN3RT3Ba9F2Ac+24IVVFqauo1sT+Ecc872UrlQzoF8S524oZfhjh3IW5xRF mpZX48tnQn5nJE/U4XgvcuQ6yw5JOhc2eEVPs2PnKT+RdUogNb9UDAXOKn6+EILc nqosNXK+aMU= =geHb -----END PGP SIGNATURE-----

1 0

Re: FBI Wants to Wiretap One of Every 100 Phones in Urban Areas
by carolann＠censored.org 17 Dec '03

17 Dec '03

This story broke on ABC radio news 26 hours ago. It is still running as lead story. Love Always, Carol Anne...still amazed it's lead story -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

1 0

Re: IBM's Microkernal
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Responding to msg by perry(a)piermont.com ("Perry E. Metzger") on Wed, 01 Nov 11:51 AM >Why is this being sent to cypherpunks? Its totally >irrelevant. It's related to IBM's work on machine/code interface security, encryption and authentication capabilities. Cryptographers may want to examine how these work in Microkernal. If IBM will allow access to the features. And it's related to parallel alarms sounded on cypherpunks about the impossibility of any durable security which does not anticipate ever-changing attacks devised by authors of competing products and services. Finally, not your hat size, to be sure, it's related to the vanity of computer security consultants who dismiss unknown competition at the peril of their credibility. "The free market is a terror for tortured souls." Anonymous.

2 1

Re: censored? corrected [Steve Pizzo cited in The Spotlight]
by Jay Campbell 17 Dec '03

17 Dec '03

> Is it? This is the _one_ thing in the article (is that term >giving it too much legitimacy?) that I whought was barely true. Whoever >controls the root level DNS servers effectively controls the Internet. >I postulated a couple of months ago about how the US Govt might attempt >to censor the rest of the world: "Remove lurid.porno.site.other-country >from your DNS system within 72 hours or we will remove references to >your DNS servers from the root level servers.". (I also speculated that >if the US Govt tried doing this, that an 'underground' DNS system would >form almost immediately.) [off topic] It almost did when InterNIC announced it's recent (and abrupt) new pricing structure for domain names. All it would take is an additional entry in {dns}/root.cache - even a small company with decent VC (and multiple geographic locations, preferably) could have pulled this off and made a decent chunk of change underselling InterNIC; with a slight shift in the way things are done, the model could have been opened up into a competitive market with price and (GASP!) customer service/response time wars. [FADE IN: Look, Jim! I submitted my domain through Campbell.NET 30 seconds ago and it's already live .. That's nothing, Terry, ...] Yet another 'axiom' that turns out to be nothing more than convention. -- Jay Campbell edge(a)got.net - Operations Manager -=-=-=-=-=-=- Sense Networking, Santa Cruz Node Jay(a)Campbell.net got.net? PGP MIT KeyID 0xACAE1A89 "On the Information Superhighway, I'm the guy behind you in this morning's traffic jam leaning on his horn."

1 0

Re: alt.anonymous.messages considered harmful
by Jay Campbell 17 Dec '03

17 Dec '03

>Those who do get the message, can not notice a cancel attack; those >who don't, would have to carefully search for suspicious Supersedes: >lines and monitor the control newsgroup. A denial of service attack by >manipulated Path: header cannot be detected by the victim. cancels aren't the only monster .. we have a vigilante up the pipe somewhere deleting a chunk of every post set in certain alt.binaries.* groups without a cancel - they're simply not passing along a piece of every set. this is irritating (as an ISP) since it should be an individual site's responsibility (if not the user emselve's), hence the term 'vigilante' as opposed to 'concerned administrator'. the fix is to get multiple feeds, of course, but everyone in the area happens to be fed through this branch .. but i digress. -- Jay Campbell edge(a)got.net - Operations Manager -=-=-=-=-=-=- Sense Networking, Santa Cruz Node Jay(a)Campbell.net got.net? PGP MIT KeyID 0xACAE1A89 "On the Information Superhighway, I'm the guy behind you in this morning's traffic jam leaning on his horn."

1 0

Re: /dev/random for FreeBSD [was: Re: /dev/random for Linux]
by tomw＠orac.engr.sgi.com 17 Dec '03

17 Dec '03

In article <DHEtE6.FB6(a)sgi.sgi.com>, Mark Murray <mark(a)grondar.za> writes: >> ? "Gut feel" suggests to me that large ammounts of "predicted" input might >> be worse than the normal sort of system noise you have been using. >> >> But keep in mind that what we're doing is XOR'ing the input data into >> the pool. (Actually, it's a bit more complicated than that. The input >> is XOR'ed in with a CRC-like function, generated by taking an >> irreducible polynomial in GF(2**128). But for the purposes of this >> argument, you can think of it as XOR.) So since you don't know what the >> input state of the pool is, you won't know what the output state of the >> pool. > I chatted with a colleague at work, and he helped bend my mind right. > I had the mistaken notion that adding lots of data would "overflow" > and "dilute" the entropy to an attackable state. I think the problem is not merely flooding the device with non-random input data. If you coordinate sucking out entropy with feeding in non-random data you can suck the real entropy in the system down to zero while making the driver think it has plenty of randomness. While it's not clear to me how this would lead to an attack, it would be worrisome. -- Sure we spend a lot of money, but that doesn't mean | Tom Weinstein we *do* anything. -- Washington DC motto | tomw(a)engr.sgi.com

2 1

Re: FBI seeks huge wiretapping system
by Jay Campbell 17 Dec '03

17 Dec '03

>I was being facetious. The point is that the government has no >inherent right to tap our phones -- indeed, it didn't do so for nearly >the first 200 years of our existance, and we did just fine -- better, >in fact. It is a well-known fact that it was common practice for NSA operatives to masquerade as Injuns in the 1800's and waylay Pony Express riders in order to intercept communications between targeted parties. This practice lost popularity towards the end of the century with the advent of boxed cereal, and with it the Lone Ranger Decoder Ring, since the operatives were too underfunded to afford anything more than oatmeal. [ducks] -- Jay Campbell edge(a)got.net - Operations Manager -=-=-=-=-=-=- Sense Networking, Santa Cruz Node Jay(a)Campbell.net got.net? PGP MIT KeyID 0xACAE1A89 "On the Information Superhighway, I'm the guy behind you in this morning's traffic jam leaning on his horn."

1 0

Re: Radiation Detectors from Aware Electronics
by usura＠berserk.com 17 Dec '03

17 Dec '03

sharborth(a)hai-net.com writes in an followup to perry(a)piermont.com: .... :: There have been several requests for information on the company that :: makes the radiation detectors with RS232 interfaces that I mentioned. [..] :: Perry : : So what does this have to do with this mailing list?? : Skip The cypherpunks mailing list has a lot to do with cryptography, an important element of cryptography is randomness one way that seems to be a superior source for obtaining random data is radioactive decay, radiation detectors wich have an RS232 interface can be hooked up to an computer and thus act as a source of randomness. -AJ- -- kill -9 hkk(a)netcom.com .. process killed .. lawyer terminated successfully

1 0

Risks of ``foreign persons'' under the ITAR
by Peter D. Junger 17 Dec '03

17 Dec '03

It is usually assumed that a foreign person outside the United States runs no risks if he posts cryptographic software to the net or otherwise discloses it to other foreign persons, although technically that is a violation of the United States International Traffic in Arms Regulations. I note, however, that in an article entitled ``Export Controls on Encryption Software'' by Ira S. Rubenstein, dated October 17, 1994 (which apparently was distributed at some legal conference) the following passage appears in Section 4(3): ---------------- Finally, foreign employees of those companies or any foreign person who runs afoul of export controls on technology transfers may face severe immigration consequencs.[83] Under the Immigration and Nationality Act,[84] as revised by the immigration act of 1990,[85] an alien who seeks entry to the U.S. to engage in activities that violate or evade export control laws is excludable.[86] Similarly, an alien who has engaged, is engaged, or at any time after entry engages in such activities is deportable.[87] [Notes] [83] For a detailed discussion see generally Rubinstein, ``Export Controls and Immigration Law,'' 93-3 Immigration Briefings (Mar. 1993). [84] Immigration and Nationality Act of 1952, Pub. L. No. 82-414, 66 Stat. 163 (codified as amended at 8 USC \S\S 1101-1524) (hereinafter INA). [85] Immigration Act of 1990, Pub. L. No. 101-649, 104 Stat. 4978 (hereinafter IMMACT 90). [86] INA \S 212(a)(3)(A)(i)(II), 8 USC \S 1182(a)(3)(A)(i)(II). [87] OMA \S 21(a)(4)(A)(i), \S 1251(a)(4)(A)(i). -- Peter D. Junger--Case Western Reserve University Law School--Cleveland, OH Internet: junger(a)pdj2-ra.f-remote.cwru.edu junger(a)samsara.law.cwru.edu

1 0

Re: What!!!
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:25 PM 11/2/95, tony266(a)vabeach.email.net wrote: >Can someone tell me this cypherpunks is all about??? Grammar not best subject his. List sense make after read for time. --Klaus! More seriously, when you subscribed you undoubtedly got a "Welcome" message. I suggest you read it. Reading topics that interest you on the list is the best way to learn what it "is all about." The Cypherpunks list archives and Cyphernomicon are also useful. They are in various places, including these Web sites: http://www.hks.net/cpunks/index.html http://www.oberlin.edu/~brchkind/cyphernomicon/ --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1