December 2003 - cypherpunks-legacy

Directed Hamiltonian Path Problem
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

I am curious on whether there are any applications of the directed Hamiltonian path problem to cryptography, zero-knowledge proofs, etcetera. My reaosn for asking is that I've come across something in my field (molecular genetics) that can be used to solve such problems in a couple of weeks or so. -Allen

1 0

Re: Cypherpunk Certification Authority
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:20 AM 11/25/95 -0800, you wrote: >At 01:53 AM 11/26/95 -0800, anonymous-remailer(a)shell.portal.com wrote: >>You'd rather sign before encryption?? >>Doesn't that give you "known plain-text" to attack? > >The signature is not known unless the whole message being signed is >known. Signatures often have known, or easily guessed, plaintext in them, like the signer's name or ID number, or various header fields such as X.509's equivalent to ----- BEGIN PGP .... >And any encryption scheme that is vulnerable to known plaintext attack >where only a part of the message is known, is worthless anyway. DES isn't worthless. It's a bit weak, but not worthless. #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

2 1

Mixmaster Remailer FAQ
by Mixmaster 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Frequently Asked Questions about Mixmaster Remailers FAQ Verson 1.7 Nov 27 1995 by Lance Cottrell This document is a semi-technical discussion of Mixmaster remailers. I wrote this to answer questions often asked by new users of Mixmaster, and to explain why you would want to use Mixmaster remailers. At the end of this FAQ is a list of currently active Mixmaster remailers. **Announcements** I am pleased to announce the release of Mixmaster 2.0.3 It contains many bug fixes, and a much improved Makefile which makes compiling a snap! **What is Mixmaster?** Mixmaster is a new class of anonymous remailers. Inspired by the existing "cypherpunk" remailers and discussions on the Cypherpunk mailing list. Mixmaster is the next generation in the evolution of remailer technology. **What is an anonymous remailer?** Quoting from Andre Bacard's remailer FAQ: An anonymous remailer (also called an "anonymous server") is a free computer service that privatizes your e-mail. A remailer allows you to send electronic mail to a Usenet news group or to a person without the recipient knowing your name or your e-mail address. For a non-technical introduction to remailers (not including Mixmaster), I recommend Andre's FAQ. It is posted regularly to: alt.privacy alt.privacy.anon-server alt.anonymous or you can get it by sending mail to: To: abacard(a)well.com Subject: Help1 Message: [Ignored] There is also a version on the World Wide Web. <http://www.well.com/user/abacard/remail.html> **What do I need to use Mixmaster remailers?** Unlike other remailers, you can't just make your own message and send it to the remailer. Mixmaster's security comes in part from using a special message format. The disadvantage of this is that you need a special program to make the message for you. Once you have that program (the client) remailing is as easy as running the program, and telling it which remailers you want to use. **How do I get the Mixmaster client software?** There are two sites for distribution. The first is my machine, http://obscura.com/~loki/Welcome.html/ or ftp to obscura.com and read /pub/remail/README.no-export. The other is by anonymous ftp to jpunix.com. You will have to follow the instructions there to get Mixmaster. Because Mixmaster contains cryptography, it may not be exported from the U.S and Canada. The reason for the circuitous route to download Mixmaster is to show my good faith efforts to keep Mixmaster from being exported. I have heard rumors that someone has already broken this law, and that Mixmaster is available from Europe. I do not approve of this and will not support that site. **How do I get the software to run a Mixmaster remailer?** The remailer software is available from the same sites as the client. **But I only see one Mixmaster distribution?** The same program is used for both the client and the remailer. The only difference is in the installation. For the client you just compile it and you are ready to go. For the remailer, you need to set up mail forwarding and cron jobs. **What kinds of computers does Mixmaster run on?** Unfortunately, not PCs or Macs. But it is being ported to those right now. Mixmaster runs under UNIX. The only machine it is known not to work on is Dec Alpha. It has been tested on Linux, FreeBSD, SunOS 4.1.3, Solaris, and several others. It has been compiled and tested on Netcom. If you use it on a machine or service not on this list, please let me know so I can add it. **How does Mixmaster work, and why should I use it?** You should use Mixmaster if you want the highest level of anonymity available, or if your are tired of building remailer messages your self. A discussion of how Mixmaster provides this level of security is beyond the scope of this FAQ, but I put an essay on the subject on my home page. **Does Mixmaster use PGP?** No, Mixmaster uses the rsaref package from RSA. Mixmaster uses its own keys and key file formats. To add a key to a key ring, simply append the key to your key file using your favorite text editor. **Can Mixmaster post to News?** Yes, like older remailers some Mixmaster remailers can post to news. Also like older remailers, not all Mixmaster remailers can post to news. Request the remailer's help file to check if it supports posting. Do this by sending mail to the remailer with the subject line remailer-help. **When Was Mixmaster Released?** Mixmaster was originally released on an experimental basis in late 1994. There were only ever two remailers running Mixmaster 1.0. Mixmaster 2.0 was released on May 3, 1995. There are now 18 publicly available Mixmaster remailers. **What is the latest version of Mixmaster?** Version 2.0.3 was released on Nov 27, 1995. This version uses a new Makefile, which makes compiling it a snap. Several bugs were also fixed, and some esoteric functions added. Version 2.0.2 was released on Sept 22, 1995. Mixmaster remailers can now accept messages containing multiple Mixmaster packets. Mixmaster can be told to choose a random set of remailers to chain your message through. It will now route multiple packet messages over independant chains. Several minor bugs were fixed. Version 2.0.1 was released on May 27, 1995. The only changes from 2.0 are some improvements in the documentation, and the inclusion of a more up to date list of remailers. **What remailers run Mixmaster?** The most recent list of remailers is available on my homepage, along with the remailer list and key file for Mixmaster. You can simply replace your old files with the ones from my site to keep up to date. They are also available by ftp. Here is the current list of Mixmaster remailers. Send mail to the remailer with the subject remailer-key to retrieve the remailers Mixmaster key. mix mixmaster(a)obscura.com vishnu mixmaster(a)vishnu.alias.net knight mixmaster(a)aldebaran.armory.com robomix robo(a)c2.org syrinx syrinx(a)c2.org replay remailer(a)replay.com hacktic remailer(a)utopia.hacktic.nl crynwr remailer(a)crynwr.com spook remailer(a)spook.alias.net flame remailer(a)flame.alias.net Armadillo remailer(a)armadillo.com anon mixmaster(a)anon.alias.net secrets secret(a)secret.alias.net wmono wmono(a)valhalla.phoenix.net ecafe-mix mixmaster(a)remail.ecafe.org aD anon(a)ad.org shinobi remailer(a)shinobi.alias.net amnesia amnesia(a)chardos.connix.com q q(a)c2.org precipice mixmaster(a)mix.precipice.com Since this is a new FAQ, I am sure it is far from comprehensive. Watch this space for changes to the FAQ. It will be evolving rapidly for a while. Please send any questions you think should be here to: Lance Cottrell <loki(a)obscura.com> -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMLoU3FVkk3dax7hlAQElGgP+NgE9z/sX402DN2pN9CZ5GKDLNdglEPIM Wz52Zone7hmd1w76VFwb7RSl1uCZxVekJIb1KnPNNXmWX5fmQYMj77ucyjInmkYe 9GVnWL6SjmKmagXppyeatvOMYDt+FtolZU0hisvRS5A+LwnX95IJhiAdZkXjba// CYC3uMqd21k= =64iE -----END PGP SIGNATURE-----

1 0

Re: The future will be easy to use (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Subject: Re: The future will be easy to use > From: dlv(a)bwalk.dm.com (Dr. Dimitri Vulis) > Date: Mon, 27 Nov 95 21:28:05 EST > > One thing that David didn't mention is security add-ons to the "network > computers" that are supposed to be rolled out within the next few months -- > the successors to X terminals, $500 boxes with a good screen/sound, > cheap cpu, and a few megs of ram and flash memory to hold a web browser. > I expect some folks to make a good living by writing add-ons (including > crypto add-ons) to these gizmos. > Don't hold your breath. The current market surveys say that there is no market for them. Check out this weeks PC Week or Mac Week, as they both have several articles discussing this. Bottem line is that the under $1000 computer seems to have no future either in industry or the home. Realisticaly, who in their right mind would buy a diskless workstation to connect to Internet? You certainly wouldn't do crypto on it because it has to boot from somewhere else and this leaves all kinds of security holes. Also, there is the fact that at the current time there are no generaly useable apps on Internet beyond the web and most companies would rather have their employees doeing something more productive than hanging ten. Anyone who bases their business on this technology won't have a business. Take care. Jim Choate CyberTects ravage(a)einstein.ssz.com

1 0

Money: Back to the Future?
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Wall Street Journal, Nov 23, 1995. Money: Back to the Future? By Walter Wriston (Former chairman of Citicorp) Americans are about to begin using a new kind of money that may have consequences for the Federal Reserve's control of the money supply and almost certainly for the velocity of money. Over the years, people have used all kinds of things for money, from the huge immovable stones in the front yards of the residents of Yap Island to the more familiar silver and gold. All these various mediums of exchange will now be joined in our country by the "smart" card -- a piece of plastic embedded with a microchip. Smart cards combine features of the following: automatic teller machine cards that let you access your bank account and draw cash; MasterCard or Visa cards that permit you to buy now and pay later; and debit cards that charge an account at the time of purchase. Not only can smart cards do all of the above but they can also serve as an "electronic purse" independent of your bank account. These cards contain real money that can be spent at stores and restaurants. In effect, the card is an electronic traveler's check, but one that makes exact change. In addition, the integrated circuit chip allows a higher degree of security for the information stored than do the current magnetic strip cards. Smart cards are common in Europe and Asia, where some 400 million were shipped last year. The first large-scale use of smart cards in this country will occur next year at the Summer Olympics in Atlanta. Plans call for 300,000 rechargeable cards, and 700,000 disposable cards in denominations of $25, $50 and $100. These cards would fit nicely into the payment habits of Americans, since in the U.S. it is estimated that 88% of transactions are done by cash or check, and of these 83% are for less than $10. In Atlanta, electronic "purse cards," which contain stored value, could be spent at pay phones or vending machines. When their stored value is exhausted, they are thrown away. The smart cards, by contrast, can be taken back to the issuer and recharged. Their broad issuance and use could return America to something very close to the free banking of the last century, when every commercial bank issued dollar bills, backed sometimes by the skill of the management, sometimes by doubtful state bonds and sometimes by gold or silver. We have grown so accustomed to the familiar Federal Reserve note that many forget that Americans had no central bank for about 75 years -- from 1836, when President Jackson vetoed the bill to renew the charter of the Second Bank of the United States, to the start of World War I, when the Federal Reserve Act was passed. After the passage by New York state of the Free Banking Act in 1838, the idea of state-chartered banks spread across the country, and each commercial bank issued its own dollar bills of various shapes and sizes. This does not mean that the 19th century witnessed complete currency chaos. In 1863, the National Bank Act was passed to create a market in the government bonds needed to finance the Civil War and to bring some order to the private issuance of currency. The act required that bank notes issued by commercial banks be uniform in appearance and that they be backed by collateral consisting of U.S. Treasury securities. As the old Civil War bonds were paid off, the currency base of the country declined some 60% from 1881 to 1890. This inflexible system led to panics and instability. To a certain extent, the Treasury Department during this time assumed some of the functions of a central bank. All during this period a debate raged, not about whether America needed a central bank but about "free silver" and the price at which the Treasury would buy gold and silver. It was not until the eve of World War I that passage of the Federal Reserve Act finally gave the U.S. government a monopoly on the creation of money. Now we may be going back to the future. The advent of smart cards means that the Fed will lose its monopoly on issuing currency, except that this time the new money will be issued not only by banks but by all kinds of companies, from convenience stores to telephone companies. Nor is this the only trend threatening the Fed's monopoly: Information technology is about to permit the creation of both electronic token money and cash money in cyberspace. Already we have Digi Cash in Amsterdam reviving in modern guise something very close to the old American free-banking system -- issuing electronic money (backed by some depository bank holding collateral in the form of Treasury securities) and performing the clearing function. None of this is necessarily a cause for panic. There is very little, if any, evidence that government has managed our currency values any better than the commercial banks did in pre-Fed days. Indeed, the Nobel laureate economist F.A. Hayek put it more strongly: "The history of government management of money has, except for a few short happy periods, been one of incessant fraud and deception." Still these new trends do present worries for central bankers. If more and more firms issue cards for cash or credit, what will be the effect on the velocity of money? How will central banks form policies on the control of the money supply if any company can issue electronic purse cards on credit, with or without collateral? What will happen if the issuer of the card goes broke? As smart cards become more visible in America, regulators and governments will begin to wonder about control of money and credit. The Eulopean system of central banks has produced an advisory report outlining a possible regulatory response, and in this countly some Fed officials are starting to wonder if their regulations will be applicable. If one definition of money is an object that has no use except to be given to someone else in exchange for goods or services, smart cards are money -- and they are coming to your neighborhood soon. -----

2 1

Re: Directed Hamiltonian Path Problem
by thad＠hammerhead.com 17 Dec '03

17 Dec '03

> I am curious on whether there are any applications of the directed > Hamiltonian path problem to cryptography, zero-knowledge proofs, etcetera. My > reaosn for asking is that I've come across something in my field (molecular > genetics) that can be used to solve such problems in a couple of weeks or so. > -Allen > > Secret sharing can be done by Hamiltonian paths. No public key code has been found to take advantage of those, or any other NP complete problem, so far as I know. DNA computing really doesn't solve the Hamiltonian graph problem, it just makes the biggest one that you can solve a little bit bigger. 500 point graphs remain insoluble (pun unitended) for earth-sized vats of DNA. Really. -- Thaddeus Beier email: thad(a)hammerhead.com Technology Development vox: 408) 286-3376 Hammerhead Productions fax: 408) 292-2244

1 0

Re: Cypherpunk Certification Authority
by torrejr＠pcnet.com 17 Dec '03

17 Dec '03

So far, everybody on the net has discussed the fun part(s) of the CA issue. The techies talk about protocol, encryption ... in short the real FUN stuff. I have enjoyed diverging opinions of some of the participants. Many make excellent points and have taught me more than I ever dreamed to learn. Lawyers are already making money and preparing for the future :-) Some lawyers argue about liabilities and drool over new laws being proposed all over the country by other lawyers to guarantee future lawsuits. Another lawyer does not believe CAs are an option and make a good buck selling books to prove it (Electronic Commerce Law-Ben Wright squire) another publishes the American Bar Association CA liabilities, names it draft of the digital signature guidelines and goes to work for Verisign (CA? DS? UH?). I can keep talking about good stuff that has happen in the last few months for about everyone interested in the last frontier (the electronic one) and its trading posts (electronic commerce), but the fact is that there are no CAs in full production yet. Yeah! Verisign is around .... Santa Clara. Of course I have other choices (Did I say great choices?) like Cost in Sweden and at one time EuroCert in England was advertising on the net. I have been asking myself ... WHY? I can't accept the standard response: Fear to liability! Granted that the liability factor is important but my gut feeling tells me that's not the whole story. The hardware and the software is out there (I haven't commented on the quality of this stuff!). I thought that several companies who have indicated interest have all it takes to make a successfull CA but nobody seem to move reasonably fast. Is it possible that the process of issuing and maintaining a certificate is so complex and expensive? I think that MITRE did a study for NIST and they came-up with a cost of $800 per year per federal employee to maintain and administer a Federal CA. Any suggestion? PS I want to thank Robert Hettinga for his excellent work promoting the principles of the Cypherpunks, and for diseminating critical information that helps shape the corporate world for a better electronic future. ------------------------------------- Juan Rodriguez i Torrent torrejr(a)pcnet.com 11/27/95 23:54:24 -------------------------------------

1 0

No Subject
by attila 17 Dec '03

17 Dec '03

well, if it is not the world's greatest thinker and knowledge bearer on Nastrodamus posting an announcement on a message we've already seen at least twice, and hashed. read the threads before you post!

1 0

Re: Internet Terminals
by Jordan Hayes 17 Dec '03

17 Dec '03

From mclow(a)owl.csusm.edu Mon Nov 27 20:07:37 1995 Would you write and send e-mail if you had no way of archiving it? This is what AOL is. Would you use "net-quicken", if it required all your data to be stored on a shared disk at Intuit? Who are you kidding? All your banking information is stored *at your bank* today; how is that any different? OBCrypto: none. /jordan

1 0

Re:ETH_ic?
by mp＠moonmac.com 17 Dec '03

17 Dec '03

Nb5s $bp2s writes, >> ...the case has killed the hacker ethic. "If I saw someone >> on the Internet with a security weakness, at this point >> I would be reluctant to act the Good Samaritan and >> report it," said Jeffrey Kegler, an independent software >> consultant in Sunnyvale Calif. "If I saw weakness in >> Intel's machine, I'd keep it to myself." If I saw a weakness in Intel's machine I would happily inform the company in the safest way possible: posting it to Cypherpunks, alt.destroy.microsoft, comp.sys.intel and any other appropriate newsgroup, via anonymous server. I'm sure the information would wind up in the correct hands _eventually_. Not that I'm suggesting anything, of course. |^^^^^^Please don't add "*(a)aol.com" to your twit filter. Thank you.^^^^^^| | mklprc(a)aol.com | "Give them a light and they'll | | mp(a)moonmac.com <*> follow it anywhere!" | | http://www.teleport.com/~mklprc/ | -- Firesign Theater | | No Microsoft products were used in the production of this message. | \----smuggle FSF terrorist BATF (fnord) FBI nuclear Saddam PGP Clinton---/

1 0