December 2003 - cypherpunks-legacy

Re: Inherent Insecurity of Internet Commerce! (was RE: SecretClearance)
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"pete(a)loshin.com" "Pete Loshin" 7-DEC-1995 14:37:13.07 OK, I'll try again. First, as I recall, SECRET clearance is actually not very high: when I got it, I had to answer a bunch of questions (do you abuse illegal drugs? are you now or have you ever been a member of any organizations? have you ever been _arrested_ for anything?) ---------------------- I suspect I know what organizations they're interested in (CPUSA et al), but did they ask about any specific organizations? -Allen

1 0

Multiple questions
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hello again cypherpunks: [In order to conserve bandwidth, I am going to ask for 5 things at once which have nothing to do with each-other in this post. Please reply to me privately if it's at all possible. <liberty(a)gate.net> ] 1. I have searched the archives for the author/artist of the "Rose on Random Bits" logo, and I have e-mailed many cypherpunks "old-timers" with no luck. [The logo appears at the top of the archives, but I am well aware that, as an anarchy, cypherpunks has no "official logo."] I have seen a number of beautiful logos during this search, but no- body has pointed me to the author of this particular logo. Any help finding this person would be _much_ appreciated. TIA. 2. I keep hearing every once-in-a-while about PGP3.0 (coming "real- soon-now") but there's nothing specific about what's delaying it. I would urge the developers (whoever they are) to release version 3.0 *before* the upcoming US presidential election, and I am interested in finding out more. TIA. 3. I have been asked by a Libertarian Party presidential candidate for a proposed platform plank in favor of strong, private, non-"GAK" encryption. [OK! I've stopped saying "FUCKED"!<g>] Of course, I want the maximum cypherpunk input possible, so feel free to suggest. The wording must *not* be too technical in nature and should (of course) condemn ITAR. <spit!> It should explain the real meaning of "escrow" and the "Newspeak" version in as few words as possible. TIA for any help on this. I'll post my final version if there's enough interest. 4. Has anyone in France been prosecuted for civilly-disobeying their anti-strong-crypto law by using PGP? What happened? Did the French people just roll over? TIA for any pointers (in English, please). 5. [A comment] Assuming the "secret clearance" requirement, how fast could an escrow agency be decertified if the "secret" person dies or is fired or heads for Anguilla, etc.? [Of course, I would not give a secret key to such a system, considering the effectiveness of simple attacks like "the honey trap" (ask Mordechai Vanunu how this attack works).] JMR - ---------------------------------------------------------------------- Regards, Jim Ray http://www.shopmiami.com/prs/jimray - ----------------------------------------------------------------------- PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 (key on homepage & servers) <liberty(a)gate.net> PGP encrypted mail enjoyed, even if it's _not_ "important." IANAL - ----------------------------------------------------------------------- Help Phil! email zldf(a)clark.net or http://www.netresponse.com/zldf _______________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh. iQCVAwUBMMdHO21lp8bpvW01AQEZDgP9Hw8Ymf2zHMY59+TUE6N8+v+WHSeAXsQk Kg7j3Z5jWwPSZopVL2joXolW2t41vDbFEgr5eclweGJXHkLiJdnlPEwGhr+rtf/n dqv/m/o99kBf92D7nCME3nzMxJ1c4eQcGwFBjBZRvysQZ6PU/s0sSo5xqd5g2Qku icleREE+aVc= =4NSh -----END PGP SIGNATURE-----

1 0

Re: Solution for US/Foreign Software?
by jim bell 17 Dec '03

17 Dec '03

At 10:26 AM 12/7/95 -0600, you wrote: >jimbell(a)pacifier.com (jim bell) said: > >jb> 1. Write a program limited to keysize, carefully constructed to >jb> isolate those portions of the program which define key size, >jb> GAKedness, etc. > >jb> 2. Get it export approved. Export it. > >jb> THEN > >jb> 3. Announce that a "US-only" version of the same program is being >jb> released, and include the minimal component which replaces the >jb> limited software. Release it, only in the US of course! > > As has been pointed out, this would prolly doom geting export >approval for version 2.0. However, let's keep the developer/publisher >out of the loop. How about someone developing a 'binary diff', using >the functionality of nm to find subroutine entry points, and then doing >the binary diff from those starting points? Presumably, for most of the >program the diff would mostly be changed entry points, with the bulk of >diff being the crypto module. Then the bdiff gets exported, and >bpatch-ed into the export binary. Of course, this wouldn't work if they >strip the binary, but who is going to force them to do that? Okay, that was basically what I was suggesting. A full binary difference file wouldn't even need to have any information about the internals of the program anyway. Basically, what needs to be achieved is a way to allow the software manufacturer to sell an approved product outside the country, but allow the foreign buyer to (easily) convert it into a GOOD encryption product. Once that works, laws against the export of encryption are meaningless. In fact, the legally-exported program obviously wouldn't even need to HAVE encryption in it at all, so it won't fall under ITAR classification, and thus won't need any kind of export license.

1 0

Re: Inherent Insecurity of Internet Commerce! (was RE: Secret
by futplex＠pseudonym.com 17 Dec '03

17 Dec '03

various people wrote: > OK, I'll try again. First, as I recall, SECRET clearance > is actually not very high: when I got it, I had to answer > a bunch of questions (do you abuse illegal drugs? are > you now or have you ever been a member of any > organizations? have you ever been _arrested_ for anything?) [and] > I suspect I know what organizations they're interested in (CPUSA et > al), but did they ask about any specific organizations? I think this discussion of background checks for clearances has gone rather far astray of cypherpunks relevance, folks.... -Futplex <futplex(a)pseudonym.com>

1 0

Re: Still more on the Digicash protocol
by daw＠guaymas.CS.Berkeley.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <Pine.3.89.9512071804.A21520-0100000(a)unicorn.com>, Rev. Mark Grant <mark(a)unicorn.com> wrote: > I think he means you shouldn't use a stream cipher like RC4 that XORs the > plaintext with the generated keystream, since if you know part of the > plaintext, you can XOR those bytes with (the id you want) XOR (the id > being sent) and change the encrypted data so that the payment goes into > your account and not theirs. Right. RC4 encryption doesn't provide message integrity. And I should mention that block ciphers like DES in chaining modes like CBC don't provide message integrity either -- it's a bit harder, but an active attacker can still tamper with the ciphertext to modify the plaintext in a predictable way, like with RC4. I admit it's a more difficult to mount this attack against a block cipher in chaining mode, and the success probability may go down (depending on the circumstances), but hey! paranoia is your friend; and my point remains valid: Don't count on encryption to give you message integrity. If you need message integrity, use a MAC. If you want a citation for this basic crypto design principle, I'll be happy to provide one. > This is a tough, but potentially feasible > attack if you use that kind of encryption scheme. Tough!? It's trivial for an active attacker, in the stream cipher case. He just xors some bits: no clever cryptanalysis needed. (Or did you mean it's tough to mount an active attack? I agree: that requires significant knowledge or motivation.) > Is there anywhere that you could use a similar attack on SSL ? Not in SSL v3.0; it explicitly uses a (cryptographically strong) MAC (message authentication code) on each message to prevent tampering and modification. Dave Wagner, speaking for himself, but thankful for all those behind the scenes who are helping to improve and open up Digicash communications. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMMdVCCoZzwIn1bdtAQHEvQF/c1wmuVWCpmMo+4jY0cNlrrKD/5vYb/st xC2dFLgb1ydJm6kfWRw0Hz8vF55tzj9t =N+Gr -----END PGP SIGNATURE-----

1 0

Internet Stocks
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:14 PM 12/7/95, Adam philipp wrote: >16% tumble today... > > ...is the word getting out? > A few of you have corresponded with me about investments, Internet stocks, etc., so I reckon there's enough interest out there to share a few thoughts with you. Those who think this list has only to do with number theory or PGP are of course welcome to skip this message now and get back to reading Koblitz. I won't say anything negative or positive about Netscape per se, but here are some various developments: * A Smith Barney analyst today made essentially the same sort of comments that I (and maybe another or two) made several days ago, namely, that the market capitalizations are incredible ($7 B for Netscape at $170/share), that browsers are not a proprietary "franchise" (in that the standard is an open one), that a lot of competition is coming (Spyglass Mosaic, Oracle, Microsoft, etc.), and that many people hysterically bidding up the price of Internet stocks are barely aware of what this "Internet thing" is. He issued a "sell" recommendation on Netscape, an "underperform" recommendation on Netcom, Spyglass, UUNet, etc., and was generally bearish on the sector. (I saw him interviewed on CNBC, minutes before Marc Andreessen was interviewed.) * From a high on Tuesday of $170, Netscape was down to $130 at one point today. I haven't seen the closing price. * Analysts are also closely looking at the February '96 end of the "lockout" in some stock sales by Netscape employees. Basically, a lot of the shares that went to employees, etc., cannot be sold for 180 days after the IPO, which was in early August of this year. The effects of shares being put on the market is not clear, of course, and it is possible the effects will be minimal. Still, it might be prudent to take this account when considering strategies. * Microsoft also made announcements indicating a move closer to a standard Web browser strategy (as opposed to trying to sell the world on Microsoft Network). deal with Spyglass, and a licensing of JavaScript. (There've been too many deals connected with browers, Java, etc. for me to even begin to summarize here.) * Sentiment moves in waves, as per the Dutch tulip bulb scenario, and what was headed for the moon a few days ago is suddenly a turkey, to many. The whipsawing in Netscape, UUNET, Netcom, etc., is incredible: up 30 points in two days, then down 30 points in two days! By the way, some have sent me mail asking about how to sell these and other stocks short. One can sell them short directly (getting the money now and agreeing to deliver the shares at a later date), but this is risky, should these stocks rise. (And some of these shares are not readily available for short sales, due to the limited number of shares on the market and the difficulty of finding someone to lend the shares for a short sale.) One's risk is essentially unbounded (but practically there are some reasonable limits to how much the stock can rise, of course). Short sellers are always advised to remember this maxim: "He who sells what isn' his'n, must buy it back or go to prison." (It is said that some of the rise in Netscape stock price is due to "the shorts running for cover." That is, those who shorted the stock at, say, $80 are frantically trying to buy the stock to close out their positions. This can cause the relatively few shares to be bid further and further up. As I keep saying, be careful in believing this or not.) A safer strategy is to buy puts and calls, or to sell puts and calls. Buying "puts" (my mnemonic: the right to "put it" to another investor) involves, say, buying the right to sell a stock at some price in the future. Thus, one might buy a put on the Internet Index (http://www.amex.com) a collection of Internet-related stocks, to sell the IIX at $25 in April, '96 for a strike price of $255. If the IIX goes _up_, and as April approaches, that put will become worth less and less and may become worthless. If the IIX goes _down_, that put becomes more worthwhile (because one has the right to "put" it someone for $255 when the actual value of the IIX has dropped to, say, $200. (Roughly speaking, at expiration in April '96 this put will be worth $55, for a doubling of one's original investment; the pricing of options depends on a lot of things, including risk, time value of money, expectations, etc.) At this point there are no widely-available puts and calls on most of the recent high-fliers on the Internet. This is why the IIX looks to be a way to play this game. Interested investors should also look at LEAPs, which are essentially puts and calls with much longer expiration dates. A friend of mine bought $25K worth of Intel LEAPs (JAN96s) during the height of the Pentium debacle, when Intel was trading at $30, and in the next six months this $25K investment became worth over $300K. (Needless to say, your mileage may vary. Don't blame me if you lose your shirt. Bulls make money, bears make money, but pigs never make money, as another maxim goes.) --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: FW: websurfer 4.6
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Thu, 7 Dec 1995, Anonymous wrote: > Not surprising. They confuse random doodling with software, too. > > The real problem with NetManage is a severe case of brain death. My, thanks for your opinion. It may interest you to know that Microsoft recently licensed a bunch of stuff from NetManage (San Jose Merc, no real details given). - -rich - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMMdKlSoZzwIn1bdtAQGYYgF8CIf5Trt1E5YdMCna43irv5MeGgFnzSvP KXQ0ZR22U9MqbFAbrTjVKUB4ojC30lwo =+3ha -----END PGP SIGNATURE-----

2 3

Re: Still more on the Digicash protocol
by jim bell 17 Dec '03

17 Dec '03

At 10:03 AM 12/7/95 -0800, you wrote: >I am glad that DigiCash supports this type of cash which anyone can >deposit. Actually, I am surprised and puzzled that it does, given >Chaum's apparent reluctance to endorse schemes to allow payee anonymity >(due to political problems, apparently). I, on the other hand, think one of the best uses of digital cash is to drastically reduce and eventually eliminate the whole concept of "government." I see payee-anonymous digital cash as being absolutely essential.

1 0

Re: 1)Age etc CA 2)Swedish Digicash
by Duncan Frissell 17 Dec '03

17 Dec '03

At 01:56 PM 12/7/95 +0100, Mats Bergstrom wrote: >Posten has licensed Digicash and plans to >open a mint/bank (Posten already is closely connected to a bank) >dealing in Swedish crowns. (This is not news but things seem to >be moving right now.) Some (but slight) mention of laundering, >of course. It's supposed to come about in 'the beginning of next >year'. I wonder how exchanges crowns/dollars will be managed. Is there an existing Post Office Bank in Sweden? If so, can foreigners open accounts? The UK's postal bank (Girobank) has become more like a normal bank and I think foreigners can open accounts. (The US Postal Savings System was closed in 1956 or so.) I'd rather have a Swedish Digicash account than one in the US. DCF "A bank is just a money switch. Soon we'll all have money switches."

2 1

revised librand now on ftp.research.att.com site
by Matt Blaze 17 Dec '03

17 Dec '03

Sorry for the noise, but I just discovered that the librand.shar file that I put in my ftp directory got garbled somewhere along the line. I've repaired the damage and put a correct version of the file in: ftp://ftp.research.att.com/dist/mab/librand.shar (Worst of all, the garbled version actually compiled, but you can tell you have it by its failure to link properly). Again sorry for the noise. -matt

1 0