December 2003 - cypherpunks-legacy

Re: Political Cleanup program
by Greg Broiles 17 Dec '03

17 Dec '03

At 07:35 PM 12/17/95 -0800, you wrote: >Here's a question I have never heard anyone else ask (or answer!). "What is >the purpose of a PAC? > >To be more specific, a PAC simply seems to be a funnel through which >individual donations flow; why do we need a PAC? Is it to keep records of >"who's naughty and nice"? Any contribution that can be made by a PAC could >just as easily be made by one individual. PACs are to politics what mutual funds are to investing - that is, a mechanism for investors to diversify their holdings, and to allow for the managers of those holdings to use their expert/specialized knowledge to achieve better returns (at the cost of some frictional skimmings-off) than individuals would on their own. But I'm not sure what this has to do with C-punks any longer. -- "The anchored mind screwed into me by the psycho- | Greg Broiles lubricious thrust of heaven is the one that thinks | gbroiles(a)netbox.com every temptation, every desire, every inhibition." | -- Antonin Artaud |

1 0

Re: Campaign Finance Reform
by jim bell 17 Dec '03

17 Dec '03

At 07:43 PM 12/17/95 PST, you wrote: >On December 17th you wrote: > >>To: cypherpunks(a)toad.com >>From: jim bell <jimbell(a)pacifier.com> >>Subject: Political Cleanup program >> >>Politics is traditionally corrupt, it appears, because donors to politicians >>and political campaigns expect a quid pro quo for their donations. Various >>unsatisfactory solutions include campaign spending limits, etc. >> >>It occurs to me that it would be a major advance if a system could be set up >>that would "blind" campaign donations as to their source: The donor could >>be satisfied that his donation gets to the candidate or cause, but the >>candidate couldn't know who actually paid the money (and the donor would be >>unable to prove that he made a donation, for example). Admittedly there are >>a lot of details that need to be worked out, but if this could be >>accomplished it would change politics as we know it. > >If you'll give it some more thought, Jim, you'll see that it has a loophole >in it you could drive a semi through. There is no way to keep a donor from >passing the word to the recipient. No matter how you work out the details, >it's impossible to keep the information from passing. It could never work. It is absolutely true that you couldn't stop a person from communicating claims of a donation to a politician. But what you COULD do is to ensure that the donor couldn't PROVE that he made such a donation. In other words, _I_ could claim that I gave $1K to Senator Sludgepump (a lie) and the good senator would have no idea that I wasn't telling the truth. The people who REALLY made such donations would be helpless. >Consider a more radical, and possibly workable, solution to the thorny issue >of campaign finance. If we go back to the root of the problem, it seems >clear that it is the high cost of a campaign. If a typical campaign were to >cost a tenth or a twentieth of what it presently costs, we'd have gone a >long way towards ameliorating the situation. How to do it? Simply ban all >paid political spot ads - TV, radio, newspaper - all of them. Write it so >that there's damned little wiggle room - a candidate can use lawn signs, but >not billboards. They can use personal appearances, but not commercials. >They can spend all the gas money they want running around their state or >district, but not a dime for media spots. > Well, I have an even better and cheaper solution to the problem of government and politics. At an average of $20,000 per Congressman, we could clean up Washington for $10 million dollars.

3 2

Re: What ever happened to... Cray Comp/NSA co-development
by thad＠hammerhead.com 17 Dec '03

17 Dec '03

"Anitro" speculated about the fate and capabilities of the CCC PIM (processor-in-memory) machine. A friend of mine was working on it, and it would have been a screaming machine, no doubt about it. He said that the Cray mostly acted like a really fast network for the processor chips. As "Anitro" said, the PIM chips were made by a dedicated NSA company, Supercomputer Research Center, in Bowie MD. But, it was nowhere near finished when the company finally went down, and the team was completely disbanded. My friend was talking about going to the auction when the parts of the various machines were going to be sold, I don't know if he did so. He suspected that the various pieces would end up going back east to the Fort Meade area. Still, it is such an odd machine that you would probably have to transfer the staff to finish it, and that didn't happen. In any case, while it was fast (1/2 million 1-bit processors, perhaps as low as 1 nanosecond (1 GHz) cycle time), it was not fast enough to brute force reasonably strong ciphers. It's really no joke that it would take a computer with picosecond clocks the size of the earth more than the age of the universe to brute force IDEA, for instance. It would have made a great DES cracker, though; my back-of-the-envelope calculation has it cracking one key every .75 days on the average. thad -- Thaddeus Beier email: thad(a)hammerhead.com Technology Development vox: 408) 286-3376 Hammerhead Productions fax: 408) 292-2244

1 0

Re: Political Cleanup program
by James A. Donald 17 Dec '03

17 Dec '03

At 11:04 AM 12/17/95 -0800, jim bell wrote: > It occurs to me that it would be a major advance if a system could be set up > that would "blind" campaign donations as to their source: The donor could > be satisfied that his donation gets to the candidate or cause, but the > candidate couldn't know who actually paid the money To make this work, the government would need to prohibit individuals from campaigning for politicians, taking out ads with political consequences, and so on and so forth. A short step from totalitarianism A better solution is to move assets and money into forms where politicians cannot get at them, thus reducing the power of politicians, and thus the incentive to buy favors from them. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

Re: Political Cleanup program
by jim bell 17 Dec '03

17 Dec '03

At 07:03 PM 12/17/95 -0500, you wrote: >On Sun, 17 Dec 1995, jim bell wrote: > >> >> It occurs to me that it would be a major advance if a system could be set up >> that would "blind" campaign donations as to their source: The donor could >> be satisfied that his donation gets to the candidate or cause, but the >> candidate couldn't know who actually paid the money (and the donor would be >> unable to prove that he made a donation, for example). Admittedly there are >> a lot of details that need to be worked out, but if this could be >> accomplished it would change politics as we know it. > >Just a straight Chaumian style blinding won't work, as there are too many >covert channels available via both timing and amounts; For example, Joe >Random Capitalist-Oppressor could arrange to pay a series of relatively >small amounts wth different values in the cents field which could be used >to confirm their payment (e.g. they could be composed to form a digitally >signed value of some kind ("pollution rools" or "lung cancer is kool") :) Yes, as I suggested a number of details would be necessary to avoid this. Reporting only cumulative donations, occasionally over a long period of time (once every three months, for instance), and even then only approximating the total number would make doing such a correlation extremely difficult. >Sen. Dianne Running-Dog could then look for a matching set of donations >and confirm that the bribe had in fact been paid. > >There are much better ways of reforming the political system -the >formation of proper political parties with real programmes (the one good >thing about the newtoid surge); changing the rules for TV advertising, >etc. Blinding just makes things worse. The blinding needs only be temporary; long enough so the politician can't act improperly on the donation, but eventually revealed in enough time to expose political influence before the next election. Besides, I have already proposed what I consider to be a _better_ method of reforming government. It's called "Assassination Politics." Perhaps you've heard of it.

1 0

Re: Secured RM ? (source)
by Ben Holiday 17 Dec '03

17 Dec '03

On Sun, 17 Dec 1995, Jiri Baum wrote: > > In this particular case what im concerned about is a temporary cleartext > > copy of a permanently encrypted document. The cleartext only exists for > > about 1-4 seconds, and then is deleted, so backups arent really a > > problem.. > > Is it then necessary to write it to disk? Im pretty sure that its nessecary.. at least at this point. Basically what im working on is a bit of front end that trys to make keeping things encrypted a bit less of a hassle. It needs to be able to read multiple file types, and as such it does some odd things. It opens the file and figures out the magic for it, closes it, then jumps to the right routine for reading the particular thing.. the file is opened again, perhaps once, perhaps repeatedly, depnding on the nature of what is going on.. then when it finishes with the file the cleartext copy is removed.. the main idea pushing me here is that if you were to encrypt things on your harddrive for storage, you would most likely want access to them at some point, and if your like me, you'd want access to them on a regular basis. Prior to starting work on this project i would manually decode whichever file i needed, work with it, andd then delete it. This was a pain in the ass, and also somewhat less secure since im only human and could conceivabley forget to resecure the file after im done using it. So looking at it from a relaxed standpoint.. the code as it stands now is at least as good as the previou method i was using, and is alot simpler. :) To be a bit more critical, neither method seems to be the BEST method.. I hate saying this cause it feels like a cop out, but I keep coming back to the question of usability versus iron-clad security. At this point there is no noticible speed difference between using the program with encrypted versus decrypted files. Im pretty concerned about the overhead of getting too involved in a flawless implementation. I think at this point if i could produce a first release that would be "good enough" to pass (for example) a moderatly sophisticated once over by local law enforcement, i would be content. Once thats available I have alot of other things tthat I'd like to see done better.. Incidentally, i'm planning to post the full details including an FTP site sometime in january or febuary.. at that point i expect to be torn to shreds by the cryptographic comunity.. :)

1 0

Re: [more NOISE] BIO-MUNITION: gifs of perl-RSA tattoo
by Alan Olsen 17 Dec '03

17 Dec '03

At 11:06 PM 12/17/95 -0500, you wrote: [Much noise on Perl-RSA tatoo and compile problems deleted] The only thought that came to mind on this thread was how closely the tatoo artist spellchecked that tatoo. It would be pretty funny to have a "munitions violation" that was non-functional due to tatooing errors. | Remember: Life is not always champagne. Sometimes it is REAL pain. | |"It's only half a keyserver. I had to split the | Disclaimer: | |other half with the government man." - R. Rococo | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

Re: What ever happened to... Cray Comp/NSA co-development
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 10:32 PM 12/17/95, Anonymous wrote: >What caught my attention was the architecture. > >A "hybrid design linking two supercomputer processors with an >array of HALF A MILLION inexpensive processors" that were >designed by the U.S. government laboratory affiliated with the >NSA. The same chip house that brought us Clipper. First, half a million chips is not that big a deal...the Connection Machine had up to 64,000. Very few cryptographic problems of interest to us will be affected by a mere factor of a million or so. Second, there was work on a "processor-in-memory" architecture, in conjunction with a Bowie, Maryland spook-connected company. Perhaps this is what you are thinking of? Third, all avenues of continued funding having fallen through, Cray Computer (not Cray Research, of course) was shut down and assets liquidated. I haven't heard what's become of Seymour, though. (He is undoubtedly an asset, buy I doubt the Agency would have him liquidated.) >I've not kept up with the "ultimate" demise that eventually >befell Cray Computer Company, but the October 16 FBI filing >on capacity for Digital Telephony got me thinking back to this >article. 1% seems like a rather huge need for horsepower. And >what if GAK doesn't fly? And the widespread use of hard crypto >just keeps increasing? The tightly-coupled supercomputers are hardly needed for these sorts of problems. >This kind of machine could, in theory: > >1) Implement ALL Clipper(II) based Key Escrow functionality in > silicon (the easy part) AND allow for simultaneous decrypt and > surveil of 'who knows how many' Clipper based data streams. Huh? First, what evidence do you have for this claim? Second, who cares? Implementing Clipper in a Cray Computer machine--why bother? As to the claim that a million-processor machine could do this, you need to work out the math. (If a backdoor exists, or the LEAF has been gotten, a supercomputer is not needed....) >2) Implement general RSA based Prime Factoring functionality in > silicon (the not so easy part) AND allow massively parallel > decrypt and surveil of 'who knows how many' RSA/etc. based > data streams. Prime Factoring? Primes are easy to factor, of course. (Hint: Every prime has two factors.) If you mean using supercomputers to brute force the general factoring of an RSA modulus, this is nonsense. While there may be math shortcuts we don't yet publically know about which make factoring easier than we currently think it is, a mere million or even a billion processors will not make a dent in the factoring of, say, a 700-digit modulus. See the tables in Schneier and elsewhere for some estimates of factoring efforts needed. >3) Implement it all, AND 'on-line' transaction based surveillance > via the FBI's 1% capacity infrastructure. Let's see some numbers. (On second thought, let's not.) >Chilling... Who needs key escrow (or RSA private keys) when >you've got a massively parallel prime factoring machine. What if >GAK was to become a 'non-issue'? How fast do you think a machine >such as this could factor RSA 129? Well, do the math. The MIPS-years for the RSA-129 crack were publicized, so the computation for a million SPARC-equivalent (or even UltraSPARC-equivalent) can be done. When you've done this, and concluded that RSA-129 could be done in, say, X minutes, then move on to RSA-384 (the BlackNet key cracked by the MIT group), and on to the 1024- and 2048-bit keys. Tell us how many years or centuries it will take. (Hint: Rivest and Schneier have done these calculations....) --Tim May, who fears that he's just been trolled by Derek Atkins Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

6 5

Java and timing info - second attempt
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

I asked about using Java scripts to capture remote timing info before and got no response. I assume everyone thought it was a stupid question. Therefore, I'll ask it again. The thing that makes Java a big deal is that you execute other people's code on your machine. You browse a Java-enhanced Web page, click on something interesting, suck across an applet, and execute it on your machine. This setup enables a bunch of nifty interactive Web stuff. Turn the picture around: You setup a Java-enhanced Web page, include some interesting buttons to click, write some clever applet, and people around the world suck your applet onto their machine and execute it. Combine this with some a standard crypto API for doing Web-based digital signatures or authentication or encryption and you may begin to see some possibilities. Would it be possible to create a Java applet that causes the client machine to sign or encrypt something with their private key, and then send back timing info? For the answer to be YES a few things need to be true. There needs to be some sort of standard crypto API in use that can be accessed by a Java script, and Java scripts need to be able to capture and send back timing info. Does anyone on this list know enough about Java to know if it can do any of these things? Jim_Miller(a)suite.com

3 2

Re: Motorola Secure Phone
by dan＠milliways.org 17 Dec '03

17 Dec '03

On Sun, 17 Dec 1995 17:38:49 -0800 you wrote: >At 06:40 PM 12/15/95 EST, you wrote: >> > >I don't know Moto's phone models, but there are some cordless phones, >especially long-range 900MHz ones, that are "secure" because of >spread-spectrum, and others that call themselves "secure" because >they're "digital", so you can't eavesdrop on them just by playing >with a scanner and maybe single-sideband. Sigh. > Well, just to finish the story, I ended up getting the Cincinatti Microwave Escort 9000 (yes, the radar detector people). It's 900 MHz digital spread-spectrum, although it's still unclear how secure their implementation is. I'll call them and see what I can come up with....I realize it's *not* going to give me military-style security. But really all I'm interested in is making it simpler (ie cheaper) for Big Brother to wiretap me than to deal with trying to scan me without court authorization. Dan *************************************************************** #define private public dan(a)milliways.org Worcester Polytechnic Institute and The Restaurant at the End of the Universe ***************************************************************

1 0