December 2003 - cypherpunks-legacy

RE: Random Number Generators
by JR＠ROCK.CNB.UAM.ES 17 Dec '03

17 Dec '03

From: SMTP%"tcmay(a)got.net" 18-JAN-1996 06:33:11.77 >At 11:40 PM 1/17/96, Kurt Buff (Volt Comp) wrote: >>If you're going to work with hardware to get really random numbers, why not >>go to the back of any of several PC-type magazines, and order the radiation >>detector board that someone is hawking? Can't really do any better than >>that, can you? Counting cosmic ray hits and noting their time differentials > ^^^^^^^^^^^^^^^ >>should be just what the doctor ordered, right? > >Almost all of the counts in simple radiation detectors are from earthly >sources, not from cosmic rays. For Geiger tube counters (not very common >these days), the main counts are for gamma rays and for beta particles (if > ... stuff deleted ... The main problem I see on these sources is not their ramdomness, which, in some instances may be not so good as one would expect, but their subscep- tibility to tampering. First, randomness: for radiactivity counters, decay is a log function of time. This could be used to reduce keyspace search. Second, radiactivity can be quenched. If you are measuring background levels, then you are exposed to external influences too: to be extreme, one can expect your counter to go mad after an atomic explosion in the neighborhood. This reduces randomness and keyspace. Second, tampering: the atomic bomb explosion is a good example: it is possible to produce an external source of radiactivity and influence your detector. Unless you measure alpha particles from a radioactive source of yours... And even then, you'll have to buy your source... >From whom? Just imagine a spy porting a radiating gun and pointing it to your detector. Also, the technology used is normally electromagnetical. One could think of a method to storm a detector with a em field... thus reducing randomness. The point is: since you don't notice these fields or radiations, you are prone to fall in the trap: one gets used to rely on the technology 'cos it always works, and when the day comes since you don't notice anything unusual you don't suspect anything wrong. Your detector may be overloaded and only outputs zeros for a while and you won't notice anything wrong. >RNGs based on thermal noise and natural radioactivity have been discussed >on our list at least a dozen times (multiple posts each time), so I suggest >further research be done there. > >--Tim May This sounds to me more like the way to go: you need to rely on something of which you have full control. Either a RNG function or something that can not be tampered without you noticing. It would be very difficult to produce big changes in temperature without you noticing... Though still you are left with electromagnetic interferences on the detector. My view is that what is needed is something that a) you can fully control or b) nobody can control/interfere/mimic in any way. In this sense, my point of view is: anything that can be influenced from the outside is not reliable. This means you need something that's totally inside and controlable. It should be fairly random, and not able to be influenced from the outside. And possibly originate its own electrical current which is not dependable on external influences of any type. Specially electrical/radiation influences. It should be easy to monitor and difficult to tamper with temporarily (so that tampering could pass unnoticed). The only thing I can think of is a biological source converting chemical products into random electrical data. Biological sources are very difficult to influence rapidly (other than by death which is irreversible), they can't be switched on/off, their range of values is always bounded to physiological limits (i.e. the only way to "overload" them is by killing them or some other drastical and evident measure), have normally a strong resilience to external influences, and as long as you can keep an eye on them, you can remain sure they are alive and not horribly sick. And finally, if you are the source, then you have the highest availability possible and the fullest control. You could measure the changes in charge induced by a electrical fish as it swims. Or changes in conductivity of some plant/animal tissues. Or have a culture of electrical microorganisms. Or just use your own electroencephalogram with the appropriate corrections to remove waves. There are also some biological processes whose production is intrinsically random. Things like some biochemical cycles, or some muscle movements. It's all a matter of finding the best one(s) according to randomness and ease of measure. And you can always combine several sources. There are even some studies already done about the randomness of different biological processes, their predictability and to which extent they can be influenced. The technology to measure most of them is already well developed and highly reliable. It's all a matter of adapting it to a new use. Just my 2c. jr

1 0

Re: FW: Net Control is Thought Control
by eli+＠GS160.SP.CS.CMU.EDU 17 Dec '03

17 Dec '03

In article <+cmu.andrew.internet.cypherpunks+4kz3qSq00UfAM0yv9n(a)andrew.cmu.edu> Mr. Nuri writes: >that 9 of the last 10 flamewars on this list were actually carefully >orchestrated, *manufactured* by a single person interested in making >this point, and teasing people that refused to believe that rampant >dischord can be sown through a barrage of pseudonyms. Enough already. We all know that discussion groups are subject to disruption by flamers, and that anonymity can reduce accountability. What is more interesting is whether the use of pseudonyms adds any new possibilities. >how can you be so sure that the cypherpunks lists is really what you >think it is? a bunch of people from around the country independently >interested in crypto? an agent provacteur, or agent saboteur, could >create a vastly different perception regardless of the input of other >people. Ah, conspiracy theories again. A conspiracy of one does have certain advantages over the old-fashioned approach of gathering several like-minded people. Communication costs are reduced, and the problem of trust is eliminated. On the other hand, a conspiracy of one isn't much good for anything but playing games on the net -- cattle mutilation is really a two-man job, and infiltrating the U.S. Government is right out. Being a good Medusa may be easier than controlling the banking system, but it seems to be quite hard. Your history suggests that stylistic analysis may be used to link nyms. A sufficiently skilled writer might be able to avoid this. An individual known to me was wanking around with pseudonyms (from nyx, I think) on rec.music.industrial in '92-93; he did a decent job of stylistic variation, but was noticed on the basis of the response patterns of his articles (and nailed by nyx usage logs, but that's another matter). There are several Usenet examples of people trying to use inapparent pseudonyms without lasting success. The classic response, of course, is that the real conspiracies are too good to be detected, and/or they off the investigative reporters. This is not falsifiable, but we can compare pseudonym conspiracies to meat ones: the risk is lower, particularly in an regime of unconditionally-secure pseudonyms from which the Medusa can simply walk away. But you don't get real-world power or money. You get to put in a lot of effort for a chance at unduly swaying public opinion on one forum. (And if you screw up, you get a lot of attention -- this may be a major draw for some.) But there are easier and more effective techniques: press releases and paid advertising, for example. Who needs pseudonyms? Side note: >another very interesting effect to measure is the following: if there >is already a lot of mail on a list, people tend to post less. I would say the opposite. -- Eli Brandt eli+(a)cs.cmu.edu

1 0

Re: Crypto anarchist getting through customs
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 12:13 PM 1/17/96, hallam(a)w3.org wrote: >...only >conspiracy theories we are interested involve the NSA, MI5 or the Stay-Puffed ^^^^^^^^^^^ >Marshmellowman. ^^^^^^^^^^^^^^ ROTFL. Yes. Well. He just seemed so soft and friendly. I figured thinking about *him* couldn't hurt... Cheers, Bob ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The NEW(!) e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

Re: new web security product
by Brad Shantz 17 Dec '03

17 Dec '03

Perry Metzger wrote: > I don't think its going to fly. No one wants to pay for an unneeded > $100 piece of hardware to encrypt the same credit card over and over > again, when a nearly zero marginal cost piece of software can do the > same thing. I agree with Perry. Hardware encryption does add a layer of security not normally found in software, but it is hardware. Shoot, I don't even have a 28.8 modem yet, why would I want a black box that supposedly does something with my Credit Cards? Brad

1 0

"trust management" vs. "certified identity"
by norm＠netcom.com 17 Dec '03

17 Dec '03

This is reminiscent of a recent idea of mine. Imagine the following signed declaration: I (fingerprint = ...) claim that the code X with SH (secure hash) = ... satisfies contract with SH= ... when its free code pointers are bound to other code conforming to contracts identified within X by their SH's. The contracts would be either formal or informal. When a Java program arrives at a client it can warrant its services if it finds local access to warranted sub-routines. (For this purpose behaviors of objects are sub-routines.) The Java loader can build warrants recursively with such declarations. They would, of course, be relative to the reputation of signers of the above declarations. I have just sent for your paper.

1 0

Re: underground digital economy
by Duncan Frissell 17 Dec '03

17 Dec '03

At 10:27 PM 1/17/96 -0600, Jim Miller wrote: >This is the part that bothers me. Wouldn't a gateway between anonymous >e-money and identified e-money would stick out like a sore thumb to >agencies tracking the flow of identified e-money? Wouldn't identified >e-money trails start and/or terminate at the gateway? Once the gateway is >discovered, all clients on the identified e-money side of the gateway >would be discovered. But those clients could be shell companies given to the "real" users. As long as one has a continuing opportunity for anonymous *spending* you can transfer the value of the underground e-cash into useful goods and services. DCF

1 0

Re: new web security product
by Steve Gibbons 17 Dec '03

17 Dec '03

# Perry Metzger wrote: # > I don't think its going to fly. No one wants to pay for an unneeded # > $100 piece of hardware to encrypt the same credit card over and over # > again, when a nearly zero marginal cost piece of software can do the # > same thing. Merchants might. Current credit-card processing terminals are increadibly overpriced for what you get. $100.00 plus the price of an inexpensive PC, plus proprietary software isn't too far of the mark, in comparison. # I agree with Perry. Hardware encryption does add a layer of security # not normally found in software, but it is hardware. I've been a fan of unrelated encryption at each layer of the 7 (5, 4, whatever) layers, lateley. In military/financial terms, the question of "who has access to what" and "needs to know what" at different levels of the protocol stack make a big difference. Network guys should be able to perform traffic analysis, application guys should be able to debug application-specific traffic, but not visce versca. # Shoot, I don't even have a 28.8 modem yet, why would I want a black # box that supposedly does something with my Credit Cards? If you think "Not _my_ credit cards, but my _customers'_...", then it starts to make sense. -- Steve(a)AZTech.Net

1 0

Re:
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

At 03:41 PM 1/16/96, you wrote: >I thought you might find this interesting... Thanks, that is very cool beyond just ecommerce, because what does it mean for personal encryption? If I buy one of these doo-hickeys for $100, and so do you, does that mean we don't have to buy an AT&T 3600 (secure phone) to talk securely, and also not have to worry about Clipper crap? Or (as it probably is) does that mean we _have_ to talk through this company and it only sends tiny bits of info from the card reader... (it'd be cool if you could modify it...) Interesting. > >found at:http://www.cnn.com/TECH/9601/encryption/index.html >New security device may broaden business on the web > >January 16, 1996 >Web posted at: 9:30 p.m EST (1430 GMT) > >>From Correspondent Marsha Walton > >ATLANTA (CNN) -- For cyberspace marketers, The World Wide Web is a potential >world wide mall, an electronic marketplace for consumer goods and services. > > But for now, most visitors are window-shopping, not buying. A new survey by >the University of Michigan shows consumers are wary of purchasing goods >online for fear their credit card numbers will be misappropriated. > > People who think nothing of giving their credit card number to an anonymous >voice over the phone or handing their card to a waitress at a restaurant, >flinch at the thought of putting that number into a computer. > > But a New Jersey, ISED Corp., has created a device that >secures transactions, both on the Internet and over the telephone. It's >called SED, or secure encryption >device. It costs about a hundred dollars, attaches to a >phone or a PC and operates with the swipe of either a credit or ATM card. > > "What the device will really allow is consumers a new form >of payment from home using their ATM card. They'll be able to purchase goods >and services or whatever on the internet, " said Roger Payne, an engineer >for BT Labs which is testing the product. > > Potentially vulnerable personal account information is >scrambled or encrypted on the magnetic stripe on the card. It is >electronically transferred through the hardware. That eliminates the need >to say or "key in" the account number or expiration date. > > "So that if somebody who is not supposed to be looking at it, they can't >understand what's in there," said Grant Helmendach whose company BUYPASS >processes three quarters of a billion financial transactions a year. > > BUYPASS is marketing SED to "mom and pop" retailers which charge goods by >making an imprint of credit cards, relying on paper transactions that are >costlier, and less secure. > > "Lots of folks want to focus on the Walmarts of the world. not a lot of >people have focused on the smaller specialty shops, specialty retailers, and >what folks at SED have done, is built a terminal that's very inexpensive, >so they can play in this game. They have financial incentive to do that," >said Helmendach. > > As buying by computer catches on, the device could eventually be used to pay >for everything from a pizza delivery to bailing a friend out of jail, and >would be as much a part of the home computer as a floppy disk or a hard drive. > > And just as consumers have grown accustomed to computers and ATM cards, the >combination of the two could be another step toward a "cashless" society. _______________________ Regards, If God intended one space between sentences, why do we have two thumbs? - ? Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu 0C 69 D4 E8 F2 70 24 33 B4 5E 5E EC 35 E6 FB 88

1 0

Re: pgp broken?: my mistake
by hoz＠univel.telescan.com 17 Dec '03

17 Dec '03

I apologise for including the following line: >>On 16 Jan 96 at 19:16, Derek Atkins wrote: Making it appear that Mr Atkins had something to do with the quote, which he did not. After rereading, the entire post has a sort of nasty tone that I did not intend. Oh, well, maybe I should return to lurk mode for a while... Rick F. Hoselton (who doesn't claim to present opinions for others)

1 0

01 16 96 CuD Cypherpunks-related Items
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, Cypherpunks-related items in 01 16 96 Computer under- ground Digest: Cryptography and Privacy Justice Dept. press release: no PGP prosecution (fwd) FLASH: Phil Zimmermann case dropped! Letter to Wiesenthal Center in re "hate speech" ban AP/NYT: Jewish Groups Call for Internet Censorship CuD is available as a Usenet newsgroup: comp.society.cu-digest The most recent issues of CuD can be obtained from the Cu Digest WWW site at: http://www.soci.niu.edu/~cudigest Cordially, Jim

1 0