December 2003 - cypherpunks-legacy

US: Domestic Encryption Protected by US Constitution?
by C Matthew Curtin 17 Dec '03

17 Dec '03

Something that has come up in my recent random thoughts... Given that the US State Department classifies strong crypto as munitions, is it possible that any laws passed outlawing the use of strong crypto among US citizens could be declared unconsitutional, in violation of the second amendment? Are there any legal precedents that apply here? Is the question purely academic (i.e., no such laws exist, no such bills are in the works, or none have been tried)? Does anyone know of any laws on the books that might be relevant to my question? -- C Matthew Curtin Chief Hacker Fahlgren, Inc. 655 Metro Pl S, Ste 700, Box 7159 Dublin OH 43017-7159 http://www.local.com/~cmcurtin/ cmcurtin(a)fahlgren.com PGP Mail Preferred

1 0

Whalepunks, Marginpunks, Gunpunks, Clintonpunks, and Politics
by tcmay＠got.net 17 Dec '03

17 Dec '03

To all the Whalepunks, Marginpunks, and Gunpunks, I've been deleting after only a brief glance the dozens of posts on these subjects (funny how some people who issue "pissograms" telling people things are "off-topic" apparently think their own long rants on off-topic subjects are just fine). However, this misstatement caught my eye: At 6:30 PM 6/8/96, hallam(a)Etna.ai.mit.edu wrote: >by government. I have even heard it stated that had gun ownership been >more widespread >in the UK the Dunblane massacre would not have occurred. Whether the >teacher was >expected to gun down Hamilton with the Kalashnikov she carried to school >each day or >whether the tots were expected to come to her aid with Smith and Westons >I'm not sure. >In short I don't think that there is any type of piffle that the "most >fuzzy headed free >market types" cannot offer. Some of the folks I know would point out the logical flaws in this model. First, a Smith and Wesson is not what the tots should be carrying. An MP-5K would fit nicely in their bookpacks (especially now that all yuppie kids carry de rigeur designer backpacks, though mostly for designer water). More firepower. Second, the preferred "trans-humanist" solution is much cleaner: blow up the classroom and then restore the innocents from backups. (High-tech variant: "Kill them all and let the nanotech truth machines sort them out.") My point of view is that while schools should be free of guns, adult citizens should probably have access to guns. There are, sadly, nutty people who will use nearly any available weapon to commit mayhem and mass murder. Rifles, shotguns, axes, knives... The "Luby's" cafeteria massacre in Texas several years back is a better example than the Dunblane school shooting (or the one in Tasmania, or the one in California....). There, had some of the restaurant patrons been armed, it is likely that at least one of them could have gotten off a shot. Further, many of these nutcase killers are basically cowards, according to profiles I've read, and might be fearful of sitiuations where there victims can shoot back. When they know their victims are unarmed, are sheep for the slaughterhouse, I think this causes more such "mukkings" (to use Brunner's prescient term from "Stand on Zanzibar...Christ, what an imagination he had). Remember, "Guns don't kill people, postal workers do." In general, I think Phill raises some good points about the efficiency of free markets. However, I doubt that Cypherpunks is the proper forum for debating economic theory, for various reasons. I lean strongly toward the free market side, inasmuch as I think most non-free market economies are actually just cases where the government controls the _single_ corporation they let run an industry, and thus one gets a worse situation that with the grossest excesses of capitalism. More pollution, more strip-mining, more denudation of forests, more destruction of lakes, etc. Look at the former U.S.S.R. and Eastern Europe for a glimpse of what "state capitalism" can do. However, the reason many of us don't jump in and write defenses of free markets here (and I would not have except to make my transhumanist joke--so sue me) is that this list is not "Libernet" nor any of the similar political discussion lists. Secondly, there is almost zero chance that any of us will have our views changed by such political arguments, so why bother? (I do discuss what I think are the _logical implications_ of strong cryptography and cryptoprivacy, and even the implications of crypto anarchy, and I think these issues are "on-topic" for this list. Even if one is a socialist, a fascist, a royalist, or a Wobbly, the implications remain important.) But arguing the merits of capitalism vs. socialism, for example, has rarely been fruitful in the past 10 years of the Usenet, or on mailing lists, and I doubt the debate will be more fruitful here. The same goes for debate about Clinton, Hillary, Vince Foster, Whitewater, etc. The fact that someone forwarded a Brock Meeks story in which he (apparently, as I skimmed-then-deleted the story) make negative comments about the Clintons, and then someone chimed in with points about her allegedly illegal stock trades....well, these are clearly not list topics, in my view of course. (I claim no right to set the list agenda. Nor do I accept Perry's oft-repeated claim that I am "causing" the list's decline by stating my views on this point.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Elementrix Snake Oil Spam...
by Robert Hettinga 17 Dec '03

17 Dec '03

Was it just me, or did others on this list get three whopping MS Word docs sent to them from the POTP snake-oil folks? Came from one Charles W. Morgan, <charlie(a)outcomesinc.com>, of "Outcomes 2000, Inc.", whoever *that* is... Probably somebody trying to give the Albuquerque Spam King a run for his money, I bet. Feh! Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "If they could 'just pass a few more laws', we would all be criminals." --Vinnie Moscaritolo The e$ Home Page: http://www.vmeng.com/rah/

1 0

Thank you for the Archives 100 messages
by qut4.qut＠netcom.com 17 Dec '03

17 Dec '03

Apologies, but rich has deleted me from his mailboxes, and for a few days now, somebody has placed a global cancel bot on me. I'm gonna have plenty of fun figuring this out. Kwow any good sniffers? I agree the list should be public usenet: A mail gate-way to a usenet group that ALSO permits unmoderated posts. This would be a nice way to combine a strict moderated mail-list, with a standard netnews group.

2 1

Re: Anti-Scientologists
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

>1. There's a gang of flamers (David Gerard, Jon Noring, Ron Newman, Rob J. >Nauta, and the like) who try to stop $cientologists from discussing their >religion on the Usenet newsgroup alt.religion.scientology. Most of them are >disgruntled former cult members and/or members of other similar cults. Untruth #1. Aside from the "religion" red herring you tossed in (it's a cult), the critics expose the lies, doubletalk and inconsistencies posted by cult apologists. (It should be noted that these people aren't generally "just another satisfied Scientologist," but are cult employees who are carefully vetted to distribute propaaganda without ever answering critics' questions.) [snip] >3. These harrassers are Usenet Cabal supporters, and they are sometimes >joined by initerant cabal enforcers such as Peter Vorobieff, who visit a.r.s >to lend a helping hand and to flame Co$. So what's your point? Besides, there is no Cabal fnord. :-) >4. Recently the anti-scientologists have asked me for a copy of my cancelbot, >and have been using it to forge cancels for scientologist posts on a.r.s. Untruth #2. Articles canceled from a.r.s. have been multiple postings of standard Scientology tracts (over 10,000 in all, so my newsreader says), spread out over various alleged users. These aren't intended to promote discussion -- they're intended to bury the newsgroup in noise. Apparently being selected Kook of the Month causes disturbances in one's ability to distinguish the correct from the incorrect. (Or is that how one gets the award in the first place?)

1 0

Rabin patented?
by Mark M. 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Is Rabin encryption patented? I have never heard of any patent covering Rabin encryption, but I have also heard that Diffie-Hellman will be the first PK algorithm that is patent-free when the patent expires in '97. I know that until recently, ElGamal was considered to be covered under the DH patent. I wonder if the same is also true for Rabin. - -- Mark =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= markm(a)voicenet.com | finger -l for PGP key 0xe3bf2169 http://www.voicenet.com/~markm/ | d61734f2800486ae6f79bfeb70f95348 "In Christianity neither morality nor religion come into contact with reality at any point." -- Friedrich Nietzsche -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: noconv iQCVAwUBMbozMrZc+sv5siulAQH2ugP8C0ymdTJJLUa9NQxj7ahkcGD/u0tFZWfN DtMDRm08b0aupADNgDntn7ZHAZKXo5RRAClLfvB3Z/gIGMbqAQKFMItSN7CbJ4k1 osY2enhnrDN840LH0jQmC/dS0MjVWh5CaC3R9SqHqhiu5S5oZUP4fAJhIyDMcQuo VLGUQzLZVxs= =P3wZ -----END PGP SIGNATURE-----

1 0

Anonymous return addresses
by Hal 17 Dec '03

17 Dec '03

Browsing through the 1995 IEEE Symposium on Security and Privacy proceedings at the library, I found two articles of interest here. The first, "Preserving Privacy in a Network of Mobile Computers", is really a method for anonymously receiving mail via reading it from a large database such that no one knows which part you are reading. This is a topic which we discussed here at some length a year or two ago, but I think this article has a new idea about it which I will discuss below. The other one was "Holding Intruders Accountable on the Internet" and it had one strange comment. Basically it was about a way of trying to track down cracker types who break into systems. One strategy these people use is to log into a whole series of insecure hosts, one after the other, before attacking their target. Then tracing back where they came from is very difficult. Cliff Stoll's "The Cuckoo's Egg" is the classic account of how hard it is to trace these people. Probably the new books about Mitnick talk about the same thing. The idea in this article is that you monitor the whole net and track all the rlogin and telnet traffic between pairs of hosts. Then they describe a statistical technique for determining that two different telnet sessions are chained together by recognizing the same patterns of traffic on them. Basically they count the frequency of spaces and punctuation marks on minute-long time slices and try to correlate them. This way you can tell that the intruder attacking here is also using these other hosts over there, and try to track him down that way. I don't think this is very practical, and I have mixed feelings about the technology - I don't favor breakins, but the kinds of surveillance that would be necessary to implement their technique seem very threatening. Also they do mention the obvious countermeasure of using encryption at each stage, which would be easy with such things as the secure remote shell programs around now. The interesting comment came when they were discussing an alternative scheme, which would be to have all hosts keep track of their incoming and outgoing connections: "The difficulty with all such host-based tracing systems is that, when an extended connection crosses a host which is not running the system, accountability is altogether lost at that point.... Even if most hosts could be secured, the intruder community could easily maintain a set of machines to launder connections, just as they maintain anonymous remailers." So apparently in the view of these authors anonymous remailers are maintained by "the intruder community." It is unfortunate that we have this image among some member of the larger community. BTW, there are periodic suggestions here to run general-purpose connection redirectors, but people should be aware of the problem that cracker types would seize on these as another shield for their crimes. These would have to be limited to specific uses, such as port 80 which is the http port and which hopefully can't easily be used for attacks. In any case, let me describe the message-receipt idea from the other paper I mentioned above, which is by David A. Cooper and Kenneth P. Birman of Cornell. They have a few ideas, among them exchanging message labels for the next message in an ongoing conversation, so that later messages don't have any identifying information on them, but just opaque message labels which can be scanned for matches to those of interest. This is a concept we have discussed before. However you still have the problem at least for the first message to an anonymous recipient of getting it to him anonymously even though the message says what pseudonym it is for. A simple idea is to put all such messages into a database and to let everyone scan the message headers to see whom they are for. Then when they see one for them they download, decrypt, and read it. For more security, let the database machine be trusted, and let the download request and response be sent encrypted. Now only the database machine knows which person asked for which message. This provides a level of security analogous to sending through a single remailer. (Another idea is to download all messages, but that is generally infeasable if there are a lot of people using the system.) The new idea is to use multiple databases to get security similar to using multiple remailers. I'll describe it using two machines. Each holds a database of messages, and the two databases are exactly alike. Some mechanism keeps the two synchronized. Furthermore, all the messages need to be the same size. There will need to be some padding and fragmentation/assembly mechanism to arrange for this. Someone who wants to receive some mail anonymously first downloads all the message headers as before, and determines which messages are for them. Suppose just one is, and it is message number 20 out of a database of, say, 50 messages. Now what the reader does is to choose a random 50 bit number (where 50 is the total number of messages in the database). He makes a copy of this number, and toggles bit 20 in one of them (20 is the message he wants to receive). Then he sends one number to one of the database servers, and the other to the other server. Each one receives a random-looking 50 bit number. What each server does is to take the messages from the database which correspondo to 1 bits in the 50 bit number, and XOR all those messages together, byte for byte. The resulting output will be the same size as a quantized message. It is sent, encrypted, back to the requestor. Now all he does is to XOR the two messages he got back from the servers. All of them will cancel out except for message 20, which is the one he wants. This can be generalized to more than two servers, by creating multiple bit strings and arranging so that the XOR of all of them will just leave the bit set for the message he wants. If he wants more than one message the protocol has to be repeated separately for each message. There is no large amount of traffic needed, as each server only sends an amount of data equal to one message. The individual servers do not get any information about which message the requestor wants (other than that it is one of the 50). Only by colluding and XOR'ing their bit strings can they figure that out. The same kind of collusion is needed to trace a sent message using two remailers, so the security is similar to what we get sending messages. Messages would have a finite lifetime and would expire and be removed from the database after a while. The authors propose breaking the database up into batches with a fixed number of messages, but I don't fully follow the reasoning behind this. I guess it reduces the load on the server when it does its XOR's. I'm not sure whether this particular scheme was proposed when we discussed this concept in the past, but it does seem like an interesting alternative way to receive messages. Hal

5 5

Re: [NOISE] Buying whales with digicash Re: Anonymous stock trades.
by drose＠azstarnet.com 17 Dec '03

17 Dec '03

hallam(a)Etna.ai.mit.edu wrote: >>usually, people just call me Davve. > >Unusual to spell Dave with two v's, were your parents also dyslexic? Er, Phill (if I may make so bold, sir--arggh, treasure ahead laddies), I'm being a tad sarcastic, Phillll. Get it? Frankly, my wanker/tosspot amigo, I am more than a bit sick of your self-professed ignorance. And your ad hominem attacks don't amount to a hill of beans. I am more than through with you. Perhaps Perry has more patience.

1 0

Re:
by jim bell 17 Dec '03

17 Dec '03

At 05:09 PM 6/8/96 -0500, Igor Chudov @ home wrote: >jim bell wrote: >> >> While I appreciate your...uh...appreciation, let me remind you that part of >> my "pronouncements" are that the current political and social system is >> sick. Many people around here seem to agree with this assessment. What I >> advocate is a comparatively simple change in the rules that could have the >> effect of vastly changing the way things are done. Whether these changes >> are in "the best interests of the inhabitants of this nation" is still an >> open question, and many people have agreed with me on this matter. >> > >Since corrupt officials are likely to have more anonymous cash that >phreedom phighters, guess who will win. The people, that's who. The reason is that while "corrupt officials" may have more money, per person, that ordinary citizens, there are FAR more ordinary citizens than officials. Further, these corrupt officials only have more money because they rob it from ordinary citizens, which means that they start out the game hated by the public. Finally, officials are, by definition, identified or identifiable, while disaffected citizens are not. Jim Bell jimbell(a)pacifier.com

3 2

Re: [Off-Topic] "Curfews"
by Jean-Francois Avon 17 Dec '03

17 Dec '03

On 8 Jun 96 at 12:40, jim bell wrote: > JFA wrote: > >I did something I always bitch at when done by others: looking at a > >situation outside of it's appropriate and complete context. > > As you can see, this is one of the big difficulties that people can > have understanding AP: Since it changes just about everything about > how a society works, you can't analyze it "easily" using your > built-up knowledge of societies. Actually, it makes one realize that society and the "collective" is nothing, that the basic building block is the individual. If you analyse the motivation of the individual, AP is not difficult to understand. > As I've said so many times before, AP is like a political Rorschach > test: Your reaction to it is strongly related to your political > philosophy. That's part of the magic. Please stay out of magic. The actual politician are enough into it. JFA DePompadour, Societe d'Importation Ltee; Limoges porcelain, silverware and crystal JFA Technologies, R&D consultants: physicists, technologists and engineers. PGP keys at: http://w3.citenet.net/users/jf_avon ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891

1 0