December 2003 - cypherpunks-legacy

Re: Prof Shamir arrested
by Bert-Jaap Koops 17 Dec '03

17 Dec '03

Jim Bell wrote: [many things on "fraud"] Excuse me if I don't react on this in detail. We have already explained it, and there it stands: fraud means playing a game without abiding by its rules. It's perfectly legitimate to establish a game and to introduse rules of the game with it. If you want to play the game, play by its rules, otherwise don't play it. If you play it while cheating, though, you must bear the consequences ("go directly to jail" ;-). Bert-Jaap --------------------------------------------------------------------- Bert-Jaap Koops tel +31 13 466 8101 Center for Law, Administration and facs +31 13 466 8149 Informatization, Tilburg University e-mail E.J.Koops(a)kub.nl -------------------------------------------------- Postbus 90153 | This world's just mad enough to have been made | 5000 LE Tilburg | by the Being his beings into being prayed. | The Netherlands | (Howard Nemerov) | --------------------------------------------------------------------- http://cwis.kub.nl/~frw/people/koops/bertjaap.htm ---------------------------------------------------------------------

2 1

European Commission on "Illegal and harmful content on the Internet"
by wfgodot＠iquest.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- A recently released European Commission Communication on "Illegal and harmful content on the Internet" may prefigure the nature of coming European Union regulatory initiatives concerning the net. This Communication was in response to a 27 September resolution by the Telecommunication Council on "preventing the dissemination of illegal content on the Internet, in particular child pornography." The document reportedly reflects what will be ongoing work to "present practical measures in time for the next Telecommunications Council on 28 November 1996." The Communication describes its aims as: firstly to describe briefly the different types of illegal and harmful content, secondly to examine the technical context in which action can be taken to deal with illegal and harmful content, and finally to suggest a number of practical measures designed to be rapidly implemented Among the points of interest, it states with emphasis that "additional international cooperation is required to avoid 'safe havens' for documents contrary to general rules of criminal law." With respect to anonymous communications it discusses proposed "measures to close known loopholes and improve traceability and that anonymous remailers record details of identity." As is typical of these agendas, the devil will be in the evolving details of enforcement. It looks like 1997 will be a busy year for proponents of greater state control over internet content both here and abroad. If they can conjure up enough sufficiently compelling bogeymen, it could be a very successful one for them as well. The HTML version of this document can be found at: <http://www2.echo.lu/legal/en/internet/content/communic.html> Links to RTF and Word versions along with the accompanying press release and related documents can be found at: <http://www2.echo.lu/legal/internet/html> - -Michael -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 iQCVAwUBMmaw0tGJlWF+GPx9AQGMLgP+JC5Lyd0NZDukq8AWipUNcDUgb6m16iUN 3smYcPdPYvsUDSWznx7ZQsklQV0oz9u5Ru7s8VoOQfA2wqSoiai3LiUiJg5WkfOg HTAbvVQCeoUaRmkmmbFJSzfqVzGB4VkJRCE4htPmmqYhCwwmMjooTi3bAClySGTD 7YcLjv0pC5w= =4EZY -----END PGP SIGNATURE-----

2 1

Cyberspace Law
by John Young 17 Dec '03

17 Dec '03

David Post has a comprehensive outline of the legal issues affecting cyberspace, many of which are addressed by cypherpunks, at: http://www.cli.org/cyberspace/index.html It's very much worth reading, pondering and learning from. Here are excerpts: ----- Law of Cyberspace Seminar Fall 1996 Prof. David G. Post (david.post(a)counsel.com) Introduction The emergence of the global network -- the "Internet" and its constituent networks -- and the associated "digital revolution" -- the ability to access, store, and transmit vast amounts of information in digital form (computer software, videogames, music, text, etc.) -- presents an array of new problems and opportunities for lawyers preparing to practice in the 21st Century. It is becoming increasingly evident that the process of "mapping" existing legal concepts and tools into this new domain is not going to be straightforward, and that a number of familiar legal concepts will need to be rethought before they can be efficiently applied in the new environment. The goal of this course is threefold: First, to introduce you, by means of a series of specific case studies chosen to illustrate the clash between existing legal regimes and new technologies, to a reasonably comprehensive subset of the legal problems that will need to be addressed in this new environment; Second, to help you, through fairly intensive work on your research papers, to prepare publishable quality written work; and Third, to help you become comfortable with the information-retrieval and transmission capabilities of this new medium, both because no discussion of the "law of cyberspace" can be very fruitful without some basic understanding of the special characteristics of the new domain, and because lawyers will increasingly be called upon to demonstrate some familiarity with Internet navigation as businesses (including law firms) increasingly utilize the global network as a means of delivering their services. [Big snip of bountiful thoughts and links to information sites] Appendix 3: Possible Paper Topics This list is just designed to get you started thinking about possible paper topics. It is by no means exhaustive; feel free to choose a topic not mentioned below. Protection of employee electronic mail. Are new rules required regarding online sexual harassment? Trademarks and Internet domain names -- can they be reconciled? Intermediary (system operator) liability for subscribers' copyright or trademark infringements or other "wrongful" conduct. Does Web browsing, or the caching of World Wide Web pages, constitute copyright infringement? Analysis of electronic shrinkwraps: Are online disclaimers enforceable? What procedural steps can be used to enhance enforceability? Jurisdiction and choice of law in cyberspace. Dispute resolution in cyberspace. Should true anonymity be allowed in online contexts? Who will bear the responsibilities of anonymous actions? Taxation in cyberspace (e.g., application of foreign states' sales tax laws to online transactions). Dataveillance. The use of online data profiles in marketing research. Compilation copyrights for collective online activities. Legality of online gambling. "Moral rights" in cyberspace. Analysis of legal issues regarding programs that extract information from a user's hard drive and communicate back to a central server (Windows 95, Netscape Navigator). Data authentication, the use of computer-generated evidence and computer-generated signatures in contracts. Content regulation in cyberspace: Obscenity, indecency, and false advertising Licensing and professional liability (e.g. the application of licensing schemes and other regulatory provisions to professional practice of lawyers, doctors, or others on the net). Internet self-regulation: cyber-democracy, frontier justice, and other regulatory models in cyberspace. The control of online defamation. Product liability for on-line products. Clipper, encryption and decryption. Net commerce: Digital money and other solutions. Net commerce: Copyright management systems and other schemes for charging by the byte. Do we need new rules regarding enforcement of the antitrust laws in cyberspace? ----- Thanks to David Post for this IP lift lift.

1 0

Dimitri goes to California - was Re: [SERDAR ARGIC] Ray Arachelian...
by peter.allan＠aeat.co.uk 17 Dec '03

17 Dec '03

> Date: Mon, 21 Oct 1996 21:08:17 -0700 (PDT) > From: Sandy Sandfort <sandfort(a)crl.com> > So it IS intellectual dishonesty and cowardice. I thought so. > Is there anyone on the list who thinks Dimitri is a man? Not me. Pick another speaker, poll the pledgers for agreement and don't ask Dimitri again. And just when I let him out of my killfile in the hope I'd see him accept the challenge. -- Peter Allan peter.allan(a)aeat.co.uk

2 1

Netescrow & Remailers?
by Adam Shostack 17 Dec '03

17 Dec '03

Would it make remailers more reliable to use a netescrow system, so that if a remailer goes offline, the others can request its keys, and continue moving its messages? To me, reliability is as large a problem as UI. If the next Mixmaster is going to do direct IP transport, reliability could increase as a problem. Adam -- "Every year the Republicans campaign like Libertarians, and then go to Wasthington and spend like Democrats." Vote Harry Browne for President. http://www.harrybrowne96.org

4 4

Negative credentials
by Hal Finney 17 Dec '03

17 Dec '03

There has been some discussion here and on the Simple Public Key Infrastructure (SPKI) mailing list about anonymous credentials and abuse. This is something we have of course talked about many times over the years but I don't think we have ever had a specific look at Chaum's approach to the "negative credential" problem. In essence his method allows you to prove that you haven't cheated on any of your contracts, without revealing any more about yourself than that. Chaum uses what he calls "sequenced couples", which are sequences of pseudonym pairs such that credential A on one pair of the sequence can be transformed by the user into credential B on the next pair. This ties into his whole scheme, which is a bit too complicated to explain here. What I will describe is a very simplified version of what Chaum has. Chaum's description can be hard to follow but takes care of a lot more possibilities. His full paper, which BTW is my favorite crypto paper of them all, is: "Showing Credentials Without Identification: Signatures Transferred Between Unconditionally Unlinkable Pseudonyms," D. Chaum, Accepted but not Presented Auscrypt '89. The general idea is this. Every time you engage in a contractual relationship with someone it is done under the auspices of an "anonymous credential" organization. You first show your contract partner a credential from the AC org which guarantees that you have not cheated anyone so far. After you participate in your current interaction, if it completes to everyone's satisfaction, you are given a new credential by the AC org which proves that you still haven't cheated. Each credential can only be used once, so if you cheat someone you can't get a new one. There is a simple and obvious solution which satisfies these requirements. That is to use a blinded signature exactly as is done with DigiCash coins. You get your first credential on registering with the AC organization. (Here we have a bit of a bootstrapping problem, in that the AC org needs to make sure you don't register more than once. But actually since things will be blinded you can just use your SS# or other identity documents.) The credential is a blind signature, unlinkable to your identity. When you go to contract with someone, you show your credential and the AC confirms that it hasn't been used before (exactly like checking for double spending on coins!). The AC marks the credential as being in the "in use" state (putting it on its own private list of such credentials). Then when your contract completes successfully, your partner certifies this fact to the AC, and it then retires your old credential and issues you a new, freshly blinded credential. This credential is unlinkable to your earlier one or to your identity, but it proves that you haven't cheated and you can show it the next time you need to make a contract. Now, obviously this simple solution has problems: - You can transfer credentials to other people. Chaum's more elaborate solution links the credentials to your pseudonyms. - You could get cheated by your contract partner who won't authorize a new credential for you even though you completed your contract. This happens today, unfair credit rating blotches. There would have to be some kind of arbitration procedure. - There is no way of distinguishing someone who's done dozens of successful contracts from someone who's done only one. This is a feature, not a bug... But if you want you can show positive credentials from earlier participants; Chaum's method allows them to be linked to your new pseudonyms. - You can only have one contract going at once. Chaum has some solution involving time limits but I've never fully understood it. The general idea might be that when you go into the contract the AC gives you a new credential which means "he hasn't cheated anybody so far, and if he does cheat someone we'll know about it by <date>". <date> would be the date of completion of the contract. This is still a blinded credential, so the date gets encoded in the signature. Chaum shows how you can even blind the date, moving it in to some earlier date (but never out). Then you can use this credential to establish a new contract as long as the date hasn't expired. It gets complicated once you have multiple contracts with different expiration dates, though. Although this solution is somewhat simplified, hopefully it will give people a picture of how negative credentials can be dealt with while still retaining full anonymity in contract relationships. Hal

1 0

Chinese internal internet
by E. Allen Smith 17 Dec '03

17 Dec '03

I seem to recall someone predicting that China and other such countries would set up an internal net with strict controls. Good prediction... I wouldn't be surprised to see Cuba recruited to it, for instance, although North Korea doesn't appear likely (too insular). -Allen > ______________________________________________________________________ > Centura > ______________________________________________________________________ > China's Xinhua launches business computer network > __________________________________________________________________________ > Copyright © 1996 Nando.net > Copyright © 1996 Reuter Information Service > BEIJING (Oct 21, 1996 10:25 a.m. EDT) - A China-wide computer network > launched by a subsidiary of the official news agency Xinhua on Monday > will take Chinese businesses online and supply them with news and > economic information, company officials said. > The China Wide Web (CWW) created by China Internet Corp would provide > Chinese customers with online services in their own language and would > give overseas subscribers a window on to the Chinese business world, > company chairman Ma Yunsheng said. I've about concluded that we'll see a Web dominated by two languages - English and Japanese. It's very hard for native speakers of Indo-European languages to learn Japanese, it's very hard for native speakers of Japanese to learn English, and no other such language has a prosperous-enough home country to work. Such internal nets may alter this, however... [...] > In January, Xinhua was appointed the government regulator for foreign > suppliers of economic information in China, a role that some analysts > say clashes with its involvement in enterprises that supply financial > and business data. [...] > Unlike the open-access Internet, CWW was modelled on internal company > networks or "intranets," Edelson said. > "There will be a lot of real-time information available," he said. "I > think there's going to be very fast growth from a zero start." > China Internet would enjoy free use of Xinhua's communications network > and already had access agreements with the powerful Minstry of Posts > and Telecommunications, he said. > Ma said domestic economic information would also be available through > Xinhua news services and databases. He declined to say how many > clients were expected to subscribe. Heavily edited domestic economic information... > The Internet is viewed by some Chinese officials as a haven for > pornography and political dissent but CWW would likely be a > politically correct alternative. > "CWW should reflect Chinese culture," technology officer Wong said, > without giving details. Ah, yes, the old claim of cultural difference to try to justify censorship. So Nazi Germany was due to a cultural difference? ****** MESSAGE DAMAGED IN TRANSIT ******

3 2

Re: Blue Box Plans & hacker bbs's
by Bill Stewart 17 Dec '03

17 Dec '03

At 08:09 PM 10/20/96 EDT, you wrote: >I know this is my second question in a short period of time...but anyone >got or know where to get any good blue box plans?? I cant find shit on >the web, and I need some good hacker telnet bbs's. Someone please give >me either. goto alt.2600. Around here we generally can afford to pay our phone bills :-) Also, the network's signalling has changed, and the basic Captain Crunch Whistle doesn't work many places any more - most of the signalling is digital out-of-band rather than inband audio. Phreaking isn't impossible (or there wouldn't be as many people chasing the Dread Pirate Mitnick), but at this point you actually need to know what you're doing to succeed at it, and merely having plans for a device you don't know well enough to emulate in code on your PC isn't going to buy you much. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

6 8

Re: [DES] Criteria for Key Recovery target.
by eli+＠gs160.sp.cs.cmu.edu 17 Dec '03

17 Dec '03

Russell Holt writes: >BTW, does anyone have references to statistical comparisons of key >searches in "real world" settings? Eg, random starting locations >versus random keys .. etc.. E(time) with all trial keys distinct: 1/N Sigma^N i = N/2 = 2^55. E(time) for random trials: 1/N + (N-1)/N (1 + E(time)) so E(time) = N = 2^56. Centralized keyspace handling is a clear lose, IMO. The RC4-40 project had server problems; scaling up by another 2^16 would be non-trivial. Then there are problems with malicious searchers, corrupt servers, flaky networks... all this for a factor of two? (And, admittedly, the reduction in variance.) To rain on the parade a bit, what this discussion says to me is that most applications of DES are safe from net cracking for a few years yet... -- Eli Brandt eli+(a)cs.cmu.edu

1 0

Re: cypherpunks ftp site
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 04:51 PM 10/21/96 -0700, you wrote: >I am trying to get some code from <ftp.csua.berkeley.edu:pub/cypherpunks>. Try http://www.csua.berkeley.edu/ ; you may need to wait till they're not busy. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

1 0