December 2003 - cypherpunks-legacy

Re: e$: Cypherpunks Sell Concepts
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 5:41 PM 8/6/94 -0700, Eric Hughes wrote: >The obstacles are certainly not for electronic money, which the Fed's >been using for some time now, but rather for electronic cash, which >includes anonymity. We've chased each other around a tree like this one before... Let's see what the differences are this time. I've been doing some thinking about this... Anonymity can come out of retail settlement of e$, if the transactions aren't tracked. We've talked here before about how you think that the tracking of those transactions at the retail level is pretty trivial, so the cost to the user of traceable e$ may be meaningless. I'm not so sure that that's the case, and I think (I hope!) I remember Perry agreeing with me on that point. But if we fiat the argument just to see where it takes us, we come to the sheer volume of transaction records themselves. Is it possible to accurately estimate the cash transaction load of an economy? I bet that if we could, you'd see that the data from each transaction would cause the problem news servers have by several orders of magnitude. The information would get dumped pretty frequently. This is probably the same problem the NSA has now picking out signals to listen in on, but running down an audit trail is different, it's a historical process. Since you don't know whose transactions you need, you need to keep them all. True, this doesn't keep TLAs from trying trying to drink from a firehose, or more to the point, to free-dive to the bottom of the Marianas Trench (if they could keep all of the data), or high-dive into a wading pool (if they couldn't). Hmmm... >The USA provides a fair amount of financial >privacy to everyone but the government, particularly law enforcement. >So the _business_ case for privacy is largely felt to be already >satisfied by the regulators. When *every* business transaction can be scrutinized (as much as physically possible, per above) at any time, for any reason the government deems necessary, it makes a sizable business case *for* traceable electronic cash. This is probably the place to put the lever on the business community. >The Treasury department, among others, really _doesn't_ want >non-recorded transactions. Unless the banking community as a united >front _does_, I don't think it will happen domestically (USA) before >other deployments. If there's not a united front, it'll be divide and >conquer. Non-recorded transactions exist already. It's keeping them from dissapearing that we're really talking about here. It's quite possible to get banks to present a united front. They have one of the largest lobbies in Washington. They have fought reporting requirements tooth and nail with some considerable success, but every time they get greedy (S&Ls) the noose tightens. It might be the threat of international deployment and regulatory arbitrage which brings them around, and fires up the lobbying apparatus on our side of the issue. It has worked before (gold, et.al.). On the other hand if those reporting requirements are frictionless, they don't *need* to fight it, do they... It's time to leave the ring. Somebody tag me. My brain hurts... Now to plug the topic of the thread a bit, how receptive would people in the crypto community be to participating in an annual dog&pony/schmoozefest for the suits? Who should chair the morning "primer" session? *E-mail* me with your ideas, everyone. Thanks, Robert Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

4 3

Re: e$: Cypherpunks Sell Concepts
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 2:19 PM 8/7/94 -0400, Perry E. Metzger wrote: >The regulators >have taken ten years just to eliminate the restrictions on interstate >banking, and they still haven't quite done the job yet (although >hopefully the restrictions will go away by '96 or so.) It really isn't to most of the individual banking entities' advantage for interstate banking to exist because almost all of them would merged out of existence. It isn't the regulators' fault; it's a wonder they got this far as fast as they did, and that's primarily because the foriegn markets are driving the regulators to it. Regulatory arbitrage. If there was a clearcut financial advantage to interstate banking to First Podunk Bank and Trust, it would have happened already. >They understood >that stuff fairly well. They probably won't understand digital cash as >well, although it will probably be even worse for us if they do. Which, I believe, is the point of this thread. It's time to shuck and jive a bit. If it can be demonstrably proved that a market exists, that there's some boards of directors for those hoary old regulators to sit on in their golden years, then there's a chance to make retail trade settlement a reality. You can't do that without a legimate test, and you can't get that without mau-mauing the regulators some, eh? Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

Re: e$: Cypherpunks Sell Concepts
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 10:31 AM 8/7/94 -0700, Eric Hughes wrote: > >There are two legal problems that I could see being used against digital > >cash. The first is the civil war era prohibition on banks issuing private > >bank notes. > > It seems to me > that one could just as easily treat digicash as securities denominated in > dollars, [etc.] > >It didn't occur to me before, but you could also have 'nonbank notes'. >If the issuer isn't a bank, does the regulation still apply? OK. Your question has two parts. First, Eric, what exactly do you mean by 'nonbank notes'. Like the kind issued by corporations in the money markets, or Amex Traveller's Checks?. Second, we need a lawyer. This is a good thing, 'cause a you can't hack laws without a lawyer (most of the time, anyway...), and (ObThreadRelevance) we need one to pitch this stuff to other lawyers (regulators, et. al.) anyway... In search of Vinnie "the Pro" Bono, honorable second cousin of the esteemed mayor of Palm Springs, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

CreditCard info
by Brian Lane 17 Dec '03

17 Dec '03

An interesting sideline - I ran into an interesting situation at a local video rental place yesterday. If you give them your credit card number they charge you .25 less a tape to rent it(2.75 compared to 3.00) Your number goes into their customer databse. I laughed, and said i'd rather pay the .25 a tape than take the chance of some part-time HS kid getting ahold of my CC number. It's unbelieveable (to me anyway) that people would give this kind of information out and trust that it can't be abused. It's bad enough that we're asked to hand out our SS number for everything. Brian ---------------------------------------------------------------------------- Linux : The choice of a GNU generation | finger blane(a)free.org witty comments pending | for PGP key and subLit ----------------------------------------------------------------------------

1 0

Re: URGENT: Please Tell Congress to Allow Encryption Export
by Ian Farquhar 17 Dec '03

17 Dec '03

On Aug 5, 5:53pm, Jim Dixon wrote: >> Imagine this: you're a politician. If you're a US politician in particular >> you will be correctly told that you are, by virtue of your position, a target >> for a lot of "extremeist" groups and terrorism. [etc] > This has little to do with being a politician and even less with being > a US politician. People at all levels everywhere at all times are willing > to pay for what they perceive as additional security. The original point was an explanation as to one of the reasons why politicians can do unaccountable 180 degree turns of opinion when entering politics. As such it had everything to do with being a politician. Your point that it is a manifestation of a more general desire for security is valid, but you missed the main point at issue here. Ian.

1 0

Re: Anonymous Transport Agents
by greg＠ideath.goldenbear.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > Suppose an encryption-savvy mail transport agent, say ESMTP, was > developed. Further suppose that part of handshaking protocol for this > transport protocol included an ENCRYPTED reverse lookup on IP identities > to check that the message is actually coming from where it claims it's > coming from. Suppose again that the results of this lookup were only > checked for correctness (boolean), and then discarded WITHOUT LOGGING, or > at least with minimal logging. [. . .] > In this model, one could provide anonymous transportation of > anonymous mail FOR EVERY MACHINE ON INTERNET providing that the original > message wasn't forged. It looks to me like you've "supposed" away the real obstacle to anonymous messages - the practice of logging traffic. Once you assume that people won't keep logs, the rest of the protocol is unnecessary - everyone's got anonymous messaging capability already. Forgery prevention is more useful when it's user-to-user, not host-to-host; we can do this already with PGP. The tricky part is finding a way to preserve anonymity where the majority of sites on the Internet continue to log traffic carefully, refuse to install new software (especially anon-positive software), and are administrated by people with simplistic and outdated ideas about identity and punishment. -----BEGIN PGP SIGNATURE----- Version: 2.5 iQCVAgUBLkZ7wH3YhjZY3fMNAQH3FQP9FWac8oASgwTJp4rI9fRLHsAXEVXKdNDE jwDzSYTy38ZJnaa1kBYpsqJzrPnFdYNY6t2vlIjNmZMHOevarfkwF+uKabJxah1L Wt1rlkN06P8XpgsYVGTre1L28/HB+NtrEImTm9OzQGx+LRdY0OqLW1U/vSPwOjqw /DeLaSNzBnE= =bdDT -----END PGP SIGNATURE-----

1 0

e$
by peace＠BIX.com 17 Dec '03

17 Dec '03

I can recall that many years back the casinos in Las Vegas all accepted the chips from the other ones and then had a great exchange each day where the accounts were settled up. Even the gift shops took chips in place of cash. The US Treasury put a stop to this as it was considered to be a replacement for cash. Also I hear a lot about bearer bonds, but never in the US. OTOH the NYC subways have started a cash card that they expect merchants to accept in lieu of coins. It would be nice to know what the Feds will or won't accept. BTW, does it matter if the e$ are US denominated? Could e$ be presented as travelers checks? The possibilities here are extremely interesting. - - - Bob said> However, it's a stupid parasite which >kills it's host, and that's what I'm counting on here. Not really true. All parasites kill their host or they would not be considered parasites (ie. live at the EXPENSE of the host). The only question is how quickly the host dies. There is an entire epidemiology of parasitism, ie. which strategies are best for the parasite. The virulent ones must be able to find a new host quickly, the ones that can't exit quickly rely on the host living for a long time. There was a good article in SciAm on this a little while back. Also remember, it is the US Supreme Court which ruled that the power to tax is the power to destroy. Sounds like as good a definition of parasitism as any. Peace

1 0

Re: Improved remailer reordering
by jdd＠aiki.demon.co.uk 17 Dec '03

17 Dec '03

In message <9408062320.AA17234(a)ah.com> Eric Hughes writes: > About message mixing: > > A measure that is used for situations like this is entropy. > > Indeed. This is exactly the mathematical measure for what I've called > "privacy diffusion" in a remailer network. It is, namely a measure of > of the uncertainty to a watcher of what ingoing message corresponds to > what outgoing message. > > As soon as you begin to write down some of the equations for this > value, several things become distinct possibilities: > > -- duplicate messages may decrease security > -- retries may reduce security > -- interactive protocols may reduce security > -- there is such a thing as a needlessly lengthy remailer path > -- noise messages might not be worth the bother > -- multiple different routes may reduce security > > One thing becomes blaringly obvious: > > -- it's reordering that's mathematically significant; that's what goes > directly into the equations. On thing is glaringly obvious: if you use the wrong assumptions, you will get the wrong answers. Imagine a RemailerNet (v0.2) that maintained a fixed level of traffic between gateways. Messages are injected into the system at various gateways and emerge at various gateways. All traffic between gateways is encrypted. All traffic takes the form of packets of the same length, perhaps 1024 bytes. [It is possible that a much smaller packet size might be desirable, specifically the ATM packet size, with 48 bytes of data payload.] Messages are fragmented according to policies at the entry gateway. Intervening gateways may or may not further fragment incoming packets according to gateway policy. The exit gateway is responsible for reassembling packets into messages. The routing of packets is randomized to some extent. Message transmission is guaranteed to be reliable in the sense that either the message will get there or the sender will be told that it didn't. Users desiring a high level of security are required to participate in the game. They must accept and send a fixed number of packets at each connection. These users should be responsible for packetizing their own messages when sending and assembling their own messages when receiving. They must encrypt all communications with gateways. These 'empowered' users are in fact operating RemailerNet gateways. It is likely that different levels of gateway would have to be defined, depending upon the degree of physical control that the operator had over the gateway and the level of resources that he or she was willing to devote to RemailerNet operations. Entry level users would communicate using ordinary email. Major gateway operators would communicate using RemailerNet protocols over TCP/IP. Time is measured in this system in steps. Each step corresponds to the dispatch of one set of packets. The relationship between 'step time' and chronological time will vary from link to link. This system will tolerate an arbitrary level of traffic. Over time the level of traffic (in bytes/sec) would be some multiple of the average volume (bytes/sec) of messages carried. The gateways would automatically adjust the traffic level. [Probably it should rise quickly and fall gradually.] The functioning of the system as a whole makes it very difficult to do any kind of realistic traffic analysis. Any reordering of messages is performed at the packet level. In general, the messages do not exist as wholes along the lines connecting the gateways, so a discussion of their reordering is a good way to waste time. A detailed mathematical analysis of what makes the system difficult to attack would itself be quite difficult. But I would suggest that the key factors are the fragmenting of messages, the use of fixed length packets, the systematic introduction of noise, and random delays in dispatching packets. [The random delays reorder the packets and they also introduce noise -- an unused timeslot is filled with a noise packet.] If, of course, your equations include only measures of the reordering of messages, your results will depend only upon measures of reordering of messages. -- Jim Dixon [this is not a complete or final description of RemailerNet] [v0.2 but should be sufficient to encourage a few attacks ]

3 2

Tommy the Tourist's New Home
by nobody＠ds1.wu-wien.ac.at 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- werewolf(a)io.org (Mark Terka) asked: > > Tommy the Tourist <nobody(a)CSUA.Berkeley.EDU> (Anon User) wrote: > > > > Welcome back, Tommy, we missed you! <g> Hope you're enjoying your > > new (CSUA) "home"... (Time for everyone to update their > > "chain.ini" file, BTW.) > How come? Has soda gone down or something? Or has there been an address > change? Soda was down for a week while it was moved to a different location. The new address is "remailer(a)soda.csua.berkeley.edu". I'm told that the old address will continue to work for a limited time, but it's best to get in the habit of using the correct one. I also understand that the crypto archives have also moved, but I'm not really sure of the details. --- Diogenes -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLkWDGuRsd2rRFQ1JAQH9UQP/Y5IVnEPiOVtxYmaakHMxK9huPvdsOqsC qgaH9OUKEc6MDVz7NWI/ZtW9V8FqMGfEXEN0a4rMuvgyeq5P2VgqOuMWUcOOKwKP m8jEioG+AoJy6ZWRdufz8rkkc7rU73s9a2Xfktf62rG0PSjs7g9xJrjXPCKSk+PT 2iq18F2sBPo= =5LAw -----END PGP SIGNATURE-----

1 0

RE: CreditCard info
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Brian Lane <blane(a)squeaky.free.org> asked: > I filled out a credit app at Sears last month that asked for my SSN, I > didn't give it and didn't get credit either. What exactly is SS related > use? Banks, Employment only? Employers are REQUIRED to obtain an SSAN for tax purposes, as are banks for reporting interest, etc. to the IRS. Regarding credit, they generally ask for an SSAN because that's the "unique personal identifier" that most credit bureaus index your records by (and still screw them up, even then!). --- Diogenes -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLkWV9+Rsd2rRFQ1JAQHKqAP/UISqmaWkX/n+4NwlpL6GBOxPVfcS6af+ zWU8SCpqNcdZWic1ioDq60vO1sji8zBf0jeoOfUXPaNQkcdKGp61y4gxbSZOoqBH VtDSuHCY35X+3ihCFwhp9pshqIWwJTTxvJ9KA6DMZhKM5V5nAC8+GBD7Ofhr81gZ RHPtr/Y2Tgo= =azV1 -----END PGP SIGNATURE-----

2 1