December 2003 - cypherpunks-legacy

Break the code...from RSA [CNN]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > X-within-URL: http://www.cnn.com/TECH/computing/9812/23/codecrack.idg/ > RSA WANTS YOU TO CRACK THIS CODE > > [INLINE] > > December 23, 1998 > Web posted at: 10:30 AM EST > > by Rebecca Sykes > > (IDG) -- RSA Data Security will host another contest to break the U.S. > government's Data Encryption Standard at the RSA Data Security > Conference in San Jose, Calif., in January. > > The 56-bit DES encryption algorithm is widely used and has been broken > in the contest before, most recently in July in a record three days. [text deleted] ____________________________________________________________________ What raises the standard of living may well diminish the quality of life. The Club of Rome The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

DOES U.S. INTERVENTION OVERSEAS BREED TERRORISM?
by Anonymous 17 Dec '03

17 Dec '03

<snip from http://www.cato.org/pubs/fpbriefs/fpb-050es.html> Executive Summary According to Secretary of State Madeleine Albright, terrorism is the most important threat the United States and the world face as the 21st century begins. High-level U.S. officials have acknowledged that terrorists are now more likely to be able to obtain and use nuclear, chemical, and biological weapons than ever before. Yet most attention has been focused on combating terrorism by deterring and disrupting it beforehand and retaliating against it after the fact. Less attention has been paid to what motivates terrorists to launch attacks. According to the Pentagon's Defense Science Board, a strong correlation exists between U.S. involvement in international situations and an increase in terrorist attacks against the United States. President Clinton has also acknowledged that link. The board, however, has provided no empirical data to support its conclusion. This paper fills that gap by citing many examples of terrorist attacks on the United States in retaliation for U.S. intervention overseas. The numerous incidents cataloged suggest that the United States could reduce the chances of such devastating--and potentially catastrophic--terrorist attacks by adopting a policy of military restraint overseas. <snop> <snip> In fact, the interventionist foreign policy currently pursued by the United States is an aberration in its history. Adopting a policy of military restraint would return the United States to the traditional foreign policy it pursued for the first century and a half of its existence before the Cold War distorted it. Such a foreign policy is more compatible with the individual freedoms and economic prosperity that define the American way of life. <snop>

2 1

dbts: Georecursive Auctions (was Re: Friedman (The Younger)Sings...)
by Robert Hettinga 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 4:01 PM -0500 on 12/21/98, Somebody wrote: > > If it's on my hard drive, it ain't yours anymore, in other > > words. > > What are the assumptions? Assuming that you were given what is on your hard > drive, or can you have procured it by any means, like piracy, theft, etc. :-). I'm going to do a real rant on this, someday Real Soon Now, and you can see the germ of the idea in Freidman's talk, and in my old Shipwright rants <http://www.shipwright.com/>, and also, I think, on the Philodox site <http://www.philodox.com/>. More to the point, we all, as far as I can tell, stole it from Eric Hughes, who even went so far as to present a paper on the subject, long ago at a DEFCON far away. Who knows where *he* got it from, but that's enough geneology for the time being... The point I'm making above comes from Ronald Coase, the father of modern microeconomics, winner of Nobel for same, circa 1992?. The most important thing that Coase said, the thing which got him the Nobel, was that firm size was directly related to transaction cost. In an information economy, especially in a world of Moore's law (yielding increasingly geodesic networks, and the markets overlaid on them) and strong cryptography (digital bearer transactions, perfect pseudonymity, etc.), tranaction costs get *very* small indeed, and in a considerable hurry. To some, I believe clueless :-), people, the above means that we still get economies of scale, because the first copy of a given modern bloatware application, like Word for Windows, is enormously expensive compared to its replication cost, which is functionally free by comparison, even if you put a box around it, much less if you just put it up for download from the web. However, *I* say that if you can do profitable transactions in, say, the micropenny range, you get a world where the bloated, industrially-delivered code-in-boxes that we've all come to know and love starts to surfact, under its own weight, into smaller and smaller functional bits, each maintained by different, and much smaller, firms. I use open source software as my case in point. Notice that, since the cost of code itself is free, there is a huge, and expanding, diversity of very specialized code out there now. The writers of that code don't make any money on that code except by proxy, through enhanced reputation, and so forth. However, if you could drive the cost of *transactions* down, people *would* write code just for the money, and simply auction it off their websites to the highest bidder, and could do so, profitably, for rediculously cheap prices. More about that in a minute. Sure, Red Hat grosses $20 million, but that's more a function of the cost-domination of sneaker-netted CDROM over the still-scrawny lower capillaries of the internet. More to the point, I claim, it's the result of the cost of *credit-cards*, even *checks*, as a way to pay for code. Book-entry settlement, in other words, which is done "out of band", over private, hierarchical, and proprietary financial transaction networks. If it were possible to pay to download code, as you needed it, for instantaneously net-settled *cash*, and for sufficiently small enough bits of money, then the need, the price-economy, if you will, for large glops of code would go away. And, Coase's theorem says (I think) so too would the large firms required to generate those large glops of code. So, what we're left with is a world where the legalities of intellectual property are physically impossible to enforce, thus words like "privacy" cease to have any real meaning. If you can't enforce such an intellectual "property" law, it's kind of hard to call it a law, as most law professors and philosophers of law will tell you. Ironically, I claim, that's a very strong form of a *second* observation that Ronald Coase made, that you can't have markets without private property. Sounds like a motherhood, now, but he was the first person to articulate that clearly, back in the early part of this century, and it's one of the reasons he got the Nobel, of course. *My* variant on Coase says that you don't need *laws* to ensure private property in digital form. Cryptography will do just fine. Like I said, if it's encrypted, and it's on my hard drive, it's now *mine* no matter where I got it, laws or not. I mean, who's to know I have it to begin with, and, more to the point, who's going to take it away without my permission, especially in a world of encrypted offsite net.backups, m-of-n archival reconstruction, etc. Write software, not laws, to quote the my old cypherpunk chestnut. Yet, I claim, to finally answer your point :-), people who *make* new code in such abrave new world, *still* make the most money. No, not "publish", or even distribute new code, like Microsoft and Ingram do, but the actual guy plinking away in CodeWarrior, or whatever. The mind behind the code, the developer, let's call him, in a proper use of the now mostly corrupted word. Here's how. You write software for a living. You upgrade your existing code base, and you announce its availablity to the net. Everyone who has your code knows how good your work is, and they probably have a standing bid in to buy revs of it at some specific price, anyway. So, just like the specialist's book at the New York Stock Exchange, you, or your website's CGI, accepts those bids, highest to lowest, and, as new bids come in, you sort them into the queue of outstanding orders, by price, of course, :-), and accept them in that order. Notice something important, but obvious, here. The people who bid the highest get the first copy. We'll worry about Vickery variations on that auction some other time. Secondly, there's the fun part, the *recursive* part of "geodesic recursive" or neologically, and, this very afternoon, "georecursive", auctions. That is, if I paid a monster pile for the first copy, I must have such a profitable need for it that it's worth it to me to pay that much. Of course, one of the most profitable things I can do especially in a world where the net isn't quite geodesic enough yet, and Freidman hints at this in his Cato talk, is to *flip* that code. Frankly, this is nothing really now. It's done identically the same way that large institutions flip IP0's in the market for a hot stock, or, more properly, a recording company or software "publisher" puts "talent" under contract and remarkets their output in classical vertically-integrated, and I say, now-industrial, markets for those goods. So, back to the future, I pay through the nose to get to the first copy of your code, because I have an orderbook of my *own* to fill, and, more properly, I have sufficient bandwidth and processing power of my own to remarket it. Even more fun, someone *else* can buy from me, and resell what I sell them, *recursively*, ad infinitum, and, frankly I don't really *care* what they do with what I sold them, because I've already bought low and sold high. I claim, even with all this rampant "piracy", and, especially as the network gets more geodesic -- a process which these markets would probably *accellerate* by the way think what would happen if you could sell bandwidth this way -- the person who collects the most economic "rent" would be *you*, the originator of the new code. Just like a rock star, if the code was popular enough, but without the recording company. Well, actually, with lots of very *little* record *distributors*, all taking a haircut, and, rarely would any of them make anything near like what you made selling the first copies. I mean, new information always costs more than old information, right? And, of course, you, as a developer, will always have the *newest* information of all... Finally, it even behoves huge companies who control large blocks of intellectual property, record companies, and Microsoft, for instance, :-), to compete in this new kind of market, precisely *because* the the transaction costs are so low and the initial profit margins are correspondingly higher. It's *profitable* to play in this market, even when you're losing market share, paradoxically, to smaller players. Think of what happened to large movie studios in the 1960's and '70's, and how they were replaced, in the *production* of movies, by director-owned, mostly ad-hoc, "virtual" production companies, like Coppola's Zoetrope, or Speilburg's Amblin, or Lucasfilm/ILM. Even the new "studios", like Dreamworks/SKG are really director-run enterprizes (Spielburg and Geffen, remember?). The "directors", the "auteurs" of software, are pretty much the guys who write the code, yes? Everything else is just transaction cost. Cheers, Robert Hettinga -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.5.5 iQEVAwUBNn7OucUCGwxmWcHhAQFidwf+MZ8SLZffWvH7g+QMY6Q2Q3P4flVkEVpr keXiF7cXXKlv/zL48wX1fjan93MMwN65b9/o7aIe1Wvq1nQfFE1AhPaShYZwciz9 NpInA2+9Mrz30cU4Nj775gXHfCaFl68tUmKd8GwUBI4rwjrHKgFy5hFSWlxNQSFF yQ8idMnmC7fSIELZJOurejYM90nA4z9QZZibekVuP+u3e6ogkclCS8m3e3QznpWY yCTYHqFFc5JHHEHc4PCOALWei74/rTRVvaziEU3QQCvytXgsZu2j0OLkpukc4zqb eJD/+Zkc3d1pfTqxaR4tLatr+QXVEuxozwz3nyoo3mzfd0LbKdBdnA== =kKXa -----END PGP SIGNATURE----- ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

Re: Good archive of AES algorithms?
by Anonymous 17 Dec '03

17 Dec '03

> Thanks to everyone who responded to me on the AES > archive. Most people pointed me to the counterpane.com > web site, which is very nice and well done, and answers > most of my questions. Unfortunately, though, Counterpane > itself is one of the candidates, so the site may not > exactly be unbiased. Is there any site with a similar scope > being run by a disinterested party? Apparently you did not see the post which directed you to http://www.nist.gov/aes/. This is the home page for the AES. It has links to independent analyses of the algorithms, as well as performance information. From that page we find: Block Cipher Lounge http://www.ii.uib.no/~larsr/aes.html cAESar Project http://www.dice.ucl.ac.be/crypto/CAESAR/caesar.html Efficiency Testing Table http://home.cyber.ee/helger/aes Efficiency Testing Results http://www.seven77.demon.co.uk/aes.htm Analysis from Louis Granboulan http://www.dmi.ens.fr/~granboul/recherche/AES.html NIST's preliminary efficiency testing results http://csrc.nist.gov/encryption/aes/round1/nistefficiency1.pdf

1 0

jury duty
by Anonymous 17 Dec '03

17 Dec '03

At 08:30 AM 12/23/98 +0100, Anonymous wrote: >In 22 years of being qualified, I am facing my first jury duty summons as a regular employee and see no way out except to report. The old self-employment, financial burden exemption no longer applies. Your employer is not obligated to pay you during your arbitrarily-long court slavery, BTW. See: Fully Informed Jury Amendment www.fija.org Since snailmail is datagrams, how do they know you received their packet? Remember that you aren't obligated to explain your reasons any more than the barbarians are obligated to be reasonable. >If no answers, I will resort to a search engine. But I thought this letter would get me better >quality advice. I wonder if its a crime yet to refer you to FIJA. You can get busted in Calif for distributing FIJA materials near a court. Don't stand out and you can accomplish more subversion.

1 0

Koop's Crypto Law Survey updated - v. 14.1 (FW)
by Vin McLellan 17 Dec '03

17 Dec '03

From: "Bert-Jaap Koops" <E.J.Koops(a)kub.nl> Organization: Tilburg University Date: Wed, 23 Dec 1998 16:04:37 MET Subject: Crypto Law Survey updated - version 14.1 I have updated my Crypto Law Survey to version 14.1. http://cwis.kub.nl/~frw/people/koops/lawsurvy.htm INTERNATIONAL Wassenaar Arrangement (December 1998 changes) ASIA & PACIFIC China (no use restrictions) Indonesia (use restrictions?) Kyrgyzstan (no export controls) Vietnam (import controls) EUROPE EU (to implement Wassenaar changes?) Poland (free GSN import) Slovenia (no domestic controls) Spain (Telecoms Law may forebode key recovery) NORTH AND SOUTH AMERICA Chile (no controls) Colombia (no controls) Costa Rica (no domestic controls) Mexico (no use restrictions) Puerto Rico (no controls) United States (new export relaxations; Junger dismissed; TACDFIPSFKMI charter extended; copyright act may hinder crypto research) Uruguay (no controls) Please note that the UK entry still needs updating. Bert-Jaap Koops Tilburg University 23 December 1998 -------------------------- You may forward this message, in its entirety, without permission. .-------------------------- To unsubscribe from this mailing list, send a message to <e.j.koops(a)kub.nl> with subject "unsubscribe cls-update". . ----- "Cryptography is like literacy in the Dark Ages. Infinitely potent, for good and ill... yet basically an intellectual construct, an idea, which by its nature will resist efforts to restrict it to bureaucrats and others who deem only themselves worthy of such Privilege." _ A Thinking Man's Creed for Crypto _vbm. * Vin McLellan + The Privacy Guild + <vin(a)shore.net> * 53 Nichols St., Chelsea, MA 02150 USA <617> 884-5548

2 1

Re: Jury Duty
by Anonymous 17 Dec '03

17 Dec '03

On Wed, 23 Dec 1998, Anonymous wrote: > In 22 years of being qualified, I am facing my first jury duty summons as a regular employee and see no way out except to report. The old self-employment, financial burden exemption no longer applies. > > Is there a good web site where I can find other legal means to recuse myself (I live in AZ), or if I do > decide to report and get on a trial, a web site on my rights to vote my conscious, aka jury nullification? Tell them the following: "I am aware of the doctrine of jury nullification and I will inform my fellow jurors of it. I will invoke it in cases where the defendant has been charged with a victimless crime, i.e. drug-related offenses, statutory rape, or other thoughtcrime, or when the law is otherwise unjust or unreasonable." The prosecutor won't touch you with a 10 foot pole.

1 0

Re: Good archive of AES algorithms?
by jim finder 17 Dec '03

17 Dec '03

Anonymous writes: >> Thanks to everyone who responded to me on the AES >> archive. Most people pointed me to the counterpane.com >> web site, which is very nice and well done, and answers >> most of my questions. Unfortunately, though, Counterpane >> itself is one of the candidates, so the site may not >> exactly be unbiased. Is there any site with a similar scope >> being run by a disinterested party? > >Apparently you did not see the post which directed you to >http://www.nist.gov/aes/. This is the home page for the AES. It has >links to independent analyses of the algorithms, as well as performance >information. From that page we find: > >Block Cipher Lounge > http://www.ii.uib.no/~larsr/aes.html >cAESar Project > http://www.dice.ucl.ac.be/crypto/CAESAR/caesar.html >Efficiency Testing Table > http://home.cyber.ee/helger/aes >Efficiency Testing Results > http://www.seven77.demon.co.uk/aes.htm >Analysis from Louis Granboulan > http://www.dmi.ens.fr/~granboul/recherche/AES.html >NIST's preliminary efficiency testing results > http://csrc.nist.gov/encryption/aes/round1/nistefficiency1.pdf Ah, I was so put off by the big brother process for requsting a CD that I missed those links. Thanks! Jim ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

http://walkerdigital.com/html/patents.html
by Robert Hettinga 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Walker Digital, a self-described "Edison in Menlo Park" knockoff, and propagator of the priceline.com business model patent (which see, above), is the feature article of this week's omi-1998-gawd issue of The Industry Standard. WD has been patenting everything it can think of, including something I heard of at least 3 years ago from Eric Hughes and Bob Hilby at Simple Access: accumulating internet purchases to a 900- telephone number bill. However, since WD is 5 years old, maybe they got there first after after all, and that's why Hilby, Hughes and Co., stopped talking about it. Either that or Eric got Yet Another Big Idea, and they went chasing down *that* rabbithole instead. As a mostly unmedicated ADDer, I can sympathize with that problem, myself :-)... Anyway, since business process patents are the subject of this month's DCSB meeting, with what I'm sure will be a great talk by Michael Schmelzer and Ira Heffan of Testa Hurwitz here in Boston, I figured I'd give everyone on these lists some food for beforehand. People should monitor <http://www.thestandard.com>, for the actual text of the article, if and when it eventually hits their archives. It'll probably take a week or so. If, of course, they don't have a copy of the magazine themselves already, that is. William Braddock, who's the chairman and CEO of Priceline now, used to be up my direct chain of command, three or four bosses up, when I was an operations analyst at Citicorp 10 years ago, though I never met him. Eventually, he ended up President and CEO of Citicorp after I left. The guys I worked for always used to talk about him reverentually, but that could just be an organization-man thing. I seem to remember Steve Schear, who used to work at a different Citicorp company back then, talking lately about Braddock once or twice, but I can't remember if Schear knew Braddock back then or not. Finally, and most important for us, it looks like Bruce Schnier's involved with Walker Digital as a partner. Given the cryptographic content of not a few of their patents, (like 5,828,751, "Method for Secure Measurement Certification", or 5,768,832, "Remote-Auditing of Computer-Generated Outcomes and Authenticated Billing and Access-Control System Using Cryptographic and Other Protocols") it looks like that's where he's parking some of his IP these days. But, of course, I haven't gone to look at the patents themselves to see if his name's on them, so that's only speculation. Curioser and curioser. Reading all of this stuff this afternoon me made me antsy enough, grouchy, really, to start a rant about this kind of patent-farming, sparked both by all the registered trademarks in the DigiCash bankruptcy filing, and compounded all the fun things Walker Digital has gone and patented, things which are braindead simple. To some people, anyway. :-). Priceline, for instance, seems to me exactly like the specialist's book at the New York Stock Exchange, frankly, but since it's now on the internet, it's patentable, according to the Patent Office. Anyway, the rant on this is forthcoming, or at least in the hopper, my having vented a little steam here, and, in the meantime, I thought I'd fire off this heads-up to everyone so they can read the Industry Standard article themselves. It's on Page 60 of the December 28 / January 4 issue. And, tangentally, to plug January 5th's DCSB meeting, of course, :-), which should be a really good one, in light of current events. Cheers, Robert Hettinga -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.5.5 iQEVAwUBNoFsicUCGwxmWcHhAQFQzQgAmVZDbchvpnDb5/ofq9OKGu5yqD9YMnyf I0H75rjorm/k9TNSC8kH1yvp8s0n6eaXh0r7Bf0CayYeAKg+4tZHHjysHKxKowwR Xjcmm8ACwNLTlQTF1GWpaUoSE5RQ3cDZJKJGHA3OQRRewJlC7D/Zz48pZfP7EXuB ASDOC+f+aDjAYFa66d8ax1a49SbKC4Xpr0blpxp9uCU7aUdgJp51H25jiZvE/Wi3 NvgxDZzw1me6LToSPZR+qa7rmExlEyFJsDmhYkhHh7PH8qOR4gwGXD9ZunpPlm6U buW99TtKNzM32os0Pdbod9AcuifOS+s1f5ubJxJ5i21RmeeOPEtiig== =wb+S -----END PGP SIGNATURE----- ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

mobil cctv cameras... sigh...
by Sunder 17 Dec '03

17 Dec '03

http://www.patrolcctv.com/ "PATROL CCTV: The PATROL CCTV Called MOBILE VISION, is a mobile surveillance system, which extends the visual perimeter for Law Enforcement, Military, Government mobile surveillance requirements and for both on and off road driving for SUV enthusiasts. A Pan/Tilt/Zoom is compatible with in-car video recorders. Stabilizes images, reads license plates at 300FT. With a 24X Zoom and 85,000:1 dynamic range camera, makes Mobile Vision a unique system. " -- ---------------------------- Kaos Keraunos Kybernetos ------------------- + ^ + Sunder "The real aim of current policy is to /|\ \|/ sunder(a)sunder.net ensure the continued effectiveness of /\|/\ <--*--> ALLOW FREE EXPORT OF US information warfare assets against \/|\/ /|\ STRONG CRYPTOGRAPHY! individuals,businesses and governments \|/ + v + PROTEST WASSENAAR!!! in Europe and elsewhere" -- Ross Anderson ------------------------------ http://www.sunder.net ---------------------- RESTRICTED DATA - This material contains RESTRICTED DATA as defined in the Atomic Energy Act of 1954. Unauthorized disclosure subject to administrative and criminal sanctions. NOFORN ORCON WNINTEL SIOP-ESI CNWDI

2 1