December 2003 - cypherpunks-legacy

Are RSA licenses fungible?
by paul＠poboy.b17c.ingr.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm developing some software for use in psychiatric research; basically, about 20 field sites will run the software, collect data, and modem it back to a mothership central site. The encryption & security needs are evident, and one of the main reasons to meet these needs is that the doctors involved perceive that they might be liable for leaks. Code based on Pr0duct Cypher's PGP Tools would do exactly what I want done The good doctors' general fear of liability means that I can't expose them to the risk of unlicensed use of RSA's patents (even though I think those patents are questionable, my job is to not get my clients involved with that question.) So.. if I buy 20 licenses of ViaCrypt PGP, then proceed to use PGP 2.6-based code in my applications, does that constitute a legitimate solution? - -Paul - -- Paul Robichaux, KD4JZG | Demand that your elected reps support the perobich(a)ingr.com | Constitution, the whole Constitution, and Not speaking for Intergraph. | nothing but the Constitution. -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLlyusKfb4pLe9tolAQHH6gP/cA/UwqpKqIDXv4ztBkUzyvLPypOUWRYB OoYGcE/AZF7vO1fgvkObZgwP59QC1Z0fsVU+lNUVgW8qIfadcwb0awBHcooQZ3OL 4d4cX9oD0ARxOrFoA4lFBU97k3lBXa+szyBD+hN2qyIxXUvHPPn5SZcZGYb7swMf zHfDONdqnq8= =FwPl -----END PGP SIGNATURE-----

3 2

Spoofing Nuclear Weapons and PGP
by John Young 17 Dec '03

17 Dec '03

Responding to msg by dichro(a)tartarus.uwa.edu.au (Mikolaj Habryn) on Thu, 25 Aug 5:51 PM >not really certain. *shrug* sorry. Read some books on >it - the amount of literature which should be >classified but is freely available is mind-boggling. To tie this back to crypto and technology: Under a sub-sub-sub-contract I once worked on some phony CAD drawings for the nuclear weapons production process, plotting false info that still appears in popular books, some of which has been posted here. The docs were then encrypted and stegonagraphied for authenticity. We were told that they were turned loose on the market for this product in other countries. I don't know if the USG was involved, there no security clearances. It may have been a commercial scam. Also, growing up not to far from LANL, I was told that kids of staff were encouraged to chat about B-this and W-that by the security people there as part of the fog around that outfit. This supports the suggestion for profligate use of PGP as a stratagem, to make it harder to tell the trivial from the other. Or is public encryption a stratagem to focus on software rather than hardware? Anybody hear anything about covert ID in new-generation CPUs, like done with supercomps? John

2 1

Re: In Search of Genuine DigiCash
by rah＠shipwright.com 17 Dec '03

17 Dec '03

> Making a digital cash system secure, scalable and distributed >is a non-trivial task, making it anonymous is still more difficult. But it's done already, right? At least as far as scoping out the problems and having reasonable solutions which now need to be tried out, I mean. If we're talking about problems of marketing, access to and from the rest of the financial infrastructure, enforcement for fraud (double spending), I think the problems are manageable enough for a market test, and I've done my best to talk about that here and elsewhere. If you're talking about algorithms, they're done already. They're to the point where people are writing better ones that do the same thing more efficiently. If you're talking about the operations stuff (handling cash, keeping track of unspent cash, identifying offenders, etc) I contend that the code is being written now or has been written already. >Guaranteeing anonymity creates alot of problems as was brought out in a >previous discussion on license based cash in which it was pointed out >that by colluding with consumers a bank can still "mark" bills. I am under the impression that technology exists that allows anonymous offline digital cash transactions where double spenders are identified. Is that not the case? >I am yet to see a single anonymous digital cash system which could not be >implemented more simply if the requirement on anonymity were not made. I >would be pleased to be proven wrong. How simply? Are the computational requirements for generating a piece of anonymous offline digital cash, for discovering double spenders, for holding and spending cash Chaum's digital cash, or, say, Brand's version, excessive when compared to non-secure methods, especially on-line methods? Why do you suppose these guys are spending money developing the stuff? Are they wasting their time? I've heard sums in the range of at least $10 million that Chaum has spent already... >What I'm really asking is for an example of this overhead that is being >reduced. First of all, I'd like you to talk a little about offline digital cash systems which are non-anonymous, and have all the other features of Chaum or Brands. Pointers to the information is fine, unless others want to see it here. If you're talking about *any* online system, I've got you hammered. I just won that fight on another list (or at least I think I did ;-)), and I'll dump it all to you through e-mail, if you want. I'll give you hint: my jumping off point was Eric's observation that offline methods don't involve the banking system to effect every transaction. >> There are other reasons >> for not doing on-line transactions. Including credit checks, interest >> calculations on outstanding balances, vendor reserve requirements, >> transaction threading, on-line wait states and bandwidth, etc. It's >> considerable. > >And its going to get more considerable when we have communities of agents >arguing with each other. I think we want to solve the problems created by >these requirements, not shy away from them. Agreed, but I don't think avoiding them all together by doing transactions offline is shy, I think it's economically necessary. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

Re: Nuclear Weapons Material
by Patrick Juola 17 Dec '03

17 Dec '03

In order to cause damage, alpha emitters like plutonium must come in intimate contact with a material, such as the tissues of your lungs or bones or the inside of your favorite memory chip. A billionth of a gram of plutonium inhaled or swallowed is something to seriously worry about, but you can hold a lump of the stuff in your hand as long as it is covered with a leakproof cladding or vitrified into a ceramic. It is in this sense that plutonium is extremely toxic and hazardous to the environment, while at the same time not being particularly radioactive. Heavy shielding is not required between you and it. My understanding is that the heavy metal toxicity of Pu exceeds the radioactive toxicity by several (10?) orders of magnitude. In other words, the fact that Pu is an alpha emitter is irrelevant to the risk -- it's simply like lead poisoning only several billion times worse. Simple arithmetic yields that the amount of alpha exposure from a billionth of a gram of an alpha emitter with a half-life measured in thousands of years is infinitismal. - kitten

2 1

Cash, cheaters, and anonymity
by Hal 17 Dec '03

17 Dec '03

This is a response to an untitled anonymous post which raised some good issues. My answers may be a little controversial; feel free to disagree. One question is the ease of theft in a digital cash environment, and the consequences of claiming that secrets have been stolen. This problem was recognized very early on in discussions of digital signatures. The whole point of a signature is so that someone can be held to a commitment. But an easy "out" would be to "accidentally on purpose" let the secret keys be stolen, then to claim that the signature was actually forged. Contrariwise, a business might be vicitimized by actually having its secrets stolen and a forged signature created that committed it to an unfavorable action. I don't know what the best solution of these kinds of problems will be. Probably in the next couple of years we will see some test uses of digital signatures, and then we can see how these conflicts will be handled by the courts. Obviously, traditional methods like handwriting analysis which rely on physical imperfections will not be useful. Instead the issues to be examined would include the security methods used to guard the secrets, who might have had access to them, what the reputations are of the parties involved, and so on. It seems like these cases will not be easy to resolve cleanly. On the other hand, I would hope that people actually can learn to use care in safeguarding their secrets. The pass words and PINs we use today may be complemented by physical checks for voice patterns, thumb prints, perhaps (ironically) handwriting. Another approach would be to raise people's IQ to about 1000, so they could do an unbreakable authentication protocol in their heads :o. Failing that, there have been suggestions (one here a couple of days ago) to use various kinds of information exchange between the authenticating device and the human user in order to prove authorization in such a way that even a thief who has snooped on past exchanges will not be able to use the device. This approach is sometimes called the use of "pass algorithms". Applying this to the double-spending case, I suspect that Bob Hettinga is more on the right track in seeing the solution in the legal system rather than a simple "shucks, you caught me" forfeiting of a bond worth triple damages. There really should be no excuse for double spending, even of a penny, and the penalties could be made strong enough to deter most people. If a bank does not think they will be able to find and prosecute a person who is withdrawing off-line digital cash, they will probably not give any to him. Then if the money is double-spent, the person who withdrew it would be prima facie responsible, with a reasonable presumption that they did it unless there is significant evidence otherwise. I don't know that this is how it will work out but it is one possibility (unless the uncertainty just scares everybody away - but I think the digital signature experience will get people used to the concepts and problems). The other point I wanted to discuss was this issue of the bank authenticating the people who receive the cash. This does raise the spectre of a big brother system where there is some way to identify people with 100% certainty. Obviously this could be abused. My feeling is that there is a rather fine line we could walk in which this potentially-oppressive technology exists, but in which it is wielded in a way which enhances privacy and gives people the maximum degree of control over information about themselves. By analogy, think of a surgeon using a scalpel. This is a tool which is capable of terrible damage, and it is only by using it with the utmost skill that it brings about great benefits. Shunning knives altogether would be as bad as allowing everyone to hack and slash indiscriminantly. In a similar way, authentication technology is IMO a necessary enabling step for uses of cryptography which will enhance privacy. Off-line cash is one example. We have to protect the interests of all parties involved in a transaction or else it will not occur (voluntarily). A bank will not want to give out ecash tokens for which it is liable unless it is confident that it has some recourse in the case of fraud (such as double-spending). If users have to identify themselves to the bank in an utterly non-private way, that is only so that they can then spend the money in perfect privacy. The authentication that exists at the withdrawal step is wiped out by the blinding of the cash that is done before it is spent. It is a matter of balance. Without the authentication, you're not going to have off-line cash, IMO. You will be stuck with on-line systems in which everyone has to verify everything before accepting it. This means you pay a cost in communications overhead and possibly other foregone opportunities. Another example would be digital credentials. These can be thought of as digital tokens, somewhat like cash tokens, which have specific, published meanings. One might mean, "salary > $40K". Another, "age > 18 years". Like ecash, they can be issued and then re-blinded so they are not recognizable. Here we do not have the double-spending problem, but there is still a need for authentication. In order for these credentials to be trusted, the organizations which issue them will have to validate your eligibility. You'll have to show birth certificates, pay stubs, and all of the other kinds of paraphernalia you do today. The thought of this may grate in the minds of those seeking the freedom of digital anonymity. But, again, once this authenticating step is completed, you gain the advantages of a system where you could potentially borrow money, rent cars, and do other things which all involve authentication today, in complete privacy. You authenticate yourself once, and from then on the system works for you. So, my vision of the ideal future is neither a database society, where everything is recorded and tracked and privacy is protected only by a flimsy shield of laws that are widely flouted, nor a digital anarchy where identity is meaningless and trust among transitory pseudonyms is virtually impossible. Rather, I see a foundation of careful, nit-picking authentication upon which is built an elaborate structure of information flows fully under the control of the individuals involved. By adding the option for authentication to the mix, you actually expand the opportunities offered by digital privacy technology. Hal Finney

1 0

Actually plonking on a routine basis
by John Young 17 Dec '03

17 Dec '03

> >Responding to msg by tcmay(a)netcom.com (Timothy C. May) >on Thu, 18 Aug 4:41 PM > >>I'd be a lot more interested if there were >>some tie-ins to crypto policy and technology. > >Yep, this is what I want also but need participation by >others so I don't stick out too much and get Dixon-ized >by Perry, or, bless him, Nzook-ized by Graham. > >Just see what happens when I post shortly. > >John Goodness Perry, Why waste talent aping yourself? Tim wisely says above: use your smarts on crypto and techno. John

1 0

Re: Nuclear Weapons Material
by David K. Merriman 17 Dec '03

17 Dec '03

>> I don't know much about modern munitions, but I do know that armor >> piercing rounds may have no charge in them at all. Generally, when a >> round pierces one side of a vehicle, it loses enough energy and is >> suitably deformed to prevent exit from the opposite wall. It does, >> however, bounce around quite a bit, which can be plenty of fun in a >> tank loaded with equipment, munitions, and soldiers. > > I was under the impression that the most common techniquoe for >creating armour-piercing munitions was to use shaped-charges. While >depleted uranium has it's uses (being, as someone said, rather dense), >mass alone will not get through everything. A shaped charge will get >through more things more violently :) > And in the process, vaporize a signifcant amount of metal - effectively depositing a few microns (at minimum) of metal plating on everything inside the AFV (including passenger's lungs, skin, etc). My first choice would be not to be present for *either* event; far distant second choice would be taking my chances with riccochets. Dave Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)metronet.com for PGP/RIPEM public keys and fingerprints. Unencrypted Email may be ignored without notice to sender. PGP preferred. Remember: It is not enough to _obey_ Big Brother; you must also learn to *love* Big Brother.

1 0

Re: Nuclear Weapons Material
by David K. Merriman 17 Dec '03

17 Dec '03

>> I have seen the exact same chain-gun mounted on F-16's and A-10's here at >> Bergstron AFB in Austin at at least two different air shows. I am going on >> this alone. I do not know if this was ever an active use of the gun. >> > > Are we thinking of the same A-10? Tank-killer? The one that >houses a multi-barrel gun the size of a small car, and fires shells >which could pass for milk bottles in a dark room? I've seen an F-16, and >i don't think it could carry the chain gun off an A-10 - or have i >missed the point somewhere? > I worked a few months in the GE plant where they make these wonderful little toys ("GE - We Bring Good Things To Life" - hah!). The A-10 does indeed use the 30mm cannon, while the fighter aircraft use 20mm. Externally, the guns look *very* similar - you've got to get close enough to count the barrels (which is too damn close, if it _really_ matters :-) to be sure: 20mm uses 6 barrels, 30mm uses 4 (at least, at the time I was there - mid-80's). Either shoots 4,000 rounds/minute. Then you've got everyone's favorite, the 40mm, firing 3,000 rounds/minute through 3 barrels. If you had to compare a 40mm and a milk bottle in a dark room, the milk bottle is probably the small one :-) Not something I'd want to be on the receiving end of, in any case. Of course, we all realize that the size of the ammo refers to the projectile, not the casing, which is typically about half again the projectile diameter, for 'cased' ammo. I got to watch them light off all their little toys, with different types of rounds in them, while there - even after watching Navy guns fire, I was impressed. Dave (ex swab-jockey) Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)metronet.com for PGP/RIPEM public keys and fingerprints. Unencrypted Email may be ignored without notice to sender. PGP preferred. Remember: It is not enough to _obey_ Big Brother; you must also learn to *love* Big Brother.

1 0

Alt.Cryptids.Plonk.Plonk.Plonk.
by Blanc Weber 17 Dec '03

17 Dec '03

I was just counting them, and realized: If you knew that you were in someone's kill file, and that only those who were also members of that illustrious group were the kind who would reply in reference to those who had put them there, those banished ones could talk about their censors in front of everybody and the censors ones would never know, although everybody else would. Secret expressions unconcealed. Blanc [cryptid: from cryptozoology - creatures whose existence has not been substantiated.]

2 1

Is pay-per authentication possible absent trust?
by Jason W Solinsky 17 Dec '03

17 Dec '03

I'm having a problem patching up a serious hole in one of my protocols and I was wondering if anybody here had a solution. [Actually I suspect that the hole is impossible to patch, but I haven't been able to convince myself of that yet so intuitive "proofs" would also be appreciated] Here is the situation. Charles runs a certification agency. He might be certifying that you have some basic competency so that people will hire you. Or he might be certifying that you buy lots of computers with big brother inside microprocessors, thus making advertisers who want to sell software for big brother inside computers [i.e. Microsquish] willing to pay extra money for your time. Either way, Charles's certification is worth money to you. But the value to you isn't a constant amount. Each time you use the certification, you derive additional value from it. So Charles figures that it makes much more sense to sell his certifications on a per use basis... People who only occasionally need the certification will be able to afford it and Charles can gouge people who need the certification frequently for all they are worth. To do this Charles adopts a protocol in which his signatures are time dependent. Everybody can verify that his signatures a valid for the time at which a signature is required, but only Charles can figure out what the correct signature is for time T in polynomial time. [Note: There are many alternative methods of accomplishing this, but they all seemed to have the same hole... If you can find a way to patch the hole that requires changing this protocol it would still solve my problem]. So Charles sells you one-time certifications, and Microsquish pays you extra for those certifications and everybody is happy. Then, one day, Microsquish decides that Charle's certifications aren't worth as much as they used to be, so it lowers its price (for your time) to slightly greater than what Charles is charging you. Well this makes you unhappy so you complain to Charles, but he refuses to change his price. This makes you angry at Charles and causes you to wonder if there isn't a way to lower your certification costs. Enter Ingve the insurance salesman. Ingve will guarantee to others that you are certified by Charles by offering them bets. So suppose that Microsquish sends you its advertising agent and the agent is offering a 10 nano-slinkys [a cyberspatial monetary unit] bonus if you can produce one of Charles's certifications. Charles is charging 8 nano-slinkys. In steps Ingve. You've told Ingve that you are certified by Charles as a frequent purchaser of big brother inside computers. So Ingve says: "I'll convince Microsquish to accept my word that you have Charles's certification in exchange for just four nanoslinkys. But if at my request you ask for the certification and Charles's says you aren't certified then you owe me 64 nano-slinkys." Since you are sure that you are certified you accept the deal. Then Ingve goes to Microsquish and offers to insure your certification. Each time Microsquish accepts a certification from Ingve for you, Ingve will pay Microsquish 2 nano-slinkys but will be able to get your business (and thus offset that with the four nano-slinkys). But, if it turns whenever Microsquish wants to it can check up on your certification from Charles at cost (8 nano-slinkys). If Charles certifies you all is well. Otherwise, you owe Ingve 64 nano-slinkys and Ingve has to pay up Microsquish's insurance claim (which could be quite large depending on the policy. The result of all this is that Charles is cheated out of his revenue. Ingve, You and Microsquish profit, but Charles fails to reap the benefits of his certification. The question is: Is there a secure method that charles can use to prevent the "Ingve the insurance salesman attack"? Cheers, Jason W. Solinsky

2 4