December 2003 - cypherpunks-legacy

re: on anonymity, identity, reputation, and spoofing
by Jim Demmers 17 Dec '03

17 Dec '03

> What if that `opinion' was not an accurate representation of > reality? what if a few people were creating the illusion that some > different kind of consensus existed? what if that `agenda' were > actually something inherently wicked like ... anarchy? ^^^^^^^^^^^^^^^^^ Nothing, absolutely nothing (IMVHO) is inherently wicked. This is a virtual forum, and as such, it is not (nor should it be) subject to the same laws that bound similar dialogues in actuality. The cyberspacial medium begs the development of new and unique forms of interaction - and broadening one's means of expression through the use of multiple identities is perfectly valid in my book. As for conspiracies-to-mislead, I must have seen at least 20 or 30 last night while I was watching the World Series. I don't know how many others 'buy' (pun intended) into the crap that passes between their ears during the course of any given day, but I consider myself intelligent enough to weed through the chaff unassisted. Peer pressure has always been a powerful coercive - so what? It's not my job to calibrate the 'moral compass' of others...I leave it to them as an exercise (to be turned in at check out time). > > 1) list members are allowed *one* anonymous identity if any. They are > required to associate some name with all anonymous posts via that identity. > 2) *no one* is allowed multiple `real' identities and in fact any > violation of this is considered an extremely serious breach of netiquette > & honesty. > 3) completely anonymous posts from `outside' the list are allowed; if > no pseudoidentity is given they are assumed to come from `outside'. > Give me a break! A little structure goes a long way but these rules call to mind elementary school experiences that I thought I'd left behind. I can see it now: The Cypherpunks List (schizophrenics need not apply) Let's move on... [the preceeding has not been a flame but a commentary. It should be taken as such.] -jim |=========================================================================| | | | Jim Demmers Public Domain, Inc. INET: jdemmers(a)pd.org | | P.O. Box 8899 jim.demmers(a)oit.gatech.edu | | Atlanta, GA 30306-0899 balder(a)gnu.ai.mit.edu | | Phone: 404-377-2627 FAX: 404-894-9135 | | | |=========================================================================|

1 0

crypto technique
by Matthew J Ghio 17 Dec '03

17 Dec '03

I was recently doing a calculation involving polynomials when I noticed the following: The function: 1 2 1 y = ( - x + - x + C ) mod P 2 2 where C is any integar constant, and P is any integral exponent of 2, given any positive integer less than P as input in x, will produce a unique positive integer output in the same range, [0,P). Hence we have an encryption technique which works well for binary data. Decrypting this is a bit trickier. It is possible to find the inverse equation for this, (without the modulus) which is: x = SQR(2(y-c) + 1/4) - 1/2 (SQR=Square root) Finding the square root of the modulus is the tricky part, but it is possible, since for every number it is possible to add some multiple of P and find a rational square root (There is a fairly systematic way to do this; I don't want to bore you with the math right now, I'll go into it later if anyone wants. Just trust me for now; it's possible to do without too much computation.) Now, there are some ways to beat this if you were encrypting one byte at a time, such as looking for recurring spaces in ASCII text, but if you were to group 8 bytes together and set p=2^64, it would be fairly difficult to crack. Anyway, in case you're getting bored, here comes the fun part: What happens when we double-encrypt with this technique? Well, obviously you need to use both keys (both values of C) in order to unencrypt it. For encrypting tho, we have a nested function of x: 1 1 2 1 2 1 1 2 1 y = - ( - x + - x + C ) + - ( - x + - x + C ) + D 2 2 2 2 2 2 where D is a second constant. This multiplies out to a fourth degree polynomial which can not be easily factored to find it's orininal components. Adding a third layer of encryption creates an eighth degree polynomial which is hopelessly beyond factoring in any reasonable amount of time. Hence, it is impossible to determine the decryption key if one has the encryption key. Therefore, the multiplied polynomial can be distributed as a public key, and the inverse functions needed to decrypt are kept secret (private key). Has this ever been tried before? Has it been broken? I don't see any way to break this, but I could be overlooking something. If this works it seems like it might be simpler to generate keys for than RSA. I wrote out an example of this on paper here, picking some values for C, and got: 4 3 2 y = .125x + .25x + 63.875x + 63.75x + 8159 and I was able to find values of x for values of y. Go ahead, post a number, I can decode it (can you?). Oh, don't forget to say what P is. :) P.S. In case you're wondering where that function came from, and why it always produces integars, it's a representation of the series 1+2+3+4+5...

3 7

EFF servers down?
by ferguson＠icm1.icp.net 17 Dec '03

17 Dec '03

I noticed that the EFF FTP server (FTP.EFF.ORG/KRAGAR.EFF.ORG) appears to be down. Is this a scheduled outage (servicing, etc.) or are they having problems. Curiously, _____________________________________________________________________________ Paul Ferguson Mindbank Consulting Group fergp(a)sytex.com Fairfax, Virginia USA ferguson(a)icp.net

2 1

Re: Cypherwaffle on spoofing
by doug＠netcom.com 17 Dec '03

17 Dec '03

Arthur Chandler <arthurc(a)crl.com> said: > What I find odd is the number and vehemence of posts ON A LIST DEVOTED >TO ENCRYPTION saying "Hey, it's a fact of life, accept it" -- even >dragging out Machiavelli's profoundly mistaken "if you can't enforce >it, don't prohibit it." I don't understand your point. If it really is impossible to prevent people from creating multiple anonymous identities, what good does it do for any or all of us to say that we abhor the results? I grant you that there will be bad effects...but what precisely do you suggest we do about it? If you think that people *can* be somehow limited to a single anonymous identity, you'd best explain how you think so. If on the other hand you agree that such a limitation can't be enforced, then I fail to see your point at all. Doug

1 0

IRS LEARNING . . .
by Sandy 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT Reply to: ssandfort(a)attmail.com . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Punksters, I wrote: My favorite *fun* solution would be to buy $80,000 in travellers cheques and then *burn* them. To which Phil Karn responded: Well, yes, I suppose you could then leave the country, find an **Amex** office and file a claim for the missing $80,000 of travelers checks, but wouldn't this generate precisely the kind of paper trail you're trying to avoid? . . . I do suspect that **the** government will eventually point to digital cash as justification for controlling all of cryptography. [**emphasis** added.] Folks, you have to stop thinking so parochially. The world is full of travelers check companies. Most of them protect their clients' privacy. Moreover, there is no *the government*. At any given time, their are 100-200 competing nation-states and other semi-autonomous political entities. Phil went on to say: Or they will refuse to back it [digital cash] up in court as legal tender, thus helping undermine it. I know there's this concept called "reputation" that's supposed to take the place of the government enforcing contracts, but I have a hard time understanding just how it will work for very large transactions between individuals (like buying a house or even a used car). Think a minute here. What legal tender laws back up the very travelers checks we have been discussing? What government says merchants must accept your Amex/Bank of American/Citibank/Thomas Cook/etc. travelers checks? As for "very large transactions," I again leave that as an exercise for the student. (Hint: How might an escrow be used?) I apologize to Phil for using him as an example of the provincial nature of the Cypherpunks list. At least, he is working with the concepts. The Cypherpunks list, though nominally international, is dominated by Americans. Unfortunately, we Yanks bring our own peculiar form of ethnocentrism to the list. (I also apologize to non-US list members for belaboring the obvious.) Punksters, we live in a transnational world. We work and play on the transnational Internet. Our computers and our cryptography transcend the evil empires. Transnationalize yourself; and swim like a fish through the sea of the nation-states. With apologies to Mao, S a n d y >>>>>> Please send e-mail to: ssandfort(a)attmail.com <<<<<< ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

6 12

PSEUDOSPOOFING
by L. Detweiler 17 Dec '03

17 Dec '03

I'm absolutely *horrified* and *nauseated* that our eminent list moderator E.H. has come out in total support of what I have been calling `spoofing' or using pseudo-real addresses to post to the list. (It isn't `really' spoofing in the exact sense because as I noted there has only been an *implicit assumption* by all of us here that opinions from unique addresses were themselves unique. so, lets call it) PSEUDOSPOOFING the activity of misleading people into thinking that an identity is unique when it really isn't! i.e. posting behind `real' addresses not specifically noted as anonymous! I consider pseudospoofing a *detestable* and *reprehensible* activity if it exists. Am I the only one who finds this absolutely *repulsive* and *abhorrent*? How long has this been going on? who has been doing it? am I the first to suspect it is happening? how many debates have been affected? how many people have been *harassed* or *intimidated* or *burned* to a *crisp* by pseudospoofers? is this going on in *private email* too? how many debates have been skewed? how many people here DON'T EXIST? Are the other founders T.C.May and J.Gilmore in favor of this too? how much have you guys been doing this? is this really part of the cypherpunk agenda? who here supports this, anyway? does this have anything to do with the bizarre conspiracy theories posts of `S.Boxx'?! is this why `everyone' is opposed to a newsgroup or other change in the `status quo'?! Is this why *I* get *flamed* so much? is this polluting other mailing lists?! E.H. >The claim that a person should have only one pseudonym per forum >indicates profound misunderstanding. If someone wants to have >multiple cryptographically protected pseudonyms, they will be able to; >that is one of the main goals of cypherpunks software. IMHO, this itself represents a `profound misunderstanding' under what actually constitutes an OPEN FORUM. If we are merely conducting some depraved experiment on the psychology of pseudonymity and pseudospoofing on unwilling participants, please say so! I for one never saw *that* announcement when I signed up! calling `pseudospoofing' `one of the `main goals' of cypherpunks software' sounds *criminal* to me. Or maybe I'm missing the point! I guess this is what anarchy really *is* all about! * * * speaking of OPEN FORUMS, `Jamie Dinkelacker' <Jamie(a)netcom.com> objects to my other proposals for reputation tracking statistics: >> >>1) how long they have been on the list in days, 0 if none at all >>2) how many postings they have posted here >>3) maybe a posting/age ratio -- some people seem to be very sensitive >>or tune out people with a high one. >>4) another idea: tracking the number of responses a given poster has, >>average, per original post, measured by `re: [x]' subject tracking. >> > >Each of these suggestions call for data that may contribute to identifying >individuals, tracking their behavior or providing information useful to >decypher some messages. This has a very NSA feel to it. A very ``NSA FEEL''?! all of these statistics could be generated by *anyone* who subscribes to the list! is this an OPEN FORUM or not?! How could *anyone* object to anything so innocuous? A *true* forum would be *representative*. For example, I already have the impression that no one here supports my suggestions whatsoever on list modifications & protocol from E.H.'s comments and jamie(a)netcom.com. Now, humor me, and take the hypothetical situation that these are the same person! how can this be a `forum' if an opinion is not *representative*? what if a single person just `ganged up' on someone they didn't like by overwhelming them with pseudospoofs? what if there was *truly* support for some project but a pseudospoofer ganged up on the proponents and clobbered them with flames? does this sound anything like what has happened on this list in the past? doesn't it throw every `conversation' on this list into spectacularly *grotesque* doubt? wouldn't that be a lot like intimidation at best and *extortion* at worst? would it look like a `clique'? what if this was happening *routinely*? what if people were being *influenced* by what they perceived was the *majority opinion* or the *views of their peers* that were really nothing but DECEPTION AND LIES? what if it was *thwarting progress*? I would consider this nothing but TREACHERY and HIGH TREASON. is all this really one of the `main goals' of the cypherpunk agenda? if so, SIGN ME OFF. Regardless of whether anyone believes in democracy (a `lot' of people here said they didn't a while ago, but now I have my doubts!) the idea of `one man one vote' is SACRED. it means in essence, one man shall not have UNFAIR INFLUENCE. anything less is just the `Golden Rule: He who Has the Most Gold Makes the Rules'. or, `you can be here as long as I always have more *power* than you do and you don't complain!' it is *anti egaltarian*. it is a recipe for anarchy, dischord and chaos. Or perhaps I'm MISSING THE POINT?! maybe that's what somebody *wants*. is *this* what the Cypherpunks really stand for? UNFAIR INFLUENCE. ABUSE OF POWER. MANIPULATION. DECEIT. TREACHERY. EXPLOITATION. SECRET CONSPIRACIES. p.s. if anyone doesn't hear from me for awhile, assume I've been `liquidated' and this isn't really an `open forum' ...

4 3

uniqueness
by cme＠ellisun.sw.stratus.com 17 Dec '03

17 Dec '03

>what really is our assurance that all these email addresses actually >exist and represent *unique* people? there really is very little currently. I see no way to guarantee uniqueness of the person unless you manage to incorporate some unique characteristic of a person (right hand print, for example) into a digital signature. PEM's key certificates might be an attempt to guarantee uniqueness but even there I can cheat by having a second job under a second name, for example, and getting a certificate in both. - Carl

2 1

Cypherwaffle on spoofing
by Arthur Chandler 17 Dec '03

17 Dec '03

I understand Detweiller's frustration. On another list, someone posted as if he/she were William Gibson. That kind of fraud undermines confidence on several levels. It attempts to dupe us, and usurps the name and reputation of a well-known writer, and sets up an atmosphere of suspicion and doubt fatal to any community. How would you like it if someone spoofmailed to this list under your name, then published Nazi slogans and argued for the legalization of rape? What I find odd is the number and vehemence of posts ON A LIST DEVOTED TO ENCRYPTION saying "Hey, it's a fact of life, accept it" -- even dragging out Machiavelli's profoundly mistaken "if you can't enforce it, don't prohibit it." Of all the groups on the Internet, I would think that this one would be in a special position to say "put your digital John Hancock on your post if you want to to taken seriously."

5 4

Internet makes resistance futile, Clinton aide warns
by jbugden＠alis.com 17 Dec '03

17 Dec '03

Internet makes resistance futile, Clinton aide warns This byline appeared in The Financial Post of July 24, 1997 at the top of the front page. The subsequent article discussed not crypto, but Canadian attempts to regulate television content. Even so, the second paragraph is succinct, and applicable to both debates. "Ira Magaziner, Clinton's international emissary on the issue of how governments should respond to the explosive growth of business on the Net, said any attempt to regulate its content would not only be a mistake, it would be futile." Perhaps someone should get Mr. Magaziner back to Washington to explain this to the administration. Ciao, James jbugden(a)alis.com Great minds think alike, fools seldom differ.

1 0

Re: Backing
by Matthew J Miszewski 17 Dec '03

17 Dec '03

The problem with using a concrete anfd finite source to back ypour currency is that it is just that...finite. This causes many economic problems for the social/economic system founded on it. I was barely a pup when the world first discovered this... er...that is when everyone in the mainstream allowed economists to be heard. Remember the Gold Standard? --Matt ______________________________________________________________________________ "This new technology (the printing press) threatened the Crown, which shuddered at the thought of widespread dissemination of works advocating religious heresy and political upheaval. The Crown's solution to the problem was a system of regulation designed to control this "dangerous" art." -From my Copyright Law Text (refrencing the Statute of Anne - the first Copyright Statute) (c)1993 ______________________/___________________________________mjmiski(a)macc.wisc.edu

2 1