December 2003 - cypherpunks-legacy

iterated prisoner's dilemma
by John Douceur 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >From: Hal <hfinney(a)shell.portal.com> >Date: Monday, August 29, 1994 12:03PM >Another argument sometimes advanced in favor of trustworthy escrow >agents is the "iterated prisoner's dilemma". This refers to Axelrod's >simulations of computer program agents which repeatedly interacted in >a simple "prisoner's dilemma" game which captures much of the essence >of the trust relationship (see his book "The Evolution of Cooperation"). >His results generally have consistently shown that agents which are >never the first to "cheat" in a relationship do better than those >which try to take advantage of their counterparts. . . . >Axelrod's tournaments were predicated on the implicit >assumption of an indefinite number of interactions. (This is my >recollection; I'd be interested in whether experiments have been tried >with a known fixed number of interactions, and the agents knowing how >many more there were.) It had long been recognized (pre-Axelrod) that >the prisoner's dilemma might reach a stable cooperative solution with >multiple interactions, but that this becomes unstable if the parties >know that they are reaching the end of their interaction period. Axelrod's second tournament had a variable number of interactions, precisely to defeat penultimate-interaction attacks. He added this specifically because his first tournament had a fixed and known number of interactions, and several programs took advantage of it. However, even in the first tournament, the "nice" programs did better than the "mean" programs, and Tit-for-Tat was the winner. I suppose this doesn't prove much, insofar as a Tit-for-Tat-but- Screw-Em-on-the-Last-Round program would probably have come in first had it been entered. Even so, I expect that the marginal increase in score over Tit-for-Tat would have been vanishingly small for a large number of interactions. JD -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLmJSsEGHwsdH+oN9AQGIAAQAkT6GC1xOdmCh5Zp7LU17oKRH7WAqeYoK 6FypHPqfUK688uFUAUz61MhGaMkr9ZoCcnRdsmejOGq9zQ9sW6D3SnGvTtkgGyGD zNjle57RVxG8sqkaei8kKszCyVIxZfms2RkdrmQyC/GHwAo9i/5yOszdqFotWfVJ HRe05Pfrano= =zsiI -----END PGP SIGNATURE-----

1 0

MIT PGP - PGP UI - VIACRYPT mime
by Gary Jeffers 17 Dec '03

17 Dec '03

Cypherpunks, Question concerning MIT PGP 6.2 & PGP 6.2 ui. If it is known that the PGP that encrypted a msg is one of these two versions, then can it be determined which of these two versions did the encrypting? Also, can it be determined that it was not VIACRYPT that did it. Note: If it can be determined that PGP 6.2 ui did it, then it might be a neat trick to change the ui version to mimic either of the other two at user command. Yours Truly, Gary Jeffers

2 1

Re: Statistics on remail message sizes
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

>In article <9408291623.AA29767(a)ah.com>, Eric Hughes <hughes(a)ah.com> wrote: >>Based on Hal's numbers, I would suggest a reasonable quantization for >>message sizes be a short set of geometrically increasing values, >>namely, 1K, 4K, 16K, 64K. In retrospect, this seems like the obvious >>quantization, and not arithmetic progressions. Live and learn. > >A brief suggestion: Code the progression, not the four values. As > time goes on (and lossy sendmails disappear), people are sending larger > and larger messages; it's easily conceivable that people could be > swapping multiMB files at some point in the not too distant future > (indeed, I do occasionally send out files that are 4-5 MB large, > uuencoded binaries and tar files). > >No point in limiting future behavior due to current usage. Except that coding only the progression and not the actual values lessens the usefulness of quantizing. We may have one group of remailers/users which uses the Hughes sequence: 1, 4, 16, 64, and another group that uses another sequence: 3, 9, 27, etc. I'm not saying we'll ever get everybody to agree, but there are times when it's better to converge on solid, actual numbers and not on the more-elegant abstract progressions. But maybe I'm misunderstanding the point here. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

2 1

e$: e-cash underwriting
by John Young 17 Dec '03

17 Dec '03

Responding to msg by hughes(a)ah.com (Eric Hughes) on Sun, 28 Aug 10:9 PM >Turn fraud attempts from a security cost to a profit >center. Brilliant statement, Eric. My mouth fell open. This is the best synopsis I've seen for the conversion of our national security capitalism into democratic capitalism. It makes all the pleasurable, if demanding, digicash correspondence I've read here fall into place. John

1 0

Re: Announcing Bellcore's Trusted Software Integrity (Betsi) System
by David K. Merriman 17 Dec '03

17 Dec '03

> >Certainly not enough to justify the rest: Can you name one example of an > author of a package including some virus? Not someone putting one > post-production (individual signing will prevent that), but the original > author? > >It's a straw man. Well, there was that CD-ROM program of a couple months ago that professed to be from one of the drive manufacturers (but wasn't) containing some kind of Binary Nasty (tm). The mfr's finally had to post (far and wide) the fact that it was *not* their program. The program was posted using a false ID, etc. Don't know if the Bellcore system would prevent that, but it is *one* example, anyway. I'm not arguing that the Bellcore system is the answer to Life, the Universe, and Everything; just that there are some small pieces to it that have *some* perceivable merit to them. Personally, I wouldn't want anything to do with it - as you note, the costs and hazards _far_ outweigh any benefits, and there are easier and more secure ways of accomplishing the same things. Dave Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)metronet.com for PGP/RIPEM public keys and fingerprints. Unencrypted Email may be ignored without notice to sender. PGP preferred. Remember: It is not enough to _obey_ Big Brother; you must also learn to *love* Big Brother.

2 1

Re: Announcing Bellcore's Trusted Software Integrity (Betsi) System
by brains＠male.org 17 Dec '03

17 Dec '03

>> - provide accountability by linking the author of a program >> to a real person whose identity is verified off-line > >This is unnecessary, and I would claim undesirable. A unique anonymous > ID is just as good as a "real" one -- since you're relying upon PGP > anyway, the mapping from signature to a known identity is one-to-one. > >The only reason I can see to require this "real human" mapping is > to try to prosecute people for bugs in their code or some contamination > that seeps into their release. > >That's not an aspect of the world I want to live in. Or to warn potential virus "authors" that *their* anonymity is no longer assured - not a bad thing. Not enough to justify the rest of it, IMHO, but certainly not Evil Incarnate (not to be flinging misinterpretations or aspersions :-) Dave Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)metronet.com for PGP/RIPEM public keys and fingerprints. Unencrypted Email may be ignored without notice to sender. PGP preferred. Remember: It is not enough to _obey_ Big Brother; you must also learn to *love* Big Brother.

4 5

Problems with anonymous escrow 1
by Hal 17 Dec '03

17 Dec '03

There has been some discussion here about how anonymity/pseudonymity can be applied to a wider range of relationships. One possibility that Tim May and others have mentioned is to have escrow agents be anonymous. (I will use "anonymous" and "pseudonymous" more or less interchangeably because the former term is more familiar. But I am really referring to a case where the agents maintain a certain amount of continuity via secret keys and such.) (Let me make it clear that I am not arguing that there SHOULD NOT be anonymous escrow agents. I am questioning whether they are likely to be viable entities due to the problems I am listing here.) The obvious problem I see with anonymous escrow agents is that it is much harder for them to become and stay trustworthy. With an identified (non-anonymous) agency, you can have a lot of information on which to base your judgement. You can look at its assets, at its employees and hiring procedures, at its record. You look at the jurisdiction in which it operates and judge what protection the legal system may offer. You can look at other agencies in that jurisdiction and what their track record has been. I would guess that most of that information would not be available from an anonymous escrow agent, at least not in a validated form. Perhaps some of it could be done with credentials (a blinded statement from a reputable accounting firm that (this?) escrow agency has assets of $X). But generally thinking I think it will be very difficult to get nearly as much high-quality information about an anonymous escrow agent. This leaves the possibility of using its public record to judge trustworthiness. It may be able to offer certified statements (again, credentials of a sort) from earlier customers to show that it behaved honestly. Tim has suggested "pinging" such businesses, performing various dummy transactions to make sure that they are still behaving honestly. All this can help establish a record, but how well can this be extrapolated into the future? One of the problems with anonymity which has no underlying identity certification is that you are pretty much forced to adopt the stance that "the key is the identity." Your only channel of communication with the agent is via its key, and any message signed with that key has to be assumed to be coming from the agent. There is nothing else. The problem with this is that keys are not people. People, and businesses, have a certain continuity, a certain predictability. Keys do not. A key may change its personality, literally overnight, and you will not have any warning about this. In an identified business, if it changes hands, acquires new management, or has some other change which might lead to new behavior, you generally have some warning (especially if it is a business which is selling trustworthiness, in which case it will probably provide customers with an unusual degree of access to the business's internals.) But with an anonymous business this is not the case. An escrow agent who has been as steady as the sunrise for years may, without any warning, become totally dishonest. Hidden behind the shield of anonymity there is no way for its customers to discover the change. What are the motivations for an anonymous escrow agency to stay in business, to not take the money and run? Legal sanctions would presumably be ineffective. One proposal is that as long as the expected future stream of income is worth more than the current value of all contracts being held by the agent, it is worthwhile for it to be honest. There are a couple of problems with applying this. First, it is necessary to know about how many contracts the agent is holding at one time. But this will be complicated by the possible desire on the part of many customers to keep their activities secret (even beyond their presumed shield of anonymity). So there must always be the worry that more contracts are in progress than you suspect. This is especially true when you consider the possibility that other agencies may secretly be owned by this one. But more importantly, judging whether a future income stream is worth more than a present sum depends on knowing the escrow agent's personal time preferences. Some people like to have their money now, some are willing to postpone present gratification in favor of future income. Neither position is inherently right or wrong, but obviously a customer would feel more comfortable with an agent which favored future income. And the fact that an agent has been in business a long time suggests that this is indeed its view - if the agent is stable. But combine this with the ease with which a key can change its personality without warning and it suggests that even a long track record of stability could be fragile. The business is passed from father to son, it is acquired, it is coerced away, the owner experiences a change of circumstances due to illness or other catastrophe, and suddenly the agency has changed. Now, future income doesn't look so attractive compared to present money. Now, the owners have an incentive to close the business and (I firmly think the word applies) cheat their customers. Again, with an identity-based business these kinds of changes will be monitored closely by customers. And after a change like this the customers will be nervous and may go through a period where they don't fully trust the changed company. But with an anonymous agent there is no way of knowing when these things happen, and this uncertainty will constantly threaten the safety of the customers. Hal

2 1

Re: Nuclear Weapons Material
by Ian Farquhar 17 Dec '03

17 Dec '03

On Aug 25, 11:43pm, Phil Karn wrote: > Just to bring this back somewhat to cryptography, an interesting topic > for speculation is the operation of the "permissive action links" > (PALs) that control these weapons. The complexity of the procedure > suggests that the precise timing of many events is crucial if a > high-yield nuclear explosion is to result. This is particularly true > for the timing of the many HE detonators, the neutron generator and > the fusion boost injector. Perhaps these parameters are stored in > encrypted form in the weapon and can be decrypted for use only with > the proper externally-provided key? Considering that a brute force key > search would consume one weapon per trial key, perhaps this technique > isn't too bad against dictionary attacks? :-) I heard a rumor (from several independent sources) which indicated that the firing sequences are essentially encrypted detonator timings that are passed through the PAL, which decrypts it but makes no value judgement about the timings themselves. If the timings are wrong, you get a messy squib explosion which will make a mess for about 100m around the detonation site, and which will totally destroy the weapon beyond any hope of recovery. Whether this true is anyone's guess, and there is a lot of quite deliberate disinformation concerning nuclear weaponary. Considering that one known fact is that the original fatboy contained 64 detonators, and that we'd be talking about timing in hundreds of microseconds, a back of the envelope calculation indicates that the amount of timing information would be ~900 bits for a similar device. If this keyspace is indeed heavily permuted, so that no intelligent judgements could be made which would reduce the searchable keyspace, this seems to be rather secure. Obvious layers of further protection (eg. adding a counter which will restrict the lifetime of a particular firing sequence) are also possible. Ian.

1 0

Transport Mixes
by Jim Hart 17 Dec '03

17 Dec '03

It might be possible to transport goods in a difficult to trace fashion, by applying the concept of a digital mix to physical transport. We can't make them cryptographically hard to trace, but perhaps we can minimize the clue trail by substituting crypto for normal shipment records. Here's a courier system for shipping small packages untraceably: + put your packages in a suitcase for a flight to a major hub airport, which is also a courier mix site. Each bag contains an innocuous looking Newton with a small wireless radio. These identify themselves as mix shipments only if the proper one time key is transmitted over a spread spectrum wireless channel. You also put a message in the Newton indicating the shipment route and enclosing digital cash as postage; these are successively encrypted with each mix's public key, just as with remailers + couriers spend all day locating mix bags and taking them to a nearby hotel room, and taking bags from the hotel room when they have been delayed, mixed, and queued for the flight they are and only take a few bags each at a time + the particular hotel and room changes every day + a separate courier inside the hotel room takes the following steps: -- decrypts a message inside the Newton with his private key to reveal the next destination for the shipment -- decrypts the digital cash fee for this mix and clears it -- puts the package and Newton in a new suitcase and puts it in a queue for that new destination (a flight at some point in the future, say 10-30 hours later) + like any mix, the delay depends on the rate of traffic going through the system: we'd like to mix up at least ten or so shipments at each mix + we assume that customs checks any bag at at most n-1 out of n hubs (highly probable unless the bag contains something that looks suspicious in the x-ray). + the contents of the package should contain no clues as to source and destination, unless they are securely encrypted + each mix is a separate organization, composed of only a few mutually trusted couriers + we need protocols for destroying shipments or shipping them back to the customer, due to suspicous nature of the package (customs would catch guns, bombs, sniffable drugs, etc.) unclearable postage, or other exceptions that might occur, and informing customers and arbitrators of these actions Something of this sort might even be possible with larger shipments using large ocean ports instead of airports, standard size pallets instead of suitcases, and warehouses instead of hotel rooms. Again, I make no claim that this would be cryptographically strong; but in some cases we can use cryptographic protocols to stop info flows related to transport that are otherwise vulverable to attack, and concentrate on various techniques to minimize other vulnerabilities. The mix concept is limited to important shipments where one is willing to pay a high preium. The number of mixes will be small, because increase in transport costs quickly overwhelms the increased security of using additional mixes, because there are these other vulnearabilities that become more important. Can one travel personally, untraceably? Here is a method analogous to a mix: + instead of flying directly to one's destination, fly through two or three hubs + pay for each ticket with cash; if ID is necessary use unlinkable nom de guerres at each airport + remove suitcase tags at each airport + dress differently at each airport (just enough to foil routine memories of stewardesses, etc.) + if one is being followed use the various methods to lose them, choose three new hub airports and start over Jim Hart hart(a)chaos.bsu.edu

2 1

Cyberspatial governments?
by Hal 17 Dec '03

17 Dec '03

I have been very impressed with the imagination and depth of Jason Solinsky's ideas, especially considering his apparent youth. However, I want to take issue (not semantically this time!) with the idea of a government in cyberspace, which IMO Jason tends to rely on too heavily. As I understand Jason's proposal, his government does not rely on force, but rather it acquires authority by people voluntarily putting themselves at the mercy of the government to a certain extent. The principal mechanism I have seen suggested is for people to put some money into escrow or a bond which they will surrender (according to agreed-upon rules) if they break the laws of the government. Now the simple objection I offer is that most people don't have enough cash lying around to effectively obligate themselves. Most people, unfortunately, spend their money rather than saving it. Even people who do have large sums of cash are, for that very reason, able to tolerate larger losses, so they will apparently have to put up very large bonds, which would have to be a strain on their liquid capital as well. And, for people who do have the money, how can they tolerate tying up a large sum of cash for such a long period of time? Does the government offer interest? How are the funds invested - safe or risky? Low returns or high? People want to diversify their investments, and I don't think they are going to be willing to put all their cash into this one lump sum bond. When people do save money, it is often with the intention of spending it later. They save money to put their kids through college, or for retirement. Sooner or later their comes a time when they have to start consuming the nest egg. Will this entail withdrawal from the benefits of the cyberspace government? To sum up, I don't think most people's lives are structured in such a way that they can credibly obligate and commit themselves to a potentially risky contract. With physical governments people might say "as long as I live on this island I agree that the government can shoot me if I kill someone," and I will be inclined to believe that they will not try to commit murder. But that promise is much less credible if all they will do is forfeit a $2,000 bond, if that's all the money they've managed to save. Hal

2 1