December 2003 - cypherpunks-legacy

(fwd) ViaCrypt CW Announcement
by ferguson＠icm1.icp.net 17 Dec '03

17 Dec '03

>From the "For What It's Worth" department - Forwarded message: > From: warlock(a)ACM.ORG > Newsgroups: sci.crypt,talk.politics.crypto,comp.org.eff.talk > Subject: ViaCrypt CW Announcement > Date: 19 Oct 1993 13:46:36 GMT > Organization: ACM Network Services > Lines: 29 > Distribution: inet > Message-ID: <2a0r3s$ahh(a)hopper.acm.org> > Reply-To: warlock(a)ACM.ORG > NNTP-Posting-Host: acm.org > Xref: news.sprintlink.net sci.crypt:20523 talk.politics.crypto:874 comp.org.eff.talk:21553 > > } > In spite of the uproar over Phil and Grady, its apparently busi > ness as usual at ViaCrypt as evidenced by their software product > announcement under "New Products" on page 39 of the Oct. ll, > 1993 issue of Computerworld: > > > ViaCrypt has announced ViaCrypt PGP, a high-security public key > > message encryption program designed to protect electronic-mail > > and data files. Transmitted messages or exchanged files are > > secured against unauthorized readers, and the program provides > > digital signature, data compression and key management. Cost: > >> $199.95 for a DOS single-user license, $599 for a five-user > > license and $1,649.95 for a 20-user license. ViaCrypt, Phoenix > > (602) 944-0773..... > > A company rep contacted by phone indicated that their offering > was licensed by RSA/PKP and that an export licence -- if needed > -- was "easy" to obtain provided the licensee was "at least a > "51%" American company". > > > Bill Wilson > > ################################################################## > > "Even a blind pig finds an acorn once in a while" Southern > Appalachian saying. > > ################################################################### > _____________________________________________________________________________ Paul Ferguson Mindbank Consulting Group fergp(a)sytex.com Fairfax, Virginia USA ferguson(a)icp.net

1 0

(fwd) Australians dump DES (from RISKS)
by ferguson＠icm1.icp.net 17 Dec '03

17 Dec '03

Can anyone provide ant detailed information on 'Seneca'? Forwarded message: > From: darrell(a)cse.ucsc.edu (Darrell Long) > Newsgroups: sci.crypt > Subject: Australians dump DES (from RISKS) > Date: 19 Oct 1993 03:11:34 GMT > Organization: University of California, Santa Cruz (CE/CIS Boards) > Lines: 32 > Distribution: world > Message-ID: <29vlt6$82c(a)darkstar.UCSC.EDU> > NNTP-Posting-Host: sequoia.cse.ucsc.edu > > Date: Mon, 18 Oct 1993 17:14:08 +1000 > From: zaph(a)torps.apana.org.au (Kevin Burfitt) > Subject: Australian government to replace DES > > Here is something I found in an Australian computer magazine, which > sounded like something for the Risks Forum... > > Quoted from "PCWEEK October 20, 1993" > > The Australian Government has secretly developed its own data > encryption firmware and algorithm, killing its dependence on the > US DES (Data Encryption Standard) Algorithm. > > Called Seneca, the firmware element was developed as a joint project > of the Defence Science and Technology Organisation (DSTO) in Adelaide > and the Defense Signals Directorate (DSD) in Canberra. > > [...] > > "It is a symmetric encryption technology like DES, but can operate > at very high speeds" said the source. Seneca's original specifications > included a throughput of 2Mbps, but testing had achieved rates of > 20Mbps. > > Isn't part of the security with DES its slowness, which implies that this > new encryption method will be inherently risky because of its speed ? > > Kevin Burfitt > > zaph(a)torps.apana.org.au (Kevin Burfitt) Compuserve: 100240,2002 > Torps Productions: torps.apana.org.au BBS +61-3-818-0986 FidoNet: > 3:635/574 > _____________________________________________________________________________ Paul Ferguson Mindbank Consulting Group fergp(a)sytex.com Fairfax, Virginia USA ferguson(a)icp.net

1 0

Re: your mail Re: on anonymity, identity, reputation, and spoofing
by owen＠autodesk.com 17 Dec '03

17 Dec '03

> D. Owen Rowley () writes: > > I want privacy too, and I want as much free-wheeling as possible in the > > matrix. Personally I think that accountability is going to be required > > as the price for reasonably secure encryption, reasonably open access, > > and reasonably secure privacy of data. > Why should it be? Reasonably secure encryption, reasonably > open access, and reasonably secure privacy of data can all be > implemented without accountability. Yes, of course they can be implemented. > (I refer you to Public Key > cryptography, DC/Mix nets, and secret sharing) Perhaps in practice, > the majority of people will refuse to participate in such a network but > that does not stop crackers/pirates from using one. Crackers routinely > dick each other over because of lack of accountability, but the trade off > (getting free software/phone access) is better than (getting busted) Fine, spend your time in a network of this character. But I'm trying to inject some real world values into this issue. Heres a clue, when your just playing games, this scenario is fine, when its bigtime finance, industrial secrets and intellectual property with high value, and the process of managing these things, you will find that reliabile security will be the number one requirement. In my opinion, Accountability will win over anonymity if it comes down to a choice. > Do you think I am accountable? If I didn't put my real name in my > sig you'd never be able figure out who I really am. Not even gnu, who > graciously allows me use of their machines, has my real address or phone. > The annex port that I log in on is set up incorectly allowing me to > telnet anywhere without needing to use my student account (and thus not > linking rjc@ to my college where my really private info resides) I'm sure you are quite clever, there are lots of clever people around. > rjc@ is simply my pseudonym. I could be Bill Clinton and you > wouldn't know, so why worry about it? What keeps me in line in the > reputation linked to rjc@ which I have spent a long time building up. > Acting like an asshole and choosing a new account name would waste a lot > energy that I put into posting these years. This is all fine and good in regard to the narrow focus you take on where this technology is going, and what business needs from it. > > IMNSHO, it is unreasonable to expect an anarcho-libertarian outcome to > > these issues. If you can prove me wrong I will be thrilled. > You made the assertion, the proof is up to you. Sigh.. IMNSHO is an acronym for *In my NOT so humble opinion*. LUX ./. owen

1 0

Color Copiers/Re: jrk@sys.uea.ac.uk (Richard Kennaway)
by peb＠PROCASE.COM 17 Dec '03

17 Dec '03

Well, I'm glad to hear that use of color copiers isn't highly restricted, although there seems to be a good amount of misinformation (probably intentional from the SS). This is an example of a technology that cannot be controlled so the government uses warnings and threats. Similarly, (non-escrow) crypto could end up like this: penalties could be applied if it is used for illegal activity. If such a law were proposed, it would be difficult to oppose it on the basis of freedom of expression. Paul E. Baclace peb(a)procase.com

3 2

Re: backing?
by peb＠PROCASE.COM 17 Dec '03

17 Dec '03

>From: pmetzger(a)lehman.com >In every time and place that [gold backing] was eliminated, the currency >eventually collapsed Non-gold backed currency is reputation based. The debasement of a reputation based currency looks a lot like the game theory strategy of "tit for tat, but if you can get away with tricking them, go for it"; the tit for tat is needed to keep the reputation and works both ways: (1) if a currency issuer debases value relative to another currency issuer, people will switch money to the better currency (switching to a better reputation issuer, if possible), (2) counterfeiters are tracked down and stopped to uphold the reputation. The "if you can get away with tricking them, go for it" can be easily be performed when major currency issuers work together to debase all at the same time. Luckily, this kind of collusion doesn't hold together well (like OPEC). So we already have reputation based currency as represented by hard to reproduce paper. Similarly, a reputation based digital deposit could be built that is based on ordinary currency. (I view anonymous transaction as being completely orthogonal to this.) Paul E. Baclace peb(a)procase.com

1 0

Re: Crypto Anarchy (jrk@...)
by owen＠autodesk.com 17 Dec '03

17 Dec '03

> Undoubtedly we could launch into a discussion of why it is anybody > with a pocket full of change can walk up to a payphone and leave a > variety of threats at the whitehouse switchboard - the phone > company need not fear having its equipment seized, while a computer > used in forwarding mail containing the same threats will probably be > taken along with anything else the SS feels like taking. Did you forget that the phone companies have a long history of co-operation with federal authorities ? > >Quick -- how many remailers have the support of the university? How many > >boards of trustees -- at state universities, often linked to the government > >-- will back them, if the Secret Service ``requests'' that they be shut > >down. > Gee, I don't know. Does the phone company have any government deals, > say to manufacture products using a government designed chip, that may > be at risk if its found out that phone company equipment is constantly > being used for threats?? The phone companies have agreements with law enforcement that amount to the same thing! The reason that Law enforcement wants chip level intervention capability is that they fear loosing capabilities they already have! LUX ./. owen

1 0

Re: Uniqueness and "is-a-person" credentials
by cme＠ellisun.sw.stratus.com 17 Dec '03

17 Dec '03

>From: tcmay(a)netcom.com (Timothy C. May) >Message-Id: <9310181717.AA24067(a)netcom5.netcom.com> >Subject: Uniqueness and "is-a-person" credentials >Date: Mon, 18 Oct 93 10:17:35 PDT >I don't like the idea of state-run registries of "legal persons." >Better to live with the occasional vagaries of digital pseuodonyms >than to ban them. Amen. I kept trying to point out on pem-dev, until it became obvious that I was speaking a foreign language, that the identity *is* a person's public key. It's already unique and has a firm definition -- all the definition you need. It means: "the person or people who have access to the matching private key". That's all you need. Everything else comes from relationships and relationships are established by message transmissions and files of history. The flesh and blood body doesn't matter in cyberspace unless/until you start mixing the two worlds (eg., using money, trying to arrest someone, pairing up for a sexual fling, ...). - Carl

1 0

Re: Crypto Anarchy (jrk@...)
by catalyst-remailer＠netcom.com 17 Dec '03

17 Dec '03

smb(a)research.att.com wrote: >Do you want an example? Here's how to shut down an anonymous remailer. >First, find a name for a host that no longer exists. Send a note through >the remailer to someone putatively on that host, making it appear like >a stolen account (bin(a)foo.bar.edu, or some such). The mail should appear >to discuss criminal activity, and be signed with a name from the proper >ethnic group. The message will be queued forever, of course, and will >likely be stored on the backup tapes for the mail spool directory. Next, >send a message through the remailer to president(a)whitehouse.gov, threatening >the president. Poof -- the Secret Service *will* come investigating >(those guys have no sense of humor). They may or may not believe that >the planted note is genuine. But they will approach the appropriate dean >to demand that this tool of criminal activity be shut down. Well, this apocraphyl scene is easily avoided - remailers can be configured to refuse remailing to whitehouse.gov. But then this is the Secret Service. Are they more likely to a) seize all equipment peripherally related and a bunch that isn't b) inquire about having anonymous mail blocked Undoubtedly we could launch into a discussion of why it is anybody with a pocket full of change can walk up to a payphone and leave a variety of threats at the whitehouse switchboard - the phone company need not fear having its equipment seized, while a computer used in forwarding mail containing the same threats will probably be taken along with anything else the SS feels like taking. >Quick -- how many remailers have the support of the university? How many >boards of trustees -- at state universities, often linked to the government >-- will back them, if the Secret Service ``requests'' that they be shut >down. Gee, I don't know. Does the phone company have any government deals, say to manufacture products using a government designed chip, that may be at risk if its found out that phone company equipment is constantly being used for threats?? The point is we are in a research & development stage (if you will) with anonymous remailers, reputations, filters, digital cash, dc-nets, etc. It is very likely that the projected reality, desired reality, and actual reality will be quite different; nevertheless, experimentation continues.

3 2

Re: your mail Re: on anonymity, identity, reputation, and spoofing
by owen＠autodesk.com 17 Dec '03

17 Dec '03

> From: m5(a)vail.tivoli.com (Mike McNally) > D. Owen Rowley writes: > > Personally I think that accountability is going to be required as the > > price for reasonably secure encryption, reasonably open access, and > > reasonably secure privacy of data. IMNSHO, it is unreasonable to > > expect an anarcho-libertarian outcome to these issues. If you can > > prove me wrong I will be thrilled. > By whom is accountability going to be required? How will it (or how > can it) be implemented? What sort of mechanisms can be expected to > reliably and universally evolve in the decentralized anarchic network > we know today that will make "paying the price" a meaningful concept? > I con't prove you wrong because I cannot understand what you predict. The comercial use of internet is growing at a very fast rate, and it is predicted to overtake other uses in scope eventually. wide scale networks provide capabilitys which are very attractive to a variety of business enterprises. I suspect that a first pass will be made to try and use internet and the current suite of protocols and services as they are now. I also suspect that such attempts will flush out a whole raft of problems and deficiencies along with those who exploit such things. Hopefully new protocols and services can be developed which will minimise vulnerability and maximise protection for bussiness assets while allowing us as much freedom as possible. Nobody really knows what those things will be, and it is sorta problematic to make public laundrey lists of vulnerabilitys without some sort of idea how to deal with cleaning up the mess. We are going to have to learn by example. My main point though is that eventually business will find decentralised anarchic networks to be hostile territory, and will move on to less vulnerable, more reliable networks where user authentication, and accountable security are provided. It may be that there will be barriers between the anarchic networks and the business-place networks,that require users to provide proof of identity before they can pass. >>It seems to me that multimedia extensions have an *unfolding of the lotus >>like effect upon the issues involved. > Explain: is it because of the medium itself or because of the nature > of information that'll be available with multimedia delivery systems? yes. :-) seriously.. note that you asked "because of the medium itself". It's multiMedia, thats jargon for multiple mediums interacting with each other, and presenting data interactively on multiple fronts. It means an unfolding from two dimensional thinking ( text) to three dimensional thinking ( virtual reality ). > > I also see very little regarding potential for breaking the mind machine > > link, or biologic interfaces? > Uhhhh, OK. perhaps you are unaware of some of the more starling things that are being done with biofeedback interfaces. but even more simply than that.. lets take something mundane and achievable like hand gestures sensed by the data-glove. you want to get a privileged message to a colleague. If you can both access a data-space in real time and view an interactive simulation of each other in a prileged manner that insures no one else can capture and render either view, all you need to do is communicate via ASL or even a proprietary sign language, via the dataglove interface. this is very doable.. right now. let the Intelligence analysts chew on that! BTW, that scenario was suggested to me by an individual of my aquaintance who lives on the other side of the --uh-- tracks. he was very keen to be able to have such privileged communication, and cost is no factor to him, he pays in cash. (I should point out that I turned down the offer to contract the application) we are about to enter into an era of computing that provides quite a bit of potential to evade surveilance just because of the sheer multitude of possibilities. This is what is really driving those who want to do surveilance mad. Don't be surprsed if the ultimate result is draconian restriction in order to reduce the odds that are currently in our favor. Don't be surprised if you see your decentralised anarchic net go away and never return. LUX ./. owen

2 1

"Is-a-person" Credentials, Fiat-Shamir paper
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

A minor correction to my post: "...this stuff have access to the CRYPTO Proceedings at large university libraries, and the Fiat-Shamir paper is definitely a nice little ^^^^^^^^^^^^^^^^^^^^^^^^ intro, so I'm not sure it's worth the couple of hours it may take to get a good clean copy suitable for uploading to the list." I left out a "not, " which alters the meaning. What I meant to say is that the Fiat-Shamir paper is definitely *not* a nice little inro. It's an academic paperr, not a primer on is-a-person credentialling. Few primers on advanced cryptology exist, as I'm sure you've all noticed. I'll be interested to see Bruce Schneier's new book, "Practical Cryptography," to see if it covers any of these newer ideas. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. Note: I put time and money into writing this posting. I hope you enjoy it. -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. Note: I put time and money into writing this posting. I hope you enjoy it.

1 0