December 2003 - cypherpunks-legacy

Crypto Idea; Multi-Part Sigs
by nobody＠alumni.cco.caltech.edu 17 Dec '03

17 Dec '03

I've been thinking of an idea I've heard kicking around the list somewhat; that of digital pseudonyms and groups of people going by one name; likewise single people going by names that sound like groups. Let's say that three people decide to create a digital identity for themselves, maybe they plan on dealing with Blacknet as a group. So one of the first things they might do after getting together might be to create a pgp keypair with the name of the group on it. But who gets to hold the secret key? Remember they wish to be thought of and treated like a single entity. However they all need to be able to decrypt documents addressed to them, and none of them should be able to sign a document without the consent of the others. Is it possible to produce a set of keys (for example, 3 private 1 public) such that -all three private keys are needed to sign a message from that I.D. and -any of the private keys can decrypt anything encrypted with the single pubkey. The way I see it, three (or more) people could have a joint keyID, and if they wanted to post a message from that ID, the first person would write the message and sign it with his/her segment of the key. She/he would then encrypt with the second member's pubkey and annonymously remail it to #2, who would sign with the second key segment, re-encrypt with #3's pubkey, and send it on to #3, who would sign with the final key segment and anonymously post to the 'Pool'. If a response were posted, all three could read it without depending on the others. Is this possible? In whole or in part? I don't know the math well enough to figure it out myself, sorry if this is an obvious one. Happy Hunting, -Chris <cdodhner(a)indirect.com> ______________________________________________________________________________ Christian Douglas Odhner | "The NSA can have my secret key when they pry cdodhner(a)indirect.com | it from my cold, dead, hands... But they shall pgp 2.3 public key by finger | NEVER have the password it's encrypted with!" "If guns are outlawed, only the government will have guns." -E. Abbey My opinions are shareware. For a registered copy, send me 15$ in DigiCash. Key fingerprint = 58 62 A2 84 FD 4F 56 38 82 69 6F 08 E4 F1 79 11 ------------------------------------------------------------------------------

2 1

More Anonymous "Annoyance"
by anonymous＠extropia.wimsey.com 17 Dec '03

17 Dec '03

> First of all, the Connecticut case you seem to be referring to is that > of Michael Elansky (Hartford). See Computer Underground Digest for > full details. This was *not* email. He had file downloads and kept > around (uh) "fireworks recipes". I did not say it was e-mail; I said it was _traffic_. The uploading and downloading of files constitutes traffic. > We've got to track down these supposed cases where boards were seized > for content. Elansky was busted for a very juvenile anti-cop rant, according to one news release I read regarding the case. As I remember, this was written by a caller rather than by Elansky. >I consider them minor *anomalies*, and I think a rational > analysis of statistics will bear that out. They are anomalies until they happen to you, at which point they become _major disasters_. For every bust there must be many more cases of harassment. > Turning a board into a > systematic exercise in privacy violation is *not* the proper response > to paranoia about law enforcement seizures. This punishes users for > the misdeeds of overzealous officers. Here's a hot message from the real world. Feel free to print it out and attach it to the bathroom window so that you may save the personal expense of buying a clue: Ultimately: The Law is irrelevant. Right and Wrong are irrelevant. Your "rights" are irrelevant. Ethical niceties are irrelevant. Mishnaic wrangling over gored oxes is irrelevant. Offended high principle is irrelevant. All that is relevant is what _happens_ to you. When the cops show up, you've _already_ lost. I have been watching Law, Office and Power abuse the innocent without remedy my entire life. The future promises more rather than less of this, in not the least of theatres than that of digital information transfer. The Elansky case appears to be nonsense from this remove, something no reasonable Constitutionalist would entertain for five minutes. Despite this, Elansky was held on one half million dollars bail. It is extremely unlikely that he will find remedy, or that his young life will return to normal any time soon. At best, the charges against him will be dropped, after traumatizing his family and exhausting their finances. He cannot win and "law enforcement" cannot lose, however absurd the charges against him actually are. I wonder how many BBSs were shut down, or began rigorously "self-censoring," as a result of the Elansky publicity. Unlike Internet's government and business sites that can hide behind their size, or institutions of Higher Ignorance that can shield themselves behind "academic freedom," the hobbyist BBS is a sitting duck for any ambitious crank with a badge and an axe to grind. A small California network, "NirvanaNet," that features encryption, radical political discussion and "dangerous" text files had their home node visited by the FBI earlier this year and in short order were libeled in the local press in an inflammatory hatchet-piece as (and I quote) "a clearinghouse for crime," despite the fact that no charges were filed nor any criminal activity detected on the part of any individual caller. This harassment is probably more common than we guess. There are a couple of other cases I know of personally. The chilling effect it has is incalculable. At least one NirvanaNet node went off line almost immediately, another moved and there was an apparent inventory made of the filebase with some judicious culling. The effect - ultimately - is that it is safer for a BBS operator to risk violating a caller's rights than to face trouble from the authorities on some fishing expedition. Check it out: Earlier this year, the sysop of a BBS affiliated with an NPR FM station discovered that two users had been using PGP for private messages for some months. Despite the fact that the BBS had never had a policy on encryption, nor had any request been made by the sysop to cease PGP traffic, both callers discovered their accounts deleted without notice, their access denied and all public and private messages ever made to or from either caller erased from the system. After some time, the sysop announced that he felt that PGP was a threat to his BBS (and the radio station) and that he had expelled those users without notice. The traffic, as it turned out, consisted of the development and testing of an e-mail PGP adaptation for QEdit, a popular text editor used in offline reader programs. Much of the work resident in the BBS was destroyed. In the uproar that followed, the panicked sysop secretly distributed forged messages alleged to be from one of the parties, apparently to justify his expulsion. The fascinating thing was that when all of this came to light and the offended parties talked of seeking legal remedy, other sysops with critical knowledge of the affair refused to co-operate, believing that even though the offending sysop was absolutely in the wrong, bringing legal action against him _threatened the BBS community at large_. The message was clear, "Don't make a big _schande_ out of this..." "I don't care if he did lift your wallet, don't call the cops and break up the party." This is the ultimate effect that meritless law enforcement harassment has had on the BBS community. > Don't these Fidonet operators *understand* that by perpetuating the > myth that they are responsible for all traffic on their machines, that > they are actually *playing into* the hands of authorities? they are > *strengthening* the paranoid atmosphere. And in fact I am quite > repulsed by their policies, posted here, that seem to cutely > rationalize systematic invasion of privacy. Yes, they know it, but they also know that, in the minds of most lowbrow law-enforcement personnel, encryption is synonymous with criminal activity. They don't want heat. _When the cops come, you've already lost_. The only question is how badly. These sysops are usually scrimping and saving for a new modem; they can't afford lawyers. _To law enforcement, snooping around the messagebase looking for criminal activity is infinitely more civic-minded and responsible than permitting secure encryption._ Policing your callers shows more good faith (to Constable Bubba) than permitting them terrorist PGP. If it comes down to either having a caller pissed off or having the cops pissed off, the bigger threat is obvious to even a seventeen-year-old Trekkie with zits and a BBS running on his dad's old XT. There may be a theoretical application of the ECPA that suggests a right of some non-paying parasite to use PGP on your personally-owned BBS, but it doesn't seem to account for much compared to a visit from knuckle- dragging local cops responding to a busibody mom's hysterical complaint that her kid is being sucked into a secret ring of computer terrorists who use "spy codes." Everyone from the NSA to the Sacramento County Sheriff's Department has it out for PGP, and the SCSD's public pronouncements and name-calling at Zimmermann no doubt have been filtering down through law enforcement channels to Constable Bubba with the message that PGP is "some computer thing" associated with California child pornography rings. Great. Just what you want on your kid's hobby BBS in small-town Alabama.

2 1

unsubscribe
by Tiffany Lee Brown 17 Dec '03

17 Dec '03

please drop me from the list ... magdalen(a)well.sf.ca.us .... there's just not enough flaming on the list! (heh).

1 0

criminal gif upload
by nobody＠rosebud.ee.uh.edu 17 Dec '03

17 Dec '03

> ************************************************************ > ***VERY IMPORTANT*** Critical Files to Remove from Your BBS > ************************************************************ fuck that, just point me at them gifs. henh henh hmm hmm hmm.

3 3

Criminal gif's
by cdmorgan＠mosaic.uncc.edu 17 Dec '03

17 Dec '03

Look around there everywhere In fcat those are not so bad L8r Charles

1 0

digital cash
by ssteele＠eff.org 17 Dec '03

17 Dec '03

Hey 'punks. Anyone know of an elementary primer on digital cash? I'm trying to get up to speed on this. You can send me private e-mail at ssteele(a)eff.org. Thanks! Shari

1 0

unsub
by dobrowol＠husc.harvard.edu 17 Dec '03

17 Dec '03

Please take me off the list. Txanx a lot.

1 0

REFERENCE: Data Communications Int'l - August
by cypher01＠eternity.demon.co.uk 17 Dec '03

17 Dec '03

McGraw Hill's *Data Communications* magazine (int'l edition) of August '93 has a long and informative article on the Clipper issue. Reference: "Clinton's Clipper: Can It Keep a Secret? - The administration's new encryption chip should have been code-named 'Controversy'" by Salvatore Salamone *Data Communications*, August 1993 pp 53-54, 56, 58 Vol. 22, No. 11 ISSN 0363-6399 No mention is made of PGP. However, general DES and RSA are covered in some detail, with some mention made of DSS. Russell Earl Whitaker whitaker(a)eternity.demon.co.uk Communications Editor AMiX: RWhitaker EXTROPY: The Journal of Transhumanist Thought Board member, Extropy Institute (ExI) Co-organizer, 1st European Conference on Computers, Freedom and Privacy, London, 20 November 1993

1 0

subscribe please
by John Gibb - Computer Centre 17 Dec '03

17 Dec '03

subscribe jon(a)cs.paisley.ac.uk quit (That's if this is NOT an invite only mail list)

1 0

Re: EFF GIF file recall notice: is EFF the new CERT?
by ssteele＠eff.org 17 Dec '03

17 Dec '03

I included the GIF warning in EFFector Online for unsuspecting BBS operators. Child pornography is not protected speech, and challenging child pornography laws is not currently on EFF's agenda -- but protecting BBS sysops from having their systems seized is. I figured those who sought to challenge the child pornography laws would poo poo the message. I guess I figured right. BTW, before I ran the article, Mike Godwin and I had a discussion about whether the *cops* would be angry, thinking we were obstructing justice. I guess I just can't win! I'd like to request that this discussion be taken off the cypherpunks list, since it is not on point to the list. O.k. by you? Shari

1 0