December 2003 - cypherpunks-legacy

Magic money not working bigendian
by qwerty-remailer＠netcom.com 17 Dec '03

17 Dec '03

I have not been able to get Magic Money to work right in big-endian mode using pgptl10c.zip and mgmny10d.zip. It does not work with either -DHIGHFIRST or -DHIGHFIRST plus -DHIGH_KLUDGE. The key generation seems to go OK, but then when I "mint" a coins.dat file with 6 coins in the server and try reading it in the client, all coins after the first are said to have bad signature. I have tried it with both 512 and 1024 bit keys and both fail. The previous version of magicmny.zip worked OK.

4 3

Re: Oh No! Nazis on the Nets
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

> I will note, however, that the U.S. has far better press freedoms than > almost any other country on earth, and that Germany is pretty damn bad > about freedom of the press. I can walk into any book store in America > and buy a copy of Mein Kampf -- and although I hate Adolf Hitler's > works, I am happy that I can read them if I so choose. I cannot do > things like that in Germany. I don't know at the moment whether it is allowed to sell "Mein Kampf", but what is the question: One says that in Germany nobody cares about the right-wing, the other says that you can't buy such books. What do you expect? Shall we care or not? We can't fight again right-wing people and sell such books! I'm sure that american press freedom is not better than german ones. Seen from Germany, american presidents elections look like a mixture of a football game and a tv show. Is is possible that we have different oppinions about 'democracy' ? (I'm sure german elections don't look better for americans...) And there is another difference: In Germany I can get my Cryptosoftware from whereever I want, I can give my software to whereever I want and I can write a PhotoCD decoder. [ ;-) ] In Germany it is always surprising what american people don't know about Germany. How many of you think that we wear trousers of leather, eat Sauerkraut and have women with blond plaits and name "Gretchen" all the time, not without a "Kuckucksuhr" at the wall? Hadmut

4 5

Re: Oh No! Nazis on the Nets
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

Mike McNally writes: > Really? So your only defense against ideas you don't like is to make > the dissemination of the ideas illegal? Clearly there are values you > rate higher than press freedom. (That's not necessarily bad, though I > personally don't like it.) I never said this. Why do you think it is the only defense? Why do you all mix ideas with calls for killing people? Isn't it a difference whether I publish an idea or whether I pray killing people? Is this allowed in your country? You all seem to have a nice patent for defense against Nazis. Why don't you tell/sell us this patent? It could be very helpfull. Don't you believe that we are interested in a free press? Don't you believe that we want to fight against Naziism? How do you fight against your Nazis? > Sorry, but if you have to go to some office and ensure them you're > following the "rules of newspapers" or whatever, then that statement > is incorrect. Arrrrrghl! Stop this stupid tale! Do you want to play silly games with me? Who did you tell that you have to go to any office in germany? > I can this instant decide to print out thousands of > copies of whatever I want, drive down to some public area, and start > handing out my documents (or charging for them), all without a visit > to a government office. That's not illegal. Only "pornographic" > material is inherently illegal to distribute . Exactly the same as in Germany! Many people do this! We printed papers at the school, we print papers at the university, we do it everywhere. Print anything with your computer, go to the next copy-machine. Print as much as you can pay and carry and give it to everyone you want. It happens nearly every day. When I began to study at this university I got my half bag full of papers in the mensa every day. Meanwhile they are printing less because noone reads them all, you can't read them all, they are too many. At the first day at this university I got invitations from two groups of homosexual groups, one invitiation of the lesbians group, about 20 invitations of political groups and a lot of paper I didn't even look at. > > Seen from Germany, american presidents elections look like a mixture > > of a football game and a tv show. > > What does that have to do with press freedoms? What is the use of press freedom if the press doesn't use it? > Actually, we don't see much about German elections; there's not enough > airtime between the football games and TV shows. I'm sure you don't see much about Germany at all. Where did you get all those stories? > So can I in the US---today. The problems spring up when I try to > export what I write. Is this what you call press freedom? Hadmut

6 5

CFI- Foreign Available Cryptography Resources
by cfrye＠ciis.mitre.org 17 Dec '03

17 Dec '03

The Clinton Administration has transformed its Clipper/Capstone proposal into a definitive policy that could pave the way for banning all non-Clipper crytography in the United States. I agree with most everyone who reads these groups: the thought scares the hell out of me, especially given the "fight crime" mandate from recent public opinion polls. I posted some of these thoughts in response to David Banisar's 7 February press release on CPSR's reaction to the announcement. In that post, I offered to compile a list of cryptographic tools and resources that were available outside of the United States (i.e., machines not physically located in the US) if such a list hadn't already been done. Stanton McClandish indicated that it hadn't and urged me to "GO FOR IT!". I'm going for it, but I need your help. My work account with ftp access will go away this Friday and the dial-up lines to my school account are constantly busy. I should have a digex.com account within the next two weeks, but until then I won't have reliable archie/veronica/gopher access to the Internet. That's one reason I'm asking for help (the other is the sheer enormity of searching every non-US machine). If you live outside of the US or visit non-US machines on occasion and know they store crypto resources, please send me a directory listing at this email address (for now). Also, if there are any readme files or other program descriptions in those directories, I would appreciate receiving an electronic copy of them as well. Furthermore, if any of you have product information about foreign-made cryptographic equipment or software, I would be interested in seeing that as well. I can be reached by snail mail at: Curtis D. Frye 100 Yeonas Cir. SE Vienna, VA 22180 USA I look forward to your support and hope to report back in a few weeks with some preliminary results. Curtis D. Frye PRIVATE! Citizen I don't speak for MITRE, they don't speak for me.

2 1

Strategies for getting encryption in widespread use QUICKLY
by Bryan Ford 17 Dec '03

17 Dec '03

I recently sent a version of this message to Stanton McCandlish in response to EFF's call for support on the Cantwell bill; he said you people would probably be most interested in the idea. I was planning to sit quietly for a few weeks, watch the list, and make sure it's not just old news here before opening my big mouth. But seeing the volume of the list I may not last that long, so I'll post now. :-) --- It seems like the most effective way to fight Clipper would be to ensure that by the time the government has a chance to impose any effective controls, strong public encryption is in wide enough use to make such controls completely unenforceable. While encouraging people to always encrypt their E-mail might seem the most straightforward way to do this, most people just aren't interested enough and don't see a threat in leaving their mail open, and encryption is still inconvenient. An approach introducing encryption into some other aspect of information transfer, where it is more immediately and obviously useful, might be more successful in the short term. One of the most popular uses of the Internet is for distribution of free software, both in binary and source form. It would make the lives of many people much easier if the downloading and installation process could be made more automatic. Right now if I want to always have the latest version of GCC on my Linux box at home, I have to watch the right newsgroup for announcements, FTP to the right site, download the new version, unzip, untar, and install it (not to mention compiling it if I get a source code distribution). This is not too bad by itself, but it gets inconvenient on a "real" system containing hundreds of packages to be kept up-to-date, a new version of one coming out every day or two. It shouldn't be too difficult to automate this monitoring, downloading, and installation process, especially for binary distributions that require no complicated configuration or build sequence. But suggest this to most anyone, and they'll immediately get jittery with fear about trojan horses, viruses, and every other attach known. This is where encryption technology (specifically, public-key-based signatures) could come in. Unlike with E-mail privacy, where most people don't get a really tangible benefit, in this case encryption could be a real enabling technology: it would allow people to do what they couldn't (or wouldn't dare) do before. If it was done right, in a way that people can trust, people _would_ use it because it would make their lives easier, not more complicated. Before I get into any more detail, I want to hear what you all think about the general idea, so I'll leave it at that for now. Thanks! Bryan Ford --- Bryan Ford baford(a)cs.utah.edu University of Utah, CSS `finger baford(a)schirf.cs.utah.edu' for PGP key and other info.

6 7

unsubscribe
by katz＠spectrum.cs.bucknell.edu 17 Dec '03

17 Dec '03

unsubscribe me please

1 0

PFF's Jeff Eisenach: "Time to Walk the Walk on Telecom Policy"
by Declan McCullagh 17 Dec '03

17 Dec '03

--------- July 2,1997 Time to Walk the Walk on Telecom Policy by Jeffrey A. Eisenach The Progress & Freedom Foundation Thanks to Ira Magaziner -- of all people -- the Clinton Administration has finally learned to talk the free market talk that brings joy to denizens of the Internet. Now, as always with this Administration, the question is whether it will also walk the walk. Magaziner deserves real credit for crafting the Administration's new "Framework for Global Electronic Commerce." In language that could have come from the Cato Institute (or my own Progress & Freedom Foundation), it credits the amazing growth of the Internet to the relative absence of intrusive government regulation. And it concludes that the Internet should remain "a market-driven arena, not one that operates as a regulated industry." The paper -- and the process that created it -- has already had a salutary impact on Administration policy. The White House has now backed away from its previous support of the Communications Decency Act in favor of "industry self-regulation, adoption of competing rating systems and development of easy-to-use technical solutions." And last month, Treasury Undersecretary Larry Summers, reportedly at Magaziner's urging, had very positive things to say about the "no new taxes on the Internet" legislation sponsored by Congressman Chris Cox and Senator Ron Wyden. The Administration's conversion to a free market view of the Internet is, however, far from complete -- even rhetorically. Most importantly, the Framework's treatment of telecommunications regulation amounts to an endorsement of the Federal Communications current policies -- policies that are, if anything, more regulatory than before passage of the supposedly deregulatory Telecommunications Act of 1996. Following the path laid out by Vice President Gore and outgoing FCC Chairman Reed Hundt, the Framework ignores the fact that technological innovation is rapidly ending the "natural monopoly" characteristics of the market for local telephone (and Internet) access. What government should be doing in this context is allowing marketplace incentives to work, thereby encouraging new technologies and new competitors to turn the potential for local access competition into a reality. What it is doing, under the FCC and with the apparent blessing of the Framework, is continuing a price regulatory regime that destroys marketplace incentives for the development of new technologies and competitors. The Framework, which begins by stating that "government attempts to regulate are likely to be outmoded by the time they are finally enacted," ends up endorsing the idea of "implementing, by an independent regulator, pro-competitive and flexible regulation that keeps pace with technological development." Nice fantasy -- but in contrast to the reality of the FCC's implementation of the Telecommunications Act, it comes off as nothing but a bad joke. Telecommunications is not the only problem area with respect to policy. Most notable among the others: Encryption, where the Administration stubbornly adheres to its unworkable, privacy-invading notion of "key escrow" for encryption software -- i.e., giving the police the key to your house in advance in case they decide later they want to conduct a search. Still, problems aside, what we have from the Clinton Administration is a real and laudable move -- partly rhetorical and partly real -- in the direction of less regulation of the Internet. For the most part, the Administration is now talking the deregulatory talk. Will it also walk the walk? Here are three giant steps that would go along way to proving the Administration means what it says. First, will the Administration appoint a new FCC (there are four vacancies, including the chairmanship) that understands the idea of dynamic competition to erode natural monopolies? The FCC's current "managed competition" approach is inconsistent with the broader principles of the Framework and hugely destructive to the innovation and entrepreneurship the paper emphasizes so strongly. A new Commission would no doubt want to re-think the Commission's recent rulings with respect to Interconnection and Universal Service, both of which represent massively regulatory approaches to problems the free market can largely solve. Secondly, will it specifically endorse the Cox-Wyden legislation prohibiting discriminatory taxation of the Internet? Saying nice things about the bill is one thing; endorsing it and working for passage is something else. Third, will the Administration support the new legislative agenda being developed and soon to be introduced by Senator Conrad Burns and Congressman Billy Tauzin (chairs of the Senate and House telecommunications subcommittees)? Among other things, this legislation is expected to declare "enhanced services" (including broadband Internet access services) an essentially regulation-free zone -- exactly the sort of thing the Framework says the Administration should support. Free marketers want to believe the Administration has seen the light on regulating the Internet. Our message now is simple: Take three giant steps -- and throw away on the key on key escrow -- and show us you really mean it. ###

7 11

Re: Clipper and Traffic Analysis
by smb＠research.att.com 17 Dec '03

17 Dec '03

> Also, it probably goes via a different physical path. And at least some > SS7 trunks are encrypted with DES. Care to say anything about which ones are encrypted and why? Or to ask it another way, who decides? I phrased it that way because I'm not certain of the extent, and I'm not certain how much of what I know is AT&T-proprietary. But the obvious risks that encryption avoids are traffic analysis by enemies (pick your own definition of enemy), information on what channels to wiretap (remember the furor a few years ago about the location of the then-Soviet embassy on a hilltop in Washington, D.C.?), and the threat of phone-phreaking by introducing bogus call setup messages. On the latter point, recall that out-of-band signaling was introduced in part in response to ``blue boxes'' and other device that exploited in-band signaling technologies.

1 0

Barlow article on Clipper
by Mike Godwin 17 Dec '03

17 Dec '03

Forwarded message:

1 0

Magic Money and Remailers
by remailer＠merde.dis.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Tim May wrote: >Subject: Simplified Digital Postage--Proposal >... A more sophisticated system based on true digital cash, perhaps >based on Magic Money," is more desirable, but almost anything is better >than the current system. (Well, not _anything_.) >I propose remailers immediately adopt some form of digital >money/postage, even if current instantiations are not fully debugged >or optimized. "Magic Money" may be ready for such a trial use. Magic Money will have to be modified for that use. As it works now, clients A and B are using a common server S's coins. Client A wants to pay client B some money. Client A sends client B the coins. Client B sends the coins along with new, blinded but unsigned coins, to server S. Server S checks the old coins, signs the new ones, and sends them back to client B. This leaves two options: A) The remailer is the server. In this case, you don't need Magic Money, just a straightforward blind signature system, and I could write that if someone could describe in detail what they want it to do. The remailer operator could write it too, using PGP Tools and Magic Money source code as a basis. B) There is a third party server, and all remailers use its coins. In this case, the remailers have to mail the coins to the server and get the server to verify the coins before remailing the message. A good way to set up a time lag, but pretty complicated for an all-automatic system (the client would have to be modified, too) and lost mail from the server would wreck the system. First someone has to set up a Magic Money server, which so far nobody has. >- subtle flaws in digital money protocols (and I doubt "Magic Money" >is completely free of subtle or not-so-subtle flaws...everything needs >debugging and evolutionary learning) will not be so serious when only >"postage" is involved. As opposed to "real money" situations, where >finding a way to break or spoof the protocol could result in large >amounts of money being lost. At least with digital postage, about the >worst that could happen is someone gets free remailing--the current >situation. Magic Money isn't too bad in security. It uses Chaum online cash: a random number x, MD5(x) put in a properly padded signature packet and blindsigned by the server, and different e/d pairs for different denominations. Messages to the server are encrypted with the server's PGP key, and the server's replies are encrypted with the client's PGP key (provided in the original message) and signed with the server's key. >How ready is Magic Money for a test-bed use like this? Right now it's designed to allow people to pass coins between each other, but the code could be hacked to accept coins automatically. I have mixed emotions about pay-per access (to remailers or anything else) but I am interested enough in seeing digital cash experimentation to write the code now and worry about the ideology later. >- and of course, a charge of, say, $2.00 in real money (send in $20, >get bact 10 remailer "stamps" of some form, suitably anonymized >through a blinding procedure a la Chaum) would mean that posting to 20 >newsgroups would be a nontrivial expense for a would-be flooder. Everyone would use the free remailers rather than pay $2. Both Chaum and RSA would jump on you if real money was involved. What about just having a finite number of stamps going around, to prevent mailbombing? Here's an anonymity-breaking attack I've been worrying about: In an untraceable digicash system, deposits cannot be matched to withdrawals, so the bank cannot find out where a customer spends money. However, the bank in collaboration with a payer can determine who deposits a particular coin. Suppose you are providing a non-approved service or product, using remailers and digital cash to protect your identity. Someone wants to trace you. All they have to do is set up a sting: buy your service with coins which are recorded, and get the bank to identify who cashes in those coins. To prevent this, the bank cannot know who deposits particular coins. The bank cannot know who any of its accountholders are. Being an accountless system, Magic Money can be operated through a remailer. But Magic Money is an online system. Offline systems depend on the bank knowing who the customers are, and being able to punish them for double spending. How could an offline system be made immune to this attack? I don't know about remailers, but I wish someone would set up a Magic Money server. I haven't heard much about Magic Money on the list lately. That could be good (the code works) or bad (nobody cares). Which is it? BTW the latest versions are PGPTL10C and MGMNY10E. Pr0duct Cypher -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLWGqBMGoFIWXVYodAQEFjAP/SvhcAGk4ZGuvDaFN9oNiTtZi0Yhf1Q63 ARqSJgHGtrwsMxoxKnT5cuErjoV3+ba0b7Id49apq6zdS6W7UVo6Gpm5WIxfIOui V6VeFlYE5Wry4YKrMahjYCd4th80hWLWpgcGcjCw0WqmESfR0i8jLVpiKzwB0cKO VldNKHU4/GY= =7EVp -----END PGP SIGNATURE-----

2 1