December 2003 - cypherpunks-legacy

Valid MacPGP??
by habs＠warwick.com 17 Dec '03

17 Dec '03

Hi, I am trying to verify the current version of MacPGP I am using. I haven't found the binary file to be signed in anyway. Is MagPGP signed? If so how do I check and/or where do I look? Next question: Who has signed it? /hawk

2 1

Well users loose for now
by hugh＠ecotone.toad.com 17 Dec '03

17 Dec '03

The Well has two IP feeds into the internet, due to political/biz_profit/sysadmin problems the two feeds do NOT back each other up, and the one that can be seen from toad.com has been down for a few days, thus blocking your email. If the feed comes up today, well.com based subscribers to cypherpunks should get all of the list traffic in one big burst, if it stays down much longer then the toad.com mailer will start trashing the older mail (and bug us about each lost message). This points to an interesting problem, TCP/IP is very good at getting data from point A to point B, so good that a month of bombing by the Department of War does not destroy network conductivity. Yet here in the (so very rich) USA we have lots lots of outages to parts of the net because TCP/IP does not solve the problem of PAYING for getting packets where they belong. This is a protocol issue on two levels, the first is that the idea of accounting for packets/bandwidth/capacity (in some unknown manner) was left out of TCP/IP in the first place. The second is that it is going to be a very large amount of work to replace the current plant of TCP/IP hardware and software as none of these protocols are negotiated, just presumed to be the only way to do things. If we build systems like these, then they will be 'brittle' and might inspire a few folks but not be usable by most, and some other (large) organization will build what it wants on top of our dreams rubble. There is little chance that I will ever use a monetary system that is so brittle that it fails if one link is down or one cypher unuseable due to it's being cracked by some unscrupulous agency. This important subject of protocols is the topic of the next San Francisco Bay Area Cypherpunks meeting. ||ugh Daniel Sometimes Postmaster hugh(a)toad.com

1 0

Re: Why Digital Cash is Not Being Used
by dmandl＠lehman.com 17 Dec '03

17 Dec '03

From: "Michael V. Caprio Jr." <mikecap(a)wpi.edu> > > So what is the natural currency to trade in on the Internet? What is the > medium that is most widely spread across the myriad nodes and networks that > crisscross the globe? Hot air? --Dave.

2 1

Re: TLAs, etc.
by juola＠bruno.cs.colorado.edu 17 Dec '03

17 Dec '03

Actually, we might try inviting such prosecution -- e.g., with each of us posting source code for some algorithm to the list. This is so clearly publication (ala newsletters on paper) that the case would never hold but it wouldn't hurt to have a court rule. I wish I had your faith in the court system -- or perhaps I'm glad I don't. Either way, the fact that you and I and everyone on cypherpunks thinks that posting code to a private mailing list is "publication" means exactly nothing in court, any more than it would be if I made a huge conference call to everyone on cypherpunks to conspire to evade the ITAR regulations. - kitten

1 0

PKP licensing of RSA
by Bruce C. Dovala 17 Dec '03

17 Dec '03

Hi all, Just what may be a stupid question concerning licensing of the RSA algorithm from PKP. I have friends who would like to use freeware PGP but are hesitant to do so because of _possible_ patent infringement against PKP. On the other hand, they aren't crazy about paying $100 for the ViaCrypt version. (And that price will increase shortly, I believe. Does anyone know if PKP will directly license RSA for single-user use? (In other words, get the freeware version of PGP and then get a license from PKP to use it "legally"). I would imagine the license would cost less than $100 if available (why do I doubt that ViaCrypt is in this for their health?). Yes, I realize that this would mean there would be a record of licensees. And if the government chose to make "non-Clipper" encryption illegal in the future, they would have a list of people to investigate. A LONG list. Included on which would be all cypherpunks and everyone who bought a copy of ViaCrypt PGP. So what are they going to do about it? I think it is well out of their control. It would be politically unsound to investigate all registered ViaCrypt users. Obviously, this question is for the benefit of those who, for whatever reason, must remain "strictly legal". But who don't care to pay $100 for ViaCrypt's version. People who are willing to use the unlicensed freeware version (not like _I_ ever would ;) ), could continue to do so. Maybe I'm way off-base here. Don't flame me, just correct my thinking. (Though I am wearing my Nomex suit!) Thanks for any intelligent replies, Bruce

3 2

Re: Giving Value to Digital Cash
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Perry writes: > > Most major economies are using fiat money today, so it is clear that > > fiat money will work. > > Fiat money works because guns are used to force people to accept it. > You have to pay your taxes in it, the laws are written so that all > commercial paper requires that you use it, the government makes all > its purchases in it, etc. The result of this is that it is accepted. > It is substantially harder for people to accept fiat money that > doesn't have guns barrels backing it up. Fiat money works because people can get other people to accept it, though guns are a popular way of making that happen. Most major economies use it because it's a good deal for guys with guns. You don't have to pay taxes in fiat money in the US; they'll accept real gold or silver money if you want to use it instead of the cheap paper. It's still legal _payment_ for debts, as opposed to mere tender like greenbacks. But bad money does drive out good, so people spend fiat money. Green stamps were fiat money, but somewhat useful once. US postage stamps are fiat money, and they do use guns to prevent other people from offering competing mail service, but people will often accept them as money for small purchases; it used to be a popular way of sending small payments by mail before checking accounts became nearly universal. Bill

1 0

Hacking the ITARs
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

> This is sick. According to this, I cannot teach > foreigners about cryptography in the U.S. -- even about > the open literature. This is a grotesque denial of my > first amendment rights. > > I wonder if I should hold an open enrollment cryptography > class for the sake of civil disobediance. > > Perry It not as bad as that. Well, actually, it's hard to say just how bad it is because the ITAR regulations regarding cryptography are contradictory. It might depends on whether the class teaches only from a book, or actually lets the foreign students write and exchanged programs. Here are the relevant paragraphs from the ITAR: (the terms to keep track of are - defense article, defense service, technical data, and information) ---------------------------------------------- #120.5 Relation to regulations of other agencies. If an article or service is covered by the U.S. Munitions List, its export is regulated by the Department of State... #120.6 Defense article. Defense article means any item or technical data designated in #121.1 of this subchapter. The policy described in #120.3 is applicable to designations of additional items. This term includes technical data recorded or stored in any physical form, models, mockups or other items that reveal technical data directly relating to items designed in #121.1 of this subchapter. It does not include basic marketing information on function or purpose or general system descriptions. #120.9 Defense service. (already posted this) (1) The furnishing of assistance (including training) to foreign persons, whether in the United States or abroad in the design, development, engineering, manufacture, production, assembly, testing, repair, maintenance, modification, operation, demilitarization, destruction, processing, or use of defense articles; or (2) The furnishing to foreign persons of any technical data controlled under this subchapter (see #120.10), whether in the United States or abroad. #120.10 Technical data. (1) Information, other than software as defined in #120.10(4), which is required for the design development, production, manufacture, assembly, operation, repair, testing, maintenance or modification of defense articles, This includes information in the form of blueprints, drawings, photographs, plans, instructions and documentation. (2) Classified information relating to defense articles and defense services; (3) Information covered by an invention secrecy order; (4) Software as defined in #121.8(f) of this subchapter directly related to defense articles; (5) [** deferred, see below **] #121.8 (f) Software includes but is not limited to the system functional design, logic flow, algorithms, application programs, operating systems and support software for design, implementation, test, operation, diagnosis and repair. #121.1 General. The United States munitions list. (a) The following articles, services and related technical data are designated as defense articles and defense services pursuant to sections 38 and 47(7) of the Arms Export Control Act. . . . Category XIII -- Auxiliary Military Equipment . . (1) Cryptographic [ ] systems [ ] or software with the capability of maintaining secrecy or confidentiality of information or information systems, except cryptographic equipment and software as follows: . . . (v) Limited to access control, such as...or similar data to prevent unauthorized access to facilities but does not allow for encryption of files or text, except as directly related to the password or PIN protection. (vi) Limited to data authentication which calculates a Message Authentication Code (MAC) or similar result to ensure no alteration of text has taken place, or to authenticate users, but does not allow for encryption of data, text or other media other than that needed for the authentication. ---------------------------------------------- The ITAR sections I just quoted seems to state quite clearly that cryptographic information and software systems are export controlled. However...the section I deferred. ---------------------------------------------- #120.10 Technical data. ... (5) This definition does not include information concerning general scientific, mathematical or engineering principals commonly taught in schools, colleges and universities or information in the public domain as defined in #120.11. #121.11 Public domain. Public domain means information which is published and which is generally accessible or available to the public: (1) Through sales at newsstands and bookstores; (2) Through subscriptions which are available without restriction to any individual who desires to obtain or purchase the published information; (3) Through second class mailing privileges granted by the U.S. Government; (4) At libraries open to the public or from which the public can obtain documents; (5) Through patents available at any patent office; (6) Through unlimited distribution at a conference, meeting, seminar, trade show or exhibition, generally accessible to the public, in the United States; (7) Through public release (i.e., unlimited distribution) in any form (e.g., not necessarily in published form) after approval by the cognizant U.S. government department or agency (see also #125.4(b){13} of this subchapter); (8) Through fundamental research in science and engineering at accredited institutions of higher learning in the U.S., where the resulting information is ordinarily published and shared broadly in the scientific community. Fundamental research is defined to mean basic and applied research in science and engineering where the resulting information is ordinarily published and shared broadly in the scientific community, as distinguished from research the results of which are restricted for proprietary reasons or specific U.S. Government access and dissemination controls. University research will not be considered fundamental research if: (i) The University or its researchers accept other restrictions on publication of scientific and technical information resulting from the project or activity, or (ii) The research is funded by the U.S. Government and specific access and dissemination controls protecting information resulting from the research are applicable. ----------- These sections seem to state that it is ok to teach about cryptography, and distribute information about cryptography, even to foreign persons, as long as the information is in the public domain. However, these sections do not seem to allow people to freely distribute cryptographic software, even if that software is in the public domain. Why? The ITAR defines software as *technical data*, but not *information*. Only *information* can be in the public domain, according to my interpretation of the ITAR. However, according to section #121.8 (f), the term *software* includes system functional design, logic flow, algorithms, application programs, operating systems and support software for design, implementation, test, operation, diagnosis and repair. I can understand using the term *software* for application programs, operating systems and support software. But it seems ludicrous to define system functional design, logic flow, and algorithms as *software* and not *information*. Actually, it seems ludicrous to treat software on a disk as technical data subject to export regulations, but treat software printed in a book as information in the public domain. So, can you teach a cryptography class and let your foreign students write cryptographic software? Yes, but only on the first Tuesday following the second full moon after the summer solstice, unless its a leap year, in which case they can only program in BASIC every other Saturday, or until you annoy someone at the State Department, whichever comes first. Jim_Miller(a)suite.com

1 0

Varian Synopsis
by Jeff Davis 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Distributed to TAP-INFO, a free Internet Distribution List (subscription requests to listserver(a)essential.org) TAXPAYER ASSETS PROJECT - INFORMATION POLICY NOTE May 3, 1994 This is a note about an important issue: the future pricing of Internet services. Please repost freely. - University of Michigan Economist Hal Varian says the Internet is likely to face some type of usage based pricing in the future. - Varian says increasing demands on Internet by multimedia applications and commercial bypass of telephone networks will lead to significant increases in demands on Internet resources, and create pressures for usage based pricing models. - Varian proposes a system of congestion based pricing, that will allow free off-peak usage, but speculates that other outcomes are possible, and - Predicts eventual demise of CIX model of flat rate (no settlements) pricing for Network Service Providers. NOTES ON PROFESSOR HAL VARIAN'S APRIL 21 TALK ON INTERNET ECONOMICS by James Love (love(a)essential.org) May 3, 1994 On April 21, the Telecommunications Policy Roundtable (TPR) held its first workshop on the future of democratic discourse on the Internet. Hal Varian, a professor of economics and finance from the University of Michigan, presented "Economic FAQs about the Internet," a paper co-authored with Jeffery K. Mackie-Mason. The Workshop was held at the Carnegie Institution in Washington, DC, and attended by about 60 persons. There was considerable interest in the topic. TAP had received more than 400 requests for copies of the paper (including about 350 requests by electronic mail). The paper is available for anonymous ftp, gopher, or World Wide Web at gopher.econ.lsa.umich.edu, or by sending an email message to ndaly(a)essential.org. Professor Varian's prepared talk followed the paper fairly closely, with a number of facts and antidotes thrown in to illustrate his main points. Among economists Varian is known as a superb expositor, and his presentation was as clear and accessible as the paper. Varian spent the first part of his talk describing such topics as who "owns" various components of the Internet (backbones, midlevel networks, etc), technical aspects of Internet routing, and the growth of traffic on the Internet. I won't bother to go over all the points which are explained in the paper, but a few items are worth mentioning. Varian disclosed that Internet data packets contain an unused "priority bit," that was originally designed to allow Military brass to assign priorities in data routing. The costs of routers (workstations) had fallen much faster than the long distance transport costs, and the long distance backbone facilities were often the bottleneck. Varian also spent a good amount of time explaining how Internet usage is changing, and that while electronic mail is the service most widely used, it constitutes only about 8 percent of the bits sent over the network. New applications, such as the multimedia Mosaic, Internet Fax, and Internet radio are rapidly becoming large users of Internet resources, and these new uses of the Internet are creating huge pressures to change the way Internet services are priced. To illustrate his point, Varian talked about the new Power PCs, which will allow a single user (a college student talking to his parents) to hook up a video camera, and send about 1 megabyte of data per second to the Internet, nearly tying up an entire T-1 line. Varian indicated that the power of workstations connected to the Internet is increasing much faster than the capacity of the Internet to carry traffic. Moveover, a number of commercial users of the Internet are rapidly finding ways to bypass the higher priced telephone networks, both domestically and internationally. Varian was focused largely on the increased congestion cause by the new demands on the Internet. Interestingly, his own research indicated that peak demands shifted from day to day, and peak and off-peak usage could not be easily predicted by the time-of-day, as it is for telephone service. In the United States the Internet is unregulated, and there are no internal prices for Internet usage. Network service providers typically buy bandwidth, or capacity, and face zero marginal costs for usage. End users face a variety of charges, depending upon how their service providers resell access to the network. Some foreign countries, such as New Zealand and Chile, charge Internet users for traffic, as measured by bits. Different uses for Internet services have different requirements in terms of routing priorities. Electronic mail generally does not require an immediate claim on network bandwidth, and can be managed to travel "off peak." On the other hand, some services, such as video conferencing, Internet "talk," or running Mosaic, generally allow the user to command bandwidth at a particular time. Varian was quite clear that he believes that the problem of congestion on the Internet will become a much larger problem as the Internet becomes used for a more diverse set of applications (and the growing power of desktop computers to generate data). Varian said that he believes there will eventually be prices for Internet usage, and the only real uncertainty will be which pricing system is used. A very difficult problem will be the development of accounting systems and other mechanisms to facilitate billing for Internet usage. Generally speaking, it is not simple to determine if data packets contain electronic mail, fax transmissions, video, or other data, making content based pricing problematic. There are also a number of complex issues relating to when or where traffic would be "charged" for internet usage, since users gain access to the Internet from a highly decentralized network of workstations and networks. Varian also talked about problems in determining if senders or receivers would pay for data transmissions, which he illustrated by talking about ftp or gopher servers (who was the "sender" of the data, the person sending the query, or the file server which returns data?). According to Varian, a number of persons are working on these problems, and many important decisions will be determined by engineers working on technical issues. He singled out the Internet Society's Internet Engineering Task Force as the most important forum for groups sorting these issues out. Varian said that any scheme to charge for internet usage would also involved non-trivial costs in terms of metering or accounting, and possibly significant changes in the culture of the Internet (the question on many persons minds is the future of the Internet Listserves), although on a more optimistic note, he said the costs of routing and backbone services should be low, if calculated on a per user basis. Varian said little about the Commercial Internet Exchange (CIX) in his prepared remarks, but in response to questions, he said that he did not believe the CIX pricing model (a flat fee for connectivity) was sustainable, and he thought that the new Network Access Point (NAP) providers (Ameritech, Pac Bell, Sprint, and MFS) would employ a usage based pricing approach. Varian also talked at some length about work underway to create mechanisms for charging for other types of transactions, using a variety of schemes to create "virtual cash" for use on the Internet, such as the services recently announced by Commerce Net using technology developed under NSF funded R&D. Varian said that government R&D in this area was welcomed, because it provided neutral non-proprietary systems that couldn't be controlled or manipulated by a single firm. Varian described the new Internet architecture, which is based upon four NAPs, each controlled by a telephone company, which Varian described as the new "cloverleaves" for the Internet (connecting various backbones and networks), and the new vBNS high speed backbone. Varian said the high interest in the vBNS contract was due largely to its strategic role in the development of new Internet technologies, including accounting and payment mechanisms, which may eventually be deployed to the entire Internet. (MCI "won" the recent NSF contract for the vBNS, but the award is being contested by Sprint. AT&T was also rumored to have been an unsuccesful bidder on the vBNS). Varian's own preference for Internet pricing is a system that only charges for priority routing. As described in several papers (written with MacKie-Mason), Varian would employ a system whereby users would "bid" for access when congestion was a problem, and routers would give priority to packets that had the highest willingness to pay. Users would pay the lowest price that was accepted in this routing "auction," so everyone would have an incentive to reveal their true willingness to pay. Under Varian's scheme, all Internet traffic which did not claim priority status would travel for free. Thus, for example, a large Internet mailing list such as Humanist, PACS-L or CPSR- Announce could mail for "free," with an off peak priority. For Varian's scheme to work, it would be necessary to have routers compare "bids" by packets, priority bidders would have to "pay" for access to someone, and there would have to be a high degree of consensus, so the priority packets would not face bottlenecks or delays anywhere on the Internet. Varian acknowledged that it was possible that the Varian (and MacKie- Mason) system of pricing might not be adopted, and some less elegant system, such as pricing by the bit, may be coming. A number of persons wanted to know who would decide these issues, and Varian was not too specific. The message (the "guess") seemed to be that the companies which controlled the NAPs and a critical mass of the backbones would have a lot to say about what was eventually adopted. Varian was asked to speculate about future telco investments in Internet providers, such as purchases of companies like PSI or UUNET, but he was reluctant to predict much, other than to emphasize the importance of competitive free entry into the market for Internet services, which would undermine monopolist practices. Varian was asked if it was possible that a coalition of Internet providers would have the power to implement a pricing scheme that would have an adverse impact on the future of Internet listserves (many of which "send" more than 100,000 messages per day), but he was reluctant to be very specific in his predictions, other than to say that many outcomes were possible. Note: On April 29, a follow-up workshop was held with Dr. Steve Wolff of NSF, Professor David Farber, and PSI CEO William Schrader. Notes from that workshop and other information regarding Internet pricing will be posted to tap-info. --------------------------------------------------------------------- TAP-INFO is an Internet Distribution List provided by the Taxpayer Assets Project (TAP). TAP was founded by Ralph Nader to monitor the management of government property, including information systems and data, government funded R&D, spectrum allocation and other government assets. TAP-INFO reports on TAP activities relating to federal information policy. tap-info is archived at ftp.cpsr.org; gopher.cpsr.org and wais.cpsr.org Subscription requests to tap-info to listserver(a)essential.org with the message: subscribe tap-info your name --------------------------------------------------------------------- Taxpayer Assets Project; P.O. Box 19367, Washington, DC 20036 v. 202/387-8030; f. 202/234-5176; internet: tap(a)essential.org --------------------------------------------------------------------- -- PGP PUBLIC KEY via finger! JAFEFFM Speaking & Thinking For Myself! * eagle(a)deeptht.armory.com email info(a)eff.org * *** O U T L A W S On The E L E C T R O N I C F R O N T I E R **** ***** Committed to Free Public Internet Access for World Peace *****

1 0

Double betting and money laundering...
by Peter Wayner 17 Dec '03

17 Dec '03

This is a corollary to the debate on using financial markets for laundering by placing bets on both directions. Apparently, casinos are now on the lookout for people who are teaming up to play both halves of a bet. One casino kicked out two guys who apparently were betting on pass and don't pass on the craps table. Why were they bothering? Was it laundering? Nope. It turns out that casinos hand out free "comps" based on the amount of betting that you do. This is called being "rated." They notice that you're betting $10 chips and figure that the math shows that you'll probably lose x dollars per hour. Then they give you free room and food to show their appreciation. The casinos have elaborate computer tracking systems that would scare privacy activists. They watch you're trading and try to give you free amenities worth up to some fixed percentage of what the odds say you'll lose. The article that I dug this out of said the percentage was often 30%. (I think it was in this morning's NYT.) So these guys were betting like crazy to make it seem like they were high rollers who were entitled to big comps. -Peter

1 0

Re: Lobbying/Politics/etc.
by lefty＠apple.com 17 Dec '03

17 Dec '03

>I suspect significant problems implementing a law that criminalizes >crypto. The government currently spends $billions per year trying to >eliminate illegal drugs, to very little effect. Drugs should be >easier to eliminate than crypto since phys-obs can't be copied ad >infinitum as bits can. I agree entirely. Personally, I'd be thrilled to see 'em try, purely for the fun of watching 'em going broke and looking foolish... -- Lefty (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

1 0