December 2003 - cypherpunks-legacy

theories about lack of crypto
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

sorry if this appears twice; I sent a copy through one of the new anonymous remailers last night and it looks like it didn't make it. Or I messed up somehow ;) -----BEGIN PGP SIGNED MESSAGE----- Tim May brings up some interesting and valid points about crypto protocols. I think there are several reasons surrounding the slow pace of crypto protocol (particularly software) development; rather than list them let me explain the difficulties in setting up a "data haven" (as far as I can see): I - Difficulties 1. The usual stuff like finding the time to code and maintain software, including getting access to a workstation (or whatever, some net connected computer given that my home computer is a PC running MSDOS). 2. Say all this code gets written. To really be able to run a data haven, I'd need to own the machine it runs on, to have the power to call all the shots. Yes, maybe my internet provider charges $x per megabyte, but I seriously doubt I'd be allowed to use up 100 Megs of disk space, even if I payed (and charged a bit more for storeage to cover my expenses). Now I can get a SLIP account for about $50 a month where I live, and so if I had a spare computer to devote, I'd be set, sort of. I'd definitely need the machine to be available on a network, otherwise it would be too inconvenient and nobody would use it. Of course, I'd also need an easy to use digital cash system to accept payments. Same thing with top-notch anonymous remailers; to be able to turn off logging, and be in control of a hundred details, I need to own the machine. Same thing with digital banks. Who would use a bank that runs off of an account from an internet provider? Besides, I'd need to own the machine to setup the appropriate security measures, etc. 3. Legal issues. This is the biggest problem. By running a data haven (and this applies to many other cryptographic protocols, particularly ones that guarentee anonymity, etc.) I pretty much open myself up to a legal can of worms. All it takes is one person to store pirated software, one person to send death threats through my "strong" anonymous remailer, one person to forward Clarinet posts to usenet, and I'm potentially in for a battle. Craig Neidorf (phrack) went to court and racked up a legal bill of $100,000, all for the government to drop its case. Consider if somebody posted anonymous soliciting pirated software. Let's say in a year, I set up an anonymous remailer and digital bank, and it really is anonymous. Somebody posts, soliciting the source code for Chicago (just an example), offering $10 million dollars. Some anonymous person sends it off, and receives payment. Neither party is traceable, and both are very happy. Except me. How screwed do you think I'd be facing the legal department of Microsoft? Yeah, the solution is to relocate off-shore; this is not feasible for me. This is only the tip of it since a large number of the more interesting and useful protocols are patented. Sure, maybe the concept of software patents suck, but the fact it, it's legal until a court overturns it. And I don't have the money to mount a legal battle. There is a balance to be struck between offering totally anonymous remailing (for example) and keeping enough logs to keep out of potential legal trouble. The problem is that the balance falls closer to the logging side, which would scare off potential users/customers. II - Incentives Really, what are the incentives for running these services? None as far as I can tell, other than the satisfaction of doing it. Johan Helsingus (Julf of anon.penet.fi) spends hours a day maintaining his site, responding to complaints, etc. He provides a valuable service, which obviously is very popular... all the same, I'll bet when he asked for a donation of $5 per account to help defray costs, he got almost no response. III - Usage Why aren't people using DC-Nets, data havens, etc.? Because I don't think there is a reason to. I'm not saying that it's a waste of time to develop this software; it's just for now it'll be confined to experimental usage, research purposes, or just as a challenge to surmount. I mean, I know what a DC-Net is, but I can't think of a single reason I'd actually use one, other than for the heck of it. IV - Platforms Well, for me, it would be MS-DOS. I love UNIX too, but my home computer is 10 times more convenient to develop for. >it all...remailers appear and then vanish when the students go away or lose >their accounts, features added make past learning useless, and so on. Life All I can say is for the near future, I don't see any of this stuff being done by anybody other than "hobbyists". "The Internet Casino" This sounds great, in fact, I've thought of writing a crypto version of roulette or blackjack... something that would use a bit-committment protocol to committ to a shuffle or sequence of random number, and play you. Afterwards, you could check logs to verify you weren't cheated. Maybe I'll actually find some time this summer to write it, > Later protocols have not fared as well. Why this is so is of great > importance. I'm interested in hearing your theories about this, Tim. I too wish things were different, but I just can't do much about it. I still think we are in a "ease of use" phase. Most people on this list don't even pgp sign their messages, largely because it isn't convenient. It isn't surprising later protocols aren't faring well. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLchxHIOA7OpLWtYzAQGP1QP9HbB+1eHhF5otXP9ShcC7mu5vSDVTeIf2 SNr4u28WOgRRHFP4MQcsvYp7VM0ELNhIdMXpCiThgl2kVj0oomLNboCpW0HNW9jn 4dux0K0hGJqsoxeZhqvNEybIQiVPHg0VFdkwI6q79V+oHynlOOaNZyJXad6ZFwsv xxUlGjLdmK8= =AAzE -----END PGP SIGNATURE-----

1 0

ANNOUNCEMENT: Preliminary announcement of May physical meeting
by hughes＠ah.com 17 Dec '03

17 Dec '03

PRELIMINARY ANNOUNCEMENT ======================== Different Date: The May cypherpunks meeting will be May 21, the _third_ Saturday of the month, for various scheduling reasons. New Location: We will now be meeting at Silicon Graphics, not at Cygnus Support as previously. Thanks to Katy Kislitzin for arranging this. Audio Available: We will be doing MBONE. SGI is already all set up for it. Theme: The theme is "Protocols". Contributions are encouraged. If you have original work, great. If you want to digest and present a paper from the literature, good. In either case, prearrangement is highly desirable. Mail hughes(a)ah.com. See you then. Eric it's like PGP 2.3 and 2.4 (modulo maintenance tweaks) but uses RSAREF for its crypto. Thus it is entirely U.S.-legal. I wonder what Sternlight will say to this. Eli ebrandt(a)hmc.edu "Users of PGP 2.5 should be aware that if copies are found outside of the U.S. and Canada, they could be charged with contributing to a conspiracy to export munitions to a foreign national."

1 0

Re: Keyserver service outage
by schirado＠lab.cc.wmich.edu 17 Dec '03

17 Dec '03

>During the coming week, the Massachusetts Institute of Technology will >begin formally distributing PGP 2.5, a new version of PGP that is >based on the RSAREF 2.0 cryptographic toolkit, under license from RSA >Data Security, Inc., dated March 16, 1994. When that distribution >becomes available, the keyserver will return running PGP 2.5. At that >time, the keyserver will no longer accept keys that are identified as >having been created by versions of PGP lower than 2.4. (PGP 2.4 is >Viacrypt PGP.) Questions: 1) What involvement, if any, does Phil Zimmermann have in the creation of this "new version of PGP"? 2) Will "PGP 2.5" continue to be freeware; i.e., has RSA changed its stance on licensing? 3) If the answer to 2 is "yes", has the strength of the encryption been compromised in any fashion? 4) Isn't this some sort of transparent "back door" grab by some unknown person(s) as a method of encouraging people to switch by fostering the belief that versions of PGP lower than 2.4 are somehow illegal or otherwise illegitimate? (The last is only semi-sarcastic.) Basically, I think I speak for a hefty chunk of list subscribers when I say: I want to know who's behind this.

2 1

Re:The Value of Money
by GRABOW_GEOFFREY＠tandem.com 17 Dec '03

17 Dec '03

blancw(a)microsoft.com writes: >I understand this much: there is some gold and other actual metal >located in a vault, sitting there as a symbolic standard of wealth, >worth, value. Everyone stakes a claim to it, and they exchange that >claim to others in substitution for something else (dog, rifle, gas in >the car, baby-sitting). These claims can circulate as fast as a >computer can calcualte & transfer them, and that is all that circulates >while the standard continues to sit in the vault, not being used for >anything by anybody. As long as you hold a claim to this lump of >stuff, you're Somebody - a force to contend with in the Market Place. Didn't Nixon take the U.S. off of the gold standard? G.C.G. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | Geoffrey C. Grabow | "What we demand are rigidly defined | | Oyster Bay, New York | areas of doubt and uncertainty!" | | | -------------------- | | grabow_geoffrey(a)tandem.com | Clipper, SkipJack & Digital Telephony | | | JUST SAY NO!!! | |----------------------------------------------------------------------| | PGP fingerprint = C9 95 0F C4 E9 DD 8E 73 DD 99 4E F5 EB 7A B6 1D | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Advertisement
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

I realize that one-time pads are sort of outri these days, but what do you use when there are no computers around? I've written three programs in C which [1] construct a TeX-printable sheet of pads with pseudo-random numbers (use your own rand() function), [2] automatically encrypt a message using modular summing rather than XOR (easier to do if you don't have a computer handy), and [3] decrypt the message. They aren't the best examples of C coding, but they work. The first program is included below, conventionally encrypted with PGP. For a total of just 12 [TWELVE] Tacky Tokens I'll release the password. Please send your COIN.DAT contributions by encrypting with the PGP key below and posting to alt.test with the subject: IGNORE - NEON. Cast your bread upon the waters. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCVAi2/ZzEAAAEEOQGMwT6H90aJMTmkf3bLdMVyJ3hyBDoh8ruQfa2x/8tTEPhs 0dyOMroWwMMFQHY5Gdc7etULE6G3W8Q8CGotwFIEUMCXEc9UBeePv3WaU3ovZ/Dz bdvnTeH8KYpQhV68bi1jvX3ahM2tk5jRwK8zP9+YHv5ZpbQlubVI6pRIYxGNuGfP zntP48UABRG0CG5lb24gPEA+ =CTOG -----END PGP PUBLIC KEY BLOCK----- Since I don't know how to do a zero-knowledge (0-k) proof, I post part of the documentation below, as proof that it exists: PAD CONSTRUCTION ---------------- Cut each pad out seperately as shown, and staple together. A hot-melt glue gun can also be used for binding. The figure "EAF45" is a random value generated as a lable for each pad (see line #12 of OTP.C). 18 12 25 04 18 13 15 19 15 12 15 10 12 08 27 29 18 24 19 20 S 24 20 17 06 25 21 12 04 00 11 T 21 16 24 08 24 28 16 20 25 04 A 02 17 11 25 12 25 02 16 16 28 P 24 12 15 10 14 08 18 00 25 29 L 10 23 07 05 07 15 08 10 18 24 E 18 02 02 22 03 25 20 25 03 14 13 14 26 09 25 11 00 16 03 10 12 18 23 20 20 17 10 02 19 23 EAF45 Page 3 (etc.) -----BEGIN PGP MESSAGE----- Version: 2.3a pgAADYzOLESSLoz1Lddh5LT3bg8J5abD8CJL16I4c+9ws8KIMpnTgJjCRWysFpfn 70huIgY6tPzmRA2P7B9/foTcQ8oMNao/FAiOw8m5Hym1SKk1OdMNL+ryWRa4okTH dtBJgAg+JNFVnM5IuKy2XGnIaDwUxuF5wsgqMzXVWr0aOMFj307IYrISubo4JarG y48cRn6UOXLIFb72+Ua1aJIwTnskfEqxvPSFUOutZEPXrRUocyTWu0udD7Jdzhu1 Iq1doB1HeG1Mm0+yppwFEevCvHZKVzueWDfCZTo/b/ia2eyUZAkq6Q4BaLW4HW1j /V4R1+zxLK/MW8jeb8OMDMpzI3iEjHM/G0fm1JCfIRa3zlbOetWthxZSDlikfKaH fhUa8usOqmXlvAl/vP2thejeGfTZFQnqiLnhtj2jmJa1EKe0RAqL8ffak7/tXJHh 188oKIOuFRyKoe2lAk2oRzhvG7L99B9OZHD05L8dZD7JsVUkat6ryV2HNNlWcHuD BgT3ukYemnLKc8FQjzcqFF5gYS7grlxH5J5uFXlhdlVEsvE+hNebr8wfMmeno+Dg e4JK6RJuIxtb+YUf2oduQ7aIyw+YgWbRGVXP5rnmrQtpxZDRgfhvCYPr5IocKo79 AOkGAIjG6iihc4RektOWBc5FfwWkrSvhZ45/kxuuABnrBlQ+568c3KZybGfk8MtL n3PwKZwTaJ8O3jwYwFZceuVsgtdvKTxJvf/rH7MbwojudEwgZLg421bgCXuLUYIC AW5Qf3Lbv3SYlL+ZRjJ1GE4OUl0M3//gBvbezJphkyMVQXmmuh9Kkwisouv/Dov5 FkBvvYCAeNM/QtwwNi9HkawoOVhfO9tRFFYXVXphOx+bNBjRzWSJ4Q9ONXa3S/XG +J0vN4CA9YwzORh4e5Z45C08MmYxltfB0hVDNFEKTw0UZGFV7vlX12z5eCeoUs0K BBtWBqwxjxWRcF/HRy0d+oYG7aSbHSeJfnhXiRYuF8Z0+b7ZJLg/tjwec3K9KZ2d le4lU25pQXMLNGaBQRrwesofIWD9pwY8ZRNtEZOGZlfLWr0qqf1qITM6gTBjJBPj dhGXa8YClLqETO9gQUWI4NAZXfV+nxrBbrUYz/Ky2DD1A6SAwUm2fR/yIZDDo1+8 M9lD8EgqXAx3h02tGQ7/mj3P3c94GNturdRXzxHaXgZ+mHIj0yIaMpXRujTCs/f6 W3FTzJJMbY+bZNWE0D1eVGiwzzc5tILFDWbqGppC7YuMvYc2MA3VUoEeUa0dW9Al +JMvMvd2FP97VkQyYTLz1IBmyWBcLE6qf840Gn6qL7G7C7d1THG2PBer0TgDZm/w i6xS/hvKD4cK9yU1YBNV7apchFDs2sdyCQk/xbNckhZcbPsCSwmA7SY0sJsP3UNO CsAJ9UZbtpdZ20sakvx0Fw3CHHedJUYIU+HdGEsHUNuRVTvrR94chjEmvfhlFhPt 6+g4BTCMACz6orefPhR4vC8b3CFkvRWZvsBLP+31HvXwHMzyzNXYLtMNw/H3T+Ti LUu1iMr0ZuqDmVlmoCsegrgEbBm2c2pcZt6t3tEkcG46dEWe4i6FSs1RJAp6YM3b k1V+VOUl2pqv34JoFOIbllsSPH373PNrdW6s/DVhtre0eogMT/5tGEvQEOm59qe2 h/4DTzfzK3QbUMFTrIL43YeQVn3rAYI9+rtaaPQonnS0adzPmZ8VWDYKEsierutm M8nw1X0+zz5Gc1bsbcEuPxTVI7LSrtc6YB6HWZFFPpSAk1v4fnsjgfpq3eymUvIg uaeFfdv5xaBI7qu4lROxt8NyJqLSrcUOz1LhwwIpGhY1GNFLtj9el/VeYZ8iGqk1 7CilWSPO6mmI4k/yYM/qLWVTfVltdwnehVIlUyqf2ZTLPIYdRPJB6/pOmwf8xuMY xYVgvOHEwpSaH2yiP9yl1OHS7gOyWPMgfMb5yK56SssNt0x2FFTJKJMbWwADYPDU msvuZ2+g5BP1bOD0gt3DFV8/ShO6zqIMnsHVz57JqchBppuMT9egckkAjn+ReW9T 8+dRVrmYj7t8FMxcVAtyKL1x80Zmxt22IN4UBFCjW9SoTey3hMzzgBQPyw0nbpBJ ncNmflBEB4ROpXqgfr80WU2mmPFuNKkgQw2fOqbFtZ0sLs8b6UjBCPUZyiE0teJ6 Abs6VL2IOTHOIe6/n5tmTwZU4Ey3N+fbmQaFx9ilyROcJKD3kIaOCBAjygwQxg/g Xnfo4q2P/v90y//KavuiSeXklSzuQ6aHuSXNeSHw754E8kFRhRhQFS7TktcC0g+t CLtqQviUrxQQOzF4CbQPehONtajrGNdopST1Xvok2QVTPlK7YebEeEMEZvtSIKQo /D+9OIWUwnob11gM5rJFgwyj2zTsqlgAnlSm9PumHdSpqVzlMz3EJ47QXVhNfb3i fhvZHgjbtnPd9sGFgurwmentdJg00j8X1vfFaPMXiE/oEMF41GtQQGGI+sJTcq98 z/F0XQaoK/ilRWQ7nPVpch9knvHc8NIHQIrvYpJPneo3gw53VJ2wCTqLr45g2IVU 3N4I6B41ooaSUk4FqL1sh9BWvOxGbn6u1MUa3WjBtPIxwYB38AQJWtkKYBExckUI 7Lua0lSpeddiqB1skB9KmsqoGzVJJxFVEEaeFM2WZQyvOJtnWqqkWNMEP210mgmB 26Lgbebr/Inmn0TEXw4zfIcEFsUZ/yu2xV6KFxK7HDZiKZKv0HBgsG30KPxI2bGd 8pOVuXJu/u2L6EHPWJxZKEb6fVifbuxPJDSz4PwO8rUhW2sUSeXWfyJQXGcJhaU9 5D0zXPaZ/ZBmAZSCXEs278D06uYEcpSw29KquRSH4F2DLy17WrXMtj74U+1eub/C U5+Mt89D3yR8x0OJbLkJMi5mB2YKv3Mv2OZdr+cIQAC6qs/Mg45jl78kBXMqg3w0 +bho9omOYqv2aXeLzYD1aXX99MoBw5tP+fcguchKxWHxVgwTdwE87eGsbnRSWry2 myaVLImpBcaMfWwzaeoEknnanqJAaGJ9sjHyEaoPPSPUMOqGKN7xGsSBF4cyyM5D Jt2YDjU2aYqjlxLTTchv/YYJhXaY/6jDQOygXjMBqjZji8GRZ9IGNFIezXX3+0bC KqUlPRmuOPMj3cZVidvaEwMejKOsr/8QjaseStICPiTuJO6RlcP8Dx9AQTLxj5q/ 8WVgKiTyd68t6Aq/50EUZRYRU+64lAQ7/WIr6dNkAd4dz20aIA5ZG5NF91Rfhylo pa8VA54y8t6xNMmojBzMrHu9bJuS9C9tN84AccXgRutlsOH7XnWlIfo6kV98Q39b WOS7EIBIdt/1tQZf9TPrm8lvD3Ne/WK/ghAzjxPWTj9Bmnfuv5QlzH8rahYPQsT9 ajxLIRpIkc07A1aQUMTGqCeH+nGU1RW04pfni2JJgUTlgxNymkwP5/NBNG6NWXp7 YtfENuHVIVlszASOuEAqqA9QLktI0oAgThiICvfLsSZqf0dFElevlKUllZSCqBZU ctt6+A6g4iaLFcUO16nZQtpGDPy3ufQwEI+YpeQWO/X0O59TXECME/bmaXacIwwa 8lKJ3yNivnMzN7sl+vdQRg50b7uAAO2e9C18WM19dizqdMgGY9zWx2bc9UsTbV23 5SIDiL2szeeqqnqAild39EMMHvAzdHn6ze+iMwQnLk3Yng1VWsf2AtadzVrnCV+K AS/fw/CnLUOX3xQBsnskT1Sj9udu+TsGZ96d5F8yBX1e1y4lhq1NFXBl92qQnIps xLa71IwgA/YexiZXpNO9rthSEfmiOUFLLkHbI8FGJbWBRv///mFdz3Kjsb4hTuD4 FqfJxxQ2eRgHskShUkgI539hOe9uqRIoZ/qG8idtoi9JFp2PflzwSVrre0vqlRt6 +0gfnAvBWDMbH4Zj6lByuMPE6jljxPt+42yMmRPB0WtkaNAnw1/6XjVn0a2p1bLe 3qvMup0P9NPSPfqA1fRvK2y4OzEAB8xDHLh8b05pDwiMD9GE9553PtEkfL+4IhT2 HhXKeT14Zii8e3VA85u2ymNeqmq6EReNi7XSTuX/nWneL07FiPhKlW4RVvSYb5e8 g+2ZgG8Fd37aoPlVuCCXPv2Z/yNzu0Z4E9ft5FqnbdXMsQUt91NrAS+3h2hMdDa7 qZgzhtOscDhCTVoa0lg0Zgr4ggVnS/uajDBybOYn+qd4QWZpPH51Ayc9J5iLADNQ 8x98OAnXtelSqHm5ptCSvwIvzdP/mEOC0F100J/4OVJj69GFn85t0NaPmNoaZFpy +E39PNNJ2G33YvcXQebc5Id/dv+cPlITeHY9CBX4qyvU+WkhK0K29MU1stpU+q47 X00VnG3SempqkKDni+a1W5p6sftZ7eUN6vPCNY2chNP0vurHkFCctWU8k8FKkBwc 4PxteGtcsIW8YDF6fHxkZNqZPSFkddoxmleZ+C6lBV60278bjpUGXmWGzjOvfCdq RIYu1iZmv2srvVMVJeL0WJL7PFyKr3sS6/3feGZNoBTC/1ju1sN/mWvBR0xL0zAf Kxcra9o/xLmaUIZ3X+j0k6vXafv52Vm0BvvB62F6wanZFSdqBAx8xZ3A/KvYbRV8 4pOY+QFSJqOYv7gERx44ODw= =GuJh -----END PGP MESSAGE-----

1 0

Re: Advertisement
by Black Unicorn 17 Dec '03

17 Dec '03

-> The first program is included below, conventionally encrypted with PGP. For a total of just 12 [TWELVE] Tacky Tokens I'll release the password. Please send your COIN.DAT contributions by encrypting with the PGP key below and posting to alt.test with the subject: IGNORE - NEON. <- Is there a mac version?

1 0

Re: Keyserver service outRAGE
by Hal 17 Dec '03

17 Dec '03

Let's not fly off the handle. This _could_ be a very promising development. IF source code is available, this would be, at last, a U.S.-legal, free version of PGP. Let's wait and see what Phil Zimmermann has to say. Hal

3 2

Re: Keyserver service outage
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Adam Shostack writes: > I think folks outside the US can legally run 2.4 or 2.5, as > there are no restrictions in their countries on using that software. > The difficulty is getting it outside of the US without getting anyone Not true. The problem is copyright, which is honored by Berne Convention signers even if they don't have software patents or patent-after-publishing rules like the US. This includes Europe, the U.S., and many other places. ViaCrypt 2.4 is copyrighted by ViaCrypt, and RSAREF is copyrighted by RSA, so you won't be able to use 2.5 source outside the US either; not sure about binaries. There's an easy cure for this, though - if some non-North-American wants to write an RSAREF-compatible software package in C and distribute it as freeware, then it can be used in non-US versions of things that require RSAREF. An interesting question is whether PGP 2.5 will include any restrictions on the non-RSAREF portions of the source code, like not talking to earlier PGPs, or the RSAREF interface glue not being exportable or whatever. But we'll see real soon. Bill

1 0

Re: Keyserver service outRAGE
by lefty＠apple.com 17 Dec '03

17 Dec '03

Some nobody writes: > >So that's it, isn't it? Clipperized PGP. The government has pressured >RSA into allowing a new version of PGP, in an attempt to displace the >use of freeware PGP, with the hope that they will then be able to >control it more. This stinks. Yep, you got it. Dig a hole, crawl inside, and pull it in after you. As soon as you can manage it. Personally, _I_ think the government's out to destroy this list by recruiting a bunch of low-IQ paranoid schizophrenics, denying them their medication, sitting 'em at terminals and giving 'em the Cypherpunks address and the address of an anonymous remailer. The half-wit quotient around here is definitely on the rise. -- Lefty (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

2 1

Re: Server clusterfuck
by Black Unicorn 17 Dec '03

17 Dec '03

-> As I said, I do know that the limitation son the keyserver were part of the bargain to get a legal non-infringing freeware version of PGP... Take that any way you want. Onoce I see the code and can peruse it, I will probably trust 2.5 as much as I have trusted other versions of the code. > I hope the code of 2.5 is looked at real carefully. Trust me, it will be! -derek <- Fair enough Mr. Atkins. And thanks! -uni-

1 0