December 2003 - cypherpunks-legacy

17 Dec '03

What's that smell? Doesn't it seem a little... musty? A little stale? Something's getting old. Something needs to be changed. It's your key. There are a lot of old, stale keys out there. Moldy, dusty keys a year or two old. It's time for those keys to change! The need for regular change of public keys has not been emphasized enough. The longer you use a key, the more likely something will happen which will expose your secret. Plus, it gives attackers more incentive to try to break or steal your keys if they know they'll be able to decrypt messages for a long time once they get them. A lot of people seem to think of keys as quasi-permanent, sort of a voluntary version of social security numbers. One key, cradle to grave. But this is not the idea at all. I was reminded of this by Graham Toal's response to Bill Stewart: > Public key has the advantage that the operator doesn't *need* a database. > If you want to implement use-once addresses (or use-N-times), > you could include a tag with the address (such as the IV), > and reject future messages using that tag (e.g. save a hash of the tag). > > I think you missed the point - with your scheme it's still technically > possible to decrypt the address years afterwards - you're relying on the > remailer to always stay secure; with a delete-the-key scheme you couldn't > even if you were hung upsidedown from the ceiling from your toenails by the > gestapo. (Though you might want to...) - so a corrupted remailer would > limit damage to only live keys that arrived after it was corrupted and not > its entirely history of dead ones from the period beforehand. Graham is thinking in terms of remailers which retain their keys for years. What is a good interval for key changes? I would suggest every year or so makes sense, especially if infrastructure can be developed to make it easier to propagate key changes. Keys should be overlapped in time, so that you make a new key and start using it, while continuing to support the old key for a time. But for remailers, I'd like to see a considerably accelerated key turnover schedule - maybe every month, or every week. This would help defeat the kinds of attacks Graham is talking about. And the remailers should securely dispose of their old keys to the extent possible. Granted, right now the difficulties of distributing keys are rather high, so the costs of changing keys may be large. But as this technology becomes more available, key changes should be scheduled regularly. PGP has some fields for key expiration, but support for that was never implemented. The idea was that you would get warned when it was time for you to change to a new key. Users of old keys would be warned as well that they should try to find out the new key they should use. All this was not done because there wasn't time. Hopefully the feds will change their mind about pursuing legal sanctions against PGP developers and progress can be made again. Hal

2 1

re: call for security products!
by SGT=DARREN=S.=HARLOW%ISB%MCTSSA＠nwsfallbrook3.nwac.sea06.navy.mil 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I work with a Banyan Vines Network which contains it's own logs. What type of logs are you wanting to maintain? I may be able to help point you in the right direction. Sgt Darren Harlow - Computer Security Internet: harlow%isb%mctssa(a)nwsfallbrook3.nwac.sea06.navy.mil or another less reliable address: harlow(a)mqg1.usmc.mil "The views expressed are my own, and always will be..." - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCNAi2pYOoAAAEEAJ0Fdc1HDwlww3Wz8JPeQDZT2Gk/q1gh0J+4njtUC66HXngN DNyxzoGnZVcA0bbkirsCdjvvZlsP84QVgxdijzgW4pNOJKowJgrQWFftGEqJKH5b I2NxJrk0kmKt/jli5kV/wDs9Rr4PxXQjGN4B+uJOCSlyWX+fnWNyHMOkIY2tAAUR tENEYXJyZW4gSGFybG93IDxoYXJsb3claXNiJW1jdHNzYUBud3NmYWxsYnJvb2sz Lm53YWMuc2VhMDYubmF2eS5taWw+ =v34V - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLa8zRmNyHMOkIY2tAQHm7AQAmde5g8D4MPorbwPyxx+P1mMoBOtw0W1/ sXIsXUgNaMwEQLGohuYYGOU05KITqPGCynhaRTBoj2jGhH4nmay7h/OBt421nGI8 Pvthbt4aBkiPHdaNecESs085CWHdvUzTyBErWdgZuHueGHoI+z2tPdcAaxDdZ3R1 M3BcYEFCia8= =3Mv6 -----END PGP SIGNATURE-----

1 0

Laundering money through commodity futures
by gnu 17 Dec '03

17 Dec '03

I wonder if anonymous digital cash will really consist of shares in frozen orange juice futures... John Date: Fri, 15 Apr 1994 06:55:58 -0400 From: farber(a)central.cis.upenn.edu (David Farber) Subject: The Soft Pork Underbelly of Efficient Markets [I knew electronic markets were good for something .. djf] To: interesting-people(a)eff.org (interesting-people mailing list) Date: Thu, 31 Mar 1994 23:30:20 -0500 From: Peter Wayner <pcw(a)access.digex.net> Subject: The Soft Pork Underbelly of Efficient Markets The Under Pork Belly of Efficient Markets, or How to Launder Money Using Cattle Futures The great promise of electronic networks and virtual communities is a collection of very efficient markets. In the future, information will be moved, products will be sold and trades will be executed in a blink of an eye. This efficiency is usually considered to be a pretty good thing by everyone in business, in economics or in line at the video store. The underside of this efficiency, though, is a blurring of the line between legitimate and illegitimate business. A good way to understand this effect is to study the case of how to launder money using the futures markets. Laundering money is an age old problem for people who want to move funds from person A to person B without leaving a suspicious trail. Cash is the nieve approach and it has plenty of problems: it is bulky, it can be lost or stolen, and most importantly it often leaves people asking "Hey, where did that come from?" The futures markets, though, make it simple to move funds in a way that is indistinguishable from ordinary commerce. If it is done correctly, the recipiant, person A, looks like a lucky stiff or a market savvy investor. Person B is usually out of the picture or out of luck. The same games can be played with almost any other market, but futures markets are so efficient that the process is actually feasible and easy to do. The basic transaction in futures is to buy or sell a contract for the delivery of x pounds/barrels/tons/feet of some commodity at y dollars/yen/marks etc. If you buy a contract, then you're obligated to actually cough up y dollars when the contract comes due. Most people don't hold on to the contracts long enough for them to actually take delivery. They sell another contract and the futures market maintains a clearing house that is responsible for matching up the contracts and cancelling them out. It's a great system. Very efficient and very useful for farmers, manufacturers and others who actually produce and consume commodities. Futures markets are great for laundering money, though, because they can generate big losses or big gains in a short amount of time. It is quite possible for $100 to turn into a $5000 gain overnight. The downside is that it can often turn into a $5000 loss in the same amount of time. In fact, the market is a zero sum game. If you make n dollars, then there is someone out there who just lost n dollars. The sum total of the losses and the winnings equals zero. This zero sum nature is the key to laundering the money. Person A and Person B get together and guess that the price for a commodity is going to go up. That means that who ever buys a contract will make money. So Person A, the intended recipient buys a contract and Person B sells a contract. If they're right, then Person A gets the money and Person B loses the same amount. Bingo. The money moved from B to A and no one can trace how it got there. Person A looks smart or lucky and Person B looks out of luck. There was no direct connection between the two. There are thousands of other people out there winning and losing money at the same time. The marketplace's central clearing house arranges it so each wins and loses their rightful share. You may wonder why B bothered to sell a contract and lose money. This is the safeguard against guessing wrong. No one is correct all of the time. Even the people who try and rig the markets and corner them get burned as often as they succeed. The best investors in the futures markets, the ones who make money time after time, are the arbitrageurs. They spot inefficient pockets and try and remain neutral to the overall shifts in the market. Person B sells the contract so that if the market goes down, i.e., the wrong way, then A and B together have lost no money. It's a zero sum. Now they just have to play the game a bit longer or for stakes that are twice as high. You can think of the process as flipping a coin until you have encounter a heads. Ideally, you play this game with two players with relatively deep pockets. This means that A can cover the short term loses. This is a bit of a disadvantage because many money laundering operations must move cash from the rich to the poor. You can cover up this problem by using the same broker for A and B. The broker executes the trades and then assigns the winning trade to A and the losing trade to B. They fill in the order books after the fact. Using the same broker for A and B can be problematic because it may look too suspicious if the mirrored trades appear on the same ledger. The beauty of this system is that it can look quite indistinguishable from normal business practices. Many companies actively enter the futures markets to hedge themselves against foreign currency movements. Others actively enter the futures markets to guarantee themselves a good supply of their raw materials. The essential point of this lesson is that fast, efficient markets make it possible to move money easily. The futures markets were designed so that is no real other half to every trade. It's literally you against the world with every trade. The RISKS, of course, is that accountability can vanish as the size of the crowd grows to be as big as the world. There is no way to catch up with this. The futures market are so great because there is no need to deal one on one. The effects of speed are not only apparent in big financial markets. Credit cards and overnight delivery are a dangerous combination. You could steal cards, order a fortune of stuff, arrange for it all to be delivered overnight and then jump town quickly before people notice the card was gone. Suddenly, merchants must deal with the fact that something that used to be complete legitimate (exchanging cash for goods) is now a potential theft. Of course, there are other crimes that lose their edge. It is much harder to escape the law by heading to a new town. Computerized fingerprint files are very, very efficient. I think everyone felt that perfect, computerized markets would bring about the right mixture of accountability and efficiency. It would be a perfect mixture of Big Brotherly scrutiny would take care of everything. Every trade, after all, is recorded in the futures market. Yet, the best mechanism for anonymous fund transfer yet discovered exists here in the midsts of all of this record keeping, legal scrutiny and oversight. ------- End of Forwarded Message

3 2

Factoring Broken, news at 11
by rjc＠gnu.ai.mit.edu 17 Dec '03

17 Dec '03

A friend of mine told me that a friend of his (who I know), has a professor who knows someone at Bellcore who has just succeeded in a factoring breakthough. Supposedly it relies on quantum complexity theory or something else I've never heard of. Of course, I think it's total bullsh*t and probably a misinterpreted April Fools joke, but there's always the possibility.... Just thought I'd relay this semihumorous tidbit. (and possibly start another nasty net.rumor ;-) ) -Ray -- Ray Cromwell | Engineering is the implementation of science; -- -- rjc(a)gnu.ai.mit.edu | politics is the implementation of faith. --

1 0

Re: Laundering money through commodity futures
by sonny＠netcom.com 17 Dec '03

17 Dec '03

2 1

FOIA- New Docs Reveal Criticisms of FBI Cost-Benefit Analysis of DT
by Dave Banisar 17 Dec '03

17 Dec '03

[1] FBI Wiretap Claims Questioned Ever since it first proposed "Digital Telephony" legislation in 1992, the Federal Bureau of Investigation has claimed that wiretapping enables law enforcement agencies to prevent billions of dollars in economic loss. Most recently, in a briefing book on the proposed legislation dated March 8, 1994, the Bureau stated that "[t]he economic benefit from the continued use of electronic surveillance (fines, recoveries, restitution, forfeitures and prevented economic loss) is in the billions of dollars per year." These FBI figures are derived from a cost-benefit analysis the Bureau drafted in May 1992 to justify the substantial cost the telecommunications industry would need to bear in order to comply with the legislation. Among other things, the FBI analysis claimed that electronic surveillance had prevented more than $1.8 billion in "potential economic loss" between 1985 and 1991. CPSR has now obtained government documents under the Freedom of Information Act (FOIA) that raise substantial questions as to the accuracy of these numbers. The documents contain comments on the Bureau's cost-benefit analysis from various components of the federal government, including the White House. These internal critiques of the FBI analysis include the following: * May 22, 1992 memo from the White House: "The analysis should make consistent assumptions with respect to both costs and benefits. The benefits analysis should reflect clearly that only some cases involve electronic surveillance; that some surveillance could continue in the absence of this legislation (at least for some period of years); and that some convictions could probably still be obtained absent surveillance." ... "The analysis does not consider the existence of or the potential for other forms of surveillance that might compensate for the reduction in telephone wiretapping capabilities." ... "On p. 4 and p. 6, certain figures representing 'prevented potential economic loss' are cited. Please explain what losses are encompassed in those figures and how they are calculated." ------------------------------------------------------ * May 22, 1992 memo from Office of the Vice President: "In several places in the analysis, figures are cited without reference to their sources or to how they were derived. For example, on p. 4 a figure of $1.8 billion is cited for potential economic loss. ..." ------------------------------------------------------ * May 26, 1992 memo from Treasury Department: "It is difficult to do a critical analysis of DOJ's cost benefit package without a full explanation of how DOJ arrived at its cost/benefit figures, and what costs and benefits were included in those figures. It is not clear that DOJ knows, or could know, all the costs and benefits involved, but this should be clearly stated." ------------------------------------------------------ In addition to these new documents, industry officials at a Congressional hearing on March 18 sharply questioned the FBI's figures. Roy Neel, President of the US Telephone Association, disputed the FBI's figures that the bill would only cost around 300 million, citing that just revising call forwarding would cost an estimated $1.8 billion. ----------------------------------------------------------------

1 0

Counter-Intelligence Provisions Pass Senate
by Dave Banisar 17 Dec '03

17 Dec '03

[2] National Security Provisions Added to Competitiveness Act In March, the US Senate added several controversial provisions to S. 4, the National Competitiveness Act of 1994, to make counter-intelligence surveillance easier. The amendment, named the Counter-Intelligence Improvement Act of 1994, was introduced by Senator William Cohen (R-ME) and approved by a voice vote March 10. S. 4 passed the Senate on March 16 and is now pending in the House of Representatives as HR. 820. One provision makes it easier for the FBI to obtain credit reports. Another allows the secretive Foreign Intelligence Surveillance Court to authorize break-ins. Section 1011(b) authorizes the FBI to obtain the credit reports of individuals without a warrant if a designee of the Attorney General sends a letter to the credit bureau stating that the subject is the target of a counter-intelligence investigation and they have "specific and articulable facts" that the person is a foreign agent. Section 1011(c) allows the FBI to obtain the name, address, former addresses, current and former places of employment of a person from a credit bureau with a written request stating that "the information is necessary to the conduct of an authorized foreign counterintelligence investigation." The credit bureaus are prohibited from disclosing to the people that their reports have been obtained. The only oversight is a yearly report presented to the Intelligence Committees of the House and the Senate. Another provision allows the Foreign Intelligence Surveillance Court, (FISC) a secretive court of 7 specially chosen judges created by the Foreign Intelligence Surveillance Act of 1978 to authorize physical searches. The court currently only has jurisdiction to authorize electronic surveillance in counter-intelligence cases. Since its formation in 1979, it has never rejected any of the 6,500 requests by the government for a electronic surveillance order.

1 0

Re: Safeway + Your Privacy
by Bill Garland 17 Dec '03

17 Dec '03

Subj: Re: Safeway + Your Privacy From: Julietta <albright(a)chaph.usc.edu> Message-ID: <199404160738.AAA04602(a)nunki.usc.edu> > To: sandfort(a)crl.com (Sandy Sandfort) >Date: Sat, 16 Apr 1994 00:38:57 -0700 (PDT) >CC: cypherpunks(a)toad.com >> C'punks, >> >> On Fri, 15 Apr 1994 killbarny(a)aol.com wrote: >> >> > Safeway food stores has this neat little [glitch in their] shopping database... ^ ^ --- My [BillG] inserted square brackets there...intentional change of meaning, remove the glitch part... related to below. [Comment about the glitch itself interjected below below.] --- >And Sandy Sandfort responded: >> >> And what, pray tell, would be your cause of action? Why don't you just >> pay cash if you are so bothered? > >The thing is- yes of course, one coulpd pay cash to avoid Safeway- and in >fact, perhaps that is one must do. Okay. End of that problem. Now then, what's all this: > However, it seems to me that we a re >touching on alarger issue here- and that is the fact that these practices >amount to societal surveillance techniques which are being employed with >greater and greater frequency. No they don't. Let's assume for the moment that I own Safeway. Well, the original author did mention the guy's name, in a somewhat derogatory way...anyway, That's MY neat little database there. I can do with it what I want. What I want to do with it is ..... IRACIS. (Increase Revenue, Avoid Cost, Improve Service). Actually, if you want to look at a larger issue, consider working towards achieving your goals, sort of increasing extropy, as it were, by using intelligent technology... This is not societal surveillance. Oh, sure, I can sell my mailing lists, and if my list buyer wants forty year old left handed albinoes who recently purchased books about cats, then you can be sure she will get them, and she will sell them again, and the PTB will eventually find out. Unless, of course, I have in some way assumed an obligation to my Customers not to do this. The one thing I wouldn't want to do with my neat little database is piss the Customer off. >One has to get a bit nervous, it would seem- >when it becomes easier and easier for the powers that be to track your >every move- including the videos you have rented, the people you have >spoken with or correspaonded with, the books and magazines you have read, >etc. Everything is on the record. If you don't want records kept, well, that's absurd... records will always be kept. They wont always be accessable by those powers you fear, if you do your homework, now. I know I'M not putting cripple chips in any of my stores. Anyone caught with tessera cards is fired on the spot, since this is de facto evidence that you are a government spy. And their name goes into BlackNet... >This may not be of concern to the average citizen who is content with >going to work and going home and watching TV every night- Okay, let's not be concerned about them - no, wait, they are our Customers! They will have more money to spend in my stores if they have enough left after taxes. Gee, if they didn't have to pay so many taxes, ... > but for those who >don't buy into or are actively hostile towards the dominant hegemonic >ideology of this country- Hey. Cypherpunks, are we all active in our hostility now? The BlackNet Police are watching you. For extra points, name the dominant hegemonic ideologies of all G7 countries. > surveillance may in fact become a real concern. >Computers make such surviellance, as we have seen, more and more feasible >on a grander scale- both in terms of the amount of information it is >possible to obtian about a person, and in terms of the amount of people >which can easily be watched. Sorry if this sounds offensive to you, as I do not wish to offend - even though I would like to own Safeway... My own hostility is tongue-in-cheek - but once again, I get to surveil my own cash registers, pos terminals, inventory systems, etc, and my neat little database knowbot gives me a strategic advantage in producing my income, as well as the income of all those oppressed minions who are forced into employment contracts in my stores, so you might just as well assume I am going to make use of it. If I don't, someone else will. In fact, even if I do someone else will - they already are. --- Trying to exploit some misguided feelings about a glitch because you feel watched - back to the original threadline for a moment - It seems to me, as a customer, that I want my cheques cleared fast in the checkout line, just as I want laser bar code scanners. I hate wasting time looking at chocolate bars. If I don't want them to know I really do buy chocolate bars and cigarettes and that is why I gained weight and got emphysema and that is why they might cancel my government sponsored health care insurance, and OH YEAH, that's why they use my SmartHealthCard as ID, well, then, I might just stop writing cheques. Steal your cheques, indeed! Why not just go tell Mr. Wasisname whom you seem to hate so much that his system could be cracked if someone knew what you know and hope he gives you a reward for it. I wouldn't recommend blackmailing him... --- Back to the newer sub-thread from Julie - > I am not suggesting a grand conspiricy, although I think that >computer technology could potentially inadvertently give great power to a >centralized government. I suppose that is why it is so important not to >merely say "Hey- pay cash"- but rather to think about the further >implications of surveillance via computer in our society. Ciao for now, Hey, we have already inadvertently given great power to a centralized government. We - many of us - well, some of us, well, er, I'm sure at least Tim May and myself, are just trying to get some of it back, and not to give them any more. [Actually, Tim and I seem to have given great powers to _different_ centralized governments, eh! You can't get away from them - yet.] >Julie Bill Garland, whose .sig is watching you

1 0

anti-clipper autobomber
by rarachel＠prism.poly.edu 17 Dec '03

17 Dec '03

I found this on comp-privacy. Maybe we can use a scheme like this one to send anti-clipper information over the net... Does toad.com have a usenet news feed? If so, maybe we can have a program written that scans for keywords and mails the author of the message some info about cypherpunks and clipper and digital telespying 2. I do however strongly suggest that the automail bomber keep records of who it sent a particular anti-clipper message to. We don't want to actually mailbomb people with 500 copies of the same message. Just one article would do. We could also have this program autobomb different articles based on different keywords. It would be a good idea to also keep a list of names of those who complained so we don't send'em anything again, and separate "already-sent-to" lists for different articles with a central universal "no-send" list. I would guess that this could be done with a daemon and a couple of scripts, or perhaps some atrun'ed program. The 1st program would scan all the articles for the keywords and useraddresses. It would then append any usernames it finds that have sent messages with keywords that may indicate a favorable response to the article to the article's mail list. The second program would then take the mail list for each article and remove any names found in the universal "send-no-mail-to-me" list, and in the "already-sent-to" list. The resulting list could be fed to perhaps majordomo(?) or just passed to a mailer along with the text of each article. The name would then be thrown in the "already-sent-to" list after the message completed. Perhaps at the bottom of the mailed article we can have some instructions on subscribing to cypherpunks, or telling this autobomber to put the name into the "no-send" list. Perhaps a message to majordomo with "remove autobomber" or something... I'd imagine that this would create quite a lot of traffic for toad.com, not to mention the requirements of huge names lists... Maybe if the articles are periodic and are no longer sent after a month, it can help keep the storage and traffic in check??? Anyway, here's the article: Article 1117 of comp.society.privacy: Path: prism.poly.edu!cmcl2!yale.edu!yale!gumby!newsxfer.itd.umich.edu!gatech!howland.reston.ans.net!vixen.cso.uiuc.edu!uwm.edu!computer-privacy-request From: "Paul W. Robinson" <PAULW(a)TDR.COM> Newsgroups: comp.society.privacy Subject: Every Move You Make...I'll Be Watching You Date: 14 Apr 1994 23:41:27 GMT Organization: Computer Privacy Digest Lines: 39 Sender: comp-privacy(a)uwm.edu Approved: comp-privacy(a)uwm.edu Message-ID: <comp-privacy4.52.5(a)cs.uwm.edu> NNTP-Posting-Host: 129.89.2.6 X-Original-Submission-Date: 14 Apr 1994 02:43:17 -0400 (EDT) X-Submissions-To: comp-privacy(a)uwm.edu X-Administrivia-To: comp-privacy-request(a)uwm.edu X-Computer-Privacy-Digest: Volume 4, Issue 052, Message 5 of 19 Originator: levine(a)blatz.cs.uwm.edu "Paul W. Robinson" <PAULW(a)TDR.COM> stated: Here's something which might be of interest to you. A large Educational Instuitution's computer is watching everything sent in newsgroups and possibly in some mailing lists. I am using a modified address of PAULW(a)TDR.COM instead of PAUL because that computer has already sent me a message to PAUL(a)TDR.COM. I want to try to see what it does this time. In one list I mentioned that the Massachusetts Institute of Technology (you know what the 3 letter abbreviation is) has a system that collects E-Mail addresses of people who post to newsgroups. That site used to be called "pit-manager". I am writing this message in this way to see what happens. Apparently, any time one of the Institute's computers sees a reference to "pit-manager" it mails a message to the sender telling them that the site was changed to the address "rtfm". I am not referencing the internet address that ends in .EDU here for that educational Institution because I want to see if the Massachusetts Institute of Technology's computer is checking based upon someone using the name "pit-manager" or is it because of reference to the Institute's domain name with that term used within the message? I don't know if a program that is sending out messages based on it scanning the contents of messages that it saw is a good idea. Consider a program that checked for spelling errors and criticized people who misspelled words by telling them of all the words they misspelled. (Considering how bad some people's writing is, that might not be a bad idea.) This sort of practice could be prostituted into to all sorts of interesting political correctness tactics by having automated programs that watch for comments someone doesn't like and mailing the writer complaints. --- Paul Robinson - Paul(a)TDR.COM

2 1

Blind signature cash patents
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

A little while ago someone posted about a new company that would do patent searches via email requests. For another week they are doing free searches as an introductory offer. I did a search on blind-signature based cash systems, and these are the patents it found. This might be useful for those considering implementing electronic cash. Full text of patents are available for $4.95. The kind of search I did for free will cost $149 after another week. People are allowed 3 searches per day for free until then. For more info send a message with just "help" in the body to spo_patent(a)spo.eds.com. Hal 2 04977595 19901211 380/24 Method and apparatus for implementing ++electronic++ ++cash++ Inventor: Ohta; Kazuo Assignee: Nippon Telegraph and Telephone Corporation Abstract: In an ++electronic++ ++cash++ implementing method, a user makes a ++bank++ apply a ++blind++ signature to user information Vi produced, by a one-way function, from secret information Si containing identification information, thereby obtaining signed user information. Further, the user makes the ++bank++ apply a ++blind++ signature to information containing authentication information Xi produced, by a one-way function, from random information Ri, thereby obtaining signed authentication information. The user uses an information group containing the signed user information, the signed authentication information, the user information and the authentication information, as ++electronic++ ++cash++ for payment to a ++shop++. The ++shop++ verifies the validity of the signed user information and the signed authentication information, and produces and sends to the user an inquiry. In response to the inquiry the user produces a response Yi by using secret information and random information and sends it to the ++shop++. Having verified the validity of the response the ++shop++ accepts the ++electronic++ ++cash++. 3 05224162 19930629 380/24 ++Electronic++ ++cash++ system Inventor: Okamoto; Tatsuaki Assignee: Nippon Telegraph and Telephone Corporation Abstract: In an ++electronic++ ++cash++ system, K sets of ++blind++ signature information are derived from secret information containing identification information of a user, K/2 sets of them are opened and a ++bank++ attaches a ++blind++ signature to the remaining K/2 sets of information. The user obtains a signed license from the ++blind++ signature. The user generates ++blind++ signature information from the license and a desired amount of money and gets a ++blind++ signature of the ++bank++ to the ++blind++ signature information and obtains ++electronic++ ++cash++ signed by the ++bank++ from the ++blind++ signature. The user presents to a ++shop++ a residue power root of a node in a money hierarchial structure and the ++electronic++ ++cash++, corresponding to the amount of money to be used, and the ++shop++ verifies their validity and, if they are valid, offers inquiry information to the user. The user offers, as response information, a residue power root of the node corresponding to the amount of money to be used to the ++shop++. The ++shop++ verifies the validity of the response information and, if it is valid, acknowledges the payment with ++electronic++ ++cash++ of the amount of money to be used. 4 04759063 19880719 380/30 ++Blind++ signature systems Inventor: Chaum; David L. Abstract: A cryptographic system allows, in one exemplary use, a supplier to cryptographically transform a plurality of messages responsive to secret keys; the transformed messages to be digitally signed by a signer; and the signed transformed messages returned to the supplier to be transformed by the supplier, responsive to the same secret keys, in such a way that a ++digital++ signature related to each original message is developed by the supplier. One important property of these systems is that the signer cannot determine which transformed message received for signing corresponds with which ++digital++ signature-even though the signer knows that such a correspondence must exist. 6 04914698 19900403 380/30 One-show ++blind++ signature systems Inventor: Chaum; David Abstract: Numbers standing for ++cash++ money can be ++spent++ only one time each, otherwise the --account-- from which they were ++withdrawn++ would be revealed. More generally, a technique for issuing and showing ++blind++ ++digital++ signatures ensures that if they are shown responsive to different challanges, then certain information their signer ensures they contain will be revealed and can be recovered efficiently. Some embodiments allow the signatures to be unconditionally untraceable if shown no more than once. Extensions allow values to be encoded in the signatures when they are shown, and for change on unshown value to be obtained in a form that is aggregated and untraceable. 11 04949380 19900814 380/30 Returned-value ++blind++ signature systems Inventor: Chaum; David Abstract: A payer party obtains from a signer party by a ++blind++ signature system a first public key ++digital++ signature having a first value in a withdrawal transaction; the payer reduces the value of the first signature obtained from the first value to a second value and provides this reduced-value form of the signature to the signer in a payment transaction; the signer returns a second ++digital++ signature to the payer by a ++blind++ signature system in online consummation of the payment transaction; the --paper-- derives from the first and the second signature a third signature having a value increased corresponding to the magnitude of the difference between the first and the second values. Furthermore, the following additional features are provided: payments are unlinkable to withdrawals; a ++shop++ between the payer and signer can be kept from obtaining more value than desired by the payer; the first value need not be revealed to the signer or intermediary in the payment transaction; the returned difference can be accumulated across multiple payment transactions; and the returned difference can be divided between a plurality of payment transactions. 19 04759064 19880719 380/30 ++Blind++ unanticipated signature systems Inventor: Chaum; David L. Abstract: An improved ++blind++ signature system not requiring computation during ++blinding++ for anticipating which of a plurality of possible signatures will be made during signing, while still allowing the ++blinding++ party to unblind and recover the unanticipated kind of signature on what was ++blinded++. An exemplary embodiment ++blinds++ by forming a product including a plurality of generators raised to powers normally secret from the signing party, and unblinds by forming a product with the multiplicative inverse of a signed form of the generators raised to the original powers. Re-blinding allows a signature on a value to be transformed into a signature on a particular ++blinded++ form of the value. 23 04206315 19800603 380/23 ++Digital++ signature system and apparatus Inventor: Matyas; Stephen M. Assignee: International Business Machines Corporation Abstract: A ++digital++ signature machine provides a simplified method of forming and verifying a signature that is appended to a ++digital++ message. A sender transmits a signature with the usual signature keys and with validation table entries that correspond to the unsent keys and with the compressed encoding of the next validation table. The receiver uses the compressed encoding of the next validation table to form validation table entries from the signature keys so that the receiver has a full validation table. This validation table is compressed and compared with the compressed encoding which was received from the sender in a preceding message.

1 0