December 2003 - cypherpunks-legacy

Digital Cash
by mpd＠netcom.com 17 Dec '03

17 Dec '03

Tim writes: > If Frank the Forger, to pick a standard sort of crypto > example, takes a set of bits (possibly made with the > elaborate system Mike Duvos described in an earlier posting) > and copies that set of bits n times and then "spends" them n > times, how can any of his recipients know that parallel > transactions are happening, that the "same" money is being > spent n times and that it is very likely that n - 1 of the > recipients will be screwed? I didn't mean to oversell the degree to which the scheme deters multiple spending. It doesn't prevent multiple spending. It merely breaks the anonymity of the perpetrator if two or more people he has transacted the same note with break their own anonymity and voluntarily cooperate with the bank. There is nothing to prevent you from making N copies of your floppy, spending each one, and hopping the next plane to Argentina. Sad but true. In the real world, there would have to be some sort of limit on the number of times such a spoofed transaction could propagate before being cleared with the central bank, much like restrictions on multiple-party checks today. Merchant cooperation would also be necessary. Probably easy to get with the corner store than with the local cocaine dealer. > The other main approach is to build in to the blinding > protocols which protect anonymity ways to detect the > identity of those who spend a unit of digital money more > than the specified number of times. "Double spenders" is the > common term. This can avoid online clearing, but at the > expense of additional protocol complexity and some peculiar > wrinkles which can develop. This is really all I had in mind. Again, double spending is discouraged but not prevented. If you are leaving town and never returning, you can go on a shopping spree. -- Mike Duvos $ PGP 2.3a Public Key available $ mpd(a)netcom.com $ via Finger. $

3 2

A public alternative to clipper?
by an62213＠anon.penet.fi 17 Dec '03

17 Dec '03

> Also, the development of clipper was done with tax dollars. > The government has no need to recoup its investment in developing the > chip. Therefore, they can sell the chips at the cost of > manufacturing, and forget the R&D. That ability to ignore the bottom > line is a pretty powerful mechanism. If a clipper phone costs $100 > less than the alternative, because we the taxpayers already paid for > it, Clipper becomes more and more the only choice. Well, then. Maybe it's time to develop our own PGP chip. Would the PGP routines fit in a large PGA? What's the smallest, cheapest alternative we can come up with? If we give away the PGA code freely, that would help reduce the cost of inclusion in a commercial product. An FPGA would give the user the ability to change keys with little trouble. Upgrading is as easy as swapping a prom. (Better yet have an onboard programmer.) Even then, I would guess that a lot of people would have to pay a bit more for secure communications. I think it's worth it. ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Promise her anything...
by Hal 17 Dec '03

17 Dec '03

From: Duncan Frissell <frissell(a)panix.com> > The Black Letter phrase from my Commercial Paper class in law school: > > ---------- > Negotiable Instrument: A promise to pay to order or bearer a sum certain > in money on or after a date certain. > ---------- The other night at the library I had a chance to browse through the Uniform Commercial Code as enacted by the state of California. It had a large section on promissory notes and commercial paper in general. The basic definition of a promissory note did include a variation on what Duncan quoted. It would appear that the legal requirements and restrictions on the issuing and sale of such notes are pretty flexible. However, in the digital realm, it is not clear whether a promissory note would truly be enforceable, in the event that the debtor refused to pay. The main question is the digital signature. One thing I wonder about is this. Suppose I simply create a file saying that I promise to pay the bearer $100 on demand. I then sign this using my PGP public key, and give it to someone in exchange for $100. This would be the electronic analogue of the issuing of a paper promissory note. The problem is, "forgery" of such notes, in the sense of duplication, is both trivial and undetectable. With paper, someone could Xerox a note and end up with two, both claiming to be worth $100. But in practice we could distinguish the original from the copy. Better forgeries might be harder to detect but in principle experts should be able to tell the difference. But with the PGP-signed document, any copies made would be completely in- distinguishable from the original. How could the debtor know to honor such a note without being able to tell whether it was the original or not? How could the holder of the note sell it to someone without them kmnowing whether it is valid? Because of this uncertainty, it seems to me that in this simplest sense digitally-signed promissory notes do not work. Such a note, even though signed, cannot be considered to carry value in and of itself because it is too easy to forge. The digital signature is of no value in preventing forgeries since copies of valid notes are just as useful as plain forgeries. Now, the more elaborate technology of digital cash can actually go a long way towards solving this problem, at least in theory. With this approach, each note has a unique serial number, and part of the agreement is that only the first presentation of a note with any given serial number will be honored. Then if the holder of a note wants to sell it to someone else, they go through a protocol with the borrower in which he verifies that the note has not been spent, and a new note is issued with a new serial number that nobody has seen before. This way the buyer of the note is protected against being sold an already-sold note. Plus, the digital cash technology allows this to be done without the debtor finding out who is selling his old notes to whom. There is no reason for him to have this information; the holder of the note ought to be able to sell it privately, and this is a good way of preserving that aspect of the transaction. So, the digital cash technology works pretty well for this application. The problem is that there have to be many additional restrictions and rules in the handling of the notes - notes have to be transferred using the special protocol, and only previously-unseen notes will be honored. It is not clear to me how these additional contractual restrictions can be incorporated into the note without violating the simplicity that Duncan quoted above. Also, in the technical sense, the blinded signatures used in digital cash do not allow the signing of a textual document. Instead, what is signed is a simple number in a specified form, and the *exponent* used in the signature is what determines the "sum certain". So the formal structure of a piece of digital cash does not match the requirement for a promissory note. There would have to be some additional documents which, for example, map the signing exponents to the note values. But again, there is no place in the note itself to put pointers to such additional documents. It is possible that the note could consist in effect of two documents, one part which is a PGP-signed text document laying out the terms and conditions which are relevant, and which states that it only has value when accompanied by a digital-cash data item, signed with the proper exponent, not previously seen by the debtor, etc. Again, then, you have to worry about fraud by the debtor, in which he claims to have seen a note before when one is presented for redemption. In order for note holders to protect themselves against this fraud there would have to be some way for debtors to prove that various notes had been spent. This might be difficult, especially if the people presenting notes for redemption are anonymous to the debtor. It's going to be hard to distinguish between the twin frauds of a holder presenting the same note for redemption twice, possibly at almost the same time from two different addresses, and the debtor who receives a note for redemption, then quickly sends it to himself as though from another holder, back-dating it a few seconds so he claims that one arrived first. Perhaps some form of registered mail for note redemptions, plus a requirement that when a conflict like this arises both presenters must identify themselves, could address some of these problems. (These problems arise for digital cash just as much, by the way.) Hal

1 0

Canon Color Copiers
by Harry Shapiro Hawk 17 Dec '03

17 Dec '03

X-Reposting Policy: Don't redistribute without permission. Rev.1.0.1 ------ From: Edward J OConnell, Thu, Mar 24, 1994 ------ @ THis dovetails with what the service guy told me about using some sort of @ piece of plastic to make stuff copy...but that was when we were working @ with the color theory--he said he could interpose this piece of clear @ material to make stuff that was the 'wrong color' copy. HE didn't say @ what it was. I am willing to think that it first looks for a color or a range of colors. (I have said that before). However, it must be looking for something special based on the test I just ran. (It could be something in the non-visable spectrum.) Does anyone know what range of the specturm the CCD devices in the CLC 550 can capture? FYI, The 550 has 5 CCD's. /hawk Harry Shapiro Hawk Manager of Computer Services Warwick Baker & Fiore habs(a)uucp.warwick.com

1 0

PGP: change ".z" to ".gz" for gzip?
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

While browsing pgp.c, I noticed it checks for several kinds of compression: static char *compressSig[] = { "PK\03\04", "ZOO ", "GIF8", "\352\140", "HPAK", "\037\213", "\037\235", "\032\013", "\032HP%" /* lharc is special, must be last */ }; static char *compressName[] = { "PKZIP", "Zoo", "GIF", "Arj", "Hpack", "gzip", "compressed", "PAK", "Hyper", "LHarc" }; static char *compressExt[] = { ".zip", ".zoo", ".gif", ".arj", ".hpk", ".z", ".Z", ".pak", ".hyp", ".lzh" }; Since gzip now uses ".gz" consistently, perhaps the ".z" should change for PGP 2.5 (or whatever the next public version will be called). I think the code would have to change more to do the right thing with both, since it uses the compressSig to decide which compressExt to try -- is this right? I guess it'd be cleaner to accept both, but probably not worth extra code that would eventually become obsolete. Diogenes (Fingerprint 6FC5C2A5D1A0ED006B576AF7107D51FB)

1 0

Promise her anything...
by mpd＠netcom.com 17 Dec '03

17 Dec '03

Hal writes: > Now, the more elaborate technology of digital cash can actually go a long > way towards solving this problem, at least in theory. With this approach, > each note has a unique serial number, and part of the agreement is that only > the first presentation of a note with any given serial number will be > honored. Then if the holder of a note wants to sell it to someone else, > they go through a protocol with the borrower in which he verifies that the > note has not been spent, and a new note is issued with a new serial number > that nobody has seen before. This way the buyer of the note is protected > against being sold an already-sold note. Plus, the digital cash technology > allows this to be done without the debtor finding out who is selling his > old notes to whom. There is no reason for him to have this information; the > holder of the note ought to be able to sell it privately, and this is > a good way of preserving that aspect of the transaction. Rather than have the holder and the person to whom the note is being sold go through a transaction with the issuer, one can have the issuer give his customers a cryptographically tamperproof software module which will prevent anonymous double-spending. This allows the digital cash system to work "offline" without having to connect to the bank every time two people wish to conduct a transaction. > Perhaps some form of registered mail for note redemptions, plus a requirement > that when a conflict like this arises both presenters must identify themselves, > could address some of these problems. (These problems arise for digital cash > just as much, by the way.) If you design the system so that cheating breaks the anonymity and identifies the perpetrator, then you can simply deter it in the same way we do with conventional instruments. Give the person a horrible credit rating and threaten to toss him in jail. -- Mike Duvos $ PGP 2.3a Public Key available $ mpd(a)netcom.com $ via Finger. $

1 0

MOSAIC?
by Carl Ellison 17 Dec '03

17 Dec '03

Anyone know details of the MOSAIC interface spec to the Tessera card? - Carl

1 0

clipper debate at stanford u. (fwd)
by paul braunbehrens 17 Dec '03

17 Dec '03

Found this. Hope it's not an umteenth repost (I haven't seen it yet but I use the 'd' key very liberally). ENCRYPTION AND DIGITAL COMMUNICATIONS: LAW ENFORCEMENT OR PRIVACY? An Oxford-Style Debate J. Kent Walker, Jr. (Stanford Law '87) Assistant U.S. Attorney and Coordinator, High-Tech Task Force Marc Rotenberg (Stanford Law '87) Washington Director, Computer Professionals for Social Responsibility Wednesday, March 30, 1994, 5:30 PM Stanford Law School, Room 290 Light Refreshments Served This debate brings together two nationally prominent experts in this area. You won't want to miss the verbal fireworks and the opportunity to learn more about this important question. Background ========== The Clinton Administration is promoting use of the Clipper Chip technology that provides encryption, but in a form that law enforcement can unscramble. It also backs legislation requiring design of digital communications networks so ongoing surveillance will be feasible. Law enforcement officials argue that these proposals are necessary to protect society from criminals and preserve important investigative tools. Privacy advocates contend that these proposals grant broad new powers to law enforcement agencies and diminish protection for future users of the National Information Infrastructure. Sponsored by the Stanford Law and Technology Policy Center and the Stanford Law and Technology Association. Additional Information ====================== Contact the Stanford Law and Technology Policy Center by email (Law.Tech.Policy@forsythe) or telephone (415-725-7788). To: SFRAVES(a)TECHNO.STANFORD.EDU cc: GR.CLG

1 0

Promise her anything...
by Hal 17 Dec '03

17 Dec '03

From: mpd(a)netcom.com (Mike Duvos) > Rather than have the holder and the person to whom the note is being sold > go through a transaction with the issuer, one can have the issuer give his > customers a cryptographically tamperproof software module which will > prevent anonymous double-spending. This allows the digital cash system to > work "offline" without having to connect to the bank every time two people > wish to conduct a transaction. The notion of a "cryptographically tamperproof software module" is interesting, but I'm not sure such a thing exists or could exist. The secure offline cash systems I have seen rely on tamper-resistant HARDWARE modules which at least exist although this requirement would be very inconvenient. > If you design the system so that cheating breaks the anonymity and identifies > the perpetrator, then you can simply deter it in the same way we do with > conventional instruments. Give the person a horrible credit rating and > threaten to toss him in jail. Again, I don't know how you handle the case of two almost-simultaneous attempts to redeem the same note (or piece of cash). Both notes are identical, so having the two notes gives you no more information than having just one, hence if one note is anonymous so will two be. You know someone is cheating in this situation, but who? One of the redeemers may have stolen a copy of the cash from the other; the two redeemers may be working together; or the note maker may be working with one of the redeemers having slipped them a copy of the note as soon as it was presented for redemption. How can a court decide who is right? Maybe the answer is simply to handle this as a my-word-against-yours kind of case, where reputations and histories of such conflicts would help decide who is likely to be telling the truth. Hal

1 0

Digital Cash
by mpd＠netcom.com 17 Dec '03

17 Dec '03

Hal writes: > The notion of a "cryptographically tamperproof software > module" is interesting, but I'm not sure such a thing exists > or could exist. The secure offline cash systems I have seen > rely on tamper-resistant HARDWARE modules which at least > exist although this requirement would be very inconvenient. Quite a bit of work has already been done on this concept. Basically one generates a very large sequence of machine instructions which computes the image of the output of an algorithm under a strong cipher from the image of the input under the cipher. A controlled amount of redundant information is added to both the input and output. This yields a piece of code so obtuse and complex that nothing may be gleaned about what algorithm it is executing by observing it run. Figuring out what it actually is doing is a cryptanalytically hard problem. Also, determining a way of modifying the code which does not break it is a similarly hard problem. Once encased in such a module, an algorithm may be distributed with no fear that it will be stolen. This raises interesting poblems with software patents, since one can not tell from such a module whether it is performing a function in a way which infringes. Of course, there is a severe performance penalty to be paid for such protection. But in the case of digital cash, it could provide a mechanism for implementing a secure offline system without special hardware. > Again, I don't know how you handle the case of two > almost-simultaneous attempts to redeem the same note (or > piece of cash). Both notes are identical, so having the two > notes gives you no more information than having just one, > hence if one note is anonymous so will two be. You know > someone is cheating in this situation, but who? One of the > redeemers may have stolen a copy of the cash from the other; > the two redeemers may be working together; or the note maker > may be working with one of the redeemers having slipped them > a copy of the note as soon as it was presented for > redemption. How can a court decide who is right? Assuming the transactions are done via a tamperproof module distributed by the issuer, and the math is arranged such that using a note in multiple transactions reveals the perpetrator, the system prevents anonymous double-spending while still providing all the benefits of digital cash. Of course, you could claim that someone was in possession of your tamperproof module and associated passwords, but it is your responsibility to guard these and report them stolen promptly, just as with credit cards and PINs. P.S. Is anyone worried that the Netherlands seems on the verge of banning PGP? Wasn't this country once a hacker's paradise? -- Mike Duvos $ PGP 2.3a Public Key available $ mpd(a)netcom.com $ via Finger. $

6 5