December 2003 - cypherpunks-legacy

identity, privacy, & anonymity in cyberspace
by tmp＠netcom.com 17 Dec '03

17 Dec '03

hal finney recently wrote an interesting message taking the position that cypherpunk aims are not so much to pursue total anonymity but to promote systems with a variety of degrees in identity and pseudonymity so that the appropriate level can be achieved in various settings. (for example, borrowing money seems to require that one sacrifice some degree of anonymity and privacy). below is a message i have taken to represent the cypherpunk position from hal finney. this came from chaos.bsu.edu, a fun gopher server with a lot of cypherpunk position papers (i assume they are representative). in it, hal argues against identifying anonymous messages, saying that it would mark them with a `scarlet a' and relegate them to the `ghetto'. his recent comments seem more accommodating and less extremist. >The level of anarchy will >inevitably increase as larger numbers of people acquire net access. it seems to me that the cypherpunks already have a name for the kind of anarchy that can happen when somebody uses pseudonyms to harass and cause trouble. that word is `detweiler'. do you really know what `anarchy' is, cypherpunks? as the old parable goes, be careful what you wish for, you might get it. hal argues below that `you already know nothing about the people you interact with on the net' and that `anonymous remailers introduce no more problems than are already present on the net'. these seem to me to be flawed arguments. here's why. first of all, everyone has the experience of going to a party and knowing nobody there. but the fun of the party is learning about the people who are there! do we really want an online environment where identity is as transitory as a nym on IRC? it seems that what everyone is craving behind the banging on the keyboard is what has been called active, human `interconnection' to contrast it to `interaction' with a computer alone (still generally considered an inanimate object). if we want communities, the places we like to live in, it seems that identity is intrinsic to them. next, `anonymous remailers do not introduce any problems beyond those that already exist'-- aren't we trying to *solve* the problems associated with building an online community, our civilizations in cyberspace? it seems to me that if cypherpunks want the rest of the world to adhere to their ideas, they have to show how they are *superior* to those already present, and how they *solve* nagging problems. yes, remailers solve the problem of trying to post messages without identity, but are we sure this is a `problem' we want to `solve'? for example, hal notes that some system operators completely ignore complaints on the net. but do we really want a community of system operators that simply throw any feedback to /dev/null? what about when someone is mailbombing Usenet from a site? isn't what we *really* want a more basic definition of what is allowed and what is not? besides, under the cypherpunk vision, operators would never censor a user for postings-- but is it the case that all cypherpunks can say they have never tried to censor anyone by notes to sysadmins, i.e. of detweiler? regarding the pseudonymity issue, it seems to me a more basic, fundamental design goal might be this: we wish to make sure that people do not use sensitive private information against us. it is not a problem for our friends to know this information-- in fact it is critical that they do (friendship is based on identity!). the cypherpunk vision seems to split the world into two groups: those people i trust (my friends) and everyone else (whom i completely distrust with intense paranoia). this is a very xenophobic and chauvinistic philosophy at heart. hal argues below that there is `no line dividing the clean from the unclean' (real name vs. pseudonymous vs. anonymous etc.). to the contrary it seems to me to be the case that either `i know who you are' or i don't. what does it mean for me to `know who you are'? i admit there is no basic definition, but it does seem to me that should not prevent us from trying to find one. for example, it seems to me you cypherpunks have a very important agenda, but you seem to be extremists. the important goal is `defining what privacy really means' and cypherpunks seem to take the position, `it means that nobody knows anything about me'. our society simply cannot function under this constraint. if i wish to `interconnect', identity is necessary to minimize risk to the people i `interconnect' with. so what the cypherpunks might consider is a less extremist elucidation of what `privacy' means. for example, cypherpunks, what information should a bank be allowed to have on you when you go in to request a loan? what should companies be allowed to do with credit histories, and what rights does the individual have to influence them? if you continue to insist that `nobody should know who i am' i fear you will be bypassed by more sophisticated groups that have a less polarized view of issues of identity and privacy. and it will ultimately be the least controversial proposals that will shape the future we live in. the recent hal finney message as well as recent considerations of `morality' on the list (albeit quizzical) suggest to me you might be open to a more conciliatory, less dogmatic position on these immensely important issues. i am going to sign off for awhile in an attempt to advance some new meaningful projects (such as set up a gopher server), but i thank you for your stimulating conversations and email, and i apologize to anyone i have ever offended (send me mail if you feel i have personally left something unresolved). hal finney's message follows. pseudonymously yours, --tmp -----BEGIN PGP SIGNED MESSAGE----- I sent mail to Cypherpunks on this a couple of days ago, but it never appeared. There is a problem with the notion that all "anonymous" remailers and news-posting services should label their messages as anonymous so that users can decide whether to read them or not. This approach abandons one of the strongest arguments in favor of anonymous remailers, which is that the net is inherently an anonymous environment. Especially as more public access Unix systems, BBS systems, and so on become part of the net, we are going to see less and less of the strict controls on identity which were possible when the net was restricted to a few government labs and large universities. The level of anarchy will inevitably increase as larger numbers of people acquire net access. Unless massive and universal authentication efforts are undertaken, it is going to be more and more the case that you will know little about the true identity of a poster. Because of this, those who object to having to read the words of an "anonymous" poster are taking an untenable position. They are already reading words of people about whom they know no more than they would about an anonymous poster. And the argument that "non-anonymous" posters are subject to a form of discipline not available to anonymous posters - messages to the system operator - is clearly falsified by the existance of many sysops who care nothing about complaints. As more and more people run their own machines with net access, these cases will only increase. In short, we anonymous remailer operators have every right to be part of the net. We introduce no more problems than are already happening and will continue to occur as the net grows and becomes more universal. The resistance we've seen is from old-time sysops who are unable to adjust to a changing network environment. Rather than placating obsolete beliefs about network identity by agreeing to mark our messages with the scarlett letter A for anonymity, by accepting that we deserve to be in a ghetto set aside for inferior posts, I feel that we should challenge the net with messages that blur the distinction between anonymous and authenticated posts. The sooner people realize that there is no line that divides the clean from the unclean, the sooner anonymity will be widely accepted on the net. Hal Finney 74076.1041(a)compuserve.com -----BEGIN PGP SIGNATURE----- Version: 2.1 iQCVAgUBK7S2oqgTA69YIUw3AQEfagP8DlzINcvUDn7jc351S+hHTBz5NtB3RbRC l+0rgltFcn6QxWaE0GsWFcOa6RcPOe1DOTlwiJejiT6MbnfuDopbUoS98bCiIzLE 0Q2ZVhtsfLs5zFdUj08bRzzU7zyuzSmNoSsCx01O6OiGZB/zs0PEnx/0XqRtXFD2 RM1YTCPIF7Y= =0zw5 -----END PGP SIGNATURE-----

1 0

Re: Zero Knowledge, Hamiltonian Cycles, and Passwords
by Derek Upham 17 Dec '03

17 Dec '03

> A potential use for such systems is for passwords--one can prove one > has the knowledge without actually producing it (by typing in a > password, for example). I don't know that anyone is actually > exploring this application, yet, but I expect it'll come. Look at "Strongbox: A System for Self-Securing Programs" by J. D. Tygar and B. S. Yee in the "CMU Computer Science 25th Anniversary Commemorative" proceedings (from 1991). As the paper describes: ``Strongbox uses an authentication protocol derived from Rabin's observation about the square root operation: if one can extract square roots modulo n where n=p*q , p and q primes, then one can factor n . [That should be `if and only if', i.e., finding the square roots is too hard unless you created n in the first place.] Both our protocol and FFS are *zero-knowledge authentication protocols_* [. . .] And in contrast to Needham and Schroeder's authentication protocol, zero-knowledge authentication protocols require no central authentication server and thus there is no single point of failure that would cripple the entire system.'' In addition to zero-knowledge authentication, the paper provides an algorithm for the secure exchange of sessional symmetric encryption keys, and ways of combining authentication and key-exchange steps. I managed to get the key-exchange working some months back (in C++, using GMP to handle the number-crunching), but it was hampered by my incredibly slow 386 on one side and odd bugs in the Sun4 environment on the other. Contact me if you want to hack around on it. I also know where to find unreleased GMP 1.9 sources for some additional, probably more reliable, functions for calculating the Legendre symbol (which the whole system depends upon). Derek

1 0

Re: Zero Knowledge, Hamiltonian Cycles, and Passwords
by cfrye＠mason1.gmu.edu 17 Dec '03

17 Dec '03

Tim- I'd be interested in seeing your previous posts on this subject. Curt

1 0

talk encryption
by cheney＠hurricane.seas.ucla.edu 17 Dec '03

17 Dec '03

Hi. I was told I could ask you about an encryption system for the unix "talk". Do you know where I might find one? Thanks in advance, -mike

1 0

Day-One trailer
by Black Unicorn 17 Dec '03

17 Dec '03

Monday the 11th on Day One: Have we taken a wrong turn on the information superhighway? Looks like they are going to look into porn on the nets with a real bias media eye. I don't give day one much credit either.... -uni- (Dark)

1 0

fermats theorem. possible urban legend
by Grand Epopt Feotus 17 Dec '03

17 Dec '03

While ona BBS someone brought up something about Fermat's Last THerorem being proven and that renders all crypto broken. After trying to figure out what the hell this person was talking about I figured that he apparently believes that all encyptian schemes are based on large numbers, and since Fermats Theoremn is something like proving that youca find the solution for a^n + b^n = c^n that all of the codes are broken. Now please dont mistake me for someone who has fallen for this, but I am just wondering what the hell this guy is talking about? You're eqipped with a hundred billion nueron brain, that's wired and fired, and it's a reality generating device, but you've got too do it. Free youself ----Tim Leary----

1 0

Re: bumperstickers
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> They can have my crypto when they pry it from my cold, dead, keyboard. Or when they listen to the electromagnetic emanations from your live non-TEMPEST keyboard :-)

1 0

Prime Numbers
by Jeremy Cooper 17 Dec '03

17 Dec '03

I found something interesting that I have not proven, but it has not failed yet: The integer N is prime if: 2^N - 2 --------- N is an integer. Don't ask how I found it, I was just fooling around. Now: Is there some way to reverse the formula so we can insert and integer and get a prime number out? Let me know, I am over excited. _ . _ ___ _ . _ ===-|)/\\/|V|/\/\ (_)/_\|_|\_/(_)/_\|_| Stop by for an excursion into the-=== ===-|)||| | |\/\/ mud.crl.com 8888 (_) Virtual Bay Area! -===

6 5

TCMay's posting on zero knowledge, last year
by Matt Thomlinson 17 Dec '03

17 Dec '03

Here's what I grabbed from the list last time this came up.. By the way, this is one of the documents I have up for viewing via www (see .sig). mt Matt Thomlinson University of Washington, Seattle, Washington. phone: (206) 548-9804 Check my home page -- ftp://ftp.u.washington.edu/public/phantom/home.html PGP 2.2 key available via email, or finger phantom(a)hardy.u.washington.edu Date: Wed Apr 7 21:42:08 1993 From: tcmay(a)netcom.com (Timothy C. May) <tcmay/daemon> Subject: MATH: Zero Knowledge Proofs [Since this should also be of interest to the Cypherpunks list, which Ray is/was subscribed to, I am posting this essay to that list.] Ray Cromwell writes: > Could someone explain zero knowledge proofs and give me an example. I >have taken number theory and abstract algebra so feel free to use equations. > >(I know that zero knowledge proofs are a way of certifying something without >revealing the information you are certifying, but I want to know how they >work mathematically) Zero knowledge interactive proof systems ("ZKIPS") are sometimes called "minimum disclosure proofs" (with some subtle differences) and are exciting and mysterious (at first) methods that lie at the heart of modern cryptology. Here's a simple explanation. Too bad we don't have a blackboard! ALICE AND BOB (some people call them Peggy the Prover and Vic the Verifier) Alice wishes to prove to Bob that she knows some item of knowledge without actually giving Bob any of that knowledge. Let us first imagine that Alice claims she knows a "Hamiltonian cycle" on a particular graph. (For a given set of nodes and arcs linking some of those nodes, a Hamiltonian cycle is one which passes through each node once and only once. You might want to draw some graphs on a sheet of paper and try to find a Hamiltonian cycle for the graphs, to get a feel for the problem.) The particular graph may be "registered" somewhere with Alice's claim that she--and only she, for reasons I'll discuss at the end--knows a Hamiltonian cycle for the graph. In a sense, this is her "proof of identity." To make this example concrete, Alice is using this piece of knowledge as her *password* to get into some system. She presents a map of 50 cities and some set of highways interconnecting them and says "I am who I say I am if and only if I know a Hamiltonian cycle for this graph." The conventional (non zero knowledge) way to convey this knowledge is for Alice to simply *show* the Hamiltonian cycle to Bob. This is how passwords are currently handled. Bob, and anybody else who is spying on the exchange, then knows the "secret," which isn't a secret anymore. (Anybody who saw the exchange, including Sysadmin Bob, could then impersonate her.) ENTER ZERO KNOWLEDGE Alice, instead of showing Bob the Hamiltonian cycle, takes the cities and covers them with something, say, coins. (On a computer, this is all done in software, using the cryptographic protocol called "bit commitment.") Alice scrambles the position of the cities (covered by coins) so as not to allow positional cues. (Most of the 50 cities should have about the same number, ideally exactly the same number, of links to other cities, to ensure that some cities are not "marked" by having some unique number of links. A detail.) Needless to say, she scrambles the cities out of sight of Bob, so he can't figure out which cities are which. However, once she's done with the scrambling, she displays the cities in such a way that she can't *later change*..i.e., she "commits" to the values, using well-known cryptographic methods for this. (If this sounds mysterious, read up on it. It's how "mental poker" and other crypto protocols are handled.) Bob sees 50 cities with links to other cities, but he doesn't have any way of knowing which of the covered cities are which. Nor, I should add, are the links labelled in any way--it wouldn't do to have some links permanently labelled "Route 66" or "Highway 101"! She says to Bob: "Pick one choice. Either you can see a Hamiltonian cycle for this set of covered cities and links, or you can see the cities uncovered." In other words, "Alice cuts, Bob chooses." Bob tosses a coin or chooses randomly somehow and says: "Show me the cities." Alice uncovers all the cities and Bob examines the graph. He sees that Akron is indeed connected to Boise, to Chicago, to Denver, not to Erie, and so on. In short, he confirms that Alice has shown him the original graph. No substitution of another graph was made. Bob, who is suspicious that this person is really who she claims to be, says to Alice: "Ok, big deal! So you anticipated I was going to ask you to show me the cities. Anybody could have gotten Alice's publicly registered graph and just shown it to me. You had a 50-50 chance of guessing which choice I'd make." Alice smugly says to him: "Fine, let's do it again." She scrambles the cities (which are covered) and displays the graph to Bob...50 covered cities and various links between them. She tells Bob to choose again. This time Bob says: "Show me the Hamiltonian cycle." Without uncovering the cities (which would give the secret away, of course), Alice connects the cities together in a legal Hamiltonian cycle. Bob says, "OK, so this time you figured I was going to ask you the opposite of what I did last time and you just substituted some other graph that you happened to know the Hamiltonian cycle of. I have no guarantee the graphs are really the same." Alice, who knows this is just the beginning, says: "Let's do the next round." ...and so it goes.... After 30 rounds, Alice has either produced a legal Hamiltonian cycle or a graph that is the same as (isomorphic to...same cities linked to same other cities) the registered graph in each and every one of the rounds. There are two possibilities: 1. She's an imposter and has guessed correctly *each time* which choice Bob will make, thus allowing her to substitute either another graph altogether (for when Bob wants to see the Hamiltonian cycle) or just the original graph (for when Bob asks to see the cities uncovered to confirm it's the real graph). Remember, if Alice guesses wrong even once, she's caught red-handed. 2. She really is who she claims to be and she really does know a Hamiltonian cycle of the specified graph. The odds of #1 being true drop rapidly as the number of rounds are increased, and after 30 rounds, are only 1 in 2^30, or 1 in a billion. Bob choose to believe that Alice knows the solution. Alice has conveyed to Bob proof that she is in possession of some knowledge without actually revealing any knowledge at all! The proof is "probabilistic." This is the essence of a zero knowledge proof. There's more to it than just this example, of course, but this is the basic idea. SOME DETAILS 1. Could someone else discover the Hamiltonian cycle of Alice's graph? Exhaustive search is the only way to guarantee a solution will be found--the Hamiltonian cycle problem is a famous "NP-complete" combinatorial problem. This is intractable for reasonable numbers of nodes. 50 nodes is intractable. 2. If finding a Hamiltonian cycle is intractable, how the hell did Alice ever find one? She didn't *have* to find one! She started with 50 cities, quickly connected them so that the path went through each city only once and then wrote this path down as her "secret" solution. Then she went back and added the other randomly chosen interconnects to make the complete graph. For this graph, she obviously knows a Hamiltonian cycle, *by construction*. 3. Can Bob reconstruct what the Hamilonian cycle must be by asking for enough rounds to be done? Not generally. Read the papers for details on this, which gets deeply into under what circumstance partial knowledge of the solution gives away the complete solution. 4. Are there other problems that can be used in this same way? Yes, there are many forms. I find the Hamiltonian cycle explanation quite easy to explain to people. (Though usually I can draw pictures, which helps a lot.) 5. How general is the "zero knowledge interactive proof" approach? Anything provable in formal logic is provable in zero knowledge, saith the mathematicians and crypto gurus. Check out the various "Crypto Conference" Proceedings. Hope this helps. -Tim May -- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: MailSafe and PGP available.

2 1

New stego prog was "A possibility"
by rarachel＠prism.poly.edu 17 Dec '03

17 Dec '03

Hey guys, I'm in the final throes of applying some cleaning up on a bit of code I wrote a couple of years ago. I'm wondering what would be some good sites to FTP this to? (I'd like to just post it up on here, but since there are non-USA residents on this list, I don't need the NSA to come on knocking on my door as I've bigger things to worry about (like bills, graduating, etc.) Anyhow, a bit about this code: This is a program called White Noise Storm which I wrote out of an inspiration flash (and subsequently the reason I joined this list.) I had left this project to rot until recently when my school finally offered a crypto class, and decided on making this my project. Unfortunatly disaster struck and I had lost the final version of this program a few months ago, having only a buggy, unfinished backup. Suffice to say, I spent all last night infront of my 486 and resurected WNSTORM from the dead, and in doing so added some features which make it a useful program. Someone from MicroSoft had a similar idea, so I thought I'd go public with it before WNSTORM vanished totally. :-) So Ophir Ronen (Rho) <a-ophirr(a)microsoft.com>, here it comes. :-) A brief description of this program is basically an cypher box that takes in a password, a stream of random numbers, a plaintext file, and a window size specification (more on this later.) The program takes in one byte of plaintext, several bytes of random numbers (called a window) of varying size, and then takes an encrypted copy of the plaintext byte and spreads its bits across the random number window. The actual bits and bytes that get replaced in this window depends on the passkey and the previous window. The great and obvious disadvantage to WNSTORM is that the size of the cypher text is several times larger than the plaintext. Another is that this is a private key system, but that's not quite as large a sore point. However, by replacing the random number stream with the low bits of a sound, picture, movie or other noisy data, inserting the plaintext into this noise with WNSTORM, and re-injecting the low bits back into the picture gives us the possibility of an excellent stego system! WNSTORM will also try and statistically fix the bits it changes so that the outgoing cyphertext matches the incoming random noise stream statistically, making a stego sniffer's job much harder... Anyhow since I'll need to clean up both source code and documentation, I thought I'd take this opportunity and announce the program. Oh and Tim, this is what I was talking to you about a long time ago and kept secret. :-)

1 0