December 2003 - cypherpunks-legacy

Re: CYPHERPUNKS TO THE RESCUE
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 14:43 1994/07/25 -0700, Sandy Sandfort wrote: >The questions are: Could standard auto and garage door openers >easily be retrofitted? Could a "crypto remote" with its own CPU >be made small enough to fit into a hand-held unit? Could such a >system be made for a reasonable cost? ... Sounds like an application for a "challenge-response" system. But that would require transmission from garage unit to car unit. If there were syncnronized clocks then the signal could be a function of time so that the above replay would fail. That requires only a PRNG. Both units could compute the next password from the same PRNG but this would require a "backspace" button on the car unit for those occasions where the garage unit failed to hear a broadcast signal. A "reset to new known state" for both units would be required for when the state became hoplessly confused.

5 4

comments by Ron Rivest on Government crypto policy
by Hal Abelson 17 Dec '03

17 Dec '03

These are some thoughts by Ron Rivest on government crypto policy and the recent statement on Clipper. I'm forwarding them to this list with Ron's permission. -- Hal Abelson ****************************** The original intent of Clipper was to make available government (i.e., NSA) crypto technology (i.e., SKIPJACK) in a way that could not be exploited by criminals or foreign nationals. NIST and NSA wanted to help out by making some of their technology available to US industry, but wanted to do so in a way that didn't hurt other US government operations (intelligence, law enforcement). Key-escrowed clipper is the result. This is what Brent Morris and Mark Unkerholtz of NSA said in a public lecture at MIT in spring '94. They stressed the point that their main goal was not to catch crooks or do foreign intelligence better, but only to help out in a way that was not hurtful to these other operations. They didn't really expect that Clipper would catch a lot of crooks. (As is widely believed, any sensible crook will avoid using Clipper equipment.) The goal is to get their technology out, and a secondary requirement is that it be done in a way that doesn't hurt their other operations. Note that the above position is entirely consistent with an entirely voluntary use of other cryptographic techniques by industry. Trying to force industry to use Clipper, or to use key-escrowed techniques, would be equivalent to an assertion that the primary goal IS to assist law enforcement and foreign intelligence in their operations, and is thus contrary to the above position. I now concerned that the administration's recent announcement represents a serious revision of the above position. Probably the reasoning for NIST and NSA is going something like this: -- Congress (and parts of industry) wants the government to propose crypto standards. -- NIST, the FBI, and the NSA can't push forward with a standard that is non-escrowed, because their jobs are on the line if any significant use of government standards is made by "bad guys". -- They propose Skipjack/Clipper, which attempts to be "helpful" (it has a new algorithm) in a way that doesn't hurt (key escrow). But then, we have -- Significant opposition to escrowed standards by almost everyone except Dorothy Denning. Also, opposition to secret algorithms in standards. So, what do they do? -- Announce that they are reconsidering their policy on Clipper, while keeping their commitment to escrowed crypto standards. Invite proposals from industry for escrowed crypto standards suitable for software. The crypto algorithms could be public, etc. At this point, we have lost the only real contribution of the original proposal (the secret Skipjack algorithm is shelved), and the role of the government is now back just to trying to set some sort of standard. That is, they are no longer contributing technology, but only acting as a standard-setting body. However, the fixation on escrow techniques persists; no bureaucrat wants to have his job on the line for helping some "bad guy" that someday chooses to use the US crypto standard. But at this point, we have a government position that doesn't hang together. (The original position made more sense, although it didn't result in a reasonable policy.) Without government technical contributions to protect (e.g. Skipjack), the only motivations for preserving key-escrow are (1) protecting the jobs of the policy-makers should some fairly visible bad guy use government standard crypto someday, or (2) a reversal of the original policy: catching crooks and assisting foreign intelligence are now elevated from secondary constraints (due to reason (1)) to a primary goal. But it is well-recognized that catching crooks and assisting foreign intelligence in such a manner requires the *mandatory* use of an escrowed standard. Without legal requirements to do so, most manufacturers won't bother with the escrow capability. Moreover, with an adoption of public crypto standards, anyone (e.g. foreign businesses) would be free to produce their own non-escrowed implementations of the adopted crypto algorithms, and sell them in the US. It has been well argued that key escrow technology is not an effective or cost-effective means of law enforcement, etc. I think that mandating the use of key escrow technology would be unacceptable to most of the country (viz the current debate, which is running 1000 to 1 against even voluntary key escrow standards), too expensive, and too much sticky tar spread on our nascent information highway. I think everyone realizes that mandating key escrow is not desirable or realistic. Thus, we have a situation where there are four apparent choices left: (1) No government-approved crypto standards. (2) Government-approved public crypto standards with key-escrow mandatory for government use and voluntary elsewhere. (3) Government-approved public crypto standards with key-escrow voluntary for all users. (4) Government-approved public crypto standards with no key escrow. The other choices, involving secret algorithms, are not viable. I also think that (1) is not viable, although one might suspect that many government actions (and non-actions) were really directed at that goal. This leaves (2)--(4). Policy (2) makes no sense. Given the freedom to easily use the standard algorithms in non-escrowed manners (since they are public); policy (2) is not effective for law-enforcement, etc. It has considerable cost, and no justification other than the attempt of the policy-makers to try to do something that pretends not to hurt other government activities. Policy (3) might be workable. There is no mandated use of escrowed technology (even for government purchases) but manufacturers and users may voluntarily implement escrowing capabilities if they wish. Government agencies (NIST, the FBI, and the NSA) may develop and publish escrowing techniques, and support and encourage escrowing activities, as long as escrowing is not required by standards, government purchases, or routine export control policy. (I haven't mentioned export control policy before, but think that it falls in the same general category as requiring escrow for government purchases---it is an attempt to affect the (foreign) market by limiting what (US) manufacturers can do, rather than by affecting what products are offered through government purchasing power. In both cases, the government's power to affect the market is limited by the activities of other manufacturers and purchasers. Export control in support of specific policies against hostile countries (e.g., Libya?) is, in my opinion, not unreasonable, but telling our information highway manufacturers they can't export crypto is like telling our automobile manufacturers that they can export cars, but only if they contain no bolts, fasteners, or opaque trunk lids: for crypto is the "nuts and bolts" of an information system -- it links together separate components in a secure manner, and is also the means of protecting your information goods from prying eyes.) Finally, there is policy (4) -- no escrowing at all. This is, in the end, the most workable. It makes explicit that trying to achieve law-enforcement and foreign intelligence objectives by affecting government crypto standards is misguided and ultimately, harmful. Comments appreciated.... Cheers, Ron --TAB24284.775191964/cygnus.com--

1 0

Re: GUT and P=NP
by jamesd＠netcom.com 17 Dec '03

17 Dec '03

> James A. Donald writes: > > One can reduce all classical operations to "and", "or", and "not" > > operations on bits. Quantum computers include an additional > > operation that cannot be so reduced. > Mike McNally writes > Could you break the suspense and let us know what this special new > operator is? The new operator is a unitary transformation on a single bit. Note that I am using the word "unitary" in the sense of quantum physics, not in the sense of C language syntax (That is unitary, not unary) Actually this a three dimensional continuous class of transformations. Because it is continuous, quantum computers tend to rapidly lose precision. Just as any classical physical system can be simulated in polynomial time by a Turing machine using only the operations of boolian arithmetic, in the same way any quantum physical system can be simulated in polynomial time using only the operations of boolian arithmetic plus unitary transformations on individual bits. Of course actually building a quantum computer using only these operations would be rather silly. In practice one would need to use unitary three bit operations for reasons of efficiency. -- --------------------------------------------------------------------- We have the right to defend ourselves and our property, because of the kind of animals that we James A. Donald are. True law derives from this right, not from the arbitrary power of the omnipotent state. jamesd(a)netcom.com

1 0

(Fwd) Re: GUT and P=NP
by John Young 17 Dec '03

17 Dec '03

Forwarding mail by: sondheim(a)panix.com (Alan Sondheim) on Sun, 24 Jul 3:39 AM ------------------- >From fiction-of-philosophy-approval(a)world.std.com Sun Jul 24 04:08 EDT 1994 Reply-To: fiction-of-philosophy(a)world.std.com I would say that an algorithm is also a rigidly constructed framework consisting of well-defined formula within a stabilized potential well; as such it has limited operability in situations which possess fuzzy heuristics - such situations would include ordinary-language parsing, by the way, if a theoretical full-accountability is to be given. Eliminating indeterminacy and `true randomness' is eliminating the lifeworld itself, with its fuzzy heuristics not always reducible to natural law, even of the trajectory-bundles of chaos theory. So we are thrown back to a quantum computer which is reduced in the quoted text as well to a theoretical positioning; this is suspect since such a computer also functions in the lifeworld. If the brain in Penrose's text functions as _a_ quantum com- puter, what is the source of the singularity (_a_)? It seems to me that there is, in the real, deep fuzziness all the way around. Are we dealing with a group of logicians who have ignored Schutz? I think so, _precisely._ Alan

1 0

e$: Spamorama: Downtown Anywhere
by rah＠shipwright.com 17 Dec '03

17 Dec '03

If you're not interested in yet another e-commerce vendor, delete away. My POP newsgroup just put this up. Looks like CommerceNet has some competition. These folks claim that they're doing something different from secure mosaic. I'm going web diving in DA now, and I'll tell you what I find out. Cheers > Path: sundog.tiac.net!max.tiac.net!cjwoods > From: cjwoods(a)max.tiac.net (Chris Woods) > Newsgroups: tiac > Subject: Downtown Anywhere > Date: 24 Jul 1994 20:27:59 GMT > Organization: The Internet Access Company > Lines: 139 > Message-ID: <30uisf$bir(a)sundog.tiac.net> > NNTP-Posting-Host: max.tiac.net > X-Newsreader: TIN [version 1.2 PL2] > > This is an interesting tidbit you can check out using your WWW browser > (Mosaic, Chimera, Cello, Lynx, etc.). IMHO, this is laid out MUCH better > than many of the "popular" Web servers, such as NCSA and GNN. Check it out! > > http://www.awa.com/ > > Here's a "Press Release" type of document: > > Date: Fri, 22 Jul 1994 00:23:31 -0400 (EDT) > From: Sandy Bendremer <sandy(a)awa.COM> > To: cjwoods(a)tiac.net > > Contact: Jonathan Schull > For Immediate Release (716) 242-0348 > > Sanford Bendremer > (617) 522-8102 > > > > DOWNTOWN ANYWHERE BRINGS ONLINE COMMERCE TO THE INTERNET > > Downtown Anywhere Inc. announced its World Wide Web-based online > environment known as "Downtown Anywhere(sm)." Laid out like a > thriving metropolis, Downtown Anywhere's Museums, Libraries, and > Newsstands provide free and friendly access to global Internet > resources, while its Main Street allows visitors to browse goods > and innovative services that can be purchased with a few > keystrokes. Downtown Anywhere boasts the first real-time > consumer-oriented credit card processing on the Internet, and > its innovative Personal Payment system eliminates the need for > transmitting sensitive credit card numbers over the Internet. > > The Downtown Anywhere economy integrates the technologies of its > parent companies. AnyWare Associates' telecommunications > technologies, coupled with SoftLock Services' proprietary > telephone-based purchasing systems and patent-pending password > technologies, provide the unique capability to offer true > electronic commerce on the Internet. In minutes, anyone with a > credit card and a touch-tone telephone can acquire a Personal > Payment Password(sm) that can be used easily for online purchases > in Downtown Anywhere, and at other participating sites. In > seconds, information about online purchases of physical goods or > services is transmitted automatically by electronic mail or fax > to the merchants offering those products. And, if the product > is a SoftLock-secured document or program, the purchase can be > fulfilled instantly with the online delivery of a SoftLock > Password, which unlocks the product on the user's system. > > According to company co-founder Jonathan Schull, "We have tried > to eliminate the technical and financial barriers that have > tended to leave would-be merchants and consumers hitch-hiking > beside the information superhighway. Visitors will find > themselves in a comfortingly familiar environment that is > interesting and diverse." > > Sanford Bendremer, co-founder of Downtown Anywhere, said, "We've > already seen tremendous interest from small and large > organizations, that will be joining us in Downtown Anywhere. > Advertisers and merchants are looking at the dramatic size and > growth of the Internet, and they are seeing this media as a > powerful tool to reach customers." > > Bendremer added that setting up shop in Downtown Anywhere can be > inexpensive because the company has a stake in the success of > its clients. "We will certainly rent advertising space and prime > virtual real estate to those who want to pay for it, but since > we provide the transaction processing and communication services > that can make virtual businesses succeed, we will accept > commissions in lieu of up-front payments. We are also committed > to offering inexpensive accommodations to people and > organizations that can help us increase the richness and value > of our environment." > > The following are among the early attractions in Downtown Anywhere: > > o Digital Data Express: Complete Internet Training Kit > o Environmentally Sound Products Inc. > o The National Association for the Self-Employed > o The Convention Center: Site of the ComOnLine consumer trade shows > o W.W. Norton & Company Inc.: Sponsors of the Psychology Lab at > Anywhere University > o Kroch's and Brentano's Bookstore, with over 80,000 books > o Reiter's Scientific and Professional Books > o Waypoint Technologies Inc.: Astrophysics and education > o Chapter One Books: A truly virtual bookstore > o Digital Print Services > o The Virtual Newsroom: A special exhibit by the San Francisco > Examiner and Radius Inc. > o Webster's Weekly: The web's first weekly magazine of news and views > o John Zakour's The Doomsday Brunette > o Stories of the Virtual City: A collaborative hypertext novel, set > in Downtown Anywhere > o Tom Jackson's Pro Football Update > o Corinth Video > o Jacobs Publishing Limited > o Education Research Laboratories Inc.: Knowledge-engineered > electronic references > o Lighthouse Press and the Interactive Yellow Pages > o Nomad Press and Colin Haynes, author of McGraw-Hill's forthcoming > Paperless Publishing > o The Electronic Publishing Association > o Technical Learning Resources > o Association for Library Information Management > o ElectricSpace Co.: Sound for cyberspace > o Marrakesh Express: Moroccan rugs, pillows, and edification > o The Downtown Anywhere Souvenir Shop > > SoftLock Services Inc. and AnyWare Associates Inc. are the > parent companies of Downtown Anywhere Inc. > > SoftLock Services provides Tools and Services for electronic > publishing, software marketing, and digital commerce. AnyWare > Associates provides telecommunications services, including > FAXiNET(sm), a service that enables Internet electronic mail > users to send and receive fax messages. > > Downtown Anywhere can be accessed at http://www.awa.com/ on the > World Wide Web using a browser such as Mosaic, Lynx, or Cello. > The World Wide Web is an Internet-based global hypertext network > that is being widely acclaimed for its versatility and ease of > use. > > For more information about Downtown Anywhere and how to access > the service, send E-mail to Downtown(a)awa.com, or contact > Downtown Anywhere Inc. at 32 Woodland Road, Boston, MA > 02130-3018, TEL: 716-242-0348, FAX: 617-522-5734. > > - end - > > > HAVE FUN ON THE WEB! > > > -- > Chris Woods TIAC Support cjwoods(a)tiac.net support(a)tiac.net > The Internet Access Company 7 Railroad Ave. Bedford, MA 01730 USA > Affordable Unix Shell, SLIP, PPP, Dedicated, Leased 56 kbps for Metro Boston > email info(a)tiac.net for details! -- Robert Hettinga (rah(a)shipwright.com) "There is no difference between Shipwright Development Corporation someone who eats too little 44 Farquhar Street and sees Heaven and someone Boston, MA 02331 USA who drinks too much and sees (617) 323-7923 snakes." -- Bertrand Russell

1 0

Re: "Key Escrow" --- the very idea
by frissell＠panix.com 17 Dec '03

17 Dec '03

At 09:55 PM 7/21/94 -0400, Rick Busdiecker wrote: >One problem with what you've said is that the fourth amendment is not >phrased in the sense in which you refer to it. Specifically, it >proscribes unreasonable searches and seizures. It does not require >the people to actively facilitate the government in `reasonable' >searches and seizures. Important point to note about the Bill of Rights. It was designed to restrict the guvment not the peepul. DCF "Finally a Third Amendment violation after all these years of waiting -- Note that the DTI will require that you provide appropriate technologies to the FBI, NSA and Military Intelligence (aka "soldiers") to spy on your electronic activities for the good of the State. Once you build a house in a VR community, the only way that the Feds can spy on you is to adopt VR "personalities" and live in that community and in everyone's houses so they can see what's happening behind every "door." After all, you can't find out what's happening in a VR environment by reading a printout. Under the DTI you will have to support them in these "personalities." Thus you will be forced to quarter them in your houses in peacetime. Third Amendment violation. Question -- if you "kill" a Fed in a VR environment, is it a crime?"

1 0

Re: How to legit encryption
by Jeff Gostin 17 Dec '03

17 Dec '03

tim werner <werner(a)mc.ab.com> writes: > This is a neat way of expressing a good idea, but I wouldn't count on it. > A language can probably be construed as something that can be understood by > anyone who learns it. Even though I speak PGP, I still can't understand > what you say without a key. There's probably no legal precedent for that > yet, but look what they've done with the rest of the Constitution so far. Ok, what if PGP-encyphered text were argued to be COMPILED? In that case, the original SOURCE CODE was being shared, and the COMPILER being held secret. Source-reading keys are available upon request. Or some twist like that. :-) What do you think? All of a sudden, we have compiled source code being pushed around that is VERY difficult to reverse engineer without the proper authorization. --jeff

1 0

e$ : NetBank legality
by Hal 17 Dec '03

17 Dec '03

I'm curious about the legality of NetBank in the context of our earlier discussions about demand deposits and Chaum cash. These people will take your money and give you electronic tokens, and they will take the tokens and give you cash (minus 20%). Does this sound legal? Are they a bank? I wonder what their tax liabilities are. Sales tax on selling the tokens? Is this a barter system? If so, they're supposed to get SS#'s and such. Maybe you have to give that information if you sign up as a vendor, but legally I'd think ordinary users would have to be reported to the IRS as well, and it doesn't sound like they're doing that. This whole thing sounds pretty questionable legally. It will be interesting to see how it comes out. Hal

1 0

e$: NetBank
by rah＠shipwright.com 17 Dec '03

17 Dec '03

There's an outfit called NetBank, which is selling e-cash-like *certificate numbers*, through a dial-up BBS on a 900 line, in any denomination you want, which you can e-mail to vendors to buy stuff with. In fact all the interactions with the bank (deposits, breaking "bills" into smaller denominations, etc.) are done with switch codes in e-mail. It's extremely ungainly, and it looks userous too, to the extent that they charge 20% (each way?) to cash you in and out. I hoovered out all the stuff in their infobot (netbank-info(a)agents.com) and I really haven't plowed through it all yet. If you folks are interested I'll summarize it for the group and/or redirect my dumpster-divings on the subject to you individually in e-mail. Just let me know. 'Course you're welcome to play with their infobot yourselves, I suppose ;-). It looks like someone did some serious work on this, folks. That's just a philosophy major from Missouri talking, of course. I wonder who they are? I heard some discussion about them here, but I can't seem to find the thread in my e$ article stash.... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

List Dead Again!??
by j.hastings6＠genie.geis.com 17 Dec '03

17 Dec '03

Wow man. No letters waiting? No way. Could be GEnie, or majordomo again. Anyone get this? Please respond. Kent - j.hastings6(a)genie.geis.com

1 0