December 2003 - cypherpunks-legacy

Re: e$: Geodesic Securities Markets
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Forgive me for *ever* doubting you... Perry Metzger says, >Actually, even in the case of securities largely settled by book >entry, DTC still holds physical certificates. That is not, however, >the point. I know It's Not the Point, but I got curious anyway ;-). After all, I haven't been near a brokerage cage in 10 years (NIDS was big stuff back then), and I thought maybe it's time to learn how the world really works these days... So I called DTC, the Depository Trust Corporation, on Water St. in Manhattan, the Mother of all Securities Clearinghouses. After about five transfers, I talked to a very nice lady in underwriting. She said they really *do* have bales of securities in a vault, and that they have a program called FAST, where securities are stored in banks also. However, she said that a growing number of securities are issued book entry only. Issues of up to $150 million can be issued on a *single* certificate. That certificate is held just like the other securities issues, in a vault. She said that like par value, physical delivery is becoming more and more obsolete. That makes sense. Once a certificate is put into the vault at DTC, it usually never leaves. It might as well not be there at all. Changes in ownership are reflected by offseting book entries. Ah, the wonders of double-entry bookeeping. Oddly enough, an e$ certification scheme reverses that paradigm. The book entries disapear, the certificates proliferate, and the clearinghouse becomes a referee, "blessing" the trade. Cheers, Bob ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

3 2

Paging Eric Hughes
by Eric_Weaver＠avtc.sel.sony.com 17 Dec '03

17 Dec '03

[apologies to all others; couldn't reach him at any addresses I have seen] Mr. H., Please write me. Thanks.

1 0

Re: e$: Geodesic Securities Markets
by Perry E. Metzger 17 Dec '03

17 Dec '03

Robert Hettinga says: > Perry Metzger says, > > After about five transfers, I talked to a very nice lady in underwriting. > She said they really *do* have bales of securities in a vault, and that > they have a program called FAST, where securities are stored in banks also. > However, she said that a growing number of securities are issued book > entry only. Issues of up to $150 million can be issued on a *single* > certificate. That certificate is held just like the other securities > issues, in a vault. Yup. The certificate is held in street name -- the name such certificates are held in is "Ceed & Co." for obscure reasons I've never been able to fathom. > She said that like par value, physical delivery is becoming more and more > obsolete. That is largely the case for institutional transactions. Lots of equities are still physically delivered, and in fact all equities are still physically deliverable. (Many holders still request physical delivery, and there are many instances in which physical delivery is still in fact necessary -- for instance, when you purchase unregistered securities in a private placement. I still have bad memories about trying to get the incompetant 144 department at my broker to deal with some previously unregistered certificates.) There are no US govvies that are physically deliverable any more, although of course the older ones still are. > That makes sense. Once a certificate is put into the vault at > DTC, it usually never leaves. It might as well not be there at all. However, it is still there, fulfilling technical legal requirements, and the vaults on Long Island are heavily guarded in spite of the fact that the certificates are non transferable. > Oddly enough, an e$ certification scheme reverses that paradigm. The book > entries disapear, the certificates proliferate, and the clearinghouse > becomes a referee, "blessing" the trade. Its not really practical to do this with things that aren't bearer instruments. You need to know the beneficial owner of virtually all securities issued in the U.S., and even if we had a completely free market we would still likely not have bearer certificates for most corporate stocks, since such certificates are hard to track and one wants to be able to find stockholders for corporate governance reasons -- when stockholder meetings are called for example. Perry

1 0

Thanks!
by dwomack＠runner.utsa.edu 17 Dec '03

17 Dec '03

First, thanks to everyone for some *_super_* guidance on decrypting weak cyphers...I have some (enjoyable) homework to do now! Secondly, I seem to have come across a minor bug in the majordomo software; and I thought others might be having a similar problem... I subscribed...'domo accepted...then I got duplicate mailings. I did a 'who', and found I was listed under 2 slightly different, equally valid, addressess. I canceled one, and it required manual approval, which came (apparently) quickly...and BOTH addresses got taken off! Anyway, after fiddling with it a bit, I'm getting the one copy of each posting I wanted...but, I wonder if somehow the duplicate address problem might be related to the crash problem? Regards, Dave

2 1

Re: Unofficial Release
by trollins＠debbie.telos.com 17 Dec '03

17 Dec '03

Perry(a)imsi.com says: >Tom Rollins says: >> Ahhhh, It is nice to know that people won't even TRY to crack >> big keys. Cracking, you know, is a lot like the lotto. You >> MIGHT guess the correct key on the first TRY. But, if you >> don't TRY, then you won't crack the key. >> >> "Gotta play to win" > >It is all a question of economics. Its one thing if your idle try has >one in 10^6 chance of working, but if its one in 10^70 or something >like that the attempt is pretty much pointless -- you are more likely >to have a giant sack of gold hit you on the head. Even spending a >penny on cracking something that way is uneconomical. Our govenment has NEVER been very economical! >They could spend a lot less effort simply >getting your key via "practical cryptanalysis". True, a good hose or pretty woman in the sack would loosen me up. Except for my old key that hangs out on the pgp-key-servers. Too bad, Lost that secret key... >There is therefore no point in using a cryptosystem which would cost >the enemy hundreds of billions of dollars to try to attack and then >type in your key on a machine who's keystrokes can be monitored using >$3000 in equipment. Which way would YOU try to get the keys, eh? Say, that sounds like a good deal ! Where could I buy that. Wow, hang out at Charles Schwab, or Meryll Lynch and get account info... >Unless you are already doing all your encryption in a Faraday cage, >I'd say that there is no conceivable point in using anything over a >2000 bit key -- indeed, there is probably no point in using such a key >even if you are doing all your encryption in a Faraday cage. Well, I work for C3-Telos and we make several lines of ruggedized portable tempest capable equipment (like the one I am typing on). >The benefit is minimal, and the cost, in terms of dramatically slowed >performance, is very high. Using an 8000 bit key is like claiming you >are stronger than the enemy because whereas he only has enough nuclear >weapons to vaporize your city 15 times over you have enough to >vaporize his 90 times over. I don't need an 8000 bit key, but, I don't want the pgp-key-server barfing on a 4096 bit key that I feel I need. How can you put a price on someones life. You don't know there situation. (think about OJ and fooling around with his wife) Tim May says: >If this was tongue in cheek, I missed it. Nobody in their right mind >will try a brute force attack on a 1024-bit key, let alone a 1200- or >2000-bit key. Unless there are flaws in PGP and/or RSA we haven't >heard about. So you or I won't try the crack. But then there are all those people who are being paid from tax dollars to do nothing else but crack. And all those high priced computers paid for with tax dollars to do the cracking with. Do you think they will just close up shop and sell off the equipment? Yes, there are flaws. (some call them design compromises) Why known text in the Idea data area? Why CFB mode vs CBC mode? Peter Gutman's SFS documentation makes reference to a class of weak IDEA keys. What are they? And what do they do? >As for lotto, simple calculations tell anyone that the best way to win >is not to play. The return _at best_ is 30 or 40 cents on the >dollar, with the rest going to all the various programs the lotto is >supposed to support. The more you play, the more you lose. I don't advocate that you play the lotto. I am pointing out a fact that the lotto people use/say/claim to get people to play their game and thus give them money. >(I think gambling is a perfectly fine "tax on stupidity," collecting >money from the gullible. However, banning gambling by private citizens >while having the government run their own casinos and lotteries is >crummy. It's government at its worst.) I agree almost 100%

4 6

Re: MAIL: Using "nobody"
by Vincent.Cate＠FURMINT.NECTAR.CS.CMU.EDU 17 Dec '03

17 Dec '03

Karl Lui Barrus: >Using "nobody" as a remailer is pretty interesting ;) the only problem >being you have to be root or be allowed to choose your own username. Yes, you need to be root. >I don't understand: why can't the somebody do a telnet to port 25 and >"vrfy nobody" to see if it points to /dev/null? Or find out if mail >is piped to a script? When I do this to different machines where "nobody" is aliased to different things, I always get "Nice address". But even if there was some way to tell by accessing something on my machine, I can make my machine lie. Really. Do I need to get my machine to lie for me? Can anyone detect any difference between the "nobody"s on cs.cmu.edu, furmint.nectar.cs.cmu.edu, and alex.sp.cs.cmu.edu? >> So it would be nice if sites with remailers would set the "nobody" >> alias to point to their remailer to start this convention. Assuming > >Again, a pretty good suggestion, but I don't think most remailer >operators can do this even if they wanted to. I know I couldn't have >with remailers I've run in the past. It does not need to be all of them to work. Even if only a few places do this, it is still good cover. If there is some mail going to "nobody" on my machine, maybe I have some "black-net" operation running off of my machine, or maybe mail is all getting dropped in the bit bucket like "nobody" on standard machines. From outside you can not be sure. It could just be L. D. trying to make it look like I am up to something. If there was a witch hunt for encryption use, someone might send lots of encrypted mail to someplace like nobody(a)att.att.com, and the fierce witch hunters might try to burn someone who was not a true witch. -- Vince

1 0

RSA Key Size & QP
by catalyst-remailer＠netcom.com 17 Dec '03

17 Dec '03

A wild card here is the recent work in quantum computing, done at AT&T and reported in a recent post by Pal Vitanyi. With a specialized quantum computer (not clear yet whether one could economically built it, but it's theoretically possible) one can factor in polynomial time (computational class "QP", or something like that). If cycles on such a computer would be, say, 1,000 times more expensive than on your PC, then cracking the key would be 1,000*O(keysize^c) more expensive than generating it, not 1,000*O(c^keysize). Having a keysize of, say, 8 kbits instead of 1 kbit in this circumstance is not at all overkill; it makes a practical economic difference. Of course if your info is _very_ valuable and the polynomial is of small degree, even a large key size won't help much. If such a device was built, we'd want to switch to a cryptosystem whose inverse is not in QP; but some of our current communications would be compromised. If a QP machine is with even small probability feasible within the next few decades (or whatever your timeline of concern is), it makes sense to use larger key sizes.

5 6

Re: e$: Geodesic Securities Markets
by rah＠shipwright.com 17 Dec '03

17 Dec '03

>That is largely the case for institutional transactions. Lots of >equities are still physically delivered, and in fact all equities are >still physically deliverable. ^^^^^^^^^^^^ Except those equities designated "Book entry only" issues, of course ;-). >> That makes sense. Once a certificate is put into the vault at >> DTC, it usually never leaves. It might as well not be there at all. > >However, it is still there, and the vaults on Long Island are heavily >guarded in spite of the fact that the certificates are non >transferable. I'm just wondering why not make them e$ certificates someday... > >> Oddly enough, an e$ certification scheme reverses that paradigm. The book >> entries disapear, the certificates proliferate, and the clearinghouse >> becomes a referee, "blessing" the trade. > >Its not really practical to do this with things that aren't bearer >instruments. Ain't it a bitch...:-) >You need to know the beneficial owner of virtually all >securities issued in the U.S., and even if we had a completely free >market we would still likely not have bearer certificates for most >corporate stocks, since such certificates are hard to track and one >wants to be able to find stockholders for corporate governance >reasons -- when stockholder meetings are called for example. I'm *really* *not* making this up as I go along, but... If a clearinghouse is "blessing" the trade they could still perform their function(??) of notifying the corporation / issuer of a change in it's ownership. The "pointers" to the security just get swapped around... Uncle Sam still gets to know who owns what. However, it's possible under this scheme to have anonymous ownership, too. If it were legal, of course... While this thread is starting to look more like crypto-enabled and less like actual crypto, I'm still thrashing this stuff around on my own. My crew figures there's some business in here somewhere. If anyone wants to yak about it with me off-line, let me know.... *I'm* having fun... Cheers, Bob ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

2 1

OJ`S CELL PHONE
by bmorris＠netcom.com 17 Dec '03

17 Dec '03

To: cypherpunks(a)toad.com KK> There is an optional mechanism called "registration" by which the KK> system can keep track of your approximate location even though you're Is this registration method the exception or the rule? * RM 1.4 B0037 *

1 0

MAIL: Using "nobody"
by ghio＠cmu.edu 17 Dec '03

17 Dec '03

> I don't understand: why can't the somebody do a telnet to port 25 and > "vrfy nobody" to see if it points to /dev/null? Or find out if mail > is piped to a script? Try that on andrew.cmu.edu

1 0