December 2003 - cypherpunks-legacy

Thank you Bob Anderson
by nobody＠jpunix.com 17 Dec '03

17 Dec '03

SUBJECT: RC4 Source Code I've tested this. It is compatible with the RC4 object module that comes in the various RSA toolkits. /* rc4.h */ typedef struct rc4_key { unsigned char state[256]; unsigned char x; unsigned char y; } rc4_key; void prepare_key(unsigned char *key_data_ptr,int key_data_len, rc4_key *key); void rc4(unsigned char *buffer_ptr,int buffer_len,rc4_key * key); /*rc4.c */ #include "rc4.h" static void swap_byte(unsigned char *a, unsigned char *b); void prepare_key(unsigned char *key_data_ptr, int key_data_len, rc4_key *key) { unsigned char swapByte; unsigned char index1; unsigned char index2; unsigned char* state; short counter; state = &key->state[0]; for(counter = 0; counter < 256; counter++) state[counter] = counter; key->x = 0; key->y = 0; index1 = 0; index2 = 0; for(counter = 0; counter < 256; counter++) { index2 = (key_data_ptr[index1] + state[counter] + index2) % 256; swap_byte(&state[counter], &state[index2]); index1 = (index1 + 1) % key_data_len; } } void rc4(unsigned char *buffer_ptr, int buffer_len, rc4_key *key) { unsigned char x; unsigned char y; unsigned char* state; unsigned char xorIndex; short counter; x = key->x; y = key->y; state = &key->state[0]; for(counter = 0; counter < buffer_len; counter ++) { x = (x + 1) % 256; y = (state[x] + y) % 256; swap_byte(&state[x], &state[y]); xorIndex = state[x] + (state[y]) % 256; buffer_ptr[counter] ^= state[xorIndex]; } key->x = x; key->y = y; } static void swap_byte(unsigned char *a, unsigned char *b) { unsigned char swapByte; swapByte = *a; *a = *b; *b = swapByte; }

1 0

Societies & Your Health
by blancw＠pylon.com 17 Dec '03

17 Dec '03

Responding to msg by Doug Cutrell: "Blanc seems to be concerned principally with the soundness and health of the business entity." Well, if you mean that I was defending the prerogative of a corporate entity against an angry mob of voters descending upon it to coerce services from it, health (& safety!) is the concern. But actually I was taking your argument of equal fairness and noting that voters who responded that way to a denial of service would be expecting automatic beneficence, without considering the means to the end: if there is no existing service, there is no one to coerce into providing it. The voting public which bands together to use coercion takes services & benefits for granted, without any respect for the source. " I am not sure whether Blanc would hold that businesses should be free to engage in racist hiring policies if that is their decision...." Since I wouldn't claim to own either the corporations or the society within which they operate, I wouldn't presume to direct their hiring policies either. "The argument seems to be that in a free society, natural cooperative processes will provide a form of "autoregulation" to discourage the widespread development of oppression of specific classes of individuals." Societies, I hear tell, develop with the intent of deriving positive benefits from an association with people who want to interact with each other. In a "free" society, oppressed classes of individuals would be at liberty to leave to form their own, repressive arrangements and establish their own discriminative hiring policies. "....... imagine the development of a multitude of secret "crypto-posse" organizations. .......Organizations such as the KKK could accrue the financial support of large numbers of members to create strong social and economic pressures to oppress segments of the population. . . . . . " One thing I can say about this, is that there already exist a large number of this type of organization, and they are not very secret about it. In Bosnia, in Iran, in South America, in South Africa, et al. They suppress & decimate whole populations in full view. Perhaps if there were a larger number of secret organizations, they would target each other and kill each other off. The world could become one big, happy family of paranoids instead of just a horde of " nattering nabobs of negativism" ( is that an endangered species?). Blanc

1 0

help!
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

I'm having problems posting to the cypherpunks list. I was hoping you might be able to help me. could you post this? thanks-- Subject: beta test volunteers wanted I am in the process of starting beta tests on some server-based email filtering software. I need some volunteers to help debug the system. I'll have to ask you to commit to an informal, temporary nondisclosure agreement. If you are interested, please send me mail. Thanks-- vznuri(a)netcom.com ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Social punishment 2/3: communication societies
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Social punishment 2/3: communication societies If one examines the use of social punishment, one sees that that it is strongest in the smallest of units (a family - 'if you do that again, we won't talk to you') and while best seen as a way of keeping order in small villages or tribes, is gradually replaced by more formal legal systems, with some form of judiciary, police and prison as populations gather in towns and cities. Social punishment also works best with non-lethal 'crimes' rather than murder and rape, presumably more common in cities than in villages (or cyberspace). It has been argued that cities need formal legal systems due to the complex situations created by a large, concentrated population. More people means more people who don't know (and therefore trust) each other, and leads to more crime. Taboo and other social punishment can't work because the people are not as strongly bound together as in a smaller community. This may be partially true. I would say, however, that the primary reason that social punishment works in a village is that it is a _communication society_. People depend on each other (rather than on faceless municipal corporations or public utilities) for most activities. Most of all, they depend on each other to _talk_ - for social interaction. Social interaction is a far more important component of life in a village than in a big city. It is because of this greater need for communication, rather than the size of the population, that ostracization is so effective. Cyberspace is also a communication society. While McLuhan's Global Village has become extremely cliched, in this aspect cyberspace does resemble a village. People on the Net may not be dependent on each other for food and clothing, but they are for almost anything else concerned with a cyber life. There is thankfully no Internet Municipal Corporation that takes care of all roads (net connections), supplies (of information and public keys), and order (through centralized credentials or certification). Most would be repelled at the thought of such a thing. Cyberspace is full of vibrant communities that do little else but talk. Social interaction is at a higher level than at any time in history. The 'crimes' committed in cyberspace are non-lethal and primarily violations of protocol. Like the other communication society, the tribe or village, cyberspace is well suited to a system of social punishment. It's not as if taboos and ostracization don't already exist in cyberspace, to keep people within the few unwritten rules that exist at present. Flames, newbies, kill files etc. As a variety of activities take place in cyberspace, from digital cash transfers to elections to escrow, the number of rules will grow, but there is no reason why the system of punishment cannot be equally effective. No, I'm not saying that you can solve electronic fraud by putting a name in your kill file. More recent technologies - cancelbots, reputation systems (in concept if not in fact) - can make social punishment in cyberspace highly practical. And in cyberspace, if noone reads your posts, you're dead. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

ITARs around the world
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

M.Gream(a)uts.EDU.AU (Matthew Gream): > [quoting alt.pgp.security] > I'm afraid I have to post a clarification to a clarification. I've just > been in contact with the relevant people at the Defence Signals > Directorate. It seems that regardless of advice obtained from other > departments and documentation that points to the contrary, there are > restrictive controls on software. Is the document mentioned the equivalent (with similar legal standing) of the US ITAR? When the Scandinavian countries join the EU next year, what will the implications for crypto be? France bans it, is there any EU policy proposal? Maybe crypto software should all be written by cheap programmers in Bangalore. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

Social punishment 3/3: reputation systems
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Social punishment 3/3: reputation systems Social punishment works because individuals know that someone has broken rules, and _voluntarily_ cooperate with enforcing the accused's punishment. (Of course part of the reason is the risk of similar punishment for non-cooperation, but a major part, particularly in cybercrimes, is that if an individual could harm someone else, he or she could harm you too.) Social punishment works through reputation. XXX, after breaking rules, is seen to be a 'bad character'. Soon everyone knows XXX as a 'bad character' and behaves accordingly, usually by avoiding contact. Once XXX gets a bad REPUTATION (and this is how _I_ define the term, not as some centrally imposed certificate), in traditional societies it is very difficult for XXX to regain a good one. People _individually_ decide whether a 'bad character' is indeed 'bad' and depending on the stature of the individual and the bad character, may or may not cooperate with any punishment. A priest in traditional society or someone else with impeccable reputation is permitted to interact with even the worst of characters. One problem with such a wildfire reputation system is it can be _too_ effective. Once ostracized, the decentralized system makes it very difficult for someone to rejoin society, to have his/her 'reformation' recognized. The channels in traditional societies include lots of 'good work' and recommendation by 'good citizens' such as the priest etc. The other is a new identity. The most powerful illustration of a reputation system I can think of is Victor Hugo's Les Miserables, where ex-convict Jean Valjean finds himself ostracized by society despite having been released. A priest's kindness is not enough, and he later gains a very good reputation building an industry. The notable thing is that he rejoins society only when he gets a _new identity_ - and later gets back into prison when his old identity is discovered. This is a strong case for universal pseudonymity - BAN TRUE NAMES - which, together with strong voluntary reputation and social punishment systems can form the basis for cyberspatial order. I can't really say as yet how a cyberspace reputation system should be implemented. Old-timers will recognize the distinction between my proposed voluntary reputation and certification - the difference between PGP and central public key directories. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

Citizen-Unit Donald De-Certified
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

To all Certified Citizen-Units, We are most disappointed to inform you of the sad fate of a bright young Citizen-Unit, James A Donald. Citizen-Unit Donald has fallen prey to the increasingly common disease of incorrect thinking. He has actually suggested the possibility that this august and universally respected Board be replaced with what he calls a 'reputation' system. In his system, Citizen-Units would not be Certified by a central Board of Credentials, but would actually have 'reputations' - semi-certificates of approval by each Citizen-Unit. These reputations would be independent of any group of Citizen-Units, and would represent the trust placed by _individual_ Units in the recipient. In such a system, a wrong-thinking Unit may have a bad reputation with most people, but a good one with others! This suggestion seems dangerously close to pre-civilization tribal society, and makes the insupportable assumption that a Citizen-Unit knows what is best for itself. As we all know, any individual's opinions are hopelessly inadequate when compared with the Collective, as expressed by this Board. It is hoped that other Units will keep themselves away from such incorrect attitudes. Citizen-Unit Donald shall henceforth be treated as De-Certified. Citizen-Unit Rishab Ghosh, Senior Certifier, Central Board of Credentials and Certification ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

ITARs around the world
by usura＠vox.xs4all.nl 17 Dec '03

17 Dec '03

rishab(a)dxm.ernet.in writes: : M.Gream(a)uts.EDU.AU (Matthew Gream): : > [quoting alt.pgp.security] : > I'm afraid I have to post a clarification to a clarification. I've just : > been in contact with the relevant people at the Defence Signals : > Directorate. It seems that regardless of advice obtained from other : > departments and documentation that points to the contrary, there are : > restrictive controls on software. : : Is the document mentioned the equivalent (with similar legal standing) of the : US ITAR? : : When the Scandinavian countries join the EU next year, what will the : implications for crypto be? France bans it, is there any EU policy proposal? : The EU has published a plan of action for how to proceed into the informationsociety. -> COM(94) 347 def. Brussels, 19.07.1994 This document only states that: (translated from dutch, lousy english I know) The Commision plans, advised by a group of officials concerning the security of informationsystems, to make a proposal in september 1994 for requirements that encryption systems and signature verification systems must follow. [..] The Community will research the possiblities for cooperation in the field of encryption with third countries, notably the US. Other relevant publications are: -> COM(94) 128 def. COD 288 Brussels, 13.06.1994 ISDN and mobile networks (cellular for US folks) -> COM(92) 422 Outline of Privacy Protection [If you are in the EU, most University Law Libraries will have these documents, in the US or elsewhere one should look for an depository Library for EU publications] EnJoY -- Exit! Stage Left. Alex de Joode <usura(a)vox.hacktic.nl>

1 0

RE: E.C.T.
by Pierre Uszynski 17 Dec '03

17 Dec '03

Dave Merriman explains: > > One thing did occur to me after reading the ECT proposal: it would seem to be > ideal for mailing lists and moderated newsgroups. Someone wanting to post an > article/message pays (say) C|10 for the privelege; if others like it, they > send the author C|1. Flamers don't make much (if any) money, and good stuff > increases wealth. You don't need any Testbed Administration to do that. You can start such a mailing list right now, based on "silly name" NetCash/NetBank. They have the advantage of being right here, right now, and they are real money (so far :-). The fact that they receive their funds only through 900 numbers does not even necessarily limit them to USA residents: others can easily buy and sell "credits" through said USA residents. After all, people have been selling software and T-shirts internationally for a while. AMIX was based on such a system, albeit somehow considering they didn't need internet access, and building a pricing schedule more in line with Dialog than with internet (read "out of this world" :-). Pierre. pierre(a)shell.portal.com

1 0

Crypto Anarchist Manifesto
by cwalton＠earthlink.net 17 Dec '03

17 Dec '03

At 2:48 PM 9/9/94 -0700, Timothy C. May wrote: > >Markets for assassinations--untraceable and unlinkable--have been a >topic of discussion for a long time. You'll find them explicitly >mentioned in my 1988 "Crypto Anarchist Manifesto." > >--Tim May > And is it possible to obtain a copy of your 1988 "Crypto Anarchist Manifesto."? Sounds like fun. FTP Site? ***************************************** Conrad Walton cwalton(a)earthlink.net ***************************************** Without JOY there can be no STRENGTH. Without STRENGTH, all other virtures are worthless. Edward Abbey

3 2