December 2003 - cypherpunks-legacy

minor disagreement at the CSSPAB meeting this a.m.
by Carl Ellison 17 Dec '03

17 Dec '03

The CSSPAB is having an open meeting today and tomorrow at the Gaithersburg Hilton. I happened to be there to hear an interesting exchange. (Those in the area might want to drop by tomorrow to sit in. (Tomorrow's agenda: Gov't email, reaction to public meeting on NII security; Congressional privacy & security; tax systems; NIST activities; public comment (sign up in advance with the secy))) ============================================================================== Lynn McNulty of NIST was giving a summary of the KEA (Key Escrow Alternatives) meeting of Aug 17. One of his summary lines was to the effect that industry believed there was a "significant market for escrow products". William Whitehurst of IBM, who had been at the KEA meeting, raised his hand to disagree with that statement. As he remembered it, industry believed there was a significant market for encryption and that it was an international market and that we (the US) were in danger of being left in the dust by foreign competition -- but that there was no market at all for escrow encryption. Steve Walker of TIS seconded Whitehurst's observation. Lynn replied that they were saying the same thing because the government won't allow export of encryption without key escrow therefore there's a big market for escrow products. ============================================================================== Makes lots of sense, doesn't it??? :-| - Carl

1 0

TIS SKE paper by ftp
by Carl Ellison 17 Dec '03

17 Dec '03

anonymous FTP to ftp.tis.com /pub/crypto/ske will give TIS's SKE paper with figures (in sep. files).

2 1

US Fascist Dictatorship?
by frissell＠panix.com 17 Dec '03

17 Dec '03

So is the US about to grab all the guns, seal the borders, make foreign trade a crime, and change the color of the money? Some posters here seem to think that we are moments away from a full Nazi/Commie style totalitarian state. Is this likely? Even in the more coventional areas of political discourse, there seem to be people who think that we can -- for example -- "seal the borders." Do any of these people happen to know how many people cross US borders each year? Would you believe 40,000,000! It seems unlikely that we can go from 40 million to zero without some problems. This is travel in both directions of course. Most of the crossings are of the US-Canada and US-Mexico borders. Mexican, US, and Canadian citizens have equal rights to cross each other's borders with minimal documentation. The New York Times is doing a series this week on how hopelss the INS is at any part of its job. How it is totally demoralized, unable to deport more than a few of even the felonious aliens living in the US, and unable to even answer its phones when its boss (the Butcher of Waco) calls. "Nobody wants to do his case because he is believed to carry a weapon and be dangerous." -- Deportation agent speaking of a felon they deported so that the New York Times could watch. This was a guy they picked up at his employer whose name they got from his INS file. He was shipped off to Nicaragua and promised to be back in a week. Each Deportation Officer has 4,000 cases assigned and is allowed to deport about one alien a month. You do the math. Note that the DDR was better than most countries at sealing its border but it still failed. It is no longer with us. The fgailure of border sealing shows the general inability of modern governments to cope with there enforcement problems. 1984 is no where in sight. DCF ************************************************************************* ATMs, Contracting Out, Digital Switching, Downsizing, EDI, Fax, Fedex, Home Workers, Internet, Just In Time, Leasing, Mail Receiving, Phone Cards, Quants, Securitization, Temping, Voice Mail.

2 1

Re: The Importance of Filtering
by No Taxes through No Government 17 Dec '03

17 Dec '03

Tim May writes all sorts of stuff, and concludes: >I used the ExI software, and found it an interesting experiment, but I >can't say it save me any real effort. The effort of sending the >filtering message to the list site, hassling with the formats, etc., >clearly outweighed the tiny effort it would have taken to manually >press "d" to delete the messages when then appeared. I only disagree in the most trivial sense with this point. If you weren't required to re-establish your excludes every time they expired, it might not be such a hassle. >I also found it useful to at least spend the 2-5 seconds to see what >was being talked about before pressing "D." [...] >In other words, I find just being real fast on the "D" key is my best >way to cope with list volume. A secondary concern is that some net users do not have very much disk space available in their account, and would rather not have stuff come in in the first place. Once again, I find that if I set up my mailer to delete every C-punk message except the ones from Tim May, Sandy Sandfort, and Duncan Frissell, I get by just fine. They end up quoting people enough that I don't have a problem keeping track of threads. And I'm reasonably sure I haven't missed anything I might be interested in.

1 0

Re: PRIVACY REGULATIONS
by Ron Bardarson 17 Dec '03

17 Dec '03

Reply to: RE>>PRIVACY REGULATIONS I happen to have the text, is there interest? -------------------------------------- Date: 9/14/94 1:48 PM To: Ron Bardarson From: Brad Huntting > Can't you free yourself from jail with a writ of habeas corpus ad > subjiciendum from John Doe? But you have to know how to write one. brad

1 0

RC4 Sting, Contract Killings?
by John Young 17 Dec '03

17 Dec '03

Responding to msg by schneier(a)chinet.chinet.com (Bruce Schneier) on Tue, 13 Sep 8:57 AM >Ah. So the odd subject line resulted in many people >not seeing. I don't know if any US residents would be >willing to repost. I'm not. Bruce, Was the RC4 posting a sting? Will Bidzos arrange for an anonymous contract killing of every recipient? But then, is this list not a sting? So literal kill-files be implemented against the disreputable, that is, all of us? Are Tom Clancy and John Gilmore identical? Is Tim's epic FAQ the spy novel of our dreams? Yes, six times over. Wow. John

1 0

Re: PRIVACY REGULATIONS
by frissell＠panix.com 17 Dec '03

17 Dec '03

At 02:46 PM 9/14/94 -0600, Brad Huntting wrote: > >> Can't you free yourself from jail with a writ of habeas corpus ad >> subjiciendum from John Doe? > >But you have to know how to write one. > > >brad > But if you proceed "in forma pauperis" you don't need to know how to write one. DCF "The Privilege of the Writ of Habeas Corpus shall not be suspended, unless when in Cases of Rebellion or Invasion the public Safety may require it. Or if they're just a bunch of damn Japs." -- The Constitution according to FDR, Earl Warren, Hugo Black, and William O. Douglas.

1 0

OFFER: I'll filter Cypherpunks for $20.
by Eric Blossom 17 Dec '03

17 Dec '03

This is a blatant commercial offer. flames >/dev/null In response to the widely varying signal to noise ratio here on cypherpunks, I've begun offering a filtering service. The service is called Cypherpunks Lite, and contains what I consider to be the most relevant postings. I forward somewhere in the neighborhood of 5 - 10% of the total feed. The emphasis is on quality, not quantity. You can sign up for a one year subscription by sending a check or money order for US$20 along with your email address to: Eric Blossom 1275 4th Street, Suite 194 Santa Rosa, CA 95404 For a limited time, a two week "free trial" is available by sending a message to cp-lite-request(a)comsec.com with the body: subscribe cp-lite If I don't receive your money within two weeks, you'll be quietly dropped from the distribution. Thanks for your attention.

1 0

No Subject
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- 9/13/94 Company Plans Payment System For Shopping On The Internet By Jared Sandberg Staff Reporter of The Wall Street Journal As millions of computer users browse the Internet for a burgeoning array of goods and services, most can look but not buy. That may soon change. A new company called CyberCash Inc., formed by executives from the Internet and the electronic-payment industries, plans to introduce a system that will allow on-line browsers to pay for an item, either by credit card or through bank transfers, over the global computer network. CommerceNet, a new on-line system funded by Apple Computer Inc., BankAmerica Corp. and others, expects to adopt the CyberCash system by year's end. The company has talked to America Online Inc., which has one million subscribers and to which it has close ties. By clicking a "buy" button, CyberCash users could approve electronic transfers to merchants from checking and credit-card accounts. Companies could pay invoices, and e-mail penpals could settle bets with the point of a mouse. But to do that, CyberCash must first persuade banks that the system is secure from on-line theft, which may be its toughest challenge. "I don't think there's a system that is adequately secure that has been placed on the table," says Sholom Rosen, a vice president for Citicorp, who says he isn't familiar with CyberCash. Even if one emerges, he adds, "it's going to be tough to get everybody to agree on the same system." While some companies, including Citibank, are planning their own business-to-business electronic payment systems on the Internet, CyberCash is aimed at the millions of consumer and business users who browse the Internet. "We want to make the Internet safe for commerce," says CyberCash's co-founder and president, William N. Melton, and "provide safe passage from cyberspace into the banking world." Private on-line services use proprietary software to move funds, which reduces the risk of thieves breaking into the system. But only subscribers are permitted to make on-line purchases, and then only from participating merchants. For example, fewer than 3% of the people who frequent the CompuServe "mall" each month buy anything. The Internet, by contrast, is an unsecured free-for-all that uses "open" software to let tens of thousands of computers link up. That means more computer jocks know how it really works, increasing the chances of a break-in. Mr. Melton is in a good position to overcome the banks' security concerns. He founded Verifone Inc., which makes the devices retailers use to authorize credit-card charges. He sits on the board of America Online and helped launch Transaction Network Services Inc., a data transmission network for six of the 12 largest credit-card processing centers. TNS is expected to be part of CyberCash's private banking network. CyberCash's co-founder is Dan Lynch, founder of Interop Co., a trade-show subsidiary of Ziff Communications Co. that hosts the biggest Internet gatherings. Other partners include Stephen D. Crocker, one of the Internet's architects; James Bidzos, president of RSA Data Securities Inc., a leading software-security firm; and Bruce Wilson, a former Nynex Corp. executive and one-time board member of the Electronic Funds Transfer Association, a banking trade group. (END) DOW JONES NEWS 09-13-94 6 06 AM - -------------------------------------------------------------------------------- 9/13/94 Company Plans -2-: A "Digital Purse" For Internet Shoppers The Internet today is one big yard sale of computers, t-shirts, books, compact disks, rope sandals, legal services and hundreds of other products -- with almost no way to buy. An estimated 500 companies, from travel agencies and art galleries to real-estate brokers and a Volvo dealership, have put up storefronts. Most offer only product information and customer support. To make a purchase, a browser must phone a vendor. "It's a very clunky way of conducting electronic commerce," says Jayne Levin, editor of the Internet Letter, a newsletter aimed at business users. She estimates the current value of Internet transactions at a "piddling" $10 million. A few pioneers have passed credit-card numbers safely on the Internet. In July, an electronic bookstore received its first payment over the network. Last month, a small startup retailer in Nashua, N.H., sold its first compact disk on-line. Almost no one, however, has been able to automate payment by bringing banks directly on-line, which is CyberCash's goal. Its approach would let users punch a few keys to ask their banks to set aside money in a "digital purse." When the customer clicks on a "buy" icon, the merchant's computer would pass the request to CyberCash's network, which would forward it to the bank. If funds are available in the "digital purse" or a credit-card account, the money would get tranferred from bank to CyberCash to merchant. CyberCash would receive a small fee for each transaction from the banks. "The transaction is processed instantaneously -- while you wait," says Mr. Crocker of CyberCash. He says the company is working to secure the system, "but there's no question we will have people trying our `front door.'" CyberCash plans to spend $20 million on a private network of computers, which will separate Internet merchants from users' bank accounts. To protect sensitive account information, RSA Data Securities will provide encryption to scramble the data, allowing only those who have a special software "key" to read it. Customers and their banks will hold the keys. In addition, Cybercash is discussing licensing with David Chaum, president of Digicash Inc., a key patent holder for digital-cash technology. Digicash emphasizes anonymity: A merchant is told only whether the cash is available, not who is paying. Other security measures must be taken. On the Internet, users can veil their identities or steal access accounts masquerading as someone else. Backers of RSA and CommerceNet, which posts business and product information on the Internet, are working on tools to verify user ID and keep payment requests private and tamper-proof. Even with those measures, however, CyberCash executives concede it will take some potent powers of persuasion to get the banks on board. "There is no security on the Internet," says Dan Schutzer, president of the Financial Services Technology Consortium, a group of major banks. "Your conversations can be tapped, your passwords can be obtained, and your credit card number can be filched. Clearly, it's there for the reading for a clever hacker." -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLneTKqyHUAO76TvRAQHrVgP+MmLm4+YTliqVMLcsNKakx/GXTsgpOGeD aPyqYRxAEEJNmAfGjrmpPHl3FOMvrnZsINDlo+n6CXArMt79YRExtO69hR2lCY7J Uwrf7EAAIhiYc5pKdRTZ29ZgSRbqEP4gOB1TPAoncjR84lXVC61wdNXz6yU7tuaF 6oyXUH5UEw4= =QHMH -----END PGP SIGNATURE-----

1 0

Re: thoughts on RC4
by Carl Ellison 17 Dec '03

17 Dec '03

>Date: Thu, 15 Sep 94 10:52:03 EDT >From: perry(a)imsi.com (Perry E. Metzger) >Can anyone see any reason why one could not change RC4 to >being a word oriented stream cipher, call it "ERC4"? Alleged-RC4 (1) requires that the table be a permutation and (2) might base security on the fact that the table is itself permuted beyond recognition after a small number of inputs. (1) You could conceivably go to an array of 65K short values and retain the permutation but I wouldn't try to go to an array of longs. I don't have 32GB of RAM on my workstation. (2) With a longer array, the amount of input until the array is indistinguishable from the one with which you started is proportionally longer. I don't know if that means that shorter arrays are more secure, but it's worth taking a look at. - Carl

1 0