December 2003 - cypherpunks-legacy

Re: How do I know if its encrypted?
by Ben.Goren＠asu.edu 17 Dec '03

17 Dec '03

At 6:58 PM 1/13/95, Eric Hughes wrote: > From: Ben.Goren(a)asu.edu > > That of the data haven operator being able to deny knowledge of the > contents of files people send him. He'll only return files that, when > operated on by a strong cryptographic algorithm, make sense. > >This idea doesn't work for the purpose intended. I'll upload straight >ASCII. When you ask for an decryption key, I'll make one up randomly, >apply the decryption algorithm to the flat text, and send that back to >you as a confirmation. >[. . .] Damn. I hate it when I overlook the obvious. Still, I'd like to think there's an answer. Perhaps I'll keep thinking on it. >Eric -- Ben.Goren(a)asu.edu, Arizona State University School of Music Finger ben(a)tux.music.asu.edu for PGP public key ID 0xCFF23BD5.

1 0

NIST Key Certification Document
by chen＠intuit.com 17 Dec '03

17 Dec '03

At the RSA conference, I came across an interesting-looking tome called _Federal Certification Authority Liability and Policy: Law and Policy of Certificate-Based Public Key and Digital Signatures_. It seems that we can obtain this thing from NIST for a modest fee of $61, but I'm wondering if there might be an online version around somewhere. Does anyone know? -- Mark Chen chen(a)intuit.com 415/329-6913 finger for PGP public key D4 99 54 2A 98 B1 48 0C CF 95 A5 B0 6E E0 1E 1D

1 0

Re: Reefer madness
by Blanc Weber 17 Dec '03

17 Dec '03

Thanks for your replies about the Turkish prison films, and all, I think I comprehendo now. I did see the movie Airplane, but I somehow overlooked that salient point. Blanc

1 0

Re: How do I know if its encrypted?
by daleh＠ix.netcom.com 17 Dec '03

17 Dec '03

You wrote: > >Fine. The operator has no idea of how to make sense of this data >format. Just because someone in the world has an interpretation for >it doesn't mean that I do. > The primary point that I'm trying to make is that there is no such thing as an algorithmic test for a dataset being in a 'state' of encryption. Such a test is beyond alogrithmic capability (at least in our universe). Therefore, an RM/DH operator should just drop the pretense of filtering out non-encyphered submissions. Just take what comes and tell customers that if they don't want you to read it, it's up to _them_ to make certain that you can't. Period! The DH operator could encypher all submissions with his own key so that the DH contents can't be compromised to outsiders. This seems to be a much more real-world approach to the problem than tilting at windmill with encryption filters. (The previous examples were an attempt to demonstrate, in a concrete way, the failure of any such algorithmic approach. Whatever encryption-test algorithm you come up with I guarentee you I can defeat it!) Dale H.

1 0

Re: How do I know if its encrypted?
by Dr. D.C. Williams 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > From: daleh(a)ix.netcom.com (Dale Harrison (AEGIS)) > Paco begins by > inventing the new [format] of which only Paco knows the internals. Eric Hughes replied: > No operator of any data service can be expected to know about every > data interpretation. The key here is "good faith". An operator can > undertake a good faith effort to remain ignorant about content. While this may be possible, the argument that someone actively tried to remain uninformed about something "dangerous" or potentially "illegal" doesn't seem like a particularly strong defense. Someone with proper credentials might want to comment on whether intentional ignorance is sufficient to avoid culpability. =D.C. Williams <dcwill(a)ee.unr.edu> - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLxdS6yoZzwIn1bdtAQHHYQF/Qe+7AcXH5ub+BMEY91hjbKNwGGUEho5o CN63jwJ4NQYBcLHwhhu9Q+b1wTE9hMrB =lSSE -----END PGP SIGNATURE-----

2 1

Re: How do I know if its encrypted?
by jpb＠gate.net 17 Dec '03

17 Dec '03

I accidentally sent a reply to Ben's letter solely to him. He responds here to the major points I brought up. I'm forwarding it here with his permission. Ben's text begins At 8:11 AM 1/13/95, jpb(a)gate.net wrote: >Ben.Goren(a)asu.edu said >> Here's a solution: >> >> Alice sends a file to Dave's DataHaven. When Alice wants her file back, she >> sends to Dave a secure hash of the file, a key with which to decrypt it, >> and a handful of plaintext at the beginning of the file. Dave decrypts the >> file that matches the hash with the key Alice gave him; if the file begins >> as Alice says it should, Dave returns the file to Alice. > >If Alice initially encrypts the file to herself, and then encrypts it to Dave >(Dave doesn't accept non-encrypted files), Dave doesn't need to decrypt it. >If Dave even *can* decrypt it, and makes a policy of decryption, he is >setting himself up for legal liability. > >Dave should allow anyone who can provide the MD5 of the cyphertext, the >fileid and the fee to retrieve the file. Retrieval requests will of course >also require a pgp key to encrypt the file to and a anonymous remailer block. I address this somewhat further in a response to Eric Hughes on the list. Basically, Dave wants to make sure that he can't see what's in the file. My scheme guarantees that the file is unreadable to anybody but the owner until the owner asks for it back. If return of the file is automated, Dave'll never know what's in it. Alice should, of course, further protect her data if she feels the need. >> This way, only those people who have an intimate knowledge of the files can >> recover them. > >I agree that this is a good thing to enforce. > >> Dave can have a policy whereby he deletes a file after returning it, unless >> Alice pays more to keep it there. Thus, Bad Bobby can send his naughty >> pictures to Dave, tell the 'net how to get them--but the first person who >> neglects to include the fee to leave the pictures there winds up blocking >> out everybody else. Similarly, Samaritan Sam could get into a spending war >> with Bobby. Each time Bobby sends Dave his smut, Sam retrieves the file >> without paying for its continued storage--and takes a sneak peak at the >> pictures before deleting them himself. > >This is a bad policy for Dave from a financial point of view. If Alice pays >for a 30 day storage, it should stay there for 30 days. This means that Dave >also needs to require an owner-password when the file is initially stored, >but that is no big deal. Change the payment structure a little and you don't have those worries. Alice doesn't pay for thirty day storage, but rather pays for at least thirty day storage. If she thinks she'll be getting the file back in fifteen days, she only pays for that long. If she needs it for longer than that, she sends another payment before the file expires. >In a perfect world, Alice could specify an extra retrieval charge over and >above Dave's, and the DH would enforce this and pass the extra money on to >Alice. This would allow for information sale when neither party trusts the >other - Alice and Bob can agree on a fee for the file through anonymous means, >and once it is set, Bob can send in the cash and be sure the file will be >sent. That's the job of a data broker, not a data haven. Dave might well wish to offer that service, too, but, if I were him, I'd keep the two obviously separate. >Whether or not the file is what it is advertised to be is a whole >new problem that can't be solved securely in software. Not without an awfully good AI....

1 0

Re: How do I know if its encrypted?
by pstemari＠erinet.com 17 Dec '03

17 Dec '03

At 10:07 PM 1/13/95, Ben Goren wrote: > ... Alice hashes her file and uses that hash as the key to encrypt the file. >She sends the file to Dave, and sends the original hash when she wants it >back. Dave decrypts, and confirms the hash. > >Unfortunately, this still doesn't quite close the loop--Dave knows the >contents of the file once Alice sends the key. It does, however, make it >very difficult for Dave to know anything about Alice's file. ... This seems overly complicated. If Dave has a known public key, then Alice should be able to hash her file, sign the hash, encrypt (the hash, her public key, and the file) with Dave's public key, and (anonymously) sends the result to Dave's (encrypted) address. Dave then decrypts, verifies the sig, and stores the file, hash, and PK together, indexed by the hash. When Alice wants the file back, she signs (the hash and her encrypted return address), encrypts the result with Dave's key, and sends it off. Dave decrypts the request, fetchs the public key based on the decrypted hash, verifies the signature, encrypts the file with Alice's provided public key, and sends it back to the encrypted return address. To avoid Dave's knowing the file contents, Alice can encrypt it before the described protocol and decrypt it afterwards. The protocol is subject to a replay attack, but the result of the replay would cause the file to be sent to the original sender and not to the replayer. The signed hash in the first step prevents people from spamming Dave with files that have Alice's public key. Alice only requires an encrypted address and public key for Dave, and Dave validates the retrieval request against the public sent in the first step. --Paul J. Ste. Marie pstemari(a)well.sf.ca.us, pstemari(a)erinet.com

1 0

Draft of editorial to SF Chronicle
by raph＠netcom.com 17 Dec '03

17 Dec '03

Chaos and Anonymity keep the Internet Vital I could not let Martha Siegel's editorial ("Anarchy, Chaos on the Internet Must End", 2 Jan 1995) go unchallenged. To the uninformed reader, her arguments may seem plausible. However, her distortions give a picture of the Internet quite at odds with the true nature of the Net. Her views are by no means representative of those who actually use the Net. Of the dozens of messages I saw in response to the editorial, not a single one was in favor of her proposals. As Ms. Siegel correctly points out, the Net is not governed by any one individual person or organization. Rather, it is collectively run by those who use it as part of their daily lives. The operation of each Internet node is subject to the individual judgement of the people who own it. Ms. Siegel is wrong, however, in believeing that such a state of affairs is intolerable. Rather, this state of affairs has brough us a remarkable flowering of discourse, ideas and culture, which is just now beginning to be recognized in the mainstream press. In a lawyer's dream world, there is a rule covering every action in every situation, along with a well-functioning system to enforce the rules. This is the exact opposite of the spirit of the Net, and of Usenet in particular. Rather, there has evolved an informal set of guidelines for promoting open, civil discourse, collectively known as "netiquette." These guidelines may seem arcane to newcomers, but basically they simply ask people who use the Net to be considerate of other people, their time and their resources. A violation of netiquette brings on not legal action, but responses pointing out why the action was inconsiderate. Continued violation brings on ridicule and scorn -- people who engage in this are considered to be either sociopathic or just obnoxiously self-promoting. The single most infamous breach of netiquette in Usenet history was almost certainly the "green card spam," in which thousands of advertisements for green card services were posted to completely unrelated message areas, or "newsgroups." Advertisements presented in a way considerate to others are tolerated and even welcomed on the Net. Posting thousands of copies, though, is just going too far. Negative response was immediate. The perpetrators were asked to stop, but they refused to. One Norwegian hacker took it upon himself to track down and "cancel" the offending messages. Most people on the Net considered this to be entirely appropriate. A number of other self-promoting hucksters have sensed an opportunity, and have performed similar spams. In response, the Net evolved a defense mechanism to counter these spams and minimize the damage. The person currently serving this role is known by the pseudonym "CancelMoose." Almost everyone on the Net supports this effort, and agrees that it improves the overall value of Usenet. Who was responsible for the original green card spam? Why, Ms. Siegel herself, the same one who is complaining about "chaos and anarchy." Chaos, anarchy, and anonymity are a large part of what keeps the Net so vital. Particularly galling is Ms. Siegel's appeal to free speech. Usenet in its present form is perhaps the most conducive forum for free speech in history. The threat to free speech is not from chaos or anonymity, but from the sorts of changes that Ms. Siegel proposes. Usenet is astonishingly effective in getting around the practical barriers to free speech. These barriers come in many forms, including libel, trademark, and copyright laws, fear of retribution, etc. Because of its decentralized, communal nature, Usenet resists direct attempts to censor. The main tool for circumventing more these more indirect barriers is anonymity. As an example of such barriers, take the t-shirt commemorating the green card incident. It was emblazoned with the words, "Green Card Lawyers - Spamming the Globe" and a fist clutching a green card. Shortly after the shirt was proposed, Canter & Siegel threatened to sue if the shirt was in fact produced. It was only after several outraged lawyers promised to defend against such a case pro bono that I and others could be proud owners. Or take one of the sexual abuse recovery newsgroups, where anonymity is the norm. If someone were to post a message asking for support, saying "my uncle did it" under their real name, they would be vulnerable to a libel suit from said uncle. On the other hand, if they used an anonymous service such as the one in Finland, they would not simply escape punishment for the libel, but prevent it from happening at all. In many countries (and even China is on the Net these days), writings critical of the government, such as exposure of human rights abuses, are illegal. The authors face imprisonment, torture and death. By posting anonymously to the Net, the information can be brought safely to the attention of the world. Not all anonymous messages are pleasant or popular. Unpopular speech is a necessary consequence of free speech. At least to the founders of this country, the benefits of free speech outweigh the discomfort. Our founding fathers were also comfortable with anonymity -- the Federalist papers were originally published under the pseudonym Publius, because the authors felt the ideas should be evaluated on their own. Judging from the materials already published by Ms. Siegel, an Internet built according to her vision would free of such disturbing ideas, but would readily support five hundred channels of green card ads, impassioned pleas to purchase American flag plaques, and, yes, anonymous testimonials for radial keratotomy specialists.

4 3

NYT on Phiber Optik
by John Young 17 Dec '03

17 Dec '03

There's an article today on Phiber's return to indecency, a recap of MOD and celebratory party, with digs by unnabbed hiway-weebs. For copy send blank message with subject: PHI_out

1 0

BBC on Net trade, G7 special summit
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

BBC WSTV reports on commerce on the Net prior to a special G7 meet on the implications of the infosphere. Surprisingly, they don't mention anarchic blackmarketeers; more surprisingly they don't mention encryption - which one might expect when they talk about a one-man garage firm settling multimillion $ commodities trade contracts over the Net. Some people are about to learn something really fast. Let's hope they don't react like C&S. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "In between the breaths is rishab(a)dxm.ernet.in the space where we live" rishab(a)arbornet.org - Lawrence Durrell Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0