December 2003 - cypherpunks-legacy

Re: Card Playing Protocol?
by kentborg＠world.std.com 17 Dec '03

17 Dec '03

tcmay(a)netcom.com writes: >Find a _reason_ to use crypto in games... Easy. Three quick ones. 1) If you like nice distributed "I don't need no stinkin' trusted server" ways of doing things, it is the only way to play some virtual games. 2) Games are very important. (Quick: Name 10-industries which are bigger. ... Betcha ya made at least one mistake.) 3) A simple game of cards is very non-threatening. It doesn't smack of anarchists or revolutionaries or anything frightening like that. Those words scare a lot of people. This is politics man, these things matter. Tim also writes: >An obvious problem with crypto card games is this: what does it >provide that is worth the extra effort of doing encryption? I admit I originally considered a situation where the user actually saw the crypto elements in action, I have since convinced myself that is silly. At least in the case of doing cards, too complicated. Seeing the results is pretty powerful, however. Also, remember who suggested this (today): I am a user interface freak. The effort is in the protocol, the user never sees it, she only notices that she can now be part of the World Wide Duplicate Bridge Tournament that she heard about on All Things Considered. The effort in building the protocol? I love that stuff. The effort in writing the software? I like that stuff somewhat--but there is possible *profit* here, I might not have to write more than the crude 0.9 version. Some game company might finally bring down ITAR. (Now that is economic might.) The effort in CPU time or communication bandwidth? Shit! We are talking a world of digital video, for christsakes! What's a few computrons and bauds burnt to deal a hand of go-fish? Is there a flavor of effort I forgot? -kb -- Kent Borg +1 (617) 776-6899 kentborg(a)world.std.com kentborg(a)aol.com Proud to claim 32:00 hours of TV viewing so far in 1994!

5 5

Re: Leaving the Country
by frissell＠panix.com 17 Dec '03

17 Dec '03

At 03:50 PM 7/15/94 -0500, Benjamin McLemore wrote: > >*New Hampshire--alcohol sales (state run liquor stores), anything else? >*Alaska--lots of oil. All the New England States including Taxachussets have State Liquor Stores. NH has the cheapest booze of the lot and even entreprenurially advertizes to encourage the residents of other states to save money at their stores. Actually lots of states had no sales and income taxes when I was born and yet life somehow went on. People may have even been happier (or more satisfied). DCF "Sunday is the 200th anniversary of the Whiskey Rebellion. Our last chance to avoid a strong federal system. Have a rye whiskey in memorium."

1 0

Re: ID card from hell
by frissell＠panix.com 17 Dec '03

17 Dec '03

At 02:04 PM 7/15/94 PDT, Blanc Weber wrote: >First they nationalize your possessions, then your mind: but it can >also be done the other way: while everyone is freely engaging in >commercial transactions across national boundaries, in the background >everyone is being corralled into a national identity scheme >the connection to the Holy Leadership is always maintained, like a >tether - you always know, psychologically, to whom you are attached >and to whom therefore, you must surrender your money, your time, your >identity card........ The advantage of expatriation. If you are in a country other than that of your birth there is less of a psychological burden. The government is just another thing to deal with. No magic associations from childhood. This is particularly true if you move around. Dual nationality helps too. You can buy same for <$25K from various Carribean nations. DCF "Anyone with at least one grandparent (living or dead) born in Ireland (including Northern Ireland) is an Irish citizen. All you need do is apply for a passport."

1 0

Re: ID card from hell
by frissell＠panix.com 17 Dec '03

17 Dec '03

At 12:29 PM 7/15/94 -0700, Timothy C. May wrote: >Not addressed in Duncan's essay was my chief concern: The "National >Benefits Card" is required to get license plate tags. (And maybe other >things, like car and home insurance, etc.) This can't be required because corporations and other legal entities can own cars and these entities can, in turn, be owned by non-resident foreigners. Funny story. A couple of weeks ago, I rented a car from (a major car rental agency) in a NE state. They gave it to me for a week. It had Florida plates. The registration expired at the end of June, three days into my week-long rental. I drove an "unregistered" car with the permission (albeit unknowing) of a major corporation for 4 days. Also hard to break the Clean Team/Dirty Team technique where one family member owns the cars and the others drive. Same with property ownership. If demand develops, I expect that some enterprising members of the "underclass" will be able to rent their identities or rights to conduct transactions to those who need them. Government penalties won't faze them. >If I fail to pay, I lose my car insurance (which makes me ripe for a >"deep pockets" lawsuit by anyone who gets into an accident with me). >Lots of other implications. Very real implications. It is *much* easier to protect your assets from a private party than from the government. Private parties usually can't afford to sue you in the Cook Islands to try and break your Foreign Asset Protection Trust. >I continue to see great dangers here, in tying a national ID card to >transactions we are essentially unable to avoid in this society: >driving, insurance (and let's not argue insurance...I mean it is >unavoidable in the sense of legal issues, torts, etc.), border >crossings, etc. Tim, I sense that you suffer from the great American Insurance Addiction. The belief that it is possible to eliminate all risk if you pay massive amounts of money to an insurance company. This tends not to work. It leads to mandatory insurance laws that lead to exploding insurance costs that lead to system collapse. Judgment proofing oneself is cheaper. >Now how will one file taxes without such a card if one is made >mandatory for interactions with the government? Saying "taxes are not >collectable" is not an adequate answer. They may not be collectible >for street punks and others who inhabit the underground economy, but >they sure are for folks like me. If you fail to include your SS# on your tax form but it is otherwise complete and they have their dough, they don't prosecute. Remember "Have Spacesuit, Will Travel" in which our hero's father kept his money in several cookie jars including one labeled "Uncle Sam" and then once a year emptied that one out and sent it to the government: IRS Agent: But you have to fill out a tax form Taxpayer: The government can't even require that you be able to read and write. In 1993, the IRS referred approximately 350 cases to the Justice Department for criminal prosecution. Out of 20 million tax evaders that's a pretty blunt sword. Note that the current ID requirements under the 1986 Immigration Act have had the sole effect of *dropping* the price of an SS Card and a California Driver's License on the streets of East LA from circa $50 to circa $20 (due to economies of scale presumably). More technically advanced ID will merely encourage people to become self employed (a good thing in any case). Germany has much tighter ID requirements than we do. Illegals there work through contract employment firms that accept the risk for profit. On the subject of border controls. The DDR tried machine guns, barbed wire, and concrete as border controls. It worked for less than 30 years and "that was then this is now." Things move faster these days. Even with anti-foreigner hysteria, Germany, France, and the Benelux countries recently eliminated crossing controls. The others in the EU "inner 9" should follow soon. NAFTA should reduce ours as well. Note BTW that Mexican vehicles (including trucks) will get ease of entry in a couple of years. Good place to register your car? As more countries become "developed" and world real income doubles and doubles again (with shorter doubling times) travel for all purposes will explode. It will make current travel rates (the highest in history) look insignificant. Swamping is bound to occur. Since we've established that direct application of force will have to be increasingly rare (cost factors) that leaves control freaks with only denial of service to fall back on. Since DOS leaves unfilled demands (if the service denied is something people actually want) it will create its own market opportunity. Markets have become *much* more efficient at this sort of arbitrage these days. Note that those denied credit cards because of bad credit suddenly have dozens of secured credit cards to choose from. Tim has claimed that the government will get markets to reject willing customers who have money to spend because they lack their 'US Card'. That runs counter to the entire history of markets. People will find a way to buy what they want. DOS attacks will just leave people increasingly outside the government system where some of us want to see them in any case. DCF "What is the first thing a 'Rocket Scientist' Derivative Designer says when he's told that Chairman Gonzales of the House Banking Committee is out to crush derivatives. 'Gee, you mean to tell me that I'll have to charge another couple a hundred thou to design a new derivative to eliminate the new regs? No rest for the weary.'"

2 1

Re: Triple encryption...
by DAVESPARKS＠delphi.com 17 Dec '03

17 Dec '03

Adam Shostack <adam(a)bwh.harvard.edu> wrote: > While the IDEA in th middle might slow down a meet in the > middle attack on 2DES, I don't know that you're justified in claiming > 112 bits of DES key space without something like: > > des|des|IDEA|des If IDEA can be *TRIVIALLY* broken, and assuming the availability of the massive amounts of memory needed to store all of the data required for a MITM attack, then you're technically correct. But, even granting that possibility for the time being, you still have the equivalent of 57 bits of DES keyspace, which is better than totally relying on 3DEA. While a "super DES breaker" machine has been hypothesized, and a cost to build it estimated, I don't recall anyone doing so for a "MITM DES breaker" which would require incredible amounts of memory. At a minimum, it would require not only *TWO* super-DES-crackers, but a very sophistocated machine to gather the blocks generated by all of the various parallel processors comprising the other two machines, store, and continually compare them, searching for matches. IMHO, that "middle" machine would be far more complex and expensive than the other two. A MITM attack might, theoretically, take only twice as long as attacking a single layer, the cost of doing so would be much more than twice as large. Anyone care to estimate what the cost of the RAM alone for the "MITM interface" machine would be? Let's see, for two 56 bit beys, you'd need storage for 2^57 blocks of 8 bytes each, or 2^60 bytes. At $40 per Mb, or so, that would come to ... let's see ... $4 * 10^51 for memory alone. And once the list of blocks started growing as the attack progressed, could the interface processor keep up with the other two, in real time? Massively parallel processors might speed both ends of the attack, but the "database comparison phase" would be the real bottleneck, IMHO. /--------------+------------------------------------\ | | Internet: davesparks(a)delphi.com | | Dave Sparks | Fidonet: Dave Sparks @ 1:207/212 | | | BBS: (909) 353-9821 - 14.4K | \--------------+------------------------------------/

1 0

Re: Triple encryption...
by DAVESPARKS＠delphi.com 17 Dec '03

17 Dec '03

Mike Johnson wrote: > Or for the rabid, clinically paranoid: > > 3des | tran | IDEA | tran | Diamond | tran | Blowfish | prngxor | [11 iterations deleted] > ... about 500 more lines of the same ... > > with a memorized 5 megabyte key. > > And I thought 15 round Diamond with a 256 bit key was overkill worse than > 3 key triple DES! > > Seriously, folks, the weakest links of most cryptosystems are not in the > symmetric key cipher (provided you pick one of the good ones), but in the > key management, associating people with keys, and in picking good pass > phrases. There's always a trade-off, and you've just demonstrated one of the extremes. In the final analysis, it's sort of like deciding whether to spend $1000 on a security system to protect a $500 car, for "security", or leave the doors unlocked and "hide" the ignition key under the mat for "ease of use". Probably something in between makes the most sense. HOWEVER ... I was merely demonstrating one possible permutation on the triple DES method. (More precisely, a permutation to someone else's permutation.) Replacing the middle layer of DES with IDEA seems to be a feasible alternative, since IDEA is as fast as DES, or slightly faster. If a user is concerned enough about security to want to use 3DES in the first place, then an extra 64 bits of keying material is not an unreasonable burden. It also "diversifies" the overall protection in case either DES or IDEA should eventually be found to be exceptionally weak when attacked in a certain, previously unknown, manner. IMHO, "paranoid" would be saying that people *MUST* protect their data to this level, regardless of its actual "value", as opposed to merely presenting options for an end-user the choose from, including some common-sense key management guidelines as well. A single iteration of the 512 layer "overkill" scenario might even make sense, actually, under certain extraordinary circumstances. Unless the various algorithms react in some sort of strange way to actually *WEAKEN* each other, your final security is equal to that of the STRONGEST of the mix. OTOH, if we *KNEW* that the best attack against IDEA was brute force, then single IDEA would suffice for just about any conceivable application. What would you like to suggest in the way of key management to make that "link" at least as strong as the algorithmic one? Your point is certainly a valuable one, but the two aren't mutually exclusive. That would be like saying that I won't buy a lock for my front door until I've first replaced all my windows with something more sturdy than glass. It depends on the nature and source of any potential attacks. To follow the analogy, some "burglars" are better at lock picking than glass-smashing. /--------------+------------------------------------\ | | Internet: davesparks(a)delphi.com | | Dave Sparks | Fidonet: Dave Sparks @ 1:207/212 | | | BBS: (909) 353-9821 - 14.4K | \--------------+------------------------------------/

2 1

Re: Leaving the Country
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Tim writes: > I say "popularization" instead of coinage, because Goldwater use a > variant ("There isn't...") in his 1964 campaign, reportedly written by > one of his speech writers, Karl Hess. (The same Karl Hess who is > involved in libertarian matters.) _was_ involved, I'm afraid. Karl's heart disease caught up with him this spring. He'll be long remembered. Bill # Bill Stewart AT&T Global Information Solutions (new name for NCR!) # 6870 Koll Center Pkwy, Pleasanton CA 94566 1-510-484-6204 fax-6399 # Email: bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465 KH: "A good friend, good lover, good neighbor" Q: "That's all there is to being an anarchist?" KH: "What did you expect, a lot of rules?" Karl Hess, 1923-1994 - R.I.P.

1 0

Re: National I.D. Cards
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Brian writes: > It would seem we are missing a point about having National I.D. > cards. The rest of the world seems ready to rush in and adopt some > form of "Clipper" chips to monitor their own citizens. (There doing > it in the U.S.!) Do we really doubt they will adopt "The Card" as > well? (don't leave home without it!) > > Step 2: International I.D. Cards...... > > Can you say "New World Order?" Sure you can....... Various other people write: > But what about the tourists? But we've had *international* ones for years. Passports. Go visit Morocco, or Egypt, or other places with heavy-duty bureaucracies, especially *French* bureaucracies, and you'll find you need to show your passport or National ID Card to stay in a hotel or change money; some of those places even have the beginnings of computer infrastructure to let them coordinAte that information. Disgusting, but all too common. In Egypt, they stick paper stamps like postage stamps on all the paperwork to show you've paid the fees. We've escaped that stuff for a long time (not surprising, considering how upset some of our ancestors got about a 3% tax on tea...), but we could join the rest of the world just about the time they're giving it up....

1 0

Detweiller
by Random H0Z3R 17 Dec '03

17 Dec '03

hello, I hope this isn't a stupid question (if it is, the anonymity protects me!!) ghio said that Detweiller must have forged that Big Collision message sent to his remailer, because the person it was attributed to hadn't logged in. I wonder if "rsh" shows up in that type of login?? maybe he "rsh"ed to the account to send from there?!?! and didn't log in to have a cover story?? btw, I haven't seen anything from Detweiller at tmp(a)netcom.com. I assume he still has the account?!?! maybe if someone calls netcom and complains they will do something?? i'm glad ghio caught that message in his mailbox through careful screening so that it wouldn't go out to the newsgroups. I always thought the remailers were automated, but I guess in most case the operators are screening all the stuff. this is good, because we don't need any more Detweiller junk out there (amazing how peaceful things are without him!!!) too bad if the message was forged, because it would be LOTS of fun to EXPOSE THE BASTARD!!! (insert evil smirk here) BTW, here is something I was wondering. on the Detweiller message he has an "errors-to: /dev/null" field. what does that do? why did he put that in there, anyway? i've never seen any documentation reference it. do the remailers handle it? "wondering"

1 0

Re: Leaving the Country
by kentborg＠world.std.com 17 Dec '03

17 Dec '03

frissell(a)panix.com writes: >All the New England States including Taxachussets have State Liquor Stores. Nope. As a many year Mass resident I have never seen a state liquor store in the state. Sure, plenty across the border in New Hampster, but not in MA. One of New Hampster's big tax sources is nasty property taxes. Nice regressive taxes on wealth (both taxing wealth and regressive taxes annoy me), to support a state which does its best to not exist. -kb, the Kent who is currently in California where I can buy booze on *Sunday*, and at a *grocery* store. Cool! -- Kent Borg +1 (617) 776-6899 kentborg(a)world.std.com kentborg(a)aol.com Proud to claim 32:00 hours of TV viewing so far in 1994!

1 0