December 2003 - cypherpunks-legacy

Bank Fees and E-Cash
by Black Unicorn 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - - - Bank Fees and the E-cash Niche. Banks have gorged themselves on rocketing fees for the last five years. The result is that typical bank customer currently pays 150% of the amount of interest collected on accounts in a given year in the form of fees. My prediction, and my hope, is that e- cash will cut through the pretense upon which the rationalization of many of these fees is based, and even market itself on this point- Lower Fees. - - - New Fee Schemes "Overdraft Assistance" and the Myth That Only Irresponsible Bank Customers Bounce Checks or Overdraft. Banks have begun to implement policies intended to help the customer overdraft. They may, for example, cash the largest checks first such than an overdraft will hit with several small checks rather than one or two large ones causing multiple overdraft fees. Banks have begun to routinely delay crediting checks for 48 and 72 hours, and out of state checks for anywhere from 3-14 business days. ATM cash deposits are typically subject to 24-48 hours delay. The "Unofficial Credit." Many times the delays in crediting various transactions are hidden by the "unofficial credit." Most noticeable in ATM deposits, a credit is given but should demands on the account draw into the "unofficial credit" an overdraft will be posted on the rationale that an "official credit" has not yet been posted and the funds are thus not "officially" available, this despite the fact that the funds will appear available to ATM balance requests and statements. Of course the bank will profit from the "unofficial credit" to "official credit" interest float regardless of what overdraft fees might be charged. The "wire credit" and "official wire credit" are another example. Banks receive a wire transfer on Monday, send a "electronic payment advice" the same day, but post the credit to the account "officially" on Tuesday. The original intent is for the bank to be able to take advantage of the interest "float" between the receipt of funds and its credit to the account. The result is an additional overdraft potential. The Separate Wire Office Hours. Often times the bank's "wire" office will close hours before the branch closes. Wires received some hours before closing on Friday will not be credited until the following Monday. The ATM Processing Time Table. Many bank only begin processing ATM deposit transactions an hour before closing, crediting only as many deposits as can be processed in this time, the remainder are not processed until the next morning. ATM debits are, of course, processed all day. Check Processing Time Table. In a given day, debit checks are processed on an account before deposit checks are processed. Obviously, an account that overdrafts overdrafts only because of the order in which checks are processed. - - - The Created Convenience Fee A great many bank fees fall into what I call "created convenience fees." Really created convenience fees resemble airport customs bribes in third world countries. The customs officer makes what should be an easy passage terribly difficult, then demands a "fee" to make travel as easy as it should have been to begin with. The net effect is for the traveler to pay to dispense with a problem created by the party receiving the fee. Nigeria is a prime example. Upon arrival the average traveler will find him or herself embroiled with licensing deficiencies, visa fees, entry fees, the threat of quarantine, seizure of expensive equipment for "inspection" and other such invented requirements. Some hours into the "negotiations" the customs official will offer to "overlook" these transgressions for a "fee." This is a created convenience fee. Banks fall into this category by such programs as "overdraft insurance" whereby banks enact policies which, as we have seen, make it painfully easy to overdraft and then charge a monthly fee to avoid the overdraft charges. - - - The Result Bob is a sort of combination of my own experience and discussions with other bank customers in D.C. Bob has an account in Washington, D.C. with $1500.00 in it. Bob Receives a wire at 3pm Friday for $1700.00 Bob writes five checks on Friday, one for $1400.00, one for $200.00, one for $150.00 and two for $100.00. Totaling $1950.00. Bob deposits 4 checks totaling $2000.00 in the night depository Saturday. Bob deposits $50.00 in cash in an ATM on Saturday Night. Bob checks his ATM balance ($3250.00) and withdraws $50.00 from an ATM on Sunday Morning. Bob's wire arrives after the wire office has closed for the day - an "unofficial credit" is posted Friday before closing anyhow. Bob's bank processes the $1400.00 check first, leaving Bob's account with an "official" $100.00 and $1700.00 in "unofficial funds." Bob's bank processes the $200.00 check, notes a $100.00 overdraft, charges $25.00 for this check, refuses payment on the remaining three checks and drops a $25.00 overdraft fee plus a $10.00 "bad check" fee for each. Total charges: $130.00 Bob's bank processes the $50.00 ATM withdrawal, which overdrafts. $25.00 fee is posted. Total fees so far: $155.00. Bob's balance for the majority of Monday: -$255.00. Bob's bank begins to process deposits, notes all the checks for deposit, $1000.00 of which are out of state. No checks are credited. Bob's bank notes the ATM transaction at the end of the day on Monday, but does not credit it immediately despite the fact that it is cash. Bob's bank credits the ATM deposit to Bob's account on Tuesday. Bob's balance is now -$205.00 Middle of the day Tuesday, Bob's account has been below its required minimum $500 balance for 24 hours. A $50.00 fee is charged. End of the day Bob's wire is "officially" credited - a $10.00 fee is charged for receiving the wire. (No, I'm not kidding) Bob's bank credits the $1000.00 of in state checks on Wednesday Finally, on Friday, Bob's out of state checks are deposited. Bob will likely be liable for $50.00-$75.00 fees for each of his bounced checks as vendors will probably charge hefty fees. Telecheck will have Bob on the 10 most wanted list for $350.00 in bounced checks. Bob's check writing ability is about nil in D.C. for the month it will take him to clear it up. Bob gets a mailing a week later telling him of the advantages of his bank's newest "overdraft insurance" program. $150 a year. Bob, for what would literally be a series of very responsible transactions, is looking at over $215.00 in bank fees, and at least $150 in bounced check fees from vendors because of violation of technical rules the bank has designed to cause fees to be charged. - - - E-Cash I cannot believe that e-cash won't be able to solve some of these problems, and I hope it will limit its own fees to usage. To me this is a classic argument for small house e-cash shops. Citibank and Mastercard are going to fight for their fees. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMClJUS1onm9OaF05AQEhugf/T2FquzHdEhHp8dQI5FRYcuayTusig1F3 pHejUdry84F1MqLArSZukVGxEWtZVR0qh2xq4AiN/UwlW9ZKasFdbPPGJtbD6gpO aALJIhQaYJSTQkW4fmieejhcNPMf7e59YaerOl83LkKS/+1tFi9ib1Xz2ZnmXlph 0mWuJjONzH45tPylyJy8fyB9nrpk5WDCAiLhUSxqHRdVmA9nq6uIIZbdmz7sEpLq 82cHyHXKeufGKGvx26R4z3lu0o5Ykd/dGAWADpJ6OT2bhlWFinApF/HMJAA9mLvi w70StZZL/94ncQQWF7LU5vMhGu7/5WNsrpRTzZXG5A0EfFL0ZAdYPw== =ew58 -----END PGP SIGNATURE----- 00B9289C28DC0E55 nemo repente fuit turpissimus - potestas scientiae in usu est E16D5378B81E1C96 quaere verum ad infinitum, loquitur sub rosa - wichtig! *New Key Information* - Finger for key revocation and latest key update.

4 3

PGP at work?
by Rick Busdiecker 17 Dec '03

17 Dec '03

Sorry for the FAQ. Really, I've spent the last hour scanning the distributed docs and hopping around to different web pages looking for this info. What constitutes ``commercial use'' of PGP? I could swear (if I were a theist :-) that I'd seen some sort of statement from RSADSI, PKP and/or MIT that it is ok to use PGP for mail at work providing that the *purpose* of the mail is not commercial. Could someone confirm or deny this, preferably with a reference? -- Rick Busdiecker Please do not send electronic junk mail! net: rfb(a)lehman.com or rfb(a)cmu.edu PGP Public Key: 0xDBD9994D www: http://www.cs.cmu.edu/afs/cs.cmu.edu/user/rfb/http/home.html send mail, subject "send index" for mailbot info, "send pgp key" gets my key

1 0

Re: Only 1/3 of Government Computers Down So Far
by sbryan＠maroon.tc.umn.edu 17 Dec '03

17 Dec '03

At 12:29 pm 8/9/95, KALLISTE(a)delphi.com wrote: >Perry, > Many people are interested in cryptology because they don't >want the NSA (among others) invading their privacy. The Foster story >concerns the chief NSA privacy-invasion of modern times: spying on >domestic banking transactions. So it's relevant. > The Grand Inquisitor role is getting a little old. So if >you want to continue to play it, my response is: Fuck Off. > >-Orlin I'm thankful that someone can occassionally (or even always) point out that the messages are getting rather far from what is considered the main topics of the list. This is a very high volume mailing list, at least three times as high as anything else I try to read. I didn't subscribe to a conspiracy buff list but it is not my intention to go out of my way to insult anyone here. But there are lists (aren't there?) for people who find such speculation interesting. +---------------------------------------------------------------------- |Steve Bryan Internet: sbryan(a)maroon.tc.umn.edu |Sexton Software CompuServe: 76545,527 |Minneapolis, MN Fax: (612) 929-1799 |PGP key fingerprint: B4 C6 E2 A6 5F 87 57 7D E1 8C A6 9B A9 BE 96 CB +----------------------------------------------------------------------

1 0

Re: Crypto = Competitive Advantage?
by Andrew Loewenstern 17 Dec '03

17 Dec '03

Jason Weisenberger writes: > > Apparently the opening price was doubled very shortly before the > IPO > (late yesterday afternoon) from $14 to $28. By lunch-time > (in NYC), > shares were trading at $72. > > Amazing aint it - a moron girl at Goldman Sachs of course told me > I was crazy and anyone who felt Netscape was going to go over the > top was a moron. It may have "opened" at $28, but the first bid was $71 and now it's trading at $50something. Not quite so spectacular as at first glance... So unless you shorted it or were an insider it wasn't such a hot thing (so far). Quarterdeck is probably a better buy. ob crypto: the "top secret" source just posted looks interesting... 64-bit blocks, 80-bit keys, 32 rounds hmmmm.... andrew

1 0

"S1" encryption system (was: this looked like it might be interesting)
by Hal 17 Dec '03

17 Dec '03

I suppose the unstated implication is that this might be Skipjack. I have looked at the program a bit and have a few observations: There is an obvious typo in the "g" function, whose first parameter should be 0 or 1, but which tests it for 0, 1, or 2. This suggests an amateur effort. The coding style in general suggests a lack of familiarity with C (absence of "for" loops, with equivalent "while" loops substituted). The program appears to be based on a hardware-based description of the algorithm, judging from comments and style. The algorithm uses two fixed arrays F and G. Comments indicate that F was designed as four independent arrays F0, F1, F2, and F3. These are suposed to be non-linear. Each takes 8 bits in and 8 bits out. G is two arrays, each 8 bits in and 1 bit out. The comments indicate that it is supposed to be "pseudo-linear". G1 is the odd parity function. G0[i] is 0 0 1 1 0 1 1 0 0 1 repeated over and over. This is unusual because it is period 10 (the second 5 bits are the inverse of the first 5). I don't know whether there would be a more concise algorithmic representation of G0. Key size is 80 bits. The program implements the ability to hold 5 keys at once. Block size is 64 bits. The keys are expanded internally into a large array. I haven't looked at the key scheduling in detail. The encrypt and decrypt block functions have fixed xor's applied to the 64 bits of input and output. This appears to be cryptographically useless (or at least not very useful), similar to the initial permutation in DES. It is curious that xor's are used here rather than a permutation. That may represent an attempt to design the cipher to run well in software. The encryption function itself is a modified Feistel type cipher, with the blocks broken into 8 pieces and xor'd with functions involving F, G, the key and other pieces in a reversable pattern. The loop iterates 32 times but only two of the 8 pieces are changed each iteration so each 8 bit piece actually gets modified only 8 times. The pattern is: piece 6 modified by pieces 4, 5, 2, 3 piece 7 modified by pieces 4, 5, 0, 1 piece 0 modified by pieces 6, 7, 4, 5 piece 1 modified by pieces 6, 7, 2, 3 piece 2 modified by pieces 0, 1, 6, 7 piece 3 modified by pieces 0, 1, 4, 5 piece 4 modified by pieces 2, 3, 0, 1 piece 5 modified by pieces 2, 3, 6, 7 repeated 8 times. Decryption goes in the inverse order as is typical of these ciphers. The key is basically 80 bits, however there is a function S1_create_key which pads it with 16 bits of 0 and then encrypts it with two overlapping encryptions using the all-zeros key. The resulting 96 bit key is then fed as input to S1_load_key which decrypts it and checks for the 0's to ensure validity. I am not much of a cryptanalyst, but from what I understand the overall security of a Feistel-type cipher like this depends a great deal on the structure of the F (and in this case G) boxes. I would not be at all qualified to analyze those. So potentially this may be a strong cipher or it may be weak. The actual implementation does as I remarked show some signs of amateur programming skills. In addition to the points mentioned it is curious that the G arrays are initialized with a list of 256 values rather than taking advantage of the apparent regularities noted. Hal Finney hfinney(a)shell.portal.com

6 6

Re: "S1" encryption system
by Hal 17 Dec '03

17 Dec '03

Correction, I just noticed that the four F functions have 4 bit output not 8 as I wrote. Realize that all this is based on a very cursory examination of the code. BTW I just was starting to look at the key scheduling and I noticed that fullkey is indexed in its 2nd slot by i*2 where i goes from 0 to 31, but is only declared as being 32 in size in that slot. So I think this is another typo, probably the index should be i. This kind of thing does not inspire confidence... Hal

3 2

IPSEC goes to RFC
by Perry E. Metzger 17 Dec '03

17 Dec '03

RFCs 1825, 1826, 1827, 1828, and 1829 came out today. These RFCs describe in detail the IPSEC protocol, which is designed to secure the internet from the ground up. IPSEC permits the cryptographic encapsulation of all your IP traffic, which means all your internet communications. IPSEC is now a Proposed Standard. Please read them and help us in the effort to universally deploy this protocol. Still to come will be a key management system. The current notion is to store RSA keys in the DNS -- a proposal to do this made by Eastlake and Kaufman has been accepted by the IETF. Eastlake is now working on a certificate format that will be an alternative to X.509. The keys will be used by a modified version of the STS protocol (a signed Diffie-Hellman exchange) that is being worked on by Phil Karn -- the key management system is to be called "Photuris" and is currently an internet draft. Again, *we need your help*. Cypherpunks write code. Help us make the internet safe for personal privacy by contributing to this effort. Perry

8 13

This summer's special delivery?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:59 PM 8/9/95, Matt Blaze wrote: >Someone sent me (to my bell labs address) a copy of this this afternoon via >an anon server in the netherlands. It looks like others got it as well, and >it appears to have been posted to the cypherpunks list, though it hasn't >yet shown up here from the list (my mail seems to be slow today). Did >anyone else have a copy mailed directly to them? I got a copy mailed to me directly as well. I don't know why he/she/it sent it me, but I got it. I have nothing further to add on this. But recall that it was just about this time last year--just before Crypto--that the "alleged RC4 code" was posted anonymously to the list. Hmmhhh.... --Tim May Special note: My ISP has changed its domain name from "sensemedia.net" to "got.net" (as in "got milk?"), so I have to again ask you all to bear with me and use my new e-mail address, "tcmay(a)got.net". ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

2 1

Re: "S1" encryption system (was: this looked like it might be interesting) (fwd)
by gt7508b＠prism.gatech.edu 17 Dec '03

17 Dec '03

Forwarded message: > On a fair number of occassions I have been told that federal type folks > have made statements to the effect that there is no such thing as a "TOP > SECRET" classification of US government docs. Since really secret things > tend to get neither confirmed nor denied, I am inclined to believe this. > Thus SECRET is the top classification in today's government/military. If > anybody knows otherwise I would be interested in the information. > > JWS > In high school I was in JROTC and was put in charge of security for our batallion. I read the army's guides to physical security. These books were dated early 80's and late 70's, so the situation might have changed, but I doubt it. They denoted three information security clearance levels. CLASSIFIED, SECRET, and TOP SECRET. If TOP SECRET doesn't exist now, it definately did just a few years ago. -- =-=-=-=-=-=-= Tom Cross AKA The White Ninja / Decius 6i5 */^\* -=-=-=-=-=-=-=- -=-=-=-=-=- TWN615(a)mindvox.phantom.com GT7508B(a)prism.gatech.edu =-=-=-=-=-=-= =- "Government is not a reason, not an eloquence; it is a force. Like fire, =- -=- it is a dangerous servant and a fearful master." -- George Washington -=-=

3 2

>actual< classification categories
by tbyfield＠panix.com 17 Dec '03

17 Dec '03

I have copies of declassified documents with the following markings: secret (1985) top secret (1986) classified (1984) confidential (1985) eyes only (1986) Some have various combinations, such as: secret/sensitive top secret/sensitive eyes only/top secret/sensitive This isn't a complete list, but it's better than idle speculation. The vast majority of declassified paper documents that I've seen (not a small number) have explicit statements regarding _who_ is allowed to see it, _how_ they are allowed to move and/or distribute it, control #s and copy #s, semicomprehensible strings of characters, and so on; many have thiings like destruction instructions and expiry dates. More and more, slight variations are being introduced into each version for purposes of compartmentalization. It's conceivable that this is the source of the typo Hal spotted, but I doubt it. The fact that specific instrux were relegated to a separate "label file" seems very suspect; the fact that the warning tag is tacked onto the end is maybe noteworthy--it's in a different format, which is possibly odd, but it might've been put there for silly theatrical purposes. Basically, "top secret" without further comment is James Bond stuff, since in and of itself it doesn't tell those who need to know what they need to know. My guess is that someone stuck the "top secret" stuff on the beginning and end of something they found. But that doesn't make it a hoax, necessarily. Ted

1 0