December 2003 - cypherpunks-legacy

Re: T.A.Z. on Disk
by Mark Grant 17 Dec '03

17 Dec '03

On Fri, 20 Jan 1995, Angus Patterson wrote: > I also saw another e-book site that had some more of his stuff, can't > remember what it was though. There's some more on the WWW at http://www.uio.no/~mwatz/bey/index.html. Mark

2 1

Re: traffic analyzing Chaum's digital mix
by Hal 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- From: Wei Dai <weidai(a)eskimo.com> > I have been thinking about the problem of traffic analysis of a > remailer. > [...] > The basic approach is to use this raw traffic information to calculate a > SCORE for each user of the remailer with respect to Alice, where the > user with the highest SCORE is the person Alice is most probably > communicating with. The idea is that with a Chaumian mix, every time > Alice sends a message to Bob there is always a pattern of Alice sending > a message to the mix, followed by Bob receiving a message from the mix > during the next batch. By counting the number of such correlations for > each user over a period of time, and taking into account the fact that > users who receive more messages from the mix will have higher numbers > of coincidental correlations, a SCORE can be calculated so that it would > be a good indication over the long run of the probability that a particular > user is communicating with Alice. This sounds like a good idea. It was very interesting to see your earlier result on the impact of dummy messages on this approach. Even a relatively small number of batches without dummy messages allows continual accumulation of incriminating information. I know that the Eurocrypt 89 proceedings had some articles on cryptanalyzing Chaum's mixes. My library has an excellent crypto selection but is missing this volume. Can anyone who has read this say whether there is anything in those papers that isn't obvious? Another interesting aspect of your analysis is the possible role of latency. Earlier I had thought of latency as primarily a way of doing mixing, an alternative or addition to batching which mixes messages without holding them up quite as much. But in terms of this in/out analysis latency could play a part in blurring the batch boundaries, adding more uncertainty and making the job of the analyst harder so he would need more data to establish his scores. Hal -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBVAwUBLx/jixnMLJtOy9MBAQGFzwH/diYW0NSddacKyXGvsBc53FsR47R+4BSS pVprHz2LfpVl7U2FFAePMjZIGr5w24hA6nxn1brAO9v6JkVzgUabvA== =Vehs -----END PGP SIGNATURE-----

3 2

RE: Remailers-in-a-box
by Johnathan Corgan 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >I guess it'd be possible to treat remailers as disposable - when one >had pissed off enough people, it could be abandoned - but this lack >of long-term reliability seems poor. Someone had posted a protocol scheme that would allow new remailers to advertise their existence on a newsgroup, which would cause any number of auto pinging "reputation" services to begin monitoring this new remailer automatically. Once reliability, etc., was established, the reputation services would "add" this node to the remailernet. Similar actions would take place if a remailer just "went away". Quality of service, features, etc., would be part of the advertisement, and would result in a form of competition between remailers. Similarly, reputation services would have differing criteria for "blessing" a site, which would result in a form of competition between the _reputation servers_ for a good reputation. The key to this whole scheme is in the automation of the process. Done correctly, it would result in a self-organizing, self-healing ecology of remailers, that would naturally gravitate toward providing the features and services in most demand. Yeah, sure. Looks good on paper, anyway. Lots of real-life hassles to work out, but it _probably_ could be made to work. == Johnathan Corgan "Violence is the last refuge of the incompetent." jcorgan(a)scruznet.com -Isaac Asimov -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLyB9001Diok8GKihAQEZAAP+MU2qaWZahpOgsdoyk7XuHvAnMbNGgalw zJqLNz4H8knRINEZsDsTR7pIMbnhMWxlRfDtgXXNCE8KXvdCA3FkVyG4MItFn5vF fQZxw9rg87m/B9YwEOEah9N4RhNXs2RHsB8dVinMkncw9REklWbGkydcxf0EvKkc Y6JgzEkX54w= =Tu9L -----END PGP SIGNATURE-----

1 0

Hakim Bey URL, etc.
by dmandl＠panix.com 17 Dec '03

17 Dec '03

The URL for the Hakim Bey web site (someone might have already posted this) is: http://www.uio.no:80/~mwatz/bey/ Except from the Hakim Bey interview in "Axcess" magazine (conducted last summer): "I have to admit I felt a certain intense interest, perhaps even amounting to a potential enthusiasm, when this tech was first being discussed," Bey told me. I'd read William Gibson like the rest of us, and I certainly understood his dystopian point, but nevertheless, when Tim Leary and people like that began to get enthusiastic, I had to investigate on that level. I haven't seen much evidence that what Uncle Tim thought was going to happen is really happening. Once again, any technology could be democratic if it were distributed, you know what I mean? It's a simple Marxist thing about means of production. There's nothing inherently authoritarian--at least at first glance--to any technology, although one could argue about how technology then shapes the society that has already shaped the technology in a kind of feedback loop that can move towards greater and greater authoritarianism or lack of autonomy. The potential for what, back in the 50's and 60's, people were calling electronic democracy, is obviously still there as a potential structure. You can see certain elements of it in the Net, but when you're talking about the high tech involved in virtual reality you're really talking about something that is not accesible to most people. And I think it probably never will be. There's never going to be any cheap VR kit that's going to allow a dock worker in Manila to get on some kind of cyberspace Internet, much less a dock worker in Atlanta--or me, for example." Bey was equally gloomy about the future of the Internet. "My impression is that 90 per cent of what goes out over it is completely unrelated to any kind of freedom interests, autonomy proposals or projects, or struggles for genuine non-hierarchical, non-authoritarian group dynamic. Most of it is just chit-chat--banal chit-chat that could just as easily be carried out over an old-fashioned party line phone." Unabashed in my online addiction, I couldn't help but ask if he saw _any_ way to realize the internet as a T.A.Z. "I'm led to believe, through conversations with people who are much more techie and active than I am, that cypher--unbreakable code--is the key. So the cypherpunks are the people to keep an eye on at this moment. They tend to be the ones who are most active around freedom of speech issues...whether legal or extra-legal. Even so, Bey felt that the powers that be will never allow the "Information Superhighway" to develop unchecked. "I think Clipper was a declaration of war on the Net. The fact that the egg is on their face, because within ten minutes some hacker figured out how to beat the Clipper, is an indication of--oh, let's call it an area of chaos. Within areas of chaos, either horrible destruction and disease and death occur. Or, if you're flowing the right way, and if all hearts are beating in unison to a certain degree, then that area of chaos can become the T.A.Z. Now I've said over and over again that there's no such thing as a T.A.Z. that's only on the Net, and I maintain that that's true. In order to have autonomy, you have to have physicality. Autonomy is not something that can only exist in the imagination or in the world of images. I think that it involves the entirety, the whole axial being, and that is rooted in the earth and concerns physicality, materiality, the body--mortality, if you like--as contrasted to the spurious immortality of cyberspace. But I still maintain that, at least in theory, the Net could be an adjunct to the T.A.Z., could be a tool or a weapon, even, if you want to look at it that way, for the construction of the T.A.Z." -- Dave Mandl dmandl(a)panix.com

1 0

IRS to keep unreviewable secret dossiers on US citizens
by xpat＠vm1.spcs.umn.edu 17 Dec '03

17 Dec '03

Excerpts from : St Paul Pioneer Press, Jan 29, 1995 "IRS plans to collect more data on individuals to nab tax cheats" a "vast expansion of secret computer database of information it keeps on virtually all Americans" will include "credit reports, news stories, tips from informants, and real estate, motor vehicle and child support records, plus conventional Govt financial data" "Any individual who has business and/or financial activities can expect upgraded agency reports to be put to IRS auditors promptly" Here's the kicker: "Although agency officials concede that some of the data collected will be inaccurate, taxpayers will not be allowed to review or correct it" ^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^ So much for the FOIA. ------------------------------------------------------------------------ P M Dierking |

4 3

Re: The Remailer Crisis
by Jaeson.M.Engle＠josaiah.sewanee.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Okay. Here's my 2-bits. I run on the MacOS, but how hard could it be to port this code? If anyone is willing to do this (I assume it's not written in Pascal, which is my only language of any consequence), I will run it. It will be available from now until I graduate in '98 during the school months. If anyone wants to try this from scratch, we could try it in Pascal. I would be very willing to do the developing as well as host a discussion list for anyone who jumps in. I will take no responce to mean that all options are not going to be pursued, and that this discussion is just that, a discussion. - -Kyraden -----BEGIN PGP SIGNATURE----- Version: 2.6ui iQCVAgUBLyCKEEiLvmPjc4XdAQEGtAP/TqjIlPgmVWto4Gklrhj8F1LCyyb0urfD QGkGlFODmAuv8jyLHzXUHI8xjaNQHD/fSI7xtsuOODPfDMxuoPGJ6Myfx7OjZ7Ff nVagNeV6N3f1pVW8BLRaoP5gibnZZWq/c2tTuDbXF1wm3h594iP6leugT3Q+3112 NtBTMH6YPVE= =GX7K -----END PGP SIGNATURE----- aka: (-: Jaeson M. Engle || jme(a)josaiah.sewanee.edu :-) (-: www server: http://josaiah.sewanee.edu/ :-) (-: It's January 29th! IT'S TIME!!! Ask me for details!:-) (-: Finger 'jme(a)josaiah.sewanee.edu' for my Public :-) PGP block.

2 1

Re: The Remailer Crisis
by jalicqui＠prairienet.org 17 Dec '03

17 Dec '03

James wrote: >Now this is OK if one wishes to run linux, and have a >remailer as one hobby in addition to the main use of the >box, but it is still a bit much to pay for a dedicated >remailer. > >Now I just do not like linux. Sure it is a great >operating system but it will not run codewright > >(Vi causes mental degeneration. Even though I detest, >loath, and hate vi, vi takes up so much brainspace that >I find myself issueing vi commands in editors that I >use much more, and vastly prefer to vi. Vi is evil.) > >Therefore there is no way in the world I am going to >waste a full internet connection and a PC on linux. Would it be better if you didn't have to dedicate your box to Linux, but just ran it every so often when you weren't playing with Codewright? If you had some store-and-forward mail system (like UUCP or Fido), you wouldn't need to say goodbye to DOS/Windows. I envision a setup right now where you could (if you wanted) type "remailer" at the DOS prompt to bring the remailer up. The screen would show a monitor-type program, with a menu option to "R)eboot" to DOS again (or you could just hit Ctrl-Alt-Del). Oh, and I'd probably package a much nicer editor than vi with it. Believe it or not, the state of Unix editors has progressed beyond vi (and even emacs). But that's assuming you'd need to pull up an editor at all...

3 2

Re: Why emoney? Why not a web of debt?
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 6:54 PM 01/20/95, anonymous-remailer(a)shell.portal.com wrote: > But electronic computers are good at checking out these kinds of >chains automatically. Suppose there were a web of debt-trust. Each >person would indicate the other people who's iou's they will accept >(and the amount they would be willing to take). Thus I might take (up >to $10 of) Jo's, who might take Carol's who might take Terry's, etc. > > To buy something from me online, you will need to produce an IOU >from Jo, Carol or Terry. I would hand it to Jo for verification. Jo >would accept it or reject it (perhaps after talking to some other >folks online). If it were a CarolIOU, or a TerryIOU I would insist Jo >trade it for a JoIOU. All the details could be hidden behind a nice >little GUI. Certainly, that's what money is after all. Pretty much. But how are you going to transfer these IOUs electronically in a way that is relatively fraud-proof? Digital money. Ecash. When we say "ecash", we're talking about what Chaum was writing about in whatever paper, what Schneier describes protocols for in AC. Maybe the ecash is redeemable in US dollars, or maybe it's redeemable for 10 units of service from Jon Smith, but an ecash protocol is what you are going to use to transfer and issue those digital certificates of value, whatever the value represents. And of course, if you want to use these certificates of value anonymously, which is what is required to pay for an anon remailer, there are some slightly more stringent requirements. The right kind of ecash protocol can still handle it. But Carol probably shouldn't be paying for a remailer in CarolBucks (or CarolIOUs, whatever), at least not unless Carol is such a big spender that CarolBucks are in wide circulation and used by lots of people other then Carol. Which I guess is possible in your system. A pseudo-anarchist non-state-supported debt system would work fine, but you still need a mechanism to transfer your certificates of value, whether they stand for ten U.S. dollars, or 10 hours that Jon Smith will work mowing your lawn. And another way to look at it is that you are just proposing an ecash system where every person issues their own ecash, instead of just a few central banks doing it. There are advantages and disadvantages to that sort of thing, and it might be something interesting to think about, but you ultimately aren't going to be able to do it over a computer network without ecash. Ecash is the way you represent value certificates in digital form, pretty much.

4 3

Re: Why emoney? Why not a web of debt?
by Anonymous 17 Dec '03

17 Dec '03

> Date: Fri, 20 Jan 1995 19:36:34 -0500 > From: jrochkin(a)cs.oberlin.edu (Jonathan Rochkind) > > Certainly, that's what money is after all. Pretty much. But how are you > going to transfer these IOUs electronically in a way that is relatively > fraud-proof? [...] By only trading with trusted partners. Read on... > And of course, if you want to use these certificates of value anonymously, > which is what is required to pay for an anon remailer, there are some > slightly more stringent requirements. The right kind of ecash protocol can > still handle it. But Carol probably shouldn't be paying for a remailer in > CarolBucks (or CarolIOUs, whatever), at least not unless Carol is such a > big spender that CarolBucks are in wide circulation and used by lots of > people other then Carol. Which I guess is possible in your system. If the remailer operator trusts Carol, then Carol and the Op can exchange Op-IOU's for money, or Carol-IOU's for Op-IOU's. (This is the base case of the induction for you math geeks.) Carol can use the Op-IOU's directly with the Op or 'sell' them to people who want to do business with the Op. If the remailer operator doesn't trust Carol, but there is a chain of trust from Carol to the remailer operator, then Carol can get IOUs from someone which the remailer operator does trust. Call them Jo-IOUs. To do this Carol asks Pat who asks ... who asks Jo for an IOU worth $32. Carol gives Pat a Carol-IOU worth $32(+transaction fee is Pat is a greedy sole) in exchange for which Pat gives Carol the Jo-IOU worth $32 (which Carol got from Pat (which Pat got from some place only Pat knows for sure)). IOU swaps will probably be done under the cover of encryption. Swaps can also be done with a nice ecash system like Chaum and Brandt(sp?) have proposed. But I am not sure it is required. Anonymity can come also from the chain of IOU swaps, in the same way remailers produce anonymity -- each person neglects to tell any others for whom they carry out IOU swaps. Sure Pat knows Carol wants a Jo IOU, but Pat doesn't know why. Jo could figure out that Jo's IOU went out to W.Smith, and came back from V.Jones but can't make any conclusion about weather W. and V. are trading partners or not. It would take a conspiracy of each person along the swap path to expose the real trade. Alternatively the buyer or seller can out the transaction. (But suppose they only know each other via some anonymous email pool...) And privacy (from other than your trading partners) comes from using encryption during each IOU swap. But if you don't trust your trading partners enough to keep quiet about who you are, by all means use an untraceable ecash system. (There are other advantages to using blind signatures anyway.) > A pseudo-anarchist non-state-supported debt system would work fine, but you > still need a mechanism to transfer your certificates of value, whether they Well... TackyTokens, and a little bit (ha!) of client code (start with Sameer's?) ought to do the trick. (So perhaps the original message's subject ought to have been "Why Ebanks? Why not a web of debt-trust?" since it is the central bank I am avoiding here. Not tacky tokens.) But it isn't really necesary. Read on... > [...] There are advantages and disadvantages to that > sort of thing, and it might be something interesting to think about, but One problem with getting an ecash system off the ground is making the tokens worth moeny. The advantage of a distributed web-of- debt/trust model is that I only need to trade IOUs for US$ with a few trusted friends. I don't need to go to any kind of central bank. No central bank means no central point to be attacked with guns, hacks, or taxes. No central bank means no credit card numbers, money orders, or green backs mailed away to strangers. Another cool thing, and the reason you don't need Chaumian digital cash, is that the only people you can steal from (or who can steal from you) are your trusted friends! If I pass a bogus token in exchange for a real IOU, then I just ripped off my friend. The only place two non-friends interface is at the final buyer-seller interface. If the seller refuses to honor the token, the buyer can ask the friend who gave it to them for a refund, who can ask for a refund from ... until the token gets back to the thief. The thief can either steal from their friend by refusing the refund, or infact honor the bogus token, and eat the loss (if any). One bad thing is anyone can deny service to people by passing bogus tokens, and then refunding them. Lukily the friends of the blocker will notice that when getting tokens through that person, the number of refunds is higher than average. In that case, the blocker can be removed from lists of their friends, and cut out of the economy. Denial of service can be prevented another way too -- but it does require Chaumian blind signatures. Instead of trading a Carol-IOU for any old Jo-IOU, Carol might demand a Jo-IOU which is a signature on a particular (blinded) secret number. Just as if Carol were doing a TackyToken protocol exchange directly with Jo. If Carol gets a thing from Pat which isn't signed by Jo, Carol complains to Pat. If Carol gets a thing which un-blinded isn't a signature by Jo of Carol's secret number, Carol again complains to Pat. Symbolically: instead of a <-> b, then b <-> c, then ... y <-> z; do a -> via b -> via c ... via y -> z signs -> via y ... via b -> to a. The disadvantage is that Pr0duct Cypher's Tacky Token code would need to be hacked a bit more. And then there is the nasty old issue of algorithm patents. Noyb

1 0

Re: Netherlands crypto ban?
by Alex de Joode 17 Dec '03

17 Dec '03

In article <gate.HRP0yc1w165w(a)dxm.ernet.in> you stated: : What's the update on the move to ban private crypto in Holland? : Last I remember there were trial balloons, but nothing happened. The proposed ban came from the former fundamentalist christian led department of justice. Since the elections the political landscape has been changed, the christian democratic party has been removed, we now have Liberals (something like Republicans in the US :) ), Socialists and Social Democrats in power. Law Enforcement has come under public scrutiny, since special police teams used unlawful tactics to get criminal organizations out of their business. They broke into Warehouses to see if narcotics were depostid there (without a warrant), they made up reports and lied in court. The new head of the justice department, already has dropped some policies that were in place, and she just announced that due to the rise in competence of the LEA the rights a suspect has also have to be raised in order to compensate it. She swiftly killed of any opposition the LEA had against that proposal. In my opinion, The Netherlands will not adopt a crypto policy on their own, the'll do it if the EC proposes such a "thing". -- Alex de Joode usura(a)replay.com Hate mail appreciated, http://www.xs4all.nl/~usura weekly contest for best death threat.

1 0