December 2003 - cypherpunks-legacy

IP security drafts
by perry＠imsi.com 17 Dec '03

17 Dec '03

The latest version of the proposal Bill Simpson and I have made for the IPv4 security protocols (which are more or less the same as the IPng proposals) are now available from the internet drafts directories near you. Perry

1 0

Which remailer does Julf operate?
by Nathan Zook 17 Dec '03

17 Dec '03

sez it all Nathan

2 1

Re: The Remailer Crisis
by Johnathan Corgan 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >Well, let's do the math. Since the remailer has to be connected at all >times, of course, this implies $162 a month in connect charges, over >and above the other charges. Or $187 a month including the line >charge. Or $2244 a year. > >This makes a "cheap Linux box" almost a moot point. This is a lot more >than I'm willing to pay to run a remailer. > >(I can imagine workarounds that involve connecting at regular >intervals to pick up mail....assuming it "accumulates" somewhere (?), >but the goal of a remailer "on the Net" is what I'm after.) Well, yes, this is true. My point was that reliable, fast, easy to use bandwidth on the order of 128 Kbps is available now in some areas for relatively cheap rates. _With the condition_ that continuous access is not necessary to run a remailer (as I had outlined), this could prove to be a good jumping off ground for some remailer operators. Sheesh, I could start my own on my home ethernet if I were so inclined. The solution to the access fee problem is, of course, sharing that fee with other payees. Your example of putting boxes directly on TLG's network is a good example of this. >I agree that it's something to look at. We don't disagree here; we are solving two different problems it appears. == Johnathan Corgan "Violence is the last refuge of the incompetent." jcorgan(a)scruznet.com -Isaac Asimov -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLx8uG01Diok8GKihAQHClwP/fVWl/GWM9lWArj4qP4orDV9ZGJWqaCEj LJYVSekzetdxIn2iBfTcCLCSwYKqTsJgCKha8tqxM9H5Zq2hVUYat9TlGKBZwpfr b/Vy+N3K1o/+E3NnWxcsJPLaeJfkom1sIJZiZkXKrqUM2v7v2l8MERub7uYG/EIl 5LhaDwdg9ig= =Acce -----END PGP SIGNATURE-----

1 0

stjude?
by Judith Milhon 17 Dec '03

17 Dec '03

i'd be happy to get forwarded the skirmishes around my existence. Anybody save them? i'm not on the list because i'm writing 2 books, but i have root in the solar system, true, and i did come up with the name cypherpunk one morning as i was washing my cat... hit me like a meteorite... cypherpunk... yes... mumble >jude<

2 1

Supreme Court & Anonymity
by Andre Bacard 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Attached is a Supreme Court decision that may bear directly upon anonymous remailers and upon people who want to curtail anonymous remailers. This info came from Dave Banisar at EPIC <banisar(a)epic.org> via Stanton McCandlish at EFF <mech(a)eff.org>. Thanks to Attorney Banisar for supplying this information. See you in the future, Andre - ------------------------------------------------------------ Andre Bacard Bacard wrote "The Computer Privacy Box 3009 Handbook: A Practical Guide to E-Mail Stanford, CA 94309 Encryption, Data Protection, and PGP abacard(a)well.com Privacy Software" [for novices/experts]. Introduction by Mitchell Kapor, Chairman, Electronic Frontier Foundation and Founder of Lotus 1-2-3. Book Available February 1995. Write for Details - ------------------------------------------------------------ TALLEY v. CALIFORNIA SUPREME COURT OF THE UNITED STATES 362 U.S. 60 January 13-14, 1960, Argued March 7, 1960, Decided Certiorari to the Appellate Department of the Superior Court of California, Los Angeles County. 172 Cal. App. 2d Supp. 797, 332 P. 2d 447, reversed. A. L. Wirin and Hugh R. Manes argued the cause for petitioner. With them on the brief was Fred Okrand. Philip E. Grey argued the cause forrespondent. With him on the brief was Roger Arnebergh. Shad Polier, Will Maslow, Leo Pfeffer and Joseph B. Robison filed a brief for the American Jewish Congress, as amicus curiae, urging reversal. Warren, Black, Frankfurter, Douglas, Clark, Harlan, Brennan, Whittaker, Stewart MR. JUSTICE BLACK delivered the opinion of the Court. The question presented here is whether the provisions of a Los Angeles City ordinance restricting the distribution of handbills "abridge the freedom of speech and of the press secured against state invasion by the Fourteenth Amendment of the Constitution." n1 The ordinance, @ 28.06 of the Municipal Code of the City of Los Angeles, provides: "No person shall distribute any hand-bill in any place under any circumstances, which does not have printed on the cover, or the face thereof, the name and address of the following: "(a) The person who printed, wrote, compiled or manufactured the same. "(b) The person who caused the same to be distributed; provided, however, that in the case of a fictitious person or club, in addition to such fictitious name, the true names and addresses of the owners, managers or agents of the person sponsoring said hand-bill shall also appear thereon." The petitioner was arrested and tried in a Los Angeles Municipal Court for violating this ordinance. It was stipulated that the petitioner had distributed handbills in Los Angeles, and two of them were presented in evidence. Each had printed on it the following: National Consumers Mobilization, Box 6533, Los Angeles 55, Calif. PLeasant 9-1576. The handbills urged readers to help the organization carry on a boycott against certain merchants and businessmen, whose names were given, on the ground that, as one set of handbills said, they carried products of "manufacturers who will not offer equal employment opportunities to Negroes, Mexicans, and Orientals." There also appeared a blank, which, if signed, would request enrollment of the signer as a "member of National Consumers Mobilization," and which was preceded by a statement that "I believe that every man should have an equal opportunity for employment no matter what his race, religion, or place of birth." The Municipal Court held that the information printed on the handbills did not meet the requirements of the ordinance, found the petitioner guilty as charged, and fined him $ 10. The Appellate Department of the Superior Court of the County of Los Angeles affirmed the conviction, rejecting petitioner's contention, timely made in both state courts, that the ordinance invaded his freedom of speech and press in violation of the Fourteenth and First Amendments to the Federal Constitution. n2 172 Cal. App. 2d Supp. 797, 332 P. 2d 447. Since this was the highest state court available to petitioner, we granted certiorari to consider this constitutional contention. 360 U.S. 928. In Lovell v. Griffin, 303 U.S. 444, we held void on its face an ordinance hat comprehensively forbade any distribution of literature at any time or place in Griffin, Georgia, without a license. Pamphlets and leaflets, it was pointed out, "have been historic weapons in the defense of liberty" n3 and enforcement of the Griffin ordinance "would restore the system of license and censorship in its baldest form." Id., at 452. A year later we had before us four ordinances each forbidding distribution of leaflets - -- one in Irvington, New Jersey, one in Los Angeles, California, one in Milwaukee, Wisconsin, and one in Worcester, Massachusetts. Schneider v. State, 308 U.S. 147. Efforts were made to distinguish these four ordinances from the one held void in the Griffin case. The chief grounds urged for distinction were that the four ordinances had been passed to prevent either frauds, disorder, or littering, according to the records in these cases, and another ground urged was that two of the ordinances applied only to certain city areas. This Court refused to uphold the four ordinances on those grounds pointing out that there were other ways to accomplish these legitimate aims without abridging freedom of speech and press. Frauds, street littering and disorderly conduct could be denounced and punished as offenses, the Court said. Several years later we followed the Griffin and Schneider cases in striking down a Dallas, Texas, ordinance which was applied to prohibit the dissemination of information by the distribution of handbills. We said that although a city could punish any person for conduct on the streets if he violates a valid law, "one who is rightfully on a street . . . carries with him there as elsewhere the constitutional right to express his views in an orderly fashion . . . by handbills and literature as well as by the spoken word." Jamison v. Texas, 318 U.S. 413, 416. The broad ordinance now before us, barring distribution of "any hand-bill in any place under any circumstances," n4 falls precisely under the ban of our prior cases unless this ordinance is saved by the qualification that handbills can be distributed if they have printed on them the names and addresses of the persons who prepared, distributed or sponsored them. For, as in Griffin, the ordinance here is not limited to handbills whose content is "obscene or offensive to public morals or that advocates unlawful conduct." Counsel has urged that this ordinance is aimed at providing a way to identify those responsible for fraud, false advertising and libel. Yet the ordinance is in no manner so limited, nor have we been referred to any legislative history indicating such a purpose. Therefore we do not pass on the validity of an ordinance limited to prevent these or any other supposed evils. This ordinance simply bars all handbills under all circumstances anywhere that do not have the names and addresses printed on them in the place the ordinance requires. There can be no doubt that such an identification requirement would tend to restrict freedom to distribute information and thereby freedom of expression. "Liberty of circulating is as essential to that freedom as liberty of publishing; indeed, without the circulation, the publication would be of little value." Lovell v. Griffin, 303 U.S., at 452. Anonymous pamphlets, leaflets, brochures and even books have played an important role in the progress of mankind. Persecuted groups and sects from time to time throughout history have been able to criticize oppressive practices and laws either anonymously or not at all. The obnoxious press licensing law of England, which was also enforced on the Colonies was due in part to the knowledge that exposure of the names of printers, writers and distributors would lessen the circulation of literature critical of the government. The old seditious libel cases in England show the lengths to which government had to go to find out who was responsible for books that were obnoxious to the rulers. John Lilburne was whipped, pilloried and fined for refusing to answer questions designed to get evidence to convict him or someone else for the secret distribution of books in England. Two Puritan Ministers, John Penry and John Udal, were sentenced to death on charges that they were responsible for writing, printing or publishing books. n6 Before the Revolutionary War colonial patriots frequently had to conceal their authorship or distribution of literature that easily could have brought down on them prosecutions by English-controlled courts. Along about that time the Letters of Junius were written and the identity of their author isunknown to this day. n7 Even the Federalist Papers, written in favor of the adoption of our Constitution, were published under fictitious names. It is plain that anonymity has sometimes been assumed for the most constructive purposes. We have recently had occasion to hold in two cases that there are times and circumstances when States may not compel members of groups engaged in the dissemination of ideas to be publicly identified. Bates v. Little Rock, 361 U.S. 516; N. A. A. C. P. v. Alabama, 357 U.S. 449, 462. The reason for those holdings was that identification and fear of reprisal might deter perfectly peaceful discussions of public matters of importance. This broad Los Angeles ordinance is subject to the same infirmity. We hold that it, like the Griffin, Georgia, ordinance, is void on its face. The judgment of the Appellate Department of the Superior Court of the State of California is reversed and the cause is remanded to it for further proceedings not inconsistent with this opinion. It is so ordered. Footnotes n1 Schneider v. State, 308 U.S. 147, 154. Cf. Lovell v. Griffin, 303 U.S. 444, 450. n2 Petitioner also argues here that the ordinance both on its face and as construed and applied "arbitrarily denies petitioner equal protection of the laws in violation of the Due Process and Equal Protection" Clauses of the Fourteenth Amendment. This argument is based on the fact that the ordinance applies to handbills only, and does not include within its proscription books, magazines and newspapers. Our disposition of the case makes it unnecessary to consider this contention. n3 The Court's entire sentence was: "These [pamphlets and leaflets] indeed have been historic weapons in the defense of liberty, as the pamphlets of Thomas Paine and others in our own history abundantly attest." It has been noted that some of Thomas Paine's pamphlets were signed with pseudonyms. See Bleyer, Main Currents in the History of American Journalism (1927), 90-93. Illustrations of other anonymous and pseudonymous pamphlets and other writings used to discuss important public questions can be found in this same volume. n4 Section 28.00 of the Los Angeles Municipal Code defines "handbill" as follows: "'HAND-BILL' shall mean any hand-bill, dodger, commercial advertising circular, folder, booklet, letter, card, pamphlet, sheet, poster, sticker, banner, notice or other written, printed or painted matter calculated to attract attention of the public." n5 Lovell v. Griffin, 303 U.S., at 451. n6 Penry was executed and Udal died as a result of his confinement. 1 Hallam, The Constitutional History of England (1855), 205-206, 232. n7 In one of the letters written May 28, 1770, the author asked the following question about the tea tax imposed on this country, a question which he could hardly have asked but for his anonymity: "What is it then, but an odious, unprofitable exertion of a speculative right, and fixing a badge of slavery upon the Americans, without service to their masters?" 2 Letters of Junius (1821) 39. MR. JUSTICE HARLAN, concurring. In judging the validity of municipal action affecting rights of speech or association protected against invasion by the Fourteenth Amendment, I do not believe that we can escape, as Mr. Justice Roberts said in Schneider v. State, 308 U.S. 147, 161, "the delicate and difficult task" of weighing "the circumstances" and appraising "the substantiality of the reasons advanced in support of the regulation of the free enjoyment of" speech. More recently we have said that state action impinging on free speech and association will not be sustained unless the governmental interest asserted to support such impingement is compelling. See N. A. A. C. P. v. Alabama, 357 U.S. 449, 463, 464; Sweezy v. New Hampshire, 354 U.S. 234, 265 (concurring opinion); see also Bates v. Little Rock, 361 U.S. 516. Here the State says that this ordinance is aimed at the prevention of "fraud, deceit, false advertising, negligent use of words, obscenity, and libel," in that it will aid in the detection of those responsible for spreading material of that character. But the ordinance is not so limited, and I think it will not do for the State simply to say that the circulation of all anonymous handbills must be suppressed in order to identify the distributors of those that may be of an obnoxious character. In the absence of a more substantial showing as to Los Angeles' actual experience with the distribution of obnoxious handbills, * such a generality is for me too remote to furnish a constitutionally acceptable justification for the deterrent effect on free speech which this all-embracing ordinance is likely to have. On these grounds I concur in the judgment of the Court. Footnotes: * On the oral argument the City Attorney stated: "We were able to find out that prior to 1931 an effort was made by the local Chamber of Commerce, urging the City Council to do something about these handbills and advertising matters which were false and misleading -- had no names of sponsors. They were particularly interested in the fictitious name. They said, 'Who are these people that are distributing; who are advertising; doing things of that sort?' The meager record that we were able to find indicates that a request from the Council to the City Attorney as to their legal opinion on this subject [sic]. The City Attorney wrote back and formed the conclusion that distribution of handbills, pamphlets, or other matters, without the name of the fictitious firm or officers would be legal [sic]. Thereafter in the early part of 1932 an ordinance was drafted, and submitted to the City Council, and approved by them, which related to the original subject -- unlawful for any person, firm or association to distribute in the city of Los Angeles any advertisement or handbill - -- or any other matter which does not have the names of the sponsors of such literature." MR. JUSTICE CLARK, whom MR. JUSTICE FRANKFURTER and MR. JUSTICE WHITTAKER join, dissenting. To me, Los Angeles' ordinance cannot be read as being void on its face. Certainly a fair reading of it does not permit a conclusion that it prohibits the distribution of handbills "of any kind at any time, at any place, and in any manner," Lovell v. Griffin, 303 U.S. 444, 451 (1938), as the Court seems to conclude. In Griffin, the ordinance completely prohibited the unlicensed distribution of any handbills. As I read it, the ordinance here merely prohibits the distribution of a handbill which does not carry the identification of the name of the person who "printed, wrote, compiled . . . manufactured [or] . . . caused" the distribution of it. There could well be a compelling reason for such a requirement. The Court implies as much when it observes that Los Angeles has not "referred to any legislative history indicating" that the ordinance was adopted for the purpose of preventing "fraud, false advertising and libel." But even as to its legislative background there is pertinent material which the Court overlooks. At oral argument, the City's chief law enforcement officer stated that the ordinance was originally suggested in 1931 by the Los Angeles Chamber of Commerce in a complaint to the City Council urging it to "do something about these handbills and advertising matters which were false and misleading." Upon inquiry by the Council, he said, the matter was referred to his office, and the Council was advised that such an ordinance as the present one would be valid. He further stated that this ordinance, relating to the original inquiry of the Chamber of Commerce, was thereafter drafted and submitted to the Council. It was adopted in 1932. In the face of this and the presumption of validity that the ordinance enjoys, the Court nevertheless strikes it down, stating that it "falls precisely under the ban of our prior cases." This cannot follow, for in each of the three cases cited, the ordinances either "forbade any distribution of literature . . . without a license," Lovell v. Griffin, supra, or forbade, without exception, any distribution of handbills on the streets, Jamison v. Texas, 318 U.S. 413 (1943); or, as in Schneider v. State, 308 U.S. 147 (1939), which covered different ordinances in four cities, they were either outright bans or prior restraints upon the distribution of handbills. I, therefore, cannot see how the Court can conclude that the Los Angeles ordinance here "falls precisely" under any of these cases. On the contrary, to my mind, they neither control this case nor are apposite to it. In fact, in Schneider, depended upon by the Court, it was held, through Mr. Justice Roberts, that, "In every case . . . where legislative abridgment of the rights is asserted, the courts should be astute to examine the effect of the challenged legislation . . . weigh the circumstances and . . . appraise the substantiality of the reasons advanced . . . ." Id., at 161. The Court here, however, makes no appraisal of the circumstances, or the substantiality of the claims of the litigants, but strikes down the ordinance as being "void on its face." I cannot be a party to using such a device as an escape from the requirements of our cases, the latest of which was handed down only last month. Bates v. Little Rock, 361 U.S. 516. n1 Therefore, before passing upon the validity of the ordinance, I would weigh the interests of the public in its enforcement against the claimed right of Talley. The record is barren of any claim, much less proof, that he will suffer any injury whatever by identifying the handbill with his name. Unlike N. A. A. C. P. v. Alabama, 357 U.S. 449 (1958), which is relied upon, there is neither allegation nor proof that Talley or any group sponsoring him would suffer "economic reprisal, loss of employment, threat of physical coercion [or] other manifestations of public hostility." Id., at 462. Talley makes no showing whatever to support his contention that a restraint upon his freedom of speech will result from the enforcement of the ordinance. The existence of such a restraint is necessary before we can strike the ordinance down. But even if the State had this burden, which it does not, the substantiality of Los Angeles' interest in the enforcement of the ordinance sustains its validity. Its chief law enforcement officer says that the enforcement of the ordinance prevents "fraud, deceit, false advertising, negligent use of words, obscenity, and libel," and, as we have said, that such was its purpose. In the absence of any showing to the contrary by Talley, this appears to me entirely sufficient. I stand second to none in supporting Talley's right of free speech -- but not his freedom of anonymity. The Constitution says nothing about freedom of anonymous speech. In fact, this Court has approved laws requiring no less than Los Angeles' ordinance. I submit that they control this case and require its approval under the attack made here. First, Lewis Publishing Co. v. Morgan, 229 U.S. 288 (1913), upheld an Act of Congress requiring any newspaper using the second-class mails to publish the names of its editor, publisher, owner, and stockholders. 39 U. S. C. @ 233. Second, in the Federal Regulation of Lobbying Act, 2 U. S. C. @ 267, Congress requires those engaged in lobbying to divulge their identities and give "a modicum of information" to Congress. United States v. Harriss, 347 U.S. 612, 625 (1954). Third, the several States have corrupt practices acts outlawing, inter alia, the distribution of anonymous publications with reference to political candidates. n2 While these statutes are leveled at political campaign and election practices, the underlying ground sustaining their validity applies with equal force here. No civil right has a greater claim to constitutional protection or calls for more rigorous safeguarding than voting rights. In this area the danger of coercion and reprisals -- economic and otherwise -- is a matter of common knowledge. Yet these statutes, disallowing anonymity in promoting one's views in election campaigns, have expressed the overwhelming public policy of the Nation. Nevertheless the Court is silent about this impressive authority relevant to the disposition of this case. All three of the types of statutes mentioned are designed to prevent the same abuses -- libel, slander, false accusations, etc. The fact that some of these statutes are aimed at elections, lobbying, and the mails makes their restraint no more palatable, nor the abuses they prevent less deleterious to the public interest, than the present ordinance. All that Los Angeles requires is that one who exercises his right of free speech through writing or distributing handbills identify himself just as does one who speaks from the platform. The ordinance makes for the responsibility in writing that is present in public utterance. When and if the application of such an ordinance in a given case encroaches on First Amendment freedoms, then will be soon enough to strike that application down. But no such restraint has been shown here. After all, the public has some rights against which the enforcement of freedom of speech would be "harsh and arbitrary in itself." Kovacs v. Cooper, 336 U.S. 77, 88 (1949). We have upheld complete proscription of uninvited door-to-door canvassing as an invasion of privacy. Breard v. Alexandria, 341 U.S. 622 (1951). Is this less restrictive than complete freedom of distribution -- regardless of content -- of a signed handbill? And commercial handbills may be declared verboten, Valentine v. Chrestensen, 316 U.S. 52 (1942), regardless of content or identification. Is Talley's anonymous handbill, designed to destroy the business of a commercial establishment, passed out at its very front door, and attacking its then lawful commercial practices, more comportable with First Amendment freedoms? I think not. Before we may expect international responsibility among nations, might not it be well to require individual responsibility at home? Los Angeles' ordinance does no more. Contrary to petitioner's contention, the ordinance as applied does not arbitrarily deprive him of equal protection of the law. He complains that handbills are singled out, while other printed media -- books, magazines, and newspapers -- remain unrestrained. However, "the problem of legislative classification is a perennial one, admitting of no doctrinaire definition. Evils in the same field may be of different dimensions and proportions, requiring different remedies. . . . Or the reform may take one step at a time, addressing itself to the phase of the problem which seems most acute to the legislative mind. . . . The prohibition of the Equal Protection Clause goes no further than the invidious discrimination. [I] cannot say that that point has been reached here." Williamson v. Lee Optical Co., 348 U.S. 483, 489 (1955). I dissent. Footnotes n1 "When it is shown that state action threatens significantly to impinge upon constitutionally protected freedom it becomes the duty of this Court to determine whether the action bears a reasonable relationship to the achievement of the governmental purpose asserted as its justification." 361 U.S., at 525. n2 Thirty-six States have statutes prohibiting the anonymous distribution of materials relating to elections. E. g.: Kan. Gen. Stat., 1949, @ 25-1714; Minn. Stat. Ann. @ 211.08; Page's Ohio Rev. Code Ann. @ 3599.09; Purdon's Pa. Stat. Ann., Title 25, @ 3546. ******************************************** David Banisar (Banisar(a)epic.org) * 202-544-9240 (tel) Electronic Privacy Information Center * 202-547-5482 (fax) 666 Pennsylvania Ave, SE, Suite 301 * ftp/gopher/wais cpsr.org Washington, DC 20003 * HTTP://epic.digicash.com/epic ********************************************** -----BEGIN PGP SIGNATURE----- Version: 2.7 iQCVAwUBLx7L1d6pT6nCx/9/AQHhQwP+PcbJgT5Eyx+9TNIoOSMQJXnnlT0iiHM1 qhKC4Xg2ZZl4/u1Pe927S3UfDXoEunoSAOaq1hgi8c4Wjd31XPM5wFHRdE18/UWZ RXLmLQ+qT6MIFQIicOs6bpDeLCusqT3SF1krViIpIwqscwcdRgu8t1IUbfMVC/6w oFsKqF3fj7o= =XCRK -----END PGP SIGNATURE-----

1 0

T.A.Z. on Disk
by blancw＠pylon.com 17 Dec '03

17 Dec '03

I just sent this email to Sandy Sandfort, and he suggested I share it with the list: ------------------- I was just at BlockBuster Music store this evening and happened to go by the 'H's in the Rock Music section - and saw Hakim Bey's name. Yes, there is a CD names T.A.Z *. Blockbuster allows customers to listen to CDs before they buy, so I listened to it. Hakim actually reads several chapters from his book, and there is odd music at the introduction and in the background while he reads. He has a very nice, deep, clear voice. I guess you could say this is one of those self-help books-on-tape - sort of a "save time & become an anarchist while you drive" CD. *T.A.Z. = The Autonomous Zone .. Blanc

3 2

Ask Bill
by blancw＠pylon.com 17 Dec '03

17 Dec '03

Bill Gates now has an address for questions - askbill(a)microsoft.com He has a column which is published every other Wednesday In the local Seattle Post-Intelligencer, where he answers a few of the questions which he finds in that mailbox address. He says he will not reply to questions personally (only in the column), but you never know - a few of you special people could burn his ear and perhaps elicit one to yourself (or perhaps even to the list!) .. Blanc

1 0

cpla mailing list revived
by jpp＠markv.com 17 Dec '03

17 Dec '03

The quietness of the cpla list was brought to my attention recently. I have improved the list software, changed the list address into a real internet style mailing list. You should now be able to be join and depart the cpla mailing list automatically. Who knows, this might even prompt a physical get-together. I will be adding the members of the old list to the new list, so expect to get another copy of the welcome message if you were on the cpla list a while ago. Here is a copy of the welcome message, FYI. Welcome to the Cypherpunks LA <cpla(a)markv.com> mailing list. Like every moderator of every new list, I hope this will be mostly signal and very little noise. I don't envision this as a general discussion list -- that's what the main list is for. This list is for: Coordinating physical meetings of Cypherpunks in the Los Angeles area: Location, time, equipment, arranging rides, etc. Suggesting topics to cover at the meetings. Coordinating other local group activities. Announcements of relevant talks, seminars and other such goodies in the Los Angeles area and environs. *Concise* pointers to other local groups, mailing lists, and sources of information that might be of interest to local Cypherpunks. Whatever everyone seems to use it for. This list is NOT for: Reposting the "important" messages from the main list or any other mailing list or newsgroup. (If someone wants to run a "distilled" Cypherpunks list, fine. This isn't it!) Preaching to the converted. No ranting! (If you want to rant, do it on the main list. Everyone else seems to...) Rehashing the same topics that are going on the main list. This list is now managed by a simple minded program. Send a message with a blank body and the subject 'subscribe' to be added to the list. The subject 'unsubscribe' will remove you from the list. Any suggestions for how to improve this intro are welcome. Any suggestions for a *local* FAQ are also welcome. Direct your sugestions to me at jpp(a)markv.com. PGP/ViaCrypt mail gladly accepted. This information is also available at ftp://ftp.markv.com/pub/jpp/cp-la-hi.txt j' <jpp(a)markv.com>

1 0

traffic analyzing Chaum's digital mix
by Wei Dai 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have been thinking about the problem of traffic analysis of a remailer. More specifically, the problem is how can Eve trace Bob, who is communicating with Alice through an ideal Chaumian digital mix? (As most of you know, current remailers are missing many of the features of the digital mix Chaum specified in his CACM paper (at ftp://ftp.csua.berkeley.edu/pub/cypherpunks/papers/chaum.digital-mix.gz ), thus making them extremely vulnerable to anyone with non-trivial resources.) The simplifying assumptions I use here are: 1. there is one mix, which is perfectly secure and trustworthy (note that multiple mixes do not increase untracebility over a single mix if it is perfectly secure and trustworthy) 2. anyone can monitor all traffic in and out of the mix, but no one can link an incoming message with an outgoing one The basic approach is to use this raw traffic information to calculate a SCORE for each user of the remailer with respect to Alice, where the user with the highest SCORE is the person Alice is most probably communicating with. The idea is that with a Chaumian mix, every time Alice sends a message to Bob there is always a pattern of Alice sending a message to the mix, followed by Bob receiving a message from the mix during the next batch. By counting the number of such correlations for each user over a period of time, and taking into account the fact that users who receive more messages from the mix will have higher numbers of coincidental correlations, a SCORE can be calculated so that it would be a good indication over the long run of the probability that a particular user is communicating with Alice. For a digital mix that does batching based on a fixed number of incoming messages, the SCORE for a user U can be calculated in the following way: 1. for each mix batch i, calculate P(i)=lesser(# of messages sent by Alice, # of messages subsequently received by user U) 2. after a period of time t, calculate Q=sum(P(i)) 3. calculate the average value of Q of users with similar usage patterns as user U 4. SCORE(U) = Q / average(Q) Now whether or not this approach actually works depends on whether the number of users with SCORE higher than Bob's SCORE converges to 0 as time t increases, and how quickly it converges. Answering these two questions will require modeling the usage patterns of Alice, Bob, and the mix as a whole. I'll try to do this for some simple cases in a later post. Wei Dai -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLx9V8Tl0sXKgdnV5AQFg2gQAhEJ1wgf/XaqMOlVcvYfwgOeR2cKPPyQM fitAJdXKkEXvTtUa3biByvVK86SLQmW/0cLME76UsmaMUY+FVncBoKwlRGKJnDci 6b7VtEW2ZkZKntUieTXFaVbSgI5XL/lIqQu2FFS6wuxH1KayxFeDLiTD6HWfa8t6 sedGrTb5f2I= =Vjum -----END PGP SIGNATURE-----

1 0

Re: Threats in real life - what are we worried about?
by Matt Blaze 17 Dec '03

17 Dec '03

I wrote: > > Given existing crypto tools (PGP, etc), what are the top ten > practical attacks against the privacy of stored data and > electronic mail? Who are the bad guys? What tools do we need > to limit these threats? > >I'll post my own thoughts later. > Matt's Top Ten Underappreciated Threats to Privacy on the Internet ================================================================== 1. The sorry state of software. Everyone knows that nobody knows how to write software. Modern systems give hundreds of thousands of lines of code the chance to violate security policy. How can we be sure that the software we trust does the right thing? How can we reduce the opportunities for problems? 2. Ineffective protection against denial of service attacks. While not a direct threat to privacy, the ease with which almost anyone can mount effective denial of service attacks threatens the ability to deploy anonymous services. You'll note that no one worries very much about the millions of anonymous entry points to more robust networks like the telephone system or the postal service, where it's relatively hard (and expensive) for an individual to cause large-scale service disruption. How can we make the 'net robust enough to withstand mailbombs and newsgroup spamming? 3. Poor secret storage on networked computers. Cryptosystems allow you to manage large secrets by protecting smaller ones (keys). Unfortunately, modern computers are awful at protecting even the smallest secrets. Multi-user networked workstations can be broken into and their memories compromised. Standalone, single-user machines can be stolen or compromised through viruses that leak secrets asynchronously. What are the right mechanisms for storing and managing keys on various platforms? Remote servers, where there may be no user available to enter a passphrase (but see threat #5, below), are an especially hard problem. 4. Poorly understood random number generation techniques. Keys and session variables need good sources of unpredictable bits. Currently used techniques (like event inter-arrival times) are only marginally well understood and depend to a great deal on low-level characteristics of the platforms on which they are run. We need a wider range of techniques (especially ones that work without relying on user input), and to better understand their risks and failure modes. Some interesting ideas have been proposed that deserve further study. At CRYPTO '94 there was an interesting paper on using disk airflow variation to get random bits. Another interesting technique, first proposed by Don Mitchell, involves exploiting clock skew. Here's a C program that seems to produce one pretty random bit per second on most platforms. How good are the bits? Can we get more bandwidth out of it? #include <stdio.h> #include <signal.h> int count=0; void printbit() { signal(SIGALRM,printbit); alarm(1); printf("%1d",count&01); fflush(stdout); } main() { signal(SIGALRM,printbit); alarm(1); while (1) count++; } 5. Weak passphrases. Most crypto software addresses the key storage and key generation problems by relying on user-generated passphrase strings, which are presumed to contain enough entropy to produce good key material and are also easy enough to remember that they do not require secure storage. While dictionary attacks are a well known problem with short passwords, much less is known about lines of attack against user- selected passphrase-based keys. Shannon tells us that English text has just over 1 bit of entropy per character, which would seem to leave most passphrases well within reach of brute-force search. Less is known, however, about good techniques for enumerating passphrases in order to exploit low entropy. Until we have a better understanding of how to attack passphrases, we really have no idea how weak or strong they are. 6. Limited support for remote trusted agents. Almost all currently available cryptographic software assumes that the user is in direct control over the systems on which they run and has a secure path to it. For example, the interfaces to programs like PGP and CFS assume that their input is comes from the user over a secure path like the local console. This is not always the case, of course; consider the problem of reading your mail remotely when logged in over the Internet. We need better mechanisms for transferring the trusted operations to the local trusted machine while keeping the logical operations (like where the mail is) where they logically belong. 7. Poorly understood protocol and service interactions. Features frequently come back to bite us, and its hard to know even where to look. The Internet worm was propagated via an obscure and innocent-looking feature in sendmail; how many more features in how many more programs have unexpected consequences just waiting to be discovered? Is the conventional wisdom of hiding behind firewalls and turning off services really the only answer? 8. Lack of scalable security infrastructure. No comment... 9. Poorly understood "out of band" attack risks. Security people tend to focus on what's easy to model. Unfortunately, attackers focus on what's easy to exploit. We need a better understanding of just how easy some non-traditional attacks are. Most of the answers are probably too scary to think about. How long do our keys need to be in the face of electromagnetic radiation, physical monitoring, Trojan horses, social engineering, and so on and so on? 10. No broad-based demand for security. This is a well-known problem among almost everyone who has tied his or her fortune to selling security products and services. Until there is widespread demand for transparent security, the tools and infrastructure needed to support it will be expensive and inaccessible to many applications. This is partly a problem of understanding the threats and risks in real applications, and of building systems that include security as a basic feature rather than as a later "add on". There's a lot missing from this list, and a lot you can disagree with among the things that are on it. Flame away... -matt

1 0