December 2003 - cypherpunks-legacy

Commercial killers
by rah＠shipwright.com 17 Dec '03

17 Dec '03

God help me, all of this reminds me of a Carl Sagan book, of all things. One of his science fiction characters was said to have made his first fortune by building a commercial zapping chip for VCRs. Butthead Astronomer, indeed... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: a hole in PGP
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 8:49 PM 7/31/95, Dr. Fred said: >You might be, but even if you are not, that doesn't mean there are no >back doors. Well, we all knew it would happen, didn't we. I feel like I'm about to shoot Ol' Yeller, but... PLONK! See ya on the other side, Fred. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

The Two Threads of Dr. Cohen
by cman＠communities.com 17 Dec '03

17 Dec '03

There are two threads to Dr. Cohen's arguments which bear separation. One thread, with the implications of deliberate wrongdoing on the part of Derek Atkins or others unnamed should be dismissed out of hand. His comments regarding the fundamental security properties of PGP and the burden of proof for software security are right on target. One has to draw the line somewhere with regard to what "they" are out to do. PGP may have had weaknesses from the beginning, but to suggest a deliberate change so subtle to escape PGP's original authors is to descend into the realm of paranoia. In addition, such allegations are extremely rude, and I think Dr. Cohen owes Derek an apology. At the same time, I think some apologies are in order with respect to some very good points raised by Dr. Cohen about software security. There is a whole sub-discipline of CS devoted to the construction of trusted computer systems, which if practiced can result in much greater assurances about the reliability and security of the resultant software. This is (I believe) the source of Dr. Cohen's assertion that the burden of proof is on those who claim something is secure. PGP is practically a poster child for how not to write a secure piece of software. It has had a great many authors. It is non- modular. It is large and complex. Simplicity is almost always sacrificed at the altar of even slight performance gains. It is absolutely infested with platform-dependent code. And these are only the problems that directly impact its security... it's also strongly tied to a tty-style interface and implements a poorly-designed format. With respect to "tiger teaming" PGP, I think it is a pretty hopeless proposition. It is never, ever going to be as secure as some people would like it to be. Given the past and current bug discovery rate, it is almost inconceivable that there are not exploitable bugs. This is not to say it isn't "pretty good", but it is not what someone with a formal background in real secure systems developement would ever bless as "secure". PGP needs to be thrown away and rewritten from scratch. This has, in fact, been done, but while this development effort has been incrementally better, it still doesn't qualify as a secure development approach. Also, nobody has this product yet for reasons that I won't mention as we don't need to start another tangential flamewar. In any event, I think it's important for people to realize that in the security community, the burden of proof _is_ on the software developer, not on those claiming security problems. I'm surprised Perry hasn't chimed in on this score yet, many of his posts allude to similar notions of security by design and by construction. Doug

1 0

Re: U.S. Banks are not all that bad
by Michael Froomkin 17 Dec '03

17 Dec '03

In message <v02120d01ac4219a2e38e(a)[199.2.22.120]> Douglas Barnes writes: > ... > > I must say that I've had some absolutely amazingly bad experiences > with banks in Asia, Mexico and Central America, so I'm a skeptic > when it comes to assuming that non-US banks are light years better. The U.K. banks make the U.S. look awfully good.... > Although I have no direct experience of European banking, I do know that > the European banking industry, taken as a whole, is substantially > behind the US banking industry in automation and efficiency. Most of Oh yes oh yes oh yes...and I've banked with Lloyds on and off for 12 years... > .... -- Michael Froomkin until Aug 6: michael(a)umlaw.demon.co.uk U.Miami School of Law London, England mfroomki(a)umiami.ir.miami.edu <-- this will still find me PO Box 248087 Coral Gables, FL 33124-8087 "Rain in parts, then dry" --BBC See http://www-swiss.ai.mit.edu/6095/articles/froomkin-metaphor/text.html

1 0

Re: Commercial killers
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

At 1:00 AM 8/1/95, Robert Hettinga wrote: >God help me, all of this reminds me of a Carl Sagan book, of all things. >One of his science fiction characters was said to have made his first >fortune by building a commercial zapping chip for VCRs. > >Butthead Astronomer, indeed... There have been _billions and billions_ of proposals for commercial zappers. (Actually, not such a saganesque number, but dozens at least.) Harry Bartholomew was telling me a year or so ago about some ideas for detecting volume changes. I think, however, the problem of distinguishing commercial from non-commercial signal is, I think, a tough one. My point earlier was not to actually do this, but to suggest that if the V-chip is to code various kinds of content, then the logic is strong for commercial content to be similarly coded. (For example, schools often show taped broadcasts...they might claim that it would be harmful and improper for children to be exposed to beer commercial during school hours...) This would gore the ox of the advertisers, so they might quietly have the whole V-chip thing killed. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

3 2

BOOK: "Artificial Intelligence: A Modern Approach"
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

On a lighter note, I've recently gotten a new book, "Artificial Intelligence: A Modern Approach," by Stuart Russell and Peter Norvig, 1995, Prentice-Hall, ISBN 0-13-103805-2. In 900 pages of well laid-out text, with excellent use of typography to make finding topics easy, it seems to be a great compendium of methods loosely called "AI." AI has gotten a bad rap, perhaps deservedly after the hype of the mid-80s, but the methods are useful for various purposes. This book is focussed on "agents," and lots of code fragments are available (in Common Lisp) for actual construction of agents. Topics that relate to Cypherpunks are scattered throughout the text, including stuff on planning, provably correct designs, game theory, simulations, neural nets, belief, and ontology. Lots more stuff, too. (If I were writing a formal book review, I'd say more. But this is just a pointer, so that interested folks can check it out at their local technical bookstore or university library.) Not a lot to do with getting PGP 3.0 out the door, and not a lot to do with building remailers, but stuff I find interesting. Let a thousand flowers bloom. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Re: Pat Robertson Fears E-cash?
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

At 12:31 AM 8/2/95, John Young wrote: > A Foxhole-atheist swears Pat Robertson said last night that >his > new book warns of a "digital cash society" and massive > theft by cyber-criminals. Did any believer hear this, or >know if > this is what he prognosticates for e-cash bedevilment? I didn't see this, but even if I did it's not likely the subtleties of digital cash societies would be explored. There is the "digital cash society" we fear as an Orwellian surveillance society, with all transactions recorded. This is perhaps the future Robertson fears. There is the "digital cash society" based on Chaumian schemes and untraceability, similar to a "hard cash" society without proofs of identity at every stage, and I suspect Robertson would find much to like about this. (There are also the implications which Robertson might recoil at, too. :-}) So, hearing that "Pat Robertson is warning against a digital cash society" is not too worrisome to me. I suspect he means the stuff about Big Brother tracking us and the Number of the Beast, and so on. Don't forget he came out strongly against Clipper, early on. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Attacks on PGP
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

Things are heating up between Fred Cohen and some of the rest of the list. I don't believe MIT is in collusion with the NSA or any other government agency to deliberately weaken or cripple PGP. I base this on having dealt with some of the MIT folks, with the various source code analyses folks have done, etc. However, I think it's a perfectly *fine* idea for some group to launch a cryptanalytic attack on PGP, or an attack based on any other approaches. This is the "tiger team," or "Team B" approach to finding flaws and weaknesses. I don't take the security of PGP only on faith, though analyzing it is not my bag, as they say. Rather, I use the Popper/Bartley notions of falsifiabilty and see truth as a process, not a state. Seeing lots of source code available, independent compilations on various machines, and believing neither Zimmermann nor Atkins nor Schiller, etc., would consent to inserting back doors into PGP, I am thus led to _believe_ that PGP is probably not so affected. Doesn't mean it isn't so, but I'm not overly worried about it. Still, more studies and technical attacks (technical, not verbal) would be welcome. One of the problems we in the "civilian cryptography" sector face is that we don't have much activity in cryptanalysis. (We've talked about this several times before, before Fred Cohen joined the list, for example.) The NSA and other intelligence agencies have not only code makers, they also have code _breakers_ (such as modern ciphers are breakable, which hasn't been the case much lately, if Bamford and Kahn are to be believed). Probably entire groups whose only job is to try to break the systems devised by others. (Modern ciphers are not as prone to breakage as earlier ciphers were, for technical reasons, so I suspect the number of cryptanalysts has shrunk since the good old days when they had more successes...there may only be a small contingent left...) The lack of cryptanalysis papers at "Crypto" has been striking...I was told that the program committee considers cryptanalysis to be less important than original research. (I can see the rationale in this, as Crypto is an academic/research conference, and there are really no "engineering" crypto conferences. And cryptanalysis might not even fit into an engineering conference very well, as cryptanalysis is traditionally a sort of "hobbyist" activity--if you've read Kahn you'll know what I mean.) Crypto comes in various flavors, from hardware implementations, to number theory, to Unix/IETF sorts of standards, to digital cash, and even to statistical analysis. It is dangerous to have a "monoculture" in which one topic is the trendy one and everyone is urged to work on that (whether the "that" is PGP or Java or anything else equally trendy). Most of the activity has been on adding hooks to PGP to make it usable in other programs, or on remailers. Not as much effort has gone into proofs of validity, systems analysis, etc. (Eric Hughes and I talked about this several years ago, before the Cypherpunks group was formed...the need for "Viper"-like systems with provably correct components, especially for digital money, etc.) If folks think PGP is flawed, or deserves an independent and critical look, then this is a good project for someone. (I think several such analyses have been made, however...this doesn't make it impossible for a flaw or backdoor to exist, but at least the code has been examined by various folks. I'm personally not too worried, though this has little suasive value.) (The Monoculture of Trendy Projects. My own programming mini-project, while proceeding slowly, is of a pattern extractor and "entropy estimator" for text. Stuff like measuring patterns, examining clusterings and author-specific patterns. I'm writing it as a bunch of "critic agents" who are responsible for different areas of analysis. In SmalltalkAgents. My point? There will be those who cite the "monoculture" and scoff at anything not written in C++ for Unix boxes, or not built to be Net-aware from the gitgo, or not written as applets in Java....oh well, in Digital Walden, one marches to a different drummer. Better to program the thing I _want_ to program rather than the things I _don't_ want to program, and hence _won't_. Final note: it'll be ready for use and maybe demonstration when it's ready. And ready when it's finished, finished when it's ready.) I've long appreciated Fred Cohen's work on viruses, so it's nice to have him on the Cypherpunks list. Maybe Fred can tell us if it's really true that he was stopped by U.S. Customs and held for many hours at the Canadian border when going to or returning from a conference where he described computer viruses.... --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

6 5

Cypherpunks Santa Cruz (CSC)
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

About a month ago I sent out a notice suggesting that we in the greater Santa Cruz area (Monterey, Carmel, Watsonville, Soquel, Boulder Creek, even parts of Santa Clara Valley, etc.) have a get-together occasionally, as the Bay Area meetings are quite far away (and possibly getting further away if they continue meeting in San Francisco). Response was better than I'd expected, with 17 people sending me notes asking to be kept informed of the thing. I just sent out a notice to them, partly to make sure my mail addresses are accurate and well-formed, and partly to update them on the meeting time (which will be Saturday, August 26th, the last Saturday of the month, at my house in Corralitos, CA). If you got my "CSC MEETING..." message, then you need do nothing further. If you did not get it, and wish to, send me a message. If you know of others in the area who may be interested, forward them this message. This mailing list is maintained manually, in Eudora Pro, so send me English messages, or the best approximation of English you can manage. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Re: The Net (short movie review)
by cwalton＠earthlink.net 17 Dec '03

17 Dec '03

At 8:11 AM 7/31/95, Sandy Sandfort wrote: > >I hope the movie is very popular. It helps us by inducing >healthy cynicism with a dash of paranoia. I've been talking with a friend for years about PGP and crypto stuff. He wasn't interested. Yesterday, he saw The Net. Now he can't wait to learn how to use it. This is a good thing. I hope it's a popular movie too. Conrad Walton | cwalton(a)earthlink.net | http://XXX.XXXXXXXXX.XXX/~XXXXXXX/ ------------------------------------------------------------------------------ Without JOY, there is no STRENGTH. Without STRENGTH, all other virtues are worthless. Edward Abbey

1 0