December 2003 - cypherpunks-legacy

7-29_b8_EXTRA_Internet.html
by Damaged Justice 17 Dec '03

17 Dec '03

Tuesday July 29, 1997 [1]ImageMap LA Fitness Web gaming is 'ripe for fraud' _________________________________________________________________ By Patrick Wilson Washington Bureau _________________________________________________________________ WASHINGTON - Two senators toured Internet gambling sites Monday as they listened to warnings the growing online casino industry could be ripe for corruption and consumer fraud. Sens. Jon Kyl, R-Ariz., and Richard Bryan, D-Nev., looked on as Wisconsin Attorney General Jim Doyle presented what he characterized as questionable Web gambling sites. Doyle appeared before a Senate technology subcommittee studying a bill by Kyl to ban gaming on the World Wide Web. Doyle said Web gaming has grown from a "sleeping giant" to a developed industry that must be stopped. To demonstrate how easy it is to gamble online, he played a videotaped sample of online casinos such as the "Golden Palace," where Web surfers can use credit cards to play craps, keno, slots and blackjack, among other games. Doyle noted the Internet gambling industry even has its own online newsletter, "Rolling Good Times," which now is conducting an online poll where people can bet - for fun - on whether Congress will pass Kyl's bill. "Who knows what's on the other end of this screen?" Doyle said. "Who knows if those cards are fair? Who knows whether organized criminal activity is involved?" Bryan said he has "no confidence whatsoever that gaming on the Internet can be regulated now or at any time in the future." "Unlike the heavily regulated casinos in Nevada, Internet wagering is unregulated, and since many of these sites operate off-shore it is beyond the reach of U.S. authorities," he said. "Such a scenario is ripe for consumer fraud." Web gambling is catching on rapidly, with one estimate reporting 25 gaming sites and 100 more in the works. Bryan called Internet betting "something that's kind of mushroomed." Internet users can gamble online with a credit card or by setting up an account. There is no way to stop children from gambling on the information superhighway, say supporters of the Kyl bill. "Bringing gaming directly into people's homes, as we are beginning to see through the Internet, is so full of potential problems and so far beyond the ability of any state to regulate that despite whatever business potential it may have it needs to be prohibited on a national level," Bryan said. Kyl's bill, backed by the National Association of Attorneys General, would punish those who set up Internet gaming Web sites with a fine of up to $10,000, two years in prison or both. Those who made an online wager would face one year in prison and a $5,000 fine. [2]| Top of page | References 1. LYNXIMGMAP:http://www.dailybulletin.com/news/7-29_b8_EXTRA_Internet.html#na… 2. http://www.dailybulletin.com/news/7-29_b8_EXTRA_Internet.html#a

3 3

Queries from a Cyper-newbie?
by Chris Avery 17 Dec '03

17 Dec '03

Anybody willing to offer a bit of help to a cypher-newbie? I'm trying to sort out a few of the basics: (and if not answers, just a few pointers on where to go for info? ) Thnks. 1. PGP 5.0 -- good software? If not, what problems? Why to use DSS vs/ RSA keys? How is 5.0 different than 2.6.3i ? Which is better? 2. Are emails encrypted using PGP 5.0 decypherable by PGP 2.6.3i (and vice versa?) Using RSA keys? 3. I understand certain encryption s/w cannot be legally exported, I am aware that such s/w is nevertheless being used (and built) abroad. My queries: Is purely domestic use being threatened by the pending legislation? Is it already illegal to send an encrypted msg out of the US? If so, is it illegal to receive an encrypted msg from outside the US? 4. How strong is strong? My MS Explorer has the 128 bit encryption scheme to secure domestic financial transactions (such as credit cards). How "un-encryptable" is this? I read some recent postings here re difficulty of breaking 128 bit keys -- but this had reference to stronger methods of encryption than MS Explorer uses, right? So 128 bits is hard to break (umptyump years, terrawatts, etc.)? Then why does my PGP 5.0 software offer keys that are 768, 1024, etc. up to 4096 bits in length? Are these numbers on the same scale? Any "strength" differences between RSA, DSS, and Diffie-Hellman? IS there some layman-understandable difference between these? 5. Is international data traffic somehow monitored (or monitorable) to detect encrypted traffic? Thanks for any help.

3 2

Australia and Encryption Policy
by denning 17 Dec '03

17 Dec '03

Ross Anderson posted a message on the net recently stating that Australia was proposing an encryption policy that would force residents to use weak cryptography while banks would get key escrow. His source was a talk by Steve Orlowski, who is Assistant Director, Security Management, in the Australian Attorney-General's Department. Attached is a copy of an open letter by Mr. Orlowski in response to that post. He is not proposing that individuals be forced to use weak encryption. Key escrow would be an option available to anyone wanting a high level of encryption. Organizations and individuals could escrow their own keys if desired. This message and his letter may be forwarded. Dorothy Denning --------------- Dear Thank you for your comments on the subject of the use of encryption by private individuals. Firstly I would like to make the point that the debate has arisen from one person's interpretation of a paper I gave at a conference on "Cryptography Policies and Algorithms" The full text of that paper is now available on the net at http://commerce.anu.edu.au/comm/staff/RogerC/RogersHome.html The paper carries a disclaimer at the top that the views are mine and do not necessarily represent the views of the Australian Government. The paper sets out the Government's policy on telecommunications interception, which includes the issue of the use of cryptography as: "As a result of the Report, Australia is, among other TI issues, monitoring the impact of encryption in the telecommunications interception area and will re-examine matters in 1997 following the opening of the telecommunications area to full competition." Telecommunications covers both voice and data communications. The last paragraph of the paper says that there is a need to expand the cryptography debate to cover the needs of individual users in the context of the information superhighway rather than current Internet users. The paper also points out that issues suh as cost, convenience and public confidence in cryptography systems will be the main issues. Public confidence is explained in terms that as long as it meets the general requirement for privacy it will be acceptable. I still maintain that the general user of the superhighway in the next century will be satisfied with a lower level of encryption which will meet that and cost and user friendliness requirements. On specific point made in the Internet message, the paper does not suggest, either directly or by implication, that individuals should be banned from using encryption. Regarding the use of higher level encryption, the paper supports the concept of commercial key escrow where organisations hold their own keys but may be required to provide them in response to a court order. The same would apply to individuals who could either hold there own keys or store them with a commercial body. Access to those keys would be by court order and in that respect is no different to existing procedures for the interception or seizure of telephone conversations or paper records. There is no suggestion that these basic principles, and protection of individual's rights in general, should be changed If individuals were to use lower level encryption there would be no need for them to maintain copies of any keys for such systems. To my mind this is preferable to a requirement for keys to be maintained for all encryption systems, which could be the result if universal key escrow were introduced. Finally on the question of interception, the general public expects a reasonable level of law enforcement to ensure the protection of their person and property. Governments are required to find a balance between this and the rights of individuals to privacy. Part of this balance is to ensure that law enforcement authorities convince a court that there is a need to carry out an interception. There is no suggestion that this fundamental approach should be changed. The paper certainly does not suggest tha the Attorney-General's Department should become a centralised interception authority. In fact such a role would not be consistent with its role as a source of advice to Government. I hope the above clarifies both the Government's policy and my personal views on these matters. I consider this to be an open letter and have no objection to it being used as such. Yours sincerely Steve Orlowski

1 0

Re: Random Hiss from Mac mike
by Carl Ellison 17 Dec '03

17 Dec '03

>Date: Wed, 23 Aug 1995 19:09:35 +0100 >From: Andrew.Spring(a)ping.be (Andrew Spring) >I've been looking at using the Mac's Sound Input Manager for hardware RNG. [...] >I suspect there's much less entropy in that signal than even this estimate, [...] >Does anybody have any experience/advice in this area? I would try injecting noise and seeing how well you can control the output signal. I would also do a Fourier transform of the output and look for cyclic behavior -- then see how the frequency spectrum can be modified by turning machinery on and off, turning radios on and off, .... You can also try various compression algorithms to see how much entropy they claim to see. When that's done, you can then use some of my ranno conditioning code, free on the net (although written for UNIX, for now): http://www.clark.net/pub/cme/html/ranno.html I especially like running a pseudo-random stream through ranM and then a hash, to obliterate any patterns which might sneak past your analysis. - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme/home.html | |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | ``Officer, officer, arrest that man! He's whistling a dirty song.'' | +----------------------------------------------------------- Jean Ellison -+

1 0

Random Hiss from Mac mike
by Andrew.Spring＠ping.be 17 Dec '03

17 Dec '03

I've been looking at using the Mac's Sound Input Manager for hardware RNG. The advantage of it is that (1) most macs have a microphone port these days, (2) it doesn't involve any user interaction, (3) the API is easy. What I don't know, is how secure it is. Or more precisely, I don't know how much entropy is contained in the signal. In the simplest case, where the microphone is not attached, the signal consists of long runs of '0x80's alternating with '0x7f's. Now, I have no problem transforming this into uniformly distributed RN's : just hash the buffer with MD5. My question is, how many bytes get fed into the hash? Obviously, enough bytes so that I have 128 bits of entropy. Preliminary tests give me a max entropy of about .65 bits per sample byte. That's not very much, but if I can sample at ~20 KHz, that's 1625 bytes per second. That's estimated by recording the length of runs and computing the entropy over the entire sample: i.e. the sum (for k = 1 to 120) of -(fraction of runs of length k * log2 of that fraction). That works out to about 3.3 bits per run with an average run of 5.1 bytes. I suspect there's much less entropy in that signal than even this estimate, but I don't have any way to conduct tests with pure 50 cycle power and uniform ambient temperature. Or whatever else biases the signal. For all I know, every time someone in this building starts his microwave it biases the signal. Does anybody have any experience/advice in this area? -- Thank you VERY much! You'll be getting a Handsome Simulfax Copy of your OWN words in the mail soon (and My Reply). <Andrew.Spring(a)ping.be> PGP Print: 0529 C9AF 613E 9E49 378E 54CD E232 DF96 Thank you for question, exit left to Funway.

3 2

Denning questions/reverses her position?
by Attila T. Hun 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm too old for this! I never thought I would see the day that Dorothy Denning would terminate her star role as a shill for the Clinton/LEA encryption ban! from: http://www.news.com/News/Item/0%2C4%2C13000%2C00.html?nd Two supporters of Clinton administration's stance on encryption released a report today finding that encryption has not inhibited law enforcement efforts, with at least one author questioning her belief in the administration's position. The authors--Dorothy Denning, a Georgetown University computer science professor, and William Baugh Jr., vice president of Science Application International Corporation-- ______________________________________________________________________ "attila" 1024/C20B6905/23 D0 FA 7F 6A 8F 60 66 BC AF AE 56 98 C0 D7 B0 -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQCVAwUBM+Eh5L04kQrCC2kFAQF9wwP+INGEAnc+1akKc+dP7re8fleX4PJrmsYU UKzxgBZAsWcZC7L5WkaOygckHznOc+a37iHzDFtt3sr86DP0D/4j675qJdt/O4B+ jbxXumJ8EXmTN9bOvXK8x9JRGjR9aWzjeaJKN3X+fH4Bjbw76FR9xIFkhhNvZqnM ahBzZyL2cZ4= =MlQZ -----END PGP SIGNATURE-----

1 0

PacBell's idea of a good password
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - From the PacBell Messsage Center (voice mail) brochure: "Make it easier to remember your password by choosig a code you use already, i.e. a PIN number or birth date." - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMDu1OyoZzwIn1bdtAQEvlAF+ObOioS3uF8obI6BRhtjfkZdvRAztTlUa uCjeR0AH2MzNEgTFM0mCSXuTnyy/trG0 =rg3O -----END PGP SIGNATURE-----

1 0

The sorry state of non-US crypto
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I just spent an hour surfing the various crypto/cypherpunks web sites. In this hour I did not come across a single non-US site that carried anything else but PGP. Most non-US sites just carry rants about the evil ITAR, and a few carry the various international versions of PGP. That's it. I know that there are several European ftp sites that have other cryptographic software as well, but I sure as hell can't find them by browsing the web. One would think that at lest some of the major homepages (Virtual library, etc) carry links to such sites. Who cares if someone violates ITAR, if overseas users can't find the exported software? - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMDq+LSoZzwIn1bdtAQGfJAF7B/XTP5VHlvTLgVRcrDHGX9kcLOANI7OE oQbdMFG6K9V7URHL7HV4N7EaAo+TriRp =Ocb0 -----END PGP SIGNATURE-----

10 9

Re: e$: The Book-Entry/Certificate Distinction
by stevenw＠iglou.com 17 Dec '03

17 Dec '03

>At 2:30 AM 8/22/95, Timothy C. May wrote: >> (An important point is that >>in a cash economy, identity is almost irrelevant. It's only in non-cash, or >>"account-based," economy that True Names are demanded. Lots of interesting >>issues to discuss here, which I won't now.) [Lots of interesting discussion deleted] >Everyone trusts their transactions because of the difficulty of forging >certificates. That means that once again, a certificate has it's own >inherent worth. It speaks for itself, and when it changes hands, the trade >is, as Eric Hughes says, "immediately and finally" cleared and settled. >The overhead of keeping books is gone, at least for the trading parties, >and especially for the clearing houses, who, like exchanges, just kind of >disappear, along with any way to regulate them. Somewhere, Joe Kennedy, >the first Chairman of the Securities and Exchange Comission, is probably >either crying his eyes out or laughing his head off, depending on your >interpretation of his role in regulatory history. In such a system, where does credit come in? If I have a certificate that is worth X, then does the recipient know that it's from my "credit card"? How do I obtain credit, and in what form does it exist? Furthermore, how do we assess the value of real physical things in a system like this? -- Steven Weller <Windsor Consulting Group> +1 502 454 0054 (voice) OS-9 Consultancy and Software +1 502 451 5935 (fax) Finger for public key 00 02 3C 2F 83 76 D3 77 2A 95 E8 90 94 9A 9D 74 http://iglou.com/windsorgrp stevenw(a)iglou.com or realtime(a)well.sf.ca.us

2 1

Re: The End of the Ecash Trial?
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 12:35 PM 8/23/95, Nathan Loofbourrow wrote: >I have yet to see a date, but Digicash states several times in their >press releases that Cyberbucks are only a trial currency, and that at >some point in the future the trial will come to an end. We've talked about this a little bit on ecm. Someone from Digicash is on record there as saying that trading in c$ came as a complete surprise. The hitch about continuing to honor c$ is that there needs to be a bank. Someone correct me if I'm wrong, but it seems that the current system does work on an offline, peer-to-peer basis. Nonetheless, ocassionally, you still need to verify that the money hasn't been double spent, and for that you need a bank. The problem with being a bank is the price of the bank software, which is where David Chaum and Co. want make their money. Thus, the last price I got (offhand) from David on the phone a year ago was $250k + 10% of net profits. Given the cost of hardware, people, lawyers, and if you actually back the certificates with dollars in a bank of deposit (not being what we want do to here, admittedly) bankers, and more lawyers. Could add up to a mulitmillion dollar proposition. Of course, it could be done with donated professional time, bandwidth, hardware and donated bank software from Digicash. But it's hard to see that happening from here... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

2 1