December 2003 - cypherpunks-legacy

Why ecash is traceable
by Hal 17 Dec '03

17 Dec '03

There has been considerable discussion on sci.crypt and on the cypherpunks list about the fact that currently proposed digital cash is "traceable", or to put it another way, that there is no payee anonymity. This is an annoying asymmetry, where the payor is protected more than the payee. But there is a fundamental reason for this, which I want to explain here. It is not just perversity on the part of digital cash designers. The problem is that there is a conflict between the desire for payee anonymity and the need to prevent double spending. And preventing double spending is far more important, since without that the cash would be worthless. Here is how the conflict occurs. Suppose Alice has a piece of digital cash which she wants to spend with Bob. She goes through some protocol and transfers data to him. Bob, then or later, sends some resulting data to the bank and gets his account credited. Now if Alice spent that same coin with Charlie, we need to have the bank find it out. When Charlie deposits his data with the bank, and the bank compares that with what Bob sent in, there must be a red flag that goes up. The fundamental requirement of preventing double spending implies that Bob's and Charlie's data, when sent to the bank, has some correlation which will identify the fact that they both come from the same coin. It doesn't matter exactly what the form of this data is, or how it has been blinded and stirred, but if double spending is to be detected there must be a correlation which the bank can see. But this correlation is what makes the coin traceable. Suppose Alice is paying a coin to Bob via an anonymous network, and she and the bank are going to try to figure out who he really is. She goes through the payment transaction, and Bob sends his resulting data to the bank. Before doing so, though, Alice simulates a payment of the same coin to Charlie. Charlie doesn't actually have to be involved, Alice can just go through what she would have done if she had spent the coin elsewhere. The result of this simulated payment has been shared with the bank. Now, when Bob deposits his data, the bank compares it with the data Alice sent, the result of her simulated spending of the same coin. By the argument presented above, Bob's deposit will be flagged. It will correlate with the data Alice sent in since this will be the equivalent of a double-spending. So when Bob makes the deposit he can be linked to the specific coin payment which Alice made, and his anonymity is lost. It would seem that any system which is capable of detecting double- spending just from the information which the payees send in to the bank would be vulnerable to this. Systems which use tamper-proof observer chips to prevent double spending beforehand can avoid it, but of course if someone breaks an observer the whole cash system might crash. In general it does not look like payee anonymity is possible without giving up other very important features. Hal Finney hfinney(a)shell.portal.com

3 2

number theory number theory
by catalyst-remailer＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- All right, a number theory discussion! >The integer N is prime if: > 2^N - 2 > --------- > N is an integer. Well, this is false. The above formula is derived from Fermat's Little Theorem, or Euler's Generalization of Fermat's Little Theorem. a^(n-1) = 1 mod n, n prime, gcd(a,n) = 1 ==> a^n = n mod n a^n - n = kn, for k some integer (a^n - n)/n = k, for k some integer now sub in a = 2. However, the converse of this is not true (n isn't necessarily prime if it satifies the formula). Composities that satisfy this are called pseudoprimes. For example, for a = 2, n = 341 satisfies the relation, so 341 is a pseudoprime base 2. Now it works "most" of the time, and in fact one method of testing large integers for primality is to choose a whole bunch of a's and plug in n. If a^(n-1) mod n != 1, the number is composite and can be rejected. But, if a^(n-1) mod n == 1, you can only be 50% sure n is prime. (Roughly speaking; Phil Karn notes that the PGP docs indicate a 50%, I've seen proofs that this pseudoprime test fails 50% of the time, etc. But these are upper bounds; the real percentage seems much lower and I haven't seen a tighter bound on it). There is a "strong psuedoprime" test, in which failure occurs for at least 25% of integers in the range, thus the probability that a composite will pass is at most 25%. Even better is Lucas' test, but it runs a bit slow. However, you can be unlucky and pick a Carmichael number, which will pass the pseudoprime test for all bases relatively prime to n (for all a such that gcd(a,n) = 1). Ray Cromwell advises to choose n = 561, the smallest Carmichael number (an excellent choice!) Carmichael numbers exist, they are relatively rare, formulas exists for generating some of them... Eric Hughes mentions that 1729 is the next Carmichael number... not quite true. 1105 is the next Carmichael number. (But congrats Eric for even remembering the third one!) ;) Now, some other topics: > For any number n which is prime, (2^n)-1 is also prime (Mersenne's > theorem). Hm... some confusion here. A Mersenne prime is of this form (2^n) - 1 where n is prime, but not all number this formula generates are primes. Mersenne primes are related to perfect numbers. An example of a composite of this form: for n = 11, 2^11 - 1 = 2047 = 23 * 89 > For any number n (2^(2^n))+1 is prime. (I might have that wrong, I > don't remember exactly) Well, no. These number are Fermat numbers, and while the first 5 (n=0 to n=4) but Euler showed that the Fermat number for n=5 is composite. As an aside, Fermat numbers satisfy the pseudoprime test. > For any number n, if the square root of (n!)+1 is an integer, it is > also prime. (This is interesting, but rather useless in practice) A couple of issues here: I think you may be remembering a different theorem, a consequence of Wilson's theorem. Wilson's theorem says: for any prime p, (p-1)! = -1 mod p The theorem I think you are referring to is: if P is the product of the remainders relatively prime to m, then P = +/- 1 mod m; +/- = plus or minus The congruence is +1 except in three cases: 1) m = 4 2) m = p^b (m is a power of an odd prime) 3) m = 2p^b (m is twice the power of an odd prime) I'm still trying to either prove or disprove your claim! Two followups relating the the original formula posted: > For any number a, 1<a<=n, n! mod a == 0; therefore, n!+1 mod a == 1. > n!+1 is prime. Prime numbers don't have integral square roots. Good analysis, except for the "n! + 1 is prime" part. The only thing you can say is n!+1 has no factors <= n. For example, n = 4, n!+1 = 25 = 5 * 5. > Well, it was quoted from memory, so it's possible that I made an > error, but it seems to work as stated... > For example : > (4!+1)^(1/2)=5 > (5!+1)^(1/2)=11 > (7!+1)^(1/2)=71 > I can't find a value which produces a result that is a non-prime > integer. (Of course that doesn't prove that there isn't one.) Still working on this... ;) -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLanNNYOA7OpLWtYzAQF10wP9GExbaoloiXqFe7AtXb/UzUHXhW3VDC1b mfD0RhgK2i0Dr05RW5FCvj/9i7Jxhrd3E26hTe5g4WckvIcvp+GWhE/5fkdtVMA9 THutX1ukGO/5qCxSRT4hVCeXStAz7tunkF3fcEQjPe8pSSvKxN8tw/wIZzclRDRx JDE4HYRhAz0= =OW8h -----END PGP SIGNATURE-----

4 4

Re: Why ecash is traceable
by Donald M. Kitchen 17 Dec '03

17 Dec '03

Re: ecash being non-tracable if anon accounts are allowed... And if not, a market will probably develop to launder ecash. Don

1 0

Re: DD, pedaphiles, and Terrorists, oh my
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <9509141640.AA30602(a)zorch.w3.org>, hallam(a)w3.org wrote: >We never used to see kiddie porn on the internet. The net would go balistic if a >picture of a teen age nude was posted. Recently there has been a flood of hard >core paedophile material. There has always been nude teens on the net. The kind of pictures the most casual observer can take at any Mediteranian beach at any given day in the Summer. There is no real kiddy porn readily available on the net. I looked long and hard. Its a red herring. ANYBODY on this list seen some real kiddy porn on the net? I am talking intercourse, etc., not scans of six year olds from the Sears catalog, or naked boys building sandcastles on the beach. - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMFjDkioZzwIn1bdtAQEB0gF+M67Ih6WLAl8J9bxPZOBmyjxKsxUczpqv th5x7ZuILyuf/+bFTtcLKwbOnzZkIfpJ =pjLL -----END PGP SIGNATURE-----

3 2

PGP BUG/FEATURE: multi-platform keys
by nobody＠alumni.cco.caltech.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Recently I have received two keys that were unusable without modification (from wonderer and Sameer) because they were not prepared using canonical text. I had to replace all the carriage returns by hand (this is the workaround for mac users who receive PC keys). Why is non-canonical text even an option in pgp? Who would use it except by mistake? As long as I'm at it, here are some more macPGP2.3 bugs, for those who care. Trying to decrypt a message signed by a key I don't have causes a serious crash requiring reboot. Trying to select cancel in a signature dialogue just raises the same dialogue box instead of cancelling. I'm running on a powerbook 145 under system 7.0.1. Eternal!Optimist(a)anon.penet.fi (copyright 1993, Eternal Optimist [Ha Ha Ha]) 0) 0) =:()]-< <na26436(a)anon.penet.fi> -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLNe7R4jvfLxJbYYtAQFFHQP7BCqn1JKaI09wBrWnjOF73CPz7GetaC/y XL8zqhmzDdrGdLbWB/vBDgXW7z+2EJHazbvqaUhq1GQw8bq+opC2fe4mXcw2x3Y+ wliLy1CWDtfl24L8ah//nLQMtttfG4kXjiB8JqUnS7US+W3vvH3AXxi+wZb5W2qi 7gPXMErUCUA= =Ew/6 -----END PGP SIGNATURE-----

1 0

Re: Digital Fingerprinting
by James Caldwell 17 Dec '03

17 Dec '03

On 12 Sep 95 at 11:27, Andrew Loewenstern wrote: > Such technology would be very useful in business, especially the > high-tech industry. Think of how many non-disclosure agreements > are signed every day relating to new products developed for the > software industry alone. Many companies are very paranoid and > already 'fingerprint' information by using unique code-names for > projects, for instance. i.e. the spec sheet on their new GAK > crypto product they give to Alice may be code-named 'project foobar' > but the one they give to Bob may be code-named 'project burris'... > Then, when the information leaks out they check which person they > gave the document with that code-name and they know who to sue (or > at least not give any more trade-secrets to). It's very simplistic > but it has been know to work in the past. > > Most of the real technology for doing this is much better, of > course... However, what stops you from printing out a > fingerprinted document and scanning it back in, for instance? Well, there is selective wording, mispellings, punctuation and formatting. These can be corrected easily if allowed to be transported as a text or common file type. Another way is to place the document in a PItA proprietary graphical format for transport and viewing only, stego identifier imbedded if you chose * , so that every portion of the document has some indentifier imbedded in it. Many obvious and many devious. Electronic drawings with a harmless and useless circuit(s) added on , software with do nothing code (by design!:) ). Difficult and time consuming to do, but for megabuck items, no prob. Automated for an additional fee of course. Start a service industry for such, make money, pay me back by running a fast, reliable remailer. Idea is to make the thief go to some major effort and if the scanning option is used to make the deletions as obvious and telling as the former identifier. > andrew note* Makes a neat way of putting copyright & source information in picture and sound files, somewhat useless but every trip up helps.

1 0

e$: Progress and Freedom Conference this Summer
by rah＠shipwright.com 17 Dec '03

17 Dec '03

There was a pointer here to an article in the NYT or WSJ about the conference this summer of the Progress and Freedom Foundation, with muchos net.luminarios (Huber, Myhrvold, Barlow, Brand, Kelly, Dyson, Keyworth, etc.) in attendence. Topics were mostly about e$ and the causes/consequences thereof. I just saw this thing on CSPAN, and I thought it was way cool. Here's how to get it from CSPAN in case they don't run it again. Ask for Tape number 57759-63 CSPAN prices their tapes by the hour, at $35/hr. This tape is $105.00 CSPAN Department 53 Washington, DC 20055 In case I botched something above, or you want to put this on your favorite book-entry transaction account ;-), CSPAN's phone number is 202-737-3220 and ask for Viewer's Services. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

3 2

Hazard of encrypt to self?
by nobody＠eli-remailer 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I always encrypt stuff when I send it to the remailers. I always encrypt to myself along with the remailer, in case I need to look at the message again. But since trying to decrypt a message reveals the id's of the keys that can decrypt it, this reveals information about the sender of the message that wouldn't be available if I only encrypted to the remailer. A partial solution - I generated a new key pair to use for the encrypt-to-self function (a nice short one). I put some meaningless nonsense in the id, so anyone who observes my message on its way to the remailer will no know it is from Eternal!Optimist(a)anon.penet.fi (copyright 1993, Eternal Optimist [Ha Ha Ha]) 0) 0) =:()]-< <na26436(a)anon.penet.fi> -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLObHdojvfLxJbYYtAQEZAgP8Db7qpgqy17wmP91/zl5ZioF/53IIugpW eFjJVtT/UC0wEB/wdvQSBuG2xoXFPWxwWraEtWUCvsAP580juKiGSvmpZARxnm30 yfHVuqv+cfo8FYm7KJpWGdSIFmoqvG8h/a4wiGWMg/Dnai5wOZtRt0mWDyftj+gt EzgFJSwTtIc= =xEZA -----END PGP SIGNATURE-----

1 0

Re: laptop passwords
by Alan Olsen 17 Dec '03

17 Dec '03

At 01:22 PM 9/15/95 -0800, you wrote: >I've got a dilema. > 2 laptops that I just purchased at a police auction have passwords, >from what I can tell they are passworded at the cmos level. I would normaly >just pull out the battery and clear the cmos but these are laptops and I'm >not to comfortable about doing that. Any ideas? > >laptop1 - Toshiba Satelite Pro T2400CT >laptop2 - Epson Action Note 500 c I am not familiar with those models, but if they work like a regular AMI bios, try hitting ctrl-alt-delete at the password prompt. On many passworded bios it will get you right past it. That will at least give you enough info to see if there is anything worth saving. (I have no problem giving out that trick since I have found most bios passwords pretty useless unless used against the most clueless of users.) | Minister of Forced Caffinization in the DNRC | alano(a)teleport.com | |"The moral PGP Diffie taught Zimmerman unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.| | http://www.teleport.com/~alano | <fnord> |

1 0

Re: Digital Fingerprinting
by Alan Olsen 17 Dec '03

17 Dec '03

At 12:28 PM 9/15/95 +5, you wrote: >Another way is to place the document in a PItA proprietary graphical >format for transport and viewing only, stego identifier imbedded if >you chose * , so that every portion of the document has some >indentifier imbedded in it. Many obvious and many devious. Electronic >drawings with a harmless and useless circuit(s) added on , software >with do nothing code (by design!:) ). Difficult and time consuming >to do, but for megabuck items, no prob. Automated for an additional >fee of course. Start a service industry for such, make money, pay me >back by running a fast, reliable remailer. I seem to remember a software piracy case from a number of years back. The case was settled by Apple showing that their code had been copied by the copyright "easteregg" hidden in the roms. Made for a quick and effective demonstration in court. (The story may be apocryphal, but it makes for an example as to how such things do have a (supposed) valid use in protecting code from being snagged by other companies.) | Minister of Forced Caffinization in the DNRC | alano(a)teleport.com | |"The moral PGP Diffie taught Zimmerman unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.| | http://www.teleport.com/~alano | <fnord> |

1 0