December 2003 - cypherpunks-legacy

Mark Twain Bank (was: Anonymity: A Modest Proposal)
by cman＠communities.com 17 Dec '03

17 Dec '03

First of all, those who have looked over the MT Bank stuff all know that they are clearly off to a very shaky start. I know of three guys that could have done a _much_ more professional job, almost a year ago. Unfortunately we were rejected by Chaum as insufficiently respectable. So now we get a service that is lame, confusing and expensive -- at least at the bank end. Chaum apparently continues to suffer from the belief that he needs a real bank to issue e-cash. Well, MT Bank is a real bank, but they have managed to violate at least one major Federal Reserve requirement (accounts in the ECash mint are clearly demand deposit accounts -- it would have been trivial to define them differently but somebody apparently wasn't thinking.) A technically-oriented NBFI could have done a much better job, without a lot of the "real bank" baggage, such as minimum deposits ($250, not $2,500, but still pretty steep for someone wanting to spend $.10 on something.) My understanding is that the _bank account_ is FDIC insured, but not the ECash. I could be wrong -- their materials are extremely confusing and hard to follow. As one of my co-workers said today, "It will be interesting to sit back and watch them take regulatory mortar fire." Indeed. I'm really hoping that they pull their act together -- I've already sent in my account application -- but things look really grim at the moment. There are certainly a lot of projects list members are working on that would be greatly enhanced by functioning, popular e-cash. I encourage everyone to give them lots of helpful feedback so that they can turn this around. On another note, I'm hoping that some of you will also bite the bullet, get accounts, and join me attempting to win valuable prizes in Sameer's "Hack Digicash" promotion. I'd rather see one of us find holes in this than see the whole thing melt into the ground. This extremely unprofessional, bungled launch does, I admit, make Mondex (with scads of beautiful marketing literature) look better all the time, although based on some conversations on Sunday, it appears that they may have _extremely serious_ architectural security problems. We'll see how things play out. Later, Doug > With the release of digicash I hope that we can soon make this >stuff for-pay and much of the spam problem will be fixed. (Not all of >it, of course.) > (I am rather hesitatnt to setup an account with Mark Twain >though.. $2,500 min balance and not FDIC insured?)

6 6

Hack DigiCash: Payee Anonymity
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

Well, Sameer is offering a "Hack DigiCash" promotion, in the same spirit as the hack Netscape and Microsoft offer. However, Chaum is a fairly experienced cryptographer, and I doubt that there are any major security flaws in the system. The trial version used RSAREF, so that code at least was open for your inspection. There is still the possibility of bugs creeping in when porting to different platforms tho... I think the most interesting hack to pursue is to eliminate the payee-nonanonymity problem. The current software uses the following protocol: The <--(blinding)--- Client Bank --(unblinding)-> Client --> Merchant(non-anonymous) --> deposit in bank The client is anonymous to the bank because of the blinding. What we want is for the client to be able to pay someone money, and have the recipient be able to spend the money anonymously. That is, there must be blinding between the payer and the payee: The <--(blinding)--- payer <--(blinding)--- payee Bank --(unblinding)-> payer --(unblinding)-> payee --> payee spends money The payee generates some digital coins, blinds them, and sends them to the payer. The payer then makes a withdrawl from his bank account, blinds the coins again (or not, it really doesn't matter) and sends them to the bank. The bank signs them, and returns them to the payer. The payer removes his blinding (if any) and sends them to the payee. The payee unblinds the coins and spends them at his leisure. Privacy for all involved.

5 4

"Dr." Fred
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

The most charitable explanation for "Dr." Fred is that he's degenerated into the professional equivalent of those pathetic aging former chess masters who try to eek out a subsistence living by charging five bucks a game. People often play with them out of sympathy, or for the novelty of having lost to a past great. It's part of the chess culture, and it's basically harmless and sort of quaint. The difference, of course, is that its almost impossible to have sympathy for Dr. Fred. His hustle is for a hell of a lot more than subsistence. He was also never actually a master of his field, a fact that becomes increasingly obvious as our exposure to him goes on. Now he's reduced himself to trying to collect someone else's winnings.

5 9

Digicash will not fly
by James A. Donald 17 Dec '03

17 Dec '03

While Chaum is a brilliant cryptographer, he is an incompetent businessman He has demonstrated this in numerous ways. The latest being "Cash" where the bank skims off 4% to 10% every time. No one is going to use digicash under these kinds of terms and conditions. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

EE Times on IDEA
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Electronic Engineering Times Oct 23, 1995 p. 66 T.R MADHUSUDAN SASTRY, T. GANESAN, B.MADHUKAR AND N. SRINIVASA MOTOROLA INDIA ELECTRONICS Pvt. Ltd. BANGALORE, INDIA Time is right for a good, secure 'Idea' Computers are the medium in which almost all of today's business deals and international transaction transpire. That calls for the development of secure systems, which protect data from being accessed by unautho-rized users. Digital Encryption Standard (DES) is a cipher system that uses a 64-bit-long secret key. With present comput-er technology, it is not difficult to break DES by trying all possible keys. That made cryptographers look for different encryption algorithms that take a long time for today's computers to break the code. The International Data Encryption Algorithm (Idea) is a private key-block ciphering scheme, which is computationally highly secure since it uses a 128-bit-long secret key. The brute force method of breaking the code, (trying all possible combinations as keys) would require 10^24 years for a chip that can test a billion keys per second. The design philosophy of Idea is to niix the operations from different algebraic groups to add confusion and di! ffusion to the input data. The operations are addition modulo, multiplication modulo, and exclusive OR (XOR). We have implemented Idea in electronic-code-book (ECB) mode on the Motorola DSP 561xx family of processors. In ECB mode, a 64 bit input block is encrypted to generate a 64-bit output block that is transmitted to the receiver through insecure but error free channels. In Idea, all the algebraic operations work with 16-bit blocks of data. That makes the algorithm efficient on a 56 to DSP, which has a very good instructioln set to perform the addi-tion modulo 2^16, multiplication modulo 2^16 + 1 and 16-bit XOR operations. The Idea is a block-cipher scheme in which the incoming data is divided into blocks of 64 bits and fed as input to the encryption algorithm (see figure). The 64 bit data X= (X1 X2 X3 . . . X64) is initially divided into 4 subblocks X1, X2, X3 and X4each of 16 bits. These four sub-blocks become input for the first round of operation. In each round, each subblock is added and multiplied under modulo fields with key subblocks, thus adding more confusion and diision. The sequence of operations for the first round is given below; it's the same for all rounds of operations except for different key subblocks. [1] Multiply X1 and Kl, (first key subblock Zl^l) under modulo 2^16 + 1 [2] Add X2 and K2 (Z2^1) under modulo 2^16 [3] Add X3 and K3 under modulo 2^16 [4] Multiply X4 and K4 under modulo 2^16 + 1 [5] XOR the results of step 1 and step 3 [6] XOR the results of step 2 and step 4 [7] Multiply the results of step 5 and K5 under modulo 2^l6 + 1 [8] Add the results of step 6 and step 7 [9] Multiply the re sults of step 8 and K6 under modulo 2^16 + 1 . [10] Add the results of step 7 and step 9 under modulo 2^16 [11] XOR the results of step 1 and step 9 [12] XOR the results of step 3 and step 9 [13] XOR the results of step 2 and step 10 [14] XOR the results of step 4 and step 10 The results of each round from steps 11, 12, 13, and 14 form the input blocks for the second round of opera- tion after swapping the two inner blocks (see figure). After eight rounds are over, the following transformation has to be done before taking output cipher text. It should be noted that swapping is not done for the last round. [1] Multiply X1 and the 49th key subblock K49 (Z1^9) [2] Add X2 and the 50th key subblock to k50 (Z2^9) [3] Add X3 and the 51st key subblock k51 (Z3^9) [4] Multiply X4 and the 52nd key subblock K51(Z3^9) The decryption algorithm is also exactly the same except for the change in the subblock keys. From each of the key subblocks in the encryption, either additive inverse or multipli cative inverse is used. For example, the subblock key used to multiply this data subblock is re placed with its multiplicative inverse. Also the order in which that multiplicative and additive inverse occurs in the decryption algorithm takes care of the shuffling of the intermediate data subblocks. As stated earlier the encryption key is 128 bits long. The 52 encryption subblock keys are derived from the encryption key, and the corresponding subblock keys are derived from the encryption-key subblocks. The key subblocks for the first round of encryption are derived by dividing the 128-bit-long key into 16-bit blocks. Then, for every next round, the encryption key is circularly shifted by 25 bits and then divided into 16-bit blocks to yield encryption-key subblocks. In the last round, only the first four key subblocks are generated. The Idea can be implemented in all three modes of operation: ECB, output-feedback mode (OFB) and cipher-feedback mode (CFB). In ECB, the input is split into 64-bit blocks, encrypted and transmitted. In CFB, the output cipher text from one block of encryption is used to form part of in input block. And the output of the algorithm is XORed with the input plain text, and transmitted. Similarly, the feedback is taken after the XORing operation. In thepresent implementation, only ECB mode is done, which is the fastest among the three. Since all the operations are on 16-bit blocks, the powerful instruction set of 561xx can beused for efficient implementation. The modulo 2^16 + 1 multiplication operation is used many times, and it is computationally intensive when compared with XOR and modulo 2^16 addition. The fixed-point multiplication construction of 561xx can be utilized to perform 32-bit multiplication. The modulo 2^16 addition operation can be done just by ignoring the carry of 16-bit addition in 561xx. The XOR operation is also supported in one instruction as in any other DSP processor. Hence all three algebraic operations can be implemented efficiently using the instruction set of 561xx Again the decryption algorithm is exactly the same as the encryption algorithm, except, that the decryption-key sub block is used instead of encryption. The whole program can be reused for decryption by changing the input variables and output variables. Circular shift The main computation in encryption-key subblock generation is the circular shift of the l28-bit-long key. The encryption key can be stored as eight words in memory. In the present implementation, instead of shifting the key circularly, the mask patterns are used to pick up suitable key subblocks. That is, the second set of eight key subblocks can be generated by picking up 16 bits from the ninth bit of the second word of the encryption key. Hence, for each round, we need to multiply each encryption key word by a suitable mask pattern, and left shift it with a suitable number of bits. The left-shifting operation for any arbitrary number of bits can be performed using the integer multiplication. Storing the mask patterns can be eliminated by using the shifted version of left-shift constants as right-shift constants. The left-shift constant is multiplied with the current encryption-key word, and the right-shift constant is multiplied with the next keyword, and both are combined to generate one key subblock. The right-shift constants are gotten by right shifting the left shift constant by 1 bit, which considerably reduces the computation involved. The current implementation of Idea in ECB on Motorola's DSP 56166 running at 60 Mhz supports up to 625 kbits/second in full-duplex mode. That is 3.6 times faster than using the DES algorithm.

3 2

1995-10-27 Members Named to Nat Security Telecom Committee (fwd)
by Ed Carp [khijol SysAdmin] 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Fri, 27 Oct 1995 20:11-0400 From: The White House <Publications-Admin(a)WhiteHouse.Gov> To: Public-Distribution(a)clinton.ai.mit.edu Subject: 1995-10-27 Members Named to Nat Security Telecom Committee THE WHITE HOUSE Office of the Press Secretary ________________________________________________________________________ For Immediate Release October 27, 1995 PRESIDENT NAMES MEMBERS TO THE NATIONAL SECURITY TELECOMMUNICATIONS ADVISORY COMMITTEE (NSTAC) President Clinton today announced his intent to appoint the following individuals to the National Security Telecommunications Advisory Committee (NSTAC): Dr. Vance D. Coffman is the president of Lockheed Martin Corporation. Previously, he was president of the Space Systems Division of Lockheed Missiles and Space Co. and vice president of the corporation. Dr. Coffman was responsible for the Hubble Space Telescope, MILSTAR, Follow-on Early Warning, and the worldwide mobile commercial cellular phone system, Iridium. He holds a B.S. degree in aerospace engineering from Iowa State University, and masters and doctoral degrees in aeronautics and astronautics from Stanford University. Mr. Paul E. Wright is chairman of Chrysler Technologies Corporation (CTC), the aerospace and defense electronics arm of the Chrysler Corporation. He was president and chief operating officer of Fairchild Industries prior to joining CTC. Mr. Wright guided the company's focus toward spacecraft, defense electronics, and selected industrial products. Mr. Wright spent 28 years with RCA Corporation, during which time he rose to senior vice president. He was responsible for developing and administrating the strategic plans for RCA. Van B. Honeycutt is president of Computer Sciences Corporation (CSC), the largest independent provider of information technology consulting, systems integration, and outsourcing to industry and government. He began his career with CSC in 1975, serving as a regional marketing manager for Infonet, the company's timesharing and value-added network, which CSC sold in 1989. In 1983, Mr. Honeycutt became president of CSC Credit Services. He was later promoted to corporate vice president and president of CSC's Industry Services Group in 1987. He led CSC's advance into the growing outsourcing market, negotiating the industry's largest outsourcing pact, a 10 year, $3 billion agreement with General Dynamics Corporation. The President's National Security Telecommunications Advisory Committee (NSTAC) provides the President with information and advice from the industry's perspective regarding specific measures to maintain, protect, and enhance the nation's telecommunications resources that support national security and emergency preparedness capabilities. The Committee addresses telecommunications issues throughout the year and periodically reports directly to the President, and also to the Secretary of Defense in his capacity as the Executive Agent for the National Communications System. -30-30-30-

1 0

Pinkerton Risk Assessment & "Security 2000"
by blancw＠accessone.com 17 Dec '03

17 Dec '03

I have been broswing through the MSN (Microsoft Network), and discovered a section in the "SOHO" (Small Home Owner's Guidebook) called "Partners Pages". In it there is a list of companies with icons which subscribers can click on to view these companies' business/financial-related services. One of them is the Pinkerton Risk Assessment Service. I opened & examined their several icons, and it suddenly occurred to me how useful this kind of on-line information could be to individuals in the new anarcho-capitalist, nationally-borderless world. Sort of in keeping with the theme which Sandy Sandfort and Duncan Frissell brought up with their "lectures" on "Risk" last year, as well as what I had said in an earlier post about people in our brave new world needing to become imaginative in providing for their own self-defense (seeing as how trusting the goverment doesn't work so well), it occurred to me that having information on threats to one's physical safety would be fitting for this need - like the RISK mailing list is for computers/software. This kind of data would be different from what we can get on the regular news, which is combined with many other kinds of news and is very generalized, in that it deals more specifically with the subject. They advertise their services as: "... the risk assessment tool for the 21st century. If you or other members of your company travel internationally, the Global Risk Network on MSN. is an invaluable service, keeping you informed of worldwide events, political turmoil, global sensitive spots, and more! Now you have direct online access to a wealth of exclusive Pinkerton information, all via your computer. You can even order hard copy reports or have customized research performed by Pinkerton Risk Assessment experts, simply type in your request. Tailored for the individual traveler, as well as the corporate executive, our risk services give you several options to know the security situation anywhere." Although their services are advertised for the corporate business traveler, it obviously is of use to any traveler, and particularly to the person who is in the location mentioned. They have icons opening up to BBSes where they report on trouble spots and potential threats in a timely manner: "The Global Risk Network provides even more detailed country data, including The Daily Risk Assessment Weekly Risk Assessment Special reports Statistical analysis of significant incidents by country and region Security tips Eye on Travel " You would think that if the NSA & other State Departments used their services, that they wouldn't need to poke around people's computers to better predict where to put added security for high honcho dignitaries or State office buildings. But isn't that what the intelligence services are for? Oh, well. Here, I thought, is a great service for the regular person which they can use to be prepared for the exigencies of life's little problems, like terrorists and other restive types with violence on their mind. For any of you in the Washington, D.C. area, there will be a lecture from Pinkerton next week as detailed below. If anyone from this list goes, it would be interesting to get a post on what they say - the section on cybersecurity might be of relevance to the list. (I got this from the same location on their MSN site.): IN COOPERATION WITH THE GEORGE WASHINGTON UNIVERSITY PRESENTS SECURITY 2000 Please join us at The George Washington University's Marvin Center on November 9, 1995, for a seminar on topics of vital interest to security professionals. The seminar will highlight the opportunities and challenges of the security environment in China; computer crime and how it can affect your business; a global overview of political unrest, terrorism and crime,; and a demonstration of the new Pinkerton Global Risk Network on the Microsoft Network. Join us for the news, views and tools for ensuring your organization's security as we approach the 21st century. Featuring: 0800-0900 China and Southeast Asia - Dan Grove, Pinkerton - Asia 0910-1000 Cybercrime - Special Agent Jim Christy, Air Force Office of Special Investigations 1010-1110 Global Patterns and Trends - Hugh Barber, Pinkerton Risk Assessment Services 1120-1220 Pinkerton Global Risk Network on the Microsoft Network - Demonstrated by Frank Johns and Hugh Barber, Pinkerton Risk Assessment Services 1230-1400 Lunch - GWU Club (no charge) The GWU campus is just off the Foggy Bottom Metro stop, in Washington D.C., near the U.S. Department of State, where the annual OSAC conference will take place on November 7-8. There is no fee for the seminar, however, seating is limited. Please RSVP by calling Pinkerton Risk Assessment Services at (703) 525-6111, Fax (703) 525-2454 or via e-mail at: pras(a)access.digex.net -------------- .. Blanc

2 1

Conference in Eugene, OR - 11/3 and 11/4
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- One of the professors at the U of Oregon School of Law here in Eugene, Keith Aoki, has put together what looks like a pretty good conference. As far as I can tell, it's going to be something of a sleeper - lots of good speakers, and probably not very many people in the audience who'll be able to appreciate what they're seeing. Folks on the west coast interested in law and technology policy might do well to pop up to Eugene for the weekend. I've got limited floor space for people who need a place to crash and don't want to pony up the $ for a place in Eugene. (I'm in Springfield, the redneck town across I-5 from Eugene - I'm about 15 mins from campus by car, and can give folks a ride over if they're willing to stay for the day.) Motel rooms ought to run between $30 and $80 per night in Eugene, depending on whether or not knife marks on the headboard and the smell of old cigarettes bothers you. :) Eugene is 2 hours (~ 110 miles) south of Portland on I-5 and 8 or 9 hours north of the Bay Area by car, up I-5. There's an airport here, so it's possible to fly in - some rocket scientist planners put the airport way north and west of anything interesting in town, though. The conference is Friday, November 3, and Saturday, November 4. Speakers include (in no special order): John Perry Barlow James Boyle Rosemary Coombe Steven Winter Rudy Rucker Tim Sloan A. Michael Froomkin Marc Rotenberg Lee Tien Cait Clarke Gary Glisson Rex Heinke Eric Hughes Matthew Ghourdjian Benjamin Kaminash Barry Schrader Vibeke Sorenson Dhruv Khann Jerry Kang Peter Jaszi Jessica Litman David Peterson Brian Stine Alfred Yen Richard Stallman James Love Pamela Samuelson Jerry Berman Shari Steele E. Wally Van Valkenburg Margaret Chon Folks who want to stay with me (you should be at least dog-tolerant) or who want help getting picked up at the airport/finding a motel/whatever are welcome to give me a call (503 744 2713) or send E-mail. I think there's some charge to get in (not for law students, so I haven't been especially attentive to it) but Keith said that we can probably waive that if folks are interested and can't pay. If that sounds like a problem, send mail, and I'll see if I can get him to issue some Cypherpunk passes. (The idea is to extract $ from working attorneys without scaring away interested non-attorneys.) It ought to be quite a conference. By all means, if you can make it, come on up (or down). -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMJMtEH3YhjZY3fMNAQHSBQP/R4OdjIQIYbpcR0sloIBc+ZVeR8hzQ81w c8o2NyKncO0P/Hthxx+peCAUwN2S7RJr8k/jNvY0ah5Qcy4lmPnhn3uBVZFeY9O4 7I+NPimj38xNjvYdnUYrQT1HuEyVknnwi1s/2VsSGCVvbfJkHOWkuc0nR8JCX1cI sc5GsGR2zzk= =W/r5 -----END PGP SIGNATURE-----

1 0

Keyed-MD5, ITAR, and HTTP-NG
by Simon Spero 17 Dec '03

17 Dec '03

To summarise: the consensus is that using keyed-MD5 for authentication is ok under ITAR, but using it for confidentiality is out. The reason I wanted to check is that I'm solidifying some of security paramaters for HTTP-NG so we can add them to the test implementation before the Dallas IETF. In addition to the slight problem of having half the development team on the other side of the Atlantic, I want to make at least a subset of the security schemes mandatory, and that means making the core stuff exportable. At the moment, I'm thinking of making the mandatory schemes be Keyed MD5 for authentication, and weakened RC4 with an IV for confidentiality, with the added stipulation being that the user must be informed when key weakening is being used. I may swap RC4 for DES; they're both public domain, but RC4 is simpler. They're both shared key, but I don't make PK stuff mandatory. The other pre-defined schemes I'm planning on getting at least speced are 3-DES and IDEA for confidetiality, SHA for hashing, and RSA & DH for key exchange, signatures, and authentication. Certificate format is currently X.509- PGP format will go in ASAP. Simon --- (defun modexpt (x y n) "computes (x^y) mod n" (cond ((= y 0) 1) ((= y 1) (mod x n)) ((evenp y) (mod (expt (modexpt x (/ y 2) n) 2) n)) (t (mod (* x (modexpt x (1- y) n)) n))))

10 13

Re: InfoWar
by koontz＠MasPar.COM 17 Dec '03

17 Dec '03

>Industry representatives played down the privacy loopholes. >Ronald Plesser, a Washington attorney who represents online >services and direct marketing firms, said, "I know of no >example of anybody trafficking in e-mail descriptions." A >spokeswoman for Hughes Electronics Corp.'s DirecTV said, "We >do not release names of customers that ordered movies. The name of the customer of a video tape rental may be disclosed only under narrow constraints (USC 18 Chap 121 2710): * (b) Video Tape Rental and Sale Records. - (1) A video tape service provider who knowingly discloses, to any person, personally identifiable information concerning any consumer of such provider shall be liable to the aggrieved person for the relief provided in subsection (d). (2) A video tape service provider may disclose personally identifiable information concerning any consumer - o (A) to the consumer; o (B) to any person with the informed, written consent of the consumer given at the time the disclosure is sought; o (C) to a law enforcement agency pursuant to a warrant issued under the Federal Rules of Criminal Procedure, an equivalent State warrant, a grand jury subpoena, or a court order; o (D) to any person if the disclosure is solely of the names and addresses of consumers and if - + (i) the video tape service provider has provided the consumer with the opportunity, in a clear and conspicuous manner, to prohibit such disclosure; and + (ii) the disclosure does not identify the title, description, or subject matter of any video tapes or other audio visual material; however, the subject matter of such materials may be disclosed if the disclosure is for the exclusive use of marketing goods and services directly to the consumer; o (E) to any person if the disclosure is incident to the ordinary course of business of the video tape service provider; or o (F) pursuant to a court order, in a civil proceeding upon a showing of compelling need for the information that cannot be accommodated by any other means, if - + (i) the consumer is given reasonable notice, by the person seeking the disclosure, of the court proceeding relevant to the issuance of the court order; and + (ii) the consumer is afforded the opportunity to appear and contest the claim of the person seeking the disclosure. If an order is granted pursuant to subparagraph (C) or (F), the court shall impose appropriate safeguards against unauthorized disclosure. (3) Court orders authorizing disclosure under subparagraph (C) shall issue only with prior notice to the consumer and only if the law enforcement agency shows that there is probable cause to believe that the records or other information sought are relevant to a legitimate law enforcement inquiry. In the case of a State government authority, such a court order shall not issue if prohibited by the law of such State. A court issuing an order pursuant to this section, on a motion made promptly by the video tape service provider, may quash or modify such order if the information or records requested are unreasonably voluminous in nature or if compliance with such order otherwise would cause an unreasonable burden on such provider. * (c) Civil Action. - (1) Any person aggrieved by any act of a person in violation of this section may bring a civil action in a United States district court. In other words it can be a federal crime to release personal info. (Without regard to ordering movies over the internet)

2 1