December 2003 - cypherpunks-legacy

Minor Risk to LSB Steganography
by futplex＠pseudonym.com 17 Dec '03

17 Dec '03

Last week I attended a lecture given by Dexter Kozen at Cornell, on "Efficient Algorithms for Optimal Transmission of Video Data". He mentioned in passing a couple of approaches to choosing data that may acceptably be lost in the process (i.e. without excessive picture quality degradation). One scheme (which I believe counts as a "corona method") involves simply discarding the LSBs of all the encoded pixels or whatnot. This method was not at all a focus of the talk. Anyway, I thought I'd mention it as another minor potential threat to the use of LSB steganography in video transmission, e.g. MPEG streams. -Futplex <futplex(a)pseudonym.com>

1 0

Digital Cash on sci.crypt
by Hal 17 Dec '03

17 Dec '03

There has been some discussion on sci.crypt of digital cash and its facilitation of kidnapping, extortion, etc. Here is a posting I made when mentions an on-line paper on the topic. I had met the author, Markus Jakobsson, at Crypto 95, but I only had a chance to check out his web site yesterday. awc(a)slcawc.aug.ipp-garching.mpg.de (Arthur Carlson TOK ) writes: >[In response to a discussion of whether digital cash could be used to >provide anonymous collection of ransom money] >Is there really no technical fix for this? To enable the prevention of >double spending in off-line systems, the ID of the withdrawer is coded >into the coins in a way that is verified by the bank. If the victim's >relatives can undo enough of the code to satisfy the bank, why can't >they undo the rest to detect when the coins are spent? Alternatively, >why can't the bank put an identifier on the coins (in a way that isn't >destroyed by the unblinding) that amounts to a message encoded in the >public key of the withdrawer? Then the withdrawer can make the >destination of the ransom money visible by revealing his private key >(after the victim has been released, of course). (He also reveals >every dime he spent in the last year and all his kinky love letters, >but, hey, we're trying to catch a kidnapper here.) There has been considerable discussion of this problem in the literature recently. A paper I found yesterday on the net is by Markus Jakobsson and Moti Yung: Revokable and Versatile Electronic Money, at <URL:http://www-cse.ucsd.edu/users/markus/revoke.ps> (postscript format). It has references to other work as well. The specific attack I discussed earlier applies to the current DigiCash scheme (or at least how it is assumed to work). Offline cash systems would be more complicated. The references in the paper mentioned above describe how these attacks would work on such systems and some ways of avoiding them. However there is a more powerful attack, which the Jakobsson paper addresses, in which the bank as a whole is coerced. Maybe terrorists threaten to blow up the World Trade Center unless Citibank engages in a specific protocol which will leave the terrorists with millions of dollars in fully blinded electronic cash. Even if the normal withdrawal protocol has signatures, etc. which would prevent this, Jakobsson shows that there is a corrupted protocol which if the bank is forced to follow it will leave the criminals with valid but untraceable electronic cash. The solution in the paper is to make it so that none of the ecash issued by the bank is untraceable. Under normal use it is anonymous, but if necessary the authorities can break the anonymity. This is sometimes called "Clipper cash" after the U.S. Clipper chip proposal which had similar privacy properties. With Jakobsson/Yung's approach even the more powerful attack can be defeated because the cash is traceable, and no amount of coercion will allow the attacker to create valid but untraceable cash. While these approaches are technically interesting, the political implications are more ominous. While Jakobsson labels the entity who has the power to break the anonymity an "ombudsman", implying that he defends the interests of the cash holder, he could equally well be called a "policeman" because he is the one who catches the criminals. It is all a matter of how you look at it. The question is whether these various threats of kidnapping, blackmail, extortion, etc. are good enough reasons to go to a cash system where privacy is protected only at the sufferance of government agencies. There are plenty of precedents for governments misusing supposedly- private information, such as the use of phone records to track down those who resisted the German regime during World War II. One of the attractive aspects of electronic cash has been its immunity to this form of governmental coercion. The overwhelmingly negative response to the Clipper chip proposal (other than in the cryptographic and law enforcement communities) may apply to Clipper cash as well. A related issue is the possible competition of rival cash systems. As with Clipper, where it would apparently be necessary to forbid the use of alternatives, so with Clipper cash it would seem that people would prefer true anonymity over conditional protection, even if you call the cash tracer an "ombudsman". So there would seem to be a need for governments to criminalize the use of fully anonymous electronic cash in order to force people to use the ones which the government could track. Whether this will even be possible in an increasingly global financial system remains to be seen. Hal Finney hfinney(a)shell.portal.com

1 0

Re: Whitehouse "dissident" web site monitoring?
by tcmay＠got.net 17 Dec '03

17 Dec '03

I strongly agree with the views of Phill Hallam-Baker and Brian Davis, and perhaps others who make the same points, that access by the White House to the various Web sites is NO BIG DEAL. I go further: I have no concerns about the NSA reading _this_ list! After all, it's a public list, so all are free to read it. Also, it may be very useful for the Feds to be seeing what we are arguing. We don't believe in "security through obscurity," do we? The notion that we are "safe" if the White House, or (horrors!) Janet Reno herself, are not reading our list or the Web sites on various issues, is the same kind of security the ostrich thinks he has with his head in the sand and his butt in the air. If you want to be unheard by the Feds, and the White House, and the FBI, and GCHQ, and Mossad, etc., then don't post publically. If you want your own access to Web sites kept private, push for the development of Web proxies ("Web remailers"). And so forth. Security is in our own hands, as it should be (and as "complex mathematics" has made it). (In the U.S. and most Western countries--actually, an increasing number of countries, worldwide--it is not easy to prosecute and convict a citizen for mere views expressed, or for reading preferences, etc.. Although I am thought of as a "crypto anarchist," and basically am such a thing, the fact is that there aren't a lot of trials for thoughtcrime in this country. I have some doubts about the circumstances surrounding Danny Casolaro's death, though, so I don't say all is rosy and perfect. I just say that paranoia that the White House or the FBI is reading public items is unwarranted.) --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

3 2

Re: Can GAK be made "not interoperable" with PGP?
by Hal 17 Dec '03

17 Dec '03

From: Duncan Frissell <frissell(a)panix.com> > At 10:26 AM 9/13/95 -0700, Timothy C. May wrote: > > >But is this even possible, to make a GAK system "not interoperable" with, > >say, PGP? > > > >Unless the GAK system has some sort of entropy analyzer, and can recognize > >high-entropy sources which it presumes to be encrypted data (*), one can of > >course PGP-encrypt a text file and then GAK the resulting file. > > I took it to mean that they were saying that an approved program on one end > of a communication exchange could not exchange encrypted messages or > established an encrypted session of some kind with an un approved program on > the other end. Not trying to outlaw superencryption (PGP on both ends using > a GAKed channel) but GAK on one end working with an unapproved system on the > other end. A ringer GAK-work-alike that would defeat the intent of GAK. Yes, I think this was the idea of the original "software key escrow" proposal, from TIS as I recall. The sender would encode the session key with a government public key but there was some trick by which the receiver would verify that the session key was in fact encoded correctly and refuse to operate if it was wrong. So any attempt to corrupt or remove the LEAF would be detected if you were talking to a compliant receiver. That is part of why Matt Blaze's Clipper attacks were so significant, because they went to the heart of this requirement. It was always clear that you could superencrypt with Clipper, but Matt found a way in which you could send a LEAF which would be accepted by a regular Clipper phone but which had bogus data for law enforcement. So this defeated the requirement of not interoperating with rogues. Hal

1 0

Re: Whitehouse "dissident" web site monitoring?
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> > | Oh please! Some clerk browses the internet and you don't want to respect > | their privacy because of the IRS? This makes sense how? I suppose that > | you're going to dig up information about me and spread it around the > | internet because you have issues about the company I work for? > > First off, I was being somewhat sarcastic, as you might have > noticed from several things, not the least of which was the phrase > 'sarcasm aside.' > > That said, why should I respect the privacy of government > employees? There is a substantial difference between government and > private companies, in that I am not compelled in any way to do > business any private company. > > Adam Someone is making you let users at government sites browse your website? Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Re: Scientology tries to break PGP - and fails?
by Andrew Loewenstern 17 Dec '03

17 Dec '03

Tom Rollins writes: > If this is the file that the Co$ is trying to crack, then what the > is being asked for is a pass phrase that can be handed to the Co$ > that will pass the PGP valid key check and still not decrypt the > data to anything usefull. Well, I don't have the PGP 'conventional' encryption format memorized, but there is probably a constant after the IV that is prepended to the data. The constant is used to determine if the key is correct. Since the conventional encryption runs in CFB mode and there is a full block of random IV at the beginning of the file, it is extremely unlikely that a key could be found that would properly decrypt only the first two blocks while leaving the rest unreadable... > If Larry Wollersheim does have the valid key. It would be a simpler > process to know what fake key to use and work it backwards through > the MD5 to arrive at an ascii string to produce the fake key. Not really. Even if you could find an IDEA key that would produce the desired output it would be hard to find a passphrase that would produce that key when hashed. One of the properties of one-way hash functions is that it is difficult to find a plaintext that produces a given hash. Hence the term 'one-way'.... Even if you did find a passphrase (which, if MD5 is strong, would require something like 2^64 operations), it would likely be long, have 8-bit chars, and would be impossible to type in. It would be tough to convince anyone that it was the real passphrase. andrew

4 3

Text tracking
by Black Unicorn 17 Dec '03

17 Dec '03

On Mon, 11 Sep 1995 owner-cypherpunks(a)toad.com wrote: > Hal Finney wrote: > > > I'm not sure how to do it for software, but for novels it > > should be easy to fingerprint. Every couple of pages the > > author writes a sentence twice in different forms. This would > > not take a great deal of extra effort on the part of the > > author. > > Perhaps. Some authors might be offended by the idea that > using a different form of a sentence doesn't affect the work. Examples of "text tracking" in documents where language specificity is important (legal, scientific) are typically marked with changes in the justification scheme, i.e. the number of spaces to the right, number of lines to a page, number of pages total, etc. etc. Clearly it is much more difficult to apply in digital schemes, but consider that in order to modify the scheme to avoid traceback to the distributer, one of two conditions must exist. 1> The distributer must be close to the initial release point. (If not, then all documents ABOVE the distributer in the chain will be text tracked, and all the documents BELOW the distributer will not. Clearly this will brand the distributer). 2> The distributer must be entirely outside the 'legal' distribution scheme. Remember also that uniform modification of text tracking methods is itself identifying unless several 'illegal' distributers are using the same sanitizing method. The same way you can get surgery to have fingerprints removed, but the resulting scars make you all the more identifiable.

1 0

Re: cryptography eliminates lawyers?
by dsc＠swcp.com 17 Dec '03

17 Dec '03

Black Unicorn wrote, >But won't clients insist on proper credentials in one form or another? Yes. >Doesn't the practicality and accountability of a centralized authority >(or several authorities) provide the best answer to this? No. >Who is going >to accept my signature promising that I did indeed get a law degree and >pass the bar? Very few. Certification can be from multiple private and government organizations and might vary depending on the type of legal service (or other lawyer service) needed. Licensing can only be done by an entity that can use physical force to prevent buying and selling legal services. >I don't see how the net will eliminate the basic need for highly >qualified professionals and the proof that they have credentials. It won't. The needs might shift a little but they will be there. >Perhaps diplomas and such will be transfered into digital signatures for >the institutions, but I can't see how this "cracks" any "monopoly." >Perhaps the monopoly is shifted to those who have diplomas, rather than >those "licensed to practice" but so what? It might "crack" government enforced monopoly. Should a market monopoly survive some form of crypto-anarchy it would be in the form of a certification entity that does such a good and efficient job that it is very hard to break into the business. Not so bad if it happens, but much more honest, efficient and softer-edged than "licensed to practice". I suspect that people have needs for varying levels and varying specializations so that several kinds of certifications may develop and might be supplied by multiple entities. I suspect that many people would want a certification that a lawyer meets the usual licensing requirements of the outside world. Who knows, maybe that would be the most popular kind. But it won't be the only kind. Dar =========================================================== Dar Scott Home phone: +1 505 299 9497 Dar Scott Consulting Voice: +1 505 299 5790 8637 Horacio Place NE Email: darscott(a)aol.com Albuquerque, NM 87111 dsc(a)swcp.com Fax: +1 505 898 6525 http://www.swcp.com/~correspo/DSC/DarScott.html ===========================================================

1 0

Re: cryptography eliminates lawyers?
by Black Unicorn 17 Dec '03

17 Dec '03

On Wed, 13 Sep 1995, Dar Scott wrote: > Black Unicorn wrote, > >But won't clients insist on proper credentials in one form or another? > > Yes. > > >Doesn't the practicality and accountability of a centralized authority > >(or several authorities) provide the best answer to this? > > No. > > >Who is going > >to accept my signature promising that I did indeed get a law degree and > >pass the bar? > > Very few. > > Certification can be from multiple private and > government organizations and might vary depending > on the type of legal service (or other lawyer service) > needed. Didn't I just say this above? A centralized, or several centralized authorities. I guess the center of my question is, how can you apply Web of Trust to e.g. a university degree. Who cares what Bob and Alice think my degree is in, the client only wants to know from the institution. Licensing can only be done by an > entity that can use physical force to prevent > buying and selling legal services. I believe you are incorrect, but I guess my main concern is your characterization of "Physical force." I am assuming you mean coercion, and not that you will be jailed or such (though this may be the case). I would argue that as long as coercion exists (violence of any type, physical or not) you have a licensing authority. Take the hollywood blacklist. No one actually pushed around suspected pinko screenwriters (well, at least, if anyone did, it was incendential) but they certainly faced a great deal of persuasive motivation. Look at the committee as the licensing authority here. (Licensing you as a non-communist as it were). If several governmental and private authorities were in the practice of certifing that Bob has a law degree from Tremont University, and that he is competent to practice in D.C., and given that the citizens of D.C. will look for these credentials, isn't this a license? Afterall, Bob has to pass some test or requirement to get the signatures. Isn't this coercion in your definition? Can't the multiple authorities set common or near common guidelines? Rather, don't they HAVE to in order to have their signatures worth the electrons they are transmitted with? If you take the exteme position you seem to, there's an antitrust case here. Am I not "licensing" my key signature to people provided they pass my key signature criteria? Am I not doing violence by withholding my signature and the benefits it might convey for certain "terms?" In this definition, all trusted authorities are by definition licensing. Either their signature is worth nothing, and thus they are not coercive by witholding it, or it is worth something, and thus to be non-coercive they must give it to anyone who asks, rendering their signatures worthless. This is the trap of the licensing argument. The evil is not licensing, which I think serves a real purpose, but created convenience fees, taxation through the withholding of licensing and the use of other government largess. I wrote a massive piece on this and sent it to the list about a year and a half ago. With interest I will repost it. The real question is how you decide what an authority to license is. Is it to be dictated by government? Or by market forces (i.e. the reputation of the licenser). > > >I don't see how the net will eliminate the basic need for highly > >qualified professionals and the proof that they have credentials. > > It won't. The needs might shift a little but they > will be there. Then why will lawyers, or a 'professional monopoly' be broken? > >Perhaps diplomas and such will be transfered into digital signatures for > >the institutions, but I can't see how this "cracks" any "monopoly." > >Perhaps the monopoly is shifted to those who have diplomas, rather than > >those "licensed to practice" but so what? > > It might "crack" government enforced monopoly. Now you are getting more specific. > Should a market monopoly survive some form of > crypto-anarchy it would be in the form of a > certification entity that does such a good and > efficient job that it is very hard to break > into the business. Agreed. Again, what does this do to lawyers? See my above comments on what constitutes a license. > Not so bad if it happens, > but much more honest, efficient and softer-edged > than "licensed to practice". I'm not so sure. There will be a tremendous amount of corporate power in these authorities, and if (as you seem to be saying a few paragraphs up) it is hard to break into the trusted certification business, there is a monopoly again. > I suspect that > people have needs for varying levels and varying > specializations so that several kinds of > certifications may develop and might be supplied > by multiple entities. Like the several state Bars? Hint: An attorney licensed in Deleware has a much different speciality likely than one licensed in Alabama. > I suspect that many people would want a > certification that a lawyer meets the usual > licensing requirements of the outside world. > Who knows, maybe that would be the most popular kind. > But it won't be the only kind. So you have estentially admitted that a central authority is required? Or will be more often used? So is this a license or what? Looks like one to me. If your defintion of license is simply who does the coercing, I think you should reconsider. > Dar > > =========================================================== > Dar Scott Home phone: +1 505 299 9497 > > Dar Scott Consulting Voice: +1 505 299 5790 > 8637 Horacio Place NE Email: darscott(a)aol.com > Albuquerque, NM 87111 dsc(a)swcp.com > Fax: +1 505 898 6525 > http://www.swcp.com/~correspo/DSC/DarScott.html > =========================================================== > > >

1 0

re: CYPHERPUNK considered harmful.
by Sherry Mayo 17 Dec '03

17 Dec '03

P. Trei writes > "CYPHERPUNK" considered harmful > I would like to propose that we, the 'cypherpunks', are making a > strategic error, which will make it far more difficult to achieve the > goal we share. > Our error lies in our approach to encouraging the widespread use of > crypto. It is an error of hubris - overweening pride. > We too often think of ourselves as an elite - smarter and better in > various ways to our non-cpunk neighbours. We refer to these others as > 'Joe Sixpack" and other such derogatary terms. I think thsi is confusing two separate things. The need to publicise and encourage the use of crypto is important to many of us and lots of us do this in various ways (web pages, magazine articles etc). The other aspect of the cypherpunks is writing code, discussing protocols etc, some of which is fairly arcane stuff and is by necessity the interest of an "elite" (as you put it). I think the success of this list lies in the mixture. > I suggest that we drop the term 'cypherpunk' - it has the wrong > connotations to get our ideas into the mainstream. I don't have a > perfect replacement yet: I'll come clean and say that initially the term "cypherpunks" made me cringe (and still does, maybe 'cos I'm a brit ;-) ;-) but I certainly remembered it and it stuck in my mind enough to get me interested in this stuff in the first place. In short, don't ditch the name because if nothing else it *is* memorable, much more so that some more comventional tag. However, you do make some bloody good points about not alienating more conservative people by coming over all crypto-anarchist (or whatever your particular bent is) when encouraging/publicising the use of crypto. The "why use crypto" questions and answers was a good example of how to appeal to a more conservative viewpoint. When trying to find out about crypto intially on the WWW I was rather overwhelmed by the number of political rants and a bit underwhelmed by the lack of solid info. This situation has improved a lot in the last 2 years but still needs work IMHO. [An aside to Web page maintainers... <whinge> Another thing to consider (for Web sites in particular) is that people from _all over the world_ will be reading it. If your site is a fairly central one, bear in mind that a lot of rants about congress trampling all over the Nth amendment mean bugger all to a lot of us furriners, and come over as a bit parochial. I'm not saying a local perspective is a bad thing, just that it shouldn't be the only thing. </whinge> ] my 2c worth Sherry

1 0