December 2003 - cypherpunks-legacy

Certificates/Anonymity/Policy/True Names
by Michael Froomkin 17 Dec '03

17 Dec '03

I have a question which is of course purely hypothetical. Suppose you were designing the legal framework that would govern the operation of Certification Authorities (the people who issue certificates vouching for public keys used for digitial signatures), called CAs for short. The CAs will operate in a hierarchical model (not a PGP-web-of-trust model), with a state agency being at the root, and issuing certificates for private CAs. You have decided to allow the private CAs to issue certificates of varying degrees of corroberation so long as the degree of verification used is deducible from the certificate. E.g. a certificate might say "we check the passport"; or "we check driver's license" or "we took blood, hair, fingprint, retinal scan and first-born child". It might even say "we checked nothing". You have also decided that a CA may issue a certificate in the name of a pseudonym, so long as the CA retains information about the True Name. Now the issue arises as to whether one should allow the CA to issue certificates to pseudonyms where it has *no record* of the real identity of the person proffering the key pair. Is there any reason why a person would want such a certificate? In other words, given that the recipient of a digital signature will easily be able to check the value of the certificate (nil), won't the transaction/communication be in all ways identical to one where there was no certificate at all. So is anything of value lost by prohibiting such a certificate? I understand, of course, that in a world where the CA has no duty to check the client's representations, there is a somewhat farcical element to this debate, but this hypothetical problem involves group decision making and groups find themselves debating irrational things. A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | mfroomki(a)umiami.ir.miami.edu U. Miami School of Law | P.O. Box 248087 | It's hot here. And humid. Coral Gables, FL 33124 USA | See http://www-swiss.ai.mit.edu/6095/articles/froomkin-metaphor/text.html and http://www.law.cornell.edu/jol/froomkin.htm

2 2

Complete Bulk Email Pkg only $49.95
by emailblaster＠mail-response.com 17 Dec '03

17 Dec '03

*Special Promotion* Complete Bulk Email Package only $49.95 including Unlimited Email Addresses (25 Million and Growing!!!). Our company is running this special promotion to allow you try out our software at an affordable price. We know that if you enjoy using this package that you will be our future customers. Our program ranks up with all the other bulk email software such as Floodgate, Email Magnet, Netcontact, Extractor Pro. etc at hundreds of dollars less!!! Why pay $399 just for a bulk email software, when you can pay $49.95 including email addresses??? HOW DOES E-MAIL BLASTER WORK? E-Mail Blaster has dozens of special filters to automatically harvest E-mail addresses from major online services such as: America OnLine, Compuserve,Delphi, Genie, and of course the internet and will email your marketing letter to 13k consumers per hour at the single push of a button!!! SPECIAL CLOAKING DEVICE: Email Blaster can successfully hide the origin of all email being sent out. Email Blaster can mask itself to look like it came from the recipients own host. This will help stop users from flaming your email box! FRIENDLY BULK EMAIL PROVIDER: Now you can have your account 100% Bullet Proof by taking advantage of our Bulk Email Provider Service for only $99 per month. This will also include your own website, 3 autoresponders, and your own domain name. SIMPLE TO USE: E-Mail Blaster does all the work for you and, unlike other E-mail programs, with E-Mail Blaster there is no need to purchase any additional software. NO SPECIAL EQUIPMENT NEEDED: E-Mail Blastert runs on a PC with Windows 3.xx Windows 95, Windows NT, a 386 or faster processor, 4 MB RAM, and a hard drive with at least 10 MB free and your own SLIP or PPP connetion. No other software needed. Also runs on a Macintosh with SoftWindows installed Plus.... Turn $99 into $995 Cash Instantly distributing "Email Blaster. This is the #1 business opportunity on the net! You become a distributor of Email Blaster for only $99 and you receive 5 Complete Email Blaster packages. Let's say you resell Email Blaster package at a discount of $199 each. $199 x 5 packages = $995 CASH!!! Your potential is unlimited! This price is a Special Promotion and is only available to new distributors!!! Our distributor package normally sells for $199. Take advantage of these low prices for the month of July now and reserve as many copies as you want. he more you buy the more $$$ you can make!!! Price List 5 Packages: $99 10 Packages: $149 20 Packages $299. Larger quantity discounts are available upon request. Benefits of becoming a Distributor Now: 50% Discount for the month of July No Shipping (You simply refer all your customers to our website to download their package.) No postage No inventory (We keep track of how many packages you have and how many you sold electronically.) No hassles (We have full tech support that will assist your customers for you! This is invaluable!!!) No need to worry about payment methods ( We can assist you in obtaining a method of being able to accept major credits and 900# service for billing. No credit checks or approval necessary!!!) Plus.... You will be able to distribute all future software programs and receive the best prices!!! Additional questions (No problem, call our office at: 609-933-3527 What are you waiting for start making money today SIGN UP NOW!!! ********************************************************************************************************** To take advantage of this opportunity, please fill out the order form below and fax or mail to: Internet Marketing P.O. Box 276 Bellmawr, NJ 08099 Phone: 609-933-3527 Fax: 609-933-1499 Don't miss out on this opportunity! Special Promotion!!! Name: _____________________________________________________ Address:____________________________________________________ City:___________________________________________ State:___________________________ Zip:_____________________________ Telephone::_____________________________________________ E-Mail Address:__________________________________________ Once we receive your order, you will receive a confirmation by email, informing you of our tech support number , website address so you may go and download your packages immediately and info on our Bulk Email Provider Service. No need to ever wait for a package in the mail!!! ---------------------------------------------------------------------------------------------------------------------------------- "COMPLETE EMAIL BLASTER PACKAGE" only $49.95 ________ 1 Copy of Email Blaster 1 Electronic Help System: Email Blaster Help System will provide you with step by step directions on how to use Email Blaster and help with setting up your provider. For your convience this is built right into your copy of Email Blaster. Unlimited Email Addresses: 25 Million And Growing Our Email Addresses are updated monthly. You can download these addresses right from our website at your convenience. ----------------------------------------------------------------------------------------------------------------------------------------- 5 DISTRIBUTOR PACKAGE only $99: _________ This is a Special Promotion to new distributors only!!! 5 Copies of Email Blaster 5 Electronic Help System:Email Blaster Help System will provide you with step by step directions on how to use Email Blaster and help with setting up your provider. For your convience this is built right into your copy of Email Blaster. 5 Unlimited Email Addresses: 25 Million And Growing Our Email Addresses are updated monthly. You can download these addresses right from our website at your convenience. Now you can take advantage of Email Blaster Package and resell each package up to $299. each. You make $1495 10 DISTRIBUTOR PACK only $149. _______ Includes 10 Complete Packages of Email Blaster. You can make up to $2990.00 20 DISTRIBUTOR PACK: ONLY $299 ________ Includes 20 Complete Packages of Email Blaster. You can make up to $5980.00 ************************************************************************************************* If you would like to pay by check, please make check payable to: Internet Marketing mail to: PO Box 276 Bellmawr, NJ 08099 or Fax to 1-609-933-1499 along with this order form. If you are paying with a Fax Check please include an additional $3.00 for check processing fees. Credit Card: _______________________________________________ Visa, Master Card and AMEX. EXP. Date: _____________________ Total to be charged: $________________________ Signature:___________________________________________________________ 3024

1 0

Re: SSL challenge -- broken !
by goedel＠tezcat.com 17 Dec '03

17 Dec '03

David Neal wrote: >On 18 Aug 1995, Panzer Boy wrote: >> John Pettitt (jpp(a)software.net) wrote: >> : Huh? So you run on 120 workstations worth how much? to steal a credit >> : card number worth how much? Get real - there are hundreds of ways >> : to get credit card numbers that cost less. >> >> Has anyone thought about starting up a distributed rc4 cracking web. >> Send in your message to a web server form, it will then spawn of requests >> to a pool of machines willing to try cracking rc4 for you. Allow anyone >> to offer up spare cycles towards the effort. >> > >I suggested that very thing just yesterday in the list, but my message >seems to have gone awry. In short, I suggested we use E-Cash payments >for cracking efforts. This would establish a reward for participating >and an 'exchange rate' for e-cash at the same time. I'd we willing to set up a "crackweb" mailing list, or perhaps a site to register your machine(s) with % available and MIPS ratings. DJK

1 0

Cypherpunks' ideal escrow agent
by Childers James 17 Dec '03

17 Dec '03

I've seen the idea of voluntary key escrow discussed before on this list. (And no, not the government's idea of "voluntary", either.) A question I would raise is this: What would be the ideal setup for an escrow agency? If I were to open up an agency for business, what would be some characteristics you would look for? "Freedom is meaningless unless | ic58(a)jove.acs.unt.edu - James Childers you can give to those with whom| No man's freedom is safe you disagree." - Jefferson | while Congress is in session EA 73 53 12 4E 08 27 6C 21 64 28 51 92 0E 7C F7

2 1

Cryptography Question (I hope it's not off-topic on this list)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

I was thinking about *chaining* remailers and wondered if encryption of a certain strength could be *chained* in order to make it as strong as stronger encryption. e.g. - If only 56-bit encryption becomes legal, is there a method of *chaining* several passes of 48-bit encryption which would make it just as hard to break as 96/192/384-bit (etc.) encryption? If this is indeed impossible, then perhaps the government might pass a law that makes it illegal to encrypt an encrypted file, but experience seems to suggest that any law passed always leaves a loophole or back door for inventive people to circumvent it. CyberDoc

3 2

Re: Exportable if Escrowed Changes Nothing!
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

Joey Grasty writes: > Governments: can't live with 'em, can't shoot 'em. ^^^^^^^^^^^^^^^ It is precisely this kind of self-defeating pessimism that has allowed the current state of affairs to develop.

1 0

Re: Cypherpunks' ideal escrow agent
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- James Childers <ic58(a)jove.acs.unt.edu> wrote: >I've seen the idea of voluntary key escrow discussed before on this list. >(And no, not the government's idea of "voluntary", either.) A question I >would raise is this: What would be the ideal setup for an escrow agency? >If I were to open up an agency for business, what would be some >characteristics you would look for? Exactly what the government *doesn't* want, I'm afraid... I would want them to honor *only* warrants which involve crimes dealing with at least the possibility of an individual, articulable victim. Despite much hot wind about "terrorism" from the FBI to the contrary, the reason for "GAK" [I liked "FUCKED" better] is to allow prosecuting the tax-and-spend drug war to remain possible. Also, the temptation to ignore any warrant requirement and screen *political* e-mail if a "minor" political party started to gain prominence would be nearly overwhelming to any non-angels with "real-time" decryption capability. Political debates these days are (obviously) won by sound bite, and advisors want to be prepared for a sound "byte" such as "tax-and-spend drug war" [Oops, can't use that one now!] :) flying through cyberspace toward an opponent, just as Reagan was (supposedly) prepared for Carter's lines before their debates. <zipping up my Nomex bodysuit now...> JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMDUDZ21lp8bpvW01AQFx0wP/b5c5xTxyGygbTcRJriErK9dD0ahfFXEu SSpqmExn+E+aD6tYNQNEDS50pnT8wOI7IKQjVLGGEZKfmeZRIU7gnT0jttbHV14c QnMGkMsEsVK3R2YkWPGavhPeJwdrwHrvYC/xUFzrtSJHQQ1u7X3LXubjS2vikcVJ mxqfYoUympA= =YEMs -----END PGP SIGNATURE----- Regards, Jim Ray "The important thing is not to stop questioning. Curiosity has its own reason for existing. One cannot help but be in awe when he contemplates the mysteries of eternity, of life, of the marvelous structures of reality. It is enough if one merely tries to comprehend a little of this mystery every day. Never lose a holy curiosity." -- Albert Einstein ------------------------------------------------------------------------ PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 ------------------------------------------------------------------------ Support the Phil Zimmermann (Author of PGP) Legal Defense Fund! email: zldf(a)clark.net or visit http://www.netresponse.com/zldf ________________________________________________________________________

1 0

News from the Front (July Issue)
by news＠sldc.ffg.com 17 Dec '03

17 Dec '03

An update to our customers and friends on happenings at ----------------------------------------------------------------------- F O R E F R O N T - Taking the Chaos out of the 'Net http://www.ffg.com Newsletter 7/23/97 ----------------------------------------------------------------------- Contents: I. News from the 'Front II. Hot Tip III. Special Offer ----------------------------------------------------------------------- I. News from the 'Front ForeFront enrolls hundreds in FREE e-mail course! ForeFront unveils its Internet Research Course, the first of ForeFront's free e-mail courses helping Internet users become more productive. - http://www.ffg.com/courses/internetresearch.htm WebSeeker Special Editions Released! In addition to searching the Web, WebSeeker Legal Research Edition searches over 35 search engines specific to the Legal Profession. Get your own >online legal assistant now! - http://www.ffg.com/seeker/lre.htm TechSeeker searches over 100 online technical resources, including the popular online press, standard search engines, and Usenet Newsgroups. Let TechSeeker find the technical information you need right now! - http://www.ffg.com/seeker/techseeker.html GrabNet update released online! - http://www.ffg.com/grabnet/ GrabNet, ForeFront's amazing bookmarking tool, allows you to quickly and easily organize everything of interest you come across, web page, graphics, or text! A must have for anyone compiling online information. Brother's newest Printers now come with ForeFront's Internet Products! - http://www.ffg.com/press/05_97brother.html ForeFront Introduces MCSE Self-Study Course! - http://www.ffg.com/press/05_97MCSE.html Now you can easily prepare to become a Microsoft Certified Software Engineer, the hottest certification around! ForeFront Streamlines NetWare Administration with ConsolePro! - http://www.ffg.com/press/5-97ConsolePro.html Tame your Netware Network directly from the Server! ----------------------------------------------------------------------- II. Tip o' the Day Tired of Downloading Lots of Files you don't want with WebWhacker? WebWhacker 3 only downloads what you want! If you are tired of using precious disk space up with useless files downloaded by WebWhacker, then you need WebWhacker 3's Content Filters! With these filters you can choose not to download any files with certain file extensions, files that are too large, or secific MIME types. For example you could choose to only download .WAV files and not .AU if you had Windows 95 and not a Macintosh, and only if the files were less than 100KB in size. There is no end to the filter combinations you can use! To use the Content Filters, click the Content Filters... button on the second step of the URL Subscription Wizard or view the Filters Tab of a URL's Properties. If you don't have WebWhacker 3 then buy it now! - http://www.ffg.com/whacker/ If you have an earlier version of WebWhacker then upgrade now! - http://www.ffg.com/whacker/wwupgrade.html ----------------------------------------------------------------------- III. Special Offer FREE GrabNet! ForeFront would like to offer you, our V.I.P.'s, the new version of GrabNet, for FREE! All you need to do is purchase a copy of WebSeeker! With this dynamic duo you can find and organize everything of interest on the Internet! Take advantage of this opportunity at http://store.ffg.com/seeker_special/ ----------------------------------------------------------------------- This newsletter is only sent to those who requested the newsletter and those who downloaded, registered, or evaluated our software. If you wish to unsubscribe from the ForeFront newsletter mailing list, please visit http://www.ffg.com/press to Unsubscribe.

1 0

Re: Certificates/Anonymity/Policy/True Names
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:47 PM 8/18/95, Michael Froomkin wrote: >I have a question which is of course purely hypothetical. > >Suppose you were designing the legal framework that would govern the >operation of Certification Authorities (the people who issue certificates >vouching for public keys used for digitial signatures), called CAs for >short. The CAs will operate in a hierarchical model (not a >PGP-web-of-trust model), with a state agency being at the root, and >issuing certificates for private CAs. I don't see any basis for having a state agency as the root...lots of things that are grounded in law have no origin/connection to the state. But, I'll assume your hypothetical (though I think the assumption that government = root leads down a dangerous path). >You have decided to allow the private CAs to issue certificates of varying >degrees of corroberation so long as the degree of verification used is >deducible from the certificate. E.g. a certificate might say "we check >the passport"; or "we check driver's license" or "we took blood, hair, >fingprint, retinal scan and first-born child". It might even say "we >checked nothing". You have also decided that a CA may issue a certificate >in the name of a pseudonym, so long as the CA retains information about >the True Name. Now the issue arises as to whether one should allow the CA >to issue certificates to pseudonyms where it has *no record* of the real >identity of the person proffering the key pair. It all depends on what the purpose of certification is in the first place, and whether alternative heierarchies of certification exist outside the one that has government as root. For example, I may instantiate many keys for use in experiments, or as agents in a market microworld, and I may "vouch" for them. These "agents" have no True Name, are not persons, but still have varying levels of certification (to me, at least) A company may even have multiple agents. Multiple departments, multiple users, etc. The web-of-trust model, which, loosely phrased, says "I say I believe this is the key of so-and-so, and you can believe me or not. We don't need no steenking badges!" The beauty of this is that any person or program can generate lots and lots of keys, for experiments, agents, etc. Now if it is desired to have the "legal system" mesh with this certification process, the governemnt is still not needed. Contract law suffices. If the Alice Corporation claims the Bob Company signed a document with a fraudulent key )or whatever the scenario might be), then each side can present in a court what the contracts they agreed to said and what the facts were. This happens all the time, though "I am not a lawyer," in disputes about whether a contract was signed properly, about whether the signer had the right authority, etc. And it is apparently not necessary to have the "state" establish itself, for example, as the keeper of signatures. I concede that there is a path back to the legal "is-a-person" status of parties, such as credentials for identity. In cases involving software agents and "virtual persons" (which is where key certification tends to come in), a stipulation can be made that a Real Person is to be involved in the loop. >Is there any reason why a person would want such a certificate? In other >words, given that the recipient of a digital signature will easily be >able to check the value of the certificate (nil), won't the >transaction/communication be in all ways identical to one where there was >no certificate at all. So is anything of value lost by prohibiting such >a certificate? So long as I am not prohibited from getting together with others (on a list like our, in a corporation, with offshore folks, etc.) and setting up our own system--of whatever nature--then I suppose it doesn't matter. But you ask "So is anything of value lost by prohibiting such a certificate?" Well, why prohibit something unless a real and compelling problem exists? it might turn out to be very useful to have certificates even for keys that belong to entities or agents that have no True Name attached to them. I've given some examples, and can think of more. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

2 1

Economic Model for Key Cracking
by cman＠communities.com 17 Dec '03

17 Dec '03

So far, list members have mostly presented two points of view on the economics of key cracking: o It's free, since it uses spare CPU cycles o It should be priced at the cost of the dedicated computer hardware needed to do it. Both of these approaches are wrong. The first approach fails because it doesn't scale -- there probably aren't enough people willing to crack lots of keys purely for the research interest, hack value, or the goodness of their heart. At the same time, many people and companies have lots of unused CPU time on their hands. Economically, this CPU time is scrap material -- and there are companies out there that do nothing but buy up scrap equipment for pennies on the dollar. Therefore it should be possible to create a market in spare CPU cycles for tasks like this that require massive parallel computing. An earlier suggestion for bounties on keys (basically the Chinese lottery approach) is a step in this direction. I'd also like to point out that a hacker who can sniff out SSL-encrypted packets on a hacked network is going to be vastly harder to catch than someone who trolls through his or her physical community dumpster diving and bribing clerks. The ability to anonymously gather and decrypt credit card numbers has a vastly lower "cost" in terms of likelyhood of prosecution. If it drops down to under $100 per key, it's probably at a good break-even point to do it wholesale. Certainly the out-of-pocket cost of cracking a 40-bit SSL key is less than that right now for a great many people, even without creating a market.

3 2