December 2003 - cypherpunks-legacy

Re: require for new remailer list tag?
by futplex＠pseudonym.com 17 Dec '03

17 Dec '03

sameer suggests the creation of a new remailer list property, "permanent", to denote a remailer expected by its operator(s) to persist indefinitely. I'm curious about the potential sociological effects of such a move. I imagine that pseudonyms would be attracted to "permanent" remailers for use in their reply chains. But this phenomenon could/should be mitigated by the possibility that sting remailers would tend to advertise themselves as "permanent" (truthfully, even !), in anticipation of the bias in pseudonym remailer chain inclusion. Enemies of anonymity might specially target remailers claiming to be "permanent" for antisocial uses. This is all similar to the effects (observed and supposed) of the existing reliability ratings for remailers. But the sharp contrast of a binary property might make the effects more pronounced. Perhaps it would be useful/meaningful to note the duration (or starting date) of each remailer's term of operation, on the theory that past survival is some indicator of the chances for continued existence. Anyway, I think it would be an interesting experiment to try. -Futplex <futplex(a)pseudonym.com>

2 1

Re: textbooks
by ethridge＠Onramp.NET 17 Dec '03

17 Dec '03

>I have also heard good things about a book by Warwick Ford. "Computer Communications Security", Warwick Ford, PTR Prentice Hall, 0-13-799453-2 allen

1 0

Re: Netscape rewards are an insult
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

>> The idea that Netscape (like Microsoft) thinks they can get free >> testing services from all over the net by real experts just by offerring >> a tee shirt is down right offensive. > > >THE NETSCAPE BUGS BOUNTY > >(major snip) > > And if the security bug you find is severe as defined by Netscape, and > hasn't been previously found, and can be reproduced by us, we'll write > you a check for $1000. Ha! I reported a serious problem to Netscape ten days ago, on Thursday the twelfth. They haven't even returned an answer to my email yet nor even acknowledged its receipt. Yep, I guess that their check is in the mail .... Has anyone else seen or heard anything?? T-shirt's, mugs, checks, or email being returned or answered?? Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

2 1

COMMUNITY CONNEXION TO OFFER REWARD FOR REVEALING HOLES IN ECASH
by sameer 17 Dec '03

17 Dec '03

For Immediate Release Contact: Sameer Parekh sameer(a)c2.org 510-601-9777 (pager: 510-321-1014) COMMUNITY CONNEXION TO OFFER REWARD FOR REVEALING HOLES IN ECASH October 23, 1995 - Community ConneXion, an internet privacy provider in Berkeley, California, announced the extension of its existing "Hack" contests to the electronic cash system announced today by Digicash bv and Mark Twain Bank. "The ecash deployment an important step towards making internet commerce more than just a curiosity," said Sameer Parekh, President of Community ConneXion. The contest is meant, as with the other "Hack" promotions being run by Community ConneXion, to encourage the examination of the security of the ecash system so as to reveal holes before they are exploited by a criminal element. Community ConneXion hopes that the inquiry being done into the security of these products results in a secure infrastructure for the new paradigms provided by internet commerce. "All internet commerce systems thus far released have been based in old, out-of-date, insecure technology, such as credit cards. DigiCash is the first revolutionary system which can change the way we do business," said Parekh. "If the move to internet commerce does not radically improve the way people do business, then we have not taken full advantage of the potential inherent in the technology." Details regarding the Hack DigiCash promotion are available on Community ConneXion's webserver at http://www.c2.org/hackecash/. Contest submissions should be sent to hackecash(a)c2.org. Community ConneXion is the premier internet privacy ISP. They offer anonymous accounts, remailers, and psuedonym servers, in addition to the standard ISP fare of webspace and dialup IP access. Information is available from http://www.c2.org/ or from sending email to info(a)c2.org. Ecash, DigiCash, Cyberbucks, and Mark Twain Bank are trademarks of their respective owners. This promotion is not affiliated with DigiCash bv nor Mark Twain Bank.

1 0

pkcs7 examples
by Eric Young 17 Dec '03

17 Dec '03

Greetings peoples, I have just about finished writing routines to parse and write pkcs7 objects. I have written all the backend digital envelope routines and so now I have to decide on the the library API and test things. I currently only have a single pkcs7-signedData example, one that is being used to 'transport' x509 certificates and CRL's. Do any of you out there have pkcs-7 'objects' you can send me? I especially want examples of pkcs7 signedAndEnveloped. For those that don't know, pkcs7 is used in S/MIME and is a superset of PEM. The degenerative case of signedData is being used by protocols such as SSLv3 to transport X509 CRL's. thanks in advance. eric (whos SSL library is becoming a kitchen sink of crypto related stuff) -- Eric Young | Signature removed since it was generating AARNet: eay(a)mincom.oz.au | more followups than the message contents :-)

1 0

Re: Mondex vs. Digicash (was: Godzilla vs. Mothra)
by rah＠shipwright.com 17 Dec '03

17 Dec '03

--- begin forwarded text To: rah(a)shipwright.com (Robert Hettinga), www-buyinfo(a)allegra.att.com, ecm(a)ai.mit.edu, bsdc(a)ai.mit.edu Cc: hallam(a)w3.org Subject: Re: (cpx) Mondex vs. Digicash (was: Godzilla vs. Mothra) Date: Mon, 23 Oct 95 12:06:43 -0400 From: hallam(a)w3.org X-Mts: smtp Sender: bounce-bsdc(a)ai.mit.edu Precedence: bulk Reply-To: hallam(a)w3.org Some comments on the comments: > The availability of Digicash in the US, for real, with spender anonymity, will be announced very soon; reporter activity on this subject is consistent with an embargoed press release for Monday or Tuesday. From posts to the list it's clear that a fully working system, ready for customers, will be announced. The avbilability in the US I don't consider as meaning much one way or the other. Mondex is avaliable in Swindon in the UK, a very large and very serious real world trial. More importantly Mondex has Wells Fargo Bank behind it and NatWest and HKSB, these are major league players with very tight coupling, cross ownership of subsidiaries etc. > When doing market research on this subject, it became clear that low-value payments are largely going to be used for impulse purchases. If the Digicash system allows people to set up their accounts without getting out of their chairs (which I suspect will be the case, if they do it right), it will initially get more adopters. DigiCash will be limited to the Internet, Mondex is genuine cash, it allows offline purse to purse transactions. > One or both systems could be found to have serious security problems; who knows what the outcome of their discovery & exploitation would be? I know at least one group of people who believe they have a good line on a serious security problem in Mondex. If they have the specs they are under an NDA. If you know people who know a problem tell them to get in touch with Tim Jones, they are very keen to get the best security possible. I'm not sure that the conventional "publish everything" dogma of cypher types is valid. I don't think they are relying on security through obscurity, they simply want it in addition. Mondex is designed with two security schemes to be exchanged at overlapping four year intervals. > Even if the Mondex hardware were given away for free, think how much fun it is for the average user to add a new piece of hardware to their machines... ever install a sound card and CD-ROM drive on a PC? I remember reading something like 20% of all "multimedia" kits were returned, largely due to user install problems. If there is a competing method that costs the same and _doesn't_ require the hardware, people will tend go with this. They need it to be plug 'n play. I expect this to happen. > In my conversations with state and federal regulators, it is clear that it _is_ possible to issue spender-anonymous e-cash. If you ask them, "Hey, can I create fully anonymous digital cash?", they go apeshit, but if you explain that the money uses existing (auditable) channels going in, and existing (auditable) channels going out, and that only spenders are anonymous, they relax considerably. They may change their minds later, but we're about to get an existence proof. All I know is that at the mention of DigiCash bankers start muttering Regulation E. > It's not clear that _either_ system is going to win completely in the next 10+ years. Although there's been considerable shakeout in the last ten years, there is still a huge variety of non-electronic payment methods -- how can you be so sure that Mondex will win over Digicash, and that they won't co-exist like, say, money orders, currency and cashier's checks (three instruments with both similar and dissimilar attirbutes)? Quite probable, except that Mondex is a very credible scheme with very large and very established names behind it. I haven't heard of Mark Twain bank. I don't say that this predetermines the outcome, just that there are reasons why one might have an advantage. Phill H-B --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: FidoNet Remailer
by jgrubs＠left.webcasters.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- RobL <robl(a)on-ramp.ior.com> writes: > At 04:34 PM 10/20/95 -0400, Jim Cannell wrote: > > > >=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > > > >-----BEGIN PGP SIGNED MESSAGE----- > > > >I have been a long time lurker on this list, as well as having a long time > >interest in crypto. Most of my activity in this area has been on FidoNet > >rather than the internet. Due to the control phreak nature of much of > >FidoNet, I've spent a lot of time and effort in an attempt to just simply > >route around the bastards. I created the SecureMail system, which is a > >network of FidoNet nodes that agree to route any and all traffic without > >monitoring or censorship. Within SecureMail, encrypted traffic is not > >only permitted, it is encouraged. > > > At the end of the month, I will be putting my BBS back online with new > software which is more Fido friendly than what I had been using.. I would be The Fido remailer appears to be drawing some interest. Fidonet is often criticized (by me among many, many others) for being dull, provincial, and dominated by power phreaks. However, the Fidonet connectivity protocols have much to be admired from the 'punks perspective. Internet has great speed and bandwidth, but network routing is "hardwired." Fidonet is frequently slow and narrowband, but routing is much more flexible. The so-called "nodelist" contains the node number (the equivalent of IP number), various technical parameters, and the dial-up telephone number and availibility schedule at which e-mail/data calls can be accepted. Since the access number of every site in the network is known, you can send e-mail directly to the destination site if you wish not to use standard, fixed routing. This, plus call forwarding and laptops at pre-arranged temporary locations, means Freeh's wiretap problem is now the need to monitor every call at every ESS. Hence, his curious request for huge wiretap capacity. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: LIBERTY!! Use it or lose it!! iQCVAwUBMIvDZt74r4kaz3mVAQG74wP/XhD/g9jE/sNcP5dQWskd95yJSPgJgXac Z42Aj1QfR1fchG4v1A2iuUsaKDma3MU/whn4gqMxJPVjeat6D7wvzU0DzSj7eeSk mAjVZNnZcmGcXiTy4ueTBcdttgi0JV2g0djijOvKCGx48fMIUy8zWK9vPFe7kpkb hDzcqlpD5Xw= =ObiT -----END PGP SIGNATURE----- -- WebCasters(tm) James C. Grubs jgrubs(a)webcasters.com 6817 Maplewood Avenue Tel.: 419-882-2697 Sylvania, Oh 43560 Fax: 419-885-2814 Internet consulting, HTML programming, Information brokering

1 0

Re: Don't Kill the Messenger--A New Slant on Remailers
by Rev. Mark Grant 17 Dec '03

17 Dec '03

On Fri, 20 Oct 1995, Rev. Mark Grant wrote: > I suspect that I could easily hack this into Mixmaster in a day or two, Ok, I have an initial version that works on single-packet messages (there seems to be a lot of code duplication for multi-packet messages), and ought to have it finished off and tested by the end of the week. I doubt I'll be able to set up such a remailer, but I'll release a patch for 2.0.2 and hopefully Lance can incorporate it into the next release as a compile-time option. Mark

1 0

Saudi Arabia?
by mixmaster＠obscura.com 17 Dec '03

17 Dec '03

Does anyone know what restrictions there might be on the use of crypto (pgp) in Saudi Arabia?

1 0

Quantum Computation article
by cjl 17 Dec '03

17 Dec '03

David P. DiVincenzo from the IBM Research Division has written an article in the 13th October issue of SCIENCE magazine (vol. 270, pg. 255-261) entitled "Quantum Computation". The article is nicely divide into subsections: - Building blocks of quantum logic - Quantum circuits - Peter Shor's prime factorization - The decoherence problem - Outlook >From the outlook section "It is evident from this survey of the current state of the art in quantum experimental physics that the construction of quantum computers is presently in the most rudimentary stage, and that to even think about a procedure like Shor factorization, which might require millions of operations on thousands of qubits, might be absurdly premature." If that is the good news for Cypherpunks, then the great news is the following. ". . even a few bits of quantum computation will be very useful in performing so-called Bell measurements, which could be used to implement quantum teleportation, in which an unknown quantum state can be trasmitted to a remote location. At perhaps the 10-qubit level, a quantum computer becomes capable of performing Schumacher's quantum coding, which would be of interest in the implementation of efficient quantum cryptography. And at perhaps the 100-qubit level, a quantum computer becomes an efficient repeater for a noisy (that is partially decohered) quantum cryptographic link." It looks like the advantages of quantum computing accrue to Alice and Bob, long before it becomes useful to Eve and Mallet. A must read for aficianados of "alternative computing". Here are some URLs from the references http://vesta.physics.ucla.edu/~smolin/ (Quantum Information Page, Center for Advanced Accelerators) http://eve.physics.ox.ac.uk/QChome.html (Quantum Computation and Cryptography page, Clarendon Laboratory, Oxford University) C. J. Leonard ( / "DNA is groovy" \ / - Watson & Crick <cjl(a)welchlink.welch.jhu.edu> / \ <-- major groove ( \ Finger for public key \ ) Strong-arm for secret key / <-- minor groove Thumb-screws for pass-phrase / )

1 0