December 2003 - cypherpunks-legacy

crypto export from the UK
by sameer 17 Dec '03

17 Dec '03

Could people in the UK please tell me what the crypto export laws are like there? I know someone who wrote some really great crypto code in the UK but isn't willing to distribute it because of crypto export laws... I was under the impression that it was legal to export crypto from the UK. -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

1 0

Re: Anonymity: A Modest Proposal
by tomw＠orac.engr.sgi.com 17 Dec '03

17 Dec '03

In article <DGoAr7.L5s(a)sgi.sgi.com>, kelso(a)netcom.com (kelso) writes: > Hi, > One method to take the heat off of the last remailer > in a chain would be to call on our friend the "one > time pad". A message is split into two equal parts > that only make sense when the two parts are 'xor'ed > together. The seperate parts are then sent through > different paths to the final recepiant (or newsgroup). > The reader would have to 'xor' the parts together in > order to read the message. The remailer could not be > blamed (as the message was unreadable to him). > The drawback is that the message would be unreadable > until both pieces showed up. No, the drawback is that then all the readers of the newsgroup would complain that this remailer was cluttering up the newsgroup with unreadable garbage. Twice. Here's another modest proposal. I note that once you've sent a message, there appears to be no way for a recipient to reply without knowing who the originator is. A simple addition to the remailer protocol would be to encrypt the message and the control information seperately. This would allow the sender of a message to provide a pre-packaged method for returning a reply. The recipient of the original message could then just blindly send his reply to the starting point remailer specified in the original message by tacking the pre-packaged routing information on to the front of his message. -- Sure we spend a lot of money, but that doesn't mean | Tom Weinstein we *do* anything. -- Washington DC motto | tomw(a)engr.sgi.com

2 1

Re: MKE Threat Assessments
by futplex＠pseudonym.com 17 Dec '03

17 Dec '03

[quotes pulled out of context, sorry] > I also strongly believe that you gravely overestimate the threat of MKE, I like to think of MKE in terms of a scenario like the Watergate break-in. Imagine that Haldeman and Dean pull the right strings to get Liddy the escrowed keys used by the Democratic National Cmte. to encrypt their campaign plans. George Bush's favorite millstone, J. Danforth Quayle, seemed to do a pretty good job of manipulating the legal system when it looked like Brett Kimberlin wanted to chat with the media about his pot customers. I believe this sort of abuse is a significant threat. > [and] probably overestimate the interest LEAs have in your personal affairs, Ordinarily, I'd say you're right (speaking only for myself). But I suspect that my active contributions to this list may have put my name in somebody's Oracle database. (I certainly underestimated the LEAs' interest in Leonard Bernstein's personal affairs.) What a waste of time and tax dollars ! -Futplex <futplex(a)pseudonym.com>

1 0

Re: Simple Hardware RNG Idea
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 8:20 PM 10/5/95, Simon Spero wrote: >On Thu, 5 Oct 1995, Norman Hardy wrote: .... >> You presumably use the oddness of the count for your random bit in some >> predetermined time interval. External radiation can change, but not bias >> the parity. If the counter saturates, the counter may be biased towards one > >Hmmm. But isn't this method slightly biased? If the probability of N >events < the probability of N+1 events, wouldn't you need a large number >of events per bit to make the bias insignificant? .... What you really need is entropy (information). I propose concatenating several counts and sending them thru MD5. The counts are distributed the same way but are independent so that the entropy of the concatenation is the sum of the entropies. Each count has a Poisson distribution. That tells you how many bits of entropy there are in the input to the MD5. Take that many bits, rounded down, as your random bits. If there are an average of x bits in a time interval then the probability that the count will be exactly K is (x^K/(K!))exp(-x). That is the Poisson distribution. The entropy is then: - sum[i=0 to infinity] (x^K/(K!))exp(-x)log( (x^K/(K!))exp(-x)) = - sum[i=0 to infinity] (x^K/(K!))exp(-x)(log(x^K/(K!)) - x) = - sum[i=0 to infinity] (x^K/(K!))exp(-x)(K*log(x) - log(K!) - x) Here is a klutzy Scheme program to evaluate these: (define (sum g)(letrec ((ss (lambda (n) (if (= n 0) (g 0) (+ (g n) (ss (- n 1))))))) (ss 30))) (define (log2 x)(/ (log x)(log 2))) (define (fact n)(if (= n 0) 1 (* n (fact (- n 1))))) (define (p x k) (* (/ (expt x k)(fact k))(exp (- x)))) (define (en n)(sum (lambda(x) (let ((c (p x n))) (if (= c 0) 0 (* c (log2 c))))))) (en 1) => 2.07 (en 3) => 2.92 (en 10) => 3.73 (en 15) => 4.0 I.e. if 1 count is expected on average there are two bits of entropy in the count (supprising!) and if the count averages 10 then there are 3.7 bits worth. It goes up as the log. Before you bet your enterprise on this scheme consider that the math was done at 03:30 AM.

1 0

How was the Federal thing?
by carolann＠censored.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Can someone please offer a suummary of the Federal Courthouse thing? Love Always, Carol Anne...now hooked on "Court Cypherpunk" -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMIbw3IrpjEWs1wBlAQGbnwQAjzxulfm3DEporCzZic9Jb6Isq1Jvx8yU M0y/e7npkNc+lVJ5M+aieFiGBormWsiYvAzGBqhK4H9OXs2J+HQX5sDs4LO9jqLj 52x5yc8djJN1opMdmi9g+V5/A8MzpBz32v9QzbRrZAAcRwWf9r9BK9edfvlhWqko fZk8kv1F+8s= =CrJS -----END PGP SIGNATURE----- -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

1 0

SciAm's Crypto Stego Pushup
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Scientific American, November, 1995 Doing Business on the Net By Anne Eisenberg Like the leaves of autumn, those resolutely noncommercial days on the Internet when ads were anathema are dwindling fast. Nowadays the Internet's World Wide Web has so much commercial promise that it has spun off an association called the HTML Writers' Guild (http: //www.mindspring.com). You can hire one of its members literate in Hypertext Mark-up Language (HTML is the language of the Web) to create dramatic "home pages," sites on the Web where a growing number of businesses advertise their wares. "We're there for the same reason we have banks in malls," one Citibank executive explained. "It's where people congregate." Web ads are quickly evolving into arresting combinations of sound, text and vivid, point-and-click picture links called image maps. Computer science students who were once stern critics of business on the Net now eye the ads appreciatively, so long as they are not "in your face" -- inserted where people have no choice but to look at them. Besides, commercials may one day pay for Net services, much as they now underwrite programs on radio and television. And the ads are convenient: click on the icon, read about the product and order, all in one step. Many companies arc poised to put not only advertisements but entire catalogues on the Web as routinely as they now list their services in me Yellow Pages. After all, if e-mail could hatch a generation of letter writers by eliminating the bother of envelopes and stamps, surely commerce should blossom when paper catalogues fall, and we all start buying straight from the screen. For business to thrive, though, people will need a secure way to pay and be paid on the leaky Net, where messages containing credit-card numbers can be intercepted as they travel from machine to machine. And all those prospective shoppers, entrepreneurs and micromerchants will want not only secure payment mechanisms but also a choice -- cash, check or charge -- before they hit the convenient, brightly colored order links. Inspired by a vision of untold millions buying and selling on the Net, companies and banks (among them Chase Manhattan, Citibank, CyberCash, DigiCash, Mondex and Microsoft) have joined what is being called the Gold Rush of 1995, as they race to become the Great Central Biller in the Sky. No victors have yet emerged, but early leaders are probably going to provide security in the form of public-key, (PK) cryptography, ingenious algorithms that use pairs of unique numerical "keys" for encoding and decoding messages. If you use PK software for an online shopping trip, you will have your own pair of keys, one public and one as private as the identification number you use to get cash from an automated teller machine. When you order, your program will automatically encrypt the information with your private key. When the company uses your public key to decode the order, it will know without question that the message was generated by you -- the match is the digital signature that authenticates the transaction. Companies in turn will encrypt messages to you with your public key; the messages will be secure, for only you can decrypt and read them, using your private key. Netscape and other new Web browsers -- software that lets you travel to linked Internet resources without typing complicated addresses -- are known as encrypting browsers; they are ready to help you shop securely on the Net. Some will even come with built-in PK signatures. Whether the cryptographically cloaked digits of e-money will bestow privacy in addition to security is another, far more contentious matter. When people start using e-wallets instead of cash to rent a video or lend a friend $20, fertile new areas for infringing on privacy will bloom. Electronic dossiers can be compiled by automated systems that track spending habits. Many people will not want the details of their daily lives collected and stored in, say, consumer preference data banks, joining the folders that already document their health and credit ratings. Only a few of the emerging electronic payment systems address privacy issues. The untraceable digital cash closest to hand is probably Chaumian cash, named in honor of David Chaum, founder of DigiCash and of the cryptographic protocols that underlie his anonymous digital-money technology. Chaum's patented e-cash is an adaptation of PK cryptography that includes one-way privacy for the payer. The bank can verify that the money is genuine but is blinded from identifying the source. This means you will be able to prove you have made a payment when you need to, but the bank cannot flick a switch to retrieve the records of your travel and entertainment preferences and add them to its data-mining operations. The terminology of electronic commerce reflects the clash of cultures that has come about as the youthful language of the Net meets the austere discourse of banking. The jaunty "e-" prefix has attached itself firmly to Nettish talk of the e-wallets and e-purses that we will soon be using to make our e-payments. But bankers resist this linguistic cheeriness. They substitute "digital" for "electronic" whenever possible and never shorten it to "d-" when they speak of the digital time stamps and digital signatures they will soon offer us to authenticate our digital payments. And cryptography (known affectionately as crypto on the Net) is still a four-syllable word at the bank, where it is against nature for managers to be linguistically fond of any action that commits them to untraceable communications and exchanges. We will know the new, hybrid field of electronic commerce is truly on its way when banking ads on the Web offer "strong crypto" and even, as a backup, steganography (the science of hiding the existence of messages in, say, microdots or sound files) for telephone chats with loan officers. On the Net, of course, this service is already known as stego. ----- Anne Eisenberg (aeisenb(a)duke.poly.edu) conducts her e-business at Polytechnic University in Brooklyn, N.Y.

1 0

Re: DalSemi: Add-Only Memory for Storage of Digital Cash (fwd)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:46 PM 10/19/95, Nathan Loofbourrow wrote: (quoting someone else...) > > Perhaps someone with more semiconductor physics background > > can correct me, but my understanding is that some kinds of nuclear > > radiation can be used to erase OTP EPROMS. I suppose this might damage Sure, x-rays can erase EPROM cells. (Not the dosages found in airport x-ray machines, anticipating the usual question someone raises when they hear this.) > > the crystal lattice badly enough to render the device useless in > > some bit positions or reduce data retention time a lot, but I sure > > wouldn't bet any security on devices out there not being > > arbitrarily reprogrammable (thus using bits to represent digital > > coins in a wallet that get reset when they are spent is not a > > good idea). The details of whether one can x-ray (or gamma-ray, etc.) erase a one-time programmable (OTP) device without semi-permanently damaging it depend on a lot of factors. Generally, an EPROM-based OTP device will erase under irradiation before it is damaged. (At least this was my experience. Your erasage may vary.) >You might want to take a look at the paper I mentioned, then: I >believe that irradiation of the OTP EPROM to return all bits to "ones" >is too blunt a tool to do you any good. A virgin EPROM has a value of >zero in the suggested scheme. And, as mentioned, flipping random sets >of bits is strongly likely to get you caught. Whether a floating gate empty of electrons ("erased") is considered to be a "zero" or a "one" is wholly dependent on conventions in the design....one manufacturer may treat "erased" bits as zeroes, another as ones. (The sense of the charge may invert several times on the way through the sense amplifiers and decoding logic.) Bottom line: I'd take a bet that I could bulk-erase a Dallas Semi chip without damaging it permanently, even if lacked a transparent lid. But I wouldn't take a bet that I can then reprogram it so as to spoof another such chip. Continuing on to some other points: >I seem to remember PROMs actually undergoing physical, rather than >electrical, state changes (that were presumably nonreversible). Am I >recalling old technology, or am I just plain mistaken? There are several kinds of "programmable read-only memories" (PROMs): * Fusible-link PROMs, in which a silicon, nichrome, or other fuse is "blown" by passing an appropriate current through the fuse. These are indeed nonreversible changes (though a failure mechanism is for fuses to "grow back"). And there are variants involving "anti-fuses." * _Erasable_ PROMs, in two main categories: - UV-EPROMs, or just EPROMs, in which a dosage of UV light through a transparent window (quartz or sapphire) erases the EPROM cells. This works by the UV photons supply enough energy to the electrons stored in isolated ("floating") polysilicon gates so tha they leave the floating gates and are conducted away. Programming is done by forcing electrons to be avalanche-injected onto the floating gates. - EE-PROMs, or EEPROMs, or "E-squared PROMs," in which UV light is not needed. A suitable electrical bias can cause a cell to be erased (i.e., to allow electrons on floating gates to leave). * And there are all sorts of wrinkles, variants, and other issues: - Transparent lids vs. no lids. EEPROMs obviously need no transparent lids. Even EPROMs may be built without transparent lids, if the intended use is for customers to program them _once_ and only once ("OTP"). - Bit-erase vs. block-erase. Whether individual bits in an EEPROM can be erased without neighboring bits being erased. A design issue. (Obviously UV-EPROMs are only used in block-erase situations, where the block is the entire memory.) Intel built a "Key-PROM," circa 1983-5, in which the innards were somewhat encrypted against outside-reading. My electron-beam testing lab was able to image the internal states of these devices and so bypass the encryption. (But it was enough for casual use to foil certain types of copying.) I hope this helps. Semiconductor physics is its own specialty, like crypto. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

STT - useable in real life ?
by lyalc＠ozemail.com.au 17 Dec '03

17 Dec '03

>From reading the STT specs, a 'credential' is made up of typically 4 certificates - root, country CA, issuer Ca, and cardholder/merchant. Two certificates are based upon a 1024 bit public keys, 1 (root) is 2048 while the cardholder PK is 512/768 bit. I believe a decrypt operation is required to verify each certificate. I have seen test result from a local crypto company which indicate a 1024 bit decrypt operation will take between 2.5-30 seconds (Pentium 90 - 386/33 - I am trying to relate this to userland, not the well equipped cybernaut). PK encrypt is somewhat faster. On this basis, a credential verify will take 10+ seconds up to several minutes, on this range of equipment. This seems to take a significant amount of time in verifying certificates. This situation will only get worse as renewal certificates are appended to existing certificates. Can someone comment, or steer me in the right direction if I have misunderstood certificate verification ? Working for a bank who may have to use this one day, customer impact is a big deal - we can afford specialised hardware, but not all our customers can. thanks for any clarification, lyal All mistakes in this message belong to me - you should not use them!

2 1

Oppenheimer Quote Regarding Government Secrecy and Public Policy
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

Rather liked this quote regarding the development of the super in the 1950s. J. Robert Oppenheimer, "Atomic Weapons and American Policy," Foreign Affairs, Vol. 31, No. 4, July 1953, p. 525. [We must have] candor on the part of the officials of the United States Government to the officials, the representatives, the people of their country. We do not operate well when the important facts, the essential conditions, which limit and determine our choices are unknown. We do not operate well when they are known, in secrecy and in fear, only to a few men. The political vitality of our country largely derives form two sources. One is the interplay, the conflict of opinion and debate, in may diverse and complex agencies, legislative and executive, which contribute to the making of policy. The other is a public opinion which is based on confidence that it knows the truth. Today public opinion cannot exist in this field. No responsible person will hazard and opinion in a field where he believes that there is somebody else who knows the true, and where he believes that he does not know it. ------------------------- Regards, I hate people when they aren't polite - Talking Heads Joseph M. Reagle Jr. http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu 0C 69 D4 E8 F2 70 24 33 B4 5E 5E EC 35 E6 FB 88

1 0

ABA guidelines no longer read-only
by Michael Froomkin 17 Dec '03

17 Dec '03

I am informed by the webmaster of the page holding the guidelines that the Section leadership has authorized him to make the text downloadable and that he will make it available in various formats very soon. This desirable result was, however, in no way helped by what I am also informed was juvenile and in at lest one instance threatening email sent to the parties involved. That the mail identified itself as originating from members of this list -- and in response to my message announcing the site existed -- can only have the result of devaluing any comment I and other people on this list may make. Not a pretty sight. A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | U. Miami School of Law | froomkin(a)law.miami.edu P.O. Box 248087 | http://www.law.miami.edu/~froomkin Coral Gables, FL 33124 USA | It's hot here. And humid.

1 0