December 2003 - cypherpunks-legacy

CAS_bah
by John Young 17 Dec '03

17 Dec '03

10-22-95. NYPaper: "High Stakes, High Tech. Imagine the Internet As Electronic Casino." Mr. Fields is the former director of Darpa. He now hopes to transform the Internet, developed to defeat the evil empire, into a powerful medium for indulging America's growing weakness for wagering, to bring casinos to the people -- and into the center of American life, the home. "When I was looking around for what I would do next I decided to do something in the entertainment and gaming industries because they're now the greatest users of advanced technologies," Mr. Fields said. "It used to be the defense industry." CAS_bah (6 kb)

1 0

Re: CJR returned to sender
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:30 AM 10/26/95, Jeff Weinstein wrote: > Should they also reject the same content (RSA-PERL) delivered >in any of the following ways: > > Printed on paper > Printed on paper in OCR font > Printed on paper in barcode > Printed on paper with magnetic ink (like checks) > > The lines being drawn here seem very arbitrary. I'll try to think like a bureaucrat responsible for actually trying to limit the export of weapons, munitions, cluster bombs, nerve gases, secure communications gear, crypto tools, etc. My test would be this: "Is the product actually usable by an adversary or helpful to them in any major way as a tangible product?" (I have no idea of what their review criteria are, just suggesting some plausible considerations.) How different products get evaluated by these criteria: * cruise missiles -- Yes. * designs for cruise missiles -- Yes. Blueprints, especially. Books are more problematic, as the U.S. has no tendency to screen books for publication, and no border checks for books. (Not that outgoing luggage ever gets checked anyway.) * functional crypto systems, such as RSA products or PGP -- Yes, thinking as a bureaucrat. (I won't argue the effectiveness of such steps, or the ultimate futility of trying to control software export.) * "RSA in Perl," even in machine-readable form. I would not block export of it, as it is not a "usable system" (no key management, unwieldy to use). The proof of the pudding: how many people are using "RSA in Perl" to actually communicate? How many Pablo Escobars or Saddam Husseins are likely to ever use it? (If the argument that the few lines of RSA in Perl "give away" the secret of RSA, this is bogus. The core steps are widely, widely (did I say "widely") known, and are standard programming examples. One of the first things I did in Mathematica, several years ago, was to code up "RSA in Mathematica"...took about 15 lines, without much effort to compact it.) * "RSA in Perl" on an unreadable t-shirt. Yes. Yes, thinking as a bureaucrat I would certainly approve it. Or try to lose it, return it unopened, etc., knowing full well the CJR was being done as a publicity stunt (well, isn't it?) and that reporters were waiting to make the State Department look foolish by reporting: "State Department Rules "Munitions T-Shirt" May Be Exported!" (Or to look just as foolish by rejecting it.) --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Re: 80 bit security from 40 bit exportable products
by Carl Ellison 17 Dec '03

17 Dec '03

>Even if you assume complete independence of key setup, if a successful >decryption at each layer can be independently detected and verified >(which seems likely in your example), there're only about 3 * (2 ^ 40) >total operations in the worst case, NOT 2 ^ (3 * 40) operations needed >to expose the plaintext. This is an effective 41.5 bits, not 120. > Of course. It comes down to whether each encryption step plans some known plaintext to be used for brute force testing of any next layer.

1 0

Re: [Noise] Perrynoia in the Comics
by Alan Olsen 17 Dec '03

17 Dec '03

At 08:13 AM 10/26/95 -0400, you wrote: > >Alan Olsen writes: >> This has no real crypto relevence, but some anarchistic relevence. > >Alan; > >As much as I found the comment interesting, it probably belonged >somewhere like libernet-d, not here on cypherpunks. I posted it on Cypherpunks becuase it is the only list I take where such political views are even mentioned. I thought that people on the list would enjoy it. I prefaced it with [noise[] so that people who would object would skip over it. Evidently that disclaimer is not enough anymore. >[I'm posting this in public, as I do about one in ten such messages, >so that a wider audience of people will be discouraged from posting >such things in advance. Don't bother mailing me a message saying "you >are adding to the noise yourself, why not mail in private" -- I do >that 90% of the time. Sometimes the nose levels rise enough that I >feel that a few public mentions would do some good.] I am not certain as to the "nose levels" as I thought they stopped publishing a number of months back. I think you need to get some treatment for those hardening of the orthodixies. | Visualize a world without lawyers! | alano(a)teleport.com | |"The moral PGP Diffie taught Zimmerman unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.| | http://www.teleport.com/~alano | <fnord> |

1 0

RE: Let's Not Merge Mailing Lists, OK?
by ali＠eit.COM 17 Dec '03

17 Dec '03

Greetings, The problem is reducing the noise at cypherpunks list, so all communities can benefit from it, and not the "varying levels of competence" different communities may have. What more noble cause is there than to educate others of your beliefs. A well thought out question or cross-point is not noise but a poorly-backed false claim certainly is. In special instances, cross-postings enable the cypherpunk community and the other communities to interact together to produce real-life solutions that real people would care to use. Thinking on the social issues such as anonymity and privacy with no regards to what other communities think about or have to say is simply not optimum. Now if there is technical issues, such as mail-loops or some such thing against cross-postings, please inform. Regards, Ali p.s. Being subscribed to cypherpunks is not a prerequisite for following the list; thanks to its hypermail archive and numerous filters.

1 0

Re: Anonymity: A Modest Proposal
by loki＠obscura.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I think the idea of a token has come up before. I think it is a good idea. The token should have some expiration information in it so the remailer need not keep it around forever (or it could just "forget" all token older than 3 months). Right now there is not much spare room in the Mixmaster headers. There are several ideas for improvements in Mixmaster that will require the adoption of an incompatible message format. I plan to collect them and implement them all at once. One of the ideas is an expiration date in the message to keep it from ever being replayed (even after the remailer expires its record of the message ID). -Lance At 7:43 AM 10/26/95, Adam Shostack wrote: >Lance Cottrell wrote: > >| How open is the protocol? Is there and API for it? Does anyone know how big >| the coins are? There will have to be room for one per header in Mixmaster. >| Do they vary in size, or are all coins identical? There is so much stuff to >| try to keep track of all at once! :/ > > If the coin is bigger than a Mix header has room for, does it >have room for an arbitrary token? > > I send a message to the mixmaster I'd like to use, containing >a coin and a large arbitrary number. I then put that number in a list >I maintain of the tokens I can spend with that mixmaster. > > The mixmaster cashes the coin at once[1], and puts my number >into a list of 'paid' tokens it will accept. > > When I want to spend the token, I put that in the message >header block. Since its smaller than the coin, its easier to put in >the header than the coin. > > This scheme also reduces mapability between the coin and the >message, since they are not strongly correlated in time as they would >be if they were included in the message. This seems to be a stronger >win than the size benefit that caused me to suggest this. > > [1] Other than the time mapping win, I could also see spending >a few bucks at the start of each month to be able to use any >mixmaster. The mixmasters would, by cashing my coins early, win on >the float between the time they get my money and the time they provide >service. Icing on the cake. > >Adam > -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMI/NvfPzr81BVjMVAQGcbgf/b9wzPqGoijggurIm3uGiddSyaz2uAEXj 65INp6g/Va/Yf1q3+vQfyfixs3jviihmPMgepjs/deQqV5qxgEh05kbyvgKDf8wX vh8cVLTYMKpqGOU34K/9jLOXD9gZqvKBdDy9Z5YsLimDRV3ju9uRpBSLnUaiI1rU whpP+py/hqgFl0DL4Ybx5PBZDbcSkRhSqmlnx46/hbyY/bnaiTplPtMAU8oHZTK6 VOSB3hsPtfpGuKwCqe60WeZZDQygPbD6aDW+BZl4kMSv5+1kf4/aHECCOUqfzmvc O1Jmr6K8wLLtp/S12qRKh4SIEea9TUqN4PoV6YGQTBV1gM6MxC/GrQ== =qSuu -----END PGP SIGNATURE----- ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

newsweek oct 30 Levy digital cash article
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

a slick article by Steven Levy appears in the oct 30 Newsweek mag (cover Farrakhan). I'll let the ILF post it, but here are a few of the elements: - covers mark twain bank going live with Chaumian "e-money" - also a sidebar on Mondex.. - 1st virtual mentioned - Bruce Sterlings "heavy weather" e-money dystopia - Netscape flaw as example of the stakes - US government get into the act? - privacy concerns (EPIC Rotenberg quoted) - "tax may be voluntary" --Barlow - FinCEN worried about drug money I didn't find any obvious errors or overhyped paranoia, so I commend Levy on the article. it can be seen as a definite cypherpunk cap-feather. Levy is doing a really great job IMHO. an editorial in an earlier issue of newsweek about Rimm and pornography in cyberspace was dead bang on.. p.s. I'm very curious about the "information security" reference that someone gave earlier, has there been any more information here about that one? -- also, my question about whether one loses the downloaded Chaumian bucks if one's hard drive crashes was answered in the affirmative by Levy. hoo boy, I think this could become one of the worst new urban legends about losing money due to failed hardware/software. there is going to be a lot of paranoia about this item. I'll bet virtually all digital buck schemes will have to explicitly answer this question to a paranoid public: what happens if my computer crashes? part of my motivation for querying about losing cash due to a hardware failure was based on an interest in showing how the really "soft" system of credit card purchasing that we have now, while considered lame by a lot of cypherpunks, often protects the consumer. remember, Jane Sixpack is frequently locking her keys in a car. ecash that can be lost or stolen just like real cash may not be as attractive as say a credit card system whereby one can sometimes call up the company and say afterwards, "I didn't really mean that". cypherpunks should consider that one of the key things we think is the strength of ecash--namely privacy-- may be a key area the opposition to untracable cash transactions can tout as a weakness or problem. it seems to me that the very techniques that tends to enhance privacy also tend to make the spending "more dangerous" in the sense that one cannot backpedal or one can lose it, irretrievably, more easily. for a public with the IQ of Joe and Jane Sixpack, this could be a serious concern. identification is key to helping people retrieve lost or stolen checks, etc. "have you ever locked your keys in your car? don't use digital ecash. you might lose it and never get it back." I suggest that Chaum definitely consider this a major aspect in his marketing campaign. it could be a very serious soft spot in widespread public acceptance of ecash. rumors could float, "ecash is dangerous to the consumer". hopefully we can head this one off at the pass. imho, the future will never see complete digital cash, or complete identification. they are likely to mix a lot. however I think ecash may become very respectable, and ultimately become far more common than identified transactions are today. but its really amazing how no serious alarm flags have been going off in the legislative arena about digital cash. I suspect this is going to become a white-hot public policy issue. if you thought the fights over terrorism, wiretapping, or pornography laws were messy, just wait until legislators pinpoint digital cash as the horseman of the infocalypse. fireworks will fly. may you survive interesting times. <g>

5 5

Digitial Money [SHAMELESS PLUG FOR BOOK]
by cman＠communities.com 17 Dec '03

17 Dec '03

Leslie Lundquist, a co-worker of mine here at Electric Communities, together with Dan Lynch from Cybercash & Interop fame, has written a book called _Digital Money: The New Era of Internet Commerce_. It should appear in stores "real soon now"; it can be ordered right now from any book store for $24.95. The book is intended as an overview of current and projected digital payment systems and commerce, and contains basic background information on the underlying technology. It is intended for the general reader: this is the kind of book a techno-weenie might buy for his or her manager to help them understand some of these issues. Note that this is a different book than _Digital Cash_, by Peter Wayner. I'm not in the loop on this, but this appears to be "one of those things" and not intentional on anyone's part. For more information, e-mail leslie(a)communities.com

1 0

I resubmitted the CJR
by Raph Levien 17 Dec '03

17 Dec '03

I have been told by several people that I did it wrong. Apparently there are two addresses: one for mail, and one for couriers. The first time, I sent it by mail to the courier address. This time, I also sent a fax. From what I've heard, I should be receiving a tracking number within a few days. Also, for those who were wondering, the "Arlington, CA" address was merely a keying error. The actual envelope said VA. I will keep the list up to date with any further developments. Raph

1 0

Re: rejection of CJR
by Peter D. Junger 17 Dec '03

17 Dec '03

I happened to speak to Mr. Capilino at the Office of Defense Trade Controls this morning, and mentioned that the Commodity Jurisdiction Request for the T-Shirt had been returned and read him the message to that effect. He told me that that was the wrong address for mail, since it was used only for currier deliveries, and that they have stopped accepting even currier deliveries there since the Oklahoma city bombing. He suggested that those who want to apply for the Commodity Jurisdiction determination should call him at 703-875-7396. He will fax the current information on how to submit a CJR to anyone upon request. He did not say so, but I rather think he looks forward to getting the T-Shirt request. -- Peter D. Junger--Case Western Reserve University Law School--Cleveland, OH Internet: junger(a)pdj2-ra.f-remote.cwru.edu junger(a)samsara.law.cwru.edu

2 1