December 2003 - cypherpunks-legacy

E-cash and Interest
by Frank O. Trotter, III 17 Dec '03

17 Dec '03

Once the Ecash Mint and the account (in our case the WorldCurrency Access account - others will be different) are merged, the balance you hold in the Mint may be able to earn interest. Like an individual, the amount of interest offered will involve a cost benefit relationship based on cost of funds, regulation, and operational costs, but there should be no obvious reason not to pay something in most curencies. One note, under US banking regulation, "transaction accounts" fall under different rules than money market accounts, savings accounts, and NOW accounts. Depending on the exact functionality desired, and future regulation changes, there will be more or less incentive and/or legal ability to pay interest. Given the current functionality of Ecash there will be little incentive to hold balances on your hard drive once interest is available. It is just too easy to move the money down when you need it. Today there is no specific cost incentive between the Mint and your hard drive. It does not take a long leap to see that when the account and the Mint are merged, that since the Mint _is_ the account, PC/Internet banking, debit and all other regular banking functionality can become immediately integrated! Frank Trotter ftrotter(a)marktwain.com Opinions expressed are my own.... > On Wed, 10 Jan 1996, Tim Philp wrote: > > > With the E-cash systems that I have seen, you generate your own E-cash > > and have it signed by a 'bank' At that moment, it becomes like cash in > > your wallet and you loose interest that this money could be earning. > > >From the standpoint of monetary economics, this is correct. The (ecash) > bank has the right to use your deposits to give out loans. When you > withdraw your money (and turn it into either cash or ecash) they (the > bank) no longer have the right to turn your deposits into loans. > Withdrawn cash/ecash can not earn interest. > > This is the problem of (e)cash: if you have it on hand you _must_ forgo > any interest earnings. Theoretically, the optimum holding of (e)cash is a > function of interest rate (the greater the interest rate, the less cash on > hand), transaction cost of making withdrawals (the easier and more > convenient the withdrawals, the less cash on hand), and the "providence > value" of cash (the more you value instant gratification, the more cash on > hand). > > Thats why ATM machines have caused us to hold less cash. We can now keep > money in the bank (letting it earn interest and letting the bank create > loans with it) and withdraw from ATM terminals only when we need it. > > ------------------------------------------------------------------------------- > Patiwat Panurach Whatever you can do, or dream you can, begin it. > eMAIL: pati(a)ipied.tu.ac.th Boldness has genius, power and magic in it. > m/18 junior Fac of Economics -Johann W.Von Goethe > -------------------------------------------------------------------------------

2 1

Reliance Limits Considered Harmful
by Jueneman＠gte.com 17 Dec '03

17 Dec '03

>Suppose I am a CA. I am worried that by issuing a certificate with a >lifespan of more than 2 milliseconds I am opening myself up to unlimited >liability if for some reason, despite my best efforts, I issue an >erroneous certificate. > >I know I can write disclaimers, but that's not reliable since courts >often ignore them, and anyway it scares off customers. > >I know I can put an expiration date on the certificate, but that's not >enough. I can accumulate a lot of exposure in a few seconds, much less >weeks. > >I know I can put a reliance limit in the X.509 ver 3 certificate, but >that's not enough. Even a $1 limit could be used many millions of times. > >Is it feasabile to say: Can only be relied on once per day/week/month? >Is this something the relying parties can reasonably be expected to monitor? > >It seems to me that this sort of a limit is essential if a CA is to feel >comfortable outside Utah.... > >A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) >Associate Professor of Law | >U. Miami School of Law | froomkin(a)law.miami.edu >P.O. Box 248087 | http://www.law.miami.edu/~froomkin >Coral Gables, FL 33124 USA | It's warm here. > I have been troubled from the first with the concept of a reliance limit, in particular because of the problem Prof. Froomkin cites. In the "normal" paradigm for digital signatures, neither the CA nor the relying party(ies) have any knowledge of how many times that particular certificate/key has been used. As a result, there are few if any controls that would operate to enforce the notion of a reliance limit. Even in the electronic credit card environment where there is some sort of a closed loop system (the purchases are reported back to the Issuing Bank, and presumably would be or could be known by the CA, which is probably acting as an agent of the bank), there are some substantial problems. The first problem is one of privacy. If I have a very high credit limit, I certainly don't want to advertise that fact in a public certificate. On the other hand, if I have a low limit, I don't want to advertise that either. And in any case, the reliance limit is not intended to be a "floor limit", i.e., an amount below which it is not required to contact the credit card company for authrotization. (Floor limits used to be popular, especially in Europe where the cost of telecommuncations was high. But now almost all transactions are authorized against the customer's current balance and credit limit, and if the merchant doesn't check he can be stuck with the charge if the customer doesn't pay.) I have argued (quite unsuccessfully in the credit card community) that the reliance limit can provide a useful means of limiting the subscriber's exposure (as well as the CA's) in the event of a security compromise affecting the subscriber's private key. Since there are no perfect computer security solutions available at any price, much less an affordable price, both the subscriber and the CA have to make a tradeoff between their risks and the rewards of greater convenience, etc. I tried to get around the privacy issue in the credit card environment by treating a negative reliance limit as a percentage of the customer credit limit. But no one in the credit card industry was convinced, and maybe I'm not either. The concept of a reliance limit is enshrined in the Utah Digital Signature statute (and the ABA draft Digital Signature Guidelines), where it is wrapped up with a draconian requirement that registered CAs have to put up a surety bond or irrevocable letter or credit in the amount of 30% of the aggregate of all outstanding reliance limits. This is not just an insurance policy -- a CA's corporate assets are pledged to back up the certificates issued, not withstanding the fact that the identification system we have in this country is not sufficiently reliable to warrant such representations. And surely no CA is going to hire private investigators to check out who someone claims to be with sufficient credibility as to be able to issue certificates to individuals -- at least if they intend to charge any kind of a reasonable price for the certificates. In my personal opinion, that requirement in the Utah law makes it highly unlikely that anyone will ever become a registered CA in Utah, unless the reliance limit is set to $1 and/or the expiration period to about 1 millisecond. (Maybe the Utah statute was really trying to set up a lottery, rather than a system for registering CAs. Everyone gets to play, and if you can find a person who has invalid credentials, even if issued through an innocuous clerical error (someone misspelled the street name in someone's address), you can claim you were harmed in some way, sue them big time and collect millions. That's the American way, isn't it? :-) Although X.509 v3 provides a simple mechanism to allow additional attributes, potentially including a reliance limit, to be included in the certificate, there are at present no plans that I know of for any existing CA to actually do so, or more importantly, for anyone else's software to be able to read and comprehend those reliance limits or perform any checking. As a purely technical matter, the problem could be solved by requiring the relying party to validate the transaction (not just the certificate) with the CA in real time. (Checking a CRL database isn't good enough.) By providing a transaction amount, the CA could keep track of the extent of its liability, and could detect misuse. Alternatively, the subscriber could request a new certificate for each one time use. However, both of these "solutions" would require a significant extension to the current mechanisms, and also give rise to a number of privacy issues. In addition, there are other practical problems. If I am the relying party (or the CA), and the subscriber is using his digital signature to confirm an order to sell futures on the commodities market, how can I evaluate the potential risk? If the subscriber is selling futures for orange juice and a storm wipes out all of the orange trees, his losses could be unbounded. Similar situations could exist in the case of a signature on a patent claim, and creative people can probably think of many more cases. Although the notion of a reliance limit usually arises in conjunction with digital signatures, it would presumably apply to certificates used for message encryption, to set up encrypted sessions, etc., as well. This puts the CA in an even more difficult position, for now we are not talking about a (single) financial transaction. If I send an encrypted message to someone, and it turns out that the person who received it was not who he claimed be, I may in fact be greatly harmed. (If the message wasn't important, why would I have encrypted it in the first place. Suits for violation of privacy have resulted in millions of dollars in damages -- does that mean that the CA ought to provide a million dollar reliance limit? My conclusion after having thought about this a lot is that reliance limits are at best ineffective and at worst positively harmful. They are difficult or impossible to enforce in any meaningful way, they raise substantial privacy issues, and at least as codified in the Utah Act and the draft Digital Signature Guidelines they will almost surely act to dissuade any prudent business from setting up a licensed CA. Does this mean that the subscriber, relying party, and CA all have effectively unbounded liability, absent a stated reliance limit? No, I don't think so, but we may have to change our paradigm a little bit. Most people accept a driver's license as providing a degree of proof of someone's identity, but very few would consider it proof positive. Since the state-issued driver's license is the only practical means of identication available to a CA in the case of private individuals, that consitutes the weakest link in the system and is quite likely to remain so. The only other identification document I am aware of that is available to private individuals that provides substantially better identification than a driver's license is a permit to carry a concealed weapon. Here in Massachusetts, obtaining a pistol permit requires a trip to the local police station, where you are photographed, fingerprinted, and two or more affidavits concerning your character are reviewed prior to submitting your fingerprints and picture to the FBI, where a search of the NCIC database is used to determine if you have any prior arrests, etc. The permit card that is issued carries your residence or business address, your picture, fingerprint, date and place of birth, height, weight, complexion, hair color, eye color, and occupation. Since the Brady Bill was passed, I believe that many states have set up similar systems. (Of course many jurisdictions sharply limit who can actually receive a weapons permit. I'm only describing the process, not debating the reasonableness or unreasonableness of gun controls.) Even if state laws were amended to make this degree of identification assurance available for purposes other than weapons permits, many if not most people would have strong reservations about the privacy implications. And to the best of my knowledge, private companies are not allowed to access the NCIC, also for privacy reasons. Does all this mean that digital signatures are worthless? No, not at all. But it does mean that they are unlikely to convey a degree of surety as to someone's identity that is very much stronger than a driver's license identification. In my personal opinion, I think we need to establish a stronger degree of "no fault" protection for CAs that follow the rules. Whose rules are to be followed, and who audits them for conformance are valid issues. We clearly don't want irresponsible CAs issuing certificates to all and sundry, but we can't make the cost of entry into the business so high that no one takes on the burden of being a CA at all. The issue is how to balance risks, the costs, and the rewards equitably between the subscriber, the relying party, and the CA. In the case of the credit/debit card industry, the credit card companies charge a fee that covers both the risk and their administrative costs. If digital signatures can be used to reduce their risks, presumably the fees charged to the merchants can be reduced somewhat. But in any case, the fee that is charged is proportional to the amount of the transaction, and therefore statistically covers the risk. The real question is what to do outside of the credit card industry, where certificates may be used for transactions are much more complex, and where there may not be the infrastructure to collect a percentage fee for each use. Please copy me directly on any replies, as (to the best of my knowledge) I am not a subscriber to cypherpunks. Bob ---------------------------- Robert R. Jueneman GTE Laboratories 1-617-466-2820 "The opinions expressed are my own, and may or may not reflect the official position of GTE, if any."

1 0

Re: Domains, InterNIC, and PGP (and physical locations of hosts, to boot)
by jim bell 17 Dec '03

17 Dec '03

At 11:22 PM 1/11/96 -0800, you wrote: >For what it's worth, you can use the mapping software at ><http://tiger.census.gov> to find your location fairly accurately; you may >need another map to locate yourself, since the streets are unlabeled. I >managed to figure out that I'm currently at latitude 37.3435 degrees, >longitude -121.8925 degrees. I think that's correct to within about 100 >feet or so. > > - Tim > >Anyone with a GPS device, feel free to stop by; I'm in unit A2, and I've >got homebrew in the fridge. About 10 years ago, I bought a Loran unit from Heath, and (due to my association with some people who did laser photoplotting for PC boards) had a program written which generated a "LAT/LON" map plastic overlay. Apply over a USGS 7.5 minute map, and you can read LAT/LON directly. (It only needed to be photoplotted once, of course: positive contact printing duplicated it easily.) Only one problem: Since the width of longitude changes with latitude, a given map overlay can only be "exactly" accurate at one latitude. Still, it made estimating LAT/LON FAR easier.

1 0

Re: [NOISE] Microsoft continues to mislead public about Windows security
by daw＠quito.CS.Berkeley.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199601100451.UAA13211(a)infinity.c2.org>, <kolivet(a)alpha.c2.org> wrote: > On Tue, 9 Jan 1996, Frank Willoughby wrote: > > When a system is breached or a CERT Advisory is issued, this is a major > > embarassment for the company. > > What are CERT's criteria for a bulletin to be issued? Would the previously > mentioned Windows NT and Windows 95 security bugs qualify? CERT normally won't publish a security warning until the manufacturers have fixed the bug & offered a patch. So I doubt the Win95/NT bugs will be announced by CERT tomorrow. If you want to publish a bug, CERT is probably not the best place to go. CERT often ends up sitting on bugs for ages, because nobody knows about the hole, so nobody can pressure the vendors to fix 'em, so CERT refuses to release a bulletin-- a vicious cycle. IMHO, embarassing public pressure often seems to be the quickest way to get attention & fixes from uncooperative vendors... But then again, that's the old "full disclosure" (and "security through obscurity") debate(s). - -- Dave "a believer in security through caffeine" Wagner - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMPWugyoZzwIn1bdtAQFYrgGAyQhuXiFCK36qFdJzEw4PSp2f/oIvpoi+ 8peJmKjle86aBlY20SGYQBQoactyKcza =3NOo -----END PGP SIGNATURE-----

2 1

Minor correction about tax rates and witholding
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:21 PM 1/11/96, Gary Howland wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >> you think that's a bit ridiculous? i'm paid via an NIH grant given to my >> adivisor by the govt. this stipend is taxed. it didn't used to be >> (started to be taxed around '86 i believe). why the hell doesn't the >> govt just save everyone the trouble and pay me less. i'm sure they could >> get rid of a couple of IRS people this way. > >It's even sillier over here in Europe, and the paperwork is probably .. I didn't comment when the first remark was made, several days ago, but if others are going to elaborate on it, I will now comment. The government cannot simply take its cut before sending the stipend/salary for a very good reason: they don't know the final tax rates of the taxpayers! Some people will end up paying no taxes, for whatever reasons (low overall wages, lots of deductions and dependents, offsetting capital losses, etc.). Others will pay 20%, and some may even pay more (doubtful, on a stipend, but you get the point). Clearly the government cannot simply "withold" 15%, say, nor can it know in advance the precise amount to withold. A flat tax rate would make this more possible, but would still not be completely accurate. --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

US DoJ Zimmermann Press Release
by Declan B. McCullagh 17 Dec '03

17 Dec '03

>From Mike Godwin and Stanton McCandlish. Transcribed from fax. -Declan ----------- [begin] [logo] United States Attorney Northern District of California _____________________________________________________________________________ San Jose Office (408) 535-5061 280 South First Street, Suite 371 San Jose, California 95113 FAX: (408) 535-5066 PRESS RELEASE FOR IMMEDIATE RELEASE January 11, 1995 Michael J. Yamaguchi, United States Attorney for the Norther District of California, announced today that his office has declined prosectution of any individuals in connection with the posting to USENET in June 1991 of the encryption program known as "Pretty Good Privacy." The investigation has been closed. No further comment will be made by the U.S. Attorney's office on the reasons for declination. Assistant U.S. Attorney William P. Keane of the U.S. Attorney's Office in San Jose at (408) 535-5053 oversaw the government's investigation of the case. [end]

2 1

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Got this off the web - it's a link to the letter that Phil got from the US attorney: http://www.eff.org/pub/Alerts/usatty_pgp_011196.announce U.S. Atty. DROPS PGP INVESTIGATION! - -- Ed Carp, N7EKG Ed.Carp(a)linux.org, ecarp(a)netcom.com 214/993-3935 voicemail/digital pager 800/558-3408 SkyPager Finger ecarp(a)netcom.com for PGP 2.5 public key an88744(a)anon.penet.fi "Past the wounds of childhood, past the fallen dreams and the broken families, through the hurt and the loss and the agony only the night ever hears, is a waiting soul. Patient, permanent, abundant, it opens its infinite heart and asks only one thing of you ... 'Remember who it is you really are.'" -- "Losing Your Mind", Karen Alexander and Rick Boyes -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMPXZYyS9AwzY9LDxAQG4BgP+PmA6GoUSMCpnvUfo+1v1MpFX0pdg66jN Foo5yuT+G2fIG1m+K4aVrZusPHhC+tHjx2kaMqn0ZSE9nC8U32blpt01+CE+xgp3 x4q5L6llkyEK4oWSrnjbZImcjm3VIrAiaj8S3+qGfAz3FEZ5ChJZ2Q4J91lsqv5z 3FY/xiKqu60= =Nrr2 -----END PGP SIGNATURE-----

1 0

Re: Zimmermann case is dropped.
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:29 PM 1/11/96, sameer wrote: > We've made no progress. Phil has lots lots of time and gained >lots of grey hairs, and everyone who donated to his defense fund lost >money. > The US can still harass people if they want, and make their >life hell. Yes, I think it likely that another case will be filed, a case the government senses is more winnable. In many ways, what Phil and/or some of his friends may or may not have done was too "stale." None of the Four Horsemen were involved directly, and Phil's case generated publicity that tended to make him a hero, not an Enemy of the People. I would look for something like a prosecution of a remailer operator, though only after laws are passed making it illegal to remail certain items. (Right now there is no law against redirecting a message, so prosecution would be difficult.) --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

For once, Thatcher said it best: "Just Rejoice." However, Churchill said it better: "This is not the end. This is not the beginning of the, but rather the end of the beginning". But has Phil sold the photos to a tabloid yet? Simon (defun modexpt (x y n) "computes (x^y) mod n" (cond ((= y 0) 1) ((= y 1) (mod x n)) ((evenp y) (mod (expt (modexpt x (/ y 2) n) 2) n)) (t (mod (* x (modexpt x (1- y) n)) n))))

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- First of all, let me apologize for not being very knowledgable about CA's and https and SSLeay, apache, and generating renegade (ie, your own) certificates. If someone wants to go over this [again] certainly it'd be welcome. I was today playing around with a Mozilla 2.0beta5 that someone gave me [more bells and whistles than my 1.12, but not much more bang for the buck] and was showing a friend all the nifty information that netscape tells about you when you visit sites, then went to c2 to show off the apache web server and when I tried to use https:// to show off how you can have your own encrypting web server for free and everything, a window popped up and said the certificate was expired. I couldn't really tell if it meant that the certificate that Sameer generated really needed to be updated, or if Netscape beta 5 had just been rigged to reject non-netscape certificates, but the end result was no encryption. (Jeff, if you're reading this, of course we know that Netscape, with it's open loving policies wouldn't do anything underhanded, but the thought does come to mind, and by the way, when are we going to see an option to turn off or control what information is passed out to the other end. Specifically, I'd like http://anonymizer.cs.cmu.edu:8080/prog/snoop.pl to come up nearly blank.) Soooo, anyway, I was wondering if anyone knows anything about the use of privately generated certificates. Yes, Jeff, we know that Netscape is jumping to fully support user-specified certificates, but personally I saw, relating to certificates, a lot of *nifty* options and displays, but really didn't see much in the way of anything that looked like "add". ...Looking forward to the day where end-to-end encryption is king, and the TLA, my competition, or anyone else can take their packet sniffer and kiss my butt. Don PS: my predictions on the PRZ-secretly-sold-out-rumor-index: 6. my predictions on the IQ of those making those claims: 6. (cumulative) woohooo Phil! - -- <don(a)cs.byu.edu> fRee cRyPTo! jOin the hUnt or BE tHe PrEY PGP key - http://students.cs.byu.edu/~don or PubKey servers (0x994b8f39) June 7&14, 1995: 1st amendment repealed. Junk mail to root(a)127.0.0.1 * This user insured by the Smith, Wesson, & Zimmermann insurance company * -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMPXDV8La+QKZS485AQHkXwMAnGWVeLB6ntpkK1ksZ7a8+iklA/sPfIT2 XqqJRRX0Ddg2UuAAxmk6WOC/nxnRPRlM/4AkkaEohZRv14ccnlvv3qVGFxpLlxKG iYgbn1x9/xgHjwAB31HqozQix79wPfB/ =v9ni -----END PGP SIGNATURE-----

1 0