December 2003 - cypherpunks-legacy

Re: The great GAK crack (making GAK economically impossible)
by geeman＠best.com 17 Dec '03

17 Dec '03

This seems to ignore a possible worst-case scenario, in which the only products which are ultimately approved wrap the key using a special law enforcement key, for example. If the Powers that be can mandate "escrow" --- really GAP, Gov't Access to Plaintext --- then it can be mandated to take a particular form that is defined to be tractable. At 05:25 PM 9/15/97 -0700, Tim May wrote: > >At 8:41 AM -0700 9/15/97, nospam-seesignature(a)ceddec.com wrote: >>If I have to GAK my keys, and there then exists a pgp-gak, then we simply >>recruit the same CPU power that generated the millions of DES keys to just >>run pgpk-gak with the shortest keylength and send billions of keys to the >>GAKserver each week. Many from out of the US if pgp-gak becomes available >>there. >> >>My test software uses a loop that generates a new pair every few seconds >>on a pentium (and found some very obscure bugs). I would be required to >>send all those to the gak.gov. If they really want them... >> >>What it probably means is the govenrment will issue keys or have to >>license people to create them. > >"There ain't no such thing as free escrow." > >Some fee will be collected to register keys. "To defray costs" (never mind >that the government is the party _requiring_ the damned escrow!). > >This will stop the "flooding attacks" which a free key escrow system would >generate. It will also, sadly for us, put an end to many applications where >keys are generated quickly, transiently, and on an ad hoc basis. There >simply will be no time to register the keys, and the $10 (or whatever) >processing fee will be unacceptable for these applications. > >--Tim May > >There's something wrong when I'm a felon under an increasing number of laws. >Only one response to the key grabbers is warranted: "Death to Tyrants!" >---------:---------:---------:---------:---------:---------:---------:---- >Timothy C. May | Crypto Anarchy: encryption, digital money, >tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero >W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, >Higher Power: 2^1398269 | black markets, collapse of governments. >"National borders aren't even speed bumps on the information superhighway." > > > > > >

2 1

[political NON-noise] Re: Crypto & Taxes
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:03 AM 11/4/95, s1113645(a)tesla.cc.uottawa.ca wrote: >Not that I want to get into a big political discussion, but David Friedman >has a nice, calm and rational book called The Machinery of Freedom, 2nd ed, >which argues anarchism/libertarianism from an economist'spoint of view. >The argument is not cased in terms of ethics and morals but rather >economic efficiency and utility. Slim, easy to read and cheap. He also >has a good sense of humor. Unfortunately the book is currently on back order. >I'm holding on to my library copy until they ship one to me. David Friedman is now teaching law at Santa Clara University, over in Silicon Valley. We've been in contact, and expect to meet for dinner sometime soon. (He attended a special Cypherpunks meeting a few years ago.) >You can butt heads with him and Tim on the cyberia list (I don't remember >the address but they have it at news://nntp.hks.net ) Ah, but the Cyberia list is a _law_ list, and political discussion is discouraged. >I gather from the cyphernomicon that someone recently converted him to >cryptoanarchy. His "Machinery of Freedom" and many other articles clearly establishes him as a leader in this area. He didn't previously know a lot about strong crypto, but now he sees that this makes many of the abstract ideas of "Machinery" near at hand. Vernor Vinge believes the same thing. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Many Topics are Appropriate for Discussion Here
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 10:35 PM 11/3/95, hallam(a)w3.org wrote: > Just a calibration point. The libertarians on the list do not seem >to shrink from expressing their political views. Indeed the entire discussion >on the NSA is a political thread pure and simple. My post related directly >to the question of personal privacy rights in a democratic, plural society. >I do not regard that it was off topic in any sense. I was not aware that >any agreement was in effect as to the method by which goals might be >achieved. I chose to persue goals by the means most likely to succeed. In >that I am a pragmatist. Government regulation often provides social benefits >it is not by definition an evil to be avoided. In any case regardless of the >rhetoric government regulation increases, I prefer to press for some >regulations I like rather than dream about there being none whatsoever. I for one have no problem with left-leaning (that is, nonlibertarian :-}) folks expressing views. That libertarians tend to be the most vocal and perhaps most articulate advocates of strong crypto is only a trend: I know of several left-leaning folks who strongly push crypto. We happen to disagree on some points, but agree on others. On this list, Dave Mandl and Rich Dutcher (probably no longer subscribed) have represented somewhat leftist views. The late John Brunner was a particular favorite of mine, whose "Stand on Zanzibar" was an utter masterpiece, and whose "The Shockwave Rider" was of course a major influence on many cyberspace privacy advocates. And yet he called himself a leftist and was strongly opposed to the corporate state. As I am, by the way. Much of the power of very large corporations comes from the power of the State enforcing certain franchises and monopolies granted to them. (Intellectual property laws are largely such franchises---if one doubts this, imagine a return to the era of the guilds, where the silversmith's guild could physically block other people from smithing silver, and so on for all of the guilds. Modern intellectual property law works mostly the same way, giving to Apple or Sun or Intel the control a "truly free" market certainly would not.) > I do not separate the question of politics from technology. My >reasons for working on the Web have from the start been explicity political. >I regard the persuit of technology without consideration of the political >consequences to be unethical. I agree. And though I have been called an "ethical monster" for pushing my agenda for crypto anarchy, I agree that one must always consider ethics and politics in technological matters. (I suspect we disagree about many conclusions of this view, however.) > I am only in a position to influence the political process if I >understand the position of the administration and can demonstrate an >appreciation of their concerns. As Sun Tsu said "you must build a golden >path along which your enemies may retreat". The problem with government >is not that it is a conspiracy, it is an interlocking series of >beuraucracies which all seek to avoid responsibility. I view governments as just another example of an organism or system which perpetuates itself. It's in the genes. Evolutionary game theory, etc. > If you want to get Phil Z. off the hook or foul up the governments >escrow scheme plans you have tobe prepared to step into their mindset >and walk about on the inside a bit. somewhere inside the government there is >a jobsworth who is deciding to hassle Phil Z., this person will be a civil >servant, not a political appointee. Ie the dregs which get left behind each >time there is a new administration. What we need to do is to identify that >person and nail their ass to the wall. It has to become apparent to the >administration that that individual has created an unnecessary source of >embarassment. This I think we have been already been doing a pretty good job at. I have been on panel discussions with Stewart Baker, former chief counsel of the NSA (and now with Steptoe, a D.C. law firm, and still active in pushing crypto legislation), and Ron Lee, the current chief counsel. And I spotted Dorothy Denning's deep involvement several years ago. Ditto for key escrow. And of course John Gilmore, Phil Karn, and others have been very active in "nailing their asses to the wall," so to speak. > If somone makes contiuous political spiels themselves but object when >I make one they disagree with (as one person has done) I am not going to take >their objection as indicating anything other than an inability to argue their >case. As this post should make clear, I certainly don't object. I doubt I'll have any energy to argue things I argued for the first time almost 30 years ago, but I'm very interested in the nuts and bolts of how strong crypto will affect institutions and policies. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Sources of randomness
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:04 AM 11/4/95, Peter Monta wrote: >Perhaps there ought to be a couple of standard random-bit-source >implementations, say at the CMOS-standard-cell and board-subsystem >levels, that are widely vetted and trusted (and used!). But it's >mostly a solved problem, seems to me. This is something John Gilmore called for when he wrote: At 9:50 PM 9/20/95, John Gilmore wrote: >Software-generated random numbers are likely to be of poor quality. >There just isn't that much true randomness visible to computers. >Several ways to build good hardware random number generators are >known. But before hardware random number generators can be >incorporated into common desktop computers, someone will have to put >them into a small fraction of a chip. > >Currently, random number generators are chips or larger circuits. >Nobody will pay to put these on a motherboard. But if a random number >generating circuit occupied 1/1000th of a CPU chip or "multi-function >I/O" chip, cost would not be a reason to leave it out. > >You probably can't build a hardware random number generator out of >existing "gate array" gates or "standard cell" cells, because all the >existing gates and cells are designed to behave completely >predictably! It will take designing a new circuit structure. > >Do we know any solid state physics / circuit design experts who think >this might be a fun thing to do? I bet you could get a paper out of >it. And probably improve the world a few years later, when companies >used your paper to close another hole in their computer security. > > John There were several other posts in this thread, so interested folks might want to check the archives for this time period. Continuing on with Peter Monta's post: >A radioactive source might be okay at the board level (though probably >costlier than its electronic counterpart), but it'd be a pain to >integrate, and it might disturb the rest of the chip. (I'd like to >have a get_random_bit instruction as part of a microprocessor, for >example.) Also if you want a high rate of random bits, you need many >decay events, whereas for electronic sources the corresponding >bandwidth is free---Johnson and shot noise are flat to 1 THz or so. I agree, for several reasons. First, I agree that electronic noise sources are easy to build, easy to get licenses for use (basically, no licenses, unless the ITAR boys decide random number generators are munitions--maybe the "This t-shirt is a munition" could have "export-controlled dice"? Second, the ease of integration as a standard library module. However, getting the chip companies to do this will not be easy. They generally don't see the need (hey, even _we_ don't, given the diverse opinions on what is needed). This is why many of us favor an external dongle that plugs in somewhere. Then it could be sold cheaply and not have to get "buy-ins" from industry and committees. One idea is something that superficially looks like a modem, as everyone has modem software and ports (though I suppose many people use internal modems and so can't easily access it.) One would attach the "RNG-modem," a little dongle, and grab noise into a buffer for processing (hashing, filtering, etc.), or as ASCII garbage. (Before anyone jokingly asks about "1-800-RANDOMS," I've thought of it. Not practical, for obvious reasons.) A purer approach would be just a noise source dumped into dev/random, or whatever one wishes to call it. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: alt.anonymous.messages considered harmful
by futplex＠pseudonym.com 17 Dec '03

17 Dec '03

> >Specifically, if HTTP transactions with > >a popular web server were routinely encrypted, then all reasonably long > >visits to that site would act as cover traffic for a message pool on that > >server. > > Qua? The "length" of the visit is just the time to download a document. > Leaving a page in the browser window doesn't generate traffic... You're absolutely right. I wasn't thinking sensibly about HTTP. I wanted to make an argument about the time it would take to search the pool and serve a results page. But upon reflection, I don't think that even holds up under my HTTP delusions of yesterday, let alone a realistic view. Please ignore the "reasonably long" part of my previous statement. Thanks for pointing that out. -Futplex <futplex(a)pseudonym.com>

1 0

Re: FBI Wants to Wiretap One of Every 100 Phones in Urban Areas
by clarkm＠cnct.com 17 Dec '03

17 Dec '03

Thanks for this item! Two little excerpts jump out at me. They follow: > Last year, federal and state courts authorized 1,154 wiretaps, of which 48 > percent [snip] > "People are starting to say that seems awfully high," Dempsey said, noting > that > the overall level of such surveillance activity is now a total of 20,000 > to 25,000 > intercepts nationwide over an entire year. So what is it? 1,154 wiretaps? Or 20,000? FBI Director Louis Freeh testified under oath to 1,157. The FBI was asked for the data to support those numbers. The FBI refused to release them until the year 2002. The FBI is being sued under FOIA to support Freeh's sworn testimony. (Of course, he used different numbers at different times....) One last thing. What's so special about the year 2002? .---. .----------- * :::::::::::::::::::::::::::: / \ __ / ------ * clark.matthews(a)paranet.org / / \(..)/ ----- * :::::::::::::::::::::::::::: ////// ' \/ ` ---- * //// / // : : --- * PERMISSION TO \\/ / * / /` '--* COPY / REPOST \*/ * //..\\ x-x-UU----UUx-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x '//||\\` N E M O..M E..I M P U N E..L A C E S S I T x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x

4 3

Re: Crypto & Taxes [WAS Re: Cybersecurity]
by Bill Stewart 17 Dec '03

17 Dec '03

A couple of weeks ago, Michael Froomkin <froomkin(a)law.miami.edu> wrote: >> > fully applied crypto (e. g. fully anonymous digital cash) >> > makes it essentially impossible to base a tax system on income. >Hold on. This is more "factoid" than "fact": recall that income is PAID >by people as well as EARNED by people. Most payers have easily >detectible physical presence and assets that can easily be attached by >regulators. It will be a cold day before, e.g., my employer agrees not >to report my earnings. And the same is true for most employers in most >industries. Unfortunately, this is true, at least for people whose employers are subject to income tax somewhere. Taxing businesses doesn't make sense economically - you could collect almost as much money with far less disruption to the underlying economy by taxing it as wages for workers and dividend or interest payments to owners* rather than inside the business itself, substantially reducing the accounting workload of businesses**. But it's still very attractive to governments, not only as a lever for implementing social policy and extracting cooperation, but as a critical tool to force businesses to report wages payed to employees - I don't know if law.miami.edu is a taxable business, but for most employers, if they don't report the wages they paid to their employees, but do report all their revenue, they get taxed on the additional profit, instead of the employee getting hit with the tax; most people I know who've been paid "under the table" have been working for small businesses that are also not reporting cash revenues. Of course, if a business isn't _spending_ money on employees, but is just contracting for work performed by an Anguillan corporation, they still have receipts for expenses, and the financial arrangements between the Anguillan corporation and any of its US employees aren't really their concern.... >And if it ever stops being true, we'll just get VAT, and VAT inspectors. >So the line about death and taxes remains as true as ever, crypto or no. Value is really hard to measure in a service economy. Most of my work over the last N years has been talking to people, typing on keyboards, going places on airplanes to talk to other people and type on other keyboards, and occasionally handing people piles of collated and stapled dead trees, a racket for which people pay my employer lots of money***. Where's the value? When was it added? If the Tax Collectors don't see people handing my employer lots of money, can they demonstrate how much money they can confiscate? - - - - - - * this misses payments to foreign owners and taxes on foreign customers, but any government foolish enough to discourage investment by foreigners and sales to foreign customers deserves to be blamed heavily for lost jobs.. ** US businesses spend approximately 40% as much calculating taxes as they do _paying_ them... *** My previous employer was very good at taking metal, sand, and fermented dinosaur parts, and shaping them into boxes and strings that people would give them money for; they were extremely optimistic that they could get lots of people to also pay them money for sending them people to talk about boxes and strings and getting other people to pay _them_ for talking and banging on keyboards. They shouldn't have been quite so optimistic, and now I'm in the racket on my own, having not yet acquired overseas corporations to shelter my income through :-) #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

5 5

The Crypto Applications we would rather not talk about
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

Anonymous remailer and PGP Unusual applications I dont know if anyone else caught it last year but High Times discovered anonymous remailers and PGP for an article last year for anonymous remote control of grow rooms. PGP Wins again? and lately the thule people(bigoted and racist Nazis) have been learning to protect themselves also according to news reports from germany. Crypto and Privacy tools protect everyone from the hero to the anti-hero... the technology itself is neutral I wonder how long it will be before we hear news reports of some of the governments people being caught using internet casinos from the white house network. On other notes CCCF(the chaos computer club France) was shown to have had a high level plant from the french intel services, The founder of the CCCF himself. this story seems to repeat itself over and over when you are doing something of which the authorities DONT approve they WILL attempt to infiltrate and subvert from the inside. The answers are there and have been published in most books on tradecraft, 3 person cells organized as pyramids. Anonymous remail tech and crypto make this system possible with out Face to face contact. When does this lesson finally get learned? anon

2 1

Cypherpunks Santa Cruz Meeting/Party, 95-11-11
by tcmay＠got.net 17 Dec '03

17 Dec '03

I have sent out a detailed announcement of a "Cypherpunks Santa Cruz" meeting/party at my house in Corralitos, California, on Saturday, 11 November. This was sent to the mailing list of interested folks I maintain. If you are on this list, you already got the detailed message. If you are interested in getting on the list, drop me a line. I can also send the detailed announcement to anyone who is interested. As background, the Cypherpunks Santa Cruz is for folks in the Santa Cruz, Monterey, Carmel, Boulder Creek, Watsonville, Salinas, Big Sur, etc. area, or for anyone else on the Central Coast. Or anyone else, for that matter. At the last (and first) party we had Greg Broiles down from Eugene, Oregon, and Jeff Simmons up from San Luis Obispo, plus a bunch of folks from "over the hill" in the Silicon Valley/Bay Area. All told, 25 people. I'm not sure if there is a Bay Area meeting that day. If so, attend one or the other, or both, as my party starts late afternoon (of course, it may be a long drive, depending on where the Bay Aryans are meeting). --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Crypto++, Cpunk Icons, list noise
by don＠cs.byu.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Wei Dai <weidai(a)eskimo.com> writes: >I am still talking to RSADSI's lawyers, but it's taking a lot longer And the efforts are appreciated. Of course, your original efforts can still be appreciated at utopia.hacktic.nl. I don't know about everyone else, but that TCP encryption sounded interesting. Any plans to discuss it on the list? - ----- An anonymous complainer writes: >Well, Perry, my opinion is that there is far too much noise on this list >as it is. I have already seen my words drowned out by bellyaching over >next to nothing. POT-KETTLE-BLACK. Also, since nothing you've written (in your commentary, as opposed to anonymous announcements or releases that most people use anonymity for here) indicates that you're using anonymity for any particular reason, please stop so people can killfile you. Or send it from a nym at alpha.c2.org. I mean, the NSA has your real name anyway, what's the point... - --------- Jay Campbell <edge(a)got.net> writes: >>masquerade as Injuns in the 1800's and waylay Pony Express riders in order >> ^^^^^^ >>I think you'll find the NSA was not in existence in the 1800's. >I'm disappointed at the sheer number of similar pieces of email I received >on this. You'da thought the Capn Crunch reference was silly enough that >people would give me a funny look and trash the original message. Hmm, I guess most of them at least had the sense to not send it to the list. The list still sees FAR too many personal queries and rebuttals. TO THE GUILTY: take your bonehead replies to email please. Jay: I had a similar experience when I mentioned elsewhere that all the primes under 1000 digits were really invented by the NSA over 20 years ago. I recommended wearing garlic around the neck for protection... Everyone: This 1% wiretap thing is getting old. Hint hint hint - ---- Lastly, regarding cpunk icons, the only ones I was able to find were at the BAP site. I've been drawing a few of my own, one of them is done. It's a yellow diamond that says Cypherpunk on Board. And it has the anarchy-A- inside-a-C symbol. It's interlaced and transparent, so it doesn't look too bad. You're all welcome to steal it at http://students.cs.byu.edu/~don. Also working on a PGP icon. BAP has an envelope with PGP being the seal. I was thinking maybe a deadbolt ("PGP") with the inscription "Mommy said to lock the doors at night" or some kind of safety lock-your-doors or lock-your-data reference. For the time being I'm working on a simple PGP/ZLDF icon, it will be on my page Real Soon Now[tm]. If you like my icons please tell me. Don -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMJvC7sLa+QKZS485AQFrIgL/VuRfkh7i+K3W3bLyep26riXdZgIVC557 RRcHf9VcacXOGyVvT03JESqNxV/XRcW2k8WDQ+fwhMDEHbHjkzWT5fUxXm6knRGc K0drBF8WlW0ZobEaiU7SgEnVjus5kFj4 =iAr6 -----END PGP SIGNATURE----- <don(a)cs.byu.edu> fRee cRyPTo! jOin the hUnt or BE tHe PrEY PGP key - http://students.cs.byu.edu/~don or PubKey servers (0x994b8f39) June 7&14, 1995: 1st amendment repealed. Junk mail to root(a)127.0.0.1 * This user insured by the Smith, Wesson, & Zimmermann insurance company *

1 0