December 2003 - cypherpunks-legacy

Internet Stocks
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:14 PM 12/7/95, Adam philipp wrote: >16% tumble today... > > ...is the word getting out? > A few of you have corresponded with me about investments, Internet stocks, etc., so I reckon there's enough interest out there to share a few thoughts with you. Those who think this list has only to do with number theory or PGP are of course welcome to skip this message now and get back to reading Koblitz. I won't say anything negative or positive about Netscape per se, but here are some various developments: * A Smith Barney analyst today made essentially the same sort of comments that I (and maybe another or two) made several days ago, namely, that the market capitalizations are incredible ($7 B for Netscape at $170/share), that browsers are not a proprietary "franchise" (in that the standard is an open one), that a lot of competition is coming (Spyglass Mosaic, Oracle, Microsoft, etc.), and that many people hysterically bidding up the price of Internet stocks are barely aware of what this "Internet thing" is. He issued a "sell" recommendation on Netscape, an "underperform" recommendation on Netcom, Spyglass, UUNet, etc., and was generally bearish on the sector. (I saw him interviewed on CNBC, minutes before Marc Andreessen was interviewed.) * From a high on Tuesday of $170, Netscape was down to $130 at one point today. I haven't seen the closing price. * Analysts are also closely looking at the February '96 end of the "lockout" in some stock sales by Netscape employees. Basically, a lot of the shares that went to employees, etc., cannot be sold for 180 days after the IPO, which was in early August of this year. The effects of shares being put on the market is not clear, of course, and it is possible the effects will be minimal. Still, it might be prudent to take this account when considering strategies. * Microsoft also made announcements indicating a move closer to a standard Web browser strategy (as opposed to trying to sell the world on Microsoft Network). deal with Spyglass, and a licensing of JavaScript. (There've been too many deals connected with browers, Java, etc. for me to even begin to summarize here.) * Sentiment moves in waves, as per the Dutch tulip bulb scenario, and what was headed for the moon a few days ago is suddenly a turkey, to many. The whipsawing in Netscape, UUNET, Netcom, etc., is incredible: up 30 points in two days, then down 30 points in two days! By the way, some have sent me mail asking about how to sell these and other stocks short. One can sell them short directly (getting the money now and agreeing to deliver the shares at a later date), but this is risky, should these stocks rise. (And some of these shares are not readily available for short sales, due to the limited number of shares on the market and the difficulty of finding someone to lend the shares for a short sale.) One's risk is essentially unbounded (but practically there are some reasonable limits to how much the stock can rise, of course). Short sellers are always advised to remember this maxim: "He who sells what isn' his'n, must buy it back or go to prison." (It is said that some of the rise in Netscape stock price is due to "the shorts running for cover." That is, those who shorted the stock at, say, $80 are frantically trying to buy the stock to close out their positions. This can cause the relatively few shares to be bid further and further up. As I keep saying, be careful in believing this or not.) A safer strategy is to buy puts and calls, or to sell puts and calls. Buying "puts" (my mnemonic: the right to "put it" to another investor) involves, say, buying the right to sell a stock at some price in the future. Thus, one might buy a put on the Internet Index (http://www.amex.com) a collection of Internet-related stocks, to sell the IIX at $25 in April, '96 for a strike price of $255. If the IIX goes _up_, and as April approaches, that put will become worth less and less and may become worthless. If the IIX goes _down_, that put becomes more worthwhile (because one has the right to "put" it someone for $255 when the actual value of the IIX has dropped to, say, $200. (Roughly speaking, at expiration in April '96 this put will be worth $55, for a doubling of one's original investment; the pricing of options depends on a lot of things, including risk, time value of money, expectations, etc.) At this point there are no widely-available puts and calls on most of the recent high-fliers on the Internet. This is why the IIX looks to be a way to play this game. Interested investors should also look at LEAPs, which are essentially puts and calls with much longer expiration dates. A friend of mine bought $25K worth of Intel LEAPs (JAN96s) during the height of the Pentium debacle, when Intel was trading at $30, and in the next six months this $25K investment became worth over $300K. (Needless to say, your mileage may vary. Don't blame me if you lose your shirt. Bulls make money, bears make money, but pigs never make money, as another maxim goes.) --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Python Cryptography Toolkit v1.0.0
by Andrew Kuchling 17 Dec '03

17 Dec '03

I've just uploaded version 1.0.0 of the Python Cryptography Toolkit, a collection of cryptographic routines for the Python programming language. It's at ftp://ftp.cwi.nl/pub/pct/pycrypt100.tgz. All my code is public domain; some of the algorithm implementations are GPLed. The Toolkit now contains various cryptographic algorithms such as DES, IDEA, MD5, etc. I will fix bugs in the software, and may add or remove the odd module if some startling new research result comes out, but things should be pretty stable from now on. The algorithms available are: Hash functions: Haval, MD2, MD4, MD5, SHA. Private-key encryption: Blowfish, DES, DES3 (Triple DES), Diamond, IDEA, Alleged RC4, 32-bit RC5, REDOC III. Public-key: Digital Signature Standard, ElGamal, RSA. (There's a non-functional ESIGN module included, too; I'll finish it for a subsequent release.) Python is an interpreted scripting language; see http://www.python.org for more information, the source code, and binaries. It includes arbitrary-sized integers, so the public-key algorithms are implemented in pure Python; this entails a speed penalty, but makes the code more valuable for educational purposes. A sample usage of a hash algorithm (MD5) is: >>> import md5 >>> hash=md5.new() >>> hash.update(message) >>> hash.digest() '\235\361\034\357\217MX\2246\226\367\366Ebx\326' A sample use of an encryption algorithm (IDEA, in this case) is: >>> import idea >>> obj=idea.new('This is a key456', idea.ECB) >>> message="The answer is no" >>> ciphertext=obj.encrypt(message) >>> ciphertext '\2325$\343=)d\341^\025<\344\013\204 T' >>> obj.decrypt(ciphertext) 'The answer is no' Questions, comments, or suggestions are welcomed at the address below. Andrew Kuchling andrewk(a)cst.ca

2 2

Re: Still more on the Digicash protocol
by jim bell 17 Dec '03

17 Dec '03

At 10:03 AM 12/7/95 -0800, you wrote: >I am glad that DigiCash supports this type of cash which anyone can >deposit. Actually, I am surprised and puzzled that it does, given >Chaum's apparent reluctance to endorse schemes to allow payee anonymity >(due to political problems, apparently). I, on the other hand, think one of the best uses of digital cash is to drastically reduce and eventually eliminate the whole concept of "government." I see payee-anonymous digital cash as being absolutely essential.

1 0

revised librand now on ftp.research.att.com site
by Matt Blaze 17 Dec '03

17 Dec '03

Sorry for the noise, but I just discovered that the librand.shar file that I put in my ftp directory got garbled somewhere along the line. I've repaired the damage and put a correct version of the file in: ftp://ftp.research.att.com/dist/mab/librand.shar (Worst of all, the garbled version actually compiled, but you can tell you have it by its failure to link properly). Again sorry for the noise. -matt

1 0

Netscape stock on 12/7/95
by Adam philipp 17 Dec '03

17 Dec '03

2 1

Micro$oft and Java
by gorkab＠sanchez.com 17 Dec '03

17 Dec '03

Microsoft announced its Internet plans, and is considering licensing Java from Sun Microsystems. Other parts of the plan: OLE controls that can be transmitted over the Web, acting like applets; Web-related enhancements to Visual Basic; commerce, security, publishing and server software. [WSJ 12/7 p.B8] IBM joined the ranks of companies licensing Java software from Sun Microsystems. The company plans to integrate the technology into all its Internet software and operating systems, including the version of Windows 3.1 it sells. [NYT 12/7 p.D2] [WSJ 12/7 p.B8]

1 0

Re: Is there a lawyer in the house?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:27 PM 12/7/95, cme(a)acm.org wrote: >It could be even worse. I was on a panel last year with Scott Charney (sp?) >(I believe from DoJ) during which he commented that if you give your secret >key to anyone -- e.g., your own company -- then you have given up the >presumption of privacy. That leaves the police open to get that secret >without a warrant. This claim should be checked by a real lawyer. Huh? You mean if you give me your key the police can get it from me without a warrant? What if I don't want to give it up, and you don't? How would the police get it without a warrant? (And "I" could be your employer, so the point is clear.) And even more strikingly, what if you give your private key to your lawyer for safekeeping? Has attorney-client privilege gone away? (Granted, there are ways to break attorney-client privilege, but these are rare exceptions. In any case, the police could not get the private key without a court order, warrant, whatever.) I can believe that some cases of giving up keys wipes out one's arguments based strictly on "privacy," but not that it wipes out other arguments. It seems to me that if one wants to voluntarily escrow private keys, for safekeeping, one's personal lawyer is a safe bet: it is very difficult to break this kind of attorney-client confidentiality, from what I know of such things. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

7 14

CPUSA = CypherPunks USA?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:39 PM 12/7/95, E. ALLEN SMITH wrote: > I suspect I know what organizations they're interested in (CPUSA et >al), but did they ask about any specific organizations? CPUSA? You mean "CypherPunks USA"? I agree that being on the Cypherpunks list is probably a serious threat to one's security clearance. After all, the things we talk about are destabilizing to governments, are conducive to creating open channels for releasing material anyone thinks is useful to be released, and even makes espionage trivial. (We seldom mention this, it being old hat, but the Aldrich Ames' of the world need no longer resort to archaic tradecraft such as leaving messages in Coke cans in the crooks of trees--digital dead drops are as close as your nearest PGP package and remailer. This is a revolution in espionage--not that I am advocating or condoning it, although it is often necessary and even moral.) Given that many of us take an explicitly trans-national approach, with little or no loyalty to local and national governments, and given that many of us advocate a Nietzschean kind of personal choice in deciding which laws to obey and which to ignore, our outlook is probably as dangerous to secret programs as membership in the Communist Party would be (especially these days, where membership in the CP would be seen as either a sign of slow thinking or quaintness). --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Still more on the Digicash protocol
by daw＠delhi.CS.Berkeley.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Just a clarification about my comments on privacy against eavesdroppers with Digicash. I admit I didn't express myself very well the first time. In article <199512071610.KAA16536(a)admin.starnet.net>, Mark Twain Ecash Support <support(a)marktwain.com> wrote: > > >Worse still, anonymity for the shop is worse with Digicash than with real > >cash. If I pay you real cash on a secluded street, you're fairly anonymous. > >If I pay you Digicash over the Internet, any passive eavesdropper could be > >recording your identy and the whole transaction. Blech. > > This is raising an issue that has nothing to do with Ecash. The complaint is > in fact about the lack of a gereral link encryption on the Internet. I agree > that this is needed, but providing it really isn't Ecash's job. I am eagerly > anticipating the general use of IPSEC. > Hrm, I think you misunderstood what I was trying to say. Assume the attacker is not doing any traffic analysis. The problem is that even then, the shop's identity (and product info, and payment amount, and bank ID, etc.) are still sent *in the clear* in the Digicash payment protocol. Thus all those items can be correlated to the payee's identity: a complete loss of privacy for the shop. There's no need to send that payment info in the clear -- why not encrypt? If it is encrypted, a passive eavesdropper can only learn the payer's & payee's identity if he uses traffic analysis, and even then he doesn't know the payment amount, product description, etc. For all he knows, the transaction could've been a $0.01 cent donation to Sameer for his anonymous remailer, or it could've been a $10,000 transfer to Sameer's machine in (virtual) Anguila-space for a few dozen Apache servers. (So this also has implications for payer anonymity & privacy, not just payee privacy. When payment info is sent in the clear, and the eavesdropper is doing traffic analysis (e.g. by sniffing the link out from a small business), the eavesdropper can correlate payer's identity with the payment amount, product description, and other buying habit information. When Digicash protocol messages are encrypted, this information isn't released, and can't be correlated with payer identity, even when traffic analysis is being done.) That's why I really wish Digicash were encrypting all its messages. And I'm very glad to hear that Digicash will support sending the entire protocol over a SSL-protected link. Great feature! I'll be looking forward to it. > >* continue specifying the protocol at a deeper level, like you promised > > (and throw in source for security-critical modules too, eh? :-) > > Writing all this down takes time. DigiCash may hire a tech writer soon. That > should improve communications between all parties. Excellent! Thanks for all you're doing to improve Digicash's anonymity, privacy, and security features, Lucky. I think it's really important to get this right in the pioneering work... - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMMeEBCoZzwIn1bdtAQFzYAF/agJtA7eal+rEP0ki34FY/vyKc/EDqJ0p QR1T+zJZ0tn6i1hwluqlmvigJpWNst41 =/NJW -----END PGP SIGNATURE-----

1 0

Re: Micro$oft and Java
by Joel McNamara 17 Dec '03

17 Dec '03

I was at the Microsoft presentation. Crypto-relevant info: A patch will be published in the next few days to address the weak .PWL encryption. I got a rather lame excuse about how the encryption was first implemented in 1991, and how it was sufficient then. They will supposedly be changing the seed. I asked about what MS was doing in regard to future strong crypto. Got an interesting response in that that "the government was going to let them implement 768 bit keys." I later asked an MS person if these were RSA session keys or what. He said yes, but I really don't think he knew what he was talking about based on some of his other comments. Visual Basic Script will be MS's response to JavaScript. The interesting thing here is a plan to use digital signatures on controls and scripts as a means of authentication. The comment was made "you'd trust something signed by Lotus or some other big name, but you probably wouldn't be that trustful of a piece of shareware." Hmmm... MS will be releasing a "safe" runtime version of Visual Basic that will supposedly prevent nasty virii and trojan horses from being implemented on Web pages. IMHO, Perry's previous comments on the security of Java apply. Servers and some clients will support end-to-end encryption. No details... I didn't ask about GAK. Bill said there was a white paper explaining Microsoft's position on encryption. Maybe I'll test the search capabilities of the MS Web site later tonight. Overall, the presentation was interesting (but obviously lacking in technical details as the audience was mostly press). MS is going to throw a lot of resources at this in order to maintain its industry dominance. Thought for the day. Bill on the relevance of the briefing being held on Pearl Harbor day quoted Admiral Yamamoto after the 1941 attack, "we have awoken a sleeping giant." Draw your own conclusions on that one... Joel

3 2