December 2003 - cypherpunks-legacy

ANNOUNCEMENT: IMC Resolving Security Complexity Workshop
by Dave Crocker 17 Dec '03

17 Dec '03

These are the final arrangements: Resolving Email Security Complexity Workshop 21 February 1996 * 8:30 AM - 5:00 PM San Jose (CA) Hilton & Towers * San Carlos Room (next to Convention Center) Pre-registration & payment: $50 * After February 16: $75 (cash, check, wire transfer, money order, or First Virtual) Pass this note on to others who are deeply involved in email security. AGENDA The meeting will be structured with a tight agenda, having a very focused sequence of work; it is definitely not for general education. Some amount of review is appropriate, but not much. The following agenda is tentative and will be reviewed and modified on the pre-workshop discussion list. Morning * Very briefly describe the MOSS, PGP, and S/MIME solutions * Review the functional and technical concerns * Review the extent to which each alternative satisfies the concerns * Seek consensus for concerns that qualify as requirements Afternoon * Haggle about the strengths and weaknesses of the technical alternatives * Explore the choices and/or negotiate a preferred solution ONLINE RESOURCES To register for the meeting: Web: <http://www.imc.org/workshop-registration> Email: <mailto:workshop-registration@imc.org> For discussion before and after the meeting: Web: <http://www.imc.org/workshop/> Email: <mailto:resolving-security-request@imc.org>

1 0

Re: Hash trees and bank solvency.
by James A. Donald 17 Dec '03

17 Dec '03

>"James A. Donald" <jamesd(a)echeque.com> writes: > > > One solution to this problem is government auditors. > > Government inspectors, unlike private auditors, can force > > their way in, in the early hours of the morning, and as each > > bank employee turns up, take him to a separate cubicle and > > interogate him with a gun in one hand and an account book in > > the other. This makes it difficult for the financial > > institution to fabricate a misleading picture of its > > financial situation. At 10:43 PM 1/27/96 -0800, Mike Duvos wrote: >This would be killing a mosquito with a flyswatter. Besides, the >employees of a financial institution may be in no position to >accurately state its financial situation, even if they are in >little cubicles with guns to their heads. I refer to actual practice, not to theory: (Though the guns are only metaphorically held to peoples heads, the examiners forcing their way in at dawn and ambushing the senior employees as they arrive are entirely literal.) The objective is to take them by surprise and interrogate them separately, to avoid them "hiding" some customers and some liabilities. If the element of surprise is lost, the examiners are likely to be confronted with truckloads of plausible, consistent, and entirely bogus documentation, as happens regularly. > A somewhat more civilized method is used by my broker, [...] Of course a broker's opportunity to pull this kind of fraud is less than a banks, because his customers will generally hold diverse stocks. Suppose the broker has embezzled some IBM stocks. Then he will have to leave out some customers that own IBM stocks from his record keeping. But this will frequently result in inconvenient excesses of other stocks and unexplained transactions in other stocks, thus the needed book shuffling is more elaborate and inconvenient than that of a bank. > I would trust the typical customer to mail back a form to an > outside auditor far more than I would trust him to examine a hash > tree, check his own entry, check the neighborhood of his own > entry for cryptographic integrity, and sound an alarm. But it only requires one customer to discover the failure in in a cryptographic tree, whereas to discover the failure in the method of book keeping you describe, we have to be sure we have covered all customers, and we have to be sure that they receive the same information that the auditor does, and how can one ensure that, except by the dawn raid method? > To be perfectly candid, I would not even want the task of > explaining to the typical banking customer what a hash tree was. That is what software is for: The task would of course have to be done by financial software, not done by hand. > The outside auditor can of course be spoofed by giving him access > only to some subset of customer accounts. The hash tree can be > spoofed by not telling a subset of customers of its existance. Set up the protocols so that software that verifies the hash tree generates certificates that are proof that you are eligible to receive the money, and software that does not, cannot generate provably valid certificates. Then if the institution comitts the fraud you describe, the ill informed customers who use the rigged software get stiffed, as they cannot easily prove that they were owed, and the better informed customers do not get stiffed. Notice that the above system requires that the banking software be supplied independently and separately from the bank. Customer expertise will improve dramatically after the first fraud, much as computer security improves dramatically after the first breach. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: SHA-2
by Kent Briggs 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >I think that has a bit to do with a question I had, whether it was SHA >and SHA-1 (aka "Revised SHA") but I've found the revised version being >referred to as "SHA-2" in a couple of sources and went with that.... >unless there *is* a third revision...?!? > >Problem is the memo I saw still referred to the revised algorithm as >SHA. (Anyone have a URL for FIPS 180-1 Please...?) > >Rob. > It is SHA-1. Look for FIP180-1.TXT on NIST's BBS at (301)-948-5140. I think they also have a web site but I don't have the URL (try Yahoo). Kent - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMQue3CoZzwIn1bdtAQFd3AGA0hJA7VvzmikZ8lC3ZPnkudPvpnivBi6e sabfhN3DZXGYuhuOrHsEbYVmiTSfLPUK =V5G8 -----END PGP SIGNATURE-----

1 0

Open NNTP servers and logging
by stephen_albert＠alpha.c2.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- A little while back there were some very helpful posts about getting started wit open NNTP servers. Since my regular site runs kinda slow in the news department I've been having fun poking around and seeing about getting more current. Then it dawned on me. People keep logs. Presumably routine logging would point right back at my ISP, and from there it'd be not too hard to pin down me specifically. No, I don't think anyone is particularly *likely* to do that, but why take chances? So...anyone know of open NNTP servers that *don't* keep logs? Or some other way around the problem? Thanks! Stephen "extra! extra! read all about it!" Albert stephen_albert(a)alpha.c2.org <*> PGP key on request and on servers -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMQYTNEimCtQtWVIdAQG/rQf/SnfVuv+fopypvTwKH9dm/4YPvwsgOjCG 5TBe0/wctyzVOEHoXiP3J/wagLrrvsuy8Xb3bRDWvJA+JoP5GOVh9RYG86ROG4Lf NIh1jKWG/FYotBYDclhROzv6+Fm4+7JXrbdVdPUTq5WwIHrmHeTMdkHv58WcJzOs PEvrpFUmTPswkIZbdyzrCz4P3GxsoUtu79Fe3QZNO83Jdwy8sIWFwGDvGq+WhJ3T 8/FLbJ2HLLqrXYYM4KYUSLShGvFyFqf/inZ9Ajbnx0p1hEXqR+/XZzyROEBdJWvJ PAIJA6ZiEeLeTXWD0jH1XlMElKAD7QYeJ2p9OcwhHabtEvgf7uIxSQ== =q/sb -----END PGP SIGNATURE-----

1 0

PAC_man
by John Young 17 Dec '03

17 Dec '03

1-28-96. TWP: "Informant's Revelations on Cali Cartel Implicate Colombian Officials." Inside the counterintelligence center for notorious Cali drug lord Jose Santacruz Londono was an IBM AS/400 computer storing coded information that listed thousands of bribes awarded by the Cali cartel to many individuals known collectively as "Caso 8000." The cartel's sysadmin has been decoding the computer's data and implicating officials from Colombian government, politics, the military and the entertainment industry. He later would be indicted as part of a major racketeering case brought by federal prosecutors in Miami against U.S. lawyers who allegedly have protected Cali interests here and abroad -- three private lawyers who are former federal prosecutors, including one who served as a high-ranking Justice Department official. PAC_man ----- TWP has a followup on the AOL raid, mostly a police story grisler on the cyber-prowling horny-cats. Has ICU of the terminal logoff by a 13-year-old nerd. The fuz posted a call-in for anon tips: "You know how many we've gotten from our on-line hot line? Not one. It's like they have this fantastic world they operate in, and we are seen as intruders or something." ICU_ded

1 0

When do patents expire on Rabin's public key scheme?
by James A. Donald 17 Dec '03

17 Dec '03

When do patents expire on Rabin's public key scheme? RSA claims that the Diffie Helman patent, which expires on the 29th of April, 1997, covers all public key cryptography. ElGamal and Rabin are unpatented. Schmeier says that ElGamal will be free of patent restrictions after that, but he says nothing about Rabin. Rabin's encryption and signatures take up the same amout of space as RSA signatures, and encryption, but ElGamal takes up twice the space, thus Rabin seems preferable to ElGamal. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

hash trees and bank solvency
by William "Bud" Kennedy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I am not so much worried about the bank stealing money out of my account as I am worried about them loaning to deadbeat countries to support some governmental idea of foreign policy. Then, of course, there is always the possibility that they will loan it to some deadbeat country, not because of the government, but because of just outright stupidity. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQu03QQo9ewScbyxAQE4HgP9GqMv8rs8PAEn16h8bZ0JHktAFm85EOr0 QI5BHqN2RYCpWzYpfE8aaD/4KgmKMJJQR2Ae0OSwBx6AY4CdgZlccr/ARn1a2vtN 5Wm7JQ2ymteWy5Jn0IocJkZkscX4q3WHp1Iuw8mhoT9+Y+0urOHHP+mH5YhDvj7R CaHWHAcI+iY= =U0jF -----END PGP SIGNATURE-----

1 0

Re: "German service cuts Net access" (to Santa Cruz)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:07 PM 1/28/96, Mike McNally wrote: >Timothy C. May writes: > > "Deutsche Telekom, Germany's national phone company, blocked its 1 million > > customers Thursday from gaining access to Internet "Web sites" maintained > > by customers of Web Communications of Santa Cruz. > >I have this urge to e-mail Deutche Telekom the output of an >appropriate AltaVista query so they can make sure none of that nasty >stuff is reaching impressionable German adults & children. It's interesting that some of the first things to pop up with a AV search of "Webcom AND Zundel" were instructions posted in one of German groups about how to bypass the access restrictions... [Actually, I just tried this search again, and didn't find the messages. Maybe I am misremembering I did last night, or maybe....] A Usenet message claims that Deutsche Bank is on the same Web server (?) and cannot access some of its customers. Whatever the precise truth of this, a side effect of countries trying to disconnect themselves from Bad Thoughts is disruption of commerce. This may provoke a bigger reaction than all of our protests and civil liberties points. --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Doctor Denning
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 02:52 PM 1/26/96 -0800, Timothy C. May wrote: >>What I found interesting was the lack of meat behind >>"Crypto Anarchy is Not Inevitable". It seemed to boil >>down to the vacuous "if everyone could just agree that key >>escrow is a good thing, there would be no problem". > >This is the main reason I haven't bothered to rebut her points: there were >essentially none to rebut. > >(There are substantive criticisms of my points that can be made, including >discussions of what might be done to delay or even head off crypto anarchy >completely. I had dinner a few nights ago with David Friedman, author of >"The Machinery of Freedom," and he made some incisive comments about how >the State might go about heading off this future. I'm glad he's on our >side, and not the government's.) > >Two other reasons I have not sought to rebut her analysis: > >First, I doubt many people saw either my original article (available on Bob >Hettinga's page: http://thumper.vmeng.com/pub/rah/anarchy.html) or >Denning's reaction article. > >Second, I stated my views, she stated her views, not much more to say. >Especially as she has not had an active presence on the Net, either in >talk.politics.crypto or in other forums I have seen, and thus a real debate >on the Net has not been possible. > >Mostly I know I can't change her views, so why bother? Other people may >have their views affected by what I say, and for these people I have >certainly written enough. Tim, trust me on this one. Dorothy Denning doesn't have a PRAYER. You already believe it, but I _KNOW_ it! Jim Bell Klaatu Barada Nikto. This will become important...soon Something is going to happen. Something...wonderful! (BTW, the above few lines, which looks like a canned signature, is not. Careful readers will note that I keep typing it in, which means that it isn't identical every time. This should be a clue to all you lurkers out there that I MEAN this; it's not just an idle macro. (It also means that I'm going to have to RTFM on my Eudora to do automatic signatures, but that's an ENTIRELY different story.) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQmQGfqHVDBboB2dAQF3lwP+JzEaN+sR9PdvnaWf2EnWJuDddZs86GbS cO7t+BLb/ALvAExBhBmVhMbYU1lFQS92akUQoMXBM/TLf330QR7E0FOjBdv12rqg n4RfFN7xV6Stib7gDOl2Q2niNqBusIzXT5Isv1A7x4NGF5Yxu7fVtUJ52tRBxHFI 9V+68Z21E4c= =SCkf -----END PGP SIGNATURE-----

1 0

The Politics of Mistrust
by John Young 17 Dec '03

17 Dec '03

The Washington Post initiates today a 6-part series on the loss of trust in all American institutions, "The Politics of Mistrust," based on a recent poll sponsored by the Post, Harvard and the Kaiser Family Foundation. While not directly related to technical crypto, a number of findings parallel discussions here about the diminution of personal and economic security. Samples: America is becoming a nation of suspicious strangers, and this mistrust of each other is a major reason Americans have lost confidence in the federal government and virtually every other major national institution. Every generation that has come of age since the 1950s has been more mistrusting of human nature, a transformation in the national outlook that has deeply corroded the nation's social and political life. Mistrustful Americans repeatedly expressed far less confidence in the federal government, the military, the Supreme Court, Congress and the Clinton administration than the dwindling numbers of Americans who were more upbeat about human nature. Fear of crime, economic insecurity and pessimism about the lives of future generations all have separately added to the belief that government is either making things worse or is incapable of making them better. Today, a clear majority of respondents in their early 20s said they do not trust their fellow Americans, a view they share with one in four Americans over the age of 60. "It's like living in the cave man age," said a 29- year-old. "Nobody cares anymore. Nobody cares. They will no sooner run you down and run away than to spit in your face." An environment in which a majority of Americans believe that most people can't be trusted breeds attitudes that hold all politicians as corrupt, venal and self-serving, and government action is doomed to failure. Wages have stagnated, workers change jobs frequently and downsizing corporations offer little protection even to the most loyal of employees. Americans who feel most pessimistic about the economy also are more likely to see the government as a threat. Harvard and Kaiser are to separately publish their own analysis of the poll. The first article offers much more detail and is quite long, about a page and a half. Perhaps someone might offer a site where this and others in the series could be made available as they appear. If so, send me a note.

1 0