December 2003 - cypherpunks-legacy

PHO_ton
by John Young 17 Dec '03

17 Dec '03

New Scientist, 24 February 1996: "Trick of the light fools forgers." Researchers at U-Conn Storrs are developing security systems that use a new kind of invisible code -- the phase of light. A transparent phase mask over a photo on a credit card would make it very difficult to forge. The authenticity of the card is checked by a reader composed of a laser light source and a device called an optical correlator. Bahram Javidi, leading Storrs researcher, will publish the latest findings in SPIE proceedings, called "Optical Security and Counterfeit Deterrent Techniques" (v 2659). "Good connections, quantum style." For quantum computers of the future, any "noise" in the connection between sender and receiver could prove disastrous. The problem is that the data in such computers will be held in the form of individual photons and, since quantum theory states that they cannot be checked because the mere act of measuring them will transform them, every error that creeps in will go uncorrected. Now IBM researchers have come up with a way to make the connection crystal clear (PRL, v 76, p 722). [Cf. recent thread "IBM's Breakthrough."] PHO_ton

1 0

Re: Numbers don't lie...
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 11:18 AM 2/18/96 -0500, A. Padgett Peterson P.E. Information Security wrote: >The second point is that their scalability seems to be based on costs per >chip alone, cost for which the engineering cost has been recovered and for >which the yeild is significant, hardly givens when you are talking pushing >the state of the art, given this 200 Mhz Pentiums would be U$10.00 also >(well, maybe U$25.00). Doubtless that is why they assume chips that are very far from state of the art: Since interprocess communication is trivial for key cracking, you are better off using large numbers of cheap chips, than smaller numbers of good chips. >Finally, no cost is allocated to the sustem required to program/evaluate >the ponderings of these 100's of ASICs. As anyone who has ever programmed >a massively parallel computer (which is what they are talking about in their >brute force machine, it is the boundary communications that kill you. Again: Interprocess communication is trivial. A brute force key cracking machine is *not* a general purpose massively parallel computer. Suppose you have a million chips. Each chip tries keys. A few bytes of the plaintext, headers and stuff are known. Assume eight bytes known. Then we could handle the interprocess communication with a single desktop computer. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

CDA Strikes.
by Ludwig von Drakenberg III 17 Dec '03

17 Dec '03

Read this in http://www.zippo.com/editor.htm. > So what's the plan....man ? > > So the CDA has come to pass and we need to move on. People will test the > constitutionality of bits and pieces of the Telecom Law, a conservative > supreme court will find the law valid, or refuse to review it. Things will never > be the same. For those who think they will be, or the for the" Don't worry, > President Clinton won't enforce the law" crowd, Friday marked the first arrest > under the new law. They picked an unsympathetic figure, twice before > convicted child pornographer, and got him for illegal data transmission over > the Internet. > Next time it won't be such an unsympathetic figure. It will be some ISP, > minding their own business, not knowing they have a user that didn't read the > rules. They'll spend a year in federal court, defending their postion based on > not knowing they comitted a crime. In the end, they will win, but they'll be > broke, and out of the business. Won't happen to large providers, too political, > and they have the resources to do all of the CDA compliance window decorating. -- Ludwig von Drakenberg III God *is* the dice of the universe. drake(a)servidor.unam.mx My goddess gave birth to your god. Facultad de Ciencias, UNAM Fuck the CDA -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCNAzExbCgAAAEEAONJqT5AeaOg29oT2WXzpgkMQ/BxZXCiduJsOAWRRIPlkOQc 7RN2ooQKJmvHamhoaXktoIbmpK3fkPoEt4OONDtncmOKQKKKl9BgifUW9lO1msRp W0WIGZ9wTlX/1j6RTcdAEEWqWlBi4xz8A7a3MJdoIANPOV1Zs6HEQwyN9No5AAUR tCpFZHVhcmRvIEVzY2FsYW50ZSA8ZHJha2VAc2Vydmlkb3IudW5hbS5teD4= =nmxM -----END PGP PUBLIC KEY BLOCK-----

2 1

Re: "Physical Reality"
by Duncan Frissell 17 Dec '03

17 Dec '03

At 08:41 AM 2/28/96 +1100, Mark wrote: >I dislike having to follow up something so unrelated, but the bad boys are the >criminals, the song is about what will you do when the cops come for you. >The cops are not the "bad boys" in the song. Trust me. > >Mark > Actually, the song is deliberately ambiguous. Because the phrase "Bad Boys" is repeated at both ends of the verse, you can't tell whether it refers to the cops or perps or both. I don't know the origin of the song but I recall in life or in fiction a special (Las Vegas?) police unit that called itself the Bad Boys. Certainly the Bad=Good reversal is well established in popular culture. DCF

1 0

VAN_goh
by John Young 17 Dec '03

17 Dec '03

2-26-96. FT: "Net's rivals feel the squeeze. A quiet revolution is transforming global electronic trade." Value added networks (Vans) such as GEIS and Advantis are already at risk from the Internet, according to Price Waterhouse's *Technology Forecast*, a panoramic sweep through today's electronics, from chip designs to video compression software. Electronic commerce, the forecast says, has become a worldwide phenomenon, reshaping marketplaces, trading relationships and international trading boundaries. 2-27-96. NYT: "AT&T Makes Belated Move On Internet." John Markoff. AT&T is to introduce a service Tuesday that it hopes to use to link millions of its long-distance telephone customers to the global computer network. Analysts said the entry by AT&T was certain to alter the competitive landscape for ISPs. It will offer relatively inexpensive dial-up access to the Internet and the Web to personal computer users at home. Company officials said pricing will "be aggressive enough to make the industry sit up and take notice." "You're about to see a new AT&T," said an analyst. The service will use Netscape for browsing and a search tool designed by Verity Inc. VAN_goh

1 0

"Physical Reality"
by Duncan Frissell 17 Dec '03

17 Dec '03

At 12:23 PM 2/21/96 -0800, L. Detweiler wrote: >Barlow brings up this topic in his recent "cyberspace declaration of >independence" (which can clearly be criticized as out of touch with >physical reality but is nevertheless compelling). Various critics of cryptoanarchy from D. Denning to L. Detweiler to A. Grove, to J. Kellstrom to the 1991 instance of P. Metzger have argued that the continued existence of the physical attack medium renders this new form of social disorganization DOA. Boiled down to its essentials, this argument can be expressed by the lyrics of the song "Bad Boys" as used as the theme song of the reality TV show "Cops." For those who no longer participate in the previous culture, they are: Bad Boys, Bad Boys Whatcha gonna do? Whatcha gonna do when they come for you? Bad Boys, Bad Boys repeat endlessly. I would suggest instead that the critics of cryptoanarchy are out of touch with "physical reality." For the "Bad Boys" to come for you, a whole series of requirements must be in place: 1) There must be Bad Boys 2) They must be able to travel 3) There must be a reason for them to come "for you". They need motivation 4) There must be a you 5) The Bad Boys must know where you are 6) The Bad Boys must be able to travel to where you are 7) The answer to the question "Whatcha gonna do?" must be "nothing" (This would seem to be implied by the song.) 8) They must have something to do to you when they "come for you" otherwise the journey is a waste of time. Let's examine each of these requirements to see how technological change has affected them. 1) There must be Bad Boys There are fewer Bad Boys these days. Not that Human Nature has improved all that much but law enforcement employment (relative to population) is down. The collapse of the SU and the Eastern European police states has dramatically reduced the world population of government agents. When 1/4 of your population was in the enforcement business full- or part-time (as in the DDR), the end of that system reduces the supply of "muscle." Note that during this Century of Blood, governments were murdering someone every 20 seconds or so (160 million in the last 100 years). Reports indicate that the death rate is lower these days. Occasional minutes go by without any murders by government. Additionally, even in places like the US where there would seem to be more enforcement personnel employed than ever before, bureaucratic management has worked to reduce worker productivity. Since law enforcement is still organized along Stalinist lines (state ownership and management, hierarchical organization, pay unrelated to performance), not much actual enforcement is undertaken. A New York Times article on INS agents whose job it is to find and arrest illegals within the US said that they were allowed to grab about one perp a month. The rest of the time was spent on paperwork. At the rate of 12 deportations a year per agent, it will be quite a while before the backlog is cleared. And, indeed, all the evidence we have from studies of the "clearance" rates of crimes to the street price of illegal pharmacuticals, to the "average time served per crime" suggest that effective enforcement is down. This is what we would expect since the law enforcement system has retained a very traditional organizational model while the rest of society has become much more efficient. A massive increase in what we might call "regulatory targets" combined with a decrease in the number and efficiency of the regulators, means less regulation and effectively fewer Bad Boys. 2) They must be able to travel If the Bad Boys are to come for you, they have to be able to travel. The internationalization of the modern business and communications environment has made this more difficult. There are very few enforcement agencies that have unlimited budgets of the sort that allowed Lt. Gerard to chase Dr. Richard Kimball around the country for years on end. Enforcement is largely a matter of chance. The Bad Boys come for some small part of the criminal population and leave the rest alone until chance brings them within reach. A multinational investigation and enforcement program costs the earth. It will only be undertaken in very significant cases. Nation states are still the basic unit of enforcement and so jurisdictional conflicts cause many costs and delays. Since it is part of human nature to be more concerned with one's own "stuff" than with other's "stuff," foreign enforcement agencies won't pursue cases with as much energy as domestic agencies might be willing to. One way that people are more powerful than governments is that people (or their corporations) can be citizens/residents of several nations much more easily than a single nation can rule the citizens/residents of other nations. Even within the United States, jurisdictional differences among the states can be exploited by natural or artificial persons. As regional trading blocks like NAFTA and the European Free Trade Area spread, people will be able to move around much more easily than government agencies. Since there are no sovereignty issues raised when people do business in multiple jurisdictions, these distance and jurisdictional barriers will fall much faster for private parties than for the government Bad Boys who want to come after them. <More Tomorrow> DCF

2 1

Re: Proposed Legislation Regualting Expert Testimony
by rah＠shipwright.com 17 Dec '03

17 Dec '03

A nameless associate, who lives in Albuquerque, seems to have a local perspective on this... >Date: Mon, 26 Feb 1996 17:11:54 -0500 >To: rah(a)shipwright.com >Subject: Re: Proposed Legislation Regualting Expert Testimony > >Bob, > >It is clear from the following why the bill did not pass: > >>When a cryptologist or computer expert testifies during a criminal >>defendant's penalty hearing, the cryptologist or computer expert >>shall wear a cone-shaped hat no less than two feet in height for the >>duration of the hearing. The surface of the hat shall be imprinted >>with stars, moons and lightning bolts. >> >>Additionally, the cryptologist or computer expert shall be required to >>wear a white beard no less than eighteen inches in length for the >>duration of the hearing. The cryptologist or computer expert shall >>punctuate crucial elements of his testimony by stabbing at the air >>with a wand no less than one foot in length. >> >>Whenever a cryptologist or computer expert provides expert testimony >>regarding the defendant's methods, the bailiff of the court shall >>dim the lights of the court room and shall administer two strikes to >>a Chinese gong." > >You see, the conical hat, the beard, and the wand are the costume of Manny >Aragon, >the President pro tem of the Senate, and the striking of the gong is the >conditioned response of Ray Sanchez, the Speaker of the House, to anything >Manny says. Of course, *black* hats and goatees on cryptographers are somewhat de regeur, cf. Sameer, Eric, Derek, etc. By the way, do *you* have a black hat, Tim? Cheers, Bob Hettinga PS: I'll stop now. ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

In favour of privacy legislation
by Rishab Aiyer Ghosh 17 Dec '03

17 Dec '03

> The problem is the WILDLY broad/excessive scope of the legislation AS WRITTEN. I agree that the legislation, as written, one of the shortest I've seen, is overbroad. However, it's not _that_ far off the mark. Most of your objections (such as the one relating to unauthorised biographies, which are more likely to be challenged using existing libel laws than privacy legislation that doesn't specify penalties) can be answered with a simple change: replace "personal information concerning an individual" with "personal information concerning an individual directly gleaned from that individual's statements or actions." Or something. So if you build a database tracking my purchases at your store, or what I fill in your subscription forms, you can't resell it. OTOH if you buy my dossier from someone _else_, you're not liable, though your source probably is. So you could publish biographies or political exposes and only the primary source would be liable. That source is often liable in any case, due to existing laws concerning theft, trade secrets, breach of contract etc; it's just that primary sources in these situations are almost never identified. > AS WRITTEN, it would prohibit -- > * making available for a fee, information about pedophiles, rapists, etc., Ah yes, this would include the 98.32% of Internet users who are paedophiles. You don't believe that paedophiles and rapists deserve the same legal and constitutional treatment as anyone else? "First they came for the Jews..." > * maintaining a public-access database for profit, offering consumer > information about landlords' abuses of security deposits -- or renters' > abuses of property, > * making available for profit, almost all information about individuals in > public civil and criminal court records, These, along with databases on (proven) rapists, depend on policy for the use of "public" - government-held - information on individuals. In most countries, this is governed by widely distributed regulations, not any single privacy law. For example, the European restriction on publicising names of minors charged for serious offences _during_ trial. If the simple change on direct sources is made, these do not impact privacy legislation. > I have no problem with *carefully* constructed privacy protection. But (1) > that turns out to be VERY hard to construct, and (2) this bill ain't it. Legislation governing free speech in the US is huge. The body of law that strengthens free speech (interpreting "Congress shall make" as "any level of government shall make") and restricts it (taking "no law" to mean "no law except to prevent obscenity, libel, etc") goes far beyond the deceptively simple First Amendment, but this complexity and bulk is not a common argument against free speech legislation. The California bill, with some changes, may not be a carefully constructed body of law but could be a decent start. My personal opinion, living as I do between one country - India - that is still (fortunately?) fond of habitual civil disobedience, and another - the Internet - where civil disobedience is a technologically assisted state of mind, laws are an irritation. But if they are to exist to protect _some_ rights, they should, for aesthetic balance if nothing else, exist for _all_. Rishab ---------------------------------------------------------------------- The Indian Techonomist - newsletter on India's information industry http://dxm.org/techonomist/ rishab(a)dxm.org Editor and publisher: Rishab Aiyer Ghosh rishab(a)arbornet.org Vox +91 11 6853410; 3760335; H 34 C Saket, New Delhi 110017, INDIA

1 0

Re:
by galvin＠eit.com 17 Dec '03

17 Dec '03

At 8:55 PM 2/22/96, Raph Levien wrote: >MOSS is dead, long live MOSS >---------------------------- > > There were five contenders on the field going into the day, and two >and a half at the end. MOSS was one of the casualties. A lot of us >were sorry to see it go, but eliminating candidates has got to happen >if we're going to have interoperation. > It's hard to say exactly what went wrong. MOSS had many advantages, >and was a nice, clean, pretty standard. I think what doomed it was the >lack of a good implementation. > Even though MOSS is no longer considered a serious contender, one >piece of it is still very much alive: the multipart/signed message >format. At the end of the day, there was strong, nearly unanimous >consensus that multipart/signed should be recommended as the signed >message format for _all_ of the email encryption protocols. I debated about responding since you are entitled to your opinion. After thinking about it for a while I decided I need to say a little something. It's my impression that MOSS suffered from lack of representation at this workshop. I got that view from at least 6 different people, so I believe it to be true. That said, I think it's unfair to declare its demise. Further there is a good implementation of MOSS. It was even announced at the workshop. Did you miss it? TIS has done an implementation that is available for anonymous FTP, albeit only within the US. It's integrated with MH, not the most favored mail user agent, but the current version has shell scripts that perform minimal MIME functions to facilitate integration with other agents. Finally, multipart/signed and multipart/encrypted are not MOSS. They are a framework independent of any particular secure email technology. True, MOSS depends on them, but I regard that as a feature not a bug. Jim ---------------------------------------------------------------------------- James M. Galvin galvin(a)eit.com VeriFone/EIT, PO Box 220, Glenwood, MD 21738 +1 410.795.6882

1 0

RE:
by Blake Ramsdell 17 Dec '03

17 Dec '03

> Further there is a good implementation of MOSS. It was even announced at > the workshop. Did you miss it? TIS has done an implementation that is > available for anonymous FTP, albeit only within the US. It's integrated > with MH, not the most favored mail user agent, but the current version has > shell scripts that perform minimal MIME functions to facilitate integration > with other agents. Is there a version that can be used in commercial applications? There is for PGP, S/MIME, and (I think) for MSP. From a developer's point of view, this will influence my decision between specifications. Blake

1 0