December 2003 - cypherpunks-legacy

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

The database size is really only half the problem I think. The bigger problem is managing the database. I can't quite see it being possible to have one organization serve as a distribution point for all keys. With millions of billions of certs, you're going to have having thousands or millions of database updates on a daily basis. It does seem though that if you can truly eliminate revocations then things get a lot easier. You never have to go back a check with the issuer about anything. This will probably work for some applications, but there's certainly others for which it won't. LL At 2:21 PM 2/29/96, Carl Ellison wrote: >At 12:01 2/29/96, Laurence Lundblade wrote: >>I think a problem occurs when you have 20 billion of >>these certs (two for every person in the year 2010 or such). A simple hash >>into a table isn't going to cut it because you a single database (with >>replication?) isn't going to be possible. > >BTW, at the rate that memory gets cheaper and smaller, it might be quite >reasonable to have that single database fit alongside your daily appointments >in your shirt-pocket daily organizer and e-mail terminal, in 2010. > > >+--------------------------------------------------------------------------+ >|Carl M. Ellison cme(a)cybercash.com http://www.clark.net/pub/cme | >|CyberCash, Inc., Suite 430 http://www.cybercash.com/ | >|2100 Reston Parkway PGP 2.6.2: 61E2DE7FCB9D7984E9C8048BA63221A2 | >|Reston, VA 22091 Tel: (703) 620-4200 | >+--------------------------------------------------------------------------+

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

3-1-96. TWP: "Expert Panel Wants Intelligence Director to Hold More Power." The commission finds that the patchwork of 14 separate intelligence agencies is functioning well in its current form. To meet tbe growing threat of worldwide criminal activity the panel suggested creation of a high-level policy group run out of the White House, called tbe Global Crime Committee. It would be chaired by the president's national security adviser and would include the AG, State, DoD, and the DCI. "Turner: CIA Nearly Used A Journalist in Tehran." CIA's covert operators do not want to reopen the debate. As Turner put it, "Is the media case stronger than businessmen or academics? The covert operators are worried that we may reach a point where prohibitions will get us down to where there is nobody left to spy but the Foreign Service." 3-1-96. NYT: "Commission Recommends Streamlined Spy Agencies." Most of the changes the report will recommend are evolutionary, not revolutionary. Intelligence officials used the same word to describe it: "underwhelming." The report fails to answer the big overstaffing problem. An official said the resistance within the intelligence agencies to staff cutting would be so strong that the downsizing would never happen. MAF_ios

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

I think we are in violent agreement here... > I disagree but then my worldview is different. For personal use the > compact distributed system is workable however when you start thinking > in terms of a large distributed organization, the quanta changes. > > Mention was made of the difficulty of handling 20,000 keys. I am looking at > over 80,000 today and over 200,000 tomorrow *for a single organization*. For > quantities like this, a hierarchial system of management seems inevitable. Perhaps you misunderstood what I mean by "central keyserver model". What I mean by that is the status quo, where we have a set of central keyservers and each keyserver knows about each key. When I say that this will disappear, I mean that we will move towards a more distributed system, similar to the DNS for looking up hostnames. Yes, we will need a distributed, hierarchial [sic] system in the future, and if we want to continue using PGP we will need to provide a simpler way to use that. > First, I am not about to give up my personal PGP key, it is trustworthy and > effective for my needs. It is not necessarily incompatable with an > organizational structure. This is true. > However *for the organization* something else is needed. I can see a > future in which the bulk of the population has only two keys: their own > and the punlic key of their post office (not talking USNail - private ones > though not saying the US might not operate one as well). I disagree. I know the addresses of the people with whom I communicate regularly. I know my parent's USnail address, my grandparents', my SO's, etc. I dont need to tell the Post Office "Send this to my parents" and trust them to do it. I give them a destination address and trust them to send it to the proper destination. The same thing is true in the electronic world. I put a destination on the email, give it to the mailer, and trust it to send it to the appropriate destination. A similar anology can be made when I dont know an address: I ask someone for it. Same thing with an email address/PGP key, I need to ask for it before I can use it. The same thing is true of hostnames. I can find a hostname<->IP address for just about any host on the planet. Do I have them all on my local disk? No, of course not. I look them up when I need them. However, I do cache local copies of the names I frequently use. > As noted, a hierarchal mechanism will be needed for key retrieval - > only local keys and "frequent fliers" will be kept locally. Not new > concept, just not used by post offices that I know of today. Yes, this is true. And it is used -- its called regional phone books. If I want to get a number for someone, I go to the regional phone book and look them up. I have to know something about them first, so I know where to look. If I asked you to find the machine "incommunicado" and tell me it's IP address, what would you do? You'd have to look in every domain for machines named "incommunicado". However, if you knew that I meant "in the 'ihtfp.org' domain", you'd know exactly where to look. The same is true of phone numbers. The same is true for keys. > Will need a bit of fleshing out and expect the end-state to be 2-4 years out > but is a good time to think about it. True. The problem is that with PGP messages, the only information about keys is a "random" keyID. From a keyID there is no way to determine that key unless you already have it. This means that if you do not already have the key, you have no way to find that key. See the problem? This is like the "find 'incommunicado'" problem above. What I propose is to modify, slightly, the PGP signature certificate to add a "hint" field. This hint field would tell you where to look for the key. This is the way to add the "ihtfp.org" info to the PGP signature. I hope this clears up any misconceptions... -derek

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

Where can I find it? Please send ftp or URL via private E-Mail. (define(RSA m e n)(list->string(u(r(s(string->list m))e n))))(define(u a)(if(> a 0)(cons(integer->char(modulo a 256))(u(quotient a 256)))'()))(define(s a)(if (null? a)0(+(char->integer(car a))(* 256(s(cdr a))))))(define(r a x n)(cond((= 0 x)1)((even? x)(modulo(expt(r a(/ x 2)n)2)n))(#t(modulo(* a(r a(1- x)n))n))))

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

Here is your friendly reminder of the Austin Cypherpunks meeting tomorrow, Saturday the 2nd. We'll meet at the Central Market Cafe at 38th and Lamar at 6PM. Topics include the video (I'll have a camera!), ITAR relaxation, RC4 now being called PC1, how to duck the CDA using crypto, hardware random number generators, and stuff like that. The meeting should go around 2 hours depending on the crowd, and there is a Bookstop next door if you want to browse some reading material later. Look for the people with technical books and/or crypto-related shirts. They will be us. (I'm sending this to both austin-cpunks and cypherpunks.) -- Ben Combee, CAD Software Developer, small language enthusiast, HTML dude Motorola, Paging Products Group, Strategic Semiconductor Operation--Austin E-mail: combee(a)sso-austin.sps.mot.com Phone: (512) 891-7141

1 0

Seeking Position
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

Long time cypherpunk reader seeks position. Class of 1996/J.D.: Top 10 U.S. Law School. B.A. International Affairs: Top 25 U.S. University. Highly proficent in modern fieldcraft, intelligence operations and communications security. Will sit for bar exam of employer's choice. Expert pistol, advanced tactical carbine, master level tactical driving abilities. Significant previous international clandestine fieldwork experience in developing and Eastern European countries pursuant to political risk analysis projects. Extensive legal expertise in white collar criminal investigation, national security law, bankrupcy, U.S. taxation of international and expatriot income, corporate governence, antitrust, 10(b), 10b-5 and misappropriation insider trading issues. Ideal canidate for high level position in emerging or existing security/economic/political risk analysis department of international firm, field agent for political risk consultant or to address the discrete needs of private client. Most rigorous international travel regime welcome. Serious inquiries only. TLA's need not apply. No wet work. Illegal proposals will be ignored. Borderline proposals considered with interest. Submit position description along with firm/client CV to: an436533(a)anon.penet.fi -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCPAzE3Z7oAAAEEAMClYX8ZIZ/3iwlH96s/JssxRPdmoh6fQcpBLFL8kLkthgkr bXo+Hh/gAKYmYYgDgT/SKfbpAE7qIMg+Ra8WvpMoBuhKNcCt7D7aruxGvId+l7nq KFfSLy6lVviQyVSPjCNxnCvbACIpEtXC1NnyxlShE+l6RvuVA/HuoJlH4LbVABEB AAG0FmFuNDM2NTMzQGFub24ucGVuZXQuZmk= =D7tQ -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: SET spec available
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 12:09 AM 2/24/96, John Pettitt wrote: >The SET transaction spec is now available on www.visa.com (and presumably on >www.mastercard.com although I didn't check). .... I am unable to find the specs. Anyone have an URL?

2 1

Re: PGP to PC mail integration
by Mike Ingle 17 Dec '03

17 Dec '03

>Seriously, the idea here is that the pgp front end shouldn't deal with >the user interface in your present mail program. Nobody (before you) >have considered doing it completely without a user interface. Exactly. Yes, it will at least have to have a config screen. It will probably have to prompt for a passphrase on the fly, unless you want to store it. It can ask to encrypt or not, or it can have a header in the message. The important thing is I don't care about the user interface of the mail program. This has been the big barrier so far. Mike

2 1

Re: Certificate validity issues
by lmccarth＠cs.umass.edu 17 Dec '03

17 Dec '03

some hairboy ;) writes: > I don't see any that there could be any sort of automatic way to > distinguish between the necessity for recipient-signed vs. > recipient-unsigned certificates; One would assume that recipient-unsigned > certificates would be effective only when issued from a high-reputation > source. > > Some method should be required to allow user decisions as to this, but > whatever system is designed should definitely allow for both types, and > *require* relevant software to handle both types. I think this is a policy issue, not a technology issue. In general, key owners should be able to sign certificates that say arbitrary things, regardless of whether or not some third party agrees that the statement being signed is "true". Unless you believe in libel, slander, etc., which raises policy issues of a different sort entirely. The John Birch Society can sign something claiming that I'm a member. A policy that says that's sufficient information to conclude that I *am* a John Bircher is a broken policy. A policy that requires both the above and a signature by me on the same certificate, among other things, is viable. > There's actually a third sort of important certificate the system should > handle: > > (3) I might be a member of a secret society; I might need a membership > certificate to get access, say, to certain web sites. The system > should allow a "secret certificate," readable only by the issuer. Your description is a bit ambiguous. Do you really mean "readable", or do you mean "verifiable" ? If the former, it sounds like this could be handled by distributing signed certificates encrypted with the issuer's public key. If the latter, you could distribute signed certificates but not the public key needed to verify the signatures on the certs. It might be handy to use a hybrid approach, such as distributing signed certificates that refer to encrypted entity names (suitably padded with random bytes to avert trial encryption of plaintext guesses). -Lewis "You're always disappointed, nothing seems to keep you high -- drive your bargains, push your papers, win your medals, fuck your strangers; don't it leave you on the empty side ?" (Joni Mitchell, 1972)

1 0

Re: Paint Your Own Scarlet Letter (Was: Edited Edupage, 29 Feb 1996)
by frantz＠netcom.com 17 Dec '03

17 Dec '03

>From EduPage via E. ALLEN SMITH: >SELF-PATROLLING THE WEB >The World Wide Web Consortium is pushing the Web page rating system that it >developed in cooperation with the Platform for Internet Content Selection, a >group of 22 online firms. >From SafeSurf Rating Page via lmccarth(a)cs.umass.edu wrote: >Thank you for making the Internet a safer place without censorship. >Until later, SafeSurfing to you! Remember, my goal is to convince the congress, president, courts, and Americans in general that the government should not be in the censorship business, not to have a system that actually works. I really hope this self rating system works in practice because (1) it is in line with current Internet practice, and (2) having it work makes a one hell of a fine argument. For many years people on the Internet have been encouraged to provide warnings on things they think others may find offensive. The the use of rot13 "encryption" is one example, another is the practice of putting warning labels (advertisements?) on material. Killfiles (in their most general sense) are analogous to the censoring browsers in this system. (I know it doesn't work for ftp/gopher/email/usenet newsgroups. I hope that the censors think that the web is the net.) (I think I want to start a web search engine looking for pages rated SS~~002 9, SS~~004 9, SS~~005 <5, and all the others don't care.) Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0