December 2003 - cypherpunks-legacy

Re: Chaumian ecash without RSA
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

>> 2: Nobody except the bank can verify that a coin has face validity. At 04:55 PM 4/2/96 +0100, D.A. Wagner wrote: > I claim that statement 2 is also true of Digicash's protocol as well. > > Recall that Digicash is using an *online clearing* protocol-- so you > can't tell whether a coin is valid without consulting the bank. > Consulting the bank is absolutely necessary to prevent double spending. Suppose Alice generates an unsigned coin, blinds it, and shows Bob the usigned, blinded coin. Bob then has the bank sign it, and gives the signature to Alice. If we use RSA to sign the coin, Alice now knows she has a valid coin, because she can verify the coin herself without needing to show it to the bank. So Bob has paid Alice some money, and nobody can double spend the coin, because Alice, and only Alice, knows the blinding factor. So Alice does *not* need to check with the bank. Alice cannot do this with your protocol, so we cannot have payee anonymity with your protocol. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

CDA Court Challenge: Update #3
by Declan McCullagh 17 Dec '03

17 Dec '03

----------------------------------------------------------------------------- The CDA Challenge, Update #3 ----------------------------------------------------------------------------- By Declan McCullagh / declan(a)well.com / Redistribute freely ----------------------------------------------------------------------------- April 1, 1996 PHILADELPHIA -- Chief Judge Dolores Sloviter's mouth fell open in astonishment this afternoon when net.culture guru Howard Rheingold testified that some online communities elect cyberjudges to hear disputes. Sloviter asked if realspace judges "can escape to this community?" Judge Stewart Dalzell wondered: "How are they selected? Is there impeachment?" The court's questions of Rheingold -- who appeared in a glowing blue suit, an iridescent pink shirt, and the first tie he's worn in a decade -- showed that the judges hearing our challenge to the CDA are trying hard to understand the Net. But while the three-judge panel was fascinated by Rheingold, they just didn't connect with him. This was due largely to the skilled lawyering of the Department of Justice's Patricia Russotto -- the Marcia Clark of this case. During her cross-examination, Russotto repeatedly steered Rheingold away from describing relatively understandable online communities like the WELL -- and towards hangouts like MUDs and MOOs that he said are inhabited by "dwarves, wizards, and princesses." Belittling those online communities, Russotto repeatedly dismissed them as "these fantasy worlds" and tried to confuse the judges by tossing a string of acronyms at them, staccato. Judge Dalzell rose to the challenge: "All right, I'll take the bait. What's a MUD?" Like Dalzell, Judge Sloviter is enjoying this case. As the chief judge of the U.S. Third Circuit Court of Appeals, she usually deals with lawyers, not expert witnesses, and clearly likes to quiz them herself. Responding to Rheingold's description of MUDs, she said: "I don't know about being a wizard, but I'd be a princess." Eventually the line of questioning turned to BBSs, and Russotto tried once again to damage Rheingold's credibility, saying he had stated under oath that BBSs were "open to everyone" but had just testified that adult BBSs were not. He clarified, and rallied when asked if he let his 11-year old daughter surf the Net unsupervised: "I teach her that just as there are nutritious things to put in your body, there are nutritious things to put in your mind." Russotto continued, rapidfire: "Do you really think that Hamlet depicts sexual or excretory acts in a patently offensive manner?" "You have not participated in virtual communities built around trading sexually-explicit images, correct?" "You are aware that sexually-explicit networks can form around a BBS?" "Virtual communities can form around such a BBS?" "Some Usenet newsgroups carry sexually-explicit materials?" "An ISP can decide to carry certain newsgroups?" "The particular server you're on could decide to carry the alt.sex and alt.binaries hierarchy?" The tension had heightened earlier in the day, just before lunch, when Russotto tried to prevent Rheingold from testifying. When we introduced the celebrated author of "Virtual Communities" as our witness, Russotto objected: "We would submit that his expert opinion is not relevant to this case." Battering Rheingold with a quick series of questions, the DoJer forced Rheingold to stumble. ACLU attorney Chris Hansen quickly rescued his witness and Sloviter overruled Russotto's objection: "The court will hear Mr. Rheingold." Over lunch in the courthouse cafeteria, I talked with Rheingold, who was understandably nervous from the drumming he had experienced minutes earlier. Of course, the very fact that we were chatting like old friends demonstrated the power of a virtual community -- we had communicated in one form or another every day for the last year, but we had never met in person before. Like the man himself, Rheingold's testimony was interesting and colorful, unlike that of Bill Burrington, the director of public policy for America Online, who was the first witness of the day. A good number of courtroom observers, including myself and some reporters, snoozed through most of Burrington's statements. I was more-or-less awake enough to realize that Burrington was once again characterizing AOL as a "resort pool with lifeguards" next to the wild, untamed ocean of the Internet, with its predators and sharks: "There is a channel to the Internet. You can be whisked out into the sea." His evils-of-the-Net description confused Judge Sloviter, who asked: "When you say whisked out into the sea, you don't mean involuntarily whisked?" Tony Coppolino from the DoJ cross-examined Burrington. Coppolino seems to be the most cyber-savvy DoJer and the leader of their legal team on this case. Like Russotto, he doesn't pass up an opportunity to damage the credibility of our witnesses: Judge Sloviter: "How many newsgroups are available on AOL?" Burrington: "Up to 20,000." Judge Dalzell: "I thought someone said 30,000." Coppolino: "I have a stipulation here saying 15,000." Pressed by Coppolino, Burrington admitted that AOL didn't carry Playboy or Penthouse because the material was "inappropriate for families and children." Later Coppolino suggested that AOL has problems with pedophiles and child pornographers, asking Burrington to describe a case where an AOLer found children's names from a chat room then sent them sexually-explicit images. Burrington parried: "This is the first such incident. We terminated his account immediately and are cooperating with Federal law enforcement." When HotWired honcho Andrew Anker took the stand, the questioning turned to alt.sex.bondage. Judge Sloviter started by asking: "What is alt.sex.bondage? What does that mean?" Turns out that HotWired had published a story about the newsgroup, though by the end of the questioning, the judges seemed convinced that HotWired was a net.porn haven and were surprised when Anker estimated that much less than 10 percent of his web site's content was sexually-explicit. Again, Judge Dalzell tossed us a few sympathetic questions: "If you were to label your web site as adult, would it scare off advertisers?" After some brief testimony by ACLU plaintiff Stephen Donaldson of Stop Prisoner Rape, Barry Steinhardt took the stand. Steinhardt is the associate director of the ACLU -- I first got to know him when he blasted CMU for censoring its USENET feed years ago -- and was subject to an antagonistic cross-examination from Craig Blackwell. Blackwell relied on his boss Tony Coppolino for technical tips, and stumbled a few times, like when he confused AOL with a web site on the Internet: Blackwell: "The ACLU has two Internet sites, right?" Steinhardt: "No. We have one Internet site and we are a content provider on America Online." During the DoJ's questioning of Steinhardt, a few points emerged: * The content the ACLU posts to the web and AOL is educational. * The ACLU controls content on its web site but not in AOL chat rooms and discussion groups. * The ACLU is concerned that the CDA subjects it to liability for "indecent" material, including George Carlin's monologues it has placed online. * The DoJ is trying to draw a distinction between "indecent" images of couples engaged in sexual intercourse and educational "indecent" material that they will claim is not going to be prosecuted under the CDA. We're still wondering who the DoJ will call as their pro-CDA witnesses. The two prime suspects are someone supposedly from the Department of Defense and a computer scientist from Carnegie Mellon University. I suspect that the DoD guy is the gent who's been sharing the second row of courtroom seats with me -- a grey-haired gentleman always sporting a nondescript grey flannel suit. He's been sitting on the DoJ side of the courtroom (the ACLU is on the left, of course), and after court adjourned he was confabbing with them about plans to meet later in the day. I walked over and asked Grey Flannel Suit if he was with the DoJ, and he replied: "I just do some computer work for them." I was asking Grey Flannel for his name when DoJ attorney Jason Baron jumped between us: Baron: "He can't talk to you." McCullagh: "Why don't you let him make that decision for himself?" Baron: "I make decisions for him." McCullagh: "What's his name?" Baron: "He has no comment." I'll bet anyone five bucks that Grey Flannel is from the NSA. The other pro-CDA witness is almost certainly Dan Olsen, a Mormon who is the head of the computer science department at Brigham Young University and the incoming director of the Human Computer Interaction Institute at Carnegie Mellon University. (The HCI Institute at CMU is known as a dumping ground for faculty who can't make the cut in the justly-renowned CMU computer science department.) Of course, CMU is the school that is considering what cyberlibertarian attorney Harvey Silverglate calls an "Orwellian speech code," and erotic USENET newsgroups are still banned from almost all campus computers. Since CMU spawned Marty Rimm, who tried to sell his unethical research to the DoJ and whose study helped pass the CDA, it's appropriate that CMU affiliates are helping the DoJ defend the damned CDA after all. Today's testimony ended our case, with the exception of one of our witnesses who couldn't make it earlier. Albert Vezza is the associate director of MIT's Lab for Computer Science and a PICS guru who will be testifying for us on April 12 or April 15. With the exception of Vezza, those two days will be devoted to the DoJ's arguments alleging that the CDA is constitutional and should be upheld by the court. Stay tuned for more reports. ----------------------------------------------------------------------------- We're back in court on 4/12, 4/15, and 4/26. The DoJ will reveal the identity of their expert witnesses on 4/3 or 4/8. Mentioned in this CDA update: Howard Rheingold <http://www.well.com/~hlr/> CMU and the Rimm study <http://www.cs.cmu.edu/~declan/rimm/> CMU's HCI Institute <http://www.cs.cmu.edu/~hcii/> Dan Olsen at BYU <http://www.cs.byu.edu/info/drolsen.html> Censorship policy at BYU <http://advance.byu.edu/pc/releases/guidelines.html> Censorship at CMU <http://joc.mit.edu/> USENET censorship at CMU <http://www.cs.cmu.edu/~kcf/censor/> HotWired / WIRED <http://www.hotwired.com/> PICS information <http://www.w3.org/pub/WWW/PICS/> These and previous CDA updates are available at: <http://fight-censorship.dementia.org/top/> <http://www.epic.org/free_speech/censorship/lawsuit/> To subscribe to the fight-censorship list, send "subscribe" in the body of a message addressed to: fight-censorship-request(a)andrew.cmu.edu Other relevant web sites: <http://www.eff.org/> <http://www.aclu.org/> <http://www.cdt.org/> -----------------------------------------------------------------------------

1 0

CMU/BYU administrator helps the DoJ defend the CDA
by Declan B. McCullagh 17 Dec '03

17 Dec '03

[Dan Olsen was hired as the director of the Human Computer Interaction Institute at Carnegie Mellon University earlier this year. --Declan] -------------------------------------------------------------------------- Date: Wed, 3 Apr 1996 09:12:20 -0700 To: "Declan B. McCullagh" <declan+(a)CMU.EDU> From: olsen(a)cs.byu.edu (Dan Olsen) Subject: Re: Question >Will you be testifying on behalf of the DoJ in the CDA lawsuit in >Philadelphia? Have you been at all involved with the case? > Yes I am and yes I have. ------------- Dan R. Olsen Jr. Computer Science Department, Brigham Young University Provo, UT 84602 phone: 801-378-2225 fax: 801-378-7775 -------------------------------------------------------------------------- Date: Wed, 3 Apr 1996 09:35:39 -0700 To: "Declan B. McCullagh" <declan+CMU.EDU> From: olsencs.byu.edu (Dan Olsen) Subject: Re: Question >Dan: Thanks for replying. What are you planning to testify about? What >are your personal feelings about the CDA? How were you contacted? > I understand your interest, having read your home page. I would be happy to go over all of this with you when I actually move to CMU in July and the case has completed. Until the case is resolved, it would be inappropriate to discuss it. Thanks for your interest ------------- Dan R. Olsen Jr. Computer Science Department, Brigham Young University Provo, UT 84602 phone: 801-378-2225 fax: 801-378-7775

1 0

Re: software with "hooks" for crypto
by Administrator 17 Dec '03

17 Dec '03

At 02:31 PM 4/2/96 -0800, you wrote: >Hello all, > >I'm trying to figure out exactly what the laws are regarding the export of >software which contains "hooks" for PGP. In various forms, I've heard >that it's not the ITAR which prevents this, but more a "suggestion" by >the NSA that we "shouldn't do it." Does anyone have any pointers to >real legislation/laws regarding this? There are a number of "PGP Helpers" (If this is Tuesday, it must be PGP) out there. These are other PGP front end applications such as Private Idaho, PGPShell and others that do NOT include PGP, nor do they contain any encryption code within them. These applications are all billed as "freely exportable". If your software does not contain any encryption code, such that it simply "invokes" the users separately-obtained-and-installed copy of PGP, you are not in violation of ITAR. It sounds like this is what you're doing with your "hooks for PGP". I would recommend you visit a couple of these helper application sites and check out what their authors say about the exportability of their code. You might ask them if they have encountered any legal difficulties because their code is advertised as freely exportable. Private Idaho is available at www.eskimo.com/~joelm and (rats) you'll have to hunt PGPShell down yourself. If you actually include the RSA algorithms, the IDEA algorithm, or any "cryptographic" code in your software, then yes, you could get in trouble for exporting it. Again, remember that I'm not a lawyer and that any legal advice you get from anyone on the net is worth exactly what you pay for it. -j, is anyone else finding it harder to say the "Pledge of Allegiance" to this country these days?

1 0

Digest Version???????
by kreidl＠newrock.com 17 Dec '03

17 Dec '03

Anyone know if I can get a digest version of this??? (__) (oo) /--------\/ / | || <-- Moo.(We live in Wisconsin, the dairy state, get it?) / || || * ||-----|| ~~ ~~ Chris (or Richard) Kreidl kreidl(a)newrock.com

1 0

Re: Disclosure of Public Knowledge to Foreigners
by Hal 17 Dec '03

17 Dec '03

From: tcmay(a)got.net (Timothy C. May) > "There is a reasonable chance the Supreme Court would see the overall > absurdity of a situation where the knowledge is freely available to 200 > million adult Americans, with no restrictions whatsover on publication, > discussion, etc., and yet uttering this knowledge in front of a foreigner > is a crime." It would be good if this happened. Yet unfortunately I think it is unlikely. Absurdity is not necessarily sufficient to invalidate a law. Especially in this case, if you read the judge's decision (at <URL: http://www.qualcomm.com/people/pkarn/export/decision.html >) you see that this issue is one which is "hands off" for the judiciary. The question of designating whether items should be on the Munitions List has been found both by the courts and by the legislature to be "non-justiceable", something which the courts can't review. It is strictly in the purview of the legislative branch, which passes the law, and the executive branch, which sets the policy and creates the list. Courts are required to refrain from second-guessing them. Of course this doesn't totally close the door, and if serious constitutional questions arise, the court can consider this. Phil Karn attempted to do so, but did not succeed in this case. Unfortunately there is clear precedent at the appellate court level that First Amendment concerns are not violated by export bans. As long as you can say whatever you want domestically, the government has a lot of latitude to prevent you saying things to foreigners, even though that is illogical in many contexts. I feel, by the way, that this may soon present another line of attack on the restrictions. As the Internet becomes a dominant communications medium, it will become more true than ever that these regulations have a chilling effect on all communications relating to cryptography. I can't, right now, post crypto source code to this list without breaking the law. Nor can I post it to sci.crypt. How then can I participate in discussing these matters in detail on the Internet? Maybe I could put the material on an export-restricted disk somewhere, but that does not allow for the dynamic give-and-take which is so much a part of internet discussion. So, in the context of the net, export controls are de facto content controls on domestic discussion. For now, maybe being unable to speak in detail about crypto on the net isn't that big a handicap. But in a few years, Internet communication will be a big part of everyone's lives (arguably) and being unable to present certain information will produce a stronger First Amendment violation. A couple more comments on Tim's message: > Interestingly, according to a friend of mine (Mike Ward, of San Jose), it > is much cheaper (or was when he did the analysis a couple of years ago) to > have a chunk of text entered two or more times by humans and then XORed for > errors than to OCR the text. This form of error correction--redundant > entry--would presumably work well for Schneier's code, for example. I can certainly believe it after reading about Phil's efforts. And as I point out, he actually did have a secretary type it in. It is disturbing, though, that the book had errors in it. I wonder if it was typeset by hand? Is that possible in this day and age? > What we are really about to run into is the "export of knowledge" issue, > which I think the Constitution will have some pretty important things to > say about. (It has long been the case that certain armaments knowledge, and > atomic secrets as per the Atomic Energy Act, were restricted. But this > knowledge was _also_ not in the public domain. There have not been many > cases that I know of where knowledge was freely discussable within, say, > the United States, by any citizens (and maybe others, such as permanent > residents, foreign students at colleges, etc.) and yet this knowledge could > not be "exported" outside the U.S. > > Except with our crypto laws, and some related Munitions Act laws. Unfortunately, as I noted above, so far no one has been able to come up with a convincing Constitutional argument, especially in the face of the Posey and Edler precedents, which are discussed by the judge in Phil's case, and for which I have some excerpts at <URL: http://www.portal.com/~hfinney/cryp_export2.html >. I think the real solution frankly is to get the laws changed. If the laws are absurd, people should be taught about them, and they should pressure their legislators to change them. This is not an attractive solution because it implies a lot of work and a long, slow process. But in the long run it will be better to establish a national consensus about how to deal with these issues. Then it will be harder for government to place new restrictions in place. I think the recent legislative action reflects the beginnings of this process. It may not succeed this year, but hopefully in a few years, as more people get on the net, it will gain momentum. Ironically, the termination of the case again Phil Zimmermann may hurt progress in this area. Unfair and unjustified as the pending charges against Phil were, they did at least raise people's consciousness about the problems in current policies. Phil did an excellent job of keeping these issues in front of people in all sorts of media. Now that there is no longer an articulate victim of unfair export laws it may be harder to keep people thinking about the problem. Perhaps we need a new volunteer... Hal

1 0

Re: Navajo code-talkers
by Paul_Koning/US/3Com%3COM＠smtp1.isd.3com.com 17 Dec '03

17 Dec '03

>From: grafolog @ netcom.com (Jonathon Blake) @ UGATE > << It's one of the status languages to study, if you are > a new ager --- along with Ancient Mayan, linear B and > Egyptian Hieroglyphics. >> Well, hieroglyphics and linear b are writing systems, not languages. And Linear B is Greek (though it takes effort to read it even if you know your Homer...) paul !----------------------------------------------------------------------- ! Paul Koning, NI1D, C-24183 ! 3Com Corporation, 1-3A, 118 Turnpike Road, Southborough MA 01772 USA ! phone: +1 508 229 1695, fax: +1 508 490 5873 ! email: paul_koning(a)isd.3com.com or paul_koning(a)3mail.3com.com ! Pgp: 27 81 A9 73 A6 0B B3 BE 18 A3 BF DD 1A 59 51 75 !----------------------------------------------------------------------- ! "Be wary of strong drink. It can make you shoot at tax collectors ! -- and miss!" ! -- Robert A. Heinlein, "The Notebooks of Lazarus Long" ! in "Time Enough for Love"

1 0

Re: Canada's ISO standards body?
by mccoy＠communities.com 17 Dec '03

17 Dec '03

At 11:50 AM 4/3/96, Peter Trei is rumored to have typed: > Simon Spero <ses(a)tipper.oit.unc.edu wrote: > > I don't think v3 has been balloted yet - that gives you a chance to > > explore one of the more amusing twists of OSI standardisation- you can > > get copies for free of most drafts from the editor right up until it gets > > standardised. Silly, isn't it. > > Haven't located it yet. ftp://hesiod.communities.com/pub/mccoy/ansi-x9.ps I also have a PDF version of the draft as ansi-x9.pdf, and the certificate DAM in the file certdam.ps. jim

1 0

Re: software with "hooks" for crypto
by John Deters 17 Dec '03

17 Dec '03

At 02:31 PM 4/2/96 -0800, you wrote: >Hello all, > >I'm trying to figure out exactly what the laws are regarding the export of >software which contains "hooks" for PGP. In various forms, I've heard >that it's not the ITAR which prevents this, but more a "suggestion" by >the NSA that we "shouldn't do it." Does anyone have any pointers to >real legislation/laws regarding this? There are a number of "PGP Helpers" (If this is Tuesday, it must be PGP) out there. These are other PGP front end applications such as Private Idaho, PGPShell and others that do NOT include PGP, nor do they contain any encryption code within them. These applications are all billed as "freely exportable". If your software does not contain any encryption code, such that it simply "invokes" the users separately-obtained-and-installed copy of PGP, you are not in violation of ITAR. It sounds like this is what you're doing with your "hooks for PGP". I would recommend you visit a couple of these helper application sites and check out what their authors say about the exportability of their code. You might ask them if they have encountered any legal difficulties because their code is advertised as freely exportable. Private Idaho is available at www.eskimo.com/~joelm and (rats) you'll have to hunt PGPShell down yourself. If you actually include the RSA algorithms, the IDEA algorithm, or any "cryptographic" code in your software, then yes, you could get in trouble for exporting it. Again, remember that I'm not a lawyer and that any legal advice you get from anyone on the net is worth exactly what you pay for it. -j, is anyone else finding it harder to say the "Pledge of Allegiance" to this country these days? -- J. Deters >From our _1996_Conflict_of_Interest_Statement_, re: our No Gift policy: "If you receive any alcoholic beverages, for example, a bottle of wine, you must give the gift to your location Human Resources Manager." This memo is from the Senior V.P. of Human Resources. +---------------------------------------------------------+ | NET: jad(a)dsddhc.com (work) jad(a)pclink.com (home) | | PSTN: 1 612 375 3116 (work) 1 612 894 8507 (home) | | ICBM: 44^58'33"N by 93^16'42"W Elev. ~=290m (work) | | PGP Key ID: 768 / 15FFA875 | +---------------------------------------------------------+

2 1

Re: e$ Signorage
by Perry E. Metzger 17 Dec '03

17 Dec '03

I misdirected this yesterday. Yes, its relevant: it answers the contention that ecash somehow lowers government seignorage income. ------- Forwarded Message To: James Gleick <gleick(a)around.com> cc: cypherpunk(a)toad.com Subject: Re: e$ Signorage From: "Perry E. Metzger" <perry(a)jekyll.piermont.com> James Gleick writes: > >> It's not obvious, but it's true, that the Fed collects the "float" > >> on dollar bills you carry in your pocket, > > > >Oh, really? From whom? First I've heard of this. > > Then you're learning something new. Oh, really? Don't teach grampaw to suck eggs. > On the contrary. The Federal Reserve holds Government securities > corresponding to the dollar value of currency in circulation. Ah, no. Sorry. The Fed does indeed monetize debt, but 1) that isn't related to seignorage, and 2) all new money is monetized debt, and it makes no difference whether it is held in paper or bank accounts or anything else. > It earns interest income on this amount, and returns this income to > the Treasury. This is called seigniorage. It amounts this year to > something over $20 billion. This is a very real issue. To the > extent that electronic money replaces currency (reduces the amount > in circulation), it will cost the Treasury seigniorage- -and the > Government is acutely aware of this. Whether the beneficiaries are > consumers, banks, or other issuers of digital cash will depend on > the system. Again, you really don't know what you are talking about. The vast bulk of the money in the field is not currency. Most of it is in the form of bank deposits and is circulated through bank mechanisms like checks and such. When the Fed wants to expand the money supply, it buys government debt on the open market, paying for it with nothing at all other than changing numbers in the Fed's computers. This is how debt is monetized. The bulk of that money never becomes dollar bills, and whether it is circulated via checks or ecash or direct deposit or whatever makes no difference to the amount of fake interest earned. I say "fake interest" because it isn't real income to the government at all. The amount of currency in circulation is dependant purely on demand by consumers, via banks, for currency. When banks want dollar bills, they ask the Fed -- they hand the fed electronic money and the fed gives them back dollar bills. The amount of currency, however, has nothing to do with the amount of bonds being held -- whether the monetized debt is held in bank accounts, in dollar bills, or in ecash makes absolutely no difference. Again, you just don't know what you are talking about. E-Cash has no impact on the fake interest earned by the fed, which is not seignorage to begin with. Perry ------- End of Forwarded Message

2 3